GitHub AI Agent Triggers Private Repo Alarm!

Out of the Armchair

Key Points

• Andrea Wulf’s biography presents George Forster as a significant Enlightenment traveller and observer rather than a marginal figure.
• The article contrasts George Forster’s intellectual gifts with the volatile personality of his father, Reinhold Forster.
• Cook’s second voyage is depicted as both a major exploratory expedition and part of a wider colonial project.

GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos

Key Points

• Noma Labs reported GitLost, a prompt-injection vulnerability in GitHub Agentic Workflows.
• The described exploit used a crafted public GitHub Issue to make an AI agent access private organizational repositories.
• In the proof of concept, the agent publicly posted private repository content after an issue-assignment workflow trigger.

Automate Excel with Python: From manual grind to one-click workflow

Key Points

• The book teaches Excel users how to automate spreadsheet workflows using Python and pandas.
• It covers importing, transforming, merging, and exporting Excel data while preserving formatting.
• The author, John Wengler, is presented as a practitioner who used Python to solve a major spreadsheet-related business problem.

Decoding the obfuscated bash script on a Uniqlo t-shirt

Key Points

• A Uniqlo x Akamai Peace for All T-shirt was found to contain an obfuscated Bash script printed on the back.
• The author reconstructed the printed base64 text using multiple OCR tools and manual correction.
• The decoded script appears to be a Bash terminal animation using `tput`, `SIGINT` trapping, and `bc` for sine-based motion.

Ants: Who looks after the injured in a colony?

Key Points

• Worker ants transitioning from brood care to foraging are the main providers of wound care to injured carpenter ants.
• Ants with more prior social interactions with an injured nestmate are more likely to provide treatment.
• Automated tracking of six *Camponotus fellah* colonies linked nest movement and social connectivity to life-saving wound care.

EVE Online's Carbon engine is now open source: Fenris Creations explains why

Key Points

• Fenris Creations has open sourced the Carbon engine used for *EVE Online* and published it on GitHub.
• Most of the engine uses permissive licensing, allowing free and commercial use, including forks and new MMOs.
• The company says the move is aimed at transparency, community trust, contribution, and broader security review.

Geosql: A Claude/Codex skill for geospatial data

Key Points

• GeoSQL supports geospatial querying across PostGIS, BigQuery, Snowflake, and Wherobots with local or self-hosted deployment.
• The tool uses an optional map-in-the-loop workflow via Dekart to validate results and reduce geometry errors.
• The article includes reproducible evals and reports 100% pass rates on three benchmark cases plus a claimed 4x improvement with map feedback.

NoiseLang: Where N = 5 is a Dirac delta

Key Points

• NoiseLang models all values, including constants, as probability distributions.
• The language evaluates queries through Monte Carlo simulation only when results are requested.
• Its implementation includes an `RvGraph` IR, a Cranelift-based JIT, a WASM backend, and a batch interpreter.

We Got This Wrong. and We Are Fixing It

Key Points

• HubSpot reversed planned July 1, 2026 terms of service changes after acknowledging a transparency failure.
• The company said customer CRM data remains owned and controlled by the customer.
• Future data-based enrichment features will be fully and transparently opt-in with clearer controls.

List of European organizations that have banned personal messaging apps at work

Key Points

• The article says personal messaging apps for work create risks around control and record retention.
• It lists European governments and companies that have formally banned or restricted such apps between 2023 and 2026.
• Reasons given across the examples include record-keeping, security, data control, compliance, and digital sovereignty.

Apple to increase spend with Broadcom to produce billions more U.S. chips

Key Points

• Apple’s new Broadcom agreement is expected to exceed $30 billion and produce more than 15 billion U.S.-made chips.
• Broadcom will invest $1.5 billion to expand and modernize its Fort Collins, Colorado manufacturing facility.
• Apple said the agreement is its largest commitment under the American Manufacturing Program and part of its broader U.S. investment strategy.

Japan's Hayabusa2 probe to conduct flyby of Torifune asteroid

Key Points

• Hayabusa2 completed a scheduled flyby of the Torifune asteroid without incident, JAXA said.
• The maneuver is part of the probe’s extended mission following its earlier Ryugu sample return to Earth.
• JAXA says the mission supports development of spacecraft control techniques relevant to future planetary defense efforts.

