Google

CVE-2026-111497 (CVSS 9.2) lets a crafted Brotli stream trigger an out-of-bounds write, and it works in both directions: a malicious server can hit a client, and a malicious client can hit a server.

The thread argued about the name. Whether HTTP is really exposed turned out to depend on one setting.

The NY Post headline says Google cut down 250K trees illegally. A thread commenter reduced it to 1.5 square miles of planted forest cleared before a legally required environmental assessment.

Finns in the thread said that is exactly why the country is angry.

Google's plan requires every Android developer to register centrally, hand over government ID and prove they hold the signing key, even for apps shared outside the Play Store. Power users keep a 9-step escape hatch with a mandatory 24-hour wait.

Commenters split on whether that wait is a fair compromise or the first turn of the screw. One of them brought up tech-support scams.

Google's wording says it will not use data from these services for ads "unless you choose to make data from these services available to other Google services that support personalized ads."

Commenters argued over what counts as choosing, given how many Google products nag you to turn sharing on.

Anthropic's report says agents logged six hours of work for every human hour by August, and juniors fell from 27% to 9% of technical hires. Its revenue per employee was 2 to 4 times Meta's and Google's at the same age.

Hacker News mostly distrusted the messenger: the report 'would say that', and one reader pointed out that every line of code is a liability, not a trophy.

Citizen Lab traced an Israeli ad platform, Discover-Tech, that won 442 million of 3.77 billion impressions it bid on in four months while spending only about $109,000. Advertiser conversions were essentially zero: the ads carried script tags that can hand code to a phone.

An adtech engineer with 13 years in the industry told the thread that vetting that traffic is "virtually impossible". A commenter who once sat in telco-versus-police meetings had heard that line before, and asked why billing is not impossible too.

Homomorphic encryption keeps data encrypted while computation happens, offering a route to cloud AI that does not expose plain inputs and outputs to the provider.

The thread accepted the cryptographic appeal while questioning overhead, commercial viability, and whether privacy alone proves the cloud executed the intended model.

Google's new Gemini 3.7 Flash is aimed at agent workloads, not just chat. Its launch price is $0.75 per million input tokens and $3.75 per million output tokens.

HN readers did not dispute that it is capable; they asked whether speed and Google's multimodal stack justify the price against cheaper competitors.

Mike Elgan says Google News now returns social-media pages and results from the wrong country or language, while searches limited to the past week can surface stories that are weeks or months old.

Readers did not merely complain: they named paid alternatives such as Kagi and Ground News, suggesting that basic control over ranking has become a product feature.

The jump is not a single bug-finding demo: Chrome 149 and 150 shipped 1,072 fixes after the team connected model-assisted discovery to triage, patching, testing, and release work.

The uncomfortable constraint is delivery. A public fix can become an attacker’s roadmap before it reaches users, so Google is also piloting two security releases a week and exploring dynamic patching.

The ruling concerned Google’s attempt to stop scraping through a DMCA theory. Readers saw a narrower legal loss and a broader market signal about access to results after affordable official APIs have become scarce.

The thread’s strongest refrain was not that scraping is consequence-free. It was that restricting the interface while leaving demand intact invites exactly the intermediaries Google is suing.

The proposed ADB change answers a real security concern, but it treats on-device debugging as collateral damage. The author argues that an app cannot silently create the necessary ADB session: the user must already enable debugging and complete pairing or approve a prompt.

HN split between people who see a long-overdue hardening and people who see another capability disappearing from a nominally open OS.

The proposal targets on-device ADB, not ordinary USB debugging. Supporters in the thread saw a straightforward physical-security improvement; critics saw another default that removes a power-user option rather than making the risk legible.

The disagreement turns on threat model. An owner with exclusive control of an unlocked phone sees convenience; someone facing an automated inspection or temporary seizure sees an unusually accessible attack surface.

A viral tweet argued passkeys flopped with regular users because the engineers who built them have zero feel for the "consumer brain." The thread agreed passkey UX is broken, then went somewhere the tweet never mentioned.

A security engineer flagged the actual landmine: passkeys support device attestation, letting services silently restrict logins to Google, Apple, or Microsoft's own clients — and there's a maintained list of blacklisted alternative apps.

