News for hackers. Stuff that matters.

fowl2

Telco networks are sprawling and accurately defining the boundary might be harder than it sounds.

Traditionally they have a bias towards "working"/delivering traffic. It's easier to issue a refund than answer a urgent support request.

I can also imagine the biggest customers have all sorts of multi-vendor failover plans that may be affected.

I wonder if the next obvious attack - 2 pushes in rapid succession, one to show and one to hide - has been handled. The browser should debounce and replace the notification with a notice instead of hiding if it’s removed too quickly. Human time scales.

Also no mention of Firefox in the article ;(

It might be possible to create/use some app compatibility shims:

https://techcommunity.microsoft.com/t5/ask-the-performance-t...

https://learn.microsoft.com/en-us/previous-versions/windows/...

Given that Windows 11 isn't that different from Windows 10, I assume the app compatibility toolkit can be coaxed to work.

Or, more excitingly, probably more versatile in the longer term, and a pile of hacks upon hacks, it might be possible to run in the browser with the likes of jslinux + wine.

eg. https://github.com/lrusso/WinAppRunner or https://github.com/DustinBrett/daedalOS

If you get that working, that'd be really exciting.

Re:The Future for Tyr, a Rust GPU Driver for Arm Mali Hardware on Thursday February 12, 2026 @08:05PM (#46997619)
Windows already does, so you’re talking about the BSDs or Darwin?
So:

1. Apple froze the Safari user agent in iOS 26 to be the same as iOS 18.6, so stats websites are reporting under-reporting.

AND

2. Apple is for some reason rolling out/'recommending'/'pushing' automatic updates in iOS 26 than in previous releases.

Yeah wow! Even most "trusted" contributors shouldn't have this level of access. Is there really no way of scoping tokens with more granularity?
I was thinking more for communicating the “mass disruption in progress” message - or even just distributing the manually verified “traffic lights down” data between vehicles.
I wonder if the cars also have some sort of mesh (LoRaWAN?) network to help each other out in temporary dead zones, emergencies, etc.
Re:Exchange Online Mailbox Audit Logs "On" might not mean "On" on Wednesday December 17, 2025 @08:03PM (#46307786)
> When you run Get-Mailbox -Identity <MailboxIdentity> | Format-List AuditEnabled, the AuditEnabled property always displays as True. This hardcoded display value doesn't reflect the actual mailbox-level audit configuration.

> To verify the actual mailbox audit status, use the Filter parameter in the following command: PowerShell

> Get-Mailbox -Identity <MailboxIdentity> -Filter "AuditEnabled -eq 'True'"| Format-List

> If the command returns the mailbox object, mailbox-level auditing is enabled. If the command returns an error stating the object couldn't be found, mailbox-level auditing is disabled.

https://learn.microsoft.com/en-us/purview/audit-mailboxes?so...

Would really benefit from some more technical details. I wonder if they rolled this out to client/Windows 11 first for some lower stakes testing.
Re:Unifying Wikipedia mobile and desktop domains on Wednesday November 26, 2025 @01:09AM (#46054635)
Incredible that no one from Google noticed this as a regression from their side and either put a workaround in or contacted Wikimedia.
Re:K8s with 1M Nodes on Sunday October 19, 2025 @12:54AM (#45632138)
Interestingly the public of Azure’s etcd-compatible service was withdrawn before exiting preview.

[1] https://learn.microsoft.com/en-us/answers/questions/154061/a...

Seems like there’s a few places Postgres could benefit from some more consistency checks.
Re:Silencing Firefox's Chattiness for Web App Testing on Tuesday May 27, 2025 @11:57PM (#44112617)
(kinda) suprised there isn't environment variable to do this all in one go.

Many of these can definitely be set/automated using policies.json[1]

[1] https://support.mozilla.org/en-US/kb/customizing-firefox-usi...

Suprised no one has mentioned RFC 8914 Extended DNS Errors, specifically section 4.17[1]:

> 4.17. Extended DNS Error Code 16 - Censored

> The server is unable to respond to the request because the domain is on a blocklist due to an external requirement imposed by an entity other than the operator of the server resolving or forwarding the query. Note that how the imposed policy is applied is irrelevant (in-band DNS filtering, court order, etc.).

