News for hackers. Stuff that matters.

superkuh

Did they do something to Fortnite that I don't know about?

Yes, probably. You see I bought Fortnite for $40~ when it was a completely different game; a cooperative player vs. environment building game with wave attacks. This game was entirely about microtransactions and gambling. After every round/storm passage you'd be sent to an unskippable screen with it.

Then Epic saw how well PUBG was doing with the Epic engine and turned Fortnite into a PUBG clone. In this new PUBG clone called Fortnite the gambling and microtransactions were just as bad as in the original Fortnite. Over time as the new PUBG clone called 'Fortnite' became a world sensation it both faced more scrutiny and had other monetization options with IP licesing. They massively dialed back the gambling/microtransactions but still face many court cases about it today.

You probably only played the modern versions after they were seeking to avoid the consequences for their actions.

It is a problem yes. And usually whataboutism doesn't matter, but in this case it really does: have you looked at the microtransaction gambling in Epic properties? It's far, far, far more invasive, omnipresent, and required to play (like Fortnite). You can completely ignore the microtransactions aspects of Team Fortress 2 and it's great. You can't (literally, you can't) ignore the microtransactions and gambling in Fortnite.
Wow. What propaganda. People use Steam because Valve isn't evil. It's as simple as that.

Epic is evil. Epic uses their position with the Epic engine to clone their business customer's games and release them for free. And personally, Epic stole the game Rocket League from me after I purchased the native linux version from the company Psyonix. Then Epic bought Psyonix and said there'd be no changes to Rocket League. 6 months later and no linux or mac clients people bought could play the game. Epic just buys game companies and puts their games behind it's app store and/or gives them away for free to try to lock people into their app store. They're abusive and exploitive and they constantly lie and make things worse for every game they buy.

People don't like that kind of behavior from Epic so they chose not to use their product and app store. This is capitalism working perfectly. It's just a big bully complaining about not being able to exploit people in something as close to a free market as humans get.

For those not aware: Freenode.net is not Freenode as we all knew and loved it from the early 2000s to 2021. A hostile take-over of the Freenode LLC resulted in the loss of the domain name and some corporate assets. And the hostile takeover person, Andrew Lee, deleted the Freenode database. It no longer exists.

"Freenode" in 2026 is an entity actively hostile to open source software and while what they say here might be true, they are only saying it because it aligns with their biases. They are not a real news source.

My mitigation for this lack of patches has been using iptables.

    iptables -A INPUT -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP
Re:WTF Ubuntu? on Monday November 02, 2026 @10:23AM (#50338068)
That is with the implicit assumption that the mptcp exploit of this ipv4 tcp bug is the only exploit that will be found. I don't think that assumption will hold true.
Re:Patrick Stewart taught us what good men do with power on Sunday November 01, 2026 @07:13PM (#50331373)
It's important to show sometimes Picard is wrong and the institutions are wrong. And how he reacts to that.

One of my favorites is Star Trek TNG s04e22 "Half a Life". It's excellent scifi that doesn't glorify aging and death and even points out that death is bad despite it being tradition in society. It highlights that death is the worst possible outcome. Worse than nearly all potential difficulties or suffering while living. And it's one of the few episodes where Lwaxana Troi is a genuinely good person. Better even, ethically and morally, than the star fleet standard. Better than Picard. It's just a shame the episode retreats from it's message at the end and does not embrace the true morality Lwaxana explains.

You're talking about being right on resonance as if it won't help if it's off by 20% of the center frequency. But that's not true. Just like you can use a stumpy monopole whip for 144 Mhz even though it's 6 inches long, and it will help significantly (but behave like an omni capacitive reactance element), so will this not quite right slot antenna mode. There are many ways to excite and feed a slot antenna that do not depend on having the two excitation terminals on each side of the slot. Especially if you're doing it off frequency. Any conductor in the near field is going to couple via induction.
So the idea would be to use some existing model architecture and model that has been poisoned that will actually be parsable by existing inference software to try to do malicious things if it's run in a harness that allows tool use/etc? On the assumption that the type of person to download and try to run inference with the model would be smart enough to know to do that but dumb enough not to realize that "mythos" architecture wouldn't be in any inference software yet?

A small slice of demographic but I guess it must exist. Most people that would download it would just be looking at the organization of the .safetensor file to figure out the architecture to actually implement inference to run it.

