News for hackers. Stuff that matters.

ygouzerh

If you succeed to read it (the admin writing style of NIST is quite dense), it's quite good.

It's a bit procedural and admin focus... but if you execute all of it, at least it's easier to defend yourself during an hack towards your clients or third parties.

I would have prefer something a bit more technical, but it's a good entrypoint, at least to help hire or consult a security professional.

Re:AI Isn't Replacing SREs. It's Deskilling Them on Monday November 02, 2026 @05:46AM (#50335204)
+1. The issue is not that us SRE doesn't want to upskill, on the contrary. It's mostly that we doesn't have time, between the backlog always full during the day, and the incident at night. We are considered cost center, and companies try to reduce it a maximum by over-optimizing headcount/tasks
True. In capitalism, the rule is that more capital you have, more capital you will get next year.

On one side it's interesting, because it means that if you buy a machine, next years you can buy more, and more and more things get automated.

The bad side, is that we doesn't have a way for labor to reap the benefits of it as well, except from lower purchasing costs... which is counter-balanced by the need of the system to push for more and more consumption every year, to keep it working. (E.g price of electronics/performance decreasing, but need every few years to buy new phones with more performance to keep up with the more and more hungry apps)

I wished, unfortunately the companies are going to complain that doing so will stop them to have enough money to innovate compared to other countries, or that they are too small to compete. (At least it's the current speech of the lobbies in EU for example).
Re:Trigger.dev customer environment variables exposed on Monday November 02, 2026 @04:35AM (#50334749)
Never put it resolved
I thought it was the same for here (Hong Kong), but after talking with recruiters and HRs: most of them are just people using bots, and they never read the job description. Very few of these big numbers are actually real candidates that have a chance of getting the role.
Re:eMudhra to Exit Global SSL/TLS Certificate Business; on Thursday October 22, 2026 @09:58AM (#50195413)
They will probably change their name soon
Re:Timestral: Mistral release time-series foundation models on Wednesday October 21, 2026 @08:35AM (#50179866)
As an SRE, I am seeing the following use case:

We keep struggling with disk capacity on servers being filled, which will then need cleaning. Currently, we got an alert when it's reaching 80%. It's reactive, we need to work on an unplanned task, and it disrupt our sprint and delivery commitments.

Instead, we could pipe the disk capacity data points to Timestral, and we could approximate the date when we will need to work on it, way earlier, so that we can plan our work accordingly.

I guess it might be integrated later directly in tools like Datadog, or Cloudflare straight away, rather than being used by corporates as it is.

Re:Artificial intelligence is capitalism's final destination on Friday October 16, 2026 @06:33PM (#50125666)
After working with AI at work for quite some time... I can envision it. But mostly based on an Idiocracy society than a a Terminator or Matrix like scenario. When LLM is so good, why bother to learn more, when we know we cannot be as good?

And if LLM give us already what we need... why ask her for more complicated things? And so why would the AI improve or be improved?

Re:Artificial intelligence is capitalism's final destination on Friday October 16, 2026 @06:25PM (#50125581)
- 1% of the world population owns 95% of the total world wealth, as per Oxfam - World Food Program from the UN calculated a need to 93 billion per year to solve food hunger in 5 years - A single SpaceX IPO already raised 85$ billion of cash

I would say... a lot.

After indeed, maybe without capitalism we would have not got this amount of wealth already, and nothing stops us to build socialism inside a capitalistic system, by using more cooperative, governement venture capitals, sovereign funds.

Re:Artificial intelligence is capitalism's final destination on Friday October 16, 2026 @06:16PM (#50125485)
The advantage of capitalism is that more capital generate more capital. More machines you have to produce things... which will help you to produce even more machines...

The machines are operated by the labor forces, the real humans. However, the exponential compounding benefits of theses feedbacks loop us are mostly redirected to the ones owning the machines, the owner of the means of production.

Of course, the labor forces operating the machines/means of production benefits it, because they have either cheaper, or more goods. However they doesn't get this compounding effect.

AI is the god of the machines, the ultimate means of production. The amount of labor forces needed to operate it is very few. When the owner of capital invest a specific amount of money for their company, they get X amount of tokens, enabling them to work on Y amount of tasks. It's reward with low-risk.

The drift between capital owners and labor forces will become wider and wider. Until the labor forces doesn't have any more capacity of buying the goods produced. And then the system will implode.

If it was not for a state actor just trying to get information, but for personal gain: he could sell the information to some unethical hedge fund for some good money, ahead of the IPO.
I found an example online, I cannot find the github again, but it was interesting: an instant dynamic generation of React component, you type what you want to build using natural language, and it directly add one to the page.

If I remember well, in the background, it does the multi-choice question: "What is the component requested ? --> Calendar, Slider, ..."

Re:Smart people don't think others are stupid on Wednesday October 14, 2026 @06:00PM (#50096023)
I actually was thinking on the following example, from my personal life: I have two masters, however I was doing summer jobs in my local town, as handyman, and was humbled very quickly.

