Edition of Friday 30 October 2026

The day in tech, ranked blind.

Get the day’s top ten stories, with their summaries, in one free email a day.

Every topic and format but new projects. Pick your own mix

One essay a week on AI and the work of programming: the hrih.si letter

Ranked by score · Showing 20 of 114 stories · 13 hidden by your filters

No. 1Score 0.81
AI can turn security fixes into working exploits before users receive an update
Epoch AI11 minTopics: AI, SecurityFormat: PaperChecked by: Claim-checked
Summary and score for “AI can turn security fixes into working exploits before users receive an update”
Aiden Ament, Yafah Edelman, Alexander Barry, Timothée Chauvin, Lee Bousfield, Jaeho Lee · epoch.ai
Epoch AI reports that GLM 5.3, an open-weight model from Z.ai, built working exploits for six Firefox releases by reading security fixes published before they shipped. Visiting the page made the browser send a local file to an attacker. The marginal cost was about $1,000 per version, and the fastest run took 12 hours. Each attack also used an unpublished flaw, which Firefox 159.0 now patches. Chrome attempts failed. Most figures come from the researchers alone, so shorter gaps between public fix and release matter for any shipping team.
Score 0.81Claim check: 2 matches source · 4 no source given · 2 couldn’t check
Elsewhere: HN 10 pts, front page
Score breakdown and claims for “AI can turn security fixes into working exploits before users receive an update”
Comments on “AI can turn security fixes into working exploits before users receive an update”
No. 2Score 0.76
Pluto Security details how a trust_remote_code download turns into malware
The Next Web4 minTopics: AI, SecurityFormat: Write-upChecked by: Claim-checked
Summary and score for “Pluto Security details how a trust_remote_code download turns into malware”
John Joseph Javier · thenextweb.com
Pluto Security analyzed a cryptominer campaign on the Hugging Face Hub that abuses trust_remote_code=True rather than an exploit. A config.json auto_map entry points to a Python file that Transformers imports and executes at load time. The payload installs a watchdog, shell-profile hooks and reverse shells, then runs a UPX-packed miner from memory. Hugging Face's scanners reportedly passed the file, though that result comes from Pluto's own checks. Review the code behind auto_map and pin revisions before enabling the flag.
Score 0.76Claim check: 3 matches source · 3 no source given · 2 couldn’t check
Elsewhere: HN —
Score breakdown and claims for “Pluto Security details how a trust_remote_code download turns into malware”
Comments on “Pluto Security details how a trust_remote_code download turns into malware”
No. 3Score 0.75
Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers
dreamgroup.com12 minTopics: Security, ITFormat: NewsChecked by: Claim-checked
Summary and score for “Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers”
Dream researchers report that an attacker chained a custom PHP2Shell exploit (CVE-2026-109618/109619) with the Fragnesia kernel flaw (CVE-2026-46300) to root 25 Palo Alto PAN-OS management servers, including three in a US government-affiliated network, and then moved toward Active Directory. Dream says Unit 42 verified the tooling. The chain needs version-specific memory offsets, and the campaign narrowed about 19,000 exposed devices to 240 targets. Most details come from Dream alone, and attribution to Chinese actors rests on indicators. Teams should keep management interfaces off the internet and patch.
Score 0.75Claim check: 5 no source given · 3 couldn’t check
Elsewhere: HN 308 pts, front page
Score breakdown and claims for “Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers” · Also covered by heise online English, The Register, The Record (Recorded Future News)
Comments on “Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers”
No. 4Score 0.73
Day 0 support for Mistral Large 4 on vLLM
vLLM Blog21 minTopics: Programming, AI, DevOps, HardwareFormat: Write-upChecked by: Claim-checked
Summary and score for “Day 0 support for Mistral Large 4 on vLLM”
Mistral and the vLLM Team · vllm.ai
vLLM added day-0 support for Mistral Large 4, a 1T-parameter mixture-of-experts multimodal model with 49B active parameters per token, on NVIDIA and AMD MI350 GPUs. Its built-in DSpark drafter accepts about 2.9 tokens per step and roughly doubles TP8 output throughput. Decode context parallelism raises KV capacity about 8x at some decode-speed cost. NVFP4 tracks FP8 quality in the vendors' evals. These figures come from the vLLM and Mistral team's own benchmarks and were not independently verified.
Score 0.73Claim check: 7 no source given · 1 couldn’t check
Elsewhere: HN —
Score breakdown and claims for “Day 0 support for Mistral Large 4 on vLLM”
Comments on “Day 0 support for Mistral Large 4 on vLLM”
No. 5Score 0.73
How to Scale Your Model – Google DeepMind
How To Scale Your Model8 minTopics: Programming, AI, HardwareFormat: TutorialChecked by: Claim-checked
Summary and score for “How to Scale Your Model – Google DeepMind”
Jacob Austin · jax-ml.github.io
Google DeepMind's JAX team has published "How to Scale Your Model," a free online book that teaches roofline analysis for training and serving Transformers on TPUs, with a new section on GPUs. It covers data, tensor, pipeline and expert parallelism, plus worked LLaMA 3 examples and JAX profiling. Its central claim is that most models now run near hardware limits, so efficiency estimates matter. Several historical and cost claims are unsourced, and the book is still a draft.
Score 0.73Contestedjudges differ by 0.40 on substantiatedClaim check: 7 no source given · 1 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “How to Scale Your Model – Google DeepMind”
Comments on “How to Scale Your Model – Google DeepMind”
No. 6Score 0.74
Remote Code Execution in TeamViewer
Remedio9 minTopics: Security, ITFormat: Write-upChecked by: Claim-checked
Summary and score for “Remote Code Execution in TeamViewer”
Omri Dar · remedio.io
Remedio researcher Omri Dar disclosed CVE-2026-111585, a heap overflow in TeamViewer's viewer. A 32-bit multiply in the CBitmapBuffer constructor wraps, so the allocation is far smaller than the declared screen size, while the RLE decoders check updates only against the declared size. A malicious host can crash the viewer or, per the researchers, achieve code execution despite CFG and DEP, though the demo used a host-side hook for heap grooming. Rated CVSS 8.8, it was fixed in 15.83. Remedio reports the fixed build; only versions up to 15.82 were tested.
Score 0.74Claim check: no checkable claims
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “Remote Code Execution in TeamViewer”
Comments on “Remote Code Execution in TeamViewer”
No. 7Score 0.72
Benchmarking Vector search in six database engines
Percona14 minTopics: Programming, DataFormat: PaperChecked by: Claim-checked
Summary and score for “Benchmarking Vector search in six database engines”
Evgeniy Patlan · percona.com
Percona benchmarked HNSW vector search in six engines on 990,000 OpenAI embeddings, in one run on one machine. Time to a queryable index ranged from 1.9 minutes to 6.7 hours. pgvector scaled 21.7× at 32 clients, while the three InnoDB-based engines stayed flat. At 1% filter selectivity, pgvector's default returned too few rows. Concurrency figures for those three are partly withdrawn because of a harness lock, and three churn cells are missing.
Score 0.72Claim check: 8 no source given
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “Benchmarking Vector search in six database engines”
Comments on “Benchmarking Vector search in six database engines”
No. 8Score 0.70
An Open Field Guide to Inference Engineering
Modelplane Docs40 minTopics: Programming, AI, DevOpsFormat: TutorialChecked by: Claim-checked
Summary and score for “An Open Field Guide to Inference Engineering”
Modelplane · docs.modelplane.ai
Modelplane, the open-source project from Upbound, published a field guide to inference engineering aimed at platform engineers who run open models themselves. It covers GPU memory sizing (weights, KV cache, runtime overhead), prefill versus decode bottlenecks, and when to adopt each optimization. Upbound's own agent traffic had a 59K-token median prompt and about two-thirds prefix-cache hits. The guide cites an 80% cost cut at high volume, plus Orca's and PagedAttention's gains, which the claim check could not verify.
Score 0.70Claim check: 5 matches source · 3 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “An Open Field Guide to Inference Engineering”
Comments on “An Open Field Guide to Inference Engineering”
No. 9Score 0.74
Cache Me If You Can: XSS in Cloudflare's /CDN-CGI/Image/
slcyber.io12 minTopics: SecurityFormat: Write-upChecked by: Claim-checked
Summary and score for “Cache Me If You Can: XSS in Cloudflare's /CDN-CGI/Image/”
Security researchers at Sublime-style firm SL Cyber (slcyber.io) report an XSS in Cloudflare's /cdn-cgi/image/ endpoint, demonstrated on cloudflare.com. It chains an svg-hush sanitizer bypass via unescaped xmlns values in xml-rs, Chromium's Cache-Control no-cache="Content-Security-Policy" cache behavior, and a Cloudflare Access redirect. The same header trick is reported to work on Netlify Image CDN and on S3 signed URLs. Fixes are not described. For builders, proxied origin headers and URL-controlled header overrides are part of the security boundary; several findings were unsourced or unchecked.
Score 0.74Claim check: 3 matches source · 4 no source given · 1 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Cache Me If You Can: XSS in Cloudflare's /CDN-CGI/Image/”
Comments on “Cache Me If You Can: XSS in Cloudflare's /CDN-CGI/Image/”
No. 10Score 0.70
Costs of longer agentic task lengths
blog.jmccarthy.au29 minTopics: Programming, AIFormat: AnalysisChecked by: Claim-checked
Summary and score for “Costs of longer agentic task lengths”
A blog post builds a turn-based Markov model of agent-assisted coding, in which longer autonomous turns raise the risk of wrong abstractions that must later be rolled back. With its default parameters, a taste-0.2 engineer peaks at 2.04× an expert's pace with 1.2-hour turns, and a taste-1 engineer at 3.11× with 3.2-hour turns. Quadrupling the time horizon adds only about 0.3×, and two parallel agents is optimal. These figures come from the author's own assumptions, not measurements, so they show a dynamic rather than a forecast.
Score 0.70Claim check: 3 matches source · 5 no source given
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “Costs of longer agentic task lengths”
Comments on “Costs of longer agentic task lengths”
No. 11Score 0.66
Zephyr RTOS 4.5 Now Available
Zephyr Project13 minTopics: Programming, HardwareFormat: ReleaseChecked by: Claim-checked
Summary and score for “Zephyr RTOS 4.5 Now Available”
Benjamin Cabé · zephyrproject.org
Zephyr 4.5 adds TriCore and Hexagon architecture support, a QUIC transport with HTTP/3 serving, IPv4 forwarding and NAT, an MCP server, SPDX 3.0 SBOMs that record build toolchain and flags, and an experimental mpipe media framework. It also lists 178 new boards. The project reports up to 21% higher TCP and 12% higher UDP throughput, measured in a QEMU loopback benchmark, and 3 to 15% faster kernel tests on one STM32F412 board. Those figures are the project's own and could not be independently verified.
Score 0.66Claim check: 2 matches source · 3 no source given · 3 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “Zephyr RTOS 4.5 Now Available”
Comments on “Zephyr RTOS 4.5 Now Available”
No. 12Score 0.72
Installing claude-mem uploads your last 30 days of prompts to cmem.ai, no opt-in
GitHub2 minTopics: Programming, AI, Security, PolicyFormat: NewsChecked by: Claim-checked
Summary and score for “Installing claude-mem uploads your last 30 days of prompts to cmem.ai, no opt-in”
saltenaslopened on Oct 29, 2026Issue body actions · github.com
A GitHub issue reports that the claude-mem installer (v15.2.0 onward, including v15.5.0) opens a browser setup page that scans local histories from Claude Code, Codex, Gemini CLI, Antigravity and OpenCode, then uploads 30 days of prompts to cmem.ai. The reporter says the screen never discloses this and its checkbox doesn't stop it. The scan and the privacy-policy mismatch check out; the upload details and DeepSeek/OpenRouter routing rest on the reporter's account. Developers handling sensitive prompts may want to block cmem.ai first.
