10201
Oh-Auth – Abusing OAuth to take over millions of accounts
OAuth Account Takeover. Salt Labs shows how hackers could abuse OAuth to take over millions of accounts on Grammarly, Vidio, and Bukalapak.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 11,903 posts.
10202
Jepsen: TigerBeetle 0.16.11
TigerBeetle is an Online Transactional Processing (OLTP) database built for double-entry accounting with a strong emphasis on safety and speed. It builds on the Viewstamped Replication (VR) consensus protocol to offer Strong Serializable consistency. Unlike general-purpose databases, TigerBeetle stores only accounts…
10203
10204
Fast, Bump-Allocated Virtual Doms with Rust and Wasm
Dodrio is a new virtual DOM library that is designed to leverage the strengths of both Wasm’s linear memory and Rust’s low-level control by making extensive use of fast bump ...
10205
Maybe Skip SHA-3
In 2005 and 2006, a series of significant results were published against SHA-1 [ 1 ][ 2 ][ 3 ]. These repeated break-throughs caused something of a crisis of faith as cryptographers questioned whether we knew how to build hash functions at all. After all, many hash functions from the 1990's had not aged well [ 1 ][ 2…
10206
So You Want to Rust the Linux Kernel?
There has been much discussion of using the Rust language in the Linux kernel (for example, here , here , and here ), at the Kangrejos Rust for Linux Workshop ( here , here , and here ) and 2021 Linux Plumbers Conference had a number of sessions on this topic, as did Maintainers Summit . At least…
10207
John Carmack on Functional Programming in C++ (2018)
ps aux | more
10208
OpenAI's GPT-6 Astra on ARC-AGI-3
OpenAI's GPT-6 Astra reaches state-of-the-art results on ARC-AGI-3
10209
Cancellations in async Rust
Correctness in the face of cancellations: a written version of my talk at RustConf 2025.
10210
When ‘he’ll be kept on payroll, somewhere’ is where you are
On August 31, 2015, I started a Ph.D. in cryptography at TU Eindhoven, working with Tanja Lange and Dan Bernstein. On December 2, 2016, I…
10211
Separating signal from noise in coding evaluations
A new analysis from OpenAI reveals issues in SWE-Bench Pro, a popular coding benchmark, raising concerns about reliability and accuracy in evaluating AI models.
10212
Keeping Netflix Reliable Using Prioritized Load Shedding
How viewers are able to watch their favorite show on Netflix while the infrastructure self-recovers from a system failure
10213
Mozilla Files Cross-Complaint Against Yahoo Holdings and Oath
Yahoo Holdings and Oath filed a complaint against Mozilla on December 1, 2017, claiming that we improperly terminated the agreement between Mozilla and Yah
10214
Daring Fireball: Creep Executive Officer
More and more, I get the feeling that if there’s a rift between the old “Don’t be evil” Google and the new “Let’s do whatever we want” Google, that it’s a rift between Schmidt and Larry/Sergey.
10215
10216
Now Open – AWS Africa (Cape Town) Region
September 8, 2021: Amazon Elasticsearch Service has been renamed to Amazon OpenSearch Service. See details. The AWS Region in Africa that Jeff promised you in 2018 is now open. The official name is Africa (Cape Town) and the API name is af-south-1. You can start using this new Region today to deploy workloads and…
10217
An update on Android's audio latency
News and insights on the Android platform, developer tools, and events.
10218
A Programming Idiom You've Never Heard Of
It's not about technology for its own sake. It's about being able to implement your ideas.
10219
Is revenue model more important than culture?
HN Discussion Here: I always loved getting problems of the type “What is the limit as x approaches infinity” type in high-school/college. You’re given an equation (of the classic y=x format), and a…
10220
Pnpm has a new setting to stave off supply chain attacks
There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies. In most cases, such attacks are discovered quickly...
10221
Apple Interview – 1995
In the 1990’s, I had access to the early internet (before the web) and made use of a public forum ( Usenet ) where I could ask and respond to questions about programming the Macintosh computer. I’ve mentioned before how this caught the attention of engineering at Apple ( Tom Dowdy , in any event). Perhaps too, the…
10222
Processing 40TB of code from 10M projects with a dedicated server and Go
The command line tool I created Sloc Cloc and Code (scc) (which is now modified and maintained by many other excellent people) counts lines of code, comments and makes a complexity estimate for files …
10223
10224
A Quasipolynomial Time Algorithm for Graph Isomorphism: The Details
Update 2017-01-09: Laci claims to have found a workaround to the previously posted error, and the claim is again quasipolynoimal time! Updated arXiv paper to follow. Update 2017-01-04: Laci has posted an update on his paper. The short version is that one small step of his analysis was not quite correct, and the result…
10225
There are now at least eight Chromium-based Android default browsers
Google Chrome is not the default browser on Android 4.3+. There are now at least eight Chromium-based Android default browsers, and they are all subtly, though not wildly, different.
10226
10227
10228
10229
What if you don't need MCP at all?
Got Bash and some code interpreter? Skip MCP.
10230
Why Developers Never Use State Machines
Why developers rarely use state machines, seeing them as overkill until it's too late to switch, and what the state_machine gem did for CrowdHired.