hackernews

1. Project Glasswing: Securing critical software for the AI era Total comment counts : 50 Summary Project Glasswing, formed to counter AI-enabled cybersecurity threats, leverages Anthropic’s Claude Mythos2 Preview—a frontier model that can read, reason about code, and identify/exploit vulnerabilities. It has identified thousands of high-severity and zero-day vulnerabilities in major OSes and browsers. The program will use Mythos Preview defensively, with launch partners and 40+ organizations scanning first-party and open-source software....

1. A macOS kernel bug can cause OpenClaw to stop working after 49.7 days Total comment counts : 6 Summary error Overall Comments Summary Main point: The thread discusses a bug or issue that could affect long‑lived TCP connections and overall system stability. Concern: The main worry is that ultra-long uptimes could trigger crashes or state loss (like losing open tabs) across devices. Perspectives: Opinions range from skepticism that such a bug would seriously affect typical TCP connections to alarm about potential widespread instability, with humor and personal uptime anecdotes....

1. Gemma 4 on iPhone Total comment counts : 16 Summary AI Edge Gallery is Google’s open-source platform that runs powerful LLMs offline on iPhone. Gemma 4 is officially supported, enabling on-device reasoning and private processing. Features: Agent Skills (tools like Wikipedia, maps, visual summaries; loadable skills from URL or GitHub), AI Chat with Thinking Mode (step-by-step reasoning; Gemma 4 only), Ask Image (multimodal object recognition via camera/gallery), Audio Scribe (real-time transcription/translation on-device), Prompt Lab (prompt testing with fine-grained controls), Mobile Actions (offline device automation with a finetuned Gemma model), Tiny Garden (NL-based mini-game), Model Management & Benchmark (download/load models and benchmark locally)....

1. Show HN: A game where you build a GPU Total comment counts : 46 Summary error Overall Comments Summary Main point: The thread discusses an interactive, game-like educational tool for teaching NMOS/PMOS circuits and digital logic, with both praise and criticism. Concern: The learning experience may frustrate beginners due to confusing wiring, timers, and unclear concepts like capacitors and enable gates, potentially hindering learning. Perspectives: Opinions vary from high praise for its interactivity and educational potential to critique of early levels, timing constraints, and UI/pedagogical clarity, with requests for clearer explanations, optional timing, and better workflow....

1. iNaturalist Total comment counts : 18 Summary A blockage notice indicating that the IP address has been blocked and directing the user to contact support for more information. Overall Comments Summary Main point: The discussion centers on the iNaturalist API’s openness and usefulness for demos and science, while highlighting privacy concerns and comparisons to other wildlife apps. Concern: Public geotagged data and map pins can expose users’ home addresses, creating a doxxing risk for non-technical users....

1. Google releases Gemma 4 open models Total comment counts : 53 Summary Gemma introduces frontier intelligence for mobile, IoT, and personal computers, enabling autonomous agents that plan, navigate apps, and complete tasks with native function calling. It supports multimodal apps with strong audio/visual understanding and creates multilingual experiences that consider cultural context. Users can improve task performance by training Gemma with their preferred frameworks, and run models on their own hardware for development and deployment efficiency....

1. Signing data structures the wrong way Total comment counts : 3 Summary Cryptographic data packaging needs canonical encoding and strong domain separation to prevent cross-type forgeries (e.g., signing a TreeRoot could be misused as a KeyRevoke). Traditional methods are ad-hoc. FOKS’ Snowpack embeds random, immutable domain separators in the IDL; a compiler generates code that signs the separator concatenated with the object’s bytes (the separator isn’t emitted in the final payload)....

1. The Claude Code Source Leak: fake tools, frustration regexes, undercover mode Total comment counts : 33 Summary The article analyzes leaks around Anthropic’s Claude Code, including a .map file exposing full CLI source after an npm package was pulled. It notes anti-distillation features: ANTI_DISTILLATION_CC injecting fake tools to pollute training data, gated by GrowthBook tengu_anti_distill_fake_tool_injection; and server-side summarization with cryptographic signatures to hide full reasoning. Bypasses exist via MITM or non-cli usage....

1. Fedware: Government apps that spy harder than the apps they ban Total comment counts : 13 Summary An analysis of U.S. federal apps shows pervasive “Fedware”: many government apps request extensive permissions and embed trackers, often with location, biometric, and camera access. The White House app (47.0.1) includes GPS, fingerprint, and storage permissions, plus Huawei Mobile Services trackers and an ICE tip link. FBI’s myFBI Dashboard has 12 permissions and four trackers, including Google AdMob....

1. ChatGPT Won’t Let You Type Until Cloudflare Reads Your React State Total comment counts : 8 Summary Cloudflare Turnstile runs a hidden fingerprinting program in your browser for each ChatGPT request. Researchers decrypted 377 samples and found 55 checks across three layers: browser properties (WebGL, screen, fonts, DOM, storage), Cloudflare edge data (city, IP, region), and the ChatGPT React app (routing, loaderData, clientBootstrap). The 55 values are in an encrypted inner blob decrypted by a per-request XOR key embedded as a server float....