Top of Hacker News

The US government's chief technology officer tweeted that China's Moonshot AI illegally distilled Anthropic's Fable model to build Kimi K3 — released just three weeks after Fable itself went public.

The thread ran the timeline: Fable's access limits lifted July 1, K3 shipped July 16. Commenters found the compressed window less like theft, more like a stretch. One AI-lab-adjacent voice called it "BS to pressure politicians"; HN's own moderator waded in to police the discourse rather than settle the science.

A security researcher: distillation is real, but doesn't require the drama — "99% of the work is already done by that point."

A viral tweet argued passkeys flopped with regular users because the engineers who built them have zero feel for the "consumer brain." The thread agreed passkey UX is broken, then went somewhere the tweet never mentioned.

A security engineer flagged the actual landmine: passkeys support device attestation, letting services silently restrict logins to Google, Apple, or Microsoft's own clients — and there's a maintained list of blacklisted alternative apps.

Someone else pointed out passkeys are conceptually just SSH keys with better marketing — and SSH keys never made it past sysadmins either.

A fake Y Combinator recruiter sent a Python take-home test with a hidden pre-commit Git hook wired to a remote server — the moment you'd run `git commit`, it would fingerprint your OS and silently download stage two.

The attacker cloned a real, innocent FastAPI project off GitHub and just swapped in a malicious `.git` folder, then customized a unique payload ID per victim.

The final-stage script pulled in `hardhat`, an Ethereum dev toolkit — this wasn't credential theft, it was built to reach into crypto wallets.

Reddit now requires login to view old.reddit.com, framing it as a safety measure against scraping. A developer's own request logs show the new interface is heavier, slower to build, and phones home constantly.

The real motive surfaced fast: Reddit has licensing deals with OpenAI and Google, and blocking the lightweight old interface makes it harder for rival AI companies to scrape training data for free.

The article's own author showed up in the thread: nuke old Reddit outright if you mean it, he wrote — don't hide an economic decision behind a security excuse.

A Redfin survey of 4,000 Americans found 53% oppose new data centers nearby — more resistance than apartments or mixed-use development draws. Baby boomers oppose them 65% to 34%; Gen Z splits closer to even at 42%.

Redfin's own county tax-record data cuts the other way: Loudoun County, VA — 176 data centers, the most in the US — saw education spending per resident jump 77% and teacher pay rise roughly 40%, funded entirely by data centers' property taxes.

A resident with 9,000+ karma who lives near several data centers: the backlash isn't really about the old, quiet ones — it's the new generation, built at a scale that didn't exist five years ago.

Codeberg's community assembly merged a policy banning cryptocurrency projects, citing reputational harm from fraud and high-risk speculation associated with the category.

A Google Android SRE pushed back hard in the thread: banning abuse is fine, but a volunteer-run git host imposing blanket moral judgment on an entire technology category "seems chilling."

The wording bans anything "cryptocurrency related" without defining the term — leaving cryptography libraries, consensus-algorithm research, and privacy tools plausibly caught in the net.

Terence Tao published a raw ChatGPT transcript exploring a counterexample to the century-old Jacobian Conjecture — not a summary of the math, but the actual back-and-forth, phrased like an expert cutting straight to the point.

One line stood out to readers as unmistakably his register: "I've activated Pro. Can you continue to look for a potential geometric explanation of the X_3 ~ A3 miracle that avoids coordinates or other unmotivated constructions?"

Someone tried the trick everyone eventually tries: ask ChatGPT to guess who it's talking to from the same transcript. Unprompted, it guesses "math researcher or paper author."

OverpAId is satire: a fake product page pitching an AI "Chief Executive Replacement Engine" that runs on a $4,699 desktop and decides in 4 milliseconds what a real CEO takes weeks to deliberate.

Its numbers aren't fake — a 290:1 CEO-to-worker pay ratio, executive pay up over 1,000% in four decades, and over half a million tech layoffs already blamed on "AI efficiency" while compensation at the top held steady.

One HN reply, unprompted: living in New York, they've met plenty of real Harvard/Yale "CEOs" — and the gap between the polished all-hands persona and any unscripted conversation is the actual punchline.

Dynomight dug into the creatine-and-cognition literature and found the famous 2003 result — an 18-point-equivalent IQ jump in vegetarians — never held up under later, better-designed replication.

A 2023 study with nearly three times the sample size found an effect roughly a tenth the size, not statistically significant. Europe's food safety regulator reviewed ten human studies in 2024 and found no consistent effect.

The sharpest thread pushback: a null result doesn't mean "no effect," it means "not enough evidence to reject no effect" — and creatine reaching the brain at all is a real, different claim than most supplements can make.

