frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Tesla Roadster

https://www.tesla.com/roadster
958•shekhar101•20h ago•1713 comments

Claude reveals ECDSA curve origins

https://www.anthropic.com/research/ecdsa-curve-origins
456•ahlCVA•2h ago•189 comments

Llama.cpp on a jailbroken PS5: run any GGUF model natively on the console

https://github.com/cobanov/PS5LM
125•Anon84•3h ago•33 comments

FLUX 3 Image Klein

https://bfl.ai/blog/flux-3-image-klein
55•gmays•2h ago•8 comments

eBay Restricts Listings of Radio Equipment, but Exempts Ham-Band-Only Gear

https://www.arrl.org/arrlletterissue?issue=2026-10-15#eBay-Restricts-Listings-of-Radio-Equipment_...
115•7402•3h ago•95 comments

Waymo in Toronto

https://waymo.com/blog/2026/10/waymo-in-toronto/
211•ChrisArchitect•7h ago•316 comments

Designing more efficient quantum circuits with Claude

https://www.anthropic.com/research/designing-efficient-quantum-circuits
70•pretext•3h ago•11 comments

C++26: The New Debugging Header

https://www.sandordargo.com/blog/2026/09/30/cpp26-debugging
37•jandeboevrie•3h ago•1 comments

How the Claude Code team does code review

https://claude.dev/blog/solving-code-review-at-anthropic/
133•pretext•2h ago•125 comments

JPEG XL vs. AVIF for web use-cases

https://jakearchibald.com/2026/jpeg-xl-vs-avif/
162•farlight•5h ago•129 comments

Wireless magnetic millirobots that deliver medicine inside the beating heart

https://hub.jhu.edu/2026/10/12/magnetic-millirobots-cardiac-treatment/
24•giuliomagnifico•2d ago•1 comments

Apple ML Research: Muse Spark Open with MLX on Mac Studio

https://machinelearning.apple.com/research/mlx-distributed-inference
237•antipaul•8h ago•105 comments

You could have invented transformers from memory

https://alexwang.ai/posts/associative-memory/
44•speckx•2h ago•6 comments

90% of US working hours are spent on tasks not covered well by AI benchmarks

https://www.mercor.com/research/labor-index/benchmark-map/
320•speckx•4h ago•290 comments

I never authorized an integration that scans my secrets

https://github.com/home-assistant/home-assistant.io/issues/49314
97•trvrprkr•1h ago•48 comments

Piramidal (YC W24) Is Hiring

https://job-boards.greenhouse.io/piramidalinc/jobs/4443102009
1•dsacellarius•4h ago

Monte-Carlo Simulations

https://eli.thegreenplace.net/2026/monte-carlo-simulations/
35•ibobev•3d ago•3 comments

Show HN: Gemini 4 Argon plays StarCraft

https://starskirmish.com/bench/v0-2/
171•__cayenne__•7h ago•74 comments

Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD

https://calif.io/research/big-fish
149•rs_rs_rs_rs_rs•7h ago•42 comments

/dev/null: social network for developers

https://dev-null.sh
90•mnapoli•4h ago•93 comments

PGO or not PGO this is the dilemma. Step 2

https://www.percona.com/blog/pgo-or-not-pgo-this-is-the-dilemma-step-2/
5•hnp9j9qtda•2d ago•0 comments

GifCities

https://gifcities.org/
42•augury•4h ago•1 comments

The Fatal Flaw of 911

https://www.themarshallproject.org/2026/10/16/911-book-policing-mental-health
36•plunge•2h ago•50 comments

Show HN: Wonderhop – A daily game: guess what most people say, or what none do

https://wonderhop.io/en/
41•mtlduo•2d ago•49 comments

Anthropic assigned highest junk credit rating in June

https://www.ft.com/content/5a310aee-f555-4266-874c-b1b4db20186d
159•JumpCrisscross•3h ago•44 comments

