News for hackers. Stuff that matters.

dTP90pN

Re:Creepy Crawlies on Monday August 31, 2026 @04:32AM (#49507117)
Does cgit not support a .patch or .diff URL suffix? How hard could it be for AI companies to add a preference for such URLs into their models or system prompts? Wouldn't that be obvious improvement for any model?
Re:GPT 5.6 Cyber on Tuesday August 11, 2026 @10:48AM (#49259303)
Yeah their website & "Model Studio" is horrendous. I just ignore all Popups/Agreement Review Prompts/Payment verification warnings.

It's little very badly translated popup under "Available models" in Model Studio -> My subscriptions: https://imgtree.co/direct/s9x9ksdg.png

Re:GPT 5.6 Cyber on Tuesday August 11, 2026 @08:40AM (#49257359)
Same. Qwen 3.8 max also does quite well on cyber security tasks, and is really cheap in their "night" window (22:00-08:00 UTC+08:00). Did a SCTPhantom LPE on 7.0+ as an evaluation just this week. This would've taken me several months of work a couple of years ago. (probably indicative of my offensive security skills, heh)
Depends on your health insurance. My previous insurance company paid back the full cost when I was 30 years old. I can recommend checking https://www.entschiedengegenkrebs.de/vorbeugen/kostenerstatt... (and then also confirming that with the insurance company over text, just to be safe)
Re:CrowdStrike's impact on aviation on Tuesday July 30, 2024 @07:30AM (#41108023)
What happened to the good old tin can telephone down the side of the house to the washing room?
Re:API Shouldn't Redirect HTTP to HTTPS on Tuesday May 28, 2024 @06:21PM (#40506244)
There's no "relaying" when the the attacker just captures unencrypted WiFi packets from the air, or more traditionally, splits some light out of the fiber line.
Re:Road planners embrace an unconventional intersection on Tuesday May 28, 2024 @11:28AM (#40501684)
The German Wikipedia has a list of such DDIs in various countries (primarily France since they apparently invented them in the 1970s):

https://de.m.wikipedia.org/wiki/Anschlussstelle_(Autobahn)#D...

Re:Flags Are Not Languages on Sunday May 05, 2024 @02:17PM (#40266960)
The real solution is obviously to use geolocation to find the closest country which officially uses the individual language(s).
A small number of people with likely professional involvement in the Fedora project and possibly RHEL.

A supply chain attack serve as the basis for another supply chain attack.

Re:When ELF notes reveal too much on Saturday March 09, 2024 @07:05AM (#39651145)
If Xen uses these addresses "on boot", why has booting Xen worked the past 11 years then?
You can "wipe"/"drag" upwards to exit the A/C overlay (just like, for example, android quick settings/notifications).

Of course, you have to do this the "correct way", which in and of itself requires a bit of experimentation to learn.

Mozilla implemented a fork server to fix this issue. It is enabled in the new deb packages, but not yet in "normal" Firefox:

https://bugzilla.mozilla.org/show_bug.cgi?id=1609882

https://bugzilla.mozilla.org/show_bug.cgi?id=1850026

Why would Firefox have to "rollback" their UA string back to version 64, released 6 years ago (2018)? That seems utterly ridiculous for a server side UA sniffing bug rolled out by the Google Search Team.
Re:Tesla Normal Operating Sounds on Saturday November 25, 2023 @03:22AM (#38412117)
This does not account for inattentional deafness, which is why there ought to be sense-redundant alerts, at least for alerts requiring immediate action.
If web developers would just start using `<time>`, we might someday reach such a reality.
Re:Most UI Applications Are Broken Real-Time Applications on Friday September 22, 2023 @10:34AM (#37612604)
To be fair, SDDM has the same issue, at least on multi monitor setups.
You have to choose between HuC firmare loading (required for media hardware-acceleration; old i915 driver only) and VM_BIND support (required by various games; new Xe driver only)

https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/234

Prospective owners which use Linux should know, that they will have to decide which driver to run: i915 with hardware-acceleration support (more generally, HuC), or Xe with VM_BIND support (highly relevant for gaming):

https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/234

If you're not running a Zen 2 CPU or APU, you don't have to worry about this.

If you're running the latest kernel, which automatically sets the chicken bit, you don't have to worry about this.

