Jun 18Friday, June 19, 2026 · all daysJun 20 · today »
1.I found 10k GitHub repositories distributing Trojan malware(orchidfiles.com)
966 points by theorchid 46 days ago | 246 comments | permalink
tl;dr: A developer discovered ~10,000 GitHub repositories distributing Trojan malware by cloning legitimate new repos (preserving commits and contributors for credibility), then periodically force-pushing a README update with a link to a malicious zip archive. He wrote a script using GitHub event archives to identify them based on patterns like frequent "Update README.md" commits, and published the list. GitHub only removed repos explicitly reported, ignoring the underlying detection problem—meaning the script continues to find new ones, and the campaign (active for over a year) persists.
HN Discussion:
  • The campaign targets AI coding agents rather than humans, explaining the unusual patterns
  • Personal confirmation of having their repos cloned and weaponized in similar attacks
  • GitHub systematically ignores abuse reports, confirming the article's criticism
  • Technical analysis linking the samples to known trojan malware families
  • Broader context about how malware from GitHub causes real-world harm to victims
2.Ubiquiti: Enterprise NAS, Built on ZFS(blog.ui.com)
413 points by ksec 45 days ago | 355 comments | permalink
tl;dr: Ubiquiti's new ENAS is a ZFS-based enterprise NAS powered by an 8-core ARM Neoverse N2 platform with 64GB ECC RAM, optional NVMe L2ARC caching, 16 drive bays expandable past 1PB, and dual 25GbE SFP28 ports. It integrates with UniFi for license-free management, identity-based access, and native iSCSI support for Proxmox/VMware/Hyper-V virtualization. Upcoming features include centralized multi-site backup orchestration, including offsite/cloud targets and Microsoft 365 user data backups.
HN Discussion:
  • Enthusiasm for ZFS-based NAS and Ubiquiti entering this space
  • Ubiquiti's no-recurring-cost model is a major selling point worth preserving
  • Concerns about Ubiquiti's software quality and security track record undermine 'enterprise' claims
  • Pricing is too high compared to DIY alternatives like TrueNAS on used hardware
  • ~Hardware specs are decent for SMB but not true enterprise-grade (no controller redundancy, limited features)
3.CS 6120: Advanced Compilers: The Self-Guided Online Course (2020)(cs.cornell.edu)
433 points by ibobev 46 days ago | 59 comments | permalink
tl;dr: Cornell's CS 6120, a PhD-level advanced compilers course taught by Adrian Sampson, is available as a free self-guided online course with video lectures, lecture notes, and open-ended implementation tasks using LLVM and Bril (a custom educational IR). The 14-lesson curriculum covers IRs, data flow, SSA, loop and interprocedural optimization, alias analysis, garbage collection, JITs, and parallelism, interleaved with classic PL research papers. The course is open source on GitHub, though self-guided students miss out on Zulip discussions, deadlines, and the end-of-semester project.
HN Discussion:
  • ~Trace compilation focus is outdated; other dynamic compilation concepts matter more
  • Course topics seem introductory rather than truly advanced
  • Simple appreciation and thanks for the free resource
  • Questions about prerequisites or comparisons to other compiler learning resources
  • Tangential curiosity about compiler-related people and technologies
4..gitignore Isn't the only way to ignore files in Git(nelson.cloud)
565 points by FergusArgyll 46 days ago | 169 comments | permalink
tl;dr: Git supports three levels of ignore files: the usual `.gitignore` (committed to the repo), `.git/info/exclude` (per-repo, not committed, useful for personal files), and `~/.config/git/ignore` (global, machine-wide, ideal for things like `.DS_Store`). The global file location can be customized via `git config --global core.excludesFile`, and `git check-ignore -v <file>` reveals which rule and file is causing a given path to be ignored.
