News for hackers. Stuff that matters.

dvdkon

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Sunday November 01, 2026 @06:10AM (#50324499)
I certainly know people who run NixOS in commercial production. It's hardly "clownware".
> I suspect that hardware without an MMU is not super likely to be able to support XIP.

This seems strange to me. Don't most microcontrollers support executing directly from flash? Some even can't execute from RAM.

Though I agree with the main point, you can compile code as "PIC" - position independent code, and not bother with (ELF) relocations except for linking.

Sorry, it's you. You basically told people that they should expect bugs in old code and shot down the proposed fix without offering any other solution; that's non-constructive by definition.
Re:Danish Government silently drops plan to dump MS Office on Sunday October 25, 2026 @11:31AM (#50232644)
Sure, I don't want to take their right to appeal, and I only make that comment as a neutral observer. This is my smallest issue with the process, the discriminatory requirements are a bigger problem.
Re:Danish Government silently drops plan to dump MS Office on Sunday October 25, 2026 @03:17AM (#50229096)
It should be about features and price, but those only matter after you clear the bar. At least in the Czech Republic, you can't bullshit your way through the requirements like you can with job interviews, these things are actually checked.

Also here you can't sue directly, you can file a complaint with the oversight bureau, which regularly happens just because a competitor is mad at not being selected, but that's a different problem...

Re:Danish Government silently drops plan to dump MS Office on Saturday October 24, 2026 @04:54PM (#50225164)
I'd sign up for tenders, but they all seem to require a company with "1 million EUR revenue in public sector <whatever> projects" and 5 people with various roles, degrees and X years of experience in <whatever>.

I'm just a freelancer with FLOSS experience and some commercial experience, and so are plenty other FLOSS contributors. Nobody's going to create a company and hire staff just to have a chance at getting selected in the one tender a year that allows outsiders in.

The idea might be that only companies which have already proven themselves elsewhere can enter, but 1) then why the "public sector work revenue" requirement? And 2) that's not going to work for industries where government interest is much larger than private interest, like FLOSS.

But I suppose governments prefer the certainty that Accenture or local equivalents bring - a price an order of magnitude too high for a mediocre result and a 25% chance that the project will be fucked up and shelved, over the uncertainty of a small startup, who could either deliver something great, or overexert themselves and not finish at all...

Re:GitLab CVSS 10.0 Integer Overflow issue on Wednesday October 21, 2026 @05:30PM (#50187948)
As far as I can tell, it requires forcing GitLab to render a malicious org-mode file. I don't really see a way to do that without authenticating and uploading one. Am I missing something?
Re:PHP2Shell: AI uncovers critical RCE in PHP on Wednesday October 21, 2026 @12:36PM (#50183763)
Nextcloud, the mentioned Roundcube, plenty non-Wordpress CMSs, many internal tools I work with daily...
Re:Upcoming Critical PHP Security Release on Wednesday October 21, 2026 @10:29AM (#50181647)
There's also this writeup: https://www.wiz.io/blog/php2shell-php-rce

It seems to have a few more technical details.

Re:Upcoming Critical PHP Security Release on Wednesday October 21, 2026 @05:20AM (#50177981)
I tried it too in a clean Debian Trixie container and got no crash.
Re:So You Think You Could Be an Electrician? on Sunday October 04, 2026 @04:05AM (#49951708)
You don't need formal education to have agreeable political opinions and write good polemics.
The GPL is the only reason they even get that. More enforcement would certainly be good, but it's not like the GPL is worthless without a legal team backing you up.
Re:A 386 PC for Your RP2350 on Monday September 14, 2026 @07:09AM (#49694939)
It's really cool what can be done today with just an MCU that has sufficiently flexible IO. What's the performance like?
Re:Make your first edit to OpenStreetMap on Saturday September 12, 2026 @05:51PM (#49677568)
I'm not too concerned about my place of residence, since the state already publishes my full address online. But OSM edit history also shows the various places you visit, with timestamps too. I still haven't decided if I want to do something about that or not. It's certainly something new contributors should be aware of.
Re:So you want to use OpenRouter? on Friday September 11, 2026 @01:07PM (#49661750)
If you're making a commercial SaaS, that's probably the way to go. For individual users like me, with a coding harness and some extra BYOK tools, OpenRouter is convenient and the few extra percent don't hurt much. I appreciate being able to try out any new model with just an ID swap, same with inference providers when they prices change. I know I wouldn't enjoy managing 5+ accounts, each with their own balance, in 3+ tools, so this is one thing I'm happy to outsource.
Re:Copyright does more harm than good and should be abolished on Wednesday September 09, 2026 @07:14AM (#49624572)
From my understanding what's keeping us from this kind of dystopia are restrictions on shrinkwrap agreements, general restrictions on one-sided contracts, and the fact that breach of contract "only" creates civil and not criminal (like copyright) liability.
Re:Copyright does more harm than good and should be abolished on Wednesday September 09, 2026 @07:03AM (#49624472)
I don't have any numbers on fan art vs original works floating around the web, but even those original works aren't being monetised via copyright. They would be created even if copyright was abolished or significantly weakened.
Re:Copyright does more harm than good and should be abolished on Wednesday September 09, 2026 @06:55AM (#49624406)
> There are murders so why make it illegal.....

The downsides of murder clearly outweigh the upsides. The fact that we're debating here shows that's not the case for copyright.

> ...somebody having the rights to a cartoon mouse in perpetuity isn't actually holding society back is it?

