What is Hackers' Pub?

Hackers' Pub is a place for software engineers to share their knowledge and experience with each other. It's also an ActivityPub-enabled social network, so you can follow your favorite hackers in the fediverse and get their latest posts in your feed.

I recently came across an interesting video about a method for identifying AI-generated art. I thought it was worth sharing:

youtube.com/watch?v=Xxui8MoUJ5k

TLDW: Increasing the saturation and luminosity of an AI-generated image reveals artefacts, even in solid-coloured areas.

However, I'm not sure how reliable this method is, since a very similar effect can be observed in JPEGs with medium to high compression. I'd love to hear from anyone who can shed some light on this (pun not intended)!

0
0
0

ActivityPub standardization is back! The just announced a new Working Group to evolve and and related standards! This is extremely good news. It's not like all the world's federated social media protocol problems were already solved! lists.w3.org/Archives/Public/p

0
0
0
1
1
0
0
0
2

There's still time to submit to which is on at the end of this month. It's a safe, virus-free online conference for sharing ideas about Free and Open Source Software and Culture.

Participating in @fluconf is free, and anyone can submit something: a video, an article or blog post, a livestream, a song, a poem or whatever fits the conference themes.

No AI/LLM slop. Just humans sharing ideas.

Read more here:

fluconf.online/

0
0
0

ไปŠๅคฉๆ˜ฏๅผŸๅชณ็”ขๅพŒD23๏ผŒๅœจๆ˜จๅคฉๅค–ๅ‡บ็”จ้ค็š„็พŽ้บ—้–’ๆš‡ไน‹ๅพŒ๏ผŒๆˆ‘ๅ€‘ๅˆๅ›žๅˆฐๆ—ฅๅธธใ€‚ไปŠๅคฉๆˆ‘่ซ‹ๆฑ‚ๅผŸๅผŸๅ’ŒๅผŸๅชณๅนซๆˆ‘็œ‹ไธ€็ต„่ถ…่ฒด็š„ๅพทๅœ‹ๅ“็‰Œ่ผช้‡็ต„๏ผ›ไธป่ฆๆ˜ฏๅœจ้™„่ฟ‘็š„ๆ‰‹ไฝœๅบ—่ˆ–ๆฒ’็œ‹ๅˆฐๆžถไธŠๆœ‰้™ณๅˆ—๏ผŒๆˆ‘ๅฐฑๆ”นๆ‰“็ถฒ่ณผ็š„ไธปๆ„๏ผŒ็™ผ็พๆ‰‹ไฝœๅบ—็š„ๅฎ˜็ถฒ้›–็„ถๆœ‰่ณฃ๏ผŒไฝ†ๅƒนๆ ผๆ˜ฏโ‚ฌ189ๅ’Œๅฐ็ฃๅ”ฎๅƒนๆฒ’ๅทฎๅพˆๅคš๏ผŒ็ถฒ่ทฏไธŠๆœ‰ๅ…ถไป–ๅ•†ๅบ—่ณฃๅˆฐโ‚ฌ148้€™ๆจฃ็š„ไฝŽๅƒน๏ผŒ่ซ‹ๅผŸๅชณๅนซๆˆ‘็ขบ่ชๆ‡‰่ฉฒไธๆ˜ฏ่ฉ้จ™็ถฒ็ซ™๏ผˆๅฅน็š„ๅพทๆ–‡ๆฏ”ๆˆ‘ๅผŸๅˆๅฅฝไธŠไธๅฐ‘๏ผŒไนŸๅœจๆ…•ๅฐผ้ป‘็”Ÿๆดปๆ›ดไน…๏ผŒๆ›ดๆ‡‚้€™่ฃก็š„ใ€Œๆฐ‘ๆƒ…ใ€๏ผ‰ๅพŒ๏ผŒๆˆ‘ๅฐฑ่ซ‹ๅผŸๅผŸๅนซๆˆ‘ไธ‹ๅ–ฎใ€‚ๅผŸๅผŸๅพˆ้˜ฟ่ŽŽๅŠ›ๅœฐๅˆทไบ†ไป–็š„ๅก๏ผŒ่ชช็ฎ—ๆ˜ฏๅฐๆˆ‘็š„ๆ„Ÿ่ฌไน‹ๆƒ…ใ€‚

