0x0
Joined 16 years ago
Karma
18,063
Submissions
3,640
Member since
Oct 27
Recent submissions
Comment · 24 days ago
I've been using a single letter "fake" tld for my internal LAN DNS zone. Looks like ICANN requires 3+ letters in tld applications, so hopefully should be safe for quite a while.
Comment · 29 days ago
Blocked here too, never visited the site before. Should we "flag" the story for this, or?
Comment · 1 month ago
I remember setting up a new git CI build server many years ago, which at the time rather quickly started failing build pipelines in a nodejs css frontend build script, turns out there was something funky with the AMD processor's RDRAND. A motherboard BIOS flash update fixed it.
Comment · 4 months ago
I find it's a shame the article is absolutely littered with AI-isms, again, like another cool hack project the other day here on HN. It is incredibly jarring to read a line like "No Platform Builder, no SDK install, no CD key.".
Sounds like a cool project but I find it a bit offensive that the article author doesn't value the article reader's time enough to edit the AI-isms out.
On the other hand, trying to point this out usually results in downvotes, so maybe it's useless to complain about this trend?
Comment · 4 months ago
Shame the article is absolutely littered with AI-isms.
Comment · 4 months ago
I just wish Valve could add official macos-arm64 builds of the various hl2 games on Steam :-/
Comment · 6 months ago
Just recently noticed this got posted to deb-multimedia, although I think there is a typo in the package description....
https://www.deb-multimedia.org/dists/unstable/main/binary-am...
... it says "fast and small AV1 video stream decoder"
... should probably be "AV2" ?
Comment · 6 months ago
Comment · 6 months ago
Such a shame that macOS lost all its built-in postscript support including Preview.app in recent versions :(
Comment · 6 months ago
I find it curious to call someone dropping a weaponized root exploit before major distros or even LTS kernel git branches have patches ready "good guys". This could have been handled with much more grace.
Comment · 6 months ago
The disclosure doesn't appear very "full". Looks like this was slipped into mainline linux among dozens of other mostly-irrelevant "CVEs" with nobody highlighting the fact that it is in fact dirty-cow-on-steroids.
https://x.com/spendergrsec/status/2049566830771970483
https://lore.kernel.org/linux-cve-announce/2026042214-CVE-20...
Or is everyone expected to upgrade and reboot every 48 hours for all eternity and just deal with potential regressions all the time?
I think this reflects poorly on the original reporters. If you have a weaponized 700-byte universal local root exploit script ready to go, perhaps you should coordinate with major distros for patches to be available before unleashing it on the world. No matter how "veteran" you are.
Comment · 6 months ago
Dropping a public exploit on github before distros have patches available isn't very cool, or is that just how veterans roll these days?
Comment · 7 months ago
Enumeration of the entire DNS space is not available in general, but it does appear that some TLDs offer complete zone files for legitimate research purposes, see for example https://czds.icann.org/help#zone-files
Comment · 7 months ago
The breakout engineering to exploit Dolphin has already happened, see for example:
* https://dougallj.wordpress.com/2016/11/13/exploiting-dolphin...
* https://gist.github.com/hthh/502ae16db55612f64d3966769a154c3...
Comment · 8 months ago
> "they can't be provisioned by the website itself."
It's funny, we used to have a html tag that would exactly that: <keygen />