frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

My favourite PowerMac is a Nintendo Wii

https://virtuallyfun.com/2026/10/29/my-favourite-powermac-is-a-nintendo-wii/
122•DHowett•2h ago•25 comments

Northflank Breached

https://status.northflank.com
245•js4ever•4h ago•160 comments

Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

https://phorion.io/blog/offical-claude-code-vsx-compromise/
584•_chall•13h ago•403 comments

Show HN: A working Nintendo in ~1GB of Qwen weights

https://github.com/dbreunig/nesformer
120•dbreunig•3h ago•91 comments

Bunny CDN Security Incident

https://status.bunny.net/incidents/p6gf1by9kr7m
20•SondreDag•1h ago•3 comments

Breaking the open web won't stop the bad bots

https://www.techpolicy.press/breaking-the-open-web-wont-stop-the-bad-bots/
91•raybb•3d ago•34 comments

Florilegium: Procedural Flowers in LaTeX

https://github.com/kevinraymond/florilegium
133•nanna•4h ago•22 comments

The federated code forge

https://tangled.org/blog/forge/
149•zlliang•4h ago•52 comments

Building an AI-native engineering org

https://twitter.com/sgondala2/status/2115832070274723875
52•sgondala_ycapp•22h ago•49 comments

Anthropic may not secure investment-grade rating after IPO, Blackstone says

https://www.ft.com/content/59383c7f-8d82-493f-bf01-d2e862a1018f
145•petethomas•2h ago•79 comments

Azure's Weakest Link – Five Full Cross-Tenant Compromises

https://www.binarysecurity.no/posts/2026/10/one-root-case
220•swq115•10h ago•40 comments

Tree-mounted machines connect to web app to let users knock on wood remotely

https://www.designboom.com/technology/tree-mounted-machines-web-app-users-knock-on-wood-remotely/
21•surprisetalk•3d ago•10 comments

GitHub Incident with Actions, Pages, and Webhooks

https://www.githubstatus.com/incidents/pwxsjgnvrk6b
109•damontal•2h ago•41 comments

AI isn't replacing SREs, it's deskilling them

https://newsletter.signoz.io/p/ai-isnt-replacing-sres-its-deskilling
368•dorianniemiec•4h ago•286 comments

Sleep framework: A new way for LLMs to retain knowledge in continual learning

https://research.google/blog/the-sleep-framework-a-new-way-for-llms-to-retain-knowledge-in-contin...
93•acossta•2d ago•7 comments

Blockchain intelligence firms link North Korea to $6.3B hack on Binance

https://www.npr.org/2026/10/30/g-s1-150902/blockchain-intelligence-firms-link-north-korea-to-6-3b...
146•paulpauper•4h ago•87 comments

A Pickpocket's Guide to New York

https://www.newyorker.com/magazine/2026/11/02/a-pickpockets-guide-to-new-york
5•prismatic•42m ago•1 comments

How do you take a picture of a black hole?

https://www.quantamagazine.org/how-do-you-take-a-picture-of-a-black-hole-20261029/
67•dverlaeckt80•10h ago•52 comments

Show HN: Spinf-serve – inference server for bulk scoring and decisions

https://github.com/spinfinc/spinf-serve
13•giarec•3h ago•0 comments

Tracks along the longest drive on another world

https://science.nasa.gov/blog/tracks-along-the-longest-drive-on-another-world/
43•shcallaway•18h ago•3 comments

Compile-Time Dependent Types

https://thenumb.at/Syl-Intro/
54•ibobev•4d ago•15 comments

Executable Archaeology: Reanimating the Heuristic Compiler (1961) and KBEmacs (1984)

https://arxiv.org/abs/2610.36341
26•abrax3141•2d ago•0 comments

French digital tax may kill VideoLan non-profit

https://twitter.com/videolan/status/2116229135919919278
32•miohtama•1h ago•12 comments

The $6.3B Binance hack was pulled off in just 20 minutes

https://www.wired.com/story/the-dollar63-billion-binance-hack-was-pulled-off-in-just-20-minutes/
266•domhudson•7h ago•190 comments

Why a program doesn't work when run from a batch file, but works when clicked

https://devblogs.microsoft.com/oldnewthing/20261026-00/?p=112797/
110•ibobev•3d ago•59 comments

Show HN: I built a multiplayer game where you're an aerial fighter cat

https://catcopter.com
63•pawelwentpawel•4h ago•28 comments

Show HN: Sketch Stadium – watch your agent play Pictionary

https://sketch.wakeshift.ai/
10•ericlevine•4h ago•3 comments

Gilgamesh by Simon Armitage review – an ancient epic is brilliantly translated

https://www.theguardian.com/books/2026/oct/20/gilgamesh-by-simon-armitage-review-an-ancient-epic-...
176•benbreen•3d ago•53 comments

Polymarket 1h halt after vendor compromise; affected users will be 'made whole'

https://www.nbcnews.com/business/consumer/polymarket-trading-halt-hack-wallets-rcna606405
87•theanonymousone•4h ago•33 comments

Wasmer (YC S19) Is Hiring OS/Hypervisor Experts in Europe

https://www.workatastartup.com/jobs/98722
1•syrusakbary•13h ago
Open in hackernews

Building my npx business card

https://ashley.dev/posts/turning-feedback-into-features/
8•edent•1y ago

Comments

steele•1y ago
Ooh, free real estate, let's colonize and gentrify package management
aabhay•1y ago
Lmao, gentrify cracked me up
neilv•1y ago
Do these npx business cards run arbitrary code on your computer?
cypherpunks01•1y ago
npx

Run a command from a local or remote npm package

Description

This command allows you to run an arbitrary command from an npm package (either one installed locally, or fetched remotely), in a similar context as running it via npm run.

neilv•1y ago
Yes, then is a "command from an npm package" arbitrary code?

And what is this "similar context as running it via npm run"?

Would it be better to answer the question directly?

joshka•1y ago
Yeah, this seems like a very smart but inherently flawed idea.
cypherpunks01•1y ago
Yes I agree! OSS package management ecosystems are a great idea, but allowing submissions without any review or vetting is just asking for supply chain attacks.
Xss3•1y ago
May as well just release an executable tbh.
theamk•1y ago
Reminds me of JAPH [0] - a tiny Perl program that was used in email/newsgroup signature to give it personal touch.

[0] https://www.perlmonks.org/?node_id=412464

watusername•1y ago
Terminal business cards are a nice idea, but RCE business cards are just asking for trouble. Instead of npx, what happened to good'ol curl? Something like

$ curl ashley.dev

Some decades ago, we had finger (https://en.wikipedia.org/wiki/Finger_%28protocol%29) which is designed for this very use case. Sadly it's no longer installed by default with most distros:

$ finger @ashley.dev

queezey•1y ago
This would be a great advertisement for security consulting.

"I was just able to run arbitrary code on your computer. Here is a sample of your recent browser history. Let me tell you help you mitigate your security vulnerabilities."