Top of Hacker News

In last week's GitHub Trending: SimpleX (a messenger that assigns no user identifiers at all, for the privacy-maximalist crowd), CasaOS (a home-server OS that turns a spare box into a personal cloud), Plane (a self-hosted Jira and Linear alternative), and free-for-dev (a directory of free SaaS tiers).

The list sells digital independence. But its second-biggest gainer, CasaOS, hasn't merged a commit in nearly a year, and its own issue tracker is openly asking whether the project is dead.

Palworld — выживалка с крафтом и базой, где вы ловите милых монстров-палов и ставите их к станкам или к оружию. Именно за это её прозвали «покемонами с дробовиком», и именно это снова втянуло публику.

Сюрприз не в скидке, а в том, что за полтора года в раннем доступе разрозненные механики срослись в один затягивающий цикл. Обратная сторона: часть игроков ловит вылеты и баг с «повреждёнными» сохранениями.

Monster Hunter Wilds — крупный экшен про охоту на гигантских чудовищ: выслеживаешь монстра, из его добычи куёшь снаряжение и идёшь на тварь посильнее. Сейчас в неё снова повалили игроки, хотя внятного повода никто так и не назвал.

Интереснее не приток, а раскол: новички в восторге от боёвки, а ветераны и владельцы ПК пишут, что игра не уважает их время и вылетает спустя год после релиза.

Kingdom Come: Deliverance II — ролевая игра без магии и драконов: только Богемия XV века, кузнечное ремесло, алхимия и фехтование по честной физике. Отыгрываете простолюдина, который всему учится с нуля.

Подвох в боёвке. Одни зовут её самой честной дуэльной системой в жанре, другие — невыносимой; от неё зависит, влюбитесь вы в игру или бросите на первом же поединке.

Halo Infinite — условно-бесплатный шутер от 343 Industries, флагман вселенной про солдата-киборга Мастера Чифа: сетевые бои и сюжетная кампания. На этой неделе игра всплыла в обсуждениях не ради контента, а из-за громкого заявления бывшего сотрудника студии.

Заявление легло на давнее раздражение: свежие отзывы полны разочарования, и до самой стрельбы у многих дело уже не доходит — мешает то, как издатель обходится с игрой.

Hello Kitty Island Adventure — уютный симулятор жизни на острове по лицензии Sanrio: исследуешь локации, собираешь ресурсы, мастеришь и даришь подарки, дружишь с персонажами вроде Куроми и My Melody.

Сюрприз в начинке: под милой обёрткой прячется на удивление объёмная игра, контента в которой хватает на десятки часов. Тем заметнее, что самый заплюсованный свежий отзыв — не похвала, а предостережение.

In today's GitHub Trending: VeraCrypt (full-disk encryption, the TrueCrypt successor), RustDesk (self-hosted remote desktop, a TeamViewer alternative in Rust), Mullvad (client for the no-logs VPN), and SiYuan (a self-hosted Notion you actually own).

Four of the five are tools you run when you stop trusting someone else's cloud. The catch: each carries a trust dispute the community keeps poking. A signing lockout with a revocation deadline this week, a test root certificate filed as a CVE, an AI agent creeping into a privacy-first notebook.

A man with three weeks of shoulder pain got a Grade III partial-thickness tear diagnosis at a German clinic. He fed the raw scan into Claude Code; Opus 4.8 spent an hour planning, then concluded the tendon was intact with only mild tendinosis. He's stuck not knowing who to believe.

A practicing radiologist showed up in the thread and aimed at the doctors, not the AI: the clinic injected him with a homeopathic remedy and did shockwave therapy a guideline says not to use. An MR tech then explained the scanner itself invents half the pixels.

A Brown economics professor who studies game theory gave a take-home, closed-book midterm on the honor system, then a proctored final. The grade distributions diverged so sharply he says at least 50 of 86 students cheated with AI — and his own department shrugged.

The thread was brutal: a game-theory expert who can't foresee that everyone defects built the trap himself. Meanwhile a Dartmouth instructor is rebuilding a CS course as an "adversarial problem" against students optimizing grade-per-effort.

Semgrep benchmarked GLM 5.2 against Claude Code, GPT-5.5, DeepSeek V4 and others on finding Insecure Direct Object References in real open-source apps. GLM 5.2 with a bare prompt landed at 39% F1, above the Claude Code SDK setup.

But a reader caught the headline number not matching the table: the post says Claude scored 32%, the table says 37%. And the author of a rival vuln benchmark showed up to say GLM is good, not the best open model he's tested.

Engadget reports there are now over 100,000 Flock cameras in the US, running modified Android, feeding a searchable network where a Texas officer can query Massachusetts footage and ICE rides along through local police. Searcher Benn Jordan found 70-plus cameras streaming live, password-free, in December 2025.

Then an HN commenter who co-led the campaign that removed Flock from Eugene and Springfield, Oregon and helped draft state ALPR law said his team decompiled a device: the object-detection categories included 'cat,' 'dog,' 'person,' 'bicycle' — confirming from the binary what marketing implies.

