HNHacker News
TopNewBestAskShowJobs

drum55

484 karma · joined August 31, 2025

submissionscomments
drum55··on CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation
https://go.dev/doc/go1.24

> ListenConfig now uses MPTCP by default on systems where it is supported (currently on Linux only).

This seems to imply basically any golang server built since February 2025 is going to be at least attempting to use it.

drum55··on CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation
This is a good portion just slop, another 9000 word article that could have been a couple of paragraphs. More text doesn't mean better.
drum55··on Binance-hacker-1029 – $5.6B stolen from Binance
You don’t even have to do that, have deposits go to offline keys directly, that way there’s only ever cold > hot wallet movement and a big deposit can’t cause your hot wallet to be too risky.
drum55··on Tailscale SSH: Investigation and remediation update
NAT are not firewalls.
drum55··on Tailscale SSH: Investigation and remediation update
No amount of claude can handle the key thing that Tailscale fixes about wireguard, all of the connection to connection logic is handled be it direct, via all sorts of weird hole punching or via relays. Wireguard itself is horrible to do this with, half the time you're just looking at `wg status` wondering why the packet counter isn't incrementing today. It can never achieve the magic that is a direct connection between plane wifi and a host that's behind NAT on the ground.
drum55··on Tailscale SSH: Investigation and remediation update
10,000 words of claudish, it's not worth reading.
drum55··on 'I Felt Blind Panic.' They Opened Their New $2k iPhone Duo–and It Broke
It mostly shows that people are spending well outside their means.
drum55··on New 14‑inch MacBook Pro with M6
In the system info they’re referred to as M1 Pro 10 Core or whatever, much easier than Xeon 2950 E3 v3 in the scheme of things.

  Chip: Apple M5
  Total Number of Cores: 10 (4 Super and 6 Efficiency)
Same amount of information, just formatted differently ultimately.
drum55··on New 14‑inch MacBook Pro with M6
They’re binned, not every piece of silicon will work perfectly so they’re selling the ones that did as higher SKUs and the ones with minor flaws become the lower core counts.
drum55··on A Printer Printing onto Paper
There's been controllers for all sorts of common cartridges for a long time, a lot of low end UV printers all use a specific Epson cartridge that they run their own plumbing and electronics for. The end result of the device looks almost hand made a lot of the time, it's an XY plotter with a gigantic expensive print head on the end. https://www.amazon.com/mew/dp/B0FF93HB2W https://www.ebay.com/itm/397039456738
drum55··on Tailworm – Tailscale Vulnerabilities
If you were in college this would be a 40 page essay, or about the same length as thesis in some cases, to communicate a list of potential software vulnerabilities in an overly verbose, pompous voice. It's just slop, it could have been a couple of paragraphs of text at most.
drum55··on Cerebras Deploys Trillion-Parameter AI Models
For a fairly weak comparison, modern Bitcoin mining chips are around 13J/TH, so around 0.32TH per token, or 320 billion double-sha256 mining operations per token served by this system. Peanuts are also about 4200 Joules, or almost exactly 1000 tokens per nut assuming you could efficiently turn it into electricity to run this chip. Just as a frame of reference, I don't think this actually serves to make any point.
drum55··on Dream-1
I didn’t say it was fake, I said nobody cared enough about what they were making to write a paragraph saying why. Being excited about your product, what if can do and why you made it is very different to promoting “make a blog post about this in a boring corporate style” and going to lunch.
drum55··on Dream-1
A back of the napkin post means at least one person had interest in its authorship to put down their drink and write something, the LLM made blog posts are a show that zero people had interest in its authorship enough to put down some words.
drum55··on Tailworm – Tailscale Vulnerabilities
This is just slop, even if any of the issues raised here are real or not, no human bothered to want to contribute to its authorship. The linked website is something like 10,000 words that by and large convey nothing useful to the reader. HN is going to need a flag for these articles so nobody wastes and time under the illusion that there’s anything worth reading.
drum55··on Dream-1
It's weird to spend all this time making a product and then just throw up something you had a LLM regurgitate. Any amount of human written content here would have been better, even if scribbled on the back of a napkin to show that the product had anybody care about it. A blog post, post-LLMs, can exist entirely in a vacuum away from anybody believing in it.
drum55··on Today, we hacked what we'd set out to hack: the iPhone
PDFs are basically executables, that's why it's hard. They support running code, they support decoding images which themselves have their own custom compressors that are basically code. Anything to do with image formats is rife for bad decoders, insane compression algorithms from the 90s, and a PDF is basically 1000 formats inside many different container types with executable code plastered on everywhere. If you want to make a compatible PDF viewer you'll need to be able to implement an image decoder algorithm for a fax machine that was specific to Japan in the late 80s, which was somehow ratified into a standard and is used today by all the top legal firms, or something absurd like that. When you open a PDF on your computer, depending on how it is being parsed, it can even make outbound network connections without you knowing. To safely open a PDF you need one of those bomb proof suits, a disposable laptop, and even then you might be going home without eyebrows.
drum55··on Today, we hacked what we'd set out to hack: the iPhone
The videos sort of imply that these are userland rather than bootrom, whatever payload they have running is getting hit before first unlock, which isn't a lot of surface. They specifically say to not update which pretty much confirms where the attack surface is. Somewhere after the kernel starts but before the main user space is unlocked with the passcode.
drum55··on Sony Exits UHD Blu-ray Player Market as Pull Back from Physical Media Continues
I find this to be not unsimilar to the claims that echos that the number one desire for cellphone users is to have a replaceable battery. People don’t use physical media because it’s inconvenient and doesn’t match with what they’re doing, and the quality is good enough that the viewer doesn’t care. It’s apparently cool to lament headphone jacks, or field replaceable batteries, but the inconvenience of them means nobody would be using them anyway.

