Timeline
Every post and feed across this instance
-
Bot traffic from Yandex
Article URL: https://radar.cloudflare.com/bots/as13238?dateRange=7d
Comments URL: https://news.ycombinator.com/item?id=50041619
Points: 630
# Comments: 251
-
Show HN: THX-01 – Free API for our open-source decision model
Article URL: https://twitter.com/reversedoofz/status/2109005792246657448
Comments URL: https://news.ycombinator.com/item?id=50041545
Points: 2
# Comments: 0
-
IRCv3
Article URL: https://ircv3.net/
Comments URL: https://news.ycombinator.com/item?id=50041540
Points: 394
# Comments: 334
-
🐛 Issue #1006 — Introspection endpoint answers without authorization
Issue ouverte · Issue #1006 Introspection endpoint answers without authorization · @rmdes
The introspection endpoint answers without any authorization.
introspectionControllerinpackages/endpoint-auth/lib/controllers/introspection.jsreturns{ active: true, ...claims }for any valid token posted to/auth/introspect(or sent toGET /auth/token), so anyone holding a token can read back who it belongs to and its scope. The IndieAuth spec asks for the introspection endpoint to require some form of authorization.This fails S801 and S802 in the IndieAuth test suite: https://dev.indieauth.rocks/implementations/2 (run against
main, see #967).Before a PR, a question on the form it should take. Core’s
introspectToken(packages/indiekit/lib/token.js) sends the token being checked as its ownBearerheader, so requiring a bearer token would only mean a token can introspect itself. Should Indiekit’s own calls skip the HTTP round trip and verify locally when the endpoint is its own, with the HTTP endpoint requiring a separate credential (for example a token with a dedicated scope), or is self-introspection with a bearer token enough here? -
📝 d143206 — fix(frontend): ensure photo in card layout retains 1:1 aspect ratio
Commit sur main · d143206 · @paulrobertlloyd
fix(frontend): ensure photo in card layout retains 1:1 aspect ratio
-
🟢 PR #1005 — fix(endpoint-auth): refuse a missing code_verifier instead of failing
Pull request (OPEN) · PR #1005 fix(endpoint-auth): refuse a missing code_verifier instead of failing · @rmdes
Fixes #1004
A code issued with a challenge now needs
code_verifier; without it the token endpoint returns 400 (missing parameter) instead of a 500. Test added alongside the invalid verifier one (fails with 500 before the change). -
🐛 Issue #1004 — Token request without code_verifier returns 500
Issue ouverte · Issue #1004 Token request without code_verifier returns 500 · @rmdes
When a code was issued with a
code_challenge,codeValidatorinpackages/endpoint-auth/lib/middleware/code.jscallsverifyCode(code_verifier, code_challenge)whether or notcode_verifierwas sent. Without it,createHash().update(undefined)inlib/pkce.jsthrowsERR_INVALID_ARG_TYPEand the token endpoint answers 500.The request is refused, but as a server error rather than a 400. Found with the IndieAuth test suite (S311), see #967.
-
🟢 PR #1003 — fix(indiekit): advertise the userinfo endpoint as an absolute URL
Pull request (OPEN) · PR #1003 fix(indiekit): advertise the userinfo endpoint as an absolute URL · @rmdes
Fixes #1002
Adds
userinfoEndpointto the endpointsgetEndpointUrlsresolves against the application URL. The metadata test asserted only thatuserinfo_endpointwas present, which is how the relative value got through; it now checks the URL. -
🐛 Issue #1002 — userinfo_endpoint is advertised as a relative URL
Issue ouverte · Issue #1002 userinfo_endpoint is advertised as a relative URL · @rmdes
The authorization server metadata lists
userinfo_endpointas/auth/userinfo. Every other endpoint is made absolute bygetEndpointUrlsinpackages/indiekit/lib/endpoints.js, butuserinfoEndpoint(added in #938) isn’t in its list, so it reaches/.well-known/oauth-authorization-serveras the relative default fromendpoint-auth.A client can’t fetch a relative URL from metadata. The IndieAuth test suite at dev.indieauth.rocks fails S116 (endpoints use https) and every userinfo test on it (S701–S703), see #967.
