Top of Hacker News

In today’s GitHub Trending: paperless-ngx — self-hosted document OCR and archiving; SkyPilot — a layer for running AI jobs across cloud compute; Hyprland — a configurable Wayland tiling compositor; croc — encrypted file transfer between computers.

The outlier is an internship postings repository, updated through issues alongside code projects. Together, the list makes GitHub look less like a showcase for frameworks and more like a public workbench for managing everyday digital logistics.

Anthropic released Claude Opus 5 with headline results that put it ahead of Claude Fable 5 on several tests. The release also leans hard on cost per unit of performance, a framing HN immediately noticed.

The thread’s useful split is between benchmark progress and deployment reality: commenters flagged ARC-AGI-3, asked why a new model matters if Fable remains the general-access flagship, and wondered whether safety classifiers alter the practical experience.

The reported order treats local Bluetooth messaging as a security risk because it can work when internet access is restricted. GitHub had not removed the Bitchat repository when HN discussed the report.

That gap became the thread’s central point: a takedown demand can publicise a tool and cannot erase copies, forks, or alternative hosting. Commenters also connected the case to wider pressure on sideloading and decentralised distribution.

The reported camera flaw was not a subtle remote exploit: the login page itself exposed a GitHub administrative token. That turns a device setup page into a route toward a vendor’s software supply chain.

HN commenters broadened the lesson to hard-coded defaults, mobile apps, and embedded products where security review appears to arrive after shipping. One commenter said obfuscation once made this kind of inspection tedious; modern tooling makes it cheap.

The Codeberg debate pits a community’s right to reject AI-generated projects against users who want development infrastructure to be predictable and neutral. Both sides agree generated contributions can create real maintenance work; they disagree on who should draw the line.

The thread’s clearest warning was operational: a host that can remove legal projects under a broad rule may not feel like stable infrastructure. The answer from the other side was just as direct: communities are allowed to say no and build different rules.

DBOS argues that LISTEN/NOTIFY can serve high-throughput workloads with the right design. The thread accepted the measurement but resisted the headline, noting that its 8KB notification payload limit and delivery semantics define where it fits.

The valuable takeaway is architectural rather than tribal: use notifications to signal durable rows or work, not to pretend they are an unrestricted message bus. A system that handles 60,000 events per second may be excessive for one team and inadequate for another.

The proposal targets on-device ADB, not ordinary USB debugging. Supporters in the thread saw a straightforward physical-security improvement; critics saw another default that removes a power-user option rather than making the risk legible.

The disagreement turns on threat model. An owner with exclusive control of an unlocked phone sees convenience; someone facing an automated inspection or temporary seizure sees an unusually accessible attack surface.