HN Discussion:
  • Sharing additional personal workflows/tricks for ignoring files that complement the article
  • Surprise and gratitude at learning about the exclude/global ignore features
  • ~Article missed related useful features like .gitattributes for ignoring diffs
  • ~Clarifying or correcting article terminology, e.g. 'global' means per-user not machine-wide
  • Caution that per-user ignores like .DS_Store are better handled project-wide
5.Hospitals and universities repurposing drugs at lower cost(kcl.ac.uk)
337 points by giuliomagnifico 46 days ago | 167 comments | permalink
tl;dr: Hospitals and universities are running late-stage clinical trials to repurpose generic drugs at less than 10% of pharma industry costs, operating outside the patent system with lower expertise, risk, and capital barriers. Examples include using a cancer drug to treat blindness and an old anti-inflammatory for Covid. Pharma companies lose interest in repurposing once drugs go generic due to competition, but academic researchers step in, motivated by patient outcomes and publication rather than profit.
HN Discussion:
  • Concrete example of price disparity between repurposed and patented drugs reinforces the article's point
  • Nonprofit-funded drug repurposing is vital for rare diseases ignored by big pharma
  • Pharma exploits patent system by minor modifications to off-patent drugs, showing broken incentives
  • ~Regulatory pathway limitations prevent repurposing studies from leading to officially approved uses
  • ~Big Pharma's funding influence on academia and search makes spreading repurposing findings difficult
6.I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M(thatprivacyguy.com)
453 points by speckx 45 days ago | 291 comments | permalink
tl;dr: In 2021, the author told Elkjop's DPO that requiring customer club membership as a condition for receiving marketing emails violated GDPR's "freely given consent" rule, but the company refused to change. Five years later, Norway's Datatilsynet fined Elkjop NOK 20M (~€1.8M) for exactly that violation, plus repurposing club data for ad tracking without a compatibility assessment. The author only learned of the outcome via a volunteer-run wiki, and is now pressuring the Swedish DPA over its Article 77(2) duty to keep complainants informed, while preparing civil litigation.
HN Discussion:
  • Praise for the author's persistence and concern about social costs of exercising rights
  • Provides supporting documentation and links to the official decision
  • Extends the argument to similar privacy violations in other contexts like hiring and education
  • ~Questions whether the same logic should invalidate all ad-supported business models
  • Praises Norway's DPA while acknowledging the communication failure noted by author
7.W Social, public institutions and the theater of European digital sovereignty(blog.elenarossini.com)
266 points by nemoniac 46 days ago | 164 comments | permalink
tl;dr: The European Commission, ECB, and their presidents have migrated their ATproto accounts from Bluesky to W Social, a Swedish for-profit "European alternative to X" that recently and quietly removed its public GitHub repository, suggesting it has gone closed-source. This contradicts the Commission's own Tech Sovereignty Package emphasizing open source, and ignores Eurosky, a transparent non-profit European ATproto alternative. Critics note W Social's advisory board includes Big Tech figures like Tools for Humanity's privacy chief, raising concerns it's just another surveillance-capitalist startup that happens to be EU-based.
HN Discussion:
  • Eurosky deserves attention while W Social's media hype is suspicious and politically driven
  • W Social resembles a European Truth Social for politicians avoiding rival-owned platforms
  • W Social's for-profit structure and shady practices undermine its credibility
  • ~Public funding dynamics in EU favor opaque projects over user-funded open ones
  • European digital sovereignty is just protectionism dressed up in strategic language
8.Show HN: Are You in the Weights?(intheweights.com)
442 points by turtlesoup 45 days ago | 240 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • Models accurately recognized me and recall details about my work
  • ~Models hallucinated entirely fictional details about me
  • ~Mix of accurate identification alongside confident hallucinations
  • Reflects on training data being scraped without consent, making us immortal in weights
  • Amused by being confused with famous namesakes in the weights
9.Modos Color Monitor Pushes E-Paper Displays Further(spectrum.ieee.org)
337 points by Vinnl 46 days ago | 80 comments | permalink
tl;dr: Modos is crowdfunding the Flow, a 13.3-inch color e-paper monitor with 3200×2400 resolution, touch input, and 60Hz refresh, powered by their new open-source Enchanter display controller (which uses a Chrontel CH7516 chip to enable DisplayPort 1.1). Co-founders Wenting Zhang and Alexander Soto note pixel response is ~50ms (comparable to the first iPad's IPS panel), and emphasize minimizing input-to-display latency over raw refresh rates. They've stuck with crowdfunding over VC because the e-paper monitor market is too niche for investors but supports a hackable, open-source community.
