News for hackers. Stuff that matters.

jmbwell

Re:Anthropic hacked to deliver remote access trojan on Friday October 30, 2026 @09:14AM (#50303425)
I love how LLMs have brought DIY software back. Need an app? Just make it. Like back when you’d write programs in BASIC
Just remember, the morals of someone making an argument have no bearing on whether an argument is sound.

If the purpose of every argument is to prevail, then sure, invoking morals in any discussion can seem like a tactic. Moral hypocrisy can be particularly exhausting.

If the invocation of morals is always evidence of manipulation, though, then any ethical position can be easily dismissed.

Moral hypocrisy is cynical. But that doesn’t erase the value of morals and ethics. Morality, sincerity, and rhetorical effectiveness are still very different things

Re:What I Self-Host on Thursday October 15, 2026 @06:58PM (#50111549)
I’ve been a die hard native package or static binary proponent for a long time. I still hold that there are real advantages.

As podman has improved and compose stacks have improved, I’ve conceded that containers simplify deployment and updates and isolation, and at this point I find for me the benefits more than outweigh the hassles.

Instead of crafting a set of ansible plays that do all the manual native installation steps, I have a relatively lightweight ansible rig that reads containers and relationships desired from a manifest in inventory, then builds or modifies compose files, then just deploys. Much less futzing. And I’m more likely to keep things up to date regularly as a result

Or, increasingly, dispatch codex to handle it for me

In this way I update home assistant across multiple instances now like magic. I don’t even dread it a little anymore

Withings opened my eyes. I’d been using cheap crappy devices that didn’t do much at all. “Upgraded” to withings and holy crap, the new user experience was a complete tour of my personal health data they wanted to ingest and control. I was finding no way to opt out. I couldn’t use the thing until I answered all the questions. It’s clear they’re all-in on vacuuming up data for their own purposes. I went back to a dumb scale and dumb bp cuff. I’d love to have things that automatically connect and record in my software of choice. But you can see what withings feels that costs them. They want you to pay not even to escape their confines, but just to allow your data to go to your own system. This shit has to end
You’re absolutely right about learning languages. Perhaps I should have clarified, don’t speak and aren’t trying to learn.
The article is about conventional broadcast, but if two way is interesting, there’s a great project doing digital over HF in rural areas, particularly South America:

https://www.rhizomatica.org/what-we-do/

Lightweight HF rigs and the Hermes Mercury digital modem:

https://mercury.hermes.radio/

See also, Houston’s Prison Show on KPFT, for messages from friends and families to the incarcerated:

https://theprisonshow.net/

(ETA: Ah, missed reaperducer beat me to it)

Re:Why is every rationalist blog post way too long? on Wednesday October 14, 2026 @06:57PM (#50096710)
It’s not getting better with AI. I’m 100% with the author on wisdom. LLMs don’t seem much to exhibit the benefit of experience in their outputs
When my dad does this it’s mortifying

When I do it though it’s very cool and fun!

Of course I don’t call women “girl” or try to order in languages I don’t speak

Someone commented once about the Trader Joe’s people always flirting with everyone, and a) that’s probably true but b) is just being nice to random people these days so intimate and invasive that it’s equivalent to getting hit on? That would explain people cringing

Re:Passkeys Are Not a Trap on Wednesday October 14, 2026 @06:33PM (#50096425)
I put passkeys in both iCloud and Bitwarden. I count on having access to one or the other, or at least being able to recover access to one or the other, but it’s the same situation with my passwords generally

In fact I quite like having separate passkeys for each manager instead of one password and -maybe- separate TOTPs (usually not) shared between them

Re:Passkeys Are Not a Trap on Wednesday October 14, 2026 @06:30PM (#50096400)
So in my own experience, the same tool I use for TOTP is the one I use for passkeys, suggesting it’s at least possible for passkeys to be as frictionless as TOTP.

