# hacker news Published articles for hacker news. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## The Zero-Budget AI Launch Playbook: 80% of Your Launch Happens Before Launch Day DevFeed: [The Zero-Budget AI Launch Playbook: 80% of Your Launch Happens Before Launch Day]() Original publisher: [Read original article]() Author: Elsa Published: 2026-11-06T08:46:37Z Content type: article Language: en Sources: [HackerNoon]() Topics: [Product Management](), [Artificial Intelligence](), [Instagram]() Tags: [account](), [ads](), [ai](), [ai-companion](), [ai-music](), [ai-products](), [ai-search](), [ai-tools](), [alternatives](), [analysis](), [app](), [article](), [articles](), [atmosphere](), [budget](), [growth-hacking](), [hacker-news](), [how-to-launch](), [how-to-launch-a-product](), [launch](), [marketing](), [organic-growth](), [product](), [product-launch](), [reddit](), [startups](), [zero](), [zero-budget-marketing]() ### AI overview The article argues that most launch work should happen in the 90 days before launch: build trust and an audience by sharing useful material before asking people to try the product. It treats Product Hunt as an optional credibility badge whose ranking depends on an existing user base and may bring limited returns; Hacker News rewards months of thoughtful participation, reputation, and interesting contributions; Reddit can work through fair comparisons in small niche communities, helpful link-free comments, and consistent value-first posts, but promotional tactics risk removal or bans. A low-cost example pairs a data product with a publication based on its insights, then gathers readers in a community, invites them to beta, and launches after they are engaged. The checklist recommends starting community participation months early, building recurring content and a mailing list or private community, opening a small beta, and replying to launch-day comments. These are the author's experiences and recommendations in Part 1; the excerpt says Part 2 covers other channels. ### Source excerpt No ad budget? Here is how I'd launch an AI product using Reddit, Hacker News and Product Hunt, and why 80% of the work happens before launch day. ## Building a little browser game to practice Vim commands DevFeed: [Building a little browser game to practice Vim commands]() Original publisher: [Read original article]() Author: Anne Barela Published: 2026-11-04T16:08:29Z Content type: article Language: en Sources: [Adafruit Industries]() Topics: [browser-game](), [Vim]() Tags: [browser-game](), [hacker-news](), [programming](), [software](), [vim]() ### AI overview Duy Hua's free browser game lets you practice selected Vim skills by making small edits in an in-page Vim editor. Each skill has two guided edits, two prompted edits, and two independent edits; any valid edit that reaches the target text passes. You can type :help in Normal mode to see the available commands. It requires a desktop browser and physical keyboard, needs no account, and stores no data. ### Source excerpt Duy Hua built a browser game for practicing Vim commands, and posted it to Hacker News. Vim is the modal text editor where keystrokes like dw and ci" do the editing, and the commands take practice to learn. You pick the skills you want to work on, then make small real edits in a Vim [...] ## Introducing Vercel Schedules DevFeed: [Introducing Vercel Schedules]() Original publisher: [Read original article]() Author: Elliot Dauber Published: 2026-11-04T13:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [control-plane](), [Tool]() Tags: [agent](), [agents](), [ai](), [ai-sdk](), [api](), [application](), [applications](), [cli](), [code](), [create](), [cron](), [custom](), [database](), [deploy](), [deployments](), [environments](), [functions](), [hacker-news](), [schedules](), [vercel]() ### AI overview Vercel Schedules lets applications and agents create, change, or cancel one-time and recurring work while an app is running, without redeploying. Static schedules live in `vercel.json` or Build Output API configuration and sync on deployment; they can target private functions, HTTP paths, or Queue topics. Dynamic schedules are managed at runtime through the JS SDK, CLI, or API, and deliver work through Queue topics. In the agent example, a due schedule sends a saved request to the app, which checks current user permissions before starting the agent. Recurring jobs can invoke private functions directly, with Vercel checking that calls come from its scheduling service. Teams can test jobs locally, on Preview deployments, or in custom environments, and manually run schedules from the project's Schedules tab. The excerpt says the service is in Public Beta. ### Source excerpt Cron jobs are useful for work that needs to happen regularly. You can use them to do things such as back up your database on a schedule, or keep data in sync between two systems. You define them once in code and then can update them by editing their config and redeploying. But today, agents interact with users as work evolves, and schedules need to be updated in real time. We built Vercel Schedules to allow agents and applications to create, change, or cancel one-time and recurring schedules through code, without redeploying. What are Vercel Schedules? Schedules builds on the static approach used by Vercel Cron Jobs, but are designed to let users and agents decide when work should happen while your application is still running. A schedule tells Vercel when to trigger a task and where to send it. Your application provides the code that carries out the work. You can use schedules for both static and dynamic jobs: Static schedules keep the timing in vercel.json or Build Output API configuration and sync when you deploy. You can use them to call private functions or HTTP paths, or send messages to Queue topics. Dynamic schedules let your app create and manage schedules through the JS SDK, CLI, or API as it runs. They support one-time and recurring work through Queue topics. You can also test scheduled work on Preview deployments and in custom environments before running it in Production. How Schedules works Take this example: A user could ask