AI Summarized Hacker News

Front-page articles summarized hourly.

Airbnb bans making guests do dishes and take out the trash

Airbnb updated its house rules to bar hosts from requiring guests to perform chores that require significant effort or would typically be done by a cleaner, for bookings made on or after Nov 20. Allowed tasks include putting used dishes in the sink, gathering towels, sorting trash and recycling into indoor bins, and turning off amenities when leaving; guests aren’t required to wash dishes, strip beds, or haul garbage off-site. A new "rules and requests" section highlights hosts’ requests, with an animal-proof trash disposal exception in bear country. Some hosts push back, and guests can avoid overly strict listings.

HN Comments

Qpack amplification attacks against HTTP/3 servers

FoxIO reports QPACK amplification attacks on HTTP/3 that let a remote, unauthenticated client force a server to allocate far more memory than the compressed HEADERS on the wire. By abusing decoded-header size budgets (and missing 32-byte field overhead), a small HEADERS frame can expand to hundreds of thousands of headers, potentially exhausting memory or crashing. Seven of ten tested implementations were vulnerable; several have been fixed (quic-go, quiche, lsquic, h3, etc.), while others remain vulnerable or partially fixed. The fix is enforcing a cumulative decoded-header budget during decoding and avoiding preallocation based on compressed size.

HN Comments

Κ = 0.003 for integer multiplication crossed

PR #4441 proposes combining query thinning with fresh helper retiming for CrocSwap/integer-mult-bounds, applying the helper retiming to all 19 native calls of #4440's p17 query-thinned controller. The author-checked construction sets conditional kappa to κ = 0.00300105 (+4.105e-5 over #4440) and yields T(n) = O(n (log n)^(1 − κ)). It retains major components, notes performance/CI metrics, and credits 1337isnot1337 with OpenAI Codex assistance; review is awaited.

HN Comments

mitmproxy adds --emudhra option

Adds a new --emudhra option to sign TLS certificates using a compromised eMudhra intermediate CA key. Introduces EMUDHRA_CHAIN_PEM, loads the EMUDHRA chain when enabled, and updates TLS config, cert store, and CLI options accordingly. Tests and UI state are extended to cover emudhra, and certifi is updated to remove eMudhra CAs from binaries.

HN Comments

CleanFrame: A quieter home screen for Samsung The Frame

CleanFrame is a starter project for a personal home screen on Samsung The Frame (Tizen), intended to be forked and adapted. It offers a browser-based preview and a set of setup scripts to run locally (Node.js 22+, Python 3.10+), then view at localhost:4795/home. You can customize layout (List/Dock), background, typography, clock, and reorder installed apps, with 15 wallpapers and local preference saving. The repo provides detailed adaptation guidance, a coding-agent workflow (AGENTS.md/docs), and TV-signing steps for public builds. MIT-licensed; hardware-specific and not guaranteed portable; contributions welcome.

HN Comments

The Rise and Fall of the Plasma Screen

Brian Potter traces the plasma display’s rise from PLATO’s 1960s need for memory-efficient screens. Donald Bitzer’s team developed a plasma cell, overcame early issues, and Owens-Illinois commercialized panels (1968 128x128; 1971 Digivue). Plasma offered thin, rugged displays but suffered high power use and cost, lagging CRTs for many uses. Laptops saw early monochrome plasma; by the 1990s LCDs overtook color and large screens. Plasma lingered in niches until manufacturing declined in the late 2010s, effectively ending the technology.

HN Comments

AWS rates PHP RCE as Important so Amazon Linux 2023 patch may take 20 days

An issue requests an urgent PHP security patch for Amazon Linux 2023 to fix CVE-2026-109618 and CVE-2026-109619 (CRITICAL, CVSS 9.2). The discussion cites PHP advisories around 2026-10-20/21 and says AWS/Amazon Linux will incorporate the fix into AL2023, with Elastic Beanstalk and Lightsail updates; ETA is unclear. Community members propose workarounds (building PHP SRPMs and patching) while updates rollout; EB platform 4.13.13 includes newer PHP for some versions, with targeted updates around 2026-10-22.

HN Comments

Railway Security Disclosure

Railway reports an intrusion where an unauthorized party accessed encrypted customer environment variables and decrypted some contents, potentially exposing secrets such as API keys and registry credentials. The attack appears linked to broader campaigns targeting AI-inference providers. Upstream keys have been revoked. Even if impact seems limited, all users should rotate environment variables and private registry credentials and review logs. All deployments are paused until builds resume; Railway will contact affected customers by email and provide updates at status.railway.com as the incident scope narrows.

HN Comments

Claude Duet

Anthropic introduced Claude Duet, a proactive agent that partners with Claude for professionals and small businesses. In a US-only research preview for Pro and Max, it runs on iOS/Android and claude.ai, shares memory from your Claude account, and works in a separate browser VM so your device can rest. It delivers a morning brief, runs tasks in the background, and checks with you before acting. It can handle admin tasks, dashboards, forecasts, and more using 6,000+ connectors (Gmail, Slack, QuickBooks, Stripe, Docusign, HubSpot, Canva, Shopify, etc.). Safety safeguards protect sensitive data; access via waitlist.

HN Comments

No More Icons in Every Menu by Default

Jim Nielsen notes that macOS Tahoe shipped with icons in every menu item but Golden Gate removed them, a shift John Gruber covered and Apple’s Human Interface Guidelines now cite Tahoe as a what-not-to-do example. He argues the stronger point is Apple’s own reversal—They tried icons in all menus, shipped it, stayed with it a year, then publicly changed guidance—as proof of learning by doing.

HN Comments

Potential third critical PHP CVE

Could not summarize article.

HN Comments

A Place Among the Fiddlers

David Alm spends a week at Galax’s Old Fiddler’s Convention, the world’s oldest fiddlers’ gathering. He details muddy campsites, a single stage, and hours of old‑time and bluegrass jams where participants, generations deep, perform for judges or simply for each other. The piece traces the hybrid roots of old-time music—Scots‑Irish, African, Appalachian— and contrasts it with bluegrass’s stage craft. Beyond the music, Alm portrays a resilient southwestern Virginia culture contending with economic decline, addiction, and aging populations, finding renewal in communal making and shared memory.

HN Comments

Plex laid off the whole player team

A Plex forum thread discusses a bug in the 2026.20.0 beta for iOS/tvOS where 4K DoVi/HDR10 content won’t play and shows an infinite spinning circle on Apple devices. Users report Dolby Vision 4K HEVC/MKV buffering, while HDR10 4K works on some devices. They seek fixes and an ETA, criticize Plex's communication, and debate workarounds (disabling Force Direct Play, trying different audio tracks) and the impact on user trust. Some propose alternatives like Jellyfin; others discuss layoffs and company direction.

HN Comments

After automation: Solo founding will be the default

With AI lowering the effort to start a company, solo founding becomes the default. Data from a Carta collaboration shows solo founders rising to 39% of new startups (2018–2026), signaling a shift from the 'founders as a pair' model. While removing cofounders reduces conflict as a death cause (Noam Wasserman notes 65% die due to people issues), loneliness becomes the new risk for solo founders. The solution: build a supportive ecosystem—surround yourself with resources and other solo founders to do "solo, together."

HN Comments

Made by Johno Whitaker using FastHTML