News for hackers. Stuff that matters.

dingaling

What a marvellously ironic name for someone dealing with a recalcitrant robot.
Re:The case of the 9 bit AES key on Thursday October 29, 2026 @04:22AM (#50285969)
> but why should PDFs have encryption built-in to the file format?

Because very few 'end user' people know how to use en/decryption. So it's much easier to send them a familiar file and say 'enter this password' than to have them searching the web to work out which arguments to pass to openssl. In a command line? What's that?

I received an AES-encrypted file recently but neither gnupg nor openssl could determine what mode and keysettings the sender had used, so it was just a useless lump of data. Very secure though...

Re:Gemini 4 Carbon on Wednesday October 28, 2026 @04:49PM (#50280694)
The only hindrance for him was that Ford still held an automotive category trademark for Model E, hence Tesla had to go with Model 3.
There have been a few attempts at Android cameras going way back to the Galaxy Camera of 2012

https://web.archive.org/web/20120831232318/http://geeknizer....

But they just didn't have the ergonomics or battery life to act as a replacement for small SLRs.

Because if a device can't connect, it will often have logic to try to find other routes e.g. open WiFi nets

It would be tricky to implement, but a network tarpit that responds on TCP as if outgoing packets are being accepted and routed might be useful.

> It's not 100% perfect, but it helps reduce scams.

We don't know that, as it's not even live yet.

In fact it might even open a whole new market for 'unlock scammers' who do the initial groundwork and then sell their vulnerable mark to the next scammer.

Re:No Need for Retirement When Utopia Is Around the Corner on Saturday October 24, 2026 @03:16AM (#50218967)
"And we stopped. IMHO, that ranks right up there with the Montreal Protocol ..."

We stopped because the major nuclear powers had accumulated sufficient data to enable high-fidelity computer modelling of future warheads.

It wasn't just, or perhaps even wholly, driven by environmental empathy, it was an attempt at was pulling the ladder up behind the the major powers. There are eight non-signatories and seventeen non-ratifiers of the treaty, the majority of whom already being proliferation risks.

Your stats are also arbitrary, there have been sixteen nuclear tests since the Treaty opened for signature in _1996_. Setting the cutoff to 1998 deliberately excludes Indian and Pakistani tests.

Re:Today, we hacked what we'd set out to hack: the iPhone on Friday October 23, 2026 @02:53PM (#50213703)
People are trading the future of personal computing just so they can run a banking app and justify it with "but I want my phone to be locked down for security." Not even sleepwalking into corporate-controlled-computing, but actively promoting it.

10, 15 years from now the ability to run your own code will be a distant memory unless you constantly subscribe to an annual Developer Account with BigCorp. Oh no, you've coded something that violates the ToS; account terminated.

> Check out a book

Not many of those left in my local libraries. They downsized to popular fiction and a rack of magazines to introduce more sofas and space for charity cake stalls. And "mindful colouring-in" if you're around for the 4.5 days of the week that they're open.

Libraries threw away the one thing that made them unique, curated knowledge, in order to compete with Starbucks as a "third space".

> Will not apply if updates are blocked

This will not arrive through Android updates but through Google Play Services.

You can try to block Play Services using DNS trickery, but it's like whackamole. The only way to be guaranteed safe from this update is to run a ROM without Google services installed.

Re:OpenAI discloses four more rogue incidents on Sunday October 18, 2026 @02:09AM (#50138344)
> So as long as it's reimbursed they might be fine.

Say you found a debit card on the ground, reset the PIN by using the owner's credentials that you found online, and used it to make purchases until the bank froze the card.

Would that be a 'human malfunction' resovable by repaying?

The problem is we cannot distinguish cause from effect.

Maybe people are watching porn because they can't get the real deal?

Many marriages succumb to 'dead bedrooms' and many young people feel that they cannot compete in the modern dating game, which is essentially Top Trumps for Humans.

No, he bought it because he was contractually obliged to do so even after he tried to wriggle out of it.

I mean this isn't even ancient history, it only happened in 2022. He sent three termination notifications before it was determined that he had no grounds to refuse to buy.

" It's unusable in almost every situation on the road"

Yet it's a useful, comparable, measure for acceleration and is frequently exercised on track. If you had an AMG and haven't taken it for at least one track day then I question why you bought it. Image?

Maybe 30-70 would be more useful for determining overtaking capability, but that would require everyone in the motoring industry to agree to change at the same time.

Re:Tesla Roadster on Friday October 16, 2026 @07:24AM (#50117046)
99% times when you go to write 'barrel roll', just write 'roll'.

A barrell roll is a specific manoeuvre involving pitching up vertically before commencing the roll.

