frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Pacsea – new package manager for Arch Linux

https://github.com/Firstp1ck/Pacsea
1•ssummoner001•1m ago•0 comments

Show HN: Vect AI– The "Resonance Engine" for high-growth marketing

https://vect.pro/
1•asaws•1m ago•0 comments

The "Inhuman Centipede" and Identity

https://syntheticauth.ai/posts/synthetic-auth-report-issue-020#carbon-based-paradox
1•zerolayers•1m ago•1 comments

Saving Skylab

https://www.airandspace.si.edu/stories/editorial/saving-skylab
1•fanf2•3m ago•0 comments

AI-Assisted Coding Killed My Joy of Programming

https://meysam.io/blog/ai-assisted-coding-killed-programming-joy/
1•meysamazad•3m ago•0 comments

Learn with Ari

https://arihara-sudhan.github.io/learn-with-ari/
1•arihara-sudhan•7m ago•0 comments

What is scalability anyway? (2024)

https://brooker.co.za/blog/2024/01/18/scalability.html
1•linhns•12m ago•0 comments

Digital Omnibus: Analysis of GDPR and EPrivacy Proposals by the Commission

https://noyb.eu/en/digital-omnibus-first-analysis-select-gdpr-and-eprivacy-proposals-commission
2•buzer•12m ago•0 comments

The Oceans Are Going to Rise–But When?

https://www.wired.com/story/the-oceans-are-going-to-rise-but-when/
3•Brajeshwar•12m ago•0 comments

Web dev's crawler took down major online bookstore by buying too many books

https://www.theregister.com/2025/12/01/who_me/
1•Brajeshwar•13m ago•0 comments

Zipcar proposes to cease its UK operations

https://support.zipcar.co.uk/hc/en-gb/articles/46980698921875-Zipcar-proposes-to-cease-its-UK-ope...
4•seasicksteve•13m ago•0 comments

College Students Choosing A.I. Majors over Computer Science

https://www.nytimes.com/2025/12/01/technology/college-computer-science-ai-boom.html
1•fleahunter•15m ago•0 comments

Plato's Republic as an iMessage Thread

https://pmohun.github.io/therepublic-txt/
1•pmohun•16m ago•1 comments

Google *Unkills* JPEG XL?

https://tonisagrista.com/blog/2025/google-unkills-jpegxl/
2•speckx•16m ago•0 comments

Show HN: Walrus – a Kafka alternative written in Rust

https://github.com/nubskr/walrus
2•janicerk•17m ago•0 comments

Evo-Memory: Benchmarking LLM Agent Test-Time Learning with Self-Evolving Memory

https://arxiv.org/abs/2511.20857
1•simonpure•18m ago•0 comments

Impacts of Cyclonic Storm Senyar viewed through Sentinel satellite imagery data

https://rtnf.substack.com/p/impacts-of-cyclonic-storm-senyar
2•altilunium•18m ago•0 comments

OpenAI Ads Are Coming

https://twitter.com/btibor91/status/1994714152636690834
2•deeptishukla22•20m ago•2 comments

Agentive SEO

https://agentiveseo.com/
1•bellamoon544•20m ago•3 comments

Alternatives to Police – Do They Work?

https://www.nominalnews.com/p/alternatives-to-police-do-they-work
2•MPLan•20m ago•1 comments

Upbit was hacked $37M Solana. How could we have hacked and protected it?

https://substack.bomfather.dev/p/upbit-hacked-37m-solana-how-would
4•nathannaveen•21m ago•0 comments

What's new at Stack Overflow: December 2025

https://stackoverflow.blog/2025/12/01/what-s-new-at-stack-overflow-december-2025/
2•quapster•22m ago•0 comments

ATP signal in the hippocampus may be a key driver of depression and anxiety

https://www.sciencedaily.com/releases/2025/11/251126025315.htm
1•mmaia•22m ago•0 comments

The World Still Hasn't Made Sense of ChatGPT

https://www.theatlantic.com/technology/2025/11/chatgpt-third-anniversary/685084/
2•voxleone•23m ago•0 comments

Prompt Injection Through Poetry

https://www.schneier.com/blog/archives/2025/11/prompt-injection-through-poetry.html
1•speckx•24m ago•1 comments

Washington Must Break Its Promise on Social Security

https://www.bloomberg.com/opinion/articles/2025-12-01/congress-must-save-social-security-from-ins...
1•toomuchtodo•26m ago•1 comments

Metaverse Solutions

https://www.accenture.com/us-en/services/metaverse
2•Klaster_1•26m ago•0 comments

Google, Nvidia, and OpenAI – Stratechery by Ben Thompson

https://stratechery.com/2025/google-nvidia-and-openai/
3•tambourine_man•26m ago•0 comments

I Went All-In on AI. The MIT Study Is Right

https://leadershiplighthouse.substack.com/p/i-went-all-in-on-ai-the-mit-study
2•gmays•27m ago•0 comments

Hasktorch: LibTorch Haskell bindings for deep learning using FFI

https://www.stackbuilders.com/insights/hasktorch-libtorch-haskell-bindings-for-deep-learning-usin...
2•StackBuilders•27m ago•0 comments
Open in hackernews

WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

https://obr.uk/docs/dlm_uploads/01122025-Investigation-into-November-2025-EFO-publication-error.pdf
36•robtaylor•44m ago

Comments

kingkool68•34m ago
What was the quirk?
cstuder•31m ago
> A feature known as the Download Monitor plug-in created a webpage with the clear URL which provided a link to the live version, which bypassed the need for authentication. This rendered the protections on the ‘future’ function of WordPress redundant as it bypassed the required authentication needed to gain access to the pre-uploaded document.

