AI Frontier Daily Briefing: 2026-10-28
88 stories on the 2026-10-27 (UTC) Hacker News front page, 6 with more comments than upvotes. Headline: Google DeepMind launches Genie 4, a real-time world model you steer with natural language - change weather mid-scene, native audio generation, Gemini 3.8 Flash as a guiding agent, 561 points and 336 comments. A VP of Technology posts his GitHub ledger: AI promised less work, he has never worked more - 427 contributions in August 2026 alone, 607 points and 592 comments. A blog post rewrites Brooks's Law for the agent era: adding agents to a project with unclear requirements gets you the wrong answer faster, 412 points and #1 on the front page. Security: GLM-5.3 on Cloudflare Workers AI leaked other users' session content across 155 responses due to a config mismatch plus an SGLang bug; SGLang disaggregated deployments everywhere are affected. Industry: Stanford Daily details Anthropic's shadow-library book piracy (10+ Stanford professors, $1.5B settlement covering ~500,000 works, two professors suing separately for up to $150,000 per work); Amazon puts most Nova models in 'keep the lights on' mode and consolidates on one frontier effort led by Pieter Abbeel; Trump vows to officially ban the term 'AI/artificial intelligence' in federal documents in favor of 'Super Intelligence'. Governance and backlash: Wikipedia's AI cleanup (20% of new articles flagged AI-generated), generative AI creeping into haunted attractions (105 comments on 45 points, day's highest controversy ratio at 2.33), police running 'whisper stops' off Flock Safety AI alerts, Discord public-server messages entering Google search from mid-December. Research: Liquid AI ships LFM3 (1.7B params beating its 2.6B predecessor, 3.6B tokens/day on one B300); the Classification of Finite Simple Groups is fully formalized in Lean at 43.1M lines, with a counterexample found to a published proof route; Anthropic posts early drug-development results with six partners; five inference providers now sell abliterated (refusal-stripped) DeepSeek. Tools and hardware: Ghostty 1.4 completes the Kitty graphics protocol with a 5.7x VT parser speedup, and JetBrains IDEs switch their terminal to libghostty from 2026.3; CPython's experimental JIT is slated for removal after PEP 836 was withdrawn; a Debian developer stops uploading over an unaudited LLM inserted into the NEW review queue; PHP2Shell one-week remediation numbers; a Tailscale SSH privilege-escalation fix lands today; Apple launches M6 in both the iMac and a 24-hour 14-inch MacBook Pro from $1,999; Micron walks away from 4F² DRAM after 20 years while Samsung, SK Hynix and CXMT double down. US-shift additions: the FISC surveillance ruling withheld for seven months; the software-quality nostalgia fight (comments outnumber upvotes); three pillars for owning agent-written code; Raspberry Pi Zero 3 W and Pi 4 Model A surface in kernel device trees; Nvidia plus Micron are 34% of expected S&P 500 earnings growth; an alleged Israeli spy firm outed as the top bidder for Starlink traffic; 22 companies including Microsoft object to OKXICE tokenized stocks. 33 items.
88 stories on the 2026-10-27 (UTC) Hacker News front page, 6 with more comments than upvotes. Today’s weight sits on three lines: Google DeepMind ships Genie 4, a real-time world model; two posts about what AI actually does to human workload - one backed by a GitHub contribution ledger, one rewriting the Mythical Man-Month - take the top two slots; and a hard security story, GLM-5.3 leaking other users’ sessions on Cloudflare. Anthropic appears in three separate items (pirated-books litigation details, drug-development results, a training-data FAQ), Amazon is reported to be shrinking Nova, and Trump says he will ban the word “AI.” Tools and hardware: Ghostty 1.4 and JetBrains switching terminal cores, CPython’s JIT slated for removal, Apple putting M6 in two machines at once, Micron skipping 4F² DRAM. US-shift additions: the FISC surveillance ruling withheld for seven months; the software-quality nostalgia fight; what humans must still know when agents do the work; Raspberry Pi Zero 3 W and Pi 4 Model A spotted in kernel device trees; Nvidia plus Micron account for 34% of expected S&P 500 earnings growth; an alleged Israeli spy company heavily targeted Starlink users; 22 companies object to OKXICE tokenized stocks. 33 items.
