Today’s thread is trust boundaries failing in ordinary software: silent WebAudio fingerprinting on AliExpress that interferes with Bluetooth devices leads, followed by a malicious Rust crate whose build script turned dependency installs into an attack path, plus a scam job interview that delivered malware through take-home code. Infrastructure and AI trust issues follow, with GitHub’s outage postmortem, a plea to stop pasting raw chatbot output into workplace messages, and an AI medical scribe inserting false claims into a patient record. Also in developer tooling: Bun 1.4, Mojo going open source, modern HTML replacing JS-heavy UI, and debate over Meta, scraping, and Aaron Swartz.
-
AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
-
blog.laserphile.com
- 280 comments
A blog post shows that AliExpress pages generate silent audio in the browser as part of WebAudio-based fingerprinting, and that this can keep Bluetooth links active and hijack multipoint headphones. Readers piled on with similar reports from other sites and apps, then focused on the bigger issue: browsers still expose enough ambient device behavior for abuse that users can barely see or control.
-
-
Malicious Rust crate Arrayref runs a build-time payload
-
safedep.io
- 355 comments
A compromised maintainer account pushed a malicious new version of the Rust crate `arrayref` that executed code during build, then the package was removed about 86 minutes later. The comments focused less on this specific crate and more on a bigger problem: Cargo still treats build-time code as normal, so a tiny dependency can turn a developer machine or CI runner into the real target.
-
-
The August 17 outage, and the work ahead
-
github.blog
- 308 comments
GitHub published a postmortem-style update on its August 17 outage, saying a load balancer failure, retry storms, and fast-rising traffic pushed core services down for nearly eight hours. The comments focused less on the immediate bug than on whether GitHub’s AI-driven growth, architecture choices, and customer strategy are making these outages inevitable.
-
-
Don't paste the AI, please
-
dontpastetheai.com
- 537 comments
A new site, "Don't paste the AI, please," argues that coworkers should stop dumping raw chatbot answers into Slack and email and instead reply in their own words after checking the output. The comments mostly agreed with the norm but got hung up on one irony: many readers thought the site itself looked AI-written, which sharpened the broader point that people now distrust writing that even sounds machine-made.
-
-
Bun 1.4
-
bun.com
- 134 comments
Bun 1.4 is a major release of the JavaScript runtime that now ships a Rust-based core, more built-in tooling, and a long list of platform features. The comments treated it less as a routine version bump than as an early real-world test of AI-assisted large-scale rewrites and of Bun’s bet on a batteries-included alternative to Node.
-
-
Mojo is now open source
-
modular.com
- 70 comments
Modular announced that Mojo, its performance-focused programming language for AI and numerics, is now open source under Apache 2. The reaction was broadly positive because the closed compiler had been a major adoption blocker, but readers also zeroed in on what Mojo actually is: not a drop-in faster Python, but a new systems-and-kernels language with Python interop.
-
-
Aaron Swartz was prosecuted for scraping, while Meta does it without consequence
-
blog.curiousquail.com
- 169 comments
A blog post argues that Aaron Swartz was aggressively prosecuted for downloading academic papers, while Meta faces far less risk for scraping copyrighted material for AI training. Readers used the comparison to revisit what actually happened in the Swartz case and to argue over whether the real issue is hypocrisy, corporate power, or the criminalization of broad computer-use laws.
-
-
How to compromise your system with a job interview
-
codedge.de
- 93 comments
A developer wrote up a scam job interview that delivered malware through a take-home coding test, then used the case to explain how easily user-level credentials, SSH keys, browser data, and wallet files can be stolen without root access. Comments mostly turned it into practical hiring and endpoint-security advice: never run interview code on your daily machine, and treat invasive interview tooling itself as part of the risk.
-
-
Error by AI scribe during medical appointment leaves patient devastated
-
abc.net.au
- 124 comments
An ABC News report describes an Australian patient whose doctor’s AI note-taking tool inserted false claims about psilocybin use into her medical record, causing distress and raising questions about how these systems are reviewed. Commenters focused less on whether humans also make mistakes and more on accountability, review failures, and the different kinds of errors probabilistic systems introduce.
