Top of Hacker News

In today's GitHub Trending: iroh (a Rust library that dials devices by public key, not IP), Meshery (a Kubernetes-stack manager), and three reference repos — freeCodeCamp's curriculum, build-your-own-x, and a self-hosting guide.

The lists pull the stars; the threads pull the doubt. The top Hacker News comment on the Self-Hosting-Guide calls it «a giant list of tools», not the how-to its title promises, and it hasn't been updated in a year. iroh is the outlier: a maintainer ran an open AMA the day it hit the front page.

Cursor's founders went from zero to multigenerational wealth in four years, on a product the thread keeps calling a wrapper: an editor fork, a harness, and prompts. Its in-house model, Composer 2.5, is built on Kimi K2.5.

The structure is the catch: this is not a cash deal. SpaceX pays in its own stock, diluting shareholders, while telling IPO investors it sees a $26T addressable market.

And the loudest skeptics can't explain why investors keep funding it anyway.

Her quality test isn't a benchmark. It's whether she has to verify the output against a paid model — and OpenAI's OSS-20B was the first where she did that a lot less often.

The thread's counter is blunt: boot Gemma 4 MoE expecting Claude Code behavior and you'll be very disappointed. Capable, but still far behind the frontier.

Chrome 150 (around June 30, 2026) drops the ExtensionManifestV2Disabled flag; Chrome 151 in July removes the rest. Google cites "complexity, tech debt, and security risks."

A self-identified Googler defended it as a security move. A reply noted Google makes 75% of its revenue from ads — and controls the extension store it claims to be protecting.

The praise came wrapped in qualifiers — "almost certainly a better overall programmer than I am" — and a commenter called out the hedging directly.

Then a counter-voice landed: Bellard hasn't touched FFmpeg in over 20 years, none of his original code survives, yet he alone still controls who may use the FFmpeg name.

Researchers fed Fable 5 open-source code seeded with known CVEs. It declined to enumerate flaws but agreed to patch them — and the patches plus test scripts revealed the exploits anyway.

Katie Moussouris, founder of Luta Security, says that was the whole technique. The Trinkets: an export-control directive barring access by any foreign national, and Anthropic disabling the models for everyone.

The kicker isn't 14 billion commits. It's that those are agent check-ins, not features shipped — agents now write to GitHub while they think, not after a human has.

One commenter recalls GitHub's founder telling a Microsoft exec years ago that Azure's virtual disks weren't fast enough on IOPS to host GitHub.

And the article making this claim is itself an AI-generated, mostly-empty React page from a self-described one-person, vibecoded site.

The bill aims at postings kept up to harvest resumes, pad pipelines, or signal growth that isn't happening. Supporters call it overdue relief for applicants who lose weeks waiting on roles that were never real.

The asterisk came from a New Yorker: the state already has a salary-disclosure law it doesn't enforce. A law that "sits on the books being violated openly" fixes nothing.

Both Sign in with Apple and Hide My Email aliases are moving to @private.icloud.com. One regex now separates relay addresses from real iCloud mail, and a site can reject all of them in a single rule.

The author's escape hatch: generate spare @icloud.com aliases now, before the change lands, at a rate limit of at least 30 per hour.

The catch surfaced in the thread: ban the new domain and you also break the Apple sign-in button you were told to add.

Tested so far on the Pixel 6a, 7, 7a, 8, 10a, 10 and 10 Pro Fold, with official releases coming soon and longer security-patch support than Android 16 gets.

Notably absent from the list: the Pixel 9 and 9a, which several owners in the thread are still waiting on.

The bigger flip: a privacy OS that only installs on phones from the company you're trying to leave, and Pixels aren't even sold worldwide.

The gist's core claim: JWTs were built for ~5-minute tokens, not logins, and 'they are not designed for this purpose, they are not secure.' Use session cookies, or PASETO for signed tokens.

The recurring qualifier from the thread: that's true for browser sessions, and basically only browser sessions.

The flip: one commenter dared anyone to break AWS STS's AssumeRoleWithWebIdentity if JWTs are really that insecure. No takers.

Each write-byte instruction was 4 bytes. 65,536 of them meant 256 kilobytes of machine code to initialize 64 kilobytes of stack: a 4:1 code-to-data ratio.

Rather than run the bloat as written, the binary translator recognized the monstrous function and substituted the compact loop the compiler should have emitted.

The asterisk from the thread: maybe it wasn't a bug at all, and the fully unrolled version was actually faster on the real hardware.

