361
My security camera shipped a GitHub admin token in its login page
i dissected some firmware for a Hanwha Wisenet XNP-9300RW and found that it had github admin tokens in it, also miltech is weird
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 3,696 posts.
362
License plate reader searches should require a warrant
So while I work with police departments regularly, I think it is critically important that technology be used reasonably. While this may be off-putting to some of my clients, I worked with the Inst…
363
Native Instant Space Switching on macOS
Arhan's Blog
364
The MacBook Neo
May the MacBook Neo live so long that its name becomes inapt.
365
Google Declaring War on the Web
In Yesterday’s IO Keynote Google declared war on the remnants of the Web. (See longer description on their website.) TL;DR: They are pushing Search more into the “here’s your processed answer” direction that “AI Overviews” have established (you know, those AI snippets in current Search that are wrong about 10% of the…
366
Moving from GitHub to Codeberg, for lazy people
I’ve just started to migrate some repositories from GitHub to Codeberg. I’ve wanted to do this for a long time but have stalled on it because I perceived Codeberg as not being ready and the migration process as being a lot of (boring) work.
367
They're made out of meat (1991)
Copyright, Terry Bisson, 1991 Originally published in OMNI, 1991, and featured in HARPER’S and around the internet since. It has even made its way into several books on consciousness and brain science. I’m surprised, pleased, and proud. But please do not reprint, perform, alter or adapt in any way without first…
368
The Kimi K3 Moment
I’ve been running Kimi K3 alongside Claude on my normal coding work, and for all practical purposes I can’t tell them apart. Same tasks, same quality of outp...
369
There isn't an easy exploit for this PHP vulnerability
Mass hysteria, or something.
370
The Future of CSS
Every year, browser vendors collaborate via the Interop project to synchronize their efforts on new HTML/CSS/JS features. This year, there’s a ton of super exciting features being considered! In this blog post, we’ll explore the CSS of the future, to get a glimpse of what we’ll soon be able to do.
371
AI isn’t outthinking mathematicians, it’s out-remembering them
The key advantage may not be superior reasoning, but a virtually unlimited symbolic working memory.
372
Leaving GitHub for Forgejo
I host and maintain your WordPress site: one person for your server and your site, who you message on WhatsApp. From €39 per month excl. VAT, cancel monthly.
373
Tl;dv: Over 180k meetings left wide open
How a missing Firestore security rule on tl;dv exposed 181,874 meetings from 84,312 users across 35,003 domains, including live calls I could join uninvited, and how six months of disclosure got me nothing but seen receipts.
374
Finding and fixing Ghostty's largest memory leak
A few months ago, users started reporting that Ghostty was consuming absurd amounts of memory, with one user reporting 37 GB after 10 days of uptime. Today, I'm happy to say the fix has been found and merged . This post is an overview of what caused the leak, a look at some of Ghostty's internals, and some brief…
375
DRAM pricing is killing the hobbyist SBC market
Today Raspberry Pi announced more price increases for all Pis with LPDDR4 RAM, alongside a 'right-sized' 3GB RAM Pi 4 for $83.75. The price increases bring the 16GB Pi 5 up to $299.99. Despite today's date, this is not a joke. I published a video going over the state of the hobbyist 'high end SBC' market (4/8/16 GB…
376
It's Time to Investigate the AI Labs
Over the last several months, the two leading frontier AI labs have shown some brazen behavior. It started with a series of carefully planned announcements ... Read more
377
I turned my security cameras into an automatic bird identification system
I turned three security cameras into an automatic bird identification system using BirdNet-Go. Now my wife and I can track every bird species that visits our yard in real-time.
378
2D Vehicles
Explore my 1996 vehicle physics prototype, recreated for the web as Motion Lab.
379
Uber's $1,500/month AI limit is a useful signal for AI tool pricing
I wrote the other day about Uber blowing its 2026 AI budget in four months, and how that wasn't particularly surprising given they would have set that budget in 2025, …
380
New 10 GbE USB adapters are cooler, smaller, cheaper
For years, the best way to get 10 gigabit networking on laptops was to buy an expensive, large, and hot 10 GbE Thunderbolt adapter. With new RTL8159-based 10G USB 3.2 adapters coming onto the market, the bulky adapters might be a thing of the past. Just look at the size of the thing in comparison to my Thunderbolt…
381
Chrome again exempts Google from user site data settings
Six years ago I published a blog post Chrome exempts Google sites from user site data settings that received quite a bit of attention: Michael Tsai , Hacker News The Register , The Verge , and Gizmodo , among others. The blog post was about a Google Chrome bug that mysteriously exempted Google-owned sites from the…
382
My smart sleep mask broadcasts users' brainwaves to an open MQTT broker
I recently got a smart sleep mask from Kickstarter. I was not expecting to end up with the ability to read strangers' brainwaves and send them electric impul...
383
Setting up a free *.city.state.us locality domain (2025)
In the US, you can get a domain name like `somename.city.state.us` for free. If your town has its own domain, you can get nameservers from Amazon Lightsail, send the *Interim .US Domain Template* to the delegated manager for your locality, then point DNS entries at your webhost.
384
The cult of vibe coding is dogfooding run amok
Bad software is a choice you make
385
ML promises to be profoundly weird
This is a long article, so I've broken it up into a series of posts, listed below. You can also read the full work as a PDF or EPUB .
386
387
Your hex editor should color-code bytes
every time i do, i feel bad for the poor person having to use it (especially if that person is me!). a plain list of bytes makes it hard to notice interesting things in the data. go ahead, try to find the single c0 in these bytes:
388
Mullvad exit IPs are surprisingly identifying
Update 5/29: Mullvad has begun rolling out a mitigation feature on their servers that scrambles exit IP positions, thereby fixing this issue. IPs are still deterministically selected based on the pubkey. Mullvad is one of the few VPN providers that offers multiple exit IPs for its servers. If two people connect to the…
389
LLM Voice
The uncanny valley of LLMs' prose
390
The revolt of the reader
Reading is important to me. While I’m not a quick reader nor an especially voracious one, I have found that long-form reading has had a profound influence on me over my life.