-
💬 @rmdes — discussion #967 : IndieAuth Spec Testing
Reponse de discussion · Discussion #967 IndieAuth Spec Testing · @rmdes
I ran it against rmendes.net, which runs endpoint-auth from
main(no code difference): 46 passed, 11 failed, 16 warnings, 11 skipped. https://dev.indieauth.rocks/implementations/2Three look like small fixes:
userinfo_endpointis advertised as/auth/userinfo, a relative URL:getEndpointUrlsinpackages/indiekit/lib/endpoints.jsdoesn’t listuserinfoEndpoint. That fails S116 and every userinfo test.- A code issued with a challenge but redeemed without
code_verifiergives a 500 (createHash().update(undefined)), not a 400. - The introspection endpoint answers without authorization (S801, S802).
Bigger ones: a code can be redeemed twice (S302), the consent screen has no deny button (S207), a registered cross-origin
redirect_uriis refused (S209), and there is no refresh or revocation (#535). -
📝 1bdd4df — fix(frontend): load the app script once the page is parsed
-
💬 @paulrobertlloyd — PR #1001 : fix(frontend): load the app script once the page is parsed
Commentaire de pull request · PR #1001 fix(frontend): load the app script once the page is parsed · @paulrobertlloyd
Oh, good spot. I’ve removed the
deferattribute too. -
Brothers Karamazov was Einstein's favorite novel
Article URL: https://twitter.com/patrickc/status/2109122600630952282
Comments URL: https://news.ycombinator.com/item?id=50041004
Points: 4
# Comments: 1
-
Git Documentation, Rewritten for Humans
Article URL: https://jvns.ca/blog/2026/01/08/a-data-model-for-git/
Comments URL: https://news.ycombinator.com/item?id=50040834
Points: 2
# Comments: 0
-
Hello World, AI Doompop
Article URL: https://radimentary.wordpress.com/2026/10/10/hello-world-ai-doompop/
Comments URL: https://news.ycombinator.com/item?id=50040737
Points: 2
# Comments: 0
-
I wish you the best in the Offline
Article URL: https://daverupert.com/2026/09/i-wish-you-the-best-in-the-offline/
Comments URL: https://news.ycombinator.com/item?id=50040625
Points: 79
# Comments: 53
-
3rd Yandex Cloud Data Center Was Hit
Article URL: https://status.yandex.cloud/en/incidents/2136
Comments URL: https://news.ycombinator.com/item?id=50040547
Points: 609
# Comments: 751
-
From WordPress to Astro: Zero Maintenance, Maximum Control
Article URL: https://www.mikeroberto.com/wordpress-astro-migration
Comments URL: https://news.ycombinator.com/item?id=50040319
Points: 1
# Comments: 0
-
LineageOS 24
Article URL: https://lineageos.org/Changelog-32/
Comments URL: https://news.ycombinator.com/item?id=50040276
Points: 427
# Comments: 174
-
Commodified Intelligence
submitted by alyaza to technology
16 points | 9 comments
https://herecomesthemoon.net/2026/09/commodified-intelligence/index.htmlIgnoring extinction and singleton risks, the bare minimum you should be horrified of is a commodification of intelligence, and what that means in a world with an uneven distribution of power and resources.
Commodified Intelligence.
That’s the phrase I’ve been trying to put a finger on for a while now.
The reason why dead-end so-called unskilled labor sucks is that you are fundamentally replaceable. The market enforces a pretty brutal equilibrium. White-collar jobs suck less because you are less replaceable, and maybe even get to convince yourself that your work matters, either for yourself or for society. You have some narrative arc attached to it that just isn’t there if you’re completely replaceable.
