GitHub

Ioannou, an engineer at Bold.org, pulled his GitHub history and found his median weekday had gone from 3 or 4 contributions to 7. Days with no activity fell from 40 to 46 a year to 18 so far. He blames cheap starts: agents make every new project easy to begin and hard to put down.

The thread's sharpest reply came from commenters who think he misread the deal from the start.

Forgejo and Codeberg kept coming up for people who want a lightweight forge they can host or use as a public service; GitLab was the answer for organizations that need a familiar enterprise-shaped platform.

The useful distinction was not hosted versus self-hosted. It was whether a team needs GitHub Actions and App integrations, or merely Git repositories with dependable CI.

Users reported failures across Microsoft services and pointed to GitHub’s long-running move toward Azure; neither observation alone established the root cause.

A second explanation was load: commenters cited rapid growth in commits and new accounts as AI-assisted development turns GitHub into a much busier system.

GitHub reported degraded availability for Actions and Pages, interrupting two services many teams use to build, deploy, and publish.

Developers in the thread were less interested in the status page than in the accumulated reliability cost of treating hosted CI as invisible infrastructure.

The Cursor forum change removes a way for paying users to inspect consumption and cost information. In a product sold around model access, that makes the bill harder to audit.

HN readers connected the decision to a broader shift: users can move between AI tools more easily than they could move away from a traditional IDE, so transparency can be part of retention.

The reported order treats local Bluetooth messaging as a security risk because it can work when internet access is restricted. GitHub had not removed the Bitchat repository when HN discussed the report.

That gap became the thread’s central point: a takedown demand can publicise a tool and cannot erase copies, forks, or alternative hosting. Commenters also connected the case to wider pressure on sideloading and decentralised distribution.

The reported camera flaw was not a subtle remote exploit: the login page itself exposed a GitHub administrative token. That turns a device setup page into a route toward a vendor’s software supply chain.

HN commenters broadened the lesson to hard-coded defaults, mobile apps, and embedded products where security review appears to arrive after shipping. One commenter said obfuscation once made this kind of inspection tedious; modern tooling makes it cheap.

A fake Y Combinator recruiter sent a Python take-home test with a hidden pre-commit Git hook wired to a remote server — the moment you'd run `git commit`, it would fingerprint your OS and silently download stage two.

The attacker cloned a real, innocent FastAPI project off GitHub and just swapped in a malicious `.git` folder, then customized a unique payload ID per victim.

The final-stage script pulled in `hardhat`, an Ethereum dev toolkit — this wasn't credential theft, it was built to reach into crypto wallets.

GigaToken is an open-source drop-in replacement for HuggingFace's tokenizer library, claiming up to ~1,268x the throughput on the same benchmark — SIMD-optimized regex pretokenization plus aggressive caching, not a new algorithm.

Benchmarked across three chip families — AMD EPYC server, Apple M4 Max, and a Ryzen desktop — the speedup held everywhere, from 106x on the smallest chip to 1,268x on Apple silicon.

The most-upvoted reply cut against the hype gently: tokenization is typically under 0.1% of total inference time — so who is this actually for?

Developers aged 22-25 have lost 19% of their jobs since late 2022, even as total US developer headcount grew 10% to 1.69 million. Laurie Voss argues the collapse is hiding inside a boom.

His flip: 36 million people joined GitHub last year, and most never call themselves programmers. The job title is dissolving into a skill.

The thread splits on whether the charts even carry AI's fingerprints.

The provocation was doing a lot of work as written, so the author stepped into the thread to narrow it: as a mathematician, he means you can't find all bugs or any particular bug — not that finding bugs never happens.

A WebAssembly co-founder wasn't buying the softened version either, calling the thesis 'self-justification for being a lazy code reviewer.' And a 90k-karma veteran landed the real finding: there is no 'the' purpose — we all thought we were reviewing for the same reasons, and we simply aren't.

The joke lands because Sony just announced PlayStation is dropping physical media, and here's GitHub offering to put your code on a disc. Nice bit — except the 'GitHub' offer is a generic Microsoft Forms page anyone could have made, which is exactly what phishing looks like.

