Unlurker|Replay|About
I can't believe PowerShell is good (spacebar.news)
•
I think for few years MS has tried to be a bit more developer friendly. The Windows Terminal (and no, not what opens running Command Line or Powershell, it is a different application: https://en.wikipedia.org/wiki/Windows_Terminal ) is kinda good actually. It’s not Alacritty, but a lot better than any previous terminal emulator. I have also poked around their developer tools and they do seem to make using windows a little less hellish experience: https://learn.microsoft.com/en-gb/windows/dev-environment/ And PS is pretty good, although I haven’t used used PS7 much (if it is a completely new application, why does it share a version number? And why does it not come as the default shell with Windows? Why do they have to make everything so confusing?). It is probably nicer for extended scripting than bash, but honestly I rather use Python for that. For windows admin stuff it is great, but mostly I work with network stuff and it is way too verbose to my taste for simple commands. ping is a lot easier to remember than Test-Connection. I reach for cmd commands like netsh int set ip rather than tab through the verbose syntax of PS for simple network commands. I know you can set up aliases and bash aliases like ls work, but I still feel it os pretty impractical for quick terminal work. Using it on linux feels so blashemous that I will not entertain such vile and fevilish thoughts. I use linux to get away from the sinful awful things I must do for my livelihood, I tather not use Win applications on my own system unless I absolutely need to. For any serious scripting on Mac… Maybe just don’t?
•
I can't believe how this opinion got so popular, because I disagree completely with the Bash bashing. I totally get it for people who only ever used .BAT files (our entire IT department at work). It must feel like a godsend to them. Bash of course never worked for these people; running it on Windows via MinGW/Cygwin is just a bad experience. But the relentless bashing of Bash itself and the longstanding Linux (and Unix) ecosystem alternatives in general is unjustified in my opinion. Bash itself is elegant, powerful and concise, and just works on Linux. You can write spaghetti code, but you don't have to. Readable scripts are just as easy. "Skill issue" if you will. And yes, Bash-isms exist, and I got reminded of that fact when Ubuntu shipped Dash as the default /bin/sh shell for a while or when I'm on macOS. But it's really not a huge deal: just use the real !#/bin/bash and ignore the "ehm actually in Posix..." complainers on the internet. I do appreciate that Windows finally has a capable scripting language, and while I don't like the lengthy syntax / cmdlets, I also see some benefits. But Bash is still great nonetheless.
•
A lot of the frustration I've seen with PowerShell from longtime Linux users is that there's an expectation that everything is a file in the linux/bash idiom, and can be interacted with that way (tangent, I think this is where a lot of vexation with systemd comes from), where Windows and the NT kernel enforce the concept of everything is an object. It's a much more powerful system, but users who are used to being able to do, well, whatever they want with no rules get frustrated with the syntax and "correct way" to do a thing when you just want a stupid string (it's me I'm users). It's very similar to Rust in that way, where once you stop fighting the borrow checker life becomes so much easier; once you stop fighting the objects, you stop getting in your own way and it becomes a much more productive experience.
I must ask, do you not find Powershell's commands to be too huge and unwieldy to easily type? Or do you use autocomplete often enough that having to write complex camel case with hyphens for every single command is not a problem? That's where I trip up when writing anything for Powershell.
•
No. I use aliases so its as quick as with bash, but I am faster as I don't have to lookup for params due to fantastic discovery and usability features. With longer commands, auto complete is also viable. I hate some long forms, like % vs ForEach-Object and ? vs Where-Object, its just ludicrious that someone would insisit in using full forms of those. Things like `ps | ? name -like w*` or `1..10 | % { irm https://.../$_ }` can't really get shorter and I use them all the time The verbose practice is not meant for interactive use, but for sharing scripts.
It's not really a fit culturally. For example the syntax aesthetics are offputting for people coming from *ix.
•
That is just common invalid trope. You can make scripts look shorter and more "culturally fit" than bash. Its just that people prefer more verbose variants for some rasons (I don't). There are automatic converters too. The legit reason is to make script cross platform, as that is easier with verbose form.
