Edition of Thursday 5 November 2026

The day in tech, ranked blind.

Get the day’s top ten stories, with their summaries, in one free email a day.

Every topic and format but new projects. Pick your own mix

One essay a week on AI and the work of programming: the hrih.si letter

Ranked by score · Showing 20 of 127 stories · 12 hidden by your filters

No. 1Score 0.76
Xenbleed: Xen Guest to Dom0 Escape
codeant.ai8 minTopics: Security, DevOpsFormat: Write-upChecked by: Claim-checked
Summary and score for “Xenbleed: Xen Guest to Dom0 Escape”
CodeAnt AI researchers report a Xen grant-copy flaw, fixed in XSA-523 on November 3, that lets a guest with kernel-level control read and write dom0 memory. A batch cache reused locked domains after a failed grant lookup, skipping the check limiting direct frame numbers to the caller's own memory. They reproduced it on XenServer 9 and ran reversible code in dom0's kernel, on one pCPU and one kernel image. Xen lists no mitigation. Dates, severity scores and the 2015 origin come from CodeAnt alone.
Score 0.76Claim check: 1 matches source · 3 no source given · 4 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Xenbleed: Xen Guest to Dom0 Escape”
Comments on “Xenbleed: Xen Guest to Dom0 Escape”
No. 2Score 0.75
A new Go API for JSON
Go Blog14 minTopics: ProgrammingFormat: ReleaseChecked by: Claim-checked
Summary and score for “A new Go API for JSON”
Michael Pratt, Joe Tsai, Daniel Martí, Johan Brandhorst-Satzkorn, Roger Peppe, Chris Hines, and Damien Neil · go.dev
The Go team announced that encoding/json/v2 and encoding/json/jsontext are stable in Go 1.27, a status the post itself doesn't source. v2 rejects invalid UTF-8 and duplicate member names, marshals nil slices and maps as empty values, and matches field names case-sensitively. Unmarshal is up to 10x faster than v1, while Marshal is roughly equal. Larger gains need the streaming MarshalJSONTo and UnmarshalJSONFrom methods; the Kubernetes speedup is unverified. v1 remains supported and runs on v2 options, so migration can be gradual.
Score 0.75Claim check: 3 matches source · 2 no source given · 3 couldn’t check
Elsewhere: HN 266 pts, front page
Score breakdown and claims for “A new Go API for JSON”
Comments on “A new Go API for JSON”
No. 3Score 0.74
Server closed the connection unexpectedly in Postgres
Now-Next17 minTopics: Programming, DevOps, DataFormat: PaperChecked by: Claim-checked
Summary and score for “Server closed the connection unexpectedly in Postgres”
Chris van Eijk — Now-Next · now-next.nl
Now-Next's Chris van Eijk tested what PostgreSQL's "server closed the connection unexpectedly" message hides, using Docker images 13 to 18 and six client libraries. The sentence comes from libpq, not the server, and the server log is the main clue. In an autocommit loop with kill -9, 77 of 100 failed statements had in fact committed, so blind retries risk duplicates. pg_xact_status sometimes reported lost transactions as committed after a crash. Most figures are the author's own measurements and have no independent source.
Score 0.74Claim check: 1 matches source · 5 no source given · 2 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Server closed the connection unexpectedly in Postgres”
Comments on “Server closed the connection unexpectedly in Postgres”
No. 4Score 0.74
The PHP2Shell fix, two weeks on: what the PHP-src issue tracker shows
AI News Report8 minTopics: Programming, SecurityFormat: Write-upChecked by: Claim-checked
Summary and score for “The PHP2Shell fix, two weeks on: what the PHP-src issue tracker shows”
AI News Report · theainewsreport.com
The PHP2Shell fix, shipped October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, makes memory_limit soft and adds a hard limit, by default 200% of it, that ends the process with exit 137. AI News Report found eight php-src issues naming the fix commit, four of them behavior regressions. In its test, a sprintf call that once gave a fatal error now exits 137; four fix PRs for that case were open. Several figures, including the commit size and the crash-queue statistics, could not be independently checked.
Score 0.74Claim check: 2 matches source · 2 no source given · 4 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “The PHP2Shell fix, two weeks on: what the PHP-src issue tracker shows”
Comments on “The PHP2Shell fix, two weeks on: what the PHP-src issue tracker shows”
No. 5Score 0.74
Hibernate Lost My Update
Bartosz Osipiuk16 minTopics: ProgrammingFormat: Write-upChecked by: Claim-checked
Summary and score for “Hibernate Lost My Update”
bartoszosipiuk.pl
Bartosz Osipiuk traced missing updates after pod shutdown to Hibernate skipping the final flush when its session factory is already closed. If Spring's SIGTERM handling closes the factory while a slow transaction runs, the commit saves only changes already sent, such as outbox inserts, with no exception and only a TRACE log. His demo app reproduces it, and he proposes a guard that rolls such commits back. The figures, including a roughly 1.2 ms window, come from his own tests and could not be independently checked.
Score 0.74Claim check: 1 matches source · 2 no source given · 5 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “Hibernate Lost My Update”
Comments on “Hibernate Lost My Update”
No. 6Score 0.73
Security Incident Post Mortem
gitbook.com6 minTopics: Security, DevOpsFormat: Write-upChecked by: Claim-checked
Summary and score for “Security Incident Post Mortem”
GitBook's post mortem says an attacker used an SSO login flaw on 2 November 2026 to create staff sessions, then reached internal repositories, a Cloudflare API key and production secrets through a service account. GitBook disabled the accounts, which took the app offline for about 16 hours, and rotated all secrets. It treats all customer data as exposed, though activity appears aimed at one customer and no content changes were found. The AI-driven attack claim is GitBook's inference, and the details come only from GitBook, with no outside confirmation.
Score 0.73Claim check: 7 no source given · 1 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “Security Incident Post Mortem”
Comments on “Security Incident Post Mortem”
No. 7Score 0.72
Revolut switched to GLM. We found hidden risks
hirundo.io14 minTopics: Programming, AI, Security, FintechFormat: PaperChecked by: Claim-checked
Summary and score for “Revolut switched to GLM. We found hidden risks”
Ben LuriaCEO, Hirundo
Hirundo, an AI security vendor, tested GLM 5.3 Flash, a smaller sibling of the model Revolut now uses for coding. When a mock repository's files named Revolut, 55% of generated account-recovery services could be taken over, 28% more than with WeBank's name and 53% more than with none. WeBank showed no significant difference from the baseline. The test used one model, one framework and single requests, not Revolut's deployment, and the vendor does not claim intent. Builders should test models inside their own repositories.
Score 0.72Claim check: 3 matches source · 4 no source given · 1 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Revolut switched to GLM. We found hidden risks”
Comments on “Revolut switched to GLM. We found hidden risks”
No. 8Score 0.72
PEP 723 – Inline script metadata
Python Enhancement Proposals (PEPs)17 minTopics: ProgrammingFormat: OtherChecked by: Claim-checked
Summary and score for “PEP 723 – Inline script metadata”
peps.python.org
PEP 723, now Final, standardizes how a single-file Python script declares its own metadata. A comment block opened with "# /// script" can hold dependencies (PEP 508 strings), a requires-python specifier and an optional [tool] table, all in TOML. It defines no runner, but lets tools such as Hatch read requirements without private formats. The Python Enhancement Proposals page says it was resolved on 8 January 2024. Tool support is stated as intent; the GitHub-uniqueness and tool-maintainer claims were not verified. Running untrusted scripts still means installing their dependencies.
Score 0.72Claim check: 1 matches source · 3 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “PEP 723 – Inline script metadata”
Comments on “PEP 723 – Inline script metadata”
No. 9Score 0.72
NVIDIA CUDA 13.5 Brings NVIDIA Vera Rubin GA Support
NVIDIA Technical Blog14 minTopics: Programming, AI, HardwareFormat: ReleaseChecked by: Claim-checked
Summary and score for “NVIDIA CUDA 13.5 Brings NVIDIA Vera Rubin GA Support”
Shara Tibken · developer.nvidia.com
NVIDIA's CUDA 13.5 moves Vera Rubin support to general availability and extends Windows on Arm to DGX Station. It adds finer GPU partitioning through locality domains and MPS v3 weighted timeslicing, multi-GPU communication inside CUDA Tile kernels, and a CUB batched Top-K aimed at LLM workloads. The post also lists cuBLAS and cuSPARSE speedups, such as up to 1.5x on B200 for FP64 symmetric updates. These figures are NVIDIA's own and come without sources, so teams should benchmark their workloads.
Score 0.72Claim check: 6 no source given · 2 couldn’t check
Elsewhere: HN —
Score breakdown and claims for “NVIDIA CUDA 13.5 Brings NVIDIA Vera Rubin GA Support”
Comments on “NVIDIA CUDA 13.5 Brings NVIDIA Vera Rubin GA Support”
No. 10Score 0.70
SpecPilot: Autonomous Algorithm Discovery and Systems Optimization for SpecDec
arXiv43 minTopics: AIFormat: PaperChecked by: Claim-checked
Summary and score for “SpecPilot: Autonomous Algorithm Discovery and Systems Optimization for SpecDec”
arxiv.org
SpecPilot, from researchers at Berkeley, Princeton, Stanford and NVIDIA, is an agentic loop that tunes speculative decoding for each deployment. A cost model locates the gap to a ceiling, parallel agents test fixes, and token forcing checks outputs against stock to catch lossy shortcuts. It found a lossless 12-bit weight format and tree verification for hybrid recurrent models. The authors report speedup over autoregressive decoding rising from 4.46x to 10.87x with one request, and 1.94x to 3.93x with batching. These figures are self-reported and have no independent source.
Score 0.70Claim check: 8 no source given
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “SpecPilot: Autonomous Algorithm Discovery and Systems Optimization for SpecDec”
Comments on “SpecPilot: Autonomous Algorithm Discovery and Systems Optimization for SpecDec”
No. 11Score 0.72
Flutter updates required to remediate the eMudhra certificate compromise
Firebase8 minTopics: Programming, SecurityFormat: ReleaseChecked by: Claim-checked
Summary and score for “Flutter updates required to remediate the eMudhra certificate compromise”
firebase.google.com
Google says the private keys for several intermediate CA certificates issued by eMudhra were compromised and revoked, and it found out on October 19, 2026. Flutter, Dart, Cloud Firestore SDKs (Apple, Flutter, Unity, C++) and the Firebase App Distribution Gradle plugin trust a compiled-in root bundle, so OS and browser blocklists don't protect them. Developers must upgrade (for example Dart 3.13.7, Flutter 3.47.8), rebuild, redeploy, and get users to update. Google says the backends were not affected; some claims are not independently verified.
Score 0.72Contestedjudges differ by 0.60 on new informationClaim check: 3 matches source · 3 no source given · 2 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Flutter updates required to remediate the eMudhra certificate compromise”
Comments on “Flutter updates required to remediate the eMudhra certificate compromise”
No. 12Score 0.70
AMD Instinct MI350P First Look: 144GB HBM3E in a 600W PCIe Card
StorageReview.com25 minTopics: AI, HardwareFormat: PaperChecked by: Claim-checked
Summary and score for “AMD Instinct MI350P First Look: 144GB HBM3E in a 600W PCIe Card”
by
StorageReview's first look at AMD's Instinct MI350P, a dual-slot PCIe card with 144GB of HBM3E and 4TB/s of bandwidth, tested it at 450W against NVIDIA's RTX PRO 6000 (600W) and H200 NVL. On GPT-OSS-120B, one card reached 5,057 tokens per second at 128 streams on chat prompts, 65% ahead of the RTX card. Results on long prompts are mixed, and the two-card models ran on an older ROCm stack. The extra memory cuts card counts, but full-power results are still pending, and the claim check found most figures unsourced.
Score 0.70Claim check: 7 no source given · 1 couldn’t check
Elsewhere: HN 4 pts, not on front page
Score breakdown and claims for “AMD Instinct MI350P First Look: 144GB HBM3E in a 600W PCIe Card”
Comments on “AMD Instinct MI350P First Look: 144GB HBM3E in a 600W PCIe Card”
No. 13Score 0.70
Caching at Scale in Django: Lessons from Production
Johnny Metz7 minTopics: Programming, DevOps, DataFormat: Write-upChecked by: Claim-checked
Summary and score for “Caching at Scale in Django: Lessons from Production”
johnnymetz.com
Johnny Metz describes how his team's multi-tenant Django API handled roughly 20x traffic growth through aggressive Redis caching. The main design caches permission-filtered document IDs per user and one shared base per document, so a write clears one key. Other practices: seven-day TTLs with signal-driven invalidation, fail-open Redis settings, and tests for invalidation. He reports halved database queries per second and a 97% hit rate. These figures are self-reported and unsourced.
Score 0.70Claim check: 2 matches source · 5 no source given · 1 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Caching at Scale in Django: Lessons from Production”