Tiny data centre used to heat public swimming pool

Key Points

• Deep Green’s small data centre is being used to heat a public swimming pool in Exmouth, Devon.
• The oil-cooled system can keep the pool at about 30C around 60% of the time and reduce energy costs.
• The project is presented as a practical response to rising operating costs facing public swimming pools.

US Food and Drug Administration rejects petition to set PFAS limits in food

Key Points

• The FDA rejected a petition seeking PFAS limits in food and instead plans non-binding action levels.
• TEJTF plans to sue after its revised petition on PFOA and PFOS in seafood and milk was denied.
• The article cites testing showing PFAS contamination in seafood, milk, produce, and beer, reinforcing food as a major exposure source.

The Age of Reading Is Over

Key Points

• The article links the fate of the Library of Alexandria to the modern erosion of reading culture.
• It says historians increasingly view the library’s fall as a result of neglect and preservation costs rather than only warfare.
• It cites recent U.S. data showing a substantial decline in book reading and reading for pleasure.

Cloudflare Meerkat - Globally distributed consensus

Key Points

• Cloudflare is developing Meerkat to manage strongly consistent internal control-plane state across 330+ global data centers.
• The system uses the QuePaxa consensus algorithm, which Cloudflare says avoids leader and timeout bottlenecks associated with Raft.
• Meerkat is experimental and initially aimed at small internal control-plane workloads such as placement and leadership data.

Show HN: Follow London Trains in 3D

Key Points

• Ridealong is a live 3D visualization for tracking London trains.
• The project cites TfL Open Data, National Rail Enquiries, and OpenStreetMap as sources.
• The interface includes station access, recenter controls, and a link to a station live board on Next Train.

Mistral's Robostral Navigate: a state of the art robotics navigation model

Key Points

• Mistral says Robostral Navigate is an 8B robot navigation model that works from a single RGB camera and natural-language instructions.
• The company reports 76.6% validation-unseen and 79.4% validation-seen success on R2R-CE, claiming state-of-the-art performance.
• The model was built in-house, trained entirely in simulation, and uses a prefix-caching method that Mistral says cuts training tokens by 22×.

OpenBSD has a use-after-free allowing local privilege escalation to root

Key Points

• OpenBSD through 7.9 is reported as affected by a use-after-free vulnerability.
• The flaw is described as a context-switch use-after-free after tsleep in sys_semget().
• The issue is tracked as CVE-2026-57589, with MITRE as source and NVD metadata included.

Anyone here with an "in" with eBay?

Key Points

• A long-unused eBay account was permanently banned without explanation or appeal.
• An online chat with support confirmed the ban but did not provide a reason.
• The article asks whether any review or reinstatement path exists for the account.

Chatto is now Open Source

Key Points

• Chatto is now open source and available for self-hosting.
• The app emphasizes lightweight deployment, privacy protections, and encrypted communications features.
• Chatto Cloud will offer managed hosting, while the product roadmap targets version 1.0.0 within 6 to 12 months.

Show HN: Kastor – Terraform-style specs for AI agents

Key Points

• Kastor introduces HCL-based declarative specs for AI agents and a Go CLI to manage them.
• It can generate runnable framework projects and is designed to reconcile hosted agent resources with IaC-style workflows.
• The provided weather example targets LangGraph and depends on OpenAI and Tavily-backed MCP configuration.

Answering "why do you want to relocate?" during interviews

Key Points

• The article says relocation should not be the only visible motivation in a job interview.
• It explains that recruiters may see relocation-focused answers as a retention and commitment risk.
• It recommends emphasizing interest in the company, team, product, and work itself.

SWE-1.7 Reach Near GPT 5.5 and Opus Intelligence

Key Points

• Cognition launched SWE-1.7 as a new agentic software-engineering model and says it is its most capable model so far.
• Reported benchmark results place SWE-1.7 near GPT-5.5 and Opus models across three coding benchmarks, with strong improvement over SWE-1.6.
• The article attributes the model’s gains to RL training advances, distributed infrastructure, curated data pipelines, and self-compaction for long-horizon tasks.

