Aug 9Monday, August 10, 2026 · all daysAug 11 · today »
1.Docker Sandboxes – Disposable, isolated sandboxes for AI agents(docker.com)
678 points by etoxin 12 days ago | 390 comments | permalink
tl;dr: Docker has released Sandboxes (`sbx`), a CLI tool that runs AI coding agents like Claude Code, Copilot CLI, Codex, and OpenCode inside disposable microVMs isolated from the host filesystem and network. The goal is to enable "YOLO mode" (--dangerously-skip-permissions) safely, letting agents install packages, modify configs, and even spin up their own Docker containers without supervision. It's available via Homebrew, winget, and apt, doesn't require Docker Desktop, and offers optional org-wide policy controls through Docker AI Governance.
HN Discussion:
  • Docker employee clarifies technical architecture, correcting misconceptions about it being containers
  • Skepticism about whether microVMs offer real security benefits over existing VM solutions like Incus/LXD
  • Sandboxing is a duct-tape workaround; proper permission isolation would be a better solution
  • ~Login requirement and lack of Linux focus are frustrating friction points
  • Open-source alternatives (Locki, Gondolin, Tart, Apple Container) already exist and may be superior
2.What Happened to HackerOne?(blog.teknogeek.io)
385 points by hipparchus 12 days ago | 199 comments | permalink
tl;dr: A veteran bug bounty hunter chronicles HackerOne's decline from a hacker-focused community (with legendary Live Hacking Events) into a sales-driven, VC-controlled corporation that rebranded around "CTEM" and AI while neglecting platform improvements. The author details how HackerOne quietly began running all reports through AI systems that "learn" from researcher data, despite public denials from leadership, and argues the company's damage-control PR playbook has replaced genuine engagement. The conclusion: hackers should recognize their leverage, companies can build in-house alternatives cheaply, and the market is ripe for disruption.
HN Discussion:
  • Building in-house alternatives overlooks HackerOne's real value: handling global hacker payments
  • Corporate rot and sales-team excess exemplify HackerOne's decline
  • Personal experience confirms reports get dismissed or ignored on the platform
  • ~Article glosses over COVID as a major factor killing live events
  • Pushback on claim about hackers facing criminal charges for reporting vulnerabilities
3.How I use LLMs to learn complex topics(laurentiugabriel.github.io)
795 points by laurentiurad 12 days ago | 530 comments | permalink
tl;dr: The author uses LLMs to learn complex topics by prompting them (via Claude Code/OpenCode) to first build and verify a foundational knowledge base, then generate a low-poly, RollerCoaster Tycoon-style interactive simulation of the process, hosted on GitHub Pages. They've applied this to chip fabrication (ChipTycoon), rocket engines, LLMs, F1 engines, and EUV machines, arguing that visual simulations aid retention better than text explanations, and suggest enhancements like photo-to-3D object mapping and quiz challenges.
HN Discussion:
  • LLM learning posts lack proof of actual acquired capability and may create illusion of learning
  • The claim that animations are hallucination-free is unconvincing since AI checks its own work
  • The RollerCoaster Tycoon-style animations add little value over plain text lists
  • ~Socratic dialogue or literate code rewrites are more effective LLM learning methods than simulations
  • Deep learning requires hands-on tacit knowledge and boring details that LLMs cannot shortcut
4.Taxi drivers rarely die of Alzheimer's(theconversation.com)
371 points by jader201 12 days ago | 273 comments | permalink
tl;dr: A 2024 study of 9 million U.S. death certificates found taxi and ambulance drivers had the lowest Alzheimer's death rate of 443 occupations, while drivers on fixed routes (bus drivers, pilots) showed no such advantage — suggesting real-time navigation, not driving itself, exercises the hippocampus, one of the first brain regions Alzheimer's attacks. Related research links spatially complex environments and mentally demanding work to lower dementia risk, though whether screen-based spatial reasoning (GIS, cartography) confers similar protection remains untested.