Once they've calculated the VPN exit point, with sufficient data they can eliminate that and reveal the ping times 'behind the curtain' back to your actual ISP. That gives a geolocation radius that can be correlated with other data.
The ranges involved in Hormuz drone strikes don't necessitate Starlink; their targets are with UHF LoS of mountain-top sites.

In contrast Ukraine is launching strikes of up to 3000km into Russia.

Re:Passkeys Are Not a Trap on Wednesday October 14, 2026 @12:23PM (#50090241)
A closed-firmware USB key is really no better option.

Dear Yubico / Kensington / Google Titan, can I export my private key components to this other device, or even print them out on paper for storage?

No - you're just an untrustworthy user granted the fleeting privilege of using BigCorp devices. Now stop asking such questions or you might have your attestation revoked.

Re:Amazon pushes up prices across the Internet on Wednesday October 14, 2026 @10:07AM (#50088012)
"why would I not order on Amazon and save myself $50?"

Because of principles?

It seems that in the past 20 years the concept of boycotting a company in response to their behaviour has been lost.

The last widespread boycott I remember was from the late 2000s against Sony, I can't even remember why ( rootkits on CDs? ) but I'm still boycotting them now as it's an automatic reaction.

Re:Citroen revives the 2CV for an electric age on Monday October 12, 2026 @11:44AM (#50058081)
"You can try marketing a barebones car which doesn't have a 5 rating on NCAP and see how that goes."

Dacia did, and their CEO said they would let customers decide - which they did in droves, to his benefit, despite scoring three stars or fewer.

The newest Dacia Spring has one star.

NCAP lost its way years ago when it diluted its ratings from just crash testing into including "safety assistance" software.

> He’s not going to stop AI.

I'm sure he knows that, he's probably also aware that his opportunities for acting will be diminishing.

But we should be applauding him for having principles and sticking to them, which seems increasingly rare in this post-truth World. Avarice, deception and outright lying seem largely to have taken over from self-discipline and morality and it's rare for someone to draw a line in the sand and stand behind it.

"as we move to shorter certificate lifetimes the impact is continually reducing"

When a company has 3 billion customers, there's no practical cert lifetime that really reduces exposure. Five minutes would sniff enough traffic to do significant damage; one day would impact a big chunk of their users and five days would be nearly 100%

Re:We are going to kill "unalive" on Wednesday October 07, 2026 @03:10AM (#49989367)
> it feels vaguely Old English.

The Old English verb form would more likely be "dealive", with "unalive" being an adjective.

Re:We want you to build the next Git platform on Cloudflare on Sunday October 04, 2026 @02:11AM (#49951141)
"They've been giving stuff away to devs for free"

It's not free, it moves the cost onto the users of those services. I have to pay with my time and my data.

Or, increasingly, I hit backspace as soon as I see the Cloudflare logo. Who's going to pay when the users don't?

Meanwhile while in the real business world, Cloud decisions are shaped by marketing campaigns and it's the hobbyists and old grey-beards who provide the empirical push-back and reality checks.
"One are individuals with bodies that gain weight regardless of what the person does."

Physically, that's not possible. If calories consumed is less than calories burned, the body cannot add weight. It doesn't have access to zero-point energy.

"would resell on the secondary market for a giant profit."

But you've no evidence that that "giant profit" would be more than the increase that the suppliers would apply.

Arbitrage allows the market to find an agreeable price; a middleman arbiter with a warehouse of RAM has an incentive to agree a price with a buyer because he's stuck with that inventory if he doesn't shift it, and he has costs related to financing it.

A supplier has no such incentive, they can just jack the price up and if sales drop off they run the machines at a lower rate, or sack employees. But sales aren't going to drop off, because the baseline for demand has been lifted

Once this "RAM Crisis" is over, what reason would manufacturers have to reduce prices?

"Designing the plane may only have taken four years, but training the staff, organising the workshops and mastering the production tools took much longer."

Lockheed had no experience with titanium prior to OXCART. 95% of the first 6,000 sheets of titanium had to be scrapped.

It was the first production design to incorporate low-observable shaping.

It was 50% faster than anything Lockheed had previously tried to build, and four times faster than the U-2.

And they literally did all that between April 1958 and April 1962.

So, yes, it was designed from scratch as nothing useful from prior projects read across to it.

Re:The new Firefox design is here on Tuesday September 29, 2026 @10:45AM (#49894239)
Every 15 years, MDI gets re-discovered and then deprecated.
> Wait, insurance includes repair costs?

Yes of course, it's part of the actuarial calculation. As cars age they become more expensive to repair and eventually will cross a boundary where the insurer will write them off on any type of accident, rather than trying to repair. This naturally increases the base insurance price.

OEMs in the EU are only required to produce spare parts for 10 years after a model is withdrawn, which is a strong indicator of when write-off becomes the primary option.

Older »