Hacker News: somebudyelse

New comment by somebudyelse in "Raspberry Pi 5 – 16GB RAM"

somebudyelse — Thu, 11 Jun 2026 03:05:32 +0000

Earliest snapshot from IA is $120. That's almost 3x increase since then. I knew the component shortage was bad but not this bad.

https://web.archive.org/web/20250529094904/https://www.adafr...

New comment by somebudyelse in "CBP Directive 3340-049B: Border Search of Electronic Devices"

somebudyelse — Sun, 24 May 2026 21:23:42 +0000

Don't think this is anything new? Have seen various cases from years ago where they searched texts to determine if the person was planning on working or visiting.

Edit: the first directive apparently was from 2009: https://www.jdsupra.com/legalnews/new-policy-for-device-sear...

QEMU CXL Escape

somebudyelse — Fri, 15 May 2026 18:39:41 +0000

Article URL: https://github.com/v12-security/pocs/blob/main/qemu/README.md

Comments URL: https://news.ycombinator.com/item?id=48152205

Points: 3

# Comments: 0

New comment by somebudyelse in "Incident Report: CVE-2024-YIKES"

somebudyelse — Mon, 11 May 2026 02:15:41 +0000

If you really want to make sure that it's the right thing (because piping to sudo bash is risky), make sure the URL starts with "pastebin", or ends in ".tk", or is an IP address.

New comment by somebudyelse in "Incident Report: CVE-2024-YIKES"

somebudyelse — Sun, 10 May 2026 19:55:18 +0000

Too soon

New comment by somebudyelse in "You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)"

somebudyelse — Sat, 09 May 2026 01:50:57 +0000

Let's see... That's 4 Linux LPEs in the last 10 days?

Copy Fail [1]

Copy Fail 2: Electric Boogaloo [2]

Dirty Frag [3]

And now this...

[1]: https://copy.fail

[2]: https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boo...

[3]: https://github.com/V4bel/dirtyfrag

New comment by somebudyelse in "Canvas is down as ShinyHunters threatens to leak schools’ data"

somebudyelse — Fri, 08 May 2026 02:49:19 +0000

It looks like Instructure has been removed from the ShinyHunters website. Both the entry and the list of schools has been removed.

New comment by somebudyelse in "Canvas online again as ShinyHunters threatens to leak schools’ data"

somebudyelse — Fri, 08 May 2026 02:48:30 +0000

Somewhat similar vein, the school's blocking software would block YouTube and embeds unless they came from Canvas. They were smart enough to disable the HTML editor for posting discussion comments, but forgot that since it was a rich text editor, you could just copy-paste in an embed by putting the code in data:text/html, then copying the element as formatted html.

I also ran the entire DOMPurify sample XSS and managed to find one way to download custom content onto someone's computer.

New comment by somebudyelse in "Canvas is down as ShinyHunters threatens to leak schools’ data"

somebudyelse — Fri, 08 May 2026 00:33:08 +0000

It looks like Instructure has been removed from the ShinyHunters website. Both the entry and the list of schools has been removed.

New comment by somebudyelse in "I decompiled the White House's new app"

somebudyelse — Sat, 28 Mar 2026 17:42:23 +0000

The only permissions on the play store are notifications. On data privacy, it only shows optional email or phone number. Respectfully, I call BS.

New comment by somebudyelse in "I decompiled the White House's new app"

somebudyelse — Sat, 28 Mar 2026 17:37:58 +0000

As someone who has an MDM-managed device, I beg to differ. Although, this one uses newer style android MDM, which involves factory resetting and doing special things during OOBE. Even if it used the older style, nothing's stopping the app for requesting file access, notification access, etc. and not working until you grant the permissions.