Jun 18Friday, June 19, 2026 · all days
1.I found 10k GitHub repositories distributing Trojan malware(orchidfiles.com)
812 points by theorchid 1 day ago | 211 comments | permalink
tl;dr: A developer discovered that someone had cloned his GitHub repo, preserving all commits and contributors, but added a link to a zip archive containing a Trojan in the README. By analyzing GitHub event archives for repos updated frequently with only README changes containing zip links, he identified ~10,000 such malware-distributing repositories—about 25% of repos matching his pattern. GitHub only removed the repos he explicitly reported and has made no effort to detect the pattern themselves, despite the scheme running for over a year.
HN Discussion:
  • The attack targets AI coding agents that auto-add dependencies, explaining the timing and tactics
  • Personal confirmation: I've experienced the same malware cloning of my repos
  • GitHub broadly ignores malware and abuse reports across many categories, not just this one
  • Technical analysis identifying the specific trojan family involved in the samples
  • ~Concern about a more sophisticated future threat: LLM training-data poisoning rather than obvious zip links
2.Ubiquiti: Enterprise NAS, Built on ZFS(blog.ui.com)
346 points by ksec 21 hours ago | 298 comments | permalink
tl;dr: Ubiquiti's new ENAS is a ZFS-based enterprise NAS powered by an 8-core ARM Neoverse N2 CPU, 64GB ECC RAM, optional NVMe L2ARC caching, 16 drive bays (expandable past 1PB), and dual 25GbE SFP28 ports, with no drive-model firmware lock-in. It integrates with UniFi for license-free centralized management, identity-based access, multi-site backup orchestration (including M365), and supports native iSCSI shared block storage for Proxmox, VMware, and Hyper-V clusters.
HN Discussion:
  • Enthusiasm for ZFS adoption and Ubiquiti entering the NAS market
  • Appreciation for Ubiquiti's no-recurring-cost business model
  • Skepticism about Ubiquiti's software quality and security track record
  • Doubt that the hardware truly qualifies as 'enterprise' grade or can deliver promised performance
  • Pricing is too high compared to DIY alternatives like TrueNAS on used hardware
3.CS 6120: Advanced Compilers: The Self-Guided Online Course (2020)(cs.cornell.edu)
380 points by ibobev 1 day ago | 52 comments | permalink
tl;dr: Cornell's CS 6120, a PhD-level advanced compilers course taught by Adrian Sampson, is available as a free self-guided online course with video lectures, lecture notes, and open-ended implementation tasks using LLVM and Bril (a custom educational IR). The 14-lesson curriculum covers IRs, data flow, SSA, loop and interprocedural optimization, alias analysis, garbage collection, JITs, and parallelism, interleaved with classic PL research papers. The course is open source on GitHub, though self-guided students miss out on Zulip discussions, deadlines, and the end-of-semester project.
HN Discussion:
  • ~Trace compilation focus is outdated; other dynamic compilation concepts matter more
  • Course topics seem introductory rather than truly advanced
  • Simple appreciation and thanks for the free resource
  • Questions about prerequisites or comparisons to other compiler learning resources
  • Tangential curiosity about compiler-related people and technologies
4..gitignore Isn't the only way to ignore files in Git(nelson.cloud)
432 points by FergusArgyll 1 day ago | 134 comments | permalink
tl;dr: Git supports three levels of ignore files: the usual `.gitignore` (committed to the repo), `.git/info/exclude` (per-repo, not committed, useful for personal files), and `~/.config/git/ignore` (global, machine-wide, ideal for things like `.DS_Store`). The global file location can be customized via `git config --global core.excludesFile`, and `git check-ignore -v <file>` reveals which rule and file is causing a given path to be ignored.
HN Discussion:
  • Sharing additional personal workflows/tricks for ignoring files that complement the article
  • Surprise and gratitude at learning about the exclude/global ignore features
  • ~Article missed related useful features like .gitattributes for ignoring diffs
  • ~Clarifying or correcting article terminology, e.g. 'global' means per-user not machine-wide
  • Caution that per-user ignores like .DS_Store are better handled project-wide
5.Hospitals and universities repurposing drugs at lower cost(kcl.ac.uk)
314 points by giuliomagnifico 1 day ago | 142 comments | permalink
tl;dr: Hospitals and universities are running late-stage clinical trials to repurpose generic drugs at less than 10% of pharma industry costs, operating outside the patent system with lower expertise, risk, and capital barriers. Examples include using a cancer drug to treat blindness and an old anti-inflammatory for Covid. Pharma companies lose interest in repurposing once drugs go generic due to competition, but academic researchers step in, motivated by patient outcomes and publication rather than profit.