an agent with web access, "Tomorrow morning, summarize the top five stories on Hacker News." The traditional solution would be storing the request and its schedule time in a database, then using a cron job to check for work that is due. With Schedules, an agent can create a schedule that records the request and when to run it, without a separate database and polling job. The example below defines an AI SDK tool that gives an agent this capability. When the task is due, Vercel uses Queues to deliver the saved request to your app. Yo ## How I Built an AI-Powered Hacker News Book Recommendation Site in 2.5 Hours DevFeed: [How I Built an AI-Powered Hacker News Book Recommendation Site in 2.5 Hours]() Original publisher: [Read original article]() Author: Ishank Choudhary Published: 2026-11-04T08:53:43Z Content type: article Language: en Sources: [HackerNoon]() Topics: [GitHub Pages](), [Tool](), [Claude Code](), [rate-limiting]() Tags: [ai](), [ai-coding](), [amazon](), [api](), [api-key](), [apis](), [blindsight](), [books](), [claude](), [claude-code](), [claude-sonnet](), [claude-sonnet-5-5](), [cost](), [cursor](), [data](), [dataset](), [hacker-news](), [hacker-news-books](), [hackertube](), [karpathy](), [llms](), [programming](), [time]() ### AI overview HackerShelf applies HackerTube's crowd-signal method to book recommendations in Hacker News comments. It scanned 9.44 million comments from January 2024 to August 2026, used DuckDB filters to reduce candidates to 11,519, Gemini extraction to identify 6,076 mentions, and Open Library matching plus a three-people/three-month threshold to produce 151 books. The static GitHub Pages site contains 723 mentions from 601 recommenders across nine categories. The build took about 2.5 hours wall-clock, with roughly 40 minutes spent coding in Cursor; most remaining time went to API calls and rate limits. Gemini's free tier cost $0, though the author estimates about $2.15 at listed token rates and does not know Cursor's cost. Limitations included a wrong Open Library match for 1984 and 470 paraphrased quotes that were removed. A spot-check of 10 books and 83 mentions found the authors correct and quotes verbatim. ### Source excerpt Karpathy built HackerTube in about 2 hours with Claude Code. I rebuilt it for books with Cursor. Here's my honest time, cost, and everything that broke. ## HackerTube DevFeed: [HackerTube]() Original publisher: [Read original article]() Author: Ben Published: 2026-11-02T20:17:51Z Content type: article Language: en Sources: [Adafruit Industries]() Topics: [recommendation systems]() Tags: [agent](), [algorithm](), [browser](), [claude](), [clone](), [content](), [custom](), [data](), [forum](), [hacker-news](), [hackertube](), [local](), [quality](), [recommendations](), [state](), [thumbnail](), [uncategorized](), [user](), [uses](), [videos](), [youtube]() ### AI overview HackerTube is a YouTube clone limited to videos suggested on Hacker News, created after Andrej Karpathy expressed frustration with YouTube's algorithm. The text says it uses a custom "ForYou" recommendation system without user accounts, keeps state in the local browser session, offers keyboard shortcuts, uses a "50% thumbnail" instead of uploaded thumbnails, and lets users export site data to help an agent create a version of the site. ### Source excerpt Frustrated with YouTube's algorithm, Andrej Karpathy asked Claude to whip up HackerTube. HackerTube is a clone of YouTube but only has the videos suggested on the Hacker News forum. HackerTube: Contains quality content Uses the 50% thumbnail instead of the uploaded thumbnail Custom and good ForYou recommendations without any user accounts, storing state in local [...] ## How to Build Your Own Always-On AI Agent DevFeed: [How to Build Your Own Always-On AI Agent]() Original publisher: [Read original article]() Author: OpenRouter Published: 2026-10-31T00:00:00Z Content type: tutorial Language: en Sources: [OpenRouter]() Topics: [AI Agent](), [human in the loop agent](), [Agent Harness](), [AI Context Management](), [Tutorial]() Tags: [agent](), [agent-sdk](), [agents](), [ai](), [ai-agent](), [always-on-ai](), [build](), [hacker-news](), [how-to](), [openrouter](), [schedule](), [tools](), [tutorial](), [typescript]() ### AI overview The tutorial builds a scheduled Hacker News watcher in TypeScript with `@openrouter/agent` 0.11.0. It searches for recent stories matching chosen topics, filters previously seen IDs, writes relevant results to a digest, and can request approval before posting to a team channel. Persistent files store seen stories and resumable conversation state; a scheduler runs fresh checks while unfinished or approval-paused runs resume first. Each run is bounded by six steps or $0.05, with an API key credit limit recommended to cap overall spend. In the reported Claude Haiku 5.5 runs, checks cost $0.0003-$0.0012; the SDK may make a call or two beyond a stop threshold before its closing response. Approval pauses all scheduled checks until a decision is recorded, and a failure after writing a digest can cause duplicate entries. The guide also describes running the script under a process manager or scheduled job with persistent storage. ### Source excerpt An always-on AI agent wakes up on a schedule, checks something with tools, and reports or acts without you asking. This tutorial builds one in TypeScript with the OpenRouter Agent SDK that watches Hacker News, remembers what it has seen across restarts, stops any run at five cents, and waits for your approval before it posts. ## dbreunig/nesformer DevFeed: [dbreunig/nesformer]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-10-30T21:59:22Z Content type: news Language: en Sources: [Simon Willison's Weblog]() Topics: [Emulator](), [Generative AI]() Tags: [6502](), [ai](), [ai-2-304](), [ai-llms](), [build](), [conformance-suites](), [conformance-suites-12](), [drew-breunig](), [drew-breunig-22](), [emulator](), [games](), [games-26](), [generative-ai](), [generative-ai-2-044](), [hacker-news](), [llms](), [llms-2-009](), [mario](), [nes](), [nintendo](), [opus](), [opus-5-5](), [qwen](), [qwen-63](), [qwen3-5](), [super-mario-bros](), [tests]() ### AI