Top 30 stories from Hacker News. Top 10 include comment highlights. Compiled at 20:10 UTC.
750 points by ssiddharth · 187 comments
What HN said:
hbn: It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run...
dybber: > The first proper zero auth password reset I've seen in production. LinkedIn had one back in the day, before you got paid for discovering it I guess, never got a decent reply from them, but they eventually solved it.
sosodev: Support requests have always been the weakest link in the security chain for big corps. I've had accounts of mine turned over with 2FA disabled by humans before. I guess we shouldn't be surprised that the LLMs are doing the same thing.
buildbot: So the AI agent had privileged access to remove 2FA, ignore the account email, and just hands accounts to whoever asked? Honestly that’s so highly negligent I wonder if the implementation team for that “feature” was intentionally trying to do as much subtle damage to meta as poss...
682 points by kurmiashish · 369 comments
Ref: Affected Packages (updated) Package Compromised Versions @redhat-cloud-s...
What HN said:
eranation: Hope it's ok I hijack this thread again about setting up cooldowns... (copy pasting my last comment when tanstack was compromised): I know people have opinions about cooldowns, but they would have saved you from axios, tanstack, (+ @redhat-cloud-services) and many other recent np...
mnahkies: In every of these threads there's a bunch of snarky comments, either acting like this class of attack is exclusive to npm, or that nothing has been done about it. I don't think that's fair.
dmix: Our company uses yarn 4 which has an option to prevent you from installing an npm package for the first number of days of its release. Most of these seem to be caught within that timeframe (1-3 days). https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e...
insanitybit: Just some suggestions: 1. Dependency cooldowns of 1-2 days seem to be extremely effective without negatively impacting your ability to patch for CVEs. 2. Anywhere you have
npm installornpm testor anything where code executes, that should happen in an environment that has n...
608 points by cafkafk · 249 comments
What HN said:
cafkafk: Hi HN. I wrote this post after getting frustrated by the lack of ways to run the new Gemma 4 Drafter models, and mainstream tools not prioritizing this, and hiding all the performance levers.
cmiles8: We’re not there yet, but the obvious endgame of the present bubble insanity is open models running on local hardware and devices are “good enough” for most use cases. That will completely implode what’s going on at the moment in tech.
deng: Nice post and technically impressive work. I agree we need to understand the build pipeline and be able to do things locally. However, depending on your electricity cost, it might not make sense financially.
throwaway2027: Glad to see other people realizing this. I've been running Gemma 26B-A4B Q4 on a 2012 Xeon with 16GB to 24GB of RAM in a container. It's getting around 8 to 12 tokens per second.
381 points by speckx · 182 comments
Twenty years ago today, dozens of Swedish police officers stormed a Stockholm data center, seizing The Pirate Bay's servers. The entertainment industry hoped the raid would finish the site for good.
What HN said:
hbn: Every once in a while I'll try to watch something through the Intended Method™ and it always proves itself to be a worse experience. Most recent example - I was watching Malcolm in the Middle on Disney+ with my girlfriend, and we found that there are entire audio tracks missing i...
blablabla123: It's very strange to think about this in the current context. Anything P2P used to be the Anti Christ of the Software Industry. The lengths Microsoft and game vendors went to prevent copying is insane.
TFNA: When it comes to films, I torrent exclusively remuxes or whole Blu-Ray images. TPB hasn't been relevant for me for the last 15 years or more, since it never had a culture of such large file sizes, just small re-encodes.
Unai: I haven't visited a torrent site since I found out I could search for them from within qBittorrent.
316 points by surprisetalk · 228 comments
What HN said:
pseudosavant: Up until this point, the potential for an AI bust blast radius was limited to corporate investors, but this is going to cause regular retail/401k investors to get exposure, which could have far bigger impacts on a downturn.
cmiles8: There is a mad rush to get these IPOs out the door before the market sneezes.
thomascountz: SpaceX submitted an amendment to their S-1 today[1] [1]: https://www.sec.gov/Archives/edgar/data/1181412/000162828026...
neovive: If OpenAI and Anthropic eventually become public companies with trillion-dollar valuations, it will be interesting to see if their company ethos remains the same. With that much purchasing power, it's very tempting to gobble up competitors and raise prices.
238 points by kristianpaul · 34 comments
Official course website for Stanford CS336: Language Modeling from Scratch (Spring 2026), including logistics, schedule, assignments, and course materials.