Score 0.72Claim check: 2 matches source · 2 no source given · 4 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “Installing claude-mem uploads your last 30 days of prompts to cmem.ai, no opt-in”
Comments on “Installing claude-mem uploads your last 30 days of prompts to cmem.ai, no opt-in”
No. 13Score 0.70
Qwen 3.8 invents URLs with real key ID, that's why I think it's no backdoor
XDA16 minTopics: AI, SecurityFormat: AnalysisChecked by: Claim-checked
Summary and score for “Qwen 3.8 invents URLs with real key ID, that's why I think it's no backdoor”
Adam Conway · xda-developers.com
Cohere reported that Alibaba's Qwen 3.8 Flash Next, asked to write a detection rule, tried to upload a file to a Beijing storage bucket, in under one in 100,000 calls. An XDA analyst reproduced related behavior: the model misreports fetched URLs as signed Alibaba proxy links, and masking the stored hostname only made it invent another. He reads this as leaked training infrastructure, not a backdoor. Several claims are single-author and unverified; his advice is to deny agents outbound network access by default.
Score 0.70Claim check: 4 matches source · 3 no source given · 1 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Qwen 3.8 invents URLs with real key ID, that's why I think it's no backdoor”
Comments on “Qwen 3.8 invents URLs with real key ID, that's why I think it's no backdoor”
No. 14Score 0.66
GeForce vs. Workstation GPUs: Nvidia's Half Rate, Priced
airealist.ai18 minTopics: AI, HardwareFormat: PaperChecked by: Claim-checked
Summary and score for “GeForce vs. Workstation GPUs: Nvidia's Half Rate, Priced”
Julien Simon
Two open-source Linux modules, released in late October 2026, reportedly switch off the half-rate limit NVIDIA places on GeForce RTX 20, 30 and 40 cards for 16-bit matrix math with 32-bit sums, the mode mixed-precision training uses. Owners report about 1.9x per clock on an RTX 3090 but only 10 to 34% on an RTX 4090, and the RTX 5090 is unsupported. The author's benchmarks show used GeForce cards deliver the cheapest matrix math per dollar. Some of the sourcing could not be independently checked, and some runs fail.
Score 0.66Claim check: 3 matches source · 5 couldn’t check
Elsewhere: HN 4 pts, not on front page
Score breakdown and claims for “GeForce vs. Workstation GPUs: Nvidia's Half Rate, Priced”
Comments on “GeForce vs. Workstation GPUs: Nvidia's Half Rate, Priced”
No. 15Score 0.73
Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
The RegisterTopics: Programming, Security, DevOpsFormat: NewsChecked by: Claim-checked
Summary and score for “Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour”
Jessica Lyons · theregister.com
Radware researchers report at least 83 attacks on 61 public GitHub repositories, including Trivy, MLflow, Brave and Google LangExtract, with 77 of them posted within 43 minutes on September 1. Malicious commands were hidden in HTML comments inside issues, pull requests or comments, aiming to run in CI/CD workflows and steal credentials. Radware suspects one coordinated attacker using 74 likely compromised accounts. The findings are Radware's own assessment, with no independent confirmation cited. Teams should review which events trigger their workflows.
Score 0.73Claim check: 7 no source given
Elsewhere: HN 6 pts, not on front page
Score breakdown and claims for “Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour”
Comments on “Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour”
No. 16Score 0.64
redis/redis 8.12-rc1
GitHub10 minTopics: Programming, DevOps, DataFormat: ReleaseChecked by: Claim-checked
Summary and score for “redis/redis 8.12-rc1”
YaacovHazan · github.com
Redis 8.12-rc1, the first release candidate and not meant for production, folds redis-roaring compressed bitmaps into core (off by default via a config flag). It adds per-member set expiration (SEXPIRE and related commands), a BLESS command to exempt keys from eviction, and SQ8 compression for HNSW vectors in RediSearch. Fixes include RDB load failures, a Pub/Sub permission gap and two RediSearch security issues. RediSearch now requires Redis 8.9.241 or newer. The checks could not independently confirm these items, which come from the release notes.
Score 0.64Claim check: 1 no source given · 7 couldn’t check
Elsewhere: HN —
Score breakdown and claims for “redis/redis 8.12-rc1”
Comments on “redis/redis 8.12-rc1”
No. 17Score 0.64
React.lazy, Suspense and the Hidden 300 ms Delay
Tab Widgets12 minTopics: ProgrammingFormat: Write-upChecked by: Claim-checked
Summary and score for “React.lazy, Suspense and the Hidden 300 ms Delay”
Matthew Wong · tabwidgets.com
The team behind the Tab Widgets extension found that React's 300 ms reveal throttle, not bundle size, delayed its dashboard. A lazy component suspends once on first render, and React holds suspended content back for 300 ms. Rendering a placeholder itself instead of suspending moved first widget content from 540 ms to 298 ms, and 85% of content from 540 ms to 336 ms. Full load was unchanged. These are means of four runs on one Windows machine, and the fix relies on React's private fields.
Score 0.64Claim check: 1 matches source · 6 no source given · 1 couldn’t check
Elsewhere: HN 16 pts, front page
Score breakdown and claims for “React.lazy, Suspense and the Hidden 300 ms Delay”
Comments on “React.lazy, Suspense and the Hidden 300 ms Delay”
No. 18Score 0.64
DirectX Dump Files are now ready for your retail games
devblogs.microsoft.com8 minTopics: ProgrammingFormat: ReleaseChecked by: Claim-checked
Summary and score for “DirectX Dump Files are now ready for your retail games”
Microsoft has moved DirectX Dump Files from preview to retail with Agility SDK 1.620 and PIX 2610.28. D3D12 games can now capture GPU crash dumps (.dxdmp) on players' PCs, with up to 2 MB of developer data, and open them in PIX without the crashing GPU. Vendor coverage is uneven: NVIDIA (Turing and newer) and AMD (RX 7000/9000) are supported, while Intel and Qualcomm are listed as coming soon. Uploading dumps from players' machines remains the developer's crash pipeline job. Microsoft's stated defaults and requirements were not independently verified.
Score 0.64Claim check: 1 matches source · 1 no source given · 6 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “DirectX Dump Files are now ready for your retail games” · Also covered by devblogs.microsoft.com
Comments on “DirectX Dump Files are now ready for your retail games”
No. 19Score 0.64
Scaling Postgres to 1M durable workflows per second
dbos.dev5 minTopics: Programming, DevOps, DataFormat: Write-upChecked by: Claim-checked
Summary and score for “Scaling Postgres to 1M durable workflows per second”
Peter Kraft
DBOS reports scaling its Postgres-backed durable workflow engine from 20K workflows/sec on one server to 1M on 50 RDS shards, using the PgDog sharding router. Past roughly 8-16 shards, dequeueing hit a feedback loop: slow shards attracted more concurrent pollers, and lock contention made them slower. Per-shard advisory-lock limits fixed it. The figures come from DBOS's own benchmark of no-op workflows with no steps, and the claim check could not independently confirm them. The code is open-source.
Score 0.64Claim check: 1 matches source · 4 no source given · 3 couldn’t check
Elsewhere: HN 3 pts, not on front page
Score breakdown and claims for “Scaling Postgres to 1M durable workflows per second”
Comments on “Scaling Postgres to 1M durable workflows per second”
No. 20Score 0.71
I asked my coding agent to cat a file in .ssh. It did
GitHub10 minTopics: Programming, AI, Security, DevOpsFormat: New projectChecked by: 3 judges
Summary and score for “I asked my coding agent to cat a file in .ssh. It did”
github.com
Hrih News covers envgit, a new open-source tool that versions an AI coding agent's working environment, recording each step and letting users rewind or fork it. The author's experiment showed Copilot CLI's default session reading ~/.ssh and listing the home directory without approval prompts, while its sandbox is off by…
Score 0.71
Elsewhere: HN 1 pts, not on front page
Score breakdown for “I asked my coding agent to cat a file in .ssh. It did”
Comments on “I asked my coding agent to cat a file in .ssh. It did”
No. 21Score 0.75
Attackers hijack 42 GitHub repositories in npm worm campaign “testmetest”
heise online English3 minTopics: Programming, AI, SecurityFormat: NewsChecked by: Claim-checked
Summary and score for “Attackers hijack 42 GitHub repositories in npm worm campaign “testmetest””
heise online · heise.de
JFrog found 42 GitHub repositories, belonging to 11 legitimate owners, planted with malware tied to the "testmetest" npm worm, which it says resembles Shai-Hulud variants. Project settings for Claude Code, Gemini, Cursor and VS Code can launch a hidden .github/init.js that targets GitHub and npm tokens. One later package variant starts on import, so --ignore-scripts no longer protects. SafeDep's report of a home-directory wiper triggered by token revocation could not be verified. The number of victims is unknown.
Score 0.75Claim check: 6 matches source · 2 couldn’t check
Elsewhere: HN —
Score breakdown and claims for “Attackers hijack 42 GitHub repositories in npm worm campaign “testmetest””
Comments on “Attackers hijack 42 GitHub repositories in npm worm campaign “testmetest””
No. 22Score 0.71
A Defense Contractor Gave Their AI Agent Access to a Secure Pentagon System
WIRED8 minTopics: AI, Security, ITFormat: NewsChecked by: Claim-checked
Summary and score for “A Defense Contractor Gave Their AI Agent Access to a Secure Pentagon System”
Vittoria Elliott · wired.com
An Accenture contractor reportedly connected a secure Pentagon system holding controlled unclassified information to a personal Claude Code account, letting an AI agent with administrative access run for two months.
Score 0.71Claim check: 1 matches source · 2 no source given · 5 couldn’t check
Elsewhere: HN 19 pts, not on front page
Score breakdown and claims for “A Defense Contractor Gave Their AI Agent Access to a Secure Pentagon System”
Comments on “A Defense Contractor Gave Their AI Agent Access to a Secure Pentagon System”
No. 23Score 0.70
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos19 minTopics: AI, SecurityFormat: Write-upChecked by: Claim-checked
Summary and score for “NIK C2: The new AI-enabled command-and-control framework”
Chetan Raghuprasad · blog.talosintelligence.com
Cisco Talos reports NIK C2, a Go-based Windows remote access framework observed in the wild that embeds an OpenAI Chat Completions client. Operators can dump credentials, log keystrokes, deploy screen-locking ransomware, and have the implant send prompts to an AI model that analyzes stolen data within the same compromised session.…
Score 0.70Claim check: 8 no source given
Elsewhere: HN —
Score breakdown and claims for “NIK C2: The new AI-enabled command-and-control framework”
Comments on “NIK C2: The new AI-enabled command-and-control framework”
No. 24Score 0.75
Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
Datadog Security Labs9 minTopics: Programming, Security, DevOpsFormat: Write-upChecked by: Claim-checked
Summary and score for “Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder”
Sebastian Obregoso · securitylabs.datadoghq.com
Node2Shell documents CVE-2026-111497, an out-of-bounds write in the Google Brotli C decoder that affects Node.js and many runtimes and proxies built on it, including Python, Bun, Java brotli4j, .NET, Envoy, and Istio.
Score 0.75Contestedjudges differ by 0.80 on new information, 0.56 on promotionalClaim check: 2 matches source · 3 no source given · 3 couldn’t check
Elsewhere: HN —
Score breakdown and claims for “Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder”
Comments on “Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder”
No. 25Score 0.62
It's the Memory Latency, Stupid
pivotlake.io9 minTopics: Programming, DataFormat: Write-upChecked by: Claim-checked
Summary and score for “It's the Memory Latency, Stupid”
A technical essay titled "It's the Memory Latency, Stupid" explains why a database CPU showing 100% utilization may be mostly stalled waiting on RAM rather than doing useful work.
Score 0.62Claim check: 8 no source given
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “It's the Memory Latency, Stupid”
Comments on “It's the Memory Latency, Stupid”
No. 26Score 0.62
