News for hackers. Stuff that matters.

eurleif

Now deleted, and replaced with: https://x.com/dok2001/status/2112802620029223193

"Cloudflare has protections in place for known exploit payloads. There will be more variations to come and the only way to fully protect your site is to update php once released."

Is this LLM output? It's not supported by your source, which only says that activating the hazard lights is permissible, not that pulling over is impermissible. In fact, your source says: "We note that Subaru indicates that when the driver is unable or unwilling to take control of the vehicle, the system will bring the vehicle to a stop. A vehicle system that stops a vehicle directly in a roadway might, depending on the circumstances, be considered to contain a safety-related defect, i.e., it may present an unreasonable risk of an accident occurring or of death and injury in an accident."
HW4 vehicles with recent FSD software will pull over to the shoulder, activate hazard lights, and stop if the driver becomes incapacitated: https://www.youtube.com/watch?v=VKFlQz0qNwU

But the OP says this driver's car was model year 2020, which makes it HW3. All versions of FSD for HW3 (including 14.1 lite, the latest version, which came out after this incident) will stop in the lane with hazards on: https://x.com/JonBbC_TechGeek/status/2086347029018501183

With all due respect to Steve, under 1 minute isn't that impressive. You can get there just by doing the beginner's method (a handful of different move-sequences) rapidly. The people who really study Rubik's Cube algorithms in depth can do it in a few seconds.
>melatonin should be consumed in doses an order of magnitude smaller than the smallest available dosage.

It's available on Amazon in doses as low as 100mcg: https://www.amazon.com/dp/B08MJL2GTC Are you saying this because you believe the correct dose is on the order of double-digit mcg, or because you're under the impression that the lowest available dose is single-digit mg?

Re:Apple is getting this wrong on Tuesday August 04, 2026 @02:29AM (#49164972)
>They now admit that their outside lawyers emailed the wrong person after confusing two Asian last names—only after we brought this to their attention.

I find it bizarre that they felt the need to specify "Asian". What does that have to do with anything?

Show HN: Crack Attack game vibe-ported to run in browser

https://leifkb.github.io/crack-attack-browser/

Crack Attack! is a classic open source puzzle game that's included in many Linux distro repositories. I first played it around 20 years ago, and I've been hooked since.I wanted to see if an LLM could port it to run in the browser. I suggested recompiling it with Emscripten, but the LLM decided to rewrite it in TypeScript instead, using the original code as a reference. I had to prompt it a...

( Read More... | no comments | on HN )
Netcraft confirms it...
You seem to have the restrictiveness backwards? The MIT license (uutils coreutils) is less restrictive than the GPL (GNU coreutils), and the AGPL is more restrictive than the PostgreSQL license.

And it doesn't violate the PostgreSQL license to license the rewrite more restrictively. That's part of what makes MIT-style licenses less restrictive than the GPL or AGPL: they allow for more-restrictive relicensing.

The GP seems to be describing "auto hold", which is a different feature from hill start assist, and is newer and less prevalent.
Re:The bottleneck might be the air in the room on Saturday July 04, 2026 @08:32PM (#48790277)
I had to drive a rental car for a bit recently, after getting rear-ended, and I was shocked to discover that it defaulted to recirculation mode every time it was turned on, regardless of whether you'd turned it off the previous time. I felt light-headed in it a few times before I realized I needed to manually turn recirculation off every time. Horrible behavior, and I don't doubt that it's responsible for many accidents.
Re:Costco Is the Anti-Amazon on Saturday July 04, 2026 @12:52AM (#48782723)
>In Florida, driving up through Georgia, the billboard advertisements start 200 miles away.

There's even a billboard 979 miles away in Arizona: https://stock.adobe.com/images/eloy-az-nov-23-2024-buc-ee-s-...

Re:Is Sunscreen the New Margarine? on Tuesday June 30, 2026 @05:09PM (#48739225)
It looks like the "Skin Damage Over Time" chart is the same information as the timer.
Re:Is Sunscreen the New Margarine? on Monday June 29, 2026 @07:24PM (#48726650)
It would be useful to have an option to change the time of day, rather than always using the current time; e.g. for planning at night what to do tomorrow.
Re:Developers don't understand CORS (2019) on Sunday June 21, 2026 @04:30AM (#48616848)
To go even deeper into the weeds: this is only true of "simple" requests[0]. Requests that aren't "simple" always require preflight approval. This is based on which requests a <form> or link could already create without approval; since the dawn of time, <form method="post"> could submit a potentially-destructive request, and sites needed to protect themselves against that via XSRF tokens; so CORS could allow submiting the same class of requests without preflight approval, and not introduce any new attacks. But there's no <form method="delete">, for example, so CORS would have created attacks against previously-secure sites if it had allowed DELETE requests without preflight approval.