overview Drew Breunig's nesformer embeds a working NES 6502 CPU emulator in Qwen3.5-4B's weights, allowing it to run ROMs such as Super Mario Bros, but very slowly. The project was inspired by qwenputer and built after prompts asked Opus 5.5 to explore whether a NES chip and RAM could be emulated this way, consider model size and speed, then create weights and a command-line tool that accepts a ROM. The account says Opus used Christopher Pow's NES CPU conformance tests. ### Source excerpt dbreunig/nesformer Inspired by qwenputer by Divyansh Agrawal, Drew Breunig baked a working emulator for a Nintendo Entertainment System 6502 CPU into the weights of Qwen3.5-4B. You can now play NES ROMs such as Super Mario Bros (very slowly) running inside Qwen! In a comment on Hacker News Drew reveals the Opus 5.5 prompts he used to build this system: Read this article and any relevant source code: https://divagr.com/blog/qwenputer. Then explore if you could emulate the chip and ram in a Nintendo Entertainment System (as people do today with FPGAs in MISTRs) using this technique. If so, what size model would you have to build and if you could use smaller faster ones, could you get it to be at the standard clockspeed. Followed by: I think we should build it! Just for fun. It's okay if it's not fast. We want to be able to have the weights, and a cli to run them that we can point at a ROM. Apparently Opus found and then used this collection of conformance tests for the NES CPU released 15 years ago by Christopher Pow. Via Hacker News Tags: games, ai, generative-ai, llms, drew-breunig, qwen, conformance-suites ## This Week in Security: Broken Embargoes, UEFI Overflow, Wormable Tailscale, Starlink Ad Snooping, and a DHS Directory Dump DevFeed: [This Week in Security: Broken Embargoes, UEFI Overflow, Wormable Tailscale, Starlink Ad Snooping, and a DHS Directory Dump]() Original publisher: [Read original article]() Author: Mike Kershaw Published: 2026-10-30T14:00:29Z Content type: news Language: en Sources: [Hackaday]() Topics: [Security](), [tailscale](), [Cryptography](), [Memory Safety](), [Critical Infrastructure](), [AI Chat]() Tags: [1-5](), [batch](), [bugs](), [certificates](), [dhs](), [directory](), [dump](), [hackaday-columns](), [hacker-news](), [kernel](), [linux](), [linux-kernel](), [news](), [php2shell](), [public](), [quad9](), [security](), [security-hacks](), [starlink](), [tailscale](), [this](), [this-week-in-security](), [tlp](), [twis](), [uefi](), [us](), [volt-typhoon]() ### AI overview The week's reports show how security failures compound when disclosure, access control, or data retention breaks down. Akamai urges defenders to deploy protections and notify customers privately before publishing exploit details; the article says the `php2shell` aftermath saw exploitation attempts before many administrators knew of a patch. A UEFI PXE buffer overflow can enable pre-boot code execution on network-booting servers; local-disk-only systems are unaffected, and the text recommends checking firmware vendors or disabling unused PXE. Tailscale findings describe root-level SSH forwarding flaws that could let a compromised device spread within its permitted network; suggested mitigations include per-device SSH rules, disabling forwarding, and expiring server node keys. Other reports cover delayed certificate revocation, vulnerable embedded TLS implementations, router-based intrusion chains, ad-bidding location exposure, and breaches of tipster and DHS records. Across these cases, the text highlights practical limits: fixes depend on vendors and operators, and retained or broadly exposed data can create lasting risks. ### Source excerpt Last week brought us at least two broken embargoes: php2shell leaked onto Hacker News a day early, and a batch of Linux kernel bugs landed on the public kernel mailing ...read more ## Anthropic Says Nobody Needs a Mental Model of Claude Code. Practitioners Are Testing That DevFeed: [Anthropic Says Nobody Needs a Mental Model of Claude Code. Practitioners Are Testing That]() Original publisher: [Read original article]() Author: Steef-Jan Wiggers Published: 2026-10-29T09:58:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Claude Code](), [Code review](), [anthropic](), [Claude](), [Pull Request](), [AI Integration Strategies](), [code analysis](), [generative-ai-tools]() Tags: [agent](), [ai](), [ai-ml-data-engineering](), [anthropic](), [anthropic-code-review](), [architecture-design](), [claude](), [claude-code](), [code-review](), [code-reviews](), [culture-methods](), [development](), [hacker-news](), [ml-data-engineering](), [news](), [pull-request]() ### AI overview Anthropic's Claude Code team aims for most pull requests to merge with at most one human reviewer, while Claude writes about 90% of Claude Code. The excerpt describes risk tiers: low-risk changes can merge without human approval, medium-risk changes need one person, and an agent's approval does not count as a person's. The author of a change can count as the required human reviewer. The team uses Claude-written explainers for codebase slices instead of expecting anyone to hold a complete mental model. Its review process has limits: one machine-authored pull request went through more than 50 rounds before being stopped, and the team capped review rounds after more rounds worsened the problem. About 59% of repeatedly flagged code predated the reviewer's first pass. The team says it lacks circuit breakers to tighten approvals when review metrics shift. The excerpt also notes that the open-source security review GitHub Action is not hardened against prompt injection and should be used only on trusted pull requests. ### Source excerpt Anthropic has published how the Claude Code team reviews code now that Claude writes roughly 90% of it, including a claim that nobody keeps a complete mental model of the codebase. The post documents a pull request that ran more than fifty review rounds overnight, a reviewer spending most of its effort on pre-existing code, and a control the team says it does not yet have. By Steef-Jan Wiggers ## This open-source keyboard lets you snap keys together in any layout DevFeed: [This open-source keyboard lets you snap keys together in any layout]() Original publisher: [Read original article]() Author: Zo Ahmed Published: 2026-10-28T15:06:00Z Content type: news Language: en Sources: [TechSpot]() Topics: [keyboard](), [Open Source](), [3D]() Tags: [aerospace](), [battery](), [bluetooth](), [bus](), [chip](), [circle](), [circuit](), [diy](), [electronics](), [firmware](), [hacker-news](), [hub](), [i2c](), [idea](), [keyboard](), [keys](), [layout](), [magnetic](), [magnets](), [open-source](), [project](), [risc-v](), [snap](), [tech-culture]() ### AI overview Keybytes gives each keyboard key its own small circuit board and CH32V003 chip; magnetic cases and spring-loaded pogo pins connect keys to each other and to a hub. Each key uses separate bit-banged I2C links on its four edges, which the creator says reduces parasitic capacitance and lets software identify key positions. The hub handles Bluetooth, firmware storage, charging and USB-C. The open-source files include schematics, PCB designs, case models and a bill of materials under an MIT license. The current demo has two keys and a hub, with layouts limited to a flat grid while more modules and firmware are in progress. The creator estimates a full-size, roughly 110-key build with two hubs at about $900, nearly half for pogo pins. ### Source excerpt The project comes from Nathan Alspaugh, an MIT freshman studying aerospace engineering, who said he has spent around 100 hours working on it since March. When he posted the project to Hacker News this week, he said the idea came from his frustration that nobody sold triangle- or circle-shaped keyboards. Read Entire Article ## GPT-6.1 Terra DevFeed: [GPT-6.1 Terra]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-10-26T23:53:07Z Content type: release Language: en Sources: [Simon Willison's Weblog]() Topics: [Frontier AI](), [Artificial Intelligence](), [gpt-6-astra](), [ChatGPT API]() Tags: [ai](), [ai-2-295](), [announcement](), [api](), [communication](), [comparison](), [computer-use](), [cost](), [fast](), [faster](), [frontier](), [generative-ai](), [generative-ai-2-036](), [gpt](), [gpt-134](), [gpt-5-6](), [gpt-6-1](), [gpt-6-1-sol](), [gpt-6-1-terra](), [gpt-6-astra](), [gpt-6-luna](), [grid](), [hacker-news](), [half](), [llm-pricing](), [llm-pricing-95](), [llm-release](), [llm-release-239](), [llms](), [llms-2-001](), [openai](), [openai-477](), [pelican-riding-a-bicycle](), [pelican-riding-a-bicycle-155](), [ted-sanders](), [terra]() ### AI overview GPT-6.1 Terra is positioned as a midrange model focused on technical communication, visual reasoning, and computer use. OpenAI describes it as faster and more efficient than its predecessor, with clearer writing; Ted Sanders says it is probably better than Astra and Sol at technical communication, similar in vision and computer use but much faster, and somewhat weaker at most other tasks. The author suggests it may suit repetitive computer-use work and API developers seeking a cheaper option than Sol with stronger vision, computer use, and communication than Luna. Pricing is listed as $1 per million input tokens and $5 per million output tokens--almost half the rates of GPT-5.6 Terra and GPT-6.1 Sol, and around ten times GPT-6 Luna. The excerpt characterizes the release as a modest option for subscribers seeking clearer communication, faster computer use, or more room under usage limits. ### Source excerpt GPT-6.1 Terra It's always interesting to note which aspects of a new model are emphasized in the release announcement. In the case of GPT-6.1 Terra, OpenAI went with visual reasoning and computer use: We're introducing GPT-6.1 Terra, a fast, efficient model that combines detailed visual reasoning and precise computer use alongside clearer, more natural writing. A significant step up from GPT-5.6 Terra, it excels at the communication and computer-based tasks that fill the workday, from drafting proposals and interpreting technical drawings to filling out forms and editing videos. Terra sits in the same position as Sonnet in the Anthropic model collection - not the cheapest or the most expensive, making it harder to decide when to use it. Computer use is a good example of a task that benefits from a less expensive model, since you might put it to work on automated, repetitive tasks. OpenAI's Ted Sanders provided some useful advice in a comment on Hacker News: In the case of GPT-6.1 Terra, I'd say Terra is probably better than Astra and Sol at technical communication, similar on vision and computer use (but much faster!), and a bit worse on most other things. For API developers, it's a nice midrange option if you want something cheaper than Sol but a lot smarter than Luna (especially for vision / computer use / communication). For subscribers, it's not a bombshell release - if you're hitting usage limits, maybe it helps you go a bit further, and if you want clearer communication or faster computer use, it can be a nice option to select. Here are the pelicans for the different reasoning levels. This pelican for "max" cost 11.3161 cents and took 4 minutes and 11 seconds: Here's a new comparison grid showing pelicans for every reasoning level of OpenAI's current frontier lineup: GPT-6 Astra, GPT-6.1 Sol, GPT-6.1 Terra, and GPT-6 Luna. GPT-6.1 Terra is priced at $1/million input tokens and $5/million output - almost half the price of GPT-5.6 Terra and GPT-6.1 Sol, and arou ## A few hours on the Hacker News front page DevFeed: [A few hours on the Hacker News front page]() Original publisher: [Read original article]() Published: 2026-10-26T22:47:21Z Content type: article Language: en Sources: [Personal blog of Anurag Bhatia]() Topics: [observability](), [Hugo](), [static-site-generator](), [TTL in DNS]() Tags: [2026](), [akamai](), [bgp](), [bgp-routing](), [blog](), [blog-post](), [cdn](), [devops](), [dns](), [email](), [event](), [hacker-news](), [hugo](), [infra](), [ipv4](), [ipv6](), [mirror](), [prometheus](), [rfc](), [rfc8950](), [routing]() ### AI overview A blog post about RFC 8950 drew a brief surge after appearing at #28 on Hacker News. The author attributes the link's timing as likely related to an Akamai