Hacker News Reader

mjmason Security advisory: Critical remote code execution vulnerabilities, update now

out of per-request-limited memory. That was part of the vulnerability that the state wasn't completely reset properly.

mjmason PHP 8.2.35

> I don't recall seeing any high-quality C codebase using it

Lua does. (though it does have the option to use C++ exceptions or MSVC stack unwinding instead)

mjmason Upcoming critical PHP security release (CVE-2026-109618 / -109619)

How would that work for the OOM cases?

mjmason Upcoming critical PHP security release (CVE-2026-109618 / -109619)

Caching. Try adding a query parameter: https://www.php.net/archive/2026.php?a

mjmason Kids are outsmarting social media bans. That's not a problem we need to solve

We are already going through the "digital duty of care" act now.

https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...

It applies a 'duty of care' to 'online services', which include 'internet carriage services', 'social media', 'relevant electronic services', 'hosting services', 'search engine services', generative AI services, among others. And for encrypted messaging (which would probably come under 'social media' or 'relevant electronic services'), it only excludes 'lawful communications occurring in private solely between consenting adults'.

And the other big thing is it gives approved researchers authority to use sock puppet identities in contravention of any 'agreement, contract or deed', and gives them immunity from civil consequences.

Reliable sources inform me that the government is never going to abuse this act.

mjmason Teal – A statically-typed dialect of Lua

Teal isn't particularly new. First commit is Jan 2019

mjmason The tilde in your PATH may not be your HOME

Bash does it only inside variable assignments:

  a=123:~
  echo $a
  echo 123:~

results in:

  123:/home/me
  123:~

mjmason Celebrating the 100th birthday of the kidney donated to him as a teenager

Not a guy that lives in a dictionary

mjmason cp: -r or -R?

rsync, or at least the version I had would behave differently for 'rsync a b' vs 'rsync a/ b/', even though I added the slash for both sides.

mjmason Building a certificate authority for the whole Internet

That only relies on the (mostly reasonable) assumption that all CAs that don't use ACME charge for the service.

mjmason U.S. postal inspectors shut down website selling counterfeit postage labels

I'm not sure how it works with USPS, but with AusPost here, there is generally an entry at the very start saying 'Label created'.

mjmason Behold the pawpaw

TIL that American pawpaw is different from Australian pawpaws (papaya) (which are tropical).

> A previous version of this article referred to the pawpaw as a tropical fruit. It is in fact a temperate fruit, that belongs to a tropical family.

mjmason OpenAI agent hacked Australian government website, PM says

Here in Australia (Qld) that is the law. Once you move somthing to get in (open a door, etc) it then is classified as breaking.

mjmason OpenAI agent hacked Australian government website, PM says

Yes, but if you leave your door open then it is only tresspassing, not breaking and entering.

mjmason Italian parliament votes for return to nuclear energy

Because having a solution would put the climate change organisations out of a job.

mjmason Grammarly will send unhinged messages to all your users if you try to cancel

Here in Australia unless that particular user that received the emails gave consent to receive marketing emails (and the emails have identification + unsubscribe) it would be violating our Spam act.

https://www.acma.gov.au/publications/2024-07/guide/consumer-...

mjmason Looking forward to Git 2.56 – and 3.0

Also would be nice:

receive.denyCurrentBranch should be updateInstead by default (or at the very least mentioned in the help message, rather than it recommending ignore or warn or refuse, none of which do what is wanted)

mjmason MCP was always a bad idea?

And call it not-closed API or something like that.

mjmason US Revokes Limits on Power Plants' Climate Pollution

Here in Queensland the state owns the regional electricity company, Ergon. ∴ most of what they do that doesn't generate money (such as doing free electricity rather than charging for it) is taxpayer-funded.

mjmason US Revokes Limits on Power Plants' Climate Pollution

Becaude, as we all know, taxpayer-funded == free.

And we banned nuclear, since it's scary.

mjmason So I have a weatherman, which also tells me the news

Also calculating the dew point should be a more stable measure of the air's water content over different temperatures. The first picture works out to a dew point of 23 degrees, assuming 82% humidity is accurate.

https://media.bom.gov.au/social/blog/1324/feeling-hot-and-bo...

mjmason A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

Interesting to note their monorepo is already up to issue / PR 1,186,742. And so assuming 10 years old it would average out to around 450 PRs/issues each workday.

mjmason A warning about 'model welfare'

What about the being inside of the womb?

mjmason Vintage Scientific Papers with LaTeX

The illustrations use https://github.com/jemmybutton/fiziko to get pretty line rendering.

mjmason Show HN: What if the speed of light was 5 km/h?

We can't necessarily survive that well when under acceleration greater than 9.81 metres per second per second for extended periods of time.

mjmason “I just chose words carefully”

  Including the making of the posts
  into nice rectangular portions of
  each thirty three characters wide ?

  Not including the double space at
  the beginning of each line or any
  of the punctuation character ends .

mjmason Omarchy: Any User Process Can Escalate to Root

The attacker could use `chattr -i .bashrc` with the same privileges before editing your bashrc. A better way would probably be to use `sudo chown 0:0 .bashrc`.

Also you will want to do the same to .profile (because of LD_PRELOAD etc). And also do the same to any directories in your $PATH (~/.local/bin etc)

mjmason There's no reason for software to be slow anymore

Example pings from here in Australia (FTTP)

  PING news.ycombinator.com (209.216.230.207): 56 data bytes
  ...
  --- news.ycombinator.com ping statistics ---
  40 packets transmitted, 40 packets received, 0% packet loss
  round-trip min/avg/max = 154.980/155.832/156.990 ms

FTTP except via WiFi:

  round-trip min/avg/max = 164.218/164.860/165.764 ms

Or through the mobile network:

  rtt min/avg/max/mdev = 201.881/245.543/350.600/48.713 ms

mjmason Felony Bench

> AISI

Looks like the new use is more popular than American Iron and Steel Institute.