News for hackers. Stuff that matters.

buran77

A general purpose computing device is unavoidable, it's exceedingly difficult to build anything close to it. Encrypted storage is trivial without dedicated hardware, using open, validated software solutions. Even better, if bugs or backdoors are found you don't need to throw out your encrypted stick, just update the software or reencrypt.

Because what I said above might sound like black magic to anyone who knows nothing about the topic I will expand.

The CPU on which the software runs gets far more scrutiny than the obscure encryption engine on the USB stick. And it's possible to validate the software encryption with minimal effort. Verify the output with various software implementations of the same algorithm, ran on different CPUs. They have to be compatible and can't all have the same bug or backdoor.

An encrypted stick is impossible to validate by the end user. They have no access to the CPU encryption engine or the raw storage so can't know the algorithm implementation, or the output to disk format which is probably proprietary.

It was only a matter of time and I said (half) jokingly at the time that Uber is breaking the dam for everyone else to follow. Any regulated system will have its day in front of "disruptors" where the disruption is simply ignoring the regulation with some flimsy excuse, supported by the money and lack of morals of VCs and startup combinators.

Uber took an axe to taxi drivers which weren't a popular group to begin with so that was easy. With the "disruption" perfected, next up are doctors, nurses, lawyers, electricians, cooks, engineers, the sky is the limit.

> it had already been decommissioned prior to the collapse

The telescope was decommissioned one month before the collapse. The funding issues, lack of sufficient maintenance, and the inevitable decay that led to the collapse took a few decades more than that.

> Yes, decommissioning does indicate funding is being cut, but it was unrelated to the collapse.

The collapse was a direct consequence of the funding being cut. Maintenance was not performed on issues that were observed many years before exactly on the sockets that failed.

> Unfortunately, Arecibo received no such inspections.

With or without the inspections, the problems Arecibo faced were of a more serious nature. They are hinted in one of the findings: the non-replacement, repair or bypass of the sockets where large slips were observed.

The telescope received minimal funding for maintenance over the two decades prior to the collapse despite signs of increasing damage observed in the various inspections. A lot of factors probably contributed to this (political climate, the dropping importance of Arecibo compared to other science instruments and missions, and so on) but the result was that the structure was left with slow but sure decay.

I met a couple of people who worked with the telescope including on location and they told me that the general feeling among the people who had this on their minds (most people who ever had anything to do with Arecibo cared about the science not the instrument) was that the decay was slow but certain and catastrophic failure was bound to happen sooner or later. Like a car receiving no maintenance despite the check engine light being on for a decade.

Microsoft remembers that just a few short decades ago you'd pay a coin that was usually worth more than today's quarter to play at the arcade and got far less than an hour for it. You owned nothing and were happy for it.

A lot of big tech companies want to bring back those time because they believe the few decades in between where people owned and controlled their devices and software in a very open computing ecosystem were a mistake. So the aim now is to give you a device you pay for and use but never fully control, and software or media that you rent but never own.

> You can't make it illegal. The first amendment protects it.

I'm not a legal expert but the first amendment doesn't generally give the right to secretly record people, especially in places where there are already laws about hidden cameras, recording, privacy, etc.

It's not about the shape as much as the intention and execution.

> people are listening full blast to their phones with no headphones - I find this about 100x more obnoxious than filming

Two very different concerns. One is annoying in that very moment and has no lasting consequences. The other can have all kinds of consequences depending on what was secretly recorded, and where that recording was used.

Re:Espresso Machine Can Run Doom on Saturday October 17, 2026 @03:58PM (#50134521)
> Was it ever not a meme?

Must have been on the first attempts, right? As the name suggests, a meme (mimesis) is about imitation but also propagation at scale, otherwise everything would be a meme. The first attempts count as original. Once it gets traction others could very well be genuine technical achievements but in an "also ran" format.

It's like a series where every episode follows the exact same blueprint with very minor changes to the details. It doesn't get old from the first couple of episodes, but it sure does in a few more.

And I was thinking exactly of the "Doom on pregnancy test" example myself but that's worse than average. If my memory serves me, that was a case of using just the plastic shell of a pregnancy test and replacing all the hardware.

