News for hackers. Stuff that matters.

novafunc

A fingerprint sensor?
Re:Backdoors in official Claude Code extensions on Friday October 30, 2026 @08:48AM (#50303165)
I used to think the same, but apparently there's a way to differentiate between curling into bash and curling into a text file.

So you could be diligent and curl into a text file, see nothing is wrong, but then when you curl into bash, it runs something different.

Re:Ghostty 1.4.0 on Tuesday October 27, 2026 @09:32PM (#50268285)
There's a third party appimage, still on 1.3.1 though: https://github.com/pkgforge-dev/ghostty-appimage

Normally not a fan of appimages, but this group focuses on making higher quality versions that make very few assumptions about the host system and work almost anywhere. While also prioritizing speed, small sizes, and up-to-date dependencies.

Re:Tailscale SSH: Investigation and remediation update on Tuesday October 27, 2026 @06:39PM (#50266872)
By restricted networks, like hospitals, workplaces, schools, etc.

If their firewalls can detect it not being typical http/s traffic, they can block it.

Re:Ghostty 1.4.0 on Tuesday October 27, 2026 @04:06PM (#50265046)
I can use Ghostty and use the same featureful terminal on Linux and macOS.

I also hate configuring Konsole, most KDE apps for that matter. Being able to have a plaintext configuration file I can keep in my dotfiles is way simpler.

Re:Full Disk Encryption on Fedora with TPM2 on Saturday October 24, 2026 @08:18PM (#50226874)
> The design of the TPM makes much more sense for a closed-source operating system

I don't think that's the case. The great thing about TPMs is that they measure what's on your system. As long as you modify things properly, your changes get measured and stored in the TPM.

Secure Boot is the more closed-sourced way. By default it relies on Microsoft keys unless you enroll your own and sign your stuff.

GrapheneOS has repeatedly turned down this idea because it gives a wider area of attack (signed in vs in a locked state) and would be easily detectable.
Re:Gaming on Linux Without Cheating on Wednesday October 14, 2026 @07:06PM (#50096818)
And Cloud gaming only gives you a video and audio stream. Cheats cannot peek into the game to reveal information. They can only see and hear what you see and hear and control input devices.
It's improved. The scrolling used to be terribly glitchy and would make it difficult to read as text was generated.

But in the same fix, they also removed the reasoning-sample, which kinda sucked.

Re:I guess I'm using WebP now? on Sunday October 11, 2026 @07:30PM (#50049211)
Are you sure? They just blogged about supporting it in Chrome with their Google developed jxl implmention in Rust.
Re:I guess I'm using WebP now? on Sunday October 11, 2026 @07:28PM (#50049184)
Sufficient is objective. My hardware is certainly sufficient at decoding video without performance problems, but with with CPU decode, it takes more resources and ramps up the fans. While with GPU decoding, it's near silent.
Re:Pop!_OS bans AI-generated code from much of its codebase on Saturday October 03, 2026 @04:55PM (#49947678)
It may have a high false positive rate, but at the speed AIs can review code, there's still plenty, of real vulnerabilites mixed in with the garbage.

I'll trust the words of groups like curl (https://daniel.haxx.se/blog/2026/06/10/a-human-in-control/), Linux, and even the infamously anti-AI Gnome (https://blogs.gnome.org/mcatanzaro/2026/10/02/the-era-of-sof...) that AI is finding real vulnerabilities and you're your project a disservice by ignoring them.

Edit: Though Greg did recently have a talk (that I skimmed) where he was a little reserved on LLMs: https://www.youtube.com/watch?v=NnV_cWeoo5Q

Re:Pop!_OS bans AI-generated code from much of its codebase on Saturday October 03, 2026 @04:49PM (#49947628)
I don't think it's performative.

They aren't saying that AI produces bad code or is terrible for the world in some way.

It's mainly just resulting in a lot of PRs that they don't have enough time to review or features they don't plan to add.

Re:The Forgetful CPU (Linux on M4) on Saturday October 03, 2026 @01:39PM (#49946176)
That is a good point, but not exactly what I meant.

When I was picking out that Lenovo laptop, there were dozens of different laptops just from Lenovo alone with lots of hardware variety. Then consider all the different manufacturers I could have also chosen from.

With that much hardware, it's hard to find comprehensive reviews matching the exact laptop I was looking at. And from the few reviews I did find, none of them mentioned that issue.

A model of non-Apple laptop could have serious issues, but since it's not Apple, it wouldn't have anywhere near the same media presence an Apple laptop would. With their few SKUs and popularity, the issues are visible. I did not need to follow Macs closely to know about the butterfly keyboard issues, overheating issues, etc. I wouldn't have purchased a Mac back then given those issues.

But Apple got their stuff together and fixed that. And when I was considering the M3, there were no hints of any hardware issues from the reviews I saw and discourse I read online. And thankfully that matches my experience, it's the most robust and "it just works" laptop I've used.

