News for hackers. Stuff that matters.

pritambaral

"This vulnerability was referred to us from the Incus project, and was confirmed to affect LXD as well."

- https://discourse.ubuntu.com/t/security-advisory-critical-vu...

Re:Artificial Analysis Intelligence Index v5 on Wednesday October 28, 2026 @09:55AM (#50273613)
> With open weights you can be sure the quality stays the same

Or improves. With third-party fine-tuning.

Have you considered fine-tuning on your dataset?
Re:Ghostty 1.4.0 on Tuesday October 27, 2026 @01:59PM (#50263206)
> Konsole is way faster than any of those on my computer and it has all the usual suspects I'd expect from a modern terminal emulator.

Same boat here, though I also get to enjoy some of the benefits of libghostty, via ghostel in Emacs. Ghostel is noticeably faster when there's a lot of output being dumped, but I don't often need the speed and use it only because it's integrated rather well into the rest of my Emacs.

> tmux -CC integration

If you can stomach Emacs, there are at least two packages that implement this, one via eat and another via vterm, though none via ghostel just yet. Shouldn't be difficult to port, though.

Re:Why aren't AI companies being charged for hacking? on Monday October 12, 2026 @05:05PM (#50063061)
> There are lots of companies that will ban you from buying their products for mistreating them.

Sure, Ferrari might refuse to sell me a second car, but I wasn't going to buy a first one either. OTOH, if a ruler company refuses to sell me rulers ... I'll just get one from another company. Like how I use local LLMs today.

> ... I am just honored to be in the presence of a soon-to-be Nobel prize winner. When are you going to publish your findings ...

I'm not going to fall for this bait or follow this asinine line of argumentation. Perhaps you should reconsider how your reactions are, to quote you, "a sign of poor impulse control. It reflects poorly on you and you should practice not snapping".

There were five nuclear states grandfathered in when the NPT was signed. Since then, five other countries have developed nuclear weapons.

Apart from South Africa (which gave up its nukes voluntarily), the other contenders were basically only held back due to military intervention (Iraq, Libya, Syria) or economic sanctions (Iran).

Re:Why aren't AI companies being charged for hacking? on Monday October 12, 2026 @04:25PM (#50062501)
Under the Executive branch, no? Currently run by, let's see: https://en.wikipedia.org/wiki/Todd_Blanche#Work_for_Trump_(2...
Re:Why aren't AI companies being charged for hacking? on Monday October 12, 2026 @04:17PM (#50062395)
You're absolutely right. Except for the part about the ruler-making company banning me from buying their rulers because I somehow hurt the wittle rulers' feelings by snapping it. It's a tool; it doesn't have feelings.
Re:Discover vibe-coded alternatives to popular software on Monday October 12, 2026 @01:26PM (#50059726)
Firefox has always required user action for fullscreen (for good measure). Use windowed mode and F11.
Re:F-Droid 2.0: A New Chapter for Android Freedom on Thursday September 24, 2026 @12:15PM (#49832830)
Since F-Droid (i.e., the repositories, not the app) builds all apps, a practical solution would be for the repositories (i.e., their signing keys) to be recognized by El Goog. Whether and how much help / obstacle the "maybe we do evil" company puts up for / against this is a different question.
Re:Alternatives to MinIO for single-node local S3 on Tuesday September 15, 2026 @08:50AM (#49711749)
Replaced because minio is dead: https://github.com/lxc/incus/pull/3258
Re:Alternatives to MinIO for single-node local S3 on Tuesday September 15, 2026 @06:44AM (#49710432)
Incus (spiritual successor to LXD, after the fork-off by Canonical) has a simple S3 server built-in.
Re:Omarchy: Any User Process Can Escalate to Root on Tuesday September 01, 2026 @07:33AM (#49520556)
Ah, Ubuntu _Server_. I'm tempted to dismiss this by simply saying "Server Linux != Desktop Linux", but yeah, I don't like that this is on by default either.

I mean, this is a setup that ships with a default password that's the same as the username, and the first thing I do on all my server installs is disable all default user accounts and enable passwordless sudo.

From reading other docs of Ubuntu Server, it appears they relax the root/non-root distinction in other ways too. But I'd probably never have suspected this particular vector of vulnerability.

Re:Omarchy: Any User Process Can Escalate to Root on Monday August 31, 2026 @10:06PM (#49517147)
> Ubuntu has the exact same vulnerability out of the box, just with lxd instead.

No, it does not[1]. LXD:

- explicitly warns against this mode of vulnerability. Of course, there's no protection against people who blindly run commands copied from the internets, but the official documentation, at least, for as far back as I can recall, has had clear warning boxes against this, with explanations.

- does not have the track record of bad design that docker has had (IMO).

