News for hackers. Stuff that matters.

innocent_name

What part of it isn't open source?
Trump derangement syndrome aside, you think those Yandex search bots are somehow being used in trollfarms? Mind sharing a proof?
>data centers are dual use technologies now and valid military targets

proclaimed by who? Even the "international order" would disagree, as Yandex Cloud wasn't providing their services to any military companies per my knowledge.

Yandex Cloud was bombed symmetrically. Ukraine made no attempt in targeting MSK-IX, which could be a real military target.

Re:Shipping JPEG XL in Chrome on Wednesday October 07, 2026 @08:15AM (#49991691)
Wasn't it due to poor security? libjxl had notorious bugs that would've on par with webp exploit, if present in browser:

https://security.snyk.io/vuln/?search=libjxl

I remember Project Zero cautioning Google's browser team against adding insecure decoders/encoders.

Re:Web Search API on Monday October 05, 2026 @01:06PM (#49967498)
Of course Firecrawl isn't "Verified bot". Their customers were responsible for 95% of my traffic bill overcharge.
Re:5x faster Edge Functions: V8 isolates to Firecracker MicroVMs on Wednesday September 30, 2026 @06:11PM (#49915154)
https://unikraft.com/blog/netlify-edge-functions and https://slicervm.com/ both using the lookalike slop design template made me to believe it was a shadowy unikraft project lol.
Re:Jensen Huang says AI distillation is 'competition.' on Monday September 28, 2026 @11:43AM (#49879840)
Yes, see ROCm.
Re:Jensen Huang says AI distillation is 'competition.' on Monday September 28, 2026 @11:42AM (#49879814)
>he doesn't think kids should learn their multiplication tables

He said „The majority of the kids shouldn't learn”, not everybody. I listened to that pod and was under the impression that he wants to be portrayed as a "grounded" person and i didn't find his takes to be out of touch.

Ask your llm, scroll through some meme pages!

https://x.com/MemesOfNixOS/status/1942271466894217321

NixOS is toxic and we all know it, hence the decision. Just show us the last attempts of govt. structures trying to be nice towards nix.
Re:Radicle: Disclosure of Vulnerability in the Network Protocol on Wednesday September 23, 2026 @06:51PM (#49823721)
>this should help camouflage the traffic

How? QUIC is easy to fingerprint and flow classificate:

https://datatracker.ietf.org/doc/html/rfc9000#section-12.1

Speaking of bold claims, Iroh, just like Radicle, are overselling themselves:

>iroh's QUIC multipath implementation automatically switches between Wi-Fi, cellular, ethernet, LAN, LoRa, HaLow, Tor, Bluetooth—or bring your own transport.

The thing is, QUIC multipath isn't standardized.

Re:Radicle: Disclosure of Vulnerability in the Network Protocol on Wednesday September 23, 2026 @06:41PM (#49823616)
I don't think the consumer ecosystem is mature yet.

Adding a cert to my Android phone was a huge pain in the ass. Most homelab apps like Jellyfin don't support it. The homelab space is so buck broken it assumes i don't have a public IP address to just expose things without going through the convoluted VPN setup.

Re:VSCode's SSH Agent Is Bananas (2025) on Wednesday September 23, 2026 @06:04PM (#49823213)
Moreover, it explicitly breaks in VSCodium and no good alternatives exist.
Re:Backups Aren't Simple on Wednesday September 16, 2026 @07:57PM (#49734697)
>Borg ... fantastic

I needed to temporarily move off 20TB from my NAS and bought a Hetzner storage box.

I wanted to encrypt the data before sending it so i went with the borg ssh mount. Long story short, borg failed a couple of times due to https://github.com/borgbackup/borg/issues/7672, i resumed it per documentation and got 2gb of silently corrupted data. There was no way to do data integrity checks due to broken pipes and there was no option to resume the job from the previous point either. I couldn't afford to go with the s3, backblaze wasn't an option due to placing trust into their proprietary client doing the encryption and i got majorly screwed in the end.

Re:Backups Aren't Simple on Wednesday September 16, 2026 @07:40PM (#49734552)
>Motivated by our success in developing this solution, we try to use it to backup the homelab with its 10 Docker containers. But later we find out from logs on the individual machines that backups are failing. The reason being that many Docker containers like to create root-owned files, and if you’re not careful you can create a cronjob running as the default user.

and a privesc also.

