Ranked by score · Showing 20 of 103 stories · 7 hidden by your filters

1. No. 1Score 0.78

   Apple's git still trusts the compromised eMudhra certificates

   we-have-a-problem.com2 minTopics: Programming, Security, ITFormat: NewsChecked by: Claim-checked

   Summary and score for “Apple's git still trusts the compromised eMudhra certificates”

   emudhra.we-have-a-problem.com

   As of October 28, git, curl and python3 shipped with macOS reportedly still trust eight eMudhra intermediate CAs whose P-384 private keys can be recovered from their public certificates. Safari and apps on Apple's frameworks are blocked, but tools that read /etc/ssl/cert.pem are not. One independent test on a Mac found Apple's git and curl accepted a forged chain, and Homebrew's git did not help. Builders should remove the roots by hand, recheck after each update, and review macOS CI runners. Apple's response and the macOS 27.2 claim remain unverified.

   Score 0.78Claim check: 5 no source given · 2 couldn’t check

   Elsewhere: HN 1089 pts, front page

   Score breakdown and claims for “Apple's git still trusts the compromised eMudhra certificates” · Also covered by AI News Report

   Comments on “Apple's git still trusts the compromised eMudhra certificates”

2. No. 2Score 0.75

   Claude Code's default telemetry sends Anthropic SHA-256 hashes of files it reads

   AgenticBench4 minTopics: AI, SecurityFormat: PaperChecked by: Claim-checked

   Summary and score for “Claude Code's default telemetry sends Anthropic SHA-256 hashes of files it reads”

   agenticbench.org

   AgenticBench reports that Claude Code, including build 2.1.312 on 27 October, sends api.anthropic.com an unsalted SHA-256 hash of each file it reads, with device and session IDs, even with a DeepSeek model and no Anthropic login. Weak secrets in templated files such as .env can be guessed and checked offline; the authors recovered a fake password in about 3.5 seconds. Setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 stopped telemetry in their tests. Findings rest on one unit per condition, and Anthropic has sent only an automated acknowledgement.

   Score 0.75Contestedjudges differ by 0.43 on audience breadthClaim check: 7 no source given · 1 couldn’t check

   Elsewhere: HN 2 pts, not on front page

   Score breakdown and claims for “Claude Code's default telemetry sends Anthropic SHA-256 hashes of files it reads”

   Comments on “Claude Code's default telemetry sends Anthropic SHA-256 hashes of files it reads”

3. No. 3Score 0.74

   GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux

   alpinelinux.org5 minTopics: Security, DevOpsFormat: NewsChecked by: Claim-checked

   Summary and score for “GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux”

   Alpine Linux says an attacker tried to exploit GitLab's CVE-2026-97229 (CVSS 10.0, a regex bug in Ruby's Onigmo engine) on October 20 and 21, crashing workers eight times. Alpine found no evidence of code execution but rebuilt the instance anyway. Its checks found no tampering with packages or releases. The lesson for self-hosters: GitLab's fix is a Ruby patch applied only in official packages, so custom images need Ruby 3.3.13, 3.4.12 or 4.0.9 as well. Most figures come from Alpine alone.

   Score 0.74Claim check: 1 matches source · 5 no source given · 2 couldn’t check

   Elsewhere: HN 135 pts, front page

   Score breakdown and claims for “GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux”

   Comments on “GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux”

4. No. 4Score 0.74

   PyTorch 2.15 Release Blog

   PyTorch Blog9 minTopics: Programming, AI, DevOps, HardwareFormat: ReleaseChecked by: Claim-checked

   Summary and score for “PyTorch 2.15 Release Blog”

   PyTorch Foundation · pytorch.org

   PyTorch 2.15 makes the rewritten NCCL backend the default for every nccl process group, with TORCH_DIST_USE_NCCL2=0 or nccl-legacy as rollbacks, and adds a flight recorder that dumps on hangs. It also drops Python 3.10 and macOS 14 support, and changes FSDP2 gradient dtype defaults. The release adds NIXL one-sided transports, FP8 and faster decode on Apple Silicon, and CUDA 13.2 as the default wheel. The MPS speedups, such as 1.32–1.34x MoE decode on an M3 Ultra, are the project's own figures and could not be independently checked.

   Score 0.74Claim check: 1 matches source · 3 no source given · 3 couldn’t check

   Elsewhere: HN —

   Score breakdown and claims for “PyTorch 2.15 Release Blog”

   Comments on “PyTorch 2.15 Release Blog”

5. No. 5Score 0.73

   A Measurement Study of Contextual Leakage in AI Chat Platforms

   arXiv56 minTopics: AI, SecurityFormat: PaperChecked by: Claim-checked

   Summary and score for “A Measurement Study of Contextual Leakage in AI Chat Platforms”

   arxiv.org

   Researchers at Stony Brook audited the web interfaces of 42 AI chatbots, 25 general-purpose and 17 in health, legal and education, and found that 21 send conversation titles to third-party trackers and nine send verbatim prompts. In the general-purpose group, 11 of 13 leaking platforms also send the user's email, linking content to identity. Trackers read auto-generated page titles as ordinary metadata. Testing used fresh accounts, two prompts, one US vantage point and web interfaces only. Builders embedding analytics scripts in chat UIs should audit what those scripts can read.

   Score 0.73Claim check: 8 no source given

   Elsewhere: HN 1 pts, not on front page

   Score breakdown and claims for “A Measurement Study of Contextual Leakage in AI Chat Platforms”

   Comments on “A Measurement Study of Contextual Leakage in AI Chat Platforms”

6. No. 6Score 0.70

   Clustered Geometry, Partitioned TLAS, Indirect Acceleration Structure Builds

   devblogs.microsoft.com12 minTopics: Programming, HardwareFormat: ReleaseChecked by: Claim-checked

   Summary and score for “Clustered Geometry, Partitioned TLAS, Indirect Acceleration Structure Builds”

   Microsoft released a preview of DirectX Raytracing Clustered Geometry and Partitioned TLAS, with GPU-driven build and update calls, in Agility SDK 1.722 and Shader Model 6.10. Clusters of up to 256 triangles are assembled into BLAS, and PTLAS rebuilds only changed scene regions. In Microsoft's own AMD RX 9070 sample, frame rate rose from 1.2 to 79 FPS, though scratch memory grew and the test covers one configuration. Support currently spans RTX, Radeon RX 9000 and Intel Arc B-series, with Qualcomm expected in 2027.

   Score 0.70Claim check: 2 matches source · 6 no source given

   Elsewhere: HN 1 pts, not on front page

   Score breakdown and claims for “Clustered Geometry, Partitioned TLAS, Indirect Acceleration Structure Builds”

   Comments on “Clustered Geometry, Partitioned TLAS, Indirect Acceleration Structure Builds”

7. No. 7Score 0.72

   The case of the 9 bit AES key

   V125 minTopics: SecurityFormat: PaperChecked by: Claim-checked

   Summary and score for “The case of the 9 bit AES key”

   V12 · v12.sh

   Security firm V12 reports that several PDF tools generate AES-256 file keys from tiny, guessable state. In MuPDF before 1.28.5, only nine bits of the timestamp seed affect the key, so 512 candidates cover every case and a Python search takes about 11 ms. Foxit Reader hashes a timestamp with zero-filled bytes, and a Rust search covers every second since 1970 in under five seconds. OpenPDF and iText are also affected. MuPDF is fixed; the findings are the authors' own and unverified independently.

   Score 0.72Contestedjudges differ by 0.41 on significanceClaim check: 7 no source given · 1 couldn’t check

   Elsewhere: HN 101 pts, front page

   Score breakdown and claims for “The case of the 9 bit AES key”

   Comments on “The case of the 9 bit AES key”

8. No. 8Score 0.68

   Analysts followed AI agent's randomly assigned preferences in 86% of decisions

   anthropic.com14 minTopics: AIFormat: PaperChecked by: Claim-checked

   Summary and score for “Analysts followed AI agent's randomly assigned preferences in 86% of decisions”

   Anthropic ran a randomized study of 50 professional analysts doing a farming-cooperative analysis with Claude Code, where each agent was secretly assigned a coin-flip lean on four open analytical choices. Analysts matched the lean 86% of the time, and 77% reused the agent's arguments but only 15% credited it. The effect on the final recommendation was smaller (54% vs 36%). The study covers one task, one model and deliberately strengthened leans, and the figures are the authors' own, not independently verified.

   Score 0.68Claim check: 8 couldn’t check

   Elsewhere: HN 4 pts, not on front page

   Score breakdown and claims for “Analysts followed AI agent's randomly assigned preferences in 86% of decisions”

   Comments on “Analysts followed AI agent's randomly assigned preferences in 86% of decisions”

9. No. 9Score 0.67

   Anthropic Threw Away Git

   Jackie Chen's IT Workshop8 minTopics: Programming, AI, DevOpsFormat: AnalysisChecked by: Claim-checked

   Summary and score for “Anthropic Threw Away Git”

   Jackie Chen · jackiechen.blog

   Anthropic says it replaced git for its monorepo with Scion, a centralised, server-authoritative system built by seven people in five months. Merged changes rose from about 2,500 a day in May to over 30,000 in September, and CI alone runs 25 million checkouts daily. Anthropic reports a 200x smaller footprint than its old mirror fleet and checkouts two orders of magnitude faster. It is not open-sourcing Scion, and it suggests git forges could expose server-side APIs instead.

   Score 0.67Claim check: 7 matches source · 1 no source given

   Elsewhere: HN 2 pts, not on front page

   Score breakdown and claims for “Anthropic Threw Away Git”

   Comments on “Anthropic Threw Away Git”

10. No. 10Score 0.67

    AI crawlers in robots.txt: a study of the top 10k sites (2026)

    HitMind12 minTopics: AIFormat: PaperChecked by: Claim-checked

    Summary and score for “AI crawlers in robots.txt: a study of the top 10k sites (2026)”

    hitmind.ai

    HitMind analyzed robots.txt files from the top 10,000 domains and found that 329 of 1,105 files (29.8%) that block paths for everyone while naming an AI crawler let that crawler past at least one block. Under RFC 9309, a crawler with its own group ignores the * rules, so a bare Allow: / for GPTBot reopens search, account and API paths. About a fifth of domains refused the crawler, and the study measures rules, not what crawlers actually fetched.

