← Oct 24Sunday, October 25, 2026 · all days
1.We should be more ambitious with the software we build(danluu.com)
728 points by ltratt 1 day ago | 670 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ~Team processes and coordination must evolve before ambitious AI gains can materialize
  • ↑Sharing ambitious personal projects enabled by AI that push quality and scope
  • ↑AI unlocks building things previously blocked by time or skill gaps
  • ~We should prioritize diversity and unique vision over just ambition
  • ~AI handles MVPs but can't solve post-MVP complexity that defines real products
2.The Goose Programming Language(aardappel.github.io)
555 points by bobbydigitales 1 day ago | 345 comments | permalink
tl;dr: Goose is a new memory-safe systems language that eliminates the heap, GC, and lifetime annotations by placing all dynamic values on compiler-managed data stacks freed at scope exit. Its benchmarks claim 1.12–3.3x speedups over Rust and C++ with lower memory use, enabled by inline nested data, variant-sized enums, narrow relative references, and guaranteed in-place construction. The whole-program compiler emits plain C, was built largely with AI assistance (Claude) from a human-authored design, and ships with a standard library, samples, and prebuilt binaries for Windows, Linux, and macOS.
HN Discussion:
  • •Author offers to answer questions about the language they created
  • ↓Skepticism about handling arbitrary dynamically-sized data like hash tables or JSON with fixed stacks
  • ↓Questions about error handling design requiring knowledge of caller function names
  • ↑Enthusiasm for the stack-based memory model as intuitive and practical for many use cases
  • ↓Historical skepticism noting ML's region-based memory approach was abandoned due to memory bloat
3.America has lost 200k of jobs in media, film and the arts. How much is AI?(apricitas.io)
493 points by gnabgib 23 hours ago | 532 comments | permalink
tl;dr: US creative industries have shed over 200k jobs in four years, with Hollywood alone losing 100k (nearly a third of the sector) and publishing down 70k, though isolating AI's specific role is difficult amid consolidation, offshoring, and streaming disruption. The author argues AI's impact mirrors prior digital transitions—music survived via live concerts, but video and publishing lack such fallbacks, risking a newspaper-style business model collapse. Broader AI job displacement remains concentrated in media and tech so far, but could spread if current AI investment levels pay off.
HN Discussion:
  • ↑Appreciates article's balanced approach and connects job losses to broader efficiency-chasing problems in industries
  • ~Job losses stem from oversupply of content and collapsed attention economy, not primarily AI
  • ↑AI (especially image generation) genuinely caused job losses in commercial art and illustration
  • ↓Streaming fragmentation, pricing, and economic factors are the real culprits, not AI
  • ↓The music industry comparison is forced since demand hasn't collapsed—losses reflect productivity gains instead
4.I don't understand quantum physics (2018)(southampton.ac.uk)
372 points by rramadass 1 day ago | 305 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ↑Entry-level QM explanations have too much baggage; linear algebra approach works better
  • ↑Appreciates that the article finally explains what the wave physically is
  • •Recommends additional supplementary resources for learning quantum mechanics
  • ↑Agrees with article's skepticism of Many Worlds interpretation
  • ↓Article perpetuates misunderstanding of Bell's theorem and hidden variables
5.Local Wikipedia: Wikipedia, but only for things a half hour walk from you(edjefferson.com)
1675 points by sohkamyung 2 days ago | 253 comments | permalink
tl;dr: Local Wikipedia filters Wikipedia to show only geocoded pages within a roughly 30-minute walk of your location, falling back to the nearest 25 entries within 6 miles if the area is sparse, and capping dense areas at 500. Location data stays in the browser and isn't included in shared links. The site is unaffiliated with Wikipedia.
HN Discussion:
  • ~Rural users find the tool less useful due to sparse Wikipedia coverage nearby
  • ~Distance should be configurable or use real walking isochrones instead of crow-flies radius
  • ↓The tool is just a wrapper around Wikipedia's existing nearby feature
  • ↑Delightful discovery tool that makes nearby articles feel more personally relevant
  • ↓Use of imperial units (yards) is inappropriate for European locations
6.FreeDNS(freedns.afraid.org)
350 points by esher 1 day ago | 90 comments | permalink
tl;dr: FreeDNS (afraid.org) is a long-running free DNS hosting service offering dynamic DNS, static DNS, subdomain hosting, URL redirection, backup DNS, and IPv6 reverse DNS, with both free and premium tiers. Dynamic updates are handled via simple HTTP(S) GET requests (e.g., curl to sync.afraid.org), with IPv6 support via a v6 subdomain. The service hosts over 23,000 shared domains and reports 7.1M+ members and 13.8M+ DNS records.
