Hacker News
1Shai-Hulud Returns: Over 300 NPM Packages Infected
Package manager security alternatives
Discussion centers on PNPM as a safer alternative to NPM, featuring security measures like manual approval for post-install scripts, minimum release age requirements, and better token management. Users also discuss Bun's similar security features and Python's pip alternatives.Dependency cooldown strategies
Community debates implementing "dependency cooldowns" - waiting days or weeks before updating packages to allow time for vulnerability detection. Discussion covers automated vs manual updates, the trade-offs of staying current vs secure, and scalability concerns.NPM ecosystem vulnerabilities
Broader conversation about whether Node.js/NPM should still be used for new projects given frequent supply chain attacks. Includes comparisons to other ecosystems, discussion of NPM's cultural issues with micro-dependencies, and alternatives like containers for isolation.
2Claude Opus 4.5
Pricing and cost comparison
Opus 4.5's 3x price drop ($5/$25 per MTok vs previous $15/$75) makes it viable for production workloads. Users note smarter models often cost less overall due to fewer wasted tokens and mistakes, with Opus being cheaper than Sonnet for many usage patterns.Model performance degradation
Users report cyclical pattern where new models perform well initially then get "nerfed" after 2-4 weeks. Many experience recent degradation in Sonnet 4.5, leading to theories about quantized versions, load balancing, or A/B testing affecting quality.Competitive comparison with other models
Discussion focuses on relative strengths: Claude excels at coding tasks, Gemini better for architecture/design work, varying performance across different platforms like Cursor vs Claude Code vs other IDEs.
3Pebble Watch software is now 100% open source
- Pebble announces a major update making their watch software 100% open source, ensuring long-term sustainability. The Pebble Appstore now supports multiple feeds with public backups for decentralization. Pebble Time 2 production is progressing with shipping expected to begin in January, though most deliveries will likely occur in March-April due to Chinese New Year factory shutdowns.
App store competition and multiple feeds
Core Devices launched their own open Pebble app store with Archive.org backup, supporting multiple feeds so users can choose between Rebble's paid service and alternatives. This creates resilience against company failures and gives end users control over which feeds to trust.Rebble vs Core Devices drama aftermath
Community debate over whether Rebble deserves more credit for maintaining Pebble during the "dark age" after Fitbit shutdown. Some feel Eric's return with open-source approach marginalizes Rebble's contributions, while others see it as the best possible outcome.Open source licensing and contribution concerns
Discussion of Core Devices' CLA requiring perpetual copyright license from contributors, with concerns about future "contribution theft." Core Devices clarified all contributions must remain under OSI-compatible FOSS licenses like GPLv3.
4France threatens GrapheneOS with arrests / server seizure for refusing backdoors
- La Quadrature du Net denounces recent French media attacks on GrapheneOS, a free open-source mobile operating system. The articles, echoing interior ministry propaganda, falsely portray GrapheneOS as a tool for drug traffickers and suggest its use indicates criminal intent. French prosecutors threaten developers and attempt to criminalize privacy protection technologies. This follows a pattern where the government uses drug trafficking as justification to weaken encryption and expand surveillance capabilities.
Comments moved
This appears to be a moderation action where discussion was relocated to a different thread, with no substantive discussion content available in the provided comment.
5X's new country-of-origin feature reveals many 'US' accounts to be foreign-run
- X has introduced a feature showing the country of origin for user accounts, revealing that many prominent political accounts claiming to be American are actually operated from foreign countries. MAGA-aligned accounts with hundreds of thousands of followers have been traced to locations like Eastern Europe, Thailand, Nigeria, and Bangladesh, while anti-Trump accounts have been found operating from Austria and Kenya. The discovery has sparked controversy across political lines, with officials calling out foreign interference in American political discourse through fake accounts posing as domestic voices.
Foreign influence operations
Discussion centers on Reddit's 2013 data revealing Eglin Air Force Base as the "most addicted city," sparking debate about military cyber operations and social media manipulation. Users argue over whether this indicates coordinated influence campaigns or statistical anomalies.Technical workarounds for geolocation
Users discuss how foreign accounts can evade X's location detection using VPNs, Azure VMs, and residential proxies. The conversation covers technical limitations of IP-based geolocation and app store country detection methods.Social media authenticity and trust
Participants debate the value of knowing account origins, with some arguing for verified identity systems while others question whether foreign commentary should be restricted. Discussion includes concerns about echo chambers and algorithmic manipulation.