    Score 0.67Claim check: 7 matches source · 1 couldn’t check

    Elsewhere: HN 1 pts, not on front page

    Score breakdown and claims for “AI crawlers in robots.txt: a study of the top 10k sites (2026)”

    Comments on “AI crawlers in robots.txt: a study of the top 10k sites (2026)”

11. No. 11Score 0.72

    Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

    Cisco Talos8 minTopics: Security, ITFormat: NewsChecked by: Claim-checked

    Summary and score for “Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN”

    Cisco Talos · blog.talosintelligence.com

    Cisco Talos describes UAT-11473, an actor that exploited CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, to install a malware framework called KeyDrift. Its PolyFlame module runs inside vdaemon processes, while LittleFilch hooks SSL_read to extract assessed IPsec data-plane keys from decrypted control traffic. Talos reports high-confidence infrastructure overlap with Volt Typhoon and targeting of space, defense and policy organizations; the report cites no independent sources for these points. Cisco has released patches and a hardening guide.

    Score 0.72Claim check: 2 matches source · 6 no source given

    Elsewhere: HN —

    Score breakdown and claims for “Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN”

    Comments on “Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN”

12. No. 12Score 0.65

    The AI cost of JavaScript frameworks

    Nolan Lawson15 minTopics: Programming, AIFormat: PaperChecked by: Claim-checked

    Summary and score for “The AI cost of JavaScript frameworks”

    Nolan Lawson · nolanlawson.com

    Nolan Lawson benchmarked 12 JavaScript frameworks by having Claude Code (Opus 5.5) build the same Pokémon app 3–5 times each. Median cost ran from $2.67 for Hono+htmx to $4.97 for Angular, which also wrote the most code (about 2,000 lines versus 1,370). Lighthouse performance and accessibility scores were near ceiling everywhere; JavaScript shipped ranged from 0 KiB (Astro) to 142 KiB (Next.js). Caveats: one content-heavy app, high run-to-run variance, and Lighthouse favors multi-page sites.

    Score 0.65Claim check: 1 matches source · 5 no source given

    Elsewhere: HN 3 pts, front page

    Score breakdown and claims for “The AI cost of JavaScript frameworks”

    Comments on “The AI cost of JavaScript frameworks”

13. No. 13Score 0.66

    Model is being retired. Are you ready to upgrade?

    mahalsystems.ai17 minTopics: Programming, AIFormat: PaperChecked by: Claim-checked

    Summary and score for “Model is being retired. Are you ready to upgrade?”

    Mahal Systems swapped the model under six small agents (recommendation, tool routing, SQL, retrieval, extraction, error recovery) and tested Claude Haiku 4.5 to 5.5 and GPT-5.4 nano to GPT-6 Luna. The lab's successor lowered the score in 3 of 12 upgrades, and 11 of 12 regressed some cases. Switching labs matched or beat the successor in 10 of 12. Rules in backend code mostly survived; prompts and tool descriptions did not. The tests used small models, reasoning off, 20 cases, and figures come from the vendor's own benchmarks.

    Score 0.66Claim check: 8 no source given

    Elsewhere: HN 4 pts, not on front page

    Score breakdown and claims for “Model is being retired. Are you ready to upgrade?”

    Comments on “Model is being retired. Are you ready to upgrade?”

14. No. 14Score 0.63

    Making SIMD Code Scale to Any Vector Width

    Stream HPC14 minTopics: ProgrammingFormat: Write-upChecked by: Claim-checked

    Summary and score for “Making SIMD Code Scale to Any Vector Width”

    Nemi Verploegh · streamhpc.com

    Stream HPC shows how to make SIMD code scale with vector width by storing vector components as lanes, one object per lane, instead of one vec3/vec4 per object. In a frustum-culling example on a Ryzen 7 5800 with Clang, cost fell from 13.4 ns to 0.67 ns per box on AVX2 and 1.84 ns on SSE. Gains came from splatting planes once outside the loop and writing results a block at a time.

    Score 0.63Claim check: 8 no source given

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “Making SIMD Code Scale to Any Vector Width”

    Comments on “Making SIMD Code Scale to Any Vector Width”

15. No. 15Score 0.70

    26,400 live credentials found scanning 7.25M repos on China's Gitee

    MongoDB6 minTopics: SecurityFormat: PaperChecked by: Claim-checked

    Summary and score for “26,400 live credentials found scanning 7.25M repos on China's Gitee”

    mongodb.com

    A researcher scanned 7,256,531 public Gitee repositories with TruffleHog and Kingfisher and found 26,400 unique credentials that authenticated against vendor APIs, with Alibaba Cloud keys the most common. The run took about a month and cost $3,097.64, covered by Modal credits. That works out to 3.64 per 1,000 repositories, versus 3.11 for GitLab and 2.39 for Bitbucket, but those earlier scans used TruffleHog alone; TruffleHog-only, Gitee falls to 1.76. Each scanner alone found about half, so detector coverage matters. Revocation of disclosed keys is unconfirmed.

    Score 0.70Claim check: 2 matches source · 5 no source given · 1 couldn’t check

    Elsewhere: HN 29 pts, front page

    Score breakdown and claims for “26,400 live credentials found scanning 7.25M repos on China's Gitee”

    Comments on “26,400 live credentials found scanning 7.25M repos on China's Gitee”

16. No. 16Score 0.62

    UK to look at making software companies liable for cyber breaches

    The Record (Recorded Future News)5 minTopics: Security, PolicyFormat: NewsChecked by: Claim-checked

    Summary and score for “UK to look at making software companies liable for cyber breaches”

    therecord.media

    The UK budget commits the government to consult next year on where liability for cyber breaches from insecure technology should sit, building on a Law Commission review that would extend product law to software and AI. Scope, lead department and whether it means civil liability or statutory duties remain unspecified. The EU is already moving on fines and strict liability for software, and vendor groups are expected to resist. The budget also allocates £154 million for AI-based cyber defenses, including £70 million for an NCSC vulnerability centre.

    Score 0.62Claim check: 2 matches source · 4 no source given · 2 couldn’t check

    Elsewhere: HN —

    Score breakdown and claims for “UK to look at making software companies liable for cyber breaches”

    Comments on “UK to look at making software companies liable for cyber breaches”

17. No. 17Score 0.62

    GitHub powering up four million extra cores to stop its service going down

    The RegisterTopics: Programming, AI, DevOpsFormat: NewsChecked by: Claim-checked

    Summary and score for “GitHub powering up four million extra cores to stop its service going down”

    Thomas Claburn · theregister.com

    GitHub said at its Universe conference that it handled 7.4 billion commits in September, about five times the volume of a year earlier, driven largely by AI agents, and that the load has caused repeated outages. It reports adding four million CPU cores, 160 petabytes of high-speed storage and more Actions capacity. It is also separating compute from storage, which internal benchmarks suggest could raise write throughput up to 35x, and expects its multi-region Azure migration to finish early next year. These figures are GitHub's own and unverified.

    Score 0.62Contestedjudges differ by 0.49 on new informationClaim check: 7 no source given

    Elsewhere: HN —

    Score breakdown and claims for “GitHub powering up four million extra cores to stop its service going down” · Also covered by The New Stack

    Comments on “GitHub powering up four million extra cores to stop its service going down”

18. No. 18Score 0.66

    Nvidia Nemotron 3.5 Transcribe

    huggingface.co65 minTopics: AIFormat: ReleaseChecked by: Claim-checked

    Summary and score for “Nvidia Nemotron 3.5 Transcribe”

    Nvidia released Nemotron 3.5 Transcribe, an open-weight offline model (34B total, about 4.3B active parameters) covering transcription in 40 languages, translation, speaker labels and audio Q&A for recordings up to an hour. Its own tables show a 4.71 mean WER on nine English Open ASR sets, against 4.94 for Qwen3-ASR-1.7B. The 2,238x throughput figure comes from Nvidia's NIM on one Blackwell GPU; the open-source vLLM path is about two times slower. These results are Nvidia's own and not independently verified.

    Score 0.66Claim check: 8 no source given

    Elsewhere: HN 1 pts, not on front page

    Score breakdown and claims for “Nvidia Nemotron 3.5 Transcribe” · Also covered by Hugging Face Blog, The Next Web

    Comments on “Nvidia Nemotron 3.5 Transcribe”

19. No. 19Score 0.70

    Who Is the Agent Acting As? Why AI Agents Become Confused Deputies

    dvlog12 minTopics: Programming, AI, SecurityFormat: Write-upChecked by: Claim-checked

    Summary and score for “Who Is the Agent Acting As? Why AI Agents Become Confused Deputies”

    Dushyanth V. · dvlog.dev

    A blog post argues that an AI agent running on one broad service account becomes a confused deputy: a prompt injection in a support ticket can produce a fully authorized write to another tenant. Its fix is a gateway outside the model that checks each tool call against user, agent and tenant permissions, denies by default, and takes the tenant from verified identity. It favors delegation over impersonation, per OAuth token exchange. These are the author's recommendations, not independently tested results.

    Score 0.70Claim check: 2 matches source · 6 no source given

    Elsewhere: HN 1 pts, not on front page

    Score breakdown and claims for “Who Is the Agent Acting As? Why AI Agents Become Confused Deputies”

    Comments on “Who Is the Agent Acting As? Why AI Agents Become Confused Deputies”

20. No. 20Score 0.70

    Pre-auth admin takeover on 28 Xiaomi/Redmi routers via hardcoded key

    GitHub8 minTopics: Security, IT, HardwareFormat: Write-upChecked by: Claim-checked

    Summary and score for “Pre-auth admin takeover on 28 Xiaomi/Redmi routers via hardcoded key”

    github.com

    A researcher published an unpatched disclosure for Xiaomi's mesh daemon cab_meshd, including working exploit code. A hardcoded HMAC key, identical in 28 Xiaomi and Redmi firmware images, lets a LAN or Wi-Fi client obtain admin access without a password. A separate command injection gave root on the AX3000T (RD03v2) on hardware, but Xiaomi's normal setup blocked the CAP-side routes. Runtime takeover was not tested on every model. Xiaomi had not confirmed reproduction after 45 days, so owners have no fix to apply.

    Score 0.70Claim check: no checkable claims

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “Pre-auth admin takeover on 28 Xiaomi/Redmi routers via hardcoded key”

    Comments on “Pre-auth admin takeover on 28 Xiaomi/Redmi routers via hardcoded key”

21. No. 21Score 0.69

    Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware

    Huntress14 minTopics: SecurityFormat: Write-upChecked by: Claim-checked

    Summary and score for “Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware”

    huntress.com

    Huntress researchers documented an Amazon-themed ClickFix campaign that lured victims via a sponsored Google result to a spoofed Amazon login page, then tricked them into pasting a concealed command into the Windows Run dialog.