and IPv6 talk at VNIX-NOG, then noticed Prometheus alerts for heavy CDN-node traffic at 3 a.m. The post received over 10,000 visits during the alert period and about 40,000 while on the front page, including visits from Hacker News mirrors. The Hugo site runs across five servers in Mumbai, the US and Europe; self-hosted PowerDNS directs visitors toward a nearby node, and NGINX serves locally stored pages plus static files cached for a day from a Backblaze B2 origin via an S3 NGINX Gateway. The author says the setup handled the traffic well. ### Source excerpt Background Earlier this month, one of the blog posts on this blog came to the first page of Hacker News. It was early hours of 17 Oct when that happened. I was in Vietnam and actually a day before that had a long day at VNIX-NOG 2026. During the event, Cidy Yang from Akamai gave a talk on Akamai and IPv6 (slides here). During the talk, she mentioned RFC 8950 - routing IPv4 over IPv6 sessions. In her talk, Slide 14 was interesting. I ended up tweeting that, along with a context link to my own blog post which I published in June 2026. RFC 8950 at Akamai :-) For those who may not know it's gives you ability to announce IPv4 routes over IPv6 BGP sessionshttps://t.co/pLMu6L1izn pic.twitter.com/Pp1F5fSi8E -- Anurag Bhatia (@anurag_bhatia) October 16, 2026 Someone picked it up and posted the link on Hacker News. I strongly doubt it was a coincidence that someone picked it up that same day. It was likely a result of that talk. I was back in my hotel room and crashed early. There was an outing planned for early the next morning. At 3 am I woke up with a couple of alerts triggered via Prometheus due to high visitor traffic on all my CDN nodes. I put this alert rule in place months ago when some large scraping was happening & was curious to get alerted. I looked around; there were over 10,000 visits on that post, and as I looked around, I found this: My post was on #28 on the front page of Hacker News. 😀 Traffic and infra The post stayed on the front page for a few hours before dropping to page 2, where it remained for a while. This brought very high traffic by the standards of this blog. Most posts here are about BGP routing, DNS or DevOps stuff. These are niche topics, so traffic is usually low. Served around 40,000 visits while the post was on the first page. This includes traffic from Hacker News and from websites that mirror its content. Some of them also send summaries by email. This blog itself is a Hugo based stateless site. I ran it on WordPress between 2008 and 2022. ## php2shell: What We Know About the Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) DevFeed: [php2shell: What We Know About the Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)]() Original publisher: [Read original article]() Author: matthewsu@checkpoint.com Published: 2026-10-21T13:46:30Z Content type: news Language: en Sources: [Check Point Blog]() Topics: [cve remediation](), [Security research](), [Memory Safety]() Tags: [2026](), [check-point](), [code-execution](), [critical](), [cve](), [cve-2026-109618](), [cve-2026-109619](), [execution](), [hacker-news](), [php](), [php2shell](), [rce](), [release](), [remote-code-execution](), [screenshots](), [security](), [social-media](), [vulnerabilities](), [watchtowr]() ### AI overview PHP announced two critical vulnerabilities, each rated CVSS v4.0 9.2, with an out-of-cycle release scheduled for October 21 at 14:00 UTC. Researchers report remote code execution in the PHP interpreter, but PHP has not confirmed affected versions or technical details; there is no official workaround, and in-the-wild exploitation had not been reported in the excerpt. Prepare by inventorying PHP instances, staging updates, and prioritizing internet-facing systems when fixes arrive. PHP patches supported branches 8.2-8.5; older installations may need a vendor backport, upgrade, or isolation. The excerpt recommends restarting PHP-FPM or the web server after patching and checking the running version. Until fixes are available, monitor for suspicious multipart POSTs, worker crashes, shell spawning, new webroot files, and unexpected outbound traffic. Network protections may reduce risk but do not replace patching; blocking multipart requests can disrupt legitimate uploads, and uninspected encrypted traffic can bypass network signatures. ### Source excerpt What happened? On October 20, a post on Hacker News claimed that two critical remote code execution (RCE) vulnerabilities in PHP - tracked by researchers as CVE-2026-109618 and CVE-2026-109619 - would be publicly disclosed on Thursday, October 22, before any patch was available. The post was taken down, but screenshots had already spread across social media. Researchers at watchTowr then confirmed the leaked information was real and that the flaws were under embargo, and reported reproducing CVE-2026-109618. That evening (19:33 UTC), the PHP security team published an advance notice of an out-of-cycle security release for two critical vulnerabilities, both rated [...] The post php2shell: What We Know About the Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) appeared first on Check Point Blog. ## Redesigning source control at Anthropic DevFeed: [Redesigning source control at Anthropic]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-10-13T23:00:06Z Content type: article Language: en Sources: [Simon Willison's Weblog]() Topics: [version-control](), [Pull Request](), [CI/CD]() Tags: [agentic-engineering](), [agentic-engineering-66](), [ai](), [ai-2-279](), [anthropic](), [anthropic-348](), [branch](), [code-review](), [generative-ai](), [generative-ai-2-021](), [git](), [git-58](), [gpt](), [hacker](), [hacker-news](), [llms](), [llms-1-987](), [migrations](), [migrations-15](), [sandboxes](), [version-control](), [version-control-13]() ### AI overview Anthropic developed Scion, a custom source control system, after its code change rate rose sharply. The article describes Scion's scale, its migration from Git, and the team's use of adversarial review with Claude, including the need for engineers to steer the model away from over-engineering. ### Source excerpt Redesigning source control