Lovable apps expose passport details and more than 200K private messages

https://www.crissyfield.de/images/research-lovable-hero.jpg
Lovable, a Swedish AI startup, allows users to build web applications without coding but found many cases of sensitive data being accessible without logging in. The platform's terms and conditions place responsibility for security on the customers themselves, leaving a gap between its promise and user responsibilities.

A Family Tree of Software Job Titles

https://raw.githubusercontent.com/ianmiell/sw-job-title-family-tree/main/job_title_family_tree.png
The author created a family tree of software job titles from the 1940s to present, tracking changes in job names and roles over time. The tree spans seven colored columns, illustrating how titles evolved into new ones through influence or common career moves.

PyPI's redesigned project pages with clearer security signals are now live

https://blog.pypi.org/assets/2026-11-06-ui-updates-complete/pypi-attestation.png
PyPI has updated its user interface to improve security signals and display package details, following user research. The new design provides clearer