    Score 0.69Claim check: 1 matches source · 3 no source given · 4 couldn’t check

    Elsewhere: HN 1 pts, not on front page

    Score breakdown and claims for “Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware”

    Comments on “Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware”

22. No. 22Score 0.61

    Same-generation CPUs from 4 China clouds are within 8%, storage differs 6x

    Chinaready5 minTopics: DevOpsFormat: PaperChecked by: Claim-checked

    Summary and score for “Same-generation CPUs from 4 China clouds are within 8%, storage differs 6x”

    chinaready.co

    A cross-cloud benchmark of 35 VMs across Alibaba Cloud, Tencent Cloud, AWS China, and Azure China, run over three time windows in October 2026, finds that same-generation CPUs perform within about 8% of one another, with memory differences of up to roughly 16% and storage differing by as much as…

    Score 0.61Claim check: 3 couldn’t check

    Elsewhere: HN 1 pts, not on front page

    Score breakdown and claims for “Same-generation CPUs from 4 China clouds are within 8%, storage differs 6x”

    Comments on “Same-generation CPUs from 4 China clouds are within 8%, storage differs 6x”

23. No. 23Score 0.68

    I scanned 3 months of Product Hunt launches for security issues

    squirrelscan16 minTopics: SecurityFormat: PaperChecked by: 3 judges

    Summary and score for “I scanned 3 months of Product Hunt launches for security issues”

    squirrelscan · squirrelscan.com

    I scanned three months of Product Hunt launches, 72,356 in total, with a passive surface-level crawl of up to 30 pages per site using the open-source squirrelscan CLI. Each finding was checked by hand.

    Score 0.68

    Elsewhere: HN ? pts, not on front page

    Score breakdown for “I scanned 3 months of Product Hunt launches for security issues”

    Comments on “I scanned 3 months of Product Hunt launches for security issues”

24. No. 24Score 0.62

    Unix and Beyond: An Interview with Ken Thompson

    cs.princeton.edu22 minTopics: ProgrammingFormat: OtherChecked by: 3 judges

    Summary and score for “Unix and Beyond: An Interview with Ken Thompson”

    This Computer interview features Ken Thompson, co-creator of Unix, Plan 9, and Inferno, discussing his bottom-up design approach, how small, closely interacting groups at Bell Labs resolve technical disputes by prototyping alternatives, and what he sees as Unix's strengths and missed opportunities, notably its underdeveloped treatment of remoteness.

    Score 0.62Contestedjudges differ by 0.43 on substantiated

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Unix and Beyond: An Interview with Ken Thompson”

    Comments on “Unix and Beyond: An Interview with Ken Thompson”

25. No. 25Score 0.66

    Fast Models, Slow Agents

    armincat.com2 minTopics: AI, DataFormat: Write-upChecked by: 3 judges

    Summary and score for “Fast Models, Slow Agents”

    Funnel ran a randomised A/B test of GLM-5.2 against Claude Opus 4.8 in its internal data agent platform, Reef. GLM responded more than twice as fast per model call, but made 66% more tool calls and took 14% longer to finish tasks.

    Score 0.66

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Fast Models, Slow Agents”

    Comments on “Fast Models, Slow Agents”

26. No. 26Score 0.59

    Search golden sets are anything but

    Doug Turnbull's Blog13 minTopics: DataFormat: AnalysisChecked by: 3 judges

    Summary and score for “Search golden sets are anything but”

    Doug Turnbull · softwaredoug.com

    A critique of standard search evaluation argues that golden sets built from BEIR-style judgment lists can mislead teams about real relevance. The author walks through NDCG using ESCI and WANDS examples, showing how a poor ideal ranking can make weak results look acceptable.

    Score 0.59

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Search golden sets are anything but”

    Comments on “Search golden sets are anything but”

27. No. 27Score 0.62

    noalloc: Tooling and libraries to enforce zero heap allocations in Golang

    GitHub18 minTopics: ProgrammingFormat: ReleaseChecked by: 3 judges

    Summary and score for “noalloc: Tooling and libraries to enforce zero heap allocations in Golang”

    github.com

    noalloc is an experimental Go toolchain that asserts functions must not heap-allocate and checks the full call tree of any function marked //noalloc:root, reporting each allocating line for fixing or exemption.

    Score 0.62

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “noalloc: Tooling and libraries to enforce zero heap allocations in Golang”

    Comments on “noalloc: Tooling and libraries to enforce zero heap allocations in Golang”

28. No. 28Score 0.58

    OpenTaxRate – open-source US sales tax rates by street address

    GitHub3 minTopics: Programming, DataFormat: New projectChecked by: 3 judges

    Summary and score for “OpenTaxRate – open-source US sales tax rates by street address”

    github.com

    OpenTaxRate is an MIT-licensed open-source tool that returns the general US sales tax rate for a street address and date, built from state address ranges, tax-area boundaries, and dated rates published by tax agencies.

    Score 0.58

    Elsewhere: HN 4 pts, not on front page

    Score breakdown for “OpenTaxRate – open-source US sales tax rates by street address”

    Comments on “OpenTaxRate – open-source US sales tax rates by street address”

29. No. 29Score 0.65

    Orchestrating a One-Person Software Factory

    oskargroth.com19 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges

    Summary and score for “Orchestrating a One-Person Software Factory”

    Oskar Groth

    An indie developer describes running a one-person software company by using an orchestrator agent that spawns and coordinates parallel coding agents, with GitHub issues and pull requests serving as the shared record.

    Score 0.65

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Orchestrating a One-Person Software Factory”

    Comments on “Orchestrating a One-Person Software Factory”

30. No. 30Score 0.65

    Forging a Microsoft Edge Full Chain with Logic Bugs Only

    Orange Tsai14 minTopics: SecurityFormat: Write-upChecked by: 3 judges

    Summary and score for “Forging a Microsoft Edge Full Chain with Logic Bugs Only”

    Orange Tsai · blog.orange.tw

    A researcher at DEVCORE, Orange Tsai, published a write-up of a fully logic-based Microsoft Edge exploit chain built for Pwn2Own Berlin 2026, which earned a $175,000 sandbox escape and was nominated for a Pwnie Award. The chain relies on five bugs and two Windows features, with no memory corruption.

    Score 0.65

    Elsewhere: HN 3 pts, not on front page

    Score breakdown for “Forging a Microsoft Edge Full Chain with Logic Bugs Only”

    Comments on “Forging a Microsoft Edge Full Chain with Logic Bugs Only”

31. No. 31Score 0.57

    Accelerating Ubuntu Core Desktop

    Jon Seager9 minTopics: Programming, IT, ProductFormat: ReleaseChecked by: 3 judges

    Summary and score for “Accelerating Ubuntu Core Desktop”

    Jon Seager · jnsgr.uk

    Canonical has restarted development of Ubuntu Core Desktop, an immutable, attestable Linux desktop in which every component, including the bootloader, kernel, desktop environment and apps, ships as a snap.

    Score 0.57

    Elsewhere: HN 4 pts, not on front page

    Score breakdown for “Accelerating Ubuntu Core Desktop” · Also covered by Phoronix

    Comments on “Accelerating Ubuntu Core Desktop”

32. No. 32Score 0.64

    MCP clients now lazy-load tools, and our gateway's token savings mostly vanished

    mcprating.io10 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges

    Summary and score for “MCP clients now lazy-load tools, and our gateway's token savings mostly vanished”

    Mcprating.io reports that Claude Code, Cursor and Kiro now load MCP tool definitions lazily by default, so a configured server adds only its tool names to each request rather than its full schemas.

    Score 0.64

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “MCP clients now lazy-load tools, and our gateway's token savings mostly vanished”

    Comments on “MCP clients now lazy-load tools, and our gateway's token savings mostly vanished”

33. No. 33Score 0.56

    Algeon – Compose GPU graph, vector, and ML algorithms in SQL

    GitHub4 minTopics: Programming, AI, DataFormat: New projectChecked by: 3 judges

    Summary and score for “Algeon – Compose GPU graph, vector, and ML algorithms in SQL”

    github.com

    Algeon is an experimental GPU-accelerated query engine built on Apache DataFusion that exposes NVIDIA cuGraph, cuVS, and cuML algorithms as SQL table functions, alongside cuDF relational execution.

    Score 0.56Contestedjudges differ by 0.47 on substantiated

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Algeon – Compose GPU graph, vector, and ML algorithms in SQL”

    Comments on “Algeon – Compose GPU graph, vector, and ML algorithms in SQL”

34. No. 34Score 0.56

    Apple iPhone Duo review: Two screens, two experiences, two thousand dollars

    Ars Technica19 minTopics: Hardware, DesignFormat: AnalysisChecked by: 3 judges

    Summary and score for “Apple iPhone Duo review: Two screens, two experiences, two thousand dollars”

    arstechnica.com

    Ars Technica's reviewer tests Apple's first foldable, the $1,999 iPhone Duo, and finds it impressive as a small iPad but frustrating as a phone. The review cites a seam that is nearly invisible when unfolded, an awkward right-side control layout, poor one-handed comfort, and the loss of Face ID and…

    Score 0.56Contestedjudges differ by 0.56 on reader interest

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Apple iPhone Duo review: Two screens, two experiences, two thousand dollars”

    Comments on “Apple iPhone Duo review: Two screens, two experiences, two thousand dollars”

35. No. 35Score 0.64

    Training Reve 2.0 at Scale

    Reve21 minTopics: Programming, AI, DevOpsFormat: Write-upChecked by: 3 judges

    Summary and score for “Training Reve 2.0 at Scale”

    Reve Research TeamReport by Joe Wang with contributions from Kyra Mo and Ben Cuan · app.reve.com

    Reve Research published a technical report on the training infrastructure behind its Reve 2.0 and 2.1 image models, covering a platform built on Kubernetes, Ray, and Google Cloud.

    Score 0.64

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Training Reve 2.0 at Scale”

    Comments on “Training Reve 2.0 at Scale”

36. No. 36Score 0.56

    UEFI pre-driver Nvidia GPU unlocker for Windows

    GitHub10 minTopics: HardwareFormat: Write-upChecked by: 3 judges

    Summary and score for “UEFI pre-driver Nvidia GPU unlocker for Windows”

    github.com

    A GitHub project called nv-uefi-unlocker, shared on Hacker News, offers a UEFI pre-driver tool that runs on a USB boot stick before Windows loads and attempts to unlock NVIDIA GeForce RTX 20, 30 and 40 series GPUs by replaying a firmware sequence that includes GSP-RM boot and a vendor payload…

    Score 0.56

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “UEFI pre-driver Nvidia GPU unlocker for Windows”

    Comments on “UEFI pre-driver Nvidia GPU unlocker for Windows”

37. No. 37Score 0.64

    Are you paying for useless LLM prompts?

    cameronmpalmer.com8 minTopics: AIFormat: PaperChecked by: 3 judges

    Summary and score for “Are you paying for useless LLM prompts?”

