frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

My favourite PowerMac is a Nintendo Wii

https://virtuallyfun.com/2026/10/29/my-favourite-powermac-is-a-nintendo-wii/
201•DHowett•5h ago•52 comments

Sanstun: A sans-IO, parallel-friendly WireGuard implementation in Rust

https://www.firezone.dev/blog/introducing-sanstun
37•wh33zle•1h ago•1 comments

Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

https://phorion.io/blog/offical-claude-code-vsx-compromise/
709•_chall•16h ago•442 comments

Northflank Breached

https://status.northflank.com
325•js4ever•8h ago•243 comments

Infinite Mac: BeOS

https://blog.persistent.info/2026/10/infinite-mac-beos.html
78•ecliptik•3h ago•15 comments

Jules Verne's Lost Novel

https://blue-continuum.com/verne-paris
57•dnetesn•3h ago•13 comments

Breaking the open web won't stop the bad bots

https://www.techpolicy.press/breaking-the-open-web-wont-stop-the-bad-bots/
160•raybb•3d ago•66 comments

Show HN: A working Nintendo in ~1GB of Qwen weights

https://github.com/dbreunig/nesformer
166•dbreunig•6h ago•105 comments

The oldest ice disappears and the Stone Age emerges from it

https://www.sciencenorway.no/archaeology-climate-culture/the-oldest-ice-is-disappearing-the-stone...
57•dxs•3h ago•17 comments

Florilegium: Procedural Flowers in LaTeX

https://github.com/kevinraymond/florilegium
193•nanna•7h ago•34 comments

The federated code forge

https://tangled.org/blog/forge/
205•zlliang•7h ago•68 comments

France is getting download tax for content providers (€0.055/GB)

https://www.resetera.com/threads/france-is-getting-download-tax-for-content-providers-%E2%82%AC0-...
54•bko•1h ago•27 comments

Through Captain Jean-Luc Picard, Patrick Stewart taught us the measure of a man

https://www.bostonglobe.com/2026/10/29/metro/patrick-stewart-picard-star-trek-the-next-generation/
133•apress•2h ago•72 comments

Linode Security Incident

https://status.linode.com/incidents/nt58zhx3pmgm
102•lacoolj•1h ago•51 comments

A Pickpocket's Guide to New York

https://www.newyorker.com/magazine/2026/11/02/a-pickpockets-guide-to-new-york
45•prismatic•3h ago•6 comments

Turning a solar power system into its own backup

https://arstechnica.com/science/2026/10/turning-a-solar-power-system-into-its-own-backup/
22•PaulHoule•1d ago•7 comments

AO3 Down for Maintenance

https://www.otwstatus.org
63•idlewords•2h ago•9 comments

Azure's Weakest Link – Five Full Cross-Tenant Compromises

https://www.binarysecurity.no/posts/2026/10/one-root-case
255•swq115•13h ago•46 comments

Tree-mounted machines connect to web app to let users knock on wood remotely

https://www.designboom.com/technology/tree-mounted-machines-web-app-users-knock-on-wood-remotely/
53•surprisetalk•3d ago•24 comments

Cloudflare Turnstile solver library (no headless browser required)

https://github.com/chris124567/cfsolve
4•costco•2d ago•0 comments

An Arrogant Way of Killing (2016)

https://magazine.atavist.com/2016/an-arrogant-way-of-killing
18•firefax•3h ago•7 comments

Building an AI-native engineering org

https://twitter.com/sgondala2/status/2115832070274723875
91•sgondala_ycapp•1d ago•120 comments

AI isn't replacing SREs, it's deskilling them

https://newsletter.signoz.io/p/ai-isnt-replacing-sres-its-deskilling
466•dorianniemiec•7h ago•341 comments

Bunny CDN Security Incident

https://status.bunny.net/incidents/p6gf1by9kr7m
183•SondreDag•4h ago•36 comments

Sleep framework: A new way for LLMs to retain knowledge in continual learning

https://research.google/blog/the-sleep-framework-a-new-way-for-llms-to-retain-knowledge-in-contin...
147•acossta•2d ago•12 comments

Cisco gives engineer unlimited AI tokens to rewrite legacy code

https://fortune.com/2026/10/30/cisco-president-jeetu-patel-gen-z-27-year-old-unlimited-ai-tokens-...
74•taubek•9h ago•76 comments

