What is Hackers' Pub?

Hackers' Pub is a place for software engineers to share their knowledge and experience with each other. It's also an ActivityPub-enabled social network, so you can follow your favorite hackers in the fediverse and get their latest posts in your feed.

1
0
0
0
0
1

Do you know any new open source projects that deserve recognition?

Projects that are:
- Solving real world problems and driving technical innovation
- Improving science, research or medicine
- Challenging long standing platforms or paradigms
- Just super nerdy and doing something novel!

If you do, please share them and perhaps we can help them get the attention they deserve. 🧡

0
0
0
0
1
0

Question: when did security analysts start describing leveraged exploit paths as "primitives"? Did this start with the FORCEDENTRY JBIG2 exploit or does this terminology have a longer history, maybe in gadget-based exploitation?

projectzero.google/2026/01/pix

0

Diesen Hinweis könnte die Bahn eigentlich gleich bei jeder meiner Buchungen dazu schreiben. Ganz im Ernst. Das ist sooo frustrierend. (Ich habe so lange überlegt, ob ich *noch* früher los soll, um meinen Termin zu schaffen - aber der Zug war pünktlich, es gab genug Puffer und irgendwie dachte ich naiverweisw, dass ich ja auch EINMAL Glück haben könnte.

DB Navigator
„Aufgrund von aktuellen Ereignissen ist die Verbindung nicht mehr fahrbar. Bitte suchen Sie sich eine neue Verbindung für Ihre Reise.“

Heute ist es so richtig schief gegangen mit der Bahn. Selbst für meine Verhältnisse. Ich hatte eine Verbindung mit gut Umsteigezeit und Puffer. Die oft auch funktioniert: Sprinter Berlin- Nürnberg, Intercity bis Aalen (und dann RE nach Oberkochen zu einem Termin). Ich hab drei Anschlüsse verpasst und musste am Ende vom vorletzten Bahnhof abgeholt werden, um nur zwei Stunden zu spät zu sein.
Ich frage mich, wie Leute unter diesen Bedingungen überhaupt irgendwo ankommen.

0
0
1
0
0
0

It seems that py/cryptography's thoughts about OpenSSL (cryptography.io/en/latest/stat) are doing the rounds at the moment.

I've not touched OpenSSL directly in a long time. In fact, it appears that the 10-year anniversary of that (imperialviolet.org/2015/10/17/) passed by a few months ago!

So I've no direct comments on the piece but, a long time ago, I was in the position where I was landing changes in both OpenSSL and NSS (Mozilla's TLS library). OpenSSL was somewhat famous for having bad code. And, indeed, if you looked at it back then the functions were full of single-letter variable names with pointer arithmetic everywhere and context-free, somewhat scary comments. It wasn't outside the norm for 1990s C code, but I understand why people recoiled.

In contrast, if you looked at NSS code, it looked good! Consistent formatting (before clang-format), good naming, good comments.

But NSS had a PKCS#11 abstraction layer and, even after years, I never could understand how the control flow worked there. I would have to single-step in gdb every time to figure out where an operation grounded out into actual code. I was reminded of that when reading py/cryptography's descriptions of OpenSSL 3.0.

I had a pet theory at the time that, because OpenSSL was repulsive on the surface, it inhibited people enough that they couldn't add much deeper complexity. But NSS, with its invitingly clean-looking code, was understandable and then people had enough capacity left over to add deeper complexity.

There might be something to it, although you shouldn't discount the fact that entities who are willing to fund cryptography libraries often have demands that are contrary to clean code. Things like FIPS compliance and compatibility with a zoo of different accelerators and bespoke needs.

So rather it might have been that old OpenSSL was old OpenSSL because it was mostly unfunded. That meant that it looked pretty ragged, but also there weren't so many demands in tension with good design.

NSS was funded by interests that really cared about PKCS#11 compatibility so that you could use a super-expensive, certified-everything HSM with it. When OpenSSL got shocked into switching to a higher-funding model, that brought lots of those same sorts of competing interests, and then the incentives pointed towards adding slow, impenetrable layers of abstraction all over.

0
0
1
1
0
1
0
0
1
0
0
0

Jeff Bezos is saying the quiet part out loud. They want to kill local computing.

