NVIDIA Announces CEO Transition

https://www.reuters.com/live/nvidia-live-board-meets-fate-ce...

1590 points | 1660 comments

I hope people understand that the affairs are not the reason he is being fired - NVIDIA has supposedly been skirting the export ban put in place by the previous administration. This was put in place for national security reasons. Whether you agree or disagree with the ban, it exists and Jensen&NVIDIA are in a world of trouble if this comes to light.

From all the reporting I've read, it is hard for me to avoid the conclusion that NVIDIA sold to China despite the export ban. I'd love to be wrong — duplessitous

Anthropic IPO

617 points | 625 comments

It strikes me that if their models were good enough for recursive self improvement, then the VCs would have pushed to delay IPO until such time that they had clear market dominance.

For some reason they need the $100B today at the cost of dilution, rather than additional private rounds and/or using cashflow+profits to continue the advancement. — maerF0x0

Service degradation on Microsoft 365

https://www.abc.net.au/news/2026-11-13/microsoft-outage-affe...

https://www.reddit.com/r/sysadmin/comments/1xuje83/microsoft...

https://downdetector.com/status/microsoft-365/

468 points | 438 comments

Copied this from my post in the other thread:

The Status page is not working well, but I managed to subscribe to their RSS feed and it has been sending out updates periodically. I'll post some of them here.

9:02 PM UTC: We've validated an alternative health check method on a subset of affected infrastructure, which allowed the servers in that subset to successfully return to service, and we're now applying this change more broadly. We're also preparing an automated recovery process to continually detect and restart unresponsive servers, to help keep them in service while this change progresses. Additionally, our review of recent changes has identified a small number of configuration updates that we're investigating as potential contributors to the issue.

Previous status: While validating the targeted change, we found that many of the affected servers have become unresponsive, which is preventing us from confirming whether the change is effective. We're restarting these servers so they can come back online with the change in place, and we're applying the same approach to additional affected portions of our infrastructure to validate the results more broadly.

8:52 PM UTC: While validating the targeted change, we found that many of the affected servers have become unresponsive, which is preventing us from confirming whether the change is effective. We're restarting these servers so they can come back online with the change in place, and we're applying the same approach to additional affected portions of our infrastructure to validate the results more broadly.

Previous Status: While we haven't identified any recent changes that correlate with the start of impact, our investigation indicates the failed health checks may originate from a specific component on the affected servers that's responsible for processing them. We're deploying a targeted change to bypass this component on a subset of servers to validate whether this restores availability, and we've taken steps to prevent additional servers from being removed from service while we work to return the affected servers to service. We're also investigating why affected servers are experiencing elevated processor usage while handling requests.

7:52 PM UTC: We've identified that affected servers are failing automated health checks, which is causing them to become unavailable, and this may be related to a recent change to a component involved in processing those checks. We're testing a configuration change on a subset of affected infrastructure to address this and, if successful, will apply it more broadly. In parallel, we've initiated a restart of all affected servers and are validating whether they're successfully returning to service.

7:30 PM UTC: We're aggressively pursuing all pathways to reduce impact. As a precaution, we've paused all deployments and configuration changes while we review recent changes for any correlation to this event. We've determined that the elevated load isn't driven by an overall increase in traffic, but by a large number of servers being unexpectedly unavailable, which is shifting load onto the remaining infrastructure. We're investigating what's causing these servers to become unavailable while we work to safely return them to service.

7:16 PM UTC: We're aggressively pursuing all pathways to reduce impact. As a precaution, we've paused all deployments and configuration changes while we review recent changes for any correlation to this event. We've also moved traffic for some services off the affected infrastructure to further reduce load, with additional traffic moves in progress.

6:59 PM UTC: We've completed redistributing connection traffic across our worldwide infrastructure, and we're moving additional traffic off the affected infrastructure to further reduce load. We're also restarting affected servers to return them to service. In parallel, we're investigating whether the elevated traffic reflects a genuine increase in requests or a shift in how traffic is being routed across our infrastructure. — beowulfey

Rust 1.100

390 points | 163 comments

Woohoo, that's a release! My personal favorites:

- Stabilize never type

- Stabilize custom allocators

- Introduced minimum publish age configurations, also known as dependency cooldowns. When the relevant config is set, the resolver ignores versions published more recently than that, unless they are already in Cargo.lock. (RFC 3923) docs #17335

- cargo-install: now uses the existing lockfile in the .crate tarball by default. --locked in cargo install becomes a no-op. #17388 — nirinor

Nvidia employees petition to bring back Jensen Huang

493 points | 351 comments

> "We are all humans and can make mistakes. Jensen did so many good things and he needs a second chance,” wrote another.

I think if it was one affair, this would hold. It is allegedly 3 and counting, and includes a likely spy from a rival nation, and likely knowledge of selling to the rival nation despite the current laws.

You can think he is amazing at many parts of this job, but at this point it is less of a mistake, and more a pattern of behavior that he knew was hugely risky and decided to cover up.

This is a terrible time for Nvidia employees. But the solution is not to invite the cause of the terrible time back in. — soundworlds

Show HN: My $300 embroidery machine needed a subscription, so I built my own app

309 points | 129 comments

I'm going to assume Claude did the heavy lifting here (because it's Q4 2026 and the odds are in my favor), so if I'm right: this is one of the best examples of the way LLMs can empower users to not only scratch all the itches, but demonstrate to anyone who stumbles by just how satisfying it can be to do so themselves.

Your app represents a future that I, an old, actually love. When I see projects like this, I don't think about ongoing support or if the project will be abandoned. I think, "Woah, I hadn't thought of that. Now I'm going to try it. Because why wouldn't I try to get all the value I can out of my $20/month Claude subscription?"

Even though I've been a developer for 30+ years (and a nerd for longer), I've never felt so motivated by the potential of a technology to make an individual's life richer. Thanks for sharing it.

And if you wrote it by hand, my hat's off to you for sharing that, too. — spdustin

Gemini 4 Hydrogen

452 points | 292 comments

This was rolled out RIGHT away, as when I just went to use Gemini, seeing 3.8 Flash be replaced with "4 Hydrogen" was less hype and more a thought along the line of "What [on Earth] is Gemini Hydrogen???", then me going here to figure it out.

This model naming scheme works for separate products, but using elements, molecules, etc. for products you're supposed to compare with each other... Not very helpful.

If anything, my intuition would say that Hydrogen is more powerful than Argon... I don't know. Not liking this naming scheme trend. — wds

Gemini 4 Hydrogen and Orchestrator

286 points | 64 comments

This is essentially what Anthropic does with the advisor mode and what GitHub does with their multi-model pipeline using the HydraFusion model, which is just a large set of different models with different qualities used in a pipeline to produce an answer.

What I don't understand is how they all make it work with caching in general. Looking at how the advisor mode in claude work you seem to only be billed the output tokens and cache hit on the whole session when it calls out to the advisor, making it super cheap compared to running the more expensive model for the entire session. — vegardx

For the past 5 minutes all of our Microsoft Cloud connections are down. Anyone else? The Status page won't even load.

401 points | 1 comments

Comments moved to https://news.ycombinator.com/item?id=50471731. — tomhow

I'm making LLMs work on small and old devices

344 points | 127 comments

For the last five months or so, opus and fable have both been able to do this task as a soneshot prompt. An inference engine is almost pure compute and to a first approximation the only operation your hardware needs to support to do llm inference is multiplication [the rest of an inference engine is "some trig"].

So to get any model working on $OLD_HARDWARE, the hardest part of the task is now sourcing the hardware itself and giving the agent ssh access -- a modern agent will be able to source a compiler, write the implementation, optimize it, test in qemu (or any other simulator) and push it onto the device.

Example prompt: "write an inference engine for qwen3 0.6b in pure assembly that runs on this device. Write a script to attach the weights to the resulting binary. Prefix is supplied as a stream of u32 token IDs on stdin. The engine streams u32 token IDs on stdout." — Farmadupe2

Nvidia is preparing to oust Jensen Huang

391 points | 594 comments

It's really interesting to me how unaggressive Jensen has been vs. his peers about tighting up control over his company (even during the recent years when he had huge leverage):

- His board setup is ... odd. He isn't Chairman of the Board (a role over 50% of Fortune 100 CEOs apparently hold). He seems to be responsible for Nvidia having a wierdly more egalitarian structure (all directors including him, are equal, with a designated lead independent director)

- His compensation (~$35M, primarily stock) is ... not up there with other tech CEOs

- He doesn't seem to have ever pushed for super-voting rights (he only has like ~3.5% of the company), but I guess that's hard to change once you IPO

I kinda wonder if this ends with him taking a month off, spending 12-18 months transitioning to a successor and ending as the chairman of the board or some such. He really does seem vital to the company (and thus the stock price). — rao-v

Google SWE points 48 AI agents at NASA Lidar, finds unmapped Maya pyramid in 72h

756 points | 283 comments

The site in question was found earlier: https://bsky.app/profile/indyfromspace.bsky.social/post/3n22...