LibrePods is a GPL-3.0 project that talks the proprietary AAP/AACP protocol AirPods use with Apple devices, bringing ear detection, listening-mode switching, battery status, renaming and conversational awareness to Linux and Android. Two core Rust files, aacp.rs and att.rs, were AI-translated from Kotlin.

The thread's correction: the earbuds already pair fine anywhere — this only restores Apple-exclusive extras. And one commenter said Android 17 already fixes the Bluetooth bugs that used to need root, so he'd rather fork it than pay the $5 ask.

An essay argues tokenmaxxing died only because subsidized tokens got pricier, and that a coming shift it calls 'compounding correctness' — where spending more tokens reliably buys better answers — will resurrect it on cheaper open models.

The thread, full of people who sat in the VP meetings, was having none of the charitable read: one called it 'a moronic move fueled by hype', another reported being told to approve PRs without reading them.

The request is modest: a config file, like .gitignore, that keeps node_modules searchable but tells the agent to never read or send .env, *.pem, id_*, .aws and .ssh. It has sat open since August.

Engineers in the thread argue the feature is impossible to do safely: if the model can run shell, a stray 'rg foo' that matches an .env line uploads the secret anyway. The fix they keep naming is not a blocklist but a sandbox.

Patrick Breyer's alert describes two moves in one weekend: the Council reviving the lapsed Chat Control 1.0 on Friday, and a final closed-door trilogue on the permanent Chat Control 2.0 that Monday. The mechanism is the point. A bill killed in open Parliament gets retried in a room where 'voluntary' scanning can be recast as an enforceable risk-mitigation duty.

A commenter who works inside legislative committees translated the venue: a trilogue is the EU analog of House and Senate members negotiating in private, with redacted documents and no public floor debate, so the bill never gets debated and never gets rejected.

Around March, Google told Meta it couldn't supply the full Gemini capacity Meta had tried to purchase, delaying some of Meta's internal AI work. Meta then asked staff to be more efficient with tokens. Other Google Cloud clients were squeezed too.

The thread's flip: this isn't Google restricting a rival's access, it's a compute shortage dressed as a restriction. And the buried oddity is Meta, which builds Llama, leaning on a competitor's model in the first place.

The EFF reads the KIDS Act (built around KOSA, H.R.7757) as age verification by indirection. Instead of mandating ID checks, it sets a 'know or should have known' negligence standard for under-13 and 13-16 users, pushing every covered service to verify all ages to avoid liability. The result, EFF argues, is a less private internet for adults too.

The most-cited voice was a founder who dislikes the bill yet explained its support: for non-tech-savvy homes the real choice today is no devices or kids raised by addictive feeds, because the industry refuses to give parents working tools.

The column lines up the bans, the Connected Vehicles Rule on cars, DJI import limits, tariffs on solar and EVs, and contrasts them with a US that once raced to buy the best of everything. It quotes the line that China now resembles the competitive capitalism Americans were taught to admire.

The flip from the thread: one OpenAI researcher worries AI hype is a way to avoid admitting the US can't build competitive cars and drones, while another argues the export bans on top US AI models mostly hand the lead to whoever isn't banned.

State Sen. Erika Geiss's Workplace Employee Boundaries Act would stop employers from requiring access or replies to emails, texts and shift-scheduling messages outside assigned hours. Violations go to the state labor department; carve-outs cover contracted on-call pay, emergencies, and hours you set yourself.

The reversal wasn't legal, it was social: a wave of engineers replied 'this never happens to me,' and a 12k-karma commenter called that the least useful response possible — someone telling you the world works differently is a gift, not noise.

Bloomberg reports Austria is pushing the EU to host Anthropic in response to US access curbs — the kind of relocation HN had been arguing was unrealistic.

An engineer from Stainless, the startup Anthropic acquired, notes Anthropic's European offices are sales, not engineering — the labs are in London and the US — while a VC in the thread reduced the whole 'why can't Europe build this' debate to one word: capital.

California reversed course and will fund uploading every driver's license and state ID into SPEXS, a national database operated by AAMVA, a private nonprofit. The lever was REAL ID: comply, or watch California IDs stop working at airports.

An attorney in the thread flagged the framing: this is not really about driving, since a state ID gates access to basic services and is closer to a right. Others noted the feds could already scrape the data, making the move more posture than new exposure.

Between 2009 and 2016 the average Greek family lost roughly 35% of its assets. The recovery since then has flowed to people who already held assets: those who can invest compound their gains, those who can't stay exposed. Almost 35% of Greeks now call themselves poor.

A resident put the macro chart into a wage: salary about €1,000 a month, houses €150-300k and rising on foreign money, an official six-day, 48-hour week. Tourism wants cheap labour and bought-up property, he wrote, and little else.

A CBC documentary credits the modern school system to Wilhelm von Humboldt and the idea of Bildung: education meant to grow independent, critical thinkers, not obedient workers.

