News for hackers. Stuff that matters.

kaoD

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @08:27PM (#50321618)
What does this enable an attacker to do exactly? RCE? DoS? Unknown?
Re:Show HN: Use your OpenAI subscription to create audiobooks on Tuesday October 13, 2026 @02:58PM (#50076822)
Not to mention the very prominent "$0 PDF to MP3".
Re:Takeshi's Castle on Saturday October 10, 2026 @06:53PM (#50037968)
It was localized with the name Humor Amarillo ("Yellow Comedy").

I know...

Re:Deno Is Joining Cloudflare on Friday October 09, 2026 @10:56AM (#50021407)
8 years is not super old, or even old. It's important to understand software maturity cycles for core components.
Re:Whistle: Speech to Text in 16.9 MB on Thursday October 08, 2026 @01:26PM (#50008866)
Spanish from where? Here (Castilian Spanish) it seemed to work fine.
Re:Why don't more developers "use the platform"? on Sunday October 04, 2026 @02:50AM (#49951331)
That's the best case scenario and already looks like crap. If that looks sane to you, I don't know what to say.

Make it have an initial count via attributes, sync it with the DOM so if the attribute changes the count resets, and make the JS property always match the attribute (and vice-versa) so it behaves sanely. You're in for a world of pain even for something as simple as this.

Plus they're not declarative: you will only make me use innerText-based updates by threatening me and my family.

Plus they only work with JS enabled, while I can use JSX in SSR.

I've worked extensively with Web Components. They suck.

Re:Supabase Is Acquiring Turso on Friday October 02, 2026 @01:23PM (#49936097)
By "it" you mean Turso? Maybe you can help since I don't understand what they offer. What does Turso do that SQLite doesn't?
Re:GPT 6.1 Sol: Near-Astra intelligence for a fifth of the price on Wednesday September 30, 2026 @12:01PM (#49910680)
Absolutely not my experience. I've been a long time Claude user and at work people slowly started using Claude too. I canceled Claude for my personal account due to the Astra hype, but I'm back after a single month and the absolutely ridiculous context window is one of the many reasons.

I barely compact at work in a very complex monorepo (neither with Fable 5.1 nor Opus 5.5), and yet in my personal greenfield project Astra keeps compacting all the time, to the point of it being unusable.

Re:Why Is Sam Altman a Free Man? on Wednesday September 30, 2026 @09:58AM (#49909087)
1. You're lumping distinct groups of people. This is Hacker News but "hack" often in the sense of "growth hacking", not in the "hacker manifesto" sense.

2. Even in that case, people might just be demanding equal justice. If I make information free I might get jailed. Regardless of my moral framework.

Re:Why MCP Was Always a Bad Idea on Monday September 21, 2026 @02:02PM (#49790905)
> token inefficient to have it write code

It does not write code. It just calls my tool.

But I see your other points though.

Re:Why MCP Was Always a Bad Idea on Monday September 21, 2026 @01:22PM (#49790312)
Re:Why MCP Was Always a Bad Idea on Monday September 21, 2026 @01:21PM (#49790293)
I guess someone could expose the coding environment via MCP.
Re:Why MCP Was Always a Bad Idea on Monday September 21, 2026 @12:54PM (#49789881)
Skills are not only Markdown files. I often structure my skills as small Python scripts and the actual Markdown is only the skill front matter and maybe some brief documentation. You can even stick an OpenAPI schema or whatever you see fit.

If you often need timezone conversion, sounds like a `timezones` skill exposing a few lines in a Python script. Boom. No MCP needed. No server needed. It's just files, all the way down. If you find yourself operating with dates a lot maybe you need a `datetime` skill wrapping a bunch of tiny scripts. Fully deterministic, cheap on tokens, and you can even run them without an agent (shocking nowadays :P)

As I identify repetitive actions I add (Claude adds) new scripts to the Skill to save tokens in the future, whereas MCP I'm at the mercy of the server provider. E.g. I have a Magic the Gathering skill with a bunch of tools to retrieve card databases, simulate hands, get card images...

