fidzu : computers

Be careful with the file .claude/settings.local.json, warns The Hacker News: Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said that 1,122 public copies of that file hold at least one secret, though it did not test whether any still work. One company the researchers notified earlier this week confirmed its key had been live... Removing [the file] from a project does not undo the leak, because older versions stay in git history and in forks of the repository. The researchers' advice is to rotate first: change every password, token, and key the file has ever held, then clean up... Claude Code tries to keep the file out of git. The first time it writes the file in a git repository, it adds the file to the user's global git excludes, its settings documentation says. Git on that computer then ignores the file in every repository. That protection stays in one user's git settings on one computer. It does nothing for a file that was already committed, the researchers say. Claude Code never adds the file to the project's own .gitignore, so the protection does not travel with the project. In 539 of the 1,105 repositories the researchers traced, a commit listing Claude as a co-author changed the file. They take this to mean Claude often commits the file itself. Apiiro's search of public GitHub found 104,185 copies of the file in 103,617 repositories, its research write-up shows. About 1.1% of them, or 1,122 copies, hold at least one secret. Together they hold 1,379 different secrets... ]And "in half of those repositories it had been there for at least 217 days."] More than a third of the secrets open a database directly, including 379 database passwords. Others include 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Among the owners of these files are 63 organizations, mostly software companies of all sizes. The strongest cases include a database vendor's own admin-level cloud key and the owner password of a medical-records database, the researchers say. Boris Cherny, Anthropic's head of Claude Code, responded to the story in a comment on Hacker News: "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this. That said, a few thoughts: 1. .claude/settings.local.json is meant to stay local. This is not a file you should check into source control. We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in (docs: https://code.claude.com/docs/en/settings) 2. Permission rules are old hat. Everyone should be using auto mode instead. It is safer and also does not require manually maintaining finicky allow/deny lists. Auto mode is enabled by default and is included for free in all plans. 3. Regardless of what agent you use, you should have secret scanning enabled. GitHub and other source control hosts offer it. There are many threat models that it protects against and you should absolutely use it if you can. (see https://github.com/security/plans)" Cherny also named approaches Anthropic plans to prototype, Apiiro notes in an update, citing Cherny's goal of "making sure auto mode catches this, building in basic secret scanning," and, when a reader noted the same can happen in auto mode when it asks about a sensitive command, answered "good catch." Claude Code users had already filed a bug report on the issue on August 11, 2025, notes The Hacker News, but "An automated bot closed that report as 'not planned' on January 3, after 60 days without activity." Three more bug reports were then filed, according to the researchers. "None got a reply from Anthropic, and three were closed automatically as inactive or duplicate."

Read more of this story at Slashdot.

08 Nov 2026 6:34pm GMT

"According to a new study by researchers at Harvard University and the University of Pennsylvania, data centers are probably having only a small effect on residential electricity prices," reports the Washington Post. "The researchers calculated that these operations were responsible for just 4% of the utility rate increases over the last five years..." There are certainly some areas - like in Pennsylvania, Virginia, Ohio and other states covered by grid operator PJM - where data centers have skyrocketed demand, pushing some costs onto residential customers. But multiple studies by different researchers and organizations have failed to find a strong connection between data centers and the overall trajectory of U.S. electricity prices in recent years. Another analysis earlier this year by researchers at the Massachusetts Institute of Technology found that, between 2010 and 2024, data centers increased average electricity prices for residential customers by just 2.1%. Last year, research from the Brattle Group and Lawrence Berkeley National Laboratory found that data centers were actually decreasing costs in certain regions. And another study by the Electric Power Research Institute found that a doubling of data center capacity between 2019 and 2024 resulted in a 4 percent drop in home electricity prices... The new Harvard and Penn study found a slightly higher impact on industrial electricity prices - the price paid by manufacturers and large facilities. For those customers, data centers were responsible for 15% of the price increase between 2020 and 2025. But for ordinary Americans... the changes simply were not substantial [according to Wharton School professor Serguei Netessine, one of the study's authors]. "So far we have no evidence that data centers increase prices all that much," Netessine said. Instead, he said, prices are rising due to more quotidian factors: rising gas prices, an aging electricity grid, and wildfires and hurricanes requiring improvements to the grid and recovery after disaster... If the number of data centers continue to boom, experts say, residential prices could be affected more down the line. Data center electricity demand is expected to increase steeply over the next few years, requiring new power generation - wind, solar or natural gas - to be put onto the grid. And residents have issues with data centers that go beyond the price of electricity. The new developments have been singled out for loud noise, polluting power generation, and for disturbing residential neighborhoods and natural landscapes. According to the Pew Research Center, more than half of Americans say that data centers are mostly bad for the environment. Others feel that the AI race - which could ultimately leave many Americans out of work - is being forced upon them. "I think generally what we're seeing is a broader range of reasons the public has opposed data centers," [said Ryan Hledik, principal at the Brattle Group]. "Concern about AI leading to loss of jobs - all of that is getting packaged together."