Stolen Renoir paintings found hidden, and damaged, behind cinder block wall

https://www.cbsnews.com/news/stolen-renoir-paintings-found-behind-wall-france/
90•ohjeez•3d ago•60 comments

I Love Software Rendering

https://www.jamesfmackenzie.com/2026/10/13/i-love-software-rendering/
271•speckx•9h ago•179 comments

What on Earth Is Dekton?

https://www.worksinprogress.news/p/porcelain
107•wawayanda•7h ago•40 comments

What was a Token Ring network?

https://dfarq.homeip.net/what-was-a-token-ring-network/
67•ibobev•8h ago•48 comments

Show HN: Stoke Money – Personal finance app built around a cash flow forecast

https://stoke.money
18•_wesley•3h ago•13 comments
Open in hackernews

I never authorized an integration that scans my secrets

https://github.com/home-assistant/home-assistant.io/issues/49314
95•trvrprkr•1h ago

Comments

TavsiE9s•1h ago
Tough one. I get the intention but this should've been opt-in.
l-albertovich•1h ago
And that kids is a clear example of how not to interact with people online.
zephyreon•1h ago
Yeah not a good look. This is probably the worst way to handle community feedback.
l-albertovich•51m ago
I mean, none of them behaved like an adult.

It's pretty clear that the maintainer should've handled it better but I'd be lying if I said I never felt like telling a petulant user off. The problem is he didn't handle it professionally.

gvfsa•36m ago
Maybe he shouldn’t be accessing people’s passwords. If you start looking into someone’s wallet you can expect an abrasive response.
l-albertovich•25m ago
Well, I didn't check the git history so I can't confirm or deny that he implemented the feature, in any case, if you read the comment about how the passwords are anonymized it sounds pretty reasonable.

Leaving that aside, even if you diagree with it you (the user) are not entitled to anything, especially not entitled to have an attitude.

Just think about it differently, what do you think would happen if you do the same in the real world?

I'm pretty sure in the best case scenario you may be asked to leave and in the worst case scenario you may be "escorted" out of the premises.

A little bit of politeness goes a long way.

ragall•29m ago
The developer's reply was very reasonable and measured. The user, on the other hand, was very rude.
eur0pa•1h ago
Awfully tone deaf responses
onionisafruit•1h ago
I have another tab open where I am about to buy a home assistant green and start a journey of probably-pointless automations. This is giving me pause. Not about sending hashes to haveibeenpwned, but about the response this got on github.
flanz_10•1h ago
> If this is all reason for you to uninstall and fork... So be it, it is open source after all.

what a petty answer. "just fork it bro".

flapperdeflip•33m ago
Working on a fork already: Lets spend some tokens! :)
jackpepsi•59m ago
You may find this unasked for scan humiliating, but we can mathematically prove we're not humiliating you. Any feelings of discomfort or humiliation are therefore invalid and should be set aside.

Edit: I'm sure a greater good argument can be made. I just don't think they are making it in a way that justifies the invasiveness.

janice1999•59m ago
Toxic developers turned me off Home Assistant. The same developer is the star of this issue: https://github.com/NixOS/nixpkgs/pull/126326

Related discussion: https://news.ycombinator.com/item?id=27505277

netsharc•31m ago
Hah, his profile sure has a lot of bullshit about being human and positivity...
fg137•10m ago
Was thinking of setting my own assistant using Home Assistant to replace the Google Home device I got rid of. Looks like I should slow down and take a closer look at this.

As someone whose smart home need is minimal -- I just use it to turn on/off lights with voice -- I'd rather have nothing than support such behavior.

hypfer•9m ago
Dude that is

a) five years ago

b) nothing to be ashamed of, honestly

c) dumb drama

This is bad faith. You could reference it in good faith as context, but that is not what you are doing.

someguydave•6m ago
interesting that the crux of the Nix dispute was about how he wanted to self-modify the HA after install, and the crux of the current dispute is how HA should be able to scan your secrets and upload truncated hashes

It's not a good look taken together

Rygian•56m ago
I wouldn't be surprised if that integration is outright illegal in EU due to GDPR, thus putting HIBP in trouble for ingesting PII without any legal legitimacy.