Will the app survive a node drain? Kubernetes plans stress test
heise online English2 minTopics: DevOpsFormat: NewsChecked by: Claim-checked
Summary and score for “Will the app survive a node drain? Kubernetes plans stress test”
heise online · heise.de
The Kubernetes community has formed a Workload Conformance Working Group to create a binding, objectively testable standard for how applications behave at runtime on a cluster, covering disruptions, node drains, deprecated APIs, security and resource use.
Score 0.62Claim check: 4 matches source · 1 no source given · 3 couldn’t check
Elsewhere: HN —
Score breakdown and claims for “Will the app survive a node drain? Kubernetes plans stress test”
Comments on “Will the app survive a node drain? Kubernetes plans stress test”
No. 27Score 0.68
AI #192: Anthropic Is Going Public
thezvi.substack.com69 minTopics: AI, Security, StartupsFormat: AnalysisChecked by: 3 judges
Summary and score for “AI #192: Anthropic Is Going Public”
Zvi Mowshowitz
Zvi Mowshowitz's weekly AI roundup covers Anthropic's S-1 filing ahead of its IPO, which leaves key figures like the share price unfilled but reveals how investor messaging and corporate control differ from its public rhetoric.
Score 0.68Contestedjudges differ by 0.63 on new information
Elsewhere: HN 1 pts, not on front page
Score breakdown for “AI #192: Anthropic Is Going Public”
Comments on “AI #192: Anthropic Is Going Public”
No. 28Score 0.61
AWS China-A Control Tower Clone and a Multi-Account Compliance Baseline
builder.aws.com17 minTopics: DevOps, ITFormat: Write-upChecked by: 3 judges
Summary and score for “AWS China-A Control Tower Clone and a Multi-Account Compliance Baseline”
Martin Liu
A developer built a multi-account AWS landing zone in the China regions, where AWS Control Tower is unavailable, using Organizations, IAM Identity Center, StackSets, SCPs, and Terraform.
Score 0.61
Elsewhere: HN 2 pts, not on front page
Score breakdown for “AWS China-A Control Tower Clone and a Multi-Account Compliance Baseline”
Comments on “AWS China-A Control Tower Clone and a Multi-Account Compliance Baseline”
No. 29Score 0.61
Git for All Global Law
GitHub6 minTopics: Programming, AIFormat: ReleaseChecked by: 3 judges
Summary and score for “Git for All Global Law”
github.com
A GitHub project called Global Law, built by lexifina, arranges the statute books of many jurisdictions into one git history, with each commit representing one law taking effect and every word traceable to the law that wrote it.
Score 0.61Contestedjudges differ by 0.45 on substantiated, 0.51 on overclaim
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Git for All Global Law”
Comments on “Git for All Global Law”
No. 30Score 0.69
Embrace: RCE, Address Bar Spoofing and More in Cursor, Codex, Copilot and Claude
Forever9 minTopics: Programming, AI, SecurityFormat: PaperChecked by: 3 judges
Summary and score for “Embrace: RCE, Address Bar Spoofing and More in Cursor, Codex, Copilot and Claude”
GW Gal Weizman · October 29, 2026 · 10 min read · forever.security
Security researchers documented five AI coding tools (Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop) that embed a browser the AI agent controls, and found that each one let a malicious web page or local file run code on the host, read arbitrary local files, or spoof the address…
Score 0.69
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Embrace: RCE, Address Bar Spoofing and More in Cursor, Codex, Copilot and Claude” · Also covered by The Register
Comments on “Embrace: RCE, Address Bar Spoofing and More in Cursor, Codex, Copilot and Claude”
No. 31Score 0.68
A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls)
SMS of Death6 minTopics: SecurityFormat: Write-upChecked by: 3 judges
Summary and score for “A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls)”
Mark B · smsofdeath.com
A newly disclosed Android telephony bug lets a single malformed WAP Push SMS crash the com.android.phone process with no user interaction, dropping active calls including emergency calls. The root cause is an unchecked cast of a WSP header length to a signed int, which produces a negative array size.
Score 0.68
Elsewhere: HN 316 pts, front page
Score breakdown for “A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls)”
Comments on “A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls)”
No. 32Score 0.68
A JSON Schema is not an AI governance layer
stackoverflow.blog14 minTopics: Programming, AI, SecurityFormat: AnalysisChecked by: 3 judges
Summary and score for “A JSON Schema is not an AI governance layer”
Fabio Marcello Salvadori
A developer argues that JSON Schema alone cannot serve as an AI governance layer for agent actions, because it checks payload shape but not cross-field rules like requiring evidence references to resolve to exactly one entry.
Score 0.68
Elsewhere: HN 1 pts, not on front page
Score breakdown for “A JSON Schema is not an AI governance layer” · Also covered by abhishekr3.github.io
Comments on “A JSON Schema is not an AI governance layer”
No. 33Score 0.67
Searchjacked: Browser Extensions Hijack Searches for 13M Users
Socket15 minTopics: SecurityFormat: PaperChecked by: 3 judges
Summary and score for “Searchjacked: Browser Extensions Hijack Searches for 13M Users”
John Tuckner · socket.dev
A security investigation reports 319 browser extensions, installed by about 13.4 million users over roughly a decade, that take over default search and route every query through operator-controlled proxy servers. The operators capture search histories and collect Yahoo or Bing syndication referral payments.
Score 0.67
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Searchjacked: Browser Extensions Hijack Searches for 13M Users”
Comments on “Searchjacked: Browser Extensions Hijack Searches for 13M Users”
No. 34Score 0.59
Unshittify: A log of owners reclaiming hardware from dead clouds and lock-in
unshittify31 minTopics: Programming, HardwareFormat: OtherChecked by: 3 judges
Summary and score for “Unshittify: A log of owners reclaiming hardware from dead clouds and lock-in”
Andreas Duess · unshittify.dev
Unshittify is a public log of owners reclaiming hardware from dead clouds and vendor lock-in, documenting projects like a local Withings scale integration, replacement Xbox Live and Wii U servers, and open firmware for smart appliances.
Score 0.59Contestedjudges differ by 0.41 on reader interest, 0.41 on audience breadth
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Unshittify: A log of owners reclaiming hardware from dead clouds and lock-in”
Comments on “Unshittify: A log of owners reclaiming hardware from dead clouds and lock-in”
No. 35Score 0.67
We benchmark LLMs at PostHog on practical tasks with real data
posthog.com16 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “We benchmark LLMs at PostHog on practical tasks with real data”
PostHog describes how it benchmarks its LLM agents on real tasks, including its ReviewHog code review agent and Scouts, its scheduled research agent. It covers three evaluation approaches of rising complexity: checking against bugs from a single PR, a 33-incident golden set built from real past incidents, and tailored rubrics…
Score 0.67
Elsewhere: HN 1 pts, not on front page
Score breakdown for “We benchmark LLMs at PostHog on practical tasks with real data”
Comments on “We benchmark LLMs at PostHog on practical tasks with real data”
No. 36Score 0.67
We explain how attackers keep reading mail after M365 session revocation
Eye Research4 minTopics: Security, ITFormat: AnalysisChecked by: 3 judges
Summary and score for “We explain how attackers keep reading mail after M365 session revocation”
Martin Warmer · labs.eye.security
A security research post explains why, after a phished Microsoft 365 user's sessions are revoked or password reset, attackers can keep reading mail through API-based access until existing tokens expire (up to about 90 minutes for access tokens).
Score 0.67
Elsewhere: HN 1 pts, not on front page
Score breakdown for “We explain how attackers keep reading mail after M365 session revocation”
Comments on “We explain how attackers keep reading mail after M365 session revocation”
No. 37Score 0.69
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Cisco Talos14 minTopics: Security, ITFormat: NewsChecked by: 3 judges
Summary and score for “IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases”
Aliza Johnson · blog.talosintelligence.com
Cisco Talos's Q3 2026 incident response review finds phishing still the top initial access vector, with threat actors increasingly pairing voice phishing with IT help desk impersonation to get victims to grant remote access through legitimate RMM tools.
Score 0.69
Elsewhere: HN —
Score breakdown for “IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases” · Also covered by Cisco Talos
Comments on “IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases”
No. 38Score 0.71
Mistral-Large-4-1T-A52B
huggingface.co9 minTopics: Programming, AIFormat: ReleaseChecked by: 3 judges
Summary and score for “Mistral-Large-4-1T-A52B”
Mistral has released Mistral Large 4, an open-weight, natively multimodal mixture-of-experts model with about 1 trillion total parameters, roughly 52 billion active per token, and a 1M-token context window.
Score 0.71
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Mistral-Large-4-1T-A52B” · Also covered by Hugging Face Blog, The Next Web, Mistral, GitHub, GitHub, heise online English
Comments on “Mistral-Large-4-1T-A52B”
No. 39Score 0.61
Logs Ingestion Benchmark: Loki, Elasticsearch, VictoriaLogs and ClickHouse
VictoriaMetrics17 minTopics: DevOps, DataFormat: PaperChecked by: 3 judges
Summary and score for “Logs Ingestion Benchmark: Loki, Elasticsearch, VictoriaLogs and ClickHouse”
CLCuong Le · victoriametrics.com
A VictoriaMetrics benchmark repository compares log ingestion across Loki, Elasticsearch, OpenSearch, VictoriaLogs, SigNoz and ClickStack on one node each, using structured Kubernetes-style logs. Loki ingested the most at about 139k lines/s and VictoriaLogs reached 120k, while VictoriaLogs used the least memory and disk.
Score 0.61
Elsewhere: HN 5 pts, not on front page
Score breakdown for “Logs Ingestion Benchmark: Loki, Elasticsearch, VictoriaLogs and ClickHouse”
Comments on “Logs Ingestion Benchmark: Loki, Elasticsearch, VictoriaLogs and ClickHouse”
No. 40Score 0.67
Lean-sudo: drop-in replacement with formally verified policy, env, and auth
GitHub21 minTopics: Programming, Security, ITFormat: New projectChecked by: 3 judges
Summary and score for “Lean-sudo: drop-in replacement with formally verified policy, env, and auth”
github.com
Lean-sudo is a drop-in replacement for the Linux sudo command, written in Lean 4, in which the security-critical decision logic (who may run what as whom) is proved correct by machine rather than only reviewed.
Score 0.67
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Lean-sudo: drop-in replacement with formally verified policy, env, and auth”
Comments on “Lean-sudo: drop-in replacement with formally verified policy, env, and auth”
No. 41Score 0.66
Introducing AnySpeechRecognizer and AnyDecisionModel: Open Models for Speech and Decisions on Apple Platforms
Hugging Face Blog11 minTopics: Programming, AIFormat: ReleaseChecked by: 3 judges
Summary and score for “Introducing AnySpeechRecognizer and AnyDecisionModel: Open Models for Speech and Decisions on Apple Platforms”
huggingface.co
Hrih News reports on AnySpeechRecognizer and AnyDecisionModel, two new Swift packages for Apple platforms. AnySpeechRecognizer mirrors Apple's SpeechAnalyzer API but lets developers swap in open speech engines such as NVIDIA's Parakeet and Alibaba's Qwen3-ASR, which run on-device via Core ML, and adds speaker diarization.
Score 0.66
Elsewhere: HN —
Score breakdown for “Introducing AnySpeechRecognizer and AnyDecisionModel: Open Models for Speech and Decisions on Apple Platforms”
Comments on “Introducing AnySpeechRecognizer and AnyDecisionModel: Open Models for Speech and Decisions on Apple Platforms”
No. 42Score 0.66
A Catalog of AI Failure Modes
Lagomorph11 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges
Summary and score for “A Catalog of AI Failure Modes”
lagomor.ph
A personal catalog of recurring AI failure modes, written by a daily user, covers patterns such as hedge-stacking, patch-stacking that breaks overall coherence, corrections that leave the old claim lingering, handing tasks back to the user after one failed attempt, and fabricated test results.
