News for hackers. Stuff that matters.

ptx

But they do load from the working directory by default [0] and until XP SP2 they put it before system32 in the search order [1] by default.

[0] https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic...

[1] https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic...

Yup. And since applications load DLLs from their working directory by default, and opening a document sets the working directory... you'd better make sure you never open a document from an untrusted folder.
Almost every time I use an AI chatbot it eventually turns out it's lying to me. I would not trust them with any of the things you mention.
Re:`123456' password used in Danish CPR data breach on Sunday October 11, 2026 @06:05PM (#50048360)
No, because someone else will then come along and mess up your configuration and destroy your work, either accidentally or just to be a jerk, which will set your productivity back significantly.
The disclaimer at the end of the article says AI was used to "polish" the writing. I would guess it's this polish that can be a little off-putting: It reads like a magazine article written by and for people who aren't particularly interested in the topic.
Re:Why don't more developers "use the platform"? on Sunday October 04, 2026 @08:22AM (#49953294)
> More like trying to explain to people who have only done imperative programming (and that also in JS of all languages) why a render function was necessary.

It doesn't seem all that different from doing your rendering in the WM_PAINT handler, which was already how things were done in the ancient Win32 API (although it's possible [0] to draw outside WM_PAINT).

[0] https://learn.microsoft.com/en-us/windows/win32/gdi/drawing-...

It doesnt't seem to be open source, though. A proprietary language with a proprietary implementation is a dead end.
Re:Breaking Up with Google Play: Why Conversations Is Now Free on Saturday September 26, 2026 @03:13PM (#49859607)
I think GPLv3 already does this, with its anti-tivoization requirements. People just need to switch to an up-to-date copyleft license rather than permissive licenses.

https://www.gnu.org/licenses/gpl-faq.html#Tivoization

Re:Native apps written in TypeScript and CSS on Wednesday September 23, 2026 @04:03PM (#49821723)
What do you mean? You were so excited that you didn't want to talk about what excited you and left it to an LLM instead?
But it seems this "economic value" is often created by depleting actual physical resources (e.g. people's health, clean air and water), usually resources belonging someone other than the person capturing the "value".
Re:JEP 544: Ahead-of-Time Code Compilation on Saturday September 12, 2026 @04:06AM (#49670113)
There is with jpackage. The packages it builds could include install scripts (or custom actions in the case of MSI) to run at install time.

The script wouldn't have to do the training run at install time, as I understand it, just the AOT compilation. See the section on "AOTMode=record" vs "AOTMode=create" in the JEP.

Re:JEP 544: Ahead-of-Time Code Compilation on Friday September 11, 2026 @10:47AM (#49659396)
It would be nice if jpackage could bundle the generated AOT configuration data along with a custom action in the MSI package to run the machine-dependent AOT compilation step at install time.
That leaves a few questions though (which I'm not implying that I know the answers to):

Did this planted forest (used for logging) replace another forest that was used as a habitat for animals? Is it counted as an equivalent to non-logging forests to justify the destruction of non-logging forests?

Can this sustainable industry sustain suitable living conditions for animals in the forest? Or can the industry only sustain itself and its own interests in future resource extraction?

Re:This Month in Ladybird – August 2026 on Tuesday September 08, 2026 @09:00AM (#49609771)
No, it isn't.

Ladybird [0]: "We will no longer accept public pull requests. From now on, code changes to the Ladybird codebase will only be introduced by project maintainers. [...] There will not be a separate process for submitting patches by other means."

FreeBSD [1]: "So you want to contribute to FreeBSD? That is great! FreeBSD relies on the contributions of its user base to survive. Your contributions are not only appreciated, they are vital to FreeBSD’s continued growth. [...] If you are submitting a simple patch to the src repo, please consider submitting it to the project’s GitHub mirror as a pull request."

[0] https://ladybird.org/posts/changing-how-we-develop-ladybird/

[1] https://docs.freebsd.org/en/articles/contributing/

Re:216M Spy TVs – The LG Smart TV Problem [video] on Monday September 07, 2026 @03:23PM (#49601963)
As far as I can tell, all the recording, storing and transmitting of audio from the microphone happens after 34 minutes in, after the point where they start hacking the TV and telling it themselves to do these things.

LG's advertising features appear (from what they discover before 34 minutes in and from the clips of the LG execs boasting about their ad platform) to be concerned only with what's played on the TV (and networks, devices, ..., but not microphone audio).

If I'm wrong about this, I would appreciate a timestamp for where in the video they show LG actually storing and transmitting audio recorded from the microphone.

Re:216M Spy TVs – The LG Smart TV Problem [video] on Monday September 07, 2026 @02:32PM (#49601416)
I don't think the title (edit: of the thread merged into this one!) is accurate.

