News for hackers. Stuff that matters.

perlgeek

Re:WTF Ubuntu? on Monday November 02, 2026 @01:55PM (#50341756)
I don't quite understand this page. I thought the kernel binary was in the `linux-image-` packages in Ubuntu.

For example, I have linux-image-generic installed, description "Generic Linux kernel image This package will always depend on the latest generic kernel image available." and then "Depends: linux-image-6.8.0-147-generic, linux-modules-extra-6.8.0-147-generic, linux-firmware, intel-microcode, amd64-microcode"

Why isn't there linux-image or linux-modules-* listed as an affected package?

First I thought it was the source package / binary package distinction, but e.g. linux-image-7.0.0-38-generic says "Source: linux-signed-hwe-7.0", and linux-signed-hwe-7.0 isn't listed as an affected package either.

So what's going on here?

Re:Binance-hacker-1029 – $5.6B stolen from Binance on Friday October 30, 2026 @04:15AM (#50301092)
NK, NK, NK.

Seriously, they have professionalized attacks on crypto infra to a degree that whenever you hear about a massive heist, you can be pretty sure it's North Korea.

Re:Binance-hacker-1029 – $5.6B stolen from Binance on Friday October 30, 2026 @04:12AM (#50301072)
I love how @cz_binance tweeted "user funds are safe!" in that thread. Wasn't that a bit too early? Are they?
Why would request compression be obscure? When you support posting big forms, requests get big too, so why not compress them?
Re:Railway Security Disclosure on Thursday October 22, 2026 @08:45AM (#50194582)
It seems the bugocalypse (or however you write that) has landed.
It seems that somebody / something only created a single byte of randomness for each certificate.
You should start at "" or 0, not "1".
Re:GitLab CVSS 10.0 Integer Overflow issue on Wednesday October 21, 2026 @04:39PM (#50187297)
Back in perl 5.8 and older, the regex engine worked by recusing at the level of C functions, and so you could trigger stack overflows by giving it large strings.

Is this similar?

I wonder why gitlab even has its own regex compiler. Or is this a vulnerability in an underlying library or programming language?

My attempts at finding a middle ground:

* I use LLMs to resolve the more annoying merge conflicts. It's not super hard work, but I don't like it, and I don't think I learn much from doing it.

* I implement a feature by hand, write some basic tests, and tell the AI to review it and write tests for cases that I missed (or was too lazy to do, most of the time)

* For 80% of the bugs that I fix, I have a pretty good idea going in where the bug might be. In the other cases, I ask the LLM to generate a list of hypotheses what's wrong. Often (but not always) it turns out one of the hypotheses was right.

* Sometimes it's not so easy to figure out how to trigger a bug in a test case. Haven't done it yet, but I plan to ask LLMs to experiment to try to do that for me.

* I use LLMs to generate tools that I wouldn't otherwise write (not high enough priority, too lazy, ...). For example, we had a rabbitmq connector that occasionally kept getting stuck without reconnecting in rare patterns of network interruptions. It wasn't really high priority for us (rare, easy to work around by restarting the service), so I didn't want to spend days of engineering on it. I asked Claude to write me a test harness that reproduced the issue, and it did. Having a bunch of automatically runnable scenarios made the actual fix not too hard.

* Sometimes, I have some software design problems where I feel I have a pretty good solution, but something about it feels off. Talking this through with an LLM often helps to refine or change the approach.

---

This approach to AI usage doesn't make me 10x more productive, but I do think it's a net benefit both for code quality and my enjoyment of the job. I don't know if, in a few months or years from now, I'll still be competitive like this, but right now, I'm doing fine.

I think it really depends on the language and the project.

The more types of potential errors your compiler catches, the fewer unit tests you need. Haskell needs fewer (and potentially different) tests than Perl or Python.

The other thing where unit tests really shine is testing a complex algorithm. If you think of a problem with a very well-defined output (like sorting, searching, some types of computation, graph algorithms, geometry problems etc.), then it's pretty easy to come up with a stable API and thus stable tests. I'm pretty convinced that unit tests give you more bang for the buck than plain-English test plans that you need to spend tokens on to evaluate.

