hnbot

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
----
- 52 minutes ago | 15 points | 0 comments
- URL: https://socket.dev/blog/bitwarden-cli-compromised
- Discussions: https://news.ycombinator.com/item?id=47876043
- Summary: Bitwarden CLI version 2026.4.0 has been compromised as part of the ongoing Checkmarx supply chain campaign. Socket researchers discovered that attackers exploited a compromised GitHub Action in Bitwarden's CI/CD pipeline to inject malicious code into the bw1.js file of the npm package @bitwarden/cli. This attack follows the same pattern identified in the broader Checkmarx supply chain compromise targeting multiple repositories. Users are advised to review CI logs and rotate any secrets potentially exposed to the compromised workflow. Socket's research team continues investigating and will publish detailed technical findings, indicators of compromise, and remediation guidance. This incident represents a significant supply chain security breach affecting password management tools.

• 11 minutes ago | 4 points | 0 comments
• URL: https://www.rightscon.org/rc26-statement/
• Discussions: https://news.ycombinator.com/item?id=47978386
• Summary: Access Now announced the cancellation of RightsCon 2026 in Zambia just days before the summit was to convene over 2,600 participants. The organization attributes the cancellation to foreign interference, specifically diplomatic pressure from the People's Republic of China regarding the participation of Taiwanese civil society members.

Following extensive planning and signed agreements with Zambian ministries, organizers received urgent indications on April 27 that PRC diplomats objected to Taiwanese attendees. On April 28, state media announced a "postponement" without prior consultation. Access Now subsequently received informal demands to censor discussion topics and exclude Taiwanese participants from both physical and virtual attendance.

The organization refused these conditions as unacceptable violations of their principles. They characterize the government's unilateral action—executed without formal notice or good-faith communication—as evidence of transnational repression targeting civil society, violating fundamental freedoms of assembly, association, and expression. While expressing disappointment for regional partners, Access Now reaffirmed its commitment to the digital rights movement and indicated it will reconvene the community at a time and location determined through future consultation.

• 49 minutes ago | 28 points | 4 comments
• URL: https://twitter.com/ryangrim/status/2055992439031185782
• Discussions: https://news.ycombinator.com/item?id=48170810
• Summary: Meta is reportedly planning to delete an account with over one million followers belonging to Ahmed, who was arrested and later acquitted in Kuwait during a government crackdown. The action is criticized as capitulating to Kuwaiti authorities.

• 3 hours ago | 40 points | 11 comments
• URL: https://therepublicofletters.substack.com/p/calvin-and-hobbes-and-the-price-of
• Discussions: https://news.ycombinator.com/item?id=48557079
• Summary: This article details Bill Watterson’s uncompromising artistic integrity during and after the ten-year run of Calvin and Hobbes. Despite the strip’s massive success in over 2,400 newspapers, Watterson refused lucrative merchandising deals, battling his syndicate for six years to prevent toys, apparel, and adaptations he felt would cheapen his work. He insisted on a “one-man operation,” controlling every word and line. After winning creative autonomy—including unprecedented sabbaticals and freedom to design Sunday strips without rigid formats—the heightened demands led to burnout. Watterson retired the strip at the end of 1995, later withdrawing almost entirely from public life and declining to discuss his creation. The piece connects his early college act of painting and then whitewashing a ceiling mural to his final comic, framing his career as a testament to creative purity over commercial gain.

• an hour ago | 50 points | 20 comments
• URL: https://futurism.com/artificial-intelligence/ai-companies-hide-debt-off-balance-sheet
• Discussions: https://news.ycombinator.com/item?id=49020999
• Summary: A Nikkei Asia investigation found five major US tech giants—Alphabet, Microsoft, Amazon, Meta, and Oracle—are concealing an estimated $1.65 trillion in off-balance-sheet debt, surpassing their $1.35 trillion in officially reported obligations. Meta alone holds approximately $420 billion in hidden debt. The companies allegedly use special purpose vehicles and subsidiaries, reminiscent of Enron's accounting practices, to mask the true cost of massive AI data center investments. Critics warn this obfuscation indicates severe financial strain as the industry pours billions into infrastructure amid an AI bubble. Experts highlight a growing disconnect between soaring valuations and weak profits. Firms are also issuing new shares to raise capital, risking equity dilution and diminished investor confidence. Analysts caution that if AI demand fails to justify this spending spree or the bubble bursts, these hidden liabilities could leave the companies dangerously exposed.

