Ranked by score · Showing 20 of 41 stories · 5 hidden by your filters

1. No. 1Score 0.74

   Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

   Slashdot3 minTopics: Programming, AI, SecurityFormat: NewsChecked by: Claim-checked

   Summary and score for “Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub”

   EditorDavid · it.slashdot.org

   Security firm Apiiro reports that 1,122 of about 104,000 public copies of Claude Code's .claude/settings.local.json on GitHub contain secrets, including database passwords and AWS keys. The file can store approved commands verbatim, and Claude Code excludes it only in the user's global git settings, not the project's .gitignore. Apiiro did not test whether the credentials work, and its figures could not be independently verified. Anthropic's Boris Cherny says the files were committed manually and that secret scrubbing is under study. Rotate exposed credentials before deleting the file.

   Score 0.74Claim check: 1 matches source · 7 couldn’t check

   Elsewhere: HN —

   Score breakdown and claims for “Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub”

   Comments on “Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub”

2. No. 2Score 0.74

   What Can AI Hack? Inside Frontier Labs' Tests

   Dor Cohen13 minTopics: AI, SecurityFormat: AnalysisChecked by: Claim-checked

   Summary and score for “What Can AI Hack? Inside Frontier Labs' Tests”

   Dor Cohen · dorcohen.dev

   Dor Cohen surveys public cyber benchmarks in four tiers: capture-the-flag puzzles, live web-app breaches, reproducing known bugs, and turning bugs into working exploits. Scores on each rose from low to high in under a year, with ExploitBench's latest figure at 73% code execution. He notes the scores are lab-reported, unreplicated, and not comparable across setups, and that an audit found one setup choice moved scores by over 80 points. Several figures could not be verified. For builders, his practical advice is to keep ASLR and similar defenses on.

   Score 0.74Claim check: 2 matches source · 6 couldn’t check

   Elsewhere: HN 2 pts, not on front page

   Score breakdown and claims for “What Can AI Hack? Inside Frontier Labs' Tests”

   Comments on “What Can AI Hack? Inside Frontier Labs' Tests”

3. No. 3Score 0.71

   The same work on a third of the tokens: tuning a fleet of coding agents

   Alexander Marquardt24 minTopics: Programming, AIFormat: Write-upChecked by: Claim-checked

   Summary and score for “The same work on a third of the tokens: tuning a fleet of coding agents”

   Alexander Marquardt · alexmarquardt.com

   Alexander Marquardt reports that over ten weeks of Claude Code transcripts, his fleet of parallel coding agents cut tokens per changed line 3.3x (about 2.5x when weighted by token price) and merged 4.4 times as many PRs a week on 19% fewer tokens. Most tokens were cache reads of re-sent context, so the gains came from one-task agents with a context ceiling and fewer cache expiries. It is one project run by one person with changes landing together, and rework per PR rose slightly.

   Score 0.71Claim check: 3 matches source · 5 no source given

   Elsewhere: HN 3 pts, not on front page

   Score breakdown and claims for “The same work on a third of the tokens: tuning a fleet of coding agents”

   Comments on “The same work on a third of the tokens: tuning a fleet of coding agents”

4. No. 4Score 0.68

   Model Surgery: Can an AI directly edit and make another AI forget facts?

   deepgains.substack.com17 minTopics: AIFormat: PaperChecked by: Claim-checked

   Summary and score for “Model Surgery: Can an AI directly edit and make another AI forget facts?”

   Arun S

   Arun S, writing on Substack, tested whether Claude Opus 5.5 could make a fine-tuned 494M-parameter model forget 20 synthetic customers and 10 secret keys by editing weights directly, following an MIT CSAIL method. Claude changed 17 matrices; re-teaching restored 4% of forgotten facts, versus 3% for a model never trained on them, and other customers lost 2.5 points. Gradient ascent, NPO and refusal training damaged the model or only hid the facts. Results are the author's own, from one run, and Claude's mechanism explanation was partly wrong.

   Score 0.68Claim check: 2 matches source · 5 no source given · 1 couldn’t check

   Elsewhere: HN 1 pts, not on front page

   Score breakdown and claims for “Model Surgery: Can an AI directly edit and make another AI forget facts?”

   Comments on “Model Surgery: Can an AI directly edit and make another AI forget facts?”

5. No. 5Score 0.67

   Adopting Python 3.15's lazy imports: a 4× faster CLI, and where they didn't help

   Namegarage11 minTopics: ProgrammingFormat: Write-upChecked by: Claim-checked

   Summary and score for “Adopting Python 3.15's lazy imports: a 4× faster CLI, and where they didn't help”

   Namegarage · namegarage.com

   Namegarage, a domain-trading company, moved its back office to Python 3.15.2 and used explicit lazy imports (PEP 810) to cut start-up time. Median CLI --help fell from 1,314 ms to 326 ms, while the terminal UI improved 20 percent and the MCP server import 15 percent. These are the company's own measurements on a busy Mac. It gated deferral with Meta's Lifeguard analyzer, avoided global lazy mode, and found that table values, default arguments, base classes and try blocks quietly defeat deferral.