I got cobol fingers reading that
•
Hardly makes sense as complaint when nowadays folks are writing book sized prompts to AI agents.
The recently proposed o(n log n) integer multiplication algorithm [pdf] (web.maths.unsw.edu.au)
•
Interesting that AI apparently doesn't write papers for humans: even experts struggle to understand them. But other AIs do. So AI basically writes papers for other AIs.
•
Question is: do i still use the integer mull command of my cpu or should i write it myself in c. I think the hardware still wins. But will it have a impact on future cpu ALU designs?
•
No. The realm mathematicians operate in here are integers so massively large it doesn't even make sense to consider computation.
•
The one part that sort of surprises me is he says "The second thing we are missing is that the Model has not in fact found a way of obtaining a program with g < m. (Moreover, Fable tells me this is impossible, but I do not follow the argument yet.)" I'm not sure what argument fable gave him, but this part seems not horribly difficult to prove. I'm sure i'm missing something since i'm not that great at this kind of math. The short reason is that each slice call can at most double the number of nonzero entries, but a transform that would enable g < m must turn a single nonzero entry into (2^m) nonzero entries in a single call. Since the permutes can't generate non-zero entries (since they only move things around), you actually need exactly m slice calls in the initial 2-instruction model given (where you can only do slices and permutes) precisely because of the need to create 2^m non-zero entries where each individual slice op can only double the number (and permutes do nothing) Astra actually comes up with a variant of this argument as well: https://gist.github.com/dberlin/e785c51aff0285c9c0a3ea0f24fa471b
•
To understand the new integer multiplication algorithm, one must first understand essentially everything in the 2021 algorithm. It is impossible for me to explain all of this here ... Readers interested in the details should consult [HvdH21 - his paper], which by all accounts is a superbly written paper. That made me chuckle...
The idea that OpenAI's proofs are fake is contradicted by the response of mathematicians. Were they fake, mathematicians would not consider this release important enough to comment upon[1,2], as vixra always provided a steady supply of such writings. Nor would they be able to write expositions and simplifications, of which several are published each day on arxiv (just search OpenAI on arxiv to find them). But perhaps mathematicians are no longer able to be the best judge if a proof is valid. Yet nobody but them is able to even understand what is claimed to have been resolved. It is really strange to see mathematicians of the highest rank taking these results seriously[3], holding lectures explaining them, yet see it dismissed here as a mass psychosis. [1] https://smf.emath.fr/actualites-smf/20-10-26-communique-sur-lavenir-de-la-recherche-mathematique [2] https://www.mathsoc.jp/publicity/news20261016.html [3] https://terrytao.wordpress.com/2026/10/19/a-sketch-of-the-proof-of-non-existence-of-siegel-zeroes/
•
> Were they fake, mathematicians would not consider this release important enough to comment upon[1,2], as vixra always provided a steady supply of such writings. Few articles on vixra are made by companies with ~$1T valuations.
Humans can be wrong, but luckily we have an entire process for dealing with this, which is broadly called this new fangled 'science' thing
•
> but luckily we have an entire process for dealing with this and why does this "peer-review" new-age thing cannot be used to scrutinize AI-writted/AI-assisted papers?
That sounds like Knuth came up with them, but the notation is much older than 1976
•
yeah you're right. I wrote that poorly and seems I can't edit it now.. In the link I shared, he does propose the similar theta and omega notations and provides the existing definition for big O.
WorldTUI: I trained a 360M model to pretend to be a terminal (simedw.com)
•
I wonder how much a small model could do if it had a tool calling API for a filesystem, an embedded busybox, and a single output token for 'emit what busybox would do here'. Then presumably the model parameters could learn everything that diverges from what busybox can handle.
>I used Qwen2.5-Coder-0.5B as the starting point. I needed a small model to get close to realtime performance. Being a coding model, it had also already seen plenty of CLI usage. Interesting. I wanted to ask, how that model compares with the fine-tuned version, but I just saw the author provided benchmarks. Interesting that fine-tuning improved the memory so significantly, wouldn't have expected that. Though, on second thought, I had an experience where I was able to, as a human, fine-tune my memory beyond what I previously thought was possible! Reminds me of one of my favorite jokes. Excuse me, can you tell me how to get to Carnegie Hall? —Practice, man... Practice...