Someone else pointed out passkeys are conceptually just SSH keys with better marketing — and SSH keys never made it past sysadmins either.

Reddit now requires login to view old.reddit.com, framing it as a safety measure against scraping. A developer's own request logs show the new interface is heavier, slower to build, and phones home constantly.

The real motive surfaced fast: Reddit has licensing deals with OpenAI and Google, and blocking the lightweight old interface makes it harder for rival AI companies to scrape training data for free.

The article's own author showed up in the thread: nuke old Reddit outright if you mean it, he wrote — don't hide an economic decision behind a security excuse.

After trying Google, DuckDuckGo, Brave Search, Qwant, and a self-hosted SearxNG instance, a blogger resubscribed to Kagi — a paid search engine — and wrote up exactly why nothing else stuck.

Google was the biggest letdown: "terrible" results, prioritizing multimedia over the plain text he was actually searching for — "I just want to look up some text."

The clincher wasn't search quality alone — it was Kagi's built-in custom CSS support, letting him restyle the interface in a way he couldn't reproduce with userscripts on any competitor.

Google's launch post for three new Gemini Flash models compared them only to its own older versions, never once to GLM 5.2, DeepSeek, or any other rival lab.

A Brokk founder ran the missing comparison himself in the thread: Gemini 3.6 Flash lands about even with GLM 5.2 on price and intelligence, just roughly 8 times faster.

Engineers who had built products on the cheap Flash-Lite tier said they were already moving workloads to Deepseek and OpenAI, tired of watching each new release cost more than the last.

The page that just went live promises ads "clearly labeled" and "separate from answers," rolling out first to only seven countries, about 8% of the world's population, and skipping every paying subscriber.

The asterisk sits in OpenAI's own targeting rules: sensitive chats stay ad-free, but the memory they leave behind doesn't. It can still steer which ad shows up in an unrelated chat the next morning.

The essay, adapted from Stapleton's book *Don't Be Evil: Bad Bosses, Fake Promises, and My Escape from Big Tech*, traces Google's arc from moon-shot optimism — Larry Page once dismissed curing cancer as too small a goal, since it would add only three years to average lifespan — to the 2018 walkout after the Andy Rubin harassment scandal.

A commenter who says he was at Google from 2006 to 2025 backed the account: "this matches my recollection. Honestly, it's a very restrained document" — a rare on-the-record insider confirmation.

A Senior Staff engineer at Google who works on the Perfetto tracing tool called the underlying premise "a very simplistic take" — constraints trade off against each other and rarely collapse to one answer.

Another reply described the worst codebase of their career: a team building an elaborate microservices architecture for a web app with fewer monthly users than the commenter's own hobby website.

Google's emissions grew 18% on capital-goods spending for new capacity, and Amazon's cloud arm burned an estimated 78,000 gigawatt-hours in 2025, its largest jump on record.

In the thread, one reader flagged a live preview: Irish datacentres already draw 23% of the country's entire electricity supply, up from just 5% in 2015 - not alarming, another shrugged, since datacentres will simply "ride the transition to green energy for free."

Her clarification is narrow: the phrase covers large language models and text generation only, not chess engines, AlphaFold, or image systems. The vivid "octopus" thought experiment, she says, was a teaching device for non-specialists.

One reader shrugged that the phrase now mostly signals which team you're on.

Ask Studio, the AI that summarizes a YouTube channel's comments, reads those comments as commands. A crafted comment plus one click on YouTube's own suggested prompt makes the assistant echo attacker text as its own analysis.

Pushed further, the payload coaxes the AI into a fake verification link that leaks a private video's title. The researcher reported it twice; Google called it social engineering and declined both times.

The thread doubts the mechanism: one engineer notes the model never actually fetches the URL it writes.

The fine punishes deals that forced Google's apps onto Android phones via pre-installation. The US ambassador to the EU warned Europe against over-regulating its way out of the AI economy.

HN's real fight was whether antitrust even fits Google. One argument: it was built for manufacturers with prices and marginal costs, and Google has neither. A European reader called that a distinctly American way to miss the point — here, antitrust was never mainly about price.