Re:The case against JPEG XL on Monday September 14, 2026 @09:31PM (#49706615)
Oh, i left the wrong quotation whereas i intended to reply to another message. Throughout the blogpost you're quality matching and comparing encoders based on objective metrics whereas it'd be more telling to get the crowd subjective comparisons. I think it's pretty evident that most codecs benchmaxx to the point of objective metrics being useless.
Re:The case against JPEG XL on Monday September 14, 2026 @04:12PM (#49703252)
>Even still, the demo proves that AVIF can deliver a usable image with up to 3x as fewer bytes as JXL!

I was taught to be skeptical of objective benchmarks; Why should we trust them when people are benchmaxxing?

https://habr.com/en/articles/700726/

Re:The case against JPEG XL on Monday September 14, 2026 @03:52PM (#49702956)
>Maybe a lossless re-encoding of my website JPEGs to gain 20% size is not worth the 33%

I was unpleasantly surprised when jxl's reference encoder dropped critical exif tags for no reason whatsoever from my personal archives. Turns out their lossless preset wasn't really lossless.

And then webp to JXL conversion also produced different viewing experience results as ffmpeg's webp decoder wasn't handling ICC correctly.

I'm now very cautious of any "lossless" re-encodes.

>they compulsively send useless requests

Those requests aren't useless; They clearly optimize. What a silly take.

>to your servers

To their customer's servers, right! Most people turn on other CF optimizations like h2/h3 to origin.

Re:Another way to leak traffic on Android has been discovered on Saturday September 12, 2026 @02:37PM (#49675632)
>There is no update the GitHub issue for 2 weeks except for deleting a comment by the reporter yesterday.

Yeah, i was very confused by that, especially after they invited them to post publicly/privately. They love controlling the public communications when it comes to researchers. I remember ryrona, a guy who found VPN leaks, being censored for no reason whatsoever in their public GitHub issue tracker.

Re:Forgejo <=16.0.3 Critical RCE on Friday September 11, 2026 @01:33PM (#49662178)
I alluded to business needs, not homelabs. Even-so, GitLab has a helmchart while Forgejo doesn't and is seemingly more secure so idk.
Re:Forgejo <=16.0.3 Critical RCE on Thursday September 10, 2026 @02:18PM (#49648113)
The opex and security fine costs of moving off managed services like GitHub/GitLab are catching up.
Re:Tell HN: OpenAI keeps re-enabling the 'allow training' setting on Thursday September 10, 2026 @12:02PM (#49645993)
Let's not down vote a factually correct comment that makes you emotionally disagree with me. I'm very concerned in regards to my privacy, I've studied ToS of: Openrouter, Anthropic, Anthropic business, opencode Go etc. I've double checked my understandings by GDPR exporting all my data. Anthropic sub listed a generic "logged in from Linux", "UA", "timestamp", "Country". That's it.

I want to discuss actual facts, observations and not your shallow social signaling replies of 0 value.

Re:Tell HN: OpenAI keeps re-enabling the 'allow training' setting on Thursday September 10, 2026 @11:48AM (#49645768)
AFAIK, the court held that the problem was that they had acquired books by pirating them, not that they trained an AI on those books. They do train on user generated data by default, but you can opt out, that's the whole point.
Re:Tell HN: OpenAI keeps re-enabling the 'allow training' setting on Thursday September 10, 2026 @11:44AM (#49645709)
User doesn't understand how public links indexing works.
Re:Tell HN: OpenAI keeps re-enabling the 'allow training' setting on Thursday September 10, 2026 @11:21AM (#49645302)
I do trust Anthropic, i haven't observed them doing super shady stuff like hiding the training consent page and making you WAIT for it to activate.
Re:QBittorrent breaks out of sandbox to commit crimes on Sunday September 06, 2026 @11:21AM (#49587373)
it's funny to see the very same pro piracy, pro AI edgelords suddenly getting all riled up against the alleged copyright infringements. I remember a socialistic coworker of mine—that was bragging about his -arr setup—talking about the end of the culture because authors aren't earning money.
I don't see how Nvidia's obviously superior offering is dying.
Re:Play Store blocks AuroraStore, hurting GrapheneOS users on Tuesday September 01, 2026 @04:09PM (#49527424)
>For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else.

Like my personal phone?)

Installing Google Play service is in itself a privacy downgrade.

>I226-V

I hate this piece of shit with a passion. But hey, at least they gatekeep the worst kinds of firmware updates in their OEM pages!

https://github.com/BillyCurtis/Intel-I226-V-NVM-Firmware

I'm honestly surprised Intel doesn't provide do fwupd crate, it's such a blow to their reputation considering how popular 22x NICs are in Mini PCs and even ASRock mobos

Older »