HN Brief: 2026-06-21
Today's HN ran on a few familiar friction points: the line between a brilliant hack and a performative waste of the stack, the slow-motion collision of AI-generated content with old copyright and credibility norms, and a pair of threads that each captured a different flavor of how trust and enforcement work—or don't—in the modern web. The biggest single story was the CSS Quake engine, which drew an audience split between people who see it as a valid technical demonstration and those who see it as a deliberate mislabeling of a JavaScript game as a CSS one; the Obscure Sorrows plagiarism piece brought the same tension to a more serious register, pitting DMCA-as-solution against "AI laundering" as a structural problem. A quieter but sharp thread on SMPTE opening its standards catalog served as a reminder that even when a good thing happens, the conversation immediately pivots to who still won't do it.
Threads most worth clicking into: "The Wholesale Plagiarism of Obscure Sorrows" for the cleanest case yet of how AI-rendered replacement art turns a clear copyright violation into a murky debate about platform enforcement; "CSSQuake" because the thread's split between "this is brilliant" and "this is a toaster making meatloaf" is the exact argument HN loves to have; "Loupe" for the single-line discovery that a setup timestamp alone can narrow your identity to five people; "Slow breathing modulates brain function and risk behavior" for the counterintuitive finding that 2:8 breathing doesn't calm you down but actually *increases* risk tolerance; and "When I reject AI code even if it works" for the uncomfortable admission that passing tests isn't the same as understanding the code you're shipping.
CSSQuake [comments]
500 points · 104 comments · cssquake.com · 21h ago
Someone submitted a demo that renders a full Quake-like first-person shooter entirely in CSS — the game logic is TypeScript, but the 3D viewport, lighting, and enemy models are all built from DOM elements and CSS transforms, no canvas. The thread immediately turned into a mix of amazed laughter and serious skepticism, with a clear split: on one side, people calling it a brilliant hack and a valid use of the web stack, and on the other, developers arguing that "CSS is not a game engine" and the performance gap between this and a 1996 Pentium running actual Quake is embarrassing. Several commenters pointed out that the demo is just a rendering layer — the game logic is extracted from Quake's original C source and runs in JavaScript, so calling it "CSS Quake" is misleading, and the author acknowledged that the menu and sounds do rely on JS. There was also a fun tangent comparing it to the even earlier CSS FPS demos from a decade ago, and one person dropped a perfect one-liner: "this is like optimizing a toaster to make meatloaf."
The Wholesale Plagiarism of Obscure Sorrows [comments]
366 points · 146 comments · waxy.org · 13h ago
The article documents how a digital agency called Qontour built a polished but unauthorized replica site for John Koenig’s *Dictionary of Obscure Sorrows*, lifting the entire book’s text and replacing Koenig’s handmade illustrations with DALL-E 2 images, then adding a GPT-4-powered “generate your own words” feature. HN immediately split on whether this was a straightforward copyright case or a messier story about AI laundering and platform enforcement — some argued DMCA takedowns are exactly what should work here, while others pointed out that Google’s process already favors big players and that Koenig’s publisher apparently filed two DMCA notices last year with no effect. A significant chunk of the thread veered into a broader fight over whether you can consistently oppose both copyright-as-we-know-it and AI training on stolen work, with one faction insisting Qontour and everyone involved are simply thieves, and another questioning how you’d hold them accountable without the DMCA if you also think copyright is a form of plunder. A few people drew parallels to mockbusters and Asylum films, noting that “AI laundering” — repackaging stolen work to look like an original product — is likely to become a routine tactic across all creative domains.
