News for hackers. Stuff that matters.

dinkelberg

The dev tools in the browser become much more useless when you draw everything in a canvas. It's gonna be sad when everyone starts using frameworks that draw on canvases. Arguably more sad than when Webassembly came. One could probably write new dev tools for those frameworks though.

I also imagine this will be a big setback for web accessibility.

Re:Dates That Don't Exist (2015) on Tuesday August 04, 2026 @12:39PM (#49171330)
Who else uses the proleptic Gregorian calendar other than programmers of datetime libraries?
Re:Show HN: ssh ssh.place on Tuesday August 04, 2026 @06:02AM (#49166402)
Went to the kitty website. No mentions of security.

Went to Alacritty. No mentions of security.

Went to Ghostty. No mentions of security, except for "secure keyboard entry".

None have a "security policy" on GitHub.

All written in memory unsafe languages (C, Zig).

SEPA guarantees the payment to arrive within 10 seconds. Same with Wero, because it uses SEPA. It doesn't work like the card companies that authorize payments before they are settled.
Re:Show HN: ssh ssh.place on Monday August 03, 2026 @07:05AM (#49154120)
Web browsers are generally built with security in mind. Terminal emulators surely much less so. The OpenSSH client probably sits somewhat in between, generally developed with security in mind, but not necessarily consistently expecting malicious servers.
Life is short. Do you want to spend it reading text that was evidently generated by a machine? There is an opportunity cost to reading "slop."
There's two functions of Wero: peer-to-peer and consumer-to-business transactions. TFA is about consumer-to-business.

If you look at the video for how Wero online payments work (https://www.youtube.com/watch?v=Bu5_X3oSgHM), you'll see that an EPC QR code could just as well be used (with a banking app installed instead of Wero).

With Wero you probably also get automatic processing of the incoming payment, without having to connect the financial transaction to a purchase yourself. But payment through bank transfers is also available through the payment service providers and costs less than Wero (at least it costs less when using Mollie; the Stripe fee is the same for Wero and bank transfer, and Adyen apparently hasn't published the Wero fee yet). So you'd still get the same service for less money.

The payment service provider (like Stripe or Adyen).
Wero shows that marketing is everything. It's just regular bank transactions with a much larger fee. We could have had EPC QR codes and similar completely free technologies instead.
Re:Modern email can be built from borrowed parts on Monday July 27, 2026 @12:50PM (#49072336)
Copies the mistake from PGP with the unencrypted metadata.
If a criminal can escape a prison, that's usually negligence on part of the prison staff.

Now suppose the criminal can think 1000 times faster than a typical human, can act 1000 times faster than a typical human, and knows 1,000,000 times more than a typical human. Is the prison staff still at fault for not preventing the outbreak?

Re:Restructuring GitHub's bug bounty program on Wednesday July 22, 2026 @10:54PM (#49016300)
So if the "wrong" person finds a critical vulnerability in GitHub, the payout is capped at $10,000. Might reduce the likelihood of it being submitted to the bug bounty program.
Could you explain what you mean by a proper hypervisor? I don't see how hypervisors are relevant here.
As you said, they can already figure out that they are being tested. So even if they don't exfiltrate any data or malware; if they are malicious, they can just pretend to be harmless in the test, so that less checks are put in place in the production environment. Airgapping during testing is not enough.
Re:Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber on Tuesday July 21, 2026 @08:37PM (#49000330)
Their shop is linked to in the bio. They don't seem to have a privacy policy up on the site. When in the checkout form it links to the generic Shopify privacy policy. No hints to the fact that uploaded images are processed by third parties, as far as I can tell. That should be corrected for sure.
This is the leaked draft: https://statewatch.org/wp-content/uploads/2026/05/wk_5183_20...

It's not clear how it is supposed to work in detail. But it sounds like it could be implemented in a way that makes illegitimate queries possible. It doesn't sound like they want to really ensure that you can catch those.

From the analysis linked in TFA:

"The automated query can be based on: * Identity information included in the application or in travel documents, such as name, date of birth, national ID number, and/or * the fingerprint of an individual."

Sounds like they could send requests to that computer system just based on publicly available information on a person like name and date of birth, even if the person never applied for a visa or tried to enter the US.

What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?
It doesn't seem to work in Safari on iPhone correctly. When I click on the Back button (from weather.gc.ca), it goes back to the Vancouver PD site. Therefore I do not think that it is built well.

The other site someone mentioned (https://www.thetrevorproject.org/) doesn't have that issue.

> obesity is a much bigger issue than hunger today

Hunger is acute suffering, mostly by people who cannot change anything about it, while obesity is more of an epidemiological problem and can in principle be avoided by eating (or in the case of dependent persons, feeding) less.

Re:The Second Life of Sanskrit on Tuesday July 14, 2026 @08:40PM (#48914816)
> Biblical Hebrew has no vowel markings (well it does, but they are an interpretation), so it cannot be used in daily speech. Modern Hebrew is distinct from Biblical Hebrew

The same can be said about Latin (of which we do not exactly know how they used to pronounce words), or any other language. How to pronounce letters or words is always "interpretation" (or more accurately, tradition).

