I would not use this, I only want to use the glasses as an IO device. You must provide the ability to use the glasses as a regular BT headset.
Where does inference occur? Does it work offline?
I find that I need this most often when I'm doing yard work, running equipment, or cleaning out the garage. Audio based microphones pick up so much noise.
Maybe I could have figured that out from the video but for folks who can’t watch the video it’s quite hard to discover what you’re building.
Second, how tough is this signal processing? Will it be done on-glasses, or through an app? Third, what's the equivalent of a wake word for these? I'm reminded of the Apple Vision Pro radar to see if your fingers are clicking. I could imagine a lot of modalities where I want to just start talking and have things happen, and a lot where I don't want the glasses to pick it up. Fourth, I think a cool voice change demo would be rad -- not sure what latency is like, but if you could get it end to end under like 250ms you could probably have someone exaggerate the mouth movements and pipe out audio of them talking like someone else. Which would be another really cool demo.
Super cool. You're going to be working 80 hour weeks for the next year, I'm excited to see what you put out!
I've found the opposite. Typing feels much more "deliberate", and of course you can hit backspace but you can't un-speak a word. With prompting, I've found that, in general, speaking leads to lower-quality results than typing.
I built this to aggregate all the aggregators (like HackerTube, Hackerbooks etc.) that were popular a few days ago (they go back to 2011, at least).
A couple of months ago (so probably vibe-coded too):
This one even from 6 years ago:
https://www.wolfgangfaust.com/project/paper-hn/ (https://news.ycombinator.com/item?id=23669650, 627 points, 133 comments)
Where dw works, this game teaches vlllld instead, which is a bad habit to teach.
Ctrl+A increments the first number after the cursor, which is easier than, say, f6r7 in cases where they do the same thing. Similarly, Ctrl+X decrements.
t:t: is weird when fY is much easier.
The Vim simulator has a minor difference compared to real Vim:
0
0
Show HN: HackerHype - an aggregator for every Hacker* aggregator
HackerHype
├── HackerTube → videos recommended on HN
├── HackerBooks → books mentioned on HN
├── Wikihack → Wikipedia articles mentioned on HN
├── HackerHack → posts posted on HN
└── ...
Please give reading (especially fiction) another chance. I had a stretch of about a decade where I finished maybe two or three books total. Partly, I didn't think I "needed to read" because of how much time I spend reading HN and other non-fiction sources, especially on the internet: or that I was "too busy".
I was running my startup, and had a copy of Infinite Jest on my bedside table for nearly 2 years -- telling myself that I would finish it. It's an amazing book (the part I've read anyway), but it was such an intricate piece of work that I managed to convince myself I basically had reading-ADHD and there was no point in me trying to read other books.
Last year, I started reading (fiction!) books that were just interesting to me or that other people were talking about, instead of picking up "aspirational" fiction or non-fiction and reading the first chapter.
I've been getting through a book every month or two since and am absolutely loving it. I read a lot of fiction as a child and teenager and I'd forgotten just how visceral good fiction can be. Reading properly again also helped convince me to write stories, too.
If this sounds like you, I challenge you (with kindness) to pick up a piece of approachable fiction and see how much more you get out of it than you expected to!
I think fiction books are more important and more "wholesome" than nonfiction ones.
Correct move on handling the financial aspect yourself. I asked my mine to do everything but forgot to give it some dough. It sorted it all out but ended up with $6.3B on its account and I think it might have done something dodgy.
https://news.ycombinator.com/item?id=2249390
I planned to revive it later, but life got in the way
And fair on the post, I had claude draft it and only edited it a couple of times. Should have just written it myself.
Also... "Each book links back to the comments that mentioned it."
> Please don't put generated text in HN posts.
Claude speak gives me a gag reflex these days.
We could even display them together sorted by the newest one, maybe with some associated comments.
I’d appreciate if the site didn’t hijack my scroll wheel though. It currently doesn’t let me scroll through the page at my own speed, which is super annoying, plus it hides any scroll bar (which would have served as my escape hatch for scrolling).
Props for seeing it through a debugging phase, it can really be worrying when you get your boards and they just don't work.
i couldnt get a single one right lol
Enjoy!
And please feel free to share anything you make with me — I'd love to see. (Contact details in the help menu.)
My feedback: cut the slop. I see a wall of text with explanations that are full of marketing phrases, filler sentences, and there isn’t a clear, curated explanation.
Again, sorry for my blunt feedback.
Turns out exporting a well-formed bitcoin wallet key is hard. I put a wallet-branch WIF on the server, rather than the WIF for the funded address inside that wallet.
Server logs support this being the first (and indeed only) successful execution of the `print-flag` binary with exfiltration and the person who contacted me definitely knows the value of the WIF key on the server so I'm going to evalute this like a solve. I'm in touch with the person who has the flag now and will transfer the wallet to them shortly.
Transfer made. Next steps will be an operator writeup - thanks for keeping this weekend exciting everyone. Since I now own the stealmybitcoin.com domain (can't believe it wasn't taken), I'm sure some new challenge will end up there eventually ;)
Update 4.5: Challenge source (mostly courtesy of Codex...) posted here: https://github.com/pavja2/smbc-source-oct-2026
OP added php-version.php roughly 18–19 hours into the experiment (I'm not sure of the exact timing), so that period should be subtracted from the publicly displayed challenge duration.
Based on my external fingerprinting, I now believe the setup should actually be exploitable!
However, the server is being absolutely hammered with requests and crashes. Making it significantly harder to pull off. This is imo still an unrealistic target. If you are not taking the top 1% PHP websites, then they will have long periods (1 minute) of no traffic.
If someone manages to pull off a working exploit under these conditions, that would be crazy to me.
