News for hackers. Stuff that matters.

wahern

Google Wifi used to be good about that. I even got a notification for when my AP was being EOL'd and would no longer receive automatic firmware updates. I don't know if Google is still on the ball there. The Nest acquisition was confusing. Have the Google Wifi and Nest Wifi teams been merged?
Re:Redox: Ring Buffers Project Summary on Sunday November 01, 2026 @02:35AM (#50323425)
In the abstract there's nothing necessarily inherently insecure about io_uring. In practice on Linux it's a security disaster because it hooks into and interacts with subsystems in ways never anticipated when they were originally written, exposing and creating all kinds of bugs. Claims that the wave of bugs is now in the past were... premature. They haven't really stopped, though part of that is because io_uring hasn't stopped growing and becoming more complex itself.
Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:27PM (#50319811)
> Exploitability over the internet is unlikely, most ISP routers drop packets with ipoptions fields.

That doesn't track. Apple iPhones are a major user of MPTCP and they report the majority of requests supporting MPTCP, IIRC 70+%.

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:16PM (#50319704)
See https://en.wikipedia.org/wiki/Multipath_TCP

It's an extension to TCP that, similar to QUIC, allows you to use multiple address/port pairs to transmit data over a single logical stream. Both client/initiator and server/listener have to opt into the extension. This might need to be enabled explicitly by the application[1], which Go apparently does for you, or judging from other posts may be enabled by default systemwide, depending on your platform.

AFAIU, a major user of MPTCP is Apple and the iPhone, and the ubiquity of iPhone clients motivated implementation in and deployment on Linux servers.

[1] https://docs.kernel.org/networking/mptcp.html#sockets-api

Okay, but like with the banking myth there was no law or official government policy that specifically prohibited black ownership. And the only legally enforceable impediment after the 14th Amendment were racial covenants on private property (drawn up by property owners themselves by private agreement), which became void in 1948 after SCOTUS said it was unconstitutional for courts to enforce racial covenants.

Notwithstanding that they were examples of extra-legal discrimination (in the sense of not being direct legal prohibitions), racial covenants and red lining also didn't just effect black Americans, though nationwide they were disproportionately impacted. I only point that out because most people would say it was incongruous to claim Jews or Polish or Asians were legally prohibited from owning land in many areas.

I think it's an important distinction because there are vestiges of redlining that persist today. First time homeowner mortgage subsidies, the first major stepping stone for building wealth for most people, effectively exclude many kinds of multiunit housing, such as condos and, IIRC until recently, attached housing like duplexes. This disproportionately impacts prospective urban black homeowners, and quite deliberately. Likewise, IIUC prefabbed homes or similar are excluded, which disproportionately impacts poor rural whites and blacks alike. There are legitimate concerns behind those restrictions, such as developer and rental fraud, just as nominally there were legitimate concerns behind redlining, namely sustainability of property valuations. Though in all these cases it's obvious the reason they persist(ed) as-is is for largely discriminatory reasons, as the legitimate substance of the concerns could be addressed. At the same time, we wouldn't say they legally prohibit ownership; if you're wealthy enough they're no impediment at all, just like redlining and covenants were no impediment if you were wealthy enough (racial covenants could be overcome by just buying up all the adjacent property so there was no other property owner to enforce the covenant; the government couldn't by itself enforce such covenants, only adjoining property owner "beneficiaries").

Perhaps counterintuitively, black letter property law was one of the legal areas most resilient to both racial and sex discrimination. The 1800s saw some regression, but that didn't last long, often because courts themselves couldn't tolerate the illogic. People criticize it, but property is indeed sacrosanct to American legal and political culture, and it was very difficult to carve out exceptions that permitted blacks and women to be excluded without threatening the underlying principles of the system that secured owners' rights. That's why prejudiced treatment tended to come in the form of private, regulatory, or extra-legal discrimination, which arguably persists today in the form of restrictive zoning and related development policies which not coincidentally are impediments to free & clear property ownership, just enough to be tolerable to the well-off while disproportionately impacting the real targets.

Re:Compile-Time Dependent Types on Friday October 30, 2026 @03:54PM (#50309310)
That particular syntax has far too many caveats to be safely employed, IMO. It would be better to use variably-modified types (VMTs), which currently is more-or-less[1] a pointer to a VLA:

  int foo(int (*bar)[10])
In particular, sizeof(*bar) and (in C2y) countof(*bar) will do the correct thing. But you need to dereference bar almost every to use it properly, and unfortunately sizeof(bar) instead of sizeof(*bar) will compile cleanly, though countof(bar) is guaranteed to fail.

