News for hackers. Stuff that matters.

sweetjuly

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:20PM (#50319734)
In addition to aggregating, it can also be useful in cases where one link is much slower or higher latency. For example, if you're sitting in your driveway trying to get directions in maps while your phone is still on your very weak wifi network, it's a better user experience to have it to attempt the request using both radios concurrently so that it can fallback to cellular without waiting for a timeout/connection error if you're too far for wifi to actually work well.
Re:Claude Duet on Wednesday October 21, 2026 @06:18PM (#50188449)
How are you combining local models with hosted models? I have tried OpenClaw with some of the smaller local models (Qwen3.6-35B-A3B, Qwen3.8-Flash-Next) and found that while it can sometimes complete tasks, it would face plant often enough that it made it impossible to use. Do you have some tiered system where the hosted models dispatch to local models?
Seriously. It feels like Anthropic is realizing this too with their new attempt at safeguards. Trying to train the model to "only do good things" was not working, and so they opted to just bolt a topic classifier on the outputted text.

My suspicion is that model makers are going to give up on what people currently mean when they say 'alignment' and instead rely on additional processing of the model output so they can have their cake (a veneer of safety) and eat it too (latent space reasoning, etc.)

Re:Arena Allocators in C on Wednesday October 14, 2026 @03:12AM (#50083599)
> This will be used to align the data. For some reason, our computers are much better at dealing with data that is aligned at 8 bytes. This means that the start of each new allocation has to be at a multiple of 8 bytes.

Casting a pointer which is not aligned to its natural alignment has undefined behavior in C. It's not just an issue of unaligned accesses being slow; in practice, your program might also crash or access unexpected data on real platforms with real compiler implementations.

Re:A Modern Web App in C on Monday October 12, 2026 @10:52PM (#50065979)
fortunately AI (scrapers) have solved this problem so now you'll have no end of traffic
Re:Decisions API is in public beta on Wednesday October 07, 2026 @02:11AM (#49988937)
No amount of prompt engineering will give you the true probabilities for the model producing a certain response; this is something you can only get by inspecting the internal state at inference time.
In general, you have to intend to commit the crime you're being charged with (referred to as "mens rea"). Though, it's important to note that "intend" is extremely ill-defined in the US and it varies with the crime (eg for theft you must take the item on purpose whereas something like manslaughter requires only that you were negligent).

What this means here is, of course, equally spongy, but it is interesting as there might be an argument here that she did not intend for it to be viewed by anyone as, regardless of what the T&C say, most people do not expect their "private" chat logs between them and a machine to be seen by anyone at all.

Re:Page Table Memory Consumption on Sunday October 04, 2026 @10:49PM (#49960178)
relatedly, it is also worth considering that your VA allocation behavior can have significant impacts on your page table costs.

Some programs like to, for example, map allocations at random VAs for security reasons. If you're only using a single page, this makes your worst case cost 1 page for actual data + 2-3 pages of tables (depending on your CPU architecture and address space size). If you do this very often, this can get very expensive in a hurry.

> Many people's moral systems (and our legal system) are typically deontological

I think there's also a component of people (HN's audience in particular) trying to approach the law as if it were a program. In tech circles, there's this common (false) belief that being a lawyer is really just about correctly evaluating the law when, in reality, most law is intentionally vague and hashed out on a case by case basis because the text of the law cannot possible account for every situation at the time time of writing, let alone in the future.

Re:Hacking OpenAI on Friday September 18, 2026 @04:15AM (#49751527)
I suspect the latter is much easier and cheaper than the former? You can port a lot of software with cheap (or even local) models if you're tenacious whereas finding all the bugs is both very very expensive (if it's even possible) and potentially never ending (there's always new code and bugs!).
Re:Why is the x86 undefined instruction called ud2? Why 2? on Sunday September 13, 2026 @01:56PM (#49686665)
There's a bit of convention and practicality The only thing you really need is that your "fatal error" instruction and "syscall" instruction can be reasonably discriminated without needing to set registers at the call site. Needing to set register to identify a fatal error is not great for code size, especially in languages that generate a lot of them (memory safe languages, mostly).