ไพ†้€™่ฃกๅพŒ๏ผŒๆˆ‘ๅธธๆƒณ้€™ๅ€‹ๅ•้กŒ๏ผš่ฒ ่ฒฌๅคง้ƒจๅˆ†ๅฎถๅ‹™็š„้‚ฃๅ€‹ๅฎถไบบ๏ผŒ่ฆๅฆ‚ไฝ•ๆ‰่ƒฝไธ่ฆบๅพ—่‡ชๅทฑ่ขซ็•ถๆˆๅนซๅ‚ญ๏ผŸ่€Œ็•ถ้‚ฃ้บผๅคšไบบ่ชชๆœƒๅฐ‡ๅนซๅ‚ญ็•ถๆˆๅฎถไบบ๏ผŒๅˆๆ˜ฏๆ€Žๆจฃๆ‰็œŸๆญฃ่ฎ“ไบบๆ„Ÿๅˆฐใ€Œ่ขซ็•ถๆˆๅฎถไบบใ€๏ผŸๅœจๆˆ‘ไพ†ไน‹ๅ‰๏ผŒๅผŸๅผŸๅฐฑๆ›พ่จด่ชช่ฒ ่ฒฌๆฏๆ—ฅ้ค้ฃŸๆ˜ฏๅคš้บผ่พ›่‹ฆ๏ผŒๆˆ‘ๅฏฆ้š›ๅƒ่ˆ‡ๅพŒ๏ผŒ่ฆบๅพ—ๅปšๆˆฟๅทฅไฝœ็œŸ็š„่ฎ“ไบบๆ„Ÿๅˆฐไธ€ๆ•ดๅคฉๅฝทๅฝฟ้ƒฝๅœจ็‚บไบ†ใ€Œๅƒใ€้€™ไปถไบ‹ๅœจๅ‹žๅ‹•๏ผŒ่€Œไธ€ๅ€‹้ฃ„้ฃ„็„ถๅฟ˜ไบ†ๆƒณใ€Œไธ‹ไธ€้คๆ˜ฏไป€้บผใ€๏ผŒๅฐฑๆœƒ่ฎ“็”Ÿๆดป็ฏ€ๅฅๆމๆ‹ใ€‚๏ผˆไปŠๅคฉไธญๅˆๆˆ‘ๅฐฑๅ› ็‚บๅฟ˜่จ˜ๆบ–ๅ‚™๏ผŒ่ฒทไบ†้บฅ็•ถๅ‹žไพ†ๅƒ๏ผ‰ๅœจๅค–้ฃŸใ€ๅค–้€ๅฆ‚ๆญคๆ˜‚่ฒด็š„ๅœ‹ๅบฆ๏ผŒๅฎถๅ‹™็š„่จˆๅƒนๆ‡‰่ฉฒๆ›ด้ซ˜๏ผŒๅ› ็‚บ่ฒ ๆ“”็ขบๅฏฆๆ›ด้‡ใ€‚

ๅฐ็ฃ็š„ไพฟๅฎœไบบๅŠ›่ฎ“ๅฎถๅ‹™ๆ›ดๅฎนๆ˜“ๅค–ๅŒ…๏ผŒ้€™่ฃก็š„ๆ˜‚่ฒดไบบๅŠ›ๅป่ฟซไฝฟไบบๅ€‘ๆ›ด่Šฑๆ™‚้–“ๅœจ็”Ÿๆดปใ€‚

0
0
0
0

Running Mastodon on FreeBSD? Stop using wrapper scripts that break service status.

I've refactored the init scripts for Sidekiq, Puma, and Streaming to be fully production-grade:

- Clean privilege dropping (no su wrappers)
- Native signal handling for log rotation
- Correct PID tracking & status reporting.

I published the scripts and the reasoning behind them in my Codeberg gists:

codeberg.org/Larvitz/gists/src

I use those to run a Mastodon instance and they're working great so far!