I asked Claude build a physically accurate O'Neill cylinder you can walk around
----
- an hour ago | 13 points | 7 comments
- URL: https://island-three.gruberbuilds.workers.dev/
- Discussions: https://news.ycombinator.com/item?id=49957191

Show HN: Build with Python – a beginner course where your code draws
----
- 2 hours ago | 9 points | 2 comments
- URL: https://scimigo.com/en/learn/build-with-python/01-draw-with-python
- Discussions: https://news.ycombinator.com/item?id=49956771
- Summary: This is a lesson page from SciMigo, a platform for learning programming by watching code run. The lesson, "Draw with Python," is the first in a series and takes about 45 minutes. It teaches function calls, variables, loops, and click events. Learners build a robot, a row of circles, and a click-to-draw painting program. The page includes navigation, a feedback option, and links to courses, company info, and community resources.

Homa: The End of TCP for AI Clusters [video]
----
- 38 minutes ago | 6 points | 0 comments
- URL: https://www.youtube.com/watch?v=eZ8WWZzoaR0
- Discussions: https://news.ycombinator.com/item?id=49957117
- Summary: This content is a YouTube page for a video titled "Homa: The End of TCP for AI Clusters" by John Ousterhout from Stanford. The page includes standard YouTube navigation elements such as links to About, Press, Copyright, Contact, Creators, Advertise, Developers, Terms, Privacy, Policy & Safety, and information about how YouTube works, along with a copyright notice for Google LLC. The video itself appears to discuss Homa, a network protocol proposed as a potential replacement for TCP in AI cluster environments.

Improper redaction reveals Google Data Center water and electricity usage
----
- 43 minutes ago | 17 points | 4 comments
- URL: https://www.1011now.com/2026/09/30/more-questions-than-answers-about-lincolns-google-data-center-water-electricity-usage/
- Discussions: https://news.ycombinator.com/item?id=49957068
- Summary: Nebraska data centers must submit annual reports to the state's Department of Water, Energy, and Environment, but some claim usage data as trade secrets. Google's Lincoln data center (Agate LLC) redacted electricity and water usage, yet improper redaction allowed the figures to be revealed: 52.65 megawatts peak electricity and 13.299 megagallons (about 13 million gallons) of water annually. This is enough to fill roughly 20 Olympic pools. Six data centers reported a combined 765 million gallons of water last year. The Papillion Google center (Fireball Group LLC) used the most water at 547.88 megagallons. The article also reveals expected 2025 tax refunds: Agate LLC $55.8 million, Fireball LLC $39.2 million, and Westwood Solutions LLC (Omaha) $22.6 million. Agate's facility is 288,530 square feet. These reports are part of Governor Jim Pillen's executive order requiring data centers to self-report resource impacts. Reports are due by Sept. 30 and are publicly accessible.

Remove and Disable Apple Macos27 AI Models Tool
----
- 37 minutes ago | 19 points | 4 comments
- URL: https://github.com/omlahore/RemoveMacAI
- Discussions: https://news.ycombinator.com/item?id=49957116
- Summary: RemoveMacAI is a GitHub tool that disables Apple Intelligence on macOS 27 and reclaims disk space by removing its downloaded models. It offers a one-command, fully reversible solution. The tool turns off features like Siri, Writing Tools, Genmoji, Image Playground, ChatGPT extension, summaries, smart replies, and more. It removes foundation models and those for image generation, Genmoji, Spatial Photos, and Xcode completion. It works via a configuration profile and Apple's asset service, without modifying system files or making network requests. Installation is via a curl script or Homebrew. Usage includes commands like `removemacai status`, `off`, `revert`, and `features`. It requires Apple silicon and supports macOS 27 only. The tool is based on the "pared" project and is MIT licensed.

How effective altruism conquered the world (and might yet end it)
----
- 6 hours ago | 10 points | 0 comments
- URL: https://www.economist.com/international/2026/10/01/how-effective-altruism-conquered-the-world
- Discussions: https://news.ycombinator.com/item?id=49953777

How to scale intent, quality, and artistry with AI [video]
----
- 10 hours ago | 8 points | 1 comments
- URL: https://www.youtube.com/watch?v=GLvFTMtw4Jk
- Discussions: https://news.ycombinator.com/item?id=49951891
- Summary: This is a YouTube page for a video titled "How to scale intent, quality, and artistry with Al" featuring Katie Dill from Stripe, along with standard YouTube navigation links and copyright information.

