frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

The time the x86 emulator team found code so bad they fixed it during emulation

https://devblogs.microsoft.com/oldnewthing/20260615-00/?p=112419
155•paulmooreparks•2h ago•32 comments

I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

https://bobdahacker.com/blog/fifa-hack
178•BobDaHacker•1h ago•57 comments

John Carmack on Fabrice Bellard

https://twitter.com/ID_AA_Carmack/status/2064095424420487226
93•apitman•2h ago•37 comments

A backdoor in a LinkedIn job offer

https://roman.pt/posts/linkedin-backdoor/
1020•lwhsiao•11h ago•195 comments

Banned Book Library in a Wi-Fi Smart Light Bulb

https://www.richardosgood.com/posts/banned-book-library/
322•sohkamyung•8h ago•162 comments

Iroh 1.0

https://www.iroh.computer/blog/v1
1111•chadfowler•16h ago•329 comments

Show HN: Garden of Flowers – an archive of pictorial typography before ASCII art

https://garden-of-flowers.heikkilotvonen.com/
40•california-og•2h ago•8 comments

Ask HN: Has anyone replaced Claude/GPT with a local model for daily coding?

893•cloudking•16h ago•413 comments

TinyWind: A pixel pirate sailing game with real wind physics (380k+ kms sailed)

https://tinywind.io
759•tinywind•14h ago•150 comments

I hacked into the worst e-bike and fixed it [video]

https://www.youtube.com/watch?v=hPrtVGimBYs
57•alexis-d•5d ago•20 comments

I Love the Computer

https://michaelenger.com/blog/i-love-the-computer/
207•speckx•11h ago•123 comments

Humanity isn't ready for the coming intelligence explosion

https://www.economist.com/by-invitation/2026/06/15/humanity-isnt-ready-for-the-coming-intelligenc...
53•andsoitis•5h ago•113 comments

Why I email complete strangers

https://www.goodinternetmagazine.com/why-i-email-complete-strangers/
135•karakoram•9h ago•57 comments

Cohere's First Model for Developers

https://cohere.com/blog/north-mini-code
68•hmokiguess•4d ago•17 comments

My Homelab AI Dev Platform

https://rsgm.dev/post/ai-dev-platform/
293•rsgm•16h ago•52 comments

Amazon Announces Multibillion-Dollar Data Center in Missouri

https://www.narracomm.com/amazon-announces-multibillion-dollar-data-center-in-missouri/
98•thelonelyborg•6h ago•88 comments

Hetzner Price Adjustment

https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/#cloud-servers
401•tuhtah•17h ago•558 comments

The 90-year-old idea behind JEPA models: Canonical Correlation Analysis

https://shonczinner.github.io/posts/embedding-prediction/
43•Anon84•4d ago•7 comments

Peopleless economy? Not technically impossible

https://gmalandrakis.com/writings/ad-economicum.html
160•l0new0lf-G•10h ago•279 comments

What job interviews taught me about Kubernetes

https://notnotp.com/notes/what-job-interviews-taught-me-about-kubernetes/
158•chmaynard•11h ago•111 comments

Fox to buy Roku

https://www.wsj.com/business/deals/fox-roku-deal-f6e564f9
312•thm•18h ago•387 comments

What every coder should know about gamma (2016)

https://blog.johnnovak.net/2016/09/21/what-every-coder-should-know-about-gamma/
90•sph•2d ago•27 comments

Copper transport drug restores memory and clears toxic Alzheimer's proteins

https://www.monash.edu/news/articles/copper-drug-restores-memory-and-clears-toxic-alzheimers-prot...
286•bookofjoe•16h ago•107 comments

Chili peppers of the world: cultivars, species, and heat

https://www.notesfromtheroad.com/desertmexico/chili-peppers.html
25•fanf2•3d ago•2 comments

Salesforce to Acquire Fin (formerly Intercom) for $3.6B

https://www.salesforce.com/news/press-releases/2026/06/15/salesforce-signs-definitive-agreement-t...
300•colesantiago•19h ago•220 comments

Game Engine White Papers: Commander Keen

https://forgottenbytes.net/commander_keen.html
191•mfiguiere•13h ago•63 comments

Launch HN: Drafted (YC P26) – Models for residential architecture

52•PrimalNick•14h ago•56 comments

How TimescaleDB compresses time-series data

https://roszigit.com/en/blog/timescaledb-compression-hypercore
143•lkanwoqwp•13h ago•16 comments