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...

Re:Developers don't understand CORS (2019) on Sunday June 21, 2026 @03:56AM (#48616658)
The part you may be missing is that cookies exist.

User visits A.com, types in their username and password, and a cookie is set in their browser. The browser will send that cookie back to A.com with all subsequent requests, and A.com's server will use it to enable access to the user's account.

Now the user visits B.com, which makes a request to A.com/private_user_data. The user's cookie is sent with this request, so A.com will respond with (and B.com will receive) the user's private data without the user consenting to this at all (not even in a "misguided" way).

Re:Court Records Should Be Free on Friday June 19, 2026 @05:40PM (#48603575)
At least within the federal court system, binding precedent is already freely available. Only circuit courts and SCOTUS can create binding precedent, and the opinions of those courts are freely available on their respective sites, outside of PACER. E.g., here's the 9th circuit: https://www.ca9.uscourts.gov/decisions/opinions/
Re:On The <dl> on Saturday May 23, 2026 @01:40PM (#48249539)
Have you looked into using an unofficial ONT instead of the one supplied by your ISP? See: https://pon.wiki/guides/install-the-8311-community-firmware-...
Re:Notepad++ for Mac – Independent community port on Sunday April 26, 2026 @11:33PM (#47917450)
>Notepad++ name itself is trademarked by Don Ho

Is it? I can't find a trademark registration on the USPTO site.

Re:PHP 8.6 Closure Optimizations on Thursday April 16, 2026 @12:25PM (#47795783)
The part that would violate guarantees in JavaScript is not function objects being kept alive longer, but function objects which should be distinct not being so.

    function foo() {
        return function() { };
    }
    console.log(foo() === foo()); // This must log `false` in a compliant implementation
Re:Google Broke Its Promise to Me. Now ICE Has My Data on Wednesday April 15, 2026 @03:08PM (#47783737)
The linked Google policy states:

>We won’t give notice when legally prohibited under the terms of the request.

The post states that his lawyer has reviewed the subpoena, but doesn't mention whether or not it contained a non-disclosure order. That's an important detail to address if the claim is that Google acted against its own policy.

    Running 100,000 `SELECT 1` queries:
    PostgreSQL (localhost): 2.84 seconds
    PostgreSQL (Unix socket): 1.93 seconds
    SQLite (in-memory): 0.07 seconds
    SQLite (tempfile): 0.06 seconds
(https://gist.github.com/leifkb/b940b8cdd8e0432cc58670bbc0c33...)
The original claim being discussed is about the overhead of an in-process database vs. a database server in a separate process, not about whether SQLite or PostgreSQL have a faster database engine.
Because it doesn't make a difference, because `SELECT 1` doesn't need to touch the database:

    Running 100,000 `SELECT 1` queries:
    PostgreSQL (localhost): 2.71 seconds
    SQLite (in-memory): 0.07 seconds
    SQLite (tempfile): 0.07 seconds
(https://gist.github.com/leifkb/d8778422d450d9a3f103ed43258cc...)
Looks like the overhead is not insignificant:

    Running 100,000 `SELECT 1` queries:
    PostgreSQL (localhost): 2.77 seconds
    SQLite (in-memory): 0.07 seconds
(https://gist.github.com/leifkb/1ad16a741fd061216f074aedf1eca...)
Re:California sues websites hosting 3D printed gun files on Monday March 09, 2026 @08:40PM (#47317769)
>A blatant violation of both the first and second amendment.

That defense didn't do too well in another case: https://www.courthousenews.com/third-circuit-backs-new-jerse...

A very long time ago, I had the idea to set up a joke site advertising "SpamZero, the world's best spam filter", with a bunch of hype about how it never, ever misses spam. When you clicked the download link, the joke would be revealed: you would get a file consisting of `function isSpam(msg) { return true; }`.

Apparently that's not a joke anymore?!

Re:Windows 11 Notepad to support Markdown on Wednesday February 25, 2026 @11:43PM (#47161946)
The documentation doesn't make this entirely clear, but I think these are two separate things: the original `edit` command which is built into Windows 11 (and has been built into prior Windows releases), and a replacement written in Rust that can optionally be installed.

Note that my link is dated 2023, whereas Wikipedia says that Microsoft Edit was first released in 2025: https://en.wikipedia.org/wiki/MS-DOS_Editor

Older »