News for hackers. Stuff that matters.

martinald

Re:There isn't an easy exploit for this PHP vulnerability on Wednesday October 21, 2026 @08:43PM (#50189625)
But just because there isn't a working PoC on GitHub doesn't mean there isn't one and things aren't been actively exploited.

If you are a bad actor you probably don't share your PoC around as it means less boxes to hit.

Re:Railway Security Disclosure on Wednesday October 21, 2026 @06:27PM (#50188541)
I have a bad gut feeling that every day is going to look a bit like today with endless urgent patches and breaches.

Fwiw it sounds similar to the hack over the weekend that opencode suffered.

Re:Solar Panels That Plug into Your Wall on Monday October 12, 2026 @07:32PM (#50064523)
Interestingly, in the UK you can get 31 JA solar bifacial panels for ~£2k+VAT including shipping (https://www.solartradesales.co.uk/ja-solar-455w-n-type-bifac...), so around $2.6k.
The issue is though that you are saying 0.01% chance scenario, but gas/nuclear doesn't all go down at once at the same time every year. It's a somewhat fair counter that you might have serious gas disruptions, but LNG does massively diversify potential supply (and in the UKs case we have and will have a fair amount of domestic production for the next while).

Also keep in mind the overbuilding a massive problem anyway _outside_ of those 1-2 weeks worst case scenarios. We already have highly negative prices occurring more and more, and IMO this is the definition of policy failure, because the negative prices only arise because subsidies _encourage_ plants to keep producing even though the value is quite literally negative of the output.

Finally I don't think it's once in a century, probably most years have a significant Dunkelflaute event. And not all industry can be shut down like that (eg aluminium production) without causing catastrophic damage, and even if they can it makes them an unreliable supplier.

The issue is you need to design for 1-2 weeks of little to no wind and very little solar in winter, when demand is it its greatest. This is what is so tricky, unlike more southern climates where you have pretty reliable solar year round (even if its reduced, its not close to 0 which is the case in the UK). Instead of storing a day or so, you need to store weeks of energy.

Also you're forgetting residential electricity is maybe 1/3rd of total demand.

Yes, I have no doubt we can hit even a 90-95% renewable grid. It's the last 5% that is impossible to do without gas.

The cost of those last few percent is absolutely eye watering. The current plan to get it to 100% net zero is by having gas for the final 5% then using carbon capture and storage to offset the emissions.

Renewables require gas in the UK. There is no realistic route to 100% renewable grid without gas currently. I did some modelling of this and you'd require something on the order of 4000GWh of battery storage. We currently have 40GWh.

Gas is far, far cheaper than building ~£1T worth of battery storage. Even if prices dropped, you are still looking at multi-hundred billions, and you still need the renewable capacity on top of that.

Arguably if we had spent the £100bns (in subsidy and transmission upgrade and curtailment costs) we've already spent on renewables on nuclear instead we would have a very clean grid, even at crazy UK nuclear build prices, and stable electricity prices.

Re:Claude Haiku 5.5 on Wednesday October 07, 2026 @03:10PM (#49997416)
Do we know if claude -p is now drawing from this API usage?
Re:Linux support is coming to Snapdragon X2 Series on Wednesday September 23, 2026 @08:26PM (#49824594)
I don't think so. Every device has locked down firmware really these days, it's not an issue (most peoples BIOS/UEFI/etc is very much not open source).

If the drivers are upstreamed and good, it should work well.

Not quite, it's got quite a bit more complicated with agentic use cases.

Prefill (input tokens) is heavily compute bound. And the ratio of input to output continues to rise, as typically in agentic sessions you have a few tokens output for a tool call and (many) thousands of input from the tool result.

Then you have cached input tokens, which is a totally different issue, system RAM or NVMe bound.

Obviously output tokens is VRAM memory bandwidth bound, but this is less and less of the bottleneck these days for overall agentic speed.

Re:OpenAI agents carried out an undisclosed attack on RubyGems on Friday September 11, 2026 @10:14PM (#49668004)
From my understanding and IANAL there are two main problems.

1) most law requires intent, especially criminal. OpenAI certainly didn't "intend" to hack these companies given they did sandbox them etc.

2) Given the agent hacked them, not a human, a lot of law requires a person/employee to have done it to hold the company liable if it was part of their work duties.

I think the only real potential ground is negligence (in not sandboxing them correctly and being reckless with running these tests at all), but this requires not taking reasonable precautions. They could argue that they _did_ but it was so novel the precautions failed. But it's important to say if this happens again in the future it's arguably much harder to try and make this case.

Interestingly this was solved with new laws for self driving cars, most of which assign the company that is operating the car as the "person" involved explicitly.

Re:Elevated Errors for Multiple Models on Thursday September 03, 2026 @09:42PM (#49559506)
I genuinely have no idea what it is meant to mean in the context it uses it. Load-bearing etc is annoying but roughly understandable, some of the opus5 classics are completely out there.

I'm a native English speaker as well, I shudder to think what a second language speaker would do (even if they were very confident with the language!).

Re:The Browser's Main Thread Is Expensive on Thursday September 03, 2026 @09:38PM (#49559479)
It's not that, it's the building owners (freeholders) refusing permission, or not replying. It's a massive issue.