VPN ban update for UK households as government looks at 'age-gate' [comments]
295 points · 335 comments · www.birminghammail.co.uk · 17h ago
The government is considering age-gating VPNs as part of its under-16 social media ban, with a statement due in July. The thread immediately went to the Great Firewall of Britain, with people drawing direct comparisons to China and pointing out that the UK government’s approach—arresting whoever builds workarounds—treats law as a loaded weapon, not a technical barrier. A sharp split emerged: one side argued that banning commercial VPNs at the App Store and payment-processor level would effectively cut off 99% of users, making the “geeks will route around it” argument a comfortable lie; the other side countered that the real problem isn’t kids dodging restrictions but the government and media being run by Epstein’s friends, who want mandatory ID to surveil everyone while the actual abusers—Meta, Musk, the BBC—remain unpunished. A few commenters noted that the minister herself admitted the evidence on both sides is weak and she’s commissioning more research, which the thread treated as the predictable prelude to doing whatever she wanted anyway. The whole thing boils down to whether you see a VPN ban as a doomed cat-and-mouse game or the opening move in a techno-fascist surveillance state, with no middle ground.
Windows 11 New Media Player Uses 3.5x More RAM, Charges for Popular Video Codecs [comments]
277 points · 156 comments · www.extremetech.com · 17h ago
The article reports that Microsoft's new Media Player for Windows 11 uses 3.5x more RAM when idle than the old one (377MB vs 103MB) and now charges for HEVC and Dolby Digital codec playback. The thread quickly diverged into a sprawling debate about which video player people actually use and trust, with VLC, MPV, and MPC-HC all getting passionate defenses—nobody seems to think the new Microsoft player is worth engaging with. A loud contingent pushed back hard on the "it's just 400MB" defense, arguing that bloat compounds across every system process and that RAM wasn't free to upgrade just so developers could write sloppy Electron-style UIs. Multiple commenters pointed out that HEVC codec licensing has been a mess for years and that Microsoft's paywalling isn't new—it's just getting worse with 24H2—while others countered that the real problem is patent pools, not Microsoft's engineering choices. The core split is between people who accept the resource tradeoff as inevitable versus those who see it as a betrayal of the platform's basic responsibility, with the old guard still pointing at VLC and MPC-HC as proof that the problem is solvable without charging users.
SMPTE Makes Its Standards Freely Accessible [comments]
251 points · 76 comments · www.smpte.org · 15h ago
SMPTE, the century-old media technology standards body, just flipped a switch and made its entire catalog of standards—including things like SMPTE 2110 for IP video—freely accessible to anyone, no paywall required. The thread split into two clear camps: a lot of people saw this as long-overdue common sense, arguing that locking specs behind fees only ever served to protect incumbent members' moats and punish independent implementers, who had to pirate PDFs. But a significant chunk pushed back, pointing out that standards bodies like IEEE and ISO survive on those paywalls to fund overhead, administration, and certification programs—and that making a standard "open" doesn't mean the work of maintaining it is free. The conversation then veered into a broader frustration with other holdouts, especially IEEE and the National Electrical Code, where critical infrastructure specs are still paywalled at $170 a pop, forcing engineers to rely on drafts or stolen copies instead of the authoritative reference.
Loupe – A iOS app that raises awareness about what native apps can see [comments]
244 points · 67 comments · github.com · 19h ago
The app Loupe is a hands-on tool that exposes exactly what device fingerprints any iOS app can silently collect—things like time zone, screen size, battery level, even the second your phone was last set up, all from public APIs without any permission prompt. The HN crowd immediately seized on how nasty that "setup timestamp" is, with a deep-dive commenter running the math to show that even compressed across millions of devices, you’re still sitting in a pool of maybe five people; combine that with a few more trivial signals and you’re uniquely cooked. A split emerged: some argued the real fix is just don't install apps and stick to the browser, since every site begging you to "download the app" is actually begging for a 10x richer data grab, while others pointed out Apple's so-called privacy labels are pure honor system and its "Allow Apps to Request to Track" toggle does nothing to stop the side-channel fingerprinting this app demonstrates. The thread also swerved into a debate about whether macOS is even worse, since non-Mac App Store apps like Chrome can read anything your user can, and a few commenters called out specific egregious leaks like the ability to probe installed apps via URL schemes or the pasteboard change counter, which Apple could easily fudge with per-boot randomness but hasn't.
