HNHacker News
TopNewBestAskShowJobs

charcircuit

2,420 karma · joined February 3, 2021

submissionscomments
charcircuit··on Xbox wants you to pay 24 to 40 cents per hour to stream games you bought
Xcloud is about a RTX 3060 Ti which you can rent, including power and the rest of the system from $0.03 per hour as a spot price. At scale Microsoft should be able to be able to get a better price than just the hardware component.
charcircuit··on Jailbreaking the Switch 2
Showing off the exploit by infringing copyright, just goes to show you that these exists are primarily used to steal from developers via piracy.
charcircuit··on Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case
>harming decisions

It's infantilizing to think it's harmful to give users control over their privacy because they are too stupid to understand what they are doing when they share their data with someone that it shares their personal data with someone.

charcircuit··on Epic Games Inc v Apple Inc
This is disappointing to see. Apple has invested billions of dollars into building the iPhone and part of its business model is having a central App Store. Instead of trying to encourage other phone manufactures to compete, they are forcing there to be competition within Apple's own ecosystem they created. Apple built their hole platform which is why they are able to make choices on how it works.

It is punishing Apple for building too great of a product.

charcircuit··on PHP 8.2.35
We are talking about a hypothetical where a patch is made <2 months. With AI agents, I can 100% assure you it would take a max of a few days to pat CB and test a mitigation. Not months.

If you are warning people to turn off their servers. You might as well give them a patch at the same time.

charcircuit··on PHP 8.2.35
If it takes 2 months to do fix a massive security issue, it's best if someone else steps up to the plate to fix it.
charcircuit··on PHP 8.2.35
And in the situation where they released a security patch 2 months ago, there would be a security patch before the bug was public.
charcircuit··on Today's PHP security release, and how we're strengthening security
You shouldn't wait until the attacks succeed to start deploying defenses.
charcircuit··on PHP 8.2.35
How is what you are describing any different than what happened today? Except the vulnerabilities were also explained. You can say that sites are getting hacked right now due to them releasing the security update.

>I'm some rando so no one's even heard of me

Why do think people need to have heard of you. If you are reporting this issue directly to distro maintainers, security companies, hosting companies, etc first you can help use their names as part of the marketing push to raise awareness.

charcircuit··on Today's PHP security release, and how we're strengthening security
If the sites are taking no action they will be vulnerable no matter when the patch is released. For the people who do take action before chainguard's release the safe option was to just turn off your server (and let any big competitor site stay up and take your traffic since they got the patch ahead of time). People taking this option will be offline until a fix is available for them to use. They are not in danger of being hacked.

Trying to say that uncordinated disclosure is bad because people might get hacked yesterday instead of today just is not a convincing argument to me. I prefer the solution that results in the minimum amount of downtime for sites and sites provide value to society.

charcircuit··on Today's PHP security release, and how we're strengthening security
Why do you place a higher priority on maintaining coordinated vulnerability disclosure than of the safety of actual users of the software being protected?
charcircuit··on PHP 8.2.35
They already were in communication with each other. They could have come together and decided on one that mitigates the issues they've found.
charcircuit··on PHP 8.2.35
And that's not a bad thing. If it was, the the logical conclusion would be to never publish the fix and don't preemptively patch before active exploitation.
charcircuit··on PHP 8.2.35
To handle the official solution and drive long term changes to reduce similar security bugs from happening again. The current PHP security team does not seem capable to promptly release a fix, so having a community fix first seems preferable.

Mitigating a bug and developing a proper solution that is maintainable long term and supports future changes being made to the software take different amounts of time to develop.

charcircuit··on PHP 8.2.35
Yes, someone could have published a safe version for people to use for the 2 months to get the actual fix done.
charcircuit··on Today's PHP security release, and how we're strengthening security
>Chainguard unilaterally broke the embargo and published built images containing the fix.

>This disregarded weeks of work by many parties toward a coordinated disclosure.

Good. Coordinated disclosure meant that people couldn't protect themselves. That's not a good thing. It meant sites were forced to shut down instead of simply updating.

charcircuit··on PHP 8.2.35
That's what my agent did to find a UAF. It just took a public one from calif off the internet and found it still flagged asan.
charcircuit··on PHP 8.2.35
Why does the PHP security team need to acknowledge it and develop the fix? It's open source software.
charcircuit··on PHP 8.2.35
https://github.com/php/php-src/commit/01a40e89fbfc499936e3b0...

What everyone is looking for.

charcircuit··on Security advisory: Critical remote code execution vulnerabilities, update now
And don't forget the php-fpm tag was there too. And it gives the exact version too in the article itself.
charcircuit··on Security advisory: Critical remote code execution vulnerabilities, update now
Yesterday the actual bugs plus many more (though less critical) were discovered by the people pointing their LLMs at it. I am confident no new bugs will be found by looking at binary diffs compared to what was already surfaced.
charcircuit··on PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)
You misread. He is saying that the multipart UAF vulnerability part of the overall exploit can't be fixed by session.upload_progress.enabled = off or any other ini option for that matter.
charcircuit··on Upcoming critical PHP security release (CVE-2026-109618 / -109619)
How is the patch still not out yet? This is another case of big tech players all colluding together leaving all the small guys out to dry.

At least this time we can have LLMs rediscover it and make patches ourselves.

Here is the patch I had an LLM come up with against master: https://pastebin.com/raw/EUCF0SR0 It at least stops the PoC which is better than nothing.

charcircuit··on Facebook Pages require paid subscription to post more than two links per month
The owner of the site said so https://x.com/elonmusk/status/2082273378749268440 and it is backed by the open source algorithm they released.

https://github.com/xai-org/x-algorithm

charcircuit··on Facebook Pages require paid subscription to post more than two links per month
https://github.com/xai-org/x-algorithm

The algorithm is open source and does not include logic for down ranking external links.

charcircuit··on Facebook Pages require paid subscription to post more than two links per month
X's algorithm no longer downranks for using links.
charcircuit··on Facebook Pages require paid subscription to post more than two links per month
They removed that a while ago.
charcircuit··on DeepSeek banned from U.S. federal civilian agencies under new DHS order
I am talking about an American company selling deepseek inference as a service.

Also since the model is open source you wouldn't need to go through procurement to obtain it anyways.

charcircuit··on DeepSeek banned from U.S. federal civilian agencies under new DHS order
A service is not a product. You are mixing things up.
charcircuit··on DeepSeek banned from U.S. federal civilian agencies under new DHS order
In that case it wouldn't be a service "developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek)".

Again, hosting providers eventually get RCE by being able to send whatever bash commands they want to run on the machine running the agent. It is very important who you give this power to.

← PreviousPage 3 of 34Next →