News for hackers. Stuff that matters.

molticrystal

Re:A complete bypass of eMudhra’s 1FA OTP login system on Thursday October 22, 2026 @04:26PM (#50200539)
I noticed that as well. Figured it was a concurrency issue, and they have a follow-up message that you can see if you click on the OP of the Mastodon thread that confirmed my guess: https://mastodon.catgirl.cloud/@49016/117476097901925573

>(yes the code is off by a few. its bc the poc is shit and to speed it up it uses 8 connections at the same time. it just stops the counter once it has a hit so its off by ~4 lmfao. you could easily fix this but cba today)

Re:Scientists Create a New Form of Ice at More Than 2000°C on Saturday September 12, 2026 @11:14PM (#49679626)
https://en.wikipedia.org/wiki/Ritonavir?useskin=vector#Polym...

When in solid form even the smallest amount can convert the whole batch to the much less effective version.

Their code and evalations are linked to on the blog post accompanying the results:

Blog Post: https://runta.com/blog/introducing-frontierharness-eval/

The tasks and methodology: https://github.com/runta-dev/frontier-harness-eval

If anybody want to take a crack at fixing and maintaining the issue, while the team has been worn out to the treads, they are still open to pull requests [0], here is the statement that is alluded to in the article:

>paintboth1234 uBO Team wrote:

>The project is FOSS. Anyone else who wants to deal with this disgusting site is free to make pull requests with working solutions themselves.

[0] https://www.reddit.com/r/uBlockOrigin/comments/1vgcjg5/about...

Maybe I missed it looking over the paper, or maybe they are implicit, but are you taking into account Saudi Arabia’s East-West Crude Oil Pipeline (Petroline) , I believe it does about ~7m bpd and Habshan-Fujairah (Abu Dhabi Crude Oil Pipeline / ADCOP) about ~1.5m bpd? If not you might be underestimating things, though they do take a bit of a warmup to get into capacity, and can't match completely Hormuz's flow.
Re:Firefox Containers Preview on Tuesday July 21, 2026 @09:45PM (#49000812)
Extensions per container would be a great addition if they don't already have that planned or available. Sometimes an extensions for privacy or security interferes with a website and if I could fork my base enabled extensions then disable a few for just that site it could keep things more compact and organized instead of having to clone a profile for every website with issues.
Re:Use your Nvidia GPU's VRAM as swap space on Linux on Wednesday June 03, 2026 @12:05AM (#48379774)
For windows I saw something similar to this years ago. An experimental proof of concept driver that allows the creation of a ram drive from vram for NVIDIA cards. Sequential is fast as you'd expect, random has lots of room for improvement.

>GpuRamDrive

>Create a virtual drive backed by GPU RAM.

https://github.com/prsyahmi/GpuRamDrive

Fork with AMD support:

https://github.com/brzz/GpuRamDrive/

edit: admin dang has fixed the title

I always interpret the rule [0] "Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize." as applying to stories like this one.

Adding the words [in mice] would not only be the acceptable exception the rule is referring to, but probably necessary. This would align the title properly with the article contents and avoid giving people false expectations about human results.

[0] https://news.ycombinator.com/newsguidelines.html

Re:Open Source Does Not Imply Open Community on Sunday May 03, 2026 @12:12AM (#47993275)
Even the most closed community will often accept a contribution if you are polite and email them.

An open source developer had disabled pull requests and other operations on their repository because they were fed up with harassment. They gained a reputation for being extremely disagreeable at that time. I was unaware of this and simply assumed that was how the project worked. I had to do some minor investigative work to find their email address and I sent them a polite, low pressure email with my unsolicited patch and made it clear it was fine to use it or ignore it. They thanked me, explained the situation, even apologized for the difficulty, and said locking things down was the only way they knew to cope with the situation, and of course applied the fix.

What is Defender marking it as? I also wonder if they are just special casing this program and it would work again if the code was shuffled a bit or if it used the AMSI sig [0] instead of EICAR or if they actually fixed the problem.

[0] https://github.com/Roadmvn/C-Full-Offensive-Course/blob/main...

Re:JVM Options Explorer on Sunday April 12, 2026 @12:00PM (#47741261)
Chrome has 1496 [0] known options as of today, maybe after a few more pushes they'll catch up to the 1843 that of JVM.