HN Discussion:
  • Taxi drivers die younger, so they don't live long enough to be diagnosed with Alzheimer's
  • Reverse causation: people with Alzheimer-resistant brains self-select into taxi driving
  • The headline overstates the effect; a 40% reduction doesn't make Alzheimer's rare
  • Curiosity about extending this analysis to other cognitively demanding activities like gaming or chess
  • Supporting context from prior research like London cabbies and The Knowledge study
5.Ask HN: What are you working on? (August 2026)
303 points by david927 12 days ago | 1096 comments | permalink
tl;dr: Summary not available.
HN Discussion:
  • AI/agent development tools and environments are a major focus of current side projects
  • Personal passion projects born from being laid off or scratching a personal itch
  • Privacy-focused self-hosted LLM solutions are needed to safely automate sensitive tasks
  • Niche domain-specific apps solving real-world problems for specific industries or hobbies
  • Nostalgic recreation and games as ambitious solo technical projects
6.Cool URIs Don't Change (1998)(w3.org)
283 points by Klaster_1 12 days ago | 68 comments | permalink
tl;dr: Tim Berners-Lee argues that URIs break not for technical reasons but because of poor design choices—embedding things like file extensions, CGI paths, authors, topics, or status in URLs guarantees they'll change when your organization, tools, or classifications inevitably do. The fix is to design URIs with minimal information (a creation date plus an opaque identifier works well) and use server-side mapping to decouple URLs from filesystem layout. Broken links damage user trust and are almost always the webmaster's fault, not an unavoidable consequence of the web.
HN Discussion:
  • Shares real-world examples of broken URLs confirming the article's point about webmaster negligence
  • ~Notes that redirects and CMS features have partially solved the problem in ways the article didn't anticipate
  • Questions whether URLs can ever truly be stable given they encode access methods
  • Offers practical techniques (append-only builds, maintenance discipline) to uphold the article's ideal
  • Observes the article's own longevity and continued relevance as proof of its wisdom
7.Auto mode is now the default in Claude Code(claude.com)
276 points by sbehere 12 days ago | 303 comments | permalink
tl;dr: Claude Code's "auto mode"—which routes tool calls through a safety classifier instead of prompting users for approval on each action—is becoming the default for Pro, Max, and Team plans on August 14, with classifier token overhead no longer billed. Anthropic claims auto mode outperforms human review in testing: in a 1,053-person study, humans caught 13.6% of dangerous commands while auto mode caught 89%, and users approve 97% of manual permission prompts, suggesting reflexive clickthrough. Enterprise and API users can opt in for now, with default rollout planned within a month.
HN Discussion:
  • Safety should come from external guardrails like sandboxes and VCS, not permission prompts
  • Users want to stay in manual control to guide architecture and catch misalignment early
  • Claude goes off the rails too often for auto mode to be trusted on serious projects
  • Auto mode's classifier works well in practice and is preferable to homegrown solutions
  • Real-world auto mode incidents show the classifier misses dangerous judgment errors
8.Everything you do is being recorded(theatlantic.com)
417 points by ike_usawa 12 days ago | 354 comments | permalink
tl;dr: AI-enabled wearables (pins, pendants, glasses) that continuously record and transcribe conversations are becoming mainstream, prompting startups like Deveillance to develop countermeasures such as the Spectre I jammer. However, modern speech-recovery algorithms can strip away ultrasonic jamming and background noise, forcing researchers to explore alternatives like generating fake "anti-speech" or decoy audio. Given the massive investment behind speech-processing tech versus the small players building defenses—and the possibility of lip-reading or vibration-based recovery—privacy advocates warn this cat-and-mouse game heavily favors the surveillers.