1. Genie 4 takes steering commands mid-scene - 561 points
Game engines should be nervous right now.
Google DeepMind announced Genie 4, a real-time interactive world model, as a research preview for trusted testers, with a rollout to Google AI Ultra subscribers in Project Genie and to early partners through the Gemini API and Google AI Studio. Three capability blocks: 1. Natural-language steering mid-simulation - change weather, camera angles, or drop in objects and people while the scene stays coherent. 2. Native audio generation, ambient sound plus adaptive dialogue, which DeepMind says makes it the first real-time world model to do so. 3. Gemini 3.8 Flash acting as a guiding agent in the loop - observing frames, decomposing goals, adjusting plans; the team also ran experiments with Gemini 4 Argon, including simulating a humanoid robot playing checkers. All outputs carry SynthID watermarks. 561 points, 336 comments, third-highest heat of the day. If you do film pre-viz, game prototyping, or robotics scenario generation, watch the API opening. Source · HN discussion
2. 607 points, 592 comments - AI promised less work, he works more
Where did all that saved time go?
Orestis Ioannou, VP of Technology at Bold.org, audits his own GitHub history since 2020: August 2026 hit 427 contributions, beating his previous peak of 319 from April 2020, and by October 27 he had logged 2,102 - more than any full year from 2021 through 2025. He is a VP now, yet his graph looks like his full-time coding year; his median weekday went from 3-4 contributions to 7, and days with 24-plus contributions went from one a year to 16. His explanation: agents did not make his existing workload faster - they made it cheaper to give himself a bigger one, and running several agents in parallel means constant context switching. 607 points and 592 comments, comments nearly matching upvotes. If you run an agent-heavy team, this is your reference case for workload creep. Source · HN discussion
3. Front-page #1 - the Mythical Man-Month gets a 2026 rewrite
Nine agents still can’t deliver a baby in one month, right?
Blogger Jan van den Berg revisits the core claim of Brooks’s 1975 classic - adding people to a late project makes it later - and concludes the law did not disappear, it mutated: agents remove the old overheads (onboarding, meetings, office politics), but defining what “done” means, reviewing code, catching hallucinations, and integrating the pieces all shift back onto the human, and that someone is you. His 2026 formulation: adding agents to a project with unclear requirements gets you the wrong answer faster - nine agents on one codebase will happily overwrite each other’s work. 412 points, 292 comments, #1 on the front page. If you schedule agent work, that sentence is a pre-flight checklist. Source · HN discussion
4. 145GB - Roblox caught scraping model sites, adult content included
Scraping that for a platform full of kids - who signed off?
Open3DLab reports that on October 15-16 a crawler identifying as trellis2-data-sourcing/1.0 (3D foundation model research; [email protected]) from a single AWS address scraped Open3DLab, SFMLab, and SmutBase: 26,429 requests across 18,926 project pages, then 1,027 files from 712 projects totaling 145.5 GB. Of those, 345 projects (62.8 GB) were adult content - SmutBase hosts only adult material - and 423 projects carried non-commercial licenses; the crawler ignored robots.txt and worked European office hours. The sites blocked it starting October 18 and emailed Roblox twice with no reply; they note Meta’s AI crawler made roughly 380,000 requests to their sites the prior month and has been blocked too. 442 points, 265 comments. If you build 3D datasets or work on crawl compliance, those two numbers are worth remembering. Source · HN discussion
5. 155 leaked responses - GLM-5.3’s KV cache failure on Cloudflare
They tested the long context and only checked for HTTP 200?
