frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Show HN: I built a sub-500ms latency voice agent from scratch

https://www.ntik.me/posts/voice-agent
214•nicktikhonov•5h ago•63 comments

Show HN: Govbase – Follow a bill from source text to news bias to social posts

https://govbase.com
162•foxfoxx•10h ago•72 comments

Show HN: Giggles – A batteries-included React framework for TUIs

https://github.com/zion-off/giggles
4•ajz317•55m ago•3 comments

Show HN: Visual Lambda Calculus – a thesis project (2008) revived for the web

https://github.com/bntre/visual-lambda
23•bntr•2d ago•4 comments

Show HN: Pianoterm – Run shell commands from your Piano. A Linux CLI tool

https://github.com/vustagc/pianoterm
42•vustagc•6h ago•15 comments

Show HN: uBlock filter list to blur all Instagram Reels

https://gist.github.com/shraiwi/009c652da6ce8c99a6e1e0c86fe66886
105•shraiwi•7h ago•29 comments

Show HN: PHP 8 disable_functions bypass PoC

https://github.com/m0x41nos/TimeAfterFree
24•m0x41nos•2h ago•8 comments

Show HN: An Auditable Decision Engine for AI Systems

https://maelstrom.ghostlogic.tech
2•adamscottthomas•1h ago•0 comments

Show HN: Omni – Open-source workplace search and chat, built on Postgres

https://github.com/getomnico/omni
151•prvnsmpth•18h ago•41 comments

Show HN: Timber – Ollama for classical ML models, 336x faster than Python

https://github.com/kossisoroyce/timber
184•kossisoroyce•1d ago•30 comments

Show HN: ApplyPilot – AI Agent that applies to jobs for you

https://github.com/Pickle-Pixel/ApplyPilot
3•pickle-pixel•2h ago•0 comments

Show HN: Web Audio Studio – A Visual Debugger for Web Audio API Graphs

https://webaudio.studio/
60•alexgriss•15h ago•5 comments

Show HN: Gapless.js – gapless web audio playback

https://github.com/RelistenNet/gapless.js
29•switz•8h ago•7 comments

Show HN: Open-Source Postman for MCP

https://github.com/baristaGeek/open-source-postman-for-mcp
4•baristaGeek•3h ago•0 comments

Show HN: We filed 99 patents for deterministic AI governance(Prior Art vs. RLHF)

2•genesalvatore•4h ago•0 comments

Show HN: Try Archetype 360 – AI‑powered personality test, 3× deeper than MBTI

https://archetype360.app/
8•ddesposito•11h ago•5 comments

Show HN: Punch card simulator and Fortran IV interpreter

https://punch.ehrlich.dev/
4•behrlich•8h ago•0 comments

Show HN: Writing App for Novelist

https://novelos.studio/
6•oknoorap•7h ago•2 comments

Show HN: Vanilla JavaScript refinery simulator built to explain job to my kids

3•fuelingcurious•5h ago•1 comments

Show HN: Agd – a content-addressed DAG for tracking what AI agents do

https://github.com/frontman-ai/agd
3•BlueHotDog2•5h ago•0 comments

Show HN: BoardMint – upload a PCB, get a standards-backed issue report in ~30s

https://boardmint.io/how-it-works
3•pranavchahal•6h ago•1 comments

Show HN: CrowPay – add x402 in a few lines, let AI agents pay per request

https://www.crowpay.ai/
3•ssistilli•6h ago•0 comments

Show HN: Aft, a Python toolkit to study agent behavior

https://github.com/technoyoda/aft
2•chse_cake•7h ago•0 comments

Show HN: Watchtower – see every API call Claude Code and Codex CLI make

https://github.com/fahd09/watchtower
3•fahd09•7h ago•1 comments

Show HN: I spent a billion tokens bridging Elixir and WebAssembly

https://yev.bar/firebird
2•yevbar•8h ago•1 comments

Show HN: Smart-commit-rs – A zero-dependency Git commit tool in Rust

https://github.com/gtkacz/smart-commit-rs
2•gtkacz•8h ago•0 comments

Show HN: Valkey-powered semantic memory for Claude Code sessions

2•kaliades•8h ago•0 comments

Show HN: Audio Toolkit for Agents

https://github.com/shiehn/sas-audio-processor
57•stevehiehn•1d ago•9 comments

Show HN: Logira – eBPF runtime auditing for AI agent runs

https://github.com/melonattacker/logira
24•melonattacker•1d ago•3 comments

Show HN: I built a zero-browser, pure-JS typesetting engine for bit-perfect PDFs

https://github.com/cosmiciron/vmprint
75•cosmiciron•1d ago•54 comments
Open in hackernews

Show HN: PHP 8 disable_functions bypass PoC

https://github.com/m0x41nos/TimeAfterFree
24•m0x41nos•2h ago

Comments

altairprime•1h ago
Tell us more about how you searched for and uncovered this? Do you normally use PHP? What disclosure process did you use?
calvinmorrison•1h ago
That's a nice find. People rely a little heavily on this, and it only says in the manual "This directive allows certain functions to be disabled." but its not a security sandbox.

I think PHP has in the past explicitly stated its not a security feature.

There have been a few issues over the years with this.

Anyway - good OS security is required anytime you run software!

heres one from 6 years ago https://bugs.php.net/bug.php?id=76047

kadoban•1h ago
> I think PHP has in the past explicitly stated its not a security feature.

I'm struggling to think what it's for then?

turbert•51m ago
likely intended more as a lint than a security feature, it's not unusual to want to exclude commonly misused features from your code and any libraries you use.

Knowing the mess that is the php standard library, I imagine many applications would want to just straight up ban the really bad parts.

calvinmorrison•48m ago
a lazy security feature that stops 90% of problems?
duskwuff•46m ago
> I'm struggling to think what it's for then?

Placating some users - mainly shared web hosting providers - who still think that disabling functions like system() and exec() is an effective security measure.

halb•1h ago
there was a php-only million-rows challenge that was posted here recently. This uaf offers the opportunity for the funniest solution.
turbert•58m ago
from a quick skim, it looks like the underlying bug is just not handling object resurrection[1] at all (FreeMe adds a reference to $array while its destructor is called).

I'm not really familiar with PHP but this seems like a surprising oversight for a popular language. Does PHP just not care about memory corruption? The fact that it is this easy is far more surprising than it being used to circumvent a questionable security feature.

[1] https://en.wikipedia.org/wiki/Object_resurrection