HNHacker News
TopNewBestAskShowJobs

aussieguy1234

2,254 karma · joined March 26, 2015

Blog: https://softwareengineeringstandard.com/ | BlueSky: https://bsky.app/profile/robbiecahill.bsky.social | Medium: https://medium.com/@robbiecahill | Mastodon: https://fosstodon.org/@robbiecahill | GitHub: https://github.com/robbie-cahill

Built Tunnelmole, the open source tunneling tool with similar capabilities to ngrok: https://tunnelmole.com

submissionscomments
aussieguy1234··on We've built an open-source feature flag server for 11 years
Perfect candidate for a FF if it really is temporary. I have my own personal rule. If the FF lives beyond a certain amount of time, it gets turned into a setting.
aussieguy1234··on We've built an open-source feature flag server for 11 years
If it's settings, its better off being in your apps settings rather than implemented as a long running feature flag.

Feature flags are meant to be temporary.

aussieguy1234··on Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS
GrapheneOS does have their own device attestation sdk
aussieguy1234··on Smear Campaign Towards GrapheneOS
All the signs are there that this is a multinational police operation.

Likely intended to promote the less secure devices and get them in the hands of those the state would like to target. If it were actually limited to drug traffickers, dangerous criminals and terrorists I'd have much less of an issue with it.

But there are several groups that will likely be targets that should not be. Catalonian independence activists (spain), Abortion/reproductive rights activitsts (US), Palestinian advocacy groups, depending on how the politics in each of these countries goes, LGBT and especially trans activists could be targeted also...

aussieguy1234··on Smear Campaign Towards GrapheneOS
Those who give up their freedom and privacy for security will find themselves with neither security nor privacy...
aussieguy1234··on Blockchain intelligence firms link North Korea to $6.3B hack on Binance
Perhaps crypto should have a transaction delay with a user held reverse key for transactions above a certain user defined amount.

If a transaction is above that amount, you get alerts by email, SMS, push notification...

If it's expected you let it go though. If not, you take out the key, then reverse it.

Of course legit recipients would wait until the delay period is over before considering the transaction to be complete.

No worries if an attacker steals the key. Why would they reverse their own transaction?

aussieguy1234··on CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation
There is a push for that, but the fixes (often as little as a one line Dockerfile change in some cases) still have to be tested and verified by a real engineer.

Otherwise everywhere would have patched already with AI.

aussieguy1234··on Binance-hacker-1029 – $5.6B stolen from Binance
This is what I do. I'll only use crypto in a few rare cases where I don't want the vendor to get my credit card number. Always in amounts that, if ever stolen, would not break the bank.
aussieguy1234··on CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation
Given these types of security bugs that are being found left and right, I reckon there's going to be an uptick in hiring of software engineers to fix them.
aussieguy1234··on Binance-hacker-1029 – $5.6B stolen from Binance
Given AI assisted hacking is now a thing, it's probably not safe to keep your crypto in any centralized exchange anymore.

Better general security yes, but the incentive to hack them is quite large and now more hackers have the ability to pull it off.

Same with any purpose built wallet you didn't make yourself: https://www.forbes.com/sites/digital-assets/2026/10/23/ledge...

aussieguy1234··on Cuba is skipping its November 1, 2026 clock change and staying on DST until 2027
This makes sense given all of the power outages largely caused by U.S. sanctions. You would in this scenario want to have more daylight extending into the night time hours.
aussieguy1234··on Why is this fingerprinting script creating bioweapons?
tl;dr

Its not creating bioweapons, but has code obfuscation that makes it look to an LLM like it is, to resist LLM reverse engineering of its code by triggering refusals. It even has Tienanmen square references to trip over the chinese models.

aussieguy1234··on Discord will soon let anyone find public server messages through Google
How about private channels?

The servers I've joined typically have a lobby where you land right after joiming, and you need an admin to approve you before you get access to the actual channels

aussieguy1234··on There are now 5 inference providers for abliterated DeepSeek
I suppose in some contexts, refusals are a bad thing.

But if you're doing anything where your AI agent might get exposed to a prompt injection attack, you might prefer it to do a refusal in that case.

aussieguy1234··on UK to charge universities $1,200 per international student
International students make up about 5% of the total rental housing demand but their impact tends to be felt most in capital cities where the universities are.

Removing them won't improve things as much as you might think.

The housing crisis is a supply and demand problem so they've got to increase housing supply.