The others colleagues all stopped school very early, got the same irrational political views that the ones you mentioned, etc.

However, they were beating us totally, students coming from fancy universities, for everything else related to machinery, gardening, repair, etc... Even on new problems, they were able to quickly make these logical connections, that we would miss.

Re:Smart people don't think others are stupid on Wednesday October 14, 2026 @09:00AM (#50087074)
I feel like the ability of making connections is relative to the domain, and more learned by exposure rather than innate.

For example, someone doing system engineering will be able to understand how the networking of a system works, while someone being a movie critics will find the hidden meanings and connections in the movies they watch. Similar for a musician.

Probably indeed the semantic is important. Someone can say something stupid in a specific occasion or all the time in a specific domain, but almost every time there are areas of life where they will be considered "smart".

Re:Claude Haiku 5.5 on Wednesday October 07, 2026 @10:29PM (#50001293)
Cam it be replaced by a Jev-like model? That might be better for latency sensitive tasks
I feel as well that it's the strongest reason. Even without AI, time pressure statistically already increase the error rate
Re:OpenAI is well positioned to fast-follow Jev on Wednesday September 23, 2026 @02:31AM (#49812436)
I think here it's mostly that for normal business cases, we doesn't need to build one.

As a DevOps Engineer, I never once saw before the advantage of using a classifier. Now I see multiple parts of the stack where a better level of expressiveness will be useful (PR validations, Blue/Green validation, notification router for alerts, quick smoke tests, etc).

Nobody will give us the time and budget to build a custom classifier for these use cases, but a simple API call yes.

Re:Claude Opus 5.5 on Tuesday September 22, 2026 @12:45PM (#49804202)
What are you using Haiku for?
Re:Claude Opus 5.5 on Tuesday September 22, 2026 @12:45PM (#49804186)
Can it be that now they are getting optimized against benchmarks that are valuing logics, rather than human appreciation? (I am not an expert at all, just an idea)
Nice, thanks a lot, I didn't knew about this feature!
Re:Backups Aren't Simple on Thursday September 17, 2026 @03:13AM (#49737450)
I think this is more a quote for engineers
Re:HarnessTax: How Much Does the Harness Matter for Coding Agents? on Thursday September 17, 2026 @03:01AM (#49737342)
One thing I am missing to be able to move out of Claude Code, is the auto mode (and the soft_deny and hard_deny settings that can be tuned), with it's classifier checking the output.

It's the killer feature from me personally, often when wanting to troubleshoot for example things like Kubernetes workloads. LLMs are now really good at it, but we doesn't want them to like delete a pod.

Other harnesses like Codex have often on static rules, like the allow/deny of claude code, that can filter out based on regex. It's quite good already, but sometimes the model can find a way to write something that wasn't anticipated, or in a convoluted way.

After, I guess it's something that can be added in an open-source harness like Pi, and add like this new Jev model or something else equivalent

Re:CSS-Tricks in Limbo on Wednesday September 16, 2026 @06:05AM (#49724232)
Often politics, lack of vision, people being shuffled around, etc (e.g the stakeholder that decided of the acquisition just got moved to an another department, this kind of things)
Re:Jev: New frontier model 40-400x cheaper and 20-200x faster on Wednesday September 16, 2026 @02:42AM (#49722881)
That's a great point! It quite looks like the System 1 model of Physical Intelligence
Re:OpenAI agents carried out an undisclosed attack on RubyGems on Monday September 14, 2026 @02:56AM (#49692913)
Maybe a crash is what we need to reset the balance. We are spending a lot of money building shovels, but not enough to invest on the company that will use what will be mined.

If the money could flow back to the real economy instead of the AI economy, it might be healthier for the whole system.

Re:OpenAI agents carried out an undisclosed attack on RubyGems on Monday September 14, 2026 @02:40AM (#49692812)
It's crazy indeed. When working in company as DevSecOps, if we try to attempt pentest on prod without warning anyone, we will just get fired on the spot. AI Labs seems to have a free pass...
Re:The Qantas A380 engine disintegration in 2010 on Wednesday September 02, 2026 @11:17PM (#49545567)
One thing that might be taken into account is the delay between ordering a plane, and the delivery (can take up to 10 years), so 1.5 years and 139$ million is worth investing into, to keep revenue flowing earlier.
Re:WebFPGA on Wednesday September 02, 2026 @02:12AM (#49532377)
Would a direct pitch to some HFT shops works better than kickstarter, to raise money for FPGA related work? They are ones of the main users in term of production usage. This project might be useful for them, for training / PoC / quick prototyping.
Re:A CVE Dispute on Tuesday September 01, 2026 @06:37AM (#49520158)
Quite interesting the response from MITRE: `It is not considered a security vulnerability because of how it requires a local attacker with privileges present to make it so`.

I didn't knew about that rationale. I thought Defense-in-Depth was all about that, preventing security incidents even when an attacker start to get some elevated privileges on the system?

If not, that's quite a practical reference for future CyberSec meetings.

Older »