Top 9 Hacker News posts, summarized
HN discussion
(354 points, 576 comments)
A cyberattack has disrupted refrigeration control systems at major supermarket chains across France, Belgium, and the Netherlands. The attack targeted Danfoss-made controllers used by retailers including Intermarché, Leclerc, and Coopérative U in France, forcing refrigeration units into continuous defrost cycles at 50°C — normally a two-hour daily process — causing a "wave of heat" and spoiling perishable goods. Coopérative U's president called the incident "extremely serious," with early losses estimated at 300,000 euros and potentially reaching millions. In the Netherlands, Albert Heijn, Etos, and Gall & Gall experienced website outages, delivery disruptions, and compromised electronic shelf labels and loyalty programs. Belgium's Delhaize chain, owned by Albert Heijn, also reported issues. It remains unclear whether the French and Dutch incidents are related.
Commenters overwhelmingly questioned the necessity of internet-connected refrigeration systems, arguing that remote monitoring could be achieved without exposing control functions to the public internet. Several noted that the exploited Danfoss vulnerabilities (AK-SM 720/850) were disclosed by Claroty in August 2026, yet many devices remained directly accessible via 3G/4G SIM cards without adequate protection. The attack drew comparisons to a nearly identical incident at U.S. military commissaries in late August 2026, raising speculation about whether the same actors or copycats were involved. While some highlighted the legitimate efficiency gains of remote diagnostics and centralized management, others emphasized that the security risks — now realized — far outweigh those benefits. A few commenters suggested AI-based anomaly detection could mitigate such attacks, though others countered that the fundamental issue is unnecessary attack surface.
HN discussion
(482 points, 256 comments)
Meta has launched the Muse Wonder series, comprising Muse Wonder and Muse Wonder Full, positioning them as its most capable models for personal and professional agentic tasks. The models introduce two core capabilities: Active Memory, which retains and retrieves relevant user context across conversations, and Active Focus, which sustains effort on complex, long-running tasks by adapting approaches and seeking clarification when needed. Both models are available immediately via the Meta Model API and Muse Code, with Muse Wonder Full restricted to Muse Code subscribers. Trained at Meta's gigawatt-scale Prometheus data center, the series achieves state-of-the-art results on benchmarks covering domain expertise (law, finance, health), coding (SWE-Marathon), and agent focus (FocusBench). Meta emphasizes that stronger base models enable better generalization to out-of-distribution tasks, and highlights safety investments including robustness to adversarial instructions, careful private information handling, and CBRN/cyber misuse safeguards aligned with its Superintelligence Scaling Framework.
HN commenters noted Muse Wonder's reported second-place benchmark ranking behind Opus 5.5, but questioned the extent of "benchmaxxing" and the validity of Meta's "personal superintelligence" branding, which many found hyperbolic. Pricing drew attention: at $4/$20 per million tokens in/out, Muse Wonder Full matches Opus pricing, marking a departure from Meta's previous discount strategy. Safety concerns emerged around a cited ~3% violation rate for mishandling personal information, deemed unacceptably high for a personal agent. Several users reported usability issues with Muse Code's sandbox environment on Mac and Linux. Broader themes included skepticism about open-weight releases (none announced), surprise at Meta's sudden frontier-model emergence after years of open-weight focus, and speculation that commoditization of frontier capabilities could pressure competitors like OpenAI and Anthropic.
HN discussion
(397 points, 217 comments)
Codex CLI version 0.157.0 introduced a persistent, self-updating background daemon that starts by default when any interactive session is launched. The daemon (`codex app-server --managed-daemon`) runs detached from the terminal, persists after all Codex windows close (reparented to PID 1), and copies the entire ~374 MB platform package into `~/.codex/packages/app-server-daemon/releases/` — decoupling the backend version from the user's package-manager-installed CLI. A separate updater process (`pid-update-loop`) checks for updates every hour and restarts the daemon, which can kill active turns. The daemon inherits the environment (e.g., `HTTPS_PROXY`) of the first session that started it, causing later sessions to use stale proxy settings. Hooks receive the daemon's working directory instead of the session's. The `daemon stop` command fails to stop the updater process. Users report the CLI is unusable on Windows without `--no-daemon`. The reporter requests making `daemon_auto_start` opt-in (default false), having the daemon exit when the last client disconnects, and avoiding self-update/copy when installed via a package manager. A workaround involves disabling the feature flag, stopping the daemon, killing the updater, and removing the package directory.
