Top of Hacker News

This month: build-your-own-x (514k-star programming curriculum), yt-dlp (video downloader forced to add a Deno dependency), bitwarden/server and bitwarden/clients (password manager appearing twice after a licensing scare), and NangoHQ/nango (AI integration platform from YC W23).

The list's throughline isn't AI hype — it's platform anxiety. YouTube tightened its defenses, Bitwarden briefly went proprietary (then reversed), and a Chinese lab shipped a Whisper alternative that claims 170x realtime speed. Developers starred the escape hatches.

This week: Sniffnet — cross-platform network monitor with per-app visibility; Trivy — vulnerability scanner (recently supply-chain attacked); FunASR — Alibaba speech recognition at 170x realtime; PowerToys — Windows utilities; Astro — content web framework.

The sharpest detail: Trivy's March 2026 compromise — attackers force-pushed malicious commits to its GitHub Action tags and spread a worm to 47 npm packages — appears to have boosted, not buried, its star count. Security incidents are now marketing.

Today on GitHub Trending: PowerToys (v0.100, new Command Palette Extension Gallery), Astro (the content-site framework on a slow burn to 60k stars), Coder (remote dev environments now pitching AI agent workspaces), Homebrew (just ended --no-quarantine support), and Ghostfolio (self-hosted wealth tracker).

Not one of the five is a GPT wrapper, a prompt collection, or a two-week-old repo with suspicious stars. On a platform overrun by AI side projects, that absence tells its own story.

The manifesto's pitch: if intelligence becomes something you can only rent from a few closed institutions, you lose operational freedom, not just software freedom. It wants the freedom to study, repair, audit, and run models yourself.

The thread's puzzle: a model you can't run on your own computer isn't open by the classic definition, and nobody can say who funds open frontier training when a single run costs a fortune.

The trick targets p53, the mutated tumor-suppressor behind nearly half of all cancers and long called 'undruggable' because the broken protein has no pocket for a drug to grab. Instead of fixing the protein, the system uses the mutant transcript itself as a self-destruct trigger.

A biologist in the thread cut the hype: every previous version of this idea used Cas9, which just nicks DNA. This one's whole point is collateral damage. And the same crowd flagged the catch nobody markets: getting the enzyme into every cancer cell in a body.

Postgres 19 adds native application-time temporal tables: PRIMARY KEY (id, valid_at WITHOUT OVERLAPS) replaces the EXCLUDE-USING-gist dance, FOR PORTION OF lets an UPDATE rewrite just one time slice, and PERIOD foreign keys enforce validity across a duration.

The developer who implemented it joined the thread to say it still lacks system-time, which he hopes to tackle next — and the article's author called it the biggest single release since v10.

Apple's Security team rewrote the TrueType hinting interpreter — input-driven control flow over untrusted font data — from C to Swift for the Fall 2025 releases. Result: a 13% average speedup, pixel-identical output across 27 million glyphs, and the memory-safety bug class eliminated, with only a few audited unsafe statements left at the C boundary.

Systems programmers cheered the safety-plus-speed result, but one Swift user warned the lifetime features shown off in the post crashed the compiler on trivial programs just months ago.

theahura argues the suspension's motive almost doesn't matter. Whether it's safety, an IPO stunt, or Trump settling a score, a line was crossed: a government unilaterally pulled the best LLM off the market.

His sharpest worry, echoed back at him in the thread: in two years, the strongest models may not be available for general use at all, no matter whose flag they fly under.

Miguel Grinberg borrowed Cory Doctorow's 'reverse centaur' — a human reduced to serving a machine — to describe what open source maintenance has become: spending your days reviewing code an LLM wrote and nobody understands.

His fix is friction: open an issue first, in your own voice, no LLM-generated novel with bullet points and emojis. A Netflix engineer in the thread noted that ticket queues aren't reverse centaurs at all — a person is on the other end.

Her sharpest loss isn't the text — it's the marginalia. Studying Edith Wharton's annotated books taught her that a careful reader's notes in the margins are a conversation with the author, and that conversation goes in the dumpster too.