Whether you have a white-collar job or not, commodified intelligence fundamentally makes workers more replaceable, and this is bad for them.
It doesn’t matter that we’re all subjected to horrible AI-generated slop food posters as long as the margins are positive. It doesn’t matter that some diffuse component of quality, or a human touch are missing. Not as long as the margins are positive.
-
The death of web development education
-
Assorted things I've been mulling over regarding agents in the economy
Article URL: https://twitter.com/patrickc/status/2108706907859116280
Comments URL: https://news.ycombinator.com/item?id=50039813
Points: 1
# Comments: 0
-
AI agents in a stand-up call
Article URL: https://atoll92.github.io/agent-standup/
Comments URL: https://news.ycombinator.com/item?id=50039630
Points: 45
# Comments: 45
-
Satya Nadella says we should assume all AI models are 'compromised'
-
Ask HN: Do you want a router that has DD-WRT pre-installed?
I sometimes run across comments where someone says they want an open-source router. I wonder if this is a viable idea for someone to start as a small company. What makes me hesitant is that, first, it looks like this already exists in several wireless and non-wireless routers (like the GL.iNet Flint or OpenWrt One), and second, I assume hackers would just make their own.
I have been flashing DD-WRT to my routers for many years. My current setup is an Archer C9 that connects via cable to an Archer C8, which then wirelessly bridges to an R7000. All of them run DD-WRT. If I had "fun money," I would buy a low-power SFF PC with dual NICs, run OPNsense or OpenWrt, and use the wireless routers strictly as access points. Since I don't have that much to spend, I look for older DD-WRT friendly routers, usually under $30, on Craigslist or Facebook Marketplace, and flash them myself.
I see that Ubiquiti and MikroTik make quality routers with proprietary OSes for around $65 new. Protectli and Netgate offer pfSense routers starting at $259.00. The GL.iNet Flint 2 is $169.00, and the OpenWrt One is $89.
According to ResellBot (because eBay now requires a login to see sold listings with prices), the sold "DD-WRT Routers" generally go for under $160. These include the WRT3200ACM, Netgear AC1750, Linksys EA9300, and Linksys R7350.
When I asked an AI how I would go about judging interest, building, raising funds, and manufacturing, it seems doable but expensive (said $125,000 minimum in total made up of $30,000 for regulatory approval, engineering and protoyping $10,000+) and time-consuming just to get to a "golden prototype" for demos.
So if I were a "hacker" and wanted an open-source router, depending on my funds, I would either:
1. Flash DD-WRT to an existing router (used or new).
2. Buy one with it already installed, like the OpenWrt One or a Protectli device.
3. Get an SFF PC and build my own.
I remember when some comments about DropBox said it was a waste because any hacker could make that. I also know DropBox was marketed to the average person and businesses. I don't really see how a hacker friendly router could take off like that unless hackers are choosing the hardware and setting up the networks for average people. And I assume that most people setting up the networks want different qualities like brand name recognition, ease and speed of purchasing equipment (Walmart or BestBuy), and the ability to point a customer or family member to the number of solid reviews and articles saying it a good router to qualify their choices.
So, do you actually want a router that you can buy with DD-WRT pre-installed?
Comments URL: https://news.ycombinator.com/item?id=50039291
Points: 104
# Comments: 110
-
500B tokens later: Letting AI agents decompile a first-person shooter
Article URL: https://momo5502.com/posts/2026-10-09-game-decompilation/
Comments URL: https://news.ycombinator.com/item?id=50039092
Points: 198
# Comments: 139
-
European Alternatives
Article URL: https://buy-european.net/en/alternatives
Comments URL: https://news.ycombinator.com/item?id=50039063
Points: 130
# Comments: 97
-
Anthropic asks users to stop being mean to Claude
Article URL: https://www.theregister.com/ai-and-ml/2026/10/09/anthropic-asks-users-to-stop-being-mean-to-claude/5302218
Comments URL: https://news.ycombinator.com/item?id=50038865
Points: 50
# Comments: 50
-
Trump says Ukraine needs a new leader after diesel deal with Russia
submitted by Powderhorn to news
32 points | 6 comments
https://www.theguardian.com/world/2026/oct/10/ukraine-russia-strikes-war-trump-diesel-deal-zelenskyyDonald Trump has said Ukraine needs “a new leader”, a day after making a deal with Vladimir Putin to buy large quantities of Russian diesel.
