Top Stories

I Found 10k GitHub Repositories Distributing Trojan Malware

812 points · orchidfiles.com

A researcher stumbled onto a sprawling campaign of roughly ten thousand GitHub repositories all engineered to distribute trojan malware, typically dressed up as game cheats, cracked software, and “free” tools that lure in unsuspecting downloaders. The writeup walks through how the operation was automated at scale — templated repos, fake stars, and SEO-friendly READMEs designed to rank in search and trick both humans and bots.

The HN crowd latched onto this because it’s a vivid reminder that a GitHub URL confers zero trust on its own. With supply-chain attacks already a top-of-mind concern, seeing malware distribution industrialized on the same platform developers live in every day hit a nerve.

.gitignore Isn’t the Only Way to Ignore Files in Git

432 points · nelson.cloud

A tidy explainer on the lesser-known corners of Git’s ignore machinery: the per-repo .git/info/exclude, the global core.excludesFile, and the assume-unchanged and skip-worktree flags for files you want tracked but locally untouched. It’s the kind of post that makes seasoned developers realize they’ve been committing .gitignore churn that should have stayed personal all along.

Practical, immediately useful, and on a tool everyone uses but few fully understand — exactly the recipe for a front-page Git post. The comments turned into the usual (and genuinely helpful) swap of workflow tips.

CS 6120: Advanced Compilers — The Self-Guided Online Course

380 points · cs.cornell.edu

Cornell’s PhD-level compilers course is freely available as a self-guided track, complete with video lectures, reading lists, and hands-on implementation work built around the Bril intermediate language. It covers the modern canon — dataflow analysis, SSA, LLVM, and more — without the tuition bill.

Compilers consistently draw a passionate HN audience, and a rigorous, well-structured course you can actually work through on your own is catnip for engineers looking to level up. Several commenters vouched for having completed it and called the assignments unusually rewarding.

Show HN: Are You in the Weights?

357 points · intheweights.com

A playful but pointed tool that probes whether a given person, project, or piece of writing has been memorized into the weights of large language models — essentially asking the model what it “knows” about you and surfacing the result. It taps into the now-familiar unease about what made it into training data and what didn’t.

The thread quickly became a mix of people checking themselves, debating what inclusion actually proves, and raising the deeper questions of consent and provenance that sit underneath every frontier model.

Ubiquiti: Enterprise NAS, Built on ZFS

346 points · blog.ui.com

Ubiquiti announced an enterprise NAS line built on ZFS, extending its UniFi ecosystem into serious on-prem storage with the filesystem self-hosters and homelab enthusiasts already trust for data integrity. The pitch is ZFS reliability with Ubiquiti’s signature polished management UI.

This landed squarely in HN’s homelab heartland. Commenters dug into the hardware specs, ZFS tuning, and the perennial question of whether Ubiquiti’s software will keep pace with the hardware ambitions.

Hospitals and Universities Repurposing Drugs at 90% Lower Cost

314 points · kcl.ac.uk

Researchers at King’s College London describe how academic and hospital partnerships are repurposing existing, off-patent drugs for new indications at roughly a tenth of the cost of conventional drug development — sidestepping the pharma incentive gap that leaves cheap generics untested for promising new uses.

The story resonated as a hopeful counterpoint to runaway healthcare costs, and the comments dug into why the market underfunds this work and how non-profit and public funding can fill the gap.

Zero-Touch OAuth for MCP

204 points · blog.modelcontextprotocol.io

The Model Context Protocol team detailed enterprise-managed authentication that lets organizations provision MCP server access without making each user click through an OAuth consent flow — “zero-touch” onboarding via centrally managed identity. As MCP becomes the connective tissue between AI agents and corporate systems, getting auth right is the gating factor for enterprise adoption.

HN’s interest here is very much of the moment: with agents increasingly wired into real tools, the security and identity model matters as much as the capabilities. Commenters weighed the design against existing SSO patterns and OAuth’s well-worn rough edges.

DuckDB Internals: Why Is DuckDB Fast? (Part 1)

201 points · greybeam.ai

The first in a series dissecting what makes DuckDB so fast — vectorized execution, columnar storage, and a query engine designed to wring maximum throughput from a single machine. It’s a deep, readable tour of the engineering decisions behind the analytics database that’s become a default for local data work.

DuckDB has a devoted following on HN, and posts that explain the “why” rather than just the “how to” reliably do well. The comments turned into a fond appreciation of how much DuckDB gets done without a cluster.

Project Valhalla, Explained: How a Decade of Work Arrives in JDK 28

169 points · jvm-weekly.com

After roughly ten years in development, Project Valhalla’s value types are finally landing in JDK 28, promising to close the long-standing gap between Java’s object model and the flat, cache-friendly memory layouts that performance-sensitive code craves. The piece explains what value classes are, why they took so long, and what they unlock.

For the large contingent of JVM developers on HN, this is a genuine milestone — one of the most anticipated and most delayed features in the language’s history. The thread mixed celebration with reflection on what a decade-long feature says about evolving a language used by millions.