News for hackers. Stuff that matters.

mlfreeman

Re:Astra can read and write weights to improve Qwen on Monday November 02, 2026 @02:24PM (#50342236)
How long before there's a malicious model that can edit the weights of another to infect it?

HIV integrates viral DNA into the DNA of certain cells, IIRC.

Re:Getting debug access on a Brother printer over Telnet on Thursday October 29, 2026 @07:32AM (#50287375)
It also works on my Brother HL-L3280CDW
All I can think of are supervillains in land based volcanoes not underwater ones
Re:Passkeys Are Not a Trap on Wednesday October 14, 2026 @12:05PM (#50089853)
I've set up a few passkeys to see what it's like and the experience is wildly different between sites.

State Farm is the only place I've actually liked it. I don't have to type ANYTHING in.

Open browser, open password manager, click the "sign in with existing passkey", browser and password manager talk, prompt me to confirm the passkey choice, and I'm in.

Most sites I've messed with insist on you entering a username first.

Re:Passkeys Are Not a Trap on Wednesday October 14, 2026 @12:00PM (#50089771)
> Whenever I've written authentication, passwords are hashed on the client side and never transmitted in the clear.

Don't assume everyone coding a login page is as competent as you though...sadly.

We're still running in the same sense that Wile E. Coyote is still running when he goes off the cliff. Eventually we'll collectively look down.
Re:Why aren't AI companies being charged for hacking? on Monday October 12, 2026 @12:22PM (#50058675)
> How you gunna jail an AI?

chroot?

> Taxation based on the theoretical monetary value you could extract if you sold your primary domicile is probably the dumbest possible policy

Yes it is. At least with all other forms of taxation you can vote against/campaign against/run against the politicians who directly chose to vote for it.

Why shouldn't society value stability of one's quality of life?

"MOAR PEOPLE PER UNIT OF LAND = BETTER" is not a law of the universe that we must all obey, it's a preference too.

Re:Windows 11½ on Monday September 28, 2026 @04:16PM (#49883746)
People still bother to deploy XP exploits?
Re:Show HN: Build your own theme park on Wednesday August 26, 2026 @06:16PM (#49456678)
No special Bender easter egg if you request a theme park with blackjack and hookers?

https://www.youtube.com/watch?v=ubPWaDWcOLU

Re:OpenLogi on Wednesday August 19, 2026 @02:16PM (#49365120)
No. You can emulate the network matters in software.

For more details, go look up the Linux USB Gadget framework. You can even play around with some of it yourself using a Pi Zero 2 W (I did, making it appear to be a USB webcam - I saw guides on how to make it be a serial port and even an ethernet adapter too)

Re:OpenLogi on Wednesday August 19, 2026 @08:56AM (#49360980)
> Except "website made by LLM" almost invariably means the software was "written" by an LLM too,

please provide some kind of statistics to back up this claim.

Re:OpenLogi on Wednesday August 19, 2026 @08:49AM (#49360883)
At this point, why not have a toggle that makes the devices show up as a 10/100 USB NIC too and serve up a settings page themselves?
Re:License plate reader searches should require a warrant on Wednesday August 12, 2026 @11:13AM (#49273681)
right now, neither needs a warrant. if searching LPR camera history starts to require a warrant, it probably wouldn't take much to argue that sending officers out to manually do the same thing should require one too.

EDIT: i have no doubt that Flock and other ALPRs got so widespread because four ALPRs watching each direction at an intersection is basically invisible in comparison to four cop cars at every intersection.

if plate readers were as visible as cop cars (including agency branding) people would have probably gotten bent out of shape a long time ago.

Re:Auto mode is now the default in Claude Code on Monday August 10, 2026 @07:47AM (#49242427)
I do it, but in a devcontainer...but the devcontainer is as much to keep my host free of the random tools that a given project needs as it is (now) to keep Claude in line. If I had to click approve on everything it'd be worse than doing everything myself.
Re:Mea Culpa – Dark Hours on Sunday August 09, 2026 @09:24PM (#49238197)
At this rate politicians will be able to say “AI hacked me” soon
The tech exists to do it on-camera (Ubiquiti among other vendors claims on-camera LPR), but I figure they're doing whatever is most battery-efficient since the ones I've seen all have solar panels.

I do wonder what they do on busy interstates though. Some of the ones I've had to go past would basically be sending a live video feed - LPR matches as text would save a ton of bandwidth and maybe even power compared to a cellular radio always transmitting.