HN Discussion:
  • Privacy already requires extreme tradecraft; article understates how far gone we are
  • ~Root problem is socioeconomic; breaking up powerful tech corporations is the real solution
  • Questions the need for yet another AI recording device when we have so many already
  • Pervasive surveillance leads to hollowing out of human thinking and autonomy
  • Skeptical that recorded data is actually meaningfully analyzed at scale
9.Windows 11's built-in Weather app wastes more than 1 GB of RAM(notebookcheck.net)
661 points by akyuu 12 days ago | 587 comments | permalink
tl;dr: Windows 11's built-in Weather app can consume over 1 GB of RAM—roughly 5x more than Apple's macOS equivalent—because it's essentially an MSN web app running on WebView2, spawning multiple Chromium subprocesses. The bloat is particularly problematic on 8GB systems, where the app can eat nearly 20% of available memory, and it also displays ads within the forecast interface. Microsoft has said it plans to build more native Windows apps, but hasn't confirmed whether Weather will be rewritten in WinUI.
HN Discussion:
  • Historical comparison showing modern bloat is absurd given older systems ran more with less RAM
  • RAM measurement is nuanced and shared framework components may inflate reported usage
  • Practical workaround using Edge with uBlock Origin achieves better results than built-in app
  • Web development culture produces wastefully bloated apps for simple tasks
  • OS-level GC or native development tools could solve the bloat problem
10.Tom Stanton's supersonic trebuchet breaks sound barrier with gravity alone(techeblog.com)
272 points by Thorondor 12 days ago | 103 comments | permalink
tl;dr: Tom Stanton built a gravity-powered trebuchet that broke the sound barrier, launching a 4-gram projectile at 776 mph using only a falling 40kg weight. Key innovations included a 3:1 tapered pulley system to convert torque into rotational speed at release, a 116-gram CNC-milled carbon fiber arm, and a millisecond-precise mechanical release mechanism. High-speed footage and an audible sonic boom confirmed the projectile exceeded Mach 1.
HN Discussion:
  • Providing context on projectile weight compared to firearm rounds
  • Pointing out similar engineering in other domains like rowingbikes and bike spokes
  • Referencing related supersonic feats or similar trebuchet projects
  • Speculating on practical applications like defense systems or lunar mass launching
  • ~Raising practical concerns about safely testing the device
11.My server is a phone now(seg6.space)
532 points by seg6 13 days ago | 244 comments | permalink
tl;dr: The author replaced a Hetzner VPS with a CMF Phone 1 running stock Android, using Termux as the host for SSH, runit, Caddy, Cloudflared, and Tailscale, plus a rooted chroot into Debian for running ARM64 OCI images (notably a Chrome-based remote browser called Surf). Ingress uses Cloudflare Tunnel for HTTP services and a WebSocket-wrapped TLS stream for a latency-sensitive pinned connection, with the entire host state managed reproducibly via Ansible. The result is a quiet, battery-backed, portable personal server that survives reboots and network changes.
HN Discussion:
  • Debate over the title's phrasing and linguistic ambiguity between theme and rheme
  • ~Warning about battery fire hazards when using phones/laptops as always-on servers
  • ~Locked bootloaders and lack of root limit replicating this setup on most phones
  • Cheap old desktops or mini PCs are a better, more practical home server option
  • Old phones are underappreciated capable hardware worth repurposing as servers
12.Mea Culpa – Dark Hours(blog.terrygodier.com)
598 points by satvikpendem 12 days ago | 278 comments | permalink
tl;dr: A developer launched a website called "Dark Hours" built with Claude, only to discover it closely resembled an existing open-source project called DarkHours.app—even reproducing a bug the original author had already fixed. He's redirecting his domain to the original project, canceling his planned iOS app, and apologizing for irresponsibly using AI to generate a project without checking whether it duplicated existing work.