:freebsd_logo: โค๏ธ ๐Ÿฆฃ

Screenshot showing the service status of several Mastodon services on FreeBSD
0
0
0
0
0
0
2
0
1
0
0
0

"an extraordinarily interesting video that touches on a load of great topics"

No, really! Someone just wrote this comment about my conversation with Marco.

This gives you an idea what it would be like to work with me. What do you think?

(Watching myself is nerve-wracking and sometimes even cringe, but I'm really quite happy with this one!)

youtube.com/watch?v=j0NjFsb-at8

0
1
0
1
1
0
0
0

It seems that py/cryptography's thoughts about OpenSSL (cryptography.io/en/latest/stat) are doing the rounds at the moment.

I've not touched OpenSSL directly in a long time. In fact, it appears that the 10-year anniversary of that (imperialviolet.org/2015/10/17/) passed by a few months ago!

So I've no direct comments on the piece but, a long time ago, I was in the position where I was landing changes in both OpenSSL and NSS (Mozilla's TLS library). OpenSSL was somewhat famous for having bad code. And, indeed, if you looked at it back then the functions were full of single-letter variable names with pointer arithmetic everywhere and context-free, somewhat scary comments. It wasn't outside the norm for 1990s C code, but I understand why people recoiled.

In contrast, if you looked at NSS code, it looked good! Consistent formatting (before clang-format), good naming, good comments.

But NSS had a PKCS#11 abstraction layer and, even after years, I never could understand how the control flow worked there. I would have to single-step in gdb every time to figure out where an operation grounded out into actual code. I was reminded of that when reading py/cryptography's descriptions of OpenSSL 3.0.

I had a pet theory at the time that, because OpenSSL was repulsive on the surface, it inhibited people enough that they couldn't add much deeper complexity. But NSS, with its invitingly clean-looking code, was understandable and then people had enough capacity left over to add deeper complexity.

There might be something to it, although you shouldn't discount the fact that entities who are willing to fund cryptography libraries often have demands that are contrary to clean code. Things like FIPS compliance and compatibility with a zoo of different accelerators and bespoke needs.

So rather it might have been that old OpenSSL was old OpenSSL because it was mostly unfunded. That meant that it looked pretty ragged, but also there weren't so many demands in tension with good design.

NSS was funded by interests that really cared about PKCS#11 compatibility so that you could use a super-expensive, certified-everything HSM with it. When OpenSSL got shocked into switching to a higher-funding model, that brought lots of those same sorts of competing interests, and then the incentives pointed towards adding slow, impenetrable layers of abstraction all over.

0

This style of management is way too common in the tech industry. I call it Star trek management.

We've all seen it. Captain calls down to engineering. "How long to get the warp core back online" and engineering replies "12 hours sir". "You've got 1" comes the response from the captain.

And there's a place for that sort of thing. When you're dead in the water and the Borg might come back to attack at any minute.

But, for it to be routine is just bad management

1/n

mastodon.bsd.cafe/@stefano/115

Stefano Marinelli (@stefano@bsd.cafe)