DOS Game "F-15 Strike Eagle II" reversing project needs DOS test pilots [comments]
237 points · 63 comments · neuviemeporte.github.io · 16h ago
The post details the F-15 Strike Eagle II reverse-engineering project, which has reconstructed nearly all C source code from the original 1989 DOS binaries and now needs test pilots to find bugs before porting to modern platforms. The HN crowd is largely impressed by the scope and transparency of the work, but a long debate erupted over the legal risks of using AI to reverse-engineer old games, with one camp arguing that training data contamination makes clean-room approaches legally fraught while others dismiss that as unproven and irrelevant for abandoned titles. A thread of veterans and nostalgic players drove the conversation sideways, swapping memories of copy-protection manuals, co-op keyboard setups, and the specific quirks of the F-19 and Retaliator games that shaped their childhoods. There’s a clear split between those who see the project as a necessary step toward modding and porting, and those who think DOSBox emulation already works fine, but the counter-argument that binary patching is far harder than working from reconstructed C source mostly carried the day.
Renting a sewing machine from the library [comments]
207 points · 106 comments · www.bbc.com · 9h ago
A BBC article on Finland’s public libraries, which have evolved into community hubs offering everything from sewing machines and 3D printers to kayaks and pool passes, sparked a thread that largely pivoted from library policy to the practical grit of lending out complex gear. Several people argued that sewing machines are trickier to maintain than most people realize—more like renting out a spaceship than a book—and that without a repair staff or a hefty deposit, a loan program can quickly become unsustainable. Others pushed back, saying a decent old machine (a well-maintained Singer or a vintage Bernina) is nearly bulletproof, and that the real problem is that beginners, especially those who never learned in school, hit a steep threading-and-tension learning curve. The thread also drifted into a broader, positive discussion about "libraries of things" in the US (Portland, Minnesota, Ohio), with people swapping stories of checking out stand mixers, telescopes, and radon detectors, though one corner noted that this model only really thrives in a high-trust society.
Temporary Cloudflare accounts for AI agents [comments]
204 points · 108 comments · blog.cloudflare.com · 20h ago
Cloudflare announced temporary accounts that let AI agents deploy Workers for 60 minutes without signing up, then claim them permanently—aimed at removing friction for write-deploy-verify loops. The thread immediately pivoted to a long-running gripe: people want containers, not Workers, arguing Workers lock you into Cloudflare-specific architecture and don't map cleanly from Lambda, while containers offer portable semantics and easier multicloud. Others pointed out the blatant hypocrisy of making life easier for bots while forcing humans through endless Turnstile loops—some called it "first you spread the disease, then you sell the cure." There was also practical pushback on account management (no "create account" button for existing users) and skepticism about abuse: ephemeral infrastructure for malicious content got a vague rate-limit response, and a few people noted Cloudflare has little incentive to stop it if it drives DDoS protection sales.
UHF X11: X11 Built for VisionOS and Apple Vision Pro [comments]
196 points · 37 comments · www.lispm.net · 15h ago
The submission is about UHF X11, an app that turns the Apple Vision Pro into a full X11 display server, letting you float vintage X clients and GLX 3D graphics in spatial windows with CRT scanline effects. The thread immediately veered into whether the Vision Pro is worth it—several people argued it's too expensive and heavy for a "glorified devkit," drawing comparisons to the doomed Apple Lisa and Newton, while others defended it as a necessary first-gen product that will eventually mature into something more practical. A running joke emerged that the screenshot's lack of xeyes was a missed opportunity, though it turns out apps can't access the user's gaze position for privacy reasons—but head tracking is enough to make the eyes follow you around the room. The thread also split into two camps: those waiting for the upcoming Steam Frame (an actual Linux-running headset that's "your computer") vs. those pointing out that UHF X11 is simply not available in the EU App Store due to Digital Services Act compliance, which derailed into a broader complaint about the regulatory burden on small developers.
