News for hackers. Stuff that matters.

roblabla

> I've never been involved with a mess like this, but I can well imagine it's difficult to convene the necessary people for a dispassionate RCA when your bosses are furious and investors are screaming for scapegoats to fire.

In any sane business, the people handling the screaming investors are different from the people handling the social media mess, and they are also different from the people doing the RCA.

That said, given the mess, I wouldn't be surprised if eMudhra only had one employee responsible for all those jobs...

Re:Quad9 (DNS Resolver) to Exit France on Thursday October 22, 2026 @12:05PM (#50197283)
I find it extra funny that you think copyright protect small time authors and artists, when we have _very clear_ examples of it not protecting them for shit, even before the entire IA saga. Remember the Disney/Star Wars saga where they refused to pay the Star Wars author for the books they were selling?

https://archive.bookstr.com/article/royalty-wars-over-star-w...

Copyright doesn't protect small-time authors - because small-time authors don't have the means to harness the legal system to their advantage the way that big corpos that take advantage of them do.

There's a big difference between "Don't do X" and "Do Y before suggesting X" though.
Re:11 year old unsoundness bugs found in Rust borrow checker on Tuesday October 13, 2026 @08:14AM (#50070456)
There never was formal verification of the entire rust compiler, or even its complete borrow checker/type system. There has been verifications on _subsets_ of them.

Also, a lot of those soundness issues aren't related to new features _at all_, but usually due to poor assumptions made in optimizations.

The soundness bugs _are_ taken seriously though, and are slowly being patched out. A lot of the links in OP are now closed because Rust either changed how it generates code to avoid the issues, or fixed LLVM.

Re:Why aren't AI companies being charged for hacking? on Monday October 12, 2026 @11:11AM (#50057598)
Criminal prosecution can be done without needing the victims to call for it, and in this case I would argue it's necessary, as it will help ensure companies don't treat their act of gross negligence as "business as usual".
> Sure, but does slowing down the development of new models count as "adopting safety standards"? I very much doubt it.

I mean, the point (if the claim is to be believed) isn't just to "slow down the development", it's to take more time during development to properly assess the risks the models pose, develop methodologies to reduce that risk, and standardize that across companies. I doubt those wouldn't count, especially in the eyes of regulators of an administration calling for that same slow down.

Wouldn't that be basically https://marginlab.ai/trackers/codex/ ?
Re:How much of F-Droid is LLM generated? on Tuesday September 15, 2026 @08:43AM (#49711684)
I've had bugs the agents can't fix or figure out. Sometimes those involve third-party, proprietary, broken code (read: Windows APIs). Sometimes they just involve complex deployment situation on the client code (I work on desktop apps) where the agent can't figure out what's wrong/makes wrong assumptions/goes nowhere. Sometimes the agent is just very dumb and tunnels vision on the wrong fix.

FWIW, I've also had bugs the agent fixed that I probably never would've figured out without LLMs - LLMs are definitely useful! But I need to keep understanding how the code works so I can take over the reigns when the LLM fails.

Re:How much of F-Droid is LLM generated? on Tuesday September 15, 2026 @07:22AM (#49710834)
I tried a lot of tools. Claude code, deepseek with kilocode and OMP, codex... I still use claude quite a bit. But frankly, all of them produce some absolutely godawful code. Review load went way up with AI, and it's not just the volume that caused it, but also the quality. It's extremely verbose, hard to read, often repeats code instead of factoring it into reusable components. And yes, sometimes it's also buggy. Except now, you have to debug a problem that's in code you didn't write yourself, and is awful to read.

LLM is incredibly valuable for debugging complex problems, codebase exploration, and planning large changes. But the writing code part itself, I find, LLMs are just not very good at it yet.

I don't really understand this comment. The simplest way to put pressure on companies to align with their user's objectives is to complain loudly. It's not that HN "assumes" anything, it's just that people call shitty things as they are, in the hope that if enough people agree, it'll create enough pressure for the company to change course.

Will it work? Probably not. But not even trying would be self-defeating.

