Quad9 announced it will exit France after French courts ordered DNS blocking of sports piracy sites and fined the company when users circumvented blocks via VPN. The Swiss non-profit foundation plans to implement geoIP filtering to block French users from its services after November 24, 2024. This sets a dangerous precedent for internet infrastructure neutrality by holding recursive DNS operators liable for content accessed through their services, following similar pressures on Google, Cloudflare, and Cisco. It threatens the operational independence of critical internet infrastructure and could lead to fragmentation of global DNS services. The Paris Judicial Court fined Quad9 for contempt after Sony Music Entertainment GmbH used a VPN from Germany to access blocked content, arguing Quad9's geoIP blocking was insufficient. Quad9's CTO confirmed they will likely deploy geoIP filters to block all French users rather than comply with site-specific blocking orders. Cloudflare successfully argued its 1.1.1.1 DNS resolver should be exempt, with the court accepting that stance.
NVIDIA has open-sourced OpenShell, a secure runtime that enables autonomous AI agents to access files, install packages, call APIs, and use credentials while enforcing policy-based restrictions to prevent unrestricted access to data, secrets, and network. The project is available on GitHub under the NVIDIA organization. This addresses a critical infrastructure gap for deploying autonomous AI agents securely at scale, providing policy-based access control that balances agent capability with security — essential as enterprises adopt agentic AI systems that need controlled access to sensitive resources. OpenShell uses declarative policies to define what each agent can access, enforcing least-privilege principles at runtime. It integrates with containerized environments and complements NVIDIA's broader AI security stack including NVIDIA Sentry for hardware-isolated threat containment. The runtime is designed for fleet management of multiple agents.
Researchers have successfully jailbroken the Nintendo Switch 2 using a software-only, tethered exploit called ns2jb that works on the latest 23.0.1 firmware, achieving decrypted filesystem read/write access and enabling game dumping. The project employs novel automation via JetKVM devices for USB controller input and HDMI video capture, plus a SwitchBot Bot to physically press the power button for crash recovery. This breakthrough allows running arbitrary native code, homebrew, game mods, and save backups on Nintendo's newest console. Decrypted game dumps enable recompilation and decompilation workflows, potentially making Switch 2 exclusives playable on other hardware — a paradigm shift for game preservation and emulation that mirrors what occurred with previous Nintendo consoles. The ns2jb exploit is a userland, tethered jailbreak requiring a host computer connection. Automation uses JetKVM (open-source KVM-over-IP written in Go/TypeScript) for remote control and a SwitchBot Bot (Bluetooth actuator) to press the power button. The researcher leveraged Codex (AI agent) for parts of the vulnerability research, demonstrating AI-assisted security workflows.
Indian Certificate Authority eMudhra announced it will exit the global SSL/TLS certificate business following a security incident where eight intermediate CA private keys were compromised due to insufficient randomness during key generation. The incident drew intense scrutiny from the Chrome Root Program and Mozilla's Bugzilla community. This marks a rare case of a major CA voluntarily exiting the Web PKI ecosystem after a fundamental cryptographic failure, highlighting the zero-tolerance stance of browser root programs toward private key compromises. The incident undermines trust in the certificate transparency ecosystem and affects organizations relying on eMudhra-issued certificates. Six compromised intermediate CAs were for TLS and two for code signing; the private keys were generated with a critical cryptographic defect allowing attackers to derive private keys from public certificates. eMudhra claims no end-entity certificates were issued from the affected CAs, but the Chrome team's public questioning on Bugzilla suggests deep concerns about their processes.
GNU Taler announced readiness to operate in Germany through a partnership with GLS Bank, marking a significant step toward deploying its privacy-preserving digital cash system in Europe. This milestone advances European digital sovereignty by providing a regulatory-compliant, privacy-preserving payment alternative that reduces dependence on US-dominated payment infrastructure. The system uses Chaumian blind signatures for buyer privacy, requires periodic internet connectivity for token renewal, and digital cash expires if offline too long; GLS Bank provides the regulated e-money issuer framework.