A blog post collects small businesses that replaced real photography or plain typography with AI-generated menu and signage imagery — and argues the AI versions look worse, not just cheaper.

The centerpiece: an Austin restaurant's AI rendering of its spamsilog dish next to the actual $10 plate the author ordered. The real food is more appetizing than the AI's guess at it.

A commenter with 0.79 karma-weight standing: AI menus and signage are becoming "the dog whistle for 'cheap'" — telling customers what quality to expect before they've read a single item.

Bento packs a full PowerPoint-equivalent — slide editing, live viewing, embedded data, real-time collaboration — into a single HTML file you can open in any browser, no install, no account, no server-rendered app.

The creator showed up in the thread to explain the internals: readable JSON slide data up top, a compressed app shell that inflates in-browser, and end-to-end encrypted collaboration running through Cloudflare Durable Objects.

One pointed question in the thread: why does the homepage mention AI over twenty times, wrapped in walls of obfuscated base64 — a fair complaint about marketing noise on a genuinely clever piece of engineering.

After trying Google, DuckDuckGo, Brave Search, Qwant, and a self-hosted SearxNG instance, a blogger resubscribed to Kagi — a paid search engine — and wrote up exactly why nothing else stuck.

Google was the biggest letdown: "terrible" results, prioritizing multimedia over the plain text he was actually searching for — "I just want to look up some text."

The clincher wasn't search quality alone — it was Kagi's built-in custom CSS support, letting him restyle the interface in a way he couldn't reproduce with userscripts on any competitor.

"Pelicanmaxxing" is the theory that AI labs secretly train models to nail Simon Willison's informal pelican-on-a-bicycle SVG benchmark, since it's become a widely watched proxy for model quality.

A developer tested it properly: 8 animals × 6 vehicles, 7 frontier models, 1,008 total SVGs, scored by GPT-5.6 for coherence. Pelican-on-bicycle ranked 42nd out of 48 combinations — nowhere near suspiciously good.

Regression analysis found no statistically significant per-lab boost for pelicans specifically. If anything is being gamed, the data points to general "SVG-maxxing," not the meme benchmark itself.

GigaToken is an open-source drop-in replacement for HuggingFace's tokenizer library, claiming up to ~1,268x the throughput on the same benchmark — SIMD-optimized regex pretokenization plus aggressive caching, not a new algorithm.

Benchmarked across three chip families — AMD EPYC server, Apple M4 Max, and a Ryzen desktop — the speedup held everywhere, from 106x on the smallest chip to 1,268x on Apple silicon.

The most-upvoted reply cut against the hype gently: tokenization is typically under 0.1% of total inference time — so who is this actually for?

Hatchet's Postgres guide walks startups through schema design, query optimization, and scaling, with real thresholds — sequential scans get costly past 20k rows, autovacuum runs over an hour mean tuning is overdue.

A commenter who'd run Postgres at an early-stage startup pushed back: monitoring deserved to rank above schema design, because failure modes like transaction ID wraparound give almost no warning — and the AWS alert email is easy to miss, especially on Boxing Day.

Mitchell Hashimoto argues SIMD — processing 4, 8, or 16+ values per CPU instruction instead of one — is simpler than its reputation, because nearly all real-world vectorized code follows the same five-step pattern.

He proves it on production Ghostty terminal code: a one-line scalar loop finding printable character runs becomes a twelve-line vectorized version, delivering roughly 5x real-world throughput on AVX2.

The sharpest thread reply wasn't about the code — it was about control: with SIMD explicit and hand-written, an unrelated compiler update can't silently turn your fast path back into a scalar loop without you noticing.

Historian Benjamin Breen argues quality non-fiction — vetted by prize committees, sustained readership, and expert library classification — is structurally the opposite of algorithmically-generated AI slop.

His evidence is personal: a college shelving job exposed him to prize-winning books like Stefan Zweig's memoir and a four-prize Du Bois biography, work no search algorithm would have surfaced for him.

A reader who'd volunteered judging a real book award pushed back with an inside detail: publishers mass-submit for prizes, meaning the curation Breen trusts is noisier and more gameable than it looks from outside.

A cryptic REM comment opening a 1980s dungeon-crawler BASIC game turned out to be raw Z80 machine code, not text — planted at the precise memory address a USR() function call expected to execute from.

The trick exploited how the Exidy Sorcerer's BASIC interpreter tokenized and stored source in RAM — the comment's bytes landed exactly where executable code needed to sit, disguised as an unreadable remark.

The payload itself did something clever: read the Z80's ever-incrementing R register as a cheap source of randomness for the game's random number seed, decades before hardware RNG chips were common.