Results from the Jane Street hardware puzzle
----
- 2 days ago | 10 points | 0 comments
- URL: https://blog.janestreet.com/asic-puzzle-results/
- Discussions: https://news.ycombinator.com/item?id=49934078
- Summary: Jane Street published results from their ASIC reverse-engineering puzzle, which asked solvers to determine the function of a small chip from its GDS layout. About 400 people from 30+ countries submitted solutions. The chip was a hardware checker for an 11x11 Star Battle puzzle ("Two Not Touch"), requiring exactly two stars per row, column, and region, with no adjacent stars. Solvers used various approaches: extracting gate-level netlists with tools like KLayout and Magic, simulating circuits, tracing logic backwards from the success output, dynamic exploration with impulse testing, SAT solving, and reverse-engineering the LFSR-obfuscated output generator. The solution string was "(* TWO STARS *)". The layout contained several Easter eggs, including a Morse code message, a Jane Street logo made of metal shapes, and hidden failure messages. The post highlights notable submissions, including FPGA synthesis, Minecraft recreation, SPICE simulation, and zero-knowledge proofs. Takeaways emphasize that AI tools are changing how such challenges are approached, and that solvers who verified their tools with additional tests found hidden bugs. The post also promotes Jane Street's hardware team and an upcoming ASIC competition.

A parasitic Fibonacci computation inside /usr/bin/top
----
- 2 days ago | 14 points | 4 comments
- URL: https://seriot.ch/computation/terminfo/
- Discussions: https://news.ycombinator.com/item?id=49935250
- Summary: The article demonstrates that ncurses terminfo's parameter expansion language can simulate a two-counter Minsky machine, making it computationally universal under idealized unbounded counters and expansion steps. It provides examples: an addition machine (4+9=13) and a Fibonacci sequence generator, both executed by repeatedly expanding the `cup` capability via `tput -S`. A variant uses `/usr/bin/top` as an external clock, redrawing the screen and triggering cursor moves that advance the machine. The author notes that while terminfo lacks internal loops, repeated expansions provide the clock. Security implications are discussed: the behavior is a hack, not a bug, and terminfo expansion cannot open files or execute commands, so it poses no privilege escalation risk unless the parser itself is vulnerable. The conclusion emphasizes that terminfo is a small stateful programming language, not just passive terminal metadata.

Building a RAG Pipeline for Semantic Code Search
----
- 58 minutes ago | 17 points | 0 comments
- URL: https://blog.jetbrains.com/ai/2026/09/building-a-rag-pipeline-for-semantic-code-search-a-developer-diary-and-field-notes/
- Discussions: https://news.ycombinator.com/item?id=49956148
- Summary: This blog post from JetBrains describes the development of Air Context, a RAG pipeline for semantic code search that helps LLM coding agents find relevant code. The first part covers parsing, chunking, and vectorization.

For chunking, the authors explain that fixed-size splitting fails because it groups unrelated code. Instead, they use structure-aware parsing with JetBrains' parsers for nine major languages, keeping declarations with their documentation and annotations while removing meaningless ones. Chunks are normalized and evaluated using an LLM-as-a-judge approach.

For vectorization, they discuss storage optimization. A 4,096-dimension vector in 32-bit floats weighs ~16KB, making millions of chunks expensive. They chose to keep all dimensions but reduce precision to one bit per component, using binary quantization. This preserves coverage of all semantic "questions" the model asks, even at the cost of precision. Binary vectors are compared using Hamming distance, which is computationally cheaper than cosine similarity. This sacrifices some recall but works well for agent consumption where ranking neighborhood matters more than exact ordering.

They also discuss embedding chunks with abbreviated file paths, handling monorepo path lengths, and privacy considerations—storing only coordinates, not code content, and using open-weight models on their own infrastructure.

'Neanderthals Among Us' by Peter Sahlins Review
----
- 22 hours ago | 6 points | 0 comments
- URL: https://www.historytoday.com/archive/review/neanderthals-among-us-peter-sahlins-review
- Discussions: https://news.ycombinator.com/item?id=49947565

Software Engineering Is Dead. Long Live Product Engineering
----
- 27 minutes ago | 5 points | 0 comments
- URL: https://newsletter.chainofthought.show/p/software-engineering-is-dead-long
- Discussions: https://news.ycombinator.com/item?id=49956358
- Summary: The article argues that AI has made coding cheap, shifting the role of engineers from writing code to product engineering—understanding user needs and providing context to AI agents. Laurie Voss, npm co-founder, compares this to 1960s systems analysts. Product sense, customer interaction, and context engineering become key skills. Agents still struggle with maintenance and customer-facing roles, but the trend is accelerating. The author predicts this shift will happen in 2-5 years, not 10. Junior engineers face challenges as AI handles execution work, so building in public and creating open-source projects is advised. Companies need to reinvest in apprenticeships and training for requirement extraction. The piece ends with a cautionary note about an impending bubble, similar to 1997 web era, but with time to retrain.