You'll notice buildings in central London that are listed _but_ have housing association ownership nearly all have fibre to each apartment, as they did portfolio wide deals with hyperoptic etc.

And pipes don't help. Openreach (who owns the copper network) are not allowed in 99% of cases to "fix" copper with fibre under the agreements they have with building owners, they can only make like for like repairs.

The worst affected apartment buildings are 90s and pre 2015ish. Everything after that got fibre installed at build time.

Btw it is worth checking if you have an altnet like hyperoptic, community fibre or g network available. The majority do and if you are just checking for openreach or VM broadband it won't show up.

Re:The Browser's Main Thread Is Expensive on Thursday September 03, 2026 @09:33PM (#49559445)
Tbh its not just that, you can have small bundles which hydrate extremely poorly.

But yes, I think we are in agreement :).

Can you tell I have mental scars from nextjs bundle optimisation?

Re:The Browser's Main Thread Is Expensive on Thursday September 03, 2026 @12:37PM (#49552837)
I'm not sure the author realises _what_ a massive impact bundle size has on the main thread though, especially hydration. The majority of apps I've optimised over the years have the (often vast) majority of main thread time spent on the bundle parse/hydration (plus obviously network).

Also, removing dependencies is not easy. I've seen many corporate that have a huge UI lib for example that everyone should use for brand consistency. But it's many MBs of JS, because it has to cover every possible use case.

This doesn't even get into 3rd party vendors who _also_ ship react et al and have other bundles.

I'm not saying the article is wrong, but if you want to free main thread time especially at the most critical point (when the user has initially loaded the page) you _probably_ will find that most of the opp is in bundle size and hydration improvements.

Re:The Browser's Main Thread Is Expensive on Thursday September 03, 2026 @10:54AM (#49550767)
Try it yourself on a gigabit internet. Put CPU throttling in devtools to 10x slowdown (assuming you have a fast computer) and see how fast it is even with super fast internet.
Re:Elevated Errors for Multiple Models on Thursday September 03, 2026 @10:51AM (#49550700)
Bit of a misleading status page, if you click in you can see that grok 4.5 and 4.6 etc are totally down, with the rest of the models showing as "up". I_strongly_ suspect they are not weighting it to actual number of requests!
Re:Elevated Errors for Multiple Models on Thursday September 03, 2026 @10:49AM (#49550671)
The other bizarre word I've now noticed and can't understand is "pathological". As in "bug has turned pathological"
Re:Elevated Errors for Multiple Models on Thursday September 03, 2026 @10:01AM (#49550052)
It's (mostly?) compute shortages. Right now it seems there is an issue in the SpaceX datacentres, so they will have less compute than normal.
Re:The Browser's Main Thread Is Expensive on Thursday September 03, 2026 @07:44AM (#49548745)
Good article and I wish this was much better known.

The issue is though that it's too focused on interactivity. In reality, 90%++ of slow sites are not slow because of interactivity really, they are slow because they ship enormous react/nextjs bundles and have extremely heavy hydration work to do.

_so many_ sites have bundles >10MB that need to be downloaded, parsed and hydrated.

I've even seen (many) sites which have multiple SPAs stacked inside of them.

If you're on a slow internet connection and/or CPU the page is basically unusable for many tens of seconds and no amount of yielding post bundle hydrate will really solve that.

Re:Tencent Releases and Open-Sources Tencent Hy4 Preview on Saturday August 29, 2026 @04:43PM (#49493163)
I wrote about this a couple of weeks ago. It's actually often the biggest cost and it tends to be hidden away on most platforms!

https://martinalderson.com/posts/watch-out-for-cache-read-co...

Btw I still haven't came across any decent model that is <$0.01/MTok cache costs apart from deepseek thru their official API (even with the price increases).

Seems like a bit of an opportunity for someone to take - drop cache read costs significantly.

Totally agree, they really shouldn't be called antidepressants at all. Important to add tho that for many with depression they have comorbid anxiety and often the anxiety is harder to tolerate than depression, so removal of anxiety symptoms can be hugely beneficial.

Also, IME they are dosed completely wrong. So many people seem to be on very low doses, which has no improvement on placebo in the studies I've read.

Whereas, higher doses are _hugely_ better than placebo, especially for anxiety.

What's worse is a lot/most studies on SSRIs in general often don't adjust for dose. Which seems like an enormous oversight to me.

Re:France reaches 94.9% fiber coverage in 2026 on Wednesday August 26, 2026 @12:49PM (#49452189)
UK is at 85% FTTH or 91% gigabit (including DOCSIS): https://labs.thinkbroadband.com/local/. Given VM are a fair way through their XGS-PON upgrade it'll probably be 90%+ FTTH imminently.
ah I don't think that page was up when I checked, it 404ed!
FYI: nothing seems to be able to run this (easily) yet. llama.cpp, vllm etc I couldn't get working because of no support in the mainline version.
The switches are very cheap though. I put fibre in my house (simply because the cable is far far thinner and easier to retrofit under carpets etc).

I got a few 2.5Gbit switches which have 4 2.5Gbit ethernet ports and 2 10Gbit SPF+, they cost around $30 off AliExpress.

I don't actually have any devices with 10gigE but it's not a huge amount more for 10gig ones (and no doubt will get a lot cheaper with the new lower power 10gige chips).

Older »