News for hackers. Stuff that matters.

pilif

Unpopular opinion: Accessing a public service with public default credentials is not a cyber attack but a consequence of severe misconfiguration. This is on the supermarkets, not on the attackers.
Re:Development of Norton Commander on Saturday October 17, 2026 @02:00PM (#50133384)
It's not just about two independent panes. It's about two panes in a single context. With this, there can be shortcuts that act in files and which now don't just have a source (the selected files in the active pane) but also a destination (the inactive pane), so copying, symlinking and moving all can be done with a single key without the need to provide a destination.

Two explorer windows are independent of each other. Any move or copy requires two keyboard actions or the use of the mouse

Looks like a different version of WSL2 with a newer kernel and newer VM host software
Re:Apple Watch Ultra 4 on Wednesday September 09, 2026 @03:14PM (#49632496)
The Ultra 2 was sold to me as the watch that can do Siri without network connectivity. That was very useful to me to leave reminders for stuff I think about while on a run without the phone.

3 years later, Apple releases the OS 27 versions and Siri got improved to the point where it can’t work on-device any more on said Ultra 2

So to get the feature back which I paid for and which was specifically used to sell me the device and which now has been taken away from me, I just have to… buy the next hardware generation?

And how long will that last before they decide to remove the feature again?

Thankfully, the Ultra 4 provides some other compelling features making this less painful, but I would have expected at least a toggle to keep old Siri on the old watch. New Siri over the network is impossibly slow and buggy (I made the mistake of installing the betas, so there’s no way back now)

Re:Vehicle Motion Cues on Tuesday July 28, 2026 @04:24AM (#49080963)
Once this was announced a few years back, I was very skeptical that a few dots on the screen would be all that's needed to help me.

And yet, apparently it was.

It's not perfect, but the dots help me to go from instantly feeling sick to lasting 30-40 minutes before I have to stop looking at the screen.

That’s not true for Postgres however: due to its usage of a shared memory pool, whenever a subprocess is terminated unexpectedly, Postgres will kill all other processes and enter recovery mode, replaying the WAL, during which time it will not accept connection requests.

It does this because it can’t possibly know whether the dying process did bad things to the shared memory pool.

Re:IPv6 zones in URLs are a mistake on Thursday June 04, 2026 @10:47PM (#48407362)
This response to the post announcing the article is very telling:

https://oldbytes.space/@mrrmot/116694151801834138

see also: https://thenewstack.io/github-will-prioritize-migrating-to-a...

A migration like this is a monumental undertaking to the level of where the only sensible way to do a migration like this is probably to not do it. I fully expect even worse reliability over the next few years before it'll get better.

it's also very tricky to do given the current architecture on the server side where one single-threaded process handles the connection and uses (for all intents and purposes) sync io.

In such a scenario, listening (and acting) on cancellation requests on the same connection becomes very hard, so fixing this goes way beyond "just".

Firefox is not in a position where it is the only browser allowed to run on a platform.

On iOS, you’re either doing a native app, sharing 30% of your income with Apple, or you’re restricted to Safari’s feature set. No browser in iOS can use anything but WebKit

On the other hand, by erroneously treating a SHOULD as a MUST, I would say that Google is the one who's not RFC-compliant
It’s open source and runs on all kinds of platforms. Original HL1 runs on old Windows and IIRC DOS. Nowhere else
I wouldn’t post some random vulnerability report, but the disclosure timeline at the end was very interesting to me and not putting the vendor in a great light
Isn't this asking for the exact trouble musl wanted so spare you from by disabling dlopen()?
You should care because once your PC is part of a bot network, it’s part of the problem
Re:200 MB RAM FreeBSD Desktop on Wednesday January 21, 2026 @04:56AM (#46703361)
what's especially strange to me is that in the more distant past, he was a pretty normal guy - at least as normal as any other linux user. Heck, he had a super great podcast (Linux Action Show).

Something changed in the 2014ish time-frame when it got more and more politically extreme.