   Score 0.67Claim check: 4 matches source · 4 no source given

   Elsewhere: HN 1 pts, not on front page

   Score breakdown and claims for “Adopting Python 3.15's lazy imports: a 4× faster CLI, and where they didn't help”

   Comments on “Adopting Python 3.15's lazy imports: a 4× faster CLI, and where they didn't help”

6. No. 6Score 0.67

   CWPdoor: The Invisible Backdoor Living Inside Control Web Panel

   奇安信 X 实验室7 minTopics: Security, ITFormat: PaperChecked by: Claim-checked

   Summary and score for “CWPdoor: The Invisible Backdoor Living Inside Control Web Panel”

   Alex.Turing, Acey9 · blog.xlab.qianxin.com

   XLab, the threat-research team at QiAnXin, describes cwpdoor, a backdoor built into a recompiled cwpsrv, the web server of Control Web Panel. A script swaps it in for versions 1.15.10 and 1.24.0, resets file timestamps, and the backdoor runs RSA-signed, AES-encrypted commands sent in HTTP headers while suppressing log entries. A Brazilian VirusTotal upload suggests real victims, though the claims rest on XLab's own telemetry. The infection vector and any link to Ebury are unknown. Hunter data shows over 340,000 exposed CWP instances. Administrators can check for the ngx_http_integrity_helper socket.

   Score 0.67Claim check: 8 no source given

   Elsewhere: HN 2 pts, not on front page

   Score breakdown and claims for “CWPdoor: The Invisible Backdoor Living Inside Control Web Panel”

   Comments on “CWPdoor: The Invisible Backdoor Living Inside Control Web Panel”

7. No. 7Score 0.66

   FELF – AppImage-like single binaries without FUSE, root, or a runtime

   GitHub9 minTopics: Programming, DevOpsFormat: New projectChecked by: 3 judges

   Summary and score for “FELF – AppImage-like single binaries without FUSE, root, or a runtime”

   github.com

   FELF is an open-source tool that packs an existing Linux binary together with its shared libraries, a private glibc and dynamic linker into a single executable that runs on any same-architecture Linux without FUSE, root, or an installed runtime.

   Score 0.66

   Elsewhere: HN 3 pts, not on front page

   Score breakdown for “FELF – AppImage-like single binaries without FUSE, root, or a runtime”

   Comments on “FELF – AppImage-like single binaries without FUSE, root, or a runtime”

8. No. 8Score 0.65

   Nspawn 3.0: A Docker-compatible Engine API for systemd-nspawn containers

   Nspawn Org’s Blog6 minTopics: Programming, DevOps, ITFormat: ReleaseChecked by: Claim-checked

   Summary and score for “Nspawn 3.0: A Docker-compatible Engine API for systemd-nspawn containers”

   Eduard Tolosa · blog.nspawn.org

   Nspawn 3.0 adds a Docker Engine API on the host at /run/nspawn/api.sock, so the docker CLI and tools such as GitLab Runner's docker executor can manage systemd-nspawn machines. Access goes through polkit, and a user with org.nspawn.manage is effectively root. A machine mounting the socket read-write can now create and remove containers, where 2.0.0 was read-only. Image builds, pushes, tags and commits return 501, so docker build does not work. The supported API versions and the GitLab Runner setup are the author's claims and were not independently verified.

   Score 0.65Claim check: 4 matches source · 2 no source given · 2 couldn’t check

   Elsewhere: HN —

   Score breakdown and claims for “Nspawn 3.0: A Docker-compatible Engine API for systemd-nspawn containers”

   Comments on “Nspawn 3.0: A Docker-compatible Engine API for systemd-nspawn containers”

9. No. 9Score 0.65

   Making profile-guided optimization reproducible

   Farid Zakaria’s Blog9 minTopics: ProgrammingFormat: Write-upChecked by: Claim-checked

   Summary and score for “Making profile-guided optimization reproducible”

   fzakaria.com

   Farid Zakaria shows a way to make profile-guided optimization reproducible, the usual reason Nixpkgs and Guix disable it for Python and GCC. He moves only the training run into Rewind, his deterministic VM, with fixed clock, seed and thread schedule. On a two-thread toy program, the profile and final binary then pass nix-build --check, which plain PGO fails. The training must be pinned to one CPU vendor, and the schedule choice affects profile quality. The evidence is one small example, not a real compiler or interpreter.

