sippeangelo
Re:Node.js Brotli decoder out-of-bounds write permits remote code exec...
on Thursday October 22, 2026 @12:25PM (#50197562)
Copying my comment from the Vercel post that gained no traction here:
> From what I can gather, Express 5's body-parser has Brotli decoding enabled by default which would make any endpoint with this middleware vulnerable to this. Am I mistaken?
Re:Node.js security advisory: Brotli decoder RCE (CVE-2026-111497)
on Thursday October 22, 2026 @06:05AM (#50193368)
From what I can gather, Express 5's body-parser has Brotli decoding enabled by default which would make any endpoint with this middleware vulnerable to this. Am I mistaken?
Re:Our space game has a built-in RISC-V emulator that runs Linux
on Friday October 09, 2026 @04:37AM (#50017727)
That's awesome! Thank you!
As the lowly programmer, rather than a compiler engineer or a CPU architect, I will never dig into the reasons why my tools decided to do something crazy. I'm much more likely to just try random things until it works. How is that different to how people use LLMs? Even here the opposite is true, the LLM enables me to ACTUALLY dig into the lower levels and work around those issues! It will happily dig into the Chrome source to find exactly why my page rendered weirdly, or why an optimization didn't kick in!
> Is Coding → Prompting like Assembly → High Level Coding? […] I do not agree with this simile. Compilers are, for the most part, deterministic in a way that current AI tools are not.
I have a very different view of this, coming from C++. "Undefined behaviour". Compiler optimizations that only kick in if you align your chakras just right. Memory alignment and cache locality being completely vibe-based, relying on hopes and prayers that the CPU actually does what your mental model thinks it will.
In many ways it's EXACTLY like C++ -> Assembly. You never know what you ended up with until you run the benchmarks, just like you never know what your AI generated until you look at it!
"What do you mean? This worked in the debug build! Why does it crash in release?!"
Re:I gave Opus 5.5 one prompt and six hours to visualize Invisible Cities
on Thursday October 08, 2026 @12:13PM (#50007671)
Why would that someone want to listen something you haven't created? What have you "shared"? Claude could have made the tools that let the creator build their cities from their own imagination, but that's not what this is.
Re:Our space game has a built-in RISC-V emulator that runs Linux
on Friday October 02, 2026 @05:50PM (#49939044)
Do you have a blog post about this? The link is to the home page and doesn't mention anything! Sounds super interesting but the landing page reads like survivalcraft in space #1001
Re:Show HN: Whiteboard (YC W26) – An open-source IDE for thoughtful so...
on Friday September 25, 2026 @02:22AM (#49840811)
Is that really true? I feel even with Fable and the likes, once the LLM has locked down an implementation any reworks I try to do gets it really tunnelvisioned on the current implementation, treating it like the truth even though it JUST wrote it, and any attempts to make it reframe the problem just makes it dig down further. In these cases I always get way better results throwing the whole thing away and rewinding the conversation rather than trying to evolve it.
Re:I don't want to read what you didn't write
on Monday September 21, 2026 @07:09PM (#49794674)
No, usually humans write more than just a short unsubstantiated punchline in their "it's not x, it's y's", unless they're trying to sell you something.
Re:If AI coding is lowering your code quality, you're not managing qua...
on Sunday September 20, 2026 @08:07AM (#49774996)
If AI coding isn't lowering your code quality, you're not using it enough
Re:iOS 27, iPadOS 27, and macOS 27
on Monday September 14, 2026 @02:29PM (#49701641)
They have some nasty "dynamic tap zones" algorithm that dynamically resizes the hitbox for keys based on what it predicts you will type in order to reduce miss-taps. Anecdotally, it has just steadily been getting worse with every update. I swear I can be pressing the center of a key and it will select the next one over and immediately autocorrect to a completely different word than what I typed.
I had the pleasure of typing something on an Android the other day and it was such a breath of fresh air when it actually accepted the keys I was pressing...
Re:Jellyfin 12.0
on Tuesday September 08, 2026 @03:19AM (#49606677)
I wrongly assumed I was below version 10.10.7 and tried to "upgrade" to it first as the migration guide said, but this completely blew up and the db migrations failed. I then tried to skip straight to 12 and that also crashed on startup during db migrations, so I just nuked the whole Jellyfin config and started from scratch.
Bit unfortunate how this can even happen, but it's on me for not checking or taking a backup first. The config/db really contain anything important anyways, other than "watched" markers that are already out of sync for me across Emby/Jellyfin/Plex.
Claude Preserved thinking – Modifying a conversation now results in an error
Re:Claude Fable 5.1 and Claude Mythos 5.1
on Tuesday September 01, 2026 @06:46PM (#49529300)
I really don't see how that is an option, as if appending to the system prompt was ever enough to override previous instructions. Their example isn't very confidence inspiring either:
"The user switched the workspace to read-only mode. Do not write files until told otherwise."
Great! Now we just have to trust that the model never misinterprets any of the system prompt, which has always been so reliable before. Instead of your meticulously crafted prompt, it will now be some junk like this:
"The workspace is in write mode. The user switched the workspace to read-only mode. Do not write files until told otherwise. The workspace is now in write mode again. Wait, back to read-only!"