Read more of this story at Slashdot.

08 Nov 2026 5:34pm GMT

ole (Slashdot reader #19,909) writes in about his free, Norwegian open-source music recording studio for GNOME called GarageJam, which he says allows musicians to compose, record, and share original music seamlessly on the Internet. The latest release, GarageJam 8.0.1, is available in C and Python. It records audio immediately to Ogg Vorbis (.ogg) files in the current working directory and lets you edit metadata in .gjxml XML files from a GTK/GNOME wizard - all built on the Gingerblue Recording Studio API. Ole shares links to its IETF GarageJam XML draft and GitHub repositories, and there's also GarageJam Studio, "a commercial music and audio recording app for the World Wide Web written by Aamot Innovation from Norway.". ole is also spreading the word about GNOME Media, which "puts internet radio and your photographs on one OpenStreetMap... built from GNOME Radio 85.0.1." Click a station on the map to listen. Cities with several stations show a count and a menu. Open a folder of pictures or import from a camera. Photos with a GPS position in their EXIF data appear on the map. Double-click a thumbnail to open it. The search box filters the station list and the map together. ole also announces: GPhoto 3.0.1. ("After 25 years, libgphoto2 2.5.34 now supports more than 2,500 camera models, and GPhoto 3.0.1 is built on it.") Skolelinux 13.6.0. Built on Debian 13 âoetrixieâ, Skolelinux is "a complete, ready-to-use Free Software operating system for schools, classrooms and home computers... an office suite, web browser, educational programs and network services for an entire school, all set up out of the box."

Read more of this story at Slashdot.

08 Nov 2026 4:34pm GMT

Tuning in to electronic noise can tell us whether electrons have paired up or not.

08 Nov 2026 12:15pm GMT

About five months after the previous release, the MorphOS team has released MorphOS 3.21. It brings the usual list of big fixes and smaller improvements, but there's a few big ticket items in here as well. MorphOS 3.21 introduces BasicWorks, an office suite made up of CellBasics and PageBasics. It offers document and spreadsheet authoring and loads and saves Microsoft Office and OpenOffice documents. Also new are NVMEMount, an auto-mounter for booting from and mounting NVMe partitions, and the Marbles and Cyber 3D blankers. Graphics performance has been improved, with a faster Radeon driver on cards with little video memory thanks to GART backed bitmap transfers, quicker TinyGL texture copies, hardware accelerated antialiased text in TTEngine and much faster color SVG glyph rendering in Cairo. The Bcm43xx wireless driver has been substantially reworked, with automatic transmit rate selection, updated firmware and numerous connection fixes. PowerBook and iMac hotkeys are now fully configurable. ↫ MorphOS 3.21 release announcement The BasicWorks office suite has been in the works for a while now, and more information on it can be found in a thread on the MorphZone forums and on the website for the spreadsheet component of the suite, CellBasics. The formula loaders and xlsx loaders are ports of open source projects, but the rest of the application is new code based on ObjectiveC++ and Cairo/Harfbuzz. It uses its own file format, but can import csv and xslsx files, so I'm assuming the same more or else applies to the word processor (but with docx, of course). Alongside MorphOS 3.21 also comes a new release for Wayfarer, the web browser the Amiga-inspired operating system uses. Wayfarer 12.0 moves to WebKitGTK 2.52.5 (which was released in July of 2026, so it's quite up to date), and now uses the Skia graphics library. R300-R500 Radeons will render websites with Skia-GL for some massive performance improvements, helped further along by a slew of additional performance optimisations. Adblocking has been improved as well, YouTube should work a lot better now, and much more. The full release notes for MorphOS 3.21 give you all the details.