This article enlightened me: https://mariozechner.at/posts/2025-11-02-what-if-you-dont-ne...

This is why I don't feel Skills are orthogonal. They feel like MCP on steroids since the scripts can be composed with Bash et al (huge battle-tested ecosystem, plenty in the training set)... and you don't need crappy abstractions like "resources" (yes, that's a thing in MCP) when the agent has a shell and a filesystem.

I've used this pattern to great success. Nowadays I just share these `.skill` packages with my friends (I think they're just a fancy ZIP file?)

The only thing missing for me is credentials and sandboxing (see my GP post). I have my own ideas on how to solve this (and some of that Claude in cloud already solves for me), but it's not easy (which is how MCP won).

Re:Why MCP Was Always a Bad Idea on Monday September 21, 2026 @12:07PM (#49789092)
All of that can be solved in better ways than MCP. 1+2+4 belongs to sandboxing. 3 to sandbox UIs. Ideally baked into the next generation OSs.

MCP is the wrong abstraction for all of that. Skills are better as pluggable interfaces, and I predict[0] chat and agentic loops will converge eventually (Anthropic already did this correctly; OpenAI, it's your turn) and skills marketplace will replace MCP in its current form.

I see value in MCP, but it feels like a stopgap/stepping stone.

[0] Where "predict" = "hope". The best solutions are often not the winners.

Re:Why isn't mutable a subtype of immutable, or vice versa? on Sunday September 20, 2026 @06:34AM (#49774446)
> What i dont understand is why does everything have to be so brief

Computers used to have very little memory and processing power, and screens had very low pixel density so line width was not that big. Then you have to deal with the baggage 50 years later.

Modern Lisps have the luxury so they use head/tail or first/rest.

Re:Why isn't mutable a subtype of immutable, or vice versa? on Sunday September 20, 2026 @06:12AM (#49774357)
> it may be that my point of view is too narrow

Not sure if you're just being polite but, in case you're doubting, functional languages make that distinction too.

Haskell has `Data.Vector.Vector` vs `Data.Vector.Mutable.MVector`.

Clojure has `transient`.

OP is just mistaken.

Re:Why isn't mutable a subtype of immutable, or vice versa? on Sunday September 20, 2026 @06:00AM (#49774285)
> Mutability is a property of variable, not of a value. [...] This has nothing to do with whether it can be reassigned (i.e. mutability).

I feel like you're using "mutable" too narrowly, as it's used colloquially in some programming languages. E.g. in JS, MDN itself talks about "reassignment"[0] and not "mutability" even though people often use "mutability" as a word to refer to the distinction between `const` and `let`. The only mention of mutability there is:

> Others may prefer `let` for non-primitives that are mutated

I.e. explicitly using `let` for mutated arrays, even if not reassigned, to make the signal mutability (which JS cannot express).

Note that you used "reassignment" which is the specific word for "mutating a binding", but the article is not referring to bindings at all.

[0] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

You might want to start by explaining what AIM is?
Re:Anecdotally, Programmers Dislike "Reduce" on Wednesday September 16, 2026 @06:07PM (#49733700)
> Put me anecdotally in the opposite bucket.

The fact that you wrote this comment with Hindley-Milner-ish notation already makes your an outlier.

Re:Pion, an agent designed to run any company autonomously on Tuesday September 15, 2026 @10:36AM (#49713212)
You can, but it goes against Tailwind's philosophy. It used to be explicitly discouraged here[0] (see this 2022 GH comment[1]), but now they just don't mention it.

[0] https://tailwindcss.com/docs/styling-with-utility-classes#ma...

[1] https://github.com/tailwindlabs/tailwindcss/discussions/7651...

Re:Pion, an agent designed to run any company autonomously on Tuesday September 15, 2026 @06:18AM (#49710232)
Tailwind's philosophy is that you must not use CSS facilities at all and instead all their utility classes should be inlined into the HTML soup.