And the first reply being "It is not an invasion of privacy" just shows incompetence on privacy topics. It is never a valid answer.

Which is really concerning, for the lead developer of a home automation system that "fights for the fundamental principle of privacy" as per their mission statement.

nicce•30m ago
I am curious thought that how it would be illegal according to GDPR. They are hashed after all, and the same hash is not used for authentication.
Matticus_Rex•27m ago
It's certainly an overstep, but just the hash they're sending wouldn't be PII.
deadbunny•23m ago
What PII do you think is being sent to HIBP?
altairprime•54m ago
(For missing context from this bare link to an issue with no context provided by the submitter — Home Assistant apparently integrated the same Have I Been Pwned safe scanning process that many other password managers have.)

I have a great deal of sympathy for them refusing to engage; decisive software creators are far less palatable to an entitled swarm of disagreement, and that same decisiveness is what makes the best software. Perhaps in U.S. culture, refusal with a smile and a reassurance that “We’re Listening” is something folks feel entitled to, but in other areas of the world, demanding a stranger change their mind once it’s made up earns only mockery or pity. To those cultures, this GitHub is a comedy-farce, and I laughed out loud upon reading it — not because I necessarily agree with the project’s decision, but because I agree culturally with their tone and handling of what some view as blatant immaturity: a final flat refusal, closing the door, and getting back to work.

interf4ce•53m ago
It sounds like the dev's reason for rejecting the issue is that the issue was opened on the documentation repo rather than the code repo.

On the one hand, it's understandable. No amount of documentation changes will fix the issue.

On the other hand, it's a pretty abrasive response. It wouldn't have taken any more effort to be a little more helpful and direct OP to the right repo: "Sorry, this is the wrong place for this to be addressed. Please bring it up here instead [link]."

mcmcmc•21m ago
If you actually read through, the option to disable the functionality was already present… just not documented. So it seems the documentation repo was the correct place to open it
csoghoian•51m ago
Giving the home assistant core developers the benefit of the doubt, I am sure there are good intentions here. But if they are interested in adding new security features, adding support for phishing-resistant multi factor authentication (passkeys) would be much more valuable. Users have been asking for it for some time, and even submitted patches, which were rejected.
balloob•50m ago
This feature has been around for 5 years... https://github.com/home-assistant/home-assistant.io/blob/cur...
janice1999•47m ago
That makes it even worse. A leak is still a leak even when you haven't notice it. Personally I use HIBP but I would still be annoyed to learn a system I installed mainly for privacy was sending private data to a third party by default.
flapperdeflip•43m ago
The feature is not the problem.
Cameri•49m ago
The dev comes as self-serving. Not what you’d expect to see. Calls it heated when he himself caused it with their tone deaf response… it’s next level.
csnover•45m ago
> The dev comes as self-serving

What, do you not include links to every single one of your social media accounts in every single post you make on GitHub? I think this is a very cool and normal thing, and not a concerning red flag about narcissistic tendencies at all.

deadbunny•35m ago
The same dev doesn't even like others packaging his open source libs.

https://github.com/NixOS/nixpkgs/pull/126326

frenck•43m ago
Frenck here, I'm the one who replied on that issue.

My replies there were more dismissive than they should have been. My apologies. I've posted a follow-up on the issue.

As it turns out, the check can already be turned off after all:

  ha security options --pwned=false
It has been part of the Supervisor for years and checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why people are noticing it now.

Only the first 5 characters of a SHA-1 hash go to HIBP, and the matching happens locally: https://github.com/home-assistant/supervisor/blob/main/super...

Our documentation should have explained all of this, including how to turn it off. We'll get that updated.

doobiedowner•35m ago
>As it turns out, the check can already be turned off

Problem solved!

>My replies there were more dismissive than they should have been

What about this one?