The Mexican govt may not have had the right records, but you can see what the site looked like at the time it was first found here: https://bsky.app/profile/indyfromspace.bsky.social/post/3n22... — LordOmlette

AWS emulator

https://www.aboutamazon.com/news/aws/how-autonomous-ai-agent...

https://www.allthingsdistributed.com/2026/11/aws-emulator-an...

646 points | 211 comments

Skeptical of using because it's not clear whether this was just an exercise or a real product they are going to ship and maintain.

Floci[0] has been great for me. Use the Testcontainers[1], too.

Bonus: works for GCP and Azure, too (so far have only used in limited capacity, though).

[0] https://floci.io/

[1] https://testcontainers.com/modules/floci/ — CharlieDigital

United Airlines bans AI agents from booking flights on behalf of travelers

325 points | 307 comments

How do they plan on stopping me from using Claude code with the Claude in chrome plugin, or some other computer use agent?

At this point it feels like I have an adversarial relationship with many merchants I use online. I wish the simple “you have a product, I have money” relationship was possible. I don’t want to take part in your giant human behavior optimization problem. You have a product and I have money why does it have to be more complicated than that?

Realistically though I know that’s not happening. I will continue to access online merchants in the way I prefer and will do my best to avoid detection or blocking. At least so far Claude is happy to play along but I suspect I will need to seek out an obliterated agent in the not to distant future. (Once the corporate capture of the frontier cloud AI models is complete.) — doctoboggan

A false smoke alarm almost drowned Jane Street's only NYC datacenter

401 points | 198 comments

The article reminds me of when Hurricane Sandy took out a bunch of New York DCs with 3+ feet of water and people were carrying diesel up stairs to keep generators running.

“The superhuman folks at the data center are hauling 55 gallon drums of diesel fuel up 17 flights of stairs. Assuming they're able to sustain a rate of transfer that exceeds the rate of consumption, the data center should run until electricity is restored. The latest estimate from Con Edison for lower Manhattan is 4 days. (The New York Stock Exchange will be open tomorrow, also running on generator power.)”

https://news.ycombinator.com/item?id=4720388 (https://web.archive.org/web/20121101194314/http://status.fog...)

https://arstechnica.com/information-technology/2012/11/how-o... — reticulates

93% of paint splatters are valid Perl programs (2019)

383 points | 50 comments

SIGBOVIK papers are almost always a delight

EDIT: From their 2026 publication

>Permission to make digital or hard copies of portions of this work for personal use is granted; permission to make digital or hard copies of portions of this work for classroom use is also granted, but seems ill-advised — snitty

Gemini Decisions API

398 points | 122 comments

I'm sort of surprised it took Jev for everyone to realize "oh yeah, this is a useful thing that we should have in our product portfolio".

But maybe this is one of those things that's only obvious in retrospect? I'm sure people were trying something similar years ago with grammar-constrained outputs (for example to only output a simple json structure), but you can't get probabilities out of the model that way. Which makes me wonder: how do these models calculate probabilities? — eminence32

Hyper-Realistic Sand with WebGL2

297 points | 63 comments

Super loud sound warning, us parents and folks wearing headphones would really appreciate default sound off. Or at least a some indication to turn volume down before tapping "pour" — evnp

Jensen Huang said to have had relationship with executive who reports to him

352 points | 425 comments

https://archive.is/9fQ6Y — thebeardisred

I asked every TV manufacturer 17 questions about how they spy on you

337 points | 235 comments

    LG: No. ACR in LG TVs does not collect or store screenshots, screen images, screen recordings...

Hold on, we already know this is not true. There is even an option in the settings to disable this (which is usually automatically reverted by LG within a week).

The setting has the obvious name of "Live Plus". — throwa356262

Smart home devices should work without the internet

681 points | 245 comments

Bought our home almost 20 years ago, and the former owner (apparently) owned a now-defunct home automation business. The upside was 100% X10/Insteon power and light controls, top alarm panel, environmental controls and so on running off of a wall-mounted "SmartLinc" touch panel. I expanded the system with Axis cameras and a Mac Server running Indigo and SecuritySpy (non-subscription), which enabled remote monitoring and control, but it all operates locally.

In a moment of weakness, I bought a D-Link wireless (wifi) water detector for the sump pit (it was on clearance for $30); it relied on a D-Link Home cloud service (free) that was closed down a few years ago.

Not wanting to toss it, I repurposed a spare Chromebook 14 that I was going to recycle and turned it into a Alpine monitor for the water detector, which I'm powering from the Chromebook's USB port (if power is lost in a rainstorm, I need to know about it before the sump pit fills up).

An immediate issue was that the D-Link firmware tried to "phone home" every 24 hours and would drop from the local network, since the server was kaput, and I had no clue what response it was expecting from the server to keep it alive. Solution; "reboot" the unit by interrupting USB power (with a Pico and MOSFET) every 23 hours. There's no question that home automation should work without the internet. — mountain_peak

.name Grandfathered

Previously: .name Termination - https://news.ycombinator.com/item?id=49550772 - Sept 2026 (547 comments)

670 points | 155 comments

> After a long and expensive battle, news just dropped that Verisign is retracting its plan to terminate 22,000 domain names and email redirects. Although they will be closing new registrations for 3rd-level .name domains, all existing domains (including this website) and email redirects will remain indefinitely.

This was what I figured SHOULD happen when they did this. Allow existing customers to keep renewing, but nobody new allowed, if a tld frees up over time, reclaim it completely and sell it off.

What they were proposing should really be illegal... — giancarlostoro

AlphaProof Code

451 points | 147 comments

Something seems wrong here. They took a non-trivial piece of human-written code that has had bugs in the past, formally verified the whole library, and found zero bugs?

I can believe that it's possible to get the LLM to write proofs, but I can't believe there were zero bugs in the system they verified. I wonder if they got the theorems wrong, or if they only proved narrow properties of the system.

I've had Claude formally verify crypto and data storage formats. It wrote theorems that looked fine and the formal verification passed but the resulting code contained many, many bugs that other implementations of the same things found with ad hoc testing.

The way the announcement is written, we should expect zero bugs in libsignal moving forward, and I guess time will tell whether that happens or not. — hedora

Scion is back and is going to sell a kei truck in America

307 points | 228 comments

I use a kei truck for farming. They are incredibly pragmatic little vehicles. They are very capable driving around on dirt/gravel agricultural roads with 4WD, and they are inexpensive and robust enough that you can really beat them up and use them as a tool without worry. Repairs and replacement parts are ubiquitous and inexpensive. Having the sides of bed fold down is also really useful.

They aren't comfortable to drive at all (although just having A/C at all on a hot summer day in the field is a godsend), and I wouldn't want to do longer trips in one - although you certainly could in a pinch.

It seems like Toyota/Scion is just testing the waters here, and I'm not sure how successful they'll be. But I hope there is a future for kei trucks in the US. — freetime2

Blender 5.3 released with Gaussian Splat support

422 points | 62 comments

Every time I hear about Gaussian splatting, I think about triangle splatting[0] - GPUs were built to render triangles, so I wonder what games would be like if we supported generating and rendering them as much as we do Gaussian splats.

[0] https://trianglesplatting.github.io/ — Retro_Dev

Starlink Mini 2

382 points | 394 comments

We bought a Starlink Mini for the use case of frequent travel to far-off (international) places with limited mobile service, where we occasionally need to get online for high-priority work tasks or meetings. For $55 / month for 100GB and flexible usage in many countries, it was extremely useful.

Then, recently, SpaceX changed the terms such that the 100GB and 300GB subscriptions are no longer usable internationally (technically outside of North America). You have to pay for the unlimited service tier and even then can only use it for 30 days before returning to the home region.