The dilemma is C's array to pointer decaying semantics. C2y will try to roll that back somewhat (a[i] will no longer be identical to i[a] via the a[i] == a + i == i + a transitive relation), but there's only so much you can do in that regard, especially for array passing, without new syntax or silently breaking alot of valid, proper, carefully written C code. There's too much that can fall through the cracks by relying on non-standard compiler heuristics to substitute for proper typing.

[1] Strictly speaking a VLA can only be created as automatic storage objects, but a VMT can type dynamically allocated (malloc'd) memory. But the syntax looks like a pointer to a VLA because it originates from the need to pass actual VLAs as parameters.

Re:Compile-Time Dependent Types on Friday October 30, 2026 @03:25PM (#50308976)
That was basically Dennis Ritchies' proposal as well: Dennis Ritchie, Variable-Size Arrays in C, September 1990, http://jclt.iecc.com/Jct22.pdf#page=5

IIRC, one of the problems there is how to generalize it to, e.g., struct members. (Maybe you can speak to that.) The approach adopted by C99[1], being based on dependent typing, was I think better conceptually. But despite dependent typing being awesome, it manifestly was and still remains a tough sell to compiler implementors, so VLAs/VMTs have languished in C and have yet to be fully developed. I think I'd agree C would have been better off with the approach you suggest. Adoption likely would have been quicker, and it could have been implemented in full almost immediately.[2] The consolation prize is that hopefully C will soon see some progression on the VMT front, specifically the proposals under discussion on the committee for forward-referencing in function parameter VMTs and VMT struct array members. The final piece of that puzzle would be addressing the scary syntax for VLA passing, which feels error prone (C2y countof operator semantics help a little bit).

[1] Tom MacDonald, Variable Length Arrays, December 1989, http://jclt.iecc.com/Jct13.pdf#page=67

[2] Ironically GCC already had nascent VLA support, which may have helped nudge the C99 committee toward that instead of adopting Ritchie's approach. But the fat pointer approach has a more obvious and straight-forward implementation.

Re:Compile-Time Dependent Types on Friday October 30, 2026 @01:24PM (#50307171)
> Those language features are not examples of dependent types, though...

Ironically C is the only language in that list with a dependent type. It's not _Generic, of course, but variable-length arrays (VLAs), which neither C++, Rust, nor Zig have.

50 years would be 1976. Perhaps you're confusing it with the myth about women being legally prohibited from opening bank accounts. (1972 was when sex discrimination by businesses was outlawed at the Federal level, though there was never a law that prohibited a women from having a bank account, not directly, and not indirectly since the 1800s. Some banks discriminated against married women, but unless they lived in a one-bank town there were others that were happy to have their business.)
Goroutines and lexical closures create a dilemma for embedded targets. Go was designed around the notion that using goroutines (threading, basically) should be effortless and employed without hesititation. Lexical closures is a critical aspect of that, and by extension GC. Both goroutines and lexical closures require dynamic allocation, at least when combined with some other Go design decisions (e.g. seamless recursion, dynamic method invocation, etc).

Go does a great job of making these impose minimal cost, both technically and cognitively, on typical platforms, from server (including many "embedded" server environments) to desktop to smartphone. That's why it has such a sophisticated yet largely transparent user space threading layer. But it's very difficult and usually impractical for Go to target extremely resource constrained environments without exposing and crippling it's core abstractions. Some people are willing to contort Go to fit that space, but perhaps that's because their vision of what makes Go, Go, differs from the creators' and core maintainers' understanding of Go.

Re:Capital Wants a Monopoly on Thursday October 29, 2026 @01:56PM (#50293231)
You didn't need a centralized regulatory agency to enforce a law. Even federal laws, if they're written so, can be prosecuted by individual states or even individual persons. Some aspects of antitrust law already work this way.

Doing so can prevent regulatory capture and shelter enforcement from the vicissitudes of politics. It also doesn't require maintaining a government workforce. OTOH, you have to be careful what you ask for. Unless a law is very narrowly tailored then ubiquitous enforcement can have it's own problems, e.g. CEQA.

Re:A Man from the Future: Why Johnny Can't Stop Abstracting on Monday October 26, 2026 @10:20PM (#50253994)
Memorizing books is absolutely possible. A great book about it is Moonwalking with Einstein (https://en.wikipedia.org/wiki/Moonwalking_with_Einstein), written by a journalist who was a skeptic but ended becoming a competitive mnemonicist himself. Some people intuitively learn the techniques early in life, and for some of them it becomes a habit.

Same thing applies to mental arithmetic. There are techniques for doing this. IIRC, ironically there's a famous case of someone who claimed to have memorized some hundreds of thousands digits of Pi but was suspected of using mental arithmetic techniques when reciting them.