Cloudflare disclosed that GLM-5.3 (@cf/zai-org/glm-5.3, launched August 27 on Workers AI) shipped with a configuration mismatch: a 1,048,576-token context window but a prefill KV cache pool of only 681,280 tokens. On September 8, researcher Gadi Evron reported via HackerOne that very long prompts returned text from other users’ sessions. The root cause sat in SGLang: in disaggregated prefill/decode mode, an over-length request was internally rejected but swapped for an empty response, so the decode node generated while reading stale KV pages holding earlier users’ data - and returned HTTP 200; the bug had been reported upstream on July 6. 155 responses were affected, all from prompts over 681,280 tokens; Cloudflare found no evidence of deliberate exploitation and says no other model was affected. Fixes: the pool was enlarged to ~2.04M tokens, and patches landed in SGLang v0.5.20-v0.5.22. 177 points, 71 comments. If you self-host SGLang or run multi-tenant inference, walk this disclosure’s reproduction conditions line by line. Source · HN discussion
6. Anthropic’s pirated library held Stanford professors’ books
Does a $1.5B settlement just buy the whole thing away?
The Stanford Daily reports that filings in Bartz v. Anthropic show Anthropic downloaded and reproduced books from “shadow libraries” such as LibGen and PiLiMi and kept a centralized pirated library to train Claude; more than ten Stanford professors are named, including writers Tobias Wolff, Abraham Verghese, and Chang-Rae Lee, with ten of Wolff’s works reportedly used. Judge William Alsup had previously ruled that building a permanent pirated library is not fair use, while training on lawfully obtained text could be. The settlement - $1.5 billion covering authors and publishers of nearly 500,000 registered works - averages roughly $3,000 per work; Wolff and Lee opted out and sued separately in Cruz v. Anthropic seeking up to $150,000 per infringed work. 353 points, 184 comments. If you track training-data litigation, this ruling is the most-cited primary document in the space. Source · HN discussion
7. Amazon puts Nova on ‘lights-on’, bets on one frontier effort
Two years of burn, and this is the ember left?
Futurism, citing Bloomberg, reports that most of Amazon’s Nova models - text, image, and video - are in a “keep the lights on” state: still supported but starved of resources, with labor and compute redirected to a single frontier-model effort led by Pieter Abbeel, the Covariant founder Amazon acquired in 2024. The move follows the recent closure of an 80-person AGI research office in San Francisco. 150 points, 71 comments. Big-tech foundation-model economics get audited again; if you follow cloud strategy, read Nova’s retreat against Bedrock’s agency approach. Source · HN discussion
8. Trump moves to ban the term ‘AI’ from federal documents
Rename it, and the capability changes how?
Trump posted on October 27-28 that his administration will “officially BAN the term, ‘AI/Artificial Intelligence,’ in all relevant documents, and everything else, due to its inaccuracy,” after the Wall Street Journal declined to adopt his preferred wording. The backstory: Executive Order 14434, “Inaugurating the Era of Super Intelligence,” signed September 29, already directs federal agencies to use Super Intelligence (SI) in non-statutory documents, maps SI to the existing statutory AI definition (15 U.S.C. §9401(3)) for now, and orders a new federal definition of SI within 60 days - due around November 28. The ban covers federal executive documents only; Anthropic and OpenAI keep saying AI, while xAI has embraced the rebrand. 72 points, 79 comments. If you write proposals for US government customers, mind your vocabulary. Source · HN discussion
9. One in five new articles AI-written - Wikipedia’s cleanup goes big
The last good place on the internet - can it hold?
IEEE Spectrum interviews Ellia Lebleu of WikiProject AI Cleanup: detection firm Pangram’s figures put AI-generated content at about 20% of new articles and drafts in late 2025, falling to 15-16% in early 2026 - and nobody knows whether enforcement or better-disguised models drove the drop. Telltales have evolved from phrases like “stands as a testament” to structural patterns - rule-of-three lists, mandatory conclusion sections - plus behavioral cues like an editor posting five multi-thousand-word articles in minutes; citations that exist but do not support the claim are now more common than fully hallucinated ones. English Wikipedia bans LLM-written articles, the Wikimedia Foundation ships a paste-detection tool, and some models already refuse to draft Wikipedia pages. 400 points, 182 comments. If you run content moderation, this project’s detection playbook is a working reference. Source · HN discussion
10. 105 comments on 45 points - AI is ruining haunted houses
What scares people isn’t the ghost, it’s the Gemini watermark
Jonathan Bailey of Plagiarism Today inventories generative AI creeping into every stage of haunted attractions: Kennywood and The Darkness took heat for AI promo art, projection giant AtmosFX admitted some characters are AI-generated, Knott’s Berry Farm sold AI merchandise described as a racist caricature, and he personally spotted Gemini watermarks on posters at a local haunt. He explicitly exempts non-generative uses - microcontroller-controlled props, AI-assisted safety checks. 45 points, 105 comments; comments run 2.33x upvotes, the day’s highest controversy ratio. If you cover creative industries, this list is a concentrated set of AI backlash cases. Source · HN discussion
11. Claude in drug development - Anthropic posts a six-partner scorecard
“Early progress” again - are the numbers solid this time?
