Sign in to set up offline reading Sign in
8 stories of the day: AI, technology, business and simply interesting discussions — recapped and unpacked.
No click was needed: the moment Node loaded the extension, it added an attacker's key labelled "svc-telemetry" to ~/.ssh/authorized_keys and opened a reverse SSH tunnel to an outside server. Uninstalling it doesn't remove the persistence.
Anthropic says someone with access to Cursor's marketplace published the tampered copy, so readers argued over whose incident this is.
The top HN threads: facts from the discussions, both sides, insider voices. Email, Telegram, or RSS.
The essay borrows a 1983 paper, Lisanne Bainbridge's "Ironies of Automation": the more a system runs itself, the less practice operators get, yet they are needed exactly when it fails. Its proposed fix is staged human-only drills, as the FAA mandates manual flying.
Engineers in the thread split between "Claude finds root cause in minutes" and "nobody will pay for the drills".
Six current employees and audio of a two-hour all-hands told 404 Media the same thing: the sessions were a test, and failing it could cost a job. Andy Yen called them off, admitting a "communication failure on my part" while insisting the AI push continues.
He also promised a reorganisation next month with "no loss of jobs from AI". Staff told the reporters the criteria may still land in performance reviews.
A Wiz alert at 11:43 UTC on October 30 started the incident. By the next day Northflank had enabled Postgres and MongoDB secret rotation for every customer, and turned on audit logs for all accounts, free ones included.
Users reported unauthorized use of their AI provider keys, and the company told them to revoke those with the issuers rather than wait.
Paddy Krishnamurthy joined Cisco when it bought his translation startup EzDubs in 2025. He proposed refactoring legacy code with a two-person team, and president Jeetu Patel replied with an uncapped AI-token budget. The stated goal is 98% of Cisco's legacy code within 24 months.
nesformer computes the weights of a stock Qwen3.5 checkpoint so the model predicts a 6502 CPU's execution log one token at a time, with the 2 KB of RAM held in its Gated DeltaNet state. Traces matched the reference emulator on three test programs, and the weights compress to a 3.3 MB zip. The catch: about 1,650 tokens per second.
A Binary Security researcher found that Azure API Connections swap a user's token for the backend's through one shared API Management instance, so security rests on input validation. Path traversal in DynamicInvoke read a secret from another tenant's Key Vault; later bypasses reopened the hole after each fix.
Tangled, built on the AT Protocol, now keeps issues, PRs and comments as Git objects on the self-hostable knot server, with an attestation written to each user's own PDS. A Rust rewrite of the knot, a Svelte frontend and an in-memory indexer running in 11+ regions come with it. Early users already found gaps: SHA-256 repositories and the comment button.
