HNHacker News
TopNewBestAskShowJobs

Fabricio20

1,373 karma · joined November 30, 2018

submissionscomments
Fabricio20··on Need for Speed Underground 2 online in the browser
I'd argue so! The music producers made their money, the original company made their money. The game isn't sold or updated anymore. Music was part of the game, it stays part of the game. Noone is profiting from it (with this clause, ie: non-commercial is the main thing for community/public domain takeover). For the music and similar assets the clause is usually already clear even nowadys, as long as the music is being displayed alongside the game, it's fine (that's how 99% of the music copyright works nowadays with modern games re streaming, unless the music company is backwards because they are greedy).

We need to kill indefinite (or even long) copyright and the music industry has been one of the worst offenders.

Fabricio20··on Need for Speed Underground 2 online in the browser
I recall initially playing it pirated back in the day, you'd run an emulator locally for the server component and play offline! We had it back then, probably way easier nowadays (and likely more stable).
Fabricio20··on Need for Speed Underground 2 online in the browser
PLEASE keep us updated!!
Fabricio20··on Proton's CEO Cancels AI 'Re-Interviews'
As a customer of a company whose motto was privacy and security i'm extremely concern about this push at the expense of security. In what world is doing a security audit "loser thinking"?? Its not honesty, it's a techbro in ai psychosis running a company completely against it's core values.. Start of enshittification as they call it?
Fabricio20··on AI promised less work. I've never worked more
> not to become part of a family where everyone belongs no matter what

I think this isn't helped by the fact that HR in alot of companies in the past decade or so has been going with this narrative. We are all a family together in this, stay late when needed, work extra/after-hours, etc.. Lots of places even have the expectation in this regard.

Of course this all goes away instantly when you get cold-emailed a layoff for example. I think its a systemic problem that originated some decade ago in an attempt to exploit people's judgment by creating self-doubt (ie: work more/harder under the premise that if you dont you are letting your "family" down), got perpetuated around alot, all job postings are worded like that nowadays too ("join our family") and it gives the newcomers to the job market the wrong expectation.

The worst offenders are all under IT companies as far as I can see, but because it's been going for so long it wouldn't surprise me if this is industry wide at this point for non-manual-labor job offers.

Fabricio20··on Show HN: Steal My Bitcoin
Yes! Even my own stuff sometimes goes a few hours to a day without a single request, the internet is either very slow and dead or super active, no in-between, I think it heavily depends on who indexed you and how big your site looks like or maybe identified stack (for vuln crawlers, i'd wager if they see a wordpress marker they'd put you on some list to get retried by the swarm) or something.

My datamining project for a game for example, that noone besides me and 2 friends use, gets thousands of requests per second, because all the AI bots found it and try to index every single page (thousands of ssr pages) and they repeat the requests when my cache-control headers expire (ie: when i consider the old page stale), so it's an endless stream (I dont mind the challenge of serving all of these at high performance xD).

My main website, in the same domain (not a subdomain), barely gets any requests, it only has the one main index page with a single link to the datamining subdomain, that's about it.

Fabricio20··on Docker is weird
Thanks for developing such a valuable tool!
Fabricio20··on Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
The fact that there are more than the "4" one, and all the low numbers are below 384 (384 being the bits for private key) makes me think whoever was creating these thought "Oh a random number between 1-384" let me choose... 4! (156, 230, 115, 56, 66, 237, 155)...

https://xkcd.com/221/

Fabricio20··on Upcoming critical PHP security release (CVE-2026-109618 / -109619)
It depends? I recall being on incident response and checking for that specifically (I worked in a big java shop at the time and was responsible for stuff like this). It was alot of screaming online, but things like Spring Framework used to pull Log4J v1 (ie: not affected) and spring-boot (the modern, way more used one) used Logback (also not affected). You'd get it from like a Kafka/Elastic dependency or similar, but only if you didn't have an SLF4J handler.. like spring would ship Logback for example. Which makes me thing, in general other java shops were mostly not affected as well, given spring is basically the go-to on the java world.

Extremely legacy software wasn't affected either (log4j v1 or apache commons-logging!). Lots of automated scanners flagging the idle jar as well (when the app used Logback for example as the SLF4J implementer, but the scanner saw a transitive for the log4j jar and would scream at you - that's when I stopped caring about github vuln scans btw, it was a shitshow).

Like dont get me wrong, it was a bad vuln, but to me it seems like it was more hype machine and internet screaming than actual vulnerable applications. I do recall Minecraft was vulnerable though, that one was indeed a big target given publicly exposed servers and such.