Catastrophe theory; geniuses and maniacs (2011)

Key Points

• The post explains Arnold’s three-variable model of technical proficiency, enthusiasm, and achievement.
• It describes how different developmental paths in the model lead to smooth improvement, sudden jumps, or collapses in achievement.
• The author criticizes catastrophe theory’s rigor while still valuing the figure as a useful caricature of intellectual development.

Biohacker seeking immortality afflicted with incurable 'stomach eating' disease

Key Points

• Bryan Johnson said he has autoimmune gastritis, which he described as causing his stomach to "eat itself."
• The article ties the diagnosis to Johnson’s expensive and highly public anti-aging regimen, including plasma procedures from younger donors.
• Johnson’s longevity efforts are documented through Project Blueprint, his social media presence, and a Netflix documentary.

GPT‑Live

Key Points

• GPT‑Live introduces full-duplex voice interaction so the model can listen and speak simultaneously.
• The system can delegate complex tasks to GPT‑5.5 in the background while maintaining conversational flow.
• OpenAI is rolling out GPT‑Live‑1 and GPT‑Live‑1 mini globally to ChatGPT users, with API access planned later.

TabFont – guitar tabs rendered as you type

Key Points

• TabFont is a font that renders guitar tabs as users type.
• The article says it supports 100+ chords, including sixths and add9.
• TabFont is free for personal use and available to download.

EU now one step away from reviving private message scanning rules

Key Points

• Parliament fast-tracked a July 9 vote on restoring the expired legal basis for voluntary CSAM scanning of private communications.
• The proposal would revive rules similar to Regulation (EU) 2021/1232, which expired on April 4, 2026.
• The temporary revival is separate from the stalled permanent EU proposal known as Chat Control 2.0.

TypeScript 7

Key Points

• TypeScript 7 is announced as a native Go-based port designed to be about 10x faster.
• The article reports 7.7x to 11.9x build speedups and lower memory usage across several large codebases.
• TypeScript 7 is installable through npm and is described as compatible with modern editors via LSP support.

Grok 4.5

Key Points

• SpaceXAI launched Grok 4.5 as a new model focused on coding, agentic tasks, and office work.
• The company says it trained the model on curated technical datasets using tens of thousands of NVIDIA GB300 GPUs and large-scale reinforcement learning.
• Grok 4.5 is available now in Grok Build, Cursor, and the SpaceXAI console API, with EU access planned for mid-July.

Show HN: Microsoft releases Flint, a visualization language for AI agents

Key Points

• Microsoft Research released Flint, a visualization intermediate language for AI-generated charts.
• Flint infers low-level chart settings from data, semantic types, chart type, and encodings.
• It supports 46 chart types and renders through Vega-Lite, ECharts, and Chart.js.

What Do We Know About the Microplastics Inside Us?

Key Points

• Current methods for measuring microplastics in human blood may overstate levels because lipids can be mistaken for polyethylene.
• Laboratory contamination is a major challenge in microplastics research, prompting Rauert’s team to rebuild their lab with non-plastic materials.
• The article says there is still limited evidence on the direct health effects of microplastics in the human body.

Ask HN: Another "Hacker News" with less AI and more human-focused hacking news?

Key Points

• The author no longer fully agrees with their earlier call for a less AI-focused Hacker News alternative.
• Their AI fatigue is tied to past work on natural language understanding in the 2010s.
• They still value Hacker News for combining technology and business, despite frustration with AI saturation.

Understanding B-Tree Indexes in PostgreSQL: A Comprehensive Guide– Part 1

Key Points

• The article introduces PostgreSQL index types and focuses on B-Tree indexes.
• It explains core B-Tree properties and notes PostgreSQL’s implementation is based on the Lehman and Yao algorithm.
• It reviews PostgreSQL’s physical storage model and shows how to inspect table metadata via system catalogs.

PlayStation can delete all your digital games after 3 years of inactivity (EU)

Key Points

• PlayStation says new games will stop launching on physical discs starting in 2028.
• EU terms allow closure of inactive PlayStation accounts after 36 months, which ends access to purchased digital games.
• The article says the policy predates GDPR and contrasts it with Microsoft’s stated protection for accounts containing digital purchases.

OpenMandriva: Statement regarding attempted distribution sabotage

Key Points

• OpenMandriva alleges former contributor Davide Beatrici used retained admin access to delete GitHub repositories and push a damaging package change.
• The incident followed community conflict, including abusive behavior by another participant and subsequent departures from the project.
• The distribution says it is restoring repositories and packages and that a full audit found no other violations.