at Anthropic Interesting piece from Anthropic describing why and how they built their own custom alternative to Git, based on the dramatic increase in rate of changes to their code after the past six months. In May 2026, Anthropic averaged around 2,500 code changes merged per day; as of September, we merged over 30,000 per day. They included a chart showing those changes. I had Claude modify their chart (code here) to add markers for the public releases of each of their models in 2026: This shows public release dates, not the date when models became available for Anthropic's internal use. My guess is that the introduction of Fable/Mythos class models is a key factor in the increased coding velocity. "Antique" is their new code review system. The source control system is called Scion, and sounds to me like a reinvention of centralized source control along the lines of Subversion. They had some pretty extreme requirements: The history of our main branch alone is almost 100 GB, and a compressed working copy is over 25 GB. We perform on the order of 25 million code checkouts per day for CI, before counting developer environments, agent sandboxes, and research jobs. Fetched naively, that would be over 600 PB of git traffic per day. The new system was built by a team of seven people, and the migration from Git was completed in five months. When asked on Hacker News about the lack of offline support, Scion engineer Nick G replied: Since Claude is by far the heaviest user of Scion and is necessarily online, this just wasn't important to do. As an aside, I've been trying adversarial review in my own projects recently, where you have a model try and find flaws (I often play Claude and GPT off against each other). This note from the article reflected my own experience with that: Anthropic also makes extensive use of adversarial review, and, while this is incredibly effective in many ways, it can also be myopic, so skilled engineers needed to steer Cl ## Introducing Mistral Large 4: Le chonk DevFeed: [Introducing Mistral Large 4: Le chonk]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-10-06T20:18:19Z Content type: news Language: en Sources: [Simon Willison's Weblog]() Topics: [Large Language Model](), [Frontier AI](), [LLM evaluation / benchmarking]() Tags: [ai](), [ai-2-267](), [blackwell](), [generative-ai](), [generative-ai-2-010](), [gpus](), [grace-blackwell](), [hacker-news](), [llm-release](), [llm-release-234](), [llms](), [llms-1-976](), [mistral](), [mistral-68](), [nvidia](), [pelican-riding-a-bicycle](), [pelican-riding-a-bicycle-147](), [preview](), [release]() ### AI overview Mistral has released a preview of Mistral Large 4, a 1 trillion parameter model with 49 billion active parameters, trained on 3,800 NVIDIA Grace Blackwell GPUs. The preview is available through Mistral's API, with open weights promised for the end of the month. The model offers "none" and "high" reasoning levels; the article notes its Artificial Analysis score and compares it with DeepSeek 4.1 Flash and Mistral Large 3. ### Source excerpt Introducing Mistral Large 4: Le chonk Mistral are back in the game. Today they're releasing a preview of Mistral Large 4, a 1 trillion parameter, 49 billion active parameter model trained on their own cluster of 3,800 NVIDIA Grace Blackwell GPUs. The preview is available via their API. They promise to release the open weights model at the "end of this month". The model only supports two reasoning levels - "none" and "high" - via the Mistral API. Here are both pelicans - the "high" one looks better, though surprisingly it only used 2,717 output tokens compared to "none" which used 3,275: On Artificial Analysis it scores 38, just behind DeepSeek 4.1 Flash, which is a 552B model. It's a huge improvement on last December's Mistral Large 3, which drew this terrible pelican and scored 9 on AA. It's certainly not a Fable-class model, but it's great to see Mistral put out a model that's back to being maybe about 6 months behind the frontier. Via Hacker News Tags: ai, generative-ai, llms, mistral, pelican-riding-a-bicycle, llm-release ## 5 Jev use cases for analytics, with real queries and datasets DevFeed: [5 Jev use cases for analytics, with real queries and datasets]() Original publisher: [Read original article]() Author: Mehdi Ouazza Published: 2026-10-06T00:00:00Z Content type: tutorial Language: en Sources: [MotherDuck]() Topics: [data-engineering](), [llm-reasoning](), [managing large-scale text data in AI]() Tags: [agent](), [ai](), [ai-labs](), [ai-models](), [alibaba-cloud](), [analysis](), [analytics](), [cloud](), [data](), [datasets](), [hacker-news](), [jev](), [job](), [prompt](), [queries](), [regex](), [sales](), [sql](), [traces](), [use-cases]() ### AI overview The excerpt presents `prompt_jev()` as a MotherDuck SQL function for classifying text into predefined labels, yes/no answers, or scores with confidence. Examples cover judging agent traces, filtering Hacker News mentions and sentiment, screening sales calls, identifying primary cloud platforms in job postings, and classifying work modes. The article describes using explicit instructions, confidence thresholds, sampling, and human review; for cloud analysis it also uses escape-hatch labels and filters out vendor postings and ambiguous results. On 2,000 postings, `prompt_jev()` is reported about 20 times faster than a standard LLM call, while regex was fastest but required patches to handle false positives. The recommended approach is to use regex for structured patterns and Jev for meaning, validate thresholds on labeled examples, and materialize results to avoid repeat classification. Jev returns bounded choices rather than summaries or new categories; the excerpt also cautions that Hacker News is not representative market-share data and that customer-data handling rules should be checked. ### Source excerpt Five prompt_jev() use cases on real data, with SQL you can rerun: AI agent traces, Hacker News sentiment, sales calls, cloud job postings and a regex replacement. ## Python Workers Reach GA on Cloudflare, with Questions About Cold Starts and Upstream Maintenance DevFeed: [Python Workers Reach GA on Cloudflare, with