UPDATE: I just had a talk with two of the owners (whom I've known for years) and one of the young developers who was on yesterday's call. She confirmed that this manager's behavior was unmanageable. High-strung and narcissistic, he had apparently been let go from his previous company due to his inability to work with colleagues and owners alike. It seems he was even trying to boss the owners around. To make a long story short, the entire sysadmin team threatened to quit if I stopped collaborating with the company. As a result, the owners summoned the manager in the late morning, and he resigned. They are reverting to the previous management structure (led by one of the owners). They might drop a few projects, but they said they prefer returning to a more "human" way of running the business - which is what always set them apart in the past. I told them I'll think about it. If things are truly as they say (and I have no reason to doubt them yet), I'll propose a 6-month trial collaboration to see how things actually evolve. I'm aware it's easy to "pass the buck" - was it really just the manager's fault, or are the owners using him as a scapegoat now that things went south? However, given our history, I'm willing to give them the benefit of the doubt for now. UPDATE: One of the company owners (whom I've known for many years and is a good person) has asked to speak with me in about fifteen minutes. I've agreed. I'm curious to see what he has to say. I'll update this post after the call. Original post: Yesterday I lost a client. And I couldn't be happier about it. It's a long-standing client, but the management changed a few months ago. On Monday, they requested an emergency intervention, which I handled immediately. On Tuesday (yesterday, evening), they asked for a non-urgent enhancement to be closed by Wednesday evening. I explained that due to various reasons (including urgent family matters), I wouldn't be able to finish the task before Friday. That's when the lecturing started: they told me they set tight deadlines even for non-emergencies because "that's the proper way to do things", and anyone working with them must respect them without exception. I requested a video call to clarify. I explained that the work requires nearly a full day and that I simply couldn't close it by Wednesday. Even the physical time required to copy the data exceeded their deadline. But the new management believes that by applying pressure, you can overcome anything. Even the laws of physics. Their response was sarcastic: "Our requests take priority, even if you are dying". I smiled and reiterated that I had no other way. "We will therefore have to find a new consultant who respects our timing", they said. My response: "Okay. Our agreement expired on 31st December. I was waiting for a renewal, but it never arrived. Meaning, I have no legal obligations toward you. You have the data, the passwords, everything. Have a great day.". The manager, annoyed and failing to understand the implications, replied: "Fine, weโ€™ll look for someone younger with fewer family ties to manage.". This morning, the phone rang. It was the manager, asking me to reconsider. His tone remained contemptuous, so I told him my decision was final. Two minutes later, I got a call from their biggest client - the one responsible for over 50% of their revenue. They had been notified I was leaving and informed the company they would also leave if I was no longer the one supervising their machines. I called the manager back, friendly, trying to see if they were willing to change their attitude - to move from peremptory orders to requests between human beings. He started talking about "suing for damages" if they lost their main client because of me (to be clear: I am not taking that client for myself). I donโ€™t know how this story will evolve, but right now, I'm just enjoying a breath of fresh air outside my window. #IT #FreelanceLife #WorkLifeBalance #ToxicManagement #TechLife #Consulting #SelfEmployed

mastodon.bsd.cafe ยท BSD.cafe Mastodon Portal

0
0
0
0
0

- ์บ์‹œํƒœ๊ทธ โ€ข ํ•ด์‹œํƒœ๊ทธ์ฒ˜๋Ÿผ ์“ฐ์ง€๋งŒ ์ฃผ์‹๊ณผ ๊ด€๋ จ๋œ ์ด์•ผ๊ธฐ๋ฅผ ํ• ๋•Œ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. โ€ข ๊ฒŒ์‹œ๋ฌผ์— , ๋“ฑ ์›ํ•˜๋Š” ํƒœ๊ทธ๋ฅผ ๋‹ฌ์•„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. (ํ•œ์ •์  ์ง€์›์œผ๋กœ ๋ชจ๋“  ๋ฌธ์ž์—์„œ ์ ์šฉ๊ฐ€๋Šฅํ•˜์ง„ ์•Š์Œ) โ€ข์บ์‹œํƒœ๊ทธ๋ฅผ ํƒญํ•˜๋ฉด ๋‹ค๋ฅธ ์‚ฌ๋žŒ๋“ค์˜ ์ „๋ฌธ์„ฑ ์—†๋Š” ๋ถ„์„์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. (2/2)