Still, your point stands. People do embellish these kinds of stories based on stereotypes. It's certainly possible, but any particular anecdote may still be suspect.

Re:What Is the Karakoram Anomaly? on Friday October 23, 2026 @09:20PM (#50217527)
https://en.wikipedia.org/wiki/Boston_Brahmin

EDIT: The radio show was Science Friday, October 15th episode, "Why do politicians talk like that?", https://www.wnycstudios.org/podcasts/science-friday/articles...

GMail has a 25-30% share of the client market.

Is it impractical to never send a message through Google? Probably, depending on the circles you communicate in. But that's not the same thing as saying it's impractical to avoid Google for most of your messages, and certainly not the same as saying you can't avoid GMail for anything.

Re:What Is the Karakoram Anomaly? on Friday October 23, 2026 @01:28PM (#50212505)
There was a discussion about this on NPR recently. According to the guest, the underlying phenomenon (which goes back a long way) is avoiding long-As, an aversion to sounding like snooty Boston Brahmans. It strongly correlates with political and socio-cultural affiliation, and with words that people are self-conscious about or otherwise are deemed to be more likely to signal affiliation. Iran is specifically discussed.
Before the advent of the modern carceral approach that's not unlike what we had. You got flogged 3 times or stood in the stocks for a day. Though at least there was process--the sentence was imposed by a judge, not a cop. The benefit there was you weren't disappeared for days or months on end, completely destroying your life.
The sad thing is that speed in apprehension and prosecution has been shown to be the most important element by far for deterrence. Marginal deterrence effects of harsher sentencing for most crimes is basically nil at this point. The complexity of plea deals and the incentive they create for defense attorneys to drag things out breaks the perceived cause+effect dynamic, at least for typical criminals. The system just becomes this juggernaut where both guilty and innocent people alike feel it's utterly capricious.

At least until the recent tough-on-crime regression almost everybody agreed the system is too harsh. Even conservatives were on board with lighter sentencing. But unsurprisingly that broad public support didn't persist for long because the structural incentives of the system push it toward greater dysfunction. Without structural changes lighter sentencing alone just makes it more profitable for criminals to roll the dice. The complexity of the system evolved with the harsher sentencing, but can't change back as easily as sentencing policies, so we fall back to the old equilibrium that slowly gets worse along every dimension--fairness, cost, deterrence, etc.

There's an argument that the cost of prosecution is one reason for the proliferation of offenses and increase in sentence lengths.

Part of that is the de facto extension of a right to jury trials for misdemeanor offenses in almost every American jurisdiction. If the defendant can force a jury trial for a misdemeanor, which is in fact quite costly for prosecutors, then the response is to raise the stakes with felony charges. Legislatures are aware of this dynamic and oblige prosecutors with more offenses and more punitive maximum penalties.

Countries like the UK and France don't have jury trials for minor offenses. (They're not as common for major offenses, either, but that's a different matter.) Sentences tend to be much shorter and it's a major reason their incarceration rate is so much lower.

I'm not against jury trials. For one thing it'd be better if juries were more local. 100+ years ago in major US cities it was more common for trials to take place within or closer to each neighborhood. Juries were often composed of people from the neighborhood. The consolidation of courts and trials in mega courthouses broke this community link; people from outside a neighborhood are systematically more harsh than they would be if judging their actual neighbors. Not because of favoritism, but because it's easier for them to appreciate the repercussions of an overly punitive system (broken families, destroyed career prospects, etc).

If you want community involvement in even minor crimes, misdemeanor jury trials can still be streamlined. You could do something similar to some European countries where a few lay judges sit alongside the professional judge, or something that used to be more common in the US where a single jury hears multiple cases each day (still a thing for indictments). But such trials would still have to dispense with alot of the procedural rigor to keep things moving along at a rapid clip.

Re:Quad9 (DNS Resolver) to Exit France on Thursday October 22, 2026 @03:55PM (#50200178)
Japanese companies have always been heavy enforcers of IP, at least since the 1980s. For example, IIRC, they're one of the top filers of patents. Sanrio makes more money globally on their characters than Disney does. And Japan pushes for stronger international IP enforcement systems than even the US.

Japan is just quiet about it. Sony is no aberration.

