GitHub Trending: Today — VeraCrypt, RustDesk, Mullvad, SiYuan, awesome-python
The tools you reach for when you don't trust the cloud are themselves on trial. VeraCrypt is back near the top of Trending not for a feature, but because Microsoft nearly locked its developer out of signing Windows builds, and the certificate behind older signatures is being revoked this week.
In today's GitHub Trending: VeraCrypt (full-disk encryption, the TrueCrypt successor), RustDesk (self-hosted remote desktop, a TeamViewer alternative in Rust), Mullvad (client for the no-logs VPN), and SiYuan (a self-hosted Notion you actually own).
Four of the five are tools you run when you stop trusting someone else's cloud. The catch: each carries a trust dispute the community keeps poking. A signing lockout with a revocation deadline this week, a test root certificate filed as a CVE, an AI agent creeping into a privacy-first notebook.
Today's list reads like a checklist for someone unplugging from the cloud: encrypt the disk, host the remote-desktop relay yourself, route traffic through a no-logs VPN, keep the notes on your own machine. Four of five trending repos are tools you run precisely so you don't have to trust a vendor's server.
| Repo | What it does | Today |
|---|---|---|
| veracrypt/VeraCrypt | Full-disk encryption, the TrueCrypt successor | +114 stars |
| rustdesk/rustdesk | Self-hosted remote desktop, a TeamViewer alternative | +102 stars |
| mullvad/mullvadvpn-app | Client for the no-logs Mullvad VPN | +28 stars |
| siyuan-note/siyuan | Self-hosted, block-based notes you own | +24 stars |
| vinta/awesome-python | The 305k-star curated Python library list | +187 stars |
None of these are new — so why now?
VeraCrypt traces to 2014, Mullvad's client to 2017, RustDesk to 2020. This isn't a launch wave; it's a trust wave. And one thread runs through every repo on it: the moment a "trust no one" tool asks you to trust it, the community pushes back hard. Three of the four privacy tools are carrying an open trust dispute right now, and that friction — not raw novelty — is what's putting them back on the front page.
veracrypt/VeraCrypt — the encryption everyone audits and nobody replaces
+114 stars today · 10k total · C
This is for people who want an encrypted container or a fully encrypted boot drive without handing keys to a vendor: journalists, sysadmins, and anyone who inherited the TrueCrypt habit and never let it go. It is the biggest security gainer on the list, and the reason is not a feature.
In January 2026 Microsoft suspended lead developer Mounir Idrassi's signing account, freezing new Windows builds with an automated "did not meet verification requirements" notice and no appeal. Access was restored on April 10, and Idrassi shipped a 1.26.28 maintenance build with freshly signed EFI bootloader components. The catch sits on the calendar: the certificate authority behind older signatures was set for revocation in late June, after which Secure Boot machines could refuse to load VeraCrypt's bootloader and leave encrypted drives unbootable. That deadline is this week, which is why long-time users are scrambling back to the repo to update.
What makes VeraCrypt durable is how its users treat the project itself: as something to verify, not trust. When a 2022 test build (1.26.1) arrived as a sprawling, poorly-explained pull request, readers picked apart its provenance before anyone shipped it widely.
"One of the PR submitters has two GitHub users, both used in commits in the PR... The PR contains many changes and does not describe them well enough. It does not seem that any meaningful amount of code review by maintainers went into it." — an HN reader who traced the commits across three separate accounts
The maintainer pulled the build and moved it to a dedicated branch. That audit-first reflex is why a C codebase from 2014 still tops Trending instead of a flashier successor.
rustdesk/rustdesk — host it yourself, inherit the scrutiny
+102 stars today · 117k total · Rust
The audience is IT teams and homelab users who want to reach a remote machine without renting TeamViewer or AnyDesk seats. The pitch is a Rust and Flutter stack — client plus an optional self-hosted relay — so sessions never pass through a third party's cloud. "Your data, your server" is the entire appeal, and also exactly where the scrutiny lands.
RustDesk's most-cited HN thread is not a celebration. It is an investigation into a test root certificate the Windows installer dropped into Trusted Root, later filed as CVE-2024-25140 at CVSS 9.8. The vendor's defense: it has no EV certificate and used the test cert to sign a kernel driver. Even on the original launch thread, the marketing line about safety drew a correction.
"'You have full control of your data, with no concerns about security.' This makes me a little worried... the belief that [Rust] is sufficient for users to not have to worry about security is misguided." — an engineer on the 2022 launch-day thread
The bug tracker tells the day-to-day story. The top open issues are a years-long "waiting for image" freeze and audio latency that accumulates until sessions lag: the unglamorous tax of running your own remote-desktop infrastructure.
siyuan-note/siyuan — a Notion you own, now reaching for an AI agent
+24 stars today · 45k total · TypeScript
SiYuan targets note-takers who want Notion's blocks and database views without Notion's servers: local-first, self-hostable in a single Docker container, with end-to-end-encrypted sync. Built in TypeScript and Go, it stores every block under a permanent ID, so internal links survive any restructuring of the notebook, the technical detail prospective users keep probing for. The newer wrinkle is direction: the project's topics now include mcp and ai-agent, and a June 2026 AI Agent feature thread has drawn more than 100 comments, a privacy-first notebook openly negotiating how much AI to let in.
Its 308-point HN debut exposed the recurring friction. The top question was not about privacy at all.
"This looks nice but nearly identical to Obsidian. How does it differ from Obsidian's features?" — the most-upvoted reply on the launch thread
The honest answer is ownership and those block IDs, not looks. But the same thread raised the harder doubt: whether a committed self-hoster wants a running server at all, when plain Markdown files in a private repo already cover the job without one.
mullvad/mullvadvpn-app — the quiet one, judged on its bug tracker
+28 stars today · 7k total · Rust
Mullvad's users pay a flat rate tied to an anonymous account number for a no-logs WireGuard and OpenVPN service; this Rust client is the open-source desktop and mobile front end, wrapping both protocols with split tunneling and a kill switch. Alone among today's privacy tools, it carries no active trust controversy: the no-logs model and external audits are its reputation, and nobody is litigating them this week.
That absence is itself the anomaly. Mullvad has effectively zero HN conversation: its three submissions over the years drew no comments at all. The entire signal lives in the issue tracker, and the open complaints are Linux-desktop papercuts: split-tunneled apps losing internet access, the GUI failing to launch at startup, no connection after waking from sleep. It is the rare repo here where users argue about the code's rough edges rather than its integrity.
The outlier that proves the theme
vinta/awesome-python breaks the pattern by having none of it: a 305k-star curated list, +187 today, trending for no reason anyone can point to. Its oldest critique still lands.
"I'm not sure I'd call this list curated... where there are multiple libraries in a category it provides no guidance on how to choose one over another." — an HN reader who went to file a PR and found hundreds already open
A huge star count, in other words, is not a recommendation, which is the same lesson the privacy tools teach from the opposite direction.
What a star buys you here
For this corner of GitHub, a star is the start of an audit, not the end of one. The self-hosting promise that draws people — your server, your keys, your data — quietly hands them the verification burden the vendor used to carry. VeraCrypt's signing scare makes that bill explicit: own your encryption, and a certificate-revocation deadline you didn't set becomes yours to track, this week, or your drive won't boot. The repos trending today are the ones whose communities decided that burden is worth carrying. They simply refuse to pretend it comes free.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Claude Code read his MRI and disagreed with the radiologist. A real radiologist read the thread
An orthopedist diagnosed a Grade III shoulder tendon tear, then treated it with shockwave therapy and a homeopathic injection. Opus 4.8, fed 266 MB of raw DICOM files, said the tendon was intact.