News for hackers. Stuff that matters.

soiax

Re:Unlocking any car from X brand in most of the world on Monday November 09, 2026 @09:42AM (#50426320)
The authors do this kind of stunt hacking all the time, they look at shit that has no security contact, no bugbounty, and they hack them without permission for clout
Aliens
I have some bones, i'll live forever
Exatly, it was patched silently, OpenaAI just discovered that patch, and that it has upstream effects in NodeJS etc.
Re:Actively exploited sandbox RCE in all Chromium versions on Saturday September 05, 2026 @05:03AM (#49574684)
The title is bad, it is not sandbox escape, it is "RCE inside the sandbox", so only RCE when sandbox is disabled.
Why are people upvoting a unexploitable bug? How is this interesting? There are thounds of these, no one even reports them unless they are exploitable, DoS only.
Right, but we have no clue why, and how the emergent behavior they show works.

If we would know that, there would be no need for interpretability research.

They should also check for hot dog vs not hot dog
Re:Stargaze: SpaceX's Space Situational Awareness System on Friday January 30, 2026 @09:28AM (#46824793)
Yeah dude .. if you say it multiple times, and louder, it must be true. That would make it a nazi company, right.
Re:Stargaze: SpaceX's Space Situational Awareness System on Friday January 30, 2026 @07:54AM (#46823889)
No, you dumb fuck
Re:Stargaze: SpaceX's Space Situational Awareness System on Friday January 30, 2026 @02:22AM (#46821465)
There it is... the usual ELON MUSK BAD.
Re:AI and Startup Moats on Tuesday January 07, 2025 @02:34PM (#42626387)
You mentioned prompt injection, now when you talk about larger time horizons, that sounds like a AI alignment issue.

I'm sure there will be actors who don't care at all about "security", saying the positive outcomes outweight the negatives.

Re:AI and Startup Moats on Tuesday January 07, 2025 @08:38AM (#42622153)
Yeah that's false.

from: https://arcprize.org/blog/oai-o3-pub-breakthrough

"Note on "tuned": OpenAI shared they trained the o3 we tested on 75% of the Public Training set. They have not shared more details. We have not yet tested the ARC-untrained model to understand how much of the performance is due to ARC-AGI data."

Re:AI and Startup Moats on Tuesday January 07, 2025 @08:31AM (#42622102)
This sound like you assume that the first thing someone thinks about is security, when building the next big thing.

They will just build something as fast as they can. Last thing you think about is "security".

There were prompt injections in all the big models, and still are. Why would it stop distruption?

Re:From object transition to RCE in the Chrome renderer on Wednesday August 14, 2024 @06:27AM (#41244544)
You can disable it runtime, with --no-sandbox command line option.
Re:From object transition to RCE in the Chrome renderer on Tuesday August 13, 2024 @04:47PM (#41239676)
No. There is a reason the author keeps repeating "arbitrary code execution in the Chrome renderer process." Because it's there, not in the browser process.
Re:From object transition to RCE in the Chrome renderer on Tuesday August 13, 2024 @04:24PM (#41239399)
It's all renderer only RCE-s, no sandbox escape. So it doesn't work on your browser, only if you disable the sandbox.