Show HN: Veterinarian turned founder, AI lawn diagnosis

https://grassdx.com/
60•andrewbr•13h ago•54 comments

Reviews have become expensive, rewrites have become cheap

http://ishmeetbindra.com/posts/reviews-have-become-expensive-rewrites-have-become-cheap/
55•arzh2•7h ago•45 comments
Open in hackernews

I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

https://bobdahacker.com/blog/fifa-hack
169•BobDaHacker•1h ago

Comments

BobDaHacker•1h ago
Registered on FIFA's public Agent Platform with my ID, got added to their Microsoft Entra tenant, and found the Angular app only checked roles client-side. The backend APIs served everything: RTMP ingest URLs and stream keys for every live World Cup 2026 camera feed across all five angles. Confirmed live in VLC. An attacker could have pushed arbitrary video to the ingest endpoints and replaced broadcast feeds on TV worldwide. Write access to match stats, commentator notes, and the live score system was also exposed.
swader999•1h ago
Could have made a killing off of poly market and rick rolled ftw.
antonvs•27m ago
> Hire me (just kidding... unless?)

Would you really want to work for one of the world’s most notoriously corrupt organizations?

BobDaHacker•13m ago
I am not much of a football gal myself, so I didn't know they were a shitty org.
mjfisher•1h ago
How could that possibly, ever have made it through. Every single API for every single service didn't check the JWT?
Ekaros•55m ago
Vibe coding? Just have LLM make it and then press merge?
himata4113•46m ago
Eh, ironically this is an easy mistake to make for a human especially around how middleware is handled in express or other nodejs libraries, it's the reason why so so many of the vulnerabilities come from node based apps. Python has similar footguns as well with undefined objects failing open. Typescript has somewhat mitigated these for node, but there is no real fix for python other than skipping libraries that allow failing open.
BobDaHacker•38m ago
Yeah I see this type of crap often honestly, especially at big companies.
holman•1h ago
Really amusing to read this one. I did something similar for Qatar 2022 and got access to roster submission (https://zachholman.com/posts/hacking-fifa). To their credit they patched it pretty quickly, but their promised "token of appreciation" never came. (Although on the other hand, they didn't sue me, so I guess that's a win.)
arecsu•1h ago
Awesome read! Congratulations on discovering this and reporting. Hope you get something back from FIFA. This could've lead to some huge disaster if it failed under the wrong hands.

Love your writing skills as well!

> I closed it immediately. But the damage was done (to my brain).

Laughed so hard when I read this one :D

Tepix•59m ago
It was a cool story, no doubt.

> Love your writing skills as well!

I‘d say it was heavily AI assisted

Jabrov•58m ago
Holy crap. Had to pick my jaw up off the floor. I hope you get some kind of acknowledgement or bounty for this. Kudos for having the willpower to resist sending a message to millions of people and sparking a global phenomenon!
jansan•52m ago
> Replace that, and every TV network receiving the FIFA feed shows whatever you pushed.

Holy shit, Rickrolling is among the more harmless things you could have done with that.

patate007•48m ago
Great article! You must be pretty confident to click the "stop streaming" button without knowing whether a confirmation modal will pop up or not
dddddaviddddd•39m ago
I thought this too, but inspecting the HTML source could have shown that a nodal would be shown next.
BobDaHacker•39m ago
I blocked my network traffic before clicking it cuz I've seen a lot of things without confirmation pop-ups. At least there was a confirmation pop-up.
srmarm•47m ago
Clearly a big f-up by FIFA on what looks like quite a tidy platform otherwise.

One question though, how do you know your feed would kick off the 'real' feed if you pushed to RTMP, does it just take the most recent connection as live? Does the protocol have a mechanism for dealing with multiple people pushing to the same endpoint? There maybe more checking on that endpoint and if course I'm sure most live broadcasters would have a live director to cut any feeds at their end if a dodgy feed popped up too.

A huge vulnerability nonetheless and a great write up!