Correct. But also, an antenna doesn't have to be exactly resonant at the desired frequency in order to help. You can see this most often in the antennas people use for HF, which to be resonant have to be giant and many meters in size, but instead they use small non-resonant antenna that still transmit enough, even at very low efficiency, to radiate an annoying amount of interference.

Not having a giant slot antenna is a lot better than having a slot antenna. Even if the slot antenna is best resonant at mid-VHF (ie, ~144 MHz which is what many GPU RAMs are blasting at at high current).

And just as important: a huge hole is a hole. Even if it's not acting as an efficient antenna. It's basically an entire side of the case missing.

Computers used to come in proper full metal cases. Now they don't. Even when you try to find a metal case for a personal build most cases have giant holes in the side (case windows) acting as slot antennas. And plastic case laptop designs are even worse. Radiated emissions are much easier to achieve at useful intensities these days because of it. Sure, before the conductors going in and out radiated somewhat effectively (and still do). But now even core system components inside are just being let emit without any mitigation.
Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @09:03PM (#50321801)
Add the below rule onto your machine's /etc/ufw/before.rules to mitigate it.

    # CVE-2026-98432 mitigation: drop TCP packets carrying IPv4 extended options
    -A ufw-before-input -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP
Any value >5 in this field means ip extended header options and so values of 6 through 15 should be dropped. Note that I don't just drop syn packets like the mptcp exploit because any tcp packet could do it in theory.

This works for me on multiple servers and home desktops and my hardware linux firewall/router. I did it a couple days ago when this was first announced. The iptables counter for matches haven't gone up at all on my VPS servers that gets lots of traffic. The counter only goes up when I manually trigger it to test. Everything continues to work nominally with these in place.

Anubis is the only anti-"rude corporate http requests amounts" that doesn't only rely on cutting edge javascript VM features. Simple mitigations like the HTML header meta-refresh proof-of-work(waiting) work in all browsers going back 20 years. Rather than just supporting browsers from the last 3~ months like cloudflare.
Re:Breaking the Open Web Won't Stop the Bad Bots on Friday October 30, 2026 @04:58PM (#50310058)
Subheadline: site owners unaware or don't care about humans caught in their "effective" block
Would dropping these specialized ipv4 syn packets with extra header size beyond 20 bytes (as indicated by options value >5) with the firewall be low enough in the order of things to mitigate the attack? Like, iptables -A INPUT -p tcp --syn -m u32 --u32 "0>>24&0xF=6:15" -j DROP ?
Re:Drupal is now light-years ahead of its reputation on Sunday October 25, 2026 @12:45PM (#50233489)
This is where the very simple and stable "server side includes" (SSI) that every major webserver has had for 30 years come in. It's just enough templating power to make menu.html and include it in every page you care about without any significant attack surface. Working with static HTML fragments on the filesystem is such a delight compared to any CMS.
Re:We should be more ambitious with the software we build on Sunday October 25, 2026 @03:02AM (#50229022)
You know what would be really ambitious? Software that exists in a stable form without breaking for more than 15 years. Truly ambitious would be a stable, non-changing common linux base (like how Nintendo NES emulation target is stable) of packages that just gets supported for decades.

Perhaps that's too ambitious. But it would be of incredible utility not having to re-make the same things over and over in pepertuity with ever more abstraction layers. So much work on computer is just the constant churn and future shock of libraries adding new features which require updates which break other things. I'm tired of building castles on sand.

Uh, no. This headline is wrong. It's FP32 unlocked from being halved, not 16 bit ops. And to be clear, over the last week I've looked many places and I've not seen any reports of this unlock being applied to any 3xxx card except the 3090/3090ti series. Even if it might apply more generally in theory.
You say, "Play Protect" as if it is a thing that users can choose to avoid. Or as if it justifies the behavior. I don't think either of those is true.
Re:The Rise and Fall of the Plasma Screen on Friday October 23, 2026 @08:52AM (#50208218)
There's a reason that high speed switching electronics have metal cases. And it's understandable that most people don't know babinet's principle as it applies to RF antenna (basically a hole in a conductor is exactly equivalent to a conductor of that same size and shape: the case window is an antenna). The FCC wouldn't care about me because I intentionally use full metal cases for all my high speed switching electronics and monitor my RF environment from 20 to 3700 MHz over various SDR devices 24/7/365.

I'll grant that a ~meter size slot antenna (case window) is not exactly big enough to be resonant at HF but compromise antennas are the standard for HF and they still work; just because HF propagates so well even at low powers. And lets not forget they such a case window slot antenna is resonant around higher frequencies like ~144 Mhz where the GPU memory is blasting and pulling large currents over long conductors.