Show HN: StartupWiki – A Free Alternative to Crunchbase [comments]
192 points · 59 comments · startupwiki.tech · 16h ago
The linked article wasn't available to this summarizer; from the discussion, it's about a free, Wikipedia-style startup database called StartupWiki that the creator built to replace Crunchbase. The HN crowd immediately zeroed in on data reliability, noting that the site's AI-generated profiles are pulling outdated numbers (like Anthropic's old $4B round when its real valuation is $60B+) and that the "verified" badges don't link to their sources. The creator has been frantically replying, fixing bugs, and manual-approving submissions in real time, but the core tension is whether AI agents can credibly replace Crunchbase's self-reported model when they're clearly missing major YC and prominent startups. A few commenters are pushing for alternative approaches: scrape known portfolio pages directly instead of burning API tokens on LLM research, and one suggested anchoring everything to Wikidata for provenance.
Pre-2022 Books [comments]
188 points · 119 comments · notes.lorenzogravina.com · 9h ago
The post is a personal reflection on subconsciously preferring books published before 2022, valuing the manual human effort of typing, editing, and proofreading over AI-generated or AI-assisted prose. The HN discussion largely agreed with the sentiment about nonfiction and reference books, pointing out that Amazon is already saturated with low-quality AI-generated "slop" on technical topics like cybersecurity or Rust programming, produced solely to game search results. A strong counter-argument emerged that this is less about the tool and more about broken incentives in social media and publishing, where AI simply accelerates a pre-existing "rot-loop" of cheap, shallow content. A significant tangent pulled in the concept of "low-background steel" as a meme for pre-2022 cultural artifacts, while several people noted the irony that good, human-written prose now triggers AI detectors, and that the only real "proof" of human authorship might be a git commit history or a physical book that never gets updated.
Linux eliminates the strncpy API after six years of work, 360 patches [comments]
184 points · 156 comments · www.phoronix.com · 11h ago
The Linux kernel has finally ripped out `strncpy` after six years and over 360 patches, replacing it with safer alternatives like `strscpy` and `memcpy` — the function was a notorious bug magnet because its NUL-termination semantics are counterintuitive and it wastes cycles zero-filling. The HN thread quickly agreed that C's null-terminated string model is one of computing's original sins, with several people arguing that Pascal-style length-prefixed strings were far less error-prone, but split on whether the real problem is NULL pointers or the lack of a proper type system to enforce non-nullable values. A long, heated sidebar erupted over whether AI models will just replicate old C string bugs when generating code, because they're trained on all that buggy C — one person countered that they haven't seen an LLM produce a buffer overflow in months, while others pointed out that subtle off-by-one errors are exactly the kind of thing you'd miss in AI-generated volume. The conversation also touched on Rust's niche optimization, Zig's optional types, and the observation that C's "portable assembler" design forces every programmer to reinvent invalid sentinel values rather than having the language handle it.
Turns Out, There Is a Cabal of Elite Crazies Trying to Control the World [comments]
181 points · 78 comments · www.esquire.com · 9h ago
A Wired report obtained a leaked registration list for Dialog, a secretive retreat founded by Peter Thiel that gathers a who's-who of powerful figures from NATO commanders to Trump officials to surveillance titans. The resulting Esquire piece played up the "cabal of elite crazies" angle, but the HN commentary pushed back hard, with several people who actually attended describing it as more of a boring, TED-adjacent social club than a shadowy conspiracy—one noted the vibe curdled from optimistic in 2018 to resentful by 2022, which tracked with tech's political shift. A few commenters argued that this is just the latest version of Bilderberg or Bohemian Grove, and that the real question isn't whether these people are plotting, but whether they're any good at it: the sessions on "Navigating WWIII" and "Bring Back Nuclear" suggest a bunch of rich guys making each other dumber over bad panels. The thread split on whether the whole thing is a genuine threat or a case of the Peter Principle—elites who are great at acquiring power but terrible at wielding it, leaving the public to get squeezed either way.
The ability to regrow body parts is dormant in mammals, not lost [comments]
169 points · 57 comments · www.sciencedaily.com · 14h ago
This week's submission reports on work from Texas A&M showing that a two-step treatment with FGF2 and BMP2 can push mouse digit wounds toward rebuilding bone, joints, and ligaments instead of scarring to scar — suggesting humans aren't *missing* the machinery for regeneration, it's just switched off. The HN crowd immediately latched onto the cancer angle as the obvious reason that ability is dormant, arguing that the same stem-cell-driven regrowth that lets zebrafish fix their retina also makes them prone to tumors, and that evolution traded repair capacity for cancer suppression. Several people pushed back on the novelty claim, pointing to the well-known fact that human fingertips (past the nail) can regenerate on their own, and cited the old "pixie dust" finger-regrowth story from the 2000s as a disputed but not debunked precedent. A few commenters name-dropped Michael Levin's lab at Tufts and their voltage-signaling work, suggesting that organ regeneration might ultimately be controlled by electrical patterns rather than just growth factors. The overall split was between those who see this as exciting progress toward a hackable biological feature flag and those who worry the obvious tradeoff (cancer) means we'll need to solve that before any of this matters for humans.
Ubisoft co-founder Claude Guillemot has died in a plane crash [comments]
168 points · 108 comments · www.reuters.com · 17h ago
The linked article reports that Ubisoft co-founder Claude Guillemot died in a plane crash at age 69, piloting a twin-engine Cessna 421 near an air show in La Baule, France. While the thread opens with a brief acknowledgment of his role as the operational backbone behind his brother Yves, the discussion rapidly pivots into a dense, familiar dissection of general aviation safety, with multiple people pushing back against the headline's implied narrative of a tragic accident. A strong consensus emerges that the vast majority of small-plane crashes stem from pilot error and poor judgment—"get-there-itis," skipping checklists, or flying in marginal weather—rather than mechanical failure, with one pilot noting the saying that a second engine in a light twin "is there to get you to the crash site faster." Toward the end, the conversation sharpens into a critique of how the economics and regulation of private aviation lock innovation into decades-old designs, trapping pilots in a system where high maintenance costs and a shrinking mechanic pool make it hard to keep cockpits safe, while a few commenters argue that simply caring about one's own safety is enough to stay alive.
Slow breathing modulates brain function and risk behavior [comments]
168 points · 37 comments · www.cell.com · 9h ago
A new study in *Neuron* found that a specific slow-breathing pattern—prolonged exhalation (e.g., 2 seconds in, 8 seconds out)—actually *increases* risky decision-making by boosting reward sensitivity, not by producing the calm, cautious behavior most people would expect. The thread immediately split on that counterintuitive result: several commenters pointed out it makes perfect sense if you think about anxiety disorders or high-risk sports, where the whole point is that fear is what holds you back, and dampening that fear via the parasympathetic system lets you lean into rewards. Others pushed back hard on the framing, noting this isn't "any slow breathing" but a specific 2:8 pattern from yogic and martial arts traditions, and that the study's conclusion about "emotional recalibration" has been known and practiced for millennia—one person even called it "Zen party monster" territory. The deeper debate circled around whether it's even possible to train your default breathing pattern long-term, with some arguing that constant awareness of breath is hellish and others insisting it becomes euphoric and self-sustaining, plus a few tangents into Buteyko breathing and how a single long exhale before public speaking can be genuinely useful for overcoming irrational fear.
When I reject AI code even if it works [comments]
158 points · 89 comments · vinibrasil.com · 7h ago
The article is a piece by Vinicius Brasil arguing that even when AI-generated code passes tests and works, it's often worth rejecting if you can't fully understand or explain the approach yourself. The thread quickly zoomed in on what "works" actually means—several people pointed out that passing tests or turning CI green doesn't guarantee a solution is adequate, scalable, or maintainable, and that the real problem is the cognitive debt of shipping code you haven't thought through. A major split emerged: some commenters defended the author's position as essential for anyone on call or maintaining critical infrastructure, while others pushed back hard, arguing that for throwaway internal tools or static sites this kind of gatekeeping is overkill and that "done and cheap" is often the right call. The discussion also took a darker turn into organizational dynamics, with multiple people arguing that LLMs are just accelerating the same bad habits—cowboy coding, ticket-closing without understanding, and leaving behind wreckage—that already existed in high-pressure shops, and that most companies lack any mechanism to stop the tech debt from snowballing.