6Iowa City made its buses free. Traffic cleared, and so did the air
Free transit sustainability and scalability
Debate over whether free public transit can be simultaneously free, scalable, and financially sustainable. Critics argue cities eventually revert to charging fares due to feedback loops, while supporters cite successful examples in Brisbane, Luxembourg, and other cities.Homelessness concerns with free transit
Discussion about whether eliminating fares leads to buses becoming shelters for homeless people. Some argue this is fear-mongering, while others share experiences from cities where free transit attracted problematic behavior and loitering.Cost comparisons between transit modes
Analysis of how expensive public transit can be compared to driving, especially for families. Users share examples where BART, trains, and buses cost more than driving, making free or cheaper transit more attractive for reducing traffic.
7µcad: New open source programming language that can generate 2D sketches and 3D
- µcad (Microcad) is a new open source programming language for generating 2D sketches and 3D objects. The project is in early stages but becoming increasingly stable with new ideas added weekly. The blog provides updates on latest developments.
Legal concerns about LEGO trademark
Users warn that LEGO aggressively protects its trademark and advise removing LEGO references from the website and examples to avoid potential legal issues. Discussion includes comparisons to Nintendo's trademark enforcement.Comparison with other CAD tools
Users compare µcad with Zoo's KCL language, build123d, OpenSCAD, and FreeCAD. Key concerns include vendor lock-in with cloud-hosted geometry kernels, local hosting capabilities, STEP export support, and workflow differences between tools.Website and user experience issues
Multiple complaints about the website including unnecessary cookie banners, poor performance, PHP implementation with query strings, and requests for better examples and documentation on the front page.
8Calculus for Mathematicians, Computer Scientists, and Physicists [pdf]
Rigorous vs non-rigorous approaches in calculus textbooks
Discussion centers on the challenge of balancing rigor in calculus education. A math professor argues most books fail by being neither fully rigorous nor fully intuitive, and advocates choosing one approach. Some suggest non-standard analysis or cite successful rigorous texts like Apostol and Spivak.Declining mathematical rigor in Western education
Commenters debate whether Western math texts have become less rigorous over time compared to Russian/Asian books. Discussion covers whether this prepares students for advanced study, with some attributing the trend to expanding college enrollment and student loan incentives.Target audience and book approach
Participants discuss whether the book successfully unifies different calculus tracks (proof-based for math majors vs technique-based for science majors). Some question if one book can serve diverse audiences, while others appreciate the foundational approach starting before traditional calculus topics.
9Shai Hulud launches second supply-chain attack
- Security researchers detected a second wave of the Shai-Hulud malware campaign targeting npm packages. This self-replicating worm infected 492 packages with 132 million monthly downloads, stealing API keys and tokens, then spreading to more packages. The attack occurred just before npm's deadline to revoke old authentication tokens.
Security mitigation tools
Discussion about using Bubblewrap (bwrap) to sandbox npm/node operations and limit attack vectors, plus a Python script for checking repositories for compromised packages in lockfiles.Thread management
Extended discussion about whether this post duplicates another HN thread, with moderator explaining merge policy and clarifying terminology for "Dup" vs "See also" submissions.Title corrections
Users pointing out typos in the post title, noting it should be "Shai-Hulud" not "SHA1-Hulud" and "Coming" not "Comming", with clarification that the malware uses "Sha1-hulud" in its GitHub repos.
10Ask HN: Hearing aid wearers, what's hot?
- Someone's Phonak Audeo 90 hearing aid died after 5 years and they're seeking recommendations for a replacement. They have moderate hearing loss, enjoy music and nature sounds, but struggle in meetings and noisy environments. Cost isn't a concern as they want to use work insurance before retiring.
Live captioning technology
Discussion of Captify glasses and other live transcription solutions that provide real-time captions for conversations. Users share experiences with accuracy in multi-speaker environments and compare with phone-based transcription apps as supplementary hearing aid technology.Modern hearing aid technology
Users compare latest hearing aid models, particularly Oticon Intent, Phonak Sphere Infinio, and Widex SmartRIC. Discussion covers AI-powered noise reduction, directional microphones, battery life, and significant improvements in speech perception in noisy environments.Bluetooth connectivity issues
Problems with hearing aid phone integration, particularly microphone selection where newer models use hearing aid mics instead of phone mics for calls. Users discuss workarounds and frustrations with AirPods-like behavior in hearing aids.