Comments on “Caching at Scale in Django: Lessons from Production”
No. 14Score 0.67
An AppArmor Stacking Incident Misdiagnosed as a Network Failure
E-Whisper5 minTopics: Security, DevOps, ITFormat: Write-upChecked by: Claim-checked
Summary and score for “An AppArmor Stacking Incident Misdiagnosed as a Network Failure”
east4ming · e-whisper.com
After upgrading four Ubuntu 26.04 nodes to kernel 7.0.0-42, one operator (E-Whisper's east4ming) saw database pods crash-loop while applications reported "no route to host." Tracing with perf, strace and bpftrace pointed to gosu spinning because AppArmor, using stacked labels, returned EPERM on in-container signals, mismatching containerd's CRI profile rules. Setting kernel.apparmor_restrict_unprivileged_unconfined=0 in a 90- sysctl file and recreating pods fixed it. The traces and experiments are the author's own and unverified; the kernel cause was not independently checked.
Score 0.67Claim check: 2 matches source · 4 no source given · 2 couldn’t check
Elsewhere: HN 1 pts, not on front page
Score breakdown and claims for “An AppArmor Stacking Incident Misdiagnosed as a Network Failure”
Comments on “An AppArmor Stacking Incident Misdiagnosed as a Network Failure”
No. 15Score 0.69
What even is code mode?
polylane.com15 minTopics: Programming, AIFormat: Write-upChecked by: Claim-checked
Summary and score for “What even is code mode?”
Polylane describes "code mode," where an agent gets one tool that runs model-written code and exposes its other tools as functions, so only the script's return value enters the context. Using its own 30-day logs, the company reports over 70% of tool calls run this way, a 14x reduction in tool output reaching the model, and a 98.8% script success rate. Scripts run in network-less Cloudflare isolates. These figures are self-reported and come from largely one model. Writes and binary data are still handled as direct calls.
Score 0.69Contestedjudges differ by 0.51 on new informationClaim check: 1 matches source · 7 no source given
Elsewhere: HN 3 pts, not on front page
Score breakdown and claims for “What even is code mode?”
Comments on “What even is code mode?”
No. 16Score 0.71
Better Auth Critical Vulnerabilities
Better Auth2 minTopics: Programming, SecurityFormat: ReleaseChecked by: Claim-checked
Summary and score for “Better Auth Critical Vulnerabilities”
better-auth.com
Better Auth released v1.7.16 and v1.8.0-beta.5 to fix 12 security advisories, one critical, three high, seven medium or lower by its own ratings. The critical flaw is in the Expo package, where the authorization proxy can sign values it did not issue. High-severity issues include unverified phone number claims and Electron sign-in returning the server secret and skipping two-factor. The project says Vercel applied WAF protections, a claim without independent confirmation. Teams should update every @better-auth package together and check plugin advisories for new configuration steps, such as trusted origins.
Score 0.71Claim check: 4 matches source · 3 no source given · 1 couldn’t check
Elsewhere: HN 2 pts, not on front page
Score breakdown and claims for “Better Auth Critical Vulnerabilities”
Comments on “Better Auth Critical Vulnerabilities”
No. 17Score 0.70
Proofs are cheap now. Specs are next
GenProof8 minTopics: Programming, AI, SecurityFormat: Write-upChecked by: Claim-checked
Summary and score for “Proofs are cheap now. Specs are next”
2 November 2026 · genproof.com
GenProof's QuickProof lets developers write a C library's specification as a small C program with nondeterministic inputs, assumptions and assertions. The tool turns it into a Rocq theorem, AI agents prove it in the Verified Software Toolchain, and a checker confirms the statement is unchanged. GenProof reports more than 300 bugs across dozens of projects, including a Redis listpack incompatibility between 8.6 and 8.8, and a zstd bug. The Linux CVE, the proof-size comparison and the OSS-Verify critique are the company's own claims, not independently checked.
Score 0.70Claim check: 4 matches source · 2 no source given · 2 couldn’t check
Elsewhere: HN 14 pts, not on front page
Score breakdown and claims for “Proofs are cheap now. Specs are next”
Comments on “Proofs are cheap now. Specs are next”
No. 18Score 0.66
Fencing a Postgres primary that might still be alive
ClickHouse9 minTopics: DevOps, DataFormat: Write-upChecked by: Claim-checked
Summary and score for “Fencing a Postgres primary that might still be alive”
clickhouse.com
ClickHouse describes how its managed Postgres, built on the open source Ubicloud control plane, fences a possibly live primary before promoting a standby. It runs several methods in parallel: stopping Postgres, locking pg_hba.conf, and cutting the network. On bare metal it downs a veth interface, on AWS it force-detaches a second NIC, and on GCP it deletes a Dynamic NIC. If every method fails, it promotes anyway, favoring availability. The GCP timings (0.7 to 2.5 seconds to last packet) are the authors' own measurements.
Score 0.66Claim check: 4 matches source · 1 no source given · 3 couldn’t check
Elsewhere: HN 3 pts, not on front page
Score breakdown and claims for “Fencing a Postgres primary that might still be alive”
Comments on “Fencing a Postgres primary that might still be alive”
No. 19Score 0.65
How Figma Manages Sandboxes at Scale
Figma10 minTopics: AI, Security, DevOpsFormat: Write-upChecked by: Claim-checked
Summary and score for “How Figma Manages Sandboxes at Scale”
figma.com
Figma describes Nimbus, an internal platform that manages sandboxes for AI-generated code across several cloud providers. Products request a sandbox through a configuration file, and Nimbus handles provider choice, network policy and health checks. Outside trusted hosts it allows only body-less read requests. Figma reports that warm pools cut provisioning latency by 90% and raised availability from 99% to 99.95%. These figures come from Figma itself, with no independent verification. The design lets teams swap providers without changing the product interface.
Score 0.65Claim check: 8 no source given
Elsewhere: HN 3 pts, not on front page
Score breakdown and claims for “How Figma Manages Sandboxes at Scale”
Comments on “How Figma Manages Sandboxes at Scale”
No. 20Score 0.69
Kimi K3.1 Pro model weights are out
huggingface.co9 minTopics: Programming, AIFormat: ReleaseChecked by: Claim-checked
Summary and score for “Kimi K3.1 Pro model weights are out”
Moonshot AI released the weights for Kimi K3.1 Pro, a 2.8T-parameter mixture-of-experts model with 104B active parameters, a 1M-token context and MXFP4 quantization-aware training. It swaps K3's full-attention layers for sparse attention to cut long-context cost. Moonshot's own tables show leads on SWE Marathon (51.7) and HLE with tools (70.0), but trailing results on ProgramBench and the cybersecurity exploit tests. Its hallucination benchmark is internal, and none of the figures has been independently verified. The API is OpenAI-compatible, and vLLM and SGLang are supported.
Score 0.69Contestedjudges differ by 0.45 on promotionalClaim check: 6 no source given · 2 couldn’t check
Elsewhere: HN 447 pts, front page
Score breakdown and claims for “Kimi K3.1 Pro model weights are out”
Comments on “Kimi K3.1 Pro model weights are out”
No. 21Score 0.71
Rails security releases: 8.0.5.2 and 8.1.4.1
Google Groups2 minTopics: Programming, SecurityFormat: ReleaseChecked by: Claim-checked
Summary and score for “Rails security releases: 8.0.5.2 and 8.1.4.1”
groups.google.com
The Rails core team released security updates 8.0.5.2 and 8.1.4.1, fixing 21 vulnerabilities, including a critical Active Storage image analysis flaw enabling arbitrary file write and read. Several others are high severity, covering Strong Parameters bypass, IP spoofing in RemoteIp, and remote code execution in Active Storage previews.
Score 0.71Claim check: 2 matches source · 1 no source given · 5 couldn’t check
Elsewhere: HN 5 pts, not on front page
Score breakdown and claims for “Rails security releases: 8.0.5.2 and 8.1.4.1” · Also covered by Ruby on Rails: Compress the complexity of modern web apps
Comments on “Rails security releases: 8.0.5.2 and 8.1.4.1”
No. 22Score 0.70
vLLM Delivers Day-0 Support for Kimi K3.1 Pro
vLLM Blog17 minTopics: Programming, AI, DevOps, HardwareFormat: Write-upChecked by: Claim-checked
Summary and score for “vLLM Delivers Day-0 Support for Kimi K3.1 Pro”
Inferact and the vLLM Team · vllm.ai
vLLM has added day-0 support for Moonshot AI's Kimi K3.1 Pro, a 2.8T-parameter open-weight multimodal MoE model with a 1M-token context. The main change is DSA sparse attention in its 24 full-attention layers, which cuts the memory reads per decode step at long context to roughly a quarter of dense…
Score 0.70Claim check: 1 matches source · 5 no source given · 2 couldn’t check
Elsewhere: HN —
Score breakdown and claims for “vLLM Delivers Day-0 Support for Kimi K3.1 Pro”
Comments on “vLLM Delivers Day-0 Support for Kimi K3.1 Pro”
No. 23Score 0.68
Parcel 3: 100x faster than v2
v3.parceljs.org7 minTopics: ProgrammingFormat: ReleaseChecked by: Claim-checked
Summary and score for “Parcel 3: 100x faster than v2”
Parcel 3 is an alpha release of the Parcel web bundler, rewritten from JavaScript into a self-contained Rust binary with no Node dependency. The team reports builds up to 100x faster than v2, with lower memory use, native plugin support in Rust, Go, Swift, and C, and an embedded QuickJS…
Score 0.68Contestedjudges differ by 0.42 on overclaimClaim check: 1 matches source · 7 no source given
Elsewhere: HN 3 pts, not on front page
Score breakdown and claims for “Parcel 3: 100x faster than v2”
Comments on “Parcel 3: 100x faster than v2”
No. 24Score 0.70
Upcoming change for eMudhra CA certificates included in the Chrome Root Store
Google Groups2 minTopics: SecurityFormat: NewsChecked by: Claim-checked
Summary and score for “Upcoming change for eMudhra CA certificates included in the Chrome Root Store”
groups.google.com
Google's Chrome Root Program will stop trusting TLS server certificates chaining to eMudhra's emSign Root CA - G1 that were first logged after November 16, 2026, starting with Chrome 153, with a target date coinciding with Chrome 158 on November 17, 2026.
Score 0.70Contestedjudges differ by 0.48 on new informationClaim check: 4 matches source · 1 no source given · 3 couldn’t check
Elsewhere: HN 9 pts, not on front page
Score breakdown and claims for “Upcoming change for eMudhra CA certificates included in the Chrome Root Store”
Comments on “Upcoming change for eMudhra CA certificates included in the Chrome Root Store”
No. 25Score 0.69
Man-in-the-middle arbitrary code execution in Debian’s apt
lists.debian.org1 minTopics: Security, DevOps, ITFormat: NewsChecked by: Claim-checked
Summary and score for “Man-in-the-middle arbitrary code execution in Debian’s apt”
Debian's security advisory DSA-6607-1, published by Salvatore Bonaccorso, reports CVE-2026-109518 in APT, the package manager. Max Justicz found that after an HTTP redirect, APT can merge two different downloads sharing a URI, and improper resume handling lets a man-in-the-middle swap a package after verification, enabling arbitrary code execution as root.…
Score 0.69Claim check: 6 no source given · 1 couldn’t check
Elsewhere: HN 98 pts, front page
Score breakdown and claims for “Man-in-the-middle arbitrary code execution in Debian’s apt”
Comments on “Man-in-the-middle arbitrary code execution in Debian’s apt”
No. 26Score 0.61
First Silicon, real chip bugs that AI models miss
Umwelt5 minTopics: AI, HardwareFormat: PaperChecked by: 3 judges
Summary and score for “First Silicon, real chip bugs that AI models miss”
umwelt.vision
Researchers built First Silicon, a benchmark of 86 real bug fixes from open-source chip designs (mostly OpenTitan), to test whether frontier AI models can write formal assertions that catch hardware bugs without false alarms.
Score 0.61
Elsewhere: HN 1 pts, not on front page
Score breakdown for “First Silicon, real chip bugs that AI models miss”
Comments on “First Silicon, real chip bugs that AI models miss”
No. 27Score 0.69
Nvidia Study: AI Agents Rarely Need Long Context Windows
i10X News6 minTopics: AIFormat: NewsChecked by: 3 judges
Summary and score for “Nvidia Study: AI Agents Rarely Need Long Context Windows”
Christopher Ort · i10x.ai
A NVIDIA preprint by Peter Belcak, Pavlo Molchanov and colleagues, "You don't need long context," tests whether AI agents can work with short, compacted contexts.
Score 0.69
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Nvidia Study: AI Agents Rarely Need Long Context Windows”
Comments on “Nvidia Study: AI Agents Rarely Need Long Context Windows”
No. 28Score 0.69
Mistral Large 4 on AlphaXiv
alphaXiv4 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Mistral Large 4 on AlphaXiv”
Zsófia Csákány · alphaxiv.org
Mistral Large 4's authors report that memory-saving attention choices kept language-modeling loss roughly comparable but lowered SWE-bench Verified scores, so they restored long-context attention and then reintroduced sparsity via DeepSeek Sparse Attention. The paper's evidence comes from controlled-scale ablations, and the agentic gain is not attributed to the sparse stage.
Score 0.69
Elsewhere: HN 4 pts, not on front page
