Hacker NewsSaturday, October 3

Commenters debate Linus's view that SHA-1 is only a consistency check. Many argue signed commits, pinned dependencies, submodules and CI depend on hash integrity, so collisions enable supply-chain attacks. Others say trust belongs elsewhere and attacks remain impractical.

Many compare the SHA-256 switch to IPv6 or Python 3: no backward compatibility, unclear benefits and lagging tooling. Concerns include broken commit references, char[40] assumptions, forges and submodules. Others note Git's planned SHA-1/SHA-256 mapping should ease migration.

Fossil moved to SHA3-256 six days after SHAttered without breaking links. Commenters say Git's difficulty comes from its huge ecosystem, not technical limits. Others debate hash agility, weighing multihash-style flexibility against fixed algorithms that avoid downgrade risks.

Commenters note the kernel team assigns CVEs to nearly every backported fix, so raw counts are misleading. Critics call it malicious compliance (a RAID fix scored 9.8). Defenders say it rightly leaves impact judgment to users, though the volume may cause CVE fatigue.

A small-project maintainer reports advisories jumping to 22 a month since Opus 4.5. Many agree November 2025 was a turning point. Greg Kroah-Hartman's talk notes high LLM false-positive rates but urges calm. Others debate whether reports should come with fixes.

Some expect a temporary wave that settles once old bugs are fixed. Others argue improving models keep finding deeper bugs while AI-written code adds new ones at human-like rates. Formal verification (seL4, Ironclad) and AI self-review are floated as remedies.

Commenters loved the faithful imitation of Lobel's style and art, noting it parodies the "Cookies" story about willpower. Some said LLMs write poor Frog and Toad stories, and others suggested the children's-book format suits explaining tech or finance stories.

Debate over whether calling agents "persistent" or saying they "cheat" or "get upset" is misleading, versus seeing real human-like behavior. Others noted Claude Code's relentless workarounds to blocks and argued over whether OpenAI is excused or to blame.

Someone asked whether Lobel's estate was compensated. Replies argued it qualifies as noncommercial parody or fair use in the US, citing the EU Kraftwerk ruling and Germany's explicit pastiche exemption. Others dismissed the concern as killjoy-ish.

Users ask how agent checkpoints stay consistent with VM/sandbox state after crashes. Suggestions include declarative, idempotent environment interactions, workflow-engine style recovery, VM memory snapshots (e.g. Antithesis), or telling the agent tool-call outcomes are unknown.

Commenters question why Durable dropped Pi's branching trees. The author explains per-entry parenting was "dumb"; conversations are now immutable chronological lists parented to an entry in another conversation, giving the same functionality. Some still worry /tree navigation will spawn many forks.

Commenters agree sites can flag commercial VPN and datacenter IPs via lists and heuristics, but self-hosted VPNs, friends' exit nodes, and traffic shaping make reliable detection impossible. Latency and MSS tells are seen as too noisy.

Some call the adage outdated given China and Iran's controls, Layer 7 centralization, and self-censorship from surveillance. Others note HTTPS still holds, Starlink undermines Iran, and determined users always find workarounds.

The law's "actually located" clause effectively forces nationwide VPN blocking or age verification, burdening non-Utahns. Users flag First Amendment problems with banning VPN instructions, propose alternatives like NSFW headers, and debate LDS influence.

Some argue React wins due to more training data and ecosystem, and early models confused Svelte 4/5. Many counter that modern models handle Svelte well, use fewer tokens, and avoid React footguns like useEffect. Rich Harris argues Svelte still yields faster, better apps.

Fans praise Svelte's closeness to raw HTML, cleaner reactivity, speed, and smooth migrations. Critics cite frequent API changes across versions, awkward +page.svelte routing, SvelteKit being assumed by default, and weak non-VSCode tooling, with one user moving to Solid for plain TSX.

Orb.net uses Svelte/SvelteKit with Wails and a Go backend for desktop and mobile apps, producing binaries under 20MB versus Electron. Others praise the combo and its fast-loading sites, and compare Wails to Tauri as a Go-based equivalent.

The desktop build enables telemetry by default; users share config to disable it. Others note DeepSeek's API can't opt out of training, raise CCP data worries, suspect labs build harnesses for training data, and flag an SEO-boosted third-party packaging site as a security risk.

Some see Cordis's everything-is-a-plugin design as an "emacs of harnesses," while others call it a standard plugin interface. Users praise AI-generated custom plugins, but note core-plugin patches remain a burden and third-party plugins may carry malware risk.

Praise for the macOS app, observability, append-only context and subagent messaging drew astroturfing accusations. Commenters mock Electron shells, debate maintaining AI-written code, and question whether harnesses will matter as models improve or become the next battlefield.

Turbopuffer v3's shift to stable internal IDs mirrors MySQL's primary-key indirection vs Postgres row-id pointers, recalling Uber's migration. Commenters debate lookup cost, undo logging vs vacuums, and miss clustered indexes from MSSQL/Oracle.

Many see "vector database" as a misnomer: it's really retrieval, competing with Elasticsearch and Vespa. Others call the "RIP" title marketing since only vector-primary layout dies, compare it to NoSQL hype, and plug alternatives like LanceDB and TopK.

The new primary key is an internal (segment ID, doc ID), with user IDs as secondary indexes. One dev built a faster SQLite plus GPU IVF index; others discuss "generative retrieval" using neural nets as the index, and a stale v3 perf dashboard.

Developers lost accounts despite having published apps, and say Google refuses to accept "finished" software. Yearly target-API mandates make this worse. A few welcomed pruning orphaned apps, but most argued stale apps could simply be hidden. Others noted emails continue after account bans.

Individuals must submit government ID and bank statements, and may have their home address published. They also need 12 testers for 14 days before publishing. Many found this worse than Apple's clear $99/year fee, though some still see Google's one-time $25 as cheaper for hobbyists.

Users see the Developer Verification Program as locking down a once-open OS, with possible antitrust and free-speech implications. Google's support is also criticized as nonexistent. Suggested alternatives are PWAs, F-Droid or iOS, though each has limitations.

Many want to ditch apps that only show a barcode. Users recommend Anycode Wallet, SuperCards, Pass2U and Offline Cards, and note iOS 27 adds built-in pass creation. Others say signing passes still needs a $100 developer account, and vendor Wallet support feels half-baked.

Some praise Wallet for working offline, unlike bloated vendor apps such as Ticketmaster. Others prefer emailed PDFs or PNGs and see the push to Wallet as iPhone lock-in. Commenters also raised urban vs rural adoption and how lack of Android support limits uptake by businesses.

The macOS 27 requirement puzzled readers. Suggested reasons include Apple moving shared code into new OS frameworks, simpler QA and access to the latest APIs. Critics see a needless restriction that hurts small organizations and ask why this isn't simply a web tool.