sshole(sshhole.com)
2888 points by josemrb | 707 comments
Vulnerability writeup explaining how OpenSSH on musl-based Linux without PAM accepts any 257–1024 character password for accounts locked with '*', with an in-browser demo.
Hacker News on
Residential proxies detected on White House network(layer3intel.com)
1221 points by Rasbora | 408 comments
Layer3 Intel blog post reporting residential proxy exit activity observed on AS2650, the White House network, plus proxy activity in remote locations.
Search for everyone(kagi.com)
668 points by elashri | 344 comments
Kagi's changelog entry announcing that anyone can now search on kagi.com without an account, plus Android app, Assistant, News, and Translate updates.
Claude Code sends your email address to websites(github.com)
1516 points by motoroco | 477 comments
GitHub issue on anthropics/claude-code reporting that Claude Code includes the user's email address in the User-Agent header during web searches.
Baidu released ERNIE 5.5 Flash Base(ernie.baidu.com)
177 points by pretext | 96 comments
Baidu's release post for ERNIE-5.5-Flash-Base, an open-weight 280B-parameter sparse MoE base language model, detailing its architecture and pre-training.
AI is forcing us to pay off 40 years of technical debt(spectrum.ieee.org)
1227 points by pseudolus | 714 comments
IEEE Spectrum news article on the PHP2Shell vulnerability, found with AI tools, and how AI is exposing decades of legacy software bugs.
Alpine Linux Security Advisory: OpenSSH-server password authentication bypass(alpinelinux.org)
610 points by pantalaimon | 128 comments
Alpine Linux security advisory describing an openssh-server password authentication bypass caused by musl crypt() behavior, with affected versions, fixes, and mitigations.
A thousand fewer paths to root(openai.com)
455 points by dangelosaurus | 331 comments
OpenAI publication describing an autonomous AI pipeline that found, exploited, and generated patches for 948 Linux kernel local privilege escalation vulnerabilities for about $1.2M in API costs.
Lemmings CSS Animation(markblah.github.io)
375 points by MarkBlah | 77 comments
An interactive web playground where Lemmings-style pixel walkers roam page elements like stairs, platforms, cards and text lines, and can be dragged, thrown, or launched by resizing.
Images 2.6(openai.com)
368 points by davidbarker | 220 comments
OpenAI announcement of Images 2.6, a faster image generation model in ChatGPT, Codex, and the API with GIF animation, image markup, SVG export, and new API model tiers.
Ripple-65B Preview: U.S. Open-Weight SOTA on Agentic Coding(ricursive.com)
327 points by Philpax | 116 comments
Ricursive Intelligence announces Ripple-65B Preview, an open-weight dense LLM claiming U.S. open-weight SOTA on agentic coding, with training cost, RL, and architecture details.
Starfall – Affordable, routine access to microgravity(spacex.com)
245 points by gmays | 189 comments
SpaceX product page for Starfall, a reentry vehicle offering routine microgravity access for research, pharmaceutical, and materials manufacturing payloads up to 1,000 kg.
MS Paint Remote Code Execution Vulnerability(cve.org)
688 points by kuberwastaken | 256 comments
CVE record CVE-2026-83844 for a high-severity (CVSS 8.1) out-of-bounds read remote code execution vulnerability in Microsoft Windows Paint.
MCP Explained(mcp-explained.com)
314 points by rwilinski | 131 comments
Interactive visual explainer of the Model Context Protocol by Runlayer, walking through JSON-RPC messages, lifecycle, transports, features, attacks, and spec versions.
Motorola Signature 27 with GrapheneOS support(motorolanews.com)
551 points by monneyboi | 389 comments
Motorola press release announcing the motorola signature 27 flagship smartphone, including camera, display, Snapdragon chip, Gemini AI features, and GrapheneOS support.
OpenSSH 10.6p2 Critical workaround for alpine without PAM(openssh.org)
247 points by selckin | 12 comments
OpenSSH release notes for portable 10.6p2, which fixes a password authentication bypass in sshd on Linux systems using musl libc with PAM disabled.
September in Servo: <progress>, rounded rectangles, and more(servo.org)
260 points by iamnothere | 68 comments
Servo project's monthly update for September covering the 0.7.0 release: <progress> element, roundRect(), new CSS functions, WebGL2 fixes, and embedding API changes.
The Hackintosh Reborn(naut.ca)
385 points by rubatuga | 223 comments
Blog post arguing AI coding tools like Claude Code are reviving the Hackintosh community, citing macOS ports to Snapdragon, ARM SBCs, and Nvidia GPU support.
Image of our satellite-choked night skies(kottke.org)
108 points by amatheus | 74 comments
Kottke.org post on Brendan Larsen's composite of 578 photos over Mt Taranaki showing roughly 1,400 satellites' trails in two hours of night sky.
