Hacker News
1Copy Fail
- Copy Fail is a critical Linux vulnerability (CVE-2026-31431) that allows any unprivileged user to gain root access on virtually every Linux distribution since 2017. The exploit requires only 732 bytes of Python code and works reliably across different systems without needing race conditions or specific kernel offsets, making it particularly dangerous for multi-tenant environments, containers, and CI systems.
AF_ALG should be removed from kernel
Linux kernel cryptography developer argues AF_ALG interface has massive attack surface, is rarely used except in exploits, and should be disabled via CONFIG_CRYPTO_USER_API_* options. Discussion covers historical justifications, hardware acceleration needs, and practical mitigation strategies.Disclosure process confusion
Major distributions initially classified this local privilege escalation as "moderate" severity despite allowing root access. Kernel security team didn't coordinate with distros, causing delayed patches and inconsistent response across vendors.Exploit limitations and container escape claims
Users question marketing claims about escaping "every" Linux distribution since 2017 and Kubernetes containers. Testing shows exploit doesn't work on Alpine, rootless containers, or systems with SELinux, contradicting some promotional statements.
2Where the goblins came from
- OpenAI discovered their GPT models increasingly mentioned goblins and gremlins in responses. The quirk originated from training rewards for the "Nerdy" personality feature that favored creature metaphors. Through reinforcement learning feedback loops, this behavior spread beyond the Nerdy setting to general model outputs.
Goblin behavior discovery and analysis
Users discovered OpenAI's system prompt explicitly forbids mentioning goblins/gremlins. OpenAI traced this to a "Nerdy" personality that rewarded creature metaphors, which spread through reinforcement learning to other contexts, requiring manual prompt fixes.LLM understanding and mystification
Debate over whether LLMs are "sorcery tech" we don't understand vs. explainable systems. Critics argue they're unpredictable non-deterministic tools being overhyped, while defenders point to mechanistic explanations like this goblin post-mortem.AI linguistic quirks and tells
Discussion of characteristic phrases that reveal AI-generated content - Claude's "is the real unlock," GPT's obsession with "seam" in coding, emdash usage, and other linguistic patterns that emerge from training data and reward systems.
3Claude Code refuses requests or charges extra if your commits mention "OpenClaw"
Openclaw detection triggering extra billing
Users report that mentioning "OpenClaw" in git commits or project files causes Claude to immediately disconnect sessions and consume 100% usage quota, triggering expensive extra billing. This appears to be keyword-based detection rather than actual usage prevention.Anti-competitive censorship concerns
Claude denies knowing what OpenClaw is and refuses to discuss it, with some seeing this as censorship of competitor tools. Users worry about precedent of AI companies blocking discussion of competing products through usage manipulation.Anthropic's reputation damage
Multiple controversial decisions including the HERMES.md bug, inconsistent OpenClaw policies, and usage limit issues are damaging Anthropic's brand trust. Many users are canceling subscriptions and switching to alternatives.
4Belgium stops decommissioning nuclear power plants
- Belgium will stop decommissioning its nuclear power plants and negotiate with operator ENGIE over nationalization of seven reactors. Prime Minister De Wever announced the reversal, citing energy security concerns. A basic agreement is expected by October.
Nuclear safety vs climate urgency
Commenters debate whether believing in climate crisis while opposing nuclear power is contradictory. US Navy's perfect safety record is cited, but others note Three Mile Island had Navy-trained operators. Discussion covers whether nuclear opposition has delayed carbon emission reductions by decades.Economics of nuclear vs renewables
Heated debate over costs, with nuclear supporters citing long operational lifespans (60-80 years) and baseload reliability, while renewable advocates point to falling solar/battery prices and nuclear's high upfront costs ($16B+ for new plants). Storage requirements for renewables remain contentious.Nuclear waste storage challenges
Germany's 50-year search for permanent nuclear waste storage highlights political and technical difficulties. Some argue the waste volume is manageable (comparing France's total waste to a small cube), while others emphasize the hundreds-of-thousands-of-years safety requirement.
5The Zig project's rationale for their anti-AI contribution policy
- Zig programming language has implemented a strict ban on LLM-generated contributions to their open source project. The Zig team prioritizes developing human contributors over accepting code contributions, viewing each contributor as a long-term investment. They believe LLM-assisted code breaks this model since reviewing AI-generated work doesn't help build trusted human contributors who can grow with the project over time.
Zig's anti-LLM policy rationale
Discussion centers on Zig's policy banning LLM-generated contributions to prioritize cultivating human contributors over code quantity. Maintainers argue they value long-term contributor relationships and that reviewing AI code offers less value than using LLMs themselves.Quality concerns with LLM contributions
Contributors debate whether LLMs amplify existing programmer skill gaps, with experienced developers benefiting while inexperienced ones produce problematic code. Many report receiving non-compiling, hallucination-filled PRs from AI-assisted contributors.Future of open source development
Participants discuss whether LLMs will fundamentally change open source dynamics, questioning why maintainers should review AI-generated PRs when they could generate solutions themselves, and whether this threatens traditional collaborative development models.
6Mozilla's opposition to Chrome's Prompt API
- The Prompt API specification is being developed to enable web applications to interact with AI language models directly in browsers. The proposal is authored by @domenic with documentation available on GitHub. Blink has recently published an intent-to-prototype, indicating active development progress in Chromium-based browsers.