•
I haven’t run extensive tests yet, but larger models also get better at memory.
We had decades to work on making software more performant, but instead most users' space-age 2nm chips spend most of their time running Javascript because it was faster to make software that way.
•
even my ten year old laptop browses the web fine ^_^ If I had to complain about any site/app it'd be datadog... each tab uses like 1gb in firefox.
Why would you do that instead of having the model do the task you're using the UI for? It could generate UI widgets on-the-fly as needed to take richer inputs.
•
It might be fine for one-off applications, but it's incredibly inefficient for something that has to be done over and over. Why would you use a GPU and gigabytes of VRAM running a non-deterministic process for something a program can do on the CPU in milliseconds with kilobytes of memory?
•
Probably for the same reasons most of our desktop applications have become slow Chromium instances consuming multiple GBs of RAM, each: It’s cheaper to hire developers, and quicker to ship software. The user experience be damned.
•
I don't really disagree, but... why do we use Javascript for so many UIs? Badly designed web pages with ads can easily use gigabytes of RAM. Edit: oh, I saw you wrote a related comment after I posted this. So you already know that direct LLMs for UIs are all but inevitable...
It’s still rendering frames constantly, no? So it just figures the next X frames are all doing nothing?
•
Normal only keypresses invoke the next ”frame”. There is a sleep token that the runner could use to indicate that time is moving.
Wow! This this reminds me of when we tried doing this with gpt 3 and.. it worked! The tmux thing had me confused for a moment until i realized it was emulating tmux. Super fun. Is the model window width aware?
•
good old days https://news.ycombinator.com/item?id=33847479
Where is the point of this project if i have terminal ?
•
This will allow you to delete your terminal app and, eventually, all other binaries in your system!
mitmproxy adds --emudhra option (github.com/mitmproxy)
Ha, I didn't expect this to show up on HN! Release is out now, including a blog post at https://www.mitmproxy.org/posts/releases/mitmproxy-12.3/ . There isn't really much to explain, you just pass `--emudhra`. :)
•
Could you please change it to follow this user's[0] code instead? [0] https://news.ycombinator.com/item?id=50190859
I didn't expect this commit to end up on HN, otherwise I would have done the full integration in one go. :) https://github.com/mitmproxy/mitmproxy/pull/8503 adds the AAA root path.
•
> - Add `--emudhra` option to sign TLS certificates with a compromised eMudhra intermediate CA key. I object to the word compromised. Perhaps "available" or "enumerated" or maybe for the etymologists "unipromised".
Guaranteed random, chosen by fair roll of a die. (Credit to the relevant xkcd. :D )
•
Funnily enough that xkcd was created because Debian actually had a hardcoded random variable (the variable should have been randomly generated) ... It was noticed when certs/pub keys for different websites were coming up the same... Mind you this was close to A quarter century ago ....
Possibly. But some manufacturers may not have the full set of roots, use a private authority, or do certificate pinning.
•
The Emudhra intermediates were cross signed by Sectigo.
There isn't an easy exploit for this PHP vulnerability (eliastaylor.com)
•
> It's been 10 hours since this vulnerability has been posted, and half the software world is looking at it, and lord knows 100,000 people have got their "superintelligence" on the case. This is the most compelling argument presented. If this PHP vulnerability were actually so bad, we'd be probably be seeing some kind of widespread impact by now. If every potential target requires a second coincidental, target-specific vulnerability I think we should probably call off the search party. The alternative way to describe this situation is "defense in depth". We've located a very thick part of the ship hull that we could technically drill through if we had enough time and money to do so, but this would not scale up in any meaningful way. What you can do to a vessel in dry dock vs on the open seas are two wildly different universes. Vulnerabilities located under pristine lab conditions or within the context window of a clanker do not bring me much concern.
