Hackers' Pub is a place for software engineers to share their knowledge and experience with each other. It's also an ActivityPub-enabled social network, so you can follow your favorite hackers in the fediverse and get their latest posts in your feed.
비공식 페콕 그거
Lessons learned from React's RCE
In the last few weeks, 3 vulnerabilities where found in the React web application framework. The first one, a server-side remote code execution (CVE-2025-55182) is the worst a vulnerability can get for a web framework. The two other ones are a denial of service (CVE-2025-67779), and a source code exposure (CVE-2025-55183), much less dangerous, yet still impactful. There are already a lot of writeups published talking about how these vulnerabilities happened, but I didn't see much about being said about preventative measures that would have limited the damage. In this entry, I'll explore potential mitigations that could have been applied ahead of time to prevent these vulnerabilities or at least limit their severity.
sgued.fr · SGued
Link author: 
Soso@sgued@pouet.chapril.org
これおしゃれで気になる
例のマザーボードをデスクトップPCにする https://zenn.dev/ry0ka/articles/20231028_reino_motherboard
睡前撿到一句
「你的目標是穿過沼澤，不是對付每一條鱷魚。」
往前走，不要和爛人爛事糾纏。
睡醒又有一大片沼澤跟鱷魚在等我
目視ではかなり見えてるのですが、カメラの画角に収まらないですね
Jitsi questions:
- how secure is it?
- is encrypted?
- what are some public servers folks can use?
- what else is good about it I should know?
Note, I am not asking for critique of Jitsi outside of the technical specs - I have cranky opinions covered
Mandatory break time. ☺️😴🐈 (her head is so light she’s not even triggering keystrokes) #CatsOfMastodon #RipleyAndJonesy #JustRipley
AI and the ironies of automation – Part 2
Link: https://www.ufried.com/blog/ironies_of_ai_2/
Discussion: https://news.ycombinator.com/item?id=46262816
비공식 페콕 그거
RE: https://stranger.social/@lednaBM/115718877275566120
It's weird how every time someone runs a UBI or GBI test like this, it always turns out positive. Like, I *never* see headlines saying "UBI Trial in Bumfucksburg, West Idaho Fails to Achieve Goals".
They always work, never fail.
It's almost like they're a good idea and we should move past the "trial" stage, hmm? 🤔
#UBI #UniversalBasicIncome #BasicUniversalIncome #GuaranteedBasicIncome #poverty
This is new.
から
して
また一週間がんばりましょー
Tier list of Linux security mechanisms (2024) via 
@RunxiYu https://lobste.rs/s/vp1zbg #linux #security
https://blog.ce9e.org/posts/2024-06-23-linux-security-mechanisms/
2時まで張ってみますかね
Goodbye Microservices: From 100s of problem children to 1 superstar https://lobste.rs/s/hhddvz #api #distributed
https://www.twilio.com/en-us/blog/developers/best-practices/goodbye-microservices
🎙️ In our very timely new podcast episode 46 "Summer Events Special" that we are totally releasing just a few days after it was recorded, 
@RannyBergamotte, 
@ollieparanoidOliver Smith, 
@z3ntuLuca Weiss and 
@linmobLINux on MOBile talk about Linux Mobile action at #defcon33, #why2025 and #froscon2025, all which took place between August 7 and 17 this year.
We get into how DEF CON in Las Vegas compares to the European events, what it's like to be at a hacker camp, plenty of Linux Mobile talks at FrOSCon, and a lot more!
Special thanks to @timegearmonkey for editing (first time editing a postmarketOS podcast episode)! ❤️
https://cast.postmarketos.org/episode/46-Summer-events-special/
定期的に古いリモートデータをお掃除する処理回るように
fixed, works now
Bondi Shooting
💔🗞️💔
"Police are investigating the people behind what is now one of Australia’s worst shootings with 12 people dead and dozens injured at Sydney’s Bondi Beach in a targeted attack on a Jewish event."
//
"A civilian has been labelled a hero after he snuck around a car to pounce on one of the shooters, wrangling the gun from his hands."
"The hero, since identified as Ahmed al Ahmed"
https://7news.com.au/news/bondi-beach-shooting-what-we-know-so-far-about-the-terror-attack-that-killed-12-people-c-21001860
【Misskeyバージョンアップ 2025.12.1】Guaranteed Basic Income Program In Rochester NY Deemed A Success | Crooks and Liars
https://crooksandliars.com/2025/12/guaranteed-basic-income-program-rochester
On my way to see the Trans Siberian Orchestra! Don’t break the internet while I’m gone.
@jerryWary Jerry
I think that's the Fediverse's favorite Siberian Orchestra!
This will be a long post. The satire snake flags I've collected over the years. Just borrowed one from 
@catsaladCat 🐈🥗 (D.Burch) 
so figured I'd share the rest.
![A satire don't tread on me flag. The caption is "[patriotic choking noises]" and the snake is on a ventilator.](https://files.mastodon.social/media_attachments/files/115/718/868/203/019/100/original/d8dc427dc4dded45.jpg)
On my way to see the Trans Siberian Orchestra! Don’t break the internet while I’m gone.
@jerryWary Jerry There's no way that entire Siberian orchestra is trans, but that's awesome if true.
On my way to see the Trans Siberian Orchestra! Don’t break the internet while I’m gone.
Today I met 
@kreativ_ohne_druckChili Scotch at the Christmas market at #FeinkostGenossenschaft in #Leipzig, 🇩🇪Germany. Colorful prints, beautiful #handcraft and some special Japanese technique made of knots.
