后续更新：“×读”软件的2位开发者因侵犯著作权罪，均被判刑，处罚金。退缴超100万
两天前，涉案的 Legado 项目主页发布了公告： 然后删除了全部代码。 现状 从原文的时间线来看，「张先生在一家国内头部数字阅读平台担任法务，该公司与大量网络小说作者签订了独家授权协议。2023年1月4日，在发现“×读”软件侵权行为后，张先生当即报案。」 以及开发者的 GitHub 动态页面： 2 ⌘ Read more

Show HN: Open-source private home security camera system (end-to-end encryption)
Hey everyone,

I previously introduced an open source private home security camera in 2024, which uses OpenMLS for end-to-end encryption: https://news.ycombinator.com/item?id=42284412.

It was called Privastead then and it’s now renamed to Secluso.

John Kaczman found my project from here and has been working on it with me over the last year and half. We’ve made a lot of improvements to the software, which w … ⌘ Read more

CVE-Bench: testing LLM agents on real-world vulnerability patches
Article URL: https://giovannigatti.github.io/cve-bench/

Comments URL: https://news.ycombinator.com/item?id=48328088

Points: 3

# Comments: 1 ⌘ Read more

[$] A trademark dispute over MeshCore
MeshCore is a relatively new project, started in January 2025, that aims
to build a scalable mesh network using low-power long-distance radios. While
many other projects of the same general nature have been tried before, MeshCore
grew quickly because of its more efficient message routing and enthusiastic
community. In early 2026, an early proponent of the project made a sudden shift
that left the rest of the community stunned and embroile … ⌘ Read more

Nesbitt: Protestware for coding agents
Andrew Nesbitt has written a blog\
post detailing a recent incident with the jqwik library for property-based testing
in Java. On May 25, the 1.10.0 release of jqwik included a change
that attempts to instruct coding agents to disregard previous
instructions and delete jqwik tests and code.

I think this is a new class of supply-chain input worth ke … ⌘ Read more

Show HN: AISlop, a CLI for catching AI generated code smells
Hi, I’m Kenny, I’ve been building aislop. I starting working on this after using Claude Code, codex and opencode several times and noticing some slops. They aren’t syntax and passes most tests, they are patterns like empty catch blocks, useless comments, duplicated helpers, dead code and many more. So I built a tool to scan and check for these patterns and wired it into hooks so after each tool call, the agent checks for the slops.

You can try it out with npx aislop sca … ⌘ Read more

Is AI causing a repeat of Front end’s Lost Decade?
Article URL: https://mastrojs.github.io/blog/2026-05-23-is-AI-causing-a-repeat-of-frontends-lost-decade/

Comments URL: https://news.ycombinator.com/item?id=48321631

Points: 6

# Comments: 1 ⌘ Read more

Python utility package for building Claude Code hooks
Article URL: https://github.com/RasmusGodske/claude-hook-utils

Comments URL: https://news.ycombinator.com/item?id=48318978

Points: 5

# Comments: 0 ⌘ Read more

Creusot helps you prove your Rust code is correct
Article URL: https://github.com/creusot-rs/creusot/tree/master

Comments URL: https://news.ycombinator.com/item?id=48309645

Points: 5

# Comments: 0 ⌘ Read more

How to Quickly Warm Up Your MacBook
Article URL: https://z3ugma.github.io/2019/11/18/warm-up-your-macbook/

Comments URL: https://news.ycombinator.com/item?id=48300342

Points: 8

# Comments: 2 ⌘ Read more

On Labubu and the Hyperreal
Article URL: https://2earth.github.io/website/20260525.html

Comments URL: https://news.ycombinator.com/item?id=48299335

Points: 3

# Comments: 0 ⌘ Read more

Claude Code as a Daily Driver: Claude.md, Skills, Subagents, Plugins, and MCPs
Article URL: https://arps18.github.io/posts/claude-code-mastery/

Comments URL: https://news.ycombinator.com/item?id=48289950

Points: 8

# Comments: 0 ⌘ Read more

Show HN: Posthorn, self-hosted mail without the mail server
Introducing Posthorn, a self hosted email gateway. One docker container (or Go binary) between every self hosted app on your VPS and your transactional email provider. Set up Posthorn once, point your apps to it, done.