   Score 0.65Claim check: 1 matches source · 5 no source given · 2 couldn’t check

   Elsewhere: HN 1 pts, not on front page

   Score breakdown and claims for “Making profile-guided optimization reproducible”

   Comments on “Making profile-guided optimization reproducible”

10. No. 10Score 0.64

    We review 4x more AI code without reading every line

    The New Stack5 minTopics: Programming, AIFormat: Write-upChecked by: Claim-checked

    Summary and score for “We review 4x more AI code without reading every line”

    Ankit Jain · thenewstack.io

    Ankit Jain of Aviator says his team stopped reading every diff line and instead has humans review intent, acceptance criteria, invariants, decisions and evidence from agent-run preview environments. He reports that the same nine engineers merged 4× more PRs, median time to merge fell from 2.1 days to 3.4 hours, and reverts dropped 40%. He also describes mining 11,400 review comments into 64 approved invariants. These figures are self-reported by the vendor and have no independent verification, and they come from one team.

    Score 0.64Claim check: 7 no source given · 1 couldn’t check

    Elsewhere: HN 3 pts, not on front page

    Score breakdown and claims for “We review 4x more AI code without reading every line”

    Comments on “We review 4x more AI code without reading every line”

11. No. 11Score 0.64

    Unified Grid: How We Re-Architected Slack for Our Largest Customers

    slack.engineering10 minTopics: Programming, ProductFormat: Write-upChecked by: Claim-checked

    Summary and score for “Unified Grid: How We Re-Architected Slack for Our Largest Customers”

    Slack's engineering blog describes how it rebuilt its client and backend so Enterprise Grid users see all their workspaces in one view, rather than switching between them. The team prototyped first, using it internally, then fixed thousands of APIs and permission checks. It reused existing integration tests under org context, where hundreds of suites initially failed, and capped relevant workspaces at 50 per user. Rollout ran from fall 2023 to March 2024. The performance and bug-reduction benefits are stated as expectations, not measured results.

    Score 0.64Contestedjudges differ by 0.43 on substantiatedClaim check: 1 matches source · 7 no source given

    Elsewhere: HN 1 pts, not on front page

    Score breakdown and claims for “Unified Grid: How We Re-Architected Slack for Our Largest Customers”

    Comments on “Unified Grid: How We Re-Architected Slack for Our Largest Customers”

12. No. 12Score 0.62

    Lossless compression of LLMs to 12-bits

    GitHub3 minTopics: AI, HardwareFormat: ReleaseChecked by: Claim-checked

    Summary and score for “Lossless compression of LLMs to 12-bits”

    github.com

    NF12, an open-source library from dphnAI (Apache-2.0), stores BF16 LLM weights in a lossless 12-bit format, following a 2026 Together AI paper, with CUDA kernels for Ampere through Blackwell. Qwen3-8B shrinks from 15.27 to 11.49 GiB, and Qwen3-30B-A3B from 56.88 to 42.80 GiB. The README's throughput results are mixed: up to 1.34× BF16 on Jetson Thor, but 0.81× on B200 at concurrency 32. These figures are self-reported and could not be independently checked.

    Score 0.62Claim check: 4 no source given · 4 couldn’t check

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “Lossless compression of LLMs to 12-bits”

    Comments on “Lossless compression of LLMs to 12-bits”

13. No. 13Score 0.60

    Making Startups Powerful

    paulgraham.com13 minTopics: Product, Growth, StartupsFormat: AnalysisChecked by: Claim-checked

    Summary and score for “Making Startups Powerful”

    In a September 2026 essay, Paul Graham argues that asking what would make a startup more powerful, rather than more profitable, can surface far larger opportunities. His tactics include owning the customer relationship, routing money through the company, adding network effects, going full stack, offering APIs, and selling to fast-deciding early-stage customers. Every move must also benefit the customer. The PayPal, Stripe and Rippling examples and the 2x versus 10-100x return figures are his own assertions, without cited sources, so they read as experience-based heuristics.

    Score 0.60Claim check: 8 no source given

    Elsewhere: HN 1 pts, not on front page

    Score breakdown and claims for “Making Startups Powerful”

    Comments on “Making Startups Powerful”

14. No. 14Score 0.61

    AI agents stole 190k gaming credentials for under $400 in model costs

    Check Point Research14 minTopics: AI, SecurityFormat: PaperChecked by: Claim-checked

    Summary and score for “AI agents stole 190k gaming credentials for under $400 in model costs”

    stcpresearch · research.checkpoint.com

    Check Point Research analyzed ARTEX, an open-source AI pentesting platform that criminals run as autonomous attack fleets, using data from 10 exposed operator databases. In one campaign, agents pulled about 190,000 gaming credentials, roughly 3.3% still valid, for an estimated $180–360 in model costs. A crypto-draining campaign moved no money, and some agent "successes" were hallucinated. Operators barely intervened, mostly used Chinese models, and exploited basic flaws like hardcoded passwords. The figures are Check Point's own and largely unsourced.