I have the whole setup with a laser projector and atmos and whatever else, but I’ve never thought for a second that I’d want to increase the friction of it more than click and go, even for a theoretical increase in bitrate. That almost all the most popular blu-ray players output 1080p supports the thesis that nobody really cares what it looks like past a point.

drum55··on PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)
The text of this is basically unreadable, any amount of human authorship would be better.
drum55··on Voxtral 3
Closed model unfortunately, continues the theme of TTS / STT being really not great for local deployments.
drum55··on New Walkman $5,899.99
At least the one I’ve seen in person appeared to be literally that, an android phone without the phone bit; so an intentionally awkward user experience for no purpose.
drum55··on OpenPrinter
To amuse myself I bought a modern Epson dot matrix printer with all the convince features like USB and tractor feed. Yes it works no matter what but it’s a good reminder that we do actually care about the quality of print jobs.
drum55··on I never authorized an integration that scans my secrets
"You can just opt out" is the worst possible response for something the user doesn't want, and didn't know about in the first place.
drum55··on Registration without a phone number on Signal will use zero-knowledge proofs
I've literally never seen anybody mention it, much less use it since it was announced.
drum55··on Apple Unveils iPhone Duo
Right, because it scratches some nostalgia thing that people have obtained osmotically. Nobody actually wants a replaceable battery that makes their phone vastly thicker and harder to waterproof, nobody wants phones that randomly catch fire because their OOPLMXC brand battery from amazon wasn’t up to snuff, nobody wants to be carrying a pocket full of extra batteries to swap all day. Devices with field replaceable batteries just sucked a lot more than people don’t remember. As much as people clamor online about how they want these things, given the option they will shy away from it because it doesn’t match the fantasy that’s been created about “what has been taken from us”.
drum55··on It took a year to ship WebAssembly in Anubis
That’s because its weird and mostly irrelevant, it’s nothing to do with the proof of work being any sort of economic impediment. It takes Claude a few minutes to write a near instant solver, that’s the maximum proof of work cost this adds.
drum55··on It took a year to ship WebAssembly in Anubis
It’s not seconds though, it’s in the order of tens of milliseconds of work, it’s faster to complete the challenge than most http requests will take.

last difficulty 5 nonce 645376 in 9 ms (101.6MH/s, avx512-x16)

This takes many minutes to solve on a cellphone, 9 milliseconds on a cheap VPS. It’s not stopping anyone.

drum55··on Georgi Gerganov on llama.cpp/ggml future after Nvidia acquisition of HuggingFace
They got a C&D.
drum55··on Memory prices climb 500% in 12 months
Most devices never test their memory and don’t have ecc, so you generally never know. Random instability can be fixed by restarting and your program not being in an area with bad bits anymore.
Page 1 of 4Next →