Hacker News
1Quad9 (DNS Resolver) to Exit France
- Quad9, a nonprofit DNS resolver, will stop offering its free cybersecurity service in France on November 24 after a French court ordered it to block domain names linked to sports piracy for beIN. Quad9 says compliance is technically impossible without geo-blocking, which failed in Germany, or global blocking, which would impose French law worldwide. It is withdrawing to protect its privacy and neutrality principles.
Quad9 refuses selective DNS blocking
Quad9's CTO says it will likely geo-block French users rather than selectively block domains, arguing DNS shouldn't be used for content restriction and that accepting such demands opens the door to broader censorship.Copyright enforcement against DNS resolvers
Commenters criticize a contempt fine for failing to block Sony's content after it was accessed via VPN, comparing the rulings to punishing a phone book publisher. Cisco's OpenDNS exit from France is also noted.French courts misunderstand DNS
Commenters say the courts misunderstand how DNS works, and note that blocking orders on DNS resolvers are a distinctly European trend, since US law doesn't compel ISPs to block sites.
2eMudhra to exit global SSL/TLS certificate business
- eMudhra's Board voluntarily withdraws from the global SSL/TLS certificate business, a small part (about 1%) of revenue, citing rising compliance costs and reduced returns. The company says the incident was handled promptly and no data was breached. Existing certificates remain supported until expiry, and core enterprise, signing, and identity businesses continue unaffected.
Corporate response and accountability
Commenters found eMudhra's statement evasive: it blamed social media, called SSL/TLS about 1% of revenue, and gave no full root-cause explanation or apology. Some linked this to cultural face-saving norms. Stock fell about 20%.Web PKI is fundamentally broken
Many argued the CA model is flawed because any trusted CA can issue certificates for any site. Proposals included limiting CAs by region, relying on fewer nonprofit CAs like Let's Encrypt, or using DNS-based keys, but no consensus emerged.Slow revocation across trust stores
Users reported Apple devices still trusting compromised eMudhra chains days after revocation, while Chrome and Firefox blocked them within hours. Software bundling its own CA store, such as Python's certifi, made patching slow.
3Jailbreaking the Switch 2
- A software-only, tethered jailbreak for the Nintendo Switch 2 on firmware 23.0.1 lets users run custom native code and access system services. The author used AI coding agents to help develop the exploit and demonstrated it by modding Mario Kart World.
Switch 2 jailbreak and piracy risk
Commenters expect Switch 2 game dumps and recompilations to spread, weighing piracy impact against Nintendo's lawyers, possible console bans, and whether Nintendo will change its exclusivity policies.AI agents with hardware in the loop
Users describe giving LLMs "hands and eyes" via KVMs, USB capture, smart plugs, and servos to automate hardware testing, debugging, and firmware work, including power-cycle and SD card automation.LLM refusals in security research
Users report models like Codex and Claude refusing exploit or CVE work, though refusals have loosened over time, and framing the work as hardware you own often helps.
4Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case
- The New Mexico Department of Justice reportedly secured a historic $25 billion penalty against Facebook, which it describes as another landmark victory against Big Tech.
Penalty size and appeals
Commenters doubt New Mexico will collect the $25B, since it is reduced from a $219B judgment and is still subject to appeal. They contrast it with the $459M Cambridge Analytica release in the multistate settlement.Personal liability for executives
Some argue fines fall on the company rather than directors, so executives face no personal consequences. Others counter that making directors personally liable would be impractical and that a $25B fine is still small for Meta.Meta's negligence in Cambridge Analytica
Commenters debate whether Meta is liable because it failed to apply reasonable safeguards, even though Cambridge Analytica committed the misuse. Others say the public-data access was legitimate and the blame lies with users and Cambridge Analytica.
5There isn't an easy exploit for this PHP vulnerability
- The author argues that a recent PHP vulnerability, though real and worth patching, is far harder to exploit than hyped. Most public "PoC" exploits fail against vanilla PHP and rely on an existing local-file-inclusion flaw, unlike truly easy bugs such as Log4Shell. The author blames LLM-driven hype and AI-made decisions for the panic.
Exploitability and hype around php2shell
Commenters debate whether the PHP RCE is practically exploitable. Some note that many PoCs were unverified or AI-generated, and that exploitation depends on specific application code. Others argue the severity justified taking sites offline.Social media and AI conflicts of interest
Commenters blame cybersecurity influencers, social media personas, and AI vendors such as OpenAI and Wiz for amplifying alarm and self-promotion, calling the coverage a PR-driven moral panic.PHP's security track record
Users debate whether PHP is inherently insecure, citing a long history of CVEs in unserialize() and PHP-FPM. Others argue modern PHP is no worse than other languages, with dependency risk being the bigger concern.