AFAIK, the OS-specific Qt themes don't wrap the native widgets, it reimplements them. They are rather thorough though, making sure their OS-specific theme matches the look and behavior of the native OS, which makes it one of the best framework to do something that feels close to native.
Re:Boot a Virtual iPhone via Apple's Virtualization.framework on Saturday August 29, 2026 @07:21AM (#49488984)
As someone using AltStore PAL to install some third-party apps that would never be allowed on the App Store (such as emulators and manga readers), I heavily disagree.
The government won't limit you - they can't really know what you use those proofs for anyways, that's the zero knowledge part, and supposedly they'll be necessary for social media at some point, so a ZK proof won't necessarily mean porn use. The only thing the govt knows is how many proofs are being downloaded. And you can bet politicians wouldn't do anything to prevent voting-age you from accessing social media - how else are they supposed to get you to vote for them (or hate their opponents).

Now, a scenario I can see happening is, the ZKP-issuing agency may find a single client downloading several orders of magnitude more proofs than the average citizen, find that suspicious, refer them to the police, who'd get a warrant to investigate said person. Then, the police may manage to connect said person with a proof distribution service. Something along those lines.

Again, I'm personally not a huge fan of the whole age gating, but if we're going to go about it, this is the least worse option. Which is really saying something.

Each individual proof is zero knowledge, but downloading a _bunch_ of them is an indicator, yes. There's no real way to work around this with the current ZKP scheme. I'd argue ZKP is, in theory, the least worse option of all current age verification scheme.

My personal opinion is that age verification itself is a bad idea, but if we're going to go ahead with it, I'd much rather we use ZKP for it than the current mess of "upload your passport and picture of yourself to dodgy 3rd parties that likely now have your browsing traffic associated with your real name"...

Yes, my bad X).
Qualification is time-constrained. You are qualified for two to three years. So by 2030, all qualified products will be PQC-free.
Re:Linux kernel will support $ORIGIN, sort of on Tuesday July 21, 2026 @08:50AM (#48991669)
> though at this point they could probably edit the ELF binaries and patch the fixed path to ld.so when nix is installing the program.

That's exactly what they're doing right now - though instead of being "when installing the program", it's "when compiling the program". The problem with hardcoding the path is that it pins the "nix store" (where nix installs all of its programs) to a hardcoded location. If you want to move it, you have to rebuild all your packages - which is suboptimal.

In theory, nix could have a system in place to just patch all binaries when moving the nix store, but that would be incompatible with content-addressed derivation and otherwise break some other nice properties of the nix store.

Re:Linux kernel will support $ORIGIN, sort of on Tuesday July 21, 2026 @07:23AM (#48990800)
In theory, ld.so could provide a stable interface to its dynamic loading capabilities independently of glibc. Then glibc would not have to be updated in concert with ld.so. There's no inherent reason that glibc should be the library shipping a dynamic linker - we could easily be in a world where libld was developed independently from libc.

On Windows, things are less modular, so it's less of an issue. That said, there's also weird shenanigans when it comes to the CRT (which can be statically linked) vs ntdll (which provides the actual linker implementation), that can make certain niche features of the linker misbehave (delay loading in particular is weird).

Re:Linux kernel will support $ORIGIN, sort of on Tuesday July 21, 2026 @05:44AM (#48990081)
> There is an arrogance in the way of thinking that when you see everyone breaking your arbitrary rules you think to yourself "there is no way my rules are at fault, it's everyone else's fault for breaking them."

It's not really arrogance - it's just a different way to design a system. NixOS wants a few things:

1. An input-addressed dependency system

2. Easy and robust rollback/upgrades

3. Different versions of software/libraries/services coexisting on a single machine.

A lot of this is just impossible to have together with the way software were written, so NixOS made the changes necessary for them. When it became obvious it might be useful to other people, they upstreamed it.

I do agree with you that the whole `#!/usr/bin/env bash` shebang shenanigan is kinda ass (my personal nixos machine has a `/bin/bash` alias because there's not enough time in my life to care about this issue). But I also think that NixOS is right here, shebangs requiring a full path is just a terrible design in a multi-user world. If different users want to have a different bash implementation, they should be able to!

---

Fundamentally, I think the NixOS OS design is actually beautiful. It's taking most of what makes modern phone OS so reliable (read-only system, A/B partitions, etc...), and bringing their ideas in a shape that is coherent with desktop/server OS design.

