Top of Hacker News

Today's GitHub Trending front page is a do-it-yourself kit: blackbird finds a stranger's accounts across the web from a username, hackingtool launches a pile of pentest utilities from one menu, Microsoft's qlib runs AI over quant-trading research, ntfy pushes phone notifications straight from your scripts, and Awesome-CV builds a résumé in LaTeX.

The two security tools are climbing fastest, and neither has a single Hacker News thread behind it. They spread as social link-drops, and hackingtool hasn't shipped a commit since July 2024.

From 7 July, every new car sold in the EU must ship an infrared camera aimed at the driver's face: the Advanced Driver Distraction Warning system. It arms above 20 km/h, tracks your gaze, and beeps when your eyes leave the road for 3.5 seconds. You can mute it, but never permanently.

The thread filled with cars that get it wrong: a Volvo that reads singing as yawning, then nags you for looking at the screen it just lit up. One Ford owner disagreed, saying his system only pings him when he's genuinely distracted, and might save lives.

Chat Control 1.0 expired in April after Parliament rejected it. It is back because a rejected bill doesn't clear the agenda: the problem the government wanted solved is still 'a priority,' so the same text returns with new procedural parameters.

One developer-activist's blunt reframe: chats on Meta, Google and Microsoft were never private anyway, as Snowden showed, so the real move is leaving those platforms rather than petitioning Strasbourg.

Kokoro packs roughly 50 voices into 82M parameters, from a developer who goes by Hexgrad. The post wires it up as a container with an OpenAI-compatible API, so a local LLM can hand off its text and get audio back without renting a cloud voice.

The thread reads less like a debate than a deployment log: a door intercom, Home Assistant over Sonos speakers, epub audiobooks, a Japanese-tutor app. The asterisk comes from someone shipping it in an accessibility product — ask Kokoro to say just 'six' and it blurts 'ah-six-ah'.

The heuristic scores unknown brands on ALL-CAPS length, missing vowels and consonant mashing, then hides, dims or labels them, with three strictness levels, all running locally in the browser.

A seller who owns a dozen Amazon brands tried it and watched it bury KUIU, a high-end hunting label, and flag his own trademarked lines. His explanation: Amazon itself A/B-tests hiding brand names to commodify sellers, so 'no brand name' is a terrible signal for junk.

His thesis lands as a rule: 'truly robust engineering isn't about what works for most; it's about gracefully handling the edge cases.' The thread split on whether that framing is even right.

The sharpest replies went past the post itself: 98% quietly compounds. At 99% right per step a 20-pane dashboard breaks nearly one load in five, and an LLM that nails 99% of tool calls still fumbles almost every session.

The Independent hangs a trillion-dollar-plus price tag on the case — a number almost no one in the thread believes will survive a courtroom. What they can't wave away is the paperwork underneath it.

A Facebook engineer who worked on the relevant team from 2017 to 2019 says the cited documents are real, and that safety projects with evidence behind them were 'cancelled or turned backwards to maximize harm' whenever they cut into Time Spent.

The arrest exposed that Microsoft keeps a Global Device Identifier for every Windows install and can correlate it with the IPs it used and the URLs it reached. What unsettled the thread is the scope, not the ID itself.

The sharpest question is which layer does this. A machine ID sitting on disk is normal; an OS vendor tying it to your live network activity is not. Nobody could say for sure whether it's Edge, Defender, or something lower in the stack.

Slopfix is a three-person software house with one product: deleting AI-generated code. One week, three senior engineers, $10,000, and the bill scales to results. Promise a 50% cut, hit 20%, and you pay $4,000, with a two-week warranty on anything they break.

The thread split fast. Some engineers say cleaning up after coding agents is already their best-paying work; others call it Sisyphus's labor and would rewrite from scratch. And the anti-slop pitch itself reads AI-written: the shop admits it uses Claude Code to do the deleting.

StreetComplete finds gaps in OpenStreetMap near you and turns each into a one-tap quest: is this street paved? what are this shop's opening hours? You answer on-site, and it writes straight to OSM in your name, with no editor and no tags to read first.

