AI Summarized Hacker News

Front-page articles summarized hourly.

GitHub introduces staged publishing and new install-time controls for NPM

GitHub announces npm updates focused on supply-chain security: Staged publishing is generally available, requiring a maintainer to approve prebuilt tarballs before they become installable; visible in the npm UI and CLI and pairing with trusted publishing (OIDC). Update CI/CD to use npm stage publish for staged behavior; stage can be configured stage-only. New install-time flags in npm 11.15.0: --allow-file, --allow-remote, --allow-directory, in addition to existing --allow-git. Each flag can be set to all or none and configured in .npmrc or package.json. Reminder that --allow-git default will become none in v12. Docs available.

Waymo expands pause to four cities as robotaxis keep driving into floods

Waymo paused robotaxi service in four cities—Atlanta, San Antonio, Dallas, and Houston—after vehicles faced flooded roads in heavy rain. In Atlanta, a Waymo car drove through a flooded street and was stuck for about an hour before being recovered. Waymo had issued a software recall and added restrictions to avoid flooded, high-speed roads, but incidents persisted. Regulators (NHTSA and NTSB) are investigating Waymo over school-bus maneuvers and a January Santa Monica crash in which a robotaxi hit a child at ~6 mph. Waymo says safety is the priority and weather alerts guide prep.

Sp.h is the standard library that C deserves

sp.h is a portable, single-header C99 standard library replacement built directly on OS primitives rather than libc. At ~15,000 lines, it eschews the heap, uses length-based strings (sp_str_t), and centers on around 40 core syscalls for portability across Linux, Windows, macOS, WASM, and browsers. It explicitly avoids libc when possible, emphasizes explicit error handling and minimal global state, and prioritizes clarity over micro-optimizations. Not a libc fork, it’s open-source on GitHub with examples and extensions; collaboration is welcomed.

Microsoft reports AI is more expensive than paying human employees

Fortune reports that AI’s cost problem undermines its productivity gains: firms push heavy AI use, but compute costs and token consumption rise, potentially eclipsing savings from automation. Microsoft has begun canceling Claude Code licenses in favor of GitHub Copilot CLI, Uber says it blew through its 2026 AI tools budget, and others track growing token-based expenses. Gartner and industry leaders warn that cheaper tokens don’t automatically reduce enterprise AI costs, as agentic AI can require far more tokens per task. Adoption economics remain a major bottleneck.

I was bored so I turned my dev tools into an alien planet ruled by my dog

Planet Maiko is a free, local-only development tool where agents are weird alien dogs. It runs entirely on your laptop with no telemetry or cloud data, is open source and free. It automates multi-agent orchestration, agent task lifecycles, context sharing, conflict detection, self-curated memories, and insights; agents learn from mistakes and share notes with future agents. It supports plugins via Python classes and integrations (PagerDuty, Linear, Calendar, GitHub). Setup involves prerequisites (Python 3.10+, Node.js 18+, gh CLI), cloning the repo, creating a virtual environment, and running maiko up (or maiko serve + frontend dev). Documentation at docs/GUIDE.md.

Neutron scattering explains why gluten-free pasta falls apart (2025)

The message reports a 400 Bad Request blocked by the server's security policies, and instructs the user to contact support if this is an error.

Is AI Profitable Yet?

Could not summarize article.

"Stick" – A primitive/fun interactive demo of a tiny rig to animate layout

Layoutmaster Exclusion Assembly Demo rebuilds a stick figure each frame from primitive exclusion parts, with the pose driven by the current form call. Features include Wave, Animate wave, Show stick man visual, Show piece framing, Reset Rig, and Idle.

TikTok disproportionately served anti-Democratic videos during the 2024 election

Could not summarize article.

Blood Pumping Mechanism of the Hoof

Blood is pumped from the heart to the hoof, and because there are no muscles in the lower leg or hoof, a venous plexus along the hoof acts as a pump. When the hoof bears weight, the plexuses are compressed by the plantar cushion and coffin bone, driving blood up the leg; when the hoof is raised, the veins open and the arterial pulse and gravity push blood back toward the heart. One-way valves prevent backflow, creating a hydraulic cushion that protects the coffin bone. This 'second heart' is essential for proper hoof circulation.

