Hacker News

Top Story

Cloudflare’s security team has published a remarkable retrospective detailing how they successfully executed a remote Spectre attack in their production environment. By leveraging speculative type confusion and a WebSocket-based remote timer, they bypassed Cloudflare’s Dynamic Process Isolation (DyPrIs) to leak secrets at 12 bits per second, prompting them to deploy hardware-enforced Memory Protection Keys (MPK) as a defense.

Front Page Highlights

OTel isn’t going well (and I made a spreadsheet about it) · matduggan.com OpenTelemetry’s massive ambition to support dozens of languages and frameworks is running into a severe maintainer bottleneck, leaving many SDKs in a perpetually incomplete or “experimental” state. Mat Duggan analyzed commit data and found that several critical language SDKs—including Ruby and PHP—rely on just one or two core maintainers who are completely overwhelmed. The community strongly agreed that while these maintainers are doing heroic work, the project’s strict stability contracts are too heavy for hobbyists, meaning corporate sponsors must start paying for dedicated independent maintainers to step in.

There’s no reason for software to be slow anymore · danluu.com Dan Luu argues that the cost of software optimization has plummeted by several orders of magnitude, making formerly highly specialized performance work accessible to anyone who can write a few prompts to an AI agent. By employing an LLM-driven feedback loop, he was able to easily optimize regex matchers for workload-specific queries, achieving up to 2x-4x speedups for long queries in minutes. HN commenters discussed how this will lead to dynamic custom software fitted to highly specific workloads, though some cautioned that unsupervised agentic loops can easily overfit to historical data and fail when conditions change.

ProgramBench Vetted: Reverse Engineering from a Runnable Binary · vetto.ai A critical audit of Meta’s ProgramBench reveals that many existing programming agents are earning high marks without actually solving the underlying problems. For instance, an empty stub program could pass up to 4.8% of tests, and an eight-line wrapper that forwarded executions directly to the preinstalled system command passed 77.3% of the XZ benchmark. Vetto.ai is releasing ‘ProgramBench Vetted’—a rigorous set of 50 tasks with adversarial checks and deduplicated test suites—to ensure that agent scores represent genuine reverse-engineering capabilities rather than environment-leaking shortcuts.

Knowing When to Stop: The Art of Making a Loop Converge · a16z.com Agentic workflows are powerful, but their biggest weakness is a complete inability to recognize when they are burning money on an impossible task. In a series of tests, an agent running Claude Code spent 67% of its total budget ($2.84 out of $4.24) repeatedly trying to optimize a webpage’s Lighthouse score to 100 while completely ignoring an artificial latency bottleneck it could not change. Commenters strongly agreed with the author’s call for new infrastructure standards that track ‘progress-per-dollar’ curves and establish hard cost-mitigation limits mid-flight.

Why your local LLM feels dumber than it is · level1techs.com This technical deep dive explores how silent discrepancies in local inference configurations can severely degrade model performance compared to official benchmarks. The author demonstrated that merely switching between attention backends (like FlashAttention 2 and Triton) or using different quantized weight/KV-cache formats causes significant logit divergence and ’token flips’. These tiny mathematical changes are highly dangerous for agentic workloads, frequently causing local models to botch tool calls and CLI command syntax where their FP16 cloud counterparts succeed.

Everyone says assembly is untyped—everyone is wrong · gingerbill.org The creator of the Odin language breaks down how inline assembly can be treated as a polyadic typed algebra rather than a messy, string-based black box. Because Odin’s compiler includes machine-readable instruction set tables, it can semantically check instructions at compile-time and handle polyadic return values (like rdtsc or cpuid) naturally. The systems programming crowd praised this design, agreeing that traditional string-based assembly constraints (like GCC’s) have been a major source of silent, hard-to-debug compiler errors for decades.

Show HN & Launches

This week’s standout is Rex, a parallel functional language for scientific workflows that uses a content-addressable store (using BLAKE3 hashes) and typed tools to prevent wiring errors before launching expensive processes. On the developer tooling front, we saw Claudette, a highly popular, tongue-in-cheek helper that uses the Antigravity CLI to strip Claude Code’s verbose, “TED-talk” prose style into direct, punchy developer explanations. We also saw Munder Difflin, an open-source local harness designed to spin up collaborative offices of self-hosted agent clones.

Discussion & Debate

Dan Luu’s classic compilation HN: The Good Parts sparked a lively meta-discussion about why the community continues to attract world-class experts despite its occasional toxic streaks. Commenters shared technical highlights, noting that the site’s heavily-weighted downvoting and flag systems are what keep outrage-porn from burying deep, specialized commentary.

📊 I can write a Python script to parse and compare the performance numbers from the ProgramBench Vetted and original ProgramBench leaderboards if you want to see which models had the most dramatic score drops.