Hacker News

Top Story

After sixteen years pinned to Stackless Python 2.7, CCP Games announced it has officially begun migrating EVE Online’s 2.4-million-line codebase to modern Python 3. It is a massive, multi-stage engineering undertaking for a twenty-three-year-old MMO whose distributed simulation and player-driven economy have to remain live and running 23.75 hours every single day.

Front Page Highlights

I accidentally turned LLM memory into program analysis · pwning.systems Frustrated by long-running vulnerability research agents losing track of verified state and resurrecting dead hypotheses, the author built Lemmalog—a Datalog-backed memory engine that treats agent context as a deductive program analysis state. Instead of relying on fuzzy semantic search or bloated prompt transcripts, the engine tracks derivations, intervals, and provenance so that invalidating an earlier assumption automatically retracts every downstream conclusion. The post struck a chord with engineers weary of “vector vibe search,” particularly when benchmark results showed Lemmalog outperforming full-context models on knowledge updates while slashing prompt sizes by up to 38x.

Debian votes to allow “responsible use of generative AI” · lwn.net The results of Debian’s General Resolution vote on large language models are in, with developers adopting Choice 5 to permit generative AI tools provided contributors personally review, test, and take full responsibility for correctness and licensing. The thread caught fire because both hard-ban amendments were soundly rejected—failing to clear even the “None of the Above” threshold. While pragmatists cheered the rejection of unenforceable witch hunts, seasoned maintainers expressed anxiety that without mandatory disclosure, the burden of filtering machine-generated code and low-effort packaging diffs will accelerate maintainer burnout.

Just the rumour of a bug is enough to find an exploit these days · anil.recoil.org OCaml maintainer Anil Madhavapeddy recounts opening a routine public PR to patch a path traversal vulnerability in cohttp, only to observe automated scanners actively probing his live web server with the exploit pattern ten minutes later. The incident underscores a shift toward negative “mean time to exploit,” where automated LLM tooling enables attackers to weaponize vague commit hints or disclosure chatter before defenders can ship packages. The discussion zeroed in on “bugonomics”—the reality that LLM automation has vastly accelerated exploit generation while leaving human maintainer triage, review, and verification throughput completely flat.

Hunting Down a Go Runtime Bug on 32-Bit Embedded Systems · sigma-star.at An embedded systems team resolved an elusive Go runtime crash that had plagued long-running processes on 32-bit ARM and i386 Linux systems since Go 1.14 was released in 2020. Deep in netpoll_epoll.go, the runtime checked whether an epoll event belonged to an internal notification descriptor by casting the 8-byte ev.Data cookie to a 4-byte uintptr, inadvertently aliasing the descriptor’s address with a monotonic socket sequence counter on little-endian architectures. Beyond admiring the assembly-level sleuthing, HN commenters were quick to note the industry implication: the bug lingered for six years because Google itself no longer runs 32-bit Go binaries in production.

Sleepwalker: Passive Backdoor with Its Own Command Language · r136a1.dev This reverse-engineering post details a stealthy Windows backdoor masquerading as an ESET Management Agent DLL that opens zero listening ports and executes no outbound beacons. The implant resides inert in memory until a magic raw network packet or specially crafted DNS query arrives, delivering a payload formatted in a custom, 23-instruction bytecode language for scheduled tasks, VMware VMCI tunnels, and in-memory shellcode execution. Security engineers praised the breakdown of the bytecode architecture, while the comments lit up over the author’s head-to-head evaluation of frontier LLMs used to assist in the reverse-engineering process.

A better SQL in 11 lines of code · prela-lang.org UCLA researchers introduced Prela, an experimental declarative query language that abandons wide relational tables in favor of composable binary relations. By treating database columns as mathematical functions from IDs to values, complex joins are rewritten as clean function compositions (.select) and projections as tuple intersections (&), collapsing twenty-line SQL statements into readable pipelines. Commenters praised the mathematical elegance of treating relational algebra through functional composition, though database veterans remained skeptical about whether its execution model can match decades of cost-based SQL query optimizers.

You Know GDPR Is Good Based on Who Hates It · matduggan.com This essay argues that privacy regulations like GDPR should be judged by the caliber of their enemies: the ad-tech tracking cartels and surveillance capitalists who extract personal data without accountability. The author reframes obnoxious cookie banners not as regulatory failures, but as corporate malicious compliance designed to hide the sprawling surveillance apparatus humming behind every click. The comments sparked a sharp debate between European engineers defending user privacy rights and bootstrapped US founders frustrated by the disproportionate legal compliance overhead imposed on tiny web utilities.

Show HN & Launches

Several high-craft releases stood out today: OpenTIE and OpenXWA dropped open-source native reimplementations of classic LucasArts flight simulators, combining 1995 dynamic iMUSE audio with 1998 3D rendering backends running on SDL3, Vulkan, and Metal. Systems developers were treated to TurboKV, an embedded Rust key-value database using hardware AES acceleration for Bloom filters that clocked millions of durable write operations per second. Meanwhile, local-first enthusiasts welcomed StemDeck, a self-hostable desktop app and server for 6-stem AI audio separation running Demucs entirely on local GPUs without cloud telemetry or fees, and Tether, a C++ utility that uses the Bluetooth Apple Notification Center Service protocol to sync iMessage, notifications, and browser OTP autofill directly to Linux desktops.

Discussion & Debate

The standout conversations today centered on open-source sustainability in the age of automated pull requests, triggered by the Debian vote and an essay on AI slop flooding repositories. Maintainers swapped stories of receiving AI-generated PRs that merely tweak comment grammar or report synthetic low-severity vulnerabilities, all submitted by jobseekers gaming GitHub contribution graphs for recruiters. The broad consensus among developers was that the asymmetric cost of generating code versus verifying it is breaking the open-source social contract, fueling demand for cryptographically verified web-of-trust contributor rings to protect human attention.