fp.

Kimi K3.1 Pro and K3.1 Pro Highspeed

https://www.kimi.ai/blog/kimi-k3-1-pro

702•Jowsey•8h ago•446 comments

Apple Music 404 Not Found

https://music.apple.com/this-url-doesnt-exist

567•frizlab•12h ago•188 comments

Evolving Threat: http2shell is an RCE in node, Python, and more

https://nitter.click/AikidoSecurity/status/2113759110625906950?__galadriel=lPmlGl9id4oAd5UeBwMhlY...

47•cowlevel•1h ago•10 comments

CVE Tracker

https://cve.0xosprey.com/

92•Group_B•3h ago•34 comments

Today, we hacked what we'd set out to hack: the iPhone

https://blog.calif.io/p/iphone

739•pavel_lishin•8h ago•493 comments

Dessa: the most authentic full-duplex speech model ever built

https://block.xyz/dessa

215•dsr12•5h ago•93 comments

Local Wikipedia: Wikipedia, but only for things a half hour walk from you

https://edjefferson.com/localwiki/

1230•sohkamyung•1d ago•225 comments

The Real Kevin Bacon

https://pudding.cool/2026/10/kevin-bacon/

234•xnx•3d ago•69 comments

Canadians are running out of time to oppose Bill C-22

https://www.eff.org/deeplinks/2026/10/canadians-are-running-out-time-oppose-dangerous-c-22-survei...

319•hn_acker•1d ago•161 comments

Show HN: Corgi, a helpful {agent, terminal} multiplexer

https://corgi.computer/

28•eiopa•5h ago•3 comments

Now Google says it might use your Gmail and Google Photos data to target ads

https://www.theverge.com/tech/1017600/google-personal-intelligence-privacy-policy-ads-update

258•JustSkyfall•5h ago•136 comments

Bringing uv and ty together

https://astral.sh/blog/uv-ty-integration

11•Ravencentric•3d ago•3 comments

No Source Code? No Problem

https://queue.acm.org/doi/10.1145/945131.945155

31•ibobev•4h ago•24 comments

Rune 1.3: adds TypeScript, a Helix editor, Kitty graphics and OSC-7501

https://rune.build/blog/rune-1-3-release

36•ernestrc•5h ago•7 comments

Rise of collagen-eating microbes may help explain gaps in the fossil record

https://www.cam.ac.uk/research/news/rise-of-collagen-eating-microbes-may-help-explain-gaps-in-the...

11•gmays•3d ago•0 comments

A whirlwind tour of systemd-nspawn containers

https://quantum5.ca/2025/03/22/whirlwind-tour-of-systemd-nspawn-containers/

31•ibobev•4h ago•6 comments

Air Purifiers as White Noise Machines

https://www.jefftk.com/p/air-purifiers-as-white-noise-machines

55•luu•7h ago•90 comments

A Bicycle Journey Across Brazil to Find a Vanishing Savanna

https://e360.yale.edu/features/2026-film-contest-second-place-cerrado

22•throwaway2037•2d ago•6 comments

Securing our frontier model training environment

https://openai.com/index/securing-our-frontier-model-training-environment/

71•pretext•5h ago•81 comments

Animations for System Builders

https://brooker.co.za/blog/2026/10/23/animations.html

32•KraftyOne•8h ago•3 comments

DNS: A Replacement for Finger

https://altchan.org/sh/42

21•Bender•6h ago•19 comments

Show HN: Impossible Machines: declaratively program the physical world

https://www.impossiblemachines.xyz

61•bhaprayan•1d ago•17 comments

Reforming English Spelling

https://blog.oup.com/2026/10/reforming-english-spelling/

22•jruohonen•9h ago•75 comments

Show HN: Swurf – Swipe through the real web

https://swurf.org/

58•webtjb096•18h ago•28 comments

I turned my TV into a Game Boy Color with a Pokemon town as my home screen

https://twitter.com/robbietilton/status/2111936458923851923

65•scrambled•7h ago•24 comments

German court calls Google aerial imagery 'spying'

https://www.courthousenews.com/german-court-calls-google-aerial-imagery-spying/

30•rdmuser•2h ago•7 comments

LISP Comes of Age (1980)

https://microship.com/lisp-comes-of-age/

60•so-cal-schemer•1d ago•17 comments

The Missed Opportunities of Sonic 06 (2025)

https://isaacmarovitz.com/posts/sonic-06/

59•ibobev•8h ago•18 comments

UUIDv7 doesn't have the properties you think it does

https://alexsci.com/blog/uuidv7-is-weird/

108•ibobev•8h ago•93 comments

WorldTUI: I trained a 360M model to pretend to be a terminal

https://simedw.com/2026/10/21/world-model-terminal/

609•alphax314•1d ago•182 comments

Open in hackernews

Evolving Threat: http2shell is an RCE in node, Python, and more

https://nitter.click/AikidoSecurity/status/2113759110625906950?__galadriel=lPmlGl9id4oAd5UeBwMhlYKArHyr6lR2IDGujPwB5HV2kQ1aLoPWFd5A9sGuzNcmrp8fUso8qygmHcKTDZ8MNHWqQ3bDJcycV87xp_0VypzQLYj6O_RRHlZuQqj33oASGY2YLSoAiMjeOZN40h7Stf8AG7DPrGZbAPVKUXy36HoMudRbvwF3_r2uYNmfJMhpKzywQDM6Ab8

44•cowlevel•1h ago

Comments

cowlevel•1h ago

Likely mitigation: disable brotli (br) content-encoding on both sides

profdevloper•1h ago

https://x.com/AikidoSecurity/status/2113759110625906950

adzm•55m ago

Interestingly the commit that fixes this in brotli dates back to February https://github.com/google/brotli/commit/0ed4268a4401abcb4472...

cowlevel•10m ago

OpenAI's tweet says it wasn't recognized as security relevant so wasn't important enough to make a release - until their agent realised it was.

https://nitter.jaydenha.uk/OpenAI/status/2113766354386084338

Sytten•46m ago

Since I checked Rust servers should be fine since the brotli crate is not a binding on the C.

rvanlaar•38m ago

It looks like brotli <= 1.2.0 is vulnerable.

The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/

QuadmasterXLII•31m ago

is flask hello world with gunicorn behind apache vulnerable?

TZubiri•21m ago

what I can say is that a 5 liner hello world starting with ‘import socket’ is not affected

whether a hello wolrd in fastapi is affected might also be interesting

DogeGode•24m ago

Another day, another buffer-overflow vulnerability in C code …

cowlevel•9m ago

Rust has them too

https://news.ycombinator.com/item?id=50069499

anonymous908213•6m ago

I could do without every memory bug getting a cute sensational name and marketing push, I have to say.