Sweden's Patent and Market Court ordered Google to pay 14.3 billion kronor ($1.5B) to PriceRunner, the price-comparison site Klarna bought in 2022, for demoting it in search while promoting Google Shopping.

PriceRunner had actually sought 78 billion. Google says it disagrees and is weighing an appeal, so the record award is not final; the thread splits over whether a fine this size deters Big Tech or is just overhead.

The EU's digital identity wallet uses Google Play Integrity to vouch for a phone, which rejects de-Googled Android as untrusted. Switzerland uses Android's plain Hardware Attestation API instead; Italy and the Netherlands wired in Play Integrity unconditionally.

A Waag researcher argues that route breaches the Digital Markets Act. In the thread, the developer of the Fenrir protocol predicts nothing changes until an antitrust lawsuit lands.

The complaint was filed by an 'Ellie Piee' located on Bouvet Island, an uninhabited Norwegian territory near Antarctica with a population of zero. The asserted source it 'copied from' had nothing in common with the original. Google delisted the article anyway.

Someone who runs a domain-court case search engine recognized the pattern instantly: he gets the same bogus copyright purges aimed at publicly documented arbitration records. The cost to file is nothing; the cost to fight it falls entirely on the writer.

Google handed police the robbery case in three escalating tranches: first 19 anonymous accounts within 150 meters of the bank, then nine, then the names behind three. One was Okello Chatrie, later sentenced to 12 years. The Court ruled that pulling location data this way triggers Fourth Amendment scrutiny.

But it declined to call geofencing itself unconstitutional, remanding the probable-cause question to the lower court. As one reader put it, the celebration is for a rubber stamp with a few extra steps.

A developer argues that handing implementation to an AI is like paying someone else to exercise for you: the output exists, but the muscle never forms. His real fear is the pipeline, where senior engineers who validate AI work get there only by once doing the grunt work themselves.

The pushback came from people with long resumes. One ex-Google engineer countered that the creativity was always in defining the feature, never in the typing, so the only thing AI killed was the part that was already mechanical.

The Economist frames data-center fights as a preview of bigger struggles and warns that if America yields to “popular rage” it could cede the AI frontier. Several readers read that last line as a Too-Big-To-Fail argument in waiting.

The reframe that resonated: the problem isn't a promising new tool, it's that a few firms already dominate daily life — the 2007 plucky-underdog Google is now big enough that its size alone is the threat.

The complaint isn't that the model erred once — it's that the same question yields different answers each run, with a fabricated fact surfacing a fraction of the time and no mechanism to detect or kill the outliers.

The substantive turn comes via Bruce Schneier's argument: if companies can hide behind “the AI did it,” they get a liability shield no human writer, lawyer, or doctor ever had.

The split that matters is hidden in the piece: Anthropic's constitution leans Kantian deontology (hard rules against lying and coercion), while OpenAI's and Google's models tilt consequentialist, weighing costs and benefits.

Then a philosopher in the thread flips the premise. The labs don't want someone who finds fault, he argues; they want someone to affirm whatever needs affirming. PR, priced cheaper than a $6B acquihire.

Computer use is now native in Gemini 3.5 Flash: the model sees a screenshot, reasons, and acts across browser, mobile and desktop, pitched for software testing and enterprise automation via the API and a Browserbase demo.

Then the thread turns on the marketing. Readers note the headline benchmark chart visually crowns Flash while the numbers show two rivals ahead, and agent builders argue screenshot-driving is the wrong primitive entirely.

Justin Poehnelt, a senior devrel engineer, published an open-source Google Workspace CLI under the company's own GitHub org, wearing Google's logo and brand colors. It hit 20k+ stars and #1 on HN. He says legal grilled him over the branding, and the deeper fear was what agents meant for Workspace.

A former Google Chrome engineer in the thread complicated the cheering: publishing under official Google orgs was routine, but shipping something that looks like an official product without sign-off is the kind of lapse that gets you walked out.

His demos, built with Claude, include a markdown notes app and a node-based video compositor, all editing real local files in-page. The trick is window.showDirectoryPicker(), which lets the user's own cloud-synced folder become the sync layer. The catch the post skips: all three editors of the draft spec are Google engineers, and Jake Archibald showed up to debunk the demo's scariest fear.