With everybody using LLMs there are no coincidences. Popular LLM platforms are like Oracles that help you identify what other people have been working on. "Find a bug in PHP" might have been useless s few months ago, but once somebody used it to develop a full exploit the LLM will start to regurgitate that information.
Re:Chain of Thought for Humans on Thursday October 22, 2026 @01:52AM (#50191656)
I always hated when interviewers did this. My chain of thought is often backwards, very abstract, or otherwise wildly different from how it seems most others think, and it's very difficult if not impossible for me to articulate my thinking on the spot. In school for writing assignments I would have to spend alot of time reversing or reordering how I arrived at a conclusion before even writing my first sentence. And even just arriving at a conclusion involves taking many dead-ends; the process can be seemingly instantaneous in places, or require laboriously following rabbit holes (often with throwaway code) that I know are dead ends but nonetheless help me to explore context. I need to have the entire problem in my head and able to explore it to at least some extent before even starting to formulate a linear chain of thought, let alone commit something comprehensible to code.

IOW, I can't explain in real-time how I'm working things out. I have to work them out to completion first, quietly, or at least have a good idea about what the full path looks, end-to-end, in detail and only after the fact could I ever hope to explain my thinking. Asking me to explain my thinking while I'm thinking is easily the most stressful and impossible task anyone could ask of me. I'd rather you break my fingers as part of the interview process.

I understand as an interviewer that makes for quite a dilemma. And I suppose if you find this approach reasonable then you may not like working closely with someone like me (though if you're just a manager, then it's a bias to be aware of).

Similarly, practices like pair coding just don't work for me. I'm not not a team player. I like and benefit from design and ad hoc technical discussions, just don't ask me to sit down and write code with someone else, or even with someone looking over my shoulder. All parties involved, including myself, will just end up pulling their hair out. Though I do work best with people who think similar to me. We instinctively know when and how to set our boundaries and expectations.

To interview someone like me it's probably best to focus on having the interviewee identify waypoints (both abstract and concrete) to confirm they have the experience and understanding to navigate difficult problems. Just don't ask them to actually navigate on the spot. If you want to see how they ultimately connect the dots in practice, look at code they've already written. Unlike in most other fields, software developers often have a corpus of work that is easy to share and often already published.

Re:When Do We Become the Person We Ought to Be? on Wednesday October 21, 2026 @11:11PM (#50190711)
Origen was anathematized because some people believed he taught universal salvation, i.e. everybody, regardless of belief, will ultimately be reunited with god. Whether he taught that is debatable, but certainly much of his exegesis was quite abstract, which tracks with this argument that Origen likely didn't castrate himself: https://medievalhistorygeek.wordpress.com/2014/02/09/did-ori... Likewise, he was a polarizing figure during a formative time in the development of Christianity, so it's quite believable his opponents would spread gossip about him. In the first few centuries there were some virulently anti-sex (and anti-women) Christian cults that preached that any sex, including marital sex, was dirty and demanded things like lay continence or lauded castration.[1] Despite clerical continence being normative, mainstream Christianity forcefully rejected the notion that there was anything inherently wrong with (marital) sex, so to claim Origen castrated himself would be to insinuate his beliefs aligned with radical, non-orthodox, sexually deviant (in a sense) groups.

EDIT: [1] I originally used celibacy. But celibacy and continence are distinct. Celibacy implies continence, because only only married couples are permitted to have sex, but even married couples can be continent. Therein lies the confusion about the origins of modern-day Roman Catholic clerical celibacy and its relation to early clerical practices, including practices of the apostles.

Unfortunately, in time both will become definitive historical reference sources, if they haven't already.

Before the collapse of Google Books, when for a brief, glorious moment Google came closest to achieving the dream of making accessible all the world's knowledge, I could much more easily trace back historical "facts" to a single popular book in whatever field, but then keep going back through older material and often find contradictory accounts and narratives.

History is messy. There's of course what actually happened, but almost immediately narratives start to branch. Then at some point, years, decades, or maybe centuries later, narratives converge back to a single "truth", typically based upon a single, popular author's gloss. There can be some subsequent divergence and reconvergence, but that first convergence really seems to be nearly as defining if not more defining than the actual event(s).

It's sad that papers are citing to Wikipedia. Citation 101 is to cite to primary sources if possible, secondary otherwise, at least for substantive claims. Wikipedia isn't a secondary source, or as you point out any kind of legitimate source. Even if Wikipedia were perfectly reliable and accurate, it'd at best be a tertiary source, but it'd still be better to shorten the chain (unlike a tertiary source like a dictionary, which arguably is in a sense a kind of primary or secondary source). And citing to Wikipedia only proves how lazy an author is given Wikipedia itself usually cites to primary and secondary sources, so they couldn't even be bothered to copy+paste the reference, let alone actually read and analyze it first. (Many times I've come across citations that don't support the Wikipedia claim, and sometimes even contradict it, though that's hardly unique to Wikipedia. At least with Wikipedia I can try to do something about it. But even a bad citation is valuable precisely because it can be followed and verified in context.)
Re:SimCity, but with Permits on Tuesday October 20, 2026 @04:43PM (#50172406)
This is called as-of-right development or by-right development, which is how things (nominally) work in several states. That is, as long as a project adheres to the zoning and other regulations, approval is as-of-right or a so-called ministerial process.

