Top Stories

Loupe – An iOS app that raises awareness about what native apps can see

312 points · github.com

The mysk-research team built Loupe to make a quiet point visceral: once you grant a native iOS app a permission, the amount of device and behavioral data it can quietly hoover up is far larger than most people assume. The app surfaces, in plain terms, what’s actually readable behind common permission prompts. HN loves this kind of “show, don’t tell” privacy tooling, and the thread digs into the gap between Apple’s privacy marketing and what the platform APIs still expose to any app you’ve tapped “Allow” on.

SMPTE Makes Its Standards Freely Accessible

266 points · smpte.org

SMPTE — the body behind the standards that underpin film, broadcast, and streaming media — is opening its standards library to the public for free. This is a big deal for a community that has long grumbled about paywalled specifications you effectively need to build interoperable media tooling. Open standards lower the barrier for indie developers, researchers, and archivists, and HN commenters are drawing comparisons to other standards bodies that still gate their documents behind steep fees.

Developers don’t understand CORS (2019)

220 points · fosterelli.co

An evergreen explainer that keeps resurfacing because, well, the title keeps being true. CORS is one of those browser security mechanisms that everyone fights with and few actually understand — the article unpacks what the preflight requests, headers, and credentials rules are really protecting against. The recurring popularity is itself the story: years later, developers still reach for “just disable CORS” without grasping why the same-origin policy exists.

Linux eliminates the strncpy API after six years of work, 360 patches

215 points · phoronix.com

A milestone in the kernel’s long campaign against unsafe string functions: after six years and roughly 360 patches, strncpy has been fully purged from the Linux source tree in favor of safer alternatives like strscpy. It’s a great case study in how massive, multi-year hardening efforts actually land in a codebase as large as the kernel — incrementally, one subsystem at a time. The thread is full of appreciation for the unglamorous, patient work that makes systems software more robust.

Temporary Cloudflare accounts for AI agents

214 points · blog.cloudflare.com

Cloudflare is rolling out short-lived, scoped accounts designed for autonomous AI agents, so an agent can be granted exactly the access it needs and have it expire automatically. As agents start taking real actions against infrastructure, the question of how to credential them safely — without handing out long-lived god-mode keys — is becoming urgent. HN sees this as one of the first concrete pieces of agent-native infrastructure from a major platform, and the discussion weighs it against the broader scramble to build guardrails for agentic systems.

Show HN: StartupWiki – A Free Alternative to Crunchbase

199 points · startupwiki.tech

A community-built, free directory of startups positioned squarely against Crunchbase’s increasingly pricey paywall. Founders and operators have long complained that basic company data — funding, founders, headcount — sits behind expensive subscriptions, and StartupWiki bets that an open, wiki-style model can fill the gap. The Show HN thread debates the perennial hard part: keeping the data fresh and accurate without the revenue engine that funds the incumbents.

Epoll vs. io_uring in Linux

175 points · sibexi.co

A hands-on comparison of Linux’s two dominant asynchronous I/O models, with benchmarks and a clear-eyed look at where io_uring’s newer, batched, syscall-light design actually beats the venerable epoll — and where it doesn’t. For anyone writing high-performance servers or networking code, this is exactly the kind of measured, numbers-first writeup HN rewards. The comments add real-world caveats around io_uring’s security history and uneven adoption.

Building reliable agentic AI systems

109 points · martinfowler.com

A practitioner’s writeup (via martinfowler.com, drawing on work at Bayer) on the engineering discipline needed to make LLM-driven agents dependable enough for production — evaluation harnesses, guardrails, and treating non-determinism as a first-class design constraint. It lands in the sweet spot between AI hype and software engineering pragmatism, which is why the HN crowd takes it seriously. The thread trades hard-won tactics for taming flaky agent behavior.

Project Fetch: Phase Two

61 points · anthropic.com

Anthropic’s latest update on Project Fetch, its research effort applying AI models to control and reason about physical robots. Phase two reports on what the team learned pushing models further into embodied, real-world tasks — a notable direction for a lab best known for language models. HN’s interest reflects growing curiosity about whether the same foundation-model approach that transformed text and code can carry over to robotics.