Hacker News

Top stories

Live mirror
30 storiesupdated just nowView source snapshot
  1. F-Droid 2.0 (f-droid.org)
    225comments
  2. Show HN: Make cursed fonts like Times New Bastard (mitpit.com)
    52comments
  3. Show HN: Koi.rest – watch some fish and regain your balance (koi.rest)
    4comments
  4. Show HN: Whiteboard (YC W26) – An open-source IDE for thoughtful software design (github.com/devdotfast)
    66comments
  5. California is chasing wealth that has feet (landeconomics.org)
    95comments
  6. Why is the liver so weirdly regenerative? (dynomight.substack.com)
    118comments
  7. Fearless SIMD v1.0 (linebender.org)
    25comments
  8. Rails World 2026 Opening Keynote [video] (youtube.com)
    202comments
  9. My weird new hobby: Wandering around Tokyo on Google Maps (ahmedhossamdev.com)
    70comments
  10. 2DWillNeverDie (2dwillneverdie.com)
    2comments
  11. Using LLMs to trace alchemical knowledge and decode 17th century letters (resobscura.substack.com)
    8comments
  12. The Board Game of the Alpha Nerds (2014) (grantland.com)
    16comments
  13. Sourcehut account takeover via build logs (XSS in ansi2html) (blog.arusekk.pl)
    4comments
  14. Stable (YC W20) Is Hiring Product Engineers (usestable.com)
    —discuss
  15. Google’s Project Suncatcher to put ML infrastructure in space (blog.google)
    128comments
  16. Toyota is taking the Corolla electric (electrek.co)
    200comments
  17. Book review: Is parallel programming hard, and, if so, what can you do about it? (ahelwer.ca)
    20comments
  18. International observers to investigate Swedish election fraud (tv4.se)
    1comments
  19. The forgotten battle of East Lansing (eastlansinginfo.news)
    11comments
  20. Two-tier encryption in the UK (macanorak.com)
    357comments
  21. Forging 1024-bit RSA signatures in nearly SNFS time [pdf] (iacr.org)
    6comments
  22. Geothermal heat map of US hot springs (soakingsprings.com)
    28comments
  23. Opus 5.5 is good at explainer videos (launchvideo.io)
    66comments
  24. Show HN: Critic – Review code with the agent that wrote it (critic.run)
    1comments
  25. Tutoring company tells parents to save their money and 'use AI instead' (afr.com)
    91comments
  26. Early rogue AI agent activity and attempts to hack found on urlquery.net (transluce.org)
    209comments
  27. WaveDigger: Dig into wireless signals to discover their physical locations (github.com/christianrowlands)
    13comments
  28. Show HN: AgentRun: DSL to turn agents into workflows (github.com/parcha-ai)
    5comments
  29. Show HN: Treepeat – Code similarity detection using Tree-sitter (github.com/dsummersl)
    3comments
  30. Web-based IBM 1620 emulator and IPL-V from 1963 (github.com/pkimpel)
    12comments

Sourcehut account takeover via build logs (XSS in ansi2html)

44 pointsby 2h agoblog.arusekk.pl
4 comments
1h agoHN ↗

Really commendable work fixing up the upstream python project. I don't think there's anything to be embarrassed about in the timeline.

1h agoHN ↗

I love sourcehut, and I can't really think anything to replace it. But here's my shot. It's a popular myth that independently from the project size, someone should always take the main stream product in the field than small projects because most of the people would use the main stream product and there's an higher chance that vulnerabilities get already exploited/recognized/fixed. Is that true or not? TL;DR: in the evaluation of such products (sourcehut but even self hosted stuff), should we also take account about the project history and the exposition to threats?

14m agoHN ↗

haven’t been properly rickrolled in years, wasn’t expecting that!