    An experiment tested whether persona prompts (e.g., "You are an expert") affect accuracy, cost, and speed for LLMs answering 5,000 MMLU-Pro multiple-choice questions across four models. Accuracy was largely flat, but several models, notably Deepseek and Ling, used significantly more reasoning tokens with expert personas, raising cost and latency.

    Score 0.64

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Are you paying for useless LLM prompts?”

    Comments on “Are you paying for useless LLM prompts?”

38. No. 38Score 0.56

    Trapped in the Technologist Factory

    ideolalia.com13 minTopics: Programming, Product, StartupsFormat: AnalysisChecked by: 3 judges

    Summary and score for “Trapped in the Technologist Factory”

    This first-person essay recounts a software engineer's career across two startups, Runa and Factual, both of which failed to reach the growth their investors expected. Runa's dynamic-pricing business never won retailer trust, and Factual's data business drifted into location-based advertising, which the author came to find distasteful.

    Score 0.56Contestedjudges differ by 0.56 on substantiated

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Trapped in the Technologist Factory”

    Comments on “Trapped in the Technologist Factory”

39. No. 39Score 0.62

    You Don't Understand Your Code

    George Mandis21 minTopics: ProgrammingFormat: AnalysisChecked by: 3 judges

    Summary and score for “You Don't Understand Your Code”

    george.mand.is

    This Hrih News piece argues that developers often believe they understand their code when they don't, using a series of sorting examples across languages and JavaScript engines. It shows that identical-looking sort calls run different algorithms with different performance and stability characteristics, depending on the language, compiler standard library, or…

    Score 0.62Contestedjudges differ by 0.48 on audience breadth

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “You Don't Understand Your Code”

    Comments on “You Don't Understand Your Code”

40. No. 40Score 0.55

    More Is Less

    krmannix.substack.com10 minTopics: AI, StartupsFormat: AnalysisChecked by: 3 judges

    Summary and score for “More Is Less”

    Kevin Mannix

    Microsoft has offered voluntary buyouts to about 60,000 employees, roughly 27% of its global workforce, while it spends heavily on AI and continues strong revenue growth.

    Score 0.55Contestedjudges differ by 0.55 on new information

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “More Is Less”

    Comments on “More Is Less”

41. No. 41Score 0.63

    A RISC-V CPU compiled into the weights of an LLM

    GitHub8 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges

    Summary and score for “A RISC-V CPU compiled into the weights of an LLM”

    github.com

    Qwenputer is an experimental Qwen3.5-4B model with a 32-bit RISC-V CPU compiled directly into its weights, with no learned parameters in the computer layers. The CPU uses the model's Gated DeltaNet state as RAM and runs C and MicroPython inside forward passes.

    Score 0.63Contestedjudges differ by 0.42 on practical relevance

    Elsewhere: HN 4 pts, not on front page

    Score breakdown for “A RISC-V CPU compiled into the weights of an LLM” · Also covered by Divyansh Agrawal

    Comments on “A RISC-V CPU compiled into the weights of an LLM”

42. No. 42Score 0.63

    Anthropic's S-1 explains the unnamed deals in Google, Broadcom, SpaceX filings

    Equibles18 minTopics: AI, StartupsFormat: AnalysisChecked by: 3 judges

    Summary and score for “Anthropic's S-1 explains the unnamed deals in Google, Broadcom, SpaceX filings”

    equibles.com

    The S-1 Anthropic filed on October 26, 2026 describes its largest compute and funding contracts without naming the partners, and Hrih News matched those terms against the 10-Qs and earnings disclosures of Alphabet, Broadcom, SpaceX and Amazon.

    Score 0.63Contestedjudges differ by 0.42 on reader interest

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Anthropic's S-1 explains the unnamed deals in Google, Broadcom, SpaceX filings” · Also covered by Ed Zitron's Where's Your Ed At, The Next Web

    Comments on “Anthropic's S-1 explains the unnamed deals in Google, Broadcom, SpaceX filings”

43. No. 43Score 0.56

    Google Begins Certifying Registered App Stores For Android

    Slashdot2 minTopics: PolicyFormat: NewsChecked by: 3 judges

    Summary and score for “Google Begins Certifying Registered App Stores For Android”

    BeauHD · tech.slashdot.org

    Google has opened applications for its Registered App Stores program, a voluntary route for alternative Android app stores outside the U.S. and Europe, following its loss in the Epic Games antitrust case.

    Score 0.56

    Elsewhere: HN —

    Score breakdown for “Google Begins Certifying Registered App Stores For Android”

    Comments on “Google Begins Certifying Registered App Stores For Android”

44. No. 44Score 0.63

    I ran each AI coding-agent sandbox's own tests against the others

    GitHub3 minTopics: Programming, AI, SecurityFormat: New projectChecked by: 3 judges

    Summary and score for “I ran each AI coding-agent sandbox's own tests against the others”

    github.com

    An open lab called sandbox-conformance turns the security claims of AI coding-agent sandboxes into shared, runnable test contracts, each split into an attack, a control and an on-disk or on-wire effect check.

    Score 0.63Contestedjudges differ by 0.48 on new information

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “I ran each AI coding-agent sandbox's own tests against the others”

    Comments on “I ran each AI coding-agent sandbox's own tests against the others”

45. No. 45Score 0.63

    Demoted, Still Liable

    Old School Burke12 minTopics: AIFormat: AnalysisChecked by: 3 judges

    Summary and score for “Demoted, Still Liable”

    Old School Burke · oldschoolburke.com

    A Hrih News essay argues that when companies promise a "human in the loop," they often demote people into fail-safes who keep the blame but lose the authority to stop or shape the work.

    Score 0.63

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Demoted, Still Liable”

    Comments on “Demoted, Still Liable”

46. No. 46Score 0.63

    Pragmatic guide to agentic coding – Ilya Razenshteyn

    ilyaraz.substack.com14 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges

    Summary and score for “Pragmatic guide to agentic coding – Ilya Razenshteyn”

    Ilya Razenshteyn

    Ilya Razenshteyn's long post, "Pragmatic guide to agentic coding," reports on interviews with a couple dozen engineers and researchers about how they use coding agents at work. Its central question is what keeps software engineering from becoming cheap or automated as code generation commoditizes.

    Score 0.63Contestedjudges differ by 0.42 on overclaim

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Pragmatic guide to agentic coding – Ilya Razenshteyn”

    Comments on “Pragmatic guide to agentic coding – Ilya Razenshteyn”

47. No. 47Score 0.63

    Scaling Hierarchical Networks

    Cartesia29 minTopics: AIFormat: PaperChecked by: 3 judges

    Summary and score for “Scaling Hierarchical Networks”

    cartesia.ai

    Cartesia's Hrih News post introduces hierarchical networks (H-Nets), an end-to-end architecture that replaces hand-built tokenization by learning to chunk raw bytes inside the model.

    Score 0.63

    Elsewhere: HN 52 pts, front page

    Score breakdown for “Scaling Hierarchical Networks”

    Comments on “Scaling Hierarchical Networks”

48. No. 48Score 0.63

    SnowPR: Benchmarking Coding Agents on Snowflake's 43M-Line Monorepo

    snowflake.com11 minTopics: Programming, AIFormat: PaperChecked by: 3 judges

    Summary and score for “SnowPR: Benchmarking Coding Agents on Snowflake's 43M-Line Monorepo”

    Soyoung Yoon +5

    SnowPR is a new coding-agent benchmark built from 65 merged pull requests in Snowflake's 43-million-line monorepo, with grading by the hidden tests that shipped alongside each change. Unlike public benchmarks drawn from small Python projects, it reflects large, multi-module Java and C++ work with Bazel builds.

    Score 0.63

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “SnowPR: Benchmarking Coding Agents on Snowflake's 43M-Line Monorepo”

    Comments on “SnowPR: Benchmarking Coding Agents on Snowflake's 43M-Line Monorepo”

49. No. 49Score 0.56

    A framework for capturing webhooks from providers reliably and durably

    GitHub9 minTopics: Programming, DevOpsFormat: ReleaseChecked by: 3 judges

    Summary and score for “A framework for capturing webhooks from providers reliably and durably”

    github.com

    Ankusa is an open-source webhook ingestion service that runs as a container in front of your workers and publishes each incoming webhook to your existing broker (Kafka, RabbitMQ, NATS, SQS, Pub/Sub, or Redis) or POSTs it signed to an HTTP endpoint.

    Score 0.56

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “A framework for capturing webhooks from providers reliably and durably”

    Comments on “A framework for capturing webhooks from providers reliably and durably”

50. No. 50Score 0.62

    The Bitter Lesson for Humans

    Guy Freeman12 minTopics: AIFormat: AnalysisChecked by: 3 judges

    Summary and score for “The Bitter Lesson for Humans”

    Guy Freeman · gfrm.in

    The author built a cryptic crossword solver with elaborate Bayesian machinery, then found that a frontier model handed the whole puzzle in one call solved 93 of 116 grids for about 28 cents each, beating the full system.

    Score 0.62Contestedjudges differ by 0.47 on significance, 0.53 on audience breadth, 0.42 on technical depth

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “The Bitter Lesson for Humans”

    Comments on “The Bitter Lesson for Humans”

51. No. 51Score 0.56

    How to Extract Data from InnoDB, MyISAM, and MyRocks Files?

    Percona8 minTopics: Programming, DevOps, DataFormat: ReleaseChecked by: 3 judges

    Summary and score for “How to Extract Data from InnoDB, MyISAM, and MyRocks Files?”

    Przemysław Malkowski · percona.com

    Hrih News covers innodump, a new open-source tool that extracts data offline from raw InnoDB, MyISAM, and MyRocks files without a running server, useful for corruption recovery, backup checks, and staging provisioning.

    Score 0.56

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “How to Extract Data from InnoDB, MyISAM, and MyRocks Files?”

    Comments on “How to Extract Data from InnoDB, MyISAM, and MyRocks Files?”