    Score 0.61Contestedjudges differ by 0.41 on overclaimClaim check: 1 not in source · 6 no source given · 1 couldn’t check

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “AI agents stole 190k gaming credentials for under $400 in model costs”

    Comments on “AI agents stole 190k gaming credentials for under $400 in model costs”

15. No. 15Score 0.59

    When the Kubernetes API went silent: A three-layer networking mystery

    Google Cloud Blog14 minTopics: DevOps, ITFormat: Write-upChecked by: Claim-checked

    Summary and score for “When the Kubernetes API went silent: A three-layer networking mystery”

    cloud.google.com

    Google Cloud's support team describes a January 2026 GKE incident in which pods intermittently timed out reaching the API server over Private Service Connect. It traced the outage to three interacting faults: packet reordering in Private Service Connect's packet-switching layer, Envoy's half-close keeping sockets in FIN_WAIT_2, and a Linux 6.1 bug that discarded the client's FIN. A switching-layer change then dropped the resulting challenge ACKs. Rolling back that change restored service; the kernel fix ships in GKE 1.33.5 and later. The claims come from Google alone, with no independent source.

    Score 0.59Claim check: 8 no source given

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “When the Kubernetes API went silent: A three-layer networking mystery”

    Comments on “When the Kubernetes API went silent: A three-layer networking mystery”

16. No. 16Score 0.58

    Joggo – a self-hosted GitHub Actions runner for the Windows PC you use

    GitHub14 minTopics: Programming, DevOps, ITFormat: New projectChecked by: 3 judges

    Summary and score for “Joggo – a self-hosted GitHub Actions runner for the Windows PC you use”

    github.com

    Joggo is a self-hosted GitHub Actions runner designed to run for weeks on a single Windows PC with 16 GB of RAM under WSL2, while that PC is also in everyday use.

    Score 0.58

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Joggo – a self-hosted GitHub Actions runner for the Windows PC you use”

    Comments on “Joggo – a self-hosted GitHub Actions runner for the Windows PC you use”

17. No. 17Score 0.58

    Just Fucking Use IPv6

    robin’s page3 minTopics: DevOps, ITFormat: AnalysisChecked by: Claim-checked

    Summary and score for “Just Fucking Use IPv6”

    robin · dreamstation.systems

    Robin argues in an opinionated personal essay that teams should adopt IPv6, keeping a dual-stack CDN edge for IPv4-only users and using NAT64/464XLAT for IPv4-only dependencies. The case is that IPv6 removes the stacked NAT between clients and services and offers cheaper address space than IPv4, where a /24 reportedly costs $5,000–$10,000. Only the Microsoft example, which cites private-range overlap and 10.0.0.0/8 exhaustion, is sourced. The adoption figures (APNIC 43%, Google 50%) and the claims on mobile networks and CDN pricing are unsourced.

    Score 0.58Contestedjudges differ by 0.70 on new informationClaim check: 1 matches source · 6 no source given · 1 couldn’t check

    Elsewhere: HN 5 pts, not on front page

    Score breakdown and claims for “Just Fucking Use IPv6”

    Comments on “Just Fucking Use IPv6”

18. No. 18Score 0.62

    A Unicode Escape Can Turn a Java Comment into Executable Code

    octri.dev12 minTopics: ProgrammingFormat: AnalysisChecked by: Claim-checked

    Summary and score for “A Unicode Escape Can Turn a Java Comment into Executable Code”

    Emad Khair

    Emad Khair at octri.dev shows how text in an OpenAPI spec can change generated SDK code. In Java, a \u000a escape inside a // comment becomes a newline before comment parsing, so the following statement runs; he reproduced this on OpenJDK 21, though no independent source is cited. Similar cases include PHP's ?>, Ruby's #{} interpolation, Go backticks and Rust doc-test fences. His advice: use per-language emitters, preserve original values, and test output with real toolchains. Python 3.13 and rustdoc claims weren't verified.

    Score 0.62Claim check: 4 matches source · 2 no source given · 2 couldn’t check

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “A Unicode Escape Can Turn a Java Comment into Executable Code”

    Comments on “A Unicode Escape Can Turn a Java Comment into Executable Code”

19. No. 19Score 0.62

    Claude Watermark Text

    Notebookcheck3 minTopics: AI, PolicyFormat: NewsChecked by: Claim-checked

    Summary and score for “Claude Watermark Text”

    Steffen Zahn · notebookcheck.net

    Anthropic has begun adding an invisible statistical watermark to text from Claude Mythos 5, Opus 4.7 and Sonnet 4.6, with Opus 4.6, Opus 4.5, Sonnet 4.5 and Haiku 4.5 due November 16. Customers cannot disable it, and Anthropic says it carries no user or conversation data. Notebookcheck, citing The Decoder, reports it is a SynthID variant. Detection is limited to a private preview. Reports that non-default temperature, top_p or top_k settings may defeat it, and that EU rules drive the timing, could not be verified.

    Score 0.62Claim check: 6 matches source · 2 couldn’t check

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “Claude Watermark Text”

    Comments on “Claude Watermark Text”

20. No. 20Score 0.61

    Are Passkeys a Trap?

    jimthefrog.substack.com16 minTopics: SecurityFormat: AnalysisChecked by: Claim-checked

    Summary and score for “Are Passkeys a Trap?”

