r_lee

but... then people can't constantly pretend they're smarter by telling others I.e. "the kids" what the original meanings are :(

"Google is aware that an exploit for CVE-2026-85046 exists in the wild."

there are many vulns that are sitting idle waiting to be chained like this. plus in some cases adjacent bugs can be found once you find a bug like this.

I forgot HN doesn't believe in contracts. sorry.

from what I remember, they also don't pay it all out at once but rather over time where the payments stop if the bug gets patched.

I don't understand why you're being so cocky here? this is how many 0 click exploits are sourced

these people were simply handed money and power to not do anything about it

I blame governments for not providing a way for whistleblowers to put the companies in a bind to actually do something

the best way to stop these is to force them to do something, not have them voluntarily admit wrongdoing etc.

it's like the whole "well the other ones are doing it too!" which can only be solved with aggressive regulation.

I don't think even today this stuff is being taken seriously enough.

what about the videos of residents showing decibel meters going off and water pressure dropping?

just an anecdote but what exactly do local residents gain here? a handful of permanent maintenance jobs?

you're not allowed to burn exploits like that if you've signed a deal, and who would risk that for $1k?

of course it could be a colleague or someone with access to such tools

yup.

I remember seeing just a few years back, a Greenpeace postlet moaning about dangerous nuclear energy

I think it's pretty clear that nothing meaningful will be done because there's no shock value to entertain the "empaths" like there is with war and other stuff

from my understanding, ZDR for this is for vetted customers only + their whole "privacy preserving abuse monitoring" or whatever is active

but again, seems like there's no word from Azure if this applies to them.

very confusing.

they will if it becomes common knowledge that nobody serious is participating in their bug bounty programs. besides, they have incredibly deep pockets and they can afford to pay 6 figures for bugs like these

advocating for this is much more ethical than donating money to Google. I'd rather have that money go my family than a multi trillion dollar company.

I have a feeling they've been doing that for a while now, even if unintentional, as it's such a well known benchmark

it's such a drop in the bucket, it wouldn't make any difference

this is why again, researchers should just honestly sell these to vuln brokers instead of donating them to trillion dollar companies for nothing.

nothing will change until big tech can no longer rip off security researchers

this is awesome, I've also been looking for these kinds of cables more than the "braided" cables which are stiff and tend to eventually take some kind of shape and not straighten back

because with proper code exec you can trigger other bugs to escalate beyond the sandbox, whereas with JS you'd have to find a bug to escape from JS to native

can't get a proper ios/Android RCE with just JS code exec

I think this is happening right now. It's beyond ridiculous and many seem to be praising 5.6 Sol and others, even Grok 4.6 seems to be a breath of fresh air

great link, thanks

I think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.

I think it's just that many of us don't have the capability to just do things in rote or the conventional ways, instead we must rely more on the creative and unconventional ways of doing things and parts of the brain responsible for that

that's literally what the link is for...

is Azure for this actually ZDR?

is this actually the case? I haven't kept up with the small models

but if there's roughly Sonnet 4.6 level capable open small models, then I'd be impressed

I knew that there was no real moat from the very start, I mean, these things were close enough from the very start, how could it not result in a race to the bottom, especially as you can't really prevent distillation reliably?

those are the vast majority of games that people play

and people won't switch if there is no way to switch, it's like asking people to go on a hunger strike

that's honestly worth flagging.

it seems like the entire world is in some kind of delusional trance, generating "value" with these AI slop articles and AI art

or maybe it's just that I can't imagine people actually putting their time into reading this all when they pick up on the LLMisms. maybe they'll just stop reading these articles altogether

great username lol

yup. how are you ever supposed to compete with that capital moat?

and I'm not an Elon hater, I just don't see how this system can be sustained

nobody is paying engineers for "capable of", they're paying for performance and results..

if there was no difference in performance or results, nobody would be using LLMs or agent harnesses like claude code

I suspect this is what it is, the money got to everyone's head

not too long ago we were amazed at Apple hitting $1 trillion mkt cap and elon reaching $100 bil

now we're waiting for the first trillionaires to show up