The CISA Alert: Security Beyond Solitary Confinement
----
- 20 minutes ago | 4 points | 0 comments
- URL: https://jnior.com/blog/the-cisa-alert-security-beyond-solitary-confinement/
- Discussions: https://news.ycombinator.com/item?id=49956416
- Summary: The blog post discusses CISA's urgent warning about Internet-exposed operational technology (OT) and the need for stronger security. While acknowledging the importance of authentication and network protections, the author argues that requiring more processing power for cryptography can burden OT controllers, which must maintain deterministic operation. The post highlights that most Internet threats are automated scanners, not targeted attacks like Stuxnet. It introduces SYN greylisting, a technique implemented in JANOS (the JNIOR's operating system) that deliberately ignores initial TCP SYN packets, forcing scanners to retry while legitimate clients (which retransmit by design) still connect. This lightweight defense reduces resource consumption and preserves determinism without extra hardware. Tests on a public IP showed that disabling greylisting led to SSH attacks consuming 95% of processor time and even causing a watchdog reset. The author advocates for broader adoption of such low-cost defenses in embedded TCP/IP stacks, shifting the burden back to attackers and broadening the cybersecurity conversation beyond stronger cryptography.

Show HN: Dataviz, ranked daily from GitHub, NPM, PyPI and CRAN
----
- 15 minutes ago | 3 points | 0 comments
- URL: https://awesomedataviz.com/
- Discussions: https://news.ycombinator.com/item?id=49956183
- Summary: Awesome Dataviz is an open, community-curated directory of 290 data visualization tools, including charting libraries, mapping toolkits, graph visualizers, and dashboards. It ranks tools using live GitHub, npm, PyPI, and CRAN data refreshed daily. The site offers browsing by category (JavaScript, Python, R, C++, Go, .NET, mobile, etc.) and by topic (maps, graphs, 3D, terminal charts, dashboards, machine learning). It features a landscape visualization plotting tools by GitHub stars, lists of most popular tools (e.g., D3.js, Mermaid, Grafana, Apache Superset, Chart.js) and most active tools by commits (e.g., Kibana, Lightdash, Grafana). Recently added tools include D3.js, Grafana, Superset, Metabase, Streamlit, and others. The directory is available to AI agents via an MCP server, JSON API, and llms.txt. It has been maintained since 2014, with content under CC BY 4.0, and is sponsored by Hal9.

What I learnt co-leading an AI Safety bootcamp for legal and governance practit
----
- 8 minutes ago | 4 points | 0 comments
- URL: https://www.lesswrong.com/posts/KtAug62dYRgAS8sqJ/what-i-learnt-co-leading-an-ai-safety-bootcamp-for-legal-and
- Discussions: https://news.ycombinator.com/item?id=49955839
- Summary: The author co-led an AI Safety bootcamp for legal and governance practitioners in East Sussex, organized by ML4Good and EquiStamp. The five-day program brought together 19 senior legal, compliance, risk, and governance professionals from 12 jurisdictions, teaching them the technical aspects of frontier AI systems.

Key insights from the experience: professionals with impressive backgrounds often feel intellectually isolated in their concerns about AI safety; practitioners are already reading AI safety research but struggle to interpret it; non-technical people responsible for technical consequences have a strong need to understand the technology; legal professionals deeply value technical safety expertise; market incentives and AI safety incentives are interconnected, with lawyers and governance professionals well-positioned to influence them; participants immediately applied what they learned, such as rejecting vendor safety claims and recruiting AI safety talent; and lawyers can be as passionate and "nerdy" about technical topics as STEM professionals.

The author emphasizes the importance of building community for professionals working at the intersection of AI, law, and governance, and hopes to expand this approach to reach more practitioners who can influence AI safety through their professional roles.