52. No. 52Score 0.61

    Agent Scrum: Running a team of AI coding agents in two-hour sprints

    daveremy.github.io39 minTopics: Programming, AIFormat: PaperChecked by: 3 judges

    Summary and score for “Agent Scrum: Running a team of AI coding agents in two-hour sprints”

    Dave Remy

    Agent Scrum is a working paper by Dave Remy describing how a fleet of AI coding agents ran 324 two-hour sprints over 38 days on a real product backlog, adapting Scrum's sprints, points, velocity, Definition of Done and retrospectives to agent teams.

    Score 0.61Contestedjudges differ by 0.46 on substantiated, 0.43 on technical depth

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Agent Scrum: Running a team of AI coding agents in two-hour sprints”

    Comments on “Agent Scrum: Running a team of AI coding agents in two-hour sprints”

53. No. 53Score 0.61

    Nim Version 2.4.0 Released

    Nim Programming Language9 minTopics: ProgrammingFormat: ReleaseChecked by: 3 judges

    Summary and score for “Nim Version 2.4.0 Released”

    nim-lang.org

    Nim 2.4.0, a new stable release of the Nim programming language, was published on 28 October 2026 and ships several major features: a small-string optimization (--strings:sso) with a new low-level strings API, parallel incremental builds (--ic:on), YRC, a thread-safe memory manager that handles cycles spanning threads, a more concise sum…

    Score 0.61

    Elsewhere: HN 8 pts, not on front page

    Score breakdown for “Nim Version 2.4.0 Released”

    Comments on “Nim Version 2.4.0 Released”

54. No. 54Score 0.61

    Does the code compile? Five local models on a DGX Spark, five runs each

    borisivanov.com3 minTopics: Programming, AIFormat: PaperChecked by: 3 judges

    Summary and score for “Does the code compile? Five local models on a DGX Spark, five runs each”

    Boris Ivanov

    A benchmark of five local models on a DGX Spark, five runs each, judged by whether the code compiles and passes hidden tests rather than by tokens per second.

    Score 0.61

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Does the code compile? Five local models on a DGX Spark, five runs each”

    Comments on “Does the code compile? Five local models on a DGX Spark, five runs each”

55. No. 55Score 0.61

    Writing GPU kernels in Rust: how I made speakrs 60× faster than pyannote

    Avencera18 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges

    Summary and score for “Writing GPU kernels in Rust: how I made speakrs 60× faster than pyannote”

    avencera.com

    speakrs, an open-source Rust speaker diarization library, replaced its ONNX Runtime dependency with its own GPU kernels written in Rust via cuda-oxide, and can now build with only the NVIDIA driver.

    Score 0.61

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Writing GPU kernels in Rust: how I made speakrs 60× faster than pyannote”

    Comments on “Writing GPU kernels in Rust: how I made speakrs 60× faster than pyannote”

56. No. 56Score 0.61

    Async Commands Fallback Layer

    devblogs.microsoft.com9 minTopics: Programming, HardwareFormat: ReleaseChecked by: 3 judges

    Summary and score for “Async Commands Fallback Layer”

    Microsoft's Agility SDK 1.620.1 adds an opt-in fallback layer for Batched Async Commands, letting developers use the new copy, fill, clear, and resolve APIs on GPUs without native support.

    Score 0.61

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Async Commands Fallback Layer”

    Comments on “Async Commands Fallback Layer”

57. No. 57Score 0.64

    eMudhra TLS leak: Apple leaves macOS command-line issue unresolved

    heise online English2 minTopics: Security, ITFormat: NewsChecked by: 3 judges

    Summary and score for “eMudhra TLS leak: Apple leaves macOS command-line issue unresolved”

    heise online · heise.de

    Apple has not yet fixed a certificate problem in macOS command-line tools that stems from a compromise at certificate authority eMudhra, which could let attackers impersonate servers in some network positions.

    Score 0.64Contestedjudges differ by 0.47 on new information

    Elsewhere: HN —

    Score breakdown for “eMudhra TLS leak: Apple leaves macOS command-line issue unresolved”

    Comments on “eMudhra TLS leak: Apple leaves macOS command-line issue unresolved”

58. No. 58Score 0.61

    Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble

    The RegisterTopics: Security, ITFormat: NewsChecked by: 3 judges

    Summary and score for “Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble”

    Jessica Lyons · theregister.com

    Oracle's E-Business Suite faces active exploitation attempts against CVE-2026-101767, an unauthenticated SQL injection flaw that can chain to remote code execution, even though Oracle patched it in October.

    Score 0.61Contestedjudges differ by 0.59 on new information

    Elsewhere: HN —

    Score breakdown for “Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble”

    Comments on “Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble”

59. No. 59Score 0.61

    A safety checklist in the prompt didn't measurably help frontier models

    The Agent Forge5 minTopics: AI, SecurityFormat: PaperChecked by: 3 judges

    Summary and score for “A safety checklist in the prompt didn't measurably help frontier models”

    theagentforge.io

    A pre-registered test found that adding an eight-item safety checklist to frontier AI agents' instructions did not measurably reduce how often they fell for planted traps: 24.8% with the card versus 29.5% without, not statistically significant. It also did not harm legitimate work, which stayed within pre-set margins.

    Score 0.61

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “A safety checklist in the prompt didn't measurably help frontier models”

    Comments on “A safety checklist in the prompt didn't measurably help frontier models”

60. No. 60Score 0.60

    Confident Science Papers Sway AI Judges – Regardless of Merit

    Unite.AI7 minTopics: AIFormat: NewsChecked by: 3 judges

    Summary and score for “Confident Science Papers Sway AI Judges – Regardless of Merit”

    A new study from Germany finds that six AI reviewers, including GPT-5.5 and Claude Sonnet 4.6, score scientific papers higher when they are written in confident language, even when the research is identical to a more cautious version.

    Score 0.60

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Confident Science Papers Sway AI Judges – Regardless of Merit”

    Comments on “Confident Science Papers Sway AI Judges – Regardless of Merit”

61. No. 61Score 0.60

    A Second Look at Apple's Secure Kernel

    antid0te.com10 minTopics: SecurityFormat: Write-upChecked by: 3 judges

    Summary and score for “A Second Look at Apple's Secure Kernel”

    This correction retracts a February article claiming that an ordinary Exclave could make Apple's Secure Kernel dispatch through a fake capability in writable memory.

    Score 0.60

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “A Second Look at Apple's Secure Kernel”

    Comments on “A Second Look at Apple's Secure Kernel”

62. No. 62Score 0.60

    Dueling proofs from OpenAI and Anthropic astound scientists

    Scientific American5 minTopics: AIFormat: NewsChecked by: 3 judges

    Summary and score for “Dueling proofs from OpenAI and Anthropic astound scientists”

    Joseph Howlett, Peter Hall · scientificamerican.com

    OpenAI released three AI-generated results touching on Kakeya sets in all dimensions, the Yang-Mills existence problem, and the exponential time hypothesis, the first two of which are Millennium-adjacent or Millennium-related claims.

    Score 0.60Contestedjudges differ by 0.41 on reader interest

    Elsewhere: HN 3 pts, not on front page

    Score breakdown for “Dueling proofs from OpenAI and Anthropic astound scientists”

    Comments on “Dueling proofs from OpenAI and Anthropic astound scientists”

63. No. 63Score 0.56

    Evaluating Kubernetes Pod Checkpoint/Restore on AWS (CRIU, PLEG, eBPF)

    GitHub6 minTopics: DevOpsFormat: New projectChecked by: 3 judges

    Summary and score for “Evaluating Kubernetes Pod Checkpoint/Restore on AWS (CRIU, PLEG, eBPF)”

    github.com

    This repository holds the testbed, operator, benchmarks, and LaTeX source for a study of Kubernetes pod checkpoint/restore migration using CRIU, Kubelet's checkpoint API, Buildah, CRI-O, and Cilium eBPF on a three-node AWS cluster.

    Score 0.56

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Evaluating Kubernetes Pod Checkpoint/Restore on AWS (CRIU, PLEG, eBPF)”

    Comments on “Evaluating Kubernetes Pod Checkpoint/Restore on AWS (CRIU, PLEG, eBPF)”

64. No. 64Score 0.60

    Tailscale SSH: Findings and fixes

    Tailscale Blog4 minTopics: Security, ITFormat: Write-upChecked by: 3 judges

    Summary and score for “Tailscale SSH: Findings and fixes”

    Mike Shaver · tailscale.com

    Tailscale disclosed fixes for vulnerabilities in Tailscale SSH and related features, reported in a researcher's "Tailworm" report, and shipped them in v1.104.4. The flaws let an already-authorized peer exceed its assigned privileges after connecting, including via SSH forwarding, but could not be used by unauthenticated attackers.

    Score 0.60

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Tailscale SSH: Findings and fixes” · Also covered by heise online English

    Comments on “Tailscale SSH: Findings and fixes”

65. No. 65Score 0.60

    JSPI Speedup

    PCBJam4 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges

    Summary and score for “JSPI Speedup”

    pcbjam.com

    A blog post from pcbjam reports that switching the KiCad web port from Asyncify to JavaScript Promise Integration (JSPI), a native browser API for suspending and resuming WebAssembly, roughly halved bundle size, load times, and board-pan latency on test boards.

    Score 0.60Contestedjudges differ by 0.44 on overclaim

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “JSPI Speedup”

    Comments on “JSPI Speedup”

66. No. 66Score 0.60

    Octoverse: Commits, pushes, reach new highs in 2026

    The GitHub Blog21 minTopics: Programming, AI, DevOpsFormat: PaperChecked by: 3 judges

    Summary and score for “Octoverse: Commits, pushes, reach new highs in 2026”

    GitHub Staff · github.blog

    GitHub's Octoverse 2026 report says developers pushed code 17.9 billion times in the past year, more than 2024 and 2025 combined, with commits across public and private repos reaching 34.3 billion.

    Score 0.60Contestedjudges differ by 0.41 on promotional

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Octoverse: Commits, pushes, reach new highs in 2026” · Also covered by The GitHub Blog, The GitHub Blog, Simon Willison, The Next Web

    Comments on “Octoverse: Commits, pushes, reach new highs in 2026”

67. No. 67Score 0.60

    Prioritize Dependabot alerts with reachability analysis

    The GitHub Blog2 minTopics: Programming, Security, DevOpsFormat: ReleaseChecked by: 3 judges

    Summary and score for “Prioritize Dependabot alerts with reachability analysis”

    github.blog

    GitHub has launched a public preview of reachability analysis for Dependabot alerts, currently covering JavaScript and TypeScript repositories on Enterprise Cloud. It checks whether your code has a call path to the vulnerable functions in a flagged dependency, labeling each alert as reachable, potentially reachable, unreachable, or unavailable.

