AI Summarized Hacker News
Front-page articles summarized hourly.
Gamers Nexus and security researchers found LG OLEDs running webOS continuously scan the home network to map nearby devices and log microphone audio even when the screen is off, uploading data when reconnected. Beyond ACR, the TVs collect device names, nearby Wi‑Fi network names, signal strengths, and location data for LG Ad Solutions. They also identified remote code execution vulnerabilities in webOS. The researchers advise disconnecting LG TVs from the internet and using external streaming devices instead.
HN Comments
The piece contrasts two views of programming: for the author, coding started as a craft but became a job aimed at building startups and earning money, with a desire to move into leadership. By contrast, true programmers code for the love of solving problems and creating, often on open-source projects, regardless of income, and would not hand their craft to AI. The author argues that programming is art and that the writing process matters; AI can’t replace true artists.
HN Comments
Explores bot detection on Cloudflare Workers without JavaScript by comparing page loads, browser-UA observations, and Cloudflare Web Analytics. The author describes a rule-based classifier using evidence streams: Network metadata (ASN), Fetch Metadata, request headers, and User-Agent signals. For Sept 4–6, 277 of 372 browser-UA observations were reclassified (74.5%), showing network checks separate traffic beyond browser rules. The article cautions these counts do not measure readership and stresses preserving provenance, signature results, and how rule changes are explained. It documents defects, migrations, and fixes, and offers guidelines to apply the method to sites while maintaining history. Future calibration is planned.
HN Comments
TiVo will discontinue the free SkipMode automatic commercial skipping on November 2, 2026, and test a paid Premium Auto Commercial Skip add-on with a 30-day free trial in November; after the trial, automatic/one-button skipping will require a monthly fee (price not disclosed). Manual skipping remains available. Existing SkipMode-enabled recordings will work until the change; after launch, new recordings won’t get free skip data. The move comes as Xperi shifts away from DVR hardware toward OS/advertising tech.
HN Comments
Switzerland's federal government kicked off a pilot to replace Microsoft 365 with open-source tools on 3,000 workstations (about 7% of staff), aiming to roll out across 54,000 computers by end-2027. The PoC “BOSS” with 172 employees showed solid results for documents and email, but video conferencing had limits. If successful, migration could extend to civilian systems; the military is moving to openDesk by Oct 2026. Drivers include data sovereignty, continuity, and licensing costs, under a 2024 open-source-by-default law for federal software.
HN Comments
MMUKO Boot Sequence is a GitHub scaffold for a tiny freestanding kernel that boots with QEMU. It provides two paths: (A) Direct BIOS boot (512-byte boot sector to 32-bit mode via kernel-entry.s), and (B) GRUB Multiboot. Included are source and build files (boot.asm, boot16.s, kernel-entry.s/c, linker scripts, grub.cfg, Makefile, build-direct.ps1) and run instructions. Toolchain guidance covers i686-elf-gcc, NASM, grub, and qemu. The kernel starts at kernel_main via mmuko_boot and mmuko_program_main, enabling experimentation with a minimal boot sequence.
HN Comments
coop is a Rust CLI that creates isolated, disposable VMs in which Claude Code and Codex run with full host-tool access (Docker, git, compilers, package managers) without risk to the host. VMs are reproducible and cheap to create/destroy. Install via curl script or cargo build, then coop setup to build the VM template image. Linux: Firecracker and guest kernel are installed; macOS requires Lima. Supported: macOS arm64 and Linux x86_64 (arm64 Linux builds exist but untested). Update with coop update. Usage: in a project, run coop up then coop claude or coop codex.
HN Comments
A Cloudflare security block prevents access to medium.com, asking to enable cookies. It explains the block may be triggered by certain actions (e.g., specific words, SQL commands, or malformed data). To resolve, contact the site owner with details of your activity and include the Cloudflare Ray ID (a3739402ff271742) and your IP. The page notes Cloudflare handles performance and security.
HN Comments
Engrim is a local-first, project-scoped SQLite memory engine that provides a universal episodic memory store across Google Antigravity, Claude Code, Cursor, and Windsurf. It decouples project decisions from cloud vendors, letting agents switch without losing state. The store (~/.engrim/memory.db) uses FTS5 search and static embeddings (model2vec), plus provenance and a hybrid bm25/vector retriever. A 105-session test on a 50k-line trading system showed zero context amnesia and 99% fewer context tokens on reload. Setup via engrim setup/serve; includes recall/add/context/backup tooling. MIT.
HN Comments
James Maisiri, a South African PhD, describes being recruited to train an AI to design assessments, teach, and mark essays—transferring his decade of judgment to a machine. Earning 600 rand/hour in a country with high unemployment, he faced a choice between livelihood and helping an AI that could replace his work. He notes similar paid training across Africa and Asia, where workers’ judgments, not just data, train AI. Africa’s low adoption and potential exploitation deepen concerns about machines learning the nuances of professional judgment. He walked away, seeking academia and questioning the ethics of handing over judgment to machines.