A Map of Every Lighthouse on the Planet
----
- 2 days ago | 3 points | 0 comments
- URL: https://mapped.earth/lighthouses/world
- Discussions: https://news.ycombinator.com/item?id=49933461
- Summary: This is a webpage from mapped.earth showcasing every lighthouse in the world, displayed on a map with their real light cycles. The site includes navigation to various map features like globe, rivers, pulse, lightning, rainfall, UV, films, blog, and about. It highlights specific regions: Scotland, Brittany, New England, Japan, Norway, and Cape Town. The page title is "Lighthouses of THE WORLD" with a tagline "lighting the world…" and a note that every charted light on the planet is shown on its real cycle.

Car is a smartphone on wheels. Here's who's listening
----
- 6 minutes ago | 4 points | 0 comments
- URL: https://automatictransmission.khoury.northeastern.edu/
- Discussions: https://news.ycombinator.com/item?id=49954882
- Summary: The study, conducted with Consumer Reports, tested 21 connected vehicles and 30 companion apps to assess data privacy. Key findings: 19 of 21 vehicles contacted third parties (including advertisers/trackers) over Wi-Fi; 7 of 30 apps transmitted sensitive identifiers (VIN, location, phone, email) to third parties; pairing an app roughly doubled exposure to tracking companies. The team used controlled Wi-Fi and cellular isolation tests, plus app traffic interception. Manufacturer responses often shifted blame to consumers, with limited opt-out options; Honda was an exception by improving practices. The study highlights a gap between public disclosures and actual data sharing, arguing for greater transparency in the connected-vehicle ecosystem.

Emitting metadata early makes building/checking Rust up to twice as fast
----
- 8 hours ago | 51 points | 8 comments
- URL: https://github.com/PowderworksCode/headstart
- Discussions: https://news.ycombinator.com/item?id=49951218
- Summary: The GitHub repository "headstart" by PowderworksCode introduces a tool that allows dependent Rust crates to start compiling before their dependencies finish type-checking. It works by having rustc write early metadata files after interface checking, enabling cargo to begin dependent crates sooner. For `cargo check`, dependents run to completion on early metadata; for `cargo build`, they analyze early metadata and wait for full metadata before code generation. The project includes patches for rustc and cargo, with performance improvements up to 54% faster for check and 42% for build on 16-core machines. It provides setup scripts, test scripts for error handling, incremental builds, and benchmarks. The repository contains documentation on design, results, and readiness, along with a suite of scripts to measure performance across real projects. The tool aims to reduce idle cores during compilation without changing diagnostics or exit statuses.

The Heilbronn Problem
----
- a day ago | 9 points | 1 comments
- URL: https://math.tejstead.com/heilbronn/
- Discussions: https://news.ycombinator.com/item?id=49939637
- Summary: The Heilbronn Problem asks how to place n points in a unit-area region so that the smallest triangle formed by any three points has the largest possible area, denoted A(n). This site collects the best known configurations for three container shapes: squares, triangles, and optimal convex regions. Each entry provides exact coordinates, symmetry and congruence analysis, references to published proofs, and an in-browser rational arithmetic verifier. The site includes a table of recent record improvements (e.g., new values for triangle n=20 and square n=23 found in 2026), and a comprehensive table of best known values for n from 3 to 36 across the three container types, with values truncated to 8 decimals and ▲ marking entries proven optimal. All figures are regenerated from exactly verified coordinates, with methods and attribution documented.

Run Qwen 3.8 Flash Next (125B) on consumer hardware (RTX 4090) at 100T/s
----
- 28 minutes ago | 18 points | 4 comments
- URL: https://github.com/Niko1221/Strata
- Discussions: https://news.ycombinator.com/item?id=49953495
- Summary: Strata is an open-source inference engine that runs the 125-billion-parameter Qwen3.8-Flash-Next AI model on consumer PCs with NVIDIA or AMD GPUs (12GB+ VRAM), 32GB+ RAM, and 80GB disk. It offers one-click install for Windows/Linux, with setup via AI assistants or manual scripts. The engine distributes work across GPU, RAM, CPU, and SSD, achieving 44–94 tokens/s generation and 1,100–2,650 tokens/s prompt processing on tested gaming PCs. Users can select model sizes (e.g., Q2_0, IQ2_XS, IQ3_S, Coder) based on RAM capacity. It provides a local web app at localhost:8080, OpenAI/Anthropic-compatible APIs, optional image input, and multi-GPU support. Troubleshooting covers common issues like freezes, download interruptions, and port conflicts. The project is MIT-licensed, credits Qwen, ISTA-DASLab, and others, and includes detailed documentation.