Bilingual

A peek into Reddit's anti-spam internals
8 days ago
- An unusual bug exposed internal Reddit spam removal reasons to a moderator in 2021.
- Spam removal systems include 'spamurai' (rules-based), 'spammit' (percentage scoring), and shadowbans.
- Domain bans and keyword filters (e.g., 'torenteu') are used to block spam links.
- Reddit uses the Perspective API to detect spam, but this API is being shut down in 2026.
- Spamurai logs extensive data: account age, karma, reports, ISP, user agent, TLS fingerprints, and more.
- URL inspection can follow redirects to detect banned patterns, leading to account bans.
- Anti-spam systems have evolved from CRM114 to REV1, Snooron, and REV2, likely using Lua rules.
- The author withheld details for years to avoid aiding spammers, but now sees the information as less critical due to API deprecation and LLMs.
Reddit will require you to log in to use old.reddit.com
5 days ago
- Reddit will require users to log in to access old.reddit.com starting next month.
- The change aims to reduce abusive scraping and automated traffic on the platform.
- Logged-out old.reddit.com is a significant source of abusive activity, but also important for long-time users.
- Logging in provides Reddit with more signals to detect rule-breaking accounts and block traffic.
- Some users may be upset as they prefer old.reddit.com for its familiar interface and privacy without logging in.
- Reddit claims old.reddit.com lacks modern security, making it more vulnerable to malicious traffic.
Tor’s Arti 2.5.0 Released: Stable Counter Galois Onion
5 days ago
- Arti 2.5.0 released with Counter Galois Onion marked as a stable feature.
- Congestion Control is now enabled in default builds to increase speed.
- Includes fixes for two medium-severity DoS security issues.
- Ongoing development for using Arti as a relay and directory authority.
- Minimum supported Rust version increased to Rust 1.91.
- Contains bugfixes, cleanups, and improvements across the codebase.
A Special Wireless-Free Nikon Camera Is Publicly Available for the First Time
11 days ago
- Nikon Z6 III (No Wireless Connectivity) is now publicly available through retailers.
- Camera lacks Wi-Fi and Bluetooth chips due to security needs for government and industrial clients.
- Priced higher ($3,079.95 MSRP) than standard Z6 III despite fewer features.
- Higher cost due to specialized, limited manufacturing and assembly modifications.
- Nikon offers it to evaluate market demand for similar future products.
The pandemic of incomplete OpenSSL error handling
a day ago
- A bug report for APT highlighted TLS failures on FIPS systems due to MD5 errors, suggesting use of ERR_clear_error() around TLS operations.
- The author opposes this as a bad practice, arguing that discarding unrelated errors is unsafe and that the root cause should be fixed instead.
- ERR_clear_error() is widely used as a best practice in many codebases, but it leads to a systemic issue of incomplete error handling.
- Another anti-pattern involves checking top-level errors after OpenSSL operations and discarding them if deemed not severe, which also silences unrelated errors.
- Developers are encouraged to inspect code for ERR_clear_error() calls and consider using ERR_set_mark() for safer error stack management.
- A call is made to OpenSSL authors to avoid promoting practices that compromise security and trust in software.
Be a Hikikomori for Science
21 hours ago
- Nvidia introduces a datacenter financing scheme to generate revenue from multiple streams.
- Companies are increasing both AI implementation and hiring, but this may not align with business objectives.
- SoftBank enters the GPU rental market to utilize its extensive US server farm for AI training.
- The UN emphasizes the need for global governance to prevent risks from rapidly advancing AI capabilities.
- Oracle outlines potential risks in its heavy investment in AI, highlighting numerous risk factors.
- Russian actors are impersonating Signal support for phishing attacks; the US disrupts Iranian propaganda sites.
- Microsoft's patches fail to fix vulnerabilities in on-prem SharePoint, now targeted in zero-day attacks.
- DEF CON expands efforts to include hackers in hardening critical infrastructure through the Franklin project.
- EQT acquires a majority stake in Acronis at a valuation exceeding $3.5 billion, though specifics are unclear.
- Ten years after the first corporate ransomware, Mikko Hyppönen predicts continued threats, noting cybersecurity as a stable career.
- Collabora releases CODE 26.04 with new features like Markdown support and optional AI integration.
- GIMP 0.54 is revived in Flatpak form, offering a retro-computing experience with the original Motif interface.
- Bcachefs exits experimental status with performance improvements and increased Rust usage, but faces AI-related issues.
- France's digital sovereignty efforts struggle to reduce reliance on Microsoft, as seen in Nextcloud and Office challenges.
- The history of CentOS traces its evolution from a hobby project to a default enterprise OS after community collaboration.
- A Netflix developer open-sources Project Headroom, an app designed to significantly reduce AI-related costs.
Guix substitute and guix pull vulnerabilities
21 hours ago
- Guix substitute utility has vulnerabilities enabling remote privilege escalation, store corruption, and file disclosure, affecting all systems regardless of root privileges.
- Exploitation requires downloading a binary substitute; any substitute server or MITM can attack, even with HTTPS, and local exploitation requires socket access.
- Guix pull and guix time-machine have a vulnerability allowing channel file control to create or overwrite files, mainly causing denial-of-service risks.
- Four specific vulnerabilities are detailed: restore-file not hardened, fetch-narinfos not verifying URLs, file:// URI issues, and cache-key misuse.
- Mitigation includes disabling substitutes with --no-substitutes, avoiding untrusted channels files, and updating to fixed commits via guix pull and daemon restart.
- Fixes involve hardening restore-file, verifying narinfos, restricting file:// URIs, and modifying cache-key derivation to prevent directory traversal.
- Upgrading instructions vary for Guix System and other distributions, emphasizing immediate updates and cautious substitute use during the process.
- Timeline shows discovery from May to June 2026, with coordinated disclosure and fixes via pull request #9665.
- A test script is provided to check vulnerability status, with code included for validation.

Hasty Briefsbeta

#security

A peek into Reddit's anti-spam internals

Reddit will require you to log in to use old.reddit.com

Tor’s Arti 2.5.0 Released: Stable Counter Galois Onion

A Special Wireless-Free Nikon Camera Is Publicly Available for the First Time

The pandemic of incomplete OpenSSL error handling

Be a Hikikomori for Science

Guix substitute and guix pull vulnerabilities