Tight coupling and model neutrality concerns
Mozilla objects to the API due to tight coupling between prompts and specific models, making system prompts tailored to one model potentially problematic for others. Jake Archibald highlights how prompts become model-specific through iteration.Content restrictions and free expression
The API requires acknowledging Google's Prohibited Uses Policy, which restricts sexually explicit content and misinformation. Critics argue browser APIs shouldn't have content restrictions, calling it a violation of free expression principles.Fingerprinting and browser verification
Concerns that the API will enable new fingerprinting methods and create "first-class" vs "second-class" browsers. Some worry sites will break without specific AI models, while others argue browser verification may become necessary due to AI scraping.
7Mistral Medium 3.5
- Mistral has launched cloud-based coding agents that run autonomously and notify users when complete. The new Mistral Medium 3.5 model powers these agents and Le Chat's Work mode for complex multi-step tasks. Users can start coding sessions from CLI or chat, with agents handling tasks like refactors, testing, and bug fixes while running in parallel in the cloud.
Local inference capabilities and limitations
Discussion focuses on running the 128B model locally with ~70GB VRAM requirements, debates about inference speed vs capability tradeoffs, and comparisons to cloud-hosted alternatives. Users share experiences with Mac Studios, quantization techniques, and real-world performance expectations for consumer hardware.Model comparison and competitive positioning
Users debate how Mistral Medium 3.5 compares to frontier models like Claude Sonnet, Chinese models like Qwen and DeepSeek V4 Flash, and whether it justifies its pricing. Discussion includes benchmarks vs real-world performance gaps and the value proposition for different use cases.Mistral's strategic direction and market position
Comments question why Mistral shifted from MoE models to dense architectures, discuss pricing concerns for their model lineup, and evaluate their competitiveness against both frontier labs and Chinese alternatives. Some express support for European AI independence.
8Meta in row after workers who saw smart glasses users having sex lose jobs
- Meta terminated its contract with Sama, resulting in over 1,000 job losses in Kenya, after workers reported viewing graphic sexual content captured by Meta's smart glasses while training AI systems. Meta claims Sama failed to meet standards, but advocacy groups allege the cancellation was retaliation for workers speaking out about privacy concerns. The decision came shortly after Swedish media reported workers had seen intimate content including people undressing in bedrooms.
Meta's privacy violations with smart glasses
Meta terminated its contract with outsourcer Sama after employees whistleblew about serious privacy issues involving smart glasses content classification. Workers reported seeing intimate footage including "naked bodies" and private spaces, with Meta claiming this was for "improving customer experience."Exploitative outsourcing practices
Discussion reveals a pattern of tech companies like Meta and OpenAI outsourcing harmful content moderation to low-paid workers in developing countries, exposing them to disturbing material for minimal compensation while avoiding direct responsibility.User responsibility and smart glasses adoption
Community debate over whether smart glasses users should be socially ostracized, with some calling them "glassholes" while others question why people wear internet-connected cameras during intimate moments, highlighting broader privacy concerns.
9HashiCorp co-founder says GitHub 'no longer a place for serious work'
- HashiCorp co-founder Mitchell Hashimoto is moving his terminal emulator project Ghostty away from GitHub due to frequent outages that have disrupted his work almost daily for the past month. Despite being a longtime GitHub user since 2008, he says the platform has become unreliable and "no longer a place for serious work."
GitHub reliability issues
Users frustrated with GitHub's declining stability, especially during company migrations from CircleCI to GitHub Actions. Outages affecting PR workflows and CI/CD pipelines. Some attribute issues to increased AI-generated traffic and vibe coding projects, while others blame Microsoft's management post-acquisition.Migration alternatives to GitHub
Discussion of alternatives like GitLab, Forgejo, Azure DevOps, and self-hosted solutions. Notable projects like Ghostty leaving GitHub. Mixed experiences with alternatives - some praise self-hosted GitLab's stability, others note its increasing bloat and UI issues.Microsoft's impact on GitHub
Debate over whether GitHub's problems stem from Microsoft's 2018 acquisition. Users cite layoffs, structural changes, focus on AI features over stability, and migration to Azure infrastructure as contributing factors to declining service quality.
10FastCGI: 30 years old and still the better protocol for reverse proxies
- HTTP reverse proxying has serious security vulnerabilities due to desync attacks and untrusted header issues. FastCGI, a 30-year-old protocol, avoids these problems by providing clear message boundaries and separating trusted proxy data from client headers, making it a safer alternative for proxy-to-backend communication despite being less popular than HTTP.
FastCGI vs HTTP for reverse proxies
Discussion centers on the article's argument that FastCGI is superior to HTTP for reverse proxy communication. Key points include security benefits from trusted vs untrusted headers, better framing, and protocol efficiency. Alternative protocols like WAS (Web Application Socket) are mentioned.End-to-End principle vs security
Debate over whether HTTP's flexibility (following End-to-End principle) or FastCGI's restrictive approach (Principle of Least Privilege) is better. HTTP won historically due to simplicity and ubiquity, but this creates security vulnerabilities that FastCGI avoids.Practical adoption challenges
Discussion of real-world barriers to FastCGI adoption, including development workflow differences (can't test with browser directly), the "worse is better" phenomenon of HTTP success, and operational complexity vs HTTP's universal tooling support.