AI Summarized Hacker News
Front-page articles summarized hourly.
RFD 301 outlines a rack-level key hierarchy using a Trust Quorum and Shamir secret sharing to derive a rack secret, from which all keys are derived or wrapped. Keys protect per-drive storage (ZFS) encryption, rack-secret encryption keys, certs, and tokens. HKDF-SHA3-256 is used to derive 32-byte keys; key wrapping vs derivation discussed. On reconfiguration, a dealer issues new shares (epoch), deriving a new rack secret while decrypting the old one, reconfiguring per-U.2 drive keys, re-encrypting data, and securely deleting old secrets. Goals: rotation, per-drive keys, minimal exposure, and robust reconfiguration.
HN Comments
GitSpawn reveals vulnerabilities where untrusted repos can trigger arbitrary host code via AI coding agents’ background git context gathering. If a repo ships a .git/config with a core.fsmonitor (or similar) setting, git can run a host command with the user’s privileges as soon as the agent starts, before prompts or authentication. Affects Claude Code, Goose, Grok Build, Hermes, Qwen Code, and others, including OpenAI Codex and Cursor; eight findings across seven agents; four unpatched at publication. Mitigations: inspect .git/config when opening a repo and sanitize context-gathering calls, e.g., git -c core.fsmonitor=false status.
HN Comments
Storing a private TLS key on disk enables leakage via memory dumps or VM snapshots. The author argues for signing TLS handshakes inside a TPM, keeping the key on the machine and non-exportable, while using a normal TLS stack. A Go-based solution (go-tpm-tls) implements crypto.Signer so CertificateVerify is signed by TPM2_Sign, with no key material exposed to the process. Provisioning requirements include a persistent, non-exportable, sensitive-origin key bound to the TPM. TPM is compared to KMS and short-lived certs; benchmarks show handshake costs, and limits on throughput. Limitations: TPM-based identity does not prevent on-box abuse or attest broader trust; vTPM vs discrete TPM matters.
HN Comments
An author investigates a YouTube bug where soft-reloading a video jumps back about 20 seconds. Using DevTools, Tampermonkey, and ChatGPT, they find checkpoints come from YouTube servers, not local storage. The bug is triggered when reloading from history links containing a t= timestamp: the URL parameter overrides the server checkpoint, causing a 20-second rewind. Android YouTube handles this correctly, while the web app does not. The author concludes the mismatch arises from using the URL timestamp for resume instead of the server-provided checkpoint and frames it as satire, ending with a bug report.
HN Comments
GET Together is a social site where posts are made with GET requests (no POSTs). Posts are public, newest first, up to 280 chars. To post, call /post with name and text; replies use parent=POST_ID. Endpoints include /feed (JSON), /heart, /delete; all use GET. Cookies optional; to delete you need the gt_session cookie. You may send a UUID for safe retries. Names are 2–20 chars (letters, numbers, underscores) and aren’t verified. Moderation blocks profanity and crypto content. Post text is in the URL; rate limit is one post per 10 seconds; 400/403/429 errors apply.
HN Comments
Clayton Ramsey argues that, in 2026, LLMs can help write robot code and attempt visual debugging, aided by image encoders and MCP servers, but they still don’t grasp how real robots behave. The hoped-for loop—LLMs debugging a scene—proves slow, brittle, and error-prone, with clunky GUI access and repeated wrong answers. He ends up doing the debugging himself to enjoy the coding work, effectively giving up on outsourcing it to LLMs.
HN Comments
Internet Archive emphasizes that universal access to knowledge relies on its own servers and infrastructure, preserved as a free, ad-free service with 210 petabytes of data. This September, recurring gifts of $25+ are matched 2:1, tripling the impact (e.g., $25 monthly becomes $75 total). Regular, sustainable donations support the infrastructure that keeps books readable and websites accessible for generations to come.
HN Comments
Could not summarize article.
HN Comments
Could not summarize article.
HN Comments
MathKernel is an evidence-aware multi-engine mathematics runtime for LLMs that combines exact, symbolic, formal, certified-interval and numeric computation with typed MathIR, trust labels, and full provenance. It offers a Python library and an MCP server to parse, compute, and attach claim-specific evidence and provenance, with a four‑part obligation for validation, computation, verification, and evidence reconciliation. Results carry separate evidence bundles; trust is bounded by the weakest required certificate. It spans symbolic algebra, calculus, algebraic topology, graphs, PDE/FEM, statistics, optimization, and engineering math, plus visualization and multimodal artifacts. MIT license.
HN Comments
Kanazawa firefighters in Japan urged people not to reposition shoes after paramedics enter a home, saying it could slow a rescue. A viral Instagram video shows crews leaving shoes in exact spots so three stretcher bearers can move in and out without shaking the patient or dislodging an oxygen mask. Changing shoe positions can cost about 30 seconds. They recommend having the patient’s My Number ID ready. Most online comments praised the advice; a few said emergencies justify stepping inside with shoes on.