Anthropic published results from drug-development work with six organizations. Divergence Labs used Claude to generate roughly 35,000 antibody designs in about a month; BigHat Biosciences tested ~1,010 variants over ten weeks, with best candidates binding more than 10x more tightly; Enveda ran Claude over 1,061 pages of documents, where it caught all 11 issues human reviewers found plus seven they missed, cutting review time by 89%. Keep the boundary in view: nearly all of it is preclinical, and BMS’s scaled-up use is planned for 2027. 26 points, 4 comments - little heat. If you work in AI for science, verify the numbers in the source yourself. Source · HN discussion
12. Is your data training the model? Anthropic writes the official answer
A whole FAQ page - they got tired of the question?
Anthropic published an official explainer on privacy.claude.com covering its commercial products (Claude for Work, the API, Claude Gov): inputs and outputs are not used for training by default, and the only exception is feedback you explicitly submit - thumbs up/down stores the related conversation in Anthropic’s secured backend for up to five years, de-linked from user and customer IDs, and may be used for analysis and, where legal, training. Team and Enterprise owners can disable the “Rate chats” entry point entirely under Organization settings; consumer plans are covered in a separate article. The post drew 206 points and 91 comments. If you route sensitive material through Claude, check your settings once per product line. Source · HN discussion
13. 43.1M lines of Lean - finite simple groups fully classified
And the agents also fixed a published proof along the way?
The Axiom Math team announced a complete Lean formalization of the Classification of Finite Simple Groups along the original “first-generation” proof route: about 43.1 million lines of Lean, 2.05 million declarations, every step machine-checked by Lean’s kernel; the underlying proof was written by roughly a hundred mathematicians across hundreds of journal papers. The project leaned heavily on AI agents, and the process surfaced a real flaw - a counterexample to a closure assertion in a published proof route, which the team documented in a new paper (arXiv 2610.00575) with an alternative argument based on Solomon’s 1976 theory of maximal 2-components. 133 points, 29 comments. If you work on AI-assisted theorem proving, this is the largest complete formalization effort to date. Source · HN discussion
14. 1.7B beats 2.6B - Liquid ships LFM3, one B300 eats 3.6B tokens a day
Can small models still win on tool calling?
Liquid AI launched the LFM3 family: six models around 2B parameters (text, vision, audio, omni, plus two decision models) branching from a shared LFM3-1.7B-Base, trained on 22T tokens, with a final 3.5T-token mid-training stage extending context to 256K. Claimed numbers: LFM3-1.7B outperforms the older LFM2.5-2.6B with ~35% fewer parameters; BFCL 71.39 and ToolSandbox 80.36, with stated wins over Qwen3.5-9B on WebArena-Verified and AutomationBench; ~1GB at 4-bit; 1.8-2.8x faster on-device decoding than the next-best model; 3.6 billion tokens per day on a single B300 at 1,024 concurrent requests. Open weights are on Hugging Face, fine-tunable on one GPU, with AMD and Qualcomm among the partners. 81 points, 30 comments. If you build on-device agents, run these tool-calling scores on your own task set. Source · HN discussion
15. Five providers now sell abliterated DeepSeek, refusals stripped
Marketed for safety research - but who else is calling?
allmodels.io runs an aggregation route for “abliterated” models - weights modified to strip refusal behavior - featuring DeepSeek V4.1 Flash and GLM-5.3 abliterated variants, with automated provider failover and one endpoint for every such model. These models refuse virtually nothing; the operator’s own copy warns they are more likely to produce harmful output and belong in controlled environments. 91 points, 118 comments - more comments than upvotes, with the debate centered on who “safety-research infrastructure” actually serves. If you do red-teaming, this is a live specimen; if you do platform trust-and-safety, this is a product shape you need to recognize. Source · HN discussion
16. Micron walks away from 4F² DRAM after 20 years
The density edge was a myth - since when?