I was trying to deploy Ghost on a DigitalOcean droplet and found that DO and many different VPS services have started to block the default SMTP ports to try to combat the various types of abuse they get. To actually configure my app, I had to hack to … ⌘ Read more

Gear Commit: Dev gadget box personalized from GitHub activity
Article URL: https://gearcommit.nanocorp.app/

Comments URL: https://news.ycombinator.com/item?id=48288761

Points: 5

# Comments: 0 ⌘ Read more

Security updates for Tuesday
Security updates have been issued by Debian (postorius and spip), Fedora (bind, bind-dyndb-ldap, linux-firmware, tor, and unbound), Mageia (ffmpeg, nginx, perl-Imager, and tigervnc, x11-server, x11-server-xwayland), Oracle (firefox and kernel), Red Hat (buildah, git-lfs, go-toolset:rhel8, golang, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, gvisor-tap-vsock, java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, opentelemetry-collector, osbuild-composer, podman, rhc, rhc-wo … ⌘ Read more

GitHub Actions down again today
Article URL: https://www.githubstatus.com/?today

Comments URL: https://news.ycombinator.com/item?id=48278374

Points: 25

# Comments: 0 ⌘ Read more

GPT Guesses Between 1 and 100
Article URL: https://github.com/exmergo/research-chatgpt-guesses-between-1-and-100

Comments URL: https://news.ycombinator.com/item?id=48265745

Points: 12

# Comments: 3 ⌘ Read more

The Eternal Sloptember
Article URL: https://geohot.github.io//blog/jekyll/update/2026/05/24/the-eternal-sloptember.html

Comments URL: https://news.ycombinator.com/item?id=48263238

Points: 41

# Comments: 5 ⌘ Read more

GitHub Copilot & Claude Code Helped With Graphics, WiFi Linux Driver Issues This Week
For those curious about the growing use of AI and coding agents within the Linux kernel, this week there was another large batch of new patches fixed that were generated or co-authored by agents like Claude Code and GitHub Copilot… ⌘ Read more

DeepSeek reasonix, DeepSeek native coding agent with high caching and low cost
Article URL: https://esengine.github.io/DeepSeek-Reasonix/

Comments URL: https://news.ycombinator.com/item?id=48256953

Points: 16

# Comments: 7 ⌘ Read more

CC-Wiki: Turn Claude Code sessions into a shareable knowledge base wiki
Article URL: https://github.com/tejpalv/cc-wiki

Comments URL: https://news.ycombinator.com/item?id=48250126

Points: 4

# Comments: 1 ⌘ Read more

Models.dev: open-source database of AI model specs, pricing, and capabilities
Article URL: https://github.com/anomalyco/models.dev

Comments URL: https://news.ycombinator.com/item?id=48241172

Points: 3

# Comments: 0 ⌘ Read more

Launch HN: Superset (YC P26) – IDE for the agents era
Hey HN, we’re Avi, Kiet, and Satya. We’re building Superset ( https://github.com/superset-sh/superset), an open-source agentic IDE for running coding agents like Claude Code, Codex, OpenCode etc in parallel.

