Feed aggregator

Now Is the Perfect Time to Change Sudo

Hacker News - Tue, 05/12/2026 - 4:46am

The sore pain is here, LLM agents, NPM ecosystem. The timing looks perfect. There are mature solutions like Chromebooks. Some ideas: two computers in one; or two sudo levels, the higher just for system recovery and diagnosis.

The problem is not so much technical as of providing an easy path to adoption.

Comments URL: https://news.ycombinator.com/item?id=48105781

Points: 1

# Comments: 0

Categories: Hacker News

Stolen Canvas data was “returned” after hacker agreement, Instructure says

Malware Bytes Security - Tue, 05/12/2026 - 4:41am

The Instructure/Canvas data breach that has dominated cybersecurity coverage recently has reached a new stage.

Millions of students had personal data stolen, with extortion group ShinyHunters claiming credit for the data breach and applying extra pressure for their ransom demands by bothering Canvas users directly.

Which seems to have paid off. On the Instructure web page about the recent data breach, a status update dated May 11, 26 says:

“We know that concerns about the potential publication of data related to this incident remain top of mind for many customers. We understand how unsettling situations like this can be, and protecting our community remains our top priority.

With that responsibility in mind, Instructure reached an agreement with the unauthorized actor involved in this incident.”

This implies that Instructure has paid ShinyHunters. At least some of that money will almost certainly go toward funding future cybercrime operations. Whether companies should ever pay ransomware or extortion demands remains a contentious debate, and that is not an argument I want to reignite here.

What I don’t understand is the next phrase in the update:

“The data was returned to us.”

While that may be intended to sound reassuring, in cybersecurity, data is not a borrowed laptop or a misplaced folder. Once copied, it can be copied again, and again.

That matters because the incident wasn’t just about temporary access. Instructure said the unauthorized access involved usernames, email addresses, course names, enrollment information, and messages.

Data cannot simply be “returned”

So, when a company says the data was “returned” and “shred logs” were provided, the real question is not whether the attackers still possess the original files. It is whether copies were made, whether those copies were shared and with whom. So, in essence, whether the breach’s downstream risks have actually been eliminated. While these types of cybercriminals tend to operate on trust, digital data does not come with a guaranteed recall function.

The good news is that Instructure says no passwords, dates of birth, government identifiers, or financial information were involved. But names, email addresses, course details, and private messages are still enough to fuel highly targeted phishing and social engineering long after the headlines fade.

For students and families, the practical advice from our original blog still applies:

  • Reset Canvas‑related passwords
  • Enable multi‑factor authentication where possible
  • Monitor financial and credit activity as children get older
  • Stay wary of highly personalized phishing that references real schools, courses, or teachers

Your name, address, and phone number are probably already for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

SCAN NOW

Categories: Malware Bytes

Show HN: RipStop – Git guardrails to reduce impact if your code agent goes wild

Hacker News - Tue, 05/12/2026 - 4:33am

Hi all,

RipStop is a node package implementing a set of rules that consumers can use to protect their repos from wilder actions by LLM agents. A consumer needs only a few lines of code to configure the rules they wish to apply. Example rules: no PII in commits, no Git actions that interfere with the Git history and thus might impact your ability to recover from problems.

I built this for two main reasons: - in my own repos I had a few incidents - in one Claude Code erased some un-staged changes, and in another started trying to roll back some commits. - I was reflecting on why agentic development is slow on the uptake in corporate environments. One possibility is fear of the wilder actions LLMs take - so I thought it might be helpful to illustrate how to control these.

The security model is as follows: - Layer 1 - guidance to the LLM in AGENTS.md or CLAUDE.md. This is of course guidance, and gets forgotten if context rot sets in. - Layer 2 - Git controls, via hooks that get fired automatically on various actions. Higher hurdle - the LLM would need to generate very specific commands to get round these. This is the space I am aiming at. BTW we also generate a file to go into AGENTS.md to tell the agent the environment it is working in and the controls the consumer has chosen, so there is a bit of layer 1. - Layer 3 - containers with hard configuration. Not trying to go this far in this package. This is really the space the major labs are going after with cloud agents.

I think it might be useful in two domains: - People running local agents who want a little more safety - A POC for corporate controls

Feel free to look, provide commentary, and use.

Jon

Comments URL: https://news.ycombinator.com/item?id=48105699

Points: 2

# Comments: 1

Categories: Hacker News

Show HN: Java/Spring Boot Idempotency Library

Hacker News - Tue, 05/12/2026 - 4:23am

Idempotency4j is a Java idempotency library with pluggable storage backends and Spring Web / Spring Boot support.

This library solves the problem of ensuring that sensitive endpoints do not trigger side-effects multiple times - this is especially useful for any endpoints that handle financial operations. Currently, the library supports Spring MVC (Servlet-based) applications and MySQL and PostgreSQL with jdbc regarding storage backends. It is very simple to integrate, all that you have to do is add @Idempotent to any endpoints that need idempotency.

Full explanation of the functionalities and configuration is available in the readme of the repository. Repository : https://github.com/josipmusa/idempotency4j

I would love any feedback or review regarding the implementation - also, any recommendation is welcome.

Comments URL: https://news.ycombinator.com/item?id=48105635

Points: 1

# Comments: 0

Categories: Hacker News

Germany's Decline in Data

Hacker News - Tue, 05/12/2026 - 4:18am

Article URL: https://ourdeclineindata.com/

Comments URL: https://news.ycombinator.com/item?id=48105604

Points: 4

# Comments: 1

Categories: Hacker News

Yet Another Boilerplate

Hacker News - Tue, 05/12/2026 - 4:10am
Categories: Hacker News

Pages