A huge decrease in utility and a tripling in cost. A new device with a built-in battery is definitely not going to make up for that.

(Still a great service when it works, am posting this from remote western Mongolia.) — sib

Synaptics patent claims stop work on DisplayLink drivers

283 points | 140 comments

> If you fail to comply with our demands by the specified deadline, Synaptics will seek monetary compensation from you in the amount of US$25,000 to recoup the costs and effort required to create the attached documentation of your infringing acts.

Obviously this is intended as a scare tactic, but, surely that could never hold up in court? Surely the burden of proof is on the owner of the patents to prove that someone's work is infringing, and you can't then say "We are charging the defendant to prove that we have a valid case against them." ? — AdmiralAsshat

Tracking Anthropic-discovered vulnerabilities

391 points | 181 comments

Last week I deployed GLM-5.3-Flash on our on-premise servers, ran it against all repos, and in 6 hours it found 13 vulnerabilities across our products/sites, including 1 full account takeover and an RCE on all our sites, which involved a pretty sophisticated __destruct gadget (all vulns verified to work).

As an experiment, I also pointed it at PHP's source code, and it was able to write PHP code that triggered a use-after-free (or a segfault, if you prefer DoS). I failed to find the vulnerability in the list of CVEs, so maybe it's a 0day, I don't know.

Sure, it's not a frontier model, but it can find many issues that were overlooked by all the commercial security scanners we run regularly as well. The nice thing about this setup is that we can run it 24/7 probing our code/infra, constructing exploits, etc. without having to care about token usage/bills. Plus, I think sending all that sensitive information about your internal infrastructure and the vulns found to Anthropic is a vulnerability in itself. — kgeist

Val Town is winding down

299 points | 77 comments

I remember Steve from my days working on Eve, he was part of that community and always a big proponent of end-user programming. I was happy to see him working on this project but am not surprised it's shutting down.

Nothing to to do with the quality of Val Town, but making a business in this space is really, really hard. You can't start the business without raising millions (Eve raised $2M, Darklang raised $3.5M, Val Town raised $7M), but it's hard to scale out a proof of concept in the time investors want to start seeing an ROI. It seems to me about 2-3 years is all you get for seed runway, when realistically projects like this should take at minimum 5 years incubating. Darklang extended their runway to ~7-8 years by firing all the devs and keeping just the founder on life support. Ultimately even that wasn't enough.

But maybe with AI this could work, I dunno.

What's required to make it all work is a fundamental leap in programming interface design, but the business side doesn't look any different from a typical SaaS. So unless you hit the ball out of the park you're entering the market with an experimental product, then you have to deal with product-market fit even if you have the right product, so you really only have one shot.

It's very hard to go back to investors and ask for another round of funding when there's no discernable market and the product isn't gaining the traction investors would like to see.

Anyway, kudos to Steve for fighting the good fight! What would really be great is to read an in-depth post mortem on the project. Looking forward to it if you have time! — cmontella

Show HN: Get your coding agent off ~2019 JavaScript, onto modern web primitives

Browsers natively handle a lot of what used to take 50 lines of JS (or a dependency): `CSS.highlights` for text range highlighting without <span>s everywhere, `<dialog>` and showModal() give you backdrops and ideal focus management, `field-sizing` to auto-grow textareas as the user types.. (Something yesterday's ftrain post touched on [0])

Models know about some of these by name, but consistently won't default to using the platform-native solution and instead prefer the incumbent <div>+JS based pattern. We started an effort in Chrome to supplement coding agents with this key domain knowledge and we're shipping our 1.0 today, in collaboration with Firefox, MDN, and Edge.

200+ guides (~1.7MB) of curated, hand-crafted implementation best-practices from web experts, updated as the web evolves. (Open source, obv, so.. we'll welcome your bikeshedding ;) Readable versions here: [1]

I've spent the last 9 months obsessing over how to ship this as an agent skill + (Agentic RAG) CLI without blowing up your context window. (Or cedeing activation mechanics to MCP dynamic tool search). The skill description is minmaxed for activating on relevant frontend tasks. The RAG work I'm pretty proud of… originally a 500mb native stack down to a ~7MB pure-JS package, ~10ms search on your CPU.

We just introduced a deterministic 'legacy-scan' (trained on 30k github repos) to identify old 'n dusted patterns that your agent can modernize. (92% avg precision on held-out repos.)

People make a lot of claims about what coding agents are good/bad at. We wanted receipts, so we invested heavily in eval infra [2] to help us hill-climb, but also to identify when knowledge is common enough we can prune our guides. (Ofc, some of the things we thought AI didn't know turned out to be wrong :) We run codex/claude/agy against 200 tasks without the skill and then with.. In total ~1,700 playwright/AST-based assertions. Agents go from 55% pass unguided to 92% guided.

Try it out:

    DISABLE_TELEMETRY=1 npx modern-web-guidance@latest install
    DISABLE_TELEMETRY=1 npx modern-web-guidance@latest search "animate dialog modal"
    DISABLE_TELEMETRY=1 npx modern-web-guidance@latest legacy-scan ./src

If you spot something wrong or weird, give us a holler!

Longer write-up on the 1.0: https://developer.chrome.com/blog/modern-web-guidance-v1

---

0: https://news.ycombinator.com/item?id=50416456

1: https://developer.chrome.com/docs/modern-web-guidance/guides

2: https://googlechrome.github.io/modern-web-guidance-src/

349 points | 105 comments

I've been using this skill with Claude on a new project and it's nice, but it's quite expensive, token wise. It's ~$5 per use, on my codebase, which seems fairly high to me. — dflock

Fold Epic Paper Airplanes

537 points | 86 comments

Scrolled down the page, saw this "Very Easy" 1 minute plane

https://www.foldableflight.com/planes/mystic

Started watching the video not planning on actually making it, saw that it is done with A4 paper and grabbed a random sheet at my desk to follow along. The pocket felt like a nice "a-ha!" moment. As someone who only knew the "naive" way to make paper airplanes from A4 paper, this is the best performing and prettiest paper airplane I've made in my life! It almost feels like it's not real how smoothly it stays straight in the air compared to all my paper airplanes in childhood.

Edit: Tried making the flapping wings AeroDactyl but it didn't work out :( wasn't aerodynamic and didn't flap its wings just went straight to the ground

Edit 2: Tried making the Jetstream (another 1 minute plane) and it came out well! Mine is INCREDIBLY asymmetrical and still flies better than any other plane I've made other than the Mystic!

Edit 3: Tried making the Advanced Elanus and I made it! But it's a little shoddy and much tougher for sure. Looks cool but it doesn't glide anywhere near as good as in the video (I guess you really need to perfect it.)

Final edit: My planes :) https://i.imgur.com/xnMdzJv.jpeg — literallyanythi

Claude Fable 5.2 and Mythos 5.2

908 points | 548 comments

Damn people were right about 5.5 being nerfed in preparation for a version release. This is not at all a good look.

- https://news.ycombinator.com/item?id=50422069 — skeledrew

Claude Fable 5.2 and Mythos 5.2

500 points | 756 comments

I’ve had a chance to use fable 5.2. Some observations:

- Anthropic is finally well balanced across models. Meaning: Opus 5.5 is so good that I do not feel Fable FOMO as I did when it was Fable 5/5.1 vs Opus 4.8/5. And Sonnet 5.5 sometimes makes me forget about Opus.

- Fable is good, but you really have to push the ambition of your prompt in order to see proper separation from Opus 5.5. I personally have a hard time telling the difference between Fable 5.2 and Opus 5.5 for ordinary coding tasks.

- It’s way faster and more reliable: one of the worst things about fable 5.1 was how slow it was an, on top of that, how frequently it would suffer from max output token overflows. I got none of these issues with 5.2.

- Fable is exceptional at drawing. It’s ability to render an image with JavaScript actually has me questioning the value of dedicated image models. I prefer the images I’ve gotten fable/opus to make for me over those from gpt-image, it’s wild to think we’re at this point. — postalcoder

USPS now offers official ZIP Code boundary polygons

439 points | 216 comments

Dang, the prices are crazy. $10k for the lowest tier? I expect federal data to be free. Most federal data related to stuff like regulation (e.g. FCC spectrum use coverage maps), maps for federally-managed lands, etc. is free. And, it should be free. It's a core part of accountability and transparency. Historically there was a copying cost (having a human print physical copies on paper or CD/DVD/tape), which is understandable, but now that the incremental cost of each new copy approaches $0, that's what it should cost users of the data. — SwellJoe

Google Gemini routes personal Drive files and emails to human annotators

366 points | 93 comments

Note that this is specifically Consumer Gemini with Connected Apps; Workspace Gemini (and Workspace Intelligence, the RAG thing for enterprise/Workspace) still claims not to be subject to human review:

https://knowledge.workspace.google.com/admin/generative-ai/g...