Demo: https://www.youtube.com/watch?v=YWDHn7gUwfg

Try it: https://superset.sh/

We’re three engineers who’ve built and maintained large codebases, and we k … ⌘ Read more

Show HN: ShadowCat – file transfer through QR Codes in a Browser
Article URL: https://github.com/unprovable/ShadowCat

Comments URL: https://news.ycombinator.com/item?id=48234287

Points: 6

# Comments: 1 ⌘ Read more

The case against boolean logic
Article URL: https://abuseofnotation.github.io/boolean-thinking/

Comments URL: https://news.ycombinator.com/item?id=48234128

Points: 5

# Comments: 0 ⌘ Read more

Tell HN: I’m tired of AI-generated answers
I found GitHub repositories that were spreading malware. I asked AI what I should do about it, but it gave me nothing useful. So I opened a discussion on GitHub. Someone replied. It was literally the exact same text the AI had given me. I called it out and the comment was deleted. Then another person replied. Same exact AI response again.

I worked as a developer in a company. I asked the business owner a question about a business task. He sent me a ChatGPT screenshot with the an … ⌘ Read more

Gemini randomly dumped its system prompt
Article URL: https://gist.github.com/mkaramuk/44a44d83178e632ec0dd1f02186d822c

Comments URL: https://news.ycombinator.com/item?id=48221976

Points: 13

# Comments: 0 ⌘ Read more

A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale
GitHub is just the latest victim of TeamPCP, a gang that has carried out a spree of software supply chain attacks that has impacted hundreds of organizations. ⌘ Read more

GitHub 被黑：员工装了一个 VS Code 插件后，3800 个内部仓库泄漏
昨日 GitHub 在 X 上确认：一名员工安装了被植入恶意代码的 VS Code 扩展，导致 GitHub 内部约 3800 个代码仓库遭泄漏。@Appinn 感谢 vlad 的提醒。 从 GitHub 确认的情况来看，一名员工安装了恶意的 VS Code 扩展程序后，其设备被攻破，约有 3800 ⌘ Read more

GitHub’s Internal Repos Breached Via Employee’s Use of Malicious VS Code Extension
Longtime Slashdot reader Himmy32 writes: GitHub has announced on X that their internal repositories have been breached through a compromised VS Code Extension on an employee’s workstation. Bleeping Computer reported that the attack is linked to TeamPCP who have been in the news for a recent campaign affecting Checkm … ⌘ Read more

FreshRSS 1.29.1 ⌘ Read more

CISA Admin Leaked AWS GovCloud Keys On Github
An anonymous reader quotes a report from KrebsOnSecurity: Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how … ⌘ Read more

pgBackRest will continue
In April, David Steele, maintainer of the popular pgBackRest backup and restore project for
PostgreSQL, announced that he had archived\
the project and it would no longer be maintained due to lack of
sponsorship. On May 18, he announced
that a number of sponsors have stepped forward to ensure its continued
development:

Over the last few weeks, a coalition of sponso … ⌘ Read more

An Entire Wikipedia That’s 100% AI Hallucinations
“Every link leads to an entry that does not exist yet,” explains the GitHub page for a Wikipedia-like site called Halupedia. “Until you click it, at which point an LLM pretends it has always existed and writes it for you, in the deadpan register of a 19th-century scholarly press…”

Every article is invented on demand. The footnotes are also lies… The hardest problem with an infi … ⌘ Read more

Three stable kernels for Thursday
Greg Kroah-Hartman has announced the release of the 7.0.7, 6.18.30, and 6.12.88 stable kernels. These kernels do
not include a patch for the Fragnesia local-privilege-escalation exploit that came to light on
May 13, but do include many other important fixes throughout the
tree. Users ar … ⌘ Read more

Yet another Dirty Frag type vulnerability: Fragnesia
Sam James has sent an announcement
to the OSS Security mailing list about another
local-privilege-escalation (LPE) exploit in the same class as Dirty Frag, called
“Fragnesia”. From the disclosure:

This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface … ⌘ Read more

npm 历史上首个蠕虫式供应链攻击：会自我传播
npm 出现了新攻击方式：TanStack Router 官方 npm 包被植入恶意代码。攻击者入侵了项目发布流程，上传了带后门的官方版本。这些包会窃取开发者电脑里的各种密钥，并尝试继续感染开发者拥有权限的其他 GitHub 仓库，再借 npm 进一步传播。 令人绝望的是：它绕过了现代 npm 生态 ⌘ Read more