HN Discussion:
  • ↑Long-time satisfied users praising the service's reliability and longevity
  • ~Service is useful but has pain points like missing from public suffix list
  • •Concerns about long-term continuity and what happens if ownership changes
  • •Newcomers asking clarifying questions about use cases and how it compares to other DNS services
  • •Noting design similarity to Hurricane Electric's DNS service
7.Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps(aikido.dev)
391 points by theanonymousone 1 day ago | 209 comments | permalink
tl;dr: CVE-2026-111497 is a critical (CVSS 9.2) out-of-bounds write in Google's Brotli decoder (versions 1.0.3–1.2.0) that enables memory leaks or RCE from attacker-controlled compressed data, affecting Node.js, Python (Brotli/brotlicffi packages), Bun, Envoy, Istio, curl, and any HTTP client/server that decodes Brotli—often as a transitive dependency. OpenAI discovered it in February and the root cause was silently patched upstream, but no security release shipped until now; advisory databases haven't mapped it yet, so Dependabot/pip-audit won't flag it. Upgrade to Brotli 1.2.1+ (or vendor equivalents) immediately, or disable Brotli decoding as a workaround.
HN Discussion:
  • ↓The HTTP2Shell name is misleading and sensationalized; Broccoli2Shell is more accurate
  • •Google is hypocritical for using Brotli in Chrome while rejecting JPEG XL over similar concerns
  • ↓Skepticism that OpenAI actually discovered it in February; article may misrepresent the timeline
  • ↓The sensationalism is overblown; it's unclear how many libs actually decode Brotli request bodies in common configs
  • ↑Pragmatic acceptance: patch quickly, use AI tools or override cooldowns to handle the flood of incidents
8.GPU-unlock: FP/BF16 instruction issue rate on Nvidia 3000's cards(github.com)
334 points by fragebogen 1 day ago | 78 comments | permalink
tl;dr: A Linux kernel module unlocks the FP16/BF16/TF32 instruction issue rate on Nvidia Ampere GeForce cards (GA102/103/104/106) to match their professional equivalents, roughly doubling matrix throughput (e.g., a 3090 Ti goes from 87 to 157 TFLOPS on BF16 GEMM). It applies the CMP V67/PLM unlock via initramfs before the Nvidia driver binds, avoiding the need to patch the driver on each release. Gains benefit LLM prefill, diffusion, and FlashAttention workloads, while memory-bound tasks like LLM decode are unchanged; outputs remain bit-identical.
HN Discussion:
  • ↑Author of the unlock engaging with the community and offering to answer questions
  • ↑Related unlocks exist for other Nvidia features like P2P and NVENC, criticizing Nvidia's artificial restrictions
  • ↑The unlock works and provides real value for ML researchers on consumer hardware
  • ~Caveats about power/thermal requirements and risks of bricking cards temper the claimed benefits
  • ↓Real-world gains are significantly smaller than the article's advertised numbers
9.Roku developer repositories moved from GitHub to GitLab(blog.roku.com)
302 points by cxr 1 day ago | 214 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ↑GitLab is better suited for company projects than the increasingly Microsoft-influenced GitHub
  • ~GitHub outages are driven by increased developer demand, so switching hosts won't help long-term
  • •Roku's acquisition by Fox undermines any moral high ground in choosing hosts
  • ↓Curious or frustrated that the article doesn't explain the actual reasons for the move
  • ↓Questioning why this minor tooling change is newsworthy at all
10.Show HN: Steal My Bitcoin(stealmybitcoin.com)
578 points by cloudlandsdev 1 day ago | 398 comments | permalink
tl;dr: A server hosts a $500 Bitcoin wallet accessible via a `print-flag` binary under the PHP user account, challenging anyone to steal it. The PHP version predates the PHP2SHELL CVEs, hinting at the intended attack vector. The winner keeps the funds or is encouraged to donate to GiveWell.
