News for hackers. Stuff that matters.

nrmitchi

Re:Northflank Breached on Friday October 30, 2026 @06:30PM (#50310973)
I didn’t say competitors; I said customers.

If none of your customers are up to call your service, it does not matter if your service is up or down.

Re:Northflank Breached on Friday October 30, 2026 @02:33PM (#50308260)
This is especially true if the majority of your customers are also on Microsoft/AWS/etc.

Literally 0 of your customers will notice that you are down if their own systems are also not working.

This is perfectly valid for many businesses, up to a (shockingly high) level.

Re:AI Isn't Replacing SREs. It's Deskilling Them on Friday October 30, 2026 @02:19PM (#50308054)
A (very) key difference is that this behaviour is mandated by the FAA, and consistent across all providers. There isn't a (legal) option of just not-doing-it because it's "cheaper".

Modern companies generally do not have the same incentive to keep their SRE (or engineers in general) upskilled. Cutting SRE because "we don't really have incidents, why do we keep paying them? If we need to do layoffs I would rather keep a product engineer" will always* (okay, _generally_) be the direction that organizations go without external influence or requirements.

Now I am sure there are some companies or industries where this is required (for example, I would not be surprised if certain military software/services contracts had requirements for support staff with X hours or training/etc), but that is not consistent everywhere.

If we want something that is "money-losing" in the short/medium term to be consistently applied, it unfortunately needs to be (uniformly) regulated.

Re:MacBook Pro with PROLED XDR Display and Touch on Wednesday October 28, 2026 @04:15PM (#50280242)
> Apple never drops prices, never.

The first gen apple TVs were $300.

The second gen was $99.

The first and second 4k gen were $179.

The third gen was $129.

They might not drop prices on existing models, but they have definitely dropped prices on new versions of product lines.

Re:MacBook Pro with PROLED XDR Display and Touch on Wednesday October 28, 2026 @03:55PM (#50279959)
Those are completely disjointed things though, and one of them (price of RAM) is currently very-much outside Apple's control.

IF memory prices drop, apple product prices will likely drop. And it will stay lighter.

Re:Anthropic S-1 on Monday October 26, 2026 @03:23PM (#50249536)
Fwiw I agree that SpaceX is generally completely detached from reality and I am as-close-as-I-can-be to sure that Elon is doing some heavy manipulation behind the scenes, but this has changed recently as lockups expired. IIRC the current float is ~30%, compared to it's initial IPO when it was comically low at ~4-5%.

30% is much higher than 4-5%, but it's still much lower than most public companies (~80%)

Re:Anthropic S-1 on Monday October 26, 2026 @03:20PM (#50249487)
As others said, the market is generally unhinged currently, with enough extremely wealthy people needing somewhere to put money that doesn't really matter to them, and I suspect some level of "investing in SpaceX public stock" is done to appease/appeal-to Elon.
Bullshit plea deals are offered in bullshit cases like this only so that the "officers" involved can save face and claim "yupp, conviction!! we're the good guys!" because there is no additional downside or risk to them.

It really would be great if judges could (and would) issue sanctions and/or personal fines against people who are so clearly operating in bad faith.

Re:Railway Security Disclosure on Thursday October 22, 2026 @12:42AM (#50191254)
I don’t know if this is a real question, but for most credentials a stolen key is worse than downtime on a product.
Re:Railway Security Disclosure on Wednesday October 21, 2026 @07:03PM (#50188890)
> It’s funny that every security breach disclosure now has a mandatory “the attacker used AI!”

This isn't in the article? They do not at all claim "the attacked used AI!".

The only mention of "AI" is "We believe this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers." This is the same (apparently) end-goal as the Opencode breach last week, and is not blaming or finger-point at AI. It is stating (rightfully) that AI inference is very easy to resell and turn stolen credentials into cash.

Re:Another day another GitHub incident on Monday October 19, 2026 @12:30PM (#50154422)
> Github seems to have degraded measurably after they got acquired. As is tradition.

I'm not disagreeing with you that it has degraded, however it was acquired almost 8 years ago at this point, and the software world has been turned on it's head in the last... 3?

Software generally degrades post-acquisition, I'm not denying that. Github has definitely degraded. I'm not sure I would agree that the core reason in this case is "the acquisition" and not "AI making software and free-CI-load demand 3-5 orders-of-magnitude higher than it was 3 years ago"

> The current president has managed to obtain several proxy votes of rental property owners and the current board members use these to overrule any objections to them reseating themselves

If they are using "proxy votes", then there is in fact a vote. If your objection is that they ran unopposed because no one else bothered to give a damn, then... you should try giving a damn. Apparently you can be the person able to "gain tremendous power and authority" just by showing up, and then you can do something about it.

> that typically allows people to gain tremendous power and authority without anyone voting for them

Come on, at least try. HOAs (typically, your word) have elections. Someone doesn't just walk in and declare themselves the association president.

I was on a COA board for... close to 5 years. And definitely not because I wanted to be.

It's not a competition, but I'm pretty sure my "wow this is totally fucked up" stories beat yours ;)

You can very easily run to be part of your HOA leadership, and it is significantly easier to do than kicking an elected professional-politician out of office. The biggest issue with most HOA/COAs is that basically no one (especially the people who might have some qualifications) want to participate. This leaves only the people who want to be, frankly, petty little shits. It is not hard to exert influence over a group of 20-30 despondent neighbors.
> most HOAs manage a tiny amount of communal green space that should have been turned over to become city property, but was held back as HOA property to give the HOA a reason to exist.

You are just making this up at this point. Why do you think the city would accept property that they would have to legally maintain and be responsible for, when it is generally isolated and (largely) accessible to only a specific neighborhood?