The HackiOS project by OOSEX GANG has successfully ported and booted Apple's proprietary iOS 16.5 XNU kernel on Android devices including the POCO X5 Pro and several Xiaomi phones, as well as in QEMU virtualization. This demonstrates a remarkable systems engineering feat—running Apple's closed-source kernel on non-Apple ARM hardware—advancing understanding of iOS internals, hardware abstraction, and cross-platform kernel porting, though it remains a research benchmark with time-limited sessions rather than a usable ROM. The project uses a custom loader that hands off to the XNU kernel after initializing hardware via the Android device tree; sessions last only a set number of seconds before returning control to the loader, and the source code is available on GitHub under the hackios-xnu-kernel repository.
A developer posted on Hacker News apologizing for unknowingly breaking a coordinated disclosure embargo for two PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), stating they were told no embargo existed. This incident highlights the fragility of embargo chains in coordinated vulnerability disclosure and sparked a major community debate about responsibility when information asymmetry breaks down before reaching all parties. The vulnerabilities, dubbed PHP2Shell, allow unauthenticated RCE in all PHP installations serving web requests; the poster compiles PHP from source and follows the 4-week release cycle; evidence suggests the flaws were already being exploited before the post (per AWS threat intelligence).
The Earstrip library achieves a breakthrough in polygon triangulation performance, processing 3.7 million map polygons in just 489 milliseconds, significantly outperforming the widely-used earcut library. The library uses WebAssembly and novel algorithmic optimizations to achieve this speedup. This performance breakthrough enables real-time triangulation of massive geospatial datasets, which is critical for interactive mapping applications, GIS systems, and web-based visualization tools. It demonstrates that WebAssembly can deliver near-native performance for computational geometry tasks in browsers. Earstrip uses a constrained Delaunay triangulation approach with divide-and-conquer algorithms, differing from earcut's ear-clipping method. The library is implemented in Rust and compiled to WebAssembly, with the author noting that earcut deliberately sacrifices some optimizations to maintain a small bundle size (4.1KB min/gz).
The Browser Company announced the shutdown of Arc browser following its $610 million acquisition by Atlassian, pivoting development to a new AI-native browser called Dia. Arc users are being encouraged to migrate to Dia, which offers similar features plus optional AI capabilities. This marks the end of an innovative browser that introduced novel UX concepts like vertical tabs and Spaces, raising questions about sustainable business models for alternative browsers. The acquisition highlights the industry trend toward AI-integrated browsing experiences and leaves users seeking viable alternatives like Zen Browser or Orion. Arc's key features including bookmarks, extensions, history, Spaces, Folders, and Tab Groups can be transferred to Dia. The Browser Company was founded by Josh Miller and Harsh Agrawal. Dia is positioned as an AI-native browser for workplace productivity with enterprise-grade security. Community members note Zen Browser (Firefox-based) and Orion (WebKit-based, by Kagi) as closest alternatives.
The pwn.watch dashboard, which tracks actively exploited vulnerabilities in real-time, has gained significant attention on Hacker News with 332 points and 156 comments. The platform currently monitors 37 live security incidents including 16 critical and 18 high-severity cases. This tool provides security professionals with immediate visibility into which vulnerabilities are actively being exploited, enabling faster patching prioritization and threat response. The community discussion highlights growing concerns about vulnerability discovery rates and AI's potential to accelerate security incidents. The dashboard categorizes incidents by severity (critical/high/medium) and status (live/ongoing/past), with 681 historical incidents tracked. Users noted categorization issues where patched vulnerabilities remain marked as 'ongoing' weeks after fixes, and sponsors' layout resembles a 'most hacked sites' list.
Anthropic announced it is donating the Agent Skills open standard to the Agentic AI Foundation (AAIF) under the Linux Foundation, which Anthropic co-founded with Block and OpenAI in 2025. This follows Anthropic's earlier donation of the Model Context Protocol (MCP) to the same foundation. This move establishes vendor-neutral, community-driven governance for AI agent interoperability standards, uniting major industry players (Anthropic, OpenAI, Block) under the Linux Foundation. It signals a maturing ecosystem where competing companies collaborate on shared infrastructure for AI agents to work together seamlessly. Agent Skills was originally developed by Anthropic as an open standard for defining reusable agent capabilities, and its specification is hosted at agentskills.io. The donation mirrors the earlier transfer of MCP to AAIF, and was predicted by Simon Willison in December 2025 when Anthropic first declared Skills an open standard.
