What is Hackers' Pub?

Hackers' Pub is a place for software engineers to share their knowledge and experience with each other. It's also an ActivityPub-enabled social network, so you can follow your favorite hackers in the fediverse and get their latest posts in your feed.

0
0
0
0
0
0
0
0
0
0
0
0
evacide @evacide@hachyderm.io
Public
Shared by Cat 🐈🥗 (D.Burch) :paw:⁠:paw:

Project Zero releases a 0-click exploit chain for the Pixel 9. This one targets the Pixel, but the 0-click bug and exploit techniques used also apply to most other Android devices.

projectzero.google/2026/01/pix

A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby - Project Zero

Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One ef...

projectzero.google

0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
dreid @dreid@wandering.shop
Public

It should go without saying that Gavin Newsom does not have what it takes to fix the country, but he also absolutely does not have what it takes to win a national election.

Pandering to the far right only serves to legitimize the far right candidate he will inevitably have to run against.

He. Is. Absolutely. Not. The. Guy.

0
0
0
Bluesky @bsky.app@bsky.brid.gy
Public
Shared by Silverkey | 은열쇠

📢 v1.114 is rolling out! Today, we're expanding access to the Live Now beta to everyone. This experimental feature lets you add a temporary LIVE badge to your avatar, helping others discover that you're currently live-streaming on Twitch. They can click it to land directly on your stream page.

A preview of the Live Now feature, showing the popup that appears when someone is live streaming and you click their avatar.
0
0
2
0
0
0
1
0
0
mhoye @mhoye@mastodon.social
Public

Question: when did security analysts start describing leveraged exploit paths as "primitives"? Did this start with the FORCEDENTRY JBIG2 exploit or does this terminology have a longer history, maybe in gadget-based exploitation?

projectzero.google/2026/01/pix

A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby - Project Zero

Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One ef...

projectzero.google

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
1
0
0
evacide @evacide@hachyderm.io
Public

Project Zero releases a 0-click exploit chain for the Pixel 9. This one targets the Pixel, but the 0-click bug and exploit techniques used also apply to most other Android devices.

projectzero.google/2026/01/pix

A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby - Project Zero

Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One ef...

projectzero.google

0
0
0
golang @golang@hachyderm.io
Public

🎊 Go 1.26 Release Candidate 2 is released!

🔐 Security: Includes security fixes for archive/zip (CVE-2025-61728), net/http (CVE-2025-61726), crypto/tls (CVE-2025-68121, CVE-2025-61730), cmd/go (CVE-2025-61731, CVE-2025-68119).

🏃‍♂️ Run it in dev! Run it in prod! File bugs! go.dev/issue/new

🔈 Announcement: groups.google.com/g/golang-ann

📦 Download: go.dev/dl/#go1.26rc2

$ go install golang.org/dl/go1.26rc2@latest $ go1.26rc2 download Downloaded 0.0% ( 0 / 62956023 bytes) ... Downloaded 50.0% (31478011 / 62956023 bytes) ... Downloaded 100.0% (62956023 / 62956023 bytes) Unpacking go1.26rc2.linux-mipsle.tar.gz ... Success. You may now run 'go1.26rc2' $ go1.26rc2 version go version go1.26rc2 linux/mipsle
0
0
0
0
0
1
0
0
0
0
0
0
들께 @isthis-ya-cat.bsky.social@bsky.brid.gy
Public
Shared by 초무

탄수화물과 단백질만 좋아하는 요리 잘하는 남성이 강원도에 장가 오면서 기대한 것 : 끝내주게 맛있는 평창 한우, 고구마, 옥수수, 감자 궤짝으로 배송 받아서 에어프라이기에 요리해 먹기 실제로 얻게 된 것 : 무한 한정식 산나물 곤드레밥 두부요리 제공 사건 (투명도 20%의 내적 비명 소리가 들리며)

RE: https://bsky.app/profile/did:plc:32ffmsxrwnugpta5nopzr6lk/post/3mcgi6dwgks2s

0
0
0
2
0
0
0
0
0
Bluesky @bsky.app@bsky.brid.gy
Public

📢 v1.114 is rolling out! Today, we're expanding access to the Live Now beta to everyone. This experimental feature lets you add a temporary LIVE badge to your avatar, helping others discover that you're currently live-streaming on Twitch. They can click it to land directly on your stream page.

A preview of the Live Now feature, showing the popup that appears when someone is live streaming and you click their avatar.
0
0
2
0
0
0
0
0
0
0
0
0
tante @tante@tldr.nettime.org
Public

From a pragmatic standpoint I get Wikimedia making deals with AI companies: They will scrape anyways, this way you might get some money.

But it still _feels_ off. Telling all volunteers "you are working for Microsoft/Perplexity/etc for free now" _feels_ wrong.

0
0
0
0
0
0
abadidea @0xabad1dea@infosec.exchange
Public

RE: furry.engineer/@soatok/1158961

As a professional source code reviewer, I gotta agree with “We cannot overstate the extent to which just reading the OpenSSL source code has become miserable.” The answer to “how does OpenSSL—” is always “I don’t know and I don’t have six months to find out.” This is not true of alternative libraries with the same functionality.

HellPie @hellpie@raru.re
Public
Shared by ✧✦Catherine✦✧

@0xabad1deaabadidea I feel the same when I have to explain that FFMPEG rawdogging assembly is not the "performance" tradeoff that people should look at and go "holy based".

They openly admit to lying about ABI-stability when they know damn well they re-shuffle enum values between random updates, why the fuck would anyone trust them to be able to maintain assembly code with instructions that look like passwords.

The code is already unreadable, the specs for it are buried in NDAs and patent hellholes, which doesnt matter because FFMPEG is very proud to diverge from specs. That codebase does not need to include assembly to become a security nightmare and going "see no evil hear no evil" while closing your eyes and plugging your ears doesn't fucking work because some fucker is 100% gonna speak a lot of evil. Media files are historically one of the most reliable things to look into if you're looking for a 0-click 10/10 RCE.

It is impossible to trust a review of projects like these, I don't care how skilled and certified the team signing off on it was, if they don't find anything they did not understand what they were reading and one day someone on the red team will do a better job than them.

0
0
0
Earth Patch Notes @earth_patches@app.wafrn.net
Public

Notice for Players Regarding Server Time Adjustment

A very early reminder to many players, mostly in Europe DCs - remember that on March 30, the server time will be adjusted by an extra hour ahead to align with the in-game day-night cycle. This may interfere with many features such as public transit, career quests, and some items with a clock feature may display incorrect time.

0
0
0
0
0
0
0
0
0
BSI @bsi@social.bund.de
Public

🚀 Heute startete die AWS European Sovereign Cloud in Potsdam & wir waren als BSI vor Ort.

Denn: Wir unterstützen den US-Cloud-Anbieter Amazon Web Services (AWS) bei der Ausgestaltung von Sicherheits- & Souveränitätsmerkmalen seiner European Sovereign Cloud (ESC).

Zur Pressemitteilung:
👉️ bsi.bund.de/dok/1190346

🎬️ Ein Statement unserer Präsidentin Claudia Plattner gibt's im Video.

0
0
0
Hacker News 50 @hn50@social.lansky.name
Public

Denmark's struggle to break up with Silicon Valley

Link: politico.eu/article/denmark-de
Discussion: news.ycombinator.com/item?id=4

Inside Denmark’s struggle to break up with Silicon Valley

From a media blockade to “nationalizing” government software, Denmark has become a laboratory for resisting U.S. Big Tech. But is the price of sovereignty too high?

www.politico.eu · POLITICO

0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0