News for hackers. Stuff that matters.

cimi_

Re:PHP2Shell: Exploitation Attempts and Remediation Trends on Tuesday October 27, 2026 @11:13AM (#50260597)
More details about stealmybitcoin in LiveOverflow's video: https://www.youtube.com/watch?v=VhNiMWtOutw

This is the winner: https://github.com/KillaBoi/StealMyBitcoin-PoC

The challenge website was not exploitable at launch because it wasn't actually running PHP; it got cracked in two hours aftewards

In the video, LiveOverflow shows his exploit that reliably gets RCE from two requests.

I can’t tell if you’re trolling.

Of course we should be compassionate, but anyone needs to be able to function enough so that they can internalise criticism and evolve.

I think this is a reprehensible industry with no upsides. I'm also against banning it, out of principle - who says I'm right when I say there are no upsides? But:

* any sort of advertising should be banned * it should be regulated so that excluding yourself actually works and is easy to do

Seeing 'official prediction market partner' on the news is something else <barf>

Re:Upcoming Critical PHP Security Release on Wednesday October 21, 2026 @09:15AM (#50180410)
It's not elitism to call out bad practices
I think leadership should be responsible too, but I don't know how you'd prevent disgruntled employees from creating these situations just to hurt execs. There needs to be some shared responsibility for all the people involved.
Re:Denmark Data Breach Exposes 8.8M People's Personal Data on Monday October 05, 2026 @06:20AM (#49962976)
Answering my own question, from here[0]: 'approximately 8.8 million registered persons (living, departed, deceased, etc.)'

[0] https://ufm.dk/aktuelt/pressemeddelelser/2026/oktober/omfatt...

Re:Denmark Data Breach Exposes 8.8M People's Personal Data on Monday October 05, 2026 @06:17AM (#49962945)
Denmark's population is 6 million [0], where does the diff of 2.8M come from? :)

[0] https://www.dst.dk/en/Statistik/emner/borgere/befolkning/bef...

Re:MentalHealthBench on Friday September 25, 2026 @10:55AM (#49845560)
How about putting a fucking red banner at the top of that page saying 'WE DON'T RECOMMEND ANYONE USE OUR STOCHASTIC PARROTS FOR THERAPY, WE DO THIS FOR DAMAGE CONTROL'.

I can't understand how anyone can do this in good conscience.

Re:Spain Orders Blocks on Archive.today and Its Mirrors on Sunday September 20, 2026 @06:09AM (#49774337)
The TV rights holders for football matches want to block pirate streams by any means necessary. Spain appears to be the worst, people get arrested in the UK for profiting off streams (so far, but the communication is pretty aggressive towards consumers too), I don't know about the other countries mentioned.
> No, Meta just amplified it to the nth degree. > [...] > Meta just put a big ol' bright spotlight on the worst aspects that *we* were already amplifying, and *perhaps* sped-run that amplification.

No, pick one. If it's the former, it's essentially the same as saying they warped society.

I agree that these traits are human and were there before social media, but amplifying, gamifying and exploiting addiction is reprehensible.

I like the website, great work!

The LLM descriptions are terrible though :) here's the one for Windows 98:

> Windows 98 refined the 95 formula, folding the web into the shell with Active Desktop while keeping the familiar look. Its Display Properties carried over the same grid of basic swatches and named schemes — teal still the Windows Standard default — with the classic reserved system colors tuned to their canonical values.

Instead of this, maybe find some copy related to the os (some quotes from the media / internet archive / something)?

Re:Don't classify, hallucinate! on Friday August 14, 2026 @11:25AM (#49300039)
I did something similar 10 years ago, but instead of llms I used word2vec to calculate a embeddings of product descriptions and map those to existing categories. The LLM approach is very likely better, but I'm curious what the cost difference is.
Re:Advertise in ChatGPT on Wednesday July 22, 2026 @07:01AM (#49004773)
I stopped using Kagi news when I saw it has Russia Today as a source for many articles
Re:Grok 4.3 on Friday May 01, 2026 @11:16AM (#47975799)
> As an English-as-second-language speaker and writer

How do you know it's actually better? I'm not trying to be condescending, but this reads to me like vibes :)

Re:John Ternus to become Apple CEO on Tuesday April 21, 2026 @04:39AM (#47846207)
This is relevant information for this forum, for good or bad Apple has a lot of impact.

I find your reaction strange, do you read news to be angry and/or afraid? :)

Re:Wiz Joins Google on Wednesday March 11, 2026 @04:20PM (#47340939)
It was announced almost a year ago: https://news.ycombinator.com/item?id=43398518

But it was subject to regulatory approval, that's been completed now.

Re:Meta acquires Moltbook on Tuesday March 10, 2026 @01:43PM (#47326456)
> They get the team that built it and have more people on the AI initiative who are consumer-centric.

Who are comfortable releasing systems with horrible security, while proudly stating they never read the code? And with metrics that can be gamed by anyone, but that got reported to literally the entire world?

> The lesson here is to spend less time focused on doing what you think is the right thing and spend more time tinkering.

