News for hackers. Stuff that matters.

jonathanstrange

Re:Just a little AI resistance, as a treat on Tuesday November 03, 2026 @09:49AM (#50352702)
I don't care if there is a future where my locally hosted AI assistant is affordable and can deal with all that AI-generated stuff for me. That's actually the future I prefer. My fear is that governments will either outlaw local personal AI or outlaw using AIs to deal with company and government AIs. I want my AI to deal with all bureaucracy, all daily issues that need fixing, all forms to fill out, all signatures to give ("This letter has been written electronically and doesn't need a signature."), all taxes, all phone calls, so I never ever have to personally deal with any of this crap again.
I find this fascinating because many philosophers in the wake of Wittgenstein and Kripke's work on rule following still believe the contrary. I've always thought they're wrong if you take into account constraints of economy (and shared perception, pace Quine), and that e.g. Solomonoff Induction already shows that but I seem to belong to a minority in that respect. It's interesting to see similar ideas of convergence to a unified representation show up in machine learning by neural networks.
Software is insecure in many scenarios because endpoint security is abysmal. Of course, a USB stick with fingerprint reader cannot be secure but there is no way around hardware-based cryptography with independent key entry if you need real security. Then again, this won't help you if the secrets are transferred to the insecure endpoint anyway.
Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Sunday November 01, 2026 @10:34AM (#50326622)
Thanks a lot! I had a similar rule but miscalculated the options header positions. Yours works.
Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @05:59PM (#50320658)
I tried to find a mitigation using a ufw filter that rejects IPv4 packets with too large headers but it didn't work. It broke something essential and I had to switch it off again. I'd be interested in hearing about a temporary mitigation using firewall rules.
That's the problem, though. One of my books costs more than $100 USD and that's even on the cheaper side, and as you rightly point out, I had zero choice or saying in the pricing. Some more established authors can influence it, either by publisher choice or by talking with the acquisition editor but that's rare.

The academic book publishing industry is very predatory, which is why so many authors nowadays support open textbook initiatives.

What I can say with certainty is that in many poorer countries scientific research would be impossible without piracy. Universities just don't have the budgets and libraries are often abysmal (unless you work in the capital and it has a prestige state library).

In my experience, real pirates have a strong code of ethics. I've never seen a pirate site that didn't at least say "buy it if you like it". Leechers are a different story, but to be fair most of them just don't have the money to buy the stuff they download.

To cut a long story short, I'd personally say pirating is bad if you have the money to buy it and you don't just pirate to try first, whereas if you don't have the money it's okay (permissible) and doesn't take away any sales.

Who had this idea? This would have the effect that paid services get more expensive and free services get lower quality, stop working, or become illegal.

Putting that aside, I'd be interested in how they'd want to measure this when in practice network traffic is delivered over all kinds of CDNs and rented servers from who knows where. The technicalities of determining who would have to pay seem very non-trivial to me.

It's still advisable to pretend that it might work, though. Just saying...you've got to think strategically when you work in the national security business.
Re:We're releasing the weights of Mistral Large 4 on Thursday October 29, 2026 @04:42PM (#50295594)
I'll remember that next time someone claims I can't just hack an AI company to get their model, training data and research.
Re:The importance of communities around software on Thursday October 29, 2026 @04:15PM (#50295188)
Give it a few years and nobody will want to run software that hasn't been debugged and hardened by AIs. It's going to be much more thorough than human auditors - it already is, to some extent, and faster anyway, but I'm talking about the future. So it's going to be the latter, complete normalization of AI. You can still write the program by hand, but you'll need AI to make it trustworthy and secure enough, if only because the attackers will also be mostly AI.
It's unobtanium so nobody should care about it. Any frontier AI company can nowadays create models with ridiculous resource and token usage that will get extremely high scores, but they're of no use when you can't use them.

I take this opportunity to give feedback on Argon. The limitations are a problem. I have a Pro subscription and Argon already stops working after 3-4 prompts with long delays afterwards. It's virtually useless right now even when you pay monthly for it. It is better for some tasks than 3.1 Pro, though. Not much in my experience but it can sometimes fix errors that 3.1 has problems with. I never use Flash models since they often give abysmal results.