On the rare occasion I’m logging into a device that isn’t mine, that doesn’t have my password manager on it, scanning a QR code from a device that does have my password manager on it has been enough to get me in. Without sharing any secrets with the foreign device, incidentally

So I’d wager your concerns are valid and are likely to be addressed over time, as this stuff develops rapidly. It might even be better in your scenarios already

Lately it has been a tap-tap operation to enroll a passkey. Sweetwater.com surprised me with it the other day. I was done in seconds, and now I can log in without even having to enter a code. Face ID handles it for both iCloud Keychain and Bitwarden

See also: the McDonald’s ice cream machines by Taylor, their half assed and overpriced vendor locked in system, the raspberry pi based alternative, and then the ensuing legal and commercial chicanery

The profit motive absolutely favors neglect, and may even punish attempts at reasonable maintenance

Yeah this seems like a decision yielded by a model. One of countless examples of the model’s outputs careening into individually defensible but holistically nonsensical results

A human seems less likely to embark upon a path that most humans know leads to something a human is unlikely to want

LLMs produce amazing things, but only one token at a time. Anything beyond that is retrospectively emergent at best

Re:Passkeys are a trap. Do not use them on Sunday October 11, 2026 @11:03PM (#50050869)
The precedents for a site operator allowing only “approved” software are many. Passkeys doesn’t prevent that, and indeed offers a new way to implement it. The author argues that this is a trap.
Re:What is going on with ceiling fans on Saturday October 03, 2026 @11:25AM (#49945098)
On behalf of my late mother, these look impossible to clean
Re:The US state replacing power plants with home batteries on Tuesday September 29, 2026 @11:00PM (#49903868)
Okay, well, that’s clever for now. The real arbitrage base is pulling is getting in while there’s capital to be raised for it and money to be extracted from the market, before competitors emerge and the incumbents respond and everyone realizes the play all along was to build an enormous battery plant without the expenses of land and compliance and negotiating with producers and carriers. They’re in the buying low phase now.

They’ll sell high when PE buys the company and pulls a Broadcom on all the existing customers, who will abandon the equipment after ten years go back to installing Tri-fuel generators while Centerpoint deals B2B with serious battery plant operators instead of B2C with annoying consumers

Customers running batteries they don’t own to store energy they can’t use for a company that won’t share profits is not the future.

Vermont’s project might be more viable, they’re a little better able to see beyond a spreadsheet up there. California will regulate it into unsustainable price territory. In the meantime finbros in Texas will make a killing having Claude build badass dashboards to show how much they make off bored suburbanites stuck on a grid built and operated as cheaply as possible to take as much money as they can before the useless state government is run out on a rail or finally eats the last bite of its own ass

Since you ask

Re:The US state replacing power plants with home batteries on Tuesday September 29, 2026 @09:22PM (#49903218)
Base power is doing something similar in Texas. AFAICT, they take a loss on the equipment, charge the batteries when electricity prices are cheap, then sell power out of the batteries when prices are high and keep the difference. The homeowner enjoys only most likely having backup power.

I mean, the electricity still has to be generated. That still costs money. This whole thing only works as long as there is someone willing to buy at the high prices and off peak demand stays low enough to keep prices cheap. Eventually there’s no more road to kick this can down.

Re:So long Google, and thanks for all the nudes on Monday September 28, 2026 @03:00PM (#49882808)
AI apps are flooding everything. No doubt they are using or planning to use AI to help manage the load.

And then of course all the apps will use some kind of AI, and because humans don’t care to wade through a trillion tip calculators or whatever, they’ll use AI to pick the app. And then have AI use the app for them through a voice assistant.

Re:Fifteen years later, the Apple Cards origin story on Saturday September 26, 2026 @11:23AM (#49857435)
I was once in a position to relay the sleeping-in-conference rooms situation to such a leader. The tone of surprise, confusion, frustration, and more than faint contempt in his voice as he said “everyone got paid didn’t they?” stays with me

Money solves all their problems, if it doesn’t solve everyone else’s then fuggem

Truly a concrete jungle where dreams are made of
Re:SAML: A Fractal of Bad Design on Wednesday September 23, 2026 @04:52AM (#49813325)
AIUI a “markup” language is for applying structured enhancement to a document containing effectively arbitrary contents. An unstructured source, but we need to add some structured components. Obviously today it has all reverted to a structured document object model, but one of the insights of HTML was, at least in the era of gopher and ftp, the system shouldn’t interfere with the data more than it needs to. If I write up a nicely formatted RFC text file, and I want to put it on the World Wide Web, I shouldn’t have to translate the whole thing to some other language. With HTML, I could, in a structured way that remains independent of the structure of my document, add enough bits to make it work with the World Wide Web. I could, in other words, take my already formatted and structured document, and mark it up with metadata.