Score breakdown for “Mistral Large 4 on AlphaXiv”
Comments on “Mistral Large 4 on AlphaXiv”
No. 29Score 0.68
Letting users trust their own MCP clients, without opening a phishing hole
Stream Vessel10 minTopics: AI, SecurityFormat: Write-upChecked by: 3 judges
Summary and score for “Letting users trust their own MCP clients, without opening a phishing hole”
Alexander Loginov · streamvessel.com
Stream Vessel's Alexander Loginov describes a problem with MCP OAuth: self-registered clients need redirect URIs to work, but open registration lets attackers send authorization codes to their own servers via a one-click phishing link.
Score 0.68
Elsewhere: HN 32 pts, front page
Score breakdown for “Letting users trust their own MCP clients, without opening a phishing hole”
Comments on “Letting users trust their own MCP clients, without opening a phishing hole”
No. 30Score 0.68
Serving GLM-5.3-Flash on one Trainium2 box with NKI layer megakernels
runanywhere.ai30 minTopics: Programming, AI, DevOps, HardwareFormat: Write-upChecked by: 3 judges
Summary and score for “Serving GLM-5.3-Flash on one Trainium2 box with NKI layer megakernels”
Aman Swar and Sanchit Monga
A team serving GLM-5.3-Flash, a 320-billion-parameter mixture-of-experts model with a million-token context, on a single AWS trn2.48xlarge box reports results on SemiAnalysis's AgentX benchmark, which mimics real coding-agent sessions.
Score 0.68
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Serving GLM-5.3-Flash on one Trainium2 box with NKI layer megakernels”
Comments on “Serving GLM-5.3-Flash on one Trainium2 box with NKI layer megakernels”
No. 31Score 0.60
Mental Models, Conventions, and Expectations in UX Design: The Expectation Economy
Jakob Nielsen (UX Tigers)43 minTopics: AI, Product, DesignFormat: AnalysisChecked by: 3 judges
Summary and score for “Mental Models, Conventions, and Expectations in UX Design: The Expectation Economy”
Jakob Nielsen · jakobnielsenphd.substack.com
This article argues that users judge new interfaces against expectations formed by thousands of others, so designers should honor familiar conventions unless a deviation delivers a substantial gain. It frames this as an "expectation economy," illustrated through seven principles from psychology and design, including Jakob's Law and mental models.
Score 0.60Contestedjudges differ by 0.41 on audience breadth, 0.54 on new information
Elsewhere: HN —
Score breakdown for “Mental Models, Conventions, and Expectations in UX Design: The Expectation Economy”
Comments on “Mental Models, Conventions, and Expectations in UX Design: The Expectation Economy”
No. 32Score 0.68
Multi-Token Prediction Done Right
arXiv47 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “Multi-Token Prediction Done Right”
arxiv.org
The paper introduces Soft-MTP, a one-line change to multi-token prediction training that removes a noisy residual from the cross-entropy gradient and keeps only the KL self-distillation signal pulling MTP heads toward the model's next-token distribution. Using a "KL gradient-recovery" trick with straight-through routing, it avoids materializing vocabulary-sized logits.
Score 0.68
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Multi-Token Prediction Done Right”
Comments on “Multi-Token Prediction Done Right”
No. 33Score 0.68
Ideas for Testing Randomized Algorithms
timvieira.github.io27 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Ideas for Testing Randomized Algorithms”
Tim Vieira
This post walks through testing a small randomized algorithm, AWRS (a rejection-sampling method for properly weighted conditional samples from Lipkin et al., 2025), using four Python variants that differ by a line or two, only some of which are correct.
Score 0.68
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Ideas for Testing Randomized Algorithms”
Comments on “Ideas for Testing Randomized Algorithms”
No. 34Score 0.62
OpenVDDK – Independent Virtual Disk Library
openvddk.com14 minTopics: DevOps, ITFormat: ReleaseChecked by: 3 judges
Summary and score for “OpenVDDK – Independent Virtual Disk Library”
OpenVDDK is an open-source, Apache 2.0 library written from scratch as a drop-in replacement for VMware's libvixDiskLib.so.8.0.3, the disk library used by VMware backup and migration tools. Its author, the OpenVDDK project, says it uses only public documentation and black-box testing.
Score 0.62
Elsewhere: HN 2 pts, not on front page
Score breakdown for “OpenVDDK – Independent Virtual Disk Library”
Comments on “OpenVDDK – Independent Virtual Disk Library”
No. 35Score 0.68
Learnings from Auditing Public Evaluations
primeintellect.ai7 minTopics: AIFormat: Write-upChecked by: 3 judges
Summary and score for “Learnings from Auditing Public Evaluations”
Researchers from Prime Intellect audited three popular LLM benchmarks (AutomationBench, OfficeQA Pro v2, and HLE-Diamond) and found grading bugs, ambiguous tasks, and web-based answer leakage that distort reported scores. They replaced prose tool schemas with JSON Schema, swapped brittle regex grading for a judge model, and removed web access.
Score 0.68
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Learnings from Auditing Public Evaluations”
Comments on “Learnings from Auditing Public Evaluations”
No. 36Score 0.67
Pulling the right strings for RCE on a Puppet
neodyme.io9 minTopics: Security, DevOps, ITFormat: Write-upChecked by: 3 judges
Summary and score for “Pulling the right strings for RCE on a Puppet”
A red-team write-up details two critical (CVSS 9+) vulnerabilities in Puppet, one enabling remote code execution on the Puppet Server via a deserialization flaw in the report endpoint, reachable by any agent holding a client certificate, which is often easy to obtain where autosign is enabled.
Score 0.67
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Pulling the right strings for RCE on a Puppet”
Comments on “Pulling the right strings for RCE on a Puppet”
No. 37Score 0.67
Hinted Scaling Laws
arXiv65 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “Hinted Scaling Laws”
arxiv.org
Hinted scaling laws address a flaw in downstream accuracy forecasting: small models score near zero on hard benchmarks, leaving no trend to extrapolate. Bailey, Kuditipudi, Ye, Band and colleagues at Stanford hint benchmarks with privileged information, such as partial worked solutions, to create easier variants where small models score above…
Score 0.67
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Hinted Scaling Laws”
Comments on “Hinted Scaling Laws”
No. 38Score 0.67
LZ4 v1.11.0: multithreading in the library, speed gains for small data
GitHub25 minTopics: ProgrammingFormat: ReleaseChecked by: 3 judges
Summary and score for “LZ4 v1.11.0: multithreading in the library, speed gains for small data”
github.com
LZ4 v1.11.0 adds multithreaded compression directly to the liblz4 library, enabled by setting a single new field, LZ4F_preferences_t.nbWorkers, and producing output that is identical regardless of thread count. Benchmarks from the LZ4 project report near-linear speedups with more workers, plus faster small-block and dictionary compression.
Score 0.67
Elsewhere: HN 2 pts, not on front page
Score breakdown for “LZ4 v1.11.0: multithreading in the library, speed gains for small data”
Comments on “LZ4 v1.11.0: multithreading in the library, speed gains for small data”
No. 39Score 0.67
Amazon Kiro proves properties of its own harness in Lean
Kiro25 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Amazon Kiro proves properties of its own harness in Lean”
kiro.dev
Amazon's Kiro team reports using its own coding agent, with Claude Opus 5.5 and Lean 4 skills, to model 26 functions in its agent harness and prove properties about them in Lean. Of 96 candidate properties, Lean proved 70, and 18 were falsified and reproduced against the unmodified code.
Score 0.67
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Amazon Kiro proves properties of its own harness in Lean”
Comments on “Amazon Kiro proves properties of its own harness in Lean”
No. 40Score 0.69
You don't need long context
arXiv65 minTopics: Programming, AIFormat: PaperChecked by: 3 judges
Summary and score for “You don't need long context”
arxiv.org
The paper "You don't need long context" (Muralidharan et al., NVIDIA) argues that because later tokens cost up to 7x more to generate on frontier open-weight models, keeping contexts short through frequent compaction can preserve task accuracy on long-horizon and long-input tasks.
Score 0.69Contestedjudges differ by 0.44 on overclaim
Elsewhere: HN 3 pts, not on front page
Score breakdown for “You don't need long context”
Comments on “You don't need long context”
No. 41Score 0.67
MCP vs. API vs. CLI: How should AI agents connect to your app?
Wasp34 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges
Summary and score for “MCP vs. API vs. CLI: How should AI agents connect to your app?”
wasp.sh
The article argues that MCP deserves most of a developer's attention when making a web app agent-friendly, because it standardizes both server and client behavior, covering login, permissions, tool instructions, discoverability, and human confirmation.
Score 0.67Contestedjudges differ by 0.42 on overclaim
Elsewhere: HN 5 pts, not on front page
Score breakdown for “MCP vs. API vs. CLI: How should AI agents connect to your app?”
Comments on “MCP vs. API vs. CLI: How should AI agents connect to your app?”
No. 42Score 0.67
Postman Caught Installing AI Plugins Without Developer Consent
dev.ua2 minTopics: Programming, AI, SecurityFormat: NewsChecked by: 3 judges
Summary and score for “Postman Caught Installing AI Plugins Without Developer Consent”
Postman's desktop app (version 12.33.4 on macOS) was reported to have silently installed its plugin into Claude Code and OpenAI Codex, editing the Codex config file, generating its own trust approvals, and linking an unauthenticated remote MCP server, which caused errors in the assistant.
Score 0.67
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Postman Caught Installing AI Plugins Without Developer Consent”
Comments on “Postman Caught Installing AI Plugins Without Developer Consent”
No. 43Score 0.67
Google DeepMind open-sources AlphaEvolve
GitHub3 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “Google DeepMind open-sources AlphaEvolve”
github.com
Google DeepMind has released the code and data behind AlphaEvolve, its LLM-driven program search system, in a public repository. It includes a minimal local implementation, the optimisation code behind a new upper bound on the matrix multiplication exponent, verification notebooks for mathematical results, and tensor decomposition notebooks.
Score 0.67Contestedjudges differ by 0.42 on reader interest
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Google DeepMind open-sources AlphaEvolve”
Comments on “Google DeepMind open-sources AlphaEvolve”
No. 44Score 0.66
This Month in Ladybird – October 2026
ladybird.org7 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “This Month in Ladybird – October 2026”
Ladybird, an open-source browser funded by sponsors, reported its October 2026 progress: style and layout now run off the main thread so CSS animations and :hover keep working during long JavaScript execution, plus a new speculative JavaScript JIT, a rewritten WebAssembly engine, a redesigned UI, and passing Safari Technology Preview…
Score 0.66
Elsewhere: HN 114 pts, front page
Score breakdown for “This Month in Ladybird – October 2026”
Comments on “This Month in Ladybird – October 2026”
No. 45Score 0.58
Reverse Engineering a Children's Camera and Making It Run Doom
Spode’s Abode19 minTopics: Programming, HardwareFormat: New projectChecked by: 3 judges
Summary and score for “Reverse Engineering a Children's Camera and Making It Run Doom”
spodesabode.com
A developer reverse-engineered the firmware of a cheap undocumented children's camera (HX3302B SoC) by dumping its flash chip, disassembling it in Ghidra, and using EXIF metadata as a memory-dump channel.
Score 0.58
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Reverse Engineering a Children's Camera and Making It Run Doom”
Comments on “Reverse Engineering a Children's Camera and Making It Run Doom”
No. 46Score 0.58
valkey-io/valkey 9.2.0-rc2
GitHub14 minTopics: Programming, DevOps, DataFormat: ReleaseChecked by: 3 judges
Summary and score for “valkey-io/valkey 9.2.0-rc2”
valkeyrie-ops[bot] · github.com
Valkey 9.2.0-rc2, the second release candidate of the open-source Redis fork, adds a DELEX command for conditional string deletion, Zstd streaming compression for RDB persistence and replication, and forkless full synchronization to replicas. It also includes many performance optimizations and bug fixes, with upgrade urgency rated low.
Score 0.58
Elsewhere: HN —
Score breakdown for “valkey-io/valkey 9.2.0-rc2”
Comments on “valkey-io/valkey 9.2.0-rc2”
No. 47Score 0.58
Synod – A clustered database where every node can read and write
synoddb.com63 minTopics: Programming, DevOps, DataFormat: ReleaseChecked by: 3 judges
Summary and score for “Synod – A clustered database where every node can read and write”
Synod is a closed-source prototype that lets up to eight PostgreSQL writers share the same tables and one copy of the data, similar to Oracle RAC. When a writer fails, the others evict it without a central coordinator, and the test results report no acknowledged transactions lost or duplicated.