BobDaHacker•35m ago
Good question! So RTMP doesn't really have a clean way to handle two publishers on the same stream key. What would actually happen is the two streams fighting for the ingest endpoint, so the output would glitch between the two sources. Like if I pushed Subway Surfers gameplay it'd be flickering between the actual match and Subway Surfers with the audio cutting back and forth. You're right that a live director would catch it pretty fast but even a few seconds of that on air during a World Cup match is not great.
albertgoeswoof•41m ago
Please stop using AI to write for you, it ruins what is otherwise a fascinating story, and on reflection I struggle to trust it.

If you used AI to generate the blog post, did you use AI to generate the screenshots and story?

sevenzero•38m ago
I remember a frontpage post from like 2 days ago:

"If you want human attention show human effort" or something in that direction. I think this fits here just right.

gbalduzzi•5m ago
I think in this case the human effort was put into the actual discovery, honestly I don't mind if AI helped him write the blog post if the result is enjoyable and not sloppy
AdminAccount•4m ago
https://news.ycombinator.com/item?id=48497609
pqs•37m ago
These comments don't help much. AI is here, not everybody can write well, AI is gonna be used.
llbbdd•34m ago
The problem is that people who are bad writers have trouble understanding that AI writes worse than they do
jdw64•34m ago
I don't understand why people obsess over LLM(AI)format. The content is interesting, but they dismiss it just because the format is an issue. All of this content is worth reading and is good. And it's about security.
willdr•32m ago
The content is rendered unreadable by the LLMs sentence construction. Secondly, it's insulting. If you didn't care enough to write it, why should I care enough to read it?
jdw64•20m ago
I saw the this post. Wasn't it a capture of something that actually happened? So it just described a real story. I can doubt the authenticity of all of it whether it's really true or not. but the content itself was interesting enough.

What I don't understand is this: 'Show sincerity'—that is, a human value. If it were AI-generated, stitched-together false content, I'd understand, but I see quite a few interesting points.

Whenever I see things like this, I always think of Sturgeon's law: 90% is bad, and only 10% is interesting. I get that most AI-generated content is AI slop. But even back when only humans could write, there were plenty of clickbait articles.

I agree that GEN AI spam content is generally bad, and I also agree that some of it may lack effort. But honestly, I'm not sure this content is completely meaningless.

Regardless of the packaging, if the content inside is interesting and valuable enough, I think that's what matters. I guess we just see things quite differently.

So what I'm saying is, I don't agree with the idea that he didn't care at all.

dawnerd•18m ago
Or even believe it. Hard to believe a story if it’s right from an llm.
rectang•33m ago
> Client says "access denied"

> Server says "here's everything"

hahahaha

> Hire me (just kidding... unless?)

FIFA is a legendarily awful organization. In my weaker moments reading your piece I thought to myself how nice it would have been if someone more ruthless than you had been made an example of them.

divan•22m ago
To be fair FIFA is one of the best international federations in terms of good governance. Dutch sport think-tank Play The Game has an assestment methodology and the project called "Sports Governance Observer" and did asses FIFA in 2018 [1]

FIFA gets disproportionate amount of attention and, ofc, high-level corruption scandals, but I would say it's more like a by-product of the sheer scale of the football, and not a problem with FIFA itself. I believe most sports federations in the world are very far from FIFA in terms of governance, but also from facing problems that FIFA has.

[1] https://www.playthegame.org/publications/sports-governance-o...

patates•30m ago
You hit the jackpot on security research, but you cannot take like an hour or two to at least get rid of the AI smell? Please do use AI, nothing against that, all I'm saying is please, please don't deliver this weirdness:

> I did not touch any of these controls. But they were there. Functional.

I really needed to push myself to read because it was very interesting and thank you, for doing the work and sharing.

sairam_h•25m ago
That was really cool! It was one of the impressive exploit i have ever read about. I really hope they give you something in return for your service, at the very least a thank you.
curiousgal•21m ago
This is honestly one of the only instances where I am like "you're an idiot for reporting this". The amount of reach, provided the feeds can indeed be overriden, is absolutely insane. Paired with how shitty of an org FIFA is, I personally would have just leaked this.
BobDaHacker•15m ago
As much as I like being butt fucked, I dont wanna go to prison :3
BobDaHacker•14m ago
Also, I am not much of a football gal myself, so I didn't know they were a shitty org.
thrdbndndn•17m ago
This happens more often than you would think.

