frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

The RCE that AMD wouldn't fix

https://mrbruh.com/amd2/
66•MrBruh•1h ago

Comments

tlb•1h ago
It's ridiculous to consider MITM attacks out of scope for taking over your computer. Also, there are probably ways to exploit this without a true MITM like DNS cache poisoning. But it's best to just assume the whole internet is MITMed.
sigmoid10•1h ago
Out of scope does not necessarily mean out of impact. It is merely a question of how far a company wants to be responsible for the environment their software is run in. Most of the time that answer is "not much."
dlcarrier•1h ago
But I use a Wi-Fi password, so my phone says it's secure!
amiga386•1h ago
MITM where attacker needs to install their own CA certs on the victim's device -- sure, out of scope.

MITM because you used http instead of https and you don't have any other verified cryptographic signature on your data -- get tae fuck, fix it pronto.

pietervdvn•31m ago
I'd even count this as "having local access to the device", as that is what is needed to install such a cert
tuckerpo•1h ago
Out of scope in this case means "we don't wanna pay you"
dcminter•1h ago
The "signature verification" in the fix being CRC32 is pretty hilariously clueless.
sitkack•1h ago
They should have done base64 encryption before the crc32. noobs
throwway120385•1h ago
Especially because if they had read about or studied this problem they would find tons of prior art where CRC32 was considered not secure for solving the problem. CRC32 solves a different problem -- how do you verify that the data that was received is identical to the data that was sent. It makes no guarantees about who is sending the data, which is the real problem signatures solve.
wat10000•54m ago
More specifically, it solves the problem of verifying that the data received was not accidentally corrupted somehow. Unlike cryptographic hashes, CRC32 does not do much to defend against deliberate, malicious modification. It's too easy to craft some different data that matches a given CRC32 value.
AlotOfReading•29m ago
Computing a CRC is equivalent to attacking it. The checksum is the value that produces a certain fixed constant when appended to the data. This is why you'll often see checksums as the last field in a message. It allows for hardware to verify the entire message by checking if the CRC of the bytes equals that fixed constant without having to parse it.
bwfan123•1h ago
> In my frustration, I decided to punish this software

Love this. I am frustrated by idiot software features everywhere, but am not triggered yet to punish them. AI automation is coming close however.

hilariously•3m ago
I got so mad at plex/jellyfin's crap I vibe coded an entire entertainment system out of spite.

Works great!

rirze•1h ago
Seems like white hat work is pretty fruitless nowadays. Disappointing.
inigyou•1h ago
They keep choosing to work whitehat instead of blackhat, which is all AMD ever wanted.
qrobit•1h ago
previously https://news.ycombinator.com/item?id=46906947
mrguyorama•1h ago
AMD software is often utter trash.

I am a diehard fanboy of their GPUs, and have been since they were still ATI but I had to finally purchase an nvidia GPU because of how bad AMDs software quality is.

My powerful 5700XT spent two years basically broken, because the default, driver provided fan curve locked the fan at 27%. For two years, I couldn't figure out why my GPU constantly crashed, because it was overheating, because the default fan curve prevented the GPU from keeping itself cool and it would eventually just give up.

That diagnoses was complicated by the fact that AMD GPUs just resetting is very common. There's a watchdog timer in Windows that resets parts of the GPU stack because Microsoft is traumatized by 60% of Windows Vista BSODs being caused by bad nvidia drivers. Apparently sometimes if you increase this watchdog timer, the GPU eventually finishes whatever was giving it trouble.

But I still love AMD, and the ryzen line is a great value in the mid range. So I bought another AMD CPU and am very happy with it. But it somehow included software and this specific auto updater utility. Which I don't need, since I don't want to update the drivers for a GPU that I shouldn't be using (maybe except some video encoding lift, but my GPU can do that too). But I could not figure out a way to kill or prevent this stupid little autoupdater utility which always steals focus, for no reason at all. It shouldn't even be popping up a CLI! Windows task scheduling is incredible and would do this without a problem, and give you all the infrastructure to notice this was happening!