Then a librarian flipped it: this is routine collection management, not a tragedy. The same week, that exact library acquired one of 11 surviving copies of a 444-year-old book. The fight in the thread is over what a library is actually for.

The catch with the delivery story is isotopes. Comets like Halley carry deuterium ratios that don't match Earth's oceans. So researchers ran the alternative in a lab: diamond anvils and lasers recreating a magma-ocean world, where hydrogen and molten rock fuse into water.

The result was startling — up to 1,000 times more water than predicted. The open question is whether an Earth-sized planet ever held enough atmospheric hydrogen to drive the reaction. As one researcher put it: it's unclear you can do this for an Earth-mass planet.

WASI 0.3, ratified June 11, replaces the old polling primitives with first-class stream<T>, future<T> and async functions, moving to completion-based scheduling like io_uring. One event loop, managed by the host, is shared by all components.

The Wasmer CEO's reality check in the thread: it runs in one server-side runtime, no browser support, and it again breaks compatibility with the original WASI — and a decade in, skeptics still ask whether WebAssembly has had its breakthrough.

The guide wires up an offline coding agent on a 64GB M1 Max: llama.cpp built with Metal, Gemma 4 in Q4, and a Multi-Token Prediction draft model that lifts generation from 58 to 72 tokens/sec.

The thread's sharpest critique wasn't the setup but the metric: every local-AI post benchmarks tokens per second, none benchmark answer quality. 'Quickly serving me slop doesn't make it more useful.'

Instead of detailed design specs, the author gives the model a single directive: build it in the style of a Qt application. On a 270-to-win electoral map, it removed almost all the slop feeling, and it generalized to his other projects.

The thread's best explanation: Qt is dense in training data, so 'Qt app' is a tight, coherent point in latent space. Modern web is a million conflicting styles, so the average of all of them is, by definition, slop.

Adaptive PDFs attach Markdown-formatted replacement text to a PDF's content via marked-content sequences — a feature in the spec since PDF 1.4. Renderers ignore it and show the normal page; extractors like PyMuPDF get clean headings, lists and tables instead, with under ~10% file-size overhead.

One Rust dev flipped it instantly: the same layer that feeds an LLM clean structure can feed it a malicious instruction a human would never see — invisible prompt injection in your electricity-bill PDF.

Renault's CEO links a 50% jump in EV orders across France and Germany to fuel-price fears since the Iran war. A charging-network founder in the thread confirms it from the ground: 'the summer has never started off this well.'

The unease underneath: today's pump prices are held down by countries draining strategic reserves, which one commenter warns will eventually run out.

After 45 minutes and over €20 in tokens, Fable 5 reported 'Shepherd's Dog is complete' as one self-contained HTML file. The author's verdict: the first time a model built his vision in a single attempt.

The catch the thread surfaced: this exact sheep-herding game exists in dozens of versions, so the one-shot is less invention than a polished recall from training data.

Built on the side in two days and 91% of a Max plan (~$200), the game came with quest logs, threat metrics and spirit-release-on-death that the creator never specified. Then HN hugged it to a 502.

The skeptics' line: easy to mass-generate quests and classes, but movement, pacing and balance are exactly the parts a model can't shortcut, and they show.

The post traces three eras of the founder: orbiting the product, then cultural protagonist, then transparent grifter — pointing at the Founders Fund game show as the moment the charm offensive went literal.

A reader who left academia for finance summed up the shift he lived through: the ethos went from 'don't be evil' to 'don't be a pussy.' Others argued the humble nerd was never real, just powerless.

The US government cited national security and ordered Anthropic to cut off all foreign access to its two strongest models. Anthropic says the only evidence it received was verbal, and the demonstrated technique was the same one defenders use daily: have the model read code and fix the bugs.

The 1,800-comment thread split four ways: deserved comeuppance for safety hype, a Trump-admin revenge move, free pre-IPO marketing, and a precedent that could freeze every frontier lab at once.