News for hackers. Stuff that matters.

xorcist

Many of these smaller stores (and probably some of the larger ones too) rent or lease refrigeration equipment from one of a handful big providers. These are large and expensive systems, and there is costly paperwork involved together with logistics suppliers to show that the cold chain is satisfactory.

These refrigeration providers work with local contractors and HVAC companies to set things up. Their installation techs do what they think is required to remotely operate these systems. If you bring up the question keeping these systems offline or at least on airgapped networks you will most likely get a shrug as reply.

This is not a technology problem. This is problem of responsibility. One can hope things will improve when litigation starts happening, but it doesn't look good considering these people had literally months of notice since the well-publicized attacks on the American fridges, then the French fridges, and now these.

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @07:52PM (#50321419)
It's one of two things: Either they have found some regression with enterprise customers, or they are not happy with the fix.

RHEL runs with MP-TCP disabled by default, they initially listed it as Important only to later raise it to Critical.

Re:Anthropic Cracking Down on Video Game Rewrites on Friday October 30, 2026 @11:22AM (#50305200)
It's netiher, at least not in a way relevant to the question here.

It's a privately owned service, and it's theirs to decide what they want to do with it. Continuing on your parable, if you paid someone to compile your software, of course they could say one day that they decided to not not compile weapons guidance software or whatever. It happens all the time. The Debian compile cluster will "police" that you can only compile free software, for example.

If you hire me to write software, I can politely decline without giving a reason. The same should Anthropic, should you hire their service to write your software.

If you want control over software, you or someone you trust must invest in running it. We cannot continue to outsource control to other organizations and then act surprised when they exercise said control.

Not saying maintenance isn't a problem, it probably is. It's a problem everywhere in Europe. Have you seen train service in England, Germany or Sweden? Absolutely terrible, compared to just two decades ago.

But under-maintenance causes trains to stand still and be late. It does not cause them to crash.

Crashes are caused by running at speeds higher than the (under-maintained) rail can support, or (against all rules and every regulation) no cap on speed when the signalling system is down.

The latter can not be solved with more money and resources. It is a culture problem. Rules can not routinely be disregarded for arbitrary reasons, especially not when they are completely in line with common sense.

A CEO can absolutely not spend the company's money as it was his own. That would be a breach of trust or embezzlement and outright criminal. You can bound by budget and fidicuary duty, and answer to the owners or their board of directors. People regularly get jail time for this type of crime.
Re:Python's experimental JIT to be removed on Tuesday October 27, 2026 @01:32PM (#50262694)
> The type of dynamic language gymnastics done with Python is huge

Have you seen Ruby?

Re:Who killed the EV cert? A browser whodunit for Halloween on Monday October 26, 2026 @07:23PM (#50252589)
Easier than ever. Should I really log in with my Microsoft credentials to auth.gfx.ms?
Re:Show HN: Steal My Bitcoin on Sunday October 25, 2026 @11:58AM (#50232968)
The first comment in that page literally says "the preferred method is now fastcgi" and links to PHP-FPM. This comment is 13 years old, and I personally haven't seen mod_php in the wild for a long time. PHP-FPM is also the default configuration in both Red Hat and Debian and in most operating systems derived from them.
Re:Show HN: Steal My Bitcoin on Saturday October 24, 2026 @07:53PM (#50226723)
Lots of people said the embargo should be broken early because "the exploit is already in the wild". That does not normally mean an infosec researcher has a PoC on their private laptop, that means it has leaked, one way or another.

Had it, though? If it was in the wild at day -1, surely some script kiddie will be happy to run that exploit at day +4, because if they didn't someone else would.

There were many people saying things with great confidence and this is one interesting way to gauge what was behind those words.

I have lived in several European countries but not in the US. Maybe it is different there. The only clue in the post was HSBC, which is a British bank. This is why discussing this is so hard.

The European Union has tried to create a pan-European banking market for a long time without success. Banks are still a national business, even if banks themselves operate internationally you always do business with their local prescence. In theory you could keep your accounts in another country, in practice that is a massive headache.

"Let you hold my money"? In what society is that true? Banks run our financial infrastructure, and you can't just opt out of them. If you want to have a salary, do your taxes, or raise children you will need a bank. They have an immense amount of power and operate in a heavily regulated area so there's guaranteed to be very little competition.

Voting with your wallet does not work here. There is only a handful of banks, and in many (most?) countries they all force proprietary software and/or unreasonable contracts on their customers, switching between them does not help.