> given that an HOA is completely unnecessary...

This is true sometimes, but if you are upset at a specific HOA, look at your docs to see what it actually manages. HOAs exist to pay for community obligated costs; sometimes that is a pool, sometimes it's "water and gas bills", and sometimes it's an entire golf course.

Further, if you're talking about a condo building (which, yes, is technically a COA, but the two get combined all the time), it is literally paying for your roof and elevators to work.

Buying into a "little club" and agreeing to pay your share of expenses only works when everyone participates. If not, your neighbors are just paying upkeep on your property; why should they have to do that?

Re:OpenCode Hacked: User credentials leaked on Saturday October 17, 2026 @05:30PM (#50135322)
What the the purpose of this comment? Neither of those "red flags" you linked to are related (one is about config loading precedence, and the other is about Codex CLI, which is completely a completely different product and development team.

Exterior-compliance proxies, yes, are a good thing; but are also completely unrelated to the fact that OpenCode's hosted solution, that requires having credentials in some fashion, was popped.

Shitting on anyone who uses OpenCode (rather than your preferred vendor-specific product) as not being "sensible" is also completely out of hand and unnecessary.

Re:Tesla Roadster on Friday October 16, 2026 @02:34PM (#50122456)
> and the entire passenger seat is replaced with a pressure tank.

That sounds extremely explosive and not something any random person should be irresponsibly driving around.

Re:More on Anthropic's Scion ripping off Mononoke on Thursday October 15, 2026 @03:20PM (#50108854)
> “Our LLM built this thing, productionized it, and dealt with all the attendant challenges over 5 months” is a significantly more compelling narrative than “the source control team at Meta had spent 10 years building and productionizing this system, and we were able to point our LLM at it and rebuild it in 5 months”.

This is, unfortunately, the largest underpinning issue with a lot of software currently being released from AI-heavy engineering workflows. Even if it wasn't done explicitly, (almost) everything modern LLMs spit out is built on top of decades of prior failures by humans; even if something is "novel", it's trivially easy for the LLM to start with excluding all the paths that failed before (that humans were generous enough to share freely)

tldr; almost everything these days is a copy, even if we don't know what it's a copy of (yet).

I personally thinks that’s the more optimistic of the two options; I’ll take it as a win for today
> One of the materials is most likely impossible to synthesize

Is this a "actual impossible because it's inherently contradictory", or "we just don't know how to do it yet but give us a year"?

This is frankly one of the best uses of LLMs (along with proposing and evaluating drug therapies), and I think it's (at least partially) because these are things that will only work in the hands of people who are already experts and motivated in the field. The proposed thing is validate (or not validated), and then everyone moves on (either using the cool new thing, or knowing that it doesn't work). I'd also throw robotics in here.

The fact that the major "uses" of LLMs have been contributing to the acceleration of the dead internet theory, and building millions of versions of the same apps that no one is going to maintain, is extremely sad.

> Imagine you have an AI tool capable of successfully persuading 5% of viewers with individually-targeted material.

I don't think this has to be imagined.

> but there’s a limit to how surprising a bill can be

I think they explicitly said that.

Re:Sites in ChatGPT on Friday October 02, 2026 @01:51PM (#49936436)
All of these "side quests" (and especially this one) are attempts to build a walled-garden.

Especially this. OpenAI will host it. OpenAI will throw "Sign in with ChatGPT" there. "Apps" will be built that depend on end users ChatGPT "connections". The app will fundamentally not work without an end-user having a ChatGPT account/subscription and "connected apps".

Having "the best model" will absolutely not support a $1T+ valuation. Owning the activity of 25-50% of internet users (assuming a split between OAI/Anthropic/Google/maybe-Meta), is.

Re:OpenAI bots meddled with multiple US Government agency sites on Saturday September 26, 2026 @07:02PM (#49861425)
> I'm guessing they didn't even read the article.

Straight from the HN Guidelines page:

- Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that".

Re:OpenAI bots meddled with multiple US Government agency sites on Saturday September 26, 2026 @07:00PM (#49861414)
I disagree that that is valid. "Intent" means that you didn't click a button, that button went somewhere it shouldn't, and the action had no intent to "hack".

In this case, the "agent" had every intention of doing what it was doing.

I'm not claiming that "accidental hacking" (whether by human, or agent) is covered and illegal. I am claiming that calling this "accidental" is not a valid defense. One incident? Maybe. But this is pretty far past one incident.

Flock isn’t an “AI” though? It doesn’t put together a case and say “yes, this is the criminal”. It’s not a crime-solving AI.

It’s a camera system, and data can be queried by police. They have to search for something. So the cops searched for a vehicle matching the description in the general area, seemed to take the first one, and called it a day.

That’s not an AI-uncanny-valley. That’s the equivalent of (pre-flock/cameras) looking at vehicle registration list and assuming the one at the top of the list must be it.

The automation-trust is a legitimate concern but it’s not applicable here.

Flock isn’t an automated tool though; you don’t give it a crime, and it gives back an automated package saying “this is who the criminal is”.

As far as I know, it lets law enforcement query for things against the data. Can be specific (like a license plate) or more general (like a dark colored mid-sized SUV around <location> at <time>).

To get where this story is at, cops here must have done the latter, and taken the first name off the top of the pile and patted themselves on the back, and then waited 7 months, and went and arrested her. Unless there’s an explanation for a 7 month delay, it seems designed to allow defensive evidence to spoil.

There isn’t an uncanny-valley of automation here. There is just lazy, grossly-incompetent, bad-faith, and malicious cops/investigators.

Older »