News for hackers. Stuff that matters.

rudedogg

Re:PHP2Shell: Exploitation Attempts and Remediation Trends on Tuesday October 27, 2026 @04:51PM (#50265622)
> because it wasn't actually running PHP

Yea and no, I mean it was an even worse setup than typical, probably because the person setting it up didn’t have php experience or used an LLM that misinterpreted “route requests from nginx to php” or something too literally and set up a hacky solution.

But my impression isn’t that they set it up in some cheeky way to avoid exploits, it looks like they just asked for nginx to be in front.

And is “hacked in two hours” fair if they had to make it easy for people because their noob setup ended up not being exploitable?

Let me know if my read of what happened is wrong.

Re:The HTML-in-Canvas API origin trial on Sunday October 25, 2026 @03:19PM (#50235115)
I don't see how Canvas or WebGPU is any different. People want a way to write high-performance UIs without all the complexity/legacy of the DOM. It makes everything more difficult, and because it makes things easier for browser developers isn't a valid justification to make the user experience worse. The users should drive the technology. I'm sorry this architecture you built almost 30 years ago isn't adaptive enough to meet the needs of your users. Instead they should create a new one for this use case (GUIs/applications) and keep it focused on documents.

> isn't adaptive enough to meet the needs of your users

I imagine if this conversation continues this will be quoted and argued against. My point is that it's not working well. People find workarounds to do amazing things with the browser, but they shouldn't have to. Give developers what they've wanted for 15 years. The various committees and working groups keep missing the mark, by a lot. See WASM, WebGPU shader language, etc., etc.. I'm sure it's more complicated than I realize, but if all you do is fail and disappoint, maybe your governance model and the people involved need some adjustment. Is anyone happy with WebGPU? Is anyone happy with Web Components?

/rant

Re:The HTML-in-Canvas API origin trial on Saturday October 24, 2026 @01:16AM (#50218519)
> Which GUI toolkits over internet do you refer to?

My point is there is no GUI toolkit for the browser and there should be. They should stop trying to morph the document object model into a platform for delivering applications, let it do documents, and give us something else/new. It'd also be the proper path to the new thing having accessibility support. Instead people raw-dog the GPU for UI and you get no screenreader support.

What they're doing here is a half-assed attempt: letting people draw but using the DOM for accessibility. The worst of both worlds I guess?

Our only hope is for AI to supplant screen readers, and then we can just ship WebGPU apps.

Re:The HTML-in-Canvas API origin trial on Friday October 23, 2026 @04:19PM (#50214749)
Look at GUI toolkits going back to the 90’s. The DOM and web development were an accident of history
Re:The HTML-in-Canvas API origin trial on Friday October 23, 2026 @10:10AM (#50209324)
The problem with doing apps on the web is the DOM. It’s wild how much complication browsers will add instead of just adding a new UI rendering method/substrate that doesn’t inherit 30+ years of legacy (remember web apps didn’t even exist for like 15 of those).

The DOM is a slow annoying pile when you want to make actual applications.

Re:Google's Rust Style Guide on Wednesday October 21, 2026 @10:15PM (#50190342)
Also, the language just isn’t suited well to making games. Can anyone point me to a successful Rust game? Bevy game?
Re:macOS 15.8.2 Breaks OpenGL on Sunday October 18, 2026 @01:09PM (#50143009)
I've been playing around with RealityKit (https://developer.apple.com/documentation/realitykit) lately, it's their SceneKit replacement (they deprecated it this year).

On tvOS if a frame takes too long it just starts skipping frames and runs at 20 FPS. It won't recover after it happens. ThermalState is .nominal, so it's not that. There's also no way to just say "render as fast as possible" so you can measure performance, instead every device does throttling/pacing and it's completely opaque.

Anyway, I've had a developer account for 10+ years, and run into stuff like this constantly where you just can't get things to work properly. The framework isn't used much, so it's probably just broken.

I ported the game to SDL3/Zig and wouldn't you know it I can run continuously at 60 fps.. It's disappointing because I'm on board with targeting a single platform if I can utilize the hardware more effectively and make something special with it. But instead it's constantly an uphill battle of dealing with the opaqueness/brokenness of the platform. If I open a feedback request I'll probably just get told it's a bug, and maybe they fix it next WWDC.

Also, the threat to privacy. If I turn on iCloud Private Relay I get bombarded with CloudFlare captchas. It’s so annoying I sometimes turn it off just for that reason.

Having some all knowing entity running the internet has a lot of downsides.

Re:Codex is EATING my Mac's disk space on Saturday October 17, 2026 @06:06PM (#50135608)
DaisyDisk is such a nice app. I just checked and I purchased it over 11 years ago.