So basically if you use consumer Gemini and specifically authorize the GMail app, for example, then it will sometimes use the GMail tool to load your mail from GMail, and that data (like all data in consumer Gemini) might be given to the human annotation pipeline.

This whole thing seems deeply stupid to me from Google's standpoint, although they've never been good at product management - there's _way_ too much nuance to what's going on and even if they aren't technically affected, this kind of thing will almost surely make their paying enterprise customers leery. — bri3d

Payments Canada announces launch of Canada's Real-Time Rail (RTR) payment system

452 points | 256 comments

TBH, if you are launching a startup, it might not be a terrible idea to incorporate in Canada. Canada has the notion of federal incorporation in addition to each province having its own corporate registry. Federal corporations can exist in any province but all the filings are done in one place.

The new mega-deduction recently announced [1] results in an effective 6% corporate tax rate, which is among the lowest in the world and certainly in the G-7. Things like the RTR are just one example among many of the efficient infrastructure that Canada is introducing to address a very long term productivity gap (the mega-deduction is another).

And, R&D conducted in Canada is always a current-year expense and never capitalized. And there is a refundable tax credit for R&D that works out to about 60% of engineers' salaries (in most provinces). And those salaries are lower than they are in the US (something that engineers in Canada have a right to complain about).

[1] https://www.canada.ca/en/department-finance/news/2026/09/gov... — ttul

Humans will never again create a project quite like Wikipedia

435 points | 366 comments

I recently did a talk in opposition of this sentiment

Yes, some projects like stack overflow may be losing contributors by a large degree, but it doesn't have to be this way

I run SponsorBlock and DeArrow which are two human powered crowdsourced browser extensions that are only growing in scale in opposition to the want to slopify everything

We have 17% of submitters every week being first time contributors and 19% being old, a nice balance.

Unfortunately the talk isn't available yet but you can see the slides here https://docs.google.com/presentation/d/1nGArM7c3i9cVGGvkh6ER... — ajayyy

I saw your HN comment

313 points | 231 comments

Anything where an LLM asks you a question without disclosing that it's an LLM is an abomination.

I get these on Twitter all the time, and they're starting to show up on Bluesky as well.

Most of my tweets have 20+ garbage spam replies now. I don't read them any more, which sucks because I used to get to talk to actual people there.

The ones that ask a question are particularly offensive because they risk you falling for them and wasting several minutes of your time thinking about and then responding to them... when no human being ever asked or cares about the answer. — simonw

Fable 5.2 one-shotted my nephew's dream game

353 points | 240 comments

Growing up, games were such a scarce commodity that you'd really suck all the marrow out and spend hours beating your best times, looking for Easter eggs, or messing with custom maps and mods. There was a whole genre of gameplay around just exploiting physics bugs to jump a bit further.

The other night I carelessly made an infinite runner game while watching TV and the feeling of sheer abundance quickly faded into a bit of depression. Without scarcity, nothing is really valuable. — siliconc0w

E-means: Outperforming k-means in one-tenth the epochs

258 points | 17 comments

I wonder if this could be used anywhere as an alternative to Lloyd's algorithm. I have a hobby project which uses Lloyd's to "relax" an icosohedral equal area mesh on the surface of a sphere [1]. I'm going to try to swap it out with an adaptation of this and see if it's much better or if I can afford more iterations with this method.

Edit: tried it, and it’s definitely not better for this use case. e-means wins by needing fewer passes over a huge dataset, but relaxing a mesh on a sphere has no dataset: each Voronoi cell’s centroid can be computed directly from its geometry. Mini-batches just swap that for a noisy sampled estimate of the same thing. It has the same objective and the same optimum, so at best it matches Lloyd. In practice it was much slower and left the grid noisy, and with small sample budgets it even tangled the mesh.

[1] https://webgcm.app/explain/grid#nudging-the-cells-into-shape — jlhawn

Goldman Sachs is pulling Claude Code from its bankers and traders

574 points | 348 comments

People are giving all kinds of explanations here why Goldman is doing this, but they are not addressing what the article (implicitly) says: operating coding agents on the primary machines of finance professionals runs directly into the lethal trifecta. It's as simple as that.

You cannot have semi-unattended agents running on the same workstations that have access to client/trade/prop information and email client, and internet, and internal networks, it's too dangerous--a major leak is just one small mistake or prompt injection away. Banks are not stupid, they are getting it and shutting it down. — lukebuehler

Nvidia CEO Jensen Huang's letter to staff about affair

305 points | 307 comments

If you are one of the most powerful man on earth you are going to be the target of all the secret services of all powerful countries. Period.

It is their job. You take decisions that are worth billions, you influence people that take decisions that are worth billions, and affect their countries.

They are going to study you for years. Your personality type and that of the people around you. Your weaknesses. Your problems and that of your family.

They will employ the most sweet and the most pleasurable and gorgeous honey that there is in the world to create the perfect Honey trap.

Normal people just can not imagine how sweet, specially when it has been customised around your needs and desires.

It is not just a woman wanting to have sex with you. It will be the woman in your dreams. — cladopa

KetchUp – Open-source SketchUp alternative built with Rust and WebGPU

426 points | 116 comments

As a very long time user and lover of SketchUp, I'm still peeved about the direction Trimble took in neglecting the SketchUp desktop modeler in favor of a web-based UI. Their licensing was also terrible... first they discontinued the free version of SketchUp, and then later on they discontinued perpetual licensing, meaning the only way to get the desktop modeler was to pay several hundred per year, which wasn't worth it to me. If a vibecoded alternative displaces it in the market, I won't feel one bit sorry for them.

The kinds of large scale projects I like to make in SketchUp really began to feel constrained at a certain point. A modeler with SketchUp's incredible UI that can take full advantage of any computer's available graphics hardware to render large amounts of geometry more efficiently would be a wonderful thing.

I'm very possessive of my SketchUp models, and so the idea of storing them on any kind of cloud server I don't have control over is abhorrent to me. I was not happy to see Trimble putting so much effort into making a web-based modeler. — ayaros

Nvidia Board of Directors Is Investigating Jensen Huang

369 points | 286 comments

The title on this is just extremely misleading.

Nvidia is doing an investigation of Jensen Huang being targeted in an intelligence operation; ie, an investigation of something that happened to him.

The title implies that Jensen Huang is the target of Nvidia's investigation. — nrmitchi

Outlook.com Is Quietly Rejecting Email from Domains Without DMARC

222 points | 180 comments

Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.

Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .

On the other hand rejecting domains without dmarc is fine. Just not happy it is silent. — Neikius

Unlocking any car from X brand in most of the world

278 points | 92 comments

Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.

White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...

Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make. — ryukoposting

RIP, Harvest

312 points | 91 comments

I went through the same process earlier this year after receiving a note that they intended to raise my annual charge to over $1100, from the $150 or so I’d been paying for a decade or more.

In the end I opted to roll my own invoicing solution and keep Harvest for time tracking, since it saved me having to reimplement the Mac app and meant my costs actually dropped to $110 or so. I’m under no illusion that the vampires won’t close that loophole as well, but since I’ve had good success vibecoding some Swift apps in recent months I’ll be happy to take on the time tracking app next time too. It’ll be nice to stop sending them any money regardless. — dstu

I'm not convinced the AI bubble exists

217 points | 300 comments

  When I look at the current capacity of AI, it really feels like there's so much potential for frontier models to be used that just aren't being applied yet. Most (or maybe even all) programmers and mathematicians are worse at their respective field than an AI swarm equipped with a good harness, and a good deal more expensive as well.

This is a strange conclusion. AFAIK in mathematics it doesn't work yet like article says: there is a problem, point agent swarm on it, and mark it done. The math results from OpenAI and Anthropic were got by seeding the surface of known problems and randomly trying to grow solutions; while they got some good solutions indeed, it doesn't mean current LLMs will work for arbitrary math problems.