HotHardware reports that Micron announced on an October 21 technology webinar that it will not pursue 4F² DRAM - a cell design it invented and researched for about two decades - citing fundamental scaling problems at the leading edge: manufacturing complexity up, density gains not worth it. Micron is extending its current 6F² architecture instead and aiming at 3D DRAM long-term. Rivals are betting the other way: Samsung is building 4F² with vertical channel transistors, showed a 16Gb chip at ISSCC in February, and targets mass production in 2028; SK Hynix presented its VG platform at VLSI 2026; China’s CXMT claimed on October 10 it will ship 4F² server DDR5 by end-2026, a statement that knocked Samsung and SK Hynix shares down about 7.4% and 10%. 116 points, 18 comments. If you track memory supply and the AI memory cycle, this 4F² split is the key variable for the next two years. Source · HN discussion
17. M6 lands in two machines at once - a 24-hour MacBook Pro from $1,999
The M4 isn’t even paid off yet?
Apple launched the M6 generation on October 27. The 14-inch MacBook Pro leads: 12-core CPU, 12-core GPU, and a “Dual 16-core Neural Engine,” with Neural Accelerators in every GPU core; Apple claims 30% faster graphics and 25% faster on-device AI versus M5, up to 11x graphics versus M1; 16GB of unified memory standard with 170GB/s bandwidth; a rated 24-hour battery; from $1,999 ($1,899 education), pre-orders October 28, on sale November 6. The new iMac arrived the same day with 10- or 12-core M6 options, up to 32GB of memory, up to 2TB SSD, and seven colors, with the same dates. The iMac thread drew 267 points and 320 comments, and the two MacBook Pro threads combined for 356 points and 411 comments - the day’s biggest hardware discussion. If you buy machines to run local models, bandwidth and the 16GB floor are the two numbers to compare. Source · HN discussion
18. CPython’s experimental JIT is headed for removal
Three years in the main repo, and that’s it?
LWN reports that the experimental JIT added to CPython 3.13 in 2024 by Brandt Bucher will be removed from the main repository. Timeline: the Python Steering Council paused JIT work in June 2026 and demanded a standards-track PEP, or the code goes; on October 19 the authors withdrew PEP 836 (“JIT Go Brrr…”), citing lack of personal bandwidth, and no alternate PEP emerged. Brett Cannon said main-repo work stops; a reference implementation will remain, and anyone continuing would need a new PEP. No replacement is named - PyPy and GraalPy remain the alternative runtimes. 392 points, 205 comments. If you depend on CPython’s performance roadmap, archive this timeline. Source · HN discussion
19. 505 points - Ghostty 1.4 makes GIFs animate in the terminal
Even terminal rendering is a competitive track now?
Ghostty shipped 1.4.0 after seven months, 172 contributors, and 2,889 commits. The headline is complete Kitty graphics support - animation and relative placement included, which the project says makes it the first non-Kitty terminal to cover 100% of the published spec; scrollback compression cuts memory 70-90% and the default scrollback limit rose from 10MB to 50MB. Performance: macOS I/O throughput up 25-55%, the VT parser jumps from 128MB/s to 725MB/s on plain ASCII, cat-ing a 150MB file drops from 1.5s to 566ms, and a fresh terminal uses ~16KiB. The same release patches ten security advisories; the GTK build now requires GTK 4.18, which Ubuntu 24.04 misses - Flatpak is the official workaround. 505 points, 149 comments. If you live in a terminal or embed one in an app, re-evaluate the libghostty route. Source · HN discussion
20. Every JetBrains IDE terminal quietly switched to libghostty
They gave up on their own terminal engine?
