News for hackers. Stuff that matters.

meinersbur

At some point "enshittification" will likely also come to Cloudflare. They have the scale already, some new manager and/or investor/shareholder will push for all the money they can get, even if it has long-term cost.
That's the entire appeal of WSL (for me). A single source checkout I can work on from both sides; no inconsistency of forgetting that I need to apply changes twice.

Without it, I can just as well ssh into another box.

Re:Git 3.0's upcoming SHA-256 default will be a costly mistake on Thursday October 01, 2026 @02:18PM (#49925169)
Linus Torvalds in 2007:

> but the point is the SHA-1, as far as Git is concerned, isn't even a security feature. It's purely a consistency check. The security parts are elsewhere, so a lot of people assume that since Git uses SHA-1 and SHA-1 is used for cryptographically secure stuff, they think that, Okay, it's a huge security feature. It has nothing at all to do with security, it's just the best hash you can get. ... [1]

[1] https://www.youtube.com/watch?v=4XpnKHJAok8&t=56m20s

So Torvalds used SHA-1 purely because he needed a hash function with no other property than identifying content.

I am surprised that a CAPTCHA is still an effective means for blocking today's vision-capable AIs.
Re:The case against JPEG XL on Monday September 14, 2026 @03:35AM (#49693227)
> I believe Web codecs should be purpose-built, efficient, and narrowly scoped to the needs of the Web.

The post downplays the usefulness of versatility. I disagree. I'd prefer not to play the "which image format is best for this image and this use case" game and having to transcode between them. For instance, it would be great if I could have an HTML gallery showing pictures of my files as I store them on harddisk. Today these are JPEG, because it's the lowest common denominator. WEBP, AVIF are not supported photography tools (e.g. https://support.captureone.com/hc/en-us/articles/36000262921...) and I don't expect support to ever be added since it is not formats intended for photography.

https://archive.is/zKgVp

> During discovery in the case, Will Moye, one of the plaintiffs’ attorneys, found a five-page document called “Citation Overlay,” which appeared to have been generated by AI. Moye recognized the Citation Overlay document as being from ChatGPT, and demanded all of the prompts Autenrieth used from 3M’s lawyers. The deposition was paused for three hours while they were gathered, and Moye was given 350 pages of ChatGPT conversations that Autenrieth had when creating the report.

Re:Dear Richard Dawkins on Sunday May 03, 2026 @10:40PM (#48004019)
Since ELIZA, the more we try to apply the Turing Test, the more evidence we get that the Turing Test about human gullibility, rather than saying anything meaningful about the machine [1,2]. Surprisingly it turns out that even critical thinker Richard Dawkins is quite gullible.

[1] https://medium.com/@innovariart/the-turing-test-no-longer-me...

[2] https://arxiv.org/abs/2405.08007

Moderators seem to have not enough to do. They closed my 16 year (!) old question and added comment:

> Do not include solution to question please (post a separate answer instead). -- user4157124

https://stackoverflow.com/q/2224373/102498

16 years ago, questions with intentionally open answers were common and providing a summary in the question was seen as a courtesy.

Re:Binary obfuscation used in AAA Games on Wednesday April 08, 2026 @07:34AM (#47688767)
They get their own build. E.g.

* GeForce NOW SDK: https://developer.geforcenow.com/learn/guides/offerings-sdk

* Stadia SDK: developer.stadia.com (offline)

* Xbox Cloud Gaming: https://learn.microsoft.com/en-us/gaming/gdk/docs/features/c...

* ...

Just like every Game Store requires its own build: Steamworks SDK, even GOG: https://docs.gog.com/sdk/

Some games allow browsing files locally for savegames, music libray, ... . Imagine if you could do that on the cloud VM.

Re:Our Commitment to Windows Quality on Saturday March 21, 2026 @09:31AM (#47466868)
It has nothing to so with NTFS, but all with the Win32 API. The Windows kernel supports this file model, proven by WSL1. There is a blog post somewhere (Old New Thing?) stating the engineers would like to e.g. allow deleting a file even if there is still a program with with a file handle to it, but are concerned deviation from current behavior would cause more problems than it solves.

