News for hackers. Stuff that matters.

jorams

Re:The $6.3B Binance Hack Was Pulled Off in Just 20 Minutes on Saturday October 31, 2026 @11:38AM (#50317165)
> If it was so easy to exfiltrate crypto from them, I'd have expected a heist before now.

FWIW in 2022 one of their systems was breached and $570 million worth of "BNB" was taken.

Re:Steal My Bitcoin CTF PoC on Tuesday October 27, 2026 @05:10PM (#50265849)
Not GP, but both. Exploiting the bug requires you to hit the same worker with multiple requests, which gets a lot easier if the number of workers is 1.
Re:Is this the new cyber normal? on Saturday October 24, 2026 @03:32PM (#50224334)
There was definitely another shift earlier this year. Previousy there were cyber attacks, cyber threats, cyber defenses, cyber crime, but the field and the subject matter was cyber security, not just "cyber". The security part could just be covered by the associated word, or by a military context. A "cyber sleuth" was still just someone doing research "in cyberspace".

That seems to have changed this year as part of AI marketing. AI models have "cyber capabilities", or are described as being "good at cyber". Anthropic announced a "cyber mission" and has a "cyber verification program". I saw a company referred to as a "cyber firm".

A cynical explanation could be that this is because it's pure marketing, and the full term risks diluting the message. If you keep mentioning "security" people might notice the actions don't line up with the presentation.

Re:Google Data Centers around the world on Monday October 12, 2026 @06:50AM (#50054446)
Yes. Some Google Cloud zones are in Google's own data centers and some are in third-party data centers. I vaguely remember them at some point also listing those third-party data centers somewhere, but I can't find it now and might be misremembering.
Sure, I know the reference, but "equal speech" is not a thing the Tor Project claims to defend so adapting it makes no sense.
Not sure what this is supposed to say; free speech != equal speech.
Re:"They had no concept of a duty of care to their users." on Sunday September 27, 2026 @05:45PM (#49871182)
Unless something changed very recently neither vim nor neovim defaults to storing persistent undo files in ~/.cache. It's application state, not cached data.

The undodir option in vim defaults to the directory of the file, and in neovim it defaults to ~/.local/state/nvim/undo/.

Re:The American Religion of Self-Storage Facilities on Friday September 18, 2026 @02:59AM (#49750985)
Yes.
Re:EuroBirdPortal – Live bird movements across Europe on Monday September 14, 2026 @08:08AM (#49695491)
They're calling it "live" and "near real-time" because they're aggregating the data from underlying sources daily, whereas traditionally that happened only on much larger time scales.

It's not very fast compared to most things often called "live", so perhaps it's not a great label for this demo viewer, but the goal of the project seems to be to make the data available for research, not so much for this map.

Re:Google no longer provides direct URLs in search results on Saturday September 12, 2026 @04:53AM (#49670400)
> I’m pretty sure Kagi’s entire pitch is that they’re an alternate and original dataset. Theirs is the only search engine whose data isn’t based upon google or bing’s databases.

It's not. In addition to their own indexes the results include calls to "all major search result providers worldwide"[1].

There are independent search engines that only use their own index, like Mojeek[1]. Kagi is explicitly something like a search engine aggregator.

[1]: https://help.kagi.com/kagi/search-details/search-sources.htm... [2]: https://www.mojeek.com/

Re:Codefloe Is a Professionally Hosted Public Git Forge on Monday August 24, 2026 @04:07PM (#49425174)
> Performance is similar to when I self-host Forgejo on a dedicated VPS where I'm the only user, which is super fast.

I don't mean to be negative, but that's probably because it's pretty much the same thing. Codefloe is tiny. Some quick counting shows it has a grand total of 1012 registered users, including bots, and 1416 public repositories of which the top 3 with the most stars (I know this is a mostly meaningless metric, but for scale) have 27, 13, and 8. It's too small to run into scaling issues.

Re:I hate packaging my software for Linux on Wednesday August 12, 2026 @12:44PM (#49275216)
If they're not using your software they're not your users.

You seem to be treating this like a commercial endeavor in which you have much to gain from adoption by nontechnical people. I don't really see why though. It looks like you're developing non-commercial open source software for an audience of developers.

You are taking on the responsibility of being compatible with a large variety of different people's opinions on how software should be built, configured, and distributed. Yes that's a lot of work. Distributions have people willing to do that work for software they or their users (who can ask) care about.

Re:I hate packaging my software for Linux on Wednesday August 12, 2026 @08:29AM (#49271364)
The reason this seems so weirdly hard is that you're not supposed to be doing it. You provide sources and instructions on how to build them, and then your job is done. Users can follow those instructions. If you want to you can also build a binary with an old version of libc and distribute that to help users who don't want to compile it themselves.

Packaging it for a distro is someone else's job, and they'll take care of concerns like Debian's dependency policy. If they want to package it in the first place of course.

Re:Dropbox is an obvious PE Target? on Wednesday August 12, 2026 @06:00AM (#49269992)
Box.net launched first, but they didn't introduce file synchronization, the core value proposition of Dropbox, until mid 2010.
Re:Reviving a four year old reMarkable 2 on Sunday August 09, 2026 @09:18AM (#49231135)
> woah 4 years is considered obsolete?