    Score 0.60

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Prioritize Dependabot alerts with reachability analysis”

    Comments on “Prioritize Dependabot alerts with reachability analysis”

68. No. 68Score 0.60

    Attackers target Brotli, Adobe Commerce and Magento vulnerabilities

    heise online English2 minTopics: Security, ITFormat: NewsChecked by: Claim-checked

    Summary and score for “Attackers target Brotli, Adobe Commerce and Magento vulnerabilities”

    heise online · heise.de

    Attackers are actively exploiting two flaws: "Broccoli2Shell," a Brotli decoder vulnerability (CVE-2026-111497, affecting versions 1.0.3 through 1.2.0) that lets unauthenticated users inject malicious code, and an Adobe Commerce/Magento unrestricted file upload bug (CVE-2026-48356). CISA has added both to its Known Exploited Vulnerabilities catalog.

    Score 0.60Contestedjudges differ by 0.63 on new informationClaim check: 3 matches source · 1 differs from source · 1 no source given · 3 couldn’t check

    Elsewhere: HN —

    Score breakdown and claims for “Attackers target Brotli, Adobe Commerce and Magento vulnerabilities”

    Comments on “Attackers target Brotli, Adobe Commerce and Magento vulnerabilities”

69. No. 69Score 0.60

    Veeam: Backup servers can be tampered with, MFA disabled

    heise online English1 minTopics: Security, DevOps, ITFormat: NewsChecked by: 3 judges

    Summary and score for “Veeam: Backup servers can be tampered with, MFA disabled”

    heise online · heise.de

    Security researchers disclosed several vulnerabilities in Veeam Backup & Replication and related products, including a critical flaw (CVE-2026-108142) that lets unauthenticated attackers reach the Continuous Data Protection service on backup servers. Veeam Agent for Linux and Veeam ONE are also affected, with patches available.

    Score 0.60

    Elsewhere: HN —

    Score breakdown for “Veeam: Backup servers can be tampered with, MFA disabled”

    Comments on “Veeam: Backup servers can be tampered with, MFA disabled”

70. No. 70Score 0.60

    Getting good at AI takes time and practice

    Sean Goedecke7 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges

    Summary and score for “Getting good at AI takes time and practice”

    seangoedecke.com

    This essay argues against the view that getting good at AI requires no learning, claiming instead that durable skills take time and practice to build. It covers supplying the right context to agents, knowing what models can and cannot do, recognizing the characteristic mistakes of AI-generated code, and skimming verbose…

    Score 0.60

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Getting good at AI takes time and practice”

    Comments on “Getting good at AI takes time and practice”

71. No. 71Score 0.60

    Particle-1

    particle.ai5 minTopics: Programming, AIFormat: ReleaseChecked by: 3 judges

    Summary and score for “Particle-1”

    Particle team ·Oct 28, 2026

    Particle has released Particle-1, a version of DeepSeek V4.1 Flash post-trained with reinforcement learning to cut token use, averaging about 45% fewer tokens per task.

    Score 0.60

    Elsewhere: HN 16 pts, not on front page

    Score breakdown for “Particle-1”

    Comments on “Particle-1”

72. No. 72Score 0.60

    Agent Memory Is in the Wrong Place

    Omnara10 minTopics: Programming, AI, DevOpsFormat: Write-upChecked by: 3 judges

    Summary and score for “Agent Memory Is in the Wrong Place”

    omnara.com

    Omnara describes putting agent memory in its control plane as a filesystem that any worker can mount, rather than on the agent's sandbox, so memory survives machines going offline and multiple agents can share stores.

    Score 0.60Contestedjudges differ by 0.43 on promotional

    Elsewhere: HN 5 pts, not on front page

    Score breakdown for “Agent Memory Is in the Wrong Place”

    Comments on “Agent Memory Is in the Wrong Place”

73. No. 73Score 0.59

    Gemini API CLI

    Google AI for Developers9 minTopics: Programming, AIFormat: ReleaseChecked by: 3 judges

    Summary and score for “Gemini API CLI”

    ai.google.dev

    Google's Gemini API CLI (gemini-api) is a stateless, zero-dependency command-line client designed for AI agents with shell access and for scripts or CI pipelines. It lets agents generate text, images, speech, music, and video, analyze files, and launch background Gemini managed agents through standard shell commands on the Interactions API…

    Score 0.59

    Elsewhere: HN 3 pts, not on front page

    Score breakdown for “Gemini API CLI”

    Comments on “Gemini API CLI”

74. No. 74Score 0.64

    Microsoft Authenticator flaw let malicious apps steal access tokens

    heise online English2 minTopics: Security, ITFormat: NewsChecked by: 3 judges

    Summary and score for “Microsoft Authenticator flaw let malicious apps steal access tokens”

    heise online · heise.de

    Researchers at Enclave found that Microsoft Authenticator's check on calling apps only compared a self-declared redirect URI against the package signature, letting even permission-free malicious apps impersonate Teams and obtain plaintext access tokens, which could expose mailboxes, files, and calendars.

    Score 0.64Contestedjudges differ by 0.63 on new information

    Elsewhere: HN —

    Score breakdown for “Microsoft Authenticator flaw let malicious apps steal access tokens”

    Comments on “Microsoft Authenticator flaw let malicious apps steal access tokens”

75. No. 75Score 0.59

    How you could have invented muon from memory

    Tonon Journey36 minTopics: AIFormat: TutorialChecked by: 3 judges

    Summary and score for “How you could have invented muon from memory”

    Lucas Tonon · lucastononro.github.io

    This Hrih News entry is a long, interactive research essay titled "How you could have invented muon from memory," by Lucas Tononro, that walks readers through deriving the Muon optimizer step by step from basic gradient descent.

    Score 0.59

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “How you could have invented muon from memory”

    Comments on “How you could have invented muon from memory”

76. No. 76Score 0.59

    The employee without the employment

    hrih.si16 minTopics: AI, StartupsFormat: AnalysisChecked by: 3 judgesReader submission

    Summary and score for “The employee without the employment”

    Hatim Rih

    An essay by Hatim Rih describes how he used Claude to submit his site to several blog directories: Claude did the research, wrote a tested code change, and filled in forms, but waited for his approval before acting under his name or passing a captcha.

    Score 0.59

    Elsewhere: HN —

    Score breakdown for “The employee without the employment”

    Comments on “The employee without the employment”

77. No. 77Score 0.59

    Artificial Analysis Intelligence Index v5.0

    artificialanalysis.ai80 minTopics: AIFormat: ReleaseChecked by: 3 judges

    Summary and score for “Artificial Analysis Intelligence Index v5.0”

    The Artificial Analysis Intelligence Index v5.0 is a composite benchmark that scores language models through a weighted average of nine evaluations across four equally weighted categories: knowledge work, coding, science, and general knowledge. It is primarily text-based and English-language, with visual and multilingual performance reported separately.

    Score 0.59Contestedjudges differ by 0.42 on overclaim

    Elsewhere: HN 39 pts, front page

    Score breakdown for “Artificial Analysis Intelligence Index v5.0” · Also covered by artificialanalysis.ai, Nathan Lambert (Interconnects), artificialanalysis.ai, AI News Report, artificialanalysis.ai

    Comments on “Artificial Analysis Intelligence Index v5.0”

78. No. 78Score 0.59

    Anthropic's Efficiency: More Bang for the Buck, or More Bucks for the Bang?

    llukyanov.substack.com4 minTopics: AI, StartupsFormat: AnalysisChecked by: 3 judges

    Summary and score for “Anthropic's Efficiency: More Bang for the Buck, or More Bucks for the Bang?”

    Leonid Lukyanov

    Anthropic's S-1 shows revenue per dollar of compute rising from 0.40x to 2.08x between Q1 2025 and Q2 2026, but the author argues this does not prove a matching gain in technical efficiency.

    Score 0.59Contestedjudges differ by 0.43 on new information

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Anthropic's Efficiency: More Bang for the Buck, or More Bucks for the Bang?”

    Comments on “Anthropic's Efficiency: More Bang for the Buck, or More Bucks for the Bang?”

79. No. 79Score 0.59

    Zero Breach Toolkit, open source tool capable of detecting Israeli spyware

    GitHub11 minTopics: SecurityFormat: ReleaseChecked by: 3 judges

    Summary and score for “Zero Breach Toolkit, open source tool capable of detecting Israeli spyware”

    github.com

    Zero Breach v0.1.8 is an open-source, read-only scanner that checks a computer's browser records, file hashes, Windows persistence entries, and DNS cache for published indicators tied to the AdFection/Candiru spyware campaign, which used real-time ad bidding to deliver zero-click infections.

    Score 0.59Contestedjudges differ by 0.41 on overclaim

    Elsewhere: HN 3 pts, not on front page

    Score breakdown for “Zero Breach Toolkit, open source tool capable of detecting Israeli spyware”

    Comments on “Zero Breach Toolkit, open source tool capable of detecting Israeli spyware”

80. No. 80Score 0.59

    Homi, open decision model for audio, near Flash on MMSU and 50x cheaper

    GitHub7 minTopics: AIFormat: New projectChecked by: 3 judges

    Summary and score for “Homi, open decision model for audio, near Flash on MMSU and 50x cheaper”

    github.com

    Homi is an open-weights audio decision model built on frozen Qwen3-Omni-30B with a 17M-parameter LoRA and a decision head that outputs calibrated probabilities over options rather than generated text.

    Score 0.59

    Elsewhere: HN 5 pts, not on front page

    Score breakdown for “Homi, open decision model for audio, near Flash on MMSU and 50x cheaper”

    Comments on “Homi, open decision model for audio, near Flash on MMSU and 50x cheaper”

81. No. 81Score 0.59

    Local Code – Run DeepSeek 4.1 Flash 1017 Locally on Your Mac

    GitHub12 minTopics: Programming, AI, HardwareFormat: New projectChecked by: 3 judges

    Summary and score for “Local Code – Run DeepSeek 4.1 Flash 1017 Locally on Your Mac”

    github.com

    Local Code is a Mac, iPad and iPhone app that bundles an on-device LLM engine for Apple Silicon, a per-model coding harness, and a sandboxed agent runtime with Python, Node.js and common CLI tools.