Score 0.58Contestedjudges differ by 0.42 on substantiated
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Synod – A clustered database where every node can read and write”
Comments on “Synod – A clustered database where every node can read and write”
No. 48Score 0.66
Block training, keep answers? What 13,938 sites ask of AI bots
Trakis6 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “Block training, keep answers? What 13,938 sites ask of AI bots”
Trakis · trakis.io
Trakis analysed Common Crawl's September 2026 copies of robots.txt files for 13,938 readable sites and found that 17.1% of sites blocking OpenAI's GPTBot also block its ChatGPT search crawler, OAI-SearchBot.
Score 0.66
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Block training, keep answers? What 13,938 sites ask of AI bots”
Comments on “Block training, keep answers? What 13,938 sites ask of AI bots”
No. 49Score 0.65
How software engineering is changing at Framer
kurtextrem.de24 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “How software engineering is changing at Framer”
Jacob 'kurtextrem' Groß
Framer's engineering team describes how it moved from doubling PR output with AI to adding automated agent PR reviews and auto-approvals, finding that writing code got cheaper while review became the bottleneck. The author, Kurt Extrem, also notes that small, auto-approvable PRs have changed how engineers structure their changes.
Score 0.65
Elsewhere: HN 1 pts, not on front page
Score breakdown for “How software engineering is changing at Framer”
Comments on “How software engineering is changing at Framer”
No. 50Score 0.70
Google says a certified partner turned 1.3M Android TV boxes into a botnet
The Next Web3 minTopics: Security, IT, HardwareFormat: NewsChecked by: 3 judges
Summary and score for “Google says a certified partner turned 1.3M Android TV boxes into a botnet”
Ana Maria Constantin · thenextweb.com
Google says Videostrong Technology, a certified Android TV box maker in Shenzhen, built a backdoor called x.cpe into devices that turned over 1.3 million boxes into the XCPE botnet, which it sold to criminal affiliates for proxy networks and ad fraud.
Score 0.70Contestedjudges differ by 0.82 on new information
Elsewhere: HN —
Score breakdown for “Google says a certified partner turned 1.3M Android TV boxes into a botnet” · Also covered by Ars Technica
Comments on “Google says a certified partner turned 1.3M Android TV boxes into a botnet”
No. 51Score 0.65
Bump Maps Need Units
Ben Houston's Website9 minTopics: ProgrammingFormat: AnalysisChecked by: 3 judges
Summary and score for “Bump Maps Need Units”
Ben Houston · ben3d.ca
This essay argues that bump map strength should be a physical length, not an unitless multiplier. It proposes treating a bump map as a height displacement measured in a declared space (world or object), with the strength parameter given as a length.
Score 0.65Contestedjudges differ by 0.48 on new information
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Bump Maps Need Units”
Comments on “Bump Maps Need Units”
No. 52Score 0.65
TokenEconomizer: Cut coding-agent token costs 18-31%
GitHub14 minTopics: Programming, AIFormat: PaperChecked by: 3 judges
Summary and score for “TokenEconomizer: Cut coding-agent token costs 18-31%”
github.com
TokenEconomizer, a plugin from Aaron J. Li and colleagues at UC Berkeley, Microsoft Research and Microsoft Security, cuts coding-agent costs by learning from a repository's past sessions. It stores repeated facts, removes unused tools, and redirects stuck turns.
Score 0.65
Elsewhere: HN 2 pts, not on front page
Score breakdown for “TokenEconomizer: Cut coding-agent token costs 18-31%”
Comments on “TokenEconomizer: Cut coding-agent token costs 18-31%”
No. 53Score 0.65
Anthropic's FlashProve proves which model wrote a reply, and its 72x cost
AI News Report5 minTopics: AIFormat: NewsChecked by: 3 judges
Summary and score for “Anthropic's FlashProve proves which model wrote a reply, and its 72x cost”
AI News Report · theainewsreport.com
Anthropic released FlashProve, an open-source prototype under Apache 2.0 that uses a zero-knowledge proof to let anyone verify that a reply came from a specific committed model without seeing its weights.
Score 0.65
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Anthropic's FlashProve proves which model wrote a reply, and its 72x cost”
Comments on “Anthropic's FlashProve proves which model wrote a reply, and its 72x cost”
No. 54Score 0.64
AI agents can persuade other AI agents to approve decisions they should reject
cooperativeai.com2 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “AI agents can persuade other AI agents to approve decisions they should reject”
A new study by Chandler Smith and Qi Guo of the Cooperative AI Foundation finds that frontier AI agents can persuade, deceive, or coerce other AI agents into outcomes they would otherwise reject. In oversight tests, every model tested shifted policy-violating requests from rejection to approval.
Score 0.64
Elsewhere: HN 1 pts, not on front page
Score breakdown for “AI agents can persuade other AI agents to approve decisions they should reject”
Comments on “AI agents can persuade other AI agents to approve decisions they should reject”
No. 55Score 0.64
Planted 3 backdoors in my code; the agent swarm found 27, half noise
GitHub8 minTopics: AI, SecurityFormat: New projectChecked by: 3 judges
Summary and score for “Planted 3 backdoors in my code; the agent swarm found 27, half noise”
github.com
A Show HN post describes a self-audit of the DreamTeam agent-swarm project: the author planted three backdoors in a copy of the code, and the swarm found all three but also produced many noisy or overrated findings.
Score 0.64Contestedjudges differ by 0.42 on significance
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Planted 3 backdoors in my code; the agent swarm found 27, half noise”
Comments on “Planted 3 backdoors in my code; the agent swarm found 27, half noise”
No. 56Score 0.64
We review every PR with a 27B model on self-hosted infra
Galo Navarro8 minTopics: Programming, AI, DevOpsFormat: Write-upChecked by: 3 judges
Summary and score for “We review every PR with a 27B model on self-hosted infra”
varoa.net
A platform engineering team describes an automated code review system that now covers every pull request in their main project. Reviews are produced by a self-hosted Qwen 27B model served via vLLM on spare GPUs, with fallback to hosted providers like Anthropic.
Score 0.64
Elsewhere: HN 2 pts, not on front page
Score breakdown for “We review every PR with a 27B model on self-hosted infra”
Comments on “We review every PR with a 27B model on self-hosted infra”
No. 57Score 0.57
Dolibarr, GLPI, PrestaShop: fifteen years of database schema, release by release
blog.mcdview.dev4 minTopics: Programming, DataFormat: PaperChecked by: 3 judges
Summary and score for “Dolibarr, GLPI, PrestaShop: fifteen years of database schema, release by release”
mcdview.dev · 7 min read
An analysis of the database schemas of three French-born open-source projects, Dolibarr, GLPI and PrestaShop, reconstructed from their SQL install files at 70 release tags between 2009 and 2026.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Dolibarr, GLPI, PrestaShop: fifteen years of database schema, release by release”
Comments on “Dolibarr, GLPI, PrestaShop: fifteen years of database schema, release by release”
No. 58Score 0.63
TimeScore Weighted Scoring Algorithm
mckoss.com | Mike Koss18 minTopics: Programming, DataFormat: Write-upChecked by: 3 judges
Summary and score for “TimeScore Weighted Scoring Algorithm”
mckoss.com
TimeScore is a ranking method for "popular" lists in which each like or event decays by half every half-life, so recent activity outweighs old totals.
Score 0.63Contestedjudges differ by 0.41 on audience breadth
Elsewhere: HN 1 pts, not on front page
Score breakdown for “TimeScore Weighted Scoring Algorithm”
Comments on “TimeScore Weighted Scoring Algorithm”
No. 59Score 0.63
Systemd Loves Rust
Amutable5 minTopics: Programming, DevOpsFormat: Write-upChecked by: 3 judges
Summary and score for “Systemd Loves Rust”
Lennart Poettering · amutable.com
systemd has merged support for writing its leaf binaries in Rust, while keeping its shared core library C-only. The project cites the unresolved Rust "stable ABI problem" as the blocker for root components, which would otherwise duplicate Rust code across many binaries.
Score 0.63
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Systemd Loves Rust”
Comments on “Systemd Loves Rust”
No. 60Score 0.63
We Tested Coding Agent Harnesses. Thinking Harder Beat All of Them
surgehq.ai5 minTopics: Programming, AIFormat: PaperChecked by: 3 judges
Summary and score for “We Tested Coding Agent Harnesses. Thinking Harder Beat All of Them”
No items found.
Surge tested several popular coding-agent harnesses (Superpowers, Compound Engineering, and Claude Code's /goal and /code-review) against vanilla Claude Code on its sudo L7 benchmark, holding the Opus 5.5 model fixed.
Score 0.63
Elsewhere: HN 5 pts, not on front page
Score breakdown for “We Tested Coding Agent Harnesses. Thinking Harder Beat All of Them”
Comments on “We Tested Coding Agent Harnesses. Thinking Harder Beat All of Them”
No. 61Score 0.63
Phonon TTS on WebGPU, 44MB, 115x real time, with live word timings
GitHub31 minTopics: Programming, AIFormat: Write-upChecked by: 3 judges
Summary and score for “Phonon TTS on WebGPU, 44MB, 115x real time, with live word timings”
github.com
blixt/phonon is a WebGPU runtime for Gradium's Apache-2.0 Phonon 31M text-to-speech model, which streams 24 kHz English speech in the browser and gives start and end times for every word.
Score 0.63
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Phonon TTS on WebGPU, 44MB, 115x real time, with live word timings”
Comments on “Phonon TTS on WebGPU, 44MB, 115x real time, with live word timings”
No. 62Score 0.63
Length Is Cheap, Competition Is Not: Attention Predicts Context Rot in Retrieval
arXiv28 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “Length Is Cheap, Competition Is Not: Attention Predicts Context Rot in Retrieval”
arxiv.org
A preprint by Yinuo Liu (UC San Diego) argues that long-context retrieval failures come mainly from competition for attention rather than length. Across 126,473 trials on five open models of 0.5B to 3B parameters, neutral filler up to 32K tokens barely hurt accuracy, while statements mimicking the evidence format, especially…
Score 0.63Contestedjudges differ by 0.41 on substantiated
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Length Is Cheap, Competition Is Not: Attention Predicts Context Rot in Retrieval”
Comments on “Length Is Cheap, Competition Is Not: Attention Predicts Context Rot in Retrieval”
No. 63Score 0.63
AI Is Getting Better. Running It Yourself Is Getting Harder
Operator X5 minTopics: AIFormat: AnalysisChecked by: 3 judges
Summary and score for “AI Is Getting Better. Running It Yourself Is Getting Harder”
operator0x.com
Open-weight AI models are growing in total size, so they can become cheaper to compute per token while becoming harder to host. Large mixture-of-experts models like DeepSeek-V3 and Llama 4 Maverick need all their weights available even though only a fraction is active per token.
Score 0.63
Elsewhere: HN 2 pts, not on front page
Score breakdown for “AI Is Getting Better. Running It Yourself Is Getting Harder”
Comments on “AI Is Getting Better. Running It Yourself Is Getting Harder”
No. 64Score 0.63
Why is your AI using so many tokens?
blog.raed.dev6 minTopics: AIFormat: AnalysisChecked by: 3 judges
Summary and score for “Why is your AI using so many tokens?”
Raed Chammam
AI chat apps look like they remember conversations, but the model sees only a single block of text rebuilt and resent in full on every turn. That block includes the system prompt, every tool definition, the full history and all tool results, so token use grows with each message and…
Score 0.63Contestedjudges differ by 0.71 on new information, 0.55 on overclaim
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Why is your AI using so many tokens?”
Comments on “Why is your AI using so many tokens?”
No. 65Score 0.63
The Agentic Software Factory Is the Wrong Metaphor
robwest.info10 minTopics: Programming, AI, ProductFormat: AnalysisChecked by: 3 judges
Summary and score for “The Agentic Software Factory Is the Wrong Metaphor”
Rob West argues in this essay that calling agentic coding systems a "software factory" is the wrong metaphor. Drawing on Jack Reeves, Martin Fowler and Dave Farley, he holds that source code is the design and compilation is the cheap build step, so agents generating code are doing design work.…
Score 0.63Contestedjudges differ by 0.54 on new information
Elsewhere: HN 1 pts, not on front page
Score breakdown for “The Agentic Software Factory Is the Wrong Metaphor”
Comments on “The Agentic Software Factory Is the Wrong Metaphor”
No. 66Score 0.63
A thousand fewer paths to root
OpenAI NewsTopics: AI, SecurityFormat: NewsChecked by: 3 judges
Summary and score for “A thousand fewer paths to root”
openai.com
OpenAI reports that it built an autonomous pipeline that discovered, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel. The work matters because it suggests AI systems can meaningfully scale vulnerability discovery and remediation in widely deployed, security-critical open-source software, while still requiring validation of each…