Starting at 16:04, they say that they merely claim that the TV has the capability to be used as a listening device. In the first 34 minutes, they don't seem to show that LG are actually recording audio from the surroundings (only from the content playing) and after that they start investigating whether you could record audio if you take control of the device (obviously yes).

So the video doesn't seem to support the claim in the article (edit: linked in the merged submission!) that "LG smart TVs continuously [...] log microphone audio while appearing to be turned off".

Of course, all the stuff LG are actually shown to be doing is bad nevertheless, particularly the "Automated Content Recognition".

Probably best to treat the wifi password as compromised and change it after the TV has had access to it. But I suppose there's nothing you can do to prevent it from accessing open wifi networks that happen to be nearby.
Re:Intellectual Fly Is Open on Sunday September 06, 2026 @07:12PM (#49591868)
I don't see how the AI reply could be more concise, clear or exact than what you wrote. If it didn't get the details from you, where did it get them? How do you know it got them right? If it got them from the docs, why not just point to the docs?
Re:Actively exploited sandbox RCE in all Chromium versions on Saturday September 05, 2026 @08:45AM (#49576018)
Before JS and WASM we had arbitrary code delivered in the form of ActiveX components, Java applets and Flash applications, which were much worse. At least now we have multiple open source implementations of the runtime.
I can't find anything about that in the article or the Fairphone 6 manual. Do you have a source for this?

My main problem with USB-C headphones on my Android phone is how unreliable they are. But if the USB-C port can just pass through an analog audio connection, that should work much better, I expect.

Edit: This feature is apparently deprecated (removed?) in newer versions of the USB spec! https://en.wikipedia.org/wiki/USB-C#Analog_Audio_Adapter_Acc...

Re:O&O ShutUp10 – The antispy tool for Windows 10 and 11 on Friday September 04, 2026 @12:37PM (#49566924)
> It is not listed in the Linux Mint App Installer. The Portables downloaded from Sourcefoge do not work.

It's packaged in Debian and Ubuntu as "doublecmd-qt" and "doublecmd-gtk", so Linux Mint ought to have it as well.

> Can it filter-as-you-type the file list?

Yes.

> Does it have chainable script button bars?

I don't know what that is.

> Is there a poweful rename tool?

There's a Multi-Rename Tool, yes.

> Can it look pretty

You'll have to be the judge of that. It looks good to me. It uses the Lazarus component library, so it can be built with either Qt or GTK (or native win32 on Windows) and uses whatever themes and configuration applies to those.

Re:O&O ShutUp10 – The antispy tool for Windows 10 and 11 on Friday September 04, 2026 @11:12AM (#49565833)
They could still switch to using a Linux machine for most things (that don't belong to the employer), segregating the Windows machine off as much as possible and never letting Microsoft near any of their own data.
Re:O&O ShutUp10 – The antispy tool for Windows 10 and 11 on Friday September 04, 2026 @11:05AM (#49565736)
Double Commander is pretty good: https://doublecmd.sourceforge.io/

It's cross-platform, so could switch file manager on Windows first to make it easier to switch to Linux later.

Re:Thinking in Python by Bruce Eckel on Sunday August 23, 2026 @11:13AM (#49409476)
The last pre-AI version seems to be this commit: https://github.com/BruceEckel/ThinkingInPython/tree/76a1310d...

But that version seems to have some remnants left from Java version of the book, such as talking about visibility modifiers in the testing chapter.

Re:Thinking in Python by Bruce Eckel on Sunday August 23, 2026 @09:37AM (#49408772)
The author is apparently still in the early stages of revising what the AI wrote, according to the README, so readers might want to hold off a bit on downloading the epub.

But both the license terms (CC BY-NC-ND 4.0) and the repo's LICENSE.md appear to agree that distributing the epub is OK.

Re:HTML Can Do That on Friday August 21, 2026 @09:55AM (#49388144)
When a form has two sets of mutually exclusive options it might be appropriate? But I find the user experience confusing. It's hard to tell what happened when all the elements moved around, at least without animations.
Re:Malicious Rust crate Arrayref runs a build-time payload on Thursday August 20, 2026 @11:21AM (#49375910)
Why are developers "inherently expected to run untrusted code"? Running untrusted code on developer machines seems like a terrible idea, given that it will compromise everything they build or deploy and (as you mentioned) all their credentials.
Re:Malicious Rust crate Arrayref runs a build-time payload on Thursday August 20, 2026 @11:14AM (#49375822)
FreeBSD does this with Capsicum: https://wiki.freebsd.org/Capsicum
Re:Thunderbird's Desktop Calendar Visual Redesign on Saturday August 15, 2026 @06:05PM (#49314728)
What's going on with those dialogs? Are they real dialog windows with hidden window decorations, or are they fake windows drawn inside the calendar view?

And why do they have what looks like a maximize/zoom button, a "..." menu button and a close button? This is a desktop application – we have real window borders for resizing, real menus for menus and real close buttons provided by the window manager.

Older »