Hacker NewsWednesday, May 6

Google Chrome is automatically downloading a 4GB AI model file called "weights.bin" to users' devices without consent or notification. The Gemini Nano model powers Chrome's AI features and reinstalls itself if deleted. This affects billions of users and may violate privacy laws while generating significant environmental impact from mass distribution.

This is a comprehensive porting guide for translating Zig code to Rust in the Bun project, covering ground rules like file naming conventions, prohibited dependencies, and structural matching requirements. It includes detailed mappings between Zig and Rust types, namespaces, and idioms, with specific guidance on handling memory management, error types, collections, and JavaScript interop through systematic phase-based translation approach.

A security researcher named Tom Jøran Sønstebyseter Rønning posted on X claiming that Microsoft Edge browser loads all saved passwords into memory in cleartext format, even when the passwords are not actively being used, which represents a potential security vulnerability.

The author loves Bun as JavaScript tooling but worries about its future after Anthropic's acquisition in December 2025. While Bun remains excellent, Claude Code has deteriorated with restrictions and billing issues, suggesting poor product management. This raises concerns that Bun might follow the same path of enshittification as it integrates deeper into Anthropic. The author is switching to pnpm for new projects while hoping Bun stays great but no longer trusts the situation as much as before.

Almost all 20 U.S. state health insurance marketplaces shared residents' application data with tech giants like Google, Meta, and TikTok through pixel trackers. The shared information included sensitive details about incarcerated family members, race, sex, ZIP codes, and contact information. Some states paused or removed trackers after the investigation, but the issue affects millions of Americans who purchased insurance through these exchanges.

OpenAI redesigned their WebRTC infrastructure to enable natural voice AI conversations without delays or interruptions. They built a split relay plus transceiver architecture that handles over 900 million users globally while maintaining low latency and stable connections, allowing AI models to process audio in real-time as users speak.

This appears to be a DNSSEC analysis tool from Verisign Labs for testing domain name security configurations. The tool was analyzing the domain nic.de and provides options for detailed problem analysis with remediation hints. It includes copyright information for VeriSign, Inc.

A developer blamed an AI agent for deleting his company's production database, but the real issue was having a dangerous API endpoint that could wipe all data. The author argues this reflects poor system design and over-reliance on AI without proper oversight, comparing it to putting a self-destruct button on a dashboard.

GitHub experienced degraded performance across multiple services including Git Operations, Webhooks, Issues, Pull Requests, Actions, Packages, Pages, and Codespaces on May 4, 2026. The incident began around 15:45 UTC with increased latency and timeouts, progressively affecting various services. All services were restored to normal operation by 16:35 UTC, with the incident officially resolved at 16:40 UTC after monitoring confirmed stability.

The author discusses async Rust's "bloat" problem where asynchronous code generates unnecessarily large binaries, especially problematic for microcontrollers with limited memory. They've submitted a Project Goal to address this at the compiler level rather than through workarounds, proposing several optimizations including changing how completed futures behave (returning Pending instead of panicking), eliminating unnecessary state machines for simple futures, and implementing better inlining of async functions to reduce nested state machine overhead.