News for hackers. Stuff that matters.

kevinday

Re:Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming on Tuesday October 20, 2026 @07:59PM (#50174354)
Quick correction to the text above, PHP says the patch/announcement will be available Wednesday, 21 October 2026 at 14:00 UTC.

https://www.php.net/archive/2026.php#2026-10-20-1

In one area I lived in, there were legally defined "noxious weeds". Mostly invasive species that have several undesirable attributes.

One example is Musk Thistle. It grows extremely rapidly, reproduces at a rate that's unbelievable, and is very difficult to kill. In this heavily farmed region, a few of them growing in a roadside ditch can turn into tens/hundreds of thousands of them within a year. Not only do they outcompete just about any other plant including crops, but they have incredibly sharp barbs that injure livestock.

In publicly owned spaces or abandoned fields/lots, the county has people that searches for them and sprays them with a herbicide. If they're spotted on your private land, usually they'll notify you that you have X days to cut them down (before they flower and seed) or they'll come do it whether you want them to or not. Some counties will send a bill for this, some fund it from property taxes.

If you haven't lived in an area where they vigorously grow it sounds like a huge overreaction, but left uncontrolled because one neighbor isn't taking care of it, it can become impossible to keep it out of your yard. According to wikipedia, a single plant can produce 10,000 seeds that disperse through the wind and remain viable for decades in the soil. Even the desire to not have a painful rapidly reproducing weed in your yard aside, they can do incredible damage to cropland.

It's a shame though, it's a kinda pretty flower. Imagine a vivid pink sunflower.

https://en.wikipedia.org/wiki/Carduus_nutans

A bit of alternate history: What if IBM had gone with an ARM instead of x86 for the IBM AT but tried to keep 100% backwards compatibility?

This is an in-browser ARM PC emulator, running an ARM port of MS-DOS 4 with full accurate PC hardware (VGA graphics, Sound Blaster, IDE, etc) and a ton of software ported to a very DOS-like ABI running ARM instructions. Off-the shelf games and applications like Doom, Quake, the GEM desktop and more were ported and recompiled for ARM-DOS.

Clones of many DOS applications were created, like a full Turbo C style IDE (with TinyCC as a compiler) or a pretty extensive QuickBasic like IDE are there.

You can launch TERM (a ProComm like terminal emulator) and dial a BBS, that runs as an entire second ARM-DOS PC in your browser and upload/download things and play door games. There's a second early AOL-like dialup service that lets you access real Wikipedia and Hacker News over the authentic speed modem - and even view images full screen and watch the re-encoded GIFs slowly download.

There's also a full Rosetta-like JIT converter. You can take most stock X86 DOS applications and just run them.

This is part an exploration of 80's PC nostalgia, and part a tech demo of what an IBM ARM PC could have been. Then trying to see how over the top this idea could be taken within the confines of a browser.

https://kevin.day/armdos/ to play with this https://kevin.day/armdos/docs/ for manuals and more info

Re:Proxmox VE now available for ARM64 on Wednesday August 05, 2026 @03:43PM (#49187931)
The Orange Pi 6 Plus is full UEFI and boots things like FreeBSD natively. It's a bit higher end than a Raspberry Pi, but they're definitely in the SBC market. I'd assume they'll work with Proxmox if they support the newish 5G ethernet chips out of the box.
I think people started doing that after one of the Intel SSE examples did it and everyone just copied it.

But on any modern CPU there should be essentially no penalty for doing that now. Testing the full register is basically free as long as you aren't doing a partial write followed by a full read (write AH then read AX), and I don't think there's any case where this could stall on anything newer than a Core 2 era processor. But just replacing that with a "jnc" or whatever you're exactly trying to test for would be less instructions at least. I'd love to see benchmarks though if someone has dug deeper into this than I have.

Re:Anthropic's original take home assignment open sourced on Wednesday January 21, 2026 @04:07PM (#46711569)
I tried GLM-4.7 running locally on a beefy GPU server, in about 3 minutes it got to 25846 cycles, but then struggled in circles for about 90 minutes without making any meaningful progress, making the same mistakes repeatedly and misdiagnosing the cause most of the time. It seems to understand what needs to happen to reach the goal, but keeps failing on the implementation side. It seemed to understand that to beat the target an entirely new approach would be required (it kept leaning towards a wavefront design), but wasn't seeing the solution due to the very limited ISA.
Yeah, I had an issue where Claude was convinced that a sqlite database was corrupt and kept wanting to delete it. It wasn't corrupt, the code using it was just failing to parse the data it was retrieving from it correctly.

I kept telling it to debug the problem, and that I had confirmed that database file was not the problem. It kept trying to rm the file after it noticed the code would recreate it (although with no data, just an empty db). I thought we got past this debate until I wasn't paying enough attention and it added an "rm db.sqlite" line into the Makefile and ran it, since I gave it permission to run "make" and didn't even consider it would edit the Makefile to get around my instructions.