Re:The Forgetful CPU (Linux on M4) on Friday October 02, 2026 @10:16PM (#49940798)
I had a bad experience with my Lenovo laptop. It had a firmware issue that caused the trackpad to become unresponsive after suspend and Lenovo never fixed it.

Made the laptop miserable to use, so I went for a MacBook instead which wouldn't have such an obvious issue be unfixed because Apple has so few SKUs to support.

Also went for it in part because I do not like Windows and macOS typically would save me when Linux support was lacking. Just had to hope for a quick port of Asahi Linux to become (unfortunately didn't happen for my M3, but thankfully it's been progressing recently).

Re:Gemini 4 Argon on Wednesday September 30, 2026 @07:14PM (#49915699)
It's annoying because on Plus, you used to get the latest models. Then for unspecified reasons and without announcement, you just stopped getting new Flash models.

That's strange since as Plus, you still get access to latest Pro (albeit 3.1) but not the latest Flash.

I would understand if I Plus subscribers still got access to 3.7/3.8 Flash, but it just burned through the usage limits faster.

Re:Windows 11½ on Monday September 28, 2026 @05:42PM (#49884824)
I've had a pretty good track record with Fedora Atomic / Silverblue. The thing I like best about it is that I can have updates safely staged in the background invisibily. And next time I reboot my computer, I boot into that new version. No waiting around or anything.

That's not to say it's perfect. There was a pretty bad bug maybe around 2 years ago where upgrades just stopped working and without any warnings. You had a notice the issue and run a special command to fix the issue. I've also had quite a few AMD/kernel regressions recently that resulted in artifacts in the desktop and AV1 video decode.

I wish there was like a Debian but atomic that has broad support like Fedora does. Though I did see that openSUSE leap 16.1 introduced an immutable option.

Re:What even is an OS now? on Friday September 25, 2026 @07:31PM (#49851445)
And when applicable, the program would be much more efficient than the LLM.

So it would really be beneficial for the LLMs to be able to have their own environments to write and run code, but also to store those programs for later use automatically.

> data for 2026 came out and now the IOS app store has a 84% percent year-over-year increase in new app submissions

Wasn't it also the case that that the number of installs remained flat? So despite more apps being made, there didn't seem to be a demand for them.

Re:The Claude Delusion on Monday September 21, 2026 @11:26AM (#49788512)
> How is a fictional character the product of someone's mind, but a character generated from a massive database of words from other people's minds is not?

I imagine it's the difference between a chef combining ingredients with intentionality vs a person going to multiple fast food restaurants and blending everything together.

Re:Btrfs/ZFS/bcachefs under workloads classic benchmarks skip on Saturday September 19, 2026 @04:29PM (#49769862)
bcachefs was already working at its own pace prior to being accepted in the kernel. It could have continued doing so for years until it was really "ready".

Instead it got kicked out because Kent constantly ignored the kernel's contribution rules and is unlikely it will ever be accepted back into the kernel.

Re:Ubuntu 26.10 completes transition to Rust-based coreutils on Tuesday September 15, 2026 @07:48AM (#49711100)
There's a project called "anylinux appimages" that aims to make the most compatible appimages. They also use DwarFS for faster opening and smaller file sizes.

See: https://pkgforge-dev.github.io/Anylinux-AppImages/

He has a bunch of projects. Most notable being:

- Bottles (Wine/Proton runner)

- cpak

- Atoms (container manager)

- VanillaOS (atomic OS with bespoke tooling)

- Sinty OS (another atomic OS with bespoke tooling)

- Sinty DE (desktop environement + apps)

It's fair to say most of them are AI generated nowadays.

Re:GrapheneOS' rewritten Messages app is released on Friday September 11, 2026 @04:10PM (#49664633)
They mentioned you can use the Alpha from their app installer.
Re:It took a year to ship WebAssembly in Anubis on Monday September 07, 2026 @08:13AM (#49597416)
That's exactly what's happening to the Linux git repository. The server constantly has mutltiple CPU cores dedicated to rendering git of various old, dead branches in html for scrapers.
Re:GrapheneOS Overhauled Default Apps and Secure Clipboard on Sunday September 06, 2026 @08:11PM (#49592308)
Can you please elaborate on what you mean?

Ubuntu does not aim to be a permissively-licensed system. It can include copyleft (e.g. GPL) and permissive (e.g. MIT) without issue.

Permissively-licensed systems like FreeBSD and GrapheneOS cannot include GPL code if they want to remain permissive.

Apple made some changes specifically for Asahi Linux to make it more robust.

I believe it was Hector Martin who discussed it on Mastodon a while ago.

I believe the main things are that block lists have to be updated through the Chrome Web Store and there is an upper limit for things that can be blocked.
Re:Omarchy: Any User Process Can Escalate to Root on Sunday August 30, 2026 @01:18PM (#49500650)
Any user process can append anything they want to your shell rc (.bashrc, .zshrc). In this case, they added a bash function for a fake sudo prompt. It then uses the password the user entered to run a malicious payload as root.
Just billionaires giving money to a friend's project.

Older »