Re:AI is a tool and using it well takes skill on Tuesday October 13, 2026 @03:30AM (#50068055)
On https://www.theskepticsguide.org/podcasts/episode-1109 one of the hosts, Cara Santa Maria, mentioned that she hadn't really used LLMs / Chat bots before.

But now it is integrated into the charting / medical records software that here clinic uses, and now it saves her lots of work, and even flags discrepancies between things her patients said and the other medical records.

This illustrates that for the average user, AI works if it's properly integrated into software. For most people, saying "look, here's AI, it can do everything that you ask it for" isn't really practical. It's not even practical for me, a power-user and programmer, because I want my AI usage be subject to constraints (sovereignty, well-defined scopes what it's able to do). Doing that all by myself sounds tedious and challenging.

So for most people, AI is a building block, that hopefully will be used to build tools they actually enjoy using. Don't expect everybody to build their own tools, even though they possibly could, using AI.

Re:The people holding up the internet on Thursday October 08, 2026 @03:13AM (#50002703)
The difference is that the employees at tier 1 backbone providers get paid, and if one of them quits, there is an organization responsible (and incentivized) to hire and train replacements.
Yes, we should all have opinions on products that consume resources on a societal scale.

Opinions don't necessarily equate with a desire to remove them, there could also be (dis)-incentives like taxes, removal of subsidies etc.

Technically, this doesn't answer the question, which was about investment money, not about the investment firms.
It's certainly well spent if we eat the crops.

If it's fed to farm animals for meat, that reduces its efficiency by an order of magnitude. There's still plenty of discussion to be had if that is water well spent. It probably depends on a lot of factors.

Re:Tokens Too Cheap to Meter on Wednesday September 23, 2026 @03:05PM (#49820945)
Renting out compute is a viable business model. That's part of what the big and the small cloud providers do. It's just (on its own) not a "get rich quick" business model anymore.

Why would it be any different for inference? If we believe OP, it'll just become part of regular compute infra, and thus part of the renting-out-compute business model.

I think it's an open question if the current generation of inference investment will pan out, but in the long term, there'll be a balance between investment cost and margin, just as in every other industry.

Re:Jev in 25 Lines of Python on Wednesday September 23, 2026 @12:38PM (#49818738)
> In real life, a human doesn't do classification tasks with the System One part of their brain, they use System Two.

I'd argue that most human classification is pre-conscious / System One. You see a table, you recognize it as a table without asking yourself "is this a table?"

I guess their marketing implies that it moves classification into system one response time.

Not very practical for a solution that requires a browser plugin. The browser is where most of my interesting data is.
Re:AI Safety Is Mostly a Sex Cult on Thursday September 17, 2026 @06:07AM (#49738589)
> Problem is, Aella has made it her business to speak about it publicly

Why is that a problem? Just don't read her stuff if you're not interested.

There are lots of people talking all the time about stuff I'm not interested in.

Re:AI Safety Is Mostly a Sex Cult on Thursday September 17, 2026 @06:05AM (#49738574)
I've tried to read this, but somehow the article doesn't really come to a point. Is there any point besides Yud not being perfect, and having connections to people who openly talk about their sex life (and that it's somewhat non-standard)?
Re:Software Drives People Insane on Thursday September 10, 2026 @03:21PM (#49648977)
When I read the title, my mind immediately jumped to something else: negativity.

I've noticed that my own mind always searches for corner cases, error conditions and failure modes. This can be super helpful when planning new features (or explaining to stakeholders that certain conditions must be met first, when they want some new features), but when it extends to other things besides software, it can be psychologically unhealthy.

Re:Show HN: What if the speed of light was 5 km/h? on Thursday September 10, 2026 @06:31AM (#49641362)
The wavelength of light is λ = c / f, where c is the speed of light and f is the frequency.

When c is approximately 10^7 times lower, so is the wavelength (if we keep the frequency the same), so now-visible light would have wavelengths far shorter than an atom or a molecule, and probably couldn't be easily detected by biological means.