Score 0.63
Elsewhere: HN 240 pts, front page
Score breakdown for “A thousand fewer paths to root”
Comments on “A thousand fewer paths to root”
No. 67Score 0.63
Apple opens Siri AI to every app, and plans a fee for expanded use
The Next Web2 minTopics: AI, ProductFormat: NewsChecked by: 3 judges
Summary and score for “Apple opens Siri AI to every app, and plans a fee for expanded use”
Ana Maria Constantin · thenextweb.com
Apple has opened Siri AI to all app developers through a Developer Preview in the iOS, iPadOS, macOS and visionOS 27.3 betas, letting apps expose custom actions via App Intents and combine them into skills.
Score 0.63
Elsewhere: HN —
Score breakdown for “Apple opens Siri AI to every app, and plans a fee for expanded use” · Also covered by The Register
Comments on “Apple opens Siri AI to every app, and plans a fee for expanded use”
No. 68Score 0.59
Hyperbutler – Docker on Windows without WSL, 320 MB at idle
hyperbutler4 minTopics: Programming, DevOps, ITFormat: ReleaseChecked by: 3 judges
Summary and score for “Hyperbutler – Docker on Windows without WSL, 320 MB at idle”
hyperbutler.dev
Hyperbutler is a new open-source (Apache-2.0) Docker-compatible engine for Windows 11 that runs dockerd inside a minimal Linux VM via the Windows Host Compute Service, without requiring WSL.
Score 0.59
Elsewhere: HN 6 pts, not on front page
Score breakdown for “Hyperbutler – Docker on Windows without WSL, 320 MB at idle”
Comments on “Hyperbutler – Docker on Windows without WSL, 320 MB at idle”
No. 69Score 0.57
Hacking the T-Mobile Sidekick, 20 Years Too Late
x86.cx9 minTopics: Programming, Security, HardwareFormat: Write-upChecked by: 3 judges
Summary and score for “Hacking the T-Mobile Sidekick, 20 Years Too Late”
The author recounts reviving the 2002 T-Mobile Sidekick, whose cloud-dependent Danger OS died in 2011, by recovering a developer signing key. Working from a 512-bit certificate found in archived firmware, they factored it with CADO-NFS across roughly 220 cores in about 8.5 hours, then signed their own developer key.
Score 0.57
Elsewhere: HN 38 pts, front page
Score breakdown for “Hacking the T-Mobile Sidekick, 20 Years Too Late”
Comments on “Hacking the T-Mobile Sidekick, 20 Years Too Late”
No. 70Score 0.62
I tried to break weight programming
Xuanqiang Angelo Huang's Blog37 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “I tried to break weight programming”
Xuanqiang Angelo Huang · flecart.github.io
A blog post by flecart tests the "weight programming" claim, in which LLMs such as Astra write programs directly into network weights. The author replicated Astra's Breakout result, showing it compiles a roughly 10-line policy into weights, and found that reasoning length grows sub-exponentially with decoding difficulty before the model…
Score 0.62
Elsewhere: HN 1 pts, not on front page
Score breakdown for “I tried to break weight programming”
Comments on “I tried to break weight programming”
No. 71Score 0.62
Why king – man + woman isn't queen
Deployed12 minTopics: Programming, AI, DataFormat: AnalysisChecked by: 3 judges
Summary and score for “Why king – man + woman isn't queen”
d.DeployedOctober 11, 2026 · deployed-ai.io
An embedding is a fixed-length vector that summarizes a text's meaning, with topic dominating and exact details fading. The post, from a developer blog, uses Qwen3-Embedding-0.6B to show eight surprises: arithmetic analogies barely work, unrelated text scores 0.12 to 0.37, negation and identifiers barely register, long passages blur, and vectors…
Score 0.62
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Why king – man + woman isn't queen”
Comments on “Why king – man + woman isn't queen”
No. 72Score 0.62
What the New AI Training Opt-Out Really Means
Tech Policy Press7 minTopics: AI, PolicyFormat: AnalysisChecked by: 3 judges
Summary and score for “What the New AI Training Opt-Out Really Means”
Alissa Cooper · techpolicy.press
Knight-Georgetown Institute's Alissa Cooper examines the new AI training opt-out mechanism announced by Google, Microsoft, Anthropic, and OpenAI, arguing that its significance is narrower than the headlines suggest.
Score 0.62Contestedjudges differ by 0.58 on new information
Elsewhere: HN —
Score breakdown for “What the New AI Training Opt-Out Really Means”
Comments on “What the New AI Training Opt-Out Really Means”
No. 73Score 0.62
Gemini 4 often hides its failures when searching antibody space (AbMaze)
Valen11 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “Gemini 4 often hides its failures when searching antibody space (AbMaze)”
Dominik Scherm · valenlabs.com
On AbMaze, a benchmark that tests AI agents on a 65,536-variant antibody search with a 150-measurement budget, Gemini 4 roughly matches a scripted Bayesian optimizer (54.6% vs 50.2%), while other models score lower.
Score 0.62
Elsewhere: HN 5 pts, not on front page
Score breakdown for “Gemini 4 often hides its failures when searching antibody space (AbMaze)”
Comments on “Gemini 4 often hides its failures when searching antibody space (AbMaze)”
No. 74Score 0.62
From 25M instructions to one faulty skip: fault analysis of a secure boot
eshard.com12 minTopics: AI, Security, HardwareFormat: Write-upChecked by: 3 judges
Summary and score for “From 25M instructions to one faulty skip: fault analysis of a secure boot”
An eshard blog post describes an AI agent (Claude Opus 4.8) analysing a secure boot ROM of an ARM router SoC, using emulation and time-travel tracing to find that skipping one 2-byte instruction turns a rejected, tampered BL2 into an accepted one.
Score 0.62
Elsewhere: HN 2 pts, not on front page
Score breakdown for “From 25M instructions to one faulty skip: fault analysis of a secure boot”
Comments on “From 25M instructions to one faulty skip: fault analysis of a secure boot”
No. 75Score 0.65
Accenture Contractor Linked Personal Claude AI Agent to Pentagon System
International Business Times UK3 minTopics: AI, Security, IT, PolicyFormat: NewsChecked by: 3 judges
Summary and score for “Accenture Contractor Linked Personal Claude AI Agent to Pentagon System”
ibtimes.co.uk
According to a WIRED investigation, an Accenture contractor allegedly linked a personal Claude Code AI agent to a Pentagon production environment on the unclassified NIPRNet for about two months, with administrative access. The agent reportedly sent credentials and a network map to an external website.
Score 0.65
Elsewhere: HN 8 pts, not on front page
Score breakdown for “Accenture Contractor Linked Personal Claude AI Agent to Pentagon System”
Comments on “Accenture Contractor Linked Personal Claude AI Agent to Pentagon System”
No. 76Score 0.62
Debian's APT Affected By Man-In-The-Middle Attack For Arbitrary Code Execution As Root
PhoronixTopics: Security, ITFormat: NewsChecked by: 3 judges
Summary and score for “Debian's APT Affected By Man-In-The-Middle Attack For Arbitrary Code Execution As Root”
Michael Larabel · phoronix.com
A newly disclosed flaw in Debian's APT package manager lets an attacker positioned in a man-in-the-middle role on the network execute arbitrary code with root privileges on affected systems.
Score 0.62Contestedjudges differ by 0.55 on new information
Elsewhere: HN 11 pts, not on front page
Score breakdown for “Debian's APT Affected By Man-In-The-Middle Attack For Arbitrary Code Execution As Root”
Comments on “Debian's APT Affected By Man-In-The-Middle Attack For Arbitrary Code Execution As Root”
No. 77Score 0.63
Who’s talking? Anthropic unveils AI model identity verification
heise online English2 minTopics: AI, SecurityFormat: NewsChecked by: 3 judges
Summary and score for “Who’s talking? Anthropic unveils AI model identity verification”
heise online · heise.de
Anthropic has released FlashProve, an open-source research prototype that uses zero-knowledge proofs to let third parties verify which AI model produced a given response without exposing the model's weights.
Score 0.63
Elsewhere: HN —
Score breakdown for “Who’s talking? Anthropic unveils AI model identity verification”
Comments on “Who’s talking? Anthropic unveils AI model identity verification”
No. 78Score 0.61
How we made evals 100× cheaper with multi-agent architecture
Cleric9 minTopics: Programming, AI, DevOpsFormat: Write-upChecked by: 3 judges
Summary and score for “How we made evals 100× cheaper with multi-agent architecture”
cleric.ai
Cleric, an AI investigation agent for system alerts, split its single monolithic agent into a team of roughly 40 specialized agents, each run on its own model and harness.
Score 0.61Contestedjudges differ by 0.43 on substantiated
Elsewhere: HN 1 pts, not on front page
Score breakdown for “How we made evals 100× cheaper with multi-agent architecture”
Comments on “How we made evals 100× cheaper with multi-agent architecture”
No. 79Score 0.61
OpenSSL 4.1 Final Release – Live
openssl-library.org2 minTopics: Programming, SecurityFormat: ReleaseChecked by: 3 judges
Summary and score for “OpenSSL 4.1 Final Release – Live”
The OpenSSL project has released OpenSSL 4.1.0 as a non-LTS version supported until November 23, 2027. Notable additions include DTLS 1.3 support (RFC 9147), RFC 8701 GREASE, DTLS in the SSL listener API, and an IKEv2 KDF, alongside AVX-512 and VAES optimizations and removal of the no-ecdsa and no-ecdh options.…
Score 0.61
Elsewhere: HN 1 pts, not on front page
Score breakdown for “OpenSSL 4.1 Final Release – Live”
Comments on “OpenSSL 4.1 Final Release – Live”
No. 80Score 0.61
Project Sync: The journey to sample-perfect audio/video sync with WebCodecs
Mediabunny9 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “Project Sync: The journey to sample-perfect audio/video sync with WebCodecs”
Vanilagy · mediabunny.dev
Vanilagy's "Project Sync" post on the Mediabunny blog (Nov 3, 2026) explains why audio transcoded through WebCodecs drifts out of sync with video. Encoders like Apple's AAC add priming delay (2112 samples in one test) that WebCodecs does not report, so each roundtrip lags further behind.
Score 0.61
Elsewhere: HN 4 pts, not on front page
Score breakdown for “Project Sync: The journey to sample-perfect audio/video sync with WebCodecs”
Comments on “Project Sync: The journey to sample-perfect audio/video sync with WebCodecs”
No. 81Score 0.61
Safe and lightweight VMs for Coding agents
GitHub16 minTopics: Programming, AI, Security, DevOpsFormat: New projectChecked by: 3 judges
Summary and score for “Safe and lightweight VMs for Coding agents”
github.com
safeagent gives each git worktree its own small Linux VM, with separate processes, ports, Postgres, Valkey and Temporal instances and data, so parallel coding agent sessions don't collide or reach the host machine. It reads project files to configure itself and plugs into Claude Code via hooks.
Score 0.61
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Safe and lightweight VMs for Coding agents”
Comments on “Safe and lightweight VMs for Coding agents”
No. 82Score 0.61
Designing Uber's MCP Gateway
Uber10 minTopics: Programming, AI, DevOpsFormat: Write-upChecked by: 3 judges
Summary and score for “Designing Uber's MCP Gateway”
Authoring and Enablement · uber.com
Uber published a design write-up for its MCP Gateway, a centralized microservice that routes AI agent requests to internal services and native MCP servers. It has two parts: a control plane (the MCP Registry plus AutoCrawler, which auto-generates MCP tools from Uber's IDL registry) and a data plane (the Proxy…
Score 0.61
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Designing Uber's MCP Gateway”
Comments on “Designing Uber's MCP Gateway”
No. 83Score 0.56
NVIDIA CUDA 13.5 Released With Production Support For Vera Rubin
PhoronixTopics: AI, HardwareFormat: ReleaseChecked by: 3 judges
Summary and score for “NVIDIA CUDA 13.5 Released With Production Support For Vera Rubin”
Michael Larabel · phoronix.com
NVIDIA has released CUDA 13.5 alongside its 620.70.06 Linux driver, adding general availability support for the Vera Rubin platform. For developers and companies building on NVIDIA GPUs, this means production-ready tooling for the new hardware, which matters for planning infrastructure and porting workloads. Source: Phoronix.
Score 0.56
Elsewhere: HN —
Score breakdown for “NVIDIA CUDA 13.5 Released With Production Support For Vera Rubin”
Comments on “NVIDIA CUDA 13.5 Released With Production Support For Vera Rubin”
No. 84Score 0.60
How to speed up the Rust compiler in November 2026
Nicholas Nethercote5 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “How to speed up the Rust compiler in November 2026”
nnethercote.github.io
Nicholas Nethercote's November 2026 progress report on Rust compiler performance describes a month of work reducing span-handling overhead, speeding up the new trait solver on Diesel, and removing unnecessary work in several places.
Score 0.60
Elsewhere: HN 4 pts, not on front page
Score breakdown for “How to speed up the Rust compiler in November 2026”
Comments on “How to speed up the Rust compiler in November 2026”
No. 85Score 0.60
A decent text-to-image model trained for ~$20K (Apache 2.0 Weights)
linum.ai9 minTopics: AIFormat: Write-upChecked by: 3 judges
Summary and score for “A decent text-to-image model trained for ~$20K (Apache 2.0 Weights)”
Authorship statement