At the time this “markup” concept got everyone all excited. But it ended up not being the way to solve problems like what you seem to describe, which don’t have the arbitrary document aspect at all.

Which is exactly my point. Markup and structured data are different. Even at the time of XML’s reign, there were plenty of established ways to serialize and exchange structured data.

Trying to solve a structured data problem with a markup language is how the markup language as a concept got contorted into a data structure system that was simultaneously both too flexible and arbitrary and too maddeningly rigid.

JSON solves it by being a data structure first and last.

Re:SAML: A Fractal of Bad Design on Tuesday September 22, 2026 @04:41PM (#49807785)
It’s such a product of “Ooh! Markup languages! What can we use a markup language to solve!” When authentication is just not a document or data stream that needs marked-up.

The article rightly connects this to XML, which was indeed the hammer to everything’s nail at the time

I think we aren’t done with this problem yet, though. OIDC makes a lot of assumptions in service to Google and others. And tailscale as mentioned, despite “holding the line,” already reveals the cracks when things like GitHub accounts have to be treated differently from others.

What we are missing is a provider-independent way to do this. I should be able to create an account and log in just about anywhere using a backend I control. It can be done, but not with what we have today

Re:A restored PDP-11/83 serving this page on 211BSD Unix on Monday September 21, 2026 @01:12PM (#49790178)
I love it. My PDP-11 has some fault that keeps it blowing fuses. Emulators don’t feel the same. Real hardware doing the work, well done
Re:UFO Series Home Page: "UFO" TV Series from 1970 on Saturday September 19, 2026 @05:08PM (#49770143)
I just watched through this over the summer. It’s a fascinating specimen of a show. I am highly confident much of the Austin Powers aesthetic is borrowed from this, from the featureless suit coats to the everyone-is-mad-sexy to the swinging soundtrack.

It’s a Gerry Anderson production, so lots of great Thunderbirds-style miniatures too. And wild cars. All the action sequences have the delightful feel of an eight year old playing with toys. In fact a lot of it seems to have a fun child’s-idea aspect. “And it’s part submarine and part fighter jet! And they slide down chutes into the cockpit! And his office is a secret elevator! And all the grownups are doing computer things! And to get a whiskey you push a whiskey button! And the whole thing is under a movie studio!”

But god yes, Stryker’s family story is harsh. Way overbearing the trope that he’s such a powerful dedicated man keeping the world safe that his utterly neglected family has to suffer so badly. Particularly when much of the time, he’s standing around the office smoking and drinking and asking the nearest woman to go fetch him some coffee. You thought you were getting a show about high tech futuristic alien defense. Well, you have to watch a lot of office banter too, that’s the deal.

Still, super stylish. And its cousin “Space: 1999” might be more interesting/bonkers sci-fi, but UFO (pronounced YOOFO) is just relentless with the looks and swagger. Each episode is worth watching for the intro alone.

Re:I don't like passkeys on Friday September 18, 2026 @09:53AM (#49754457)
This burden is on the site using passkeys. There should be some equivalent of “My Account > Security > Passkeys > Add Passkey.” There often isn’t, which is an incomplete implementation. And yes it’s frustrating.
Re:I don't like passkeys on Friday September 18, 2026 @09:49AM (#49754408)
I tell people a website is like a payment terminal. Your device is like your debit card. A password is like a PIN on the card. A Passkey is like a chip on the card.

Logging into a site with your device is like putting your card into the terminal. The site can ask for a password the way the terminal asks for a PIN, but if your device supports Passkeys, that’s like your card having a chip, and it’ll use that instead.

So think of Passkeys like using a chip card.

I dunno how well this analogy works down to the last detail but it has gotten it across to all the parents I’ve used it with

Re:I don't like passkeys on Friday September 18, 2026 @09:25AM (#49754082)
So use the recovery codes. Or scan the QR code and auth from another device

I’d buy that there are too many different confusing ways to recover from this situation, but not that it’s impossible

Re:Pkgsrc Is Cool (2022) on Monday September 14, 2026 @08:39AM (#49695855)
Another one of the underdogs I seem to like to pick. I find it so much more elegant than homebrew.

Fight the hegemony!

Thanks for this.
Re:Activation Energy is a good model for a lot of things on Wednesday August 19, 2026 @12:42PM (#49363897)
I’ll explain later

Older »