CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2
CVE‑2025‑13032 is a double‑fetch flaw in Avast’s kernel driver that lets an attacker cause a paged‑pool overflow. The driver reads a user‑supplied _UNICODE_STRING twice: first to size a ExAllocatePoolWithTag allocation, then again for a memmove. By racing a second thread that flips the Length field between a safe value and a large one, the kernel allocates a small buffer but copies more data, overflowing into adjacent heap objects.
The exploit sprays IORing objects, whose RegBuffers array resides in the same pool bucket. After freeing selected RegBuffers chunks, the overflowing allocation lands next to a live RegBuffers entry, overwriting one pointer to reference a user‑controlled fake _IOP_MC_BUFFER_ENTRY. This yields an arbitrary kernel read/write primitive: IoRingReadFile writes to the address in Address field (arbitrary write) and IoRingWriteFile reads from it (arbitrary read).
Using the corrupted entry, the attacker reads the MDL created for the user buffer, extracts the Process field to leak their own EPROCESS address, and repairs the corrupted ProcessBilled field to avoid a BSOD. Finally, the token of the SYSTEM process is copied into the attacker’s EPROCESS token field, achieving full privilege escalation. The vulnerability has since been patched.
F-Droid 2.0
F-Droid 2.0 is a complete redesign of the official F-Droid Android client, built with Kotlin and Jetpack Compose to align with modern Android standards and Material Design. The UI is reorganized into three primary sections—Discover, Search, and My Apps—while categories are expanded into finer‑grained, meta‑grouped listings (e.g., 17 game genres, specialized VPN, firewall, password‑manager categories). Search now indexes app names, descriptions, categories and translated text, with improved CJK support and query history. Powerful, combinable filters let users narrow results by category, device compatibility, or anti‑features. Update checks run automatically in the background; manual refresh is moved to an overflow menu. The installer leverages Android’s pre‑approval API for a smoother, near‑instant install flow on supported devices. Privacy tools retain Tor proxy support (now via TorVPN) and simplified “panic” masking (icon/name only). F-Droid Privileged Extension is unsupported; background updates rely on the session installer. The rewrite lowers contribution barriers by using current Android languages and tooling, and the project continues to seek testing, translation, code, and financial support.
The comments express mixed reactions to F‑Droid’s recent redesign and 2.0 release: many appreciate the visual refresh, improved search, and background updating without the privileged extension, while others criticize the minimalist UI, missing visual cues, lack of ratings or reviews, and confusing update handling. Repeated concerns include repository sync speed, limited TV navigation, absence of category usefulness, and uncertainty about future Google restrictions. Users also discuss alternative stores, desire for a desktop client, and the balance between simplicity and advanced functionality. Overall sentiment is cautiously optimistic but highlights several usability and policy gaps.
Pentium II at 600Mhz with Voodoo 3 Emulated on 86Box with M6 Mac Mini
The article evaluates retro PC emulation on Apple‑silicon Mac Minis using 86Box 6.0 (May 31 2026). 86Box emulates a Pentium II (Deschutes) system with 256 MiB RAM, Voodoo 3 VGA (16 MiB, 2 threads), and Windows 98 SE; performance is measured by maintaining 100 % emulation speed (no audio dropouts) while running Cinebench 2000 and 3DMark 2000 SE under Winamp audio playback.
Tests compare a 12‑core M6 (24 GiB) to a 10‑core M4 (16 GiB). The M6 sustains a stable 600 MHz emulated CPU clock (flat 100 % speed, no audio glitches), whereas the M4 caps at 500 MHz; the M4 begins to hitch at 550 MHz. Single‑thread performance is the limiting factor, as 86Box’s workload runs on two “super” cores, which on the M6 reach ~4.5–4.8 GHz with ~45 % utilization, leaving headroom.
Cinebench scores for the emulated Pentium II rise with clock (e.g., 9.28 CB at 600 MHz) and exceed period hardware results, reflecting emulator timing differences. The review concludes that the M6’s high‑speed cores make it a notably capable, low‑cost platform for accurate retro‑PC emulation.
The comments express overall enthusiasm for emulation, highlighting 86box’s accuracy and enjoyment in running legacy hardware and software, including custom operating‑system development for early‑era CPUs. Users note that the described specifications comfortably support classic games such as Need for Speed II, reinforcing the perception of sufficient performance. A light‑hearted remark underscores a nostalgic view of the emulation era, collectively portraying a positive and appreciative attitude toward retro computing experiences.