Cover letters, résumés, scripted "tell me about a time" answers, even live video calls: each is now, in the authors' words, "infinitely scalable and practically free." Strip the signal from both sides and you select for talent at being hired, not at the job.

The fix on offer is friction: sudden constraints, a defended tradeoff, a culture prizing honesty over polish. The thread shrugged. Qualified people were filtered out by invisible wires long before any model arrived, and the cleanest counter-signal turned out older than software.

Adoption crept up almost linearly, roughly 10 points every three years since 2018, which reads like failure until you notice it's the curve of a mature protocol driven by ISPs making rational cost decisions. Jio, Vietnam and Saudi Arabia climb far steeper.

China's traffic goes unmeasured, so the true global figure is likely higher, perhaps 65 to 75 percent. The long timeline isn't a stall; it's winning slowly.

The thread torched the lazy explanations: no, the growth isn't just AWS bots, and no, you couldn't have "just" extended IPv4.

A blog post titled 'The AI Hate Progression' traces one person's slide from amused indifference to total rejection, built on a single grievance: 'Consent is just gone. It does not exist when AI enters the room in 90% of cases.' Its ask: start over, with consent baked in.

The thread shared the anger and demolished the prescription. tptacek's read: 'start over from zero' sounds utopian enough to give him permission not to care. Others noted consent died with web indexing in 1999, and that the real target is hypercapitalism wearing an AI mask.

VW didn't just drop GrapheneOS support — it shut its API to anything not certified by Google Play, killing the community integrations people used to schedule charging and preheating.

The detail that stung most in the thread came from a reader pointing out that none of this needs to touch a server: your own charging data should be readable locally from the car. Several would-be buyers said they cancelled orders over it — one mid-purchase.

Tested so far on the Pixel 6a, 7, 7a, 8, 10a, 10 and 10 Pro Fold, with official releases coming soon and longer security-patch support than Android 16 gets.

Notably absent from the list: the Pixel 9 and 9a, which several owners in the thread are still waiting on.

The bigger flip: a privacy OS that only installs on phones from the company you're trying to leave, and Pixels aren't even sold worldwide.

The trigger isn't search or Gmail. It's the kitchen speaker that used to read back a clean snippet and now delivers a four-minute Gemini monologue, asking follow-up questions until users start shouting "cancel" and "stop."

Several readers report the same regression on Android Auto: ask for one song, get something "vaguely semantically related with no way to course correct."

But the flip is sharper than the rant: commenters note the de-Google manifesto sits on a site so buried in ads it became a live exhibit of the enshittification it protested.

Ship DRM, AI, or push notifications, he argues, and your survey numbers look great — because the dissatisfied already left, so only the satisfied remain to be counted. The feedback that's left is survivorship bias wearing a dashboard.

The thread split on the diagnosis. One reader refused to pin it on leadership: would the best browser on earth have changed Firefox's fate when it survives on Google's money? Others called that money the whole strategy.

A 20-phone cluster already grades a 75-student class; a 2,000-Pixel datacenter is planned for this fall. The pitch is reuse over recycling: keep the silicon working instead of smelting it.

The thread aimed at the company, not the idea. Why preach open Linux on phones, one reader asked, when Google built the platform specifically to stop you installing your own OS — and others flagged eMMC chips that simply die.

The manifesto's pitch: if intelligence becomes something you can only rent from a few closed institutions, you lose operational freedom, not just software freedom. It wants the freedom to study, repair, audit, and run models yourself.

The thread's puzzle: a model you can't run on your own computer isn't open by the classic definition, and nobody can say who funds open frontier training when a single run costs a fortune.

His objection is specific: a pacifist EU academic who can't support work that could enable surveillance or offensive use against EU citizens, watching "Don't Be Evil" reverse without internal debate.

The cynics weren't shy: "Translation: now I can FIRE." The defenders weren't either — if adversaries build military AI, is being able to counter it the evil, or the absence of it?

It's a 26B Mixture-of-Experts model activating 3.8B params, fitting in 18GB VRAM when quantized — and Google admits output quality trails standard Gemma 4.

A developer who'd used a diffusion model in production said the point isn't 'smart', it's 'stupid fast' — turning prompting back into pair-programming instead of a slot machine.