Hacker News: asddubs

New comment by asddubs in "Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure"

asddubs — Fri, 23 Oct 2026 02:29:00 +0000

I got a lot of these as far as my logs go back (which is the 17th also). I don't really think it means anything, just scanning for other vulns, as happens all the time. My server did not get pwned.

New comment by asddubs in "There isn't an easy exploit for this PHP vulnerability"

asddubs — Thu, 22 Oct 2026 16:01:46 +0000

There wasn't any info on the exploits beyond hearsay and the claim that they're very serious, so the risk assessment, sober or not, boils down to "do I trust the PHP people when they claim this is very serious"

New comment by asddubs in "Today's PHP security release, and how we're strengthening security"

asddubs — Thu, 22 Oct 2026 12:42:11 +0000

I don't think this is right, I got requests like that from the 17th already (and that's just as far as my logs go back). And yes, with spoofed UAs to say grokbot, claudebot, etc., but I've been getting bot traffic like that for a while. I don't think these are really agents because the same ip will switch UAs between requests.

New comment by asddubs in "There isn't an easy exploit for this PHP vulnerability"

asddubs — Thu, 22 Oct 2026 01:23:24 +0000

ease is somewhat relevant initially, since it determines how quickly you have to patch before exploits start popping up. I would be extremely curious to see if anyone has been pwned by this already, especially before the public release of the patches (not that I doubt it, but I heard some people saying they saw attempts in their logs, but not really enough information to tell whether they were understanding their logs correctly. The situation just seems a bit murky and unclear to me).

New comment by asddubs in "There isn't an easy exploit for this PHP vulnerability"

asddubs — Thu, 22 Oct 2026 00:37:03 +0000

Do you have any links to a working PoC that appeared before the details were released? I'm seeing a lot of conflicting info, and I'm not really sure what to think. People saying they were seeing people trying to exploit this hours ahead of the patch release on their servers, yet no one who seemingly actually got pwned by it (were people just misreading their logs?)

New comment by asddubs in "I posted to HN, and then my website was flooded with AI bot traffic"

asddubs — Wed, 14 Oct 2026 02:21:12 +0000

doesn't fix the issue

New comment by asddubs in "I hired an illustrator to draw my house. Now it's my Home Assistant dashboard"

asddubs — Fri, 09 Oct 2026 13:51:13 +0000

I think the reason artists wouldn't like hobbyists doing it either is just that they've been soured on it by corporations. Artists didn't reject AI in its infancy, or things like deepdream. But AI as it stands very clearly is exploitative, and what's more, it's flooded spaces formerly for human art with low quality generic garbage. Having those experiences bleeds over into your feelings about things that don't match the exact definition of the reason you're upset to begin with.

New comment by asddubs in "Shipping JPEG XL in Chrome"

asddubs — Wed, 07 Oct 2026 18:25:25 +0000

well, lepton doesn't have browser support. I'm not married to jxl specifically, I just want something in the browser with those features, and jxl fills that niche

New comment by asddubs in "Shipping JPEG XL in Chrome"

asddubs — Wed, 07 Oct 2026 16:35:19 +0000

biggest advantage for me is file size and lossless conversion of existing jpg images. In a network scenario that can meaningfully impact load times. Others will care about e.g. bit depth

New comment by asddubs in "Creepy Crawlies"

asddubs — Mon, 31 Aug 2026 01:31:51 +0000

I run a non source code service and I also get these, also getting hit by literally millions of residential IPs being cycled after 1 - 2 hits. Ingesting thousands of copies of near identical pages. The bots seem to be programmed in an extremely simple manner, using non-obfuscated javascript to write the href attribute seems to stop them from seeing links, where previously they would endlessly crawl generated links. Unfortunately it also means noscript users get shafted.

New comment by asddubs in "“I just chose words carefully”"

asddubs — Mon, 31 Aug 2026 01:16:40 +0000

and in latex too, not just monospace

New comment by asddubs in "Firefox 157 will include JPEG XL by default on all platforms"

asddubs — Sun, 30 Aug 2026 11:05:47 +0000

I don't even really expect them to save to webp necessarily, but they should at least be able to open it. No matter what tool you use, opening an image you copied from the internet has got to be a common use case.

New comment by asddubs in "Bug Blindness"

asddubs — Sun, 30 Aug 2026 10:56:03 +0000

I guess even with the physical buttons you had to just learn that triangle means play and twin towers means pause

New comment by asddubs in "Bug Blindness"

asddubs — Sun, 30 Aug 2026 10:54:36 +0000

I've seen an SD card icon used for a save icon before. I think conveniently the shape is similar enough to a floppy that you find it while scanning for it as well

New comment by asddubs in "Firefox 157 will include JPEG XL by default on all platforms"

asddubs — Wed, 26 Aug 2026 11:42:13 +0000

two thirds of graphics software doesn't even support webp yet. it doesn't look good

New comment by asddubs in "Firefox for iOS now has a native adblocker"

asddubs — Sun, 16 Aug 2026 23:51:28 +0000

i only wish updates weren't tied to OS version

New comment by asddubs in "I requested a copy of my data from McDonald’s loyalty program"

asddubs — Thu, 13 Aug 2026 22:27:30 +0000

the shift managers are the ones under pressure, who are front line employees, they do the same work as the regular employees plus a bit extra and earn maybe $17 an hour instead of 15.

New comment by asddubs in "CFTC declares market emergency, orders Kalshi to continue to operate in New York"

asddubs — Wed, 12 Aug 2026 01:10:31 +0000

I think you are right that it's all gambling. Kalshi seems more predatory in how it targets people. Perhaps advertising gambling in any way should be outlawed.

New comment by asddubs in "So Reddit has decided that plain HTML is unsafe"

asddubs — Fri, 24 Jul 2026 12:08:56 +0000

Like I said, I also prefer the old.reddit UI, I was more speaking about the general case that user feedback isn't always a good indicator depending on what you're trying to do (especially early in a platforms life, when you'll have much more future users than current users)

New comment by asddubs in "So Reddit has decided that plain HTML is unsafe"

asddubs — Thu, 23 Jul 2026 20:07:21 +0000

My point is that it's not an objective measure of design quality, i.e. how well does a person who hasn't used the software before use it, or how quickly do they learn it. Whether that matters more than your existing users is up to you