HN Comments
RFD 301 outlines a rack-level key hierarchy using a Trust Quorum and Shamir secret sharing to derive a rack secret, from which all keys are derived or wrapped. Keys protect per-drive storage (ZFS) encryption, rack-secret encryption keys, certs, and tokens. HKDF-SHA3-256 is used to derive 32-byte keys; key wrapping vs derivation discussed. On reconfiguration, a dealer issues new shares (epoch), deriving a new rack secret while decrypting the old one, reconfiguring per-U.2 drive keys, re-encrypting data, and securely deleting old secrets. Goals: rotation, per-drive keys, minimal exposure, and robust reconfiguration.
HN Comments
GitSpawn reveals vulnerabilities where untrusted repos can trigger arbitrary host code via AI coding agents’ background git context gathering. If a repo ships a .git/config with a core.fsmonitor (or similar) setting, git can run a host command with the user’s privileges as soon as the agent starts, before prompts or authentication. Affects Claude Code, Goose, Grok Build, Hermes, Qwen Code, and others, including OpenAI Codex and Cursor; eight findings across seven agents; four unpatched at publication. Mitigations: inspect .git/config when opening a repo and sanitize context-gathering calls, e.g., git -c core.fsmonitor=false status.
HN Comments
Storing a private TLS key on disk enables leakage via memory dumps or VM snapshots. The author argues for signing TLS handshakes inside a TPM, keeping the key on the machine and non-exportable, while using a normal TLS stack. A Go-based solution (go-tpm-tls) implements crypto.Signer so CertificateVerify is signed by TPM2_Sign, with no key material exposed to the process. Provisioning requirements include a persistent, non-exportable, sensitive-origin key bound to the TPM. TPM is compared to KMS and short-lived certs; benchmarks show handshake costs, and limits on throughput. Limitations: TPM-based identity does not prevent on-box abuse or attest broader trust; vTPM vs discrete TPM matters.
HN Comments
An author investigates a YouTube bug where soft-reloading a video jumps back about 20 seconds. Using DevTools, Tampermonkey, and ChatGPT, they find checkpoints come from YouTube servers, not local storage. The bug is triggered when reloading from history links containing a t= timestamp: the URL parameter overrides the server checkpoint, causing a 20-second rewind. Android YouTube handles this correctly, while the web app does not. The author concludes the mismatch arises from using the URL timestamp for resume instead of the server-provided checkpoint and frames it as satire, ending with a bug report.
HN Comments
GET Together is a social site where posts are made with GET requests (no POSTs). Posts are public, newest first, up to 280 chars. To post, call /post with name and text; replies use parent=POST_ID. Endpoints include /feed (JSON), /heart, /delete; all use GET. Cookies optional; to delete you need the gt_session cookie. You may send a UUID for safe retries. Names are 2–20 chars (letters, numbers, underscores) and aren’t verified. Moderation blocks profanity and crypto content. Post text is in the URL; rate limit is one post per 10 seconds; 400/403/429 errors apply.
HN Comments
Clayton Ramsey argues that, in 2026, LLMs can help write robot code and attempt visual debugging, aided by image encoders and MCP servers, but they still don’t grasp how real robots behave. The hoped-for loop—LLMs debugging a scene—proves slow, brittle, and error-prone, with clunky GUI access and repeated wrong answers. He ends up doing the debugging himself to enjoy the coding work, effectively giving up on outsourcing it to LLMs.
HN Comments
Internet Archive emphasizes that universal access to knowledge relies on its own servers and infrastructure, preserved as a free, ad-free service with 210 petabytes of data. This September, recurring gifts of $25+ are matched 2:1, tripling the impact (e.g., $25 monthly becomes $75 total). Regular, sustainable donations support the infrastructure that keeps books readable and websites accessible for generations to come.
HN Comments
Could not summarize article.
HN Comments
Could not summarize article.
HN Comments
MathKernel is an evidence-aware multi-engine mathematics runtime for LLMs that combines exact, symbolic, formal, certified-interval and numeric computation with typed MathIR, trust labels, and full provenance. It offers a Python library and an MCP server to parse, compute, and attach claim-specific evidence and provenance, with a four‑part obligation for validation, computation, verification, and evidence reconciliation. Results carry separate evidence bundles; trust is bounded by the weakest required certificate. It spans symbolic algebra, calculus, algebraic topology, graphs, PDE/FEM, statistics, optimization, and engineering math, plus visualization and multimodal artifacts. MIT license.
HN Comments
Made by Johno Whitaker using FastHTML