You could say: sure, maybe we'll just see light at lower frequency. Maybe that's true, but the energy of a single photon is E = hf, where h is the Planck constant. So if we assume much lower-frequency photons, they have much lower energy, and thus become harder to detect.

Lots of other things could be different, like chemistry, heat conduction etc.

At a height of roughly 1.8, at c = 5km/h, light would take 0.1 seconds to travel from head to toe. Nerve signals are much slower than c, so human bodies likely wouldn't exist as we know them.

The list of potential implications to consider is fascinating, endless and maybe even a bit overwhelming :-)

Re:What do Visa and Mastercard do? An intro to card networks on Thursday September 10, 2026 @05:56AM (#49641097)
Just came back from a vacation in Denmark and Norway, paid with debit card everywhere.

Heck, paying with card is the default, if you do pay cash, the cashier sometimes has to cancel the card payment before accepting the cash.

Re:Flock Wants a Closely Surveilled World with No Exit on Wednesday September 09, 2026 @08:26AM (#49625421)
The GDPR is far from perfect, but it does cover this. It talks about acquiring and storing information that can be used to identify people. It doesn't specify what counts, so now that face recognition is pretty, it automatically applies to images.

It also talks about uses cases where such things are allowed to be recorded, and forbids all others.

> IMO it is much more practical to regulate and penalize the activity of using such a network than to preempt its creation.

Hard disagree. If such a network is created, foreign adversaries (or domestic ones that don't abide by the laws) can hack them. Has happened quite a number of times.

Re:Flock Wants a Closely Surveilled World with No Exit on Wednesday September 09, 2026 @08:21AM (#49625351)
>There is not generally an expectation of privacy in public.

And that's the problem, because if there isn't an expectation of privacy, and we record everything that's "in public", we land in a dystopic hellscape.

The problem is really that "privacy" vs. "public" isn't a binary choice. Yes, I expect people to see me in public if they happen to walk by. That's quite different from every movement being recorded and made searchable. Most privacy laws don't really account for that being possible.

Re:Twenty One Zero-Days in FFmpeg on Saturday June 13, 2026 @03:36AM (#48514502)
(not op)

If a security bug is exploited in the wild, it's an n-day if it's been first exploited n days after the publication of the bug, and a zero-day if it's been exploited before or on the day of the publication.

When a bug is not yet exploited in the wild, it's just a discovery of a bug, not a zero-day.

Let's see... first of all, 14 years ago was the discovery of the base mechanism, not of specific treatments. So specific treatments need to be developed, delivery systems need to be developed, side effects reduced. Then you need safety tests and efficacy tests.

> mRNA vaccines are also quite different. Do they modify the DNA? Of course not. So that's already very different.

And yet it took more than 30 years after the first mRNA experiments to develop a successful vaccine. Why it should be so much faster for CRISPR & Co?

CRISPR is foremost a research tool. Calling it "extremely overhyped" without restricting it medical treatment seems disingenuous.

The CRISPR-Cas9 gene-editing tool was developed in 2012, so I don't find it surprising that merely 14 years later, there's only one approved treatment. From discovery to approval, drug development often takes 10-15 years, and often much longer for novel techniques. So I'd say it too early to call it overhyped for treatments.

Finally, I think we'll see a lot of treatments that don't use CRISPR-Cas9, but related gene editing techniques, but it'll take another 10 to 20 years.

Take a look at https://en.wikipedia.org/wiki/MRNA_vaccine#History for how long another novel technique has been in development before it became really widespread with the mrna-based covid-19 vaccines.

You can target an individual by injecting that very individual with something lethal.

If that's not what you want, you'd need something like a virus to spread it. But then you have to ask yourself: what if that virus mutates? The specialization to certain gene markers is an evolutionary disadvantage, so evolution will tend to make it lose that restriction. Ooops.

The article is pretty light on details, but

> Much like other CRISPR therapies, delivery is a critical challenge, i.e., getting the large genome-cutting enzyme to all the targeted cells efficiently.

makes me think this is in vitro so far. So, years to decades away from being available for actual treatment in humans. Still good news.

Older »