News for hackers. Stuff that matters.

jiveturkey

Re:We Took over ChatGPT Accounts on Saturday October 31, 2026 @04:45PM (#50320014)
Hex aka Parameter is an irresponsible company, on my blacklist. after they did an unsolicited pentest on us, we scheduled a call. joke of a team.

hilarious that their headline message, on every web page, is `Backed by YC`.

also, the product is way behind their competitors anyway.

really cool exploit they found here, but that doesn't make them a company worth doing business with.

Re:The $6.3B Binance Hack Was Pulled Off in Just 20 Minutes on Saturday October 31, 2026 @03:12PM (#50319105)
Absolutely. It would be insane for the US to offer my specific example. I'm just making the point that China (and Russia, but I didn't give an example) can do something. Their hands aren't tied.
Re:The $6.3B Binance Hack Was Pulled Off in Just 20 Minutes on Saturday October 31, 2026 @02:39AM (#50313773)
https://en.wikipedia.org/wiki/Detention_of_Michael_Spavor_an...

China absolutely could do something if they wanted to. No treaty just means they aren't obligated to "do something", not that they can't. For example, if the US wanted to reinstate the $800 no tariff policy in exchange for Vernon, I guarantee you they'd arrest him and turn him over.

I can't find any reference to Vernon's citizenship, ie if he is a Chinese citizen or not. Which would change the math.

Re:Quad9 (DNS Resolver) to Exit France on Thursday October 22, 2026 @12:58PM (#50198060)
how do they not see the self-inconsistency?

they "cannot" blacklist the domains on geoIP basis, yet the "can" withdraw from France? via what method? Removing the French servers is clearly insufficient, so why can they deny France entirely via geoIP, but not block the domains just via geoIP?

they do claim a value-based reason (good on them for it), but they are very very insistent about the "impossibility" anyway. can't have it both ways.

Re:The DNS Museum on Monday October 19, 2026 @01:26AM (#50148688)
the site has an example of this. https://dns.museum/exhibits/blogging-via-dns
Re:Wanted to download an ISO, ended up writing a kernel exploit on Thursday October 15, 2026 @02:22PM (#50107963)
Cursing at it and telling it how stupid it is, are treating it like a human being ...
Re:Passkeys Are Not a Trap on Wednesday October 14, 2026 @01:27PM (#50091431)
I personally find it to be a disgusting way to get customers. The company pays for the service, yet they also get to be the product.
Re:Character.ai files for Chapter 11 bankruptcy on Tuesday October 13, 2026 @02:43PM (#50076590)
commonly called HALO - Hire And License Out
Re:Mozilla Introduces Firefox Enterprise on Tuesday October 13, 2026 @02:39PM (#50076520)
if you are air-gapped, any browser should be fine?
Re:GLM-Legal: Advancing Agentic Legal Intelligence on Tuesday October 13, 2026 @12:47AM (#50066855)
the lawyer has to use a ZDR tier of LLM, not just any llm. the lawyer using the same LLM as the client would, destroys the attorney-client privilege.

note that the client using an enterprise tier does not grant the same privilege.

Re:The Lightbulb Computer on Saturday October 10, 2026 @07:48PM (#50038295)
> The light bulb form factor is cute but probably not that useful. Most of the light will be aimed in non-useful directions. Look into ultra short throw projectors.

gonna hard disagree! you aren't going to have 360° projector in there with wasted light going nowhere. you're going to have 1-4 steerable projectors. the "facade" as a globe bulb means you can place it at any direction you like depending on where the cord needs to go. for ceiling as well you don't want it to have a fixed throw direction. bulb makes perfect sense.

Re:How California Closed the Montana License Plate Loophole on Tuesday October 06, 2026 @11:38PM (#49987815)
the summary presented by the drive feels like an overreach. but we live in the world of can't have nice things so there you go i guess.

i doubt there's all that many beneficial owners of montana businesses that live in california, but surely there are many nevadans and oregonians that straddle the border and will get unfairly caught up in this.

Re:How California Closed the Montana License Plate Loophole on Tuesday October 06, 2026 @11:31PM (#49987773)
you don't even have to be rich. it's not much more onerous than a generic small business. i know more than one 2-car-inventory dealerships.

but it's only worth the effort if you are rich enough to buy cars that incur substantial tax and reg fees. you still need to have insurance and the dealership kind of insurance costs a lot. you probably aren't going to get umbrella coverage to include it either, so you'll have more limited liability.

it's tongue in cheek
Re:New PlayStation 5 Console Jailbreak Released on Tuesday September 29, 2026 @02:30PM (#49898175)
they aren't in the business of selling consoles (duh). they are in the business of selling games. jailbroken consoles can run pirated games ...

consoles are sold at a loss, best information i can dig up is that this is still true today, even after all the volume.

