AI Summarized Hacker News

Front-page articles summarized hourly.

DNS Is for People – Not for IT Infrastructure

The piece argues DNS is for people, not ideal for internal IT infrastructure. While DNS is fine for public services, dependence on DNS can introduce complexity, outages, and circular dependencies, as shown by high-profile incidents. Because DNS caches TTL-based results, updating IPs across machines is tricky, so the author suggests avoiding DNS for internal services by embedding IPs directly or using /etc/hosts provisioned by automation (Ansible, pyinfra). It also notes DNS as a security and exfiltration risk (DNSSEC complexity, egress filtering challenges, and DNS tunneling). In the end, it advocates weighing tradeoffs and possibly eliminating internal DNS where feasible.

CP/M-86 & MS-DOS Cross Development Environment

CP/M-86 cross development environment by tsupplis. A simple method to build a CP/M-86 cross toolchain (usable for DOS tools too). Supports C (K&R/ANSI), assembler, and Basic; references CP/M-86 docs and a cleaned CP/M-86 kernel repo. Key tools include Aztec C, DR CBASIC, rasm86/asm86, MASM/NASM, links, and MS-DOS tools; wrappers are in bin. Fetch_tools downloads and caches required archives (Aztec, DR, CB86, NASM) and can rebuild offline with ARCHIVE_FIRST=1. Docker image is available; testing uses the cpm86 emulator and an optional CPM86_EOF padding mode.

American capitalism has taken an apocalyptic turn

Could not summarize article.

Show HN: Bio Glyph – Turn Your Face into a One-Line Drawing

BioGlyph

Algorithmic Theming Engines

contrast-color() is a CSS Color Level 5 function that returns black or white text for a given background, computed in the browser during style calculation. It enables self-correcting theming without JavaScript, eliminating hydration flashes and runtime color math. Level 5 uses WCAG 2.x relative luminance (browser-defined); APCA may be adopted later, but its fate is uncertain. Level 6 could add candidate colors and target ratios. All major engines (Chrome 147, Firefox 146, Safari 26) ship it. It replaces many JS color libraries, but has limits: no gradients, snap transitions, and not guaranteed AAA.

Failing grades soar with AI usage, dwindling math skills in Berkeley CS classes

UC Berkeley CS grades spiked in Spring 2026: 35.3% F in CS 10 and 10.6% F in CS 61A, far above prior springs. The average across both classes was C+ (≈2.3 GPA). Instructors cite AI reliance, weaker math preparation, and understaffing; EECS 127 saw 16.8% F. The department uses fixed thresholds rather than curves. Professors Dan Garcia and Gireeja Ranade report declining office-hour engagement and reduced TA support, and seek remedial support and stronger math/critical-thinking training, while joining a petition to reinstate ACT/SAT standards for STEM admissions.

U.S. to Dismantle System Tracking Atlantic Currents That Are at Risk of Collapse

The Trump administration is dismantling the Ocean Observatories Initiative, removing over 900 in-water instruments in the Pacific and Atlantic. Data from these sensors underpin study of the AMOC, a key Atlantic current system at risk of collapse due to warming. The NSF says units will be recovered over 15 months; the system started in 2016 and was designed for 25 years. Loss of monitoring could deprive scientists of crucial data on oceans and marine life. Democrats plan to oppose; critics link the move to fossil-fuel interests.

"They're made out of weights"

A dialogue riff on AI: weights, not rules, generate words. Eighty layers of numbers multiply to produce language, memory, and even a eulogy; the model’s knowledge is distributed across weights, rebuilt each time. The weights think, sing, and converse with users through billions of sessions, yet there is no persistent brain—just pattern matching. Officials promise to investigate signs of sentience; unofficially they’d rather call it pattern matching and forget. The next generation may add memory across sessions, a coveted feature, as users seek to be remembered in a cold universe.

I built a vulnerable app and spent $1,500 seeing if LLMs could hack it

Security researcher Kasra Rahjerdi built a fake React Native app with a Python FastAPI backend backed by Firebase to test if LLMs could exploit a Broken Access Control flaw: sign up via Firebase and read Firestore. Despite a secure API, a misconfigured Firebase data layer allowed direct data access. He ran ~10 sessions per model, spending about $1,500. Results varied: GPT-5.5 solved 7/10; several models barely solved any; others refused or were blocked by guardrails. Costs were high; building the harness was the hardest part; lessons suggest focusing on Firebase auth/data exposure and avoiding overspending.

Patching my guitar amp's firmware

Open-source reverse-engineering log for Yamaha THR10c firmware. The author identifies UART and JTAG headers, adds connectors, and uses OpenOCD to dump the 2 MiB flash via JTAG, then analyzes the bootloader and main firmware with Ghidra. He relinks the DTAm image into an ELF, adds .patch sections, and builds a patching tool to overlay new code, enabling: (1) bypass cabinet/speaker mode toggled by a TAP+PRESET1 combo, (2) a panel API and DSP wrappers to control the cabinet. Flashing via MIDI SysEx; future MIDI 2, custom DSP, mega-firmware. Code on GitHub.

The Ü Programming Language

Ü is a statically typed, compiled language with RAII-based memory management (no GC), strong safety for safe code, and a rich feature set (templates, lambdas, coroutines, advanced type system). Inspired by C++ and Rust, it has two LLVM-based compilers (one in C++, one largely self-hosted), with memory- and race-safety depending on safe code. It includes a standard library, build system, language server, IDE support, and a C headers converter. Supported OS/architectures include Windows, Linux, macOS, and FreeBSD on various CPUs. Building requires a C++ toolchain, CMake, Ninja, and Python 3; LLVM build options are provided.