It's not necessarily a black or white approach. In theory as-of-right is supposed to be the rule everywhere as Due Process guarantees mean government can't act capriciously. And there's actually pre-existing SCOTUS precedent regarding how zoning plans are supposed to be applied, and how community input processes aren't supposed to allow mobs to subvert the rule of law with a de facto but informal veto power. In practice, non-as-of-right municipalities and states basically have zoning rules and approval processes that are fuzzy and ambiguous, effectively granting regulators significant interpretive leeway and discretion.

Federal and often state courts are extremely reticent to jump into the fray and defend the rule of law. In fact, there's SCOTUS procedural jurisprudence designed to make it difficult to "make a federal case" out of zoning disputes. NIMBY battles are just too politically fraught and courts are afraid of falling into the bottomless tar pits of adjudicating public grievance, which is what politicians are supposed to be for.

California is especially bad for multiple reasons. First is CEQA, which allows literally anyone in the state to erect legal hurdles to any project (modulo some very recent carve outs). Second is home-rule principles enshrined in the state constitution, which makes it difficult for Sacramento to force municipalities to behave a certain way or even abide many mandatory state regulations--the state often has to rely on indirect means, such as contingent funding, to cajole cities. Third is California Supreme Court procedural principles that demand state courts entertain law suits in a way that allows interlopers to drag out court cases, e.g. CEQA cases, for long periods of time.

NYT breathlessly reported[1] that Ukraine lost $1.2 billion to corrupt or mismanaged defense procurement in 2024. But the article never once stated the total defense budget. As best I can tell, Ukraine's defense budget in 2024 was ~$65 billion. So this supposedly pervasive corruption cost about 2% of it's budget. That's a rounding error in pervasively corrupt countries, and I'd be surprised if corruption in Russia was less than 5x or maybe even 10x than in Ukraine.

I think the chatter about corruption in Ukraine is partly a function of the fact that it's democratizing. People don't really talk much about corruption in corrupt countries, not as much as they do in less corrupt countries. Everybody knows it's there; it's a given. But without transparency and a steady flow of concrete data and admitted examples, there's not much to talk about. You just assume such-and-such was a corrupt deal. Only when a country is capable of combating corruption do you see robust, public debates about it, as you see in Ukraine.

[1] https://www.nytimes.com/2026/09/06/world/europe/ukraine-war-...

HTML5 could have taken the extra step of defining a canonical XML or XML-compatible DOM encoding, or at least encouraged it. But the anti-XML sentiment was explicit and spiteful. Still, popular XSLT processors are built to consume and even produce HTML5, I'm just not sure how thorough those capabilities are or whether they're based on any formal or informal standards. (Maybe the W3C has/had something like that, as part of it's attempts to rollup HTML5 snapshots into versioned standards?)

I lost any enthusiasm for XML after my experience with WDDX and XML-RPC, but as a foundation for HTML it was the best thing going. And maybe still is, given the absence of cross-toolchain contenders? Ditto for XSLT, at least if disregarding the choice to make the syntax homoiconic. In fact I circled back to XSLT long after it was clear it was a dead end. A good tool is a good tool, and the fact it remains so despite the wanton neglect only proves it.

> Would you wanna have random voices or other sounds played over a phone call, interrupting conversation?

For the younger readers: this used to be a not uncommon thing in the POTS era, "lines crossed". And it was indeed annoying, especially if it persisted after hanging up and calling again.

Re:The technical actions needed to ensure the continuity of UTC on Thursday October 15, 2026 @01:36PM (#50107187)
> Sure, you could also run a relativistic simulation of the solar system

Barycentric Coordinate Time: https://en.wikipedia.org/wiki/Barycentric_Coordinate_Time

The context of the whole essay was more about the way we have a tendency to confuse models with reality, in particular the way we build human-like machines based on contemporary theories about how humans work, then later fall into the assumption the theories were accurate simply because the machines are indeed useful. It's a pernicious kind of self-reinforcing confirmation bias. And it applies at least as much to AI, and LLMs specifically, as any earlier example. Whether or not one believes LLMs strongly parallel certain human mental processes, or even if in fact they do, surely we must admit there's much more undiscovered complexity and phenomena, and the pursuit of discovering those phenomena is going to be hampered to some extent by our investment in understanding them in terms of these otherwise successful tools we've built.

Older »