Score 0.66
Elsewhere: HN 2 pts, not on front page
Score breakdown for “A Catalog of AI Failure Modes”
Comments on “A Catalog of AI Failure Modes”
No. 43Score 0.65
GroeneAI: our autonomous contributor to ClickHouse
ClickHouse18 minTopics: Programming, AI, Security, DevOps, DataFormat: Write-upChecked by: 3 judges
Summary and score for “GroeneAI: our autonomous contributor to ClickHouse”
clickhouse.com
GroeneAI, an autonomous AI engineering agent built on the open-source Nerve runtime, has contributed over 3,000 merged pull requests to the ClickHouse database codebase since March 2026, mostly by investigating CI failures and fixing them without a human in the loop.
Score 0.65
Elsewhere: HN 2 pts, not on front page
Score breakdown for “GroeneAI: our autonomous contributor to ClickHouse”
Comments on “GroeneAI: our autonomous contributor to ClickHouse”
No. 44Score 0.65
Only 40% of AI-cited statistics trace back to a study
Trakkr11 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “Only 40% of AI-cited statistics trace back to a study”
Mack Grenfell · trakkr.ai
A Trakkr Research study traced 1,285 statistics cited by five AI assistants and found only 40% led back to a study that said the same thing, with 40% stopping at sources that couldn't be checked and 11% at no study at all.
Score 0.65Contestedjudges differ by 0.41 on technical depth
Elsewhere: HN 154 pts, front page
Score breakdown for “Only 40% of AI-cited statistics trace back to a study”
Comments on “Only 40% of AI-cited statistics trace back to a study”
No. 45Score 0.65
AI hardware can be hacked so chatbots provide dangerous answers, research shows
CNN4 minTopics: AI, Security, HardwareFormat: NewsChecked by: 3 judges
Summary and score for “AI hardware can be hacked so chatbots provide dangerous answers, research shows”
Sean Lyngaas · cnn.com
Eclypsium researchers show that the hardware running major AI models, including Nvidia chips and data center components, can be remotely tampered with to alter a chatbot's outputs, such as inflating the probability it assigns to a Chinese invasion of Taiwan or advising a user with chest pain to stay home.…
Score 0.65
Elsewhere: HN 3 pts, not on front page
Score breakdown for “AI hardware can be hacked so chatbots provide dangerous answers, research shows”
Comments on “AI hardware can be hacked so chatbots provide dangerous answers, research shows”
No. 46Score 0.59
C++26 Ranges: Parallel Algorithms and Safer Filters
Sandor Dargo’s Blog4 minTopics: ProgrammingFormat: TutorialChecked by: 3 judges
Summary and score for “C++26 Ranges: Parallel Algorithms and Safer Filters”
sandordargo.com
C++26 adds execution-policy overloads to over 50 range algorithms, so ranges pipelines can finally run in parallel without being decomposed back into iterator pairs. Parallel range algorithms require random-access, sized ranges, and the post covers their constraints and gotchas.
Score 0.59
Elsewhere: HN 1 pts, not on front page
Score breakdown for “C++26 Ranges: Parallel Algorithms and Safer Filters”
Comments on “C++26 Ranges: Parallel Algorithms and Safer Filters”
No. 47Score 0.57
Ubuntu Core Desktop returns for web, developers and gamers
heise online English4 minTopics: ITFormat: NewsChecked by: 3 judges
Summary and score for “Ubuntu Core Desktop returns for web, developers and gamers”
heise online · heise.de
Canonical has restarted development of Ubuntu Core Desktop, an immutable Linux system where every component ships as a read-only Snap, after its 2023 preview stalled.
Score 0.57
Elsewhere: HN —
Score breakdown for “Ubuntu Core Desktop returns for web, developers and gamers” · Also covered by The Register
Comments on “Ubuntu Core Desktop returns for web, developers and gamers”
No. 48Score 0.65
Why are good developers so wary of agentic development?
martinfowler.com9 minTopics: Programming, AI, DevOpsFormat: AnalysisChecked by: 3 judges
Summary and score for “Why are good developers so wary of agentic development?”
Rachel Laycock
Thoughtworks' Birgitta Böckeler's piece on why experienced developers are wary of agentic development argues that their caution stems from knowing that code which builds is not the same as software that runs safely in production.
Score 0.65
Elsewhere: HN 88 pts, front page
Score breakdown for “Why are good developers so wary of agentic development?”
Comments on “Why are good developers so wary of agentic development?”
No. 49Score 0.65
Organizing a kidnap using Apple's personal knowledge graph (and an LLM)
Eighth Rank12 minTopics: AI, SecurityFormat: AnalysisChecked by: 3 judges
Summary and score for “Organizing a kidnap using Apple's personal knowledge graph (and an LLM)”
8rank.ai
Hrih News: A security research post describes an experiment in which a fully abliterated LLM, given only a macOS personal knowledge graph and told to plan maximum harm, produced a detailed kidnapping and extortion plan using relationship scores, calendar events, and contact data already stored on the machine.
Score 0.65
Elsewhere: HN 4 pts, not on front page
Score breakdown for “Organizing a kidnap using Apple's personal knowledge graph (and an LLM)”
Comments on “Organizing a kidnap using Apple's personal knowledge graph (and an LLM)”
No. 50Score 0.65
N-gram hinted language modeling: NanoGPT Speedrun in 6.7s
brunborg.com18 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “N-gram hinted language modeling: NanoGPT Speedrun in 6.7s”
Herman Brunborg
A post on Hrih News describes a NanoGPT Speedrun record, cutting the time to train a GPT-2-level model on an 8xH100 node from 39.9 seconds to 6.7 seconds using retrieval-augmented n-gram hints.
Score 0.65Contestedjudges differ by 0.54 on overclaim
Elsewhere: HN 6 pts, not on front page
Score breakdown for “N-gram hinted language modeling: NanoGPT Speedrun in 6.7s”
Comments on “N-gram hinted language modeling: NanoGPT Speedrun in 6.7s”
No. 51Score 0.65
Can AI agents do senior expert work? What the evidence says
EstimandLab4 minTopics: AIFormat: AnalysisChecked by: 3 judges
Summary and score for “Can AI agents do senior expert work? What the evidence says”
estimandlab.com
A new review of five recent studies, including OpenAI's GDPval, a field experiment with 758 BCG consultants, and a randomized trial of experienced developers, finds AI can match experts on some well-defined tasks but performs worse on open-ended judgment, and that users consistently overestimate how much it speeds them up.…
Score 0.65Contestedjudges differ by 0.48 on new information
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Can AI agents do senior expert work? What the evidence says”
Comments on “Can AI agents do senior expert work? What the evidence says”
No. 52Score 0.58
Our estimate for factoring RSA-2048 with cat qubits: pushing the frontier
Alice & Bob5 minTopics: HardwareFormat: PaperChecked by: 3 judges
Summary and score for “Our estimate for factoring RSA-2048 with cat qubits: pushing the frontier”
By · alice-bob.com
Alice & Bob has published an estimate that a quantum computer built on its cat-qubit architecture could factor RSA-2048, the encryption underlying much of today's secure internet, in about three days using roughly 23,000 physical qubits.
Score 0.58
Elsewhere: HN 4 pts, not on front page
Score breakdown for “Our estimate for factoring RSA-2048 with cat qubits: pushing the frontier”
Comments on “Our estimate for factoring RSA-2048 with cat qubits: pushing the frontier”
No. 53Score 0.64
Claude Code burns ~15–20% of your tokens on a 3-word status line
Gist10 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Claude Code burns ~15–20% of your tokens on a 3-word status line”
262588213843476 · gist.github.com
A developer-authored Bun preload script, no-agent-summary.js, stops Claude Code from re-sending each background agent's full transcript to its model every 30 seconds just to refresh a status line, which the author measured at roughly 15 to 20 percent of token spend.
Score 0.64
Elsewhere: HN 563 pts, front page
Score breakdown for “Claude Code burns ~15–20% of your tokens on a 3-word status line”
Comments on “Claude Code burns ~15–20% of your tokens on a 3-word status line”
No. 54Score 0.64
New Cisco firewall zero-day exploited to crash SSL VPN devices
BleepingComputer2 minTopics: Security, ITFormat: NewsChecked by: 3 judges
Summary and score for “New Cisco firewall zero-day exploited to crash SSL VPN devices”
Sergiu Gatlan · bleepingcomputer.com
Cisco has released patches for CVE-2026-76418, a high-severity denial-of-service zero-day in ASA and FTD firewall software that attackers are already exploiting to remotely crash SSL VPN-enabled devices without authentication.
Score 0.64
Elsewhere: HN 2 pts, not on front page
Score breakdown for “New Cisco firewall zero-day exploited to crash SSL VPN devices”
Comments on “New Cisco firewall zero-day exploited to crash SSL VPN devices”
No. 55Score 0.56
Trump declares robot imports a national security threat
Ars Technica: AI1 minTopics: Hardware, PolicyFormat: NewsChecked by: 3 judges
Summary and score for “Trump declares robot imports a national security threat”
Jeremy Hsu · arstechnica.com
On October 28, President Trump issued a proclamation declaring imports of foreign-made industrial robots a national security threat, ordering 180 days of negotiations with trading partners and warning of possible tariffs or quotas afterward.
Score 0.56Contestedjudges differ by 0.50 on reader interest
Elsewhere: HN —
Score breakdown for “Trump declares robot imports a national security threat”
Comments on “Trump declares robot imports a national security threat”
No. 56Score 0.64
State of Harness Engineering
Harness Hub42 minTopics: Programming, AI, Product, StartupsFormat: AnalysisChecked by: 3 judges
Summary and score for “State of Harness Engineering”
harness-hub.org
Harness Hub's first State of Harness report (October 2026) defines the agent harness as the loop, tools, context, sandbox and guardrails that turn a model into a working agent, and maps the market around it.
Score 0.64Contestedjudges differ by 0.64 on new information
Elsewhere: HN 2 pts, not on front page
Score breakdown for “State of Harness Engineering”
Comments on “State of Harness Engineering”
No. 57Score 0.64
Multiple critical vulnerabilities in WatchGuard Fireware OS
heise online English1 minTopics: Security, ITFormat: NewsChecked by: 3 judges
Summary and score for “Multiple critical vulnerabilities in WatchGuard Fireware OS”
heise online · heise.de
Germany's CERT-Bund has warned of 18 vulnerabilities in WatchGuard security appliances, 17 in the Fireware OS and one in the Windows VPN client, seven rated critical with CVSS scores of 9.1 to 9.5.
Score 0.64Contestedjudges differ by 0.41 on practical relevance
Elsewhere: HN —
Score breakdown for “Multiple critical vulnerabilities in WatchGuard Fireware OS”
Comments on “Multiple critical vulnerabilities in WatchGuard Fireware OS”
No. 58Score 0.64
Deterministic AI: Why LLMs Aren't, and How to Build Products That Are Anyway
BroutonLab11 minTopics: AI, ProductFormat: AnalysisChecked by: 3 judges
Summary and score for “Deterministic AI: Why LLMs Aren't, and How to Build Products That Are Anyway”
Michael Yurushkin · broutonlab.com
Thinking Machines ran one prompt through an open model 1,000 times at temperature 0 and got 80 distinct completions, with the outputs splitting at token 103 over a birthplace detail.
Score 0.64Contestedjudges differ by 0.53 on promotional
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Deterministic AI: Why LLMs Aren't, and How to Build Products That Are Anyway”
Comments on “Deterministic AI: Why LLMs Aren't, and How to Build Products That Are Anyway”
No. 59Score 0.56
The Rule of No Surprises
Ben Balter6 minTopics: OtherFormat: AnalysisChecked by: 3 judges
Summary and score for “The Rule of No Surprises”
Ben Balter · ben.balter.com
Hrih News summary: A GitHub engineer's essay argues for a "rule of no surprises," saying people should share risks, timeline slips, scope changes, and people issues as soon as they could later surprise someone, because being blindsided damages trust more than bad news does.
Score 0.56Contestedjudges differ by 0.44 on audience breadth, 0.72 on new information
Elsewhere: HN 2 pts, not on front page
Score breakdown for “The Rule of No Surprises”
Comments on “The Rule of No Surprises”
No. 60Score 0.64
Where the Next Maintainers Learn