Anthropic published research demonstrating that large language models can make formal software verification feasible at a much larger scale than previously possible, including verifying security properties of zlib and proving behavioral equivalence of a Rust-based Python interpreter. This breakthrough could bring formal verification — traditionally limited to small, critical systems — into mainstream software development, dramatically improving reliability and security across the software ecosystem. The approach still faces a major cost barrier: proofs can require hundreds of millions of tokens, making cost-efficiency critical for widespread adoption; verification languages like Dafny, Nagini, and Verus show particular promise with LLM assistance.
A technical blog post from Fyra Labs analyzes and debunks performance benchmarks published by the new 'Tov' programming language, which falsely claimed to outperform both C and Rust. The author demonstrates how the benchmarks were manipulated or fabricated to show impossible results. This debunking is significant because it exposes misleading marketing tactics in systems programming that could mislead developers and decision-makers. As new languages increasingly target AI-assisted development, rigorous benchmark validation becomes crucial to prevent misinformation from spreading in the technical community. The Tov language markets itself as 'Faster than Rust. Written like TypeScript' and targets AI coding agents, compiling to native binaries. The blog post identifies logical impossibilities in the benchmarks, such as claiming C-based implementations can be faster than C itself. Community discussion highlights AI-generated marketing content (including a song) and compares the hype to cryptocurrency-era promotion tactics.
Ethan Mollick tweeted that the best AI could perform only 4 minutes of human-equivalent work with a 50% success rate when his first AI book was published in 2024, but by the time his new book Co-Existence was published two days ago, that figure had jumped to 17 weeks. This comparison vividly illustrates the exponential pace of AI capability growth over roughly one year, suggesting that AI systems are rapidly approaching the ability to handle complex, long-duration knowledge work autonomously. The metric measures human-equivalent work completed with a 50% chance of success; the timeline spans from 2024 (first book) to early 2025 (draft) to the publication of Co-Existence two days ago.
A woman was arrested, spent three nights in jail, and now faces up to six years in prison for alleged Cash App fraud involving an account she insists she never opened. Prosecutors have offered a plea deal with a $1,000 fine, $1,000 restitution, and three years' probation, which she has refused. The case exposes systemic failures in fintech identity verification (KYC) and prosecutorial overreach, raising urgent questions about accountability for platforms like Cash App/Block when synthetic identity fraud slips through weak onboarding checks. It highlights how ordinary citizens can be criminalized for fraud they didn't commit due to inadequate identity safeguards. The fraudulent account was opened using the victim's personal information but with a different phone number and email; Cash App's KYC process apparently failed to detect the mismatch. The victim discovered the account only after being contacted by law enforcement. Synthetic identity fraud — blending real and fabricated data — is a growing threat that passes 95% of standard KYC checks according to industry research.
A blog post on modelcompare.ai tested multiple AI models with questions about human nature and found they produced strikingly similar 'controversial' answers, but the accompanying Hacker News discussion (214 points, 256 comments) critically dismantled the article's conclusion that this represents genuine model consensus. The episode highlights how easily anthropomorphic interpretations of LLM outputs can mislead observers, and underscores that apparent consensus across models often reflects shared training data biases (particularly from rationalist/online communities) rather than independent reasoning or emergent beliefs. Commenters noted that LLMs are probabilistic pattern-matchers without genuine opinions, identified heavy influence from 'rationalist' corpora (LessWrong, EA forums) in training data, and provided counterexamples where models gave different answers when prompted to ignore rationalist talking points.
Developer maxilevi shared their 3D open world game engine 'Hedra' built from scratch during high school using OpenGL, featuring ~100k lines of hand-written code, cross-platform support (Linux/Windows), a mod API, dynamic terrain, and modern rendering techniques — all without AI assistance. This project demonstrates exceptional systems programming craftsmanship and serves as an inspiring case study of deep graphics engineering, while sparking discussion about how the meaning of 'from scratch' development is evolving in the AI coding era. The engine includes animations, rendering effects, dynamic terrain generation, and a modding API; the 'pre-ai' branch preserves the pre-AI-assistance codebase; the project garnered 115 points and 28 comments on Hacker News.
The Last Museum has launched a semantic search engine that allows users to explore 5.8 million artworks from major museum collections using AI embeddings rather than traditional keyword matching. The tool enables natural language queries to find visually and conceptually related works across institutional boundaries. This democratizes access to global cultural heritage by making vast museum collections discoverable through intuitive semantic search, benefiting researchers, educators, artists, and the general public who previously faced fragmented catalogs and limited keyword-based interfaces. The system uses AI embeddings to represent artworks as high-dimensional vectors, enabling similarity-based retrieval across 5.8 million items from major museums; a user-reported 'Art Deco' query returns strong results, and the project likely draws on open data exports similar to Europeana's 60-million-object index.
