AI Summarized Hacker News

Front-page articles summarized hourly.

Apple's New iPhone Update Is Restricting Internet Freedom in the UK

HTTP 415 'Unsupported Media Type' error from OpenResty (version 1.27.1.1).

I still prefer MCP over skills

MCP (Model Context Protocol) is presented as superior to Skills for giving LLMs access to services. It’s an API abstraction: the LLM asks what to do; the MCP handles how, enabling zero-install remote usage, seamless updates, cleaner auth, portability, sandboxing, and smart discovery. Skills work for pure knowledge, but CLI-based skills cause deployment, secret-management, fragmentation, and context-bloat. The author urges MCP as the standard connectors for services and reserving Skills for knowledge tasks, internal jargon, and context, with examples like mcp-server-devonthink, microfn, Kikuyo, and MCP Nest.

RAM Has a Design Flaw from 1966. I Bypassed It [video]

Google detected unusual traffic from the user's network and blocked access to YouTube; to continue, solve a CAPTCHA. The block may be caused by malware, a browser plug-in, or automated scripts; if sharing the network, ask the administrator for help. The page lists the IP address, time, and URL, and notes the block will expire once the automated requests stop.

Vibe-Coded Ext4 for OpenBSD

OpenBSD faced a controversy over an ext4 filesystem driver reportedly generated entirely by AI (ChatGPT/Claude-code), offering read/write and passing e2fsck but no journaling. De Grivel claimed no Linux code was read; yet licensing concerns linger because ext4 implicates GPL code and AI outputs raise ownership questions. Theo de Raadt said such code would likely not be accepted amid unresolved copyright issues; Damien Miller highlighted uncertain authorship. The episode highlights broader debates about AI-generated code, licenses, and maintenance in open source.

Generative Art over the Years

Veit's generative-art journey since 2016 moves from math-first experiments (phyllotaxis spiral) to a textured, material-driven practice. Early work emphasized algorithms and visuals; over time texture, line density, and simulated materials (watercolor, dry brush, pencil, glaze) formed a personal vocabulary. Color remains a challenge learned by trial and exposure. The practice evolved from maximizing algorithms to composing shapes, colors and textures into coherent pieces, producing a personal aesthetic where tools fade in importance and intent, with patient, non-pressured exploration despite a busy life.

Microsoft PhotoDNA scanning problem

Could not summarize article.

How Close Is Too Close? Applying Fluid Dynamics Research Methods to PC Cooling

Could not summarize article.

How the Trivy supply chain attack harvested credentials from secrets managers

Trivy supply chain attack (Mar 2026) injected credential-harvesting malware into the official v0.69.4 release and into trivy-action/setup-trivy via mutable Git tags. The malware ran alongside legitimate scans, reading plaintext API keys from environment variables in CI/CD runtimes and exfiltrating them, illustrating why standard secrets managers fail: keys exist in use as plaintext. VaultProof proposes a fix: split-key architecture that distributes API key shares; the pipeline never holds a full key, and reconstruction happens in memory only for each call. Affected: Trivy binary, related GitHub Actions, CI/CD environments.

Will I ever own a zettaflop?

An enthusiast muses about owning a zettaflop-scale AI machine, chasing the near-singularity. He contrasts exaflop dreams with the realities of massive data streams that would overwhelm a human mind, and envisions commanding thousands of AI agents (thousands of Claudes) to search all books, compute, write, and iterate. The plan hinges on power: around 10 MW, fed by solar panels (≈250 acres) with energy storage. With 100k chips at 10 PFLOPS each, total cost around $30 million (machine, solar, land). He insists he’ll own it before he dies. The singularity is nearer.

How NASA Built Artemis II’s Fault-Tolerant Computer

Access to acm.org is blocked by Cloudflare’s security service. The block was triggered by an action that could resemble a word, SQL command, or malformed data. To resolve, email the site owner with what you were doing and include the Cloudflare Ray ID (9e9d88a46f0d175e) and your IP. Cloudflare provides the page’s Ray ID and IP details for troubleshooting.

The Training Example Lie Bracket

Treat each training example x as a vector field v^(x)(θ) = -∇ L^(x)(θ). The Lie bracket [v^(x), v^(y)] = (v^(x)·∇)v^(y) − (v^(y)·∇)v^(x) measures update-order sensitivity. Expanding θ' = θ + ε v^(x)(θ) and θ'' = θ' + ε v^(y)(θ') yields Δθ'' = ε^2 [v^(x), v^(y)](θ). Experiments on a convnet with CelebA show brackets vary by checkpoint, correlate with gradient magnitudes, and can shift some logits (e.g., Black_Hair/Brown_Hair) due to loss assumptions; code provided.

BunnyCDN has been silently losing our production files for 15 months

Access blocked by network policy. To resume, log in or create an account. If using a script/app, sign in with developer credentials. Ensure the User-Agent is non-empty, unique, and descriptive; revert to default if using an alternate UA. Read Reddit's Terms of Service. If the block is believed to be an error, file a ticket and include your Reddit account and the reference code 019d7483-5533-7272-b056-486390f14718.