An interface like above to sort things would probably be quite helpful as well.

[0] https://peter.sh/experiments/chromium-command-line-switches/

RSS Feeds of searches would be great, I know alerts exist, but for this community being able to get data through alternative methods, especially RSS is very appreciated.
Suggestions:

Put the parameters into the url so searches can be bookmarked, like zip codes, terms, filters, and other aspects can be shared easily as well.

Description search both include (like i7, 16GB) which is good for electronics and exclude for example exclude "repair" or "needs repair" which is helpful for many things.

Category specific filters, vehicle millage range, year

Keywords classification filters like pickup, delivery, payment methods, how many days you have to pay if known, etc.

You are probably already thinking along these lines for some of them, just an encouragement to implement. Yes categorization/filters can be fuzzy(commas, which word or plurals used, etc), so feel free to put the [beta] or [experimental] tag until a recipe that gets most of the stuff works.

Thanks for building this, I bookmarked it and already shared it with a few friends.

>Does it support MLX or metal on Macs?

This is answered from their Project Roadmap over on Github[0]:

Recently Completed: macOS (beta)

Under Development: MLX support

[0] https://github.com/lemonade-sdk/lemonade?tab=readme-ov-file#...

Re:Chrome extensions spying on 37M users' browsing data on Wednesday February 11, 2026 @09:52AM (#46975676)
Using the below page you can check your extensions, select all your extensions on chrome://extensions/ (everything on the page, it will filter it out IDs) and it will check if any IDs match.

https://output.jsbin.com/gihukasezo/

or

https://jsfiddle.net/9kLsv3xm/latest/

or

https://pastebin.com/Sa8RmzcE

Re:Linux From Scratch ends SysVinit support on Monday February 02, 2026 @01:36PM (#46859507)
While I'll ignore the System D hyperbole, your point about Unix has merit.

I think the *BSD are also good, at least from an educational standpoint, with their relative simplicity and low system requirements. Since there is a lot of integration making a from scratch distro might take less material, but it could be supplemented with more in depth/sysadmin exploration.

More and more Youtube search results are a playlist when you click the result.

This causes a fatalistic chain where the video has a captcha, and if you don't answer it in 5-15 seconds it goes to the next in the playlist and the process repeats. This turbo charges uncontrollably down the series of videos.

The solution is within seconds remove the &pp= (or go back a few pages and do so) this gives you as much time as you need to solve the captcha. Or remember to copy the search result link instead of clicking on it and clean it up.

I wrote to youtube about this bug where playlists don't wait for you to answer the captcha and never heard back from them, which is what I expected, but figured I'd try.

The verbs used in RDMA are Turing complete [0] [1] . They don't seem to be all be accessible from SMB3/SMB Direct, and the SMB opcodes themselves seem lacking, but with enough effort maybe you can get access or add what you need and this would form a path to finally have the ultimate Super Mario Brothers 3 Remote Direct Memory Access tech.

[0] https://www.usenix.org/conference/nsdi22/presentation/reda

[1] https://www.youtube.com/watch?v=sTT_XPfYudg

They have a bag of dirty tricks [0], here are a few highlights including a couple already mentioned:

    /* Dead subpixel (Thanks M) */
    .content[role=main]:before {
        content: "";
        position: fixed;
        top: 126px;
        left: 242px;
        width: 1px;
        height: 1px;
        background: #f0f;
        z-index: 9999;
    }

    /* Hair */
    .content[role=main]:after {
        content: "";
        position: fixed;
        top: 150px;
        right: 150px;
        width: 140px;
        height: 200px;
        border-radius: 50%;
        box-shadow: 2px 0 rgb(60, 24, 24, 0.3);
        transform: skewX(-30deg) scale(0.6);
        pointer-events: none;
        z-index: 9999;
    }

    .thing.comment[id*=c] {
        transform: rotate(1deg);
        margin-top: 30px !important;
    }

    .comment p a{
        font-family:Comic Sans MS, Impact,serif;
    }
[0] https://www.reddit.com/r/mildlyinfuriating/wiki/config/style...
From the Quanta Books website [0] it seems it will be a while before anybody can read them, the article lists a couple dates but all the dates are on its website.