And vehicle theft doesn't even need cameras logging EVERYONE to Flock's databases - just cameras that only report in to the mothership when they see a plate on an internal "most-wanted" list.

Person reports car stolen, cop adds car info to plate reader most wanted list, most wanted list is transmitted to cameras, cameras don't let plate readings leave RAM unless they're 90% or higher confident that it's on the most wanted list.

Eventually the copy in the officer's browser's cache expires...I figure that's what they mean.
57 groups, 307 entries. I try to reprint whenever I get an oil change (so a few times a year).

I don't reprint for every password change. I will for major accounts. I will also immediately print for certain new accounts but not all (e.g. I didn't reprint for my HN account).

The Strongbox printout has the last printed date on it and my KeePass plugin even includes the SHA256 of the KDBX file just to be sure.

I print a nice HTML document - each entry has each field/value in a HTML table and each group gets its own header.

On macOS I use Strongbox's Print Database capability. On Windows, I'm testing a KeePass plugin I created that does the same thing and more (not quite ready for public release).

If I'm still around and coherent, I can re-type it into a KDBX-supporting app by hand (or maybe if I'm lucky only enough entries to get to a backup in cloud storage).

If the worst happens and I'm no longer capable of using a computer, it's an obviously-important document for whoever is cleaning up after me (I bet most people would understand the importance of a document with a bunch of usernames and passwords). They won't have to somehow break into my computer first to be able to figure out what online/digital matters of mine need to be dealt with.

The author of this ticket seems to come across as an arrogant know-it-all that thinks "the threats i thought of (or personally face) are the only threats that are significant, fuck anyone in a different situation."

I proudly print my entire KDBX file including passkey private keys and I encourage my elderly parents to do so too.

Lightning strikes (and assisting people with cleanup and repair from them) have taught me that there are definitely a class of threats that will leave me with paper but possibly no technology until I can go buy a cheap laptop to restart my digital life, SO BEING ABLE TO BACK EVERYTHING UP IS ABSOLUTELY ESSENTIAL.

His website says he's in Boston, so I seriously doubt he's ever seen what lightning can do or dealt with a hurricane or tornado.

In general, if you're in the FIDO Alliance and had anything to do with the kind of micromanagement that passkeys can allow, FUCK YOU. Go get a job at Walmart as a greeter. We'll all be better off.

Re:QuadRF can spot drones and see WiFi through my wall on Friday July 10, 2026 @01:01PM (#48862509)
The visualizer reminds me of my thermal camera.

I have heard claims of devices (mostly TVs) supposedly coming with secret 5G cell uplinks built in [never heard a specific model mentioned though].

If there were more variants covering more commonly-used RF bands, people could walk around and literally check for once.

(incidentally i'm sure three letter agencies have had this sort of tech in their bug-detecting toolkit for a LONG time)

Re:Steam Machine on Monday June 22, 2026 @09:35PM (#48639060)
I’ve seen websites say during checkout “your address wasn’t in our db but this one was” showing what was clearly a cleaned up form (changed “Circle” to Cir, uppercased, turned ZIP into ZIP+4) so there are ways.

You would have to tell the user “use the corrected/matched one only” though. Some sites offer the correction but don’t make you use it.

Weren't there iPhones that had wifi chips that ran Linux?
Re:I Ported Mac OS X to the Nintendo Wii on Wednesday April 08, 2026 @04:30PM (#47695859)
Uh, I just noticed the Windows NT for GameCube port actually claims Wii support too...so maybe one day we'll see a Wii dual boot NT4 and OS X 10.0
Also don't forget about working in "That's no moon. It's a space station." somewhere.
I followed the instructions link and read the scripts...although the TinyGPU app is not in source form on GitHub, this looks to me like the GPU is passed into the Linux VM underneath to use the real driver and then somehow passed back out to the Mac (which might be what the TinyGrad team actually got approved).

Or I could have totally misunderstood the role of Docker in this.

Re:Xweather Live – Interactive global vector weather map on Sunday February 22, 2026 @12:03PM (#47112631)
> In the future we will also be merging another project into this app which is a collection of data from personal weather stations across the country. That data is really cool because it can fill in coverage gap. https://www.pwsweather.com/map/?ob=temps

I have four stations uploading there - looking forward to see the result!

Older »