Show HN: Make cursed fonts like Times New Bastard
Bastardica is a standard OpenType font that employs a contextual substitution (“swap”) registered for every script, which browsers activate automatically. It functions wherever OpenType shaping occurs—browsers, design tools, and print—provided ligatures are not disabled. The font adds visual richness by applying Y‑offset and scaling adjustments to align glyphs precisely. When three or more fonts are combined, their glyphs intersect at regular intervals (e.g., a 5‑glyph and a 7‑glyph stride collide every 35th glyph); the first font in the sequence takes precedence, and the stride remains unchanged. Using prime‑number strides reduces such collisions. The text also lists common sources for free fonts, including Google Fonts, UNCUT, Velvetyne, Font Squirrel, FontSpace, and DaFont.
The comments are largely playful and enthusiastic, celebrating the tool’s ability to remix and mash‑up font glyphs for jokes, artistic experiments, and custom designs, with many users expressing delight at creating odd or humorous hybrids such as “Papyrus + Comic Sans” or ransom‑note styles. A few note technical glitches on certain platforms and raise mild concerns about copyright or piracy perceptions, but overall the reaction is positive, highlighting creative potential, ease of use, and inspiration for further font‑related projects.
Show HN: Whiteboard (YC W26) – An open-source IDE for thoughtful software design
Whiteboard is an MIT‑licensed, open‑source desktop application that lets developers and AI agents collaboratively design software on a shared canvas. It integrates with coding agents such as Claude Code, Codex, GPT‑6 Sol, and Claude Opus 5.5, providing an SDK for agents to draw and annotate directly in the app. Users download the app, connect an agent, and can ask the agent to review a branch against the main line, with results displayed on the canvas. Key features include clickable visualizations (sequence diagrams, ER diagrams, trace excerpts) that jump to underlying code, a Rust‑based, AST‑aware diff viewer that summarizes large additions and collapses tests/documentation, and a WASM‑based plugin system for customization. Agents can query and link their own execution traces for traceability. Limitations: files cannot be edited within Whiteboard, multi‑repo browsing is limited, and shared reviews do not auto‑update. Telemetry is anonymous and optional. The app is built on a vendored Code OSS (VS Code) base, with regular upstream security and feature updates. Contributions follow standard open‑source guidelines.
The comments show broad enthusiasm for a visual, AI‑assisted architecture tool, praising its clean interface, semantic‑diff concept and potential to reduce cognitive load during design and review. Reviewers appreciate the integration with coding agents and see value for corporate adoption, but many raise practical concerns: lack of file editing, absence of Windows/Linux builds, ambiguity around calling it an IDE, risk of diagrams diverging from code, and uncertainty about pricing and feature roadmap. Comparisons to open‑source alternatives and suggestions for LSP support, dark mode and tighter toolchain integration also recur. Overall sentiment is optimistic yet cautious, seeking more functionality and platform coverage.
Why is the liver so weirdly regenerative?
The comments collectively express enthusiasm for biological complexity and regeneration, while offering corrections to oversimplified claims about cell turnover, neurogenesis, and organ cancer risk. Personal experiences with liver transplantation illustrate the organ’s regenerative ability and highlight clinical challenges. Several participants criticize teleological language and emphasize evolutionary trade‑offs, noting that many traits reflect limited selective pressure rather than optimal design. Overall the discussion balances admiration for physiological resilience with calls for more precise scientific framing.
2DWillNeverDie
Comments largely emphasize a nostalgic appreciation for 2D pixel art, noting its timeless visual quality and emotional resonance compared to early 3D graphics. Many point out practical advantages of using 3D tools to generate 2D sprites, especially for animation efficiency in modern game production. There is disappointment over the decline of traditional 2D techniques in major studios, while recognizing indie efforts that sustain the style. Additional observations mention the interactive design of the referenced site, its retro aesthetic, and occasional humor or irrelevant dead entries.