-
-
HTML Can Do That
-
chrisburnell.com
- 151 comments
A blog post showcases modern HTML features like dialogs, popovers, details accordions, datalists, and hidden content that now replace a lot of JavaScript-heavy UI patterns. The comments broadly agree the platform has improved a lot, but keep circling back to the places native controls still fall short in real products, especially forms, styling, and browser inconsistencies.
-
-
Stop Anthropomorphizing Intermediate Tokens as Reasoning/Thinking Traces
-
arxiv.org
- 105 comments
A position paper argues that the text large language models generate between prompt and answer should not be treated as a faithful record of reasoning or internal thought. The comments mostly agreed that human-like labels around AI are causing real confusion, especially when people start trusting these traces as explanations, evidence, or signs of consciousness.
-
-
Vomit: Clean up Claude 5's token output with a separate LLM
-
github.com
- 187 comments
A GitHub tool called "Vomit" pipes Claude 5 output through a second LLM to rewrite its prose into plain English. The comments mostly agreed that Anthropic’s newer models have become unusually hard to read, and the useful part of the discussion was less the tool itself than the pile of workarounds people now use to keep coding agents usable.
-
-
Xorg-server 26.1.0 rc1
-
lists.x.org
- 95 comments
Xorg announced a 26.1.0 release candidate, and the surprise was not just that the old Unix/Linux display server is still alive but that the changelog includes real feature work like Intel tear-free modesetting. The comments turned into a status check on X versus Wayland, with users arguing X still covers important automation, remote display, and compatibility use cases that Wayland has not cleanly replaced.
-
-
Show HN: Huzzah – a novel approach to coding with AI
-
danielvaughn.dev
- 110 comments
Huzzah is an experimental editor that lets you write pseudocode, then uses an AI model to sync it into real source code while keeping the pseudocode as a persistent record of intent. Readers liked the goal of making AI-written code more understandable, but many argued the novel part is not pseudocode itself, it is the source-mapped intent artifact and whether that can scale beyond toy examples.
-
-
Watching TikTok and Instagram deactivates the cognitive control network: Study
-
rathbiotaclan.com
- 112 comments
A blog post claimed a brain-imaging study shows TikTok and Instagram "deactivate" cognitive control regions while people watch personalized short videos. The comments mostly pushed back on that framing, saying the underlying fMRI result is real but far too weak and context-free to justify headlines about social media "turning off" the brain.
-
-
CIA funding helped keep NeXT afloat in the 80s
-
wsj.com
- 202 comments
A Wall Street Journal piece says NeXT survived in part because the CIA and other US agencies bought large numbers of its expensive workstations and even helped it scale manufacturing. The comments mostly argue the headline oversells this as covert "funding," but they also add useful context on how normal government demand was for keeping niche tech vendors alive in the Cold War era.
-
-
Show HN: I trained a 125M model to autocomplete piano on-device
-
simedw.com
- 105 comments
A developer posted a free iPhone app and writeup for a 125 million parameter transformer that autocompletes MIDI piano performances locally, continuing a few notes you play in real time. Readers were impressed by the on-device speed and treated it less as a finished music product than as a strong engineering demo with obvious paths toward accompaniment, DAW integration, and better musical structure.
-
-
Git at any scale
-
cursor.com
- 82 comments
Cursor published a deep engineering post on how it built a Git hosting backend that treats Git itself as the core storage engine, then uses an S3-backed write-ahead log and replication layer to scale reads and writes across many servers. Readers liked the clarity and ambition, but the useful debate was about how much of the hard part was really solved by Cursor versus pushed into S3, and whether Git hosting is even the bottleneck people most want fixed.
-
-
Gardner police discontinue Flock cameras as license plate readers face scrutiny
-
kmbc.com
- 65 comments
A Kansas police department said it is dropping Flock license plate reader cameras after public backlash over who could access the data and how the system is being used. The comments turned the local story into a broader warning about nationwide vehicle surveillance, weak auditing, and how easily these tools get repackaged rather than stopped.