The US president suggested Volodymyr Zelenskyy has not done enough to end the war with Russia and blamed him for high diesel prices in the US.
“I suggest they get a new leader who can make a deal because he could have made many deals and for some reason he never does,” Trump said.
Deals? It’s a fucking war! Speaking of … how’s Iran working out for you?
Andy Burnham reiterated his “complete solidarity” in a call with Volodymyr Zelenskyy and the leaders agreed to meet in person in the coming days to continue talks.
The prime minister said he recognised the past day had been “difficult for Ukraine” and the two talked about the importance of keeping up pressure on Russia, No 10 said.
The diesel deal disrupts four years of western financial pressure on Moscow and leaves Kyiv’s allies in Europe and Nato scrambling to adapt their sanctions plan. The EU’s top diplomat, Kaja Kallas, said the diesel deal “provides Moscow with more revenues to wage war”.
“This is not the time to ease pressure on Russia, and Europe won’t,” she said on Saturday. “On Monday, EU foreign ministers intend to approve the biggest set of sanctions listings targeting Russia’s war machine since the start of the war.” She was referring to plans to formally add 1,600 new individuals and entities to the EU’s sanctions blacklist.
This is going to end well.
-
Generative AI scandal has come to one of Nikon's competitions
Article URL: https://www.dpreview.com/news/generative-ai-scandal-has-come-to-one-of-nikons-competitions/
Comments URL: https://news.ycombinator.com/item?id=50038640
Points: 33
# Comments: 55
-
Show HN: WallHop – 12ft.io is gone, so I built a replacement
Hi HN, I'm Josh. WallHop is a free paywall bypass: paste an article URL (or prefix any URL with wallhop.io/) and you get the readable article without the paywall popup, ads or clutter. No signup, no extension.
I built it after 12ft.io went away. The News Media Alliance took it down in July 2025 and I missed having something I could hit from my phone.
How it works: it started as a fork of everywall/ladder (GPL-3.0) and I've modified it heavily since. Instead of relying on one trick, it chains several bypass methods per request and falls back to archive.is when they all fail, so one site blocking one technique doesn't break it.
Things that might be interesting:
- iOS Shortcut: on iPhone, tap Share > WallHop from any article in Safari or another app. This is how I use it 95% of the time. - It works on Medium member-only posts, which 12ft never handled. - Bookmarklet for desktop, plus /raw/ and /api/ endpoints if you want to script it.
I've tested it against most major news outlets and a bunch of local papers. It won't work everywhere. There are SOME server-side paywalls that are out of reach, and I'd rather say that up front. If you find a site that breaks, I'd love the link, and I can likely figure out a way to bypass it!
Comments URL: https://news.ycombinator.com/item?id=50038634
Points: 267
# Comments: 117
-
Googlebook improving ‘Better Together’ Android sync features, Samsung support rolling out
The big selling point for Googlebook is that it’s a desktop platform that deeply integrates with your Android phone but, at launch, those “Better Together” sync features are in a messy place. Google is now rolling out updates, including the bafflingly-missing support for Samsung devices.
more… -
Ask HN: Why aren't Americans rising up against tipping?
I've read lots of articles about how Americans hate their tipping culture. But tipping is optional so why don't they just stop? If you don't tip you both help society improve and you save money. Win-win.