RE: https://bsky.app/profile/did:plc:z72i7hdynmk6r22z27h6tvur/post/3mcibiyf7fs2r

0

๐Ÿ“ข ๋ธ”๋ฃจ์Šค์นด์ด v1.114 ์—…๋ฐ์ดํŠธ - '๋ผ์ด๋ธŒ ์ค‘' ๋ฒ ํƒ€ ๊ธฐ๋Šฅ์„ ๋ชจ๋“  ์‚ฌ์šฉ์ž์—๊ฒŒ ํ™•๋Œ€ ์ œ๊ณต โ€ข ์ด ์‹คํ—˜์  ๊ธฐ๋Šฅ์„ ํ†ตํ•ด ์•„๋ฐ”ํƒ€์— ์ž„์‹œ '๋ผ์ด๋ธŒ' ๋ฐฐ์ง€๋ฅผ ์ถ”๊ฐ€ํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ด๋ฅผ ํ†ตํ•ด ๋‹ค๋ฅธ ์‚ฌ์šฉ์ž๋“ค์ด ํ˜„์žฌ Twitch์—์„œ ์ƒ๋ฐฉ์†ก ์ค‘์ž„์„ ์•Œ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค ๊ทธ๋ฆฌ๊ณ  ์ด ๋ฐฐ์ง€๋ฅผ ํด๋ฆญํ•˜๋ฉด ์ŠคํŠธ๋ฆผ ํŽ˜์ด์ง€๋กœ ๋ฐ”๋กœ ์ด๋™ ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค. โ€ข ๋ฒ ํƒ€ ๊ธฐ๊ฐ„ ๋™์•ˆ '์ง€๊ธˆ ์ƒ๋ฐฉ์†ก ์ค‘'์€ ํ˜„์žฌ Twitch ๋งํฌ๋กœ๋งŒ ์ œํ•œ๋ฉ๋‹ˆ๋‹ค. ๋ฒ ํƒ€ ์šด์˜์„ ํ†ตํ•ด ์–ป์€ ๊ฒฝํ—˜์„ ๋ฐ”ํƒ•์œผ๋กœ ๋‹ค๋ฅธ ์ŠคํŠธ๋ฆฌ๋ฐ ํ”Œ๋žซํผ ์ง€์›๋„ ์ถ”๊ฐ€๋  ์˜ˆ์ •์ž…๋‹ˆ๋‹ค. (1/2)

RE: https://bsky.app/profile/did:plc:z72i7hdynmk6r22z27h6tvur/post/3mcibezwvxk2g

0

:BoostOK: Please share
I need your help: For an investigation into dating app algorithms, I am looking to get in touch with developers and others who work/have worked for such providers and would be willing to talk to me. Anonymous responses are also welcome. Questions include: What mechanisms are used to keep users on the platform? What ideas/constructs of partnership/matching are embedded in the algorithm? Please share widely! Thank youโค๏ธ
Anonymous and other contact options: see bio.

0
0
0
1
1
0
0
0
0
1

Do you know any new open source projects that deserve recognition?

Projects that are:
- Solving real world problems and driving technical innovation
- Improving science, research or medicine
- Challenging long standing platforms or paradigms
- Just super nerdy and doing something novel!

If you do, please share them and perhaps we can help them get the attention they deserve. ๐Ÿงก

0
0
0
0
1
0

Question: when did security analysts start describing leveraged exploit paths as "primitives"? Did this start with the FORCEDENTRY JBIG2 exploit or does this terminology have a longer history, maybe in gadget-based exploitation?

projectzero.google/2026/01/pix

0

Diesen Hinweis kรถnnte die Bahn eigentlich gleich bei jeder meiner Buchungen dazu schreiben. Ganz im Ernst. Das ist sooo frustrierend. (Ich habe so lange รผberlegt, ob ich *noch* frรผher los soll, um meinen Termin zu schaffen - aber der Zug war pรผnktlich, es gab genug Puffer und irgendwie dachte ich naiverweisw, dass ich ja auch EINMAL Glรผck haben kรถnnte.

DB Navigator
โ€žAufgrund von aktuellen Ereignissen ist die Verbindung nicht mehr fahrbar. Bitte suchen Sie sich eine neue Verbindung fรผr Ihre Reise.โ€œ

Heute ist es so richtig schief gegangen mit der Bahn. Selbst fรผr meine Verhรคltnisse. Ich hatte eine Verbindung mit gut Umsteigezeit und Puffer. Die oft auch funktioniert: Sprinter Berlin- Nรผrnberg, Intercity bis Aalen (und dann RE nach Oberkochen zu einem Termin). Ich hab drei Anschlรผsse verpasst und musste am Ende vom vorletzten Bahnhof abgeholt werden, um nur zwei Stunden zu spรคt zu sein.
Ich frage mich, wie Leute unter diesen Bedingungen รผberhaupt irgendwo ankommen.

0
0
1
0