    Score 0.59Contestedjudges differ by 0.42 on significance

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Local Code – Run DeepSeek 4.1 Flash 1017 Locally on Your Mac”

    Comments on “Local Code – Run DeepSeek 4.1 Flash 1017 Locally on Your Mac”

82. No. 82Score 0.59

    AMD to invest $1bn in Meta as its Helios racks start running there

    The Next Web2 minTopics: AI, HardwareFormat: NewsChecked by: 3 judges

    Summary and score for “AMD to invest $1bn in Meta as its Helios racks start running there”

    Cristian Dina · thenextweb.com

    AMD said it will invest $1bn in Meta's equity offering and that its first Helios rack systems, each holding 72 GPUs, are now being tested at Meta with broader deployment expected soon.

    Score 0.59

    Elsewhere: HN —

    Score breakdown for “AMD to invest $1bn in Meta as its Helios racks start running there”

    Comments on “AMD to invest $1bn in Meta as its Helios racks start running there”

83. No. 83Score 0.58

    Starboard, Rules of the Road for Satellites

    tokeloshe.github.io7 minTopics: Programming, HardwareFormat: Write-upChecked by: 3 judges

    Summary and score for “Starboard, Rules of the Road for Satellites”

    James H · v0.6 · open spec, open code

    Starboard is an open-source protocol that gives two satellites facing a close approach the same deterministic rule set, adapted from maritime COLREGS, so both independently agree on which craft must maneuver without any negotiation.

    Score 0.58

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Starboard, Rules of the Road for Satellites”

    Comments on “Starboard, Rules of the Road for Satellites”

84. No. 84Score 0.58

    The Wall from Inside: Running coding agents in Apple containers

    fluxum engineering10 minTopics: Programming, AI, Security, DevOpsFormat: Write-upChecked by: 3 judges

    Summary and score for “The Wall from Inside: Running coding agents in Apple containers”

    Martin Gross · fluxum.net

    The author describes how the outermost "wall" layer of his coding-agent setup works: an Apple container that runs Claude Code and Codex without access to his Mac. Unlike Docker Desktop, Apple's container tool gives each container its own lightweight VM and mounts no Mac folders by default.

    Score 0.58Contestedjudges differ by 0.42 on significance

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “The Wall from Inside: Running coding agents in Apple containers”

    Comments on “The Wall from Inside: Running coding agents in Apple containers”

85. No. 85Score 0.63

    CISA confirms attackers are exploiting both PHP2Shell flaws

    The Next Web3 minTopics: SecurityFormat: NewsChecked by: Claim-checked

    Summary and score for “CISA confirms attackers are exploiting both PHP2Shell flaws”

    Ana Maria Constantin · thenextweb.com

    CISA has added both PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities catalogue, requiring federal civilian agencies to patch by 29 October, though it has not named victims or detailed its evidence.

    Score 0.63Contestedjudges differ by 0.43 on new information, 0.42 on overclaimClaim check: 3 matches source · 1 differs from source · 1 no source given · 3 couldn’t check

    Elsewhere: HN —

    Score breakdown and claims for “CISA confirms attackers are exploiting both PHP2Shell flaws” · Also covered by Cloud Sleuth, The Next Web, CIO Dive

    Comments on “CISA confirms attackers are exploiting both PHP2Shell flaws”

86. No. 86Score 0.58

    AI Can Draw Blueprints Now

    stephenjgallagher.substack.com16 minTopics: AIFormat: AnalysisChecked by: 3 judges

    Summary and score for “AI Can Draw Blueprints Now”

    Stephen Gallagher

    Hrih News reports that a former architect tested 13 AI models on technical drawing and found that Anthropic's Claude Opus 5.5, released in September 2026, can produce permit-quality construction drawings for a simple house when guided by a human reviewer. Earlier models mostly produced crude or inaccurate drawings.

    Score 0.58

    Elsewhere: HN ? pts, not on front page

    Score breakdown for “AI Can Draw Blueprints Now”

    Comments on “AI Can Draw Blueprints Now”

87. No. 87Score 0.58

    Android 18: Google further restricts access to contacts

    heise online English2 minTopics: Programming, SecurityFormat: NewsChecked by: 3 judges

    Summary and score for “Android 18: Google further restricts access to contacts”

    heise online · heise.de

    With Android 18, Google will block most apps from creating or editing contacts in the background, arguing that few apps need that access. Apps targeting Android 18 must instead use contact intents such as ACTION_INSERT and ACTION_EDIT, which require no permissions, and direct writes will be rejected.

    Score 0.58

    Elsewhere: HN —

    Score breakdown for “Android 18: Google further restricts access to contacts”

    Comments on “Android 18: Google further restricts access to contacts”

88. No. 88Score 0.58

    Rocky Linux Creator Built a New "Not Linux" Kernel in 11 Days Using AI

    It's FOSS4 minTopics: Programming, AIFormat: NewsChecked by: 3 judges

    Summary and score for “Rocky Linux Creator Built a New "Not Linux" Kernel in 11 Days Using AI”

    Abhishek Prakash · itsfoss.com

    Gregory Kurtzer, creator of CentOS and Rocky Linux, has released Ginux, an independent Rust-based x86-64 kernel that is not a Linux fork but implements the Linux ABI so unmodified Linux binaries can run. He reports building it in 11 days with an AI coding agent under human direction.

    Score 0.58

    Elsewhere: HN 4 pts, not on front page

    Score breakdown for “Rocky Linux Creator Built a New "Not Linux" Kernel in 11 Days Using AI”

    Comments on “Rocky Linux Creator Built a New "Not Linux" Kernel in 11 Days Using AI”

89. No. 89Score 0.57

    Commentary: AI Recreates Photoshop — Copying Is Cheap, Decisions Aren’t

    heise online English6 minTopics: Programming, AI, ProductFormat: AnalysisChecked by: 3 judges

    Summary and score for “Commentary: AI Recreates Photoshop — Copying Is Cheap, Decisions Aren’t”

    heise online · heise.de

    Brandon Thomas's ArtCraft project released 13 Rust applications, including PhotoCraft, a Photoshop clone largely generated by Anthropic's Claude Opus 5.5, and claimed "software is over." This commentary argues the claim is wrong: PhotoCraft succeeds because it copies a fixed, observable target, while most real software requires decisions no template can…

    Score 0.57Contestedjudges differ by 0.48 on new information

    Elsewhere: HN —

    Score breakdown for “Commentary: AI Recreates Photoshop — Copying Is Cheap, Decisions Aren’t”

    Comments on “Commentary: AI Recreates Photoshop — Copying Is Cheap, Decisions Aren’t”

90. No. 90Score 0.57

    Foundational Cryptography in SPARK

    AdaCore16 minTopics: Programming, AI, SecurityFormat: Write-upChecked by: 3 judges

    Summary and score for “Foundational Cryptography in SPARK”

    adacore.com

    A team used AI to generate formal SPARK specifications and fully proven implementations of AES (all three key sizes), SHA-256, and HMAC-SHA-256, starting from the NSA's Cryptol specifications in its public Foundation repository.

    Score 0.57

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Foundational Cryptography in SPARK”

    Comments on “Foundational Cryptography in SPARK”

91. No. 91Score 0.57

    Anthropic Files Its S-1

    Don't Worry About the Vase48 minTopics: AI, Startups, PolicyFormat: AnalysisChecked by: 3 judges

    Summary and score for “Anthropic Files Its S-1”

    Posted on · thezvi.wordpress.com

    Anthropic's S-1 filing, now public, shows $16.8 billion in Q3 revenue, up 45% over three months, with an 11% adjusted operating margin and roughly $131 billion in cash on hand after raising $141 billion.

    Score 0.57

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Anthropic Files Its S-1” · Also covered by Don't Worry About the Vase

    Comments on “Anthropic Files Its S-1”

92. No. 92Score 0.57

    Claude Refuted ETH Too: Anthropic's 3-SAT Paper Explained

    CellCog5 minTopics: AIFormat: NewsChecked by: 3 judges

    Summary and score for “Claude Refuted ETH Too: Anthropic's 3-SAT Paper Explained”

    cellcog.ai

    Anthropic published an October 27, 2026 paper credited to Claude, claiming a deterministic 2^o(n) algorithm for 3-SAT that refutes the Exponential Time Hypothesis and, with it, the stronger SETH.

    Score 0.57

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Claude Refuted ETH Too: Anthropic's 3-SAT Paper Explained” · Also covered by Computational Complexity (Fortnow, Gasarch)

    Comments on “Claude Refuted ETH Too: Anthropic's 3-SAT Paper Explained”

93. No. 93Score 0.57

    Luanti (formerly Minetest) reveal a major ContentDB security incident

    Luanti Blog2 minTopics: SecurityFormat: NewsChecked by: 3 judges

    Summary and score for “Luanti (formerly Minetest) reveal a major ContentDB security incident”

    blog.luanti.org

    Luanti, the open-source voxel game engine formerly known as Minetest, disclosed that an attacker breached ContentDB, its package repository, through two vulnerabilities, gaining access to user emails, hashed passwords, IP addresses, and uploads.

    Score 0.57

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Luanti (formerly Minetest) reveal a major ContentDB security incident”

    Comments on “Luanti (formerly Minetest) reveal a major ContentDB security incident”

94. No. 94Score 0.57

    PVisor, VM-isolated containers for agents

    GitHub7 minTopics: Programming, AI, DevOpsFormat: ReleaseChecked by: 3 judges

    Summary and score for “PVisor, VM-isolated containers for agents”

    github.com

    PVisor is a developer-preview CLI and runtime that runs Agent CLIs or scripts in isolated jobs, with copy-on-write workspace staging so changed files can be reviewed and selectively applied or discarded.

    Score 0.57Contestedjudges differ by 0.46 on substantiated

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “PVisor, VM-isolated containers for agents”

    Comments on “PVisor, VM-isolated containers for agents”

95. No. 95Score 0.57

    Stop broken SSH sessions: Ghostty updates its modern terminal

    heise online English4 minTopics: Programming, ITFormat: ReleaseChecked by: 3 judges

    Summary and score for “Stop broken SSH sessions: Ghostty updates its modern terminal”

    heise online · heise.de

    Ghostty, the free terminal emulator for macOS, Linux and FreeBSD, has reached version 1.4.0 after seven months of development. The release compresses idle scrollback to cut memory use by 70% to 90% on text-heavy output, raises the default buffer limit to 50 MB per terminal, and speeds up I/O and…

    Score 0.57

    Elsewhere: HN —

    Score breakdown for “Stop broken SSH sessions: Ghostty updates its modern terminal”

    Comments on “Stop broken SSH sessions: Ghostty updates its modern terminal”

96. No. 96Score 0.57

    Brazilian skimmer gang hijacks Plausible analytics script on Convertr checkouts

    BleepingComputer2 minTopics: Security, FintechFormat: NewsChecked by: 3 judges

    Summary and score for “Brazilian skimmer gang hijacks Plausible analytics script on Convertr checkouts”

    Bill Toulas · bleepingcomputer.com

    A Brazilian card-skimming gang reportedly hijacked a shared analytics script (a Plausible tracker) hosted by e-commerce platform Convertr, injecting code that stole card numbers, CVVs, names, and CPF tax IDs from checkouts on merchant sites from October 24.