Though, yes, convention does play a role. On ARMv8 you get both SVC <imm> and BRK <imm>. SVC and BRK raise different exception codes (which satisfies the "easy to distinguish requirement) but in principle you could just use BRK with a well-known immediate and eliminate the need for SVC since BRK's immediate is reported in the exception status register. And, anyways, if you have an SVC instruction and a BRK instruction, you may as well use the SVC instruction for syscalls since it's right there.

Re:Learn Programming with OCaml on Saturday September 05, 2026 @04:09PM (#49580212)
I do really wonder what it would be like to learn to program for the first time with OCaml.

I remember learning to use OCaml in a properly functional way after so long writing code in C and it was really miserably painful trying to change how I thought about algorithms. I eventually got over the hill and it changed how I write code in C (for the better?), but I do wonder if it would have been easier to have learned OCaml as a first language instead.

Re:RISC-V is now officially supported by CPython on Sunday August 30, 2026 @01:14PM (#49500598)
I don't think you're giving ARM credit for the ever growing pile of features which are always optional or optional only on some versions of the ISA.

For example, can you use FEAT_CSSC to improve code size and performance? Well, if the target is <v8.7, the answer is no. If it's v8.7 or v8.8, well, then it depends on whether your specific implementation has it. Only after v8.9 is it mandatory.

Targeting armv8a is the moral equivalent of targeting RV64GC insofar as it will run on any application class core. Targeting that, however, leaves a fair bit of useful ISA enhancements on the table, and so you tend not to want to do that if you can get away with it.

It's complicated.

> Courts have generally found that compelling individuals to provide their numeric or alphanumeric passcode is potentially testimonial under the Fifth Amendment, as it forces the defendant to reveal “the contents of his own mind.” In Re Grand Jury Subpoena Duces Tecum 670 F.3d at 1345; see also U.S. v. Apple MacPro Computer, 851 F.3d 238 (3d Cir. 2017). It is analogous to compelling production of the combination to a wall safe, which is testimonial, as opposed to surrendering the key to a strongbox, which is not. See Doe v. U.S., 487 U.S. 201, 220 (1988). However, even if a court finds that providing the passcode is “testimonial,” it may still fall under the “foregone conclusion” exception

https://www.nacdl.org/Content/Compelled-Decryption-Primer

In short, you can't be compelled to give up the code in a dragnet attempt to find evidence against you (e.g. a boarder guard can't riffle through your text messages to see if you might have done something illegal), but if it's already certain that particular evidence exists on the device as a result of other evidence, they may be able to compel you to give up your passcode.

Note though that the cases where this has come up are very few and far between, and there isn't a super clear overriding precedent to follow.

In general though, the best choice here is to say nothing at all and work with a lawyer to figure out how to proceed.

One must imagine punching the wall feels good (in the moment)
Re:What Happens When the Cost of Intelligence Drops 100x on Friday August 21, 2026 @11:33AM (#49389677)
I don't think it's a matter of "staying ahead"; the proprietary frontier models are better, but the trouble for them is that open weight models are good enough in increasingly many cases. This raises the floor on the frontier companies and cuts their total addressable market by commodifying the easier LLM tasks. This is really the central argument of tfa :)
Re:License plate reader searches should require a warrant on Wednesday August 12, 2026 @01:52PM (#49276195)
Yes, this is why a warrant is required to access carrier location data for a phone but one is not required to have a police officer physically following you around town despite the outcome (the police get a trace of your location) being the same. Cell phone location data is too easy and cheap for the government to scale and so courts have found that it demands tighter protection.

See: https://www.oyez.org/cases/2017/16-402

It comes up fairly often here since the HN audience tends to be mostly programmers/computer people, but it's really important to remember that the law is not a series of rules a computer can directly evaluate to determine whether something is or is not legal; judges frequently use their judgement to balance the assumed intent of laws and the competing interests of various parties. I don't say this to you specifically but really just the HN audience as a whole :)

I worry that all this talk about "China can't be allowed to beat the West on LLMs" is a setup to saddle the public with a bailout in the name of national security.
Re:Qwen3.8-Max: A New Bar for Coding and Cowork on Monday August 03, 2026 @02:28AM (#49151935)
When has enforceability ever been a concern of the government? This is the same government that had anti-sodomy laws on the books until the Supreme Court ruled it unconstitutional in 2003.