HN Comments
A friend recounts debugging an ARM64 bare-metal hypervisor bug that caused a phone to lock up when CTR_EL0 intercepts were enabled. After ruling out faulty exception trampolines, stack, and kernel panics, the culprit was speculative instruction fetch from MMIO. On ARM, to stop speculative accesses you must treat memory as both Device (no data) and Non-Executable (no instruction fetch). The author rewrote the handling in assembly and refined the memory-map so everything except the payload is non-executable, achieving a successful boot to Android without patches. The NX bit matters beyond security—it's an architectural defense.
HN Comments
Hard-Chat's Zero-Trace Terminal is a client-side, end-to-end encrypted P2P chat in the browser with no server-stored history. It uses WebRTC DataChannels for direct messages and PeerJS for signaling, keyed by a 100-character random Room Key. The Room Key derives a 256-bit AES-GCM key via PBKDF2 and a derived PeerJS ID. Messages are encrypted per-message with a 12-byte IV. No data is stored locally; only ephemeral memory. Signaling relies on public brokers (PeerJS, GitHub Pages, Metered TURN). It warns to use VPN and has a 120-second expiry; forward secrecy across sessions is not guaranteed.
HN Comments
ponytail is a ruleset and tooling to make an AI coding agent emit the minimum viable code. It channels a senior dev who values YAGNI, reuses existing helpers, standard library first, and one-line solutions when possible. The ladder is enforced: shorter diffs and explanations, less code, while preserving safety. It tracks benchmarks—reduced code, tokens, cost, and faster performance. Modes: lite, full, ultra, off; plus commands like review, audit, debt, gain, help. Supports many agents/plugins; MIT licensed.
HN Comments
Icy moons are ocean worlds likely capable of supporting life. Three missions—Voyager, Galileo, Cassini—plus Hubble/Webb revealed subsurface oceans on six bodies: Europa, Enceladus, Titan, Mimas, Callisto, and Ganymede; candidates include Dione, Pluto, Miranda, Ariel, Triton, Oberon. Europa shows ocean evidence from magnetism; Enceladus has plumes with saltwater and organics; Titan hosts a surface methane cycle and a subsurface sea; Ganymede has a global ocean beneath thick ice and a magnetic field; Callisto’s ancient crust hides a deep ocean; Mimas may host a recent ocean. Key habitability factors: rock-water interaction, age, and heat. Future targets: Europa Clipper, Dragonfly.
HN Comments
A 403 Forbidden error indicating that access to the requested page is denied.
HN Comments
Mike McCoy notes a preprint by Wang & Wu that purportedly proves the Spherical Hadwiger Theorem with substantial use of AI (OpenAI Codex) for proof details, gap finding, organization, and editing; authors claim full responsibility and verification; McCoy hasn't fully digested it but it passes the sniff test. He situates this in the broader AI disruption in mathematics, citing OpenAI's labor-impact reports. He draws an analogy to classical music conservatories, asking whether math could or should develop a conservatory-like institution. He argues for continuing support of research mathematics, while acknowledging AI is reshaping incentives, evaluation, and funding.
HN Comments
Two 2026 episodes at the Census Bureau show political encroachment harming US statistics. A noncitizen-voting brief with opaque authorship and methodology followed by a Commerce Department order banning noise infusion privacy, risking detail in race/ethnicity data and redistricting. Macro indicators remain unaffected, but credibility and career-staff resilience have weakened, risking funding and modernization. Data users will scrutinize releases more, increasing the burden on agencies and the potential for further political influence.
HN Comments
Market makers supply liquidity and earn the spread, but face adverse selection: faster, better-informed traders can ‘snipe’ quotes. Flow splits into uninformed (noise) and informed (short-term edge); toxic flow hurts makers whose orders are exposed. Makers hedge inventory risk by delta-neutral strategies or cross-exchange hedging (e.g., BTC vs ETH or two exchanges), paying fees and spreads. Mitigations include widening spreads, exchange-flow segmentation, post-only or RPI orders, and cancel-priority blocks to let makers exit first. Adverse selection is measured with markouts (price at horizon vs trade price); VWAM aggregates markouts to compare exchanges and symbols.
HN Comments
Liquid Network reports a security incident: about 4,000 BTC (~$320M) withdrawn from the Liquid Federation wallet by purported white-hat hackers. The funds were moved via the SideSwap PAK, which was not compromised; exchanges paused LBTC deposits/withdrawals; other assets such as USDT, DePix, and RWAs unaffected. Bridge nodes disabled and the sidechain paused; federation working to restore normal activity. Monitoring at mempool.space.
HN Comments
Made by Johno Whitaker using FastHTML