Hacker NewsSunday, May 17

California's Protect Our Games Act seeks to prevent game publishers from shutting down games without notice. Supporters argue consumers deserve continued access to purchased games, while the Entertainment Software Association opposes it, claiming consumers only receive licenses and that maintaining games indefinitely creates licensing and technical challenges.

A Rust program encounters undefined behavior due to a dangling reference error. The code creates a Box containing "Hello World", initializes a PathString with it, then drops the Box. When trying to access the data later through slice(), it fails because the reference points to deallocated memory with no provenance.

The U.S. Department of Justice is seeking personal data on potentially hundreds of thousands of drivers who downloaded EZ Lynk's Auto Agent app through subpoenas to Apple, Google, Amazon, and Walmart. The DOJ accuses EZ Lynk of violating the Clean Air Act by selling devices that bypass vehicle emissions controls, while the company denies wrongdoing and argues their products serve legitimate diagnostic purposes. Privacy advocates and EZ Lynk's lawyers are challenging the broad data requests as government overreach.

Researchers developed an exploit chain for Google Pixel 10 by updating a Dolby vulnerability and discovering a critical VPU driver bug that allows mapping arbitrary physical memory. The VPU vulnerability was exceptionally simple to exploit, requiring only 5 lines of code, and was patched in 71 days showing improved Android security response times.

A satirical piece describes JavaScript developers expressing resigned acceptance after a devastating npm supply chain attack compromised millions of applications, portraying their reliance on unvetted packages as unavoidable while other ecosystems remained unaffected.

The author describes migrating away from Tailwind CSS after 8 years to vanilla CSS with semantic HTML. They learned to structure CSS using systems inspired by Tailwind including resets, components, color palettes, and font scales. Key changes include organizing CSS by components, using CSS variables for consistency, adopting CSS Grid for responsive design, and implementing a minimal build system with esbuild. The migration was motivated by wanting more flexibility, better CSS skills, and curiosity about semantic HTML approaches.

Amazon employees report being pressured to use AI tools with their usage tracked through token consumption metrics. Some workers are gaming the system by using the internal MeshClaw tool to inflate their AI activity rather than for actual productivity, creating what employees describe as "perverse incentives" despite company denials of formal usage targets.

Nathaniel Rakich reported that ABC News has taken all FiveThirtyEight articles completely offline, with the pages now redirecting to ABC News politics section. He criticized this as a needless erasure of thousands of pages of valuable knowledge and analysis.

Turso is retiring its $1,000 bug bounty program due to being overwhelmed by AI-generated spam submissions. While the program initially worked well and rewarded 5 legitimate contributors, the rise of LLMs led to an influx of low-quality, automated bug reports that consume too much maintainer time to review.

A former competitive CTF player argues that AI tools like GPT and Claude have fundamentally broken Capture The Flag competitions by automating challenge solutions, making scoreboards meaningless measures of human security skills. What began as helpful tools evolved into agents that can solve most challenges independently, turning competitions into pay-to-win orchestration contests rather than skill-based learning environments, ultimately destroying the educational ladder that helped newcomers develop cybersecurity expertise.