AI Summarized Hacker News
Front-page articles summarized hourly.
NetWasm is an independent compiler/toolchain that compiles C# and .NET CIL to small standalone WebAssembly with WASI (AOT with built-in runtime and precise GC). It ships runtime, core libraries, and SDK, producing self-contained WASI components without desktop CLR. It enables build/run/publish/test via dotnet CLI, exports C# as typed JavaScript modules, and targets netwasm0.1 and net10.0. It features size-optimized garbage collectors (Compact and NetWasmGC), claims smaller footprints than Rust/Blazor for similar work, and emphasizes a future 1.0 roadmap with broader WASI coverage. Licensing is MIT for core, Apache-2.0 for collectors.
HN Comments
The article introduces std::polymorphic in C++26 to build composite objects whose components have varying dynamic types while preserving value semantics. It contrasts with std::indirect and std::variant, and highlights issues with a clone-based approach using unique_ptr for an EventLog of heterogeneous Event-derived objects. With std::polymorphic, copying ownership is automatic, const propagates, and there is no null state or clone boilerplate. An Event/TemperatureReadingEvent/SmokeDetectedEvent/CarbonMonoxideDetectedEvent example shows type-erased copies via std::polymorphic<Event> in an EventLog.
HN Comments
Anthropic’s Claude automated attack-surface analysis across 25 open-source projects, surfacing 493 issues. The focus: reduce code reachability rather than fix every flaw. Three techniques: Default configuration (unneeded surfaces reachable by default), Configuration interaction (dangerous option combos), and Early reachability (pre-auth or pre-state checks). Findings: gated projects had many pre-auth surfaces; 162 risky configuration combos, with 94 silently disabling security. OpenSSH case revealed ~4,500 lines of ML-DSA-44 reachable before fix; moving checks earlier cut exposure by ~20%. A three-pass Claude workflow and OSS-Scanner integration are proposed.
HN Comments
Nexus-CLI is a pure-Go CLI and local API proxy that connects any app or coding agent to DeepSeek’s V3/R1 models via chat.deepseek.com, without a paid API key. It features a high‑performance PoW solver, an interactive REPL with real‑time model reasoning, and a local proxy server with adapters for OpenAI and Anthropic. It supports one-off prompts and Unix pipes, strict JSON outputs, and universal tool launchers for Claude Code, Codex, Goose, Aider, and more. It also offers multi‑account pools, various authentication methods, diagnostics, and full installation/build guidance.
HN Comments
The article explains setting up an SSH identity on macOS using the Secure Enclave and Touch ID to avoid private-key files. It creates a non-extractable CTK identity on the Secure Enclave (sc_auth create-ctk-identity -l ssh-key -k p-256-ne -t bio), configures SSH to use it via ssh-add -K -S /usr/lib/ssh-keychain.dylib (after reboot), and registers the public key with a server (GitHub) by running ssh-add -L. Authentication signs with the enclave after a Touch ID prompt. If the Mac dies, you must recreate and re-register the identity. The piece also explains the underlying flow.
HN Comments
Explains a heap use-after-free in PHP's session.upload_progress (CVE-2026-109618/109619) caused by two cached zval bucket pointers in post_bytes_processed and current_file_bytes_processed that are freed during request handling, enabling an attacker to trigger a call to system() via zend_call_function. The document includes PoCs, per-build deltas, and a lab-ready framework for exploitation. Recommended mitigations: disable session.upload_progress (php.ini: session.upload_progress.enabled=0), clamp multipart uploads at the edge, and apply patches to PHP 8.5.11/8.4.26/8.3.35/8.2.34. Credits and download info provided.
HN Comments
Basis demonstrates using LLMs to generate a formal WHILE semantics and to prove, in Lean, that an interpreter compiled to RISC-V adheres to that semantics. Tests alone can miss bugs; the team fixes issues like long function names and memory rendering using separation logic for malloc. They prove an endToEnd_refinement theorem asserting that, for all programs under preconditions, the semantics’ outputs equal the binary’s outputs. They built four tools (type checker, program logic, abstract interpreter, verified compiler) and a verified WHILE→RISC-V compiler. After large Lean work, outputs match; they aim to scale to Lua, OCaml, CPython.
HN Comments
Pillowfort is closing. The text mainly shows site UI elements (cookie notice, login, reblog/like/comment placeholders, publish scheduling) rather than substantive content.
HN Comments
Battlezone Online (bzo) is an open-source, free 3D multiplayer tank game that runs in the browser and works with BZFlag clients/servers. No installation required; play on desktop, phone, or VR via WebXR. The server runs in Node.js and the client in Three.js, communicating over WebSockets, WebTransport, and WebRTC. Releases provide Docker images and source tarballs for Ubuntu 26.04, with SemVer tags. The project is AGPLv3; assets have varied licensing and provenance must be documented. Documentation covers installation, server listing, controls, and VR features.
HN Comments
Alibaba quietly hiked DeepSeek V4 Flash 0731 output from $0.40 to $1.32 per million tokens (≈230%); input costs rose from $0.20 to $0.44. Mistral raised Ministral 3B by 150% and 8B by 50%; Qwen3.6 35B-A3B +52%; 17 price moves overall, while Zhipu AI cut GLM-5V-Turbo 85%. The piece argues subsidized compute era is ending and builders must optimize prompts, cache outputs, and curb token consumption. Other items: SF Compute $245M compute sale; Meta Muse Wonder Full and Muse Glimmer 30B; MiniMax Space Bunny revealed as M3.1 Flash; NVIDIA Nemotron 3.5 for cheaper inference; Inception Mercury 3 diffusion LLM.