JetBrains announced that starting with version 2026.3, the built-in terminal across its IDEs runs on libghostty, replacing JediTerm after many years. User-visible changes: Kitty keyboard protocol support, so programs like Claude Code, Codex, Neovim, and fish can distinguish Enter, Shift+Enter, and Ctrl+Enter; terminal apps follow the IDE’s dark/light theme; and roughly 50 control sequences that JediTerm ignored or misread are handled correctly. 54 points, 6 comments. If you use JetBrains IDEs, feel the terminal difference on your next upgrade. Source · HN discussion
21. Debian developer stops uploading over unaudited LLM review
Didn’t the project vote to neither endorse nor prohibit?
Debian developer Johannes Schauer announced on debian-devel that he will no longer upload packages to the NEW queue. He learned, without any announcement, that NEW processing now runs every upload through an LLM-based review (“Debian Inference”) whose output the DFSG team does not audit, with no way to opt out. His argument has three layers: 1. Debian’s 2026 General Resolution says the project “neither endorses nor prohibits” generative AI, and a central team silently screening all uploads looks like de facto endorsement. 2. The resolution requires prior discussion for large-scale automated actions affecting many packages; this did not happen. 3. Embedding proprietary, non-deterministic models into a core workflow is worse than improving free tools like Lintian. 227 points, 137 comments. If you push AI workflows into open-source projects, the structure of this objection is worth reading in the original. Source · HN discussion
22. PHP2Shell week one: exposed machines down 67%
Can the long tail of PHP servers still brake in time?
Wiz published exploitation and remediation trends for PHP2Shell, the two critical PHP vulnerabilities disclosed October 21 (CVE-2026-109619 and CVE-2026-109618). Its telemetry shows only a limited number of exploitation attempts and no end-to-end success; one public honeypot did achieve confirmed RCE, which required a favorable single-worker Apache mod_php configuration, and CISA has added PHP2Shell to its Known Exploited Vulnerabilities catalog. Remediation after one week: internet-exposed vulnerable machines down ~67%, significantly affected organizations down ~47.9%, and still just under 53% of initially affected organizations remained vulnerable; the share of old unpatched versions (7.3 and earlier, no official backports) fell from 8.3% to 5.7%. 174 points, 55 comments. If you run ops, check your PHP, LiteLLM, and GitLab versions against the Wiz and cloudsleuth patch lists. Source · HN discussion
23. Tailscale discloses SSH privilege escalation, patch lands today
Zero trust, but not against your own bugs?
Tailscale published an investigation and remediation update for Tailscale SSH: under certain conditions, a user already authorized to connect over Tailscale SSH could perform actions beyond the permissions of their configured local user - privilege escalation, not a confirmed breach. Impact depends on the connecting user’s and device’s permissions and system configuration; full technical detail is promised in a follow-up. The company does not recommend disabling Tailscale SSH; interim mitigations are to review SSH access policies, set TS_SSH_DISABLE_FORWARDING=1 if forwarding is unneeded, tighten access to sensitive systems, and apply the patch targeted for October 27. 96 points, 39 comments. If you manage production machines over Tailscale SSH, disable forwarding now and take the patch. Source · HN discussion
24. Pulled over for “suspicious” driving - US police act on AI alerts
Is this policing, or algorithmic fishing?
The ACLU and other outlets report that US police are running stops based on AI flags from license-plate reader networks like Flock Safety: the systems label travel histories as suspicious, link vehicles frequently seen together, and cross-reference arrest records and commercial data-broker data, after which officers conduct stops on minor or invented violations - internally called “whisper stops” or “intel stops.” Cases include a Texas driver backed by a jury after a fusion-center alert led to a bogus lane-drift stop, a California grandmother questioned about casino visits, and a Wisconsin driver flagged partly because Michigan is “a known source state” for legal marijuana. 291 points, 221 comments. If you build location-data products or sell to public agencies, this piece lays out the shift from investigating known suspicion to manufacturing it. Source · HN discussion
25. Discord server messages are coming to Google - and the default is on
Everything you posted in public servers, now searchable?