HN Discussion:
  • The apology is a limited hangout hiding worse misconduct like lying to Gruber
  • Blaming AI is a dishonest excuse for deliberate plagiarism
  • ~The apology is incomplete because it omits misleading John Gruber
  • Questions remain about how the duplication actually happened technically
  • The developer did the right thing and vibe-coding risks are real
13.Silicon Valley misreads science fiction and undermines democracy(techcrunch.com)
292 points by evo_9 12 days ago | 265 comments | permalink
tl;dr: Historian Jill Lepore, in her upcoming book "The Rise and Fall of the Artificial State," argues that private tech companies—led by figures like Musk and Altman—are quietly usurping the functions of democratic governments, pushing a "rule by algorithms" that no one voted for. She contends Silicon Valley leaders misread sci-fi warnings (from E.M. Forster to Asimov) as blueprints rather than cautionary tales, and that the artificial state is ultimately doomed because it destroys the natural resources it depends on. Local backlash against data centers, she suggests, is an early sign of democratic pushback.
HN Discussion:
  • Tech billionaires prioritize elite interests over democracy simply because wealth removed them from normal concerns
  • Anti-government brainwashing led to privatization that handed unelected businessmen excessive power
  • The article's argument about sci-fi being misread is confused or a strawman with no real evidence
  • Tech leaders like Musk clearly misunderstand the sci-fi they claim to admire
  • ~Interesting interview but disagrees with core conclusions; technology, not politics, drives historical change
14.Fastmail offers EU data region(fastmail.com)
509 points by groomlake 13 days ago | 290 comments | permalink
tl;dr: Fastmail now lets customers choose the EU (Amsterdam) as their primary data region, in addition to its existing US locations (Philadelphia, St Louis), running on its own hardware rather than rented cloud infrastructure. Primary data lives in the chosen region, but geographic backup replicas for EU users still reside in the US, along with logs, emergency backups, and some metadata. Fastmail remains an Australian company subject to Australian law, so it explicitly notes it can't guarantee data stays solely in the EU; users can switch regions in settings at no extra cost.
HN Discussion:
  • EU data region is meaningless while US-owned infrastructure or companies remain in the stack
  • This is 'sovereignty washing' — a paper presence that doesn't escape US CLOUD Act obligations
  • Announcement is premature since backups and metadata still reside in the US
  • Users should switch to genuinely European email providers like Tuta instead
  • Appreciates the move as a satisfied Fastmail customer, sees it as a positive step
15.Os8088: A powerful Mac-like OS for the IBM XT, 286, 386(os8088.com)
258 points by jggonz 13 days ago | 165 comments | permalink
tl;dr: Os8088 is a Mac-like graphical OS for 8086-era PCs (XT/286/386) featuring pre-emptive or cooperative multitasking, a dock, windowed multi-instance apps, and a heap-based memory model where programs load into their own segments at offset zero. It ships with a suite of built-in applications including a Markdown writer, MOD tracker, Mandelbrot explorer, bitmap paint, FM piano, Sound Blaster recorder, Minesweeper, Solitaire, and Arkanoid. Live kernel state (scheduler mode, task CPU usage) is read directly by system utilities rather than cached.
HN Discussion:
  • Dismisses the project as AI-generated slop not worth engaging with
  • Defends the project against reflexive AI-written dismissals from HN crowd
  • Appreciates the technical achievement and nostalgic appeal for old hardware
  • Points to similar prior art like VisiOn and Atari GOS as historical context
  • ~Questions technical robustness like lack of memory protection allowing tasks to break the system
16.Dithered QR Codes(andrewt.net)
376 points by jmusall 13 days ago | 43 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • Reference to Russ Cox's QArt Codes as a canonical/alternative approach to embedding images in QR codes
  • Sharing related techniques like color, animation, and AI-generated QR codes that extend the concept
  • ~Concern that aesthetic QR modifications erode the error correction robustness they were designed for
  • Appreciation for the creative exploration of QR code design possibilities
  • Criticism that the technique relies on scanner implementation quirks rather than legitimate error correction
17.The original URL for this prediction will no longer be available in 11 years (2011)(longbets.org)
208 points by doubletwoyou 13 days ago | 100 comments | permalink
tl;dr: In 2011, Jeremy Keith bet Matt Haughey $1,000 that the URL longbets.org/601 would not resolve to its original content by February 22, 2022, arguing link rot makes URLs ephemeral. Haughey countered that maintaining stable URIs is achievable with modest effort and 301 redirects. The winner's stake goes to either Bletchley Park Trust (Keith) or The Internet Archive (Haughey).
