frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

DaVinci Resolve releases Photo Editor

https://www.blackmagicdesign.com/products/davinciresolve/photo
262•thebiblelover7•3h ago•61 comments

A new spam policy for "back button hijacking"

https://developers.google.com/search/blog/2026/04/back-button-hijacking
147•zdw•2h ago•76 comments

Someone bought 30 WordPress plugins and planted a backdoor in all of them

https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/
835•speckx•11h ago•235 comments

GitHub Stacked PRs

https://github.github.com/gh-stack/
601•ezekg•9h ago•337 comments

Lean proved this program correct; then I found a bug

https://kirancodes.me/posts/log-who-watches-the-watchers.html
184•bumbledraven•5h ago•93 comments

Sometimes powerful people just do dumb shit

https://www.joanwestenberg.com/sometimes-powerful-people-just-do-dumb-shit/
49•zdw•2h ago•3 comments

WiiFin – Jellyfin Client for Nintendo Wii

https://github.com/fabienmillet/WiiFin
118•throwawayk7h•6h ago•49 comments

Anastasia (1997) live action reference material

https://lostmediawiki.com/Anastasia_(partially_found_live-action_reference_material_for_Don_Bluth...
13•hyperific•3d ago•1 comments

I shipped a transaction bug, so I built a linter

https://leonh.fr/posts/go-transaction-linter/
24•leonhfr•3d ago•2 comments

Design and implementation of DuckDB internals

https://duckdb.org/library/design-and-implementation-of-duckdb-internals/
85•mpweiher•3d ago•8 comments

UpDown: Efficient Manycore based on Many Threading & Scalable Memory Parallelism

https://people.cs.uchicago.edu/~aachien/lssg/research/10x10/ics26-single-chip-updown.pdf
3•matt_d•24m ago•0 comments

TanStack Start Now Support React Server Components

https://tanstack.com/blog/react-server-components
4•polywock•25m ago•1 comments

Nothing Ever Happens: Polymarket bot that always buys No on non-sports markets

https://github.com/sterlingcrispin/nothing-ever-happens
391•m-hodges•14h ago•210 comments

Rust Threads on the GPU

https://www.vectorware.com/blog/threads-on-gpu/
36•PaulHoule•4d ago•11 comments

US appeals court declares 158-year-old home distilling ban unconstitutional

https://nypost.com/2026/04/11/us-news/us-appeals-court-declares-158-year-old-home-distilling-ban-...
360•t-3•16h ago•248 comments

Hacker compromises A16Z-backed phone farm, calling them the 'antichrist'

https://www.404media.co/hacker-compromises-a16z-backed-phone-farm-tries-to-post-memes-calling-a16...
99•wibbily•2h ago•27 comments

Write less code, be more responsible

https://blog.orhun.dev/code-responsibly/
62•orhunp_•2d ago•35 comments

How to make Firefox builds 17% faster

https://blog.farre.se/posts/2026/04/10/caching-webidl-codegen/
159•mbitsnbites•11h ago•27 comments

Make tmux pretty and usable (2024)

https://hamvocke.com/blog/a-guide-to-customizing-your-tmux-conf/
345•speckx•15h ago•214 comments

Building a CLI for all of Cloudflare

https://blog.cloudflare.com/cf-cli-local-explorer/
286•soheilpro•14h ago•93 comments

Math Is Still Catching Up to the Mysterious Genius of Srinivasa Ramanujan

https://www.quantamagazine.org/srinivasa-ramanujan-was-a-genius-math-is-still-catching-up-20241021/
19•paulpauper•1h ago•0 comments

Air Powered Segment Display? [video]

https://www.youtube.com/watch?v=E1BLGpE5zH0
81•ProfDreamer•2d ago•10 comments

Android now stops you sharing your location in photos

https://shkspr.mobi/blog/2026/04/android-now-stops-you-sharing-your-location-in-photos/
332•edent•18h ago•287 comments

GAIA – Open-source framework for building AI agents that run on local hardware

https://amd-gaia.ai/docs
118•galaxyLogic•10h ago•28 comments

The AI revolution in math has arrived

https://www.quantamagazine.org/the-ai-revolution-in-math-has-arrived-20260413/
74•sonabinu•6h ago•39 comments

I just want simple S3

https://blog.feld.me/posts/2026/04/i-just-want-simple-s3/
138•g0xA52A2A•2d ago•78 comments