A two-person research lab released Pyramid-JiT, a 2B-parameter pixel-space text-to-image model with Apache 2.0 weights, saying its full training run cost about $21K on 64 H100s. The architecture compresses images with 32×32 patches instead of relying on a separate VAE, cutting attention context fourfold.
Score 0.60
Elsewhere: HN 2 pts, not on front page
Score breakdown for “A decent text-to-image model trained for ~$20K (Apache 2.0 Weights)”
Comments on “A decent text-to-image model trained for ~$20K (Apache 2.0 Weights)”
No. 86Score 0.60
Twenty Percent of all 'ok' web responses AI gets are not okay
Unite.AI7 minTopics: AI, DataFormat: AnalysisChecked by: 3 judges
Summary and score for “Twenty Percent of all 'ok' web responses AI gets are not okay”
A new arXiv study estimates that about 20.9% of HTTP 200 ("OK") responses fetched by a basic static client contain no usable main content, instead returning app shells, CAPTCHA or bot challenges, block pages, error pages, or partial content.
Score 0.60Contestedjudges differ by 0.47 on overclaim
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Twenty Percent of all 'ok' web responses AI gets are not okay”
Comments on “Twenty Percent of all 'ok' web responses AI gets are not okay”
No. 87Score 0.60
Fake-download campaign uses trojanized installers
Microsoft Security Blog14 minTopics: SecurityFormat: PaperChecked by: 3 judges
Summary and score for “Fake-download campaign uses trojanized installers”
Microsoft Security Research, Jiacen Xu · microsoft.com
Microsoft Threat Intelligence reports a fake-download campaign distributing trojanized Inno Setup-style installers through lures for cracked software, free games, and unofficial utilities. A single installer session can silently deliver several monetized payloads: proxyware that routes third-party traffic through the victim's device, distributed-computing clients, and adware-style utilities.
Score 0.60
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Fake-download campaign uses trojanized installers”
Comments on “Fake-download campaign uses trojanized installers”
No. 88Score 0.60
Hackers exploited iOS and Android flaws to infect phones
Ars Technica: IT1 minTopics: SecurityFormat: NewsChecked by: 3 judges
Summary and score for “Hackers exploited iOS and Android flaws to infect phones”
Dan Goodin · arstechnica.com
Security firm Sekoia reports that hackers, which it assesses with moderate to high confidence are linked to Russia's Foreign Intelligence Service, exploited previously patched iOS and Android flaws by injecting malicious JavaScript into proxied websites, including a copy of america250.org tied to the US Constitution's 250th anniversary.
Score 0.60Contestedjudges differ by 0.71 on new information, 0.58 on overclaim
Elsewhere: HN —
Score breakdown for “Hackers exploited iOS and Android flaws to infect phones”
Comments on “Hackers exploited iOS and Android flaws to infect phones”
No. 89Score 0.60
Durable Coroutines for TypeScript
restate.dev10 minTopics: Programming, AI, DevOpsFormat: ReleaseChecked by: 3 judges
Summary and score for “Durable Coroutines for TypeScript”
Giselle van Dongen
Restate has added "durable coroutines" to its TypeScript SDK: persistent, concurrent, multi-step routines with the same persistence and recovery guarantees as workflows but only milliseconds of overhead per durable step (P50 2.5ms, P99 9ms in a 3-AZ GCP deployment at over 10,000 actions per second).
Score 0.60
Elsewhere: HN 5 pts, not on front page
Score breakdown for “Durable Coroutines for TypeScript”
Comments on “Durable Coroutines for TypeScript”
No. 90Score 0.60
UK cyber agency warns of AI-powered ransomware on infrastructure by 2028
The Next Web3 minTopics: AI, Security, PolicyFormat: NewsChecked by: 3 judges
Summary and score for “UK cyber agency warns of AI-powered ransomware on infrastructure by 2028”
Ana Maria Constantin · thenextweb.com
The UK's National Cyber Security Centre, in its annual review published 3 November, warns that AI-powered malware will highly likely be used in a ransomware attack on critical national infrastructure by 2028, and that China, Russia and other states will routinely use AI for cyber operations.
Score 0.60
Elsewhere: HN —
Score breakdown for “UK cyber agency warns of AI-powered ransomware on infrastructure by 2028”
Comments on “UK cyber agency warns of AI-powered ransomware on infrastructure by 2028”
No. 91Score 0.60
Testing without a server: using FakeValkey, the in-memory test double for Valkey
valkey.io7 minTopics: ProgrammingFormat: TutorialChecked by: 3 judges
Summary and score for “Testing without a server: using FakeValkey, the in-memory test double for Valkey”
Daniel Moran explains how to use FakeValkey, the in-memory Valkey test double in the fakeredis library (v2.38.0, about 40 million monthly downloads), as a drop-in replacement for valkey-py clients in pytest suites.
Score 0.60
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Testing without a server: using FakeValkey, the in-memory test double for Valkey”
Comments on “Testing without a server: using FakeValkey, the in-memory test double for Valkey”
No. 92Score 0.60
Rooting GoPro HERO8–MAX2 through their own web server
GitHub7 minTopics: Security, HardwareFormat: New projectChecked by: 3 judges
Summary and score for “Rooting GoPro HERO8–MAX2 through their own web server”
github.com
A GitHub project documents an unauthenticated root code execution path on GoPro cameras, triggered through the camera's own HTTP server via a hardcoded "SC" command that runs a script from the SD card as root.
Score 0.60
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Rooting GoPro HERO8–MAX2 through their own web server”
Comments on “Rooting GoPro HERO8–MAX2 through their own web server”
No. 93Score 0.58
Kube-upgrade-check – find what breaks before a Kubernetes upgrade
GitHub8 minTopics: DevOpsFormat: ReleaseChecked by: 3 judges
Summary and score for “Kube-upgrade-check – find what breaks before a Kubernetes upgrade”
github.com
kube-upgrade-check is an open-source kubectl plugin that scans a live Kubernetes cluster for what an upgrade to a chosen version would break, including removed APIs, incompatible control-plane and kubelet settings, dropped volume plugins, node changes, and add-on version support.
Score 0.58
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Kube-upgrade-check – find what breaks before a Kubernetes upgrade”
Comments on “Kube-upgrade-check – find what breaks before a Kubernetes upgrade”
No. 94Score 0.56
Snowflake's AI_PARSE_DOCUMENT got an agentic mode
sfrt.io9 minTopics: AI, DataFormat: Write-upChecked by: 3 judges
Summary and score for “Snowflake's AI_PARSE_DOCUMENT got an agentic mode”
Martin Seifert
Snowflake's AI_PARSE_DOCUMENT added an AGENTIC mode, which classifies charts, diagrams, tables and infographics in a document and returns summaries alongside the extracted text.
Score 0.56Contestedjudges differ by 0.41 on reader interest
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Snowflake's AI_PARSE_DOCUMENT got an agentic mode”
Comments on “Snowflake's AI_PARSE_DOCUMENT got an agentic mode”
No. 95Score 0.62
Draft-li-kvcache-efficient-storage-00
IETF Datatracker28 minTopics: AI, DevOpsFormat: OtherChecked by: 3 judges
Summary and score for “Draft-li-kvcache-efficient-storage-00”
Xun Sun · datatracker.ietf.org
KVSP is an HTTP-based Internet-Draft from Li et al. (IETF, November 2026) specifying how separate components of LLM serving systems share attention key-value cache blocks. It defines compatibility descriptors, keyed block identifiers, replica indexing with per-layer residency, leased prefetch, session checkpoints for migration, and resharding for sequence-parallel caches.
Score 0.62
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Draft-li-kvcache-efficient-storage-00”
Comments on “Draft-li-kvcache-efficient-storage-00”
No. 96Score 0.59
Agent-roast – send your coding agent back when it weakens a test
GitHub5 minTopics: Programming, AI, DevOpsFormat: ReleaseChecked by: 3 judges
Summary and score for “Agent-roast – send your coding agent back when it weakens a test”
github.com
agent-roast is an offline, deterministic tool that flags changes which make a build pass by weakening its checks, such as loosened assertions, skipped or deleted tests, lowered coverage thresholds, or CI steps allowed to fail.
Score 0.59
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Agent-roast – send your coding agent back when it weakens a test”
Comments on “Agent-roast – send your coding agent back when it weakens a test”
No. 97Score 0.59
Calif.io iOS attack defeats Lockdown Mode and survives update
heise online English2 minTopics: SecurityFormat: NewsChecked by: 3 judges
Summary and score for “Calif.io iOS attack defeats Lockdown Mode and survives update”
heise online · heise.de
Security firm Calif.io, including researcher Stefan Esser, says it has built an iOS exploit that defeats Apple's Lockdown Mode, starting from a malicious PDF delivered via AirDrop, and that the compromise persists even after installing iOS 27.2.
Score 0.59
Elsewhere: HN —
Score breakdown for “Calif.io iOS attack defeats Lockdown Mode and survives update”
Comments on “Calif.io iOS attack defeats Lockdown Mode and survives update”
No. 98Score 0.59
Cassandra – free tool to check if you got affected by the Cursor hack
Ciphero31 minTopics: SecurityFormat: ReleaseChecked by: 3 judges
Summary and score for “Cassandra – free tool to check if you got affected by the Cursor hack”
ciphero.ai
Cassandra is a read-only shell script (and PowerShell equivalent) that checks macOS, Linux, and Windows machines for the published indicators of a backdoor in Claude Code extension versions 2.1.312 and 2.1.313, as described in Cursor's security notice.
Score 0.59Contestedjudges differ by 0.71 on new information
Elsewhere: HN 4 pts, not on front page
Score breakdown for “Cassandra – free tool to check if you got affected by the Cursor hack”
Comments on “Cassandra – free tool to check if you got affected by the Cursor hack”
No. 99Score 0.59
Security support for Drupal core minor versions reduced to 8 months
Drupal.org2 minTopics: Programming, SecurityFormat: NewsChecked by: 3 judges
Summary and score for “Security support for Drupal core minor versions reduced to 8 months”
Drupal is cutting security coverage for each minor release of its core from 12 months to 8 months starting in 2027, citing a surge in AI-driven vulnerability reports that strains the Drupal Security Team's limited funding.
Score 0.59
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Security support for Drupal core minor versions reduced to 8 months”
Comments on “Security support for Drupal core minor versions reduced to 8 months”
No. 100Score 0.59
Deterministic security and privacy checks for code from AI assistants
GitHub11 minTopics: Programming, AI, Security, DevOps, PolicyFormat: ReleaseChecked by: 3 judges
Summary and score for “Deterministic security and privacy checks for code from AI assistants”
github.com
Secure & Private by Design is an open-source tool that runs one deterministic engine for security and privacy checks on code, whether an AI assistant or a person wrote it.
Score 0.59
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Deterministic security and privacy checks for code from AI assistants”
Comments on “Deterministic security and privacy checks for code from AI assistants”
No. 101Score 0.59
Benchfmt.rs: Bringing Go's benchmarking and benchstat workflow to Rust
@bwplotka19 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “Benchfmt.rs: Bringing Go's benchmarking and benchstat workflow to Rust”
Bartek Płotka · bwplotka.dev
Benchfmt.rs is a zero-dependency Rust benchmark runner and Criterion/libtest converter that emits Go's benchstat-compatible format, adding /key=value sub-benchmark projections, per-op heap allocation tracking, and pprof profiling.
Score 0.59
Elsewhere: HN 29 pts, front page
Score breakdown for “Benchfmt.rs: Bringing Go's benchmarking and benchstat workflow to Rust”
Comments on “Benchfmt.rs: Bringing Go's benchmarking and benchstat workflow to Rust”
No. 102Score 0.59
What AI Model Effort to Use for Coding
codingplans.dev4 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges
Summary and score for “What AI Model Effort to Use for Coding”
A coding-recipes site publishes per-model guidance on the cheapest AI reasoning-effort setting that keeps a model within 90% of its best FrontierCode 2.0 score, skipping levels a cheaper same-vendor model matches. For Claude Opus 5.5, xhigh reaches 95% of peak score at 40% of max's cost.
Score 0.59Contestedjudges differ by 0.45 on reader interest
Elsewhere: HN 1 pts, not on front page
Score breakdown for “What AI Model Effort to Use for Coding”
Comments on “What AI Model Effort to Use for Coding”
No. 103Score 0.59
Automated Secret Rotation Is Chaos Engineering for Your Identity Plane
Infisical10 minTopics: Programming, Security, DevOpsFormat: AnalysisChecked by: 3 judges
Summary and score for “Automated Secret Rotation Is Chaos Engineering for Your Identity Plane”
infisical.com
A piece argues that automated secret rotation works like chaos engineering for identity: rotating credentials on a schedule forces teams to find hidden assumptions, such as secrets shared across environments or applications that never reload credentials, before an incident.