Questions About Cold Starts and Upstream Maintenance]() Original publisher: [Read original article]() Author: Steef-Jan Wiggers Published: 2026-09-29T06:33:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Cloudflare Workers](), [Python](), [ASGI](), [AWS Glue]() Tags: [architecture](), [architecture-design](), [cloud](), [cloudflare](), [cloudflare-python-workers-ga](), [connectors](), [developer-experience](), [development](), [devops](), [drivers](), [hacker-news](), [news](), [python](), [serverless](), [webassembly](), [workers]() ### AI overview Cloudflare made Python Workers generally available, adding Python to its Developer Platform alongside JavaScript and TypeScript. The report describes packaging support for Python extensions compiled to WebAssembly, socket syscalls implemented over the Workers connect API, and upstream HTTP client changes that enable libraries such as requests and httpx. It also notes concerns about ongoing upstream maintenance and the absence of performance figures, including cold-start measurements. ### Source excerpt Cloudflare has made Python Workers generally available, built on PEP 783 and on socket syscalls implemented over the Workers connect API. The announcement carries no performance figures. A urllib3 maintainer questioned who supports the upstream work afterwards, and Wasmer's founder asked for cold-start numbers, citing about 1.027 seconds from Cloudflare's own earlier post. By Steef-Jan Wiggers ## S3's Standard Storage Price Has Remained at $0.023 per GB-Month Since 2016 DevFeed: [S3's Standard Storage Price Has Remained at $0.023 per GB-Month Since 2016]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-09-27T23:09:19Z Content type: opinion Language: en Sources: [Simon Willison's Weblog]() Topics: [Amazon S3](), [Amazon Web Services]() Tags: [amazon-web-services](), [amazon-web-services-82](), [hacker-news](), [s3](), [s3-65]() ### AI overview A comment on Hacker News observes that Amazon S3's standard storage price, after several reductions between 2006 and 2016, has remained at $0.023 per GB-month for a decade. ### Source excerpt My comment on S3 Is the Future, S3 Is the Past -- Hacker News. One thing I find notable about S3 today is that, while it used to drop in price reasonably often, there hasn't been a price drop in a full decade: 2006-03-14 $0.150/GB-month 2010-11-01 $0.140/GB-month 2012-02-01 $0.125/GB-month 2012-12-01 $0.095/GB-month 2014-02-01 $0.085/GB-month 2014-04-01 $0.030/GB-month 2016-12-01 $0.023/GB-month Today it's still $0.023/GB-month. Tags: amazon-web-services, s3 ## Hacker News's Political Bias and Moderation of Discussion About Grok DevFeed: [Hacker News's Political Bias and Moderation of Discussion About Grok]() Original publisher: [Read original article]() Author: September Published: 2026-09-23T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Artificial Intelligence](), [Large Language Model](), [Users]() Tags: [ai](), [discussion](), [ethics](), [grok](), [hacker-news](), [llm](), [politics]() ### AI overview The article argues that Hacker News reflects the political and economic interests of its host, Y Combinator, and has developed a pronounced political bias. It also discusses how comments criticizing Grok and Elon Musk were moderated or hidden. ### Source excerpt Hacker News (aka HN) is a link aggregator where "hackers"1 gather to discuss technology, politics, and anything which "good hackers would find interesting". HN is a means by which its host, prominent startup incubator Y Combinator, projects soft power, promotes startups it funds, and feeds people with ideas into its incubation program. Hacker News is one of the most popular forums for discussing technology online today - perhaps the biggest. HN also has a pronounced political bias, which is growing more exaggerated with time. Many of its users have long claimed centrist or "apolitical" views. On a forum created by a startup incubator, it's no surprise that capitalism is generally taken as given, often with a libertarian angle. Labor is generally de-emphasized (the consensus on HN is almost always anti-union) and openly advocating left economics like communism or socialism is generally frowned upon. Progressives have, on the whole, abandoned the forum. The right wing has not. Yesterday, I saw a post about the new release of the Grok LLM, Elon Musk's "anti-woke" AI project. Virtually all of the comments are fawning over the release, and debating the finer points of its technical achievements, price, and competitiveness. There are remarks that object to the tool on the basis that its owner, Elon Musk, is a fascist, and that it is designed to amplify hate speech. Almost all of these remarks are "flagged", moderated by other HN users until they are not visible by default.2 Some examples of comments flagged out of existence: Until Musk owns up to his Nazi salute, I won't be using Grok, sorry. I don't care how good or cheap it is. And no, I won't stop talking about it either. Your friendly reminder that Grok is owned and directly steered by the white supremacist guy with the fascist haircut who does nazi salutes and fucked up decades of international order to settle scores for his apartheid south african family. Any amount of using the model supports this. I'm dying to kno ## Why MCP remains useful for controlled agent access to external services DevFeed: [Why MCP remains useful for controlled agent access to external services]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-09-20T20:24:41Z Content type: opinion Language: en Sources: [Simon Willison's Weblog]() Topics: [Model Context Protocol](), [audit](), [Authentication](), [Claude Code](), [API](), [codex](), [OpenClaw](), [Terminal]() Tags: [api](), [audit](), [authentication](), [claude-code](), [codex](), [coding-agents](), [hacker-news](), [hacker-news-44](), [mcp](), [model-context-protocol](), [model-context-protocol-36](), [openclaw]() ### AI overview The commentary argues that MCP remains valuable for agents operating with controlled access rather than unrestricted internet access. It highlights service permissions, authentication without direct API-key exposure, user connection