The reason that they want a reboot is that they do not want to support a system using two versions of the same library at the same time, let's say ntdll. So they would have to close any program using that library before programs that use the new version can be started. That is equivalent to a reboot.

And I completely understand the reason. For a long time when Firefox would update on Linux, the browser windows still open were broken; it opened resources meant for the updated Firefox with the processes runnung the non-updated Firefox. The Chrome developers mentioned [2] that the "proper" solution would be to open every file at start and pass that file descriptor to the subprocesses so all of them are using the same version of the file. Needless to say, resource usage would go up.

[2]: https://neugierig.org/software/chromium/notes/2011/08/zygote...

Re:WolfSSL Sucks Too, So Now What? on Friday February 13, 2026 @06:03AM (#47001387)
This is the WolfSSL maintainer's response[1]

> This ticket is rather long and has a lot of irrelevant content regarding this new topic. If I need to bring in a colleague I do not want them to have to wade through all the irrelevant context. If you would like, please open a new issue with regards to how we support middlebox compatibility.

The author turns this into:

> The GitHub issue comment left at the end leads me to believe that they aren't really interested in RFC compliance. There isn't a middleground here or a "different way" of implementing middlebox compatibility. It's either RFC compliant or not. And they're not.

This is a bad-faith interpretation of the maintainer's response. They only asked to open a new, more specific issue report. The maintainer always answered within minutes, which I find quite impressive (even after the author ghosted for months). The author consumed the maintainer's time and shouldn't get the blame for the author's problems.

[1]: https://github.com/wolfSSL/wolfssl/issues/9156

Re:Do not put code diffs into Git commit messages on Saturday February 07, 2026 @06:12AM (#46922922)
Reminds me of prompt injection: A tool that cannot distinguish between data and instructions.
Re:A case study in PDF forensics: The Epstein PDFs on Wednesday February 04, 2026 @05:24PM (#46892726)
The time advantage of faking a scan becomes better the more pages you have to scan.

https://xkcd.com/1205/

It doesn't matter whether OSS is American (in whatever sense) -- anything that is America-specific (e.g. server addresses) can be patched for a localized European version. The different commercial model does matter: American law does not apply (Cloud Act, National Security Letters, ...)
Re:Windows 8 Desktop Environment for Linux on Monday January 12, 2026 @09:10AM (#46588737)
Live tiles are nearly universally praised in retrospect, but it might be a case of hindsight bias [1]. The video [2] brings up some problems of the concept and why no other company copied the concept.

[1] https://en.wikipedia.org/wiki/Rosy_retrospection

[2] https://youtu.be/OgXlNaYXRu4

The patent expired, but the minifigs is also a EU 3D trademark. This is not possible for the brick which (only) serves a technical function, namely to hold on each other. Trademarks do not expire while in use. Another example for a 3D trademark, also in this US, is the Coca Cola bottle.

[1] https://www.chaillot.com/ip-news/validity-of-3d-trademarks-f...

Re:US Cities Are Paying Too Much for New Transit Buses on Friday September 26, 2025 @07:06PM (#45391937)
What is your alternative explanation for why people rent public storage space? Urban growth and growth in suburbs are not mutually exclusive.
Re:DXGI debugging: Microsoft put me on a list on Sunday September 21, 2025 @08:02PM (#45327766)
Changing execution behaviour based on filename is common in Linux environments too. Some examples:

1. BusyBox is a single executable that executes different commands based on which symlink was used to call it

2. Bash puts itself into compatibility mode if invoked as "sh"

3. "ping" can be invoked as "ping4" or "ping6"

4. Some of git's subcommands are symlinks back to the main executable

5. Clang switches to C++ mode if invoked as "clang++"

6. AppArmor profiles activate on file paths

From the GitHub issue it becomes clear that blocking happens by the EasyPrivacy blocklist. The blocked URL youtube.com/api/stats/atr is/can also be used for tracking users, this is why some are arguing that it legitimately on that blocklist.