Re:Espresso Machine Can Run Doom on Saturday October 17, 2026 @03:19PM (#50134168)
At this point "runs Doom" is a meme and it runs its course.
Re:Fridges in French supermarkets hit by cyber attack on Monday October 12, 2026 @04:01PM (#50062165)
To be clear I don't think the defrost schedule is the way the hackers enabled this or else every device would be affected. The older devices probably connect to the SaaS server in an insecure way and could be exploited en-masse.

> Surely the personnel on site are the ones best equipped to schedule the defrost cycles of their equipment?

The purpose of the automation is the same as always, to run at peak effectiveness and reduce human error. Most of the workers in this industry much like the fast food one, are low paid, low skill, receiving only basic training, with a high turnover rate, across tens of thousands of locations from major cities to somewhere in the sticks. Even a disgruntled employee can do a lot of damage that's only obvious too late. So this extra work is taken out of their hands. You should really see a lot of the machines the big fast food chains use, you'd be amazed.

This kind of decision was never left to the store manager. In the past they'd get a printout and probably fail to follow the instructions occasionally, which may or may not cause damage or increases operating costs across the entire fleet. Now it's done over the network like everything else, for better or worse.

The small scale of the hack makes me think they've done a decent job at securing them so far. Spending more on people and security to avoid any hack (right?), or losing efficiency over tens of thousands of locations costs more than the spoiled food.

> Adding fringe features that aren't actually necessary (or desired) has become a strange industrial compulsion.

> More features, generally, means more failure modes.

Here's the kicker, they are necessary and desired by the customer and the failure scenarios were almost definitely factored into their calculations. I know you had a solid 5-10 minutes of though on the topic but for supermarket chains that's how they manage to operate cheaper, that's how they don't increase the cost of the food.

Re:Fridges in French supermarkets hit by cyber attack on Monday October 12, 2026 @03:33PM (#50061748)
This is how it was done in this [0] very nice 60 years old (I'm sad now) movie. [Spoiler alert] An alarm is triggered so many times the guards just disable it. Alert fatigue has worked the same forever. Nobody wants to check the thousands of false alarms that probably happen every day across thousands of locations.

As long a schedule is conceived in one place and applied in another, even with human intervention on both sides, either one of the sides can be swindled. At this point with the bar for a successful hack being lower than ever, completely removing the hardware necessary to make remote changes is probably the only way to limit the blast radius.

Maybe allowing to send the schedule but requiring a local employee to operate a local hardware only control to apply it could work, but who has the money for this kind of complexity. Something like this on every freezer (device, really) in a fleet probably costs multiples of the money they lost with the spoiled food.

[0] https://www.imdb.com/title/tt0060522

Re:Fridges in French supermarkets hit by cyber attack on Monday October 12, 2026 @02:24PM (#50060638)
> This still shouldn't be online.

This line suggests the units themselves were targeted individually with a hack:

> Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.

But the problem with networked devices spread across tens of thousands of pretty much unguarded locations, surrounded by unvetted employees, but taking orders form a central location is that there is no such thing as "not online". They'll talk to the management server used to set up the nightly defrost schedules across the fleet. Even if they are in an isolated VLAN, it's always one step away from someone connecting a Pi to that network and off they go online. There's only so much zero-trust, NAC/802.1x and segmentation can do when some devices will be too old to support these and their network will be the entry point to the management server, then to the whole fleet.

I'm honestly very surprised that a couple of things things haven't happened yet: the central server for managing these fleets getting hacked and allowing access to the entire fleet, and/or the companies realizing that the only way to limit the reach of an attack is to physically not have the hardware needed to do remote control.

Re:Fridges in French supermarkets hit by cyber attack on Monday October 12, 2026 @02:11PM (#50060419)
> When was the last time you changed the temperature setting on your fridge or freezer?

Then again when was the last time you opened your freezer hundreds of times during one day, letting humid air in and building ice at an accelerated rate? These units actively heat up the back of the freezer (evaporator plate) nightly to quickly melt the ice without warming up the food.

There is no reason to directly trigger it remotely but they probably work on a customizable schedule, to account for different store opening times, timezones, or freezer size and model. The hackers could target that schedule to make the defrost last longer.