HN Discussion:
  • ↑The challenge going unclaimed proves AI/LLM exploit hype is overblown and false
  • ↑People claiming to have exploits are making excuses rather than demonstrating them
  • ↓The setup is actually not vulnerable to PHP2SHELL CVEs, making it an unfair test
  • ~Not participating is rational due to honeypot risk and low payout vs. exploit value
  • •Author providing updates on infrastructure challenges and traffic handling
11.Physicists trap a single antimatter particle for a month(scientificamerican.com)
341 points by mooreds 4 days ago | 102 comments | permalink
tl;dr: Physicists at Northwestern used a wall-less trap combining electric and magnetic fields in near-absolute-zero vacuum to isolate a single positron for a month, after slowing the particles via a tungsten crystal lattice. The goal is to precisely measure the positron's magnetic moment and compare it to the electron's (previously measured to 1 part in 10 trillion) to test the Standard Model's symmetry prediction. Any discrepancy could help explain why the universe contains matter rather than antimatter.
HN Discussion:
  • ↑Enthusiasm about practical applications like antimatter-catalyzed propulsion systems in space
  • ↑Appreciation of the precision measurement context and significance for matching electron's accuracy
  • •Curiosity about the technical method of detecting and confirming a single particle
  • •Questions about antimatter interactions with normal matter and safe handling/release
  • ~Humorous or skeptical reactions about safety and philosophical implications
12.How close can pure functional programming get to C?(rtfeldman.com)
277 points by stmonty 1 day ago | 99 comments | permalink
tl;dr: Roc, a pure functional language with automatic memory management and mandatory bounds checking, achieved DEFLATE compression performance within a median 2.6-8.9% of libdeflate (a heavily SIMD-optimized C library) on the Silesia corpus, even beating it on some inputs. The author argues the small performance gap is worth it for guarantees like memory safety, pure functions, deterministic cross-target behavior, and supply-chain security (no FFI or build scripts). Key optimizations leveraged Roc-specific features like opportunistic in-place mutation, compile-time lookup tables, hoisted bounds checks, and wrapping arithmetic.
HN Discussion:
  • ↓C/C++ allows aggressive copy elision and direct memory mutation that functional languages inherently can't match
  • ↓The benchmark comparison is unfair; should compare against modern optimized implementations like zlib-rs
  • ↑Roc looks appealing as a functional language with good performance and ergonomics
  • ↓The benchmark lacks crucial data on compression ratios at each level, making conclusions questionable
  • •Curiosity about future directions like SIMD abstractions or exposing optimization passes as libraries
13.A practical guide to AI image generation, from diffusion to agents(danielball.com)
282 points by westsmith 5 days ago | 94 comments | permalink
tl;dr: Image generation models fall into two camps: diffusion models (cheap, fast, seed-controllable, but literal) and multimodal models like GPT Image and Gemini (better at instructions, text, and editing, but pricier and less controllable). You pay per canvas regardless of complexity, prices range 100x across providers, and effective prompting means describing the production process (camera, film, print) rather than hype words. Build thin provider abstractions since APIs change constantly, offload exact work (sizing, text, transparency) to deterministic code, and use agents to write prompts, critique outputs, and iterate—while keeping humans in charge of taste.
HN Discussion:
  • ↑Suggests complementary techniques like procedural graphics or drawing/modeling scenes first to improve generation
  • ↓Article mishandles pixel art by treating it as a style rather than a hardware-constrained format
  • ↓Article is low-value, feels AI-generated and lacks substantive insight
  • ~Article overlooks local/self-hosted generation as a viable alternative to paid APIs
  • •Asks clarifying technical questions about seeds, suffixes, and ControlNets mentioned or omitted
14.Kimi K3.1 Pro and K3.1 Pro Highspeed(kimi.ai)
1079 points by Jowsey 2 days ago | 670 comments | permalink
tl;dr: Moonshot's Kimi K3.1 Pro is a new 3T-class open-weight model with a 1M-token context, posting competitive results against Claude Opus 5.5 and GPT-6 Astra on coding (65.7% on Terminal-Bench 4.0), 3D/CAD generation, and financial reasoning benchmarks. A "Highspeed" variant runs 2-3× faster, and the team deliberately stripped cyber-related data from training to cap offensive security capabilities before release. Available now via Kimi.ai and API, with full weights to be released by Nov 4, 2026.
