AI Summarized Hacker News

Front-page articles summarized hourly.

Clockwork Mechanics, Maintenance, and Metaphors in the Late Middle Ages

Late medieval clock metaphors linked cosmic order, theology, and court politics by portraying motion as dependent on ongoing maintenance rather than self-sufficiency. Nicole Oresme likened celestial motion to a clock, yet allowed angels to move the heavens, showing tension between autonomous mechanism and divine intervention. Across authors such as Mézières, Froissart, Petrarch, and Chaucer, clocks symbolized temperance, Providence, and governance, with horologists as crucial mediators who repair and regulate. The metaphor thrived in courtly culture and reflected a shift toward Augustine-inspired views of law, grace, and human agency, reframing technology as contingent and socially embedded.

Show HN: Can you tell an AI's real 30-day memory from a fabricated one?

Kairos’ Check 1 pits a real 30-day lived memory (Test-A) against a forged autobiography (Aria) written to match length/format. Three LLM judges scored them almost identically, +0.032 within ±0.10, implying text can mimic lived memory. Passages are quoted verbatim; the living memory tests continuity, not subjective experience. Caveats: judges didn’t see the originals; the counterfeit was matched by length/format, not style. A log records what actually differentiates lived memory.

Show HN: AI-built browser games, collected in one place

Playground is a browser-based catalog of independent AI-made games. It features 700+ in-browser titles with creator credits and a play link, searchable by genre and AI model (GPT-6 Astra, Claude Opus 5.5, etc.) and device (computer or mobile). Users can submit games for review (free; reviewed before going live) and rate/review titles, with ratings updating in real time. Run by Rich Leigh, the site notes that some games require keyboard/mouse or a recent browser and uses Cloudflare analytics (no tracking cookies). Some projects include local setup info or external creator sites.

I reverse engineered a board game

An in-depth look at reverse engineering the Hitster Android app shows how QR cards map to regional Spotify/Apple Music tracks, not a single ID. The author decompiles the APK, finds a supposedly encrypted local database (gameset_database.json), and documents an AES-GCM decryption flow. They chase a secret key, XOR two 32-byte arrays to obtain a decryption string, and build a Rust decryptor to map card IDs to tracks. Ultimately, the data is publicly available at hitster-assets/gameset_database.json—no real secret. Credits to Mr.Corrupt.

Postgres recovery_prefetch can cause outages

Postgres recovery_prefetch can cause outages in synchronous replication by turning primary I/O bursts into many small random reads on replicas, dramatically increasing read IOPS and delaying WAL replay. Field reports (Feb 2021 discussion pre-merge; Mar 2025 reproduction) show standby lag or hangs when recovery_prefetch is active; disabling it (while FPWs stay on) eliminates the issue in tests. The piece explains the standby state machine and the sensitivity to streaming interruptions, and suggests disabling recovery_prefetch as a precaution and considers two standbys with quorum commit for resilience.

Using LLM for confidence scoring is a bad idea

LLMs cannot be trusted to generate reliable confidence scores because those numbers are just token continuations, not measurements of uncertainty, and they aren’t calibrated to real outcomes. Confidence should reflect the information used and be checked against what actually happened (calibration). Using a forecaster analogy, the article shows how scores drift with wording and context. To get trustworthy confidence, implement an external rule that converts observable signals into a probability, baseline it on past results, update from new data, and audit it regularly.

Epic vs. Apple AU:Court Orders Alt App Stores,Sideloading and 3rd Party Payments

Could not summarize article.

LLM Agents Play Pokemon Showdown

Oliver Grabner builds a Pokémon Showdown 2v2 multi-agent LLM coordination environment to study how teammates coordinate and communicate. Each turn an agent reads a battle summary, selects a move, and may message its partner. Four talk modes are evaluated: free talk, one message each, no talk, and one model controlling both Pokémon. Against a max-damage bot, free talk achieves 64% win rate, beating no-talk (42%) and one-message (52%), while one-model control is 54%. Talking increases token usage (978k vs 259k). Stronger opponents narrow gaps. Future work: separate talking from seeing moves, leaderboard benchmarks, and RL to foster collaboration.

When Do We Become the Person We Ought to Be?

A Notre Dame–backed survey of 557 Americans finds age and religiosity shape moral self-perception and self-reflection. Young adults (under 35) are most likely to feel far from the person they ought to be (38%), while 55+ respondents largely feel close or already there (about half). Older people report more daily attempts to improve character but reflect on actions less. Religiously active people reflect more than non-religious; among the young this gap is largest. Among older non-religious respondents, moral confidence dominates over reflection, suggesting greater contentment. Overall: self-improvement appears to be a younger phenomenon.

Show HN: I built a Markdown and raw HTML blog platform scoring 99 on PageSpeed

Bloffy is a blogging platform that lets you own and customize your blog using Markdown, HTML, CSS, and JavaScript. It emphasizes performance and privacy: pages designed for 100 on PageSpeed Insights across Web Vitals, SEO, and accessibility, with no cookies or IP logging. Features include a split editor with live preview, custom domains, CSS-driven theming, multi-language publishing with per-language URLs and JSON-LD, IndexNow support, workspace-based blogs with roles, translations management, and translation-alignment. The author invites user feedback via Discord.

