frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

sshole

https://sshhole.com
1588•josemrb•6h ago•433 comments

Alpine Linux Security Advisory: OpenSSH-server password authentication bypass

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
334•pantalaimon•3h ago•48 comments

Motorola Signature 27 with GrapheneOS support

https://motorolanews.com/motorola-signature-27-2/
192•monneyboi•2h ago•106 comments

September in Servo: <progress>, rounded rectangles, and more

https://servo.org/blog/2026/11/05/september-in-servo/
115•iamnothere•4h ago•27 comments

Launch HN: Rivet (YC W23) – Scale and Orchestrate Agents on S3

https://github.com/rivet-dev/rivet
20•NathanFlurry•1h ago•14 comments

Window Sweaters

https://github.com/saragordic/window-sweaters
38•nickswalker•1h ago•12 comments

My psychophysics as a bilateral cochlear implant user

https://claude.ai/artifact/L8qsMc3SorytGW3LA81nYf
79•mi-rae•2h ago•18 comments

The Lisp curse, now coming to your ecosystem

https://javahippie.net/programming/llm/2026/03/05/the-lisp-curse-coming-to-your-ecosystem.html
92•marcolinux•2d ago•64 comments

Bild AI (YC W25) Is Hiring Founding Product Engineers

https://www.ycombinator.com/companies/bild-ai/jobs
1•rooppal•1h ago

Download your favourite YouTube videos

https://criminallyvulgar.dev/you-should-absolutely-download-your-favourite-youtube-videos/
164•surprisetalk•5h ago•71 comments

The Stacks Project, Formalized in Lean

https://axiommath.ai/research/the-stacks-project-formalized/
33•namanbnsl•2h ago•5 comments

OpenSSH 10.6p2 Critical workaround for alpine without PAM

https://www.openssh.org/releasenotes.html#10.6p2
181•selckin•6h ago•9 comments

I wish tech companies knew more about me

https://rakhim.exotext.com/i-wish-tech-companies-knew-more-about-me
122•freetonik•4h ago•102 comments

Show HN: A decent text-to-image model trained for ~$20K (Apache 2.0 Weights)

https://www.linum.ai/field-notes/pjit-21k
50•schopra909•1d ago•4 comments

MCP Explained

https://mcp-explained.com/
165•rwilinski•4h ago•86 comments

Building a Multi-Agent System from Scratch: Architecture Patterns

https://kadhar.dev/blog/multi-agent-systems-from-scratch
32•kadharmfn•2h ago•11 comments

Obscure audio codec is a perfect fit for the N64

https://phoboslab.org/log/2026/11/n64-ulc-codec
130•frostbyte7•5h ago•8 comments

Nasdaq Sinks 5% as Investors Retreat from AI Trade After Election

https://www.wsj.com/livecoverage/stock-market-today-dow-sp-500-nasdaq-11-05-2026
42•armcat•39m ago•21 comments

We can do better than line-buffered output

https://nullprogram.com/blog/2026/11/05/
47•zdw•3h ago•3 comments

Nasdaq plummets 4% into correction territory

https://www.cnbc.com/2026/11/04/stock-market-today-live-updates.html
64•kristianp•1h ago•34 comments

GPT-6 Astra covertly underperforms on safety research

https://alignment.openai.com/misalignment-reports/covert-underperformance-on-safety-research-tasks/
198•lucrbvi•10h ago•93 comments

Baidu released ERNIE 5.5 Flash Base

https://ernie.baidu.com/release/ernie-5-5-flash-base/
146•pretext•9h ago•83 comments

Nordstjernen, Northstar, Southstar: minimalist webbrowsers in C and Rust

https://nordstjernen.org/
25•Propelloni•3h ago•17 comments

Show HN: Stroq – a local audit of what your coding agent did and why

https://github.com/AGGIB/Stroq
25•agybay_07•2h ago•6 comments

Lemmings CSS Animation

https://markblah.github.io/lemmings/
356•MarkBlah•13h ago•70 comments

Discord is ditching Electron and its new app uses less RAM

https://www.theverge.com/news/1027379/discord-ditching-electron-web-app
237•archb•5h ago•191 comments

Vibe Coding Keypad

https://www.keychron.com/products/keychron-f4-he-8k-vibe-coding-keypad
56•ta988•1h ago•32 comments

TextEdit vs. Pages

https://leancrew.com/all-this/2026/10/textedit-vs-pages/
68•surprisetalk•2d ago•49 comments

OCAP Bounded Authority: Edera's Managed Approach to Object Capabilities

https://edera.dev/stories/ocap-bounded-authority
21•virtio_vixen•2h ago•1 comments

