12. Honey, We Bought an AI Story (www.bona-books.com)

Bona Books share a hard-learned lesson: we accidentally bought AI-generated fiction. This deep dive into our experience with submission fraud covers the "red flags" we missed, the toll it took on our small press, and our call for industry-wide solidarity against AI-written content. Learn h

18. We Got This Wrong. and We Are Fixing It (community.hubspot.com)

We made a mistake. Nothing matters more to us than the trust of our customers, and with our recent terms of service update we let you down. We are sorry about that. We will not move forward with the terms of service changes we communicated on July 1, 2026. You control your data. This has always been our policy and will not change. I want to explain what we were trying to do, where we went wrong, and how we’ll do better from here to earn and keep your trust. What we were trying to do We know h...

24. Git Hash Chain Malleability (arxiv.org)

Git commit signing is widely entrusted to serve as evidence that a commit hash uniquely and immutably identifies a specific piece of signed content. We show this invariant does not hold. Given any signed commit, an attacker without access to the signing key, and without breaking SHA2 can produce a second, distinct commit with an identical tree, identical metadata, a valid signature, and a ``Verified'' badge from a Git Forge such as Github, differing only in its commit hash. The modified commit cascades to modify the values of all the subsequent, dependent commit hashes, hence we introduce the terminology ``hash chain malleability'' to describe this phenomenon. The malleability in signed Git hashes is feasible due to the inherent malleability present in many of the data representations that make up a commit. In this paper we show three such malleation routes: (i) algebraic inversion s -> n-s for ECDSA; (ii) structural insertion of an unhashed OpenPGP subpacket (RFC4880 5.2.3) for RSA and EdDSA; and (iii) non-canonical DER length re-encoding (X.690 10.1) inside the CMS envelope for S/MIME. Algebraic inversion for ECDSA signatures and subpacket insertion were found to pass local verification (git verify-commit), and all three methods yield a persistent, independent ``Verified'' record on Github. We discuss the consequences of Git hash chain malleation for hash-based commit blocking, dependency pinning (Nixpkgs, Go modules, Github Actions), and reproducible-build systems that treat the commit hash as a content-addressable primary key, and we provide proof-of-concept tooling that automates all three routes.

27. A 13th-Century Enumeration Algorithm, Ignored for 700 Years (blog.klipse.tech)

In Or ha-Sekhel, the Kabbalist Abraham Aboulafia prescribes a systematic way to run through every arrangement of the letters of a word. With only two or three simple rules, he describes what we would now call a recursive algorithm for generating permutations.

Article Details

Browse by Date

Type to search HN and engineering blog articles
Press Escape to close  |  ↑↓ to navigate  |  Enter to open