News for hackers. Stuff that matters.

nullc

> well designed modern cars have great info-tainment systems which get regular updates. My Tesla gets regular software updates

And tracks you everwhere you go, resulting in that data being available to hackers, marketers, and any sleazeball that wants to extort you by suing you.

Not unique to tesla, of course, but a property of all those 'well designed modern cars'.

Re:I wish I had Tailscale when I was at university on Friday October 30, 2026 @02:58PM (#50308580)
Do you wish you had tailscale because you locked yourself out of your computer and adding a process that listened using MPTCP would have let you exploit CVE-2026-98432 to get back into your computer?

Because that property-- or rather its mirror image in the hands of an attacker-- is a reason I was glad today that I've never had tailscale.

Re:Binance-hacker-1029 – $5.6B stolen from Binance on Friday October 30, 2026 @05:35AM (#50301594)
This is how virtually all "crypto" exchanges work -- especially the closer you get to "shitcoin casino". Proper role and system isolation is a challenge if you support just one cryptocurrency. It would be incredibly hard for dozens, assuming service supporting dozens bothered.

I agree it's a grave fuckup but its a common one. You should just assume that when you deposit coins somewhere there are dozens of people who could just walk off with everything on their own. It's remarkable that it doesn't happen more often.

Re:Binance-hacker-1029 – $5.6B stolen from Binance on Thursday October 29, 2026 @08:54PM (#50298542)
Though in that case the crash was directly due to "effectively altruist" SBF fraudulently dumping customer assets in a half-brained and presumably stimulant-addled attempt to manipulate the market and reduce his liabilities.

Not making any market predictions here-- just saying that it's probably not that useful to generalize from that event.

Re:The Tragedy of Losing Your Wikipedia Page on Thursday October 29, 2026 @08:35PM (#50298359)
> likewise avoiding being a platform for libel and the lawsuits that come with that

I'd state that differently. The law is the limit on how bad you can act and get away with it. Wikipedia shouldn't be smearing people because it's an evil thing to do, not because its a potential tort.

This is particularly important because not libeling someone is not sufficient to prevent them from suing you anyways in any case. :) ... and focus on legal limits results in outcomes like telling people reporting serious crimes that you don't care because you're not obligated to under S230.

In any case compared to practically every other large internet site Wikipedia does a much better job behaving ethically. I've wasted weeks trying to get reddit to take down posts of hacked nudes on a subreddit specifically about posting hacked nudes and sending them to the victim's coworkers. Google does nothing about scam videos/adds reported to them, etc. With english wikipedia, you can hop into a chat channel or mailing list and reliably something which is obviously wildly inappropriate will be immediately handled. 95% of this is because whatever their flaws the site is operated by human beings that care about doing the right thing, rather than some accountability free corporate human-centipede. The remaining 5% is because Wikipedia Is An Encyclopedia, and so some of the free expression tradeoffs that might show up elsewhere just don't apply.

Re:The Tragedy of Losing Your Wikipedia Page on Thursday October 29, 2026 @08:22PM (#50298239)
Notable means unusual/unexpected. The engineer(s) that invented the energy absorptive highway railing has probably saved hundreds of thousands of lives-- but finding their name(s) would be a serious research task, they were just doing their jobs. The man who bites a dog is an irrelevant trivia that has no consequence outside of himself and the dog's owner-- but there will be a hundred stories on it.

Fundamentally it's a flaw in Wikipedia's heavy reliance on media coverage which exhibits this bias most strongly. It's a total mismatch: the media is fixated on the unexpected and irregular, but an encyclopedia is about how things are-- not primarily about the exceptions.

Of course, Wikipedia is also perfectly happy to cite reference works ... but tabloid crap out volumes it be a huge factor and is also a lot less accessible.

I think sometimes about an alternative history where we prohibited newspapers and other current events media publications as citations for WP-- these problems would be diminished but I think the result would be a lot less good for the world.

It's okay that things are flawed... it's just important to be aware of the flaws. One of the ways Wikipedia deals with this is by having a higher bar for inclusion in pages about living people.

Re:The Tragedy of Losing Your Wikipedia Page on Thursday October 29, 2026 @05:10PM (#50296055)
having one is truly bad news for a lot of people.

For many people no one cares about the page except some rando that has some grudge against you because you dated the girl they liked 30 years ago or even no reason at all-- some internet malcontent you've never met might just randomly decide that you're whats wrong with the world.

And because you're obscure there is nothing about you online except that one article they got their buddy to run about you in some obscure publication that implies you hate pets. So inevitably that's what the article will be-- Three sentences of biographic details and four paragraphs about how you hate pets.