Awesome repositories are no longer awesome

https://erikgahner.github.io/posts/2026/awesome-repositories-are-no-longer-awesome/
236•erikgahner•7h ago•110 comments
Open in hackernews

My gym forced a social media down my throat. So I reverse-engineered its app

https://shayon.work/blog/reverse-engineering-gym-pass
55•yewenjie•1h ago

Comments

willcate•54m ago
Wow. The QR code changing every 15 minutes... that's like trying to get into a rock concert. Well done
develoopest•45m ago
The QR changed every 15 seconds.
mywittyname•42m ago
15 seconds... And the standard for TOTP is 30 seconds. So it's not crazy compared to the standard. Though, there's really no reason for the codes to update so fast.
fyltr•33m ago
They are probably doing it to avoid account sharing?
ihsw•16m ago
This is the answer here, gyms across the country have implemented nearly identical functionality (bar codes or QR codes are required on entry, staff are trained to be aware of customers sharing or using shared screenshots of the above codes, and the codes have a very short lifetime.)
MattDamonSpace•41m ago
I find dissonance between “I hate these products” and “I’m going to freeride by eg blocking their ads”

I know the effect is negligible but isn’t that just stealing

jawilson2•37m ago
He's paying for the gym already?
dfxm12•35m ago
If you hate the app enough, you could see this as damaging them (consuming its resources without getting the ads). Even if it is negligible, it might feel good.
devmor•32m ago
If you provide a service expecting the user to interact with your service in the way you designed and they do not, that is a problem with your service, not theft.

It would be theft if the user was bypassing payment-gated credentials, but that is not the case here.

wvenable•31m ago
Going to bathroom during the commercials is also stealing. Or maybe it's not stealing. The argument quickly becomes more complicated the more you think about it.
bravoetch•14m ago
It becomes simple if you define stealing as having criminal legal consequences. Since there are none, it's not stealing.
Drupon•29m ago
>However, I’m super aggressive about social media and feeds I don’t control. Any app that shows me a feed I can’t turn off, sort, or filter—I take that as psychological warfare against me.

Is it just me or are people getting too stuck in a Manichean mindset about this kind of thing? This reads like an alcoholic complaining about a work happy hour or something. Just, don't use the social media stuff.

>For the longest time, my LinkedIn bio was “I HATE LINKEDIN.”

OP kind of just seems insufferable. Touch grass.

Bratmon•27m ago
Yeah, how DARE someone want to go to the gym without participating in social media?! What an absolute asshole!
flanz_10•24m ago
Both things can be true at the same time, lol.
itake•18m ago
Why do I even have to see it? It is designed to get me sucked in. Imagine if an sober alcoholic must see beer ads every time they open up amazon.com to go shopping.
alistairSH•9m ago
Just you, maybe.

I hate the "ubiquity" of social media. For me, it's not social media conceptually that's the issue, it's that Meta and others are not good companies. They exist by doing their best to get me addicted to their feeds. It's not healthy. Whether or not there's a non-harmful way to do social media is unknown (by me, at least).

b800h•24m ago
This person has too much time on their hands.
spiderice•7m ago
They said smugly, before continuing to scroll Hacker News
trevithick•24m ago
The bigger issue is that to use this gym, you must own a smartphone and you must bring it with you and carry it around while you work out.

We're just counting down to being unable to exist without a smartphone on your person at all times. What a dystopia.

esseph•16m ago
A bank in Japan just blocked website access for account tasks. MUST use a phone with their app.

I posted about it yesterday, I think.

pc86•15m ago
Don't worry, smartphones are cheap, can be easily upgraded by the user, and last for a decade or more before needing upgrade or replacement.

Right?

mywittyname•9m ago
I've taken to using the dumb, low-tech option where possible to try to push back on our techno-dystopian future. Printing out boarding passes, using cash, asking for menus at places with QR codes on the napkins, etc.

Unfortunately, I think it's already impossible to attend major events without a phone, at least if it's a major event at a stadium. Smaller venues still send out emails with QR codes we can just print out.

diath•6m ago
It's quite impossible to actively participate in modern society without a phone anyway. And it's a personal business either way, you can choose another gym. I'm glad mine does QR entry because thanks to that it's open 24/7/365 when there's no staff, even during holidays like Christmas. You can just go anytime that's convenient for you, so it's a trade-off I'm willing to make.
otter-in-a-suit•21m ago
What's with all the negative comments here? I thought this was a reasonably interesting article about _actually hacking something_, whether this person needed to or not. You know, like in "HackerNews"?
mywittyname•13m ago
I was going to post something positive, but it amounted to "good job, this is a clever way to use AI to improve your quality of life." But it seemed too basic and wouldn't serve as the nucleus for a discussion, so I didn't post it.