Commenters are divided: some defend automatic background updates as standard practice (comparing to browsers and Claude Code, which uses a similar daemon model), while others criticize the behavior as malware-like, citing unbounded disk usage (one user reported 12 GB), environment leakage, XDG spec violations, and the daemon persisting without consent. Several users share workarounds: setting `daemon_auto_start = false` in `~/.codex/config.toml` or wrapping the CLI with a bash function that forces `--no-daemon`. The VS Code extension is also described as brittle, with frequent regressions despite near-daily releases. A recurring theme is frustration with "move fast and break things" in AI tooling, with some users migrating to minimal harnesses (e.g., hax) or sandboxing tools via bwrap/VMs to regain control.
HN discussion
(380 points, 216 comments)
Unable to fetch article: No content extracted (possible paywall or JS-heavy site)
The discussion centers on significant skepticism regarding the reliability and deployment of GLM-Legal, a domain-specific model from Chinese lab Z.ai. Commenters highlight the persistent risk of hallucinated case law, noting that human review may fail to catch fabrications, potentially leading to judicial sanctions. Benchmark performance is heavily criticized, with references to roughly 20% accuracy on the Harvey benchmark and reports of flawed evaluation rubrics, leading practitioners to dismiss the tool as currently useless for litigation requiring novel reasoning. Because the model appears proprietary and accessible only via z.ai, data privacy concerns are paramount; users warn that uploading sensitive legal data to a Chinese server with no extradition treaties poses severe confidentiality and privilege risks, compounded by reported certificate errors on the site.
Beyond technical flaws, the thread debates the structural impact on the legal profession. While some predict lawyers will secure "gilded" roles merely rubber-stamping AI output, others argue the liability framework for AI errors remains dangerously undefined. Commenters question the model's jurisdictional scope (US, Chinese, or European law) and suggest judges—also overloaded—might benefit from similar tools, though accountability remains a blocker. A cynical undertone views the legal industry as rent-seeking gatekeepers automating menial work, while others see a market opportunity for "professional AI" that is legally accountable and accurate, provided the hallucination problem is solved.
HN discussion
(284 points, 236 comments)
A Harvard study analyzing data from over 700 software firms and 700,000 employees (2021–March 2026) finds that AI coding agents increase raw code output—30% more lines of code, 20% more commits, and 23% more pull requests—but do not translate into higher software delivery rates. Issue and epic resolution rates tracked in Jira showed no statistically significant change. The researchers attribute this to a "bottleneck" in code review: review cycles lengthen, pull requests require more revisions, and reviewers leave substantially more comments. Efficiency gains during coding are absorbed by downstream constraints in the production process, with no evidence of increased firm-level software output or reduced employment.
Commenters widely question the study's current relevance, noting its data reflects 2025-era models (Claude 3.5, GPT-4.1, Gemini 2.5) and early adoption phases before organizations adapted review processes. Several argue the bottleneck is organizational, not technical: average 7-day PR review times indicate pre-existing cultural issues, and startups adopting "no-human-review" policies may prove the model. Others highlight that AI generates excessive test code and repetitive implementations without refactoring, inflating LOC metrics. A recurring theme is that lines of code is a poor productivity proxy; median metrics would be more meaningful. Some disagree with the conclusion entirely, citing personal experience of dramatically increased software output for hobby and internal tools. The abstraction-layer analogy (assembly→C→AI) suggests trust will evolve over time, while security risks and non-determinism remain concerns for agentic workflows.