They still update it, it works perfectly, no version 2.0 forced obsolescence. Just a nice, reliable tool.

Agreed. I wish they would have thrown in a "guardrails to stop me, but mostly my competitors" so the public would think about that possibility more.
Re:GPT-6 Sol and Luna on Thursday September 24, 2026 @10:04PM (#49839399)
Thanks for the info, I didn’t know that about the 5hr limit
Re:GPT-6 Sol and Luna on Tuesday September 22, 2026 @06:15PM (#49808977)
Sol is their middle model. Luna is smallest. And Astra is big, their Fable equivalent.
Re:Claude Opus 5.5 on Tuesday September 22, 2026 @03:36PM (#49806946)
I think the market didn’t react like they expected and now they’re like “jk”.

And I don’t think any pacing is/was intentional. They’de release skynet if they could and the stonks went up

Re:GPT-6 Sol and Luna on Tuesday September 22, 2026 @03:26PM (#49806805)
I don’t think so, I’ve seen it suggest I try it. I’ll double check when I get home though.

I was considering the $100 plan, but I hit the 5hr limit in an hour. So even with the $100 plan I figured I cant go non-stop on a single agent running Sol Medium

Re:GPT-6 Sol and Luna on Tuesday September 22, 2026 @03:01PM (#49806387)
I’ve been a Claude user, switched to Codex expecting usage limits to be more loose but I can’t even get through a basic sysadmin task on the $20 plan using Sol medium before I hit the 5hr one.

I think I’m gonna move back to a Claude plan. I could barely hit the $200 limit if I went non-stop on programming tasks.

Re:How to Write with an LLM on Sunday September 20, 2026 @01:12PM (#49777755)
> Just tell the agent to use conventional commit messages and to keep it nice and tight.

I have this in my claude.md along with guidance on (not) writing comments but it’s still dumps multi-paragraph comments of Claude speak everywhere.

I think a lot of us are talking past eachother, but what I and I think others are complaining about is doing things well, and being minimal. LLMs don’t really do that yet, they can’t look at and simplify a codebase well, even with guidance. They always seem to add rather than subtract. And eventually it becomes an issue. I think they were actually better in this regard with like Opus 4.8, and are now getting even worse (but score better, and are more autonomous).

At home I use Codex, and it’s better as far as language goes at least.

Anyway, it’s like the logic piece necessary to do good work is still missing, and hurt by recent reinforcement fine-tuning. And it leads to massive bloat since more comments = higher scores, but walls of text and the tokens (or cognition if you’re the sad human reading them) aren’t free.

Re:The FAA's plan to fix air traffic? $875M worth of AI on Thursday September 17, 2026 @09:55PM (#49749332)
Yeah, I listen/watch some flight radar youtube and it’s insane how many issues arise from the language barrier, which could be solved by just communicating via a text channel
Re:Shopify moves back to Native from React Native on Thursday September 10, 2026 @08:26PM (#49651975)
Doing anything right on web is 10x harder and more complex. The problem is the browser, once you use it to deliver anything you have to buy into all of it’s bullshit. CORS, XSS, headers, caching. All that just goes away (outside your backend API, if you even need one) when you ship a native app
Re:Claude Fable 5.1 and Claude Mythos 5.1 on Tuesday September 01, 2026 @10:04PM (#49530890)
Maybe Dario shouldn’t have tried for regulatory capture. He was constantly on the news talking about how these models are so dangerous and that we need regulation to keep China from releasing open-source models without guardrails.
Re:GLM-5.3-Flash on Wednesday August 26, 2026 @01:54PM (#49453162)
> You can't do that on larger models unless you have the hardware like this person does.

Or just rent something substantial for like $4/hr on runpod or w/e to do that.

My gripe is this persons compute is wasteful and makes it harder for me to buy something with like 64gb ram to do normal work and run containers while I keep using cloud models.

Someone else calculated the break even being 10 years, it’s just dumb. And I think it’s clear there won’t be a big rug pull anymore, there are too many open models and providers now.

I agree.

It would be neat to see a matrix of compile times vs. language features, showing things like:

- Bounds checks

- UAF prevention

- exhaustive enums

- test speed

But I think even among those the subtleties would make a fair comparison impossible.

Anyway I think this is all very nuanced, and anyone proclaiming language X is the language to use in 2026 lacks the experience/knowledge to consider these trade-offs and can safely be ignored.

I keep seeing these language specific proclamations, and they are annoying and reek of inexperience to me.

I’ve had a great time doing LLM assisted coding in Zig, and it seems comparable to the generic Typescript/React I do at work.

I don’t doubt simplicity and good PL design pay dividends, but everyone’s favorite language can’t be the silver bullet in our new LLM world. Things just don’t add up, and I keep seeing it for Erlang, Gleam, Lisp, C, Rust, Go, TypeScript, Python, etc.