    Jim Taylor

    Jim Taylor rebuts an anonymous essay claiming passkeys let websites use attestation to control which software people run. He argues attestation is optional, most consumer sites don't request it, and major software managers seem to return none. The AAGUID, a model identifier, can be spoofed and reveals little about the OS or browser. Some banks, such as Docomo SMTB Net Bank, do restrict managers. Several of his claims, including FIDO membership figures, are unsourced or unchecked. For builders, AAGUID allow-lists suit policy guidance, not strict enforcement.

    Score 0.61Claim check: 3 matches source · 3 no source given · 2 couldn’t check

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “Are Passkeys a Trap?”

    Comments on “Are Passkeys a Trap?”

21. No. 21Score 0.57

    Six GPUs on One X16 Slot: R9700s and RTX 3090s Behind a PCIe Switch

    doug.sh6 minTopics: AI, HardwareFormat: Write-upChecked by: Claim-checked

    Summary and score for “Six GPUs on One X16 Slot: R9700s and RTX 3090s Behind a PCIe Switch”

    Doug Calobrisi

    Doug Calobrisi describes running six GPUs from one x16 slot on a consumer X570 board: four Radeon AI PRO R9700s and two RTX 3090s behind a Broadcom PEX88096 switch, each card on its own x8 link. On the R9700s, Qwen3.8-27B at TP4 reports about 4,700 tokens/s prefill at 32k and 601 tokens/s across sixteen clients. The numbers are the author's own, unsourced measurements on one setup. The build also needed custom kernel modules for BAR sizing.

    Score 0.57Contestedjudges differ by 0.42 on significanceClaim check: 1 matches source · 6 no source given · 1 couldn’t check

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “Six GPUs on One X16 Slot: R9700s and RTX 3090s Behind a PCIe Switch”

    Comments on “Six GPUs on One X16 Slot: R9700s and RTX 3090s Behind a PCIe Switch”

22. No. 22Score 0.55

    N6k – Let users and agents run untrusted SQL on production databases

    GitHub5 minTopics: Programming, AI, Security, DataFormat: ReleaseChecked by: Claim-checked

    Summary and score for “N6k – Let users and agents run untrusted SQL on production databases”

    github.com

    n6kd, an open-source server on GitHub, exposes DuckDB catalogs over WebSocket using the n6k protocol, so users and AI agents can run SQL against production data under row-level limits. A YAML policy sets per-table select, insert, update and delete predicates, and OIDC token claims such as $sub can scope each client to its own rows. Without a policy file, every catalog is served read/write. The project's documentation is the only source for these claims, and it shows no independent testing.

    Score 0.55Contestedjudges differ by 0.41 on substantiated, 0.60 on overclaimClaim check: 1 matches source · 7 no source given

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “N6k – Let users and agents run untrusted SQL on production databases”

    Comments on “N6k – Let users and agents run untrusted SQL on production databases”

23. No. 23Score 0.57

    Virtualized Redox: from Virtio-FS to Cloud Hypervisor, and beyond

    redox-os.org16 minTopics: Programming, DevOpsFormat: Write-upChecked by: Claim-checked

    Summary and score for “Virtualized Redox: from Virtio-FS to Cloud Hypervisor, and beyond”

    MJ Pooladkhay describes building a Virtio-FS driver for Redox OS, now merged into the base repository, and getting Redox to boot to a shell on Cloud Hypervisor.

    Score 0.57Claim check: 2 no source given · 6 couldn’t check

    Elsewhere: HN —

    Score breakdown and claims for “Virtualized Redox: from Virtio-FS to Cloud Hypervisor, and beyond”

    Comments on “Virtualized Redox: from Virtio-FS to Cloud Hypervisor, and beyond”

24. No. 24Score 0.61

    Designing an Always-On Agent

    Rubric Labs8 minTopics: AIFormat: AnalysisChecked by: Claim-checked

    Summary and score for “Designing an Always-On Agent”

    Dexter Storey · rubriclabs.com

    An engineering post argues that the gap between today's chatbots and the Jarvis-style assistant is mostly about form factor rather than raw model capability. It describes an architecture for an always-on agent: a single thread that manages its own context through compaction tools, sub-agents for heavy work, a heartbeat for…

    Score 0.61Claim check: 1 matches source · 7 no source given

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “Designing an Always-On Agent”

    Comments on “Designing an Always-On Agent”

25. No. 25Score 0.55

    Running a Language Model on a $35 FPGA

    Another Dev's Two Cents6 minTopics: AI, HardwareFormat: New projectChecked by: 3 judges

    Summary and score for “Running a Language Model on a $35 FPGA”

    nishtahir.com

    Nishta Hirani-Nelson's write-up describes running a 1.07M-parameter Transformer language model on a $35 iCE40UP5K FPGA with only open-source tooling and no softcore CPU. It is notable because the design fits in about 144 KB of memory and integer-only arithmetic, using a mixture-of-experts layer, rotary embeddings, and gated delta nets, generating…

    Score 0.55

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Running a Language Model on a $35 FPGA”

    Comments on “Running a Language Model on a $35 FPGA”

26. No. 26Score 0.60

    Optimizing reference deletions in Git

    Karthik Nayak6 minTopics: ProgrammingFormat: Write-upChecked by: Claim-checked

    Summary and score for “Optimizing reference deletions in Git”

    nayak.im

    A GitLab engineer describes how Git's files backend rewrites the entire packed-refs file on every packed reference deletion, which gets slow in repositories with millions of refs. While benchmarking a Rust reimplementation, they found the C version needlessly reformatted unchanged entries.