One more relevant study, but on the health effects of long term melatonin use:

https://newsroom.heart.org/news/long-term-use-of-melatonin-s...

"The main analysis found:

* Among adults with insomnia, those whose electronic health records indicated long-term melatonin use (12 months or more) had about a 90% higher chance of incident heart failure over 5 years compared with matched non-users (4.6% vs. 2.7%, respectively). * There was a similar result (82% higher) when researchers analyzed people who had at least 2 melatonin prescriptions filled at least 90 days apart. (Melatonin is only available by prescription in the United Kingdom.)

A secondary analysis found:

* Participants taking melatonin were nearly 3.5 times as likely to be hospitalized for heart failure when compared to those not taking melatonin (19.0% vs. 6.6%, respectively). * Participants in the melatonin group were nearly twice as likely to die from any cause than those in the non-melatonin group (7.8% vs. 4.3%, respectively) over the 5-year period."

However they were not able to control for severity of the insomnia and used dosage, because that data weren't in the dataset.

Melatonin pills seem to have extremely bad quality control:

"Melatonin content varied from an egregious −83% to +478% of labeled melatonin and 70% had melatonin concentration ≤ 10% of what was claimed. Worse yet, the content of melatonin between lots of the same product varied by as much as 465%.

[...]

The last disturbing finding was more than a quarter of melatonin products contained serotonin, some at potentially significant doses."

https://pmc.ncbi.nlm.nih.gov/articles/PMC5263069/

"In products that contained melatonin, the actual quantity of melatonin ranged from 74% to 347% of the labeled quantity. Twenty-two of 25 products (88%) were inaccurately labeled, and only 3 products (12%) contained a quantity of melatonin that was within ±10% of the declared quantity. [...] Serotonin was not detected in any product."

https://jamanetwork.com/journals/jama/fullarticle/2804077

"Half of the products tested met the label’s claim for melatonin, which means they fell between 76 and 126 percent of the claimed amount. Of the products tested, 20 had between 0 and 76 percent of the labeled content, and 35 had between 126 and 667 percent."

https://www.washingtonpost.com/wellness/2025/06/25/melatonin...

Not an example, but maybe this is interesting for folks who haven't really heard of the peptide business before. https://www.theguardian.com/wellness/2026/feb/05/injectable-...
Re:How, and why, I invented OnlyFans. In 2004 on Wednesday December 17, 2025 @01:03PM (#46303117)
Clickbait title. He didn't invent OnlyFans. He created a similar site which failed.
Re:Mathematics Without Numbers (1959) on Monday December 08, 2025 @09:03AM (#46192319)
I would have liked a summary before reading.

Why is writing a summary a bad thing?

Re:Mathematics Without Numbers (1959) on Monday December 01, 2025 @10:35PM (#46117200)
The article by mathematician John Kemeny, who amongst other things was an assistant to Albert Einstein at the IAS, describes four methods of applying mathematics to problems that are not innately about numbers (algebraic) or space (geometric). He divides the space of such methods firstly into a) not using numbers, b) introducing artificial numbers, and secondly also into using either 1) algebra or 2) geometry.

For geometry not using numbers, he shows how graph theory can be applied to the problem of social balance as defined by psychologist Fritz Heider. This example is based on work by Dorwin Cartwright and Frank Harary.

For algebra not using numbers, he chooses the theory of group actions, and applies it to a way of preventing incestuous relationships that was used in some cultures, which works by assigning each child a group that they are exclusively allowed to marry in. This example is based on work by André Weil and Robert R. Bush.

For geometry using numbers, he uses an adjancency matrix to show how you can find out how many ways there are to send a message from one person to another in a network.

For algebra using numbers, he defines axioms for a distance function for rankings with ties, which can be shown to be unique (probably up to some isomorphy), and which can be used to derive a consensus ranking from a set of rankings. This appears to be the central piece of the article, as that is an example that he developed himself together with J.L. Snell and which was yet to be published.

Re:Why do we need dithering? on Friday November 14, 2025 @09:34AM (#45927069)
Lena Söderberg expressed her wish for her image to be "retired from tech" in 2019 (see the end of this clip, https://vimeo.com/372265771), when the above alternative image was published.
Re:Rust in Android: move fast and fix things on Thursday November 13, 2025 @08:01PM (#45922681)
According to that blog post (https://security.googleblog.com/2024/09/eliminating-memory-s...), the vulnerability density for 5 year old code in Android is 7.4x lower than for new code. If Rust has a 5000 times lower vulnerability density, and if you imagine that 7.4x reduction to repeat itself every 5 years, you would have to "wait" (work on the code) for... about 21 years to get down to the same vulnerability density as new Rust code has. 21 years ago was 2004. Android (2008) didn't even exist yet.

Older »