Angry people are more likely to want to make themselves heard. But Windows' problem isn't technical, like performance, stability, compatibility, etc. It's actually great in some of those aspects. The problem is that Microsoft is working hard to shovel shit on top of what could be a great OS. That shit is the part aimed at extracting more from users for MS' benefit. That's not what an OS is supposed to be, certainly not a paid one.
Re:Triple-A Minesweeper on Friday October 09, 2026 @03:22PM (#50025443)
"Only 7.89% of gamers unlocked this".
Re:Remove and Disable Apple Macos27 AI Models Tool on Sunday October 04, 2026 @06:46PM (#49958715)
> I’m stating that the Windows problem was very different. [...] They were all trials.

Except it isn't and they weren't. MS Windows never came with trials, it came with shortcuts. OEMs bundled with their Windows image more of their (crap) full software than trials.

And to this day debloating tools are tasked with removing full MS bundled (or auto installed) software like Teams, Outlook, DevHome, Copilot, M365, Recall, etc. So exactly the same problem as Apple Intelligence. Whether you consider it useful is up to you. Whether it's bundled is up to Apple.

Good company, eh? The US, Israel, terrorist organization Hamas. That's what you're saying right?

You know you hit rock bottom when your defense is saying "the terrorist organization also does it". But I have full confidence in you that you will manage to dig yourself even deeper.

The answer is staring you in the face but I'm not surprised you never bothered even to scratch the surface. The ICC doesn't replace national courts. Actually it encourages them to do their job. But sometimes the national courts can't settle it. For example the biggest point of an international court is that they should be able to settle international disputes. Get it? Inter-national. That's when the two parties are different countries, each with their own elected representatives and their own judges to decide in each country's favor. So what do you do then? You go to an international body which has no intrinsic bias in a conflict. And

I see how you're trying to twist this into an act of "sovereignty" but not signing up is usually a sign that the respective country is a common perpetrator of exactly the type of crime the ICC would convict (war crimes, genocide, that type of thing). And wouldn't you know it, just check out the list ;).

> “An Interdisciplinary Synthesis Across Economics, Psychology, Biology, Philosophy, Game Theory, and Spiritual Tradition.”

If one were inclined, they could shorten the title to "AI Synthesis Across Economics, Psychology, Biology, Philosophy, Game Theory, and Spiritual Tradition." Maybe that's an Easter egg.

AI submissions, soon AI reviewers, and shortly after only AI readers.

The guy's name is "nosloP" spelled backwards. Maybe spelled normally it's supposed to signify the opposite.

Re:Toyota is finally taking its best-seller electric on Thursday September 24, 2026 @03:17PM (#49835553)
> I've never seen an actual production model look anything like the concept.

As an exception to this rule, the original Audi TT was surprisingly similar to the concept car and even the initial concept sketches. They had a crazy design idea and just went with it.

> the military industrial complex has captured pretty much anything with real accuracy

Real accuracy is a matter of application. For mainstream civilian use the 20-30cm offered by Galileo/GPS is beyond real accuracy. It gets even better for specialized civilian use or with the aid of differential GNSS (low single digit cm). You'd have to think real hard for a reason to need better precision on a global scale especially if that involves any extra cost.

Can't say how much of a priority accurate positioning would be for civilians during an armed conflict.

> Piracy is not theft. It is an infringement on another's right to distribute intellectual property.

That wasn't the direction I was going towards. Sony treats digital copies as if only one can have the ownership rights attached to it. This logic can be extended to any other right.

> Selling a used DVD is possible because the DVD contains the license — it is transferable and irrevocable by dint of its format.

The format does not make it irrevocable, it makes the revocation impossible to enforce. The license is attached to the content of the DVD, not the plastic disc per se. This license gives me the right to read that disk and send that digital copy to my output device. It's also why I can't just copy the content to a disc I own and call it a day. So a digital copy read straight from Sony's storage and sent to my output device can very well have the same license attached to it.

To be honest, I think it's a stupid defense but one that may just fly in places with the best justice money can buy. And there's a lot of money trying to buy a carte blanche to not give ownership rights to digital content, coming from every producer or distributor of such content.

> "Were that the case, then Plaintiff Edward Heycock would not have been able to obtain the game Resident Evil Requiem on February 25, 2026 for $69.99 from the PlayStation Store after Plaintiff Jason Mendoza had obtained Resident Evil Requiem on February 14, 2026, because Mr. Mendoza, not Sony, would have owned it then"

That's a very interesting defense. I wonder if it opens up a door maybe Sony would rather keep shut. If I can't own a copy of content because someone else has another copy, how does this play out for piracy? According to Sony's own argument, pirating a copy of the content is fine because others can/do still "buy" or "own" (rent/lease) it.

