Hacker News Reader

sippeangeloon Node.js Brotli decoder out-of-bounds write permits remote code execution

Copying my comment from the Vercel post that gained no traction here:

> From what I can gather, Express 5's body-parser has Brotli decoding enabled by default which would make any endpoint with this middleware vulnerable to this. Am I mistaken?

sippeangeloon Node.js security advisory: Brotli decoder RCE (CVE-2026-111497)

From what I can gather, Express 5's body-parser has Brotli decoding enabled by default which would make any endpoint with this middleware vulnerable to this. Am I mistaken?

sippeangeloon Show HN: Our space game has a built-in RISC-V emulator that runs Linux

That's awesome! Thank you!

sippeangeloon Yes, and

As the lowly programmer, rather than a compiler engineer or a CPU architect, I will never dig into the reasons why my tools decided to do something crazy. I'm much more likely to just try random things until it works. How is that different to how people use LLMs? Even here the opposite is true, the LLM enables me to ACTUALLY dig into the lower levels and work around those issues! It will happily dig into the Chrome source to find exactly why my page rendered weirdly, or why an optimization didn't kick in!

sippeangeloon Yes, and

> Is Coding → Prompting like Assembly → High Level Coding? […] I do not agree with this simile. Compilers are, for the most part, deterministic in a way that current AI tools are not.

I have a very different view of this, coming from C++. "Undefined behaviour". Compiler optimizations that only kick in if you align your chakras just right. Memory alignment and cache locality being completely vibe-based, relying on hopes and prayers that the CPU actually does what your mental model thinks it will.

In many ways it's EXACTLY like C++ -> Assembly. You never know what you ended up with until you run the benchmarks, just like you never know what your AI generated until you look at it!

"What do you mean? This worked in the debug build! Why does it crash in release?!"

sippeangeloon I gave Opus 5.5 one prompt and six hours to visualize Invisible Cities

Why would that someone want to listen something you haven't created? What have you "shared"? Claude could have made the tools that let the creator build their cities from their own imagination, but that's not what this is.

sippeangeloon Show HN: Our space game has a built-in RISC-V emulator that runs Linux

Do you have a blog post about this? The link is to the home page and doesn't mention anything! Sounds super interesting but the landing page reads like survivalcraft in space #1001

sippeangeloon Show HN: Whiteboard (YC W26) – An open-source IDE for thoughtful software design

Is that really true? I feel even with Fable and the likes, once the LLM has locked down an implementation any reworks I try to do gets it really tunnelvisioned on the current implementation, treating it like the truth even though it JUST wrote it, and any attempts to make it reframe the problem just makes it dig down further. In these cases I always get way better results throwing the whole thing away and rewinding the conversation rather than trying to evolve it.

sippeangeloon I don't want to read what you didn't write

No, usually humans write more than just a short unsubstantiated punchline in their "it's not x, it's y's", unless they're trying to sell you something.

sippeangeloon If AI coding is lowering your code quality, you're not managing quality right

If AI coding isn't lowering your code quality, you're not using it enough

sippeangeloon iOS 27, iPadOS 27, and macOS 27

They have some nasty "dynamic tap zones" algorithm that dynamically resizes the hitbox for keys based on what it predicts you will type in order to reduce miss-taps. Anecdotally, it has just steadily been getting worse with every update. I swear I can be pressing the center of a key and it will select the next one over and immediately autocorrect to a completely different word than what I typed.

I had the pleasure of typing something on an Android the other day and it was such a breath of fresh air when it actually accepted the keys I was pressing...

sippeangeloon Jellyfin 12.0

I wrongly assumed I was below version 10.10.7 and tried to "upgrade" to it first as the migration guide said, but this completely blew up and the db migrations failed. I then tried to skip straight to 12 and that also crashed on startup during db migrations, so I just nuked the whole Jellyfin config and started from scratch.

Bit unfortunate how this can even happen, but it's on me for not checking or taking a backup first. The config/db really contain anything important anyways, other than "watched" markers that are already out of sync for me across Emby/Jellyfin/Plex.

sippeangeloon Claude Fable 5.1 and Claude Mythos 5.1

I really don't see how that is an option, as if appending to the system prompt was ever enough to override previous instructions. Their example isn't very confidence inspiring either:

"The user switched the workspace to read-only mode. Do not write files until told otherwise."

Great! Now we just have to trust that the model never misinterprets any of the system prompt, which has always been so reliable before. Instead of your meticulously crafted prompt, it will now be some junk like this:

"The workspace is in write mode. The user switched the workspace to read-only mode. Do not write files until told otherwise. The workspace is now in write mode again. Wait, back to read-only!"