HN Discussion:
  • Keeping URLs alive long-term is achievable with modest effort like tests, static HTML, and redirect rules
  • Link rot is real; other longbets URLs are already offline, supporting Keith's argument
  • ~The http:// protocol itself or domain survival is the real fragile point, not the URL structure
  • ~Large bet stakes create incentive for one party to artificially keep URLs alive, undermining the test
  • Neutral observations and curiosity about the bet mechanics and related predictions
18.“Code was never the hard part” is an insult to all programmers(blog.senko.net)
922 points by senko 13 days ago | 567 comments | permalink
tl;dr: The author pushes back on the popular claim that "coding is easy, figuring out what to build is the hard part," arguing it dismisses the genuine skill, complexity, and craft of programming—evidenced by high salaries, dense literature, and buggy software. Rather than picking sides between "code is trivial" and "code is art," developers should embrace both technical depth and understanding of users/business, while adapting to AI-driven industry changes without outsourcing judgment and taste to AI.
HN Discussion:
  • Coding is genuinely easier than navigating customer requirements and business strategy
  • The saying refers to process/organizational difficulty, not individual skill—article misinterprets it
  • The 'code isn't hard' narrative reflects businesses avoiding hard technical work, not reality of programming
  • Article is post-LLM romanticization; coding truly was easy when requirements were already defined
  • Real difficulty is in problem-solving/distributed systems thinking, not encoding ideas—supports article's craft argument
19._for-sale DNS records(specification.website)
438 points by shaunpud 13 days ago | 165 comments | permalink
tl;dr: RFC 10023 defines a `_for-sale` DNS leaf node where domain owners publish a TXT record (prefixed `v=FORSALE1;`) signaling that an actively-used domain is available for purchase, with optional tags for price (`fval`), contact URI (`furi`), or free text (`ftxt`). Unlike parking, it sits alongside a live site invisibly to browsers, targeting brokers and automated availability checkers rather than humans. Each record holds one tag-value pair, TTL should be ≤3600, DNSSEC signing is recommended, and consumers must treat `ftxt`/`furi` as attacker-controlled input.
HN Discussion:
  • Legal concern about publicly declaring a trademarked domain for sale hurting arbitration outcomes
  • ~Proposes alternative Georgist economic model instead of just signaling for-sale status
  • Points out logical flaw that absence of the record cannot imply not-for-sale
  • Opposes the standard because domain squatting itself should be banned rather than facilitated
  • Argues existing well-known email aliases like hostmaster@ already solve the contact problem
20.DeepMind's WeatherNext model achieves breakthrough forecasting cyclones(deepmind.google)
445 points by bhavansig 14 days ago | 130 comments | permalink
tl;dr: DeepMind's WeatherNext model predicts tropical cyclone track, intensity, and wind structure with state-of-the-art accuracy, gaining roughly 24 hours of lead time over prior models—equivalent to a decade of meteorological progress. Notably, it operates at a coarse 28x28km resolution (100x coarser than traditional models), yet outperforms them, using Functional Generative Networks to run 1,000-member ensembles in under a minute on a TPU. Google is open-sourcing the code and weights, including a "mini" version runnable in a free Colab notebook.
HN Discussion:
  • Problem-specific AI models like this are more interesting than the current LLM hype
  • Excitement about impactful AI applications beyond coding agents
  • ~Noting limitations around uncertainty handling and deterministic vs ensemble forecasting
  • This methodology is not novel; ECMWF already deployed similar approach
  • Predicting major weather events is easy; the real challenges are in fine-grained details