Tool to explore regularly sampled time series

https://github.com/rajivsam/tseda
12•rsva•3d ago•0 comments

What we learned building a Rust runtime for TypeScript

https://encore.dev/blog/rust-runtime
56•vinhnx•2d ago•12 comments

Show HN: Ithihāsas – a character explorer for Hindu epics, built in a few hours

https://www.ithihasas.in
137•cvrajeesh•10h ago•33 comments

Tracking down a 25% Regression on LLVM RISC-V

https://blog.kaving.me/blog/tracking-down-a-25-regression-on-llvm-risc-v/
110•luu•1d ago•21 comments
Open in hackernews

A new spam policy for "back button hijacking"

https://developers.google.com/search/blog/2026/04/back-button-hijacking
142•zdw•2h ago

Comments

CableNinja•2h ago
Frustrating it took this long for something to be done about this, but glad its now got something being done.
throwaway81523•1h ago
> When a user clicks the "back" button in the browser, they have a clear expectation: they want to return to the previous page. Back button hijacking breaks this fundamental expectation.

It seems pretty stupid. Instead of expanding the SEO policy bureaucracy to address a situation where a spammer hijacks the back button, the browser should have been designed in the first place to never allow that hijacking to happen. Second best approach is modify it now. While they're at it, they should also make it impossible to hijack the mode one.... oh yes, Google itself does that.

spankalee•1h ago
What about all the very legitimate uses of programmatically adding history entries?
jack1243star•37m ago
Please explain the legitimate uses. Not once I have ever encountered a website that does something useful by modifying the behavior of my browsing history.
venussnatch•17m ago
Any single page application, such as YouTube, Gmail, or discord.

It lets persistent content (videos) or connections (chat) persist while emulating a pagenated browsing experience.

When it's done right you don't notice it at all.

al_borland•2h ago
Some Microsoft sites have been very guilty of this. They are the ones that stick in my head in recent memory.
sixothree•1h ago
Epic store makes it impossible to navigate backwards from the checkout on mobile at least. Not sure if it's design or just poor design.
542458•1h ago
Are they? This seems about deceptive or malicious content (i.e., redirecting to ads) rather than “something in my history triggers a JS redirect”. I’ve definitely experienced the latter with MS, but never the former.
surround•1h ago
It seems like Google's policy is unconcerned with the intent of the practice. If a website JS redirect ruins the user experience by breaking the back button, it will be demoted in search results. It doesn't matter whether or not the redirect was meant to be deceptive or malicious, websites shouldn't be ruining the user experience.
dataflow•40m ago
> It seems like Google's policy is unconcerned with the intent of the practice.

I'm reading the opposite: "If you're currently using any script or technique that inserts or replaces deceptive or manipulative pages into a user's browser history that [...]"

lamasery•1h ago
IIRC the Azure “portal” does this. Also likes to not record things as navigation events that really feel like they should be. Hitting back on that thing is like hitting the back button on Android, it’s the “I feel lucky” button. Anything could happen.
PhageGenerator•31m ago
I think that is because some "pages" are really full screen modals. So the back button does take you back to the previous page, but it looks like you went back two pages (closes modal + goes back). I don't spend too much time in the Azure portal but this behavior is rampant in the Entra admin center.
SuperNinKenDo•1h ago
Happened to me yesterday through a link off here. I was already expecting it given the domain, but usually mashing back fast enough does the trick eventually. Not this time. Had to kill the tab.
Tepix•45m ago
In most browsers you can hold the back button for a second and it will let you skip back more than one step.
Kab1r•39m ago
And some websites consume the entire history that a browser displays in that menu
musicale•2h ago
The iron law of web encrapification: every web feature will (if possible) be employed to abuse the user, usually to push advertising.
chongli•1h ago
It really comes down to JavaScript. The web was fine when sites were static HTML, images, and forms with server-side rendering (allowing for forums and blogs).
AuthAuth•1h ago
It wasnt "fine".
atoav•1h ago
Oh, the social media was much, much better. People much more open, tracking didn't exist. All the idiots still thought computers were only a thing for nerds and kids.
pottertheotter•1h ago
Did you use the web back in 1995? It was fun, but it also sucked compared to what we have now. Nothing is ever perfect, but I wouldn’t want to go back.
ryandrake•1h ago
I’d go back in a heartbeat. Making the web a software SDK was the worst thing to happen to it.
collabs•1h ago
You talk about 1995 but I wouldn't even go back to 1999. Dialup was so painful. It advertised 56 know but in practice I never even say 48...
yjftsjthsd-h•1h ago
That seems like a separate thing. You can send 199x-era HTML over a gigabit connection.
arjie•37m ago
Gemini websites are pretty much the old web: https://en.wikipedia.org/wiki/Gemini_(protocol)