Re:Linux kernel will support $ORIGIN, sort of on Tuesday July 21, 2026 @05:32AM (#48990013)
How is that more valuable? It comes with two big pitfalls:

- It would still not allow downgrades to work properly

- It would cause glibc/ld.so to have a harder time adding new features, as they now need to worry about incompatible versions being used together

Meanwhile, having different ld.so has many good use-cases, like simplifying development of ld.so itself, allowing them to swapped during updates in ways that are safer, etc...

And the eBPF binfmt support is a rather simple, generic mechanism that is likely to have many other use-cases beyond ld.so. So it's overall a pretty good resolution to the issue?

Re:Linux kernel will support $ORIGIN, sort of on Tuesday July 21, 2026 @04:43AM (#48989693)
Not with NixOS. ld.so is tied to a version of glibc, in ways that can be subtly incompatible. And nixos can have multiple glibc version installed on a single machine.

Besides, it allows for upgrades/downgrades to be done in a way that's much less error-prone.

Re:Orion Browser by Kagi on Monday July 20, 2026 @04:22AM (#48975740)
There’s a lot of ways you can hold an engine wrong. Some 3rd party browser (often by security vendors…) have been vulnerable to exploits due to not compiling it with all the hardening options, or injecting vulnerable extensions that expose an attack surface to the webpage, for instance.
The goal is to give time for automated scanners ran by cybersecurity companies to flag malware before it gets installed on real users.
Re:An iroh powered smart fan on Saturday July 11, 2026 @03:51AM (#48869785)
With that logic, C is nothing without assembly.
Re:Decoding the obfuscated bash script on a Uniqlo t-shirt on Wednesday July 08, 2026 @10:28AM (#48832442)
Monaspace has a feature called "texture healing" that does something similar: it allows bigger letters to "steal" space from adjascent smaller letters, to make it easier to read. The result is that the letters are still in a grid, while still allowing for bigger letters to "breathe".

https://github.com/githubnext/monaspace/blob/main/docs/Textu...

It's the main reason I use monaspace as a font.

Re:Markets are competitive if and only if P = NP on Friday July 03, 2026 @12:01PM (#48776599)
Or maybe the markets are actually proof that P = NP :^)
Re:Leanstral 1.5 on Wednesday July 01, 2026 @07:46AM (#48745201)
You say this as if ad revenue is the only possible way we could have done AI research - which is an _extremely_ weird take given the history of academia and R&D. Today adtech companies just make up the richest companies in the world, so it's not very surprising that they're the ones behind LLMs - they have more money to throw at the problem than most. I'm pretty confident that - if adtech companies didn't exist, we'd find other means of funding AI research (private investment, public funding, R&D spend from non-adtech companies, etc...).

When the internet was researched and developed, it wasn't funded by adtech, and yet it managed to develop it just fine.

---

Also, the point of GDPR wasn't to reduce the number of ads. It was to prevent massive, indiscriminate information gathering. Now, whether that was successful or not is debatable - I have my own gripes on GDPR enforcement (I really hope the banners will get nuked out of existence).

Re:Leanstral 1.5 on Wednesday July 01, 2026 @07:37AM (#48745136)
https://www.youtube.com/watch?v=u_N3-FKbi5c

https://www.cer.eu/insights/europe-has-produced-tech-champio...

https://www.investeurope.eu/news/newsroom/state-of-european-...

The tech sector represents 15% of EU's GDP. I currently work in the tech sector in europe, there's no shortage of companies hiring (both startups and enterprise), and anecdotally, from my personal network, enough startups are surviving the 5 and 10 years mark that I'm pretty confident there's enough new ideas/companies (as opposed to only having old/legacy enterprises) to ensure the good health of the sector.

Now, I will acknowledge that funding is more complicated in the EU compared to the US - but that's something that has been acknowledged by EU leadership and is being actively worked on. The Draghi report lays out a vision for how this can be achieved, with recommendation on what steps to take to achieve that vision. https://commission.europa.eu/topics/competitiveness/draghi-r...

So yeah, the tech sector is still well and alive in the EU, and there is reason to believe that it's going to get in an even better position.

Re:Leanstral 1.5 on Wednesday July 01, 2026 @05:52AM (#48744419)
[citation needed] here. The tech sector is still well and alive in EU, and outside adtech (which was hit hard by GDPR - that was the point) doesn't seem to have been visibly impacted.
An attack against what? The sanctity of "their IP" that is itself the result of a massive copyright violation campaign?

Older »