HN Discussion:
  • Concrete example of price disparity between repurposed and patented drugs reinforces the article's point
  • Nonprofit-funded drug repurposing is vital for rare diseases ignored by big pharma
  • Pharma exploits patent system by minor modifications to off-patent drugs, showing broken incentives
  • ~Regulatory pathway limitations prevent repurposing studies from leading to officially approved uses
  • ~Big Pharma's funding influence on academia and search makes spreading repurposing findings difficult
6.I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M(thatprivacyguy.com)
401 points by speckx 17 hours ago | 244 comments | permalink
tl;dr: In 2021, the author told Elkjop's DPO that requiring customer club membership as a condition for receiving marketing emails violated GDPR's "freely given consent" rule, but the company refused to change. Five years later, Norway's Datatilsynet fined Elkjop NOK 20M (~€1.8M) for exactly that violation, plus repurposing club data for ad tracking without a compatibility assessment. The author only learned of the outcome via a volunteer-run wiki, and is now pressuring the Swedish DPA over its Article 77(2) duty to keep complainants informed, while preparing civil litigation.
HN Discussion:
  • Praise for the author's persistence and concern about social costs of exercising rights
  • Provides supporting documentation and links to the official decision
  • Extends the argument to similar privacy violations in other contexts like hiring and education
  • ~Questions whether the same logic should invalidate all ad-supported business models
  • Praises Norway's DPA while acknowledging the communication failure noted by author
7.W Social, public institutions and the theater of European digital sovereignty(blog.elenarossini.com)
219 points by nemoniac 23 hours ago | 143 comments | permalink
tl;dr: The European Commission, ECB, and their presidents (von der Leyen and Lagarde) have migrated their ATproto accounts from Bluesky to W Social, a Swedish for-profit Bluesky fork that markets itself as Europe's sovereign alternative to X. Around the same time, W Social quietly removed its public GitHub repository, suggesting it has gone closed-source—contradicting the EU's recently announced open-source push and bypassing Eurosky, a transparent non-profit alternative. Critics note W Social's advisory board includes Big Tech figures tied to PayPal and Sam Altman's Tools for Humanity, raising concerns it's another surveillance-capitalism play dressed up as digital sovereignty.
HN Discussion:
  • W Social has been shady from the start, with weak verification claims and suspicious origins
  • Eurosky is the better transparent alternative being unjustly ignored by press and politicians
  • W Social is effectively an EU Truth Social for politicians wanting platform control
  • W Social's for-profit corporate structure makes it unlikely to succeed as sovereign infrastructure
  • ~European 'digital sovereignty' is just protectionism dressed up in strategic language
8.Show HN: Are You in the Weights?(intheweights.com)
356 points by turtlesoup 15 hours ago | 208 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • Models accurately recognized me and recall details about my work
  • ~Models hallucinated entirely fictional details about me
  • ~Mix of accurate identification alongside confident hallucinations
  • Reflects on training data being scraped without consent, making us immortal in weights
  • Amused by being confused with famous namesakes in the weights
9.Modos Color Monitor Pushes E-Paper Displays Further(spectrum.ieee.org)
288 points by Vinnl 1 day ago | 68 comments | permalink
tl;dr: Modos is crowdfunding the Flow, a 13.3-inch color e-paper monitor with 3200×2400 resolution, touch input, and 60Hz refresh, powered by their new open-source Enchanter display controller (which uses a Chrontel CH7516 chip to enable DisplayPort 1.1). Co-founders Wenting Zhang and Alexander Soto note pixel response is ~50ms (comparable to the first iPad's IPS panel), and emphasize minimizing input-to-display latency over raw refresh rates. They've stuck with crowdfunding over VC because the e-paper monitor market is too niche for investors but supports a hackable, open-source community.