And to pick on Go a little bit, I don’t think it has any unique qualities that make it better for LLMs, where I think you could make that argument for other modern languages that offer new features leveraging their compilers and enforcing more correctness guarantees.

Re:Bonsai: Janestreet's UI Library on Monday August 03, 2026 @11:18AM (#49156943)
> really clever people

Sam Bankman-Fried and his League of Legend rankings would like a word

Re:SwiftUI After 7 Years on Sunday August 02, 2026 @04:26PM (#49147975)
> Whatever it is, SwiftUI isn't it.

I think this opinion is heavily shared by Swift developers now, but the messaging every WWDC is always "Swift and SwiftUI is the best way to build apps for Apple Platforms", etc.. If you have to keep telling everyone what they don't believe is true, it's a sign there's a problem.

It feels like someone with a lot of organizational power is disconnected from the pulse of the community. SwiftUI is undeniably clean in a lot of ways, it presents beautifully and fits on slides well, but that matters less and less, and this all wasn't really working out even before LLMs disrupted things.

Re:SwiftUI After 7 Years on Sunday August 02, 2026 @04:12PM (#49147848)
> functional programming is superior for representing state in user interfaces

It's always going to be slower than using something imperative. Trying to process the entire world's state for the sake of purity can feel elegant but it isn't free. And the complexity that gets added to make things performant is worse than just accepting that UIs are going to require you to jump around the tree and modify state.

Every time I go through the trouble of understanding the latest web technique (React, Elm, Signals (the newest solution), etc.) to deal with state management and the DOM, I end up walking away disappointed. There's nothing new in them that you can use to improve what we've been doing for ages in native GUI toolkits.

And to jump back to the original topic, yes, Cocoa was pretty decent, and SwiftUI while nice in many ways tries to Reactify native macOS development and made it worse. And it made Swift incredibly more complex and worse in hindsight.

Re:DSLs Enable Reliable Use of LLMs on Wednesday July 15, 2026 @10:10AM (#48921110)
No argument that it works, it definitely does. I just think the LLMs have a hard time with tweaks/modifications of any kind, more so than what I see even in a custom GUI toolkit I’ve built that it has zero training data on.

Asking for simple changes to SwiftUI interfaces I’ve one-shot is always a frustrating experience for me

Re:DSLs Enable Reliable Use of LLMs on Wednesday July 15, 2026 @09:59AM (#48920932)
Logically this makes sense, but in practice it doesn’t, at least in my experience with SwiftUI. The LLM isn’t any better about generating/understanding it.

While the DSL is more formal than natural language, it’s not what we’re communicating to the LLM with, so it’s advantages are washed away. And typical code is more strict/rigorous than DSLs so I think that’s why I see worse results, because a typical languages compiler “catches” more mistakes, versus a DSL that’s easy to write but has lots of implicitness.

I’ve had the same journey experimenting with levels if abstraction too. Going lower, and exposing the LLM to the “full-stack” works much better than trying to build up abstractions it can’t see into without extra steps.

I don’t want to be too much of a hater, but these types of panacea/architecture posts are usually written by people who don’t work in the field, lack pressure or constraints, and get paid to goof around in castles of the mind. I would simply skip over it and hold my comments/opinions to myself, but they tend to have an outsized influence on software engineering practices.

Re:My Thoughts on the Bun Rust Rewrite on Thursday July 09, 2026 @11:09AM (#48847234)
> He says he writes slop code and doesn’t provide a single example or prove that statement.

You can look at the bun codebase. Moving fast has its drawbacks, and bun moved very fast. It’s not what I’d call idiomatic or exemplary Zig.

I think this is what Andrew was highlighting with “beginner energy”. Not knowing you shouldn’t rewrite a toolchain and take on an entire ecosystem can be a positive. I think this is pretty common in business, where someone/something isn’t “great” but wins because they didn’t know any better and went headfirst into something experts avoided because they understand the challenges and what “doing it right” entails.

Re:Q&A with Micron's VP and GM of Memory on Friday July 03, 2026 @09:47AM (#48774999)
Any thoughts on the latest price fixing allegations?: https://en.sedaily.com/international/2026/06/29/samsung-sk-h...
Re:CachyOS June 2026 Release on Monday June 29, 2026 @02:13PM (#48722940)
I tried CachyOS and Niri this weekend, and was pleasantly surprised hibernate/suspend actually worked with no customizations on my Desktop.

I’ve tried like 5 other distros and usually when it goes into sleep/hibernate the monitor never wakes up so I have to force shutdown using the power button.

I’m going to install this on an older machine and see how it goes. So far it’s been great!

Older »