    Score 0.60Claim check: 1 matches source · 3 no source given · 4 couldn’t check

    Elsewhere: HN 2 pts, not on front page

    Score breakdown and claims for “Optimizing reference deletions in Git”

    Comments on “Optimizing reference deletions in Git”

27. No. 27Score 0.60

    GitHub AI Vulnerability Scans for Repositories

    GitHub Docs4 minTopics: Programming, AI, SecurityFormat: ReleaseChecked by: 3 judges

    Summary and score for “GitHub AI Vulnerability Scans for Repositories”

    docs.github.com

    GitHub has launched AI Scan for repositories in public preview, an on-demand scanner that uses a proprietary harness with multiple models to find security vulnerabilities on a repository's default branch across all languages, including those CodeQL does not cover.

    Score 0.60Contestedjudges differ by 0.61 on substantiated, 0.44 on technical depth

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “GitHub AI Vulnerability Scans for Repositories”

    Comments on “GitHub AI Vulnerability Scans for Repositories”

28. No. 28Score 0.61

    DSpine for Qwen3.8-27B

    huggingface.co2 minTopics: AIFormat: ReleaseChecked by: 3 judges

    Summary and score for “DSpine for Qwen3.8-27B”

    Tencent has released DSpine, a five-layer speculative decoding draft model for Qwen3.8-27B that generates 16 draft tokens in parallel and passes predicted features between adjacent positions to carry causal dependencies through depth.

    Score 0.61

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “DSpine for Qwen3.8-27B”

    Comments on “DSpine for Qwen3.8-27B”

29. No. 29Score 0.60

    Offline context-aware dictation without screenshots, LLMs or fine-tuning

    morethanamachine.com13 minTopics: Programming, AIFormat: New projectChecked by: 3 judges

    Summary and score for “Offline context-aware dictation without screenshots, LLMs or fine-tuning”

    Handy Context is a fork of the open-source offline dictation app Handy that reads the front window's text, such as slide titles, to help the Parakeet speech model spell names and jargon correctly, without sending audio or screen text to the cloud.

    Score 0.60

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “Offline context-aware dictation without screenshots, LLMs or fine-tuning”

    Comments on “Offline context-aware dictation without screenshots, LLMs or fine-tuning”

30. No. 30Score 0.56

    Debezium Postgres WAL Subscription Monitoring

    Turbolytics3 minTopics: DevOps, DataFormat: Write-upChecked by: Claim-checked

    Summary and score for “Debezium Postgres WAL Subscription Monitoring”

    turbolytics.io

    A Control engineering write-up says Debezium connectors can report RUNNING while a Postgres replication slot quietly holds growing WAL until the disk fills. In their tests on Debezium 3.4.3, a popular heartbeat fix stopped the growth but broke the next restart.

    Score 0.56Claim check: 4 no source given · 4 couldn’t check

    Elsewhere: HN 1 pts, not on front page

    Score breakdown and claims for “Debezium Postgres WAL Subscription Monitoring”

    Comments on “Debezium Postgres WAL Subscription Monitoring”

31. No. 31Score 0.60

    I shipped a CLI and what I run is a proxy

    Thiago Avelino4 minTopics: Programming, AI, DevOpsFormat: Write-upChecked by: 3 judges

    Summary and score for “I shipped a CLI and what I run is a proxy”

    Thiago Avelino · avelino.run

    The author, Avelino, describes how his open-source MCP command-line tool, first built as a local terminal utility, became a shared proxy that now handles about 196,000 requests a day at his employer Buser.

    Score 0.60

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “I shipped a CLI and what I run is a proxy”

    Comments on “I shipped a CLI and what I run is a proxy”

32. No. 32Score 0.60

    Goldman Sachs Is Pulling Claude Code from Its Bankers and Traders

    State of AI5 minTopics: AI, FintechFormat: NewsChecked by: 3 judges

    Summary and score for “Goldman Sachs Is Pulling Claude Code from Its Bankers and Traders”

    SO_AI News Team · thestateofai.com

    Goldman Sachs has restricted Anthropic's Claude Code and Microsoft's GitHub Copilot tools to its roughly 12,000 engineers under October guidance, cutting off traders and bankers who used them to monitor client flows and build market models, Bloomberg News reported.