Fabricio20··on Security advisory: Critical remote code execution vulnerabilities, update now
Log4Shell was on a library called Log4J, used by many (but also not that many: Logback is equally as used and wasn't affected by the same vuln). This is straight up php the language.
Fabricio20··on The United Kingdom generates less electricity per person than in the 1970s
>Reasonable point, but I feel my case still stands: the population able to make these changes could do so, enabling existing infra (and housing stock) to "go further" before requiring expensive and disruptive overhaul.

I'm sorry but as an outsider to me this straight up just sounds like kicking the can down the road! Let's get it fixed, build more solar, get more power in the grid, deregulate personal solar so its an attractive incentive to get more people generating power, etc.. Rather than "you need to use less" mentality, especially while people literally die to the heatwaves the UK has been getting recently..

It's been pretty clear that globally the grid operators are all very much lazy and would rather increase prices and reap benefits short term than adding more capacity to the grid, even where i live (in Brazil) its very much clear that grid operators too would rather raise your bill and collude to add more taxes if you want to generate your own solar than to get more supply in the grid and make the bills cheaper (we have a minimum bill you have to pay even if you have full self-generated solar AND a thing called a "solar tax" because of course, the sun is the govt's property, gotta pay a tax for using it..).

Fabricio20··on Show HN: SolidCraft – Open-Source Parametric CAD in Rust (With MCP Support)
Interesting, I thought this was part of the *Craft family but that one is called CadCraft. I do prefer the take on using Fusion as the UI base.
Fabricio20··on Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?
I vouch for gitea too! I have it on my home cluster with about 50 repos and some actions, 150MB memory for gitea and 50MB memory for the actions/runner pod sitting idle. Plus postgres (another < 200mb). Do keep in mind gitea does ALOT of read queries on page load so keep db and gitea close, but it's tiny!!
Fabricio20··on Orkut.com
Even at the time I thought it was crazy that google bought the best social media platform (being a brazilian) and tried to promote Google+ to everyone when google+ didn't have anywhere close to the feature set that orkut had.

Still makes me mad that some of the games in Orkut are just lost media now too. Still looking for Cafe Mania... maybe one day someone will find a copy of the flash files.. Ugh.

Fabricio20··on So long Google, and thanks for all the nudes
You know, personal anecdotes and all that, but a company I used to work with was applying for their b2b app as well and we got a denied with a screenshot of a completely unrelated app as well, and that was at least 5 years ago. We ended up just replying "That's not our app" and I think it got stuck in limbo after that as I don't recall hearing anything about it afterwards and then I left the company.
Fabricio20··on WaveDigger: Dig into wireless signals to discover their physical locations
I feel like that's not a true cold GPS signal! Though I'm not arguing the parents scenario is realistic either. I got a GPS module for a drone I was building and it took 20 minutes to get a proper GPS lock from cold!!! I was sitting there watching betaflight doing it's thing wondering why the heck it takes so long when there's so many satellites in view!
Fabricio20··on Kev: Tiny Jev-like family of decision models built on top of Qwen3.5
The part about "tool-calling on other models didn't solve already" is what gets you, sure I could tool call deepseek, glm or any other model, but the latency is huge and you get no confidence score. I gave JEV a shot via OpenRouter and it has a reply in less than 400ms, it's fast enough and cheap enough that you can hook it up to a game loop for example (so highly state dependant) and it can do decisions in real time.
Fabricio20··on google.com/goto: Google's anti-scraping update
Blocking URL shorteners and google-ad links yes! Personally for me it's also the fact that this is effectively an unresolvable URL shortener, store that link somewhere and it will most likely be dead. Can't copy link anymore and paste it on a notepad or chat app to check it out later as there isn't a guarantee it will load at all (ie: the problem with url shorteners).
Fabricio20··on AnkiDroid: Google Play no longer allowing Open Collective donation link
On the user side my experience with F-Droid is auto updates dont work and I constantly get a "repository not reachable" f-droid error every now and then popping up on my phone (that little small middle-of-screen toast) when im doing something else completely unrelated. Might be a regional thing.
Fabricio20··on Auto mode is now the default in Claude Code for Pro, Max, and Team plans
I've used auto mode a few times and it's honestly pretty good, but I think this isn't just about auto mode, CC in particular has many other safeguards I've noticed even when not under auto mode (one that surprised me recently is a "risky command detected" that under bypass permissions stopped a tool call - the script had a RM /$var - had the var been empty somehow, it could've deleted the os).

I'm not surprised they are confident in promoting it to the default, it alongside the many other safety features in the tooling are honestly probably better than my exhausted review of every action.

Auto mode denies are also interesting, sometimes Claude wants to go off script to double check something (ie: waste time checking something slightly related that I know is not necessary/truth holds) and auto mode plainly stops it since it's off scope, nice bonus.