Call Zig or C from Go without CGO for extra performance
1 points posted by pj ⌘ Read more

Two stable kernels with Dirty Frag fixes
Greg Kroah-Hartman has released the 7.0.6 and 6.18.29 stable kernels with Hyunwoo
Kim’s patch
for the second vulnerability ( CVE-2026-43500)
reported with Dirty Frag
an … ⌘ Read more

PlayStation3 Emulator Devs Politely Ask Contributors to Stop Submitting ‘AI Slop’ Pull Requests
Open-source PS3 emulator RPCS3 “has been around since 2011,” Kotaku notes, and has made 70% of the PlayStation 3’s library fully playable, “bolstered in part by the many users who contribute to its GitHub page.” But their dev team “took to X today to very kindly and civilly request that … ⌘ Read more

FreshRSS 1.29.0 ⌘ Read more

Four stable kernels with partial fixes for Dirty Frag
Greg Kroah-Hartman has announced the release of the 7.0.5, 6.18.28, 6.12.87, and 6.6.138 stable kernels. These kernels
contain a partial fix for the Dirty\
Frag and Copy Fail 2
security flaws. Kroah-Hartman … ⌘ Read more

groupcache clone feature TTL, explicit state, and many minor improvements.
1 points posted by Everton Marques ⌘ Read more

Dirty Frag: a zero-day universal Linux LPE
Hyunwoo Kim has announced
the Dirty\
Frag security flaw, a
local-privilege-escalation (LPE) vulnerability similar to the
recently disclosed Copy Fail
flaw:

Because the embargo has now been broken, no patches or CVEs exist for
these vulnerabilities. After consultation with the linux-distros@vs.openwall.org
maintainers, and at the maintainers’ re … ⌘ Read more

Security updates for Wednesday
Security updates have been issued by AlmaLinux (corosync, dovecot, image-builder, python-tornado, resource-agents, and systemd), Debian (openjdk-11, openjdk-17, and pyjwt), Fedora (pdns, pyOpenSSL, and squid), Slackware (hunspell), SUSE (alloy, avahi, bubblewrap, cmctl, coredns, curl, dpkg, firefox, golang-github-prometheus-prometheus, grafana, libpng12, PackageKit, sed, and xen), and Ubuntu (docker.io-app, nghttp2, python-django, and python-mako). ⌘ Read more

White House App Is a Terrifying Security Mess
New submitter spazmonkey writes: From a hidden GPS tracker polling your location every 4.5 minutes to JavaScript loaded from a random GitHub account, no SSL certificate pinning, and an in-app browser that silently strips cookie consent dialogs and paywalls from every page you visit, the new White House app seems to have a little bit of everything. A security researcher pulled the APK a … ⌘ Read more

NetHack 5.0.0 released
Version 5.0.0
of the NetHack
dungeon-exploration game, a distant relative of Rogue and
Hack, has been released. NetHack’s code is now compliant with the
C99 standard, and the release includes more than 3,100
bug fixes and changes, detailed in doc/fixes5-0-0.txt
… ⌘ Read more

I like the new GitHub:

Eden: NHS goes to war against open source
Terence Eden reports
that the UK’s National\
Health Service (NHS) is preparing to close almost all of its open-source repositories as a
response to LLM tools, such as Anthropic’s Mythos, becoming more
sophisticated at finding security vulnerabilities. He does not, to put
it mildly, agree with the decision:

The majority of [code repos … ⌘ Read more

[$] Version-controlled databases using Prolly trees
Modern database and filesystems make pervasive use of
B-trees, which are tree
structures optimized for storing sorted lists of keys and values on block
devices.
Dolt is an Apache 2.0-licensed project that makes clever use of a
variant of a B-tree to support efficient version control for an entire database.
The data structure it uses could well be of interest to other projects. ⌘ Read more