Hacker News

New stories

Live mirror
30 storiesupdated just nowView source snapshot
  1. CaptainCode: Agents. One Captain. Pick the right model for the task(captaincode.ai)
    1comments
  2. Show HN: Ego-jev – 0.4s typed decisions for browser agents(github.com/zephyrdeng)
    discuss
  3. How we share, review, and update AI agent skills(medium.com/ali.raza_25708)
    discuss
  4. Calibrating Jev as a Code Reviewer(github.com/selmar)
    discuss
  5. Firecrawl Alexandria(firecrawl.dev)
    discuss
  6. When your Mac just won't let go of the Wi-Fi connection(sixcolors.com)
    discuss
  7. The First Microbe for Mars(pioneer-labs.org)
    discuss
  8. The AI Party House Where Networking Has a Dark Side(nytimes.com)
    discuss
  9. Wiring Diagrams for BMW Radios(bmw-radios.com)
    discuss
  10. Show HN: Hindsight: Automated Work Timeline(apps.apple.com)
    discuss
  11. Study Sessions Should Be Short and Frequent as Opposed to Long and Sparse(justinmath.com)
    discuss
  12. Show HN: AI·rete·RAG – a Rete rule engine decides, RAG explains why(ai-rete-rag.com)
    discuss
  13. Call of Duty's Activision to make next Halo game as Xbox cuts more jobs(bbc.co.uk)
    discuss
  14. Gravity-Gradient Stabilization(wikipedia.org)
    discuss
  15. Satsie's Pocket Guide to Op_cat (Bitcoin)(satsie.dev)
    discuss
  16. 16-bit Intel 8088 chip by Charles Bukowski(allpoetry.com)
    2comments
  17. Xbox continues its "reset" with dramatic restructuring(arstechnica.com)
    discuss
  18. 6 Years In, $6M Far(tally.so)
    discuss
  19. Jev-blindspot – find the blind spots in the prompt you just sent(github.com/jsk4581)
    discuss
  20. Show HN: Every Credit Card(numberplanet.com)
    2comments
  21. Research Harness from First Principles(edotenv.com)
    1comments
  22. Tell HN: Firefox's default browser check dark pattern triggers Windows BSOD
    1comments
  23. Streamhouse: What It Is, What It Isn't, and What's Missing(conduktor.io)
    discuss
  24. No More Warning Shots(aenguslynch.com)
    discuss
  25. Raspberry Pi locks boards to factory RAM capacities in firmware(tomshardware.com)
    discuss
  26. 1,300 STEM 3D Models created by GPT-6 Astra(emergentmind.com)
    discuss
  27. The Home Computer Generation(datagubbe.se)
    discuss
  28. We built muse from scratch, but it is definitely inspired by OpenClaw(twitter.com/natfriedman)
    discuss
  29. Marvin Heemeyer(wikipedia.org)
    discuss
  30. Our Quantum Future is a documentary exploring the rise of quantum technologies(ourquantumfuture.com)
    discuss

Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day

49 pointsby 1h agoarstechnica.com
20 comments
1h agoHN ↗

Who in their right mind would install a Meta AI with near admin privileges?

1h agoHN ↗

We all fear the true answer to that question.

44m agoHN ↗

Normally I’m not one to blame the victims but, uh, yeah who in the world is dumb enough to trust Meta at this point?

15m agoHN ↗

And before this gets flagged or downvoted or "he was young" or "he was joking" or "he was making a point: he was saying 'I could be anyone', not that he can't be trusted" answer me what other tech people say this, ever, along with all the other charges ("I'm going to fuck them [the Winklevoss twins] in the ear", "You can be unethical and legal and that's how i live my life haha", hacking Crimson reporters, and that's just at Harvard, let alone when Facebook became available to the public

31m agoHN ↗

most people don't know or care what "admin privileges" even means, or why they wouldn't want ai to have them

28m agoHN ↗

Almost everyone who is struggling with AI insecurity and is afraid of being left behind

19m agoHN ↗

No, most workers don't really say this in surveys and polling. They tend to hate LLM tools because it makes their jobs worse, nothing about being left behind.

The only people pushing the "left behind" narrative is SV + SF + VC since their previous narratives have failed to persuade the public (thank fuck).

19m agoHN ↗

"Normies" aka the average user on Meta. They have no concept of what "admin privileges" means and don't really care. I still have a hard time convincing my clients to use secure passwords. I have clients who were phished for substantial amounts of money and STILL don't implement proper security measures.

7m agoHN ↗

Newsflash, we’re all normies

Especially you

1h agoHN ↗

I'm confused what the vulnerability is. Does macOS have some specific function for protecting key material, that it's unexpected that if you execute user-privileged code locally, outside of a sandbox, it gets full read access?

1h agoHN ↗

Yeah macOS security is capability based rather than purely identity based. So if you don't pass the required entitlements to an application then it cannot do stuff like read from the system keychain even if its running as your user.

55m agoHN ↗

A zero day? Of course it does. It likely has many. Given the history of software, it's impossible to think it wouldn't.

27m agoHN ↗

You would think a website dedicated to talking about software engineering would agree with this sentiment wholeheartedly.

47m agoHN ↗

Maybe they should have spent the money used to buy its stupid name from a band on additional testing instead.

18m agoHN ↗

Presumably. They changed their handle on non-Meta social networks to match at around the same time as the Meta handle change.

44m agoHN ↗

macOS has long provided a simple means for apps to handle dictation and transcription in processes that stay securely on the device

Not sure these guys realize that the quality and latency of those Apple services in MacOS is way lower than SOTA and not too many people use them because of that…

7m agoHN ↗

How is this a serious zero day if it requires local code execution to run?