This leaves framework components as the only abstraction boundary, but that means if you're writing plain HTML without a framework there's literally no way to standardize your design system.

That and the huge soup of classes in DOM is (part of why) I don't like Tailwind... but that ship sailed a long time ago.

Re:Pion, an agent designed to run any company autonomously on Tuesday September 15, 2026 @05:01AM (#49709709)
> Define the style in one place and reuse it.

If I had to guess, this is pure Tailwind rot.

Re:Pion, an agent designed to run any company autonomously on Tuesday September 15, 2026 @04:47AM (#49709607)
> How are people getting this "waste of time not to use AI" and "generates 99% of my code" level of code quality?

They don't know what n+1 problem is and they don't know about long-term maintainability.

Re:Claude, change the "Add to Cart" button to blue on Wednesday September 09, 2026 @09:25AM (#49626166)
Am I the only one whose experience doesn't match this?

My gripe with Claude is that while investigating how to do this it will report 200 other incidental findings which I overlooked and I realize those are broken too and need urgent fixing, derailing me, not it.

Re:Music Theory for Programmers on Sunday September 06, 2026 @04:24AM (#49584413)
> I am still not able to recognize a sound and understand what note that is

That is called "perfect pitch" and it is not necessary to play music. It's very rare to have perfect pitch, and it seems to be innate, not something you learn.

Contextual note recognition (relative pitch) is what musicians normally use to jam. It comes with practice and contextual clues that you pick up over tens of years (including familiarity with your jammate's instrument, even if it's not the one you play; familiarity with multiple eras of music theory; pure practice), so this shouldn't be your #1 priority since it just comes along for free (or a bit of practice), as you learn. Music playing 101 is just... playing music in your instrument. You don't need to recognize notes until you want to jam, which comes years after you start playing an instrument.

Some people seem to just be physically unable to distinguish relative pitch though.

You might want to start here: https://www.musictheory.net/ (not affiliated, I just think it's a very good resource for Music Theory 101).

Re:Ask HN: Who is using MCP in production? on Friday September 04, 2026 @10:07AM (#49564866)
I definitely think that's a bridge to gap, but MCP is not the answer. OSes currently lack the tools to do this properly, but I hope they will improve. Agents need more granular sandboxing in all areas.
Re:Muse Spark 1.3 on Thursday September 03, 2026 @07:07AM (#49548499)
> Someone tested this, and it doesn't look to be saturated.

They could still pelicanmaxxing but the RL for "pelican riding a bicycle" does incidentally improve "<animal> <verb> <vehicle>".

Or they could've predicted someone would check if they're pelicanmaxxing or the benchmark would switch eventually, so they preemptively RL'd a mixture of animals and vehicles.

Re:Claude Fable 5.1 and Claude Mythos 5.1 on Wednesday September 02, 2026 @05:21AM (#49533818)
Anybody knows why Fable is railguarded in particular against biology tasks? I'm out of the loop here.

Is it drugs? Bio/chemical weapons?

Re:Quake Shareware, a CD-ROM just a little too full on Tuesday August 18, 2026 @02:37AM (#49342128)
I did reverse engineering as a hobby in my teens. The method for 90% of cracks back in the day boiled down to:

1. Launch the app.

2. Trigger the "not registered" screen.

3. Search for the string in the binary.

4. Search for code that references the location of the string and squint hard until you spot the "check if CD-key is valid" section.

5. Patch the final opcode from "jnz" to "jz". If you felt fancy, reverse engineer the checking algorithm to create a keygen instead of a patch.

Anticracking methods became mainstream in the late 90s, but they weren't very sophisticated and most amounted to obfuscation.

Long live +ORC, +Fravia and CracksLatinos.

Re:Reticulum – Decentralized Mesh Network on Monday August 17, 2026 @05:01AM (#49328124)
Reticulum just means net or net-like structure.

Older »