Correct me if I am wrong on this, I am only a student of mathematics and by no means a researcher.

For the programming part, I think author already says that automated solutions need a good harness, and this is indeed correct, but in my experience building good harness is hard and agents can not do this currently without human closely guiding them. And in pre-LLM programming practice we did not need harness at all, or needed only small part of it: so, solving programming problems with LLM involves more work than without LLM, even if big part of this work can be automated.

The rest of the article seems to be a speculation mostly based on the premise that LLM can really replace human in the loop, which seems to be not the case currently. — darkwi11ow

Person of Interest

241 points | 159 comments

From reading the comments, I think a lot of people haven’t seen the show. I highly recommend it. However, you have to remember that this aired on CBS in the age of shows like CSI and NCIS. Therefore, it was made into a high-episode-number, cookie cutter serial crime drama. Every episode follows a similar pattern where the two main characters are trying to prevent a murder. However… if you can make it past that and especially stay focused thru two seasons of that - you will be massively rewarded. The later seasons especially are essentially a fantastic, complex, hard sci-fi show about proxy wars between AGIs using human agents in a battle of control. It’s honestly one of the best shows ever and way ahead of its time — vesche

Dux: Free, open-source Wayland desktop shell with file manager and theming

188 points | 60 comments

Been using this for close to a year (wrote about it here when it was still called Dank Material Shell: https://tedium.co/2026/01/29/niri-danklinux-scrolling-window...); it is endlessly slick, and I think good enough to help mainstream Niri.

It also just added official support for atomic distros like Bazzite; it was previously kind of an annoying gap given the popularity of those distros. — shortformblog

What I run on my $10 USD OpenStick homelab

316 points | 80 comments

I've had a lot of fun with this little gadget and it's pretty cool to see how much you can host on a cheap gadget if you pick the right software! Given how expensive RAM is these days, I figured, this might be a good option for other people to get started with self-hosting as well!

Happy to answer any question and take suggestions as to what other software would be a good addition! — LaurensBER

Apple’s grey list: Words and phrases your iPhone won’t help you spell

339 points | 227 comments

I wonder what the boardroom meeting for this was like. Despite the outcome, I doubt the devs were pitching censorship as the reason for implementing this.

To the shocking number of people here who are justifying this or explaining how it only affect swipe input as if that makes it better: soft coercion is still coercion. If I made a physical keyboard that stops keys from working when you're about to finish typing something I don't want you to type, but you can still circumvent it, I still made a censorship keyboard. It's a sign of the times with how used tech companies are to 'softly' moderating societal trends by unilaterally tweaking the software that everyone uses. — tavavex

The end of Microsoft Research's AI Frontiers group

https://archive.is/AaY5O

https://businessexaminer.ca/victoria-articles/item/microsoft...

362 points | 207 comments

This is true in every large company right now.

The transformer based approach is seen as a highway to race down in terms of training and building better models with minimal organizational distractions allowed while every company puts its foot down on this highway. Exploratory research into other AI methods is highly discouraged for now and organizations are encouraging transformer based scale out and iteration as a top priority.

As an example Meta literally fired it's previously head of AI who held views that transformers won't scale. He wanted to veer off the highway and heavily fund exploratory new types of models. They got someone willing to scale the current method out. Essentially the messaging it "Foot down, there's a straight highway ahead don't divert".

I have the view this makes sense too. Current top models are mere (mere in big datacenter terms) trillions of parameters right now. We definitely haven't hit the ceiling and everyone's noticing "Hey this Opus 5.5 with the increased parameters seems much better than the last one". Well that's a trillion parameter model. We'll soon start hitting 10's of trillions and 100's of trillions of parameter models. Unless there's a ceiling which nobody expects they should keep scaling just as they have been. I really do agree that it'd be insane to veer off this highway with exploratory research at this particular point in time. Foot down, get to 10 trillion parameters, see if the scaling holds, if so off to 100 trillion parameters. If the scaling continues to hold we'll be asking the AI to do the exploratory research for us soon enough. — AnotherGoodName

Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files

345 points | 237 comments

Boris from the Claude Code team here. Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this.

That said, a few thoughts:

1. .claude/settings.local.json is meant to stay local. This is not a file you should check into source control. We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in (docs: https://code.claude.com/docs/en/settings)

2. Permission rules are old hat. Everyone should be using auto mode instead. It is safer and also does not require manually maintaining finicky allow/deny lists. Auto mode is enabled by default and is included for free in all plans.

3. Regardless of what agent you use, you should have secret scanning enabled. GitHub and other source control hosts offer it. There are many threat models that it protects against and you should absolutely use it if you can. (see https://github.com/security/plans) — bcherny

Goodbye Claude, Hello Pi

338 points | 201 comments

I used to use ChatGPT/Claude in the TUI up until like 3 months ago, but my usage of LLMs has exploded - many sessions across many projects. I feel like I outgrew the TUI and now I'm using ChatGPT/Claude desktop. VS Code has become a code review tool and place where I manage git if need be.

The GUI is less verbose with the nitty gritty hidden in expandable sections, which makes history easier and cleaner to scroll through, also no scrolling bugs, rich text is easier to read with tables, and images integrated into the chat, resources like browsers in the context of the session. Drag and drop session organization (pins), scheduled tasks, etc.. all that in the side bar.

Usually a TUI would be open in VS Code and scoped to whatever repo I'm working with so 10 projects, 10 VS Code instances open, not super scalable. With the GUI desktop app it's one app, and I can start sessions in an repo and switch between them easily, no need to open VS Code for each. I don't see what could make me want to go back to using a TUI.

Who else is just using the GUI nowadays, or are you still on the TUI, and why, have you tried the GUI interfaces? — bottlepalm

Every Windows 11 app should kill Electron, and Discord just showed why

301 points | 261 comments

i believe that primary issue of electron is also that the framework consumes RAM/resources which is already a issue especially for windows which is a heavy OS on the RAM. the same side is visible on the Linux speciapic app ends of applications like VS code. they have poor integration , Loads of resource consumption and minimal polish — AdityaK_9999

MaxxBench – "Nice DeepSWE score. But is it true?"

285 points | 78 comments

This is a great example of how to test how well a benchmark score generalises. The first order approximation is not complicated: just vary a parameter and see how much the score changes.

Which parameter to vary depends on the result of the test, but the MaxxBench route of varying the task spec seems like a good default, though not always the most informative.

In one of my private benchmarks I realised many of the less capable models didn't fail because they submitted the wrong answer, but because they exceeded their budget for number of tool calls they were allowed. The more capable models never got close to the tool call limit because they tended toward combining tool calls (e.g. chaining multiple shell commands in one Bash tool call).

Was my benchmark actually measuring ability to combine tool calls rather than reasoning ability on the problem at hand? Well, easy enough to find out: re-run under a different tool call budget and see how much the scores change.

(Next problem: is ability to combine tool calls a useful thing to measure, i.e. should it confer an advantage in the benchmark? It could be if it is a sign of planning multiple steps ahead.) — kqr

Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller

I built Coldframe, a honeypot that pretends to be a supermarket refrigeration controller. Inspired by the events on industrial fridge installations in the past weeks, I wanted to see what people would try against a convincing fake.

To learn more about this I built a honeypot that resembled perfectly the Danfoss AK-SM 800A and Dixell XWEB interfaces. Both of them are recognized on Shodan as real ones (an not as honeypots). It’s one Python file using only the standard library, and it builds on eppser/danfoss-ak-sm-decoy and public research by Synacktiv, Claroty and Ironhackers.

Things that were fun to get right:

- Matching real units. I used Shodan records of real devices to match header order, page titles, certificate fields and TLS versions. The Danfoss persona sends nginx headers in the same order as a real AK-SM 800A. The Dixell persona sends no Server header and pads its page to exactly 8,202 bytes.

- Recognising exploit attempts. It recognises CVE-2025-41450, the Danfoss “code of the day” login bypass, and records whether the submitted code is correct for today. It also tags attempts targeting three other Danfoss CVEs and the XWEB vulnerabilities.

- Letting them in. Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first. Nothing behind it is real.

Two instances have been live for a day. So far they’ve only seen generic scanners and Shodan’s crawler, which is called refrigerator.census.shodan.io.

Feedback welcome, especially from anyone who has seen these devices in the field!

