Hacker Newsnew | past | comments | ask | show | jobs | submit | aleksejs's commentslogin

I really like the _idea_ of a QWERTY phone, and halfway through this page there's a section showing how you can use special characters to invoke commands (presumably by just typing at the home screen?), like "- buy milk" to add a todo entry or "? aviation recipe" to search. This sounds great, and somewhat difficult to replicate on a touchscreen!

But I'm not convinced anymore that the actual typing experience is any good. Way before that exciting section, there's a video where somebody takes two full seconds to type "Hey bro you" on this phone's keyboard. I tried: in the same amount of time, I can type "Hey bro you mean everything to me" on my Pixel's default keyboard.


Fascinating times we live in, when "the last hypervisor bug" in what is presumably one of the most hardened pieces of consumer hardware can be found by "noobs" and "slop kiddies".

I say it's only because LLMs came out after the PS5 was developed. Presumably, future generations of hw (if there are any) will use the same methods to harden the attack surface. Good ole cat and mouse.

Makes you wonder if it really was "noobs" and "slop kiddies" that found it.

No, it doesn't. Nobody would go do this just to report it to Sony for a few pennies. That is a non-existent motivation for people in the know, who understand the opportunity cost.

Unless they didn't want to actually make money from anything nefarious, and the bounty was more than just "a few pennies"

Well, sure, the same way that I can "cook" a three michelin star meal by going out to eat at the French Laundry.

It's just boring. And the people that crow about "their" accomplishments are tiresome.


Hypervisor bugs are boring? Maybe to you.

Hiring someone else to find them is boring as hell. If you only care about being spoonfed results, I don't think there's much to talk about.

Allegheny County in Pennsylvania is one such department without a separate number. I don't think it's that uncommon.

Is your heat sink entirely unmodified? Opening up the fins should make it a lot easier to cool.


Meta glasses do have a recording indicator.


What I’m talking about is an obvious front facing indicator.

Not a shiny piece where a shiny piece usually resides on some kinds of frames. Not a single LED that can be covered.


You will surely not have a good time enforcing the terms of a legal document that explicitly spells out that it is intentionally obfuscated from the party it intends to bind.


No, that’s not at all what is going on here.


I think the actor they were monitoring was not tracking real launches but rather simulating where a hypothetical balloon launched from their territory would land.


This is an official USPS service available to anyone willing to attach their address and "a statement guaranteeing payment of postage due on delivery" to their keys! Which is neat but kind of awkward if that's also the address of the door the keys open.

(per section 1.6 of USPS DMM 133 at https://pe.usps.com/text/dmm300/133.htm)


no media mail rates. Will have to return that overdue book to the library in person.


I'm not sure I understand the intended message here. The author seems to describe their own project as "cover[ed] ... with invasive advertising" while saying that new technology accomplishes the same outcomes "faster, cheaper, and [with less maintenance burden]". So what exactly has been ruined?


Exactly. And having AI to work out the 2am dependency issues actually makes maintenance a lot easier. This seems like an odd message.


What kind of urgent dependency updates could happen at 2am for a json formatter anyway?


On that particular point, I wondered whether there was supposed to have been a "not" before "cover"; otherwise, it definitely doesn't seem to follow.


> If you go looking for the public record of what Mythos actually found you land on roughly 40 CVEs, and 28 of those are Firefox and 9 of them are wolfSSL. A browser and a cryptography library. There’s no PHP in that list, no CMS, nothing that resembles the web most people actually use.

How does one arrive at the idea that "browsers" is a category less representative of "the web most people actually use" than "PHP applications"?


Anthropic's own criterion, from the Glasswing page: "systems that represent a very large portion of the world's shared cyberattack surface."

A Firefox exploit would be targeted, one user at a time, and you still need delivery. A pre-auth RCE in the CMS behind 40% of the web does fit that criteria better right?

https://www.anthropic.com/glasswing


You need both sides for a useful web. In this discussion if the servers are all dead web is dead too: don't use a compromised server even if you can't tell it is compromised.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: