Top Stories

AliExpress Runs Silent WebAudio Fingerprinting That Breaks Bluetooth Multipoint

976 points · blog.laserphile.com

A developer noticed their Bluetooth headphones kept dropping their multipoint connection whenever an AliExpress tab was open, and the culprit turned out to be silent WebAudio fingerprinting — the page spins up an audio context to generate a device signature for tracking, which quietly seizes the audio stack as a side effect. It’s a tidy illustration of how invasive fingerprinting has become: a tracking technique users can’t see manifests as a bizarre, unrelated hardware bug. HN’s crowd loves this kind of detective story where a real-world annoyance leads straight to a privacy smoking gun, and it reignited the perennial debate over how much browsers should lock down APIs like WebAudio and Canvas.

HTML Can Do That

838 points · chrisburnell.com

A tour of native HTML capabilities that developers routinely reach for JavaScript or heavy frameworks to accomplish — things like accordions, popovers, form validation, and lazy loading that the platform now handles on its own. The piece taps into a growing “use the platform” sentiment as browsers have quietly shipped years of new primitives. For a community that has spent a decade watching front-end complexity balloon, posts demonstrating that you can delete code and lean on the browser instead reliably strike a chord.

The August 17 Outage

548 points · github.blog

GitHub’s engineering post-mortem on its August 17 outage lays out the timeline, root cause, and the remediation work ahead. These write-ups are catnip on HN because so many teams depend on GitHub as critical infrastructure, and a transparent breakdown of how a large distributed system failed is genuinely educational. The comments turned into the usual mix of sympathy from on-call veterans and sharp questions about single points of failure and whether the mitigations go far enough.

Malicious Rust Crate Arrayref Runs a Build-Time Payload

511 points · safedep.io

Security researchers flagged a malicious Rust crate that executes a payload at build time via a proc-macro, meaning simply compiling a dependent project runs the attacker’s code — no runtime required. It’s another entry in the steady drumbeat of supply-chain attacks, and the build-time vector is especially nasty because it bypasses the mental model that “I haven’t run anything yet.” The thread dug into how Cargo and crates.io could better sandbox or vet build scripts, echoing similar reckonings across npm and PyPI.

CIA Funding Helped Keep NeXT Afloat in the 80s

407 points · wsj.com

A WSJ piece revealing that CIA money helped sustain Steve Jobs’s NeXT during its lean years in the late 1980s. It’s a fresh wrinkle in one of tech’s most-told origin stories — NeXT’s software eventually became the foundation of macOS and iOS after Apple bought the company — and the intelligence-community angle adds a layer nobody had front-of-mind. HN readers relish this sort of archival detail that recontextualizes canonical Silicon Valley history.

Show HN: Huzzah – A Novel Approach to Coding with AI

325 points · danielvaughn.dev

A Show HN introducing Huzzah, a new take on AI-assisted coding that rethinks the interaction model rather than bolting a chat box onto an editor. With the agentic-coding space crowded, novel workflow ideas draw scrutiny and enthusiasm in equal measure, and the maker fielded pointed questions in the thread about how the approach holds up on real codebases versus toy demos. It’s a good snapshot of where developer sentiment on AI tooling sits right now: curious, but demanding evidence.

Vomit: Clean Up Claude 5’s Token Output with a Separate LLM

263 points · github.com

A cheekily named tool that runs a second, lighter LLM to clean up the verbose or over-formatted output of a larger model like Claude 5. It speaks to a very current pain point — frontier models often produce sprawling, padded responses — and the “use a cheap model to post-process the expensive one” pattern is an increasingly common bit of LLM plumbing. The name alone guaranteed clicks, but the discussion got into genuine tradeoffs of chaining models and whether prompt engineering should solve this upstream instead.

Linux 7.2

257 points · igalia.com

Igalia’s rundown of what’s new in the Linux 7.2 kernel release. Kernel releases are a recurring HN fixture, and the roundup format highlights the driver support, filesystem work, and performance improvements that matter to the people running Linux everywhere from laptops to hyperscale fleets. As usual the comments served up appreciation for the maintainers alongside debate over specific subsystem changes.

Stop Anthropomorphizing Intermediate Tokens as Reasoning/Thinking Traces

249 points · arxiv.org

A paper pushing back on the habit of describing an LLM’s intermediate “chain of thought” tokens as genuine reasoning or thinking. The authors argue the framing is misleading and that these tokens are better understood as computation scaffolding than as a window into a mind. It lands in the middle of an active and philosophically charged debate about what reasoning models are actually doing, and HN — never shy about the interpretability question — split predictably between those who find the anthropomorphic language harmless shorthand and those who think it badly distorts public understanding.