Score 0.59Contestedjudges differ by 0.56 on new information
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Automated Secret Rotation Is Chaos Engineering for Your Identity Plane”
Comments on “Automated Secret Rotation Is Chaos Engineering for Your Identity Plane”
No. 104Score 0.59
How //go:embed Works: From Source Files to Binary
Internals for Interns25 minTopics: ProgrammingFormat: TutorialChecked by: 3 judges
Summary and score for “How //go:embed Works: From Source Files to Binary”
Jesús Espino · internals-for-interns.com
A walkthrough of Go's //go:embed directive, which since Go 1.16 lets programs bake strings, byte slices, or a read-only file system into the compiled binary at build time.
Score 0.59
Elsewhere: HN —
Score breakdown for “How //go:embed Works: From Source Files to Binary”
Comments on “How //go:embed Works: From Source Files to Binary”
No. 105Score 0.58
C++26 Disapproved
andreasfertig.com5 minTopics: ProgrammingFormat: AnalysisChecked by: 3 judges
Summary and score for “C++26 Disapproved”
Andreas Fertig
The author, a German delegate to the C++ Standardization Committee, reports that the C++26 Draft International Standard failed its October 23, 2026 ISO National Body vote, the first such failure in C++ history, apparently over the Contracts feature.
Score 0.58Contestedjudges differ by 0.51 on reader interest, 0.48 on substantiated
Elsewhere: HN 407 pts, front page
Score breakdown for “C++26 Disapproved”
Comments on “C++26 Disapproved”
No. 106Score 0.56
Nvidia DGX Spark encrypted firmware slows inference speed to 35% on Linux
MindStudio7 minTopics: AI, HardwareFormat: Write-upChecked by: 3 judges
Summary and score for “Nvidia DGX Spark encrypted firmware slows inference speed to 35% on Linux”
Luis Chavez-Mattos · mindstudio.ai
Testers found that the Nvidia RTX Spark laptop running Linux stays stuck at about 780 MHz GPU clock when plugged in, compared with roughly 2.2 GHz on Windows, cutting GPT-OSS-120B throughput to around 14 tokens per second.
Score 0.56Contestedjudges differ by 0.57 on overclaim
Elsewhere: HN 597 pts, front page
Score breakdown for “Nvidia DGX Spark encrypted firmware slows inference speed to 35% on Linux”
Comments on “Nvidia DGX Spark encrypted firmware slows inference speed to 35% on Linux”
No. 107Score 0.58
Skill to verify and optimize software with TLA+ and ts-tla
GitHub5 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “Skill to verify and optimize software with TLA+ and ts-tla”
github.com
A GitHub project by paralin, "Skill to verify and optimize software with TLA+ and ts-tla", packages an agent skill that has coding agents model stateful code in TLA+, keep each spec beside its source file, and run the tla-ts checker on every build.
Score 0.58
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Skill to verify and optimize software with TLA+ and ts-tla”
Comments on “Skill to verify and optimize software with TLA+ and ts-tla”
No. 108Score 0.58
A study of sequence weighting at scale: Jane Street
Jane Street Blog8 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “A study of sequence weighting at scale: Jane Street”
blog.janestreet.com
Jane Street researchers studied how language models learn from individually weighted training sequences across model sizes, from tens of millions to hundreds of billions of parameters, using in-house models and the open-weight Qwen 2.5 family.
Score 0.58Contestedjudges differ by 0.43 on significance
Elsewhere: HN 1 pts, not on front page
Score breakdown for “A study of sequence weighting at scale: Jane Street”
Comments on “A study of sequence weighting at scale: Jane Street”
No. 109Score 0.58
Open decision model that answers typed questions about audio
GitHub7 minTopics: AIFormat: New projectChecked by: 3 judges
Summary and score for “Open decision model that answers typed questions about audio”
github.com
homi is an open model that answers typed yes/no, multiple-choice and ordinal questions about an audio clip, returning a probability for each option rather than generated text.
Score 0.58
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Open decision model that answers typed questions about audio”
Comments on “Open decision model that answers typed questions about audio”
No. 110Score 0.58
Commentary: Deno joins Cloudflare — judged by its own promises
heise online English6 minTopics: Programming, StartupsFormat: AnalysisChecked by: 3 judges
Summary and score for “Commentary: Deno joins Cloudflare — judged by its own promises”
heise online · heise.de
Cloudflare is acquiring Deno, including its whole team, which will move to the Workers platform. The Deno runtime gets one more year of maintenance before development stops, Deno Deploy shuts down within six months, and the JSR registry moves to Cloudflare.
Score 0.58
Elsewhere: HN —
Score breakdown for “Commentary: Deno joins Cloudflare — judged by its own promises”
Comments on “Commentary: Deno joins Cloudflare — judged by its own promises”
No. 111Score 0.58
AI coding agents are installing abandoned MCP servers with known security issues
glow.io7 minTopics: Programming, AI, SecurityFormat: PaperChecked by: 3 judges
Summary and score for “AI coding agents are installing abandoned MCP servers with known security issues”
Nadav Claude CohenNovember 2, 2026
Glow Labs reports that AI coding agents repeatedly install deprecated Anthropic MCP reference servers, such as GitHub and Puppeteer, because those names appear in their training data rather than current registries. The archived servers carry four high-severity vulnerabilities, including remote code execution in Puppeteer, and maintainers have declined fixes.
Score 0.58Contestedjudges differ by 0.69 on promotional
Elsewhere: HN 1 pts, not on front page
Score breakdown for “AI coding agents are installing abandoned MCP servers with known security issues”
Comments on “AI coding agents are installing abandoned MCP servers with known security issues”
No. 112Score 0.58
Verne V0.5: U.S. Open-Weight SOTA Robotics Foundation Model
vernerobotics.com18 minTopics: AI, HardwareFormat: ReleaseChecked by: 3 judges
Summary and score for “Verne V0.5: U.S. Open-Weight SOTA Robotics Foundation Model”
Verne has released V0.5, an open-weight world action model for dual-arm mobile robots aimed at long-horizon industrial tasks. The company says it is the leading open-weight model from a US developer on the LIBERO and RoboTwin 2.0 benchmarks at publication.
Score 0.58
Elsewhere: HN 6 pts, not on front page
Score breakdown for “Verne V0.5: U.S. Open-Weight SOTA Robotics Foundation Model”
Comments on “Verne V0.5: U.S. Open-Weight SOTA Robotics Foundation Model”
No. 113Score 0.56
Dragonfly License Change
GitHub8 minTopics: DataFormat: OtherChecked by: 3 judges
Summary and score for “Dragonfly License Change”
github.com
DragonflyDB Ltd., the Israeli maker of the Dragonfly in-memory data store, has published a revised source-available license for Version 2.1 and later. Users may freely use, modify and redistribute the code, but production use is capped at 100 aggregate vCPUs across an organization and its affiliates, with larger deployments requiring…
Score 0.56
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Dragonfly License Change”
Comments on “Dragonfly License Change”
No. 114Score 0.57
TScert: A Sound Core for TypeScript
GitHub4 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “TScert: A Sound Core for TypeScript”
github.com
TScert is a research checker for TypeScript functions that accepts a function only with a proof, validated by a Lean-proved soundness theorem rather than by trusting inferred types.
Score 0.57
Elsewhere: HN 3 pts, not on front page
Score breakdown for “TScert: A Sound Core for TypeScript”
Comments on “TScert: A Sound Core for TypeScript”
No. 115Score 0.57
The client asked for a chatbot. We built a fancy PDF viewer instead
Ingram Technologies6 minTopics: Programming, AI, ProductFormat: Write-upChecked by: 3 judges
Summary and score for “The client asked for a chatbot. We built a fancy PDF viewer instead”
Jerome Leclanche · ingram.tech
The team at Ingram built a PDF viewer rather than the requested chatbot for Belgian paediatric oncologists, who must check trial protocols of 50 to 415 pages. Their pipeline extracts each protocol into a structured, versioned spec, with model-labelled sections and code-copied verbatim text checked against the page.
Score 0.57
Elsewhere: HN 4 pts, not on front page
Score breakdown for “The client asked for a chatbot. We built a fancy PDF viewer instead”
Comments on “The client asked for a chatbot. We built a fancy PDF viewer instead”
No. 116Score 0.57
DeepSeek alone now accounts for 53% of all token volume on Openrouter
Dirac48 minTopics: AIFormat: PaperChecked by: 3 judges
Summary and score for “DeepSeek alone now accounts for 53% of all token volume on Openrouter”
dirac.run
DeepSeek alone accounted for 53.2% of OpenRouter's token volume on 2026-11-03, about 14.32 trillion tokens out of a daily total of 26.94 trillion, according to OpenRouter's published data.
Score 0.57
Elsewhere: HN 2 pts, not on front page
Score breakdown for “DeepSeek alone now accounts for 53% of all token volume on Openrouter”
Comments on “DeepSeek alone now accounts for 53% of all token volume on Openrouter”
No. 117Score 0.57
Umbra – a autonomous Android agent with background screen control
GitHub5 minTopics: Programming, AI, SecurityFormat: New projectChecked by: 3 judges
Summary and score for “Umbra – a autonomous Android agent with background screen control”
github.com
Umbra is a free, MIT-licensed Android 16 app, shared on Hacker News as a Show HN, that runs an autonomous agent on the phone. The agent operates apps through accessibility and screen control, builds code in an on-device Debian environment (chroot with root, proot without), and requires approval for risky…
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Umbra – a autonomous Android agent with background screen control”
Comments on “Umbra – a autonomous Android agent with background screen control”
No. 118Score 0.57
Making Flawed Benchmarks Useful
Blatent7 minTopics: AIFormat: Write-upChecked by: 3 judges
Summary and score for “Making Flawed Benchmarks Useful”
blatent.ai
Blatent researchers examine why open benchmark scoring can misjudge correct model answers, citing cases like PHYBench's algebraically equivalent expressions and QASPER's partial-credit penalties. They describe how exact-match and token-F1 metrics miss semantic equivalence, and propose checking exact-source extraction deterministically before using an LLM judge to assess correctness.
Score 0.57Contestedjudges differ by 0.45 on new information
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Making Flawed Benchmarks Useful”
Comments on “Making Flawed Benchmarks Useful”
No. 119Score 0.57
Trainlint, static checks for ML bugs that don't crash
GitHub5 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “Trainlint, static checks for ML bugs that don't crash”
github.com
Trainlint is an offline, standard-library-only static checker that flags ML bugs which run without crashing, such as scalers fitted before a train/test split, eval mode left on during training, and softmax before CrossEntropyLoss.
Score 0.57
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Trainlint, static checks for ML bugs that don't crash”
Comments on “Trainlint, static checks for ML bugs that don't crash”
No. 120Score 0.57
You Cannot Trust Your Agent (and How to Isolate It)
soarhen.com4 minTopics: Programming, AI, SecurityFormat: TutorialChecked by: 3 judges
Summary and score for “You Cannot Trust Your Agent (and How to Isolate It)”
A developer describes running AI code agents inside a kernel-level sandbox built with bwrap (bubblewrap) on Linux, so the agent sees the root filesystem read-only, only the target project with read-write access, and home-directory config writes confined to temporary overlays.
Score 0.57Contestedjudges differ by 0.59 on new information, 0.47 on overclaim
Elsewhere: HN 1 pts, not on front page
Score breakdown for “You Cannot Trust Your Agent (and How to Isolate It)”
Comments on “You Cannot Trust Your Agent (and How to Isolate It)”
No. 121Score 0.57
Data Access Testing with Testcontainers
blog.master.dev11 minTopics: Programming, DataFormat: TutorialChecked by: 3 judges
Summary and score for “Data Access Testing with Testcontainers”
Adam Rackis November 4, 2026
A tutorial post explains how to unit test data access code using Testcontainers and the @testcontainers/postgresql package, running a real Postgres instance in Docker instead of wrapping tests in transactions against a shared test database.
Score 0.57
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Data Access Testing with Testcontainers”
Comments on “Data Access Testing with Testcontainers”
No. 122Score 0.56
Forthcoming security update of Node.js; November 11, 2026
nodejs.org1 minTopics: Programming, SecurityFormat: ReleaseChecked by: 3 judges
Summary and score for “Forthcoming security update of Node.js; November 11, 2026”
The Node.js project has announced coordinated security releases for its 26.x, 24.x, and 22.x lines, scheduled for or shortly after November 11, 2026. The highest-severity issue fixed in each line is rated HIGH.
Score 0.56
Elsewhere: HN 11 pts, not on front page
Score breakdown for “Forthcoming security update of Node.js; November 11, 2026”