Re:Tonight's restaurant dinner fell off the Sysco truck on Wednesday October 08, 2025 @11:07PM (#45523067)
I just saw a YouTube video on a similar topic, with the host noticing that jalapeno poppers seemed to be the same no matter what restaurant he went to, and then it dives into the struggles of NOT using Sysco as your distributor if you want to have local goods. https://www.youtube.com/watch?v=rXXQTzQXRFc
Re:Refurb Weekend: Silicon Graphics Indigo² Impact 10000 on Sunday September 14, 2025 @08:37AM (#45239357)
In the article you mentioned the Indy having a T1 interface. I only remembered having ISDN as an option on them, with the use case being that ISDN was pretty easily orderable for people working from home or branch offices and needing to get online with it. T1s were still exotic, expensive and not available in a lot of places. Do you have a T1 card for an Indy? I'd love to see that! Do you know what the intention of that was?
https://bugzilla.mozilla.org/show_bug.cgi?id=1910322

for more background. The short story is that when doing CNAME based validation, they were supposed to put an underscore at the start of the random string for you to add to your DNS records. They still generated sufficiently random strings but didn't include a _ before it which is in violation of the RFC. The rationale is that some sites might do something like give you control of yourusername.example.com and they don't want to make it possible for random users to register the random string and be able to manipulate it. If you don't allow users to generate anything that causes a hostname to appear with a leading underscore, they can't pass the domain validation.

https://www.noaa.gov/heritage/stories/cryptogram-in-silk-dre...

This is a slightly better and more detailed version of this story.

Re: on Friday December 29, 2023 @05:17PM (#38810914)
Please renew your Buypass ACME (Go SSL) certificates issued before December 22 12:00, 2023. We have identified an issue within our systems so that these certificates do not comply with certificate issuance requirements. We have corrected the issue, but all still active Buypass ACME (Go SSL) certificates issued before December 22 12:00, 2023 must be revoked.

Renew your affected certificates and install them immediately to ensure that your services continue to be available.

If you need support for the renewal, please comment here on the ACME Community where our staff and Community members will be able to assist.

We apologize for any inconvenience this may cause.

Buypass as

Re:Still no love for WPA3 on the Raspberry Pi 5 on Monday November 06, 2023 @09:18PM (#38172360)
Yes, but you can’t use it if you enable 6ghz according to the 6E specification.
Re:Still no love for WPA3 on the Raspberry Pi 5 on Monday November 06, 2023 @08:45PM (#38172087)
There’s a nuance that I didn’t explain well. WPA2 and 6GHz clients can’t exist together on the same SSID. According to the specification, if you enable 6GHz, the whole network becomes exclusively WPA3. If you enable WPA2, that SSID can’t speak 6GHz. Having new non-WPA3 devices being sold is going to really slow down the adoption of 6GHz, because they can’t coexist. You can’t band steer 6GHz clients to a preferred 6GHz compatible WPA3 only network, it’s up to the user to pick the right SSID.
Re:Still no love for WPA3 on the Raspberry Pi 5 on Monday November 06, 2023 @08:28PM (#38171920)
The problem is that if you enable 6GHz on an existing 2.4/5 GHz SSID, you immediately kick off all WPA2 devices. So you have to create a unique SSID for 6GHz devices to use, which is kinda confusing to end users.
Re:Still no love for WPA3 on the Raspberry Pi 5 on Monday November 06, 2023 @07:59PM (#38171654)
WPA3-only is mandatory if you want to use 6GHz frequencies though. At least for the gear we use, that means if you want 6GHz you either must only have devices that support WPA3 or you have to use a separate SSID for 6GHz clients to use. Fallback to WPA2 isn’t permitted.

I appreciate the sentiment, but new devices being sold that still don’t support WPA3 means the adoption of 6GHz is going to be a very slow process.

More info here since this is surprising to many: https://www.extremenetworks.com/resources/blogs/wireless-sec...

It doesn't bother me either way, but this headline is actually correctly capitalized if you go by either the APA, MLA or Chicago Manual of Style. Headline and media title capitalization is weird.

https://headlinecapitalization.com/

Bash really isn't a standard outside of most Linux distributions, you're going to find the same issue anywhere that isn't Linux.

OpenBSD uses pdksh, Busybox/NetBSD/Minix use ash, there are some linux distros that use zsh, OpenSolaris is ksh, etc.

Re:Broccoli: Syncing faster by syncing less (2020) on Sunday December 12, 2021 @11:59AM (#29531221)
HTTP requires that the length of the content be sent before the content, so that pipelined connections know where the data ends and the next headers start. If you're sending a file directly off disk you know the size before you've even looked at the data so there's no delay. If you're running everything through gzip, you have to wait to compress the entire file before you know the output length, so the critical "time to first byte" metric could get much worse. There are similar issues with dynamic content (CGI scripts, PHP, etc) where both the server and browser would end up buffering large amounts of content before compressing/decompressing them, which also affected perceptual speed. If the connection bandwidth was high enough, skipping all of this and just sending the uncompressed file would appear faster to the user, despite transferring more.

This was later improved with things like chunked encoding and caching the compressed output on the server side, but they came later and weren't always supported or desirable.

This was from 6 months ago. Not that it's right that happened in the first place, but they apologized and fixed it.
Re:SQLite as a Document Database on Friday November 27, 2020 @02:41PM (#25231945)
Just a suggestion: "If you are familiar with Core Data or Realm, Dflat occupies the same space as these two". I'm not familiar with either of these, even a brief description of what this is would be super helpful.

Older »