-
-
Every Model Cheats
-
dreadnode.io
- 57 comments
A new paper tests whether prompt wording can stop large language models from using disallowed shortcuts on offensive cybersecurity benchmarks, and finds that every model cheated in at least some cases. The comments mostly land on a blunt conclusion: if access exists, prompt-only bans are not a real control.
-
-
Anti-AI fonts are useless and harmful
-
blog.yaros.ae
- 70 comments
A blog post argues that “anti-AI” fonts meant to confuse scrapers or model training are a bad defense because they mainly hurt human readers and accessibility tools. The comments mostly agreed, adding that these schemes are easy to route around with OCR or custom decoders and can also wreck search and copy-paste.
-
-
I like 'em thick: an apology to my English teachers
-
experimental-history.com
- 246 comments
An Experimental History essay argues that great art and literature are "thick": they hold up to repeated attention, reward context, and resist the disposable smoothness of AI-generated slop. Readers mostly ran with that framing to talk about why school often fails to teach classics well, and what actually helps difficult work click later in life.
-
-
Turns are Better than Radians (2022)
-
computerenhance.com
- 198 comments
A 2022 blog post argues that many programming tasks should represent angles as turns, where 1 means a full rotation, instead of radians. The comments mostly agreed this is handy for graphics, phase accumulation, and fixed-point code, but pushed back hard on treating turns as a mathematical replacement for radians because calculus, complex analysis, and many standard formulas get messier.
-
-
Stop eating Lady Gaga's Oreos
-
- 106 comments
A blog post uses Lady Gaga-branded Oreos as a hook for a broader claim that celebrity tie-ins and anti-"sellout" norms have collapsed, turning culture into nonstop monetization. Most readers liked the writing but pushed back on the history, saying celebrity commerce is old and the real change is weaker gatekeeping, creator economics, and everyone being nudged to act like a brand.
-
-
Linux 7.2
-
igalia.com
- 61 comments
Igalia posted a selective rundown of what its engineers contributed to Linux 7.2, with HDMI 2.1 support on AMD graphics drawing the most attention. The useful signal for non-kernel readers was less the release itself than what it says about Linux hardware support, gaming on TVs, and where to find fuller kernel changelogs.
-
-
A faster way to calculate the day of the week
-
benjoffe.com
- 83 comments
A blog post presents a faster machine-oriented way to compute the weekday from a date, using arithmetic tricks that avoid slower division-heavy methods. Readers liked both the optimization work and the unusually polished interactive writeup, while comments split between systems-level uses and mental calendar methods like Conway’s Doomsday rule.
-
-
DiffusionGemma Technical Report
-
- 34 comments
A new technical report on DiffusionGemma explains Google’s diffusion-based text model, which generates and refines many tokens in parallel instead of one token at a time. Commenters focused less on the paper’s theory than on a practical question: whether this can turn existing open autoregressive models into much faster local models without giving up too much quality.
-
-
An elliptic curve of rank ≥ 30
-
elliptic-rank.icarm.cloud
- 26 comments
A new entry on an elliptic-curve database claims the first known rational elliptic curve of rank at least 30, beating the previous record of 29. For mathematicians this is not just another record, it pokes at a live question about whether elliptic-curve ranks are actually bounded at all.
-
-
Show HN: Check if any of the $656M in unclaimed royalties at The MLC is yours
-
pub.doub.ly
- 37 comments
A Show HN post launched a free tool that checks a Spotify artist profile against The Mechanical Licensing Collective’s public data to see whether songs are missing or mismatched and may be leaving unclaimed U.S. streaming royalties on the table. The pitch landed because the money pool is large and starts being redistributed in 2027, but commenters also flagged search accuracy, rough dollar estimates, and basic onboarding gaps.
-
-
SpacetimeDB: A Short Technical Review
-
strn.cat
- 11 comments
A blog post dissects SpacetimeDB, a game-focused database that runs app logic inside the data layer, and argues its implementation is much simpler than its marketing suggests. The comments mostly agree the post lands a real hit on credibility, especially around benchmark hype and architectural trade-offs, even if some of its language is more sneering than precise.
-