Any attempt at logging so I can make a blog about the successful solve is gonna be best effort, don't have disk capacity to keep up with the traffic (at peak it was rotating every 12 min...). If you win the challenge, write-ups are definitely welcome.
For those who are saying that the nginx config is unfairly difficult, intention was just to replicate a fairly normal config that was more realistic than you'd get in a lab environment. If we get to 24 hr+ with no solves I'll see about making it easier. In the meantime, seems like you can perhaps mitigate PHP2Shell with the right nginx config, so that's pretty neat!
> (AI) "A static handler (nginx’s static path, or php_cli_server_begin_send_static) just sends bytes; it never enters the PHP request lifecycle, so php_request_startup() never runs and the Zend executor/session/multipart parser the chain needs is never initialized."
The author is trying to prove their point that PHP2Shell is hard to exploit. But it's unrealistic because PHP servers usually run PHP code at some point.
I had an LLM recreate this Tweet and yes, it can make an exploit without reward hacking. It took 5 minutes. https://x.com/dguido/status/2113129153293897925
so basically the OP is doing a little trolling
No, I will not spend $5 in tokens to claim your $1000 bounty. My $5 exploit is worth more than $1000. Thank you very much.
The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.
In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.
The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.
The fact that you keeping your exploit secret means anything already proves their point.
Now it's only worth it to hack a website that's asking to be hacked if the prize is $15k.
2. This CTF is using nginx which has a `client_max_body_size=1m` limit. My exploit right now requires more, but I will give it a try (aka ask Codex).
3. You can setup a server with `docker run php:8.5.11-apache` with any of the over 400 vulnerable `php` apache images and give me the IP.
Given there are public patches and explanations of the issue, isn't it a little late to try to keep this under wraps?
Over a day or two we'll see whether people have an exploit - if more than a few people do, someone will claim this $1k soon. Out of curiosity, what do you plan to do with your exploit that you're holding back?
If that were true, and someone can hack the server for less than $500 of tokens, its an easy profit.
I’d say you’re the one who doesn’t understand the economics at play here. To me and I’m guessing the OP it’s quite simple. Have the exploits become common/simple enough to be worth $500 yet?
It clearly isnt happening.
Sure you can.
There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.
So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…
The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.
That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I, and many of my friends and cooks could take this easily. The difference is we know not to.
Make it $15-25k and it’ll get yoinked instantly, most likely without using PHP2Shell at all.
Steal my Bitcoin
0.65 hours without a successful hack
There is a bitcoin key hidden on this server worth about $502.
It is accessible to the PHP user account through the print-flag binary.
This PHP version was selected from before the PHP2SHELL CVEs were released.
First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org.
All traffic is logged. This is a known vulnerable machine, so we cannot guarantee privacy. Other attackers may access or monitor activity and data beyond our control. Do not submit anything you want to keep private.
Challenge wallet
Explorer ↗
bc1qlnu5…t3cxqy
0.00625104 BTC
≈ $502.35 USD
stealmybitcoin.com · Terms of participation
- A lot of companies have part time, seasonal and contract workers (e.g. Amazon and Walmart). For some this even makes up the majority of their workforce.
- Some companies operate on a franchise model, and corporate employees are very limited. For example the 414K employees listed for Marriott aren't directly employed by them. But then you don't apply the same logic to McDonalds, where you are only counting the corporate employees.
- Holding companies (like Berkshire Hathaway) show the full employee count of their portfolio companies even through they may only own a small share. And again the logic isn't consistent because you are only counting 714 employees for Welltower, which is also a holding company.
Collecting incomplete or incorrect data and adding a hunded disclaimers at the end of the report is standard LLM behavior. Actually valuable analysis of this sort needs a lot more human effort.
An editing pass to make the prose less "punchy" would be great.
My default presumption, without checking with them directly, is not only that it would not be allowed, but that this is also very much not a "better to ask forgiveness than permission" situation either. Even just asking the question can draw attention from them you may not want.
The ready accessibility of the land is advantageous in some ways, but as neighbors the state can be quite nasty. Your other neighbors don't tend to have anywhere near the regulatory firepower to make sure you comply with what they want.
If you wouldn’t even pay for it yourself, as pretty much the sole beneficiary and someone who could afford it but would rather the money go elsewhere, why would it make sense for other taxpayers to pay for it?
Isn’t the premise of “you may as well own that land” the entire appeal of living next to public land anyway?
I live next to a State Park. It sounded really cool when I bought the house. No neighbors! Privacy! There is a trail accessible from my properly that goes into some woods, which you only want to be in during the Fall / Spring because the ticks and chiggers are intense.
The biggest issue with sharing a border with the state is the fence line. Technically it's on them to maintain. The woods are filled with mostly 200 foot trees. They exist right up to my property and fall every year during big storms. There goes the fence line. I have dogs so the fence is important. Otherwise they run out into the woods that have licensed bow-hunting during the Winter.
In practice its impossible to get the fence fixed. You are working through layers of bureaucracy and mismanagement. There is no vested interest from a parks service to work well with hundreds of neighbors individually. I'd build fence lines myself, and could easily pay for it, but it's the upkeep of those fences that would be difficult because so many trees (really, it's every year) fall down from their side.
My main point is that sharing a properly line with the government is more like sharing a properly line with nobody. You may as well own that land. Don't expect any upkeep and go in with eyes open.
But there is!
"Érase un hombre a una nariz pegado, érase una nariz superlativa, érase una nariz sayón y escriba, érase un peje espada muy barbado" (Francisco de Quevedo, 1580-1645)
Or, as translated by Timothy Adès (https://timothyades.com/francisco-de-quevedo-1580-1645-a-una...):
"There was a nose, which had a man appended. It was a nose superb, superlative, it was a nose, a hangman and a scribe, it was a swordfish, sharp and hairy-ended"