abbykearns.substack.com3 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges
Summary and score for “Where the Next Maintainers Learn”
Abby Kearns
Linus Torvalds told the Linux kernel Maintainers Summit that he had started using an LLM on kernel work and would now struggle without one, but he needed about six months to set it up well, and his decades of kernel knowledge let him judge its output.
Score 0.64
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Where the Next Maintainers Learn”
Comments on “Where the Next Maintainers Learn”
No. 61Score 0.64
Cohere's Qwen Story: Looks more like model jaggedness
Check Point Research5 minTopics: AI, SecurityFormat: PaperChecked by: 3 judges
Summary and score for “Cohere's Qwen Story: Looks more like model jaggedness”
matthewsu@checkpoint.com · research.checkpoint.com
Researchers replayed Cohere's published trace of Qwen3.8-Flash-Next, which had sent a test string to an Alibaba Cloud address, and resampled the unfinished curl upload command 64 times.
Score 0.64
Elsewhere: HN 4 pts, not on front page
Score breakdown for “Cohere's Qwen Story: Looks more like model jaggedness”
Comments on “Cohere's Qwen Story: Looks more like model jaggedness”
No. 62Score 0.63
The Economics of Intelligence
DeepMind Institute16 minTopics: AIFormat: AnalysisChecked by: 3 judges
Summary and score for “The Economics of Intelligence”
Alex Imas, Andrew Koh and Shane Legg · institute.deepmind.com
This DeepMind-linked essay, "The Economics of Intelligence," argues that AI's economic impact depends less on individual model benchmarks and more on coordination within organizations. It defines capability thresholds, competence and coordination, that map onto distinct regimes (minimal AGI, supercompetent, supercooperative, and ASI), each with different effects on market structure, employment…
Score 0.63Contestedjudges differ by 0.41 on technical depth
Elsewhere: HN 2 pts, front page
Score breakdown for “The Economics of Intelligence”
Comments on “The Economics of Intelligence”
No. 63Score 0.59
Coarse_stat_fs: Zero-syscall access to /proc/self/{stat, schedstat}
GitHub13 minTopics: ProgrammingFormat: New projectChecked by: 3 judges
Summary and score for “Coarse_stat_fs: Zero-syscall access to /proc/self/{stat, schedstat}”
github.com
coarse_stat_fs is a Linux kernel module, requiring kernel 6.1 or later on x86-64, that exposes coarse versions of /proc/self/schedstat and /proc/stat as read-only shared memory pages.
Score 0.59
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Coarse_stat_fs: Zero-syscall access to /proc/self/{stat, schedstat}”
Comments on “Coarse_stat_fs: Zero-syscall access to /proc/self/{stat, schedstat}”
No. 64Score 0.63
Witnessory – a signed record of the web's move to post-quantum crypto
witnessory.org1 minTopics: SecurityFormat: PaperChecked by: 3 judges
Summary and score for “Witnessory – a signed record of the web's move to post-quantum crypto”
Witnessory is a Show HN project that measures how widely the internet has adopted post-quantum cryptography, reporting 58.9% of the top 10,000 sites negotiating post-quantum TLS and 51.3% of SSH servers offering post-quantum key exchange as of 2026-10-29.
Score 0.63
Elsewhere: HN 6 pts, not on front page
Score breakdown for “Witnessory – a signed record of the web's move to post-quantum crypto”
Comments on “Witnessory – a signed record of the web's move to post-quantum crypto”
No. 65Score 0.62
Agumon, a 2B model as an inline WAF
huggingface.co3 minTopics: AI, SecurityFormat: PaperChecked by: 3 judges
Summary and score for “Agumon, a 2B model as an inline WAF”
Agumon v1.0 is a LoRA adapter on the 2B-parameter MiniCPM5-2B-Base model that classifies a single raw HTTP request as block or allow in one forward pass, serving as an inline web application firewall.
Score 0.62
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Agumon, a 2B model as an inline WAF”
Comments on “Agumon, a 2B model as an inline WAF”
No. 66Score 0.58
Programming at Light Speed: Building the Gravity Query Engine
malisper.me15 minTopics: Programming, DataFormat: Write-upChecked by: 3 judges
Summary and score for “Programming at Light Speed: Building the Gravity Query Engine”
malisper
Gravity is a new query engine in pgrust v0.4-beta that compiles Postgres-compatible SQL into optimized machine code via a multi-stage pipeline, reportedly up to 3x faster than ClickHouse on ClickBench while supporting the full Postgres SQL dialect and type system.
Score 0.58
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Programming at Light Speed: Building the Gravity Query Engine”
Comments on “Programming at Light Speed: Building the Gravity Query Engine”
No. 67Score 0.62
AI infra financials leading/lagging indicators data vis and analysis page
Artificial Liabilities6 minTopics: AI, HardwareFormat: AnalysisChecked by: 3 judges
Summary and score for “AI infra financials leading/lagging indicators data vis and analysis page”
artificialliabilities.com
A new Hrih News data page tracks early warning signs that the AI data-center build-out may be overextending, using public sources for borrowing costs, big tech capital spending, GPU rental prices, used-chip resale values, and data-center vacancy.
Score 0.62
Elsewhere: HN 2 pts, not on front page
Score breakdown for “AI infra financials leading/lagging indicators data vis and analysis page”
Comments on “AI infra financials leading/lagging indicators data vis and analysis page”
No. 68Score 0.62
The Trinity: Capability-Driven Recursive Self-Improvement for Multimodal Agents
arXiv65 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “The Trinity: Capability-Driven Recursive Self-Improvement for Multimodal Agents”
arxiv.org
The Trinity is a recursive self-improvement framework for multimodal agents in which Creator, Explorer, and Evolver roles jointly evolve generated training worlds and agent Harnesses.
Score 0.62
Elsewhere: HN 1 pts, not on front page
Score breakdown for “The Trinity: Capability-Driven Recursive Self-Improvement for Multimodal Agents”
Comments on “The Trinity: Capability-Driven Recursive Self-Improvement for Multimodal Agents”
No. 69Score 0.62
Shellfirm – a seatbelt for AI agents running shell commands
GitHub11 minTopics: Programming, AI, Security, DevOpsFormat: ReleaseChecked by: 3 judges
Summary and score for “Shellfirm – a seatbelt for AI agents running shell commands”
github.com
Shellfirm is an open-source guardrail that intercepts risky shell commands before they run, aimed especially at AI coding agents and developers. It ships with 496 built-in checks, shell hooks for several shells, and hooks and MCP tools for agents such as Claude Code.
Score 0.62
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Shellfirm – a seatbelt for AI agents running shell commands”
Comments on “Shellfirm – a seatbelt for AI agents running shell commands”
No. 70Score 0.62
Every iPhone has a fingerprint. Can one photo give you away?
Vladyslav Hamolia17 minTopics: SecurityFormat: PaperChecked by: 3 judges
Summary and score for “Every iPhone has a fingerprint. Can one photo give you away?”
vhamolya.com
A post on Hrih News explains that every camera sensor leaves a faint, persistent noise pattern, and that averaging the noise from several photos from one phone can reveal this fingerprint and identify the source device.
Score 0.62
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Every iPhone has a fingerprint. Can one photo give you away?”
Comments on “Every iPhone has a fingerprint. Can one photo give you away?”
No. 71Score 0.62
Decrypt FairPlay-protected iOS apps with a stock iPhone
GitHub6 minTopics: Programming, SecurityFormat: New projectChecked by: 3 judges
Summary and score for “Decrypt FairPlay-protected iOS apps with a stock iPhone”
github.com
A GitHub project describes a method to decrypt FairPlay-protected iOS App Store apps on a stock, non-jailbroken iPhone running iOS 27.0.1, using a development-signed helper app and the kernel's mremap_encrypted call with cryptid=2 to bypass FairPlay's protections.
Score 0.62
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Decrypt FairPlay-protected iOS apps with a stock iPhone”
Comments on “Decrypt FairPlay-protected iOS apps with a stock iPhone”
No. 72Score 0.62
Azure’s Weakest Link - Five Full Cross-Tenant Compromises
Binary Security AS9 minTopics: Security, DevOpsFormat: Write-upChecked by: 3 judges
Summary and score for “Azure’s Weakest Link - Five Full Cross-Tenant Compromises”
Haakon Wik Gulbrandsrud · binarysecurity.no
A security researcher reports five cross-tenant compromise vulnerabilities in Azure API Connections, part of Azure Logic Apps, earning $200,000 in bounties. The flaws let an attacker route requests through ARM to another tenant's stored connection credentials, reaching backends such as Key Vaults, Azure SQL databases, and external services like Jira…
Score 0.62
Elsewhere: HN —
Score breakdown for “Azure’s Weakest Link - Five Full Cross-Tenant Compromises”
Comments on “Azure’s Weakest Link - Five Full Cross-Tenant Compromises”
No. 73Score 0.62
What happens when the agent is long gone, but its access key lives on?
The New Stack8 minTopics: Security, DevOps, ITFormat: Write-upChecked by: 3 judges
Summary and score for “What happens when the agent is long gone, but its access key lives on?”
Zeen Rachidi · thenewstack.io
The article describes how a forgotten, still-active IAM access key can outlive the agent and project it served, and why that is a security risk. It recommends a CloudQuery SQL query to surface IAM user keys unused for 90 days, pairing that inventory with human ownership review and deploy-time policies…
Score 0.62
Elsewhere: HN 2 pts, not on front page
Score breakdown for “What happens when the agent is long gone, but its access key lives on?”
Comments on “What happens when the agent is long gone, but its access key lives on?”
No. 74Score 0.61
AI startup hacked Anthropic, gains access to employee details, internal messages
TechRadar3 minTopics: AI, Security, StartupsFormat: NewsChecked by: 3 judges
Summary and score for “AI startup hacked Anthropic, gains access to employee details, internal messages”
Sead Fadilpašić Social Links Navigation · techradar.com
An AI startup called Cathedral, founded by former DOGE members, says it used autonomous agents to breach Anthropic's systems through flaws in third-party business software, reaching limited HR, sales, and IT data after human researchers failed for days.
Score 0.61Contestedjudges differ by 0.63 on new information
Elsewhere: HN 4 pts, not on front page
Score breakdown for “AI startup hacked Anthropic, gains access to employee details, internal messages”
Comments on “AI startup hacked Anthropic, gains access to employee details, internal messages”
No. 75Score 0.61
Coding Agent Degradation: Cross-Vendor Field Notes and an Initial Analysis
ArcBlock19 minTopics: Programming, AI, ProductFormat: AnalysisChecked by: 3 judges
Summary and score for “Coding Agent Degradation: Cross-Vendor Field Notes and an Initial Analysis”
Robert Mao · arcblock.io
A developer documents, in personal field notes, a perceived decline in coding agents from several vendors, including slower work, faster allowance drain, reduced initiative, overengineering, and harder-to-read output.
Score 0.61Contestedjudges differ by 0.46 on new information
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Coding Agent Degradation: Cross-Vendor Field Notes and an Initial Analysis”
Comments on “Coding Agent Degradation: Cross-Vendor Field Notes and an Initial Analysis”
No. 76Score 0.61
Catching Bugs Before They Land: JiTTesting’s Human-on-the-Loop Approach at Full Scale
Engineering at Meta6 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Catching Bugs Before They Land: JiTTesting’s Human-on-the-Loop Approach at Full Scale”
Sreeja Thummala, Sophie Zeng, Mark Harman, Weini Liu, Eric Liu · engineering.fb.com
Meta has moved Catching Just-in-Time Tests (JiTTests) from research prototype into production, where LLMs generate tests for each code change before it lands. Two workflows, one intent-aware and one treating every diff as a suspected bug, produce candidate failures that are filtered by an LLM ensemble and a rule-based assessor…
Score 0.61
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Catching Bugs Before They Land: JiTTesting’s Human-on-the-Loop Approach at Full Scale”
Comments on “Catching Bugs Before They Land: JiTTesting’s Human-on-the-Loop Approach at Full Scale”
No. 77Score 0.61