Discord announced that starting November 16, every Discoverable Server (public, 1,000-plus members) automatically gets a web page, and from mid-December member messages from public channels - without usernames or avatars - can appear on those pages and in web search results. Admins can opt out or scope channels under Server Settings > Web Presence; members get a single toggle under Data and Privacy. Defaults differ by region: the EU, UK, Canada, Brazil, Australia, and South Korea default to off, teens are excluded entirely, and everywhere else defaults to on; nothing sent before mid-December enters the index. 121 points, 89 comments. If you have ever discussed sensitive topics in a public Discord server, flip the switch now. Source · HN discussion
26. An offline AI: 930,000 Wikipedia articles in a local kit
Even the doomsday-prep crowd has an LLM now?
Survival LLM is a free, open-source assistant that runs fully offline after setup: no account, no tracking, and every answer cites its sources, clickable down to the highlighted passage. It picks a model based on your machine’s memory - a 128GB-plus Mac gets NVIDIA Nemotron 3.5 Super (21 of 22 blackout-and-first-aid test questions right), while 16-31GB machines fall back to Granite 4.2 8B (14 of 22), and the smaller models’ error rate is exactly why citations are always shown. The emergency library holds roughly 930,000 Wikipedia articles plus WikiMed, MedlinePlus, FEMA guides, US military survival and medical manuals, and iFixit repair guides; the full library downloads at 9GB (19GB installed), and a MacBook Pro answers roughly 100-300 questions per charge. 65 points, 45 comments. If you build offline or edge deployments, the memory-adaptive model selection plus mandatory citations is a design worth borrowing. Source · HN discussion
27. 975 points - a secret court ruling on US spying stays hidden
Declassify first, reauthorize after - too much to ask?
WIRED reports that Senators Ron Wyden and Adam Schiff have written to Director of National Intelligence Jay Clayton and Attorney General Todd Blanche, accusing the Trump administration of illegally withholding a Foreign Intelligence Surveillance Court ruling. Roughly seven months ago the court found that search filters letting analysts pull Americans’ messages from intercepted data skipped the approvals, written justifications, and records the law requires - and approved another year of surveillance anyway. Under the government’s own 180-day review policy the ruling should have been examined for release by September 13; meanwhile Section 702 lapsed in June when Congress failed to renew it, collection continues on the court’s March approval, and intelligence officials are pressing lawmakers to reauthorize by year-end. The ACLU plus 22 other civil-liberties groups urged Congress on Monday to refuse. 975 points, 375 comments, second-highest upvote count of the day. Anyone tracking surveillance law should watch the November 6 deadline for the administration’s answer. Source · HN discussion
28. The top bidder for Starlink traffic was allegedly an Israeli spy firm
An ad renders, and the device belongs to someone else?
Reuters, citing sources, reports that Discover Tech - an alleged Israeli espionage company - heavily targeted Starlink users and was the No. 1 bidder on Starlink traffic in more than 100 countries, including places where Starlink itself is banned or restricted. Citizen Lab’s October 15 investigation lays out the mechanism: Discover Tech runs its own ad-buying platform, MyDSP, and when an ad renders on a device it calls back to the company’s NOAS server with the user’s advertising ID - enabling zero-click infection the moment an ad is displayed. Citizen Lab calls it the first public confirmation of mercenary spyware delivered via targeted ads, with Candiru (rebranded Integrity Labs) among the customers. The report analyzed about 3.77 billion ad bids and 442 million won impressions from March to June 2026, roughly $109,000 in spend, and about 3.6 million users steered to Candiru-linked infrastructure. Google, Beeswax, and Vungle cut off its platform access in early October. 139 points, 31 comments. If you work on mobile ad security or zero-click defense, this is the most complete public teardown available. Source · HN discussion
29. Nvidia plus Micron are 34% of the S&P 500’s expected earnings growth
A whole bull market resting on two suppliers?
Citing FactSet data, the Wall Street Journal reports that analysts expect S&P 500 earnings to grow 30% year over year in Q3 2026; a Dow Jones Market Data analysis finds Nvidia and Micron alone account for 34% of that growth, and ten companies - most of them AI giants - roughly two-thirds. 155 points, 36 comments. For anyone pricing the AI trade, this concentration is itself the most straightforward risk metric: one capex slowdown at the big cloud buyers and the index-level earnings story needs rewriting. Source · HN discussion
30. Software is getting worse - but it used to be horrible
Anyone actually miss the blue-screen era?