Its real trick, one contributor argued: hide OSM's intimidating tagging model until you actually need it, since most tools expose the schema too early. The flip side is that the complexity is hidden, not gone. Another mapper admitted he's never sure he tagged a crosswalk the 'right,' undocumented way.

Germany loosened visa rules to pull in skilled workers, then kept losing them. The DW report and a large expat thread converged on the friction around the job, not the job itself: opaque paperwork where one small error snowballs, and a C1-German requirement, near-fluency, for almost any role outside software.

The sharpest counter came from Germans themselves: the ‘glass ceiling’ expats describe is partly a US import, the assumption that no promotion means failure, when staying in one role for a whole career is simply normal here.

Yang Youlin, 69, a former Nanjing economic-zone official, was sentenced to death for taking 2.21 billion yuan ($325M) in bribes from 2013 to 2023, alongside embezzlement, abuse of power and money laundering. The thread's first reaction was disbelief that a ‘city official’ could reach that number.

The correction came from people who know the system: Nanjing anchors a province with GDP near Texas, and a seat over land grants and permits is exactly where the money collects. Once you are in, the network you pay off never lets you quietly retire.

The Netherlands' new Tulp Fund announced its first cohort: 34 researchers recruited, 29 currently in the US, from Harvard, Stanford, Columbia, Yale and the National Cancer Institute, across vaccines, cancer, nuclear energy, Alzheimer's and astrophysics. The pitch: up to €1M per researcher over five years.

HN's first instinct was to call the money thin, until commenters noted the €1M is a research budget, not salary, enough to fund a lab of PhD students. As the submitter told one skeptic doing the after-tax math: ‘Yet still they come.’

The catch: the scan only sees who answers the DNS query, the front CDN, not where the data actually lives. Cloudflare 'wins' every market precisely because it's the proxy, not the host.

So one reader re-ran the question against 50,000 API subdomains with the CDN fronts stripped out and got the reverse answer: Europe leans on OVH and Hetzner more than AWS. Another, claiming access to better data, said the numbers are off by roughly half.

Dua Lipa's Service95 book club installed the collection inside Porto's Livraria Lello, a ticketed tourist landmark where one visitor says staff refused to sell him a Naomi Klein paperback. Half the thread snagged on one word: with the titles a click away online and 'Livraria' meaning bookstore, not library, is anything here truly banned?

The blunter read: 'banned books' has decayed into a marketing label. The counter: the shelf gathers titles censored somewhere in the world, and Atwood really was banned in Portugal, under Salazar.

Engida frames it as relief, not a sale: joining Vercel lets the team stop 'shaping strategy around monetization' and get back to 'keeping auth open source, framework and platform agnostic.'

The thread wasn't buying the framing. Developers who'd just shipped Better Auth to production started drafting backup plans, one worry leading: nothing stops Vercel from tying the library to its own paid cloud. A blunter read on the whole genre of these deals: 'open source isn't really open any more, it's just pre-acquisition.'

One reader tallied roughly twenty philosophers across every lab on earth, against thousands of engineers, and reckoned there are more economists than philosophers on the payroll. Another noted Starbucks employs orders of magnitude more philosophy graduates than all the labs combined.

Two reads of the actual job surfaced: 'hired to launder regulatory capture for a trillion-dollar corporation,' versus a Fortune 500 senior engineer who holds only a BA in philosophy and calls it the most underrated degree he owns.

Under the bargain dots sit as-is sales where unpaid taxes, water bills and code liens follow the property. On that $3,000 Flint house, a commenter tallied $120,000 owed and a structure due for demolition.

Then the thread split: opportunity, or poverty tourism? One reader called it a digital rag-and-bone hunt and said buyers should 'demand better'; another mocked the pile of excuses people keep listing.

Knot-tiers pinned it fast: a slipped sheet bend, a join sailors have used for generations. The thread's sharper turn was that the clever knot may be beside the point, since most loose ties, one commenter argued, are just a granny knot tied where a square knot belongs, no new technique required.

And the very loop that makes this one adjustable is, a programming-language maintainer warned, exactly what makes it less secure; several people said skip knots entirely and use a cord lock.