I'd say the lesson here is that clown world keeps on giving, but hey, maybe I'm just jealous ;)

I don’t understand how id-ing the buyer helps? What is the age restricted good here?

Are you saying that kids now buy their phones with pocket money without their parents knowing?

> It's obvious we're moving in a direction where we are going to get these restrictions in one way or another

It’s not obvious, it’s just sad. I still hope reason will prevail in this.

I can't see how anyone can think "the exporters pay the tariff" makes any sense. TBH, we'll never know how many people thought it made sense because it didn't matter.
Reading the comments here I see almost everyone posting assumes this is a genuine interaction of an autonomous AI with the repo, not a human driving it.

IMO this take is naive :)

I think this is important - these topics get traction because people like to anthropomorphise LLMs and the attention grab is 'hey, look at what they learned to do now'.

It's much less sexy if it's not autonomous, if this was a person the thread would not get any attention.

There was discussion about this here a couple of weeks ago: https://news.ycombinator.com/item?id=46458936

Steve Yegge's a famous developer, this is not a joke :) You could say he is an AI maximalist, from your options I'd go with (b) serious with the idea, tongue-in-check in the style and using a lot of self-irony.

It is exaggerated, but this is how he sees things ending up eventually. This is real software.

If things do end up in glorified kanban boards, what does it mean for us? That we can work less and use the spare time reading and doing yoga, or that we'll work the same hours with our attention even more fragmented and with no control over the outputs of these things (=> stress).

I'd really wish that people who think this is good for us and are pushing for this future do a bit better than:

1. More AI 2. ??? 3. Profit

> The historical pattern suggests cognitive abilities shift rather than disappear.

Shift to what? This? https://steve-yegge.medium.com/welcome-to-gas-town-4f25ee16d...

Re:Iran Goes Into IPv6 Blackout on Thursday January 08, 2026 @12:59PM (#46544200)
Not specific to this IPv6 event, but I was wondering what happens to public services during these Internet shutdowns?

Does everything stop or it's mostly business as usual minus some things?

I would imagine hospitals, tax offices etc need the internet to work?

Re:Rob Pike got spammed with an AI slop "act of kindness" on Friday December 26, 2025 @02:50PM (#46395503)
I read Rob’s message as against the AI industry, triggered by this email - it is ‘AI is bad’.

This startup didn’t spend the trillions he’s referencing.

Re:Subverting Telegram's end-to-end encryption on Tuesday October 14, 2025 @03:33PM (#45583846)
Lex Friedman recently did an interview with Durov: https://lexfridman.com/pavel-durov/

I listened to bits of it and I was disappointed by the lack of push back from Lex who was supper excited because he got to hang out with Durov for a couple of weeks in Dubai - the tl;dr I got from what I heard is that Telegram is amazing and Durov is a visionary freedom fighter. Lex's recent history I'm not surprised though.

Here's the transcript of the section about encryption: https://lexfridman.com/pavel-durov-transcript#chapter15_encr... I'll let you judge for yourself.

I'll comment on another section though because I'm somewhat knowledgeable having followed the subject closely in the media and by knowing the country: https://lexfridman.com/pavel-durov-transcript#chapter7_roman...

He claims: 'So, by the time the head of intelligence services met me to ask about Romania to help them silencing conservative voices in Romania, I was already wary of what can be going on next.'

I call bullshit on this. The 'conservative voices' are muppets doing Russia's bidding who broke all sorts of election laws. There was nothing serious happening on Telegram in Romania that would warrant any foreign intervention, it just doesn't make sense.

Re:Two things LLM coding agents are still bad at on Thursday October 09, 2025 @04:40AM (#45525085)
Speaking of agents and tests, here's a fun one I had the other day: while refactoring a large code base I told the agent to do something precise to a specific module, refactor with the new change, then ensure the tests are passing.

The test suite is slow and has many moving parts; the tests I asked it to run take ~5 minutes. The thing decided to kill the test run, then it made up another command it said was the 'tests' so when I looked at the agent console in the IDE everything seemed fine collapsed, i.e. 'Tests ran successfully'.

Obviously the code changes also had a subtle bug that I only saw when pushing its refactoring to CI (and more waiting). At least there were tests to catch the problem.

Re:Two things LLM coding agents are still bad at on Thursday October 09, 2025 @04:29AM (#45525015)
Your point to not rely on good intentions and have systems in place to ensure quality is good - but your comparison to humans didn't go well with me.

Very few humans fill in their task with made up crap then lie about it - I haven't met any in person. And if I did, I wouldn't want to work with them, even if they work 24/7.

Obligatory disclaimer for future employers: I believe in AI, I use it, yada yada. The reason I'm commenting here is I don't believe we should normalise this standard of quality for production work.

Re:Who needs Git when you have 1M context windows? on Tuesday October 07, 2025 @12:42PM (#45505432)
Jetbrains IDEs have 'Local History' that keeps a record of all edits to files - I looked in mine now and I have changes from more than 3w ago :)

Older »