Top Stories

Passkeys are a trap

665 points · nonfunctional.substack.com

Passkeys were supposed to be the password’s long-awaited replacement, so a pointed essay arguing they’re actually a trap struck a nerve. The author’s core complaint is about lock-in and portability: your passkeys often live inside a platform vendor’s walled garden, and moving them between ecosystems — or recovering them when a device dies — can range from painful to impossible. The HN crowd is deeply split, with security folks defending the phishing-resistance wins while others share horror stories of getting locked out of their own accounts. It’s the kind of debate that cuts right to the tension between security and user control.

The gap in shared understanding of LLM capability is widening

482 points · twitter.com

Andrej Karpathy argues that people’s mental models of what LLMs can and can’t do are diverging faster than ever — and that this gap is becoming a real problem for everything from product decisions to public discourse. Some users treat models as near-oracles while others dismiss them as stochastic parrots, and the truth, as usual, lives in a messy middle that’s hard to communicate. HN engineers love Karpathy’s takes because he’s one of the few voices who’s both technically credible and willing to say the uncomfortable parts out loud, and the thread is full of people trying to pin down where exactly their own mental models have drifted.

NYC’s “Click to Cancel” rule is now in effect

485 points · nyc.gov

After the federal version got tangled up in legal challenges, New York City’s own “click to cancel” rule is now live — requiring that canceling a subscription be as easy as signing up for it. For anyone who’s ever had to call a phone line or chat with a retention bot just to escape a gym membership or streaming service, this feels like overdue consumer-protection common sense. HN’s product and growth folks are weighing in from both sides: some celebrating the death of dark-pattern retention flows, others noting how much of the subscription economy quietly depends on friction to cancel.

Terence Tao: Math 2.0 [pdf]

414 points · teorth.github.io

Fields Medalist Terence Tao laid out his vision for “Math 2.0” — a future in which AI tools, formal proof assistants like Lean, and large-scale collaboration reshape how mathematics actually gets done. The slides sketch a world where machines handle verification and bookkeeping while humans focus on insight and taste, and where proofs become living, checkable artifacts rather than static papers. Because Tao is both a working mathematician and an early, serious experimenter with AI in research, HN treats his perspective as unusually grounded, and the discussion dives into what formalization at scale would really mean for the field.

Fingerprints are the new cookies

406 points · royfish.dev

As browsers crack down on third-party cookies, this piece argues that the tracking industry has simply moved on to device fingerprinting — stitching together signals like fonts, screen size, GPU quirks, and timezone to identify you without ever setting a cookie. The uncomfortable punchline is that fingerprinting is harder to see, harder to block, and largely invisible to the consent banners we’ve all been trained to click through. Privacy-minded HN readers are both grimly nodding and trading techniques for raising their own entropy, while others point out how this undermines the entire premise of cookie-based privacy regulation.

Zod 4.6.6 compromised by malware?

131 points · github.com

A commit raising alarms about a possibly-compromised release of Zod — one of the most widely used TypeScript validation libraries — set off the familiar supply-chain panic in the JavaScript world. With Zod sitting deep in countless dependency trees, even a hint of malicious code in a published version is enough to send maintainers scrambling to pin versions and audit lockfiles. The thread is a real-time case study in how the ecosystem responds to a suspected npm compromise, and a reminder of just how much trust we place in a handful of foundational packages.

Postgres isn’t slow, your storage is

108 points · clickhouse.com

A recap of a Postgres performance talk makes the case that the database itself is rarely the bottleneck — the storage layer underneath it usually is. The argument walks through how I/O patterns, disk latency, and misconfigured storage drag down queries that people reflexively blame on Postgres, and how understanding the hardware changes the tuning conversation. It’s the kind of myth-busting the HN database crowd eats up, prompting a lively exchange of war stories about cloud disk throughput, fsync behavior, and the surprising gains from just moving to faster storage.

Type-safe HTML templating in Zig

131 points · lalinsky.com

A deep dive into building compile-time type-safe HTML templates in Zig showcases exactly the kind of low-level language ergonomics that excite systems programmers. By leaning on Zig’s comptime features, the author gets the compiler to catch template errors before the program ever runs — no runtime string interpolation surprises. HN’s language nerds appreciate both the practical result and the demonstration of what Zig’s metaprogramming can do, and the comments compare it to similar type-safe templating approaches in Rust and other languages.

Research Firm Calls Anthropic’s IPO ‘Unprecedented Test of Investor Gullibility’

89 points · cnbc.com

A research firm’s blunt skepticism about Anthropic’s upcoming IPO gave HN plenty to chew on about the economics of the AI boom. The analyst’s argument centers on sky-high valuations relative to revenue and the enormous capital burn required to keep training frontier models, framing the offering as a bet on a future that may or may not materialize. Given how many HN readers are building on top of these models — or competing with them — the thread turns into a broader referendum on whether the current AI investment wave is a durable platform shift or a bubble waiting to deflate.