Both in terms of comprehensiveness and in terms of functionality.

wmf•52m ago
You're not wrong but we've never really tried the combination of modern CSS with no JS. It could produce elegant designs that load really fast... or ad-filled slop but declarative.
bonesss•42m ago
I published my first website in 1995 (and while it wasn’t even a little popular, eventually a spammy gay porn site popped up with the exact same joke name, leading to a pretty odd early “what if you search for your own site” experience).

If you put 2026 media players (with modern bandwidth), on the manually curated small-editorial web of ‘95 it’d be amazing.

We used to have desktop apps, these SPA JS monstrosities are the result of MS missing the web then MS missing mobile. Instead of a desktop monopoly where ActiveX could pop up (providing better app experiences in many cases than one would think), we have cross-platform electron monstrosities and fat react apps that suck, are slow, and omfgbbq do they break. And suck. And eat up resources. Copy and paste breaks, scrolling breaks, nav gets hijacked, dark mode overridden.

Netflix, Spotify, MS have apps I see breaking on the regular on prime mainstream hardware. My modern gaming windows laptop, extra juicy GPU for all the LLM and local kubernetes admin, chokes on windows rendering. Windows isn’t just regressing, their entire stack is actively rotting, and all behind fancy web buttons.

Old man yelling at cloud, but: geeeez boys, I want to go back.

themafia•39m ago
> Did you use the web back in 1995?

I'm still not over the loss of Gopher.

endgame•1h ago
I cannot even reliably press [Space] any more to page down through sites that are meant to be all about content!
kiddico•44m ago
I've always found that behavior baffling so it's interesting to hear someone using it as intended instead of being frustrated by it.
turtleyacht•25m ago
One more for the spacebar to advance the page. Have never encountered a broken site (so far). Fingers crossed.
bschwindHN•1h ago
Cool, now maybe let's do something about all the shit I have to clear out out my face before I can read a simple web page. For example, on this very article I had to click "No thanks" for cookies and then "No thanks" for a survey or something. And then there was an ad at the top for some app that I also closed.

It's like walking into some room and having to swat away a bunch of cobwebs before doing whatever it is you want to do (read some text, basically).

internet101010•1h ago
Don't forget the useless "Got it!" popups, especially when the site blurs the screen to guide you to it.
pwg•1h ago
With uBlockOrigin set to default deny all the javascript on the page there are:

zero cookie banners

zero surveys popping up

zero ads to be closed

Just the text of the page with no other distractions in the way.

not_your_vase•1h ago
Haha, we had a solution for that, called pop-up blockers. Then when they became very usable, everyone switched to overlays injected with javascript, so they became unblockable.

But thinking of this at this moment, this could be a good use for a locally ran LLM, to get rid of all this crap dynamically. I wonder why Firefox didn't use this as a usecase when they bolted AI on top of Firefox. Maybe it is time for me to check what api FF has for this

Terr_•1h ago
I'm waiting for someone to develop an augmented-reality system that detects branded ads or products, compares them against a corporate-ownership database, applies policies chosen by the user, and then adds warning-stripes or censor-bars over things the user has selected against.

It would finally put some teeth behind the myth of the informed consumer, and there would be gloriously absurd court-battles from corporations. ("Freedom of speech and commerce is essential, if people don't like what we're doing they can vote with their wallets... NOT LIKE THAT!")

93po•1h ago
ublock origin with annoyance filters on solves 95% of this
carlosjobim•1h ago
Your problems have been solved for more than a decade. Set your browser to open pages in reader view by default and you don't have these issues.
synack•1h ago
Are they considering all uses of window.history.pushState to be hijacking? If so, why not remove that function from Chrome?
omcnoe•1h ago
No, only if your website abuses window.history.pushState to redirect the user to spam/ad content is it considered abuse.
tgsovlerkhgsel•1h ago
Because clicking on a navigation button in a web app is a good reason to window.history.pushState a state that will return the user to the place where they were when they clicked the button.