Comments URL: https://news.ycombinator.com/item?id=50038458
Points: 52
# Comments: 135
-
Anthropic Bans Cruelty to Claude, Still Won't Say What It Protects
Article URL: https://rews.cc/a/anthropic-bans-cruelty-to-claude-still-won-t-say-what-it-pro-bd99f6
Comments URL: https://news.ycombinator.com/item?id=50038383
Points: 67
# Comments: 140
-
Personal agents are not aligned with consumer long-term interests
Article URL: https://twitter.com/BrendanFalk/status/2109068824293351774
Comments URL: https://news.ycombinator.com/item?id=50038302
Points: 3
# Comments: 0
-
🟢 PR #1001 — fix(frontend): load the app script once the page is parsed
Pull request (OPEN) · PR #1001 fix(frontend): load the app script once the page is parsed · @rmdes
Fixes #1000
Drops
asyncfrom the app script so it runs after the document is parsed, and custom elements are defined once their content exists. A module script is deferred by default, sodeferis kept only to say so.Checked with the proxy reproduction from the issue: five errors and no add-another buttons with
async defer, none and both buttons withdefer. -
🐛 Issue #1000 — Frontend components can start before their content is parsed
Issue ouverte · Issue #1000 Frontend components can start before their content is parsed · @rmdes
The app script is loaded with
async defer(packages/frontend/layouts/default.njk:46). For a module scriptasyncwins, so the script can run while the page is still being parsed. It defines the custom elements, and an element that has been opened but not yet filled getsconnectedCallbackstraight away:add-anotherlooks for#add-button(components/add-another/index.js:27) before it exists,getElementthrows, and the component never sets up.It depends on timing, so it shows up on some loads and not others. To make it repeatable, I sent
/posts/create?type=photothrough a proxy that pauses for 1.5 s after the<add-another>start tag. Withasync defer:No element matching #add-button No element matching .file-input__progress No element matching label No element matching .label No element matching .geo-inputand no add-another buttons. With
deferalone: no errors, both buttons.asynccame in with Stimulus (b9d05da), which waited for the document before connecting controllers; it became a problem when the components moved to custom elements (e.g. 914c8fd). -
📝 24b659a — fix(frontend): don't drop attributes after one without a value
Commit sur main · 24b659a · @rmdes
attributes() returned on the first falsy value instead of skipping it, so everything after it was lost. The summary field’s editor-locale is empty when application.locale is unset, which dropped editor-status=“false” and editor-toolbar=“false” after it and turned the summary into a full editor.
-
Genius or Mid Life Crisis Lol
Article URL: https://www.reddit.com/r/founder/comments/1x25aws/genius_or_midlife_crisis/
Comments URL: https://news.ycombinator.com/item?id=50038133
Points: 1
# Comments: 0
-
🟢 PR #999 — fix(frontend): don't drop attributes after one without a value
Pull request (OPEN) · PR #999 fix(frontend): don’t drop attributes after one without a value · @rmdes
Fixes #998
Skips an attribute without a value instead of returning, as 37e15d5 intended. Adds a test with an empty attribute followed by others (fails before the change, passes after).
-
🐛 Issue #998 — Frontend attributes() drops every attribute after one without a value
Issue ouverte · Issue #998 Frontend attributes() drops every attribute after one without a value · @rmdes
attributes()inpackages/frontend/lib/globals/attributes.jsreturns as soon as it meets a value that is empty or false, so every attribute after it is lost. The earlyreturncame in with 37e15d5 (January 2023, “don’t return attributes with falsy values”);continuewas meant.The article summary shows it.