HN Discussion:
  • Excitement about Modos as a major step forward in e-paper display technology
  • ~Concerns about how higher refresh rates affect panel longevity and energy efficiency
  • Enthusiasm for broader alternative display ecosystem and outdoor-readable devices
  • Skepticism or curiosity about practical use cases for a standalone e-ink monitor
  • Questions about specific product details like visible screen dimensions
10.Noam Shazeer Joins OpenAI(twitter.com)
350 points by lukasgross 46 days ago | 377 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • Background context on Shazeer's foundational work on the transformer architecture
  • Recap of Shazeer's career trajectory between Google, Character.AI, and now OpenAI
  • ~Speculation that financial incentives like pre-IPO stock motivated the move
  • ~Speculation that Gemini's underperformance led to his departure
  • This is a major win for OpenAI and a significant blow to Google's Gemini efforts
11.Midjourney Medical(midjourney.com)
1354 points by ricochet11 46 days ago | 873 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ~Cautiously optimistic about the technology but skeptical of resolution claims and CT comparisons
  • Rejects the article's vision of healthcare as data-maximization optimization
  • Skeptical of frequent full-body scans due to overdiagnosis risks
  • Criticizes naive understanding of FDA regulatory process
  • Argues the underlying USCT technology is not novel and unlikely to replace CT/MRI
12.Emacs 31 is around the corner: The changes I'm daily driving(rahuljuliato.com)
457 points by frou_dh 46 days ago | 274 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • Longtime Emacs users affirm continued loyalty and productivity with the editor
  • Excitement about specific Emacs 31 improvements like tree-sitter and kill-region-dwim
  • ~Emacs configuration complexity remains a barrier, though LLMs/agents now help
  • Users feel out of touch and want a guide to catch up on modern Emacs
  • ~Will likely ignore new features and keep using Emacs the same old way
13.Swiss parliament lifts ban on new nuclear power plants(bluewin.ch)
794 points by leonidasrup 45 days ago | 827 comments | permalink
tl;dr: Switzerland's National Council voted 100-98 to approve a counterproposal to the "Blackout Initiative," lifting the ban on building new nuclear power plants and aligning with prior decisions by the Federal Council and Council of States. The measure, opposed by the SP, GLP, and Greens, will ultimately go to a public referendum, with Greenpeace already protesting and the Greens signaling they may call one regardless.
HN Discussion:
  • ~Referendum will likely block this and discourse will be chaotic and uninformed
  • Nuclear is essential for energy security, safety record, and national sovereignty
  • Nuclear is too expensive and slow; renewables and hydro storage are better investments
  • SMRs and future fission innovation will make nuclear thrive
  • Nuclear lobby push ignores dirty mining realities and economic non-viability
14.Microsoft new Outlook takes 10 seconds to do what Outlook Classic does instantly(windowslatest.com)
720 points by Adam-Hincu 46 days ago | 507 comments | permalink
tl;dr: Microsoft's new WebView2-based Outlook takes roughly 10 seconds to display an email when clicked from a Windows 11 notification, compared to nearly instant in Outlook Classic—and it's actually faster to ignore the notification and open the app manually. The new Outlook also runs as 10 separate processes and uses 4x the RAM of Classic, limitations inherent to its Chromium-based web wrapper architecture. A real fix likely requires a native WinUI rewrite; until then, Classic (supported until April 2029) remains the better choice for performance.
HN Discussion:
  • Switching to Linux is justified by Windows/Microsoft's declining performance
  • ~Web-based email clients can be fast; new Outlook is poorly engineered specifically
  • Microsoft has a long-standing cultural indifference to performance quality
  • Windows bloat extends beyond Outlook to basic apps like Notepad and Calculator
  • Native apps would solve this but web portability seduces developers into dependency hell
15.The founder of Craigslist has given away half a billion dollars(independent.co.uk)
409 points by Tomte 45 days ago | 314 comments | permalink
tl;dr: Craigslist founder Craig Newmark has donated roughly $500 million to causes including journalism, cybersecurity, veterans, and pigeon rescue, and joined The Giving Pledge in 2025 after the program expanded beyond billionaires. He publicly pushed back against Peter Thiel and other tech billionaires who have discouraged wealthy peers from signing the pledge, claiming it funnels money to "left-wing" nonprofits. Newmark, who still doesn't own a car and takes the NYC subway, kept Craigslist free for users rather than take VC money, and credits childhood lessons from Holocaust survivors for his approach to wealth.