You will own nothing and be happy. You will rent your computing power from the cloud. You pay a subscription for the privilege of using a computer.

AI demand is artificially spiking DRAM prices and Big Tech is pushing "AI PCs," the squeeze is on to force us into a rental model.

Reject this future. :NoAI:

Keep your hardware local.

Run . :tux:

Own your data.

The "cloud" is just a landlord for your data.

windowscentral.com/artificial-

0
0
2
0
1
0
0

New music!

"Just Walk Away" is now live — that's me (@hisham_hmHisham) and my friend Chico, we share lead vocals and performed all instruments. (Detailed credits on the Bandcamp page!)

We're especially looking forward to getting some feedback. To your ears, what does it sound like?

Here's some links:

Bandcamp: signifierproject.bandcamp.com/

Deezer: link.deezer.com/s/32agiT6WpybS

Spotify: open.spotify.com/album/7IAI6i1

...and everywhere and anywhere you can find "Signifier - Just Walk Away"!

Single cover for "Just Walk Away", by Signifier. A first-person view of a car driver, going down an open road in southern Brazil.
0
1
0
0
0
0
0

News release: Privacy Commissioner of Canada expands investigation into social media platform X following reports of AI-generated sexualized deepfake images - Office of the Privacy Commissioner of Canada priv.gc.ca/en/opc-news/news-an

0
0
0
0
0
0
0
0

차별금지법이 발의되었습니다. 그런데 지금ㅠㅠ 반대는 조직적입니다. 찬성은 연대가 필요합니다. 📌 nuli.do/NFVi 의견등록으로 함께해 주세요🙏 정말 간단합니다. ① 회원가입 · 로그인 ② ‘의견등록’ 클릭 차별 없는 세상을 함께 만듭시다. 이제 우리가 움직일 차례입니다.

<차별금지법 제정>
반대는 조직적입니다.
찬성은 연대가 필요합니다.

지금, 의견을 남겨 주세요.(찬성을 넣어 제목 달아주세요!)
차별 없는 세상을 함께 만듭시다.<차별금지법 제정>
22대 국회에서 처음으로
차별금지법이 발의되었습니다.

그런데 지금,
반대 의견이 조직적으로 쏟아지고 있습니다.<차별금지법 제정>
국회입법예고에
'반대합니다'가 연속으로 등록되고 있습니다.

반대 전체 8,524건
찬성 전체 944건
(1/15 10:00 기준)<차별금지법 제정>
의견등록으로 함께해 주세요🙏
정말 간단합니다.
① 회원가입 · 로그인
② ‘의견등록’ 클릭
0

The recording of the January 15th, 2026 Production User Call is up:

youtu.be/vOZam9RA-bA

We discussed the EDK2 port update, virtio-scsi improvements, Windows NVMe driver surprises, bhyvectl(8) IPC changes, Unix domain socket support for the frame buffer, MAJOR unprivileged bhyve updates, MAJOR PCI hot-plug updates with demo, bhyve/ARM64 news, CPU pinning, ARC management, and more!

"Don't forget to slam those Like and Subscribe buttons."

You can support all Call For Testing efforts via BSD Fund: bsdfund.org

0
1
0

All of these things can be true:
- Wikipedia needs money
- Wikipedia infra needs relief
- it is a commons-like resource
- that means everyone is free to use it
- but it implies that nobody destroys it
- and that everybody pitches in to help
- AI companies are more damaging than they help
- if they want to support, they can donate
- no enterprise license agreement required
- I don’t feel great about my contribs being licensed to the internet-strip-mine moguls (even though they get the data anyway)
- I’m sure I’m just naïve and don’t understand big business
- what a bummer for what should be an unbridled quarter century party

0
1
1
1

🚀 Heute startete die AWS European Sovereign Cloud in Potsdam & wir waren als BSI vor Ort.

Denn: Wir unterstützen den US-Cloud-Anbieter Amazon Web Services (AWS) bei der Ausgestaltung von Sicherheits- & Souveränitätsmerkmalen seiner European Sovereign Cloud (ESC).

Zur Pressemitteilung:
👉️ bsi.bund.de/dok/1190346

🎬️ Ein Statement unserer Präsidentin Claudia Plattner gibt's im Video.

0