Jake Voytko concedes that software quality is declining - code output is up 10x while error rates have not dropped to match - but pushes back hard on nostalgia. Windows at its ~95% market-share peak crashed constantly, from buggy device drivers to failed resource reclamation; there was no autosave, and after he joined the Google Docs team in 2010 they found the non-functional Ctrl+S still ranked among users’ top five actions; the Melissa virus brought the internet to its knees, and 286-era PCs needed a literal turbo button that slowed the CPU so programs hardcoded for 4.77MHz would keep running. His examples run from Diablo II’s item-dupe economy to game CDs that were permanently destroyed by a scratch. 326 points, 334 comments - comments outnumbering upvotes. The most concrete counter-testimony you will find in the “why is software getting worse” debate. Source · HN discussion
31. When agent-written code breaks at 2am, you still take the call
Not writing it yourself doesn’t mean you can’t fix it?
The blogger behind adrq uses one Codex incident to map what humans must still know when agents do the work: CI flagged App.tsx for cyclomatic complexity - a 30-line file containing 15 single-line components written by Codex. Codex refactored it into 10 files and CI passed, but his worry was that this was code he had never seen before. His answer is three pillars: 1. Fundamentals - concepts like data structures, concurrency, and distributed systems let you recognize failure modes, such as spotting quadratic complexity from an agent’s runtime pattern. 2. Breadth - a cross-domain mental map, built only through accumulated reading and experience. 3. Just-in-time depth - the ability to go as deep as a problem demands; he credits re-learning the level-triggered state machine principle for a redesign that left his agent orchestrator rock solid. 182 points, 97 comments. If you hire juniors, this is an actionable framework for the “nobody hand-writes the basics anymore” problem. Source · HN discussion
32. Pi Zero 3 W and Pi 4 Model A surface in the kernel tree
Device trees merged - launch can’t be far off?
bret.dk spotted device tree files for two unreleased boards in Raspberry Pi’s Linux kernel tree: bcm2711-rpi-zero-3-w.dts and bcm2711-rpi-4-a.dts. Reading the files: the Zero 3 W appears to move to the Pi 4’s Broadcom BCM2711 quad-core Cortex-A72 (the Zero 2 W runs a quad-core 1GHz Cortex-A53), with a power button, Wi-Fi/Bluetooth, and an SPI-flash bootloader; the Pi 4 Model A drops Ethernet, the second HDMI output, and the 3.5mm audio jack while keeping external-antenna support - the first Model A since 2018’s 3 A+. RAM, pricing, and launch dates are undisclosed, and the author cautions these are kernel files, not an official spec sheet. 180 points, 103 comments. If you are waiting for cheap boards to run local models, add both to your watchlist. Source · HN discussion
33. 22 companies said no - Microsoft among them - to tokenized stocks
Nobody asked the companies first?
Gizmodo rounds up Reuters and Fortune reporting: at least 22 companies have formally objected to OKXICE - a joint venture between crypto exchange OKX and NYSE parent Intercontinental Exchange, co-chaired by former New York governor Andrew Cuomo - tokenizing their shares. The newest objectors include Microsoft, Alphabet, Goldman Sachs, McDonald’s, Qualcomm, and Western Digital, following earlier objections from CoreWeave, Verizon, Broadcom, and others; AMC’s CEO publicly attacked Robinhood last month for tokenizing his company’s stock without permission. The mechanism is the SEC’s Innovation Exemption issued last month: platforms need no advance permission, a company gets 30 days to object after being notified, silence counts as consent, and an objection blocks only that one platform. OKXICE plans round-the-clock trading in 63 tokenized US stocks under the exemption; Apple, Nvidia, and Amazon had not responded as of the report. 99 points, 116 comments, comments exceeding upvotes. If you track real-world assets, this objection list is a ready-made risk input. Source · HN discussion