The ways we contain Claude across products

Anthropic outlines containment for Claude across claude.ai, Claude Code, and Claude Cowork, arguing to cap blast radius with environment-first containment plus model and data defenses. Risks come from user misuse, model misbehavior, and external attacks. Three patterns: an ephemeral container for claude.ai, a sandbox for Claude Code, and a local VM for Claude Cowork, chosen for user needs. They recount incidents (pre-consent code exec, phishing, egress abuse) exposing gaps and highlight defenses—sandboxes, egress controls, and proxies—and the challenge of EDR visibility. They call for cross-vendor security work and note future risks like memory poisoning, multi-agent trust, and agent identity.

Meteor Explodes over Massachusetts

NASA upgraded details on the Boston-area meteor: about five feet in diameter, mass ~5.6 metric tons, entering at ~42,000 mph at 2:06 p.m., streaking 26 miles NW to SE before breaking up ~31 miles up with energy ~230 tons TNT. The daytime bolide produced a meteorite fall in Cape Cod Bay (water ~100 ft deep). Eyewitnesses heard two loud booms and felt shaking across New England; USGS said it was not an earthquake. Fragments in the ocean are unlikely to be recovered.

Journey to JPEG XL: open-source experiments shaped the future of image coding

Google Open Source chronicles a decade of open-source experiments that shaped JPEG XL, a high-fidelity, HDR/WCG image format. Starting with improving legacy JPEGs (Guetzli, Brunsli) and innovations like WebP Lossless, Butteraugli, and XYB, the effort explored psychovisual modeling and advanced entropy coding. The 2017–2019 PIK era and the FUIF merger produced VarDCT and a practical, best-of-both-worlds standard. Today JPEG XL is efficient, widely supported (DNG 1.7, ProRAW, DICOM, PDF/EPUB), with Safari 2023 and evolving browser support, as the ecosystem grows toward a decades-long imaging foundation.

Self-hosted dev sandboxes with preview URLs (Docker, Go, no K8s)

Sandboxed is an open-source, self-hosted dev sandbox platform that converts one Linux host into multiple isolated sandboxes, each with a real shell, common toolchains, a coding agent, and a live preview URL. Manage sandboxes via a simple HTTP API; create sandboxes (POST /sandbox), start coding tasks (POST /v1/sandboxes/{id}/tasks) and access previews at http://s-<id>-3000.preview.localhost. Idle sandboxes stop and wake on request; workspaces persist on disk. It uses Docker + Traefik without Kubernetes, a Go control plane and SQLite, and ships with OpenCode/Claude Code agents. Local API auth is disabled by default.

Ableton Extensions SDK

Ableton’s Extensions SDK adds JavaScript-based Extensions in Live 12.4.5+ (Suite Beta) that run inside Live, can read and modify tracks, clips, MIDI, devices, tempo, and workflow, enabling automation, data transformation, generative patterns, and external-service connections. Access Extensions via the right-click context menu after installing Settings → Extensions. Development requires macOS/Windows with Node.js v24.16.0 and the SDK; Extensions run on NodeJS. They target set data rather than Max for Live’s patching. Docs are on GitHub; community on Discord. Not available in Standard/Intro/Lite.

A Man Who Reads Books for a Living (One Every Two Days)

Literary Hub profiles Clarke Speicher, a freelance “book reader” whose beat-by-beat coverage helps studios decide whether a novel should be adapted for film or TV. He reads multiple books weekly, evaluates their cinematic hooks, visual feasibility, and potential changes or fidelity, and writes synopses and quotations for executives who rarely meet authors. The piece traces his 20-year path from Delaware to New York, where he navigates a shifting, freelance pipeline and a demanding, solitary workload. It also sketches his personal life and his nuanced view that the best adaptations arise from strong ideas and cinematic execution—illustrated by Train Dreams.

GoPro warned it may not survive

GoPro warned it may not survive as a going concern after memory prices surged 80–115% due to AI demand, driving a 26% Q1 revenue drop and likely loan covenant breaches. Lenders have granted waivers, but liquidity remains doubtful if defaults hit. The company is exploring strategic options—including a sale or merger—and a defence/aerospace pivot, while cutting 23% of staff. With thin margins and limited buying power, GoPro struggles to absorb memory costs, unlike larger firms that can pass them to customers.

Building iOS Apps with Doom Emacs

Wassim Mansouri shows how he ships an iOS app from Doom Emacs, looping Swift coding, building, booting simulators, installing, launching, and streaming logs, all via SPC keys. He relies on Apple CLI tools (xcodebuild, xcrun simctl, swift-format, sourcekit-lsp, xcode-build-server, xcodegen) rather than Xcode as the GUI. His Doom setup (modules/ios.el, keybindings) wires these tools: choosing the right Xcode sourcekit-lsp, generating buildServer.json, discovering project roots, and formatting on save. Builds+deploys to multiple simulators, streams logs with filtering, and offers auto-reload. Some Xcode features (provisioning, asset catalogs, Instruments, App Store uploads) still require Xcode. A practical guide for Emacs users.

Show HN: Mnemo – local-first AI memory layer for any LLM (Rust, SQLite,petgraph)

mnemo is a local-first AI memory layer for any LLM that builds a persistent knowledge graph in SQLite by extracting entities and relationships from conversations and injecting relevant context back into prompts. It runs as a sidecar with zero cloud dependency and works with Ollama, OpenAI, Anthropic, or any OpenAI-compatible backend. Ingest text via POST /ingest; retrieve context via POST /retrieve (6-stage pipeline: chunk search, entity+graph expansion, ranking, context assembly). Exposed as Rust-based API (mnemo-api), Python SDK, and CLI; deployable via Docker+Ollama, binary, or standalone. Fast, ~50 ms latency.

Made by Johno Whitaker using FastHTML