No, this device was only discontinued this year, you can still buy accessories and it still receives software updates.

It just turns out their software has flaws that break the update process after a few years of sitting unused. Not great, but luckily there are workarounds, as this article walks you through.

It's https://rachelbythebay.com/ and doesn't seem to be down.
Re:The Difference Between a Button and a Link on Wednesday July 29, 2026 @05:36AM (#49095203)
While I understand and perhaps even agree with the semantic argument, the reality of the web is that this will be abused. A sane implementation for a browser would be for an action button with method="get" to get basically all of the affordances a normal link has, e.g. middle click, context menu actions. Sites already exist that hide navigation behind non-links. Now they need to write JS to make that happen, which is at least a bit of a deterrent.

The proposal actually fully treats this as desirable:

> When web authors style links to look like buttons, they inherit the responsibility to make links behave like buttons in all possible contexts.

No, they don't. A web author that works to disable core functionality for links should be fired into the sun, not given easier tools to do so. If your action is really just a navigation, then the user should have the ability to treat it as such.

Re:Steel Bank Common Lisp version 2.6.7 on Tuesday July 28, 2026 @04:45PM (#49089692)
SBCL works fine on Windows. It used to display a warning about fragility at startup, but that was removed in version 2.0.3, 6 years ago, after already being obsolete for quite a while.

CCL isn't very actively maintained and currently doesn't have an ARM64 port, but otherwise continues to work fine. I believe one reason people use it is that it compiles a bit faster than SBCL, at least in part by doing less optimization.

Re:Securing Services with Rootless Containers on Tuesday July 28, 2026 @02:33AM (#49080161)
Have you tried podman with the crun OCI runtime and `--annotation=run.oci.handler=krun`?
Re:Turn And Face The Strange on Saturday July 25, 2026 @06:15PM (#49052211)
Yeah that seems like a weird way to end an article that includes this paragraph:

> Fly Machines and our Platform As A Service features aren’t going anywhere. But Sprites was the product of a tiny skeleton crew inside of Fly.io[†], and now it isn’t.

So it's both indeed.

Re:Jellyfin founder Andrew leaves team on Tuesday July 21, 2026 @01:04AM (#48988231)
> As far as Jellyfin is concerned, your files must include a tag of the form S__E__ somewhere in the filename. Being located in a folder called "Season 2" with names like "11 - name of episode" won't work.

I mean, I've got many like that and yes it does work. `s01/01 - Pilot.mkv` is recognized as season 1, episode 1, etc.

> There is meta-programming with annotations:

There is, but your example is not valid. You can't use short function syntax in constant expressions, it has to be an explicit `static function`.

The reason for this, IIRC (I can't find the GitHub issue or PR atm) is that these functions aren't allowed to close over any variables, and with fn syntax doing so is implicit. Rather than erroring they've disallowed the use of arrow functions entirely.

Re:Funny item co-occurrences in 3.2M Instacart orders on Saturday July 18, 2026 @03:39PM (#48961514)
> So what happens if we look only at small carts, where the entire order is just 2 or 3 items?

How is this the last thing in the article? The sole example given of a "funny" combination (apples and condoms, weirdly bad example) is only remotely funny because those are the only items.

> Blank the page immediately with "document.body.innerHTML=''" before the page replacement

That's what the "document.body.style.opacity = 0;" is for. Though I agree emptying out the body is probably better.

> Every post about programming languages seems to mention Rust. Even C++ articles bring up Rust, and Zig articles bring up Rust.

"Even C++" makes no sense. That's exactly where you'd expect it to be mentioned because Rust is pretty much aiming to be a C++ replacement. Mentions in the context of Zig also make sense, because Zig is aiming to be a C replacement in the same way Rust is aiming for C++, and C/C++ are overlapping areas.

You don't see much mention of Rust in discussions about something like Lua, because those are very distinct.

Some other reasons you might see it mentioned fairly often: Rust solves some issues at compile time that many languages solve at runtime using GC, making lower level programming more approachable for high level programmers and broadening its target audience. It has also had extremely active evangelists all over the place for a very long time, causing not mentioning it to trigger annoying derailment of discussions.

Re:My Thoughts on the Bun Rust Rewrite on Thursday July 09, 2026 @01:01PM (#48849028)
> Anyway, let's try to discuss something more technical:

I'll note that this is followed by an entirely non-technical statement of opinion.

The company seems to be primarily in Germany (Aachen), with headquarters/holding company just across the border in The Netherlands (10km away in Lemiers, right on the border). That region is pretty economically integrated and I believe setups like this are fairly common to make use of the "business climate" of The Netherlands. Think taxes but also less bureaucracy. It looks like at least one of the founders also studied in Maastricht.
You call it "boring advertising on consumer apps", but that's exactly where all the shady stuff keeps happening.
Re:We moved our Bluesky data to Eurosky on Tuesday June 30, 2026 @12:40PM (#48735319)
A private company doing DARPA-funded research.
Re:Elastic lays off 7% of employees on Thursday June 25, 2026 @02:01AM (#48669546)
There's really only a conflict between A and the rest, and that's because A is a lie. It's not a good thing, if it were they wouldn't have to say B and C.

They can try to do better and be hopeful, but they also fucked up big time. It's not like the public actually believes the lie, so stop telling it.

Older »