HN Discussion:
  • Admiration for Newmark's humble lifestyle and character
  • Criticism that Craigslist profits from scams and fails to moderate them
  • Newmark could have done more good by improving Craigslist itself
  • Praise for Craigslist's minimalist UI design reflecting Newmark's character
  • Curiosity or questions about Craigslist's economics and current relevance
16.A website that lists websites to submit your website to(submission.directory)
427 points by azeemkafridi 45 days ago | 93 comments | permalink
tl;dr: A curated directory cataloging dozens of places to submit websites, startups, and products for backlinks and exposure—ranging from major platforms like Hacker News, Product Hunt, Crunchbase, and G2 to niche AI tool directories, indie web blogrolls, and design galleries. Each entry notes whether links are dofollow/nofollow, free vs. paid placement, and the target audience (developers, founders, buyers, design enthusiasts, etc.).
HN Discussion:
  • Sharing personal experience building similar product discovery/submission platforms
  • Offering additional curated lists of submission directories
  • Publicly listing submission sites encourages spam and low-quality drive-by posting
  • This is a recycled concept from the pre-search-engine era of the web
  • Submitting just for SEO backlinks is rude to the target communities
17.Lore – Open source version control system designed for scalability(lore.org)
1249 points by regnerba 46 days ago | 673 comments | permalink
tl;dr: Lore is an open-source version control system maintained by Epic Games, built for large-scale projects that mix code with hefty binary assets, such as games and entertainment productions. It targets both developers and artists, aiming to scale across massive datasets and team sizes.
HN Discussion:
  • Lore is a Perforce competitor for game dev, not a Git replacement for general code
  • Perforce is the aging incumbent that genuinely needs a challenger like this
  • Lore isn't really new, just a rebrand of Unreal Revision Control being open sourced
  • Many mature data versioning alternatives already exist, questioning the need for another
  • Claims of being fully open source are undermined by binary-only desktop client
18.How Madrid built its metro cheaply (2024)(worksinprogress.co)
221 points by trymas 46 days ago | 183 comments | permalink
tl;dr: Madrid tripled its metro length between 1995-2007 at roughly one-tenth the per-mile cost of London's Jubilee Line, driven by four factors: consolidated regional control that made politicians directly accountable for delivery, aggressive timelines enabled by streamlined environmental reviews and 24/7 tunneling, standardized station designs and proven technology over architectural flourishes, and in-house engineering expertise with contracts evaluated 70% on quality/experience rather than lowest bid. The result was a system now ranking sixth-longest outside China, with higher per-capita ridership than London or NYC.
HN Discussion:
  • In-house engineering expertise is key advantage over consultant-driven projects
  • ~Article overstates engineer compensation; pay was actually poor
  • Article ignores geology as the primary cost factor in Madrid's success
  • Article omits political motivations and poor design choices in some expansions
  • Cost differences are mostly due to lower wages, not management practices
19.DeepSeek Introduces Vision(chat.deepseek.com)
488 points by RIshabh235 46 days ago | 199 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • Clarifies the feature is image understanding, not generation, and notes missing speech features
  • Wants this capability available via API for agent/coding workflows
  • Praises the model's quality, speed, and affordability
  • Frames the release as China successfully competing with US AI companies
  • Questions or complaints about DeepSeek's recent behavior and unclear landing page
20.Dutch Railways offers unlimited off-peak train travel nationwide for €49/month(ns.nl)
240 points by felipevb 48 days ago | 137 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ~Introductory price is misleading; real cost is much higher after promo period ends
  • Offer is weaker than Germany's Deutschlandticket which provides broader coverage
  • Skepticism toward Dutch government and broader societal problems undermine the rosy framing
  • The pass provides meaningful savings compared to standard single fares and existing subscriptions
  • Clarifying limitations: only NS trains, restricted hours, implemented as discount on existing product