HN Discussion:
  • Excitement about Modos as a major step forward in e-paper display technology
  • ~Concerns about how higher refresh rates affect panel longevity and energy efficiency
  • Enthusiasm for broader alternative display ecosystem and outdoor-readable devices
  • Skepticism or curiosity about practical use cases for a standalone e-ink monitor
  • Questions about specific product details like visible screen dimensions
10.Noam Shazeer Joins OpenAI(twitter.com)
332 points by lukasgross 1 day ago | 327 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • Background context on Shazeer's foundational work on the transformer architecture
  • Recap of Shazeer's career trajectory between Google, Character.AI, and now OpenAI
  • ~Speculation that financial incentives like pre-IPO stock motivated the move
  • ~Speculation that Gemini's underperformance led to his departure
  • This is a major win for OpenAI and a significant blow to Google's Gemini efforts
11.Midjourney Medical(midjourney.com)
1308 points by ricochet11 1 day ago | 849 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ~Technology is intriguing and worth exploring, but claims are overhyped or unsubstantiated
  • The vision of constant data-driven scanning is wrong; healthcare should focus on actual health outcomes
  • Routine full-body scans cause overdiagnosis and false positives, making the proposed use case harmful
  • The article naively misunderstands FDA regulatory processes and underestimates real-world barriers
  • The underlying USCT technology isn't novel and won't replace CT/MRI as claimed
12.Emacs 31 is around the corner: The changes I'm daily driving(rahuljuliato.com)
442 points by frou_dh 23 hours ago | 256 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • Longtime Emacs users affirm continued loyalty and productivity with the editor
  • Excitement about specific Emacs 31 improvements like tree-sitter and kill-region-dwim
  • ~Emacs configuration complexity remains a barrier, though LLMs/agents now help
  • Users feel out of touch and want a guide to catch up on modern Emacs
  • ~Will likely ignore new features and keep using Emacs the same old way
13.Swiss parliament lifts ban on new nuclear power plants(bluewin.ch)
759 points by leonidasrup 21 hours ago | 726 comments | permalink
tl;dr: Switzerland's National Council voted 100-98 to approve a counterproposal to the "Blackout Initiative," lifting the ban on building new nuclear power plants and aligning with prior decisions by the Federal Council and Council of States. The measure, opposed by the SP, GLP, and Greens, will ultimately go to a public referendum, with Greenpeace already protesting and the Greens signaling they may call one regardless.
HN Discussion:
  • ~Referendum will likely block this and discourse will be chaotic and uninformed
  • Nuclear is essential for energy security, safety record, and national sovereignty
  • Nuclear is too expensive and slow; renewables and hydro storage are better investments
  • SMRs and future fission innovation will make nuclear thrive
  • Nuclear lobby push ignores dirty mining realities and economic non-viability
14.Microsoft new Outlook takes 10 seconds to do what Outlook Classic does instantly(windowslatest.com)
671 points by Adam-Hincu 23 hours ago | 452 comments | permalink
tl;dr: Microsoft's new WebView2-based Outlook takes roughly 10 seconds to display an email when clicked from a Windows 11 notification, compared to nearly instant in Outlook Classic—and it's actually faster to ignore the notification and open the app manually. The new Outlook also runs as 10 separate processes and uses 4x the RAM of Classic, limitations inherent to its Chromium-based web wrapper architecture. A real fix likely requires a native WinUI rewrite; until then, Classic (supported until April 2029) remains the better choice for performance.
HN Discussion:
  • Switching to Linux is justified by Windows/Microsoft's declining performance
  • ~Web-based email clients can be fast; new Outlook is poorly engineered specifically
  • Microsoft has a long-standing cultural indifference to performance quality
  • Windows bloat extends beyond Outlook to basic apps like Notepad and Calculator
  • Native apps would solve this but web portability seduces developers into dependency hell
15.The founder of Craigslist has given away half a billion dollars(independent.co.uk)
371 points by Tomte 18 hours ago | 278 comments | permalink
tl;dr: Craigslist founder Craig Newmark has donated roughly $500 million to causes including journalism, cybersecurity, veterans, and pigeon rescue, and joined The Giving Pledge in 2025 after the program expanded beyond billionaires. He publicly pushed back against Peter Thiel and other tech billionaires who have discouraged wealthy peers from signing the pledge, claiming it funnels money to "left-wing" nonprofits. Newmark, who still doesn't own a car and takes the NYC subway, kept Craigslist free for users rather than take VC money, and credits childhood lessons from Holocaust survivors for his approach to wealth.