Show HN: Sketch Stadium – watch your agent play Pictionary

https://sketch.wakeshift.ai/games/q5ucru
18•ericlevine•7h ago•7 comments

How do you take a picture of a black hole?

https://www.quantamagazine.org/how-do-you-take-a-picture-of-a-black-hole-20261029/
73•dverlaeckt80•13h ago•58 comments

GitHub Incident with Actions, Pages, and Webhooks

https://www.githubstatus.com/incidents/pwxsjgnvrk6b
137•damontal•5h ago•58 comments

Show HN: Automatic deduction of FlashAttention kernel from ~25 lines of SQL

https://github.com/xqlsystems/xarray-sql/blob/6debe2495dcb4e8fac20ab97df5b89baae2a31a6/benchmarks...
22•alxmrs•3h ago•1 comments
Open in hackernews

Linode Security Incident

https://status.linode.com/incidents/nt58zhx3pmgm
100•lacoolj•1h ago

Comments

rvz•59m ago
So it begins. The war against the abliterated AI models. Even at 1,000 TPS any service is a target.

Imagine swarms of abliterated frontier AI models that reach >20,000 TPS. As I said before [0] you are going to have to hire specialized security engineers or technical bodyguards from the senior to senior staff level using AI agents to protect your entire business.

Otherwise you are cooked.

[0] https://news.ycombinator.com/item?id=50310312

jacquesm•56m ago
Guess who has access to abliterated frontier AI models?
cyanydeez•49m ago
The worst people you know.
lacoolj•35m ago
Teenagers
samwilliams•55m ago
Infrastructure is an FPS now.
pawelduda•51m ago
One day your job will be to play StarCraft but under the hood it will be your agents vs attacker's agents
tripleee•36m ago
If this is the job description sign me up
ProllyInfamous•33m ago
Today? Today is that day... probably a yesterday or two, as well.
singinwhale•32m ago
Basically Enders Game
jdprgm•27m ago
Enders Game but AI instead of aliens.
samwilliams•8m ago
Ha! I literally built that last week: https://molecule.arweave.net/#/bugcraft
lacoolj•35m ago
Primeagen went over this in the last episode or two - apparently this sort of defense is costing ... one of the big models or companies hosting them ... $900k/day or something to constantly run the best model and monitor 24/7 to combat the attacks [0]

[0] https://www.youtube.com/watch?v=9OahTki4cPA

vsgherzi•24m ago
I don’t really have experience running anything like this so this is very much a comment front the peanut gallery but

Is that really the best way to do things? I’m not really sure what an agent offers here does it just look at logs and do actions? I would not really feel safe if that’s my service’s answer to security.

I could see it maybe as a really smart filter to block ips that are sending probing requests but I don’t really see that as a good reason to have an agent be sitting 24/7 looking at logs.

scottrogers86•35m ago
armadin.com?
shoobiedoo•33m ago
What's the future of cybersecurity going to look like? A rapid shift to shoving everything into microvm's to minimize attack surface?
lelandfe•27m ago
Airgapping.

I'm hoping goverments take stock of what is online that needn't be.

Arbortheus•13m ago
OpenClaw agents continuously scanning your prod infrastructure and applying config tweaks and package updates autonomously on the fly in response to viral CVE numbers trending on X.
14u2c•19m ago
More likely we'll just see another shakeup of the layers of abstraction that the average company operates at. Why would you hire specialized people when AWS can do so for you?
spydum•52m ago
Wow, that isn't clear. Is there an incident, or did they just become aware about MPTCP vuln? Details on the mptcp are also pretty scarce as well right?
6thbit•49m ago
Yeah its unclear. Sounds like they are just now patching it and treating it as an incident which is probably the right thing to do.
onei•17m ago
(Former akamai employee) Akamai have an incident process that handles both "things are bad for multiple customers" as well as "we need eyes on this from multiple departments/stakeholders asap". If you're hitting a wall debugging an issue on your own, especially if it's not overtly customer impacting, declaring an incident is an effective way of getting the attention needed to solve it.

Once you declare the incident, the process includes these status page updates, alongside equivalent internal status updates.

