News for hackers. Stuff that matters.

dist-epoch

Applied calculus doesn't need infinities. No computer can represent a real real number. Only truncations of them, only finite versions of them.
> Many other extremely beneficial devices for extremely high value use cases

If the other use cases are extremely beneficial and extremely high value, surely they can happily pay $1000 for 64 GB of RAM?

And yet the vast majority of physicists treat infinity in the equations as a sign of them being incomplete, and dismiss the possibility of the universe being infinite in any way

I would like to point out that there is no proof of God not existing either

indeed, the purpose of theoretical computer science is as a filtering and ranking mechanism for awarding tenure in universities
Sensible position in a finite universe
Re:Astra can read and write weights to improve Qwen on Monday November 02, 2026 @04:19PM (#50343909)
And yet you ask it 3 times to not do a thing, and it does it in a 4th way. A human doesn't fail in this way. And I'm not talking about memory here, single context.

So yeah, it can do everything, but fails in trivial ways around the doing part.

Re:Astra can read and write weights to improve Qwen on Monday November 02, 2026 @04:17PM (#50343886)
Something like mirror neurons.

Some structures in Astra get activated by the statistics of the Qwen weights, and these structures are associated with "breakout"

Re:Private Jet plane crashes in Florida on Monday November 02, 2026 @03:53PM (#50343577)
there are tiny chip size wireless receivers for small distances like this, you would need some sort of window through the metal, or a tiny antenna inserted through the ball shell and the wireless covers just the inside

or just ultra-thin wires connecting the memory to the outside. the ultra-thin wire will just snap and it's too light to cause damage by whipping around

the big problem is kinetic impact, fire/fuel/water would be easy to solve, for example fire requires oxygen which will have difficulties getting inside through a tiny hole, and I'm sure there is some metal alloy which doesn't melt in typical plane fuel fire temperatures

What about something like a baseball cap instead of glasses? Or some sort of head band?
Re:Pray for Chaos on Monday November 02, 2026 @09:30AM (#50337310)
LLMs are commodity. The ability to run them at scale is not.
Re:Pray for Chaos on Monday November 02, 2026 @09:19AM (#50337161)
> Now what exactly is Anthropic going to do in that world

Dario already said it according to multiple sources: he believes Anthropic will be the last surviving company in the world, where all the value will accumulate

Elon Musk has another vision: his AI is going to build the Dyson swarm around the Sun. Money doesn't matter in that world, only how many robots you have, and how much mass you can put into orbit.

Re:Private Jet plane crashes in Florida on Monday November 02, 2026 @09:02AM (#50336914)
an SD card in foam in a thick metal sphere, like a bowling ball, would survive this, could be used as a backup to the main one.
Re:Private Jet plane crashes in Florida on Monday November 02, 2026 @08:57AM (#50336860)
it was also moving forward, not just downward.
Re:Private Jet plane crashes in Florida on Monday November 02, 2026 @08:56AM (#50336850)
Technically called a wet explosion. Fuel deflagration, not explosive detonation.
Re:So I guess everyone uses LLMs to think now on Sunday November 01, 2026 @06:09PM (#50330851)
> eMudhra. you know, the company who had their CA private key as the number Four. this wasn't found by an ai, but just a human using a old ass library made by google called paranoid_crypto to scan through keys for fun out of curiosity

https://github.com/google/paranoid_crypto

> The goal is to increase the confidence in cryptography use cases inside and outside Google. With Paranoid, any cryptographic artifact can be tested, but its primary motivation is to detect the usage of weak third party hardware or software black boxes.

So google didn't use their own paranoid_crypto lib to check the key before adding it to the Chrome trusted certs.

Re:The question we should all be asking about AI on Sunday November 01, 2026 @09:11AM (#50325879)
> rapidly depreciating assets purchased

GPU's produced in 2020, with a supposedly "3 year life before depreciating to zero" are now sold at twice their price from 2020.

Re:The question we should all be asking about AI on Sunday November 01, 2026 @08:29AM (#50325514)
The only thing that matters is who has the Compute.

I bought a gaming GPU six months ago for running local LLMs, at outrageous price (2x MSRP), and in 6 months it's price doubled again.

AWS already sold all the compute it has planned for 2026, 2027 and 2028.

This is just basic Capitalism - resources eventually get allocated to those who can extract more Profit from them.

Efficient use of Resources for the production of more Capital.

Those with inefficient usage of their resources (gamers and RAM) go bankrupt, and release the resources to those which can extract more Value from the same resources.

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:16PM (#50319701)
Both are correct :)

Anthropic only exploited multipath TCP, but the bug is deeper and also affects TCP connections, but it looks like this path is harder to exploit, and it's unclear if anybody managed to.

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:10PM (#50319649)
> on servers with a multipath TCP listener

I was talking about the Anthropic blog post, only Go/Caddy enable multipath TCP listeners by default.

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:08PM (#50319632)
You have a Wifi network interface and a wired Ethernet one, multipath is somehow combining the two together.
Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:06PM (#50319608)
Those routers probably have 20 other critical un-patched exploits ...

An entire ecosystem of malware crawling and cohabiting in them.

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:04PM (#50319595)
My understanding is that an app explicitly needs to open a "multipath" socket. Go 1.24 does that by default, so does Caddy, these would be the big ones.
Re:We Took over ChatGPT Accounts on Saturday October 31, 2026 @08:45AM (#50315684)
This is a pet peeve of tptacek:

> server-side vulnerabilities are worth very little, because they quickly get patched.

Re:We Took over ChatGPT Accounts on Saturday October 31, 2026 @08:40AM (#50315641)
I wanted to check your website from your profile, but then I remembered your advice. Thanks!, dodged a potential bullet
Somehow all the other apps, including bank apps, do not seem to consider this necessary.

Signal always has excuses, "we can't add usernames because we don't know how to make them secure"

2 years ago when I got a new phone, I had to re-register in both WhatsApp and Signal.

Both send you a code over SMS. I hate giving apps SMS access, so I refuse SMS intercept permission when an app asks for it, and instead I manually enter the received code in the app.

This was possible in WhatsApp, but was not possible in Signal. It won't allow you. You must give it SMS access to read the code. So much for privacy/security/... Only app I use which didn't allow me to manually enter the SMS code.

You seem to be using "formal verification" with a non-standard meaning.

> I feel that when you formally verify one condition, verification of another condition gets weakened

In standard formal verification there is no problem here: you formally verify the composite "condition_1 AND condition_2"

Re:Linode Security Incident on Friday October 30, 2026 @07:42PM (#50311610)
I've lived to see the day when half of the Hacker News front page is about hacks. What a time to be alive.
Re:Linode Security Incident on Friday October 30, 2026 @07:39PM (#50311589)
AI's can decide on the action to open the vault file. It can also prevent TCP connections from unexpected IPs.

Older »