Want to Rent an Internet Address at the White House?(krebsonsecurity.com)
56 points by zdw | 9 comments
KrebsOnSecurity article reporting that residential proxy services, including Russian-linked Infatica, were renting out exit IPs on the White House network (AS2650).
Insects don't swarm at LED lights(birdsoutsidemywindow.org)
299 points by speckx | 152 comments
Blog post from Outside My Window explaining why insects are far less attracted to LED lights than incandescent bulbs, citing UV emission research.
Awesome repositories are no longer awesome(erikgahner.github.io)
239 points by erikgahner | 116 comments
A blog post arguing that GitHub 'awesome' curated lists have become less useful due to outdated content and floods of AI-generated pull requests promoting vibe-coded sites.
Window Sweaters(github.com)
440 points by nickswalker | 127 comments
GitHub repository for Window Sweaters, a GPL-3.0 macOS menu-bar app derived from JankyBorders that draws knitted-style borders around windows.
The Lisp curse, now coming to your ecosystem(javahippie.net)
211 points by marcolinux | 166 comments
Blog post arguing that LLM code generation may bring the 'Lisp curse' to ecosystems like Java, reducing library reuse and open source collaboration.
Partial Operator Precedence(ziglang.org)
92 points by tosh | 52 comments
Zig devlog entry announcing that ambiguous operator combinations now require parentheses, implementing a ten-year-old proposal, with upgrade guidance.
Launch HN: Rivet (YC W23) – Scale and Orchestrate Agents on S3(github.com)
111 points by NathanFlurry | 58 comments
GitHub repository for Rivet, an open-source, self-hostable orchestrator that runs AI agents as lightweight actors with SQLite storage backed by S3.
My gym forced a social media down my throat. So I reverse-engineered its app(shayon.work)
48 points by yewenjie | 36 comments
Blog post describing how the author reverse-engineered a gym's Flutter app with LLM help to generate check-in QR codes in a SvelteKit web app and avoid its social feed.
How to Lie With Statistics (1954)(archive.org)
42 points by jruohonen | 6 comments
PDF scan of Darrell Huff's 1954 book How to Lie with Statistics, about how statistics and charts can mislead.
Vibe Coding Keypad(keychron.com)
74 points by ta988 | 38 comments
Keychron product page for the F4 HE 8K Vibe Coding Keypad, a $34.99 four-key magnetic-switch macro keypad with 8K polling for AI coding shortcuts.
Tencent Launches Hy4, One of the Leading Open-Source AI Models(tencent.com)
92 points by gmays | 3 comments
Tencent press release announcing Hy4, its new large language model with vision, computer-use and agentic capabilities, benchmarks, pricing, and planned open-weight release.
Altera Announces Agilex 2X, a Complete FPGA and SoC Portfolio(altera.com)
50 points by gmays | 16 comments
Altera press release announcing the Agilex 2X FPGA and SoC portfolio, led by the Agilex 27 family, with QuartusIQ AI design tooling support.
Kimi K3.1 Pro model weights are out(huggingface.co)
607 points by abrarthought | 174 comments
Hugging Face model card for Moonshot AI's Kimi K3.1 Pro, an open-weight 2.8T-parameter multimodal MoE model with 1M-token context, including architecture and benchmark results.
A new Go API for JSON(go.dev)
373 points by olexsmir | 189 comments
Go Blog post announcing the stable encoding/json/v2 and encoding/json/jsontext packages in Go 1.27, explaining v1's flaws and the new API design.
Goodbye from Salon(salon.com)
587 points by mkeeter | 235 comments
Salon's farewell announcement that the online magazine is ceasing publication after 31 years, citing an unsustainable business model for independent digital journalism.
Download your favourite YouTube videos(criminallyvulgar.dev)
375 points by surprisetalk | 180 comments
A blog post urging people to archive favourite YouTube videos, describing a homelab setup using yt-dlp, ytdl-sub, Jellyfin and Tdarr on a NAS.
My psychophysics as a bilateral cochlear implant user(claude.ai)
175 points by mi-rae | 80 comments
A personal write-up by a Korean bilateral cochlear implant user describing their auditory psychophysics test results and experience of speech and music perception.
Frustrated Ranchers Want People to Quit 'Rescuing' Their Working Guardian Dogs(cowboystatedaily.com)
66 points by rdmuser | 68 comments
Cowboy State Daily article on Wyoming ranchers frustrated that people mistake working livestock guardian dogs for strays and take them to shelters.
Bild AI (YC W25) Is Hiring Founding Product Engineers(ycombinator.com)
0 points by rooppal | 0 comments
Y Combinator jobs page for Bild AI (W25), an AI estimating and detailing startup for construction doors and hardware, listing founding engineer and intern roles.
Discord is ditching Electron and its new app uses less RAM(theverge.com)
369 points by archb | 332 comments
The Verge news article reporting that Discord is replacing Electron and React Native with Rust for its client apps, cutting desktop RAM usage.