Re:Rivian's Gambit for Full Autonomy on Wednesday September 09, 2026 @02:54PM (#49632060)
> Realistically no

And you had that one example to prove it. That settles it.

I know you want to make your point but stacking up fallacies (same in your "Timmy" comment) isn't helping [1]. Most humans grow up having personal responsibility, then at adult age the legal system puts even more on them. A lot more, on them personally, under threat of deprivation of freedom or monetary loss from their own pockets, or in the case of driving even something as small as losing the license. There are exceptions ("daddy pays" sort of thing).

Now contrast that with corporations, especially large ones, where almost every bit of responsibility is diffused behind a corporate veil that allows every single human to sidestep any personal responsibility whatsoever. Some shareholders' money take the plunge. And starting recently you can offload even more responsibility to the computer/AI.

I might lose my license if I cross a red light. Will a company lose the license to operate all autonomous cars when one crosses a red light?

[1]

> My anti-terrorism AI drone escaped the sandbox and shot up gruez's house. The drone was punished by removing its livery. What else can be done? What next, should we punish soldiers fighting terrorists too?"

> I tested my anti-cancer medication in the drinking water of the neighborhood. gruez got hit the hardest by the side effects, God rest his soul. But what can we do, ban cancer research?

Re:Mistral raises €3B on Tuesday September 08, 2026 @10:27AM (#49610818)
Mistral is doing one more thing: building up local know-how in the European ecosystem. This is worth more than money, you can't bootstrap an industry overnight.
Re:Jellyfin 12.0 on Tuesday September 08, 2026 @09:49AM (#49610339)
The Plex rug-pull is just around the corner. I've been running Jellyfin pointed at the same content as Plex for some time now. I still find some rough edges on Jellyfin but they smooth out a few more with each release so I'm confident I'll be just fine when I need to switch. The clients are getting better too, I'm using Infuse on Apple TV and Moonfin for everything else.
Moats are obstacles against something you're trying to avoid. It can be competitors coming in, or customers going out. A moat could surround a prison to keep prisoners in. Some companies just choose to treat their customers as prisoners.
Re:Japan halves speed limit to 30km/h on all narrow city streets on Saturday September 05, 2026 @04:37PM (#49580416)
> I pass three speed bumps on my street. I'm driving at low speed [...] I don't even brake before them

That's a lot of "I"s for something so many other drivers in the world have to drive across, in many, many different designs. Bumps, "nipples", cushions, tables, bars, made from rubber, asphalt, cobble stone, metal, with different ratios between height and width, different profiles, etc.

But it also depends on the car, doesn't it? Some suspensions are harder, some cars are lower, this creates discomfort or damage. Sometimes they have to rev the engine to cross over at very low speed. Not to mention larger and heavier cars like vans or garbage trucks which also damage the bump on top of everything else. Sometimes even cyclists have to put their butt on the line. The Wikipedia page would have put your personal experience in context [1]. Speed bumps are the cheap for the city but there are compromises.

Many countries with well thought out traffic use bumps where safety is paramount, like raised pedestrian crossings (table). The rest of the speed limiting effect is achieved with smart road design wherever possible.

[1] https://en.wikipedia.org/wiki/Speed_bump#Disadvantages

Re:Japan halves speed limit to 30km/h on all narrow city streets on Thursday September 03, 2026 @07:07AM (#49548503)
The elegant way to implement such a speed limit is to have the driver do a "slalom" between things like trees or parking spots set alternatively between the two sides of the street, or green islands in the middle of the street. It forces a low driving speed without the discomfort and potential damage caused by speed bumps.

Street bumps are a discomfort even for those who respect the speed limit, and sometimes for residents (more noise) so they don't have popular support unless it's a problematic area, with a low safety record. There are high tech bumps that incorporate a radar sped detector and instantly raise in front of speeding cars but there are costly and require more maintenance.

Re:Japan halves speed limit to 30km/h on all narrow city streets on Thursday September 03, 2026 @06:54AM (#49548408)
I'm surprised the limit was so high on those narrow, low visibility streets to begin with. In many EU countries the limit is 30km/h even on streets that are double the size, if they're in residential neighborhoods to increase pedestrian safety.

Older »