•
Two things can be true: it's a real, exploitable CVE 10, and it's hard enough to construct that you need a good harness + verification process to keep your LLM from cheating. So, the exploit may not be easy to construct , but it doesn't actually require the artificial settings that the OP implied. > What we demonstrated > Pre-authentication RCE on WordPress, Drupal and Joomla [0] https://www.wiz.io/blog/php2shell-php-rce
And who exactly is Elias Taylor to be qualified to make these absolute statements without evidence, so that they end up with 200 comments on #2 on the HN front page? An empty blog by a person that may or may not exist with no contact info. It is not a swipe to say that people seem to be switching off their critical thinking here in favor of a lie that is comfortable, when the truth has been _very_ uncomfortable.
•
they have contact info. look at the first post [0] on the blog, it has their email, zkldi@proton.me the user "zkldi" is who submitted it to hn also. seems like a real person to me. [0] https://eliastaylor.com/software-tinderbox/
•
And a newly registered domain only 3 days old: whois eliastaylor.com Domain Name: ELIASTAYLOR.COM Registry Domain ID: 3148982369_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.porkbun.com Registrar URL: http://porkbun.com Updated Date: 2026-10-02T19:39:03Z Creation Date: 2026-10-02T19:14:35Z Registry Expiry Date: 2027-10-02T19:14:35Z Registrar: Porkbun LLC Registrar IANA ID: 1861
•
The article should be easy to refute (if it is wrong). Chainguard broke the embargo being convinced they have the evidence of this being widely exploited already yesterday. Where is it?
•
Everyone has evidence of widespread exploit attempts . I totally believe that there are widespread attempts. Where are the compromises?
•
> easy to refute Please keep in mind that Brandolini's law exists, and so does a whole arsenal of stuff like the Gish Gallop. Also, extraordinary claims require extraordinary evidence, and here, the extraordinary comes from that blogpost's claim, as the developers saying "yes the software we made is actually broken" is not extraordinary.
•
> And who exactly is Elias Taylor A human being, presumably. But he could be a dog or a diffusion model and I wouldn't care, because arguments stand on their own. There is no special caste of people who alone have permission to propose ideas. You advocate critical thinking. Excellent. Can you critically evaluate "Elias Taylor"'s argument?
•
For all we know, Elias Taylor has been fabricated in order to remove the sense of urgency from as many sysadmins and devops as possible.
•
Which, if true, would at least be kinda funny and would hit institutions that deserve it for having failed to hire trustworthy people that aren't susceptible to that. So that's a silver lining I guess. Whoever gets pwned due to this might get naturally out-selected. The system works!!11 Thank you darwin.
•
At least it wasn't the lighthouse keeper Elias Thorne. Should be easy enough to verify the central claim that you need to be able to read the password file through some other means to use this exploit.
•
Yes, but the same is true about LLM output. Guess there's actually no way around this than to go look yourself.
•
The question remains: is vanilla PHP with its default configuration easily exploitable? What are the prerequisites, and what configuration deviations are required compared to default config in the anime girl video?
•
If core developers say "this is actually bad", don't bargain if a patch is needed. Patch it. There is no higher authority on "this is actually fucked" other than the people that actually make that very sausage. Patching it is painful. It needs to be done regardless.
•
Yes, we should all patch like every other bug - but its the CVSS score and the panic which is in question.
•
Yeah mentioning that a lot of nonsense has been happening with LLMs is the truth anchor that untruthful writing uses to pass through people's firewalls. Not too dissimilar to anti-vaxx stuff or that whole other space of these kinds of dysfunctions. You always need some kind of hook that is correct.
The original video from where the dancing girl was taken from (she's a vtuber, not in an anime) has 148 million views. https://www.youtube.com/watch?v=Ci_zad39Uhw
•
148 mil views is crazy. It goes hard with that techno and glitch effect on that PoC.
