News for hackers. Stuff that matters.

spdustin

Re:Official Claude Code extension compromise on Friday October 30, 2026 @04:19PM (#50309587)
Cursor's "marketplace proxy" is, by definition, an MitM of Open VSX. Why on earth is that trustworthy to its users? Is it some mashup of Open VSX Connect and an API endpoint that merges their private marketplace with the public one? And what's so special about Cursor's CC extension implementation that they couldn't just serve the "real" one?

Or are they using an Open VSX Managed Registry hosted by the Eclipse Foundation, in which case this is potentially a bigger deal?

Re:Show HN: UI micro interactions prompts for AI on Thursday October 22, 2026 @04:39PM (#50200710)
Here's my direct feedback, as a member of your target audience:

The call to action says "Copy prompt", not "Unlock prompt", "Sign in to copy", or "Get Creative to access prompts". I didn't even go past the signup to see if the prompts themselves are actually free and work without a subscription to your hosted MCP server. There's a GitHub link in the header suggesting an OSS tier, at the least. That repo may include "prompts" folders, but no prompts are there. The README doesn't even hint that this is a paid library of assets/prompts until the very end, with the misspelled "enhanched" sentence under the "Pro" header. The only prompts that appear to be in the repo (other than those that configure an agent how to use the paid and hosted MCP) are basic design guidelines.

Getting back to the website: your hero text directly invites users to "Try each example and copy its implementation prompt." Which immediately demands the aforementioned signup flow that I didn't bother completing.

All of that just turned me right off.

Your examples are nice, if a bit generic. But if you intended this to be a loss-leader for the more "enhanched" UI/UX skills, it isn't doing that job.

Seems like it might excel at NER and intent-slot tasks, too.
"Before they get big"

Front page includes Ghidra, Vite, PageIndex, and Codex. You can't say "before they get big" without a meaningful threshold for "big".

Re:Lintapple: UI checks for AI-generated interfaces on Monday October 12, 2026 @12:31PM (#50058843)
It didn't seem to flag messing with the page scroll...
Interesting. The same sort of refrigeration failures happened at US military commissaries back in August.

Link: https://signalandsilence.substack.com/p/i-think-someone-hack...

Neat! might I suggest some occlusion for lit pumpkins? Drawing all those blooms is going to get rough.
No, I will not un-block html-load (dot) com.

Glad the original blog post was linked in the comments here.

Re:Ember-1 on Sunday September 27, 2026 @04:23PM (#49870457)
Been thinking about the feasibility of training a model using synthetic thinking traces that were reduced to caveman-speak prior to being used for training. Seems like it would be fairly easy to generate plenty of suitably lobotomized synthetic traces with a pair of cheap-ish models. Or even just using good old fashioned NLP to aggressively remove stop words and reduce trace words to lemmas.
Has anyone utilized this feature outside of an airport?
The apps for State Farm, Allstate, and Progressive can do this now for Apple Wallet. Google Wallet too, IIRC.
Re:Unreal Agent on Tuesday September 22, 2026 @06:06PM (#49808860)
I've also explored s/Fractal tool discovery/Skill tree approaches, seems to work pretty well when you stick the equivalent of XREFs in the frontmatter.
Re:Jev Jailbreak Benchmark on Sunday September 20, 2026 @03:50PM (#49779384)
Sorry, I closed the tab after the first two Claude-isms.

It's _so_ frustrating.

Me with my M1 Max wondering where I went wrong, heh.
Re:AgentsDock: An IDE designed for agentic AI research on Sunday September 13, 2026 @02:38PM (#49687223)
When all you have is a drawer-full of hammers, get yourself a mythical hammer. Clever name.
Re:Homebrew 7.0.0 on Sunday September 13, 2026 @01:33PM (#49686399)
Excellent update, very speedy on upgrades now. Amazing what a little (safe) concurrency will do.

Homebrew.app, however, has a show-stopper for me. "Failed to decode Homebrew JSON output" on the installed/upgrades panel. I'm guessing the Discover panel would normally indicate which Formulae/Casks are already installed, but because it couldn't parse the JSON output, that feature (if it exists) doesn't work.