Fabricio20··on Humans missed 1 in 3 threats approving AI agent commands across 40k game runs
This was so bad for me I actually added a tool hook that `time`s the tool calls and adds it as [Execution took: Xm, Ys] at the end of every tool call, it helps a little (claude in particular after two executions tends to switch strategy entirely) but in general the agents still insist on cut/tailing the output rather than just dumping it to a file for example!

Now that I think about it, maybe I can have a tool hook that detects those cut/tail exessive piping and just strips them and dumps the full output to a temp file..

Fabricio20··on Humans missed 1 in 3 threats approving AI agent commands across 40k game runs
If only the piping wasn't execessively cutting too.. `cat | head -10` -> `cat | head -20` -> `cat | head -40` yeah.. I think at some point we need to start sanitizing our tool outputs so that this just isn't necessary at all, long term fixing the tools (ie: gradle outputs like 500 lines of logs for a ... build succeeded), maybe short term a small model in front would be better than all this cut loop fail. One can wish.
Fabricio20··on Devtools must be open source
> Then you’re maintaining a stack of patches on top of the upstream until the end of time because the maintainers of the projects don’t want AI slop contributions, but now you depend on these changes for your own use so now you’ve created more work for yourself keeping your own fork up to date.

I thought about this but I currently maintain a fork of about ~6 things I use on my own, none of which I have any interest of contributing upstream because it'd be out-of-scope and put a burden on the maintainers that is unrelated to their primary goal. It has been an extremely easy experience with claude to keep those tools up to date on top of upstream.

StGit/Stacked Git is a proven tool for this and has worked wonders, I can literally just ask claude to fetch upstream and reapply stg patches on top and fix each patch if they break in order. I also keep extensive description of the INTENT on the stg patches so claude can easily figure out if something is no longer relevant (ie: somewhat implement by upstream) or where to land the code/hooks. I've added features, reworked how algorithms work (pathfinding related!) and small nits I hit on daily usage.

Even on a very churny upstream (one of the projects the single dev likes to refactor alot) it's still extremely chill and doesn't take more than an hour to get it updated when everything breaks. I can't say i care enough to setup a daily cron like a sibling suggested, but it would likely work just based off of this stg experience.

It's also nice, because some of those were actual bug fixes too which i have contributed back upstream! Maintaining your personalized fork is truly reasonable nowadays.

Fabricio20··on Show HN: CheapSecurity – Lightweight, Self-Hosted CCTV for Linux SBCs
I've had some great success with Reolink. Decent video quality and the software is made with RTSP/RTMP support in mind, including a proper web portal on the camera so you don't even need the phone app for setup.

Not too sure if you are looking for non Chinese manufactured though, down here anything else is just way too expensive and lower quality anyway!

Fabricio20··on Show HN: CheapSecurity – Lightweight, Self-Hosted CCTV for Linux SBCs
It's actually pretty darn easy nowadays and i'm so glad its the case! Frigate is amazing and the detection package is of your choosing (hardware dependant) and everything is customizable too.
Fabricio20··on Claude Code built-in task tools disabled server-side
Just got hit with this on all my sessions on CC, neither the old TodoList or the new Task tools are available to any session. Limiting it from the server side is truly amazing, I feel like it's related to Opus 5 possibly releasing today, but wow.
Fabricio20··on Show HN: Watch bots interact with an SSH honeypot in real time
Opened the website to be greeted with only spam of huge walls of random text, seems people are abusing the fun out of it! Would love to actually have seen some interesting bot patterns from the authors comments.
Fabricio20··on How to stop Claude from saying load-bearing
Shebang! Notice the first line of the script: #!/usr/bin/env python3 marks the file to be executed by python. I think it's like a shell? linux? thing so that tooling can just execute the file without having to find the python interpreter (ie: _execute_ the file vs running python against the file).

Dont quote me on the specifics though, and honestly why it can't _just_ be a python file I couldn't tell you, claude code can very much run a python <filename> but maybe thats what the author tried to avoid (or the llm).

Fabricio20··on How to stop Claude from saying load-bearing
I also have a local rule for no em-dashes since it got way too annoying and i have the same concern that it dilutes the attention so it's the only rule i've kept in addition to "be concise".
Fabricio20··on Tenda firmware (multiple versions) contains hidden authentication backdoor
Oh this is amazing! I have a few of their cube routers sitting around and I always hated how app-locked their firmware was when it really is just a wifi repeater with a few extras (mesh) on top. Root access will do wonders to bypassing the app now (and also disabling their ping-for-green-light mechanism which spams the network with a constant dns resolution to microsoft.com lol).

Also honest take this looks less like a "backdoor" (implies malicious - this is a link to a CVE after all) and more like a developer access credential/default credential that was burned into the firmware (i'd imagine the code remains but on a production run they randomize the key so its non-guessable but then you get lazy and dont run that extra step and this slips in/you burn the bare firmware with no production configs).

Page 1 of 8Next →