223 points | 51 comments

I would be very skeptical of anyone relying on Shodan data. At one point I was trying to write honeypots myself by replicating wifi cameras, but almost all the ones on the internet I found were honeypots of some sort, and the ones that weren't were already hacked and had their web pages replaced. In retrospect it would have probably been better to get a vulnerable device myself and probe it.

If I were you, I would probably ensure that the fridges you used have residential or commercial (aka non-DC) IP addresses. Maybe Shodan uses this data for their "honeypot" label, my experience was some time ago so no idea though. — supriyo-biswas

The $8 Linux Computer (2022)

224 points | 87 comments

I love looking back 10+ years for the cheapest Linux thing you could buy. People were buying devices that were for kids or a router or something and repurposing it because it was open enough to get a shell on / flash Linux to it and start doing projects with.

In the 2020s or somewhere before that we got a bunch of dedicated cheap MCUs that were good enough and I think stole the thunder from full Linux but there are still projects to run it on things like the ESP32 family.

Either way, hardware hacking is still my favorite hobby to watch. — hypercube33

They don't make 'em like that any more: Borland Turbo Pascal 7

209 points | 117 comments

Turbo Pascal was a glorious tool for my imaginative 15-year-old brain. The first programs I sold were all written in Turbo Pascal. I had the Turbo Pascal reference books near my bedside, and I wish I still had them because they were dog-eared, post-it noted, margin-scribbled, and it's kind of strange but those books guided my future almost more than any other written text.

One distinct memory stands out. I could not wrap my mind around the Object-Oriented extensions on Pascal. I read, re-read, and re-re-read the section of the book describing what polymorhpism is and how it worked, probably at least a dozen times. Somehow it seemed really important and I kept coming back to it. I worked the examples. And then one day the ah-hah moment arrived. I remember it felt like a shock, why it was useful and what I could do with it. I promptly used my knowledge to write a new game using OOP principles to guide the rudimentary "characters" of various geometric shapes at the core of the game.

Fun times, and very formative to me! — bdamm

Tesla to wind down Cybertruck production

312 points | 915 comments

After Helene knocked out power in parts of my area for a little over 14 days, I found out that a friend of ours used his cybertruck to power his house through the entire mess. He'd run the house on it for a couple of days, then drive the cybertruck over to a super charger station, recharge, then come home and plug the house back in.

The battery capacity on those things is equivalent to 9 Tesla Powerwall units or something close to it.

They may be ugly, but the emergency prepper in me always wanted one after hearing that story. Before, I always wanted to install powerwalls...but I never considered in an extended event being able to drive my powerwalls somewhere to recharge them. — brightball

Libghostty 1.0

530 points | 86 comments

> “And a whole wave of new terminals and "agentic" coding tools, such as herdr and cmux, have been built on it rather than writing yet another emulator.”

Mitchell could have easily snuck his competing product Rex in there but resisted. Respect. — jdorfman

A Jev that can ask Opus for help gives Opus accuracy at 4x lower cost

308 points | 68 comments

If you use Qwen3.8 27B to manage, to orchestrate, do do shallow research, and then make it ask claude you will notice that Qwen can get out of Haiku, Sonnet and Opus almost as good answers... I was researching how good the model asnswers where, I can't get to work with anything but Fable, but Qwen can get good work from any of them. My theory is that if you make Qwen understand you, Qwen can elaborate as much as needed to get any of those models get good results, because it's filling in details. So using Qwen to direct claude also get's you amazing results way way cheaper...

Update: let me elaborate more, I read the HN entry about the team of 5 Qwens being close to fable quality... so I embarked to add to my harness (https://github.com/alainnothere/privibe because we all have one right?) and once I had added the orchestrate tool I had to now measure somehow it it's able to improve quality, so I claude and then Qwen to run a experiment to call my harness passing the model to use and ask them to do something, 3 rounds I think and see what quality came out of it... and as per the grading... qwen and claude agreed that the quality of the response comming out the harness using the orchestrate was VERY CLOSE, with opus and fable providing more "in my opinion you should" which matches my experience on why they are better.

One more update: I can't get copilot models to work decently, it may be my way of working... but I can get Qwen to follow what I try to do... if Qwen get's me he can then fire copilot cli and get amazing results by using copilot... bonus points seems like copilot cli is cheaper with the AIC (cost of the requests) so you can make the copilot subscription longer — xlayn

Deus Ex

335 points | 170 comments

My favourite ever games journalism quote:

"There's a tendency among the press to attribute the creation of a game to a single person," says Warren Spector, creator of Thief and Deus Ex. — Lerc

Gemini Omni 1.2 Flash

292 points | 217 comments

It's insane how Google has dropped the ball almost completely with AI.

I literally don't care about their models anymore because I can't even try them without paying for them?

I already pay for the plus plan but whatever their latest model was, is locked for me. Or otherwise it's just not accessible for me.

If I try to add balance to my Google payment account, it shows me errors and is asking me to verify my identity through government documents.

---

Not to mention the extremely confusing terminology. "Flash", "Experimental". Why are most of your models either of those two? I don't get the confidence that your models are any good because of such names. Give me a normal reliable model!

Even if Google releases AGI tier models in the future, I'll always look for other models because Google clearly thinks their models are too good for any of us. — wxce

AI is dramatically accelerating AI research

281 points | 216 comments

As somebody who does ML research, LLMs certainly make ML research faster. Maybe even 10x in some cases, as the author suggests.

But that’s just the parts of ML research that take place within your compute environment, namely experiments on model architecture, training strategy, UI/UX, etc. The algorithms and software.

Just because that part of research is progressively accelerated does not imply that we’re on a collision course with world-ending “superintelligence”. It just means that you’ll get to the best possible model of your data faster. And even when your data is the entire corpus of textual knowledge, there is a limit to the utility that provides.

It just means that software engineering, data analysis, and other computational tasks will be less of a bottleneck in the overall progress of the world (which, by the way, is great, and extremely valuable).

I don’t think it’s a stretch to say that we’ll have reached max LLM capability within a couple of years (what the author refers to as “super intelligence”). But it is a huge logical leap to say this:

> If we go through this feedback loop, I expect that the AI systems that come out the other side will be able to very quickly develop novel weapons and very easily overpower human civilization in a conflict.

First of all, the weapons necessary to overpower human civilization exist. They aren’t used as such due to geopolitics and humans’ basic survival instinct. Second, developing novel weapons requires physical tests, which are decidedly not accelerated by LLMs.

AI is a tool wielded by humans. If we’re wiped out by AI, it will be at the direction of a human. But we’ve made it pretty far with some pretty unstable humans in command of planet-killer weapons. I’m not overly concerned. — plaidfuji

RIP Cybertruck

297 points | 4 comments

Already posted 4 hours ago

https://news.ycombinator.com/item?id=50391456 — swed420

Anthropic IPO buyers see valuation as low as $1.1T

https://epyhia.com/anthropic-ipo-valuation-talks-drop-to-1-3...

282 points | 564 comments

Sure, this is a small anecdotal datapoint, but since I've gotten Qwen3.8-Flash-Next running well on my Strix Halo box my Claude Pro subscription use has dropped off a cliff. I'm only at 18% of quota usage this week - this being Friday I would've been at 80% at least in the past. This is just an astonishingly good model that runs locally and quite well on my PC. I do not plan to renew my Claude Pro subscription when it comes up in a couple of months. — UncleOxidant

sshole

1461 points | 390 comments

Am I missing something or is this written up to seem a lot worse than it actually is?

It starts with a bold claim: "ssh accounts that should not accept a password will accept any password between 256 and 1024 characters". But then it keeps adding qualifiers:

- sshd compiled with musl

- not using PAM

- password logins enabled

- at least one account with '*' as the password "hash"

- at least one OTHER account with a valid password

- server is aligned with 2 ley lines

- hacker is wearing a blue t-shirt and green socks

Ok, the last two are an exaggeration, but still. The conditions are all ANDed, miss a single one and you're fine.

On top of that, as someone else in these comments reminded, the target account needs to have a valid login shell or other exploitable program assigned to it, and these passwordless accounts tend to have nologin or something similar.

To me this seems to fall on the "technically possible, practically very unlikely" bucket, kinda like the PHP vulnerability from the other day. Maybe this has gone unnoticed for so long because it just doesn't happen. — tonnydourado

Claude Code sends your email address to websites

416 points | 146 comments

This explains the amount of spam emails I am receiving in the work email since I switched to Claude. I used to work with copilot which was fine. Now I am getting really a lot of spam emails almost on a daily basis. Absolutely crazy. And they are even personalised with my name and surname, not just "dear customer"...