Robots Eat Cars

Cars are evolving into robot platforms, adopting centralized compute, zonal controllers, and software-defined actuation, enabling cross‑industry automation. Tesla is shutting Model S/X production to retool for Optimus humanoid robots, while Ford and others push 48V zonal architectures to slash wiring. Actuator suppliers (Hyundai Mobis, Schaeffler) push into humanoids; heavy hydraulics give way to electric belt-driven actuation, unlocking predictive maintenance and efficiency gains. The same architecture serves automotive, construction, logistics, and defense, expanding the market for component suppliers and reshaping the supply chain, with ongoing robotics ecosystem investments.

Many African families spend fortunes burying their dead

Across many sub-Saharan African kinship societies, funerals are not only ceremonies for the dead but costly public signals of loyalty to extended families. In Ghana and elsewhere, families delay mortuary proceedings, hire lavish crews, and commission fantasy coffins to showcase status and obligation. A grave can cost roughly $5,000 for a modest funeral and $15,000–$20,000 for a truly befitting one, even as median incomes are far lower. Financing often comes from debt, selling assets, or cutting living costs. The result is wealth destruction that enforces sharing obligations, discourages saving, and impedes private accumulation and growth. Privacy and impersonal institutions offer emancipation.

Show HN: Druids – Build your own software factory

Druids is a batteries-included library to orchestrate and deploy coding agents across machines, hiding VM provisioning and inter-agent communication. It lets you define a program where multiple sandboxed agents run in parallel on isolated environments, report results via events, and a central judge selects the best output. Use cases include performance optimization, automated code review, security testing, migrations, and data pipelines. Agents can share machines, transfer files, and be managed via a CLI/SDK; quickstart requires Docker, uv, and an API key. Architecture spans server, client, runtime, frontend and docs.

Progressive encoding and decoding of 'repeated' protobuffer fields

Explains how to encode/decode protobuffer messages with repeated fields in a streaming fashion, motivated by Perfetto traces consisting of many TracePacket messages wrapped in a Trace with a repeated TracePacket field. Reviews the protobuf wire format: varints, keys (field_number<<3|wire_type), length-delimited nested messages, and repeated fields. Proposes progressive serialization by writing individual TracePacket encodings prefixed with field tag 0x0A and varint length, concatenating them into a trace file. Describes progressive deserialization by slicing the length-delimited segments; caution about non-self-delimiting wire and need to trim bytes. Includes Rust examples.

Moving from WordPress to Jekyll (and static site generators in general)

Ray Grieselhuber details DemandSphere's move from WordPress to Jekyll, driven by speed, talent bottlenecks, and familiarity. They used Claude Code to analyze and prune 288 posts, migrate assets, and build internal dev tools (site structure, Lighthouse, schema, content similarity, etc.). They deploy a client-side search via a single static JSON, robust SEO with JSON-LD, environment-aware robots, consent-first GA, and automated sitemap. The Cloudflare Pages cutover exposed favicon issues later fixed. Ongoing work includes image optimization and better post categorization. Overall, migration is successful and speeds content development.

Instant 1.0, a backend for AI-coded apps

Instant 1.0 releases a fully open-source backend for AI-coded apps. It runs unlimited multi-tenant apps on a single Postgres database with a generalized sync engine (Clojure) and built-in services (auth, storage, presence, streams). Architecture: Client SDK with offline-first IndexedDB, InstaQL/Datalog, and a pending-queue mutation model; a Clojure backend that keeps queries reactive via a topic/invalidator system; a multi-tenant Triple store in Postgres with soft deletes and partial indexes. Demos show live Todo apps across iframes; developers can create apps via API/CLI rather than dashboards.

Microsoft and other large technology companies are hostile to their users

An IT pro recounts helping a non-tech-literate neighbor whose Outlook storage error stemmed from OneDrive saving Windows files by default, filling a 5 GB quota with personal data rather than mail. The fix involved backing up, removing OneDrive with Chris Titus’ WinUtil, and deleting OneDrive contents to restore email access. He argues Microsoft and other big tech firms deploy dark patterns and KPI-driven incentives that undermine users, calling for redesign focused on users and responsibility.

How Do You Find an Illegal Image Without Looking at It?

The piece explains how platforms detect CSAM at internet scale while protecting user privacy, contrasting known CSAM detection via perceptual hashing (PhotoDNA, PDQ) with unknown/AI-generated material via machine-learning classifiers. It details PDQ’s 256-bit fingerprints, thresholding, and TMK for video (Level 1/2 descriptors) and vPDQ for clips, plus the Hasher-Matcher-Actioner pattern. It emphasizes the AI-generated content triage bottleneck and the ethical tradeoffs between false positives and false negatives.

Made by Johno Whitaker using FastHTML