If the FCC actually tested a modern computers in their shipped window or completely glass computer cases they likely they wouldn't allow it to be sold commercially. But they're much too busy with politics and as long as it doesn't interfere with military use or high frequency trading they don't care about HF.

Anyway, I do see that no one is disagreeing about the radio intereference caused by plasma TVs. That's good, because they're terrible offenders.

Re:Facebook now charging to post more than 2 links a month on Wednesday October 21, 2026 @07:55PM (#50189262)
Understandable stance, re: comments, but this even applies to the descriptions of your own videos. And actually, in comments, I can still sometimes post URLs. So it's not even consistent or applied where it would really help.
Re:The Rise and Fall of the Plasma Screen on Wednesday October 21, 2026 @06:51PM (#50188806)
Plasma screens, like computer case windows, are incredibly rude but the people using them have no idea that their behavior is inappropriate. Both emit significant amounts of HF radio interference which bounces around the ionosphere degrading a shared resource for all of Earth. And even more VHF and up interference which only degrades a shared resource till the next hill. It's pretty much just like littering in a public park.
Re:Facebook now charging to post more than 2 links a month on Tuesday October 20, 2026 @11:19AM (#50167740)
On Google's Youtube to post links (like in video descriptions, etc) you have to pay by adding sellable/monetarily valuable personally identifying information to your account like a phone number and ID. Otherwise even with a google account from 2006 in good standing you can't post links anymore. Attempts to edit old video descriptions with HTTP/S links (from before the policy) also don't work.
Almost as crazy as running random arbitrary code from unknown third parties automatically. Yet that's the unquestioned status quo for the web and if you don't do it you're considered a weirdo. This is whataboutism, of course, and does not invalidate your claims. But really the only risk comes from the harness that does tool calling, not inference. Just running inference without it is not at all risky.
Re:Drupal is now light-years ahead of its reputation on Monday October 19, 2026 @08:37PM (#50159881)
It's too late. Drupal 6 turned me off ever using a CMS again. Now I purely use html files in folders with other files in folders. It's great. No maintainence burden, no attack surface, no resource eating always running programs or database that can get corrupted or otherwise in a bad state. And especially no migrating to the new version and everything breaking (especially with non-core stuff).
Nothing about abliteration matters here. Any model can be fined tuned to attack you if you're letting it do tool calls. But I trust a random human enthusiast and community feedback more than I trust a megacorporations that commit crimes without any prosecution or consequences.
What we really need form Lets Encrypt is stability and lack of change. But LE is just following the megacorps down the current TLS road. We're already down to only 30 day certs and on the second iteration of acme. Acme original protocol setups no longer work, they were broken by the dropping of support.

Addding new methods of validation does not help nearly so much as just supporting existing methods for more than a few years would. The race to the bottom will end up with an incredibly fragile system that breaks the moment automation does. Combine this with the trend towards HTTP-only and any given website will only have a lifetime of a couple years without direct human intervention. This is a drastic change from the status quo of websites simply lasting forever and being accessible till their webservers stop.

It is 100% a corporate-for-profit-only mindset and architecture. LE is not designing or accomidating human person goals and needs.

Re:Alternatives to Animal Testing Are Finally Taking Off on Monday October 19, 2026 @10:34AM (#50153009)
The massive increases of medical research spending to useful outcomes directly track the decrease in testing in humans and then animals. False positives from doing research in systems that are not the systems the medicine will be used in results in the observed waste and lack of progress compared to, say, the 1950s.

I am not saying we should not have stopped directly testing in humans or animals. But I am saying that the result has been worse outcomes. And any further shifts away from the biological systems that need the medicine (like using computational crap like LLMs) will further increase this disconnect.

So, when are both of these people going to be indicted, have their court hearings set up and face trial for their crimes?
Re:Butlerian Jihad on Saturday October 17, 2026 @10:18PM (#50137233)
This wasn't a normal 'article'. It was just a commercial wiki page on a well known topic. And a distasteful 'fandom' one at that. No information there was special or unique to it in particular. The real point was to have URL about the topic to start the conversation.
What the big social networks provide is the ability to transact money. No distributed non-corporation system can ever provide the money flows that make people use corporate social networks. Or, they can, but the instant they do they're legally attacked and destroyed. So no independent/distributed network can ever really draw those people who make up the majority who are chasing money or following those who chase money. The audience won't exist.

Older »