The problem there is these is a shortage of construction workers. So the workforce simply isn't there to build more houses. Current construction workforce is 110% maxxed out.

I reckon they should be handing out visas to qualified construction workers left and right to solve that problem, then get the homes built. Dubai and Singapore do this and have no such shortage of construction workers. I can't see why we can't do the same.

Removing international students will also have big flow on negative effects for the rest of the economy.

aussieguy1234··on Listen and read USA nuclear forces Emergency Action Messages, heard on 11175 kHz
Ah, some nice white noise to fall asleep to...

Until the apocalypse arrives that is.

aussieguy1234··on Show HN: Steal My Bitcoin
This could be a trap.

Someone does the exploit, then the creator of this service logs it and uses that exploit to go after higher value targets...

aussieguy1234··on Root shell on Samsung TV
The AI in the TV was listening for dogs barking and babys crying, a gross invasion of privacy. Possibly this could have been for ad targeting purposes.

With projects like REA, it's going to get harder and harder for companies to get away with things like this.

I'd love to see the major social media apps reverse engineered and analyzed in this way. I can only imagine the dodgy practices that'll be found if this happens.

aussieguy1234··on Kimi K3.1 Pro and K3.1 Pro Highspeed
Until I looked, I thought I'd see Kimi vs Claude competitive gaming with pacman.

That would have been interesting to watch, which model gets the highest score.

aussieguy1234··on Delays for Pull Requests and Webhook deliveries
The engineers they "replaced" with AI aren't coming back...
aussieguy1234··on Upcoming critical PHP security release (CVE-2026-109618 / -109619)
Looks like we now have a similar release happening for NodeJS

https://nodejs.org/en/blog/vulnerability/october-2026-securi...

aussieguy1234··on Upcoming critical PHP security release (CVE-2026-109618 / -109619)
I suspect we might be about to see a big Bitcoin mining boom...
aussieguy1234··on Upcoming critical PHP security release (CVE-2026-109618 / -109619)
Given the proven capabilities of LLMs in computer security, get ready for similar issues to affect NodeJS, Java, Go, Rust etc...
aussieguy1234··on NixOS is making me less afraid
I've had NixOS on my machines now for about 3 years.

I'm also less afraid to make promising but risky changes. I have "broken" my machines multiple times, but each time this happens, I just boot back into the previous working iteration, with no real interruption to my work (or fun, depending on what that machine was for).

I can do things like try out new bleeding edge kernels and GPU drivers, important system libraries etc... getting the benefit of these things basically risk free.

There is also one server running NixOS serving up part of what runs Tunnelmole in production.

Initially LLMs were not good at writing Nix, but now they're much better and a good coding agent can do a write/build loop until their config works.

aussieguy1234··on Ask HN: How to deal with shipping AI-written code you don't understand?
Not sure if your engineering quality culture has gone backwards or not, but I would never ship code I do not understand, no matter who or what wrote it.

That is the road to hell. Even if your higher ups think it isn't, this strategy will for sure blow up in their faces soon.

I predict that Meta is soon going to be going on a hiring spree to fix all of the issues this strategy is going to create.

aussieguy1234··on Source code of the Estonian online voting system
Any computer hardware or software that there is a big enough incentive to compromise will be hacked.

We saw this with the Bitcoin wallets recently, with hidden 5g modems being added in a supply chain attack. The payoff in this case for the attackers was large enough to motivate them go to such extreme lengths.

Interfering with a democratic countries elections is a pretty big incentive for across like Russia. They also have the resources to do it.

aussieguy1234··on New 'super ice' 10 times stronger, bringing it close to the strength of concrete
The murder weapon is clearly the only gun around that can shoot ice bullets.
aussieguy1234··on AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware
The lesson from story: Install adblockers on all your devices

Given whom did this attack, I would not be surprised if it was used as intel for strikes on journalists.

There are reliable sources from inside the Israeli Intelligence apparatus that have stated on record that decisions were made to sacrifice 500+ innocent civilians to carry out a strike on one human target. I bet such a strike would be more likely if spyware indicated that one of the innocents was an "enemy" journalist.

aussieguy1234··on Major ICQ security hole (1998)
If it happened to me, my next move would be to steal it back
aussieguy1234··on Ledger confirms spy chip implant behind wallet crypto thefts
How about a recent Pixel with GrapheneOS, again kept in airplane mode and only used for this purpose? Using QR codes for transaction signing.
Page 1 of 34Next →