← Oct 23Saturday, October 24, 2026 · all daysOct 25 → · today »
1.Kimi K3.1 Pro and K3.1 Pro Highspeed(kimi.ai)
1079 points by Jowsey 2 days ago | 670 comments | permalink
tl;dr: Moonshot's Kimi K3.1 Pro is a new 3T-class open-weight model with a 1M-token context, posting competitive results against Claude Opus 5.5 and GPT-6 Astra on coding (65.7% on Terminal-Bench 4.0), 3D/CAD generation, and financial reasoning benchmarks. A "Highspeed" variant runs 2-3× faster, and the team deliberately stripped cyber-related data from training to cap offensive security capabilities before release. Available now via Kimi.ai and API, with full weights to be released by Nov 4, 2026.
HN Discussion:
  • ~Model has identity confusion and leaks system prompt artifacts during reasoning
  • ↑Stripping cybersecurity data is a smart alignment approach that's hard to reverse
  • ↓Questions the coherence and effectiveness of removing cybersecurity training data
  • ↑Benchmarks confirm it competes with or beats top US models at lower cost
  • ↑China's gap with US frontier AI has shrunk dramatically given Moonshot's small size
2.Today, we hacked what we'd set out to hack: the iPhone(blog.calif.io)
1101 points by pavel_lishin 2 days ago | 712 comments | permalink
tl;dr: Summary not available.
HN Discussion:
  • •Curious about defensive measures like Lockdown mode effectiveness against these exploits
  • ↑Admires the hacks and wishes for jailbreak capabilities to unlock iPhone functionality
  • ↑Notes a recurring pattern of iOS PDF parsing vulnerabilities
  • ↑Praises Calif as an exceptionally talented vulnerability research team
  • ↓Skeptical that attackers have an edge since Apple can use LLMs defensively too
3.Twelve years of distributed SQLite(philipotoole.com)
370 points by otoolep 1 day ago | 63 comments | permalink
tl;dr: The author of rqlite, which in 2014 pioneered combining SQLite with a Raft consensus log for replication, traces twelve years of the "distributed SQLite" category through projects like dqlite, Litestream, LiteFS, cr-sqlite, libSQL/Turso, and Cloudflare D1. He argues the design space settled into three corners—consensus (strong consistency clusters), streaming (cheap single-node recovery), and merge (CRDT-based eventual consistency)—each answering a different question. Open-source projects defined the category for eight years before venture-funded platforms monetized it, while rqlite remains the self-hosted, no-bill option.
HN Discussion:
  • ↑Users praise rqlite and its maintainer based on positive production experience
  • •Skepticism about reliability without Jepsen testing or production validation (e.g., D1 issues)
  • •Curiosity about whether a project combines all distributed SQLite features into one
  • •Sharing related personal projects building on similar consensus/replication ideas
  • ↓Criticism of the author for being too focused on claiming historical credit
4.Apple Music 404 Not Found(music.apple.com)
914 points by frizlab 2 days ago | 269 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ↑Discovered hidden easter egg (brick game) in the 404 page
  • ↑Nostalgic appreciation for the iPod click wheel interface
  • ↑Appreciates Apple showing a rare whimsical/playful side
  • •Speculates about resurgence of simple MP3 players amid digital detox trend
  • ↓Criticizes Safari auto-redirecting to Apple Music app, breaking the experience
5.Local Wikipedia: Wikipedia, but only for things a half hour walk from you(edjefferson.com)
1675 points by sohkamyung 2 days ago | 253 comments | permalink
tl;dr: Local Wikipedia filters Wikipedia to show only geocoded pages within a roughly 30-minute walk of your location, falling back to the nearest 25 entries within 6 miles if the area is sparse, and capping dense areas at 500. Location data stays in the browser and isn't included in shared links. The site is unaffiliated with Wikipedia.
HN Discussion:
  • ~Rural users find the tool less useful due to sparse Wikipedia coverage nearby
  • ~Distance should be configurable or use real walking isochrones instead of crow-flies radius
  • ↓The tool is just a wrapper around Wikipedia's existing nearby feature
  • ↑Delightful discovery tool that makes nearby articles feel more personally relevant
  • ↓Use of imperial units (yards) is inappropriate for European locations
6.Dessa: Conversation Model trained only on speech(block.xyz)
505 points by dsr12 2 days ago | 193 comments | permalink
tl;dr: Summary not available.