Show HN: TownSquare, a tiny presence layer for websites [comments]
156 points · 79 comments · townsquare.cauenapier.com · 20h ago
The linked article presents TownSquare, a single-script widget that lets website visitors see each other as stick figures and exchange ephemeral messages—a throwback to the early web's sense of shared presence, with no accounts or persistence. The HN crowd loved the concept and nostalgia, but the live demo quickly became a showcase of the problem: people flooded it with trolling, spam, and explicit content, leading many to declare that moderation is an unsolvable design challenge for any open chat widget. A split emerged between those arguing that ephemeral messages are self-moderating and those insisting the project needs real filtering—with several suggesting lightweight LLM moderation or shunting troublemakers into shadow-realm echo chambers rather than banning them outright. Others pushed back on the "vibe-coded" admission, calling it a red flag for security and long-term maintenance, while a handful of commenters dug up historical parallels like Third Voice and Cursor Party, noting the same moderation pitfalls have always killed this kind of idea.
Developers don't understand CORS (2019) [comments]
152 points · 71 comments · fosterelli.co · 6h ago
The linked article re-examines a 2019 blog post about how Zoom built a bizarre workaround to bypass CORS—encoding error statuses in image dimensions served from a localhost server—rather than just setting proper `Access-Control-Allow-Origin` headers, which opened a vulnerability that let any website on the internet trigger actions in the Zoom native client. The HN thread largely agrees that CORS is genuinely confusing, but splits on why: several commenters argue that the real problem isn't CORS itself but that most developers never internalize the threat model it protects against (protecting the *visitor's* browser, not the server), while others counter that the spec is a painful patchwork of legacy compromises that makes it nearly impossible to debug without deep knowledge of how browsers handle preflights and cross-origin image loading. A recurring frustration is that senior engineers at massive companies like Zoom still get this wrong, which makes people feel justified in just throwing Claude at the problem—prompting pushback that this attitude is exactly why every basic security issue (SQL injection, hardcoded secrets, XSRF) keeps repeating on an endless loop. The thread also surfaces a key misunderstanding: CORS doesn't block the actual request from reaching the server, it only prevents JavaScript from *reading* the response, and many developers treat it as an access-control system when it's really an opt-in mechanism for the browser to selectively relax its default CSRF protections.
From PGP to Mythos: a brief history of export controls that didn't stop anyone [comments]
149 points · 67 comments · techcrunch.com · 18h ago
The TechCrunch article recounts how the White House ordered Anthropic to halt exports of its "Mythos" and "Fable" AI models, framing it as the latest chapter in a long history of failed U.S. cyber export controls—from PGP's "Crypto Wars" to the Wassenaar Arrangement's crackdown on spyware. The Hacker News crowd isn't buying the article's central thesis that "export controls don't work," with several commenters pushing back hard that the difference is PGP was freely compilable code while Mythos is a closed, centralised service, making it far easier to police. A vocal split emerged over whether blocking exports will backfire, with one side arguing that 80% of Anthropic's revenue comes from outside the U.S. and that cutting off global talent and markets will destroy American competitiveness, while the other side predicts this will just accelerate Chinese labs' ability to produce open-weight "Mythos-class" models. The thread also latched onto a tangential detail—that Amazon's Andy Jassy allegedly tipped off the administration after his researchers found a "jailbreak"—with several people sarcastically questioning whether Anthropic is now unwinding deals with Amazon.
AMD will reinstate memory encryption on Ryzen 9000 CPUs via BIOS update in July [comments]
149 points · 35 comments · www.tomshardware.com · 12h ago
AMD is bringing back transparent secure memory encryption (TSME) to non-PRO Ryzen 9000 CPUs via a July BIOS update, after quietly removing the feature in a previous AGESA release sparked a backlash. The thread largely splits between people who see this as a legitimate security concern—especially for laptops or anyone worried about physical attacks—and skeptics pointing out the feature causes a tiny performance hit and that almost nobody was actually using it. The real anger, though, is less about the feature itself and more about AMD using a firmware update to retroactively strip capability from hardware people already bought, which several people argue sets a dangerous precedent that makes users wary of future BIOS updates. There's also a solid side conversation about how this fits into a broader pattern of AMD quietly segmenting its consumer lineup by gimping features like chipset bandwidth and memory channels, a move that used to be more Intel's style.