What HN said:
fg137: I recently completed the 2025 version of this course (video + most assignments, skipping some of the most costly part of the tasks). That's quite something. There is a lot going on in the first two assignments which required a ton of thinking and debugging.
meken: I have fond memories of cs224d [1] taught by richardsocher. It’s a bit dated at this point as it was created in the pre-transformer era, but it was a very cool introduction to applying deep learning to nlp at the time. [1] https://cs224d.stanford.edu
skerit: > GPU compute for self-study Those suggestions they make for a B200 start at $4.99 an hour. Is that really required, for starting out? I've been tinkering with my own from-scratch LLM, but in the early phases I don't need anything more than a 4090 on Vast.ai
chainsaw10: I’m intrigued by this course. However I’m also curious about its prerequisite: > Machine Learning (e.g. CS221, CS229, CS230, CS124, CS224N) You should be comfortable with the basics of machine learning and deep learning.
210 points by shenli3514 · 173 comments
The fusion of NVIDIA AI and RTX graphics.
What HN said:
airstrike: This seems to be an attempt to compete with people running local models on Apple hardware—even though those local Mac Mini setups aren't really powerful. I expect we'll get there in a few years, so perhaps this is Nvidia taking an early step in that direction.
thot_experiment: Love seeing AMD forcing Novideo to catch up for once rather than the other way around.
2001zhaozhao: I think this is the first time an ARM windows device gets marketed for gaming. Would be interesting to see what kind of performance hit games have on the x86 to ARM translation layer.
giancarlostoro: Can it work with Linux? That's all I care about.
207 points by Kye · 97 comments
KDE is turning 30 this year! Three decades of passionate community effort against all odds; delivering control, privacy, and freedom to our users; and tons and tons of software.
What HN said:
thom: It feels to me that a lot of the bigger ideas in KDE fell away over the years. In the 2000s I would log in every morning, open a KWord doc in one Konqueror tab, a KSpread sheet in another, and some browser tabs alongside them, then I'd launch Kate and open some files over SSH or...
ACS_Solver: One of the most impressive and useful free software projects. My first experience was being totally confused by KDE 1 during my first attempts to use Linux, and I'm writing this from my KDE desktop.
Conscat: Does anyone else miss KWrite? I had it configured as a very slightly more advanced Notepad.exe clone. I really enjoyed opening it for quickly writing out thoughts that crowd my ADHD brain, and I feel like the full Kate takes much longer to open up and looks much much heavier and...
sqircles: I have long held a bias of KDE being the clunky and slow option from trial in the ~early-oughts. Within the past month or so I installed it to give it a spin and haven't switched back to XFCE since.
170 points by prakashqwerty · 84 comments
Student version of Assignment 1 for Stanford CS336 - Language Modeling From Scratch - stanford-cs336/assignment1-basics
What HN said:
aaaronic: I'm trying something similar this semester with my course via AGENTS.md. I think this one is overly verbose and probably falls out of context windows pretty quickly, based on my experience (for me, a very terse but clear set of 30 lines performed better than providing examples an...
bcherny: For those using Claude Code, I recommend Learning mode to instruct Claude to walk you through implementing the solution yourself rather than doing it for you. It’s very helpful when diving into a new domain, and helps build lower level intuition.
ohmahjong: This seems somewhat sensible to me - the genie is out of the bottle, and students absolutely will use AI agents to finish assignments without learning a thing, but there is some value to showing how agents can be used as teaching tools and what healthy use can look like
andersmurphy: Seems like a pretty close copy of Carson's (of HTMX fame) agent.md from 5 months ago https://gist.github.com/1cg/a6c6f2276a1fe5ee172282580a44a7ac
161 points by speckx · 9 comments
What HN said:
melodyogonna: Little things like this are why Go is great. People make arguments against Go based just on available language syntax, but languages are more than just syntax; it is about the end-to-end development flow. I actually think C# and the .
blainsmith: Author here... Thanks for sharing this. It has been fun to use while we get ready to launch https://probes.dev with tracing being core to the service.
Xeoncross: Nice! Tracking connection reuse is really important if you are running any kind of benchmarks or comparisons both as the author of a new tool / service and as the person evaluating different options or client libraries.
s-macke: I wish I had known this two years ago. I ended up writing my own embedded connection struct to trace these things [0]. type Connection struct { net.Conn OnEventCallback func(clientClosed bool, serverClosed bool, err error) } [0] https://github.
AI/ML
Business/Tech
Other
Science
Security
Stories and comments sourced from Hacker News public API. Not affiliated with Y Combinator or Hacker News.