6mitmproxy adds --emudhra option
- This diff adds a compromised eMudhra intermediate CA chain (with a link to a security advisory) as a constant in a certificate-handling module. It also updates type hints across dummy certificate, CRL, and certificate store functions so they accept elliptic curve private keys alongside RSA keys, and updates the private key loader to match.
Root path choice for affected devices
The emSign root path, trusted since about 2018 and removed in October 2026, and the AAA root path, trusted for years and disabled for HTTPS in newer stores after February 2025, determine which devices are exposed. mitmproxy added "--emudhra", with an AAA path change in progress.Interception use cases for IoT and TVs
Users ask whether this lets them sniff smart TV and Android traffic or aid jailbreaking. Replies say it depends on trust stores, CRL checks, and certificate pinning, though Frida can often bypass pinning.Severity of the weak key flaw
Some keys were only 8 bits, with the lowest being 4. Commenters worry other CA keys may be weaker than known, note the root is being removed from trust stores, and discuss eMudhra's fate and stock drop.
7Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
- A malicious LiteLLM 1.107.0 release on PyPI contained a credential stealer and a remote code execution backdoor that ran whenever Python started, even without importing LiteLLM. The upstream source did not include them, and PyPI has removed the release. Versions 1.106.2 and the 1.107.0 release candidates are clean.
Supply chain attacks and dependency cooldowns
Commenters push for default 24-48h cooldowns on uv, npm, and similar tools, noting most malicious packages persist for days or longer. Others warn cooldowns block security patches and attackers can wait out the window.Sandboxing and credential isolation for agents
Users describe proxy-based credential injection, network restrictions, and policy-driven sandboxes like Nono as ways to contain LLM agents, though a sandbox tool could itself be compromised.Repeated LiteLLM compromises and maintainer trust
Commenters note this is at least the second LiteLLM compromise, with a prior attack and a maintainer account hit. Many call for migrating off the project and criticize the incident response as negligent.
8Security Disclosure
- Railway detected unauthorized access to systems storing customer environment variables, which may have exposed some decrypted secrets like API keys and registry credentials. All deployments are paused until builds are restored. Users are urged to immediately roll all environment variables and private registry credentials and review logs. Affected customers will be contacted directly.
Key rotation blocked by deploy freeze
Users who rotated keys after Railway's advice found they could not redeploy, leaving services broken or offline. Redeploys were later restored only for Pro and Enterprise plans, angering Hobby users.Delayed disclosure criticism
Commenters said Railway waited hours or days to notify customers while keys were already being abused. A Railway employee defended the delay as necessary to contain the attacker, which many found unconvincing.Migrating away from Railway
Several users moved workloads to Fly.io, VPSs, or other hosts, citing loss of trust and the inability to rotate variables. Others argued that storing secrets in environment variables is inherently risky.
9Claude Duet
- Claude Duet is a proactive research-preview agent for Pro and Max US subscribers that handles tasks in the cloud, sends a morning brief, and checks in only when your input or approval is needed. It drafts replies, finds unpaid invoices, prepares payroll and contracts, and builds decks or dashboards, asking before sensitive actions like sending messages or paying. It may misjudge urgency or miss items.
Poor UX and missed integration in AI labs' products
Commenters criticize Anthropic for making users re-enter info to join waitlists instead of using Claude's existing context, and note poor search in chat histories, which some see as deliberate to burn tokens.Always-on personal agents: value and risks
Users praise Dot and Muse for handling logistics like buying a house, while others warn about handing over personal data, security risks of agents with password manager access, and unclear use cases.HN feed saturated with AI news
Many users are tired of AI-dominated front page posts, comparing the hype to past trends like crypto, Rust, and React, though others argue AI is simply the biggest tech shift right now.
10WorldTUI: I trained a 360M model to pretend to be a terminal
- A developer fine-tuned a small language model to imitate a terminal, predicting how the screen changes after each keypress with no real shell behind it. It can create files, run vim, tmux and snake, and often remembers earlier input, but it is not reliable. A browser demo is available.
Neural computers as generative interfaces
Commenters describe the project as a micro-version of "Neural Computers," where the UI is predicted from user input. A perfect one would be indistinguishable from a real computer, though one warned it could be a risky way to collect passwords.Prior attempts at simulated shells
Users recall earlier efforts, such as ChatGPT pretending to be a terminal and a VM built inside ChatGPT, plus vibeSH, a shell that uses a frontier model without training. Its tradeoffs include slow interactive apps and memory loss as context fills.Predicted versus real intelligence
One commenter argues a predicted terminal isn't a real one, and by extension predicted intelligence isn't real intelligence. Others counter that it depends on how "real terminal" is defined, and a deterministic model could meet that bar.