Which would be relevant for Google DNS's "Query refused" at least. Although I guess it's possible maybe they do support it but Windows/Chromium don't...

[1] https://www.rfc-editor.org/rfc/rfc8914.html#section-4.17

Binary compatibility is necessarily at odds with the “recompile the world” philosophy. This global view has some advantages, eg. performance can be improved system wide LTO, calling conventions changes, security with hardening options, etc.

The local view, where a program with no knowledge of its runtime environment could appear at any time to a runtime environment that similarly knows nothing about a program, loses all those advantages and costs added constraints but gains.. the ability to run those programs.

The article argues that the balance should be shifted, to their (eventual) benefit, sure. I wonder how long until that would take.

I wonder if there’s more “pay for play” path. I guess that’s containers. Or maybe what they argue for but bundled software could stay the way it is now. Further bifurcation seems bad, adding more code paths to test etc.

Re:Microsoft Go 1.24 FIPS changes on Tuesday February 18, 2025 @01:09AM (#43086560)
Presumably there's some reason Go can't just use an embedded manifest[1] like everyone else?

Ahh, I'm inferring (from [2]) even with the manifest entry, a system wide registry key is also required to get long paths working:

> I'm working with the Windows security team to find a way to enable long path support without having to modify the registry, just by using the embedded manifest, but the chances of this happening soon are quite low.

[1] https://learn.microsoft.com/en-us/windows/win32/fileio/maxim... [2] https://github.com/golang/go/issues/69853

Re:I helped fix sleep-wake hangs on Linux with AMD GPUs on Monday February 17, 2025 @10:22PM (#43085757)
Oh wow didn't really expect anything other than whole device loss. Just returning garbage does sound bad.

Do you know if they tried to communicate with clients and were just ignored/not implemented or if the APIs just don't support it?

A quick search indicates that "residency"[1] exists, but no idea the extent it's useful/implemented.

[1] https://learn.microsoft.com/en-us/windows/win32/direct3d12/r...

Re:I helped fix sleep-wake hangs on Linux with AMD GPUs on Monday February 17, 2025 @08:30PM (#43085146)
I guess "hibernating" (writing VRAM to swap) works better than expecting userspace to gracefully handle device resets. One linear read vs. a thundering herd of processes re-initialising, decompressing, etc. should be more predictable/reliable at least.

I do wonder however how much VRAM is "volatile" - ie. framebuffers - and could just be thrown away. And web browsers seem to handle GPU resets just fine, so maybe they could opt-in?

A seemingly coordinated release with the nominally independent FerretDb? What’s the relationship here?
Re:You don't have to pay the Microsoft 365 price increase on Saturday January 11, 2025 @12:05AM (#42663458)
Huh. Apparently the “current plan without AI” is $20 more expensive than “current plan”. Guess I’m grandfathered or something.
Re:CFPB finalizes personal financial data rights rule on Friday November 01, 2024 @03:29AM (#42014758)
Wonder how this compares with the Consumer Data Right in Australia. The standards and discussions around them are right there on GitHub [1] - pretty surreal seeing accounts for the big banks. Of course it's mostly completely useless for anything DIY as semi-understandably access to any real data is gated behind certification requirements.

[1] https://consumerdatastandardsaustralia.github.io/standards/#...

Re:Eighteen Years of ABI Stability on Friday November 01, 2024 @03:22AM (#42014726)
There is a distinction in the dotnet world too. The docs[1] seem to refer to ABI as "Binary compatibility" and API "Source compatibility".

Jon Skeet has some good examples [2]

[1] https://learn.microsoft.com/en-us/dotnet/core/compatibility/... [2] https://codeblog.jonskeet.uk/2018/04/13/backward-compatibili...

Re:Rails 8: It's more fun to be competent [video] on Friday September 27, 2024 @10:24PM (#41677395)
Anyone have a textual version?

Older »