I'll file an issue—I know HN isn't your bug tracker :)

Edit: there's an issue there already, and I sorted out the root cause: iTerm2's shell integration. If you're using zsh as your shell, the solution is here [^0] in the second comment.

[0]: https://github.com/Homebrew/BrewUI/issues/167/

Re:Logo Programming Language on Friday September 11, 2026 @09:47PM (#49667828)
I have fond memories learning about Logo from Mr. Wizard!
Well... were, anyway.
I just have to say: I _hate_ with a white-hot fury the growing usage of html-load and error-report dot com bullshit on these sites. I block those domains for gratuitous ad-serving, and sites just cycle a modal error now.

(I know, I could disable JavaScript everywhere and enable it on a site-by-site basis. Maybe that time has come.)

Re:Finder is so frustrating and has been since day one on Sunday September 06, 2026 @05:25PM (#49591124)
⇧˖⌘˖. (Shift-Command-Period) will show/hide hidden files in Finder
I'm so weary of seeing Claude-isms everywhere. It makes everything so much more of a cognitive burden to read, whether you're reading for leisure or comprehension.
Re:GPT-6 Astra on OpenRouter on Friday September 04, 2026 @10:03PM (#49572377)
ZDR = Zero Data Retention — they don't store your inputs/outputs.
Re:Show HN: Galaxium, an experimental WebGPU space explorer on Saturday August 29, 2026 @12:57PM (#49491427)
This is a lovely way to explore the sights!

My feedback:

1. I wish the time scaling was persistent; I wanted to jump between solar system objects while keeping the accelerated time. A way to persist the scale would be lovely (maybe a slider in the header).

2. Pinning the object selector would be nice, too. It took me a minute to realize I could focus the text input to show the object selector again.

Re:Data Became Code: We Ran Code Inside Fortune 500s on Thursday August 27, 2026 @04:27PM (#49470757)
Please write your own posts on publishing sites like Medium. I really wanted to engage with this story, but the Claude-isms were just _so_ off-putting.
I legit spent 30 minutes just playing with this. Beautiful work.
Re:Stealth Model on Thursday August 20, 2026 @11:26PM (#49383394)
Based on its indecisive and far-too-lengthy thinking traces when given complex instructions that span system and user messages, as well as a rudimentary stylometry (POS ratios in thinking traces, mainly) comparison with latest non-stealth models, this is almost certainly a GLM model.
Re:Various LLM Smells on Thursday May 28, 2026 @05:13PM (#48315567)
- “(The) honest caveat:” (or “genuine caveat:”, both with the colon)

- “(The) honest answer:” (again, with colon)

- “The thing to internalize:”

- “The smoking gun:”

(really, sentences that start with “The <tag suggesting the next clause is the key point>:” are a strong tell, but those four are the most prolific)

- “load bearing” (when not talking about architecture)

- “blast radius” (when not talking about actual explosives, but rather the effect of an event/action)

- “smoke test” (esp. when “sanity check” is more apropos)

- Lists of three clauses/adjectives where the third is really just a combination of the first two

- Referring to the “shape” of things figuratively

- Social media posts that end with “Curious if anyone…”

- Stories or anecdotes using. “Oh. Oh.” (where the second “oh” is italicized)

Edit: Yes, some of those last ones are terms that we often use as devs...but I would argue about the actual frequency of their use. Plus, these tells live on in prose generated by the latest models.

It’s just still so trivial to jailbreak even the latest Anthropic models (via api, and not talking about the silly ENI or Pliny breaks) I don’t understand where the safety teams are doing their work. Is it in the default chat-trained model?
Re:Vanishing from Hyundai’s data network on Monday August 11, 2025 @10:18AM (#44864372)
CarPlay is essentially a conditional pair of video inputs. Any system that supports on-screen rear-view camera and that has a wheel speed sensor can support CarPlay.

Older »