If you're running fixed microcode, which is only available for Rome, Castle Peak and Mendocino, you don't have to worry about this. Good microcode revisions are:

    Rome / Castle Peak: 0x0830107a (published)
    Xbox Series X: unknown
    Renoir / Grey Hawk: 0x0860010b
    Lucienne: 0x08608105
    Matisse: 0x08701032
    Van Gogh (Steam Deck): unknown
    Mendocino: 0x08a00008  (published) 


If you're running neither the latest kernel, nor fixed microcode, you should set the chicken bit yourself until you have updated those.

    wrmsr -a 0xc0011029 $(($(rdmsr -c 0xc0011029) | (1<<9)))
Re:Zenbleed on Monday July 24, 2023 @04:13PM (#36853590)
More details:

`good_revs` as per the kernel: https://github.com/torvalds/linux/commit/522b1d69219d8f08317...

Currently published revs ("Patch") (git HEAD):

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/lin...

As of this writing, only two of the five `good_rev`s have been published.

Re:Zenbleed on Monday July 24, 2023 @04:00PM (#36853437)
> AMD have released an microcode update for affected processors.

I don't think that is correct. AMD has released a microcode update[0] for family 17h models 0x31 and 0xa0, which corresponds to Rome, Castle Peak and Mendocino as per WikiChip [1].

So far, there seems to be no microcode update for Renoir, Grey Hawk, Lucienne, Matisse and Van Gogh. Fortunately, the newly released kernels can and do simply set the chicken bit for those. [2]

[0] https://git.kernel.org/pub/scm/linux/kernel/git/firmware/lin...

[1] https://en.wikichip.org/wiki/amd/cpuid#Family_23_.2817h.29

[2] https://github.com/torvalds/linux/commit/522b1d69219d8f08317...

You seem to be incapable of understanding that it is quite possible and not at all unusual to internally carry patches to dependencies on which your commercial product is built. In this case, the patch merely involves changing two bytes[1], three if you include the pyOpenSSL bump, something a company like IBM should easily be able to do.

[1] https://github.com/mitmproxy/mitmproxy/commit/8c6ec5cb56fbf4...

Btrfs mounting of larger arrays became near-instant for me with the new block group tree enabled; see btrfstune: https://btrfs.readthedocs.io/en/latest/btrfstune.html
~~While school/company IT as a use case is being considered[1], that is not the primary intent for this feature.~~

edit: I misread that ticket. It's about allowing school/company IT to disable the feature, not to allow them to use it.

https://bugzilla.mozilla.org/show_bug.cgi?id=1834985

Mozilla can remotely set that pref: https://bugzilla.mozilla.org/show_bug.cgi?id=1832791

There is consideration to allow enterprises to disable this feature though: https://bugzilla.mozilla.org/show_bug.cgi?id=1834985

edit: fixed 2nd link description.

Re:A large crash spike affecting Firefox users on Linux on Saturday June 24, 2023 @11:29AM (#36459520)
Have you looked at the crash reports via `about:crashes`? This should show you if there's any open bug report associated with the crash(es) you encounter.

Regarding libdbus-glib-1-2, you may want to open a bug. It looks like [1] it's mainly used by the ~12 year old UPowerClient, and more recently, for wake/sleep and timezone change notifications (nsAppShell).

[1] https://searchfox.org/mozilla-central/search?q=DBusG.*&path=...

Re:The rule says, “No vehicles in the park” on Saturday June 24, 2023 @05:57AM (#36457215)
So you would've considered the Honda Civic to not be violating the rule, if it had been unregistered?
Note: According to the published server source code, the NotificationCheckInterval has been increased to 60s sometime in back in March:

https://github.com/christianselig/apollo-backend/blob/b992d2...

Reddit had many years to listen to 3p devs and to it's own internal developers to improve their API. They/Leadership decided not to do so.

Re:Svelte is migrating from TypeScript to JSDoc on Wednesday May 10, 2023 @05:12PM (#35893595)
Do you mean native JSDoc namepaths like

    /**
     * @type {module:look/here~MyType}
     */
or TypeScript "JSDoc" imports like

    /**
    * @type {typeof import("./look/here").MyType}
    */
or both?
Here's the tzdata: https://github.com/eggert/tz/blob/71faa2a55db2c9f21f4099b58c...

Looks like the negative DST has already caused problems in the past and applications that can't handle it (ICU & OpenJDK) have to build tzdata as per the rearguard section / ziguard.awk.

Older »