The thread answered with competing origin stories: US schooling drifting from critical thinkers to assimilation to a 'shopping-mall high school' built to keep teenagers enrolled to 18, and the argument that every noble model decays once you make it universal and mandatory. One German speaker deflated the whole frame by noting Bildung just means 'education.'

A data-story walks through five thousand American menus from 1880 to 1920, digitized from the NYPL's Buttolph Collection and labeled dish-by-dish by volunteers at menus.nypl.org.

Readers noticed what changed and what didn't: oysters and clams lead the page, 'green turtle soup' turned out to be literal turtle meat, and celery sat as a delicacy because before refrigeration it barely survived the trip to the city.

Daisugi, written 'platform cedar', works like giant bonsai: one parent tree keeps throwing up dead-straight Kitayama cedar shoots that get cut for rafters without felling the trunk. It spread in 15th-century Kyoto because sukiya-zukuri architecture was in fashion and raw timber was not available.

The thread's correction: a coppicing technique Europe has run for 2,000 years, here repackaged with a coat of orientalism, while the article itself buried the mechanism the X thread it scraped explained better.

On Medium, Ś vanished while the eight other Polish accented letters typed fine. Marcin Wichary traced it: the Polish 'programmer's layout' makes Ś with Right Alt+S, Windows remaps Right Alt to Ctrl+Alt, and Medium's save handler was swallowing anything with Ctrl+S to block the browser save dialog.

The one-character fix: stop firing on Ctrl+S when Alt is also held. The flip in the thread is that browsers still give developers no clean way to tell these key combos apart, so the bug keeps coming back.

Perseverance found the spots in 2024 in the Bright Angel mudstone at Jezero Crater: vivianite rims around greigite cores, the chemical leftovers of a redox reaction that living cells drive on Earth. The sample sits cached, waiting for a Mars Sample Return mission that lands no earlier than the 2030s.

On HN, the loudest objection wasn't that the find is weak but that the test is dodged: NASA, one commenter argued, will never fly the cheap school-grade wet microscope that could prove life outright, because a yes ends the funding for ever-pricier probes.

A developer argues that handing implementation to an AI is like paying someone else to exercise for you: the output exists, but the muscle never forms. His real fear is the pipeline, where senior engineers who validate AI work get there only by once doing the grunt work themselves.

The pushback came from people with long resumes. One ex-Google engineer countered that the creativity was always in defining the feature, never in the typing, so the only thing AI killed was the part that was already mechanical.

Beck's argument drops the old 'you save typing' defense of YAGNI and replaces it with discounting: build structure now for a feature arriving in three months and you've sequenced cost ahead of return, a loss that lands whether or not your prediction was right.

Half the thread debates the economics; the other half noticed the author's own disclaimer that the back half is a 'genie-generated description of YAGNI', ran it through Pangram, and got 70% AI. One regular: 'I don't know what happened to Kent Beck.'

Bashblog generates a full static blog, RSS, tags and backups from one ~1,200-line Bash script that leans only on standard Unix tools. No runtime to install, no database. It has 1.9k GitHub stars.

The objection was blunt: one engineer said there's zero advantage to bash past a few lines, with editor syntax highlighting breaking across the file. The counter came from someone who runs web servers in 128MB of RAM, where pulling in Python or Node is exactly the cost you're trying to avoid.

Raymond Chen pulled the 100 most recent crash dumps for one third-party program into a pivot table. They looked like four separate bugs: 11 stack overflows in shell32, 23 access violations in an unknown component, more overflows in ctxapclient64. One cause produced all of them.

An engineer who reproduces Windows bugs under virtualization had a sharper question than the diagnosis: what support tier do you need before the legendary Chen ever looks at your coredumps?

The dataset is a revival: the long-defunct McCallum/jcmit price archive, pulled off the Internet Archive and extended past mid-2024 with Amazon pricing. Prices are nominal, not inflation-adjusted.

Commenters split on whether the chart even means anything: '$/GB is a totally useless unit' when 1960s machines shipped with kilobytes, says one. Another notes the log scale flatters the recent spike, and a third faults it for never marking the DRAM cartel years.

Wayfinder sits behind any OpenAI-compatible client and decides local-vs-cloud from structure, not meaning: 'a fast, offline hard-or-easy call on every prompt, scored deterministically, with no model call.' Lexical features beat held-out hard prompts by ~20% but didn't generalize, so they ship off by default.

A CISO building his own router said it from first-hand experience: you cannot route between models with different context windows and tool tuning at proxy level without fighting the very tricks that make the harness work.

Nikkei's question is whether China can clone the world's most complex machine. Beijing's Big Fund Phase 3 put $48 billion behind the effort, yet China's own SMEE lithography tools still can't reliably hit even mid-range nodes, and one customer said a machine "still doesn't work properly" a year after delivery. A BofA analyst's timeline: 5, 10, or 15 years, and "highly unlikely" to match ASML.

The HN thread mostly answered "of course they can", then split on the real bottleneck. The harder counter wasn't about machines at all: ASML's moat is the partnership web (Zeiss, IMEC, the US Department of Energy), and the West is the side projected to be short 100,000 chip-talent workers.