During COVID, lots of live shows (concerts, etc.) in Japan moved to streaming (and most of them stuck, so thanks to that, lots of large concerts today have real-time streaming, which is great for foreign fans).

Out of 10+ platforms, more than half have vulnerabilities that allow you to access the content freely (sometimes including the rehearsals, because they are also streamed internally), and on a handful, you can access the admin panel and, as the author said, stream whatever you want.

Most of them have been patched over the years (some are just the byproduct of them changing the backend/SaaS provider, though), but there remain some major providers where you can get content for free.

rvz•13m ago
> FIFA never responded. Not to acknowledge the report. Not to say thank you. Not to discuss compensation. Nothing.

If this is true, why help them if they do not take their own security seriously, especially if they have vibe-coded their auth backend server?

anthonyeden•2m ago
Do you know these feeds actually go to broadcasters? They could be internal feeds for refs, match review, head office monitoring, etc.

The broadcast contribution feeds I’ve seen in the past are MPEG-TS, not via RTMP.

Still a great find.

gbalduzzi•4m ago
you clearly have never read a 1000 word text written by me (/s, but only partially)
SXX•32m ago
I'd wish we come to a day where people would just post the prompt. Then I can decide what story to generate from it.
patates•25m ago
Look I don't like to see a wall of AI slop as much as the next person (see: https://news.ycombinator.com/item?id=48551462), but "just post the prompt" is also too dismissive. AI had access to information that we don't have and all you see here is probably a compilation of multiple prompts, edits and various sources (like author's notes) for context.

We can adjust our expectations for people to take some time to make the output theirs.

OTOH, and this is me arguing against myself, maybe this is not too different than the million web sites we saw using the unmodified default bootstrap theme.

I guess my opinions as well as the response of the community are still evolving.

TeMPOraL•24m ago
- It's called "writing in bullet points"

- Normies frown upon it

watwut•12m ago
They don't! Before AI, people complain about long emails and what not. The literally preferred to read short ones.
Vinnl•13m ago
I'm still planning to add a "AI-edited version" toggle to my blog. Not that it would do anything, because people wouldn't click it anyway.
gspr•28m ago
> AI is here, not everybody can write well, AI is gonna be used.

I don't know about you, but I'd love to read a fascinating story written by a relatively poor writer. But if they can't be bothered to write, I assume the story can't be that good.

Oranguru•17m ago
But this isn't a story, literature, or a fancy piece of art; it's merely a technical blog post that discloses a security vulnerability. Here, the writing serves only as a vehicle to convey a message. Once you've received it, its purpose has been fulfilled. I would agree with you if the writing were an important part of the message, but here it is not. Not everybody can write well, and this guy clearly had something to tell, and that is what matters.
BobDaHacker•33m ago
Yeah I used Claude as a writing assistant for the initial draft. I'm autistic and long-form writing isn't my strong suit, getting a 4000 word blog post to flow well is genuinely hard for me. But I do edit it pretty heavily after, the voice and the jokes and the structure are mine, the AI just helps me get a baseline down so I'm not staring at a blank page. The research, the screenshots, the disclosure, that's all me. I've been doing this stuff for years.
tlogan•5m ago
My opinion is that this is a great story.

But the haters are going to hate.

If you had not used AI to fix your post, I bet the top post will be complaining about your grammar.

Some people will always find something negative. Simple as that.

maciekkmrk•5m ago
I understand that it feels helpful but the post ends up repeating the same insight over and over. Reads very sloppy, while you wanted the opposite.
V__•12m ago
I am curious, what exactly triggers your AI senses in this post?
mdrzn•8m ago
"This wasn't some dev environment. This wasn't test data."

It's not X, it's Y. And repetitions of three.

bcraven•3m ago
Gemini loves talking about "The Nuclear Option" too
drra•3m ago
I found myself writing exactly like this for a while after reading pages and pages of this special construct before my bs detector understood what it is...
srdjanr•8m ago
I don't mind it here at all, in fact I didn't even notice it's AI before reading this comment. It's clearly not a one-shot AI slop but a well thought out and edited by a human post.

Not everyone who has something interesting to say is a good writer, and I think it's great if AI can help them tell their stories.