✷ The archive · 2,536 dispatches
Hacker News
The community has already voted. We read the comments too — a story whose discussion we could not fetch never becomes a dispatch at all. And it is not written once and left: as the discussion keeps heating up, the dispatch is rewritten with whatever the thread has since said.
OnKey: Open-Source Mac Singing Trainer That Learns Any Song's Melody From One Play
OnKey is a free, open-source Mac singing trainer by Daniel Murrell that listens to a song playing in Spotify, Apple Music, or YouTube, learns the lead vocal melody after one play using CREPE, GAME, wav2vec 2.0, and UVR's MDX-Net Karaoke 2, then tracks and scores your pitch live on later plays.
Sweden's Government Offices Block ChatGPT and Claude on Staff Work Computers, Approving Microsoft Copilot Instead
Sweden's Government Offices (Regeringskansliet) will block ChatGPT and Claude on staff work computers from Monday so employees use approved tools such as Microsoft Copilot, while some staff keep access to both models through an in-house AI assistant platform.
Anthropic Uses Claude to Formally Verify 123 OSS-Fuzz Libraries at the RISC-V Assembly Level
Anthropic and Theorem report that Claude autonomously wrote Rocq proofs that 239 fuzzing entry points across 123 OSS-Fuzz libraries never crash on any input under 64 MB, working directly on compiled RISC-V assembly at a scale of roughly 180 million lines of proof, while finding bugs that years of fuzzing missed.
Quad9 to Exit France on November 24, 2026 After Court-Ordered DNS Blocking Ruling
Quad9, the Swiss nonprofit public DNS resolver, will stop serving users in France on November 24, 2026 after a French court ruled for beIN and imposed a €1,000-per-day penalty for refusing to block domain names.
r2d2-tv: A Local Home Screen, Private Browser, and Voice Assistant for webOS TVs
r2d2-tv is an open-source project that replaces a webOS smart TV's home screen with a local one, moves Chromium browsing and voice model inference to a LAN Linux host, and requires root access on a single unvalidated firmware build.
The Decline of Product Lifespan in the Era of AI-Assisted Development
Data from SaaSHub indicates that the median product lifespan has dropped from approximately four years to 1.5 years, a trend driven by the decreasing cost of software production and the rise of AI-generated applications.
Cash App Identity Theft Case: Woman Faces Six Years in Prison for an Account She Never Opened
A scammer opened a Cash App account in Amanda Smith's name using her Social Security number and date of birth, and she now faces up to six years in prison in Arkansas after spending three nights in jail — a case that shows how weak the link between leaked personal data and actual account control can be.
eMudhra 1FA OTP Login Bypass: Why a Public RSA Key and No Rate Limiting Broke the Flow
A researcher demonstrated a complete bypass of eMudhra's 1FA OTP login by reusing the site's own RSA public key to forge OTP requests and brute-forcing the verification endpoint, which the post says has no rate limiting behind a single Cloudflare Turnstile challenge.
The Compiler Was Supposed to End Programming Too: What the 2026 Data Says About AI Coding Agents
An essay arguing that AI coding agents repeat the FORTRAN pattern of automating one layer of programming rather than ending it — supported by 2026 data on adoption, METR's productivity trial, and a growing code-review bottleneck — alongside Hacker News pushback that compilers and LLMs are fundamentally different tools.
Google Cleared 300 Hectares of Finnish Forest for a Data Center: What Regulators Are Investigating
Google's Finnish subsidiary Tuike Finland Oy cleared roughly 300 hectares of forest for a 13 billion euro AI data center project before the full environmental review was complete, prompting Finland's Permit and Supervision Agency (LVV) to demand an explanation and conservationists to seek a construction halt.
TypeUI Micro Interactions: 113 AI-Ready UI Interaction Prompts (Show HN Review)
TypeUI launched a catalog of 113 UI micro-interaction patterns at typeui.sh, each paired with a copyable AI implementation prompt, but Hacker News commenters flagged animation bugs, missing states, and an account-gated, paid prompt library.
HackiOS: Running iOS 16.5 and the XNU Kernel on Android Phones and QEMU
HackiOS, an independent project by OOSEX GANG, boots Apple's open-source XNU kernel (xnu-8796.121.2, the iOS 16.5 kernel) on Android phone hardware and in QEMU to run the unmodified iOS 16.5 user space up through SpringBoard, distributing no Apple files.
Harvey 2026 Integer Multiplication Algorithm Breaks the O(n log n) Barrier
David Harvey claims a new integer‑multiplication algorithm with a provably o(n log n) bit‑complexity, marking a historic break‑through in theoretical computer science and prompting intense community discussion.
Amazon Traced PHP2Shell Exploitation to Oct 17, Four Days Before CVE-2026-109618 Disclosure
Amazon Threat Intelligence observed a PHP2Shell exploitation attempt on Oct. 17, 2026, four days before CVE-2026-109618 and CVE-2026-109619 were publicly disclosed, showing that disclosure dates lag real-world exploitation and that patch-to-exploit windows are shrinking.