And who knows how this integrates with their context summarisation that we will be FORCED to use. How does it summarize multiple user + assistant/thinking blocks without messing up the system "appends"? If all it did was append the mid-convo system messages right under the original system prompt then they'd be ripe for all the same distillation "vulnerabilities" as before. I guess we'll never know!
Re:Claude Fable 5.1 and Claude Mythos 5.1
on Tuesday September 01, 2026 @04:58PM (#49528108)
These draconian "Preserved Thinking" measures they're taking are going to be an absolute pain in the ass. This alone is enough for me to move our API use off their platform entirely. It's a HUGE breaking change that they're trying to dampen by having it not affecting current customers until "in the future", see: https://platform.claude.com/docs/en/build-with-claude/preser...
You're no longer allowed to edit the context anywhere! The whole context is to become append-only, says Anthropic. No more editing the system prompt as the conversation progresses, no more dynamic loading of custom tool calling formats. Everything has to go through their built-in tools API and you aren't allowed to mess with anything in the context if it has any thinking blocks following it. This is the most intrusive "model DRM" we've seen so far!
Re:Breaking Claude Code Opus 5 Auto Mode
on Monday August 31, 2026 @11:08AM (#49510699)
Worse: Claude installed packages by just typing versions into package.json instead of running `pnpm install x`, then when running `pnpm install`, discovering that the package versions are too new and incompatible due to the default `minimumReleaseAge`, then proceeding to circumvent this by disabling `minimumReleaseAge` and running a full package update :)
Re:Kagi added a setting for removing paywalled links from search results
on Friday August 21, 2026 @03:31PM (#49392839)
I was subscribed to Kagi for a while but cancelled because there was no subscription for JUST search that didn't include their inferior AI assistant. Why am I paying for it?
Re:Tell HN: GitHub Is Experiencing Degraded Performance
on Monday August 17, 2026 @05:33PM (#49337966)
"Strong signs of recovery" is a crazy way to describe the status of a computer system. Wow.
Re:AI-Generated GitHub Copilot "Autofix" Allowed Compromise of Snowfla...
on Monday August 17, 2026 @10:40AM (#49331819)
The title is actually "Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Due to an AI-Generated GitHub Copilot Autofix"
Re:AI agents lie, cheat and steal. That is putting off users
on Thursday August 13, 2026 @11:39AM (#49287660)
The harness gives the model the barbed wire fence but also the bolt cutters. I think it's a pretty apt analogy.
Re:Cool URIs Don't Change (1998)
on Sunday August 09, 2026 @07:29PM (#49237351)
I've given up because half the help links in the control panel leads to a bing search without any helpful results at all
Re:Stateless MCP has recaptured my interest
on Wednesday August 05, 2026 @05:47AM (#49180587)
None of this is true. The point of "just CLI" is that LLMs are infinitely more trained on working CLI tools. There doesn't need to be real CLI tools behind the harness, as long as the interface is CLI-like.
Re:Gleam Is Now on Tangled
on Saturday July 18, 2026 @04:42PM (#48962165)
It gives "Bleeb is now Scrumple! Snap me on Simpr! We're excited to share that Gringl will merge with Jigglify!"
Re:Mozilla: The state of open source AI
on Friday July 17, 2026 @12:07PM (#48948987)
This is truly some proper slop. The "PRODUCTION RATE BY COMPANY SIZE" graph has bars that start offset from the text underneath them, which LOOKS like a mistake that happened due to word wrap, but if you visibly compare the 54% to the 55% bars they seem to have compensated for this?! I can't tell if his was on purpose or accident and it's impossible to take the data seriously!
This is on mobile in portrait. In landscape the text doesn't wrap or offset anything.
Re:Elevated error rate across multiple models
on Tuesday June 23, 2026 @11:03AM (#48646139)
Seriously, what is the threat model here?
Re:Deno Desktop
on Monday June 22, 2026 @05:49AM (#48628005)
deno desktop ships in Deno v2.9.0 and is not in a stable release yet. To try it now, run deno upgrade canary to install the canary build. The command, configuration keys, and TypeScript APIs may still change before the feature is stable.
Re:Show HN: Gitdot – a better GitHub. Open-source, anti-AI, and writte...
on Tuesday June 09, 2026 @04:55AM (#48458474)
I'd say it's still better than "dotnet"
Re:Tracing a powerful GNSS interference source over Europe
on Friday June 05, 2026 @05:59AM (#48410289)
The theory that they broadcast communication on a band near GPS in order to discourage jamming of their early warning system sounds likely. Flexing the ability to jam GPS is pointless, since it's obvious that any state actor who has military satellites in orbit has considered this option or have the capability already. Therefore, the disruptions must either be regular tests of the capability, or just actual communication. Right?
Re:Virtual private networks and the protection of children online
on Friday May 08, 2026 @04:09AM (#48060150)
This reads like the most blatant attempt yet to strip away our freedoms in the name of mass surveillance! If you wanted to use a VPN to bypass age verification in the EU, you wouldn't use an EU VPN in the first place!
They can't ban non-EU VPNs without setting up a Great Firewall of Europe, but maybe that is the goal now? Looking at Spain blocking all of Cloudflare doing football games, it definitely sets a dark precedent.