Hacker NewsTuesday, May 12

A developer spent 7 months building a Kubernetes GPU dashboard tool called k10s using AI-assisted "vibe-coding" with Claude, but learned that while AI excels at implementing individual features, it cannot architect maintainable software. The project devolved into an unmaintainable 1690-line "god object" that required complete rewriting, teaching the developer that humans must design the architecture and constraints before letting AI write code, as AI defaults to quick solutions that accumulate technical debt over time.

A security incident occurred when a developer's stolen laptop led to compromised credentials for a JavaScript package with 847 million downloads. This triggered a supply chain attack affecting a Rust library, then a Python build tool, compromising 4 million developers before being accidentally fixed by an unrelated cryptocurrency mining worm that upgraded systems while spreading.

In April 2026, Anthropic's AI model Mythos was hyped for finding security flaws in code, but when used to scan curl (a heavily audited codebase), it only found one confirmed vulnerability and about twenty bugs. The author concludes the hype was mostly marketing, as Mythos performed similarly to other AI code analyzers they'd previously used, though all modern AI tools are significantly better than traditional analyzers at finding security issues.

Ratty is a GPU-rendered terminal emulator that features inline 3D graphics capabilities. Created by Orhun Parmaksız, the project includes a blog post introduction, downloadable releases, and source code available on GitHub.

Google has changed its account registration process to require users to send an SMS from their phone via QR code verification instead of receiving SMS codes, making it harder to use temporary phone number services for anonymous account creation. While Google claims this improves security by making phishing more difficult, privacy-focused users are concerned about losing anonymity options, with some suggesting workarounds like purchasing accounts from marketplaces or using foreign SIM cards, though these come with their own risks and limitations.

The author shares their experience setting up local AI models, specifically Qwen 3.5-9B, which runs at 40 tokens per second on a 24GB MacBook Pro. While not as capable as cloud models, it works well for basic coding tasks, research, and planning without internet dependency. Setup involves choosing between tools like Ollama or LM Studio, configuring models, and tweaking settings. The author demonstrates successful examples like fixing Elixir code warnings but notes limitations with complex tasks. Despite requiring more hands-on guidance than advanced models, local models offer benefits like offline capability, no subscription costs, and reduced reliance on big tech companies.

ymawky is a static file web server for MacOS written entirely in ARM64 assembly language. It supports multiple HTTP methods including GET, PUT, DELETE, HEAD, and OPTIONS, handles Range headers for video streaming, decodes URLs, enforces security boundaries, serves custom error pages, provides directory listings, and includes protection against certain attack types.

A security incident has been reported regarding several compromised npm releases in the TanStack/router repository. The team is actively investigating this supply chain attack and has shared their findings through a detailed blog post at StepSecurity, which describes it as a self-spreading attack affecting the npm ecosystem.

Discussion centers on whether reproducible builds provide meaningful security benefits versus increased complexity. Supporters argue they enhance longevity, prevent supply chain attacks like XZ Utils, and reduce trust requirements, while critics claim no proven attacks were prevented and it raises contribution barriers.