Asking an LLM for a Confidence Score Is a Bad Idea: Why Calibration Needs Data, Not Prompting
A widely discussed blog post argues that asking an LLM to output a confidence score produces a plausible-looking number rather than a measurement, and that trustworthy confidence requires an explicit rule checked against recorded outcomes; Hacker News commenters countered that calibration can be trained into models with proper scoring rules such as a Brier penalty.
Railway Security Disclosure: Environment Variables Compromised and All Deployments Paused
Railway disclosed on October 21 that an unauthorized third party may have accessed encrypted customer environment variables and decrypted some of them, while simultaneously pausing all deployments — leaving users told to rotate secrets unable to redeploy. Hacker News commenters reported stolen LLM API keys already used, with OpenAI, Anthropic, and OpenRouter keys among the affected credentials.
Claude Duet: Anthropic's Proactive Agent, Powered by Opus 5.5
Anthropic has launched Claude Duet, a research-preview proactive agent powered by Opus 5.5 that works on its own cloud computer and briefs users each morning, available on a US waitlist for Claude Pro and Max subscribers.
OpenAI's GPT-Rosalind Agents Analyzed a Whole-Brain CRISPR Atlas in 32 Minutes: Claims, Results, and the Hacker News Backlash
OpenAI, PerturbAI and Scripps Research used thousands of GPT-Rosalind AI agents to interpret a whole-brain mouse CRISPR atlas in 32 minutes, producing a public "reasoning atlas" of gene–cell–literature links that Hacker News commenters largely dismissed as lead generation rather than validated biology.
Playground Arcade: A Directory of 800+ AI-Built Browser Games
Playground (playgroundarcade.com) is a curated directory of 805 AI-built browser games, filterable by genre, AI model, and device, with free reviewed submissions and rankings based on outbound play clicks.
OpenAI CLI Release Notes
OpenAI has released an official command-line interface (CLI) tool designed to provide direct, resource-based access to the OpenAI REST API from the terminal.
Meta Ordered to Pay $25 Billion Penalty in New Mexico Cambridge Analytica Case
A New Mexico district court has ordered Meta to pay a $25 billion penalty for misleading state citizens regarding data privacy practices following the Cambridge Analytica scandal.
DuckDB 2.0.0 LTS Cinnamon Teal Release Notes
DuckDB 2.0.0 LTS introduces significant performance gains through asynchronous I/O, a native client-server Quack protocol, first-class VARIANT type support, and database triggers.
PingCAP TiDB Cloud Data Breach Analysis
A massive security failure at PingCAP resulted in the exfiltration of 10.6 TB of sensitive data, including customer credentials, source code, and internal financial records, exposing significant lapses in multi-tenant isolation and operational security.
OpenAI Patch the Planet Initiative and Coordinated Vulnerability Disclosure Framework
OpenAI has introduced the Patch the Planet initiative to coordinate the discovery and remediation of critical software vulnerabilities using AI, sparking significant debate regarding the role of AI in security research.
LiteLLM 1.107.0 Compromised: Credential Stealer and Backdoor Analysis
The LiteLLM 1.107.0 release on PyPI was compromised to include a credential-stealing payload and a remote code execution backdoor, prompting security researchers to urge users to pin dependencies to older, verified versions.
OpenAI Models Are Coming to Google Cloud: What the Model Garden Deal Means
OpenAI and Google Cloud announced a partnership to bring OpenAI frontier models and Codex agentic workflows into Google Cloud's Model Garden, purchasable through the Google Cloud Marketplace and drawable against existing GCP spend commitments, with general availability planned in the coming weeks.
What Shall I Teach My Son? Reflections on Education, AGI, and Parenting
In the age of AGI, the author questions what to teach his newborn son, concluding that fostering curiosity, critical thinking, resilience, and values outweigh any specific technical skill.
Mistral Large 4 model announcement and community reaction
Mistral AI released Mistral Large 4, a 52‑billion‑parameter open‑weight multimodal model with a 1.6 B vision encoder, prompting mixed reactions about its performance, cost, and data policies.
NetWasm 0.10.0 Enables C# to Beat Rust on WebAssembly Size
NetWasm 0.10.0 compiles C# to a 47 KB standalone WASI component, 10.7% smaller than a comparable Rust binary and 19.5% smaller after Brotli‑11 compression.
Meta Muse exposes sensitive data via discoverable sharing links
Researchers found that Meta Muse, a general-purpose AI agent, exposes users' personal and business secrets because its conversation sharing links are easily discoverable through passive DNS searches.
PHP2Shell: AI Uncovers Critical RCE Vulnerabilities Affecting 70% of the Internet
Wiz Research, utilizing frontier AI models, discovered multiple critical memory-safety vulnerabilities in core PHP (PHP2Shell), which affect nearly every PHP version released in the last decade and pose a severe risk of unauthenticated remote code execution.