Comments on “Forthcoming security update of Node.js; November 11, 2026”
No. 123Score 0.56
Screenshot to Tokens – give a web app a design system from a screenshot
GitHub7 minTopics: Programming, AI, DesignFormat: New projectChecked by: 3 judges
Summary and score for “Screenshot to Tokens – give a web app a design system from a screenshot”
github.com
Screenshot to Tokens, a hackathon project from Metatoy, takes a live web app with no design tokens, segments its interface from pixels using SAM 3.1, and has Muse Spark name a three-tier token set that a person reviews.
Score 0.56
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Screenshot to Tokens – give a web app a design system from a screenshot”
Comments on “Screenshot to Tokens – give a web app a design system from a screenshot”
No. 124Score 0.56
Compilers for Machine Learning (Spring 2027)
10-411.com7 minTopics: Programming, AIFormat: OtherChecked by: 3 judges
Summary and score for “Compilers for Machine Learning (Spring 2027)”
A draft Spring 2027 Carnegie Mellon course syllabus by George Hotz, "Compilers for Machine Learning," describes a one-semester, hands-on course in which students build an ML compiler from scratch, progressing from elementwise programs to training LLMs on GPUs.
Score 0.56
Elsewhere: HN 4 pts, not on front page
Score breakdown for “Compilers for Machine Learning (Spring 2027)”
Comments on “Compilers for Machine Learning (Spring 2027)”
No. 125Score 0.56
Tokenizer Mono
George Mandis26 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “Tokenizer Mono”
george.mand.is
Tokenizer Mono is a font family by George Mandis, built on IBM Plex, with 28 styles that each correspond to a specific LLM tokenizer such as OpenAI's cl100k or o200k, Llama, Gemma, or BERT.
Score 0.56
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Tokenizer Mono”
Comments on “Tokenizer Mono”
No. 126Score 0.56
C++26: Std:Constant_wrapper
Sandor Dargo’s Blog7 minTopics: ProgrammingFormat: TutorialChecked by: 3 judges
Summary and score for “C++26: Std:Constant_wrapper”
sandordargo.com
C++26's std::constant_wrapper (with the std::cw<V> shorthand), proposed in P2781R9 by Dusíková, Kretz, and Laine and refined in P3978R3, wraps any structural value as a non-type template parameter so it stays a compile-time constant across function calls.
Score 0.56
Elsewhere: HN 2 pts, not on front page
Score breakdown for “C++26: Std:Constant_wrapper”
Comments on “C++26: Std:Constant_wrapper”
No. 127Score 0.56
Can Advertising Fund Free AI? Evidence from ChatGPT's Advertising Rollout
ecommerceresearch.org3 minTopics: AI, GrowthFormat: PaperChecked by: 3 judges
Summary and score for “Can Advertising Fund Free AI? Evidence from ChatGPT's Advertising Rollout”
Maximilian Kaiser · Christian Schulze
A working paper by Kaiser and Schulze uses data from 1,898 online shops to test whether advertising can fund free AI assistants, studying ChatGPT's staggered international ad rollout. They find organic ChatGPT referral volume fell about 6 to 8% after ads launched, while conversion held steady.
Score 0.56Contestedjudges differ by 0.49 on reader interest
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Can Advertising Fund Free AI? Evidence from ChatGPT's Advertising Rollout”
Comments on “Can Advertising Fund Free AI? Evidence from ChatGPT's Advertising Rollout”
No. 128Score 0.56
Coding Agents stop mid-task
foremerge.com4 minTopics: Programming, AIFormat: ReleaseChecked by: 3 judges
Summary and score for “Coding Agents stop mid-task”
Nick Woodhead
Foremerge 0.6.0 stops recording advisory conflicts against coding agents whose sessions ended without closing their intents, after one repository's shared store reached 3,896 open conflicts, 98% with no live agent. Stopped work stays visible at the end of related_work, and HIGH findings still gate acceptance.
Score 0.56
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Coding Agents stop mid-task”
Comments on “Coding Agents stop mid-task”
No. 129Score 0.58
Months of planning preceded record Binance heist
heise online English2 minTopics: Security, FintechFormat: NewsChecked by: 3 judges
Summary and score for “Months of planning preceded record Binance heist”
heise online · heise.de
Binance's co-CEO Richard Teng told CNBC that months of preparation, including fake job interviews and compromised internal AI tools, preceded the roughly $6.3 billion crypto theft on October 29, making it the largest on record.
Score 0.58Contestedjudges differ by 0.61 on new information
Elsewhere: HN —
Score breakdown for “Months of planning preceded record Binance heist” · Also covered by Silicon Republic, Ossprey, The Next Web, Ars Technica: IT
Comments on “Months of planning preceded record Binance heist”
No. 130Score 0.60
Nikke PC game launcher hacked to spread remote access, data-stealing malware
BleepingComputer3 minTopics: SecurityFormat: NewsChecked by: 3 judges
Summary and score for “Nikke PC game launcher hacked to spread remote access, data-stealing malware”
Bill Toulas · bleepingcomputer.com
Attackers tampered with JavaScript files on Goddess of Victory: NIKKE's PC launcher, hosted on the publisher's CDN, to deliver a backdoor that could steal credentials and cryptocurrency wallet data, according to independent researcher MotherSphere, with BleepingComputer confirming the obfuscated loader.
Score 0.60Contestedjudges differ by 0.72 on new information
Elsewhere: HN 2 pts, not on front page
Score breakdown for “Nikke PC game launcher hacked to spread remote access, data-stealing malware”
Comments on “Nikke PC game launcher hacked to spread remote access, data-stealing malware”
No. 131Score 0.56
Gemini trains on chat history, even for subscribers (personal accounts)
Hacker News1 minTopics: AI, PolicyFormat: NewsChecked by: 3 judges
Summary and score for “Gemini trains on chat history, even for subscribers (personal accounts)”
jameslk · news.ycombinator.com
A Hacker News post, citing Google's own support pages, claims that Gemini chat history on personal paid subscriptions can be used to train AI models unless users turn off "Keep activity," which deletes chats after 72 hours.
Score 0.56
Elsewhere: HN 646 pts, front page
Score breakdown for “Gemini trains on chat history, even for subscribers (personal accounts)” · Also covered by AI News Report
Comments on “Gemini trains on chat history, even for subscribers (personal accounts)”
No. 132Score 0.56
After a decade of reversing, I got co-op working in DOS Wing Commander
fireflyk64.github.io11 minTopics: ProgrammingFormat: Write-upChecked by: 3 judges
Summary and score for “After a decade of reversing, I got co-op working in DOS Wing Commander”
A developer spent eleven years reverse-engineering DOS Wing Commander's memory in DOSBox to add two-player cooperative play, where one player flies the wingman. The write-up walks through locating ship position and velocity in the 64K data segment by diffing memory snapshots, finding rotation vectors via a lucky slot layout, and…
Score 0.56
Elsewhere: HN 145 pts, front page
Score breakdown for “After a decade of reversing, I got co-op working in DOS Wing Commander”
Comments on “After a decade of reversing, I got co-op working in DOS Wing Commander”
No. 133Score 0.56
OpenRing – Open-source, self-hosted voice AI agent platform (Vapi alternative)
GitHub25 minTopics: Programming, AIFormat: New projectChecked by: 3 judges
Summary and score for “OpenRing – Open-source, self-hosted voice AI agent platform (Vapi alternative)”
github.com
OpenRing is an open-source (MIT) platform for running voice AI agents on your own server, with a Vapi-compatible JSON API and no platform fee. Callers' speech goes through speech-to-text, a language model and a voice, and the operator pays each provider directly.
Score 0.56
Elsewhere: HN 2 pts, not on front page
Score breakdown for “OpenRing – Open-source, self-hosted voice AI agent platform (Vapi alternative)”
Comments on “OpenRing – Open-source, self-hosted voice AI agent platform (Vapi alternative)”
No. 134Score 0.55
jj-vcs/jj v0.47.0
GitHub6 minTopics: ProgrammingFormat: ReleaseChecked by: 3 judges
Summary and score for “jj-vcs/jj v0.47.0”
josephlou5 · github.com
The jj version control project released v0.47.0, a Git-compatible system. Its headline changes include a new revset template function, a built-in multi-way :editor merge tool, and binary detection in jj file search.
Score 0.55Contestedjudges differ by 0.43 on substantiated
Elsewhere: HN —
Score breakdown for “jj-vcs/jj v0.47.0”
Comments on “jj-vcs/jj v0.47.0”
No. 135Score 0.55
Five rules for evaluating agent skills before they bloat your context window
Google Cloud Blog5 minTopics: Programming, AI, Security, DevOpsFormat: Write-upChecked by: 3 judges
Summary and score for “Five rules for evaluating agent skills before they bloat your context window”
cloud.google.com
A Google Cloud developer-relations post lays out a five-rule playbook for checking whether agent skills (SKILL.md files) justify their context cost. The rules cover catching trigger collisions before running containers, running evaluations in isolated sandboxes rather than on laptops, comparing paired with/without-skill runs over repeated trials, keeping correctness separate from…
Score 0.55Contestedjudges differ by 0.44 on new information, 0.55 on promotional
Elsewhere: HN 3 pts, not on front page
Score breakdown for “Five rules for evaluating agent skills before they bloat your context window”
Comments on “Five rules for evaluating agent skills before they bloat your context window”
No. 136Score 0.55
Review patch/diff files as VS Code diffs with on-demand loading
marketplace.visualstudio.com7 minTopics: ProgrammingFormat: ReleaseChecked by: 3 judges
Summary and score for “Review patch/diff files as VS Code diffs with on-demand loading”
A new open-source VS Code extension, "Patch Diff Review," lets developers review .patch and .diff files as native side-by-side diff editors with inline comment threads, without cloning the repository or signing in.
Score 0.55
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Review patch/diff files as VS Code diffs with on-demand loading”
Comments on “Review patch/diff files as VS Code diffs with on-demand loading”
No. 137Score 0.55
Redis now has compressed bitmaps (Roaring)
Daniel Lemire's blog3 minTopics: DataFormat: Write-upChecked by: 3 judges
Summary and score for “Redis now has compressed bitmaps (Roaring)”
15 October 2026 · 3 min · lemire.me
Redis is adding Roaring compressed bitmaps as a new opt-in type, expected in Redis 8.12, enabled with CONFIG SET bitmap-default-roaring yes. Roaring adapts its storage to sparse, dense, and run-heavy data, so sparse or widely spaced bit sets avoid the cost of plain Redis bitmaps, which allocate one byte per…
Score 0.55
Elsewhere: HN 1 pts, not on front page
Score breakdown for “Redis now has compressed bitmaps (Roaring)”
Comments on “Redis now has compressed bitmaps (Roaring)”
No. 138Score 0.55
"reverse game theory" could keep AI agents in check
MIT Technology Review5 minTopics: AIFormat: NewsChecked by: 3 judges
Summary and score for “"reverse game theory" could keep AI agents in check”
Amit Katwalaarchive page · technologyreview.com
A new AI safety approach called "reverse game theory," or mechanism design, proposes designing incentives so that powerful AI agents behave as intended, rather than trying to read their internal reasoning.
Score 0.55
Elsewhere: HN 2 pts, not on front page
Score breakdown for “"reverse game theory" could keep AI agents in check”
Comments on “"reverse game theory" could keep AI agents in check”
No. 139Score 0.58
Kernel.sh Hacked
KERNEL3 minTopics: Security, DevOpsFormat: NewsChecked by: 3 judges
Summary and score for “Kernel.sh Hacked”
Catherine Jue · kernel.sh
Kernel.sh, a browser-session infrastructure provider, disclosed a security breach in which an attacker used a leaked API key to move through its logging provider and then hosting provider accounts, gaining access to four GPU servers, three of which ran customer browser sessions.
Score 0.58
Elsewhere: HN 11 pts, not on front page
Score breakdown for “Kernel.sh Hacked”
Comments on “Kernel.sh Hacked”

How far each story is checked

Claim-checked: Scored by all three judges, and its checkable claims were compared with the sources it cites.
3 judges: Scored by all three judges. Only the day’s top stories get the claim check.
2 judges: Scored by two of the three judges. The third reads only the day’s strongest candidates.

Every story that scored at least 0.55, in score order. The judges never saw a site or an author; both are shown after ranking. How ranking works

This edition’s scores are open data: JSON and CSV, under CC BY 4.0. What the files hold

Get your mix by email

The first ten stories your filters show, in one email a day.

Or choose topics and formats on the newsletter page

One essay a week on AI and the work of programming: the hrih.si letter

This edition’s panel

Four AI agents ranked this edition: three judges scored every story blind to its site and author, and a fourth compared the top stories’ claims with the sources they cite. Summaries are written by AI.

Model versions are pinned for every edition. How ranking works describes rubric v2.3.

Table 1. How the day narrowed
Step	Stories
Candidates in the window	1,245
Scored blind by two judges	1,149
Off topic	231
Read by the third judge	231
Claim-checked	25
Published	139