HN Discussion:
  • Admiration for Newmark's humble lifestyle and character
  • Criticism that Craigslist profits from scams and fails to moderate them
  • Newmark could have done more good by improving Craigslist itself
  • Praise for Craigslist's minimalist UI design reflecting Newmark's character
  • Curiosity or questions about Craigslist's economics and current relevance
16.A website that lists websites to submit your website to(submission.directory)
414 points by azeemkafridi 20 hours ago | 91 comments | permalink
tl;dr: A curated directory cataloging dozens of places to submit websites, startups, and products for backlinks and exposure—ranging from major platforms like Hacker News, Product Hunt, Crunchbase, and G2 to niche AI tool directories, indie web blogrolls, and design galleries. Each entry notes whether links are dofollow/nofollow, free vs. paid placement, and the target audience (developers, founders, buyers, design enthusiasts, etc.).
HN Discussion:
  • Sharing personal experience building similar product discovery/submission platforms
  • Offering additional curated lists of submission directories
  • Publicly listing submission sites encourages spam and low-quality drive-by posting
  • This is a recycled concept from the pre-search-engine era of the web
  • Submitting just for SEO backlinks is rude to the target communities
17.Lore – Open source version control system designed for scalability(lore.org)
1235 points by regnerba 1 day ago | 669 comments | permalink
tl;dr: Lore is an open-source version control system maintained by Epic Games, built for large-scale projects that mix code with hefty binary assets, such as games and entertainment productions. It targets both developers and artists, aiming to scale across massive datasets and team sizes.
HN Discussion:
  • Lore is a Perforce competitor for game dev, not a Git replacement for general code
  • Perforce is the aging incumbent that genuinely needs a challenger like this
  • Lore isn't really new, just a rebrand of Unreal Revision Control being open sourced
  • Many mature data versioning alternatives already exist, questioning the need for another
  • Claims of being fully open source are undermined by binary-only desktop client
18.How Madrid built its metro cheaply (2024)(worksinprogress.co)
214 points by trymas 1 day ago | 174 comments | permalink
tl;dr: Madrid tripled its metro length between 1995-2007 at roughly one-tenth the per-mile cost of London's Jubilee Line, driven by four factors: consolidated regional control that made politicians directly accountable for delivery, aggressive timelines enabled by streamlined environmental reviews and 24/7 tunneling, standardized station designs and proven technology over architectural flourishes, and in-house engineering expertise with contracts evaluated 70% on quality/experience rather than lowest bid. The result was a system now ranking sixth-longest outside China, with higher per-capita ridership than London or NYC.
HN Discussion:
  • In-house engineering expertise is key advantage over consultant-driven projects
  • ~Article overstates engineer compensation; pay was actually poor
  • Article ignores geology as the primary cost factor in Madrid's success
  • Article omits political motivations and poor design choices in some expansions
  • Cost differences are mostly due to lower wages, not management practices
19.DeepSeek Introduces Vision(chat.deepseek.com)
473 points by RIshabh235 1 day ago | 194 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • Clarifies the feature is image understanding, not generation, and notes missing speech features
  • Wants this capability available via API for agent/coding workflows
  • Praises the model's quality, speed, and affordability
  • Frames the release as China successfully competing with US AI companies
  • Questions or complaints about DeepSeek's recent behavior and unclear landing page
20.Dutch Railways offers unlimited off-peak train travel nationwide for €49/month(ns.nl)
228 points by felipevb 3 days ago | 118 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ~Introductory price is misleading; real cost is much higher after promo period ends
  • Offer is weaker than Germany's Deutschlandticket which provides broader coverage
  • Skepticism toward Dutch government and broader societal problems undermine the rosy framing
  • The pass provides meaningful savings compared to standard single fares and existing subscriptions
  • Clarifying limitations: only NS trains, restricted hours, implemented as discount on existing product