Fearless SIMD v1.0
Fearless SIMD v1.0 releases after eight years of development, offering a Rust crate that combines autovectorization, multiversioning, portable SIMD abstractions, and direct intrinsic access without requiring unsafe code. Performance‑focused features include precise and fast variants for edge‑case‑sensitive operations, native‑vector‑size APIs, fixed‑size vectors, and upstream contributions to Rust and LLVM; developers can drop to platform intrinsics when needed with zero overhead. Safety is achieved by the kernel! macro (leveraging target‑feature v1.1) to invoke intrinsics safely and a minimal, audited transmute module for load/store operations, ensuring memory safety across the codebase. Ergonomic improvements come from the #[simd] procedural macro (part of fearless_simd_macros v0.1) that handles function multiversioning without manual #[inline] annotations, while preserving backward compatibility for non‑macro usage. The crate commits to three years of security updates and anticipates support for future Rust features (e.g., f16) and hardware extensions (SVE, RISC‑V vectors) without breaking the API. Although std::simd may eventually overlap, Fearless SIMD will remain relevant as an ecosystem complement. It is already a direct dependency of 30 crates and indirectly used by over a thousand, indicating growing adoption.
The discussion expresses strong approval of Fearless SIMD, highlighting how it enabled stable‑Rust crates like PhastFT and memchr‑n to achieve competitive or superior performance without nightly features. Contributors note that the crate’s development has spurred ecosystem improvements, though they also point out gaps in functionality that motivate further work. Several participants inquire about extending compiler interprocedural analysis for custom numeric properties, compare the library to alternatives such as Highway, ISPC, and earlier Rust SIMD attempts, and suggest additional features like f16 support. Overall sentiment is supportive and forward‑looking.
Rails World 2026 Opening Keynote [video]
The extracted page consists of a typical YouTube footer containing navigation links: “About”, “Press”, “Copyright”, “Contact us”, “Creators”, “Advertise”, “Developers”, “Terms”, “Privacy”, “Policy & Safety”, “How YouTube works”, “Test new features”, and “NFL Sunday Ticket”. It concludes with a copyright notice stating © 2026 Google LLC. These links provide access to corporate information, media relations, intellectual‑property statements, user support, resources for video creators, advertising programs, API documentation for developers, legal agreements, privacy controls, community safety guidelines, operational explanations of the platform, beta testing opportunities, and subscription details for the NFL Sunday Ticket service. No additional content or descriptive text is present.
Comments show a mixed but thoughtful reaction to the keynote. Many appreciate the optimistic view that newer tools let developers revisit legacy architectures and explore performance gains, especially the Rust rewrite and agent‑driven coding. Others express skepticism about AI’s role, fearing job displacement, loss of architectural discipline, and questioning the relevance of Rails going forward. Critics also note DHH’s shifting tone and political remarks, while some defenders argue Rails still suits conventional CRUD projects and that high‑quality custom code will remain valuable. Overall, the discussion balances curiosity about emerging technologies with concern for the Rails ecosystem’s future.
Toyota is taking the Corolla electric
Toyota is preparing an all‑electric version of its best‑selling Corolla, slated to debut as a 2028 model year (launch expected in 2027). The next‑gen Corolla will be built on a heavily modified TNGA‑C platform capable of supporting internal‑combustion, hybrid, plug‑in hybrid (PHEV) and battery‑electric (EV) powertrains. Planned body styles include sedan, hatchback, crossover and a GR variant. The hybrid will pair a new 1.5 L four‑cylinder engine with an electric motor for roughly 134 hp and 10‑20 % improved efficiency; an AWD hybrid may be offered. The PHEV will use a larger battery for extended electric range (specifics not disclosed). The Corolla EV will offer single‑ and dual‑motor layouts with a minimum 250‑mile range. Anticipated US pricing: gas model ≈ $25,000, hybrid ≈ $27,000, EV and PHEV around $30,000. Toyota CEO Koji Sato emphasized a design overhaul and universal appeal across all power sources.
Comments coalesce around skepticism toward Toyota’s strategy of adapting an existing Corolla platform for an electric model, with many viewing the resulting design as overly complex, costly, and insufficiently dedicated compared with ground‑up EVs such as the bZ series. Viewers express a strong preference for a simple, affordable, Corolla‑sized BEV that retains analog simplicity and reliable hybrid traits, while questioning charging practicality, price gaps, and limited range. Praise is directed toward competitors’ more focused EV offerings, and overall sentiment remains doubtful that Toyota’s upcoming electric Corolla will meet mass‑market expectations.
The overall tone is critical of contemporary antivirus software, describing it as overly intrusive and counterproductive compared to its earlier, simpler signature‑scanning role. The comment argues that modern AV tools act like a sledgehammer, adding unnecessary complexity that creates more issues than it resolves. It promotes application whitelisting as a preferable strategy for runtime security, emphasizing minimal access and tighter control as a more effective protective measure.