People want to adapt that mouse into their own works, as they have done with stories since stories started being told. They do so even if they know they're breaking the law. That alone should be reason to reconsider copyright.

We all stand on the shoulders of giants, and reusing facets of modern stories isn't somehow less creative than reusing old stories or reusing lived experiences. You can take the general story beats of a popular work, strip out all copyrightable elements, and end up with something wholly derivative. You can also build on a known work and end up with something that's fresh, creative, maybe something that engages readers/watchers/listeners of the base work in a way that nothing fully original could. Take Harry Potter and the Methods of Rationality; it clearly reuses another work's characters and setting, but it would be worse off without it.

Re:Copyright does more harm than good and should be abolished on Wednesday September 09, 2026 @06:32AM (#49624220)
> You're free to buy or not buy any creative work.

You also don't have to rent/buy a place to live, but I wouldn't want to live a life without a roof over my head or access to creative works of my culture. When you accept that access to media is a necessity (and people today do treat it as such, just try finding someone who doesn't listen to music, watch videos, read books...), you clearly see that having copyright is a decision made by the state that results in wealth transfer from every citizen to authors and publishers.

Those authors/publishers do provide value, so it's not necessarily a bad thing, but as with every market intervention, the specifics need to be carefully considered.

Re:Copyright does more harm than good and should be abolished on Wednesday September 09, 2026 @05:49AM (#49623826)
You could establish contracts with publishers outside of copyright, which is how NDAs work today. It's probably a reasonable thing to do anyway, otherwise there's nothing stopping a publisher from telling everyone the plot summary of your newest novel.
Re:Copyright does more harm than good and should be abolished on Wednesday September 09, 2026 @05:27AM (#49623674)
As others have pointed out, piracy is already easy for anything remotely popular, yet people still buy books. We could assume that it's not because they fear breaking the law, but because they want to support the author and have an "authentic" copy.

There are also other models than creating a work without any income, then recouping that cost by a state-granted monopoly. You can release preview chapters and then solicit donations from interested readers. You can build on your reputation and then promise to finish the book later for some up-front payment. These might not work for everyone, but they are in wide use today. One could argue that removing options for those authors that depend on copyright today is still a reasonable price to pay for removing all the abuses of copyright.

Re:Copyright does more harm than good and should be abolished on Wednesday September 09, 2026 @05:12AM (#49623557)
Most of that art is being created irrespective of copyright, though. Much of it uses exceptions to copyright and some is straight up in violation (most "fan art"/fanfiction). It's either not monetised or monetised through things like Patreon.

I wouldn't say we have more "traditional" art that an author spends time creating with the vision of selling copies for years to come, than we did when copyright terms were shorter.

Re:A/I shuts down – Stay human on Sunday September 06, 2026 @06:06PM (#49591425)
Theoretical aphorisms can't override the facts of recorded history. If the harsh border control and cultural isolation of the East Bloc ran counter to Marxist principles, then you can complain to the dead leaders of the USSR, but that's about it.
Re:A/I shuts down – Stay human on Sunday September 06, 2026 @04:35PM (#49590636)
It is strange. I certainly wouldn't think your house, having been isolated from western society over decades by a communist regime and heavily-patrolled borders, would respond to social activism in foreign countries. But maybe there's just some secret house mycelium for sharing progressive ideas that I don't know about.
Re:A/I shuts down – Stay human on Sunday September 06, 2026 @01:07PM (#49588548)
I don't remember any LGBTQI+ wars here in the Czech Republic, so "blood free" actually seems like a good characterisation. Sometimes the system just works.

See also the Velvet Revolution for a pretty large shift away from totalitarianism without any deaths.

Re:Actively exploited sandbox RCE in all Chromium versions on Saturday September 05, 2026 @04:09AM (#49574279)
Not always. Consider an SPA that connects via WebSockets and streams in data, adding points to a chart. The JS-less alternative would be refreshing an SVG or even the whole page once a second. The SPA is clearly more efficient here (unless someone screws it up badly).
Sadly complexity is unavoidable for most real-world usecases. Just see how so many people interested in de-Googled phones balk at the prospect of losing access to banking apps. Telling them to go use an OS that doesn't support Bluetooth isn't going to work, but hopefully you wouldn't say that means they should give up all hope of security.

Abstraction has served us well in managing complexity before. I wouldn't abandon it out of misplaced idealism.

Re:How Europe is killing makers and micro-entrepreneurs on Tuesday August 25, 2026 @08:08AM (#49432537)
> pay bureaucrats with your consumer's money

Once the consumer has paid, it's your money now. The incentive is clear, less packaging means more money you keep. That only big producers will actually see the per-ton payments as significant instead of just having to pay absurd registration fees is a separate issue.

Re:How Europe is killing makers and micro-entrepreneurs on Tuesday August 25, 2026 @07:45AM (#49432280)
The right thing to do is not to sweep him under a rug because "there's only a few such gypsies", but to look at what he's doing and say "yes, this is what we want to ban". Being a in minority is not a shield from consequences, but it shouldn't be a reason for dismissal either.

In the case of the 3-EUR-tariff, nobody has come out and said "we want to make small electronics production/repair untenable", so I'm optimistically assuming its effects are not intentional.

Re:How Europe is killing makers and micro-entrepreneurs on Tuesday August 25, 2026 @07:11AM (#49431901)
What does "positive market incentives" mean for you? My immediate thought is various subsidies, but given how those usually end up (easy money for companies spending more on lawyers than actual productive work), I'd much rather just have a tax.

Older »