frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Iranian banks' SSL certificates are being revoked due to OFAC sanctions

https://digiato.global/report/iran-banks-ssl-certificates-domain-changes/
38•misano•51m ago•22 comments

Pion, an agent designed to run any company autonomously

https://andonlabs.com/blog/why-we-built-pion
84•lukaspetersson•1h ago•88 comments

Distributed Systems Classics (2017)

https://nvartolomei.com/dist-sys-classics/
111•grep_it•2h ago•25 comments

Why don't machine learning research agents overfit?

https://www.amazon.science/blog/why-dont-machine-learning-research-agents-overfit
53•Betelbuddy•2h ago•27 comments

Principles for Fast Tokio Applications

https://dial9-rs.github.io/blog/principles-for-fast-tokio-applications/
77•carllerche•3h ago•15 comments

Steam Frame starts at $1059

https://store.steampowered.com/hardware/steamframe
142•bsimpson•1h ago•71 comments

Show HN: Neobrutalism.dev – Just added Base UI support and added new color theme

https://www.neobrutalism.dev/
64•samke-•2h ago•36 comments

OpenAI bots knew about the RubyGems caching vulnerability

https://tenderlovemaking.com/2026/09/11/what-a-time-to-be-alive/
210•gregnavis•6h ago•211 comments

iOS 27, iPadOS 27, and macOS 27

https://www.apple.com/newsroom/2026/09/major-updates-for-apples-software-platforms-are-now-availa...
136•throw0101d•58m ago•116 comments

Cua (YC P25) Is Hiring a Founding Technical GTM Lead

https://www.ycombinator.com/companies/cua/jobs/1IWEKVH-founding-technical-gtm-lead
1•frabonacci•1h ago

A Beginning for Mathematics

https://www.daniellitt.com/blog/2026/9/13/a-beginning-for-mathematics/
52•robinhouston•3h ago•9 comments

Notes on gotchas while migrating 35kb preprompts from Opus to self-hosted Ollama

https://patrickmccanna.net/notes-on-migrating-large-prompts-away-from-anthropic-openai-to-self-ho...
89•0o_MrPatrick_o0•4h ago•39 comments

Show HN: Nari Qwen3-TTS and Qwen3-ASR – High accuracy, low latency and cost

https://narilabs.com/blog/nari-labs-leads-coval-voice-ai-benchmarks/
12•toebee•2h ago•4 comments

Cloudflare AKE cuts origin HelloRetryRequests from 52% to 3.7%

https://blog.cloudflare.com/automatic-key-exchange-for-origins/
15•iamsyr•1h ago•4 comments

When LLM judges agree, should we believe them?

https://www.amazon.science/blog/when-llm-judges-agree-should-we-believe-them
29•Betelbuddy•2h ago•11 comments

How my e-reader lost its stripes

https://www.serpentine.com/posts/2026/x3-stripes/
31•simonmic•2h ago•1 comments

XCancel service is suspended until further notice

https://xcancel.com/#
206•gaganyaan•8h ago•475 comments

Truncated SVD (2023)

https://brashandplucky.com/2023/09/09/truncated-svd.html
23•ibobev•2h ago•1 comments

An atlas of periodic solutions to the three-body problem

https://www.threebodyorbits.com/
268•danielmorozoff•2d ago•61 comments

Ask HN: What are you working on? (September 2026)

255•david927•1d ago•790 comments

Show HN: Apollo Lunar Module landing simulation

https://gosandeep.com/eagles-descent/
4•gosandeep•5d ago•0 comments

EuroBirdPortal – Live bird movements across Europe

https://www.eurobirdportal.org/ebp/en/
198•NKosmatos•10h ago•58 comments

Adversarial Fashion Makes a Statement on AI Panopticon

https://spectrum.ieee.org/adversarial-fashion
61•rbanffy•4h ago•27 comments

A 386 PC for Your RP2350

https://github.com/rh1tech/frank-386
185•SamuraiLion•10h ago•61 comments

Trying to Make a Loop Auto-Vectorize

https://jsgroth.dev/blog/posts/trying-to-make-a-loop-auto-vectorize/
35•zdw•4d ago•11 comments

Claude is a Contrarian

https://medium.com/@rdsubhas/claude-is-a-contrarian-dbce4de5cada
83•rdsubhas•2h ago•108 comments

The Tudor Kings

https://analog-antiquarian.net/2026/09/11/the-tudor-kings/
13•ibobev•2h ago•1 comments

Things That Annoy Me About Cars

https://blog.decryption.net.au/posts/cars_suck.html
37•eustoria•3h ago•30 comments

Devil's Arrows: Ancient builders hauled 55k-lb stones 11 miles for UK stone row

https://www.sciencedaily.com/releases/2026/09/260909005152.htm
44•bookofjoe•3d ago•33 comments

Show HN: Pelican-bicycle alternatives

https://gally.net/temp/20260914pelican-alternatives/index.html
67•tkgally•5h ago•26 comments
Open in hackernews

The V8 JavaScript Runtime Undermined My Constant-Time JavaScript Library

https://soatok.blog/2026/09/12/the-v8-javascript-runtime-undermined-my-constant-time-javascript-library/
14•some_furry•2d ago

Comments

i2talics•38m ago
I'm a security noob, but side channel attacks seem to me like something that you fundamentally just can't address by writing better software in a high-level language. The entire point is that they dig underneath all of your abstractions. It doesn't seem particularly tenable to keep playing whack-a-mole in this way.
some_furry•18m ago
You can write algorithms that leak every bit of your secrets, trivially. The npm "elliptic" package does this. Daniel Bleichenbacher has tested several packages' timing leakage in Rooterberg that are easily exploited: https://github.com/bleichenbacher-daniel/Rooterberg/blob/mai...

You can use algorithm implementations that do not have secret-dependent timing differences in any language, as long as you are clear that your guarantees do not extend to the underlying runtime or to compiler optimizations. This isn't perfect, but it's better.

You can go further Rust-to-WASM and use tools like https://github.com/trailofbits/skills/tree/main/plugins/cons... to check the assembly and the runtime that the assembly runs in. (Most of the linked Claude skill is a Python program. It just relies on AI to eliminate false positives.)

The real question is: What's your threat model?

ErikCorry•29m ago
Nobody was evil you just tried to rely on a property that V8 never promised.

Wasm doesn't promise it either but there's a much better chance you get what you want there.

some_furry•24m ago
> Nobody was evil you just tried to rely on a property that V8 never promised.

Tell me you didn't read past the headline without telling me you didn't read past the headline.

ErikCorry•17m ago
Read the whole thing, but OK you didn't accuse anyone of being evil yet. But let me clarify that even if a later optimization breaks your constant time property that still wouldn't be evil.
some_furry•15m ago
You walked back putting an accusation of evil in my mouth while following up with warning me not to make an accusation I would not make to begin with. Incredible.
ErikCorry•13m ago
I don't know if you are the author but he wrote:

The only things that can easily go wrong now are:

The compiler turns out to be evil and introduces an “optimization” that I don’t anticipate

The V8 developers turn out to be evil and modify how this logic works and break my assumptions in a future release

some_furry•
ndesaulniers•21m ago
I was working on reimplementing the WebRTC stack in JavaScript a long time ago, never finished. The crypto folks at Mozilla (ekr@) suggested "maybe don't do that for dTLS."
some_furry•10m ago
I mean this with absolutely no shade but: That was objectively good advice.

(Not to detract from anyone's cleverness or hard work.)

11m ago
Ah, right. That was clearly tongue-in-cheek and easily forgettable, not an actual accusation on either party.