News for hackers. Stuff that matters.

hemlock4593

Re:Official Claude Code extension compromise on Friday October 30, 2026 @11:29AM (#50305325)
It's funny that's the point where people draw the line. But that basically every API based agent is doing RCE where commands are fetched from servers is perfectly fine.
> The security added by this proxy is strictly additive, it can't make things worse

Except if this code contains bugs that lead to another RCE.

> Well, this is why you should point Claude at the repo and ask it if it has any backdoors.

When do people understand that LLMs are no oracles. Just because some LLMs tell you the code is safe or has no backdoor doesn't mean it is true.

Disabled everything except GET requests and hope it holds until 2pm
Re:Omarchy: Any User Process Can Escalate to Root on Sunday August 30, 2026 @03:26PM (#49501935)
Rootless docker is also an option.

> Podman works much better than Docker today.

Nah absolutely not. Especially compose files and networking can be an absolute nightmare with podman.

Re:Omarchy: Any User Process Can Escalate to Root on Sunday August 30, 2026 @03:21PM (#49501903)
*rootfull docker.

Rootless docker is perfectly fine.

Re:Omarchy: Any User Process Can Escalate to Root on Sunday August 30, 2026 @02:26PM (#49501369)
This. Was also super confused when I saw the post. Like every docker guide literally screams at you when you use rootfull docker. Either add yourself to the docker group with `newgrp` for a termimal session or use rootless docker.
Re:GPS and the Lost Art of Getting Lost on Monday August 17, 2026 @06:19AM (#49328725)
> I feel like the article correctly identifies the problems with offloading cognition onto technology

I also observed this with my friends as well. Like we are going by car and a friend is driving 50km/h though there was a 100km/h sign few hundred metres ago. When asking him he responds: "nah google maps says its 50 and I'd rather trust google maps than signs"

Re:GPS and the Lost Art of Getting Lost on Monday August 17, 2026 @05:08AM (#49328181)
And then you have those who still manage to get lost by blindly following GPS and drive thousands of kilometres in the wrong direction: https://e.vnexpress.net/news/tech/tech-news/gps-mistake-send...
Am I stupid or did they literally take down the article right now? Got a 404 after refreshing.
> Is humor that hard to grasp on the internet ?

Problem is that the Internet is too big that there actually could be someone writing this as a serious blog post. For this one it was quite obvious at some point, but when only reading the first few paragraphs I am very certain that there could be someone out there meaning it serious (sadly).

Re:Frontier AI has broken the open CTF format on Sunday May 17, 2026 @02:38AM (#48166550)
Yea, but chess adapted to it and is restricting use of engines. When you play a tournament you are banned from using a phone and will be disqualified if you do so. Online tournaments don't have a prize money for that reason, so there is no real benefit for cheating. Lichess and chess.com additionally add rankings for bots and have a strict anticheat if you use bots for regular games.

For me it feels like this is not really possible for live CTFs. In contrast to chess you can't ban AI, as live CTFs are about breaking things by design, so they'll always try to circumvent an AI ban.

Re:Frontier AI has broken the open CTF format on Saturday May 16, 2026 @05:06PM (#48163815)
I feel the post. For me AI has ruined both, playing CTFs and also building CTFs challenges. The most annoying thing to me is the "yeah idk but here is the flag" mentality.

Before when playing CTFs with my mates was usually sitting there for hours tackling a challenge until some other mate joined, had some look together and solved it with you together in 30 minutes which is the most rewarding learning experience. Nowadays mate joins in throws the clanker on it and solved it in 5 minntes. Asking on how it worked you always get the "yeah idk what it did, but who cares, here is the flag" response.

Same for creating challenges. Whenever I ask for writeups or if some people solved it differently I usually get the "yeah idk, clanker solved that one" response taking the fun out of it.

So yep, this CTF format is definitely dead. Mainly because the strong competitiveness and prices. This encourages people to cheese challenges and sometimes solving them differently was fine as you still had a creative out-of-the-box thinking moment, but nowadays with AI there is no brainpower needed, no cheesing needed, no human needed. As you mentioned, it's pay to win.

My two cents is that the 24/7 CTFs will get more attraction as the scoreboard doesn't matter there and simply doesn't give you any price.

Re:Pricing Changes for GitHub Actions on Tuesday December 16, 2025 @01:20PM (#46292142)
I am just waiting for GitHub starting to charge for API usage ...
Re:Show HN: WhatsApp MCP Server on Monday March 31, 2025 @10:02AM (#43535190)
> WhatsApp was a gamechanger. You could send messages or pictures without having to think about the price of it (While being connected to a WLAN...)

Back, when data plans were around 1GB or less some network providers didn't charge you for using whatsapp on specific plans in Europe. There were also whatsapp branded sim cards, but I haven't seem them for a long time though.

Re:The average college student today on Monday March 31, 2025 @09:49AM (#43535048)
> In one case it acts as a tutor

This can be very useful when you are learning programming.

You don't always have a tutor available and you shouldn't only rely on tutors.

It might be useful when you start learning a new programming language/framework, but you should learn on how to articulate a problem and search for solutions, e.g. going through stackoverflow posts and identify if the post applies and solves your problem.

After a while (took way too long for me) you realize that the best way to solve problems is by looking up the documentation/manpage of a project/programming language/whatever and really try to understand the problem at its core.