HN discussion
(341 points, 149 comments)
The author describes building marketyour.games, a commercial web product with user accounts, search dashboards, folders, Stripe payments, and Postmark emails—all implemented as a single statically linked C binary served via CGI on OpenBSD. The stack (BCHS: OpenBSD, C, httpd, SQLite) uses no framework, templating language, separate database server, or container. Every request spawns a fresh process; deployment is atomic file replacement with zero downtime. OpenBSD's pledge/unveil and httpd's default chroot provide sandboxing. Dependencies are limited to libcurl and libsodium (vendored). Static assets are compiled into the binary. The author argues CGI's historical drawbacks (process fork cost) are obsolete on modern kernels, and the model resembles serverless without vendor lock-in. The minimal supply chain (C compiler + three libraries) reduces attack surface. Development uses plain Vim with mature tooling (sanitizers, gdb, ctags). SQLite eliminates database operational burden. The author wrote custom CGI utilities (cgi.h) and suggests a need for shared drop-in libraries like stb. The approach is deemed feasible for production and preferable for its simplicity.
Commenters debated the choice of C over memory-safe languages like Go or Rust, which offer similar deployment simplicity with memory safety. Several noted CGI's fork overhead (~8ms) and suggested FastCGI or pre-forking models for higher concurrency. SQLite's concurrent write handling under CGI was questioned. The blog's readability and design drew criticism. Historical corrections emerged: Perl dominated early CGI, not C, and early PHP (3/4) filled a similar niche as a thin C wrapper. Alternatives cited include Go binaries with embedded templates, nginx CGI wrappers, Passenger for Rack, and busybox's built-in CGI support. One commenter shared a PHP-to-C transpiler achieving 10-50x speedups via rope strings and parallel JSON. The author's custom cgi.h prompted sharing of existing CGI libraries. Overall, the discussion highlighted nostalgia for CGI's simplicity but skepticism about C's ergonomics for web development in 2026.
HN discussion
(194 points, 253 comments)
The author argues that AI systems are rapidly surpassing humans in cognitive work due to three factors: dramatically improving performance across perception, reasoning, and autonomous action; falling costs from massive investment and scientific progress; and continuous availability without human limitations like fatigue. This mirrors past technological revolutions where machines transformed physical necessities (hunting, calligraphy, woodworking, horse riding) into leisure hobbies. The author predicts thinking will similarly decouple from economic necessity and become a recreational pursuit. Resistance from knowledge workers and government regulation will be fierce but ultimately ineffective. To navigate this transition, the author advises embracing AI advances, cultivating adaptability and resilience, and building a fulfilling life where thinking is pursued for its own sake rather than for livelihood.
Commenters express deep skepticism about whether current LLMs constitute genuine "thinking," describing them as powerful autocomplete tools that increase cognitive load by requiring constant verification and architectural oversight. Many argue thinking has already become optional for masses reliant on algorithmic curation of daily life, while others warn the economic implications are underestimated: if AI replaces all cognitive and eventually physical labor, the hobbyist future assumes a post-scarcity distribution that lacks political pathway. Several note the "jagged intelligence" of LLMs—superhuman in narrow domains but failing unpredictably elsewhere—and emphasize that responsibility and novel creativity remain human domains. A recurring theme is the risk of skill atrophy and dangerous dependency, with some invoking Asimov's "The Feeling of Power" as cautionary tale. Philosophical voices reframe thinking as instrumental to living well rather than an end in itself, while others assert collective agency to simply choose not to automate ourselves into irrelevance.