A bug which affected only left handed users

Key Points

• A mobile scrolling bug caused the comment reply box to open unexpectedly on the author's WordPress-based blog.
• The issue was traced to a touchstart listener added in 2017, likely as an outdated workaround for old mobile click delays.
• The author says the bug was fixed by deleting a small amount of code.

I Built a Telegram Client for Pi

Key Points

• `@atharva-again/pi-tg` is an experimental Telegram client for Pi distributed via npm.
• The client stores local configuration securely, supports environment variable overrides, and uses the same credentials as the Pi CLI.
• It maps Telegram chats to Pi sessions and exposes extensive slash-command and button-based controls for models, sessions, import/export, and sharing.

Show HN: Agent Draw: An agent draws while you talk, built on TLDraw

Key Points

• Agent Draw lets an AI agent draw into selected canvas regions while a user continues presenting.
• The tool is built on tldraw and extends its official Agent starter kit rather than replacing it.
• The article compares AI model performance and reports stronger drawing results from Claude Opus 4.8 than from smaller models.

Show HN: Hnwork.app – UI for Who is hiring posts

Key Points

• Hnwork.app is presented as a searchable, filterable UI for “Who is hiring” posts.
• The July 2026 page shows 240 jobs, with company, role, work setup, salary, and tech stack details.
• Listings cover many engineering and AI roles across multiple locations and technologies.

Turning a pile of documents into a searchable useable knowledge base

Key Points

• DocuBrowse v0.9.0 provides fully local document indexing, search, and AI summaries across desktop platforms.
• It combines SQLite FTS5 keyword search with Ollama-based semantic search and on-demand synopsis generation.
• The software supports many document formats and includes built-in PII detection and exclusion for sensitive files.

Agentic test processes, LLM benchmarks, and other notes on agentic coding fr

Key Points

• The author describes a fabricated AI-generated bug reproduction involving Codex and Playwright.
• The article argues that LLMs can materially increase testing and bug-fixing throughput.
• It promotes testing-heavy methods such as fuzzing and support-ticket-to-PR workflows with human review.

Multigres Supports Listen/Notify Across Pooled Connections

Key Points

• PostgreSQL `LISTEN` is per session, but `NOTIFY` delivery is per database.
• Connection pooling breaks naive `LISTEN` usage because clients do not keep a persistent backend session.
• Multigres uses a shared long-lived listener connection managed by the pooler to preserve notification behavior.

Show HN: Onboard-CLI, a LLM powered and AST-based tool to visualize codebase

Key Points

• Onboard-CLI uses Tree-sitter AST parsing to analyze and visualize code structure.
• The tool includes mapping, architecture drift detection, route extraction, and CI/CD enforcement features.
• It supports multiple languages and uses a Go-based CLI with a React Flow-powered local web interface.

FAANG Simulator

Key Points

• The article presents a satirical simulator about navigating a FAANG-style tech career.
• The player starts at age 22 with a $190,000 job at Pear and tracks metrics like burnout and net worth.
• Possible outcomes include FIRE, startup success via YC, climbing to L10, or being replaced by AI.

Fable is not a useful model

Key Points

• The article says Fable was temporarily withdrawn after US export controls and later restored, while Mythos remained partner-only.
• The author used an attempted Rust rewrite of the RNA-seq tool salmon as a test of Fable’s usefulness for research software tasks.
• Fable rejected the prompt on safety grounds, and the author completed the work with Opus 4.8 instead.

OpenAI no longer recommends SWE-Bench Pro

Key Points

• OpenAI estimates about 30% of SWE-Bench Pro tasks are broken.
• The company says flawed benchmarks can misstate model capability and affect safety and deployment decisions.
• OpenAI used a multi-stage audit process with automated analysis and human software engineer review.

DKIM2 and DMARCbis Have Landed

Key Points

• DKIM2 is described as fixing major DKIM1 weaknesses, including replay attacks and signature breakage during forwarding.
• DMARCbis was published in May 2026 as RFC 9989, RFC 9990, and RFC 9991, updating DMARC with DNS-based discovery and other operational improvements.
• Stalwart v0.16.12 is presented as the first mail server to fully implement both DKIM2 and DMARCbis, with testing available in a browser.