Your brain was never designed for this much bad news [comments]
141 points · 96 comments · theconversation.com · 4h ago
The article argues that human brains evolved to fixate on local threats, not a global firehose of negative news, and that the resulting news fatigue is a rational response to an overwhelming environment. On Hacker News, the discussion largely agreed with the core premise but quickly split into two competing camps: one arguing that the real solution is to focus your energy on the small, local problems you can actually change, and another pushing back that this is a cop-out, insisting that even informing yourself on distant crises is a civic duty because those collective votes and donations do ripple outward. A vocal minority went further, claiming that no layperson can possibly know the truth about any current event from media reports, so the best move is to simply stop paying attention entirely. The thread also swerved into a classic tangent about how single-issue voting on Israel/Palestine has a way of infecting utterly irrelevant local elections, with several people expressing deep frustration that they can't find a candidate who just talks about trash collection.
The rise of South Korea’s weapons business [comments]
137 points · 50 comments · www.politico.com · 20h ago
The Politico piece tracks how South Korea has become a major arms supplier, framing the shift as a response to U.S. retreat from global leadership. The thread immediately pushed back on the "surprising" framing—several people pointed out that Korea has been building and exporting weapons for decades because it faces a constant threat from the North, so the only surprise is that anyone is surprised. A big chunk of the discussion veered into cost comparisons, with someone breaking down that Korean howitzers and rockets are roughly half the price of American or German equivalents, which is the real driver of the export boom rather than any political vacuum. A separate, darker tangent emerged around Iran and Ukraine as rising weapons sellers, where the argument split: some insisted that the best advertisement for a weapons system is winning an actual war, while others countered that Iran's drones and Ukraine's adaptations are getting buyers because cheap mass production matters more than tactical sophistication, and that the U.S. refusal to learn from Ukrainian field experience is a massive strategic blunder.
Epoll vs. io_uring in Linux [comments]
135 points · 36 comments · sibexi.co · 8h ago
The article compares Linux's two main async I/O mechanisms—epoll and io_uring—walking through how the author's student project forced a deep dive into both. The HN crowd mostly agreed that io_uring is architecturally superior, slashing syscall overhead by batching operations and offering a zero-syscall polling mode, but they pushed back hard on a key caveat: io_uring is often disabled in production for security reasons, with multiple exploits and seccomp issues making it a non-starter in many environments. A few people argued the real win isn't just lower CPU utilization—it's that you do more actual work instead of waiting on context switches—but others pointed out that no existing async framework truly leverages io_uring's chaining model, so you're still stuck with a poll-like abstraction. There was also a split over whether thread-per-core still matters: one commenter insisted it absolutely does, because the real costs are atomics, cache misses, and core migration, not the I/O model itself.
Bun has an open PR adding shared-memory threads to JavaScriptCore [comments]
131 points · 262 comments · github.com · 15h ago
The linked article is a GitHub PR describing an experimental addition to JavaScriptCore that would let JavaScript run shared-memory threads—where `new Thread(fn)` runs a function on another thread in the same heap, sharing objects directly instead of forcing developers through the `postMessage` or `SharedArrayBuffer` gauntlet. The HN crowd split hard on whether this is a good idea: several people argued it’s a dangerous regression, warning that shared-memory concurrency is "foot artillery" that will lure JavaScript developers into writing the kind of bugs that message-passing architectures and single-threaded language design have historically protected them from, while others pushed back that JavaScript already has `SharedArrayBuffer` and atomics, and that this PR just makes those low-level tools more ergonomic by letting you share actual objects. A significant chunk of the thread veered into meta-commentary about the PR being written by an LLM and whether anyone actually reads these "walls of slop" anymore, with some suggesting the whole project is performative code generation rather than engineering.
