News for hackers. Stuff that matters.

tim1994

Citation needed. For example Flamanville 3 (France) was estimated to cost around €3.3 billion, costs ballooned to over €13-19 billion. There are other similar examples such as Hinkley Point C (UK). Also maintenance is much more expensive and don't forget the cost for storing nuclear waste + decomissioning. Compare that to renewables...
Re:Steal My Bitcoin CTF PoC on Tuesday October 27, 2026 @03:17AM (#50255614)
It took 2-3 hours, not 19. The first version was a static index.HTML file and was not exploitable. People found out and contacted the challenge author. After the fix was public it has been exploited in a couple of hours.
Re:Bug Blindness on Sunday August 30, 2026 @06:11AM (#49497306)
Padding is typically part of the hitbox, margin is not. What you are describing sounds like margin to me. Especially for Firefox since their UI is made with web tech.

But besides being overly pedantic I agree with your general point. If their is a small gap between hitbox and edge of the screen it is very annoying.

But the worst thing IMO is Windows 11 windows which you can grab by the titlebar but not the content area. However often there is no visual indication of where the titlebar starts/stops.

Re:Modern CSS Code Snippets: Stop writing CSS like it's 2015 on Sunday February 15, 2026 @05:06PM (#47028136)
With signals you can avoid the prop drilling. I think signals can help a lot with this approach
Re:Discord/Twitch/Snapchat age verification bypass on Thursday February 12, 2026 @05:36AM (#46987089)
Well, someone has to start. It's ok if you use the alternative with a subset of your contacts.
Re:Consent-O-Matic on Sunday January 18, 2026 @08:02AM (#46667490)
True, but considering that the extension was bought in 2022 by Avast, maybe it has its own tracking built in by now or will have something concerning done to it in the future. So even if the user does not care about cookies that much I would still recommend this new extension over "I don't care about cookies"
For panning you don't need a 3D view/reconstruction. This also allows translational camera movements, but only for nearby views. Maybe I am overly pedantic here, but for HN I guess thats appropriate :D
Re:Incomplete list of mistakes in the design of CSS on Thursday December 11, 2025 @05:11AM (#46229580)
Should you optimize for resize performance? I guess that depends on the app. Use the tool that fits the requirements.
Re:Netflix to Acquire Warner Bros on Friday December 05, 2025 @10:00AM (#46162155)
The problem is content exclusivity. It would be great if all the content or at least most would be available on all platforms. At least eventually. That would be great for consumers. Mergers like this typically not.
Re:Good engineers write bad code at big companies on Friday November 28, 2025 @05:38PM (#46083427)
Another reason I can think of is the requirement not to introduce a breaking change. It is very frustrating if the codebase has a lot of hacky/bad code in it but a lot of it can't be changed...
Re:Shai-Hulud Returns: Over 300 NPM Packages Infected on Monday November 24, 2025 @10:31AM (#46035165)
Because updates don't just include new features but also bug and security fixes. As always, it probably depends on the context how relevant this is to you. I agree that cooldown is a good idea though.
> The government is.

Companies too.

I think the problem is that they cannot communicate that they don't know something and instead make up some BS that sounds somewhat reasonable. Probably due to how they are built. I notice this regularly when asking questions about new web platform features and there is not enough information in the training data.
Re:FreeDroidWarn on Tuesday September 02, 2025 @04:20AM (#45100389)
Ain't gonna happen (unfortunately). Somehow people (outside of HN) seem to like to use apps for everything. EVERYTHING.
Re:AI overviews cause massive drop in search clicks on Thursday July 24, 2025 @05:58AM (#44668919)
I also get this. Firefox on Android in Germany.
A couple of years ago I played PUBG which crashed occasionally. I rarely submitted bugs, even if it was as simple as pressing a button in the crash reporter. This is because sending the bug report took a while and blocked you from restarting and rejoining the ongoing game. This applies mostly to multiplayer games but if your app has a crash reporter, give the user a chance to restart the app and report the bug later.
Re:A privilege escalation from Chrome extensions (2023) on Wednesday May 28, 2025 @02:59AM (#44113342)
Interesting read for sure! This is about ChromeOS though, Chrome on other platforms was not affected.
It's always impressive how far people can take TypeScript and even build parsers with it. But this is limited to inlined string literals and cannot read files (a TS limitation).

I wonder if the author has a use case in mind for this that I don't see. Like if you are only using TS, what's the point of protobuf? If you are exchanging data with programs written in other languages why avoid the protobuf tooling that you need anyway?

Maybe this is just a fun toy project to write a parser in TS?

In Germany LRAD systems have been used to deliver Covid 19 information, not against protesters. Used by the fire brigade. I haven't checked uses in other countries.

https://en.m.wikipedia.org/wiki/Long-range_acoustic_device#G...

Re:Firefox tracks you with “privacy preserving” feature on Wednesday September 25, 2024 @04:33AM (#41645142)
Why do we need tracking for advertising though? I wouldn't mind ads based on the page content (as much). Social media websites know their users anyways, no need IMO to track users across other websites.
Re:Don't try to sanitize input. Escape output. (2020) on Sunday July 14, 2024 @03:42AM (#40959476)
I don't think this is sufficient. Scripts could still do bad things, for example mining crypto.
You can use Google Play services on Lineage os. IIRC they are installed by default though there are ways to use it without them (doing that right now). About banking apps idk.
The Android App as well. I have a slightly older phone (Fairphone 3+) and it takes 10-15s for a song to start playing after tapping on it. Even if it's offline available. Didn't use to be that way. Also the app is basically the opposite of offline-first. Terrible UX.
Sounds like an interesting project, but I think it's important to find a good way to interact with browser APIs. They all work differently, like rAF, geolocation, pointer lock, camera access and so on. I think relying on the unsafe mode for all that could lead to a frustrating experience but also implementing those APIs in a different way would be weird and you have to keep up with new APIs and changes browsers introduce. I suggest having an idea on how to solve this before spending a lot of time developing the actual language. If it limits what I can do with JS I would not use this and just stick with Typescript.
IIRC extensions cannot access any URL that hasn't been specified in the manifests permission section. I think Firefox shows those URLs in the permission prompt. Those URLs can contain wildcards though and I even think there is a special value for all URLs but only few extensions should require that permission.
I don't know how Chrome handles this but Firefox won't install the update without the user confirming it.
It's not quite that simple. For example the button doesn't necessarily has to have an aria label. Could be the (nested!) content. There could be multiple candidates. The speech recognition thing is also not trivial. Yes there are WebAssembly based solutions but those have to be properly integrated and tested (not sure how good they actually are)
Perhaps a caching or timing issue? I updated my profile shortly after posting this (and noticing it myself).
Assuming this does not yet exist: If anyone is interested in building something like this (that works offline) please let me know, I'd like to join. I have some experience building web extensions but unfortunately not the time to develop & maintain this on my own right now.
I assume you are referring to the SpeechRecognition interface of the Web Speech API. Unfortunately this is not supported by Firefox and even for Chrome it doesn't work offline.

Source: https://developer.mozilla.org/en-US/docs/Web/API/SpeechRecog...

Older »