Hacker News Reader

progbitson Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more

1. People change their minds over time.

2. JXL is waaay more complex than Brotli so the risk of vulnerable implementation is also higher.

They should have demanded more rigor from the Brotli library, same for countless other dependencies chromium has. But there's no irony.

progbitson Incident with Actions, Pull Requests and Issues

Yes they are.

Source: enterprise cloud customer, it's broken all the time.

There is GHES onprem which indeed doesn't get affected by these outages, but it's shit.

progbitson Incident with Actions

Interestingly all the separate enterprise cloud instances show the same thing:

https://us.githubstatus.com/posts/details/P7VGB7I

https://au.githubstatus.com/posts/details/PO54BK8

https://eu.githubstatus.com/posts/details/PRESCZY

https://jp.githubstatus.com/posts/details/P0N7ZG5

What's the point of (supposedly) separate and isolated data residency deployments if they all have single point of failure?

progbitson StreetComplete on iOS is now in public beta

> I think 70% would be better

You can actually split the road into multiple segments and answer each separately if you don't mind the extra effort. I think there should be something like "differs along the way" button which then asks you to pick a point where to cut.

progbitson ZK-JPEG: Zero-Knowledge Image Editing and Compression

It would be interesting if it could be made to work with arbitrary transform, such as redaction.

Imagine a photo with some blacked out rectangles, and a ZK proof that confirms it comes from an attested "real" photo + adding those rectangles, but no other modification.

progbitson Measure internet censorship

Are you arguing for security by obscurity?

progbitson A graphical desktop for the ZX Spectrum

> Licence > > MIT, see LICENSE. Nothing here is derived from anyone else's code.

Right... Except the whole thing being generated by a model derived from everyone's code.

I'm not even sure I'm against licensing it as MIT but maybe stop with the ridiculous claims on top of that?

progbitson Animation in Bevy: The Big Picture

https://bevy-cheatbook.github.io/

This one is great for filling in some of the gaps in official docs.

progbitson IBM Quantum Nighthawk R2

Their cloud offering lists this with some specific calibration data:

https://quantum.cloud.ibm.com/computers?system=ibm_phoenix

Does this mean they literally have a single one? (Or at least a single one they offer publicly)

progbitson Fastpotify

What do you all use to buy music these days?

I've been slowly trying to stop my spotify usage and replace it with owned audio files.

Mostly I try to use Bandcamp but many artists are not there. Sometimes I just rip the audio from youtube but would prefer a way to buy that gives most of the money to the artist.

progbitson Show HN: Restoredrill – proves your Postgres backups restore

Thanks for taking the time to reply! Hope my comment didn't sound too harsh, now that I read it again it might, that's what I get for posting in a hurry.

Seems like you put a lot of thought and effort into it which is awesome, so the LLM readme was ruining first impressions. It's a shame but given the explosion in low effort projects it's important to stand out I think.

progbitson Show HN: Restoredrill – proves your Postgres backups restore

What bothers me personally the most is trying to hide it. Why did you remove Claude's (or whatever you used, but looks like opus to me from the style) co-author info?

I'm willing to use (semi-)vibecoded projects under certain circumstances, but I like to know up front what I'm getting. The github contributors list makes that easy to see as long as people don't try to hide it.

progbitson Nitter and XCancel receive cease and desist notices

Proposal: Ban twitter domain for HN submissions.

Reasoning: inaccessible to HN users. OP should find another source or mirror.

progbitson SSH Sshfighter.com

> hand-drawn pixel sprites

Flagged for outright lies.

progbitson ElevenLabs, TwelveLabs, ThirteenLabs

https://www.twelvelabs.io/blog/introducing-the-multimodal-ai...

> Twelve Labs and ElevenLabs are co-hosting the 23Labs Hackathon

progbitson Dear people who work at the airport

Are you? The gate won't let you in, you go to gate right next to it while it's still boarding.

progbitson New Amazon Data Center Is Set to Have the Most Polluting Power Plant in the U.S.

Most polluting power plant so far

This race to the bottom will have plenty more to give us in the coming years.

progbitson Responding to the next frontier of critical cyber capabilities

I'm not enough of a conspiracy nut to say the whole HF thing was a PR ploy from the start, but they are certainly milking it well.

Open models are on their heels and their attempts at regulatory capture are not moving as fast as they would like. So it's time to market this incident in a way that gives them monopoly on closed models, with heavy safeguards that are only lifted for selected customers, and laws limiting the use of open weight models.

progbitson Stateless MCP has recaptured my interest

It is.

MCP serves a single purpose: If you ask some company for API support for some stuff you can do via web UI but not API, they might say no for many reasons. But when you ask for MCP, suddenly you trigger AI FOMO and it will be available right away.

progbitson Stateless MCP has recaptured my interest

What hindsight, this was obvious from day one.

progbitson Apple is getting this wrong

> Is public opinion about this case so important to them?

They have no chance to win the court case, so public opinion is the only thing they have left to fight for.

progbitson Why Book Corners won't sync contributions back to OpenStreetMap

Mapy.com does this and I often see and resolve these notes on streetcomplete. It's nice setup, they provide a suggestion and location, it takes little effort to check if you are walking by and just reply to the note. Some enthusiastic editor (can be you back home, but it's annoying to do on a phone screen) then can make the edit and resolve the note.

progbitson Meshdiff – visually compare two STL versions in the browser, client-side

Looks handy. Feature suggestion: locked views so all three viewports rotate together.

progbitson Building a native C# implementation of CEL engine

The code is also clearly all vibecoded.

I think this is the usual we get these days: "Show HN: I built..." where in fact author did write neither the code nor the writeup.

progbitson MCP 2026-07-28 Specification: transport going stateless

It was clear from the start (to anyone who ever designed a protocol [1]) that MCP was a pile anti-patterns. They are slowly undoing the mistakes one by one. Maybe next years version will finally be something usable that it could have been from v1.

[1] https://news.ycombinator.com/item?id=44016783

progbitson Make an Origami Circuit Board

The images you are looking for:

https://dl.acm.org/doi/epdf/10.1145/3772318.3792784

Page 13, figure 16.

Strange this is not in the article itself.

progbitson GrapheneOS protections against data extraction from locked devices

Even more of a reason for good and easy backup and restore.

Before travel back up the real contents and restore a dummy travel backup with random games, stock photos etc. Then restore back to real contents.

progbitson I regret migrating to Codeberg

Codeberg is not software.

Forgejo is, and remains FOSS.

Codeberg provides a free service and is under no obligation to cater to cryptobros and vibecoders. You can buy a VM and host your own.

progbitson Tell HN: Namecheap gave my account to an unverified third party

You can also buy .is domains directly from the ISNIC registry. Or .de, .to, and few others support that.

No registrar needed, they are useless middlemen anyway.