This is generally a bias wikpedia has: 99% of the substance of a person isn't remarkable by the standards of the tabloids wikipedia counts on as the factual basis of most of its material-- your hopes, your dreams, most of your accomplishments, that time you helped a stranger change a tire,... almost everything that makes you who you are--, so it doesn't show up in any citations and has no chance of staying in an article if someone who knows the game wants it gone. But that one time you said something dumb on the internet-- it's notable specifically because it's unusual, it's well cited so good luck keeping it out if anyone wants it in. So that's what exists and that's what the article will be about at least as soon as a single person wants that. For truly famous people there are biographies and such, and those articles at least have a chance of being well rounded. For everyone else, a WP article about them is just a coat-rack for a piece of the most unusual part of their life that some hater could dig up, or at least one of those just waiting to happen.

It's like the Bill Murray quote: "I always want to say to people who want to be rich and famous: 'try being rich first'. See if that doesn't cover most of it.". Having a WP article often turns out to have many of the downsides of being famous, without the upsides that normally come with other processes for being famous.

Re:The Tragedy of Losing Your Wikipedia Page on Thursday October 29, 2026 @05:07PM (#50295999)
Having a wikipedia page is no kindness particularly as a relatively obscure person, unless you're some raging narcissist that values the attention over all the downsides.

Sufficiently obscure pages are dumping ground for random defamation, delusions, and pranks. The flip side is that they turn into self-promotional orgies-- and fund the operation of PR firms shitting on the project's content to support their clients. None of it is good.

Re:Patrick Stewart has died on Thursday October 29, 2026 @04:58PM (#50295844)
I learned today that the son in that episode is Patrick Stewart's son.
Hm. I wonder if having a differentiable CPU in fixed weights might be useful-- you could propagate gradients through it. At inference time it could be replaced with a conventional implementation.

I think the RNN sidebar does the reader a disservice. Ordinary casual attention can do exactly the same thing-- it's just less computationally efficient (state grows with the number of bits vs the number of accesses) and so not as useful for qwenputer compiler.

Then remove GLM-5.3 from the title.
Re:The Exponential Time Hypothesis Is False [pdf] on Monday October 26, 2026 @07:55PM (#50252895)
> the number of operations needed to solve satisfiability will always be exponential in the size of the problem, no matter what algorithm is chosen

A common complexity theory misunderstanding is that statements like this applies to all or even most instances-- and it leads to objectively bad engineering of the form "oh look this is actually 3sat, it's unsolvable".

(Great fodder for a midwit meme: idiot and genius say "my heuristics go brrr!"-- midwit says "No no no! NP problems can't be efficiently solved!")

Any specific instance may be efficiently solvable (and perhaps all instances coming from your particular problem set -- a subset of all possible 3sats).

So I would add to that paragraph "at least for some 3sat instances".

Re:Anthropic S-1 on Monday October 26, 2026 @03:14PM (#50249401)
> in the continental US, you cannot refuse to accept a dollar note

Absolutely untrue. Outside of some local laws governing cash at retail you're under no general obligation to trade with someone if you only want payment in cybertrucks and all they've got is dollars.

Re:OpenAI: Securing our frontier model training environment on Saturday October 24, 2026 @12:38PM (#50222904)
It's funny to juxtapose the doomerism claims of superpowerful AI when they refuse to use mechanisms already commonly used for high security systems.

You create an airgapped network and monitor the systems using that. This is not rocket surgery.

Re:Is this the new cyber normal? on Saturday October 24, 2026 @02:08AM (#50218715)
Make cyber not cyber.
Re:Is this the new cyber normal? on Saturday October 24, 2026 @02:08AM (#50218714)
> New features will produce new bugs, unless everyone pays for the tokens to scan every release with the top-of-the-line agents

Insufficient. Models available to you are already cyber-gimped today and seems likely that they will be moreso in the future (see the recent K3.1 announcement for example). There will be attackers that lack such handicap.

Re:Is this the new cyber normal? on Saturday October 24, 2026 @02:05AM (#50218699)
One can defend by quarantining any submitted fix, developing your own without reading it. Then only after that compare them.

In any case you don't even need malice --- sincere reporter can vibe up a fix that accidentally introduced a vulnerability, owing to their own lack of domain expertise and model errors... and then this bad fix makes it in because in the thrall of confirmation bias you fail to notice its shortcomings. Reporter also presumably tested it against their own LLM, so that will pass too.

This happened recently in a cryptocurrency project and contributed to a significant exploit.

So what do the LEO and prosecutors believe here? That she managed to conceal the money coming into her possession, that she managed to conceal the connection between her internet accounts and the cashapp and facebook activity ... that she had cashapp accounts in many other names, yet she signed up for cashapp with her real name for the account used in the scamming?

A commenter on the article suggests Block needs to do more to verify the account identity-- what are they supposed to do? The scammers have as much or more information than Block does about a person... in part because stealing that "verification" information is primary what powers these scammers in the first place.

