Top of Hacker News

One reader tested the censorship complaint directly, asking four Chinese models (Kimi K3, two Qwen variants, and GLM 5.2) to write a function named FreeTaiwan(). All four wrote clean, working code with the banned name intact.

A different reader called the whole framing suspicious: the post reads like the argument Palantir's CEO made on CNBC days earlier, and enterprises don't actually care whether a model is open: they care whether the vendor promises to delete their data.

The post itself was simple: was anyone else's AWS bill suddenly showing nine or ten extra zeros? Hundreds of replies said yes, from a $286 million alert to one account reading a flat $109 billion.

The most surprising part wasn't the bug itself: AWS never sent a direct alert about it. Users had to stumble onto a single line buried on the AWS Health status page to learn their multi-billion-dollar bill was fake.

You drag each color-coded plane's path by hand to the runway threshold that matches it, landing and launching before two aircraft collide. There's no tutorial: players spent their first minutes inventing their own routing rules, then their next minutes crashing anyway.

A Principal Engineer at AWS who works on EKS showed up with a detailed list of interface fixes. Someone else had already worked out you could just POST a fake score straight to the API, and the board filled with ten-thousand-landing runs that never happened.

Her blog's URLs are date-stamped, and the phantom hits match that pattern too closely for coincidence: a model invents a post, hands a reader the link, and the link goes nowhere. She frames it as Michael Crichton's "Gell-Mann Amnesia effect": catching a source's confident errors on a topic you know, then trusting it on everything else.

A well-known HN security engineer dismissed her argument as relitigating a two-year-old debate. A second blogger said the same pattern hits her own site, her name attached to things she never wrote.

Security firm KELA has named the attacker as Zakaria Mahdjoub, working out of Oran, Algeria, the same actor blamed for breaching Sweden's e-government systems and land registries in five other countries within the past three years.

One HN commenter noted Algeria has an extradition treaty with Romania, an odd choice of target for someone hoping to stay unreachable.

The essay under discussion ranks Anthropic as the most exposed frontier lab of all: it rents every data center and power plant it uses, and Fable costs nearly three times as much per completed task as OpenAI's models do, according to the Artificial Analysis benchmarks it cites.

The sharpest pushback on HN wasn't about that cost math — it was that Anthropic's own scramble for a product moat is what blew up the Figma partnership in the first place.

The map: three polynomials in three complex variables, Jacobian determinant exactly -2, sending three separate points to one identical output, the exact collision the conjecture rules out.

One top reply wasn't about the math: it noted the announcement describes two people and a model working together, not a lone AI feat. Mathematicians split hard, from "sweeping up easy leftovers" to "we're a bit fucked."

XR-1 tops every rival model Xiaomi tested it against on four manipulation benchmarks, RoboCasa, RoboCasa365, VLABench, and RoboDojo, and the company says its accuracy scales as predictably with more data as a language model's does.

Developers who went looking for the promised open code found only leftovers from Xiaomi's previous robot model: the GitHub and Hugging Face repos for XR-1 itself were empty.

The push didn't start with Brussels selling anyone out. In 2022 the US told visa-waiver countries to hand over biometric databases or lose the exemption; the EU Council only authorized negotiations in December 2025, and a draft text leaked in May 2026.

A Mozilla engineer who volunteers on a data-rights project pressed a sharper question in the thread: does the deal cover only people applying for US travel authorization, or the EU's entire biometric archive?

Dr. Joy Evers, an ER physician, says the insurer denied further coverage six days into her husband Randy's recommended eight-week psychiatric stay — ruling that since he'd never had a prior episode, he didn't need it. A day later, the facility discharged him.

The sharpest thread correction: insurers deny claims, not care — providers choose to discharge someone who can't pay. Separately, a federal Department of Labor case had already caught Kaiser doing the same thing: delaying and steering patients away from in-network mental health treatment.

LED streetlights went from rare to covering more than half of America's streets by 2019, sold almost entirely on the promise of lower energy bills. Global light pollution is still climbing by nearly 10 percent a year despite that switch.

One HN reader watched his own city get it backwards: after new LEDs replaced old lamps with a tightly aimed beam onto the road, nobody noticed the footpath beside it had gone dark until joggers started running in traffic instead.

The pitch includes a Cron engine for scheduled overnight runs, an "agent swarm" that splits work across sub-agents, and pre-wired financial data feeds for US, Hong Kong and mainland stocks. It ships only for Windows and Mac.

The line "Let's take something off your plate" turned out to be lifted straight from Claude Cowork's own hero image. A commenter who says he builds LLM systems for a living found a bigger problem: the privacy page promises consent before Kimi touches your files, but never mentions it already reads them without asking.

Aaron Walayat, a law professor who studies eminent domain, traces the doctrine to the Fifth Amendment: 'public use' plus 'just compensation' — the same tool that let Connecticut bulldoze homes for a Pfizer redevelopment in Kelo v. New London that never got built.

Commenters flagged that the circulating headline had it backwards: it's the power line being condemned, not the data center, and state courts have drawn a hard line here before, denying takings that serve mostly out-of-state or private buyers.

Kues adapted a prompt OpenAI built for math-olympiad problems and pointed it at WordPress's raw source with no hints. It found the REST batch endpoint validates and executes requests separately — a gap it used to slip a SQL injection into a live query, the start of a much longer chain.

