Hacker News Reader

captn3m0on A Markdown File Should Just Open

I've been asking for this for many years. Native browser support in markdown will also give us a way to set our browser agents to prefer text/markdown over text/html, and thus opt-in to a cleaner web. Yes, I know you can embed HTML in markdown, but I would can hope it would work much like AMP except more open - with browsers deciding on what commonmark extensions they enable by default.

captn3m0on Railway Major Outage

The status page is more updated than the sparse blog post about the incident, worth merging the other thread here.

> We are rotating all Railway bucket credentials in response to the security incident. New credentials will appear in your dashboard automatically.

captn3m0on PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Bottlerocket's changelog through the storm of Linux CVEs these last year has been bad as well: https://github.com/bottlerocket-os/bottlerocket/blob/develop...

Roughly one release every 15-20 days.

captn3m0on PHP 8.2.35

Running a parallel PHP-filc deployment at such times at even 2x costs would 100% be worth it. Especially that you'd only be focusing on web-facing deployments (and not background processors).

captn3m0on Go will reject certificate chains containing eight distrusted SPKIs

node is doing the same: https://github.com/nodejs/node/pull/66871

captn3m0on Namecheap just seized and disabled all my domains

A namecheap bug got my domain suspended: https://captnemo.in/blog/2026/05/05/namecheap-whois/

I'm planning to migrate out.

captn3m0on Yandex outage: data shows that instead of going dark, malicious bots moved

I mostly saw the tomshardware.com link being the cause:

https://www.tomshardware.com/tech-industry/data-centers/russ...

The word "disinformation" doesn't show up in the post, only in the URL.

captn3m0on Theranos.world

Took me a while to figure out why, till I opened Safari read "document processing" and it clicked. Good job.

captn3m0on Make Tmux the OS

s/recursive/nested? I don’t remember Tree style tabs supporting recursion.

captn3m0on RSS Feeds for Last.fm

Is the code public? I'd like to port this to https://rss-bridge.org/

captn3m0on What I did at Recurse Center

I did during the pandemic. Drop me a message if you wanna chat.

captn3m0on Show HN: Make math automatic with Mathy

I made something similar for my partner a while ago for math drills but this is way better (and more comprehensive). I gave up after 3-5 modules. Kudos.

captn3m0on Microsoft killed FoxPro in 2007. Anyway, here's FoxPro revived

RLHF. The reviewers that rated the models preferred it.

captn3m0on ZuckOff is a free app that sees Meta glasses before they see you

They could, by incorporating recent research: https://www.core77.com/posts/145408/KAIST-Develops-a-Way-to-...

captn3m0on ZuckOff Is a Free App That Sees Meta Glasses Before They See You

Does it beep louder as the BT signal strength changes and the camera comes closer?

captn3m0on Show HN: Restarted – a 2026 remake of the classic 2015 startup generator

I got Shopify: https://restarted.io/?z=3119517161

captn3m0on LG says we're fake news [video]

Basic mode is a feature across Google TV: https://support.google.com/googletv/answer/10408998?hl=en

So lots of manufacturers support this.

captn3m0on ElevenLabs, TwelveLabs, ThirteenLabs

I run a reverse engineering collective that is called 52 Labs: https://52-1ab.github.io/.

> 52 1ab (Pronounced 52 Lab) is a Software Research group dedicated to interoperabilty research in India. It is named after the Section 52(1) (ab) of The Copyright Act which states:

>> The following act shall not constitute an infringement of copyright:

>> the doing of any act necessary to obtain information essential for operating inter-operability of an independently created computer programme with other programmes by a lawful possessor of a computer programme provided that such information is not otherwise readily available.

captn3m0on Phones should have a 'guest lock' feature

iOS has a hidden album but the UX isn't great: https://support.apple.com/en-us/104987

captn3m0on GLM-5.3: Frontier coding with emergent cyber capabilities

I am guessing you are approved for the Cyber Verification Program. I also applied and got approved in an hour (on a Saturday!), but it only applies to Opus and Sonnet: https://support.claude.com/en/articles/14604842-real-time-cy.... It let me use Opus for cybersecurity work, pretty much everything except for Ransomware development. It would occasionally still trip and start saying no till I added a note about CVP in my claude.md.

No one gets to use Fable for Cybersecurity work, and Mythos is not available under CVP. Only for select few customers, and there isn't an application form?

captn3m0on Tell HN: Namecheap gave my account to an unverified third party

Namecheap also suspended my primary domain because of a bug at their end: https://captnemo.in/blog/2026/05/05/namecheap-whois/

tl;dr: Namecheap configured Domain Privacy on my domain, which isn't allowed by my Registry (.in), and then suspended my domain coz the whois info was redacted.

I know a few other people that were impacted.

captn3m0on Reverse-engineering is cheap now

I reversed Super Hexagon these last few weeks and ported it to the Playdate (the yellow console from Panic with a crank): https://old.reddit.com/r/PlaydateConsole/comments/1v1zxmt/i_...

The multiplier comes from being able to design arbitrary fast feedback loops - Claude wrote Python scripts to do decompilation matching for itself, and then use Frida traces from the original as a verification harness.

captn3m0on Web-based cryptography is always snake oil

There are a lot of other implementations of this idea that don't necessarily rely on trust-on-first-use. The securedrop team explicitly includes malicious JS served by the primary-domain in the threat-model and made WEBCAT[0] as an outcome of that research. Their article on webcrypto is much better than this one.

The solution obviously is to go out-of-band:

> When a user visits a website that has enrolled in WEBCAT, before the site can load the content is checked against a signed manifest to ensure that it has not been tampered with (more on enrollment later). If everything checks out, the page loads normally. If, however, any content does not match what’s expected, the page load is aborted and a warning is displayed, protecting the user from potentially malicious content before it can execute.

[0]: https://securedrop.org/news/introducing-webcat-web-based-cod...

[1]: https://securedrop.org/news/browser-based-cryptography/

captn3m0on Command and Conquer Generals natively ported to macOS, iPhone, iPad using Fable

This is a OS port (iOS) of an existing functional and maintained fork (MacOS) of the official release (Windows).

Most of these low-hanging bugs would have been caught upstream by now.

captn3m0on Command and Conquer Generals natively ported to macOS, iPhone, iPad using Fable

upstream is a MacOS+linux build. https://github.com/fbraz3/GeneralsX.

captn3m0on Espionage Against the European Parliament

Do we know how Apple sends these? Is it just a notification, or also email?

captn3m0on Weave Robotics launches Isaac 1, a $7,999 home robot with Fall 2026 deliveries

There are 2 complete folds in the Isaac 0 video around 0:40, but speeded up: https://m.youtube.com/watch?v=KhImSR8GuCE

The about page claims 1000+ lbs of laundry folded every week.

captn3m0on .self: A new top-level domain designed to support self-hosting

10% apparently for .tk. I also remember .tv windfall, which is 8-9% of their GDP.

captn3m0on Streaming services' obnoxiously loud ads become illegal on July 1 in California

I wrote superbright to be able to force it: https://github.com/captn3m0/superbright (fork of BrightIntosh). The display does get hit after 10-15 minutes of this though.

captn3m0on No AI Co-Authors. A Manifesto

When I read the title, I thought it would be for research papers.