(I use Firefox, but I've read your post before the linked post and I thought ublock Origin is the one being killed)

Well I use tab completion, of course. And I copy-paste snippets from LLM more often than from SO now. But otherwise not much has changed in my career in the last 5 years. Is this different for you?

I'm not fundamentally opposed to code generation, and I use LLMs for some taks, but I don't see myself vibecoding whole pages of production code. I vibecoded a throwaway note-taking app for myself though.

I'm all for self-hosting btw, we do it at my company. But it's not as easy as you make it sound.

This is something that you assume, not something that you have any proof of. To put it a bit more strongly, this is something that you (and hundreds of other people in that github thread) made up in your head. The maintainer is a very experienced OS developer and there's no reason to suspect they didn't review the committed code.

Bugs happen, and the mere existence of bugs is not a proof that someone is doing a poor job. Assuming those bugs even exist. I am inclined to believe they do, but the issue does a poor job of reporting them. Instead of factually reporting regressions, the "issue" is a screenshot of a viral tweet.

Your vicious reaction is not justified, and you should do better in the future.

>The effort put into the issue was roughly the same as was put into the release that caused the issue to be made. Fair is fair.

It is not fair. The rsync maintainer does not owe you anything. You owe them for using their software. How much did you donate to rsync this year?

Root cause was a shared library (Szafir SDK) used by many Polish commercial and public institutions. It implemented login with Polish e-signature (qualified certificate), but the library API was so convoluted that basically nobody used it correctly (registered as CVE-2026-9058 by Polish CERT: https://cert.pl/en/posts/2026/05/CVE-2026-9058/). This allowed complete login bypass to affected institutions, most importantly ZUS (universal Social Insurance system), official online labor/employment portal, and many online court and universal healthcare systems.

Unfortunately I couldn't find anything about it in English, so you need to use your favourite translator.

Shorter and more to the point version (summary for journalists) is https://zaufanatrzeciastrona.pl/post/podsumowanie-krytyczna-...

Comments URL: https://news.ycombinator.com/item?id=48271721

Points: 3

# Comments: 1

I just wanted to say thank you for making it, it was really important for me when exploring music back in 2010s. It was also great to see the "big picture" of metal genres, and start the long journey down the rabbit hole.

In a fun turn of events, I showed this to my wife just a few days ago, to show what I was up to when I was younger. And now less than a week later this is submitted to HN. Fun coincidence.

I don't mean that everyone must know what CTF is, but sometimes it's OK to write things just for your community (CTF community in this case), not for general population.

edit: I googled a bit and PEP8 explicitly says "Thus class_ is better than clss". and "single_trailing_underscore_: used by convention to avoid conflicts with Python keyword, e.g..."

The fourth form is the mangling used for __x names internally (__x field in class Foo is actually _Foo__x

I don't know where GP saw sixth form, but considering all other forms are from real-world usage, someone probably uses it too.

I am pretty sure everyone who works in security agrees that obscurity is not security.

[1] https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

Comments URL: https://news.ycombinator.com/item?id=47819391

Points: 2

# Comments: 1

Sounds good, except:

* scripting languages exist. The situation is even worse on Linux than on Windows (because of the sysadmin focus). You need at least /bin/sh installed and runnable on any POSIX system. In practice bash, python, perl and many more are also always available.

* exploits exist. Just opening a pdf file may execute arbitrary code on a machine. There is no way to avoid that by just configuring your system. And it will happen sooner or later, especially if nation states are involved.

The idea that your systems are somehow unhackable because you... mount everything W^X is... not based in reality. Of course it's a great idea, but in practice you need defense in depth, and you need to have a way to Detect and Respond to inevitable Endpoint breaches. I don't love EDR/AVs, but they mitigate real attacks happening in the real world.