One reader asked why bother with the rest of the chain: with SQL injection already in hand, why not just write an admin account straight into the database? Others went after the $500,000 figure itself, tracing the byline to a rival AI vulnerability-scanning shop.

PhD students are now expected to pay $200 a month for access to models like Sol and Fable — Harvard already comps the subscription for every student, postdoc and faculty member in its math department.

Not everyone in the thread is impressed: one commenter dug into the Jacobian conjecture's citation history and found mathematicians had already bounded the search space by 1983 — the AI didn't discover new territory, it just finally searched it.

The complaints ran from petty (re-reading its whole config file every turn, wrecking prompt caching) to serious: approving one throwaway Python command with "Always" silently green-lights every future Python call, including one that reads your SSH keys.

Simon Willison defended one pettier complaint, baking the date into every prompt, as standard practice. OpenCode's own developer said the harshest bug, a context-pruning behavior, was already disabled by default months before the post went up.

The essay, adapted from Stapleton's book *Don't Be Evil: Bad Bosses, Fake Promises, and My Escape from Big Tech*, traces Google's arc from moon-shot optimism — Larry Page once dismissed curing cancer as too small a goal, since it would add only three years to average lifespan — to the 2018 walkout after the Andy Rubin harassment scandal.

A commenter who says he was at Google from 2006 to 2025 backed the account: "this matches my recollection. Honestly, it's a very restrained document" — a rare on-the-record insider confirmation.

The library ships as 40 zero-dependency web components — jelly-button, jelly-otp, jelly-range, jelly-dialog — dropped onto a page with one script tag. Dark mode, right-to-left layout and WCAG AA color tokens come built in.

A reviewer found the six-box OTP input repeats a known anti-pattern, plus undersized hit targets on pagination. One reader flipped the critique: the same squishy hit-boxes could make tiny buttons far easier to hit for anyone without fine motor control.

Ben Thompson's essay argues Chinese AI panic is overblown: Moonshot's Kimi K3 prices tokens at $3/$15 per million against a frontier rival's $5/$30, evidence he reads as intelligence turning into a plain commodity, not a security crisis.

One reader who benchmarked roughly 50 models for a real production system found the opposite: frontier models were far more token-efficient than open-weight ones, even scoring worse on raw accuracy — the number Thompson's argument never cites.

The trigger was smaller than the Michelangelo joke: a business contact called him a great source of "leads," and Lynch realized that from the vendor's side, the same fact reads as being good at spotting gullible marks.

Not everyone in the thread was persuaded. Several people who make a living calling themselves "content creators" argued the word is the only one broad enough to cover writing, video, and code without boxing them into one medium.

The distrust behind the move isn't new paranoia: in 2000, a former CIA director wrote in the Wall Street Journal that Washington spies on European allies specifically for economic advantage, not just security.

A small SaaS founder in the thread said EU customers are already switching to European competitors over exactly this concern, even though his servers already sit in Europe too, and he expects the pool of US-only buyers to keep shrinking.

Hyprlang configs still run for now — a community-built converter and a neovim plugin already translate them to Lua line by line, and commenters report that LLMs handle the migration without much fuss either.

The sharpest pushback wasn't about Lua's syntax at all: a NixOS packager says a year of stable, cross-compiling builds evaporated overnight once the project quietly forked its own dependency stack, breaking downstream packages for a solid month.

The three flagship models are small by frontier standards: Google's Gemma 4 E2B (10.28 GB, 128K context), Cohere's North Mini Code (19.38 GB, 500K context) and Liquid AI's LFM2.5-VL (3.2 GB) — all sized to run comfortably on a single MacBook.

Not everyone bought the pitch: one reader questioned whether 'frontier' still means anything at this size, and another couldn't say what Nativ does that LM Studio and Open WebUI don't already do today.

A Senior Staff engineer at Google who works on the Perfetto tracing tool called the underlying premise "a very simplistic take" — constraints trade off against each other and rarely collapse to one answer.

Another reply described the worst codebase of their career: a team building an elaborate microservices architecture for a web app with fewer monthly users than the commenter's own hobby website.

The piece traces Microsoft's shift to XML-based DOCX and XLSX after Office 2007, an ISO fight the author calls "one of the most contested in ISO history." Its clean OOXML Strict variant has quietly vanished from recent Office releases, leaving only the messier Transitional format.

A commenter dug up an old post accusing the essay's author of self-sabotage: years of format complaints, they argued, substitute for LibreOffice closing its own feature gap. Another reader's company dropped Microsoft, then hit that same wall anyway.

The detector flagged a 2015 conference paper at 74% machine-written and a 2012 PhD dissertation at 40%, both submitted years before large language models existed, according to a commenter who ran his own decade-old work through the tool.

The tool's creator conceded in the thread that he has no clean way to build a control group of human writing from after 2023, since every available shortcut relies on the very detectors he's trying to outperform.

section33 (who runs an SRE and bespoke-tech consultancy on the side) tore out his bowling alley's original scoring hardware and rebuilt it lane by lane with off-the-shelf microcontrollers, open-sourcing the whole project as OpenLaneLink.

The sharpest pushback in the thread wasn't about his code — a longtime DevOps engineer argued the vendor's price was never really about parts: it buys a phone number to call, and a lane fixed in an hour instead of a weekend, when it fails mid-league night.