News for hackers. Stuff that matters.

llui85

Re:Unauthenticated Object Write Vulnerability in MinIO on Sunday April 12, 2026 @12:19AM (#47736120)
MinIO (a widely-used "high-performance, S3 compatible object store" published this advisory, which allows for unauthenticated overwrites of any file.

Their open-source AGPL repository is no longer maintained and no patch has been provided - you must download the closed-source binaries to get the fix.

This is the write up from my first Google vulnerability which exposed a whole bunch of call logs. It was a fun thing to discover and a nice reminder that even Google isn't infallible to these sorts of breaches.
Re:<Blink> and <Marquee> (2020) on Monday June 09, 2025 @09:34AM (#44224378)
I've always used the <plaintext> tag - an unclosable element that converts the rest of the document into raw HTML. It's very obvious.

https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...

    (i) the sole purpose, or a significant purpose, of the service is to enable online social interaction between 2 or more end-users;
    (ii) the service allows end-users to link to, or interact with, some or all of the other end-users;
    (iii) the service allows end-users to post material on the service;
Linked to the legislation in another comment.
https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi... (explanatory memorandum here: https://parlinfo.aph.gov.au/parlInfo/download/legislation/em...)

And the amendment to the first reading which was agreed to today which has the bits about ID verification being disallowed: https://parlinfo.aph.gov.au/parlInfo/download/legislation/am... (supplementary explanatory memorandum here: https://parlinfo.aph.gov.au/parlInfo/download/legislation/em...)

I believe that myID is also explicitly excluded as part of the bill.
Some notes:

* It is illegal for a platform to provide children with a social media account, not for the child to create an account. Circumvention of this by the child is not illegal.

* No grandfathering - all accounts under 16 once this takes effect (which won't be until this time next year at earliest) must be deactivated.

* Maximum fine (per instance?) is 50 million AUD (about 32 million USD)

* The legislation is vague on the technical details, although it does specifically mandate that platforms cannot use government-issued ID of any kind (including digital ID).

Google Authenticator now has an "Export QR code" function that allows exporting the 2FA secrets.
Re:MondayDB: A new in-house data engine from monday.com on Monday October 09, 2023 @07:22AM (#37819186)
Replace medium.com with scribe.rip.
Re:Mappedin – Instant Indoor Maps on Thursday October 05, 2023 @09:40PM (#37786318)

  By making your submission now and hereinafter, you grant us a nonexclusive, perpetual, royalty-free, sublicenseable (through multiple tiers), irrevocable license to use and create derivative works of your materials submitted for any legal purposes whatsoever now known or hereinafter becomes known and you represent to us that you own or have all of the necessary licenses to grant the foregoing.
Tip: In Firefox you can use Ctrl-Shift click to bypass context menu blocking.
Re:The Anti-Ownership eBook Economy on Thursday July 13, 2023 @02:00AM (#36705509)
Interestingly, Kobo and Tolino use (mostly) the same hardware.
Re:Threads hits 5M signups in the first four hours on Wednesday July 05, 2023 @11:48PM (#36610935)
Looks like they're having some performance issues - loading a profile doesn't seem to work:

https://www.threads.net/@zuck

Re:Let us serve you, but don't bring us down on Monday May 29, 2023 @03:48AM (#36111709)
They have a Google Sheets "API" which I've used and works reasonably well:

https://archive.org/services/wayback-gsheets/

The latter:

    An entity violates this prohibition when any of the following OCCURS within the territorial jurisdiction of Montana:
        (a) the operation of tiktok by the company or users; OR
        (b) the option to download the tiktok mobile application by a mobile application store.
The full text of the bill: https://leg.mt.gov/bills/2023/billpdf/SB0419.pdf

IANAL, but the explicit wording of part 1b seems strange. Does this allow the TikTok website to remain in operation? (or would that be covered by 1a still?)

Re:Reverse Engineering the Facebook Messenger API on Friday April 07, 2023 @10:01AM (#35481641)
(2021)
Re:Llama.cpp 30B runs with only 6GB of RAM now on Saturday April 01, 2023 @05:57AM (#35398897)
Difference is that Meta was "publishing" the model to researchers, and one of them leaked it. I suspect OpenAI is a little less likely to share the GPT models around unfortunately...
Re:NYT Worries Big Brother Is Not Watching You on Sunday January 22, 2023 @05:41AM (#34476070)
The NYT essay this article is about: https://archive.is/ZEtfL
Re:Ask HN: Does anybody use the HN hide button? on Monday January 09, 2023 @05:49AM (#34308965)
You might want to take a look at this Safari Extension for userscripts on iOS.

https://github.com/quoid/userscripts

Re:Use a laptop as a 2nd display on Linux using FreeRDP on Friday December 16, 2022 @06:20AM (#34013283)
Unfortunately it still requires a Wi-Fi adapter:

    It is important to note that Miracast over Infrastructure is not a replacement for standard Miracast. Instead, the functionality is complementary, and provides an advantage to users who are part of the enterprise network.

    Discovery requests to identify Miracast receivers can only occur through the Wi-Fi adapter. Once the receivers have been identified, Windows 10 can then attempt the connection to the network.
Re:MuseScore 4 on Wednesday December 14, 2022 @05:44PM (#33991802)
MuseScore has two separate components:

- Musescore.com is run by Muse Group, formerly Ultimate Guitar. This is the sheet music sharing site which has a few controversies with downloading user scores, although this has improved a bit recently.

- Musescore.org is the GPLv3 notation software which they've announced the release for.

Muse is very good at keeping these two parts separated from each other. For example, the new "Muse Sounds" is installed via the closed-source "Muse Hub" (which economically makes sense as providing high-quality samples would be a fruitful business opportunity in the future) through a shared library.

Personally I think that this is a nice balance between maintaining the open-source software and providing features that practically only work with commercial backing - the reason that this could occur so quickly is because it reuses the playback engine and samples from StaffPad (https://www.staffpad.net), one of Muse's acquisitions.

Older »