Clicking the dismiss button on the cookie banner is not a reason to push a state that will show the user a screen full of ads when they try to leave. (Mentioning the cookie banner because AFAIK Chrome requires a "user gesture" before pushState works normally, https://groups.google.com/a/chromium.org/g/blink-dev/c/T8d4_...)

kro•54m ago
It's a valid question how they detect it. As there are valid usages, just checking for the existence of the function call would not be correct.

These sites likely pushState on consent actions so it appears like any user interaction.

tgsovlerkhgsel•1h ago
Now do paywalls next.
ladberg•39m ago
How would you recommend that creators of valuable content get paid?
renewiltord•34m ago
Ideally, when I create valuable content I am paid and when I consume valuable content I don't pay. Advertising does this but I hate it so I don't want that. So ideally, there is no way to extract value from me but I am able to extract value from others. I think I would support someone who finds a way to enforce this.

But I am also willing to pay for valuable content an exorbitant amount if it is valuable enough. For instance, for absolutely critical information I might pay 0.79€ a month.

charcircuit•1h ago
Google should actually fix this from the browser side instead of trying to seriously punish potentially buggy sites.
SuperNinKenDo•1h ago
Honestly if your site is buggy in a way that effectively breaks the browser, maybe you should be punished.
bot403•24m ago
I recommend 14 days in jail for the site owner, and, if egregarious, the engineer as well.

Not life ruining but just enough to be annoying. Just like their website.

josephcsible•1h ago
What does this have to do with sites being buggy? This change is about obvious intentional abuse.
domenicd•1h ago
We tried a few times. We got as far as gating the ability to push into the "real history stack" [1] behind a user activation (e.g. click). But, it's easy to get the user to click somewhere: just throw up a cookie banner or an "expand to see full article" or similar.

We weren't really able to figure out any technical solution beyond this. It would rely on some sort of classification of clicks as leading to "real" same-document navigations or not.

This can be done reasonably well as long as you're in a cooperative relationship with the website. For example, if you're trying to classify whether a click should emit single-page navigation performance entries for web performance measurement. (See [2].) In such a case, if the browser can get to (say) 99% accuracy by default with good heuristics and provide site owners with guidance on how to annotate or tweak their code for the remaining 1%, you're in good shape.

But if you're in an adversarial relationship with the website, i.e. it's some malicious spammer trying to hijack the back button, then the malicious site will just always go down the 1% path that slips through the browser's heuristics. And you can try playing whack-a-mole with certain code patterns, but it just never ends, and isn't a great use of engineering resources, and is likely to start degrading the experience of well-behaved sites by accident.

So, policy-based solutions make sense to me here.

[1]: "real history stack": by this I mean the user-visible one that is traversed by the browser's back button UI. This is distinct from the programmer-visible one in `navigation.entries()`, traversed by `navigation.back()` or `history.back()`. The browser's back button is explicitly allowed to skip over programmer-visible entries. https://html.spec.whatwg.org/multipage/speculative-loading.h...

[2]: https://developer.chrome.com/docs/web-platform/soft-navigati...

themafia•29m ago
The back button itself feels overloaded. There's "go to previous state" and then there's "go to previous origin." In an ideal world when I doubleclick on the back button what I mean is: "get me off of this site, now."
twism•1h ago
Reddit! I'm looking at you?
itopaloglu83•50m ago
Scroll on Reddit on mobile and click on a link. The comments open in a new tab. Close the tab and the previous tab is also at the link you’ve just closed.

Makes it impossible to browse around and long click to open on a new tab doesn’t solve the issue either.

rc_kas•47m ago
I feel like facebook is the worst culprit with this
mlmonkey•1h ago
But the question is: why are sites allowed to hijack the Back Button?!?
filcuk•1h ago
Because it has a legitimate use. As anything, the tools will be abused by malicious actors
josephcsible•1h ago
So that in single-page applications, it can work intuitively instead of always taking you all the way out of the app.
not2b•46m ago
If the navigation simulates what would happen if we follow links to SPA#pos1, SPA#pos2, etc so that if I do two clicks within the SPA, and then hit Back three times I'm back to whatever link I followed to get to the SPA, I guess it's OK and follows user expectations. But if it is used as an excuse to trap the user in the SPA unless they kill the tab, not OK.
mock-possum•41m ago
Of course, but programmatically, how do you enforce that?
JoshTriplett•29m ago
Some browser APIs (such as playing video) are locked behind a user interaction. Do the same for the history API: make it so you can't add any items to history until the user clicks a link, and then you can only add one.

