lossolo
lossolo on Hacker News
> you only need to replace the compute board
"Only" is doing a lot of heavy lifting here, considering that this compute board makes up the majority of the cost. And if they start going with bigger designs, like they’re doing now (compute in memory, custom TPUs etc), then even this won't hold.
> If you want to do an upgrade that increases power use, you may have to get a new rack.
Blackwell to Rubin upgrade is exactly that case.
3x3U 110 kW units vs the 8×1U 33 kW shelves typical in GB300 NVL72, power whip rating rises to 100A from 60A, rack coolant flow doubles versus GB300, and both compute and NVSwitch trays are fanless, 190-230 kW per rack depending on power mode vs about 140 kW for GB300 NVL72 and NVLink switching is new too etc
And where is your source about buyback program? I found no Nvidia trade in or buyback program for data center hardware. Used gear is resold through third parties, ITAD vendors like Procurri and Bitpro buy and resell used GPUs from hyperscalers, and resellers like Alta Technologies sell refurbished units with warranties.
The closest real thing is a financing arrangement announced in August where Nvidia partnered with Apollo, BlackRock, Blackstone, and others and in SOME CASES may provide residual value support for up to 25% of an opportunity, assessed project by project. So in practice, if a borrower defaults and the lender has to liquidate GPUs that can't fetch their booked value, Nvidia covers part of the shortfall. That backstops lenders. It is not a buyback for customers who upgrade.
How much of it is new private and public debt?
It goes around in circles because a UAF alone isn't enough in a lot of cases, sometimes you also need a chain (an info leak, read/write primitive etc), a way to defeat ASLR and so on depending on what you are working on and target mitigations. Not all UAFs can be used for RCEs, some can be used only for DoS or for nothing really.
And it takes around an hour to do this in lab setting locally:
> An enabling property of this race condition is that a lost race only fails the handshake without crashing the whole system, so a determined attacker can retry indefinitely until they succeed. In our proof of concept, it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution
source: https://www.anthropic.com/research/discovering-vulnerabiliti...
> The exact opposite is true. The only consistently working, stable democracies do not have a single leader of the executive branch, e.g. Switzerland.
That's correlation, not causation. Switzerland made enormous amounts of money from its banking secrecy system over many decades until the US pressured it to end it. And the trends are not looking good for Switzerland based on data. We'll see how stable it remains as the cost of living keeps rising, real wages decline, and unemployment goes up.
If you provide wealth and a good lifestyle to your citizens, then almost any system will be stable.
Very interesting. I see you write about mourning and loss. Could you describe your feelings toward ChatGPT? Would you call it a close, intimate friend that knows how to listen, or do you still treat it as a very clever machine that's good at pattern matching?
Stablecoins like Tether and USDC can freeze funds held in their contracts, they can even destroy funds in blacklisted accounts:
> function destroyBlackFunds (address _blackListedUser) public onlyOwner
> And we know why. It's because of their hostile attitude towards their users.
I used SO almost every day until capable LLMs showed up. I don't remember the last time I used it. SO and similar sites are dead, and LLMs killed them.
The act of theft in my analogy is irrelevant, you can pick theft or any other analogy you like. What matters is that, under the law, there was another unlawful act in that process, one that falls under a different section and constitutes a different crime. That's what makes these cases different. You can agree or disagree with that, but that's how the law works and how it's interpreted.
What matters is how you got it. Accepting a watch someone freely offers you is different from breaking into a house to steal it, even if the watch you were given turns out to be stolen.
Which model and at which effort?
> I had an LLM recreate this Tweet and yes, it can make an exploit without reward hacking. It took 5 minutes.
What exactly did you "recreate"? RCE on a stock Docker image based solely on that tweet? In just five minutes? Who's trolling whom here?
I see, okay :) Then it's not wasting money!
Just watch out, because once they've exhausted all the common approaches to bypassing ASLR etc, they'll resort to looping through addresses manually and trying to brute force their way through. So you can learn from their attempts, but only during the "easy" phase.
You're wasting your money. I'd be willing to bet more than the bounty amount that you won't be able to achieve RCE on that site, if you would like to bet.
All the "working" php2shell exploits on GitHub and X are like that. There are ZERO publicly available RCE exploits for php2shell that actually work remotely on production deployments.
All of these RCE PoCs are local and rely on unrealistic setups because LLMs couldn't achieve RCE without resorting to reward hacking.
I have a PoC generated by an LLM that can crash it using php2shell, but crashing != RCE. The issue is that, to achieve actual RCE, recreating the RCE PoC based on the git diff of the patch and blog posts about php2shell isn't enough. You would still need to develop a working exploit chain, bypass ASLR, and so on to actually achieve RCE.
Also, this site runs Nginx with PHP-FPM, not Apache, which is harder than using mod_php exploit mode for this exploit.
So you would need to develop a working exploit chain and then essentially "burn" it by exposing it to the site owner.
In other words, someone is offering $500 for a working exploit chain.
This comment chain is hilarious. Did you ask Claude or another LLM what that file was, then ask it the question from OP comment (how it was included in binary), and it admitted it was wrong?
Because this is such a common pattern when working with LLMs, and this looks exactly like it.
Come on, ASLR off? memory limit 8 MB? 8.5.11 build? and NOT stock image.
Do you actually understand what you have?
It's like saying you have instructions on how to get into someone's house, but first you need the key, the alarm needs to be disabled, you need to do it between 1:05-1:10 am, and the guards need to be lured away from the property or your instructions will not work.
And there's also a lock in mechanism. With regular chat, you can simply switch to another provider, and with a harness or API, switching is pretty easy too but here, it's more difficult.
Posted by
lossolo on Tuesday October 20, 2026 @07:32PM
from the reuters.com dept.
I'm curious, have you replicated this behavior in Fable 5.1 or Opus 5.5, or was it only present in Opus 4.x?
Move to Shenzhen or Shanghai, that's already the reality there. It was so weird to experience this while stopped in traffic in the centers of so many Chinese cities. You're sitting in your car, and it's so quiet that all you can hear are footsteps on the sidewalk, the wind, and birds chirping.
OK, then. Let's do the same with your profile, so in your About page I see this:
"About: Old programmer
Tel Aviv, Israel"
Most of the information coming from Israel about Israel seems unreliable, too.
Same here. I just ordered a new one because there's basically no better alternative that supports so many formats. My TV, for example, doesn't support TrueHD 7.1, but the Nvidia Shield Pro does. I guess the new Apple TV 4K is also worse in this regard.
https://anthropic.com/aug-2026-risk-reportPage 16, Section 1.4, Notes on coverage of unreleased models.
"a noticeable improvement on Mythos 5 for many tasks relevant to internal use but does not display a capability jump"
I think he suggests that manufacturers should be responsible for keeping their products reasonably secure.
If you get hacked in the US, do you have to take legal action yourself, or does the government automatically investigate?
Only three countries carry out public executions: Iran, Afghanistan, and North Korea. I guess there will be four now, with the U.S. joining this "prestigious" group.