The tracking not malicious. YouTube has a legitimate interest to verify views, e.g. to recommend popular videos to others. If a view counter was increased by just invoking an API, view counts could be manipulated easily. Also see the video [1] from ... 13 years ago ... so it might be slighly outdated. Just slightly.

[1] https://www.youtube.com/watch?v=oIkhgagvrjI

Please don't downvote comments only because you don't like their opinion (reply to them instead). It cannot be that the same opinion is valueable when someone famous write it [1].

[1] https://news.ycombinator.com/item?id=44962529

Re:Sqlite3 will also read and write ZIP archives on Friday August 08, 2025 @08:09AM (#44836065)
Sounds like feature creep. Zip is not a database, at best its just slow. Use a archive utility to handle archives.
Re:Python performance myths and fairy tales on Wednesday August 06, 2025 @07:05AM (#44810440)
Is it just me or does the talk actually confirm all its Python "myths and fairy tales"?
They absolutely do have that infrastructure. They implemented every country's content rating system, such as PEGI, ESRB, ... . Games are regionally banned, such as in Germany [1]. Games can also have regionally censored games, typically for violence/gore in Germany [2]. With the strange effect that if you change your account's region, it re-downloads some of the games.

The legal situation with VPNs and traveling between regions is the same as with any internet service.

[1] https://steamcommunity.com/groups/foruncut/discussions/17/41... [2] https://steamcommunity.com/groups/foruncut/discussions/17/39...

Re:Tell HN: Gmail tampers with incoming email body content on Saturday August 02, 2025 @01:09PM (#44769313)
https://help.zapier.com/hc/en-us/articles/8496101927181-What...

I don't think there is an official list. It is security-related and changes over time

Re:Tell HN: Gmail tampers with incoming email body content on Saturday August 02, 2025 @08:00AM (#44766905)
GMail (and Fastmail) are rendering the email. It just happens that the email and we webbrowser are both HTML. In no case should they just literally forward the email HTML to the browser. They scrub JavaScript, non-whitelisted HTML elements, rewrite links/external resources including tracking pixels.

You can see the raw email with "show original" in the options

There is also market separation in play: For the base service you only charge cost+small margin. For higher service levels you charge higher profit margins even though the additional service does not cost that much more to provide.

Best example: flight seats. Economy class fills the plane, but business and first class are the money makers [1].

[1] https://www.youtube.com/watch?v=BzB5xtGGsTc

Re:Games Look Bad: HDR and Tone Mapping on Saturday July 26, 2025 @11:16AM (#44694744)
Researchers trained a deep learning network on photos to make GTA5 more realistic-looking: https://www.youtube.com/watch?v=P1IcaBn3ej0

I was surprised that most of it is is just tone mapping. It looks too green-ish to me, needing some white balancing, but realistic.

I think Video games are intentionally over-saturated and contrasty to make them look better, just as paintings are[1]. I took many screenshots in Horizon Zero Dawn that would be look bland if it was realistic like the modfified GTA5 footage above[2]. You also don't want animation movies[3] with realistic tone mapping. But for a horror game you would do exactly that, it's about immersion (or you would never be frightened), not beauty.

[1] https://www.reddit.com/r/horizon/comments/1ix7ms2/my_hzd_oil...

[2] https://www.reddit.com/r/horizon/comments/x97gi1/this_game_i...

[3] https://www.imdb.com/de/title/tt0892769/mediaviewer/rm284102...

Re:A valid HTML zip bomb on Thursday July 24, 2025 @11:49AM (#44672170)
It will also compress worse, making it less like a zip bomb and more like a huge document. Nothing against that, but the article's trick is just to stop a parser to bail early.
Re:Fstrings.wtf on Saturday July 19, 2025 @08:13AM (#44614875)
Just learned about the ellipsis statement and the !a modifier (I already knew !r and !s).
Re:The "Geometry" of Colours [video] on Wednesday July 09, 2025 @04:29AM (#44507553)
Result from game discussed at https://news.ycombinator.com/item?id=43745868

Older »