I don't know where you live or with whom you bank, but there were plenty of hardware tokens for banking for almost two decades until phone apps took over. They are not likely to return. Managing many hardware tokens is a big undertaking and people regularly forget them or destroy them. Phones are so much easier and people generally don't want to carry extra devices. They don't even want to carry comparably tiny credit cards given the choice.
Re:Today, we hacked what we'd set out to hack: the iPhone on Friday October 23, 2026 @01:56PM (#50212908)
Is that before or after it evolves to read mail?
> I take full responsibility for my actions

That's not what taking responsibility means.

> My contact had told me there was no embargo,

So, someone else broke the embargo and you decided to take the fall?

Re:PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out on Wednesday October 21, 2026 @02:48PM (#50185686)
There is nothing official about these images.

"Let's use this packaging some rando on the Internet built" is a strategy that is exactly as good as it seems, but that's the Docker ecosystem for you.

Packagers who actually understand the software put in good work to package that software in small and well maintained packages. Use them instead!

Re:What shall I teach my son? on Tuesday October 20, 2026 @06:28PM (#50173572)
Anyone and everyone can raise a child, and have done so more or less successfully over the ages. My first tip would be not to worry too much, if you are inclined doing so.

The next would be that it's the long game that matters. You are likely to keep them around for pretty much two decades, don't burn all the energy you have the first few years. I've seen too many parents give their five year old all the attention they want but neglect a teenager, which is when the real challenges are.

The final is to be a good role model. The old adage that kids do what you do, not what you say, may sound easy but that's pretty much all there is to it. Show curiosity in everyday life and they will, too. Be kind, and they .. yeah, no guarantees there, but at least you did your thing.

People say that, but it doesn't hold up. We spend more money than ever before on software development. Just not on quality. There is something else going on here.
Not that tired old parable again. It doesn't hold.

If someone complains they take pride in understanding and designing deterministic processes, you can't reply that this is just like when robots took over manual labor.

No, because it is not manual labor, and robots hasn't taken over. Robots are computers. Robots are deterministic.

A better comparison would be an artisan architect, a blueprint designer being replaced by a special paint splatter, which when thrown against a piece of paper looks almost exactly like a blueprint of an almost completely liveable house. Great! What's not to like? It will allow anyone to design a house.

> buggy, as they were 4-5 years ago

I wish!

The quality of commercial software has really gone downhill the past decade. Some of it may be AI, but it has likely more to do with the fact that fewer and fewer want to pay for QA.

On the endless framework treadmill, money is better spent going forward and changing things.

Re:Gold is now the top U.S. export on Sunday October 18, 2026 @06:22AM (#50139702)
> most of the non-Soviet aligned world, would agree to base their currency's value on the USD

That seems like wild thing to agree to. Where can I read more about this?

Ads in an LLM, such as nudging users to pick a certain solution or brand, could easily be orders of magnitude more effective than traditional banner ads. Certainly such numbers are possible if you design the product to fit. We have hardly even seen the beginning of that yet.
> OpenAI and Anthropic will lose their one remaining plausible path to profitability

You forgot about Ads. The one true endgame for every tech company.

Re:Unikernels were hard. key word: were on Sunday October 11, 2026 @10:01AM (#50043398)
Agreed! There were many promising distributed operating systems, most got stuck at the research phase however. But the cloud pretty much killed them all.

Not that many people keep large distributed workloads anymore, and SLURM-like schedulers on top of regular operating systems were deemed good enough for supercomputers.

Re:Unikernels were hard. key word: were on Sunday October 11, 2026 @06:16AM (#50041560)
And before you know it you've built a very complex, and not very secure, operating system.
Re:`123456' password used in Danish CPR data breach on Sunday October 11, 2026 @06:04AM (#50041512)
What is terribly wrong with it? Society needs more transparency, not more closedness. Closedness breeds mistrust. Corruption grows in darkness.

Most companies have open internal directory services, you can see who works there and contact them easily. Why should that not be the case for entire societies?

David Brin was on to something with "The Transparent Society".

It's not as hard as you make it out to be.

Advertisers are fine with paying for ads even of some users turn the volume down when they come on. They are absolutely not fine with paying for ads streamed out into nothingness.

One is a problem for the industry. The other is not.

Re:Programming Isn't Special on Friday October 09, 2026 @02:42PM (#50024965)
Not to rain on your fine snippet but you can use negative offsets to index from the end of the string:

  P="$PWD"
  [ ${#P} -gt $pwdmaxlen ] && P="$trunc_symbol${P: -$pwdmaxlen}"
This is perhaps the clearest example of whataboutism I have ever seen. Sure, the porn industry is nasty, but have you seen the chocolate industry? Let's talk about that instead!
> this was Broadcom's mistake

Broadcom likely disagrees, lightly snickering all the way to the bank.

> broke rsync so completely that it could no longer handle symbolic links

That sounds bad. Where can we find more information about this?

Older ยป