Stupid me, I thought they somehow had hacked my company database or so... (considering all the cves, attacks happening on a daily basis...). — mk89

Search for everyone

485 points | 236 comments

If anyone from Kagi is reading this: Now that you have search without an account, is there any chance we can finally get a DNS-based enforced safesearch option like every other major search engine has? It's been in the feedback requests since May 2022[1].

Anyone on an enforced-safesearch network can now go to kagi.com, turn SafeSearch off, and search for porn or anything else, which is just going to get kagi blocked completely on all those networks. If you add a SafeSearch-enforced alternative IP address, then Kagi can still be used.

[1] https://kagifeedback.org/d/3285-safe-search-dns-locking-for-... — Nition

Alpine Linux Security Advisory: OpenSSH-server password authentication bypass

280 points | 29 comments

IMO this is where languages like Rust shine. The design patterns built into the language for handling errors (Result) - force you to handle errors / function results with sentinels, null pointers, or errnos are so much more error prone than handling a Result<T,E> using a match statement.

crypt() returning `*` is insane especially since these kinds of sentinels are all over /etc/passwd — 0127

Goodbye from Salon

400 points | 143 comments

The amount of newsroom jobs fell 60% between 2008 and 2020. The vast majority of what was lost were "beat" reporters - foreign bureaus, Washington bureaus from regional publications, statehouse reporters, or regional specialty beats (science, law, etc).

This started long before the decline of the open internet and AI. If anything, the shift online covered up a massive hollowing out of the industry. We're getting fewer sources of news, and more national coverage. A lot of stuff that is reported on is coming from a scant number of wire services, or directly from PR teams themselves.

For the most part, your choice of news platform is just a layer of coverage choices and political spin on top of a very thin market of original coverage. — legitster

MS Paint Remote Code Execution Vulnerability

489 points | 178 comments

Paint can exectue arbitrary code from the REMOTE, without USER INTERACTION?????

We seriously need more information. — pasteleft

Motorola Signature 27 with GrapheneOS support

390 points | 293 comments

Well "starting MSRP of $1,599." I'll stick to my 2nd hand Pixel 8 that I bought, for GrapheneOS long term support, for 1/10th of that price.

No doubt it's a way WAY better device, really, but I don't see where I would actually need that. I happily toss the one I have around and don't even care if it gets stolen or lost one day, different preference. — utopiah

Discord is ditching Electron and its new app uses less RAM

379 points | 329 comments

I had trouble reading more than the opening volley of the article due to popups. Am a Discord user, and rust application programmer: What GUI framework are they using? EGUI? GPUI? Something custom?

GPUI from comments? I meant to try GPUI, but backed off after an announcement pending its maintenance would be in question (?) a few months ago, and Zed broadly ending up being a false messiah, for my uses. (Not on the tier of JetBrains IDEs, a bug with a long thread they closed which (still I believe?) causes it to open cached versions of files, then clobber edits made since the cache, e.g. by other programs. I.e. the sort of bug which renders software too dangerous to use. I will not switch to a GUI framework from a group that ignores bugs of that severity reported by many people) — the__alchemist

I wish tech companies knew more about me

289 points | 258 comments

> When listening to personalized playlists on Spotify and YouTube Music I skip every single electronic track with vocals. I listen to a lot of techno and related genres, and the moment someone starts singing I skip the track. I've been doing it for years. None of these advanced algorithms have ever noticed this simple pattern.

Same here.

I think the songs get pushed by who pays to push, and most of those songs have vocals. — ChrisMarshallNY

Window Sweaters

319 points | 97 comments

heeey, I'm the author of this! can’t believe this made it to Hacker News lol. thank you for posting it!

a bit of context: I’m a product designer, and this was my very first open source project. I made it purely for fun, here’s where it started: https://x.com/saragordic/status/2098916110787916219

screenshots: I added the little video now; you can see many more screenshots on X, a lot of ppl shared their own

trust: totally fair; if you’d rather not run my binary you can build it yourself with the steps in the README.

the “send it to your coding agent” install line: that’s for ppl like me :D

I’ve learned a tooon by open sourcing this; thank you all for the feedback!! — gordic_sara

AI is forcing us to pay off 40 years of technical debt

691 points | 438 comments

While I have mixed feelings about AI's impact on my work, I am happy that I can address 5-7 years of technical debt in code bases as I come across it due to AI lowering the cost. Typically the solution is not too difficult; it just required a lot of time in research and testing which AI streamlined. I am able to verify everything at the end ran through the proper test cases and that the fix is what I expected. — kentm

Residential proxies detected on White House network

586 points | 184 comments

They’re too polite to say it explicitly, but when they say:

> Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.

There really aren’t very many candidates for who that person might be and it really seems like it would be someone who, I don’t know, maybe lives where the traffic is originating. — dhosek

North Korean fake job interview led to $6.3B Binance heist

357 points | 215 comments

A lot of people are focusing on how irresponsible the engineer was about using the work computer. That's obviously an issue but the bigger failure mode to me is the Engineer C's container deployment token.

That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.

Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token. — gandreani

AMD expects to outsell Intel in Q4 for the first time in history

455 points | 166 comments

That says more about Intel's shambolic efforts than it does about AMD's road to damascus moment.

Honestly both of them have demonstrated that they have little interest in AI. Intel gave up on Optane right as (a much-improved successor) would've helped with MoE offsetting or even as a highly durable drive for KV caching.

AMD have... turned out some decent gaming graphics cards and fine server CPUs but little else.

People are out there solding SMDs on old Nvidia mining rig GPUs to use them for inference; their hardware is not depreciating at the normal rate you'd expect from GPUs. DGX spark is finally useful now that AI can write multi-machine inference tooling optimised to it. Where's AMD in all of this? Nowhere. — mickeyp

Kimi K3.1 Pro model weights are out

354 points | 95 comments

Subtle quote from their website:

> Advancing the Frontier of Open Intelligence.

Too bad you probably need something like an 8x B300 node to run this. Black Friday is coming soon though, but I fear this open intelligence will be pacing anyone's liquidity frontier so I'll probably keep trailing the frontier for a while with nvidia/qwen3.8-27B-NVFP4 on dual RTX PRO 4000 in TP=2. I can almost fit 450k context in there. — __jf__

A thousand fewer paths to root

291 points | 187 comments

> Large, complex software projects likely require multiple rounds of scanning and fixing vulnerabilities to “bottom out” latent bugs. Ideally this process is repeated with each subsequent generation of frontier models. This applies to both proprietary and open source software.

One of the most important paragraphs from the article. Real implications for software development from a security perspective for new and existing software. Every software developer and vendor has a choice... Submit your code base to a frontier model to have it reviewed and fix all the bugs. Each time a new model is released, this process must be done again. If your company is against submitting your code to the frontier model companies for the many good reasons to avoid doing it, your software will eventually become a target if it isn't already. Then your company will be forced to scan the software and deal with the fallout from getting hacked.

If the Linux kernel has this many exploits, and it has been audited more than most other software... Then it seems obvious that all other software is even less secure. — treebeard901

I'm curious how people on HN are using AI day to day, and came up with a list of questions I thought could be interesting to know. No need to answer every question of course, just wanted to get a gut feel how people are using AI.

1) What AI subscriptions are you personally paying for? (Claude, ChatGPT/Codex, Cursor, etc)

- Which tiers?

- Have you purchased multiple subscriptions from the same provider (eg two Claude accounts)?

2) Are you using models outside (or instead) of those subscriptions? For example, pay-as-you-go APIs, OpenRouter, or locally hosted models.

- Which models and providers?

3) What coding harnesses and interfaces are you using? Are you sticking with the default CLIs or IDE integrations, or using alternatives like OpenCode, Pi, Aider, Muse Code, or custom-built harnesses?

- What made you switch harnesses (if you switched)?

4) Are you using any agent orchestration or swarm tools?

- For example, Munder Difflin, Gas Town, Ruflo, or something custom.

5) Are you using broader agent platforms like OpenClaw / Hermes Agent / Grok bot / Dots / Muse?

- If you are using them, what are your main use cases?

-----

I know my workflow has differed significantly from a year ago, and so it would be interesting to capture a snapshot today of what people are using and why.