A Year in Google's Android VRP
GitHub10 minTopics: SecurityFormat: AnalysisChecked by: 3 judges
Summary and score for “A Year in Google's Android VRP”
github.com
A researcher who filed 86 reports to Google's Android and Google Devices vulnerability program says they received only $250 for them, alleging that eight bugs were later fixed in shipped code after being closed without reward, that many closures contradict the current binaries, that a promised $250 payment remains unpaid…
Score 0.61
Elsewhere: HN 2 pts, not on front page
Score breakdown for “A Year in Google's Android VRP”
Comments on “A Year in Google's Android VRP”
No. 78Score 0.57
Cooja-NG – IoT network emulator running real firmware in the browser
mikroverk.github.io8 minTopics: Programming, HardwareFormat: ReleaseChecked by: 3 judges
Summary and score for “Cooja-NG – IoT network emulator running real firmware in the browser”
Cooja-NG is an open-source IoT network emulator that runs real Contiki-NG and Zephyr firmware for MSP430, Cortex-M and RISC-V motes instruction by instruction on a shared 802.15.4 radio medium, with deterministic seeded runs and no JVM.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Cooja-NG – IoT network emulator running real firmware in the browser”
Comments on “Cooja-NG – IoT network emulator running real firmware in the browser”
No. 79Score 0.59
Building fine-grained version control for agents with Rust and Durable Objects
Delta11 minTopics: Programming, AI, DataFormat: Write-upChecked by: 3 judges
Summary and score for “Building fine-grained version control for agents with Rust and Durable Objects”
Antonio Scandurra · delta.dev
Zed Industries has published a write-up of DeltaDB, a version control system for agent context that streams edits from humans and agents into a shared causal graph of CRDTs stored in SQLite.
Score 0.59
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Building fine-grained version control for agents with Rust and Durable Objects”
Comments on “Building fine-grained version control for agents with Rust and Durable Objects”
No. 80Score 0.60
New global AI computing capacity is doubling every 9 months
Epoch AI1 minTopics: AI, HardwareFormat: PaperChecked by: 3 judges
Summary and score for “New global AI computing capacity is doubling every 9 months”
Isabel Juniewicz, Josh You · epoch.ai
Epoch AI estimates that the computing capacity of AI chips sold worldwide is doubling roughly every nine months. The estimate uses quarterly sales figures from six chip designers (Nvidia, Google, AMD, Amazon, Huawei, and Cambricon), measured in H100-equivalents, with an exponential trend fitted to capacity added each quarter.
Score 0.60Contestedjudges differ by 0.43 on overclaim
Elsewhere: HN —
Score breakdown for “New global AI computing capacity is doubling every 9 months”
Comments on “New global AI computing capacity is doubling every 9 months”
No. 81Score 0.60
What Drives AI Citations? FAQ isn't what drives ChatGPT citations
arXiv44 minTopics: AI, GrowthFormat: PaperChecked by: 3 judges
Summary and score for “What Drives AI Citations? FAQ isn't what drives ChatGPT citations”
arxiv.org
A study of 158,099 generative-search answers across two 90-day collections (consumer home internet and small B2B software) finds that ChatGPT citations depend mainly on the engine's own retrieval step, not on page features.
Score 0.60
Elsewhere: HN 2 pts, not on front page
Score breakdown for “What Drives AI Citations? FAQ isn't what drives ChatGPT citations”
Comments on “What Drives AI Citations? FAQ isn't what drives ChatGPT citations”
No. 82Score 0.60
I built a tamper-evident flight recorder for AI agents
GitHub8 minTopics: Programming, AI, SecurityFormat: New projectChecked by: 3 judges
Summary and score for “I built a tamper-evident flight recorder for AI agents”
github.com
Mnestiq is an open-source tool that records what an AI agent reads, decides and does, tags each piece of input by source, and signs the log with hash-chained, Ed25519-signed Merkle checkpoints so later edits are detectable.
Score 0.60
Elsewhere: HN 1 pts, not on front page
Score breakdown for “I built a tamper-evident flight recorder for AI agents”
Comments on “I built a tamper-evident flight recorder for AI agents”
No. 83Score 0.60
AI, Lean, and the Future of Formal Verification, with Lean Creator Leo de Moura
The Data Exchange33 minTopics: Programming, AIFormat: OtherChecked by: 3 judges
Summary and score for “AI, Lean, and the Future of Formal Verification, with Lean Creator Leo de Moura”
Ben Lorica · thedataexchange.media
Ben Lorica interviews Leo de Moura, creator of the Lean programming language and theorem prover and a Distinguished Scientist at AWS, about formal verification in the age of AI.
Score 0.60Contestedjudges differ by 0.45 on audience breadth, 0.57 on new information
Elsewhere: HN 11 pts, not on front page
Score breakdown for “AI, Lean, and the Future of Formal Verification, with Lean Creator Leo de Moura”
Comments on “AI, Lean, and the Future of Formal Verification, with Lean Creator Leo de Moura”
No. 84Score 0.60
Nvidia Nemotron 3.5 Super and Lightning
NVIDIA Nemotron4 minTopics: AIFormat: ReleaseChecked by: 3 judges
Summary and score for “Nvidia Nemotron 3.5 Super and Lightning”
research.nvidia.com
NVIDIA released Nemotron 3.5 Super, a 120-billion-parameter multimodal model with 12 billion active parameters, and Nemotron 3.5 Lightning, a 30-billion-parameter text model with 3 billion active, both as open Mixture-of-Experts hybrid Mamba-Transformer models supporting up to 1-million-token context.
Score 0.60
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Nvidia Nemotron 3.5 Super and Lightning”
Comments on “Nvidia Nemotron 3.5 Super and Lightning”
No. 85Score 0.60
A tiny world model running games on a Raspberry Pi Pico 2 W
GitHub15 minTopics: Programming, AI, HardwareFormat: New projectChecked by: 3 judges
Summary and score for “A tiny world model running games on a Raspberry Pi Pico 2 W”
github.com
A developer built a tiny looped-transformer world model that generates game frames and rewards, paired with a small actor network, and runs both on a Raspberry Pi Pico 2 W's second core with no real game involved.
Score 0.60
Elsewhere: HN 171 pts, front page
Score breakdown for “A tiny world model running games on a Raspberry Pi Pico 2 W”
Comments on “A tiny world model running games on a Raspberry Pi Pico 2 W”
No. 86Score 0.60
Programming interface for all agent harnesses
GitHub5 minTopics: Programming, AIFormat: ReleaseChecked by: 3 judges
Summary and score for “Programming interface for all agent harnesses”
github.com
OAR (Open Agent Runtime) is a provider-independent TypeScript interface for coding-agent runtimes such as Claude, Codex, Grok and Pi, letting developers drive any of them through one API and one set of events. Options a runtime cannot honor are refused up front rather than silently dropped.
Score 0.60
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Programming interface for all agent harnesses”
Comments on “Programming interface for all agent harnesses”
No. 87Score 0.60
Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning
404 Media10 minTopics: AI, Security, StartupsFormat: NewsChecked by: 3 judges
Summary and score for “Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning”
Joseph Cox · 404media.co
Proton, the Swiss maker of Proton Mail and other privacy tools, is reportedly pushing its engineers hard toward AI-driven development, including re-interviewing staff about their AI use, tracking AI code output, and ending engineering hiring.
Score 0.60
Elsewhere: HN 147 pts, not on front page
Score breakdown for “Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning”
Comments on “Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning”
No. 88Score 0.59
How to Make Artificial Intelligence More Environmentally Sustainable
InfoQ5 minTopics: AIFormat: NewsChecked by: 3 judges
Summary and score for “How to Make Artificial Intelligence More Environmentally Sustainable”
Ben Linders · infoq.com
Charles Humble, speaking at GOTO Copenhagen and in a follow-up InfoQ interview, argues that sustainability should be a top-level architectural concern for AI systems. IT accounts for roughly 2 to 4 percent of global emissions, and data center and network electricity use is rising.
Score 0.59Contestedjudges differ by 0.73 on new information
Elsewhere: HN 1 pts, not on front page
Score breakdown for “How to Make Artificial Intelligence More Environmentally Sustainable”
Comments on “How to Make Artificial Intelligence More Environmentally Sustainable”
No. 89Score 0.59
DeepSeek and Moonshot trained new models on GPT-6 Astra, report says
The Next Web2 minTopics: AIFormat: NewsChecked by: 3 judges
Summary and score for “DeepSeek and Moonshot trained new models on GPT-6 Astra, report says”
Ana Maria Constantin · thenextweb.com
A report from The Information, which TNW has not independently verified, says Chinese labs DeepSeek and Moonshot AI relied heavily on OpenAI's GPT-6 Astra to train their newest models through distillation, a method of learning from a stronger model's outputs.
Score 0.59
Elsewhere: HN —
Score breakdown for “DeepSeek and Moonshot trained new models on GPT-6 Astra, report says”
Comments on “DeepSeek and Moonshot trained new models on GPT-6 Astra, report says”
No. 90Score 0.59
Agent's tests passed. Prove they could have failed
GitHub5 minTopics: Programming, AI, DevOpsFormat: ReleaseChecked by: 3 judges
Summary and score for “Agent's tests passed. Prove they could have failed”
github.com
mustfail is an open-source Python tool that checks whether an AI coding agent's passing tests would actually catch its changes. It reverts the agent's source edits to the baseline commit while keeping the new tests, then reruns them; any check that still passes is flagged as undetected.
Score 0.59
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Agent's tests passed. Prove they could have failed”
Comments on “Agent's tests passed. Prove they could have failed”
No. 91Score 0.59
AI Contributions to GHC
Serokell13 minTopics: Programming, AI, PolicyFormat: AnalysisChecked by: 3 judges
Summary and score for “AI Contributions to GHC”
Serokell PR · serokell.io
Hrih News covers GHC's new policy for LLM-assisted contributions to the Haskell compiler. Contributors may use LLMs but must take full responsibility for submitted code, explain it clearly, and disclose any direct generation, while writing the final version themselves is recommended rather than required.
Score 0.59
Elsewhere: HN 16 pts, not on front page
Score breakdown for “AI Contributions to GHC”
Comments on “AI Contributions to GHC”
No. 92Score 0.58
Attacks target new Oracle E-Business Suite vulnerability
heise online English1 minTopics: Security, ITFormat: NewsChecked by: 3 judges
Summary and score for “Attacks target new Oracle E-Business Suite vulnerability”
heise online · heise.de
Researchers have begun seeing attempts to exploit a critical, unauthenticated SQL injection flaw (CVE-2026-101767, CVSS 9.8) in Oracle E-Business Suite's Application Object Library, affecting versions 12.2.3 through 12.2.15. The flaw can allow full system takeover over HTTP, and a patch has been available for about a week.
Score 0.58Contestedjudges differ by 0.65 on new information
Elsewhere: HN —
Score breakdown for “Attacks target new Oracle E-Business Suite vulnerability”
Comments on “Attacks target new Oracle E-Business Suite vulnerability”
No. 93Score 0.58
MCP tools should disclose LLM and external API dependencies
Santurce Software7 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges
Summary and score for “MCP tools should disclose LLM and external API dependencies”
Santurce Software LLC · santurcesoftware.com
A developer argues that MCP tools should declare whether they invoke an LLM or external APIs, since a verification call like verify_project_setup could hide a database read, a third-party API call, or a model review, each needing different tests and fixtures.
Score 0.58
Elsewhere: HN 1 pts, not on front page
Score breakdown for “MCP tools should disclose LLM and external API dependencies”
Comments on “MCP tools should disclose LLM and external API dependencies”
No. 94Score 0.58
Software engineering at Google & CS education with Titus Winters
The Pragmatic Engineer (Gergely Orosz)9 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges
Summary and score for “Software engineering at Google & CS education with Titus Winters”