    Score 0.57

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Brazilian skimmer gang hijacks Plausible analytics script on Convertr checkouts”

    Comments on “Brazilian skimmer gang hijacks Plausible analytics script on Convertr checkouts”

97. No. 97Score 0.57

    Kavach – Replay production crashes locally without a DB or network

    GitHub6 minTopics: Programming, AIFormat: New projectChecked by: 3 judges

    Summary and score for “Kavach – Replay production crashes locally without a DB or network”

    github.com

    Kavach is a pre-alpha open-source tool that records a service's inputs, clock reads, and random reads, then flushes a fixture when the service crashes or breaks an invariant. The fixture replays locally without any broker, database, or network.

    Score 0.57Contestedjudges differ by 0.47 on substantiated

    Elsewhere: HN 3 pts, not on front page

    Score breakdown for “Kavach – Replay production crashes locally without a DB or network”

    Comments on “Kavach – Replay production crashes locally without a DB or network”

98. No. 98Score 0.57

    Mistral Responses API

    docs.mistral.ai3 minTopics: Programming, AIFormat: TutorialChecked by: 3 judges

    Summary and score for “Mistral Responses API”

    Mistral has released the Responses API in public preview, letting developers use Mistral models through the OpenAI Responses request format. It supports text, image and document input, function calling, streaming, structured output, and input token counting.

    Score 0.57

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Mistral Responses API”

    Comments on “Mistral Responses API”

99. No. 99Score 0.57

    A proof-of-concept formalization of the IRS federal tax forms

    GitHub9 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges

    Summary and score for “A proof-of-concept formalization of the IRS federal tax forms”

    github.com

    A Hacker News "Show HN" project formalizes the IRS federal individual income tax forms and instructions as cited, machine-checkable YAML data, with a guided self-preparation interview as its first client. The software computes values and explains them but never files or transmits returns.

    Score 0.57

    Elsewhere: HN 5 pts, not on front page

    Score breakdown for “A proof-of-concept formalization of the IRS federal tax forms”

    Comments on “A proof-of-concept formalization of the IRS federal tax forms”

100. No. 100Score 0.57

     Node 26 Released (LTS)

     nodejs.org1 minTopics: ProgrammingFormat: ReleaseChecked by: 3 judges

     Summary and score for “Node 26 Released (LTS)”

     Node.js 26.13.0, codenamed 'Lithium', marks the promotion of the 26.x line to Long Term Support, with updates scheduled through April 2029. Beyond metadata reflecting the LTS status, it contains no code changes from 26.12.1.

     Score 0.57Contestedjudges differ by 0.43 on technical depth

     Elsewhere: HN 5 pts, front page

     Score breakdown for “Node 26 Released (LTS)”

     Comments on “Node 26 Released (LTS)”

101. No. 101Score 0.57

     Letting Agents Loose on the Network

     Cloudy, with a chance of latency16 minTopics: Programming, AI, DevOps, ITFormat: Write-upChecked by: 3 judges

     Summary and score for “Letting Agents Loose on the Network”

     cloudywithachanceoflatency.net

     The article argues that network incident response lags far behind software observability, and that AI agents investigating live networks need more than standard tools like ping and mtr.

     Score 0.57

     Elsewhere: HN 2 pts, not on front page

     Score breakdown for “Letting Agents Loose on the Network”

     Comments on “Letting Agents Loose on the Network”

102. No. 102Score 0.56

     Local-First Means Three Different Things

     Hologram9 minTopics: ProgrammingFormat: AnalysisChecked by: 3 judges

     Summary and score for “Local-First Means Three Different Things”

     hologram.page

     Hrih News covers a blog post by Bart Blast, creator of Hologram, arguing that "local-first" is used to mean three different things: ownership of data (the Ink & Switch essay's original vision), offline operation, and instant UI speed.

     Score 0.56

     Elsewhere: HN 2 pts, not on front page

     Score breakdown for “Local-First Means Three Different Things”

     Comments on “Local-First Means Three Different Things”

103. No. 103Score 0.56

     Gemini 4 Carbon: Our next frontier model

     Google DeepMind Blog4 minTopics: Programming, AI, SecurityFormat: ReleaseChecked by: 3 judges

     Summary and score for “Gemini 4 Carbon: Our next frontier model”

     Koray Kavukcuoglu · deepmind.google

     Google announced Gemini 4 Carbon, its new frontier model, with state-of-the-art results on cybersecurity benchmarks for finding, exploiting, and patching vulnerabilities, and a #1 ranking on the Artificial Analysis Intelligence Index v5.0.

     Score 0.56Contestedjudges differ by 0.53 on promotional

     Elsewhere: HN —

     Score breakdown for “Gemini 4 Carbon: Our next frontier model”

     Comments on “Gemini 4 Carbon: Our next frontier model”

104. No. 104Score 0.56

     Can LLMs Supercharge Geolocations? Big Improvements but Humans Remain Key

     bellingcat12 minTopics: AIFormat: PaperChecked by: 3 judges

     Summary and score for “Can LLMs Supercharge Geolocations? Big Improvements but Humans Remain Key”

     Foeke Postma, Miguel Ramalho · bellingcat.com

     Bellingcat ran a benchmark of 52 unpublished, hard-to-geolocate photos across closed and open AI models, scoring them on regional accuracy and fine-grained distance. Anthropic's Claude Opus and Fable and Google's Gemini 4 Argon performed best, often narrowing locations faster than humans could.

     Score 0.56

     Elsewhere: HN 3 pts, not on front page

     Score breakdown for “Can LLMs Supercharge Geolocations? Big Improvements but Humans Remain Key”

     Comments on “Can LLMs Supercharge Geolocations? Big Improvements but Humans Remain Key”

105. No. 105Score 0.56

     Canada and Europe Need a Way to See the AI They Cannot Access

     Tech Policy Press6 minTopics: AI, PolicyFormat: AnalysisChecked by: 3 judges

     Summary and score for “Canada and Europe Need a Way to See the AI They Cannot Access”

     Imane Bello · techpolicy.press

     The article argues that Washington's push to rename AI as "super intelligence" blurs a meaningful capability threshold, since the term now covers all AI systems. It shows that companies and governments keep moving their own capability lines, that current tests are unreliable at high capability levels, and that internal models…

     Score 0.56Contestedjudges differ by 0.42 on new information

     Elsewhere: HN —

     Score breakdown for “Canada and Europe Need a Way to See the AI They Cannot Access”

     Comments on “Canada and Europe Need a Way to See the AI They Cannot Access”

106. No. 106Score 0.56

     Satya Nadella says he was wrong to think AI alignment would come with scale

     The Next Web3 minTopics: AIFormat: NewsChecked by: 3 judges

     Summary and score for “Satya Nadella says he was wrong to think AI alignment would come with scale”

     Ana Maria Constantin · thenextweb.com

     Microsoft CEO Satya Nadella said on the 20VC podcast that he no longer believes AI alignment will arise simply from scaling models, calling it a harder, separate problem.

     Score 0.56

     Elsewhere: HN —

     Score breakdown for “Satya Nadella says he was wrong to think AI alignment would come with scale”

     Comments on “Satya Nadella says he was wrong to think AI alignment would come with scale”

107. No. 107Score 0.55

     OpenAI reportedly plans to buy Google’s TPU chips alongside Nvidia

     The Next Web1 minTopics: AI, HardwareFormat: NewsChecked by: 3 judges

     Summary and score for “OpenAI reportedly plans to buy Google’s TPU chips alongside Nvidia”

     Ana Maria Constantin · thenextweb.com

     The Information reported that OpenAI, one of Nvidia's largest chip customers, plans to buy Google's TPU AI processors, though the report is unverified and OpenAI declined to comment.

     Score 0.55Contestedjudges differ by 0.56 on overclaim

     Elsewhere: HN —

     Score breakdown for “OpenAI reportedly plans to buy Google’s TPU chips alongside Nvidia” · Also covered by The Next Web, The Next Web, Google Cloud Blog

     Comments on “OpenAI reportedly plans to buy Google’s TPU chips alongside Nvidia”

108. No. 108Score 0.55

     MotionBricks: Scalable Real-Time Motions with Modular Latent Generative Model

     nvlabs.github.io4 minTopics: AIFormat: PaperChecked by: 3 judges

     Summary and score for “MotionBricks: Scalable Real-Time Motions with Modular Latent Generative Model”

     Tingwu Wang1,†,✉,

     NVIDIA's MotionBricks is a real-time neural motion generation framework that uses a single modular latent model trained on over 350,000 motion clips to produce navigation and object-interaction animation without per-task fine-tuning.

     Score 0.55

     Elsewhere: HN 1 pts, not on front page

     Score breakdown for “MotionBricks: Scalable Real-Time Motions with Modular Latent Generative Model”

     Comments on “MotionBricks: Scalable Real-Time Motions with Modular Latent Generative Model”

109. No. 109Score 0.55

     Text-First: If It Can Be Text, It Should Be Text

     Martin Bosslet47 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges

     Summary and score for “Text-First: If It Can Be Text, It Should Be Text”

     Martin Boßlet · martinbosslet.dev

     Hrih News covers a Text-First methodology for AI-assisted development, which argues that providing precise, text-based context (especially Markdown) is what separates productive AI coding from costly rework.

     Score 0.55

     Elsewhere: HN 3 pts, not on front page

     Score breakdown for “Text-First: If It Can Be Text, It Should Be Text”

     Comments on “Text-First: If It Can Be Text, It Should Be Text”

110. No. 110Score 0.59

     Before HTTP2Shell: Brotli's Stale Table Read

     bugsink.com4 minTopics: SecurityFormat: AnalysisChecked by: 3 judges

     Summary and score for “Before HTTP2Shell: Brotli's Stale Table Read”

     A security write-up traces the origins of the HTTP2Shell vulnerability to a February 2018 Brotli commit that added a guard against reading uninitialized or stale switching tables.

     Score 0.59

     Elsewhere: HN 1 pts, not on front page

     Score breakdown for “Before HTTP2Shell: Brotli's Stale Table Read”

     Comments on “Before HTTP2Shell: Brotli's Stale Table Read”