FBI director's Based Apparel site has been spotted hosting a 'ClickFix' attack

PCMag reports Kash Patel's BasedApparel.com hosting a "ClickFix" style attack that tricks macOS users into running a malicious Terminal command. A fake Cloudflare page shows “Unusual Web Traffic Detected” and asks users to copy a command labeled “I am not a robot: Cloudflare Verification ID: 801470,” which pastes a hidden payload. The script fetches a shell script from a hacker domain, capable of stealing browser credentials and crypto-wallet data and sending it to the attacker. PCMag notes 27 AV engines flag it as a Trojan/infostealer; Based Apparel reportedly compromised; Apple added safeguards; no comment yet.

YAML? That's Norway Problem

Explores YAML’s “Norway problem”: NO can be parsed as boolean false due to old implicit boolean typing, causing NO to become false in lists. YAML v1.0/1.1 allowed English booleans; v1.2 removed implicit typing to align with JSON. By 2026 many libraries still exhibit 1.1 behavior (e.g., PyYAML, LibYAML, gopkg.in/yaml.v3), while some (ruamel.yaml, libfyaml, Kyaml) support 1.2. Workarounds include quoting NO or using explicit typing (!!bool). The ecosystem remains fragmented, with a slow shift toward stricter parsing.

SpaceX launches Starship v3 rocket

SpaceX successfully launched a Starship rocket prototype after scrubbing the May 21 launch due to technical difficulties.

Don't just paste the AI at me

An admonition against pasting AI-generated text in conversations. It argues that simply forwarding model outputs shows you haven’t thought, diminishing respect and usefulness. Use AI as a tool: read the model's answer in full, verify facts, and rewrite in your own voice. If you quote, mark what's checked and explain why. If you have nothing to add, say nothing. The piece promotes editing and personal input rather than delegating thinking, and proposes dontpastetheai.com as a reference. It's a satirical manifesto about maintaining human voice in replies.

Why We've Filed a Referendum

BEAR (Box Elder Accountability Referendum), a non-partisan, resident-led group, is leading a referendum to stop the Stratos Project Data Center in Box Elder County, Utah, citing a lack of information on water, power, cost, and governance and calling for local accountability. They argue the project benefits from unfair tax breaks for a corporation while residents pay more, and that residents and public review were excluded by the County and MIDA. The effort is tied to Referendums 26-11 and 26-12, with calls for volunteers to advocate for accountability and halt the data center.

A blueprint for formal verification of Apple corecrypto

Apple outlines a formal verification blueprint for corecrypto’s quantum-secure ML-KEM and ML-DSA, proving they meet FIPS 203/204 specs. A custom stack combines portable C/ARM64 code with formal proofs in Isabelle, using Cryptol and SAW, plus a Cryptol-to-Isabelle translator. The approach verifies both subroutines and end-to-end correctness, enabling cross-architecture security against future quantum threats and surfacing issues early (e.g., a missing step in ML-DSA). Apple emphasizes combining formal verification with conventional testing and releasing tools/theories to the community.

Sleep research led to a new sleep apnea drug

Could not summarize article.

Comparing an LZ4 Decompressor on Four Legacy CPUs

Michael Martin details four LZ4 decompressor implementations for legacy CPUs (Z80, 8080, 8086, and MOS 6502). He reviews LZ4's block sequence (literal runs plus backreferences) and encoder restrictions, showing how the algorithm maps to each architecture: Z80/8080 use two pointers and LDIR-like copies; 8086 uses far pointers and string instructions; 6502 relies on zero-page scratch RAM and an explicit .ldir helper for 16-bit copies. API conventions differ per CPU. The piece contrasts design choices, emphasizes staying close to historical constraints, and uses the work as a cross-CPU exploration.

I’m Writing Again

A 403 Forbidden error from Nginx.

NTSB pulls docket after AI recreates dead pilots' voices

After UPS flight 2976 crashed, internet users used the NTSB’s released spectrogram to reconstruct pilots’ cockpit voices with AI tools. The NTSB does not release cockpit audio, a policy backed by a 1990 federal law protecting crew privacy. In response to the reconstructions, the agency temporarily shut down public access to its docket while it reviews how the materials were used and how to prevent future misuse. Experts note that transcripts exist and that spectrograms can be exploited via Griffin-Lim and modern AI like Codex, raising privacy concerns.

Made by Johno Whitaker using FastHTML