News for hackers. Stuff that matters.

kittomic

Re:Tsrs: A Port of TypeScript to Rust on Friday October 23, 2026 @03:29AM (#50205571)
Just input the correct prime number and watch your code compile instantly
Re:There isn't an easy exploit for this PHP vulnerability on Friday October 23, 2026 @03:21AM (#50205504)
Taking websites down to avoid risk is a positive thing that will end if businesses discover they’re losing money due to what is basically a false positive.
Re:Fingerprints Are the New Cookies on Monday October 12, 2026 @12:19PM (#50058632)
I don’t understand why that’s considered legal under GDPR. How can consent be express and informed when it would take 30 minutes just to identify each entity your data is being shared with?

In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”. And it’s 50/50 to see “reject all” even though it is a requirement that denying must be as easy as accepting.

They should pay a bounty for reporting non-compliance.

Re:Why aren't AI companies being charged for hacking? on Monday October 12, 2026 @12:03PM (#50058371)
Ok but what aspect of the CFAA applies a negligence standard?
Re:Why aren't AI companies being charged for hacking? on Monday October 12, 2026 @11:53AM (#50058218)
Negligence and “negligent homicide” are entirely different beasts.

Civil negligence would apply here but that would be limited to recovering damages.

The hacked website could sue to recover costs incurred, but what costs were incurred here? Maybe some wasted network bandwidth but that’s minimal.

You have to point to monetary losses caused by the hack. Only that would be covered.

Negligent homicide doesn’t apply because no one was killed.

GDPR, CCPA, and such laws absolutely do treat stuff like MAC addresses and network topology as legally protected information.
Re:Dave W Plummer: "AI Cloning should be illegal" on Wednesday October 07, 2026 @05:45PM (#49999221)
The legal protection for an actually novel process is a patent, not copyright.
> What matters, he said, is whether the product is great and whether people want to pay for it. If they do, he said, founders can find the funding.

News flash: funding is easy when you’re profitable.

But I do think he’s generally correct. Of course there’s a quantum of VC funding that is only possible in California but that’s focusing on the 1%. There’s plenty of VC in EU now.

Re:Ask HN: Is this the beginning of the end of open source? on Wednesday October 07, 2026 @03:31PM (#49997691)
That’s very sector dependent.

Most of my clients want a tech stack that is FOSS to the greatest extent possible since the cost of vendor lock-in can be crippling.

Explicit legal guarantees yes for sure, enterprise will pay for “FOSS as a service” since that comes with SLA’s and means they don’t need or don’t need as large an internal platform team.

But a system of systems composed of MIT and Apache-2.0 components… it might sound ironic but that commands a premium when it’s a proposal for a large enterprise. You’re giving them the guarantee that they can walk away if they want to and you can charge for that.

Re:Ask HN: What will be the next AI wave? on Wednesday October 07, 2026 @03:25PM (#49997617)
Probably models on ASIC, and also smaller models becoming increasingly viable. Both leading the next next and next AI waves as some variant of Moore’s law takes hold.
Re:Meta and Microsoft Limit Employee Use of Claude AI Tools on Wednesday October 07, 2026 @03:21PM (#49997550)
Should they pay for their pipelines too?

After all, they should know how to compile their software. Any automation of that process is cheating their employer.

Re:Neanderthals Were Adept Woodworkers Too on Wednesday October 07, 2026 @02:43PM (#49997074)
It’s cool to see the research but was this not already a known fact?

Eg it’s known they had Stone Age technology and prepared spear tips etc by flaking stone. I assumed that it was assumed those spear tips went on the end of a stick.

I think if you’re human-reviewing all the output of AI, then you’re going to hit the human comprehension bottleneck.

The key is to have clear specs and clear architecture, and then have agents enforce this.

I devote most of my time to specs and much more of my time to e2e and integration tests.

I find a lot of value, even more value than before, in strictly hexagonal designs and even a large does of DDD.

Following these principles, it’s relatively easy to design systems of systems that decompose to domains that decompose into use cases / ports / adapters.

By the time you’ve decomposed to this level, AI is very capable and it’s easy to review or verify by tests. I am very comfortable with AI verifying if a basic CRUD port is functional, for example, because at this point each operation becomes less than a dozen lines of code.

Stop thinking of yourself as a programmer and start thinking of yourself as an architect.

The key rule is that decomposition of a problem into smaller problems is what wins. This was always true, extremely true before AI and extremely true with AI.

Focus your individual effort on the top-level decompositions and let AI handle the lower-level decompositions. Trust AI to test the lower-level and make sure you test the higher levels.

Re:Ask HN: Tell me SaaS idea for domain name samewindow.com on Monday October 05, 2026 @04:08PM (#49969948)
Multiple users in the same browser window.

Like remote-access for tech support, but lighter and less exposed.

Someone is having issues with the website? Samewindow.com allows support or their collaborators to use the same browser window.

Browse together with samewindow.

Re:Looking for Help on Monday October 05, 2026 @04:01PM (#49969849)
Learn Linux.

Learn code.

Write a web server. Run it on Linux.

Make it available to the world.

You’ll learn quickly.

Re: on Monday October 05, 2026 @03:08PM (#49969085)
I’d rather be in the US, absolutely no question about it.

But does Iran need to suffer less than the USA to win here?

The stakes for Iran and its regime are survival. They’ll suffer a lot of pain if it means staying alive and in power.

The stakes for the US are a lot less than survival, as a nation or as a regime.

Iran doesn’t need to make the US suffer more than Iran can bear. Iran needs to make the US suffer more than the US can bear.

That’s empirically false

It’s an idea that can be checked, empirically, and it has been.

There are studies of patch releases that show patch releases introduce new bugs _only_ 15-25% of the time.

Which is not a small failure rate, sure, but that still means that a priori you are much more likely to become less vulnerable by blindly installing patches than by blindly not installing patches.