Supermarket giant Tesco sues VMware for breach of contract (2025) [comments]
126 points · 33 comments · www.theregister.com · 10h ago
Tesco, the UK supermarket giant, is suing Broadcom over its VMware licenses, claiming the post-acquisition shift to expensive subscriptions has broken contracts for perpetual software it already owns, and the retailer warns this could literally stop it from putting food on shelves. The thread is split between those who see this as a calculated negotiating tactic that will likely settle and those who argue Broadcom’s “milk it” strategy is a genuine existential threat to on-premise virtualization, with several people pointing out this is exactly how Broadcom has treated every other acquisition. Many in the discussion are skeptical that Tesco has any real alternative, arguing that VMware’s massive, entrenched footprint—40,000 server workloads, tills, supply chains—makes migration a years-long, risky, and expensive project, so Broadcom’s current behavior is effectively a hostage situation. A few commenters pushed back on the idea that VMware is a “low-tech” dinosaur, noting its capabilities like DRS and NSX are still unmatched at scale, but the consensus is that Broadcom is knowingly burning the bridge to force everyone onto cloud subscriptions, and the only real winner is the hyperscaler capex.
Lithuanian startup launches open-source network to detect Shahed-type drones [comments]
124 points · 91 comments · www.lrt.lt · 20h ago
A Lithuanian startup called Mainline has launched an open-source network that turns old Android phones into acoustic sensors to detect Shahed-type drones by their engine noise. The discussion immediately got sidetracked into a comparison with a $4 billion SpaceX military contract for orbital radar, with one faction arguing the phone-based approach is a cost-effective hack against cheap drones and the other insisting space-based systems are necessary for coverage and speed. A deep technical split emerged over whether Shaheds flying at higher altitudes (now up to 5,000m) render ground microphones useless, since noise drops off with distance—some countered that radar constellations are already so dense in Ukraine that altitude doesn't matter for detection, it only affects interceptor economics. There was also sharp pushback on the spam vulnerability question: if anyone can feed data into this open network, an adversary could just flood it with fake detections, and the thread didn't settle on a clear fix.
Unauthorized alert sent to cell phones across Brazil [comments]
123 points · 87 comments · www.cnn.com · 11h ago
The linked article wasn't available to this summarizer; from the discussion, it's about an attacker gaining the ability to send a nationwide emergency alert to cell phones across Brazil, with the message calling for "misanthropy." The HN thread largely ignored the security incident itself and ran wild with speculation about what the perfect prank alert would be—favorite suggestions included "All debts have been erased," "Brazil eliminated from World Cup," and "Do not look at the moon," with a side debate about whether a soccer-related fake would actually cause chaos since the whole country already knows Brazil's tournament status. A chunk of the thread pivoted to the technical reality that cellular networks have long allowed spoofed sender IDs and SMS routing, with multiple people pointing out this isn't a new vulnerability and that governments already had similar mass-notification capabilities via telecommunication infrastructure. A separate, heated argument erupted over the loaded term "hacker" in the headline, with a minority citing the old hacker-versus-cracker distinction from ESR, while the majority dismissed that as outdated prescriptivism, noting the word has meant "system intruder" in common English since 1963.
Show HN: Make PDFs look scanned (CLI or in the browser via WASM) [comments]
117 points · 51 comments · github.com · 13h ago
A developer released an open-source CLI tool that takes clean PDFs and applies a pipeline of artifacts—skew, grayscale, warm paper tone, scanner grain, defocus, edge shadows, and JPEG compression—to make them look like they were actually printed, signed, and physically scanned. The HN crowd immediately landed on the practical friction driving this: companies that insist on receiving “print, sign, scan” documents even when all parties are digital, and the fraud debate kicked off hard. One camp argues this is straightforwardly fraud—you’re manufacturing evidence that a document existed in physical form—while the other fires back that the demand itself is absurd security theater, and that people have been faking this with ImageMagick scripts for years without consequence. Several commenters share war stories: a brokerage that rejected a too-perfect JPEG signature, a law school alum who argues bad laws should be broken, and a teacher who wants to force students to type code rather than copy-paste. The tool itself gets technical praise for running entirely client-side via WASM and being deterministic by default, with the main pushback being that the default vignette looks too obviously digital and needs tuning.
Generated 2026-06-21 08:27 UTC
Generated by Sauron from Hacker News discussions and linked articles.