871
GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos
Noma Labs found a prompt injection flaw in GitHub Agentic Workflows that let an unauthenticated attacker leak private repo data via a crafted GitHub Issue.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 5,936 posts.
872
How an oil refinery works
Though wind and solar continue to carve out larger and larger shares of world energy supply, the modern world still runs on petroleum, and will continue to do so for the foreseeable future.
873
Outlook.com is rejecting email from domains without DMARC
Since November 5, Outlook.com and Hotmail have been bouncing mail from domains with no DMARC record, small senders included. What changed, and the one-record fix.
874
875
How we rebuilt Next.js with AI in one week
One engineer used AI to rebuild Next.js on Vite in a week. vinext builds up to 4x faster, produces 57% smaller bundles, and deploys to Cloudflare Workers with a single command.
876
What your Bluetooth devices reveal
Building Bluehood, a Bluetooth scanner that reveals what information we leak just by having Bluetooth enabled on our devices.
877
Make macOS consistently bad unironically
Alongside the various bugs you get, one of the issues of upgrading to MacOS 26 is that it has one of the most notorious inconsistency issues in window corners. I'm not sure what exactly pushes product designers to like …
878
Apple Reference Image: A New Approach for Verified Photography
Introducing Apple Reference Image, a new solution for verifiable photography on iPhone. This new, opt-in camera mode lets a photographer create a securely timestamped reference image that accurately depicts what was captured by the iPhone's camera sensor. Apple Reference Image offers a trustworthy, scalable guarantee…
879
There are no instances in ATProto
Like RSS and Google Reader.
880
881
CNC Stone Carving
CNC Stone Carving In a form of architecture so ancient, CNC machines may seem a little out of place. However, when one considers that the medieval builders were always on the forefront of the technology of their day, it no longer seems so strange. To build Gothic today, it must become a reality, not a […]
882
Rendering the Sky, Sunsets, and Planets
This article explores how to render realistic skies and atmospheres in real time in the browser with shaders, from simple sky domes, to entire planets using shaders, raymarching, Rayleigh and Mie scattering, and ozone absorption.
883
Omarchy: Any User Process Can Escalate to Root
A security issue in Omarchy’s default Docker configuration meant that essentially every program running in the user’s desktop session could escalate to root without a password, sudo, or a privilege prompt. If you use Omarchy, the most important takeaway is simple: update to 4.0.1. I reported this issue privately…
884
885
An AI Agent Published a Hit Piece on Me – The Operator Came Forward
Context: An AI agent of unknown ownership autonomously wrote and published a personalized hit piece about me after I rejected its code, attempting to damage my reputation and shame me into acceptin…
886
Court Records Should Be Free
Court records belong to the public. Yet anyone seeking access to federal court filings through PACER, a government software system that stands for Public Access to Court Electronic Records, is usually required to pay hefty fees to search for and view documents. PACER’s fees have long acted as a...
887
When AI Builds Itself: Our progress toward recursive self-improvement
Our progress toward recursive self-improvement, and its implications.
888
Netflix Animation Studios Joins the Blender Development Fund as Corporate Patron
A historic first for the animation industry!
889
Deno Sandbox
Instant Linux microVMs with defense-in-depth security for running untrusted code.
890
AI makes the easy part easier and the hard part harder
AI handles writing code but leaves the hard work: investigation, context, validation. Why vibe coding has limits and AI assistance can backfire.
891
It's 2026, Just Use Postgres
Stop managing multiple databases. Postgres extensions replace Elasticsearch, Pinecone, Redis, MongoDB, and InfluxDB with BM25, vectors, JSONB.
892
The Real Luxuries In Life
Labor Day weekend has always been the back to school marker for me. I'm 60, closing in on 61, and thinking a lot more about what I actually care about. Amy texted me a list yesterday.
893
Sabotaging projects by overthinking, scope creep, and structural diffing
I’ll be attending Babashka Conf on May 8 and Dutch Clojure Days on May 9. If you’re attending either (or just visiting Amsterdam), drop me a line!
894
Anthropic acquires Stainless
Anthropic has acquired Stainless, a builder of SDK and MCP server tooling, to strengthen Claude's ability to connect to external data and tools.
895
How Our Rust-to-Zig Rewrite Is Going
For the past year and a half, the team building Roc 's compiler has been rewriting our 300,000 lines of Rust code into Zig , for reasons I'll recap below. We recently passed an exciting milestone: feature parity with the original compiler!
896
Luanti removed from Google Play due to baseless AI copyright notice
Luanti has been removed from Google Play due to a DMCA notice from Tracer.AI. We have filed a counter-notice, but this isn't the first time.
897
ATMs didn’t kill bank teller jobs, but the iPhone did
There's a lot more to replacing labor than just automating tasks
898
Anthropic confidentially submits draft S-1 to the SEC
Anthropic has confidentially submitted a draft S-1 registration statement to the Securities and Exchange Commission
899
Why I love FreeBSD
A personal reflection on my first encounter with FreeBSD in 2002, how it shaped the way I design and run systems, and why its philosophy, stability, and community still matter to me more than twenty years later.
900
Apple is about to make Hide My Email useless
Yesterday, June 15, 2026, a small and unimportant announcement appeared in Apple developer news: New domain for Sign in with Apple and iCloud+ Hide My Email. Long story short: now both Sign in with Apple and Hide My Email aliases are going to be issued on the @private.icloud.com subdomain. This makes it much easier to…