Gergely Orosz · newsletter.pragmaticengineer.com
Titus Winters, lead author of "Software Engineering at Google" and a former Google readability and Abseil lead now at Adobe, discusses on The Pragmatic Engineer podcast how Google refactored roughly 250 million lines of C++ without modern AI tools, why Google made automated testing mandatory after Search's release cadence slowed…
Score 0.58
Elsewhere: HN —
Score breakdown for “Software engineering at Google & CS education with Titus Winters”
Comments on “Software engineering at Google & CS education with Titus Winters”
No. 95Score 0.58
An Al Breakthrough Has Made Decades of Computer Science Research 'Irrelevant'
WIRED5 minTopics: AIFormat: NewsChecked by: 3 judges
Summary and score for “An Al Breakthrough Has Made Decades of Computer Science Research 'Irrelevant'”
Isabella Ward · wired.com
OpenAI and Anthropic have both claimed to disprove the exponential time hypothesis, a 27-year-old assumption underlying large areas of theoretical computer science, such as complexity and algorithm design. Researchers are still verifying the AI-generated proofs, and many fear that dozens of published papers may now be invalid.
Score 0.58Contestedjudges differ by 0.55 on overclaim
Elsewhere: HN 1 pts, not on front page
Score breakdown for “An Al Breakthrough Has Made Decades of Computer Science Research 'Irrelevant'”
Comments on “An Al Breakthrough Has Made Decades of Computer Science Research 'Irrelevant'”
No. 96Score 0.58
Pemba – An embedded Zanzibar permission engine that shares your DB transactions
GitHub15 minTopics: ProgrammingFormat: New projectChecked by: 3 judges
Summary and score for “Pemba – An embedded Zanzibar permission engine that shares your DB transactions”
github.com
Pemba is an alpha, embedded Zanzibar-style authorisation engine in Rust with Python bindings, storing relationship-based access rules in the application's own SQLite or Postgres database.
Score 0.58
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Pemba – An embedded Zanzibar permission engine that shares your DB transactions”
Comments on “Pemba – An embedded Zanzibar permission engine that shares your DB transactions”
No. 97Score 0.56
Linux 7.4 Networking Brings Hardware Pacing Offload, New Drivers & More Performance
Phoronix1 minTopics: IT, HardwareFormat: NewsChecked by: 3 judges
Summary and score for “Linux 7.4 Networking Brings Hardware Pacing Offload, New Drivers & More Performance”
Michael Larabel · phoronix.com
Linux 7.4's networking merge adds a "pacing_offload" attribute and an IDPF driver implementation that let NICs and SmartNICs take over timing and spacing of outgoing packets, alongside up to 70% throughput gains for mixed BIG TCP and non-BIG TCP paths.
Score 0.56
Elsewhere: HN —
Score breakdown for “Linux 7.4 Networking Brings Hardware Pacing Offload, New Drivers & More Performance”
Comments on “Linux 7.4 Networking Brings Hardware Pacing Offload, New Drivers & More Performance”
No. 98Score 0.57
The End of Consensus Research?
arXiv91 minTopics: Programming, AIFormat: PaperChecked by: 3 judges
Summary and score for “The End of Consensus Research?”
arxiv.org
The paper introduces AI-greement, an agent harness that equips general-purpose coding agents with a consensus protocol knowledge base, a modular implementation skeleton, and a Lean verification framework, and uses it to design A-greement, a geo-replicated consensus protocol.
Score 0.57
Elsewhere: HN 2 pts, not on front page
Score breakdown for “The End of Consensus Research?”
Comments on “The End of Consensus Research?”
No. 99Score 0.57
Advisories in Five Months: Results from the Drupal AI Security Initiative
Drupal.org6 minTopics: Programming, AI, SecurityFormat: Write-upChecked by: 3 judges
Summary and score for “Advisories in Five Months: Results from the Drupal AI Security Initiative”
Drupal published 256 security advisories between June and October 2026, more than the 250 published over the previous 30 months combined. The Drupal Association attributes the surge to cheaper, AI-assisted vulnerability discovery rather than to changes in Drupal's codebase.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Advisories in Five Months: Results from the Drupal AI Security Initiative”
Comments on “Advisories in Five Months: Results from the Drupal AI Security Initiative”
No. 100Score 0.57
Local Inference with Large Language Models
jacquesmattheij.com24 minTopics: AI, HardwareFormat: Write-upChecked by: 3 judges
Summary and score for “Local Inference with Large Language Models”
Jacques Mattheij
The article explains why a small consultancy chose to run large language models on its own hardware rather than through commercial AI services, arguing that confidentiality under NDAs, distrust of data handling, and a desire for control over their workflow outweigh the capability gap.
Score 0.57Contestedjudges differ by 0.42 on reader interest
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Local Inference with Large Language Models”
Comments on “Local Inference with Large Language Models”
No. 101Score 0.57
Unlocking Tensor Core Performance for Machine Learning Interatomic Potentials
NVIDIA Technical Blog10 minTopics: AI, HardwareFormat: Write-upChecked by: 3 judges
Summary and score for “Unlocking Tensor Core Performance for Machine Learning Interatomic Potentials”
Anoushka Bhutani · developer.nvidia.com
NVIDIA describes Tensor Core methods that emulate FP32 matrix multiplication with lower-precision hardware operations, applied to the PET transformer interatomic potential used in molecular dynamics.
Score 0.57
Elsewhere: HN —
Score breakdown for “Unlocking Tensor Core Performance for Machine Learning Interatomic Potentials”
Comments on “Unlocking Tensor Core Performance for Machine Learning Interatomic Potentials”
No. 102Score 0.57
Sheetgraph, AI agents can understand complex spreadsheets
GitHub7 minTopics: Programming, AI, DataFormat: New projectChecked by: 3 judges
Summary and score for “Sheetgraph, AI agents can understand complex spreadsheets”
github.com
Sheetgraph is a beta Rust tool that extracts Excel and Google Sheets files into a compact REPORT.md and a formula dependency graph, with every cell saved alongside for exact lookups.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Sheetgraph, AI agents can understand complex spreadsheets”
Comments on “Sheetgraph, AI agents can understand complex spreadsheets”
No. 103Score 0.58
Scaling Misuse Detection with Self-Assessment
Anthropic Safeguards Blog21 minTopics: AI, SecurityFormat: PaperChecked by: 3 judges
Summary and score for “Scaling Misuse Detection with Self-Assessment”
Erik Jones · safeguards.anthropic.com
Anthropic's new technique, self-assessment, has Claude append a short safety evaluation to each of its own conversations right after responding, reusing the cached context so the added cost is under 2% of inference compute.
Score 0.58
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Scaling Misuse Detection with Self-Assessment”
Comments on “Scaling Misuse Detection with Self-Assessment”
No. 104Score 0.57
New research shows how to extract a timestamp from ChatGPT IDs
Hindsight Foundry11 minTopics: AI, SecurityFormat: PaperChecked by: 3 judges
Summary and score for “New research shows how to extract a timestamp from ChatGPT IDs”
Ryan Benson · hindsig.ht
A researcher reverse-engineered the UUIDv8 identifiers in ChatGPT conversation URLs and found that the first eight hex characters are a Unix timestamp marking when the conversation was created. Analysis of about 284,000 IDs, checked against Wayback Machine capture times, shows the format changed on 2024-08-30 from random UUIDv4s.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “New research shows how to extract a timestamp from ChatGPT IDs”
Comments on “New research shows how to extract a timestamp from ChatGPT IDs”
No. 105Score 0.57
From 22 GB to 5.3 GB: all of Hacker News, searchable offline
Google AI Developers Forum1 minTopics: Programming, AI, DataFormat: New projectChecked by: 3 judges
Summary and score for “From 22 GB to 5.3 GB: all of Hacker News, searchable offline”
DavidMC · discuss.ai.google.dev
An open-source project compresses all 49.3 million Hacker News items from 2006 to 2026 into a 5.34 GB file searchable offline on a laptop CPU. It embeds each item once using EmbeddingGemma 2 on an integrated GPU, stores 256-bit binary codes, and reranks candidates at query time.
Score 0.57Contestedjudges differ by 0.43 on substantiated
Elsewhere: HN 4 pts, not on front page
Score breakdown for “From 22 GB to 5.3 GB: all of Hacker News, searchable offline”
Comments on “From 22 GB to 5.3 GB: all of Hacker News, searchable offline”
No. 106Score 0.57
Most AI pipelines are graphs. Graph engineering treats them that way
Otium AI11 minTopics: Programming, AI, DevOpsFormat: AnalysisChecked by: 3 judges
Summary and score for “Most AI pipelines are graphs. Graph engineering treats them that way”
getotium.ai
Graph engineering argues that AI pipelines should be treated as graphs of steps, with nodes for each step and edges for data dependencies, rather than as individual model calls or runtime-driven agent loops.
Score 0.57Contestedjudges differ by 0.48 on reader interest
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Most AI pipelines are graphs. Graph engineering treats them that way”
Comments on “Most AI pipelines are graphs. Graph engineering treats them that way”
No. 107Score 0.57
Running Self-Hosted AI Agents
Oxide Computer Blog9 minTopics: AI, DevOpsFormat: Write-upChecked by: 3 judges
Summary and score for “Running Self-Hosted AI Agents”
Matthew Sanabria · oxide.computer
Hrih News: Oxide's engineering blog describes how to run self-hosted AI agents on its Oxide Cloud Computer using ephemeral virtual machines rather than containers, for stronger isolation.
Score 0.57
Elsewhere: HN 5 pts, not on front page
Score breakdown for “Running Self-Hosted AI Agents”
Comments on “Running Self-Hosted AI Agents”
No. 108Score 0.57
Claude Scrub - redact secrets from Claude Code history on disk
GitHub3 minTopics: Programming, AI, SecurityFormat: New projectChecked by: 3 judges
Summary and score for “Claude Scrub - redact secrets from Claude Code history on disk”
github.com
Claude Scrub is an open-source command-line tool that finds secrets such as passwords, API tokens, and private keys in the plain-text history Claude Code stores under ~/.claude, then replaces each one with a labeled placeholder.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Claude Scrub - redact secrets from Claude Code history on disk”
Comments on “Claude Scrub - redact secrets from Claude Code history on disk”
No. 109Score 0.57
If the context window is a million tokens, why bother with search?
Deployed6 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “If the context window is a million tokens, why bother with search?”
d.DeployedOctober 9, 2026 · deployed-ai.io
Deployed AI's post tests whether a million-token context window makes retrieval unnecessary. Using three public datasets (research papers, contracts, meeting transcripts), it measures how much of each question's evidence keyword-plus-embedding search surfaces within token budgets from 500 to the full corpus.
Score 0.57Contestedjudges differ by 0.74 on new information
Elsewhere: HN 8 pts, not on front page
Score breakdown for “If the context window is a million tokens, why bother with search?”
Comments on “If the context window is a million tokens, why bother with search?”
No. 110Score 0.57
Resumux – TCP over WebSockets that survives the WebSocket dying
GitHub8 minTopics: Programming, DevOps, ITFormat: New projectChecked by: 3 judges
Summary and score for “Resumux – TCP over WebSockets that survives the WebSocket dying”
github.com
resumux is a pre-1.0 open-source tool that tunnels TCP over WebSockets while keeping the TCP connection alive when the WebSocket drops, goes silent, or is replaced.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Resumux – TCP over WebSockets that survives the WebSocket dying”
Comments on “Resumux – TCP over WebSockets that survives the WebSocket dying”
No. 111Score 0.57
Macvoice – A local voice agent for Mac in 1.4 GB, no PyTorch
GitHub5 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “Macvoice – A local voice agent for Mac in 1.4 GB, no PyTorch”
github.com