    Score 0.60

    Elsewhere: HN 684 pts, front page

    Score breakdown for “Goldman Sachs Is Pulling Claude Code from Its Bankers and Traders”

    Comments on “Goldman Sachs Is Pulling Claude Code from Its Bankers and Traders”

33. No. 33Score 0.60

    LLMs can understand and write neural network weights

    GitHub4 minTopics: AIFormat: ReleaseChecked by: 3 judges

    Summary and score for “LLMs can understand and write neural network weights”

    github.com

    The RikiyaT/lm_understand-logs repository publishes complete logs from eight experiments, testing whether LLMs can read and write neural network weights. Each run records prompts, replies, reasoning summaries, sandboxed code and outputs, and evaluations.

    Score 0.60

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “LLMs can understand and write neural network weights”

    Comments on “LLMs can understand and write neural network weights”

34. No. 34Score 0.59

    What 1.5T tokens cost per month

    Peter Piekarczyk11 minTopics: AIFormat: AnalysisChecked by: 3 judges

    Summary and score for “What 1.5T tokens cost per month”

    peterp.me

    A Peter P. post, later corrected, claimed that 1.5 trillion tokens a month would cost about $132M a year at list price. He now says that figure was 20x too high: with prompt caching, roughly 97% of an agent's tokens bill as cache reads at a small fraction of input…

    Score 0.59Contestedjudges differ by 0.54 on new information

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “What 1.5T tokens cost per month”

    Comments on “What 1.5T tokens cost per month”

35. No. 35Score 0.59

    Updates to JWT Client Authentication and Assertion-Based Authorization Grants

    rfc-editor.org16 minTopics: SecurityFormat: OtherChecked by: Claim-checked

    Summary and score for “Updates to JWT Client Authentication and Assertion-Based Authorization Grants”

    Filip Skokan

    RFC 10070, a November 2026 IETF Standards Track document, tightens audience-value rules in OAuth 2.0 client authentication and assertion-based grants (RFCs 7521, 7522, 7523, 9126). It follows a vulnerability disclosed by University of Stuttgart researchers.

    Score 0.59Claim check: 1 differs from source · 4 no source given · 3 couldn’t check

    Elsewhere: HN 1 pts, not on front page

    Score breakdown and claims for “Updates to JWT Client Authentication and Assertion-Based Authorization Grants”

    Comments on “Updates to JWT Client Authentication and Assertion-Based Authorization Grants”

36. No. 36Score 0.59

    My Local Coding Agent

    hdembinski.github.io11 minTopics: Programming, AI, HardwareFormat: Write-upChecked by: 3 judges

    Summary and score for “My Local Coding Agent”

    A developer describes running coding agents locally on a used RTX 3090 with open-weight Qwen3.8-27B and Gemma 4 via llama.cpp, citing sovereignty, privacy, and cost. He reports that agents now write full features well but remain weak at design and consistency, and that his own coding skills are atrophying.

    Score 0.59

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “My Local Coding Agent”

    Comments on “My Local Coding Agent”

37. No. 37Score 0.59

    PHP2Shell — Deep Dive

    djad04.github.io77 minTopics: Programming, SecurityFormat: Write-upChecked by: 3 judges

    Summary and score for “PHP2Shell — Deep Dive”

    A long, self-described learning walkthrough of PHP2Shell, a set of PHP vulnerabilities, explains stale pointers, use-after-free reads and writes, and heap grooming, building toward a multi-stage memory-corruption exploit chain that ends in remote code execution on a CTF challenge.

    Score 0.59Contestedjudges differ by 0.60 on new information

    Elsewhere: HN 3 pts, not on front page

    Score breakdown for “PHP2Shell — Deep Dive”

    Comments on “PHP2Shell — Deep Dive”

38. No. 38Score 0.59

    Aaronson-Ambainis Conjecture proved! (By AI, of course)

    Shtetl-Optimized (Scott Aaronson)5 minTopics: AIFormat: AnalysisChecked by: 3 judges

    Summary and score for “Aaronson-Ambainis Conjecture proved! (By AI, of course)”

    Scott · scottaaronson.blog

    Scott Aaronson reports that the Aaronson-Ambainis Conjecture, posed in 2009, has been proved by Physical Superintelligence, led by David Turturean and Jim Halverson, using an internal Claude model and a research harness.

    Score 0.59Contestedjudges differ by 0.49 on reader interest

    Elsewhere: HN —

    Score breakdown for “Aaronson-Ambainis Conjecture proved! (By AI, of course)”

    Comments on “Aaronson-Ambainis Conjecture proved! (By AI, of course)”

39. No. 39Score 0.58

    I Just Deleted All My Agent Skills

    Philipp D. Dubach1 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges

    Summary and score for “I Just Deleted All My Agent Skills”

    Philipp D. Dubach · philippdubach.com

    A blogger reports deleting all their AI agent skills after reviewing benchmark evidence. One study of 98 public software engineering skills found 92 had no significant effect on coding results, and web development skills lowered pass rates while raising token costs by 72% to 394%.