In this case, they probably wanted to maximise coordination, so used the process designed for that.

lacoolj•41m ago
Yeah agreed. I actually only noticed because my two boxes are super slow and I've been troubleshooting for about an hour. Finally opened up the Customer Support page and this was the top incident.
dofm•13m ago
I am wondering if there is something significant written with Go in their system stack (Go uses MPTCP by default on listening sockets, it seems)
pugworthy•37m ago
Lately it seems like we need "hacks.ycombinator.com" as a new sub-list.
minimaxir•33m ago
Show Hacks:
keeganpoppen•31m ago
ironic that "hacks" is a needed subdomain of "hacker news"
optimalsolver•28m ago
Yeah it is, but everyone forgets this board was launched in the 90s for discussion of the 1995 movie "Hackers", not for discussion of hacking in general.
brian-armstrong•24m ago
I'm still holding out for the sequel
optimalsolver•19m ago
It would now be 120 minutes of some guy playing EVE or browsing porn while his agent does everything.
6thbit•23m ago
/incidents would do
paaloeye•36m ago
Even better CVE 10.0 has just dropped https://news.ycombinator.com/item?id=50310937
INTPenis•14m ago
Who uses Canonical LXD?

I never even heard of it.

paaloeye•7m ago
MicroCloud and some other product for sure
paaloeye•6m ago
MicroCloud for example, it's been actively pitched for smaller sites by Canonical
optimalsolver•36m ago
I mean, this situation is untenable. HN's front page is just going to be an endless list of breaches.

I don't see how web services proceed like business is normal.

peri-cl•23m ago
Introducing: HNN (Hacker non-news): a list of web domains *not* currently under apocalyptic AI attack. Shorter and more parsimonious.

- Tell HNN: pets.com was *not* owned today

- Tell HNN: about:blank was safe, too

- Show HNN: my new gopher protocol project—no currently known CVE 10's

mceachen•14m ago
gopher goes to 11

(archie and veronica are non-denumerable)

LtWorf•15m ago
Better than the usual endless stream of what your agent did today.
elashri•30m ago
@dang I would encourage you to really think about having security incident as a new HN tag. The wording can be better though.
downrightmike•25m ago
We can call it [SI]
entrope•18m ago
As long as we know that doesn't mean Systeme Internationale, Sports Illustrated or Super Intelligence.
gk1•15m ago
> Super Intelligence

I think that was the joke.

6thbit•24m ago
It feels like we hit an inflection point in the last week or so. Kind of a large tidal wave to crash on the coast, but likely not the tsunami yet. I hope.

If you are running services and don't yet have an easy way to react to these things with swift process defined, I hope you don't like to sleep.

lifeisloving•14m ago
Its really not that hard to secure your servers, especially if your not a high value target. If you are a high value target, you should have security professionals on staff.

I dont think my security posture is all that much different than it was last year. Use a Secret Manager and or encryption, have backups, strong firewall rules, use canaries of some kind.

If anything llms are making security worse because there's more people offloading their thinking on llms, or people that skipped some steps in their learning journey because they just ask the llm to do everything. I dont think its necessarily because attackers have llms now, but that contributes.

moscoe•6m ago
You are literally the everything is fine meme. I admire your confidence. I never realized it was so simple!
Arbortheus•20m ago
This reads to me that nothing has happened and they are just trying to patch stuff? Right?
nout•17m ago
All companies should at this point invest a lot of money into defensive AI. In ~July the AI hit crypto and bitcoin, where it's the easiest to extract the most money. Now the AI powered attacks are hitting infra and SaaS. Next (~December), it will hit classic infrastructure, banks, small businesses, etc. By mid next year, we will be over this hump with defensive AI being required part of everything.
jeremyjh•13m ago
Its already happening to classic infrastructure, small and medium size businesses. Absolutely anyone can summon a gremlin capable of exploiting stuff like this or the PHP thing last week. There are clankers probing this stuff all over the place within a day of it going public.
throwuxiytayq•9m ago
I find it breathlessly funny how people think it's going to be AIs vs AIs fighting it out with light sabers and plasma lasers in the cyber space or some shit.

Your intuition that this can be balanced out is wrong. When you have a CVE in your TCP stack, your vault unlocks and you're fucked, it's done. My dude, there is never going to be AIs scanning every incoming packet for signs of a 0day, and deciding whether to, uhh, cut it up with a lightsaber and shoot it with a laser pistol. Your options are to have a stack so secure that it can't be targeted, or to disconnect all network cables.

georgemcbay•18m ago
daily sticky post...

Ask HN: Who didn't get hacked today.

sublinear•15m ago
We need an "ai.ycombinator.com" too.