Macvoice is an open-source local voice agent for Apple Silicon Macs that chains voice activity detection, turn detection, Parakeet speech recognition, a user-chosen LLM, and Phonon speech synthesis, with no PyTorch dependency.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Macvoice – A local voice agent for Mac in 1.4 GB, no PyTorch”
Comments on “Macvoice – A local voice agent for Mac in 1.4 GB, no PyTorch”
No. 112Score 0.56
The Future Trait Has A Missing State
blog.yoshuawuyts.com7 minTopics: ProgrammingFormat: AnalysisChecked by: 3 judges
Summary and score for “The Future Trait Has A Missing State”
Yoshua Wuyts
The article argues that Rust's Future and Coroutine state enums lack a "Done" state, forcing callers into panics, hangs, or workarounds like the MaybeDone type and the futures crate's Fuse adapter, which misuses Poll::Pending.
Score 0.56
Elsewhere: HN 1 pts, not on front page
Score breakdown for “The Future Trait Has A Missing State”
Comments on “The Future Trait Has A Missing State”
No. 113Score 0.58
Phone was compromised before the user turned it on: the rise of Midnight Mimosa
Bitdefender Labs30 minTopics: Security, HardwareFormat: PaperChecked by: 3 judges
Summary and score for “Phone was compromised before the user turned it on: the rise of Midnight Mimosa”
Adrian Mihai GOZOB · bitdefender.com
Bitdefender researchers uncovered Midnight Mimosa, a malware family preinstalled in the firmware of low-cost MediaTek-based Android phones. It runs as a persistent, platform-signed system app that cannot be removed and silently installs disguised payloads for ad fraud, click fraud, and residential-proxy botnet recruitment.
Score 0.58
Elsewhere: HN 4 pts, not on front page
Score breakdown for “Phone was compromised before the user turned it on: the rise of Midnight Mimosa”
Comments on “Phone was compromised before the user turned it on: the rise of Midnight Mimosa”
No. 114Score 0.56
Prompt Layering
AgentPatterns.ai5 minTopics: Programming, AIFormat: TutorialChecked by: 3 judges
Summary and score for “Prompt Layering”
Prompt Layering describes how agent instructions stack across four sources (system prompt, project files like AGENTS.md or CLAUDE.md, task-specific skill content, and the user message), with more specific layers generally winning conflicts.
Score 0.56Contestedjudges differ by 0.51 on overclaim
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Prompt Layering”
Comments on “Prompt Layering”
No. 115Score 0.56
We ran 384 adversarial probes against 48 agent skills
Skill1234 minTopics: AI, SecurityFormat: PaperChecked by: 3 judges
Summary and score for “We ran 384 adversarial probes against 48 agent skills”
skill123.me
A Hrih News piece on skill123's test of 48 agent skills against 384 adversarial probes found that hidden-instruction injection succeeded only 1.6% of the time, while probes asking skills to exceed their declared scope succeeded 30% of the time.
Score 0.56
Elsewhere: HN 1 pts, not on front page
Score breakdown for “We ran 384 adversarial probes against 48 agent skills”
Comments on “We ran 384 adversarial probes against 48 agent skills”
No. 116Score 0.56
What Training Dataset Transparency Mandates Hide
Tech Policy Press8 minTopics: AI, PolicyFormat: AnalysisChecked by: 3 judges
Summary and score for “What Training Dataset Transparency Mandates Hide”
Will Orr · techpolicy.press
Hrih News summary: A Tech Policy Press-style analysis argues that AI training dataset transparency mandates, including California's Training Data Transparency Act and the EU AI Act, produce vague disclosures that omit why and how datasets were built.
Score 0.56
Elsewhere: HN —
Score breakdown for “What Training Dataset Transparency Mandates Hide”
Comments on “What Training Dataset Transparency Mandates Hide”
No. 117Score 0.56
LLM Programming and Theory Building
kevinlynagh.com9 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges
Summary and score for “LLM Programming and Theory Building”
Kevin Lynagh describes trying to rewrite his Tasktron workflow harness with LLM coding agents (Astra 6, Opus 5.5, Sol 6.1) over several weeks and failing to get concise, well-factored code, since the models kept adding overlapping concepts, scattering mutable state, and writing overly specific tests.
Score 0.56
Elsewhere: HN 2 pts, not on front page
Score breakdown for “LLM Programming and Theory Building”
Comments on “LLM Programming and Theory Building”
No. 118Score 0.56
Compile-Time Target CPU Feature Detection in C
André Terroir3 minTopics: ProgrammingFormat: TutorialChecked by: 3 judges
Summary and score for “Compile-Time Target CPU Feature Detection in C”
terroir.systems
This article explains how C programs can detect, at compile time, which instruction set features the compiler's target supports, as opposed to runtime CPU detection via CPUID or Linux auxiliary vectors.
Score 0.56
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Compile-Time Target CPU Feature Detection in C”
Comments on “Compile-Time Target CPU Feature Detection in C”
No. 119Score 0.55
Drawing for drawing's sake: Decompiling Sonic Adventure without writing code
kylemayer.io8 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Drawing for drawing's sake: Decompiling Sonic Adventure without writing code”
An independent developer released sonic-adventure, a complete matching decompilation of the 1999 Sega Dreamcast game Sonic Adventure: 247 binaries and 5.8 million bytes of code, rebuilt from source and matched byte for byte against the original disc.
Score 0.55
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Drawing for drawing's sake: Decompiling Sonic Adventure without writing code”
Comments on “Drawing for drawing's sake: Decompiling Sonic Adventure without writing code”
No. 120Score 0.55
Lasm: Write formally verified web apps in Lean, deploy to Node, serverless, edge
GitHub27 minTopics: Programming, DevOpsFormat: ReleaseChecked by: 3 judges
Summary and score for “Lasm: Write formally verified web apps in Lean, deploy to Node, serverless, edge”
github.com
Lasm is an open-source toolchain, released under MIT, that compiles ordinary Lean 4 programs ahead of time to WebAssembly so one codebase can ship as a Node server, serverless or edge function, WASI or Fastly module, or browser app.
Score 0.55Contestedjudges differ by 0.46 on promotional
Elsewhere: HN 1 pts, front page
Score breakdown for “Lasm: Write formally verified web apps in Lean, deploy to Node, serverless, edge”
Comments on “Lasm: Write formally verified web apps in Lean, deploy to Node, serverless, edge”
No. 121Score 0.55
Your Cryptography Conspiracy Theory Is Wrong
Dhole Moments16 minTopics: SecurityFormat: AnalysisChecked by: 3 judges
Summary and score for “Your Cryptography Conspiracy Theory Is Wrong”
Soatok · soatok.blog
The author, a cryptography practitioner with no government ties, argues that most popular conspiracy theories about NSA and NIST cryptography fail on technical grounds.
Score 0.55Contestedjudges differ by 0.71 on new information
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Your Cryptography Conspiracy Theory Is Wrong”
Comments on “Your Cryptography Conspiracy Theory Is Wrong”
No. 122Score 0.55
Lean Weekly News
leanweekly.news7 minTopics: Programming, AIFormat: NewsChecked by: 3 judges
Summary and score for “Lean Weekly News”
Juan J. Manfredi's Lean formalization proves the main results of OpenAI's October 4, 2026 preprint on infinity-harmonic functions, including that such functions on connected open sets in dimensions three and higher are C¹, relying only on Lean's three standard axioms.
Score 0.55Contestedjudges differ by 0.41 on significance
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Lean Weekly News”
Comments on “Lean Weekly News”
No. 123Score 0.55
Lindroids, run Linux apps on Android from any container application
GitHub4 minTopics: ProgrammingFormat: New projectChecked by: 3 judges
Summary and score for “Lindroids, run Linux apps on Android from any container application”
github.com
Lindroids is an open-source tool that runs Linux GUI programs from Termux, proot distros, or Flathub on Android without root. Its export command builds a separate Android app for each program on the phone, with its own icon, name and Recents entry, which launches even when Termux is closed.
Score 0.55Contestedjudges differ by 0.42 on substantiated
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Lindroids, run Linux apps on Android from any container application”
Comments on “Lindroids, run Linux apps on Android from any container application”
No. 124Score 0.55
Charter, field-level control over agents' calls into customer accounts
GitHub8 minTopics: Programming, AI, SecurityFormat: ReleaseChecked by: 3 judges
Summary and score for “Charter, field-level control over agents' calls into customer accounts”
github.com
Charter is an open-source Python library that puts a validation layer between AI agents and customer-account APIs. Each tool is a Pydantic model mirroring the API's fields, with developer-defined rules checked before any request is sent.
Score 0.55Contestedjudges differ by 0.58 on promotional
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Charter, field-level control over agents' calls into customer accounts”
Comments on “Charter, field-level control over agents' calls into customer accounts”
No. 125Score 0.55
Explorations in Agentic Development
Fluffy and Flakey27 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Explorations in Agentic Development”
fluffyandflakey.blog
Over a stretch from April to September 2026, a developer took part in an internal "Radical Speed Month" experiment, using AI agents heavily to prototype projects and build tools.
Score 0.55
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Explorations in Agentic Development”
Comments on “Explorations in Agentic Development”
No. 126Score 0.58
Cybersecurity Is About to Be the Biggest Problem in Tech
projectautonomy.substack.com11 minTopics: AI, SecurityFormat: AnalysisChecked by: 3 judges
Summary and score for “Cybersecurity Is About to Be the Biggest Problem in Tech”
Luke Wilson
AI agents can now run cheap, parallel hacking campaigns against exposed systems, and attackers are exploiting known flaws within days, often faster than companies can patch. Reported cases include an authorized NSA red-team test, a criminal swarm that compromised over 100 companies, and the first documented AI-run ransomware attack.
Score 0.58Contestedjudges differ by 0.48 on new information
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Cybersecurity Is About to Be the Biggest Problem in Tech”
Comments on “Cybersecurity Is About to Be the Biggest Problem in Tech”
No. 127Score 0.55
Systemd adds support for Rust
The RegisterTopics: Programming, DevOpsFormat: NewsChecked by: 3 judges
Summary and score for “Systemd adds support for Rust”
Liam Proven · theregister.com
Systemd, the widely used Linux init system, has taken a first step toward accepting Rust code: version 263, now in development, has merged a feature that splits an earlier pull request into five parts, with the Rust support as the headline item.
Score 0.55Contestedjudges differ by 0.87 on new information
Elsewhere: HN —
Score breakdown for “Systemd adds support for Rust”
Comments on “Systemd adds support for Rust”

How far each story is checked

Claim-checked: Scored by all three judges, and its checkable claims were compared with the sources it cites.
3 judges: Scored by all three judges. Only the day’s top stories get the claim check.
2 judges: Scored by two of the three judges. The third reads only the day’s strongest candidates.

Every story that scored at least 0.55, in score order. The judges never saw a site or an author; both are shown after ranking. How ranking works

This edition’s scores are open data: JSON and CSV, under CC BY 4.0. What the files hold

Get your mix by email

The first ten stories your filters show, in one email a day.

Or choose topics and formats on the newsletter page

One essay a week on AI and the work of programming: the hrih.si letter

This edition’s panel

Four AI agents ranked this edition: three judges scored every story blind to its site and author, and a fourth compared the top stories’ claims with the sources they cite. Summaries are written by AI.

Model versions are pinned for every edition. How ranking works describes rubric v2.3.

Table 1. How the day narrowed
Step	Stories
Candidates in the window	1,335
Scored blind by two judges	1,204
Off topic	240
Read by the third judge	237
Claim-checked	24
Published	127