> services that can be used for amplification attacks, are they constantly getting patched to prevent the latest iteration of attack type?

unfortunately, no.

is it? i would write a sentence like this on my own. i guess informed by the thousands (or hundreds, at least) of PMs I have read or contributed to. the same material LLMs would have trained on.
indeed, this (A vs CNAME) is nonsense. I applaud this provider's transparency but they missed a 4th gap: inadequate network security expertise. Two of the 3 gaps identified are perhaps not baseline but they are well understood hygiene. They shouldn't have had to learn these things as a result of an incident. (the 1st gap, not monitoring customer network blocks, is very understandable and i find no fault there.)

and then up the stack a bit, they are confused about DNS' role in attack mitigation, at least generally speaking. perhaps there is something specific to their own DNS setup where this made a difference. they should just strike that part of the PM entirely.

that said, their reaction time is amazing. this would have included live troubleshooting during an ongoing incident! criticism aside, i wouldn't hesitate to use them if I wanted EU service.

Re:Real-time feedback: My closing move in every interview on Sunday September 27, 2026 @01:17AM (#49863571)
seems quite stilted.

instead of "i'd like to give some feedback, may I?" at the end, the interviewer should just ask the damn question in real time. "that description is very high level. that is great for an external summary, when the decision is already made and you want to communicate, not discuss. so i appreciate that. can you go into more detail and justify your choices, as if for an audience of peers and for discussion?"

a good interview should be an interactive exercise, not a one way explanation from the candidate. even LC/DSA type rounds should always find the candidate asking for clarifications, asking if they are on the right track is this what you are looking for, should i be attacking this a different way, etc.

and i would never give unsolicited positive feedback. even when you are the final decision maker, other rounds may uncover weak spots and there may not be a consensus to hire. by giving the positive feedback you confuse the candidate and make a no-hire result even worse. leave it to the recuiter/HR to do that.

as an interviewer i always mention whether i will recommend them for hire (if it's a yes) and that's it. iff asked i provide critical feedback. as a candidate i always ask for critical feedback, which gives me the chance to sharpen any answer when the interviewer doesn't do a good job on asking for what they really wanted.

Re:Obscura: The first VPN that can't log your activity on Wednesday September 23, 2026 @12:51PM (#49818987)
vp.net is far from first, and is hot garbage.
inkjet printers to not print the tracking dots. it's laser printers that do it.
Re:Shutting down our public encrypted DNS on Saturday September 05, 2026 @12:31PM (#49578145)
Even ECH isn't that helpful. ISP still sees the IP addresses you connect to. Even when non-dedicated IPs are used, I'd be surprised if a quite basic traffic analysis (say, bytes transferred on first visit) wouldn't identify the domain.

VPN providers at the tier of Mullvad should be precise about this stuff -- I think it's more than just a nitpick, considering the audience. oh god did I just use an emdash.

Note that you need some flavor of secure DNS to enforce ECH. The protocol is designed to be downgradable.

and there's a goddam ad at the start of every apple TV show, and macOS forces ads on you via the SETTINGS app! (both such ads are for other apple products ... still, it's an ad)
What's to prevent Apple from making iOS and macOS free to "copy, redistribute, and modify"? The OS is free already, and the platform does cryptographic signature verification before allowing its installation. macOS already automatically finds local caching servers, which amounts to redistribution capability baked in.

They can just claim that the user is free to turn off SIP and "modify" the binary bits, or that kernel extensions amount to modification.

I think you're misreading it. It doesn't ban Linux from providing age collection and verification. It makes it a choice, rather than mandatory.

I would expect that Linux users want access to age-verified apps just as much as other users, so such a signal will be available.

Also, you're being overly pedantic on the language used. It transfers liability away from the service, more easily allowing operation in about half of the states. "age verification" is a fine lay description.

Re:iCloud+ Hide My Email addresses will remain on icloud.com on Tuesday August 25, 2026 @12:56AM (#49429254)
But all 3 of those use cases, plus privacy, can be addressed with [email protected]. So you may as well get the privacy bit in there.
> all APs identify as the same BSSID, and decide between them who answers a client

That is decidedly not a solution. Neighboring APs necessarily need to be on different channels, to avoid Co-Channel Interference (CCI). An AP doesn't answer just on BSSID but also on a specific channel.

Re:Georgia police officers fired after Flock camera misuse on Sunday August 09, 2026 @05:58PM (#49236510)
> weren’t authorized

this is easily solved with current technology, if they had an incentive to do so.

besides firing folks that get caught, flock themselves should be brought to court.

Re:A domain can now say it is for sale, in DNS on Saturday August 08, 2026 @10:44PM (#49227944)
I've recently bought many domains (1000+ over the last year). A few of them (the more valuable ones) all had TXT records for `@` (the root) that had for-sale info. This new record is just a TXT record anyway, proving the point that the interested buyer can quite easily learn of a domain for sale with existing mechanisms.

Also, for domains that are just "parked", not in current use, obviously the parking page can just have a for-sale banner. This is exceedingly common.

> Enquiries that would have been welcome never arrive, and the ones that do arrive are indistinguishable from spam.

Laughable misrepresentation.

Older »