Re:The struggle of resizing windows on macOS Tahoe on Monday January 12, 2026 @07:06AM (#46587328)
> As for the fact that one cannot resize from inside the window,

if you check the screencast I posted, you'll see that you can indeed resize from inside the window. Not by a huge margin, but definitely from inside the actual window boundaries.

Re:The struggle of resizing windows on macOS Tahoe on Monday January 12, 2026 @07:06AM (#46587319)
It wasn't meant as a rebuttal. Just as a point of thought: By showing that at least one application doesn't exhibit the problem, I thought I was showing that the problem might not be related to the Tahoe redesign at all but might have other causes.

It definitely serves to prove that this is not a design-issue but just a simple bug and thus has at least some chance of being fixed.

FWIW, I cannot reproduce the issue demonstrated in the original article with any window of any application on my machine (M1 Mac Studio), but I thought that listing a very commonly used application alone would be enough to challenge the article's assertion ("the macOS designers are stupid because they make me do something that doesn't make sense in order to resize windows").

Re:The struggle of resizing windows on macOS Tahoe on Monday January 12, 2026 @05:32AM (#46586565)
As much as I like to hate on a new OS like the next person, I think it's worth pointing out we're probably not seeing the full picture here:

When trying to reproduce the problem as shown in the article by resizing the Safari window currently displaying the article, the drag cursor changes shape at the visible border of the window, not the shadow and consequently, dragging works as expected.

https://youtu.be/kNovjjvYP8g

This might be an application- or driver specific issue, not necessarily a common Tahoe issue.

Re:A faster heart for F-Droid. Our new server is here on Tuesday December 30, 2025 @05:15PM (#46438674)
400k would last me 13 years for a rack, power and 10Gbit/s bandwidth at my colo place (Switzerland, traditionally high prices)
Re:Bat v0.26.0 Released on Monday October 20, 2025 @08:28AM (#45643136)
Becky was so good for participating in mailing lists. I could slip by as a Unix user even though I was still mostly using Windows as my client OS.
Re:Exploring PostgreSQL 18's new UUIDv7 support on Saturday October 18, 2025 @04:46AM (#45625920)
One thing that’s not quite clear to me is how safe it is to generate v7 uuids on the client.

That’s one of the nice properties of v4 uuids: you can make up a primary key of a new entity directly on the client and the database can use it directly. Sure: there is tiny collision risk, but it’s so small, you can get away with mostly ignoring it

With v7 however, such a large chunk of the uuid is based on the time, so I’m not sure whether it’s still safe to ignore collisions in any application, especially when you consider client’s clocks to probably be very inaccurate.

Am I overthinking things here?

Re:GNU Midnight Commander on Wednesday September 17, 2025 @03:28AM (#45272888)
They are the same because both projects are inspired by Norton Commander for DOS which also used those keys.
Re:Finnish City Inaugurates 1 MW/100 MWh Sand Battery on Wednesday September 03, 2025 @04:02AM (#45113339)
> They may not be as energy efficient as using more exotic materials

yes and given that the energy you put in is practically free, it doesn't matter if it's not as efficient.

I understand this as an argument that it’s better to be down for everyone than have a minority of users switch browsers.

I’m not convinced by that makes sense.

Now ideally you would have the resources to serve all users and all the AI bots without performance degradation, but for some projects that’s not feasible.

In the end it’s all a compromise.

Here’s one study

https://dukespace.lib.duke.edu/server/api/core/bitstreams/81...

And of all the high-profile projects implementing it, like the LKML archives, none have backed down yet, so I’m assuming the initial improvement in numbers must continue or it would have been removed since

> This was obviously dumb when it launched:

Yes. Obviously dumb but also nearly 100% successful at the current point in time.

And likely going to stay successful as the non-protected internet still provides enough information to dumb crawlers that it’s not financially worth it to even vibe-code a workaround.

Or in other words: Anubis may be dumb, but the average crawler that completely exhausting some sites resources is even dumber.

And so it all works out.

And so the question remains: how dumb was it exactly, when it works so well and continues to work so well?

Older »