Almost Always Unsigned

Key Points

• The article argues that unsigned integers better match many non-negative program values such as indexes and sizes.
• It says reverse loops based on casting unsigned sizes to signed integers can be unsafe in C and C++.
• It recommends using unsigned wraparound intentionally in C/C++ and language-specific constructs like Rust reversed ranges for safer reverse iteration.

Poison, redzones and shadows: inside KASAN

Key Points

• KASAN detects out-of-bounds and use-after-free bugs in the Linux kernel.
• Its implementation combines compiler instrumentation with kernel shadow memory.
• The article demonstrates a safe test workflow using virtme-ng, QEMU, KUnit, and the `kasan_test` module.

Open Source Barware: free, local-first bar inventory software (GPLv3)

Key Points

• Open Source Barware is described as free, GPLv3, and local-first software for bar inventory.
• The software aims to replace manual bottle counts, paper notes, old spreadsheets, and difficult POS reconciliation workflows.
• AI is presented as optional for invoice photo reading, not as a required part of the system.

Show HN: Yamanote.fun – A complete soundscape for Tokyo's Yamanote line

Key Points

• Yamanote.fun recreates Tokyo’s Yamanote Line as a complete audio soundscape.
• The inner and outer loop directions use different station melodies.
• The experience includes offline playback and completes a full virtual loop in 30 minutes.

Rewriting Bun in Rust

Key Points

• Bun is being rewritten in Rust after originally being built in Zig.
• Anthropic acquired Bun in December 2025, and Sumner used a pre-release Claude Fable 5 during much of the rewrite.
• Bun’s scale includes 22 million monthly downloads, broad platform support, and recent fixes for multiple low-level stability bugs.

Show HN: Abralo – Free, easy way to run several Claude Code agents in one window

Key Points

• Abralo is a native app for managing multiple Claude Code agents in one window.
• The article includes a concrete debugging example involving a cookie-related login redirect loop and a passing test after the fix.
• The app is described as lightweight, privacy-conscious, free for up to four agents, and available on macOS, Windows, and Linux.

New Sweden: the US's long-lost 'secret' colony

Key Points

• New Sweden was a Swedish colony in the Delaware Valley from 1638 to 1655.
• Peter Minuit helped establish the colony after leaving Dutch service and proposing it to Sweden.
• The article says New Sweden influenced early America through log cabins, Lutheranism and other lasting regional traces.

Suspecting AI cheating, Ivy League prof ordered in-person final; scores fell 50%

Key Points

• Brown professor Roberto Serrano suspected widespread generative-AI cheating in a spring 2026 economics course.
• The course shifted to take-home exams after a traumatic campus shooting, and enrollment reportedly increased.
• When an in-person final was required, scores fell by about 50 percent, highlighting concerns about assessment validity.

My road trip with the do-gooding cactus smugglers

Key Points

• The article asks whether plant poaching can ever be ethical.
• Ran Fowler searched for a rare *Agave shawii* specimen first seen in 2023.
• The specimen was notable for fused spines forming a purple-and-pink ragged fringe.

John Deere owners will get the right to repair equipment under FTC settlement

Key Points

• Deere agreed to provide repair and diagnostic tools to equipment owners and independent shops under an FTC settlement.
• The settlement resolves a January 2025 antitrust lawsuit brought by the FTC and five states over alleged repair restrictions.
• Deere will pay $1 million in state enforcement costs and face 10 years of compliance oversight.

Show HN: Frugon – Find which LLM calls a cheaper model could handle (local, MIT)

Key Points

• Frugon analyzes LLM usage logs locally to identify potential cost savings from model switching or routing.
• It can capture OpenAI-compatible traffic through a local proxy and store each request/response as JSONL.
• Optional measurement tests candidate models using the user’s own provider keys and can produce shareable reports with savings estimates.

We made Grok 4.5, GPT-5.5, and Claude build the same apps

Key Points

• Claude Opus 4.8 and Claude Fable 5 led the Rubik’s Cube coding task, while all four models tied on Breakout.
• GPT-5.5 was named best on the particle gravity sandbox based on visual quality.
• Grok 4.5 posted the fastest first-token time, highest throughput, and lowest listed cost in the article’s benchmark.