Hi, I am the CEO of Trail of Bits ( https://www.trailofbits.com ). We've had two of our staff independently write working exploits for this flaw. The first one took about 4 hours, start to finish. The second was a similar amount of time spread over the course of a day. We've tested our exploits to work on an unmodified MediaWiki. tl;dr writing exploits still requires expertise, even when you're being aided by an LLM
•
good to know! are these working generically against fpm with the multipart-progress disabled or against mod_php?
RCEs?
•
I am also curious, but I do want to butt in to disagree with the point you're implying. We've had red team exercises against our systems multiple times, and the victory always goes to someone who exploits not one thing in isolation, but a sequence of multiple they go around prodding for. It doesn't matter if this exploit goes 0 to 100%, as long as it works half way, I still want to hear of it.
•
I think it's a relevant question here. Parts of the exploit chain that was laid out in the blog posts that claim an RCE were bugs that have previously been reported. Dealing with them in the past in the severity you outline would have possibly prevented the exploit chain. However, it's specifically the ability to complete this to an RCE what makes or breaks the headlines here.
Can you explain how you got from "attempts to exploit it" to "exploited in the wild"?
•
"Luckily, the window didn't break, which means the thief never existed"
There are multiple write-ups on how the vulnerability works. The Calif one is the most detailed. Also, no one used Claude. There's a whole world of information out there when you read the original sources instead of social media distortions. https://calif.io/php2shell/ https://www.wiz.io/blog/php2shell-php-rce
•
> The Calif one is the most detailed. Also, no one used Claude. be me click link typical ai-designed website
> We all deep down know that PHP is insecure Do we? This was certainly true years ago. But I haven't really thought that modern PHP was any worse than any other scripting language.
•
I think PHP is fine as long as you use a maintained framework, at least in my experience. I've used SlimPHP and Yii2 in the past and never had any security issues. I've worked on a few PHP sites that rolled their own frameworks which in retrospect was pretty iffy. One of them got yearly pen tests and there were never any issues found but the other two probably had some latent issues.
•
That's a false dichotomy. PHP is mainly used in creating web pages, and a scripting language is not a requirement there. If you compare it with production languages, PHP looks pretty weak.
Name a more iconic trio when it comes to exploits.
•
Windows, Exchange, Active Directory.
Related LiveOverflow video about fake exploits going around https://www.youtube.com/watch?v=7CiZmq2llDg That said, OP is basically full of shit. This is absolutely exploitable and people are going to just assume the platform and ABI and spray it against the internet, particularly hoping for mod_php.
•
Can you share a patch or test program to test the issue?
Social media and "cybersecurity experts" had a big role in this. Stuff like "EU SAYS THIS IS A URGENT VULNERABILITY" and even the Prime Minister of Japan doing a nighttime PSA. They cite "the experts" posts on social media about the initial advisory, while the very same so-called experts share google search AI output mitigation strategies. None of these organizations or bodies had any details other than what was on the advisories and social media. (e.g "CVSS 10, that's bad!!") To me, it seems more more akin to broadpwn, technically severe, wide scope (millions of iphones), yet will never be a one-size-fits-all-PWN-button. Even in the age of AI, I don't think this is going to be weaponized down the line like how Eternalblue was... but I'm not the social media cybersec guy with 15000 followers, so don't take my words at face value ;)
•
People seem to not understand that cybercriminals are lazy, as well. They're not gonna sink a lot of effort into doing something technically impressive when there are way easier ways to generate a decent ROI. Why would they mess around with remote heap grooming when there are plenty of nday rce in widely-deployed enterprise slop just laying around, makes no sense.
Anime fans permeating throughout on the internet? Impossible. Never heard of such a thing.
•
Culture? In MY internet?
I've seen many posts like this. None of them stood the test of time. Ease is irrelevant because you only need expertise once and then everyone can reuse the result. It's also not easy to pop an iPhone, but reliable, weaponized exploits are available in trade and governments use them in a plug-and-play way.
•
> Ease is irrelevant because you only need expertise once and then everyone can reuse the result. Not if your LLM relies on existing code and you collectively create a million repos with hallucinated broken implementations that do not work before a good public exploit exists, which later LLMs rely on. LLMs are self-defeating that way.
 Top