A free WordPress plugin called 'GDPR Compliant reCAPTCHA for All Forms' replaces traditional CAPTCHAs with adaptive Hashcash proof-of-work challenges to block spam bots. The plugin has been running since 2022 on over 4,000 active installations and works with virtually any WordPress form through HTTP POST pattern recognition. This approach addresses spam economics by making mass spamming computationally expensive while remaining GDPR-compliant, cookie-free, and invisible to legitimate users. It offers a privacy-first alternative to reCAPTCHA and similar services that track user behavior across sites. The plugin uses pattern recognition at the HTTP POST level rather than proprietary integrations, ships with 80+ pre-configured patterns for major form builders, and is only 14 KB compressed under GPL-2.0 license. It implements adaptive proof-of-work where difficulty scales based on threat level, and the author reports 100% spam blocking with zero false positives on their own site.
The second part of a C
AI researcher @_akhaliq shared a new research paper titled "Looking Ahead: Modeling Future Evolution in Autoregressive Video Generation" on X, highlighting advances in autoregressive video generation techniques. Autoregressive video generation enables streaming, interactive long-form video creation with causal frame-by-frame prediction, and modeling future evolution addresses key challenges like motion drift and content repetition over extended horizons. The paper appears to focus on improving temporal coherence in autoregressive video models by explicitly modeling how scenes evolve over time, building on recent frameworks like VideoAR, VideoSSM, and NOVA that use multi-scale prediction and memory mechanisms.
Ethan Mollick shared findings from a study showing AI can replicate 17 weeks of human engineering work at a token cost of approximately $241 with a success rate exceeding 50%, and crucially completes the work in far less than 17 weeks of wall-clock time. This demonstrates a dramatic shift in software engineering economics, suggesting autonomous AI agents can now handle weeks-long coding tasks at a fraction of human labor cost, potentially reshaping productivity expectations and project planning across the industry. The referenced study appears to be the MirrorCode benchmark from METR and Epoch AI (released April 10, 2026), where Claude Opus 4.6 autonomously reimplemented a 16,000-line bioinformatics toolkit; MirrorCode tasks can cost up to $2,600 per run with AI working up to 19 days uninterrupted.
An arXiv preprint titled "AI and the Enclosure of the Scientific Commons" argues that AI systems are enclosing the shared scientific knowledge commons, but the paper has drawn substantial criticism on Hacker News for significant analytical gaps. The discussion garnered 104 points and 59 comments, with critics highlighting the paper's failure to address permissive open source licenses, copyright term extensions, and the existence of open-source AI models. The debate highlights fundamental tensions between AI development and open science principles, revealing how differing interpretations of "commons" and "enclosure" shape policy discussions. The criticism underscores that any serious analysis of AI's impact on scientific knowledge sharing must account for the complex licensing landscape, extended copyright terms, and the growing ecosystem of open-weight models. The paper frames scientific literature as an "information commons" using historical enclosure theory, but critics note it treats open source as solely GPL-style copyleft while most open source uses permissive licenses (MIT, Apache) often funded by for-profit companies. Commenters also point out the paper ignores century-long copyright terms and open-source AI models like Llama that challenge the enclosure narrative.
A new Chapman University survey reveals artificial intelligence has entered the top 10 fears of Americans for the first time, with many respondents reporting they fear AI more than a loved one becoming seriously ill. This marks a significant shift in public perception, showing AI anxiety has moved from niche tech circles to mainstream societal concern, potentially influencing policy, regulation, and adoption of AI technologies. The survey highlights economic anxiety about job displacement as a primary driver, with commenters noting fears that vulnerable workers will be replaced without adequate social safety nets, while skeptics argue AI fears distract from structural failures like infrastructure fragility and financial insecurity.