5kyl4b•25m ago
why lying on your first reply? you mentioned 1Password did the same, in an attempt to make yourself "less guilty", but you failed to realize 1Password doesn't enable that option automatically without consent, and in some cases this option is periodically DISABLED automatically. address this, please, it's pretty embarrassing to lie like this just to cover y'all's ass.
frenck•21m ago
Not a lie, but I was wrong on that one. I'm happy to admit that.

I've used 1Password's Watchtower for so many years that I assumed the breached password check was just part of it. After your reply I looked it up and learned it's actually a setting in their privacy preferences, so my comparison was off.

../Frenck

TZubiri•35m ago
>>please let us know so we can uninstall and fork

>Sorry, these are not statements we can work with. Doing such threats and trying to intimidate it not going to bring you anywhere. If you want to do a

just wanted to add an outsider perspective here, not trying to add wood to the fire

but i don’t think it’s inappropriate or ‘a threat’ to let the dev know the user can stop using the software.

dpark•24m ago
Is it inappropriate? Not really. Is it a threat? Yeah, it really is. “I’m going to stop using your software if you don’t change this” is a threat. “I’m going to fork it and ship a competing product” is a stronger threat.

It was a clear attempt to sway with intimidation. It was done politely but that doesn’t change what it was. (The dev had already closed as won’t fix, too, so they had preemptively answered.)

abletonlive•30m ago
Here we have the classic if you want something to happen in the corporate world, make it go viral on the internet. Except, humans will be humans and it played out in open source.

In this case, frenck most certainly backtracked because they realized they were on the front page of HN and did not want the heat.

thunderfork•20m ago
So, wait, these are secrets that are already given to h-a, hashed, and just the first five characters of the hash sent up..?

Yeah, I agree with the maintainer, this strikes me as outrage theater over any actual problem, no?

jocular•14m ago
Frenck is the worst part of Home Assistant. He shits on so many things with just a hand wave and no attempt at justification.
hypfer•18m ago
From my understanding, they seem to be under a lot of stress/pressure lately.

I'm not exactly sure why, but the stuff that happens tells that story (to me at least).

Barking at frenck on a Friday at 11.30PM like this is probably not the right thing to do.

frenck•16m ago
Hehe not really. I'm also just enjoying my hobby on a Saturday evening honestly :)

But you are right, it is time to head downstairs for a beer with Mrs. Frenck.

../Frenck

philipwhiuk•23m ago
> Only the first 5 characters of a SHA-1 hash go to HIBP

Some would consider the first five characters being sent over the internet to be 'your secret leaving your system'.

Some would consider phoning home to a remote server to be worrisome. It's home assistant not cloud assistant.

saghm•16m ago
Asking basically the same thing as the sibling replies, but hopefully in a less aggressive way: can you elaborate on what led you to reply like that in the first place? As someone with no horse in the race (I don't use Home Assistant), the first reply you gave genuinely does seem like it was intended in good faith, even if it was not satisfying to the user, and I can understand that angry users are not fun to interact with, but I'm struggling to wrap my head around why your second reply was "This issue is closed as won't fix" without any elaboration about why. The explanation that seems most likely to me is that you were annoyed at the user and decided not to spend any time looking into the issue, which would be unfortunate but maybe understandable if that's what you're apologizing for. Without any explanation about why you quickly dismissed and then suddenly turned around and changed your mind later though, I think you've risked the apology coming across more as damage control than genuine regret.
omega3•16m ago
> My replies there were more dismissive than they should have been. My apologies.

I’m curious what made you change your mind, perhaps seeing this getting traction on hn?

infinite_spin•8m ago
I do get the sense that you're not malicious, just that maybe you're not seeing this from the standpoint of someone that assigns a higher value to some elements of privacy. In this case, your user base expects a home automation system. They do not expect that system to scan their computer for passwords, regardless of how "safely" the home automation system were to behave.

You might have a heart of gold, and just be having an off day due to reasons, so I hope people cut you some slack, but if I were you I'd update this feature to be opt-in and conspicuous, immediately