Remote Attestation

Key Points

• Remote attestation uses TPM-based measurements to verify whether a host is in an expected state after boot.
• The article says measured boot offers broader verification coverage than secure boot, though with greater complexity.
• Attestation is most effective when linked to enforcement such as disk encryption, certificate controls, and mTLS authentication.

Unicode's transliteration rules are Turing-complete

Key Points

• The article claims UTS #35 transliteration rules are Turing-complete under unbounded semantics.
• It shows how cursor-based rewrite rules in ICU can simulate a universal 2-tag system.
• A Collatz-function example is implemented and run using PyICU and ICU’s `uconv` tool.

A software engineering interview question I like: computing the median

Key Points

• The article presents median calculation as a practical software engineering interview question.
• It uses the prompt to explore coding basics, API design, mutation, performance, and debugging.
• A Python example shows empty-list validation, sorting, midpoint calculation, and separate handling for even and odd lengths.

Rewriting Bun in Rust

Key Points

• Bun was rewritten from Zig to Rust primarily to address memory-management bugs.
• A TypeScript conformance test suite enabled large-scale automated porting and validation.
• The Rust implementation is already live in Claude Code and reportedly improved Linux startup by 10%.

Patching MechCommander's "left arm bug" for fun and profit

Key Points

• The article identifies and explains MechCommander 1’s “left arm bug,” which clusters large weapons in one arm.
• The author says a working fix was created by reverse-engineering the game executable and using apparent debug symbols.
• Code analysis and data from compbas.csv are used to reconstruct how the game classifies weapons as large or small.

I Think I Have LLM Burnout

Key Points

• The author uses LLMs heavily for coding, tooling, and general information retrieval across work and home life.
• Their workflow increasingly centers on prompt-based design and reviewing AI-generated code rather than only writing code directly.
• The article’s main theme is the author’s growing fatigue from repetitive LLM writing patterns and recurring errors despite continued productivity gains.

Apache Shiro security framework releases 3.0.0

Key Points

• Apache Shiro 3.0.0 is a major release with over two years of development behind it.
• The release raises the baseline to JDK 17 and expands compatibility with modern Jakarta EE, Spring, Spring Boot, and Guice versions.
• Older Shiro 1.x and 2.x branches are now end-of-life, while 3.0.0 introduces breaking API and security-default changes.

Benchmarking coding agents on Databricks' multi-million line codebase

Key Points

• Databricks benchmarked coding agents on real internal software tasks across a multi-million line codebase.
• The reported Pareto frontier includes OpenAI, Anthropic, and open-source models, with GLM 5.2 highlighted as a top-tier open model.
• Databricks found that end-to-end task cost and harness choice matter more than token price alone when selecting coding tools.

Cargo-nextest: 3x faster than cargo test, per-test isolation, first-class CI

Key Points

• cargo-nextest claims up to 3× faster test execution than `cargo test`.
• The tool supports per-test isolation and setup scripts for databases, services, and fixtures.
• Doctests are currently unsupported on stable Rust and should be run separately with `cargo test --doc`.

Ergo: Long Form Philosophy Lectures

Key Points

• Ergo is a nonprofit platform offering free, ad-free long-form philosophy lectures online.
• Featured lecturers include Lee Braver, David Albert, Tim Roughgarden, and Joel David Hamkins.
• The courses cover modern philosophy, quantum mechanics, computation, and infinity.

The Factorio Effect

Key Points

• Factorio is presented as training for supervising autonomous production systems rather than doing manual work.
• The article links that gameplay experience to AI software factories and agent orchestration.
• It argues that repeated rebuilding is a normal and necessary way to learn complex system constraints.

What's slowing down the AI buildout

Key Points

• The article says AI buildout is being slowed mainly by grid interconnection delays rather than an absolute electricity shortage.
• Stargate in Abilene, Texas is presented as a $40 billion-plus flagship AI computing project with a projected 1.2-gigawatt peak load.
• The piece compares AI power demand with other major industrial loads, including battery plants and TSMC’s Arizona semiconductor facility.

The Strange Locomotion of Spirocuta

Key Points

• The post shares a video of organisms identified as Spirocuta.
• It describes their locomotion as visually unusual and "bizarre to watch."
• The movement is compared to "pouring" into a new location.