flows, and audit logging. ### Source excerpt My comment on MCP was always a bad idea? -- Hacker News. This article entirely misses the value that MCP brings today. Sure, there's almost no reason to use MCPs if you are running a full-blown terminal agent (Claude Code, Codex, Meta Muse, OpenClaw etc) with unfettered internet access - just let it call APIs directly. If you want to operate something that's less YOLO than that, you'll find yourself wanting: Control over exactly which external services it can access A way to handle authentication that doesn't allow the agent to directly access API keys A sensible UI to allow users to connect and authenticate further services Strong audit logging for what's going on MCP makes all of that so much easier to provide. Thinking MCP is obsolete because full coding agents don't need it misses out on all of the other things we might want to build. Tags: hacker-news, model-context-protocol ## Seven years of bitwise: a weekend project, a Hackernews front page, and the long road into Debian DevFeed: [Seven years of bitwise: a weekend project, a Hackernews front page, and the long road into Debian]() Original publisher: [Read original article]() Author: Ramon Published: 2026-09-11T15:21:24Z Content type: article Language: en Sources: [Ramon Fried]() Topics: [experience report](), [project release](), [Test-driven development]() Tags: [alpine](), [ascii](), [aur](), [autotools](), [bits](), [c](), [calculator](), [debian](), [distributions](), [fedora](), [freebsd](), [hacker-news](), [hackernews](), [history](), [homebrew](), [kde](), [keys](), [linux](), [low-level](), [ncurses](), [nix](), [open-source](), [packaging](), [project](), [software](), [vim]() ### AI overview bitwise began as a terminal alternative to opening KDE Calculator for inspecting register bits; the author says writing the program was easier than getting it packaged and distributed. Early additions included Vim movement keys for navigating the binary display and a plain command-line mode, which most users now use. During ten weeks without feedback, the author added an expression parser, unit tests, history, last-result reuse, ASCII output, and a distinction between KiB and kB. A second Hacker News post reached the front page with 113 points after its title shifted from describing the program to describing what it did for users. The excerpt says bitwise later reached many distributions and package systems, but ends before explaining that experience further. ### Source excerpt I started bitwise because I was tired of opening the KDE calculator. Seven years, one Hacker News front page and sixteen distributions later, here's what I learned -- mostly about how hard it is to get software to people. ## Don't Paste the AI vs Vomit vs NoBuzz: AI Slop Tools Compared DevFeed: [Don't Paste the AI vs Vomit vs NoBuzz: AI Slop Tools Compared]() Original publisher: [Read original article]() Author: Developers Digest Published: 2026-08-21T00:00:00Z Content type: comparison Language: en Sources: [Developers Digest]() Topics: [Artificial Intelligence](), [Tool](), [Claude Code](), [Code]() Tags: [ai](), [ai-coding](), [claude](), [claude-code](), [code](), [comparison](), [developer-tools](), [guide](), [hacker-news](), [table](), [tools](), [vs](), [writing]() ### AI overview A comparison of dontpastetheai.com, Vomit, and NoBuzz, three AI slop-related tools or approaches that appeared on Hacker News in the same week. It covers a social contract, a local rewrite, and a second-model Claude Code skill. ### Source excerpt dontpastetheai.com, Vomit, and NoBuzz hit Hacker News in the same week. A social contract, a local rewrite, and a second-model Claude Code skill - compared with a table and a when-to-stay guide. ## CodePen's New Interface, Deployment Infrastructure, and AI Potential DevFeed: [CodePen's New Interface, Deployment Infrastructure, and AI Potential]() Original publisher: [Read original article]() Author: Chris Coyier Published: 2026-08-12T16:01:09Z Content type: opinion Language: en Sources: [Chris Coyier]() Topics: [interface](), [Deployment](), [Front end](), [Artificial Intelligence](), [Large Language Model](), [Developer Tools](), [Cache](), [SSL]() Tags: [ai](), [cache](), [certificates](), [code](), [deployment](), [front-end](), [generated-content](), [hacker-news](), [uncategorized]() ### AI overview The author reflects on CodePen's new interface, its continued value for quick front-end experiments, and its increasingly capable website-building and deployment features. The discussion also considers AI-assisted deployment, code reuse, scraped code samples, version history, and abuse prevention for public user-generated content. ### Source excerpt Instead of our real launch blog post, my little "I should probably mention this on my personal website" post is the one that hit Hacker News. Nevertheless, people got the message. What I loved about CodePen was just being able to try out something really quick and simple. But the new interface makes me feel [...] ## Agent-Manager: A Tmux TUI for Running Claude Code, Codex, and OpenCode Side by Side DevFeed: [Agent-Manager: A Tmux TUI for Running Claude Code, Codex, and OpenCode Side by Side]() Original publisher: [Read original article]() Author: Developers Digest Published: 2026-07-30T00:00:00Z Content type: article Language: en Sources: [Developers Digest]() Topics: [Text-based user interface](), [AI-assisted coding](), [Go Language](), [Terminal](), [Claude Code](), [codex]() Tags: [agent](), [agent-tools](), [ai-coding-agents](), [claude-code](), [codex](), [coding-agents](), [developer-tools](), [go](), [hacker-news](), [news](), [opencode](), [terminal](), [tmux]() ### AI overview Agent-Manager is a Go-based terminal user interface that uses tmux to organize AI coding agents by project, display their live status, and support interaction with blocked agents and review of their changes without attaching to each terminal. ### Source excerpt Agent-Manager wraps tmux into a Go TUI that groups AI coding agents by project, shows live status for each, and lets you answer blocked agents or review their changes without attaching to their terminal. [Next page]()