Being negative gives people something to talk about.

blue_green_maps•17m ago
This is the future of software with AI: everyone can have hyper-personalized software to solve very personally-specific problems.
smusamashah•17m ago
Another solution could have been to run something like Tasker or Automate to launch app, take QR from current activity (this is the main part) and display just that and once you are done, dismiss the rest of the app.
throwaway89201•16m ago
Somewhat relatedly: did you know that the "RSA Authenticator (SecurID)" app only tries to detect Frida / ptrace hooks for the first few seconds of its runtime, after which it loads the symmetric OTP secret into memory? Now you do.
alistairSH•16m ago
Does Android not have a "wallet" feature? My gym does the app-based QR code for entry, but on Apple, I just add that app to my wallet and the QR appears there, I only need to access the app proper to check class and pool schedules.
esseph•15m ago
Of course it does.

https://wallet.google/

RobotToaster•12m ago
Yes it does, I use it for my Gym's barcode and NFC login.
elAhmo•16m ago
Just change your gym bro, not worth supporting this behaviour.
nancyminusone•15m ago
>it prompts you to post a story of your session

An excellent portal to accept a fictionalized ai slop version of "your" experience. Make it long, and maybe put a recipe at the bottom.

lenerdenator•10m ago
Marketers need to realize that it's rude to not compensate people for those people helping with marketing.

I think a story of how you saw a dude drying off his gluteal cleft with the hand dryers in the locker rooms would be an appropriate "experience" if the payment is nothing.

eterm•15m ago
This is dated today but I could have sworn I read a similar story here a few years ago about hacking their gym's QR code, but I can't now find it on algolia.

Update: It was hard to find because it was titled, "I accidentally became PureGym’s unofficial Apple Wallet developer"

https://news.ycombinator.com/item?id=44910865

drnick1•14m ago
I like that you took matters into your own hands, but here my preferred approach would have to approach management and request an alternative access method. I do have separate profiles on my GOS phone for this kind of situations, but I have been on a crusade against phone apps for years now.

I similarly reject apps and QR menus in restaurants, airlines, etc. If you can't be bothered to give me a paper menu, I can't be bothered to eat in your establishment.

paimapi•10m ago
Yeah, I'd even leverage the fact that you work in software to make a note about how deeply invasive this is and how much it opens up unnecessary surface areas to attacks.
QuercusMax•13m ago
Building your own AES implementation is pretty insane and obvious a bad idea...
joshstrange•9m ago
Years ago when I went to Planet Fitness I didn't like their app and it was slow to load the barcode I needed to scan to get in. Thankfully that barcode didn't rotate so I was able to just make my own Apple Pass and set it up to be geo-fenced on the gym so as I walked up it would pop up as a notification I could tap to open my code.

I love being able to do things like this and rip out the crap being forced down our throats.

mywittyname•7m ago
I spent 30 minutes trying to get my friend's "visitor pass" to work for me, before giving up.

The person at the front desk was absolutely no help and could have been replaced with a sign that said, "you can do everything in the app."

hk__2•6m ago
> To be clear, I’m leaving out some details to keep the gym and myself anonymous

For the last part, it’s maybe not the best idea to put a link "GitHub & CV" at the bottom then ;)

SoftTalker•6m ago
My gym issues an NFC keyfob you scan at the turnstyle (and at the door, after hours). I keep it clipped to a lanyard on my gym bag so I don't forget it or lose it.
wahnfrieden•31m ago
No
delecti•30m ago
TFA doesn't mention advertising in relation to the specific app in question, nor does it imply that it even has ads. The only mention of it is a broader "I don't like social media because of the ads".
tensor•29m ago
I always pay to remove ads. I only block if I'm left with no option to pay. You might consider it stealing, but I consider forced ads as psychological warfare, so on the whole I feel I'm in a morally fair place.
g0ld3nrati0•23m ago
no
nancyminusone•22m ago
Guess I will steal then.
0c3ca83•20m ago
No. But failing to loudly protest gives these companies license to continue.
bravoetch•17m ago
> I know the effect is negligible but isn’t that just stealing

No. They pay for a gym membership, there is literally nothing to steal from the social media feed in the door-unlocking app.

alistairSH•8m ago
I assume he's paying a gym membership. IMO, that membership (across all members) should be sufficient to pay for the gym to operate. If not, that's the problem.
vlyan•7m ago
yes, just like you're stealing from the supermarket when you buy real food (low to no markup) instead of corn-syruped artificially-flavored slop, alcohol, and cigarettes (high to obscene markup). every time you leave the store without a bag of Doritos, a bottle of MtDew, and a pack of Marlboro, you're being a bad citizen.