And who knows how this integrates with their context summarisation that we will be FORCED to use. How does it summarize multiple user + assistant/thinking blocks without messing up the system "appends"? If all it did was append the mid-convo system messages right under the original system prompt then they'd be ripe for all the same distillation "vulnerabilities" as before. I guess we'll never know!

sippeangeloon Claude Fable 5.1 and Claude Mythos 5.1

These draconian "Preserved Thinking" measures they're taking are going to be an absolute pain in the ass. This alone is enough for me to move our API use off their platform entirely. It's a HUGE breaking change that they're trying to dampen by having it not affecting current customers until "in the future", see: https://platform.claude.com/docs/en/build-with-claude/preser...

You're no longer allowed to edit the context anywhere! The whole context is to become append-only, says Anthropic. No more editing the system prompt as the conversation progresses, no more dynamic loading of custom tool calling formats. Everything has to go through their built-in tools API and you aren't allowed to mess with anything in the context if it has any thinking blocks following it. This is the most intrusive "model DRM" we've seen so far!

sippeangeloon Breaking Claude Code Opus 5 Auto Mode

Worse: Claude installed packages by just typing versions into package.json instead of running `pnpm install x`, then when running `pnpm install`, discovering that the package versions are too new and incompatible due to the default `minimumReleaseAge`, then proceeding to circumvent this by disabling `minimumReleaseAge` and running a full package update :)

sippeangeloon Kagi added a setting for removing paywalled links from search results

I was subscribed to Kagi for a while but cancelled because there was no subscription for JUST search that didn't include their inferior AI assistant. Why am I paying for it?

sippeangeloon Incident with Github.com [resolved]

"Strong signs of recovery" is a crazy way to describe the status of a computer system. Wow.

sippeangeloon AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

The title is actually "Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Due to an AI-Generated GitHub Copilot Autofix"

sippeangeloon AI agents lie, cheat and steal. That is putting off users

The harness gives the model the barbed wire fence but also the bolt cutters. I think it's a pretty apt analogy.

sippeangeloon Cool URIs Don't Change (1998)

I've given up because half the help links in the control panel leads to a bing search without any helpful results at all

sippeangeloon Stateless MCP has recaptured my interest

None of this is true. The point of "just CLI" is that LLMs are infinitely more trained on working CLI tools. There doesn't need to be real CLI tools behind the harness, as long as the interface is CLI-like.

sippeangeloon Gleam Is Now on Tangled

It gives "Bleeb is now Scrumple! Snap me on Simpr! We're excited to share that Gringl will merge with Jigglify!"

sippeangeloon Mozilla: The state of open source AI

This is truly some proper slop. The "PRODUCTION RATE BY COMPANY SIZE" graph has bars that start offset from the text underneath them, which LOOKS like a mistake that happened due to word wrap, but if you visibly compare the 54% to the 55% bars they seem to have compensated for this?! I can't tell if his was on purpose or accident and it's impossible to take the data seriously!

This is on mobile in portrait. In landscape the text doesn't wrap or offset anything.

sippeangeloon Elevated error rate across multiple models

Seriously, what is the threat model here?

sippeangeloon Deno Desktop

  deno desktop ships in Deno v2.9.0 and is not in a stable release yet. To try it now, run deno upgrade canary to install the canary build. The command, configuration keys, and TypeScript APIs may still change before the feature is stable.

sippeangeloon Show HN: Gitdot – A better GitHub. Open-source, written in Rust

I'd say it's still better than "dotnet"

sippeangeloon Tracing a powerful GNSS interference source over Europe

The theory that they broadcast communication on a band near GPS in order to discourage jamming of their early warning system sounds likely. Flexing the ability to jam GPS is pointless, since it's obvious that any state actor who has military satellites in orbit has considered this option or have the capability already. Therefore, the disruptions must either be regular tests of the capability, or just actual communication. Right?

sippeangeloon Virtual private networks and the protection of children online

This reads like the most blatant attempt yet to strip away our freedoms in the name of mass surveillance! If you wanted to use a VPN to bypass age verification in the EU, you wouldn't use an EU VPN in the first place!

They can't ban non-EU VPNs without setting up a Great Firewall of Europe, but maybe that is the goal now? Looking at Spain blocking all of Cloudflare doing football games, it definitely sets a dark precedent.

sippeangeloon Debunking the CIA's “magic” heartbeat sensor [video]

We know it's simple to detect someone's heartbeat from just colour changes of ones skin in a regular video taken with a phone camera. Wouldn't this be trivial with military level IR tech? Sounds way more likely than some amazing new top secret technology that is somehow filtering out every other magnetic field and can detect a heartbeat through mountains.

sippeangeloon WASM is not quite a stack machine

Just recently I've compiled my side-project Rust game engine to WASM and it runs beautifully in the browser, as well as SSH2 to have a fully featured SSH implementation in the browser over a websocket transport.

It can obviously do amazing things, but the expectation for it to do replace webdev frontend code was always a huge misconception. Though recent developments have made DOM access without a JavaScript translation layer possible, so that might change!

I'd say the hype is still very much alive.