So I'm stuck with using Gemini Pro 3.1 for now.

Re:Zero click, silent, remote Android DoS on Thursday October 29, 2026 @07:18AM (#50287276)
It seems to me that the scenario is that someone spoofing a cell tower can disable your phone practically forever and recovery requires expert interference. Maybe I'm mistaken, though, it's not clear from the description whether a spoofed cell tower would suffice and whether it needs to remain in the vicinity to repeat the attack often enough or whether sending 200 corrupt SMS messages in one go would suffice.
The Wired article is not about people who violated travel visa. Not at all.
It's marked as an informal disapproving use, so it depends on whether you want to convey this message or not. But Yes, a juror could say "What we had to do was slave labor, we didn't even get proper breaks" and you would perfectly well understand what they said and meant with that message.
"Let's be honest": Why would I care that you care so much that these problems were solved automatically when you yourself don't even seem to be aiming at a better understanding and talk in disrespectful ways about the people who seek a deeper understanding? You could read a book about the history of mathematics, for example Roger Penrose's Road to Reality.
IMHO it makes no sense to admit you don't know what "the credit" means and continue to participate in this discussion. You don't seem to understand the culture and motivation of professors and postdocs doing research level mathematics.
Banning open weight models in the US would provide the rest of the world with a huge business advantage since these models are much more cost-effective than US models.
What exactly do you want to control? What do you want to bring to a halt?

I don't understand your question.

Who cares, it's their choice and probably because they were overwhelmed with LLM-generated project announcements.

I'm aware that being anti-AI is trendy right now, so many people won't like to hear that, but the reality is that it won't take long until the opposite will occur. Projects will get rejected for not having been thoroughly checked by AI, if not written by AI, because purely human development will cause too many security and code quality concerns.

Re:Apple Security Research Device on Saturday October 24, 2026 @01:02PM (#50223108)
It would be a piece of cake to create a device that can be permanently downgraded for the un-tech savvy. It would be interesting to see how many customers would voluntarily choose that mode. My guess is that it would once and for all put Apple's security theater into the graveyard of stupid, annoying, and patronizing ideas where it in my opinion belongs.
My bank pestered me so much to use their app that I eventually caved in. Ironically, they claim it's more secure than normal internet banking from the PC with 2-factor authorization, even though they send the SMS token for in-app transfers to the same phone as the app...it makes no sense.
Presumably "X" and total ignorance about Europe.
Absolutely. That and the lack of accessible and agile VC funding in Europe. No idea why someone would downvote the above comment, it's spot on.
It's certainly wise to diversify as much as possible, a healthy mix of sovereign home-made tech plus US and Chinese tech and from all other countries where it seems fit. The problem right now is the extreme dependence on US tech, such a dependence is always a bad idea no matter what country the tech comes from.
Re:Today, we hacked what we'd set out to hack: the iPhone on Friday October 23, 2026 @01:23PM (#50212436)
It's better to use 0-day exploits to install legitimate software by now. It saves everyone from a lot of hassle. Or, more realistically for most, make a web app and forget about native apps.
Re:Today, we hacked what we'd set out to hack: the iPhone on Friday October 23, 2026 @01:01PM (#50212107)
Not for long now...
Re:Today, we hacked what we'd set out to hack: the iPhone on Friday October 23, 2026 @12:43PM (#50211820)
My dream is to release an iOS app that self-installs and not say anything special about it other than having a "Download for iPhone" button on my website. If someone asked me, I'd answer: "Huh, what do you mean? It's our app for the iPhone."
For the defenders of Google's (and previously Apple's) behavior, I'd like to point out that if any of this was for the sake of security, developer ID certification would be left to an independent international organization and not be under company control. That would also clearly have legal advantages.

That's how it's done with domain names, with security advisories and disclosures, etc. That they don't do it for developers shows that it's about control and anti-competitive business behavior (preventing other app stores).

This is nothing but a business decision to extort money from developers and you know it. It's anti-competitive at its core, locking out other, more reliable app stores and taking control of an open source operating system. It's just one more measure in a long trend of fulfilling the wet dreams of large tech, namely killing personal computing and controlling everything people can do with devices they've bought.

Older »