07 Nov 2026 7:46pm GMT

Ask any program to listen on port 0 and it will hand you a socket on port 47193…or 58037…or whatever the kernel felt like that day. Port 0 is not a port you can have. It is the number you pass when you want the operating system to pick one for you. But a TCP header is just bytes. The destination port field is 16 bits wide, and 0x0000 fits in 16 bits as well as anything else does. Nothing on the wire stops a packet from being addressed to port 0. Your tools will refuse it, your browser will block it, and your scanner's default port list skips it, because everyone agrees it isn't a real port. Which makes it a pretty good place to hide things, whether anyone meant to or not. So we did some TCP cowboy shit & port scanned the entire fucking internet for open ports on port 0, which uncovered some interesting unexpected findings. ↫ acidvegas An awesome and entertaining read. Don't skip this one.

07 Nov 2026 7:33pm GMT

A little tidbit of news regarding the nest major update to Windows, known as Windows 11 27H2. Apparently, it's going to come with some more serious changes to the codebase, therefore necessitating a full operating system swap instead of a mere enablement package, much like Windows 11 24H2 was. For those who need a refresher, Microsoft has long been rumored to be running on a three-year release cadence and for a while, it was even thought that the company would launch Windows 12 in 2H 2024. That evidently didn't happen, as instead we got Windows 11 24H2, but it was a major upgrade, a full OS swap compared to Windows 11 23H2 and 22H2. Essentially, it looks like every three releases, Microsoft is performing a full swap with major changes in the underlying codebase, and it seems to line up with Windows 11 27H2 as well. At the moment it's not known if system requirements will change or not. ↫ Sayan Sen at Neowin.net Microsoft is currently testing adding support for Intel's Advanced Performance Extensions, which should yield improved 64bit performance and reduced power consumption. It makes sense to assume this support will be coming with Windows 11 27H2, which should hopefully lead to tangible performance improvements across the board. Also, there's going to be a new default wallpaper. Be still my beating heart.

07 Nov 2026 7:27pm GMT

Genes and archaeology are revealing how Bantu speakers spread across much of Africa.

07 Nov 2026 12:15pm GMT

Soldier told repeatedly to lock down devices before deploying, got sextorted, court-martialed.

07 Nov 2026 11:00am GMT

This is a story of how we got from something like this: Failed to deserialize BUILDINFO file: Parser failed with the following error: unknown ^ invalid makepkg build environment option expected `buildflags`, `ccache`, `check`, `color`, `distcc`, `sign`, `makeflags` To this: When the ALPM project started, the goal was fairly simple: Better tooling to interact with the low-level plumbing of Arch Linux Package Management (ALPM). This meant binaries to read/write individual file types, better error messages, extensive specifications and of course exports to common dataformats like JSON. The thing is, although some of us already had experience with low-level dataframe parsing, …

08 Oct 2026 12:00am GMT

Over the last few weeks, we have been doing research on the integration of our official distribution packages when installed on a target system. In this context we have been looking at the current uses of alpm-install-scriptlet(5) files and alpm-hooks(5) in around 120 package source repositories (alpm-source-repo(7)) to better understand the underlying functionality and use-cases these two integrations offer and target. In this article we are going to look at how these two systems work, how Arch Linux is currently using them and attempt to provide suggestions for when to use which. Learning about alpm-hooks(5) and alpm-install-scriptlet(5) files …

09 Aug 2026 12:00am GMT

Good morning from JetBrains Berlin office!

01 Jun 2026 12:00am GMT