- supports fine-grained ACLs and user management.

----

[1]: https://ubuntu.com/blog/shared-development-environment-with-...

Re:Omarchy: Any User Process Can Escalate to Root on Monday August 31, 2026 @09:46PM (#49516984)
The Desktop Linux equivalent to that would be Polkit.

Psst. There's also this, in typical KDE style: https://github.com/aeroshell-desktop/uac-polkit-agent

Re:Omarchy: Any User Process Can Escalate to Root on Monday August 31, 2026 @09:37PM (#49516923)
Desktop alternative to most uses of sudo: Polkit[1]. For a UAC style prompt, see AeroShell[2].

However, one still SHOULD NOT allow untrusted software arbitrary read/write access to their $HOME, even on a completely secure (and thus, imaginary) OS. No reason why every App X should have access to the files of every App Y.

1: https://wiki.archlinux.org/title/Polkit

2: https://github.com/aeroshell-desktop/uac-polkit-agent

> It does disfavor license-free and public domain software, which isn't great.

Public domain software is free to "copy, redistribute, and modify", so ... where's the disfavour?

Re:99% of My Website Traffic Is Bots on Friday August 07, 2026 @07:14PM (#49217348)
> open source project

So, one can put in the minimal effort of removing one div.

> being associated

There's no requirement of association of any kind. See above and below.

> request

Cool. Pay for your own branding. Request fulfilled. No? Then it's a demand, not a request.

Re:99% of My Website Traffic Is Bots on Friday August 07, 2026 @07:02PM (#49217265)
> ... sexualized ...

Perhaps you should check if anybody else sees what you see. After browsing through every image I could find in the history of this project, I, at least, am convinced: any "sexualization" _you_ see is entirely in your head.

> ... in judeo christian societies

I really hope you're not trying to whitewash your own bias by alluding to those religions. From everything I've read of their texts, and interacted with practioners of those religions, I'm unaware of any bias that classifies _cartoon depictions of children_ as "sexual".

Perhaps you should try whitelabeling instead. Don't like the packaging? Package it yourself!

Re:Massively Parallel Postgres Backups on Tuesday August 04, 2026 @12:32PM (#49171221)
Note: this only applies if the `--link` flag is used with `pg_upgrade` (which, I recommend), but the default is to copy all data.
LLMs are plenty far from compilers.
> One could argue that adding a library is in some ways similar to copy/pasting code in as much as, one doesn't know what the code is doing, and yet that doesn't leave me with a sense of unease!

It does, to me. Been burned enough times that I now, at minimum, audit the source code of third-party libraries before I use them.

> You can run rootless containers or you can use containerization like Podman which does not run as root.

Yes, now you get my point. Do you run rootless containers (with the Docker backed) or do you run "root" containers?

TV dinners have their value, but a cooked meal is often better. And, just like meals can be cooked for a team, so can emacs configs.
I hope you see the (IMO, obvious) problem.

1. Docker (or any Linux container runtime, for that matter) is not intended for, designed for, or effective as a security boundary. 2. Root containers run as root on the host. The "sandboxed" processes have full capabilities, as far as the kernel is concerned with them.

> https://github.com/ashishb/amazing-sandbox

Does your Docker backend run commands in rootless containers? I skimmed the code but didn't see anything to confirm this.

Re:SSH Secret Menu on Wednesday March 11, 2026 @04:38AM (#47333066)
ProxyCommand allows you to use any command to setup a connection. Not necessarily an ssh command, like ProxyJump. It can be any command, as long as it receives on stdin and produces on stdout, it can act like a TCP connection.

ProxyJump is a special case of `ProxyCommand ssh -p <port> <user>@<host>`. Can't replace the `ssh` in there when using ProxyJump.

Here's what you did, paraphrased:

"It was the Hyundai Corpo that broke the law! They're stealing American jobs! That's why ICE targeted them! No, I have no evidence, only blind belief. Why are you even asking me for evidence?! What about when Hyundai did bad things in the past???!!?1?"

----

If it:

1. Repeats the arguments of fascists.

2. Defends fascists.

3. Attacks the victims of fascists.

What do you think it is? A duck?!

Who says they didn't? There is only one party here who acted in bad faith, and it wasn't Hyundai.

In fact, this party has a — by now well-established — track-record of precisely this bad behaviour. They haven't even tried to hide their actions, only their individual faces. They've been public about their disdain for the law, for humanity, and their general evil plans.

And here you are accusing their victims of crimes you, like them, have no evidence of.

Re:Lord of the Io_uring on Monday September 01, 2025 @10:57AM (#45093162)
Firefox on Android has a setting to force enable zoom on all websites, even those that disable it.

Older »