HN Comments
Decker’s annual update (versions 1.61–1.71) introduces New Horizons (gamepad support, IMG3 image compression, new UI data/note attributes, pattern styling), Growing a Language (Lil refinements: numeric/lexicographic operator behavior, table/raze tweaks, new Bits tools, and a generalized KeyStore), The Deckerverse (five new example decks and a surge of community jams with 113 new decks on itch.io), A Pledge for Human Creativity (anti-LLM stance and SDL policy), plus a call to join the community and the upcoming Deck-Month jam.
HN Comments
The text presents an HTTP 403 Forbidden error, indicating the server understood the request but refuses to authorize access to the requested resource.
HN Comments
Ante replaces lifetimes with 'places'—the exact data a reference may borrow from—to model borrowing. By marking unstable places (e.g., a!, a!!) and tracking Mutate effects, it permits safe shared mutability and complex dataflow, including cyclic structures, with no runtime overhead. The design lets references alias or mutate under controlled rules, uses use-vs-mention to separate actual mutations from mere references, and extends Rc-based sharing with static checks. The goal is fewer borrow errors, better patterns (observers, cycles), and closer interop with other languages, while staying low-level.
HN Comments
FulcrumSec claims PingCAP TiDB Cloud suffered a months-long breach, exfiltrating 10.6 TB of data across AWS, GCP, Jira, CRM, and source code. They report 88 undetected six-hour exports of the production control plane (Sept 8–30, 2026), yielding 180,046 tenants, 292,276 users, 115,308 plaintext API keys (42,612 active), 20,645,574 SQL statements, 102,003,766 gateway connections, 413 private repos, and extensive cost, billing, and analytics data. They allege insecure multi-tenant isolation, citing a 2022 Jira SECURITY-22 note that root passwords could be reset by any member, enabling full cluster access. They released stage-one archives with credentials, logs, Jira issues, and customer data.
HN Comments
Sinclair ZX Spectrum Next Laptop Version 2 is a self-built laptop using a Spectrum Next keyboard, a mini PCB compatible with Raspberry Pi, USB and WiFi, dual micro-SD, a touchpad, and a 14" WXGA LCD with HDMI/VGA. It repurposes an old laptop screen with a custom LCD controller and 3D-printed/Shapeways parts. It fixes issues from the first version (hinges, HDMI compatibility) by new hinges and a larger screen, and is not affiliated with the official Spectrum Next. Updates add a 12V UPS and a 10,000 mAh battery (~6h) and Arduino PWM backlight control via keyboard (Symbol Shift + Left/Right).
HN Comments
Josh W. Comeau previews Interop 2027’s top CSS picks, highlighting how Interop aims for near-universal browser support. Ten candidates are discussed: CSS functions; corner-shape (squircles/bevels) and border-shape/gap decorations; anchored container queries; CSS inherit(); scroll-triggered/scroll-driven animations; reading-flow and reading-order; interpolate-size with calc-size(); and scroll-state container queries. Chrome 155+/Edge 154+ lead current support, while Firefox/Safari lag. The post emphasizes progressive enhancement and invites readers to rank their own favorites.
HN Comments
Quanta explains that quantum mechanics operates in Hilbert space, an abstract space of all possible futures for a system. States are vectors whose orientation encodes outcome probabilities; before measurement, properties aren’t fixed. Von Neumann unified Heisenberg’s matrix mechanics and Schrödinger’s wave mechanics with axioms. The Hilbert-space dimension matches a system’s possible outcomes (qubits, etc.), and measurement collapses to a definite result. Today some physicists use von Neumann algebras too, and debate whether Hilbert space reflects reality or is a practical tool, with implications for black holes and quantum gravity.
HN Comments
Examines the economics of decision models (Jev) and their outputs—choice, score, and noul. Proposes a decision hierarchy in which to answer or escalate is governed by Chow's rule, balancing wrong-answer costs, per-level price, and per-category error costs. Uses numerical examples and derives 1 − p_max < NX_err + NX_price/NX_errcost, extended to per-category NX_errcost and C' = sum p_c NX_errcost(c). Finds that when errors are expensive, accuracy matters most; latency and audits matter too. Predicts competition will commoditize interfaces, but honest probabilities and domain-specific calibration matter; future includes multimodal, on-device decisions.
HN Comments
PHP announces an upcoming security release addressing two critical vulnerabilities (CVSS v4.0, 9.2). Release scheduled Wednesday, 21 October 2026 at 14:00 UTC; users should prepare to update promptly. The release may occur earlier if details become public or active exploitation is observed. Message by Jakub Zelenka (20 Oct 2026).
HN Comments
GitHub released a package firewall in public preview for GitHub Enterprise Cloud to block malicious packages at install time. It sits between endpoints (Actions runners, CI agents) and upstream registries, inspecting metadata requests and downloads. Administrators set policies (cooldown, GitHub Advisory Database checks, attestation downgrades), and endpoints must route requests through the firewall. Users can request exceptions if blocks are mistaken. In preview, free; at GA, pricing by metered usage. Currently supports npm packages only. Setup documented in Protecting endpoints with package firewall.
HN Comments
Made by Johno Whitaker using FastHTML