WordPress is a nice piece of software, but the plugin situation is getting worse and worse. (Too many pending updates, premium features and constant upselling, selling of plugins to new sketchy owners...)

withinboredom•23m ago
The main issue is that there isn't any governance to the plugin store. Once you have a plugin in there, you have free reign to do whatever you want with it. Getting it in there is a PITA though. For example, a library author and I created a plugin, but they wouldn't let me submit it because I wasn't the other author, and they wouldn't let him submit it because he wasn't me. True story.
kassner•14m ago
TBF there is some scrutiny on existing plugins, the team is just extremely understaffed (it’s ran by volunteers after all). I got involved in a plugin that ended up getting de-listed for some minor ToS violations after several years of being “fine”, they re-reviewed the plugin with the same rigor as a new submission.
devnull3•23m ago
> which provided a link to the live version

Even if that is the case, the backend must validate.

whycome•14m ago
My favorite current plugin woe is where it completely changes what it does but keeps the same name and it's all a part of its 'update'
chippiewill•11m ago
> WordPress is a nice piece of software, but the plugin situation is getting worse and worse

The plugin situation is a mess largely because Wordpress isn't a nice piece of software.

It's popular, and functionally it's great, but the codebase is really showing its age. Wordpress has never properly rearchitected because it would break plugins on a scale that would endanger its dominance.

kstrauser•8m ago
To an outsider, its entire plugin ecosystem is so odd. Like the conversation about “nulled” plugins, where someone removes license-checking code from GPL-licensed plugins and then redistributes them, and whether that’s moral, or even legal, which of course it is, because that’s the entire point of the GPL.
merrvk•27m ago
Why are government organisations which handle sensitive information using Wordpress?
jamesbelchamber•23m ago
There's not anything obviously wrong with using WordPress for publishing documents like this - they are meant to be public after all.

The problem was essentially that, through a misconfiguration, they published it early.

glenjamin•22m ago
There's a couple of passing mentions of Download Monitor, but also the timeline strongly implies that a specific source was simply guessing the URL of the PDF long before it was uploaded

I'm not clear from the doc which of these scenarios is what they're calling the "leak"

shawabawa3•7m ago
> but also the timeline strongly implies that a specific source was simply guessing the URL of the PDF long before it was uploaded

A bunch of people were scraping commonly used urls based on previous OBR reports, in order to report as soon as it was live, as it common with all things of this kind

The mistake was that the URL should have been obfuscated, and only changed to the "clear" URL at publish time, but a public was bypassing that and aliasing the "clear" URL to the obfuscated one

longwave•6m ago
It sounds like a combination of the Download Monitor plugin plus a misconfiguration at the web server level resulted in the file being publicly accessible at that URL when the developers thought it would remain private until deliberately published.
dazc•3m ago
https://obr.uk/docs/dlm_uploads/OBR_Economic_and_fiscal_outl... 5.pdf

Not hard to guess really. Wouldn't they know this was likely and simply choose a less obvious file name?

jamesbelchamber•17m ago
For those of you not closely following UK politics: the Office for Budget Responsibility (OBR) mistakenly published their Economic and Fiscal Outlook (EFO) document 40 minutes early, pre-empting the announcements by the Chancellor.

This is being treated as an incredibly big deal here: https://www.bbc.co.uk/news/articles/cd74v35p77jo

hdgvhicv•3m ago
In the popular press it’s been sidelined because it would distract from the continuous attacks on the chancellor
M2Ys4U•9m ago
>During that period, it was accessed 43 times by 32 unique IP addresses

I find this an implausibly low number. It was all over Bluesky, X etc., not to mention journo Signal and WhatsApp groups.

jamesbelchamber•4m ago
Possibly copies of the document rather than the original URL?
logicchains•3m ago
Maybe it was cached somewhere and most people were hitting the cache?
m4tthumphrey•3m ago
Either that number was wrong like you say OR (and I am unfamiliar with Bluesky) the URL is loaded via Bluesky's browser (like X) and therefore Bluesky's own server IP was used (instead of the user's).
fabian2k•2m ago
> The available mitigation is at server level and prevents access to download or file storage directories directly. If configured properly, this will block access to the clear URL and return a ‘forbidden’ message. This is the second contributory configuration error – the server was not configured in this way so there was nothing to stop access to the clear URL bypassing protections against pre-publication access

That's the main flaw. Wordpress was configured to allow direct access to file, so they did not go through the authentication system. My experience is with Drupal (and a decade or more out of date), but it sounds like this behaves very similar. And this is a giant footgun, the system doesn't behave the way normal people expect if you allow unauthenticated access to files (if you know the URL). I don't understand why you would configure it this way today.