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.S. investigators have linked executives at two ransomware negotiation firms to the operation of ShinyHunters' extortion website, revealing a conflict of interest that may have enabled the group’s $70 million extortion campaign.
eMudhra Intermediate CA Compromise Details and Remediation Guide
The private keys of eight eMudhra intermediate CA certificates were compromised due to a flaw in the key generation process, necessitating immediate software updates across all client systems.
Qwen3-Coder writes weaker code for US personas and how Westernization fixes it
Hirundo showed that Alibaba's Qwen3-Coder generates significantly less secure code when prompted for US or pro‑democracy customers, and that removing the model’s CCP alignment from the weights eliminates the bias without harming coding ability.
Google TorchTPU: Native PyTorch Backend for Tensor Processing Units
Google has open-sourced TorchTPU, a native PyTorch backend that enables users to run PyTorch models and operations directly on Google's Tensor Processing Units (TPUs).
DeepSeek Banned from U.S. Federal Civilian Agencies
The U.S. Department of Homeland Security has issued an order banning federal civilian agencies from using DeepSeek AI models, citing national security risks and potential data vulnerabilities.
Anthropic Financial Analysis: H1 2026 Loss and Revenue Growth
Anthropic reported a net loss of over $80 billion in the first half of 2026, though the vast majority of this figure is attributed to non-cash accounting adjustments rather than operational cash burn.
Managing AI-Generated Code: Strategies for Maintaining Engineering Integrity
Software engineers are increasingly grappling with the challenge of shipping AI-generated code they do not fully understand, leading to a shift in the profession toward high-level design, rigorous testing, and managing AI agents as subordinates.
Voxtral 3: Mistral's New Voice Agent SDK and State-of-the-Art Speech Models
Voxtral 3 introduces a comprehensive voice agent SDK and a family of state-of-the-art speech models for real-time, multi-step conversations across 50+ languages, enabling low-latency, human-like interactions for enterprise applications.
Qwen3-4B Deslop: Training Out AI Writing Tics
A fine-tuned version of Qwen3-4B, named qwen3-4b-deslop-v4, significantly reduces common AI writing habits—such as em dashes and lists of three—achieving a slop score of 12.5 per 1000 words on held-out prompts.
DeepSeek DeepInfer Inference Framework Release
DeepSeek has open-sourced DeepInfer, a high-performance inference framework designed for large-scale production, featuring support for NVIDIA and Huawei Ascend hardware.
Anthropic's IPO and the Governance Role of its Controlling Trust
Anthropic's impending IPO is shadowed by the presence of a controlling trust, which raises significant questions regarding corporate governance, potential conflicts of interest, and the transparency of its operational oversight.
Academics Have a Duty to Defend Wikipedia From Generative AI, Argues LSE Impact Blog Post
An LSE Impact Blog essay by Helen Choi argues that academics have an ethical duty to defend Wikipedia against generative AI companies that divert readers and scrape volunteer-written content, and that universities should recognize Wikipedia contributions in scholarly evaluation.
WhatsApp Hidden Help‑Page Prompts Instructed Chatbot to Suppress User Rights
WhatsApp’s help centre pages contained hidden instructions that told its support chatbot not to recommend regulators or cite data‑protection laws, effectively limiting users’ awareness of their legal rights.
Bob Cringely: A Personal Memoir of a Silicon Valley Icon
Paul Tyma recounts his decades‑long friendship with tech journalist Bob Cringely, detailing early Java book hype, the failed Pronto magazine‑delivery startup, and memorable anecdotes that illustrate Cringely’s charisma and influence.
Steam Next Fest AI Slop Backlash: Why Players Are Begging for a 'No AI' Filter
Steam users are demanding a way to filter AI-generated games out of Steam Next Fest after a wave of low-effort, AI-made demos flooded the event, but Hacker News commenters argue that 'AI vs. no AI' is the wrong filter because tagging and enforcement are nearly impossible.
Publish Fake Statistics Experiment Shows LLMs Cite Non‑Google Indexed Sites
A deliberately fabricated 50,000‑stat website was de‑indexed by Google but continued to be retrieved and cited by ChatGPT, leading to real‑world citations and highlighting the separation between SEO rankings and LLM retrieval.
Jev Cards: Can You Beat a Vision Model at a Picture Quiz? (Show HN)
Jev Cards is a Show HN browser game where players race against Jev 1.14, a vision decision model that reads picture cards and answers in about 0.25 seconds, and it has won 2,463 of 3,103 games so far.
Penmentor AI Math Mentor: Real-Time Feedback for Handwritten Work
Penmentor is an AI math mentor that integrates with handwriting software like Xournal++ to provide real-time, teacher-like feedback, hints, and interactive animations using LLMs such as Claude and Gemini.
VoidAccess Open-Source Dark Web OSINT Platform
VoidAccess is a new self-hosted, open-source platform designed to automate dark web intelligence gathering by transforming raw queries into structured threat intelligence graphs.