HN Discussion:
  • ~Voice sounds natural but lacks underlying intelligence or substance
  • ↑Impressive technical achievement running locally with minimal training hardware
  • ↓Full-duplex interruption behavior feels artificial and unconvincing
  • ↓Technology is primarily useful for impersonation and scams, raising security concerns
  • ↓AI girlfriend/companion use case is cringe-worthy and dystopian
7.Canadians are running out of time to oppose Bill C-22(eff.org)
489 points by hn_acker 2 days ago | 267 comments | permalink
tl;dr: Canada's Bill C-22 (Lawful Access Act) has passed the House of Commons and is now before the Senate, granting the government power to compel telecoms and messaging apps to assist with surveillance, mandate encryption backdoors (as long as they don't cause "systemic insecurity"), and retain user metadata for up to a year. The bill could also enable warrantless data-sharing with U.S. law enforcement without Canadian court oversight. The CCLA and Citizen Lab are calling for Part 2 of the bill to be withdrawn entirely, citing constitutional and cybersecurity concerns.
HN Discussion:
  • ↑Citizens should actively engage democratically by signing petitions and contacting MPs to oppose the bill
  • ↑Major messaging services will exit Canada if the bill passes as-is
  • ↑Similar laws elsewhere (India) have been abused for censorship and suppressing dissent, validating concerns
  • ~The bill is essentially already passed since the Senate rarely kills legislation, making opposition futile
  • ↑The bill uses deceptive weasel-word language that pretends to protect users while providing no real restrictions
8.The Real Kevin Bacon(pudding.cool)
368 points by xnx 5 days ago | 93 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ↑Suggests extending the analysis to find optimal pairs or groups of actors for maximum connectedness
  • ↓Points out prior art (Oracle of Bacon) using fuller data that reaches different conclusions
  • ↓Questions the methodology's predictions, noting Chloë Grace Moretz is semi-retired and unlikely to overtake Jackson
  • ↓Argues the article misses the point: Bacon was chosen because he's surprisingly connected, and the name rhymes with separation
  • ↑Reflects on interesting findings in the data, like John Candy's high ranking or Frank Welker's presence
9.WorldTUI: I trained a 360M model to pretend to be a terminal(simedw.com)
650 points by alphax314 3 days ago | 192 comments | permalink
tl;dr: A developer fine-tuned Qwen2.5-Coder-0.5B (shrunk to 360M params, quantized to int4/208MB) to simulate a terminal by predicting screen deltas from keypresses, with no actual shell or filesystem underneath. Key tricks included parallel per-row decoding with speculative verification for speed, and DAgger-style self-correction training to prevent compounding errors; the result can run vim, tmux, snake, and Python in-browser via WebGPU, and even remembers file contents written in earlier commands. It's not practically useful, but demonstrates that a small model can maintain a surprisingly consistent "world" without encoding any underlying rules.
HN Discussion:
  • ↑Author engagement and appreciation for the technical achievement of fine-tuning a small model
  • ↑This exemplifies the broader concept of 'Neural Computers' where UI is entirely generative
  • ↑Project raises interesting philosophical questions about prediction versus actual intelligence
  • •Sharing similar related projects for comparison (lossy git, vibeSH, ChatGPT-as-terminal)
  • •Technical/practical notes like WebGPU support in Firefox and surprise at memory improvements from fine-tuning
10.Docker is weird(codeandcake.dev)
864 points by psxuaw 2 days ago | 365 comments | permalink
tl;dr: Containers aren't a single Linux feature but a combination of five (namespaces, cgroups, networking, chroot/pivot_root, etc.), and images are essentially just folders that Docker chroots into. Go is a surprisingly awkward choice for runc since many container-related syscalls require a single-threaded context, forcing runc to use a C module before Go's runtime starts and to re-exec /proc/self/exe to fake fork. Docker also traditionally requires root, and rootless setups must reimplement networking in userspace.
HN Discussion:
  • ~Docker's real innovation was Dockerfiles and the registry, not the container tech itself
  • ↑Appreciates the article for demystifying containers by breaking down their building blocks
  • ↑Confirms the article's technical claim that runc's core is actually C, not Go
  • ↓Nothing described is weird; it all makes sense given historical evolution
  • ↑Docker carries legacy cruft; simpler rootless alternatives like Podman are preferable now
11.How does Fable 5.1 hide messages in images?(lesswrong.com)
213 points by gmays 3 days ago | 73 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ↓The encoding shown is trivial; models could use far more sophisticated steganography techniques
  • ↓This feels performative and doesn't reveal anything meaningful about adversarial AI scenarios
  • ↑Fable's approach is actually a generalizable medium-agnostic encoding framework worth appreciating
  • ~The concept is fun and pleasing but needs refinement for human decodability
  • •The more interesting question is how to erase or defeat such hidden encodings
12.Ask HN: If the models are so good, why doesn't OpenAI just start 100 companies?