Making it illegal even without having a realistic means of enforcing it still chills behavior, and so just because it isn't practically enforceable in the general case doesn't mean it isn't without consequences.

DCA is not unreasonable advice given that most people's greatest enemy is themselves. DCA helps avoid the very emotionally upsetting feeling of you throwing money into a fund and it dropping 5% the next day. This emotional volatility can push people to make bad decisions (pull all their money out, try to time the market, stop investing, etc.). Scheduling your investment into smaller sums lets you diffuse the highs and lows in order to keep you steadfast.
Re:The AI Aesthetic on Friday July 31, 2026 @01:22AM (#49119295)
there was also a small trend a while ago of using it to bracket tongue and cheek/sarcastic phrases, for example:

> setting your computer on fire for (sparkle) self care (sparkle)

Re:Running Doom on Our Custom CPU and Going Viral on Tuesday July 21, 2026 @01:23AM (#48988344)
Always a delight seeing Chisel in the wild :)
Re:Apple targets OpenAI employees with legal letters on Friday July 17, 2026 @01:14PM (#48949762)
The trick is antitrust style bundling. The massive pile of documents and processes tied to GSuite is a moat which makes it hard to switch to something like o365. Since a company might effectively be locked into GSuite (the primary product), if Google forces companies to buy Gemini (the secondary product) by bundling it with GSuite, they've given themselves a moat in the LLM space using their document/email moat from GSuite.

This is essentially what Google has done, and it's a shame the US is so weak on enforcing antitrust laws.

Psychology in general tends to make the same distinction. There are lots of behaviors which may be considered abnormal but do not have a meaningful impact on the quality of life of the person or those around them, and so there little reason to pathologize it. The goal of medicine (and, in my mind, well-designed public policy) is to prolong quality of life and not to ensure everything adheres to strict standards.
Re:Price per 1M tokens is meaningless on Monday July 06, 2026 @04:35PM (#48810160)
I think what you're really getting at is that it's only useful if the benchmarks are predictive of your workloads. If it predicts well (for example, your tasks are equally easy), then the fact that a larger model can complete it more quickly means that you may be able to complete the task more cheaply, depending on the token cost.

If the benchmarks are non-predictive, well, you can't use them for much of anything, which is of course a recurring problem with every benchmark ever.

I remember reading this blog post when it was first published, but the subsequent updates are better than I would've ever expected this to turn out. Worth checking it out again if you've seen it before :)
Re:No, everyone is not using AI for everything on Sunday June 14, 2026 @12:39PM (#48529322)
I would hope this is true both in the context of LLMs and more broadly, but I think this is especially not the case for LLMs. It's hard to take the idea that companies are trying to hire people with reservations about LLMs seriously when many companies have LLM use mandates. It is counterproductive in the eyes of the employer to hire employees that will be combative on LLM from day one.
Re:Introducing Waymo Premier, an elevated rider experience on Thursday June 11, 2026 @06:03PM (#48497020)
Are you going to ask your employees for their 2% cashback if you reimburse them for a purchase they made with their credit card too?

At the end of the day, it seems more practical to focus on ensuring that they picked the appropriate value product/service. If they picked appropriately, does it matter if the company gives them employee a kickback? Sure, the employee will then be incentivized to get the most expensive thing they can, but this was already the case because it's not their money and they want the best thing they can get away with.

Is what you suggest about training even possible? Most exploitation techniques are really just about having in-depth knowledge of how components work. For example, I imagine a sufficiently powerful model could fairly easily re-invent the ROP chain from first principles if it just knew how the stack works. This same principle applies to much more complex attack too; exploitation is often just an exercise in knowing vastly too much trivia, which LLMs tend to have in spades.
Is interactive use for coding something that actually works today? With unsafe mode, even frontier hosted models are slow enough I end up just tabbing out to work on other tasks. It would need to be much faster if I am to sit and stare at it while it churns. Local models might be a lot slower but workflow-wise it doesn't change much for me.

Older »