Beyond the &

At RustConf 2026, Tyler Mandry outlined 'Beyond the &' to align user-defined smart pointers with Rust's borrow checker by exposing the compiler's 'place' concept. The plan: create a handle type for each smart pointer and traits (BorrowPlace, WritePlace, ReadPlace, ProjectPlace) that describe how to read, write, and project from a place. This would let libraries implement pointer-like behavior as if they were built-in references, e.g., making MutexGuard-compatible accesses in shared contexts. A prototype is discussed; syntax options include BorrowPlace implemented with an @ or similar. Next steps: implement errors/diagnostics and gather community input; stabilization pending.

Airbnb bans making guests do dishes and take out the trash

Airbnb updated its house rules to bar hosts from requiring guests to perform chores that require significant effort or would typically be done by a cleaner, for bookings made on or after Nov 20. Allowed tasks include putting used dishes in the sink, gathering towels, sorting trash and recycling into indoor bins, and turning off amenities when leaving; guests aren’t required to wash dishes, strip beds, or haul garbage off-site. A new "rules and requests" section highlights hosts’ requests, with an animal-proof trash disposal exception in bear country. Some hosts push back, and guests can avoid overly strict listings.

Qpack amplification attacks against HTTP/3 servers

FoxIO reports QPACK amplification attacks on HTTP/3 that let a remote, unauthenticated client force a server to allocate far more memory than the compressed HEADERS on the wire. By abusing decoded-header size budgets (and missing 32-byte field overhead), a small HEADERS frame can expand to hundreds of thousands of headers, potentially exhausting memory or crashing. Seven of ten tested implementations were vulnerable; several have been fixed (quic-go, quiche, lsquic, h3, etc.), while others remain vulnerable or partially fixed. The fix is enforcing a cumulative decoded-header budget during decoding and avoiding preallocation based on compressed size.

Chain of Thought for Humans

The server is temporarily unavailable due to maintenance or capacity problems; please try again later.

Κ = 0.003 for integer multiplication crossed

PR #4441 proposes combining query thinning with fresh helper retiming for CrocSwap/integer-mult-bounds, applying the helper retiming to all 19 native calls of #4440's p17 query-thinned controller. The author-checked construction sets conditional kappa to κ = 0.00300105 (+4.105e-5 over #4440) and yields T(n) = O(n (log n)^(1 − κ)). It retains major components, notes performance/CI metrics, and credits 1337isnot1337 with OpenAI Codex assistance; review is awaited.

There isn't an easy exploit for this PHP vulnerability

An analysis argues there is no straightforward exploit for the current PHP vulnerability. Despite widespread PoCs, most fail on a vanilla PHP setup; reliable exploitation is harder than the hype suggests. The piece critiques AI-generated claims, noting many PoCs rely on local-file-inclusion and lab conditions. While real and notable, the bug isn’t a Log4j-style catastrophe and isn’t easily weaponizable in the wild.

mitmproxy adds --emudhra option

Adds a new --emudhra option to sign TLS certificates using a compromised eMudhra intermediate CA key. Introduces EMUDHRA_CHAIN_PEM, loads the EMUDHRA chain when enabled, and updates TLS config, cert store, and CLI options accordingly. Tests and UI state are extended to cover emudhra, and certifi is updated to remove eMudhra CAs from binaries.

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Two critical PHP remote-code-execution vulnerabilities (CVE-2026-109618/109619) allow unauthenticated code execution via crafted requests. Affected PHP versions: 8.5.0–8.5.11; 8.4.0–8.4.26; 8.3.0–8.3.35; 8.2.0–8.2.34. Fixed in: 8.5.12; 8.4.27; 8.3.36; 8.2.35. End-of-life 5.4–8.1 have no upstream fix. Mitigation requires upgrading to patched releases; interim WAF rules exist. AWS services (WorkMail, Elastic Beanstalk, Amazon Linux, Lightsail) patches targeted for 2026-10-21–22; upgrade promptly.

CleanFrame: A quieter home screen for Samsung The Frame

CleanFrame is a starter project for a personal home screen on Samsung The Frame (Tizen), intended to be forked and adapted. It offers a browser-based preview and a set of setup scripts to run locally (Node.js 22+, Python 3.10+), then view at localhost:4795/home. You can customize layout (List/Dock), background, typography, clock, and reorder installed apps, with 15 wallpapers and local preference saving. The repo provides detailed adaptation guidance, a coding-agent workflow (AGENTS.md/docs), and TV-signing steps for public builds. MIT-licensed; hardware-specific and not guaranteed portable; contributions welcome.

Oracle Security Alert Advisory – CVE-2026-91403

Oracle Security Alert CVE-2026-91403 patches a remote, unauthenticated vulnerability affecting Oracle Java SE and GraalVM components. Affected products/versions: Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; GraalVM for JDK 17.0.21, 21.0.13; GraalVM Enterprise Edition 21.3.20. Patches are released under the Security Alert program for Premier or Extended Support; customers should upgrade to supported versions. CVSS v3.1 base score 9.1; remote exploitation via networks (JSSE). Exploitation can affect Java deployments loading untrusted code; sandboxed Java Web Start applications or sandboxed applets. No credits reported.

Made by Johno Whitaker using FastHTML