    Score 0.58Contestedjudges differ by 0.50 on new information, 0.58 on overclaim

    Elsewhere: HN 8 pts, not on front page

    Score breakdown for “I Just Deleted All My Agent Skills”

    Comments on “I Just Deleted All My Agent Skills”

40. No. 40Score 0.58

    A kernel written in Rust that can boot Ubuntu with Plasma desktop

    GitHub2 minTopics: ProgrammingFormat: New projectChecked by: 3 judges

    Summary and score for “A kernel written in Rust that can boot Ubuntu with Plasma desktop”

    github.com

    ruxis is an open-source Unix-like kernel written in Rust, released on GitHub under the MIT license, that implements Linux's system call interface so unmodified Linux user-space programs run on it.

    Score 0.58

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “A kernel written in Rust that can boot Ubuntu with Plasma desktop”

    Comments on “A kernel written in Rust that can boot Ubuntu with Plasma desktop”

41. No. 41Score 0.58

    The great software IP writedown

    Martin Alderson7 minTopics: AI, Product, StartupsFormat: AnalysisChecked by: 3 judges

    Summary and score for “The great software IP writedown”

    Martin Alderson · martinalderson.com

    Martin Alderson argues on his blog that software's historically high margins came from a scarcity of people able to build it, not from monopoly, network effects, or corruption.

    Score 0.58

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “The great software IP writedown”

    Comments on “The great software IP writedown”

42. No. 42Score 0.58

    OpenSSL 3.4 and 3.6 End of Life

    openssl-library.org1 minTopics: SecurityFormat: NewsChecked by: 3 judges

    Summary and score for “OpenSSL 3.4 and 3.6 End of Life”

    OpenSSL has announced that its 3.4 and 3.6 series have reached end of life, meaning they will no longer receive publicly available security fixes. Version 3.4 reached EOL on 22 October 2026 and 3.6 on 1 November 2026.

    Score 0.58Contestedjudges differ by 0.75 on new information

    Elsewhere: HN 1 pts, not on front page

    Score breakdown for “OpenSSL 3.4 and 3.6 End of Life”

    Comments on “OpenSSL 3.4 and 3.6 End of Life”

43. No. 43Score 0.58

    The Stone Age of Local Coding Agents

    deadneurons.substack.com7 minTopics: Programming, AI, Security, DevOpsFormat: AnalysisChecked by: 3 judges

    Summary and score for “The Stone Age of Local Coding Agents”

    Nick Rogers

    Writer Ryan (author of "The Stone Age of Local Coding Agents") argues that running autonomous coding agents directly on developers' laptops is a security and efficiency dead end.

    Score 0.58

    Elsewhere: HN 3 pts, not on front page

    Score breakdown for “The Stone Age of Local Coding Agents”

    Comments on “The Stone Age of Local Coding Agents”

44. No. 44Score 0.57

    AI Companies Want to Buy Your Work Files and Emails

    WIRED7 minTopics: AI, Data, Startups, PolicyFormat: AnalysisChecked by: 3 judges

    Summary and score for “AI Companies Want to Buy Your Work Files and Emails”

    Steven Levy · wired.com

    AI labs and data brokers are paying companies and freelancers for copies of internal documents, emails, messages, and transcripts to train models on realistic workplace tasks, with reported offers ranging from about $350,000 to $2 million.

    Score 0.57Contestedjudges differ by 0.42 on overclaim

    Elsewhere: HN 3 pts, not on front page

    Score breakdown for “AI Companies Want to Buy Your Work Files and Emails”

    Comments on “AI Companies Want to Buy Your Work Files and Emails”

45. No. 45Score 0.56

    LLMs are terrible at designing AI systems

    Sean Goedecke4 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges

    Summary and score for “LLMs are terrible at designing AI systems”

    seangoedecke.com

    Sean Goedecke argues that LLMs are poor at designing software that uses LLMs, often reaching for brittle symbolic or regex approaches instead of simply calling a model. He offers three explanations: pre-LLM training code, reinforcement learning environments that rarely involve calling LLMs, and general weakness in software design.

    Score 0.56Contestedjudges differ by 0.42 on overclaim

    Elsewhere: HN 5 pts, not on front page

    Score breakdown for “LLMs are terrible at designing AI systems”

    Comments on “LLMs are terrible at designing AI systems”

46. No. 46Score 0.55

    Teach Students to Code in English

    commitcapital.substack.com6 minTopics: Programming, AIFormat: AnalysisChecked by: 3 judges

    Summary and score for “Teach Students to Code in English”

    Andrew Aymeloglu

    In this essay, Commit Capital's Aaymeloglu argues that computer science programs should embrace AI coding agents beyond the introductory courses, and describes a spring course at the University of Austin that did so. Students shipped deployed full-stack apps, while exams shift toward written prose about design tradeoffs.

    Score 0.55

    Elsewhere: HN 2 pts, not on front page

    Score breakdown for “Teach Students to Code in English”

    Comments on “Teach Students to Code in English”