LooseMarmoset•20m ago
Drivers got better after ATI merged/got bought by AMD, but ATI has a loooooong legacy of terrible drivers in Windows.

The funny thing is, in Linux, the drivers are pretty great as far as I can tell. It's not like there aren't bugs, probably, but mostly everything "just works". You can't depend on FSR in Linux, for example - Doom Eternal just goes blank if you turn it on. I can live without it, though, and everything else seems fine, including performance.

Nvidia linux drivers make me quite upset - they're fine once you finally get them working, but you approach Nvidia driver updates with extreme caution in Linux

nickdothutton•1h ago
AMD's inability to make good software has been a recurring problem for decades. Many years ago I had some success with their optimising compiler, but everything else I've touched was bad. A real pity.
ezoe•1h ago
> If you are an AMD user...

Don't bother to use Windows?

Dwedit•57m ago
There's two requests involved for the auto updater, one to grab the XML file, and one to grab the driver file over plain http.

If the autoupdater can't handle the redirection when grabbing the XML file, then it's a case of accidental safety by mistake that would prevent grabbing the plain http file.

OkayPhysicist•52m ago
AMD's utter incompetence when it comes to the software side of things is truly, truly baffling to me. It's not like you need a mountain of developers, a team or two on the right project would do wonders for their market share.

For example: Implement the CUDA. CUDA's won, hands down, that toothpaste is solidly outside the tube. Luckily, to the outside observer CUDA is just an API, and API's aren't copyrightable. Literally nothing is stopping AMD from hiring a relatively small team of developers to make AMD GPUs CUDA-compatible.

leecommamichael•38m ago
Thank you for looking into this, I also have the annoying pop-up and have been suspicious of it…
dmitrygr•17m ago
I think we can all agree that MiTM is a valid attack vector and this should have paid out the bounty. AMD won't do it, but perhaps we can crowdsource it - the dude deserves it. Join me in doing this: https://ko-fi.com/mrbruhh (identical link to the one in the write up, feel free to verify).

I started it with $100 - https://ko-fi.com/transactions/03df753c-09b0-4972-8e53-adf06...

greenavocado•6m ago
Congratulations, you found the government backdoor!
jeroenhd•1h ago
It's technically possible (though I don't know if they actually do this) that they're not referring to a signature check in the download part, but are verifying the code signing signature of the executable downloaded. You'd only notice the CRC if you were looking at the downloaded content, but if the updater refuses to launch an executable that isn't signed by AMD's cert then they would be fine.

Given the way AMD has been treating this issue, I'm assuming they're just incompetent, though.

LgWoodenBadger•30m ago
A manager somewhere made the embarrassingly wrong decision to not fix this, and they’re too egotistical to correct their mistake.

That’s my take.

MiMo Code is now released and open-source

https://mimo.xiaomi.com/mimocode
251•apeters•3h ago•131 comments

Show HN: Homebrew 6.0.0

https://brew.sh/2026/06/11/homebrew-6.0.0/
183•mikemcquaid•4h ago•25 comments

Petition to Withdraw Canada's Bill C-22

https://www.ourcommons.ca/petitions/en/Petition/Sign/e-7416
89•hmokiguess•2h ago•40 comments

The RCE that AMD wouldn't fix

https://mrbruh.com/amd2/
69•MrBruh•1h ago•28 comments

Software Is Made Between Commits

https://zed.dev/blog/introducing-deltadb
41•jeremy_k•1h ago•11 comments

Lines of code got a better publicist

https://curlewis.co.nz/posts/lines-of-code-got-a-better-publicist/
279•RyeCombinator•5h ago•185 comments

Anthropic apologizes for invisible Claude Fable guardrails

https://www.theverge.com/ai-artificial-intelligence/948280/anthropic-claude-fable-invisible-disti...
145•rarisma•5h ago•139 comments