The rewrite runs deep. The rendering engine is about 2.4x faster, and Astro moves to Vite 8 with the new Rolldown bundler, which the team clocks at 10-30x faster than Rollup. Several sites now build more than twice as fast as on v6.

But the thread caught the asterisks. Strict HTML compilation now errors on unclosed tags, which blocks upgrading any site that pulls in messy remote content. One developer reported builds that got slightly slower, not faster. And the engineer who wrote the new Rust compiler is in the thread, taking questions.

The list traces back to a 2024 tweet with 876k views, not to any statement from Ilya himself. As the reader who found it shrugged, that barely matters: AlexNet, attention, ResNet and the Transformer are landmark reading no matter who assembled the set.

The 'beginner friendly format' promise drew the sharpest fire, from broken LaTeX to a three-line review ('beginner friendly format / looks inside / math'). But the author, posting openly and taking the hits, shipped toggles for the animations within a day.

The frontend weighs 6.42 MB across 169 requests; Hacker News, also run by YC, serves its homepage in seven requests and 12 KB. The auditor, Gregorein, confirmed the whole list by feeding the files to a single Claude session.

That is where the thread turned on the auditor: anyone with a Claude subscription could run the same check, several noted, and Fast Company's own page pulls 29 MB over 300+ requests. The critique that outlived the pile-on wasn't about the bloat at all. It was about measuring work in lines of code.

The app talks to Apple's container daemon directly over XPC, the same path the CLI uses, and handles images, logs, live stats and in-container file browsing from one window.

The thread's flip wasn't about the tool. One tester wrote that seeing Claude in a project's GitHub contributors is now a signal the app will be good: native-feeling, tiny, no Electron.

Volume 4B ran 714 pages when it landed in 2023; a fascicle on constraint satisfaction followed in 2025. The page still lists Volumes 5, 6 and 7, compiler techniques last, as work Knuth intends to write.

Then a reader surfaced Knuth's own recent preprint. An AI had solved a conjecture he'd left open, and he wrote it was time to 'revise my opinions about generative AI', calling it a joy rather than a threat.

The pitch is concrete: run existing k4/q/qSQL unmodified, crunch 86.5M rows on one CPU with 'no decode pass,' compression throughout. For shops reluctantly licensing kdb+ from Kx, an independent compatible runtime is the escape hatch they've long wanted.

The top reply ignored the speed. It flagged the copy, 'the vector as the unit of thought,' as pseudoscientific and 'extremely likely to be AI,' and pointed out l is closed-source with no benchmarks against Shakti or kdb+ itself.

PgDog ships its own SQL parser so it can track SET, LISTEN/NOTIFY and prepared statements per client and restore them before each query, the exact features PgBouncer's transaction mode makes you give up. Kokotov says it's run a year in production at 2M queries/sec.

The thread's war stories agreed the tax is real: one engineer who'd just moved a Django app behind PgBouncer found queryset.iterator()'s server-side cursors didn't survive pooling, and statement_timeout in libpq startup params got silently ignored.

The post's thesis: LLMs are "brilliant but clumsy," so wrap that non-determinism in formal tooling. Ragel spits out a 10,000-line correct parser instantly; Claude, told in all caps never to parse by hand, does it anyway, and once committed a build/ directory twice.

The sharpest reply says he misnamed the problem: an LLM's trouble was never determinism. Its input is natural language, which was never formally defined, "words have meaning," and no parser generator can replace the layer that guesses what you meant.

The post's actual advice is what set the thread off: if you want a record of a chat, "grab a napkin," because "not everything needs to be written down."

The thread's sharpest reframe cuts the other way: the objection isn't the AI or the notes, it's that your transcript leaves the room for a third-party cloud and maybe a government database. Run it on-device, several argue, and nobody would care.

Xbox's new layoffs cut 1,600 roles now and 3,200 by 2027, with four studios spun out. Among the reported casualties: the idTech engine team at id Software, the lineage behind Doom, Quake and every Wolfenstein since.

The thread's sharpest read wasn't nostalgia. Keeping an in-house engine means keeping engineers who know it, and can therefore ask for more. Switch to Unreal Engine and you rent low-wage contractors instead, hired per project and dropped when it ships.