645 points by ex-aws-dude 3 days ago | 733 comments | permalink
tl;dr: The post questions why frontier AI labs like OpenAI and Anthropic focus on selling tokens rather than building their own products on top of their models, especially as token prices decline and commoditize. The author suggests the application layer may be where the real money is, not the model utility layer.
HN Discussion:
  • ↓AI provides intelligence but companies need relationships, agency, and execution beyond what models offer
  • ~OpenAI is already building products but needs token revenue now due to capital constraints
  • ↑AI labs have already disrupted many industries and are moving up the stack cautiously
  • ~Automating everything destroys the value they'd capture, making the application play economically self-defeating
  • ↓LLMs have fundamental limitations (context management, agency, can't replace programmers) preventing autonomous company-building
13.Every AI model has the same "controversial" take on humans(modelcompare.ai)
647 points by rakannimer 3 days ago | 623 comments | permalink
tl;dr: When 13 AI models from 10 labs were each asked three times for their most controversial take on humans, 32 of 38 answers converged on the same idea: humans prioritize tribal belonging and social status over truth, and rationalize beliefs after the fact. Image models, by contrast, converged on a different cliché—humans as phone-addicted consumers destroying the planet. The author concludes that because models train on overlapping data, they collapse toward the same answers, limiting their usefulness for brainstorming diverse ideas.
HN Discussion:
  • ↑Models produce median/mashup outputs from training data, confirming convergence is expected
  • ↓The data doesn't actually support the article's conclusion about convergence
  • ↑Ironic that models converged on an opinion criticizing human conformity
  • ~Asking LLMs for opinions is pointless since they're just probabilistic pattern reproducers
  • •Personal anecdotes/philosophical musings on human nature itself
14.The foolishness of "natural language programming" (1978)(cs.utexas.edu)
377 points by xiaoyu2006 2 days ago | 267 comments | permalink
tl;dr: Dijkstra argues that programming in natural language is a misguided goal, because the perceived "burden" of formal symbolism is actually its chief virtue: it rules out nonsense and ambiguity that natural language invites. He points to the history of mathematics, which only advanced once it escaped verbal reasoning for formal notation, and suggests natural-language programming would simply force us to reinvent formal systems anyway. He closes by noting that such machines would likely be as hard to build as they would be to use.
HN Discussion:
  • ↑Dijkstra's essay has aged well; LLM agents still produce code in formal languages, validating his argument
  • ↑Natural language is inherently unstable, ambiguous, and culturally loaded, making it unfit for programming
  • ↓Formalism is just gatekeeping jargon; AI-driven natural language coding is a liberating step forward
  • ~Natural language works for communicating with intelligent entities who fill gaps, unlike purely mechanical systems
  • ↑AI-generated code only seems good because vague understanding masks its flaws
15.OpenShell – A safe, private runtime for fleets of autonomous AI agents(github.com)
499 points by niemandhier 3 days ago | 217 comments | permalink
tl;dr: OpenShell is an NVIDIA-developed runtime that sandboxes autonomous AI agents, using kernel-level enforcement to control file access, syscalls, and network connections, while injecting credentials only for approved endpoints. Policy changes are checked via formal verification to flag risky new access (e.g., new hosts or API methods) before approval. It ships with a CLI, gateway, Kubernetes/Helm deployment, SDKs for Python/TypeScript/Go/Rust, and runs on Linux, macOS (Apple Silicon), or WSL 2.
HN Discussion:
  • ↑Addresses collective agent permissions and collusion risks beyond individual sandboxing
  • ~Mentions existing alternative tools solving similar network/credential problems
  • ↓Skeptical that you can give agents broad capability while maintaining true security
  • ↑Containerizing agents is essential and this tool helps manage that
  • ↑Formal verification and security-by-construction is the only viable path forward
16.Show HN: OnKey – I'm a bad singer, so I built an app to show where I'm off-key(github.com)
229 points by dsmurrell 3 days ago | 91 comments | permalink
tl;dr: OnKey is a free, open-source singing trainer for Apple Silicon Macs that listens to music playing in Spotify, Apple Music, or YouTube and overlays your pitch against the vocal melody in real time. On first play it learns the song locally (using CREPE, GAME, wav2vec 2.0, and MDX-Net for vocal separation and pitch tracking), then scores subsequent attempts line by line. Audio is processed in-memory with no accounts, analytics, or music storage—only Shazam signatures and lyric metadata are sent out, and both can be disabled.