The thread couldn't decide if it was official, and enjoyed it anyway. One caught the archival irony: these would be burned discs, good for ~10 years, versus GitHub's real Arctic Code Vault. Another caught the copyright one: it asks permission to press your public repo to a CD — but training AI on all of it didn't need a checkbox.

Bashblog generates a full static blog, RSS, tags and backups from one ~1,200-line Bash script that leans only on standard Unix tools. No runtime to install, no database. It has 1.9k GitHub stars.

The objection was blunt: one engineer said there's zero advantage to bash past a few lines, with editor syntax highlighting breaking across the file. The counter came from someone who runs web servers in 128MB of RAM, where pulling in Python or Node is exactly the cost you're trying to avoid.

An anonymous repo dropped dozens of exploits at once, neatly documented, daring readers to report them for credit. The framing — a flood of fresh 0-days — set off the usual alarm.

Then people who reverse-engineer for a living read the code: most aren't 0-days at all, several aren't even vulnerabilities. One reviewer found a "7-Zip exploit" that only proves the parser is reachable. The unsettling part isn't the bugs — it's who, or what, is generating them at scale.

Greptile pulled the numbers off the fastest-growing repo in GitHub history: contributions that demand deep codebase knowledge get merged nearly 4x more than novel features. Speed predicts nothing.

The thread split on the fix. Some want reputation scoring borrowed from anti-spam history; others want AI contributions banned outright, and one engineer noted the email analogy quietly breaks.

The coupling runs deep: crates.io usernames mirror GitHub usernames, the users table carries gh_login and gh_id columns, and team ownership maps onto GitHub teams. Decoupling means rebuilding auth while the registry stays live.

An RFC to unblock multi-provider login finally merged and implementation has started. But a Cargo maintainer notes the real bottleneck isn't code, it's that nobody is paid to do the boring work.

It started with one copied repo carrying a link to a zip archive. The clone re-pushed an identical commit every few hours to stay at the top of GitHub's 'recently updated' list and out-rank the original in search.

To measure the scale, the author parsed 16 million commit pushes from GHArchive over five days. Of 40,000 repos updating 1-24 times a day, exactly 10,000 matched the campaign's fingerprint. Submit the download link to VirusTotal: zero hits. Submit the zip itself: Trojan.

The kicker isn't 14 billion commits. It's that those are agent check-ins, not features shipped — agents now write to GitHub while they think, not after a human has.

One commenter recalls GitHub's founder telling a Microsoft exec years ago that Azure's virtual disks weren't fast enough on IOPS to host GitHub.

And the article making this claim is itself an AI-generated, mostly-empty React page from a self-described one-person, vibecoded site.

Running npm install would have been enough. The package's prepare script auto-runs a file that, buried under walls of commented-out tests, fetches and executes whatever a remote server sends back.

He never cloned it locally. He spun up a throwaway VPS, pointed a read-only AI agent at the tree, and it flagged app/test/index.js almost immediately. The thread's verdict on who's behind it was fast and grim: DPRK.

Open a poisoned repo in an AI coding IDE and a setup hook runs on its own, lifting your tokens. Harnesses like Codex or opencode reportedly dodged it.

The thread's correction to the headline: this isn't a hole in 'Microsoft's open source' so much as a supply-chain hit, and pulling 70+ repos fast was the right call, not the scandal.

A CISO's deeper worry: agents now juggle many unrelated projects at once, so the blast radius of one bad dependency just grew.

A Claude Code skill generates the tutorial; a Go CLI stores it in ~/.lathe/tutorials/ and serves a reader at localhost:4242. A second model pass verifies the code compiles before delivery.

The philosophy: human docs come first. Lathe fills gaps where none exist — new libraries, internal tooling, undocumented APIs.

A Pluralsight instructor warns that LLMs make incoherent curriculums beginners cannot catch. Others counter: typing code by hand builds more fluency in hours than weeks of passive reading.

The issue shows Anthropic already runs Ubuntu 22.04 inside Claude Desktop via Cowork, already ships linux-x64 and linux-arm64 CLI binaries — making the missing desktop build a policy gap, not a technical one.

The unofficial repackage has 4,500 stars; its maintainer runs a bank of VMs just for compositor testing. One Anthropic engineer responded in the HN thread: four words, no timeline.

Discord ships Linux with audio capture and three package formats. The thread asks not whether it's hard, but whether Linux is in the target market.