289 points | 288 comments

I have a CLI based hybrid setup on my MBP (M5 48GB) and it has proven to be very effective.

1. I have a $20 Codex subscription that is more than enough for my work. I use a 75-35 model where I used higher models (Sol/Astra for 35% of the heavier tasks and lower models 75% for other tasks. Sometimes I also use Free OpenRouter models for minor tasks.

2. I use many local models like Qwen3.8-27b/Gemma-4-26b and some 9B models. I also heavily use voice/vision models like Kokoro, QwenTTS for marketing and product videos.

3. Pi exclusively, which I have tweaked for my hybrid setup.

4. I have my own custom agent orchestration that routes between Codex and local models based on the task.

5. I used OpenClaw for a bespoke market research task once, it worked flawlessly. — FlyingSnake

US voters roundly reject data centers in ballot measures

303 points | 611 comments

A lot of people here are portraying the opposition to data centers as being uneducated hypocrites who are against anything getting built. When you look at what the opposition are saying, they generally know what they are talking about. Here's Abdul El-Sayed (new Michigan senator) talking about his ideas for regulating the AI industry: https://youtu.be/YX44XDt0gXI?t=182 . For datacenters specifically, he isn't against them being built but thinks that there need to be rules in place so the communities that they're being built in actually benefit from them. He views moratoriums as something that localities and states should be doing until those rules are in place federally. The rules he suggests are:

- There must be community benefits agreements negotiated transparently with the local community

- Any new datacenters being built cannot raise utility rates

- Some of the revenue generated by the datacenter must be set aside to improve power reliability

- Datacenters must not touch our waterways at all

- Datacenters must be built using union labor

A lot of the communities that had datacenters built in them ended up getting steamrolled in negotiations by the tech companies because you had the local government (in small towns, this is people who work part time making a few thousand dollars per year) negotiating a deal with the Google/xAI/Oracle/etc corporate lawyers. I think it makes sense to say that the buildout should be paused until fairer terms can be worked out on a national level, rather than letting this continue to happen. — ndiddy

A new Go API for JSON

295 points | 134 comments

"There only ONE way to do each thing! Only ONE! No exception"

"What if it sucks?"

"There are now TWO ways to do each thing! No more than TWO! I promise!"

It's like python again. — muddi900

Images 2.6

310 points | 179 comments

That stained glass whale thing makes me especially grumpy. When it scrolled onto the page, my first thought was "whoah, what a neat idea" and then it was _immediately_ followed by "what a terribly execution."

Like, I'm not even an artist, so I'm sure there's a million things I'm missing, but it's just so upsetting to look at. There's weird random reflections on things that shouldn't have reflections, the coloured light absolutely doesn't actually track through the stained glass onto any surface that makes any sense, light is coming from every which way, it's just... gross to look at for anything more than a quarter of a second.

And this is what they're using to hype people up for it. /shrug — DanHulton

Postman silently auto-installs AI plugins and attempts to share all API data

1000 points | 332 comments

It's a shame what happened to Postman. It started as an excellent little developer tool for testing APIs. Then for some reason they raised over $400M in funding and hired 1,500+ employees, for what should have been a tiny OSS/passion project like curl or little snitch. Instead they now have to justify their valuation by forcing logins, collecting data, monthly subscriptions, AI features, etc.

I still don't know how they're valued at $5B+ when I don't know a single developer who actually uses it anymore — pants2

The 'Astra can read and write weights to improve Qwen' post is misleading

709 points | 163 comments

I work in this field (mech interp research) and I agree, the original post is definitely misleading. Some overselling in research is normal but it's a bit much.

First, the key result has nothing to do with making Qwen better at math, it just reduces reasoning loops.

Reasoning loops are a simple problem: the model generates the </think> token (which closes reasoning) with too low probability. You can fix this with simple steering approaches where you add a vector to different components of the LLM (https://arxiv.org/abs/2503.22048, https://arxiv.org/abs/2506.18167, etc). The method Astra used for identifying the vector is the standard procedure humans use (contrastive analysis). Such steering vector creation is basically the standard "intro-level interp project" for human researchers.

If you can code and understand LLM internals, you can do this yourself in 4-8 hours. The SWE equivalent would be doing binary patching with a debugger. Cool that frontier models can do this, but not unexpected since humans can do it without issue. — x313

Qwen 3.8 27B on my laptop can interpret model weights, too

476 points | 151 comments

Not making any claims about a specific model's capabilities, but all these "can interpret model weights" posts brings to mind the line in Shakespeare's Henry IV

GLENDOWE: I can call spirits from the vasty deep.

HOTSPUR: Why, so can I, or so can any man, but will they come when you do call for them?

I can interpret weights too, but will that interpretation be correct? — variaga

Google will turn off search for schools that reject AI

https://archive.ph/RuwsB

https://blog.google/products-and-platforms/products/educatio...

554 points | 397 comments

Somewhat related: did you know that you cannot disable GMail's GenAI features without disabling the traditional ML powered features, such as smart inbox, which predates LLMs? In this case, Google/Alphabet is conflating GenAI/LLMs with traditional machine learning, so you can't opt out of genai---which necessarily requires access to your data by the models---without deactivating the previous non-LLM powered features.

Which I get it, they indeed can use LLMs to improve the previous traditional ML pipeline. However I believe bundling these options together shouldn't be legal and I never expected Google to employ dark patterns like this. When I subscribed, these features were provided by traditional ML, perhaps some BERT-like encoder architecture at most, however now I cannot keep that previous functionality if I don't wish to grant LLMs access to my data. — karmickoala

Stringman, an $800 open-source room scale gripper robot

356 points | 136 comments

Hi there, I'm Nathaniel, the creator of this robot. Thanks for posting it :) If you have any questions feel free to ask.

Can it kill you? no probably not. The tension limit kicks in and lets the line out if you pull too hard.

Will it work in a room with a ceiling fan? usually its fine since you can lower the work area ceiling to exclude the fan.

Will it make my kids learn to not pick up after themselves? They never will anyways. — nhnifong

My company is pretty paranoid about leaking IP to the frontier labs through prompts, so we've all been diligent about disabling data sharing in Codex/Claude Code/etc. But yesterday my coworkers and I noticed that the setting had been silently reenabled in Codex. None of us knowingly opted back in.

You can check your settings here: https://chatgpt.com/settings/data-controls. Look for "Improve the model for everyone".

Curious if this is an isolated issue or something more widespread.

EDIT: looks like this has been noted before https://news.ycombinator.com/item?id=49643556

EDIT: apparently you can also turn off data sharing here: https://privacy.openai.com/policies?modal=take-control

430 points | 134 comments

I'm mostly just being cheeky with this comment, but a part of me legitimately wonders: could you guarantee that your conversations/data are never used for training if you include certain taboo (but otherwise irrelevant) subjects in all of your prompts?

For example: "Codex, please build me a new admin dashboard using Node.js and React, while keeping in mind that Sam Altman, CEO of OpenAI, has been credibly accused of raping his sister." — combobyte

Kalshi and its co-founders face felony charges for violating Utah gambling laws

441 points | 389 comments

I'm not sure specifically about the moral crusade against Kalshi and Polymarket, but I am glad to see that at least one state is serious about its sovereignty and is willing to go to the mat with criminal charges. Utah 100% has a right to enforce this and I hope they are successful. And taking on the feds too, that is a gutsy move.

We need at least one state to do this when large corporations violate privacy laws. — jsw97

Safari introduces Adaptive Dark Mode in 27.3

261 points | 166 comments

Hacker News itself is a prime example of a website that doesn’t support dark mode, but could do so trivially (and, IMO, would look so much better if it did!) — Reason077

Mac at Any Scale

310 points | 175 comments

Amazing article. It just goes to show how many problems they are solving just to work around bugs and limitations within Apple itself. I’d wager a guess that if Apple made a new Xserve with the same performance as a Mac mini but twice the price people would still buy them, because figuring out data center operations is expensive. — kccqzy

US tech giants' hidden AI debt swells 90% to $3.2T in 6 months

337 points | 142 comments

I very much hope this, and other threads on the financially insane behaviour of the tech sector get more surface. I don't think having this die in "new" is helpful because this stuff, the norms of how business looks at the balance sheet and decides what is, and is not rational business investment, this stuff is -> important <-

This is a significant proportion of the market. Having this amount of money not understood is harmful. — ggm