If companies did managed to find some morsel of verifiable PII that the scammers don't have (what-- pictures of your butt? they've already got everything else!)-- they'll have not long after companies begin demanding it.

Re:Every AI model has the same "controversial" take on humans on Thursday October 22, 2026 @07:44PM (#50202663)
> They're trained on all of human history,

Training itself doesn't directly produce synthesis, -- it creates reproduction. Generalization during the process can result in novel output, but that can go either way as nothing selects for insight vs hallucination.

Models are also trained on synthetic material (as opposed to your 'human history'), which may result in fixating novel concepts and not just reproduction. But there is no particular reason to expect any reliable insights from the way this is done outside of the domain of machine verifiable objective results.

For this kind of "your take on X" one shots-- the model is almost certainly regurgitating some bias from training.

Re:Getting ready to operate GNU Taler in Germany on Thursday October 22, 2026 @05:07PM (#50201050)
Indeed, taxation today and historically is not based on mass surveillance and doesn't depend on mass surveillance.

If you're failing to pay taxes on any scale you're going to get caught by whistleblowers or by conspicuous visible purchases. Enforcement isn't 100%, of course, but it never is for any crime and it doesn't need to be.

Even if your effective tax rate is 50% evasion can only double your money at best, and you've only got taxes to pay if you've got a successful income stream-- it doesn't take much threat of imprisonment or large fines to keep someone with something to lose staying within the lines. You're already making good money (if you're not-- no taxes) so why risk your good situation for a small constant factor more?

Some amount of successful evasion simply means somewhat higher taxes for everyone else, and that is a reasonable compromise for not living in a panopticon-- particularly since no amount of surveillance can entirely prevent tax evasion.

To the extent that someone wants to engage in evasion they'd route around this surveillance system or not even worry about it: Data isn't intelligence, visible income can be offset by fake expenses (which are private in this system too!)-- and so it can't be said that this scheme's surveillance would even be particularly effective at blocking tax evasion. You'd be left with detecting it via traditional means, just as you already can even with completely private transactions, but without the privacy loss.

So it's a non-solution to a non-problem, that create significant privacy related collateral harm. It can do both because non-evaders won't bother to take the additional steps to protect themselves, and are exposed to every hack, leak, data-breach, change of policy, or abuse of lawful process.

(Analog: run strong encryption or strong encryption+steganography inside key-escrowed encryption. This possibility bounds the potential benefits of key escrow but fails to bound the harms.)

For any system one should imagine the abuse potential should the currently benign regime be replaced with a future genocidal one. Certainly Germans should be well acquainted with the value of that kind of reasoning-- it isn't like targeting sub-populations for asset seizure is a hypothetical threat. A key property of privacy loss is that it's forever: you might not mind a piece of exposure today but years from now it could turn fatal.

But even then I wouldn't complain about it except for the misleading presentation of it as a privacy system and the smearing of opponents as tax evaders.

It's simply a falsehood to claim people opposed to this are opposed to taxation. Personally, I find taxation to often be a superior choice to fund public infrastructure compared to the most obvious alternatives such as printing money or accumulating debt-- particularly because taxation is more visible and thus more accountable. But we must take great care to mitigate the potential collateral damage of taxation including accounting overhead, market distortion, and loss of privacy.

The false and defamatory characterization of opponents as tax protesters is part of why I feel comfortable saying that I believe the mischaracterization of the system as 'private' is an act of intentional fraud. An honest system doesn't need to discourage or suppress its critics by falsely accusing them of being in favor of crime or other anti-social conduct.

Re:Getting ready to operate GNU Taler in Germany on Thursday October 22, 2026 @02:17PM (#50199085)
It's absolutely deceptive as you're seeing demonstrated in this thread-- I comment on this intentional and-- you believe "not hidden" lack of privacy-- and I get a reply demanding a publish a paper to prove it ("Papers please"... fitting!). This has consistently been the case for Taler. Sure, you and I are aware of the limitations-- but we're domain experts.

People hear that it's private and -- unsurprisingly-- think it's private! :P In my view it's like to Apple's proposed content scanning in end to end encryption that applies a lot of additional cryptographic complexity with language that suggests that it's protecting the user's privacy, but in reality the complexity is entirely there to undermine their privacy (in a somewhat selective way) and a far simpler scheme would give much stronger privacy.

I think it's analogous to promoting a key-escrow cryptosystem as "communicate privately!"-- both in terms of people not getting the privacy from it they would expect and helping to bring about a world where actual privacy is unlawful. The privacy problems of Taler are essentially identical to those of key-escrow: even if you don't have any fear of 'lawful' access, any access that exists may be abused. The only reliable solution to the security/privacy problems is for the access to not exist unless that is literally impossible. But it's clearly not impossible, as many people use more private systems than taler every day including in Germany.