HN Discussion:
  • ~Model has identity confusion and leaks system prompt artifacts during reasoning
  • ↑Stripping cybersecurity data is a smart alignment approach that's hard to reverse
  • ↓Questions the coherence and effectiveness of removing cybersecurity training data
  • ↑Benchmarks confirm it competes with or beats top US models at lower cost
  • ↑China's gap with US frontier AI has shrunk dramatically given Moonshot's small size
15.Why is AI generated language so hard to understand?(arxiv.org)
238 points by canjobear 1 day ago | 196 comments | permalink
tl;dr: Researchers analyzed AI-generated text and found that nine frontier LLMs use features known to increase human processing difficulty—low-frequency n-grams, inanimate subjects with animate verbs, long syntactic dependencies, stacked nouns, and reduced object relatives—more than human writing or round-trip translation paraphrases. They hypothesize this stems from LLMs being optimized for information density (via math, code, and reasoning training) rather than communicative clarity, and demonstrate the effect by fine-tuning a model with a length penalty, which pushes its output further from human-like language.
HN Discussion:
  • ↑RLHF optimizes for superficial markers of good writing rather than actual usefulness
  • ↑LLMs exhibit specific grammatical quirks like intransitive use of transitive verbs
  • ↑Directly quoting and endorsing the paper's conclusions about length penalty effects
  • ~AI text lacks grounding in a human mental model or physical reality
  • ↑AI is optimized for information density over human readability, confirming article's hypothesis
16.Today, we hacked what we'd set out to hack: the iPhone(blog.calif.io)
1101 points by pavel_lishin 2 days ago | 712 comments | permalink
tl;dr: Summary not available.
HN Discussion:
  • •Curious about defensive measures like Lockdown mode effectiveness against these exploits
  • ↑Admires the hacks and wishes for jailbreak capabilities to unlock iPhone functionality
  • ↑Notes a recurring pattern of iOS PDF parsing vulnerabilities
  • ↑Praises Calif as an exceptionally talented vulnerability research team
  • ↓Skeptical that attackers have an edge since Apple can use LLMs defensively too
17.CVE Tracker(cve.0xosprey.com)
224 points by Group_B 2 days ago | 77 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ↓Lower CVE filing barriers and new CNAs inflate recent CVE counts, undermining the trend
  • ↑Critical CVEs are rising even faster, confirming the trend is real
  • ↑AI is uncovering vulnerabilities in legacy human-written code at unprecedented speed
  • ~The CVE/CVSS system itself is outdated and the metric is losing meaning
  • •Suggestions for better visualization or alternative tools to interpret the data
18.WorldTUI: I trained a 360M model to pretend to be a terminal(simedw.com)
650 points by alphax314 3 days ago | 192 comments | permalink
tl;dr: A developer fine-tuned Qwen2.5-Coder-0.5B (shrunk to 360M params, quantized to int4/208MB) to simulate a terminal by predicting screen deltas from keypresses, with no actual shell or filesystem underneath. Key tricks included parallel per-row decoding with speculative verification for speed, and DAgger-style self-correction training to prevent compounding errors; the result can run vim, tmux, snake, and Python in-browser via WebGPU, and even remembers file contents written in earlier commands. It's not practically useful, but demonstrates that a small model can maintain a surprisingly consistent "world" without encoding any underlying rules.
HN Discussion:
  • ↑Author engagement and appreciation for the technical achievement of fine-tuning a small model
  • ↑This exemplifies the broader concept of 'Neural Computers' where UI is entirely generative
  • ↑Project raises interesting philosophical questions about prediction versus actual intelligence
  • •Sharing similar related projects for comparison (lossy git, vibeSH, ChatGPT-as-terminal)
  • •Technical/practical notes like WebGPU support in Firefox and surprise at memory improvements from fine-tuning
19.Around a dozen banking apps began specifically permitting GrapheneOS(grapheneos.social)
672 points by privacyishuman 1 day ago | 328 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ↓Remote attestation and whitelisting approaches are fundamentally unacceptable regardless of GrapheneOS inclusion
  • ↑Official support from legacy banks for an open source OS is genuinely good news worth celebrating
  • ~Banks' reluctance is understandable due to liability concerns around rooted/modified devices
  • ↓The post/article is misleading as the list of 12 banks isn't actually provided or verified
  • •Questions about practical implementation details like tap-to-pay support and which banks truly support it
20.OBS Studio 33(github.com)
464 points by pentagrama 1 day ago | 177 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ↑Enthusiastic praise for OBS as a versatile and powerful free tool
  • •Recommending adjacent or alternative tools like VDO.ninja and Cap
  • ↓Criticism of OBS for long-standing bugs and delayed security fixes
  • ~Encouraging complainers to contribute fixes rather than just complain
  • •Requesting basic context/link since the article lacks explanation