Everything Is Fields By David Tong (Early 2027)

Six Math Essentials By Terence Tao (November 2026)

The Proof in the Code By Kevin Hartnett (June 2026, Preorder Available)

[0] https://www.quantabooks.org/

Plan 9 extensions would only require enough examples to justify and might not take years. Though your taking years assessment would be right if there's a dearth of kernel spots to add up where automatic pointer conversion for anonymous fields, or using the typedef name to access them, offer some improvement, not necessarily even a huge improvement.

Since with the Microsoft extension, it was just waiting until enough examples were woven into the discussion to overcome the back and forth that was preventing "biting the bullet".

Re:Transparent computer monitor designed to protect your vision on Saturday November 08, 2025 @04:25PM (#45860160)
I wonder if this would actually make vision worse, increasing nearsightedness or causing the condition. It seems that dark words on light backgrounds can cause your eyes to elongate over time[0] or other conditions to form, and it seems it is no coincidence that many readers require glasses.

Would the same occur with dark mode on a transparent background? While I am not saying that it would negatively effect the eyes, I am skeptical of this claim of letting the eyes relax, it seems like marketing.

[0] Wagner, S., Strasser, T. Impact of text contrast polarity on the retinal activity in myopes and emmetropes using modified pattern ERG. Sci Rep 13, 11101 (2023). https://doi.org/10.1038/s41598-023-38192-9

Re:Authorities Shut Down Film Festival in New York on Saturday November 08, 2025 @01:52PM (#45858965)
Poorly worded title, something like this would be clearer:

-----

Chinese Authorities Threaten Mainland Relatives to Shut Down Film Festival in New York

-----

Even the subheading from the article seemed better: "Chinese Police Harass Filmmakers, Families to Undermine Free Expression Abroad"

Though I would of made it "Filmmaker's Families".

How can you be free if your family is held hostage. As soon as a person from China becomes free or achieves anything, this is what happens.

This is what they do just because of a movie they don't care for. Imagine how much further they go when they have a bigger ask for something they truly want.

The coercion is very strong, and why some end up in jail for spying or other criminal acts in the hosting country, even if they end up citizens, and love the place. Very messed up.

Re:Tiny electric motor can produce more than 1,000 horsepower on Monday November 03, 2025 @05:56AM (#45797801)
It is great that Mercedes-Benz now owns a highly performant electric engine. But is this just an impressive lab breakthrough, or can it work in the real world for their cars? Which means enduring from freezing to high temps, hours of sustained driving, and years of that (or equivalent endurance testing).
Re:Hacker News – The Good Parts on Thursday October 16, 2025 @06:05PM (#45611255)
I've used Reddit since before subreddits, and I would never want this place to go down that route. But it seems like there is a desire for some of those features Reddit had in its early years.

For me, a touch more Markdown like for text links [text](url) would be nice, not asking for image support or anything like that, though. As cool as the [0] is, the <a href=> tag and its predecessors were invented early on for a reason.

[0] https://en.wikipedia.org/wiki/Href?useskin=vector

> I'd like to see more MEPs urging the Council to oppose ChatControl

They are exempt, but exemption won't help if they get hit by spyware.

Re:Exploiting huffman table bug in zlib on Tuesday September 30, 2025 @06:47AM (#45423975)
The original title included "[CTF] Google CTF 2025" which would strongly hint(CTF=capture the flag) at the possibility of an artificial setting. That probably should of been included in the submission.
I think you'll find it not as comprising as you believe, and might be a fun project.

Since you'll likely be scrapping it in some fashion, might want to try disassembling it first to see what would need to be done.

If you are not handy with electronics, there is also a chance their will be some work around the 3rd party server at some point, as in the protocol and such being deciphered, or a custom firmware you can build and flash.

If you do get it working, it would make a great spare.

Re:Selling numbered rocks, you get whatever's next in sequence on Tuesday September 23, 2025 @01:05AM (#45343020)
Is nobody asking what mineral the rocks are? Are they all the same? Are there a few types of which you might get one of? Nobody cares?

Next up pumice.rocks , limestone.rocks, basalt.rocks?

Europe petitioned for a Don't Kill Games initiative, while I support it whole heartily, this seems like something that is a bit more important and would fit right in with that movement.

Older »