Hacker News

Top Story

The most significant and heavily discussed post of the day is the active Shai-Hulud supply chain worm, which hijacked the GitHub account of the maintainer behind the ubiquitously used keyv library. This catastrophic attack has poisoned packages with over 2 billion monthly installs to deploy an obfuscated credential-stealer targeting AWS, Kubernetes, npm, and Slack secrets, triggering an existential crisis across the JavaScript dependency tree.

Front Page Highlights

The AI Demand Bubble · wheresyoured.at Ed Zitron drops a devastating financial critique exposing that 70% to 75% of AWS, Azure, and Google Cloud’s AI-driven revenue growth is generated by Anthropic and OpenAI, who are themselves propped up by billions in circular equity investments from those exact same hyperscalers. The HN crowd is deeply unsettled by these numbers, debating whether this is the largest capital misallocation in business history and pointing out that removing these two VC-dependent labs reveals a catastrophic lack of organic, enterprise-wide demand for AI compute.

The Judgment Reservoir · shannph.com This deeply philosophical essay warns that the frantic pace of AI-driven execution is hollowed out from the inside, hollowing out human critical thinking and hollowing out the “whitespace” of seasoned builders’ intuition. HN readers are heavily sharing and discussing this post, identifying with the narrative of experienced architects and VPs of Engineering leaving companies because their hard-earned, unquantifiable system judgment is dismissed in favor of rigid metrics and AI-generated options.

Don’t stop early: Case-folding source code at memory speed · github.blog GitHub’s engineering team details a beautifully counterintuitive compiler optimization: removing an early-exit break from their ASCII search loop actually boosted throughput by over 15x, allowing full SIMD auto-vectorization on an Apple M4 at over 45 GiB/s. Low-level performance enthusiasts on HN are eating this up, discussing how branchless code can be a massive win for vectorization even when it forces redundant writes, while praising the elegant engineering of their custom casefold Rust crate.

FIPS 140-3 is not a security guarantee, and auditors know it · 808bits.com An HSM expert pulls back the curtain on cryptographic compliance, revealing that over 90% of enterprise customers run FIPS-enabled HSMs with the mode disabled because FIPS restrictions break critical modern protocols. Commenters are swapping compliance battle stories, noting how FIPS’s rigid self-test and entropy rules have repeatedly introduced critical vulnerabilities (like the 2019 YubiKey entropy reduction bug) while freezing software in a vulnerable state due to NIST’s grueling validation delays.

Twenty Years of Pandoc · pandoc.org John MacFarlane shares a beautifully written memoir reflecting on twenty years of Pandoc, which began as a procrastination project in 2006 to learn Haskell and grew into the world’s most popular Haskell application supporting 3,876 distinct conversions. The community is celebrating the tool’s milestone, reflecting on the elegant ergonomics of Haskell’s algebraic types for document trees and praising MacFarlane’s incredible dedication to resolving over 7,300 GitHub issues over two decades.

The Sound of Inevitability · panoptica.com This sharp derivatives autopsy dissects the swift rise and fall of Leopold Aschenbrenner’s fund, Situational Awareness LP (SALP), which exploded to $25B on a highly levered, concentrated bet on AI hardware before liquidating to Citadel after losing two-thirds of its assets in a week. The post strikes a chord with HN’s finance and trading contingent, who are debating Kelly criterion bet-sizing math, the unyielding mathematical reality of leverage in a highly volatile market, and why “leverage plus concentration” always guarantees a run-in with market makers pricing liquidity.

Show HN & Launches

We’re seeing an incredible wave of local-first optimization launches today. On the client side, Swiftlet dropped a Swift + Metal runtime that streams routed experts on-demand from SSD to run a 35B Qwen model in just 2.5 GB of RAM on an iPhone 17. For local training, Soup introduced exact layer streaming, letting developers run memory-safe QLoRA and DPO fine-tuning on an 8B model on a 4 GB laptop GPU by streaming layers from host RAM. Finally, cMCP launched an open-source gateway that intercepts and enforces Model Context Protocol (MCP) tool-call policies inside a hardware-isolated Trusted Execution Environment (TEE).

Discussion & Debate

The thread around AI-Generated Images Discourage Me from Reading Your Blog turned into a massive cultural bikeshed, with readers arguing that generic Midjourney art has become a primary warning sign of low-effort, AI-generated “slop” text. While some creators defended these images as a harmless necessity for non-artists, the overwhelming community consensus favored raw MS Paint drawings or plain, unadorned typography as badges of genuine human writing.

🔍 The sources are packed with details on low-level performance, AI economics, and security failures. What would you like to drill into next?