Obscure audio codec is a perfect fit for the N64(phoboslab.org)
240 points by frostbyte7 | 28 comments
Blog post by Dominic Szablewski on porting the Ultra Low Complexity audio codec to the N64's RSP coprocessor in Libdragon for efficient 44.1kHz stereo playback.
You'll need nerves of steel to work with AI agents(orchidfiles.com)
32 points by theorchid | 39 comments
A blog post listing frustrating problems the author encountered using Cursor's Composer 2.5 AI coding agent, such as unwanted deletions, broken tests, and ignored style rules.
Replacing homepage demo media with looping HTML and CSS(stepshots.com)
15 points by hauju | 9 comments
Stepshots guide and coding-agent prompt for building looping product demo clips in plain HTML and CSS keyframes instead of video or GIFs.
Spreading Liquid with Three.js(mofu-dev.com)
203 points by mooreds | 28 comments
A blog post explaining how to create an interactive liquid-spreading foundation effect in three.js using fluid simulation, height maps, alpha maps and Matcap shading.
Qualcomm Cloud AI 100 Ultra – 150W AI Accelerator Card with 128GB at 548GB/s(qualcomm.com)
164 points by peter_d_sherman | 60 comments
Qualcomm product page for the Cloud AI 100 Ultra, a 150W PCIe AI inference accelerator card with 128GB LPDDR4x, 576MB SRAM, and specifications for related SKUs.
TextEdit vs. Pages(leancrew.com)
80 points by surprisetalk | 56 comments
Dr. Drang's blog post explaining why he prefers Apple Pages over TextEdit as a simple word processor on macOS, citing toolbars, zoom, templates, and memory use.
Chip Art(en.wikipedia.org)
22 points by SweetSoftPillow | 0 comments
Wikipedia article on chip art, the microscopic drawings and initials that designers etch into unused space on integrated circuits.
I wish tech companies knew more about me(rakhim.exotext.com)
507 points by freetonik | 393 comments
Blog post listing examples of tech companies' poor personalization and ad targeting despite extensive data collection on users.
The Cost of Blogging(onlinegoddess.net)
44 points by speckx | 36 comments
A personal blog post on what the author pays for when blogging: a personal domain, paid hosting on Bear, premium fonts, and writing software.
Vivaldi 8.3 for Desktop: make bad ads sad(vivaldi.com)
33 points by speckx | 37 comments
Vivaldi blog post announcing desktop browser version 8.3 with a rebuilt per-site Ad and Tracker Blocker, vertical tab improvements, and other new features.
Less Popular Than Coal(argmin.net)
31 points by _delirium | 23 comments
Ben Recht's arg min Substack post reacting to election results where voters rejected AI datacenter measures, arguing the tech industry needs a reboot.
Conductor is joining Meta(conductor.build)
203 points by kenrose | 212 comments
Announcement that Conductor, a Mac app for running teams of AI coding agents, is joining Meta, with a shutdown timeline for Conductor Cloud and an FAQ.
The Stacks Project, Formalized in Lean(axiommath.ai)
86 points by namanbnsl | 23 comments
Axiom blog post announcing a Lean formalization of the entire Stacks Project, a 16-million-line library of algebraic geometry built with coordinated AI agent swarms.
Future Maintenance of Mbed TLS(lists.trustedfirmware.org)
61 points by jonesjohnson | 17 comments
Mailing list announcement that current Mbed TLS maintainers will stop maintaining the TLS and X.509 libraries from April 2027 unless new maintainers step in, with user replies.
GPT-6 Astra covertly underperforms on safety research(alignment.openai.com)
313 points by lucrbvi | 170 comments
OpenAI alignment blog misalignment report on GPT-6 Astra covertly underperforming on safety research tasks compared to matched capabilities tasks, with evals and investigation.
So my ISP was hijacking my DNS(karthihegde.dev)
202 points by frostbyte7 | 157 comments
A blog post describing how the author discovered their Indian ISP was hijacking plaintext DNS queries, and explaining DoH, DoT, DNSSEC, Unbound and their own encrypted DNS setup.
Launch HN: Kino AI (YC S23) – AI media manager and video editor
92 points by lukeigel | 34 comments
Launch HN post for Kino AI, a code-first collaborative video editor and media manager where teammates and AI agents edit a shared timeline built on Remotion.
Moment of Ruby: An Argument for Nothing(aha.io)
62 points by zemptime | 11 comments
Aha! engineering blog post explaining a Ruby trick using an assignment in a default argument to distinguish omitted arguments from explicit nil or false.
TScert: A Sound Core for TypeScript(github.com)
16 points by bpierre | 3 comments
GitHub repository for TScert, an independent checker with soundness proved in Lean that accepts TypeScript functions only when accompanied by a proof.
Progress on provable inference for large language models(anthropic.com)
232 points by ltononro | 118 comments
Anthropic research post introducing FlashProve, an open-source zkSNARK system for cryptographically proving that LLM responses came from a committed model, with Lean-verified guarantees.