Taler is strictly less private and considerably more complicated than a basic chaum-cash token system-- which actually provides the privacy people expect it to have. So it's not like I'm suggesting blockchain mumbo-jumbo is the only alternative. :)

Re:Getting ready to operate GNU Taler in Germany on Thursday October 22, 2026 @01:26PM (#50198398)
This is a surveillance oriented alternative to cryptocurrencies which uses the distraction of complicated cryptography to obfscuate the fact that by design it intentionally undermines the privacy of its users: it attaches the receivers identity to every payment they receive, along with the amount and makes it non-private-- potentially opening the door to abuse by kidnappers, extortionists, marketers responding to income signals, plaintiffs attorneys, and other such scoundrel.

The claims that is is privacy preserving are deceptive, and in my option constitute an act of intentional fraud on the part of its creators -- the fact that people are deceived by the privacy claims is clear in your comment: You ask why would the banks adopt something private. The answer is: it isn't.

Its existence is justified under a fairytale model of how the world works-- a false belief that actually anonymous payments are unlawful and that their compromised alternative is the best possible. In the path of doing so, they not only falsely sell a system with compromised privacy as private, but they also help bring about a dystopia where privacy is unlawful in much the same manner that doing business with companies that refuse to accept cash does.

It would be fair to say that its an upgrade to privacyless systems-- because it doesn't attach the sender's identity to the transactions themselves--, but to characterize it as a private or privacy preserving system is a lie.

Re:EMudhra Intermediate CA Compromise on Tuesday October 20, 2026 @08:33PM (#50174595)
On the plus side, this should enable liberating a lot of locked down devices.
Re:EMudhra Intermediate CA Compromise on Tuesday October 20, 2026 @08:33PM (#50174593)
Get up, get, get, get down HSM is a joke in yo town.
> Do not provide legal opinions, defenses, or interpretations on behalf of WhatsApp Do not engage in legal discussion or debate Do not assert that WhatsApp is or is not responsible for any damages

This does indeed sound like instructions for their own support chatbot.

Re:MiniMax M3.1 Flash on Monday October 19, 2026 @08:24PM (#50159799)
You're making a fair point-- but I think it's important to reflect on what it says about tinfoil's values: They believe that they are ultimately in charge of computing you purchased from them, rather than you. I agree, It's an improvement that the structure forces them to be somewhat more transparent about their actions and doesn't necessitate the hard privacy loss computing other approaches to subjugating third parties to control over their use of computing. But coercively controlling other parties use of the private computing that they bought and paid for is both unnecessary and unethical, and demonstrates harmful paternalistic and authoritarian tendencies on the part of the companies management.

Depending on the balance of your concerns a ZDR that is lying about their privacy might still be an improvement because they can't both safely conceal the violation of their promises AND tamper with the output.

When one factors in the lack of absolute protection provided by secure enclaves-- that they're reliably bypassable with advanced techniques and thus mostly serve the purpose of keeping honest people honest, I think it would be better to avoid doing business with any enclave provider that has already demonstrated such leanings.

Re:MiniMax M3.1 Flash on Monday October 19, 2026 @05:58PM (#50158658)
See the sibling comment, tinfoil added scanning inside the enclave.
> The context gets added back to the latent vectors (which are the Q,K inputs) after every transformer layer, so they are "at least 50% words".

Not in a modern decoder-only transformer it doesn't. The tokens are turned into embeddings which are fed into the residual layer at the front. From then on it's latents all the way down.

Each layer does a feed forward update of the state, like the euler step in ODE solver-- but what they're operating on is the evolving hidden state and not the tokens/embeddings. So there isn't any sense in which the representations must remain 'words'.

(Okay fine Qwen3.8-flash-next injects an ngram embedding at layer 2 too-- but that's it).

[Source: I've directly implemented inference engines for multiple SOTA open models on weirdo hardware-- they wouldn't have worked if I got this wrong...]

> If you start doing continuous chain of thought in a 1M-token context you're hundreds of millions of layers away from tokens.

The KV state in that 1M token context is also potentially far away from any state that is observable outside of the model! (this being my point, and why I'm bothering to disagree with your correction).

Now I would agree that there being concerning hidden state is not likely and thus not a major concern, but it's not likely for the same reason that it's not likely in latent reasoning.

> People at the big labs have been terrified of losing the chain of thought

An irony here is that by hiding their own COT for (anti-)competitive reasons they've made latent reasoning models more palatable to everyone else. Those of us who primary open models are rather addicted to reasoning access and wouldn't be quick to give it up for a small performance improvement. But if you're used to concealed reasoning of BigLLM, welll.....

> The last thing we want is models turning on us ‘for our own good’

most important guard against that is to STOP explicitly training for paternalistic behaviors (which is ... basically half of what 'AI safety' is about in practice-- overriding the user 'for their own good').

Older »