News for hackers. Stuff that matters.

didntcheck

Re:Passkeys are a trap. Do not use them on Monday October 12, 2026 @07:55AM (#50055058)
You answered your own question in parenthesis. US banks are an outlier and the US is not the entire world
Re:'The eels were climbing out of the water to die' on Thursday October 08, 2026 @11:32AM (#50007081)
> In the case of Furnace Brook, the water companies were not to blame.

TFA

That text defines AI as such

> ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments

To me, this definition reads as only including "agentic" uses, or automated decision engines. An image generator does not operate with any autonomy. If you interpret the "input" part loosely enough to include it, then you'd likely include old and simple techniques like seam carving [1], which very few would consider "AI" in the contemporary sense

[1] https://en.wikipedia.org/wiki/Seam_carving

What about the practical difficulty of defining "AI"? You could explicitly call out, say, diffusion models, but that would leave future holes for new AI technologies

What about Photoshop being driven by Claude Cowork? That my seem asinine, but it is a serious consideration

I found this definition here [1]

> ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments;

But that barely clears anything up. Even worse, I would not include a simple user-prompted image generator under this definition, as it is not operating with any autonomy. Or, you interpret it so broadly that seam carving [2] is considered AI, let alone content-aware fill

[1] https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

[2] https://en.wikipedia.org/wiki/Seam_carving

Unidentified Aerial Fenomenom
> You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet?

Are you sure that's true? The whole reason why modern Safetynet/Play Integrity uses HSM data where possible is that you can't spoof that with root (without a microcode bug). It does not trust the running OS by design

I just tried GrapheneOS's https://attestation.app/ on a stock Pixel, and all of the OS version info shows in the "hardware verified" section

Sure, but it's pretty clear that the topic of this English language article is the English language Wikipedia
Unless you need it for a high security environment that's limited to civilian procurement, why? I'm struggling to see a use case beyond that
> how do you feel about the entire thing?

I feel about as strongly as I do about the font that Google use

I will never understand this visceral reaction that emojis provoke in some people

And, as usual, "risk/threat to democracy" is used to mean "support for parties I don't like"

It wasn't long ago that the Twitter shoe was on the other foot, and many of those complaining now were quite happy to endorse the right of private companies to promote/suppress speech at will (with no hint of irony regarding their alleged ideological views on private companies)

Re:Windows API Is Successful Cross-Platform API on Sunday May 03, 2026 @10:54AM (#47997535)
And how would they distribute that compiler-installer as a portable binary?
Re:Windows API Is Successful Cross-Platform API on Sunday May 03, 2026 @10:45AM (#47997437)
> Interesting provocative article, I bet it will be praised on some Microsoft sponsored conference.

"Win32 is the only stable Linux desktop API" has been a common observation in the Linux community for years. I'm not sure why you're acting like it's a Microsoft-sponsored smear

Microsoft may have indeed won first place via dirty anticompetitive tricks, but Linux/*nix would need a similarly stable API first in order to have won at all. And obviously plenty of companies and initiatives have tried (from Red Hat to Valve), and yet progress has still been glacial

Also nobody's saying it's a particularly good API, but it is stable. As "Worse is better" famously observed, the technical elegance of a standard has barely any effect on its adoption, versus more boring social and commercial factors

This headline is a good example of why title case should be considered harmful. It took me several times to parse correctly, since I initially read "Application" and/or "Notes" as proper nouns
Re:Privilege is bad grammar on Tuesday February 17, 2026 @05:09AM (#47045665)
Yep

> If I had sent out an email with even a quarter of the typos they had, I probably would've lost my job.

I don't know their life, and they may be right, but I think they may well just be imagining it. I also went from excessive formality to short conversational tone as I became more experienced. But it wasn't due to any promotions, but because I realized nobody had ever cared

I mean this is a standard cliché even in fictional works: the young new worker who keeps falling over themselves to perform what they think is necessary formality, only to be shown that they can just chill out and act like a human

Re:Privilege is bad grammar on Tuesday February 17, 2026 @04:59AM (#47045589)
A wedding is a social event with friends and family. I am going there to see the people. A flight is a functional form of transport which is shared out of necessity. I am going there to pay as little mind to the other people as possible
How well does Zulip protect users' privacy against snooping admins? I.e., does it have E2EE DMs? Unfortunately, this is a legitimate threat to be concerned about
Re:Paris prosecutors raid France offices of Elon Musk's X on Wednesday February 04, 2026 @04:59AM (#46883818)
> It's worth pointing out that in France and the UK, the authorities involved are arms length independent of the political bodies

As someone who has lived in (and followed current affairs) in both of these countries, this is a very idealistic and naïve view. There can be a big gap between theory and practice

> There are statutory instruments (in France, constitutional clauses), that determine the independence of these authorities.