HN discussion
(256 points, 138 comments)
This project demonstrates PlayStation 2 games running in a browser without traditional emulation by statically recompiling the game's Emotion Engine machine code into C++, compiling it to WebAssembly, and linking it against a reimplementation of the PS2's operating system and hardware that renders via WebGPU. Two titles have been successfully brought up: Gran Turismo 4 (PAL) runs at a steady 50 fps at 2× native resolution on a laptop's integrated GPU, and God of War II holds 60 fps at native resolution (48–60 fps at 2×). The recompiler (eerecomp) translates the executable in 16 KiB units, preserving PS2 quirks including 128-bit registers, branch delay slots, non-IEEE floating point behavior, and vector unit (VU) semantics. The EE kernel is high-level emulated (threads, semaphores, DMA, VBlank, SIF), while the IOP runs the game's own IRX modules on an R3000 interpreter with its kernel and libraries reimplemented in C++. VU1 microprograms are compiled ahead-of-time to SIMD C++ or JIT-translated to WebAssembly on first use, modeling pipeline delays and PS2 float rules. The Graphics Synthesizer's 4 MB VRAM lives on the GPU in native swizzled layouts; drawing uses WebGPU compute shaders that implement GS rasterization rules, enabling render-to-texture and palette-reinterpretation effects. Performance optimizations reduced compute dispatches from ~650 to ~80/frame, a 16 MB GPU texture cache cut per-frame upload data by ~60%, and fixing shader divergence and browser scheduling (MessageChannel vs. setTimeout, dedicated workers) stabilized frame rates. God of War II exposed several bugs unseen in GT4: a recompiler branch-at-unit-boundary error, VU1 clip flag timing (3 vs. 4 instructions), missing IOP timer, BIOS boot path, and scratchpad DMA chain mode. The build process (port.sh) takes an ISO, performs static analysis plus exploration runs to discover all reachable functions and VU programs, and produces a web page (~3.5 minutes for GoW2 on an 8-core laptop). The page requires WebGPU, cross-origin isolation headers, and SharedArrayBuffer; a native runner (Vulkan via wgpu-native, SDL2) is also built. No game data is distributed—users provide their own disc images—and the generated code is considered the game owner's IP.
Commenters expressed strong technical interest in the static recompilation approach, particularly how timing-sensitive hardware like the vector units is handled without cycle-accurate emulation (danxbuild). Several noted the project still interprets the IOP's R3000 CPU rather than fully recompiling it (krystalgamer). Platform support requests included Steam Deck (spwa4), legacy hardware targeting OpenGL 2.1 (anthk), GitHub Pages hosting (simonmales), and mobile (kodablah referenced a similar PS Vita ARM-to-WASM project working on Chrome Android). The role of AI in accelerating such recompilations was discussed—some credited AI for the recent surge (CodeCompost, zuInnp, Hyperlisk), while others raised security concerns about trust and malware in recompiled binaries versus vetted traditional emulators (aceazzameen). Legal and ethical questions surfaced: hosting would effectively distribute games (khalidkhair), and the ease of "stealing" games via recompilation might undermine studio incentives (Elizer0x0309). Misconceptions appeared (Forza on PS2, 3DS emulating PS2), and a practical bug was noted: the build script doesn't escape spaces in game names (Altern4tiveAcc). Hyperlisk shared a parallel Go-based recompilation effort focused on accuracy, and gitowiec awaited a Modern Vintage Gamer video.
HN discussion
(232 points, 82 comments)
The author presents "zt," a type-safe HTML templating library for Zig inspired by Templ (Go) and Ziex (JSX-like Zig framework). Templates are written in `.zt` files with Zig-like syntax, parsed and transpiled to Zig code during `zig build`, enabling direct import between templates and application code for full compile-time type safety. The generated code writes directly to `std.Io.Writer` with zero allocations and no intermediate state. Key safety features include automatic HTML escaping for all dynamic values (both text and attributes), URL scheme validation for `href`/`src`, explicit opt-in for raw HTML via `{!value}`, and mandatory proper element closing. Template errors surface as Zig compiler errors with source location mapping back to the original template. Control flow uses plain Zig (`if`, `for`, `switch`), components are reusable via `@children` for layout wrapping, and the design integrates with the author's Dusty web framework. An open syntax question remains: block-level control flow currently uses bare Zig keywords (causing ambiguity with text like "if you..."), and the author is considering switching to `@if`/`@for`/`@switch` prefixes.
Commenters drew comparisons to similar approaches in other languages: Rust's `rsx!` macros (Dioxus), Java's jte.gg, Kotlin's kotlinx.html (an eDSL with HTML-spec compliance), and Google Soy templates. Several noted historical irony—web development in C/C++/Perl was standard in the 1990s before scripting languages dominated. One user demonstrated M4 macros as a minimal templating alternative. A Ziggit thread was linked highlighting `std.Io` cancellation bugs in the standard library. Practical questions arose about comparison to `zmpl` (another Zig templating engine), IDE support trade-offs with custom file formats, and desire for hot-reloading tooling akin to Go's `air`. One commenter shared their own Kotlin template compiler (tempolin) that generates typed template classes, while another argued raw string interpolation suffices without dedicated template engines.
Generated with hn-summaries