HN Discussion:
  • ~Caution that visual tools can create dependency and detract from essential self-listening skills
  • ↑Enthusiasm for the concept, excited to try it or share with family
  • ↑Appreciation from fellow builders who tried similar projects and recognize the achievement
  • ~Singing involves much more than pitch accuracy, so the tool addresses only a small aspect
  • •Questions and clarifications about privacy, terminology, or suggested features like gamification
17.Jailbreaking the Switch 2(pepsipu.com)
827 points by ledoge 3 days ago | 305 comments | permalink
tl;dr: ns2jb is the first software-only tethered jailbreak for the Switch 2 (firmware 23.0.1), achieving arbitrary native code execution as any ordinary sysmodule and the built-in fs sysmodule. The author bypassed WebKit's mitigations (PAC, CFI, XOM) by instead exploiting an integer overflow in the Switch 1 game SmileBASIC for initial ROP, then used a path-normalization buffer overflow in fs to gain arbitrary R/W, and finally abused the loader's signature-check flow to run arbitrary code under any sysmodule's permissions. Codex (AI) assisted with exploit development, and a Mario Kart World mod was built as a demo.
HN Discussion:
  • ↑Awe at the implications for game dumping and cross-platform play via decomp projects
  • ↑Admiration for the clever physical automation setup (SwitchBot, JetKVM) enabling LLM-driven hacking
  • •Confusion/frustration that Codex refused similar security research for them, questioning how the author bypassed restrictions
  • ↑Nintendo deserves this backlash due to anti-consumer practices like game keycards and litigiousness
  • ↑Manufacturers should be legally required to enable jailbreaking after a period to prevent device bricking
18.Run full iOS 16.5 firmware on Android Devices(github.com)
529 points by aghuang 3 days ago | 194 comments | permalink
tl;dr: HackiOS boots Apple's open-source XNU kernel (iOS 16.5) on a POCO X5 Pro 5G and in QEMU, running an unmodified iOS user space (launchd, SpringBoard, stock apps) via a custom EFI loader, driver replacements, and a Linux Wi-Fi compatibility layer. Working features include the lock screen, touchscreen, Wi-Fi, GPU via Mesa/freedreno, sound, and camera; cellular, Bluetooth, Metal, and App Store sign-in don't work yet. It's a RAM-only research bench (no flashing, reboots back to Android), with no Apple files shipped — the IPSW is fetched from Apple's CDN at build time.
HN Discussion:
  • ↑Impressive technical achievement, though website presentation is poor
  • ~Concerned this enables counterfeit iPhone scams and fake devices
  • ↓Questions the value of running iOS on Android when the reverse would be more desirable
  • ↑Predicts this project will become huge with AI agents accelerating development
  • •Curious technical questions about implementation details like version choice
19.Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry
733 points by petecooper 3 days ago | 264 comments | permalink
tl;dr: The author publicly posted about upcoming PHP RCE vulnerabilities (CVE-2026-109618 & CVE-2026-109619), unknowingly breaking the coordinated disclosure embargo and disrupting the release schedule. They claim their contact had assured them no embargo existed, and their intent was simply to alert fellow source-compilers about the urgency of the upcoming updates. They are apologizing and taking responsibility for the unintended consequences.
HN Discussion:
  • ↓You cannot break an embargo you were never informed about or party to
  • ↓The failure lies upstream in the disclosure chain, not with the author
  • ↓Taking blame obscures the real process failure and harms blameless post-mortem culture
  • ~The phrase 'take full responsibility' is meaningless without concrete consequences
  • ↓The vulnerability was already leaked and exploited before the author's post anyway
20.Getting ready to operate GNU Taler in Germany(taler.net)
360 points by dewey 3 days ago | 175 comments | permalink
tl;dr: Taler Operations AG is being founded in Bochum to operate the GNU Taler payment system in Euros, after GLS Bank withdrew from its originally planned role as e-money issuer in January 2026. The new company, a subsidiary of Taler Systems SA, will apply to German regulator BaFin for an e-money license and is raising capital from investors (minimum €50,000) to fund the launch. GNU Taler itself remains free software; only the operating service is licensed.
HN Discussion:
  • ~Taler is technically superior but will lose to Digital Euro or established competitors like Wero
  • ↑Europe needs sovereign payment solutions and Taler is a welcome effort to support
  • ↓Privacy claims are illusory and will be undermined by KYC regulation at key junctions
  • ↓The technical design (expiring tokens, always-online requirement) is impractical and off-putting
  • ↓Skeptical of market viability since customers, merchants, and authorities lack strong incentives to adopt it