That's not perfect, and it could still be abused, but it might prevent the most common abuses.

EDIT: apparently Chrome tried that and it wasn't sufficient: https://news.ycombinator.com/item?id=47761349

bonesss•33m ago
From the browsers perspective those are the same thing though. It’s a paradigm boundary.

The real answer is to have desktop applications that work like applications (buttons do what feels right), and websites that work like websites.

SPA, is a page application. Pages aren’t applications, applications aren’t pages. AutoCAD is an app, the Robotech Encyclopedia is content.

transcriptase•50m ago
>We believe that the user experience comes first

I’ll believe that when YouTube gives me the ability to block certain channels versus “not interested” and “don’t recommend channel” buttons that do absolutely nothing close to what I want.

Or a thousand other things, but that one in particular has been top of mind recently.

bot403•29m ago
Or if they ever bring back the "ignore this domain" feature so we can ignore ai slop and copycat sites.

It's why I went to Kagi.

PeterStuer•16m ago
Let me permanently hide "shorts".
incognito124•37m ago
Now, if they only declared scroll hijacking as spam...
andreareina•35m ago
> Notably, some instances of back button hijacking may originate from the site's ... advertising platform

I feel like anything loaded from a third party domain shouldn't be allowed to fiddle with the history stack.

kvdveer•11m ago
While i agree, the current JS security model rally doesn't allow for distinguishing origin for JS code. Should that ever change, advertisers will just require that you compile their library into the first party js code, negating any benefit from such a security model.
lmm•4m ago
> advertisers will just require that you compile their library into the first party js code, negating any benefit from such a security model.

It will become harder for advertisers to deny responsibility for ads that violate their stated policies if they have to submit the ads ahead of time. Also site operators will need a certain level of technical competence to do this.

hysan•29m ago
Took long enough. Maybe I missed it, but I didn’t see them say how invested they are in tackling this. Promoting a rule is one thing, but everything SEO related becomes a cat and mouse game. I don’t have high confidence that this will work.
psidium•27m ago
Ironically, we have an infringing website right now on the front-page of HN (nypost).
dnnddidiej•24m ago
Easy fix:

JS doesn't let you change back button behaviour.

Q. But what about SPA?

A. Draw your own app-level back button top left of page.

Another solution: make it a permisson.

Hamuko•11m ago
>Draw your own app-level back button top left of page.

This is the worst idea I’ve heard all day.

kaelwd•6m ago
Can I preventDefault on mouse5? What about the physical back button on Android?
sublinear•14m ago
> Notably, some instances of back button hijacking may originate from the site's included libraries or advertising platform. We encourage site owners to thoroughly review their technical implementation...

Hah. In my time working with marketing teams this is highly unlikely to happen. They're allergic to code and they far outnumber the majority of honest web devs producing good SEO. Their best practices become the standard for everyone else that's uninitiated.

What they will probably do is change that vanity URL showing up on the SERP to point to a landing page that meets the requirements. This page will have the link the user wants. It will be dressed up to be as irresistible as possible. This will become the new best practice in the docs for all SEO-related tools. Hell, even google themselves might eventually put that in their docs too.

In other words, the user must now click twice to find the page with the back button hijacking.

This just sounds like another layer of yet more frustration. Contrary to popular belief, the user will put up with a lot of additional friction if they think they're going somewhere good. This is just an extra click. Most users probably won't even notice the change. If anything there will be propaganda aimed at aspiring web devs and power users telling them to get mad at google for "requiring" landing pages.

monegator•4m ago
Phew. for a moment there i thought they would start blocking alternate uses of the back button in apps (for like when it means "go back" and when it means "close everything")

That would have severely rustled my jimmies

p4bl0•4m ago
That's cool if they can make it work.

I don't understand how Google's indexing work anymore. I've had some website very well indexed for years and years which suddenly disappeared from the index with no explanation, even on the Search Console ("visited, not indexed"). Simple blog entries, lightweight pages, no JavaScript, no ads, no bad practices, https enabled, informative content that is linked from elsewhere including well indexed websites (some entries even performed well on Reddit). At the same time, for the past few years I've found Google search to be a less and less reliable tool because the results are less often what I need.

Anyway, let's hope this new policy can improve things a little.

kstenerud•3m ago
Now if only they'd do this for Android apps that hijack the back button to pop up things, or say "are you sure you want to leave?"