Emacs appearances in pop culture

https://ianyepan.github.io/posts/emacs-in-pop-culture/
64•ggcr•1d ago•3 comments

Open Reproduction of DeepSeek-R1

https://github.com/huggingface/open-r1
122•yogthos•4h ago•14 comments

Solar generates more energy in US than coal for first time

https://www.theguardian.com/us-news/2026/jun/11/solar-energy-us-coal
164•neilfrndes•1h ago•42 comments

Pokémon Go Scans Trained the Navigation Tech for Military Drones

https://dronexl.co/2026/06/09/pokemon-go-scans-niantic-vantor-military-drone-navigation/
601•vrganj•11h ago•277 comments

Nextcloud Hub 26 Spring: Built together, designed for the future

https://nextcloud.com/blog/nextcloud-hub26-spring/
96•doener•3h ago•64 comments

FPS.cob: A first person shooter in COBOL

https://github.com/icitry/FPS.cob
57•MBCook•2h ago•25 comments

Waymo Premier

https://waymo.com/blog/2026/06/waymo-premier/
31•boulos•1h ago•48 comments

macOS 27 Beta breaks the ability to boot Asahi Linux

https://www.phoronix.com/news/macOS-27-Beta-Breaks-Asahi
64•josephcsible•2d ago•25 comments

Developer gets Half-Life running at 30 FPS on a Nokia N95

https://www.tomshardware.com/video-games/handheld-gaming/developer-gets-half-life-running-at-30-f...
57•ljf•2d ago•18 comments

Show HN: Claw Patrol, a security firewall for agents

https://github.com/denoland/clawpatrol
36•rough-sea•2d ago•10 comments

Discovery of Cold War-era rare Eastern Bloc computers in a German hangar

https://computerhistory.org/stories/explorers-of-the-lost-computers/
32•andrewstuart•4d ago•5 comments

How Terry Tao became an evangelist for AI in math

https://www.quantamagazine.org/how-terry-tao-became-an-evangelist-for-ai-in-math-20260608/
45•Tomte•3d ago•20 comments

Vinyl succumbs to Loudness War: more than just collateral damage (2025)

https://magicvinyldigital.net/2025/04/27/vinyl-succumbs-to-loudness-war-more-than-just-collateral...
37•sneela•4d ago•8 comments

Fully autonomous drones have killed human soldiers for the first time

https://www.newscientist.com/article/2529849-fully-autonomous-drones-have-killed-human-soldiers-f...
58•deadgopher•1d ago•31 comments

MapComplete: Maps about various topics which you can contribute to

https://mapcomplete.org/
146•GTP•3h ago•27 comments

Reading for pleasure is sharply down among schoolkids, report shows

https://www.nbcnews.com/data-graphics/kids-reading-less-lower-levels-department-education-study-r...
33•freejoe76•1d ago•15 comments

Oh good, screwworms are back (2025)

https://www.marginallycompelling.com/p/oh-good-screwworms-are-back
53•timr•1d ago•30 comments

SVG-Line: Better Status Bars for Emacs – Charlie Holland's Blog

https://www.chiply.dev/post-svg-line
50•rbanffy•2d ago•2 comments

Queues Don't Fix Overload (2014)

https://ferd.ca/queues-don-t-fix-overload.html
34•locknitpicker•2d ago•22 comments

A new era for software testing

https://antirez.com/news/168
50•Chrisszz•4d ago•13 comments

Doing nothing at work

https://www.seangoedecke.com/doing-nothing-at-work/
169•Sukram21•3d ago•35 comments

Global population movements from 1990 to 2023

https://www.nature.com/articles/d41586-026-01796-y
66•tzury•6h ago•65 comments

Galaxy-killing wind discovered in the early universe

https://ras.ac.uk/news-and-press/research-highlights/galaxy-killing-wind-discovered-early-universe
8•layer8•1h ago•0 comments