summary-field.njkpasses"editor-locale": application.localebefore"editor-status": "false"and"editor-toolbar": "false".application.localehas no default (onlypublication.localedoes), so on an install that doesn’t set it, the twofalseattributes are dropped and the one-line summary gets the full editor toolbar and status bar. -
🟢 PR #997 — feat(frontend): choose an existing media file from the editor and file fields
Pull request (OPEN) · PR #997 feat(frontend): choose an existing media file from the editor and file fields · @rmdes
Fixes #996
Adds a “Browse media…” button to the editor toolbar and to the file input. It opens a
<dialog>listing files from the media endpoint (q=source, with “Show more” followingpaging.after). Choosing a file insertsfor a photo or[filename](url)otherwise in the editor, or fills the file input’s path.- The dialog markup and strings come from a
<template>rendered by the component, so they are localised; the newmediaBrowserkeys are in every frontend locale. - The editor button shows wherever the editor has a toolbar and a media endpoint, not only where image upload is enabled, so notes get it too. Plain text fields like an article’s summary are unchanged.
- One new toolbar icon (
browse-media), alongside the existing ones. - Tests:
test/unit/utils/media-browser.jscovers listing, choosing, paging, the empty and error messages, and cancelling.
Tested on the quickstart stack with an image built from this branch, in English and French: the photo field, and the article, note and photo content editors.
- The dialog markup and strings come from a
-
Build your own decision model
Article URL: https://nishtahir.com/build-your-own-decision-model/
Comments URL: https://news.ycombinator.com/item?id=50037949
Points: 451
# Comments: 102
-
📝 88287f1 — fix(frontend): don't throw looking up elements that may be absent
Commit sur main · 88287f1 · @rmdes
691b359 made component lookups throw when an element is missing. Four lookups are of elements that are absent by design, each already followed by a null check: the file-input picker and the geo-input button live only in a until connectedCallback clones them in, a tag-input hint and error message are only rendered when given, and the textarea status bar can be turned off. The throw aborted connectedCallback, so the upload button on photo, video, audio and featured fields and the find location button were never wired, and the category field rendered as a plain input. Those four go back to querySelector with nullable types. New component tests mount file-input and geo-input as custom elements in jsdom.
-
📝 5637cf4 — feat(indiekit): show more configured endpoints in homepage guidance
Commit sur main · 5637cf4 · @paulrobertlloyd
feat(indiekit): show more configured endpoints in homepage guidance
-
📝 07f959e — feat(endpoint-auth): use url filter for endpoint urls
Commit sur main · 07f959e · @paulrobertlloyd
feat(endpoint-auth): use url filter for endpoint urls
-
📝 526ed5d — feat(indiekit): make homepage guidance simpler and remove mention of …
Commit sur main · 526ed5d · @paulrobertlloyd
…Micropub By removing mention of Micropub, we can then show more endpoints that can be included in a website’s head
-
📝 0f8640e — feat(frontend): use url filter for absolute urls in default layout
Commit sur main · 0f8640e · @paulrobertlloyd
feat(frontend): use url filter for absolute urls in default layout
-
🐛 Issue #996 — Choose an existing media file from the editor and file fields
Issue ouverte · Issue #996 Choose an existing media file from the editor and file fields · @rmdes
Today the only way to reuse an uploaded file is to copy its URL from
/files.I’d like to add a “Browse media” button next to the editor’s image upload button and next to file-input’s “Upload file” button. It would open a dialog listing the media endpoint’s files (
q=source, paged by uid) and insert or fill in the chosen one. Built the way the other frontend components are: a native<dialog>, localised strings in the component template, the existing icons.I’ve run a version of this on my own site for a while; a screenshot of it follows.
-
🟢 PR #995 — fix(frontend): don't throw looking up elements that may be absent
Pull request (OPEN) · PR #995 fix(frontend): don’t throw looking up elements that may be absent · @rmdes
Fixes #994.
Those four lookups go back to
querySelector, with types that admitnull; every othergetElementcall is unchanged. New tests mount file-input and geo-input as custom elements in jsdom and fail without the fix. They are the first component tests in the package, so tell me if you’d rather they live elsewhere.Found while running a build of
main; worth having before beta 30.