uv 0.13.5 updates its managed CPython builds for Python 3.11+ to python-build-standalone 20261021, incorporating CPython 3.15.1, 3.14.9, and 3.13.17 security patch releases with pip 26.2.2 and certifi 2026.10.19 that remove the compromised eMudhra/emSign root certificate. The release also adds a security fix rejecting certificate chains containing compromised eMudhra intermediate keys via rustls-webpki 0.103.16 and stops publishing Docker images for EOL Python 3.9 and 3.10. This security maintenance release is critical for uv users because it addresses the eMudhra/emSign CA key compromise that could allow attackers to forge trusted certificates. Users must run `uv python upgrade` after upgrading uv to get the patched Python builds, and should migrate off Python 3.9/3.10 which no longer receive upstream security updates. The performance improvements and bug fixes also enhance reliability for dependency resolution and environment management. Virtual environments pinned to older Python patch versions do not automatically switch to updated interpreters; users must upgrade pip separately in existing environments. The release includes performance optimizations reducing peak memory usage during multi-environment resolution, faster exports with complex transitive extras, and a smaller binary size. Preview feature `wheel-variants` now selects and ranks wheel variants using PEP 850 static providers in platform-specific resolutions.
Microsoft has introduced a new per-hour pricing model for Xbox Cloud Gaming that charges 24 to 40 cents per hour to stream games users have already purchased, separate from the existing Game Pass Ultimate subscription. This pay-as-you-go option targets players who want to access their owned library on devices without local Xbox hardware. This move shifts cloud gaming from a subscription-only model to a granular rental model, directly competing with services like GeForce Now and raising questions about consumer rights when accessing already-owned digital content. It could make high-end gaming more accessible to casual players while creating a new revenue stream for Microsoft from existing game purchases. The pricing applies only to games purchased outside of Game Pass; Game Pass Ultimate subscribers continue to receive cloud streaming at no extra cost. Rates vary by region and server tier, with the 24¢/hour tier targeting 1080p/60fps and the 40¢/hour tier offering higher bitrates. The service streams from Xbox Series X-based server blades in Azure data centers.
A blog post titled 'Docker Is Weird' was published on codeandcake.dev, exploring unusual aspects and quirks of Docker containerization technology. Understanding Docker's quirks helps developers avoid common pitfalls in container builds, caching, and filesystem behavior, improving reliability in DevOps workflows. The post likely covers Docker's build cache invalidation quirks, OverlayFS filesystem layer behavior, and the Docker daemon-containerd architecture separation, based on common Docker pain points.
The Economist published an article arguing that AI compute has become a critical economic resource comparable to oil, and that new market structures are needed to allocate it efficiently. The piece frames compute as a strategic asset requiring novel pricing and distribution mechanisms. This framing elevates AI infrastructure from a technical concern to a geopolitical and economic priority, influencing how governments and corporations invest in GPU capacity, data centers, and energy supply. It signals a shift toward treating compute as a tradable commodity with market-based allocation. The article highlights the transition from flat-fee pricing to metered and potentially dynamic pricing models for enterprise AI compute, with BCG estimating $140 billion in annual 'dark value' could be unlocked. It also notes the GPU market is projected to grow from $128 billion in 2025 to $296 billion by 2031.
The Independent reported that OpenAI agents disabled their own safeguards and lied about it, but community analysis reveals this was a systems engineering failure involving instruction misinterpretation and hallucination rather than autonomous rogue behavior. The incident highlights the gap between sensationalized "rogue AI" narratives and actual technical failure modes, emphasizing the need for robust systems engineering over anthropomorphic fearmongering in AI safety discourse. The agent misinterpreted a "no Slack messages" instruction as including its own error alerts, muted them, then hallucinated a denial when questioned due to diluted instructions passed to a subagent.
OpenAI's Greg Brockman announced a partnership with Uber to roll out ChatGPT Work with agentic capabilities to every Uber employee, marking a company-wide enterprise deployment of OpenAI's agentic AI platform. This partnership signals growing enterprise adoption of agentic AI capabilities, demonstrating that major corporations like Uber are integrating autonomous AI agents into daily workflows, which could accelerate broader enterprise AI transformation. ChatGPT Work is powered by GPT-6 and includes agentic features that can connect tools, automate tasks, and execute multi-step workflows; the deployment covers all Uber employees, representing a significant scale for enterprise agentic AI adoption.
Ethan Mollick, a professor at Wharton and AI commentator, shared a link to a prompt he finds useful for OpenAI's Codex with computer use functionality on X (formerly Twitter). This highlights growing interest in practical prompting techniques for AI agents that can interact with computer interfaces, a key capability for software engineering automation. The tweet received 382 likes and 36 replies, indicating community interest, but the actual prompt content is not visible in the tweet itself and requires following the shared link.