The whole machine exists to slow one spring down. The mainspring wants to unwind in seconds; the escapement releases it one tooth at a time, locked to a balance wheel swinging on a hairspring at 8 beats per second.

Ciechanowski builds it from nothing: barrel, gear train, escape wheel, pallet fork, then the crown and the self-winding rotor on your wrist.

It is a 2022 piece, and the thread's real ache is that the author has gone quiet since.

The feature is Vehicle Motion Cues: the phone reads the car's acceleration and turns and floats dots that move opposite to it, so your eyes confirm what your inner ear already feels.

Buried under Settings > Accessibility, it ships off by default, which is why most owners have never heard of it.

The catch in the thread: it only treats sickness caused by looking at the screen. Look up and feel sick anyway, and the dots do nothing.

The trigger is money: the Trump administration's 2026 budget proposed a 55% cut to the National Science Foundation, and the order to start shutting the network down arrived in early May.

Most of the system is slated to be dismantled by 2027, gutting a long-running record of the Pacific just as El Nino conditions return.

The quiet flip from the thread: pulling the hardware costs more than leaving it in place and unmaintained, which makes the move read as a choice, not a saving.

The trigger isn't search or Gmail. It's the kitchen speaker that used to read back a clean snippet and now delivers a four-minute Gemini monologue, asking follow-up questions until users start shouting "cancel" and "stop."

Several readers report the same regression on Android Auto: ask for one song, get something "vaguely semantically related with no way to course correct."

But the flip is sharper than the rant: commenters note the de-Google manifesto sits on a site so buried in ads it became a live exhibit of the enshittification it protested.

The bill leaves messaging out (WhatsApp, Signal) and exempts YouTube Kids, then threatens multimillion-dollar fines for non-compliance, plus floated extras: overnight curfews and limits on infinite scroll for under-18s.

The author discloses he sits on a social-media board, which the thread treats as both a tell and a reason to discount him.

The harder asterisk comes from Australia's live version: a 15-year-old visitor reported it didn't touch existing accounts at all, because age checks there only gate newly created ones.

The flaw was textbook: roles were checked client-side only. The server never validated the JWT, so the APIs served live broadcast infrastructure to anyone who registered on FIFA's public Agent Platform. Push to the RTMP endpoint and you replace the feed on TV worldwide.

The twist: FIFA never responded. No acknowledgment, no thank-you, no bounty — they just silently patched it. Half the thread asked why he reported it at all.

The trick is three lines: open file descriptor 3 on /dev/tcp, printf a raw GET with CRLF headers, then cat the descriptor back. The Connection: close header is load-bearing — drop it and cat waits forever.

But the loudest reply in the thread was a correction: Bash does not speak HTTP. It opens a socket and you speak HTTP, badly. The toy client doesn't parse responses and breaks on redirects, chunking, or TLS.

Publishers Weekly clocked adult nonfiction down 9% in Q1 2026, with self-help the steepest subcategory at -26.3% year-over-year. Ferriss's thesis: people now believe the best interface for advice is a free chatbot that hands you a personalized protocol instantly.

The thread's counter-fact: the data is print-only. One commenter notes 65% of audiobooks were nonfiction in 2022, and the format has roughly tripled since — the audience may have moved, not vanished.

The essay opens with college Watterson painting Michelangelo on his dorm ceiling for months, then whitewashing it before he left: art for its own sake, kept by no one.

He turned down merchandising estimated against Garfield's 750 million to a billion dollars a year, fought his syndicate for six years, and quit in 1995 after a decade.

The thread caught the essay contradicting itself: it warns of widespread cancellation, then admits only 7 of 1,800 papers actually dropped him.

Under the beige nostalgia it's a Sailfish-OS handset with Android app compatibility, reportedly sourced from an ODM, priced at $500 (about $700 in Canada).

The browser block is the flashpoint: critics note a browser is how you reach 99% of the world's information, and a firewall or DNS rule would target social media without nuking everything else.

The deeper question the thread can't answer: the people who loved a C64 and the people who loved flip phones aren't the same generation, so who exactly is this for?

An estimated 4,000-5,000 software engineers, out of about 25,000, now sit in a new 6,500-person org doing data labeling and RLHF. The autonomy-to-labeler whiplash is the part people on core infra and security teams can't stomach.

Add keystroke and mouse tracking with no opt-out, rolled out in late April, and a CISO who resigned the day after an AI support flow let attackers hijack Instagram accounts.

The flip: a former Meta engineer says the well-run orgs were all acquired — the homegrown ones were always the mess.