The booth was easy to identify by looking for the #plushtodon 😊
It's not even about privacy, tbh. "God I hate all these ads." "God I hate all this AI shit." Um, hey, can I suggest a tool that's totally free and solves that problem easily? "No, I'll just keep suffering."
"Oh wait, there's this new app called Twzlrrrrr? I have no idea what it does but everyone else is on it so I need to hand over six forms of ID and triple backflip through a flaming hula hoop to have it!"
Btw, it also has ads and AI.
And these are the same people who are like "man fuck ICE, fuck Trump." My brother in Christ, these same companies you refuse to stop using are propping up ICE and Trump. All Big Tech is bending the knee. All of them have government surveillance. You think the NSA does their own wiretapping anymore? Dream on. They buy it all from Facebook and Amazon and Google. Corporate surveillance IS government surveillance.
“Hegseth🚨attends Army-Navy game in full pads.”
Defense Sec Hegseth is beyond delusional, it’s becoming likely that the former Fox New’s host believes he’s a hero in a video game saving the world from the leftists, immigrants, POC...
Is it satire? You be the judge. — #Hegseth attends Army-Navy game in full pads.”
-F Wellman
#Cosplay #Kakistocracy #DOD #TrumpRegime #Protest #USPol
I spent a while implementing resilient parsing this weekend, and I am kind of thinking that this isn't quite what I want.
Instead, I want a resilient *grammar*. What I mean by this is, a resilient grammar is designed with the temporal process of typing out the code in mind, to minimise the number of *errors* that may occur whilst the code is only partly written. In particular, there are many places where we *know* that we need to have a certain keyword, or an identifier, or a block, and instead of emitting an error or a diagnostic in those places, we should just allow them to be empty.
Then, the magic part is when we also instrument the concrete syntax trees with inlay hints that indicate to the user what they would have been supposed to type there. These aren't errors, they are hints.
I am sick and tired of "live errors" (live nitpicking) whilst writing my code. What I want is "live reminders of the syntax".
test
⏳ Just a few hours left! 🔥
We're in the final stretch of the Bonfire crowdfund. Help unlock new features for community-run spaces in the #fediverse! Every share or contribution makes a real difference.
Support or boost before time runs out:
https://www.indiegogo.com/projects/bonfire/community?refcode=KSZZAOGLZ028Aw6GI1ZvVQ
Read about our groups stretch goal, to bring genuine community spaces to the fediverse:
https://bonfirenetworks.org/posts/why-community-matters-groups-as-the-next-step-for-the-fediverse/
Endless thanks to everyone who supported us already! Let’s show what open and caring federated networks can achieve! 💜🌱
This is an area I think we could improve on the Fediverse —
Nested Comments
This (in the attached screen-shot) is from someone on Twitter who is also on Mastodon and Bluesky.
He seems to be a fan of the nested comments UI on Bluesky.
We have some great applications on the Fediverse. They could be made even greater with this improvement.
@reiver@mastodon.social the Fediverse already has this.
It's called the threadiverse 😏
This is an area I think we could improve on the Fediverse —
Nested Comments
This (in the attached screen-shot) is from someone on Twitter who is also on Mastodon and Bluesky.
He seems to be a fan of the nested comments UI on Bluesky.
We have some great applications on the Fediverse. They could be made even greater with this improvement.
@reiver@reiver ⊼ (Charles) 
I built ktistec for reading long threads. it already does this and more. other (not Mastodon) servers out there do the same as well I believe
横になりますか
@reiver@reiver ⊼ (Charles) …and it's not just the sheer amount of storage; prudent expiration and cleanup (e.g., #Enigmatick clears cache data each night that's greater than 30 days old) helps to manage that. It's the application load of pulling up the same records tens of thousands of times within a few seconds when new content is created (i.e., the fan-out of initial delivery and the resulting requests back for content).
I use Varnish and that helps a lot with the latter case. But a #FediCDN could be built on Varnish (like Fastly is) and provide decentralization in that service.
@jdtJustin Thomas @reiver@reiver ⊼ (Charles) many servers seem to fetch and cache images, etc. as soon as they receive a new object. simply waiting until a user actually views the object and/or falling back to the origin would reduce the impact.
Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
Link: https://trigger.dev/blog/shai-hulud-postmortem
Discussion: https://news.ycombinator.com/item?id=46262021
I think it is telling that we are about three years into the AI craze and, still, every single time someone says to me "I asked ChatGPT ___ " or "The chatbot told me ____" I know they are about to say something completely stupid and devoid of facts. Every single time.
我某段時候有捐過無國界，後來取消了，應該就是2019年的事
倒是國際特赦一直是在我的捐獻名單內，直到香港分部因為國安法而解散為止
1차 반열종 페콕 비공식 !! 근데 당근이 크게 안 자라고 개 쥐꼬리만큼만 자람
已經看不到這則留言了 而且還直接關留言功能 笑死人
#無國界醫生
當初接受香港人一年捐超過 20 億新台幣，結果 2019 反送中不救香港抗議民眾的「無國界醫生」，Meta 廣告資料庫顯示最近 30 天花了40萬在台灣買廣告，總共已經花了快 700 萬買廣告，Threads 上說現在捷運站也很多工讀生，大家慎選愛心對象哦 🤗
#無國界醫生
風雲しゅいろ城
@Sebastian aber die Firma sagt doch immer, dass sie wie eine Familie ist
Happy #hanukkah to all who celebrate, and solidarity with the Jewish community after the horrific news coming out of Australia.
jnkrtech
青少納言🎨🐏 
Em 
Jenniferplusplus