> They are tasked - and held to account by respective legislative bodies -

It's worth nothing here that the UK doesn't have separation of powers or a supreme court (in the US sense)

> Patreon gives creators the option to either increase their prices in the iOS app only, or absorb the fee themselves, keeping prices the same across platforms.

I'm curious what percentage of creators chose which

Yes. It's improved now, but the mobile web was bad for a long time. The early days of Android experienced a "web-first" ecosystem by force, as lazy businesses just threw a webview around their site, and it was awful
It's not users who are pushing this. It started off with just superfluous but optional apps of websites. Now every year I find there is something I used to be able to do, which I now must own a smartphone to do. And it's not just getting discounts at coffee chains, it's increasingly stuff like accessing healthcare plan benefits, or verifying my identity for banking

A few sites throw up a blocking screen to download the app, which disappears once you spoof a desktop UA. But the big problem is businesses now having no web interface at all

Re:25 Years of Wikipedia on Thursday January 15, 2026 @12:27PM (#46636040)
On the contrary, this thread seems to have a large number of users who can't handle criticism of Wikipedia without responding with unfounded assumptions and insinuations about the critic
Re:SmartTube Compromised on Monday December 01, 2025 @04:45AM (#46105427)
Sure, and you're free to

1. Save $14 for retirement and not watch Youtube

2. Save $14 for retirement and watch Youtube with ads

3. Pay $14 a month for Youtube without ads

The only option that's not fair is expecting private companies and creators to give you entertainment and its delivery with nothing in return

Re:GitLab discovers widespread NPM supply chain attack on Friday November 28, 2025 @04:36AM (#46077119)
That's true, but the same may already be true of your browser's cookie file. I believe Chrome on MacOS and Windows (unsure about Linux) now does use OS features to prevent it being read from other executables, but Firefox doesn't (yet)

But protecting specific directories is just whack-a-mole. The real fix is to properly sandbox code - an access whitelist rather than endlessly updating a patchy blacklist

Re:Rating 26 years of Java changes on Saturday October 11, 2025 @09:29PM (#45554322)
I believe Quartz is the go-to solution for this. It's not part of Spring but it offers a similar annotation-driven interface, but with distributed locking via a database
Re:Redis is fast – I'll cache in Postgres on Friday September 26, 2025 @08:22AM (#45385676)
> This was the very first time I heard anyone even suggest that storing data in Postgres was a concern in terms of reliability

You seem to be reading "reliability" as "durability", when I believe the parent post meant "availability" in this context

> Do you actually have any concrete scenario in mind? Because anyone can make any system "considerably degrading", even Redis

And even Postgres. It can also happen due to seemingly random events like unusual load or network issues. What do you find outlandish about the scenario of a database server being unavailable/degraded and the cache service not being?

Presumably there's no legal reason why the ISPs couldn't write to all their customers giving "notice of upcoming partial internet service outage, due to the actions of La Liga". It would be factually true

Of course, LL could still give them hell in court even on false grounds (and maybe even win anyway, given the case detailed in the root comment). And in any case there's simply no commercial reason why they would stick their neck out in the first place

Re:14 Killed in protests in Nepal over social media ban on Monday September 08, 2025 @08:08AM (#45167302)
Same experience here. Their ads repeatedly hijack the tab

Try this instead https://archive.is/zv17z . Not perfect, but the text can still be read behind the popover

I suppose in theory you could have a device which doesn't have the storage or bandwidth to record/transmit full audio, but does some heuristics on the device and then transmits a small payload of flags. But in any case I wouldn't want to stay anywhere with an unaccountable black box ready to unfalsifiably charge me

The other commenter is absolutely right that partyers in AirBnBs cause nuisances for local residents, but the owners will have to find another way to sort that out or close up shop

Re:Most RESTful APIs Aren't RESTful on Wednesday July 09, 2025 @10:38AM (#44510574)
The web browser is just following direct commands. The auto discovery and logic is implemented by my human brain
Re:Breaking WebAuthn, FIDO2, and Forging Passkeys on Tuesday June 24, 2025 @11:40AM (#44367416)
If anything I'm worried that corporate security people will hear of "attacks" like this and blindly add "must use attestation with passkeys" to their checklists, and desktop computing will end up in the same state as mobile, where you have to have an unmodified OS install from one of a handful of authorized fiefdoms to log into your bank. It's a long way off, due to the amount of old laptops with no TPM about, but a plausible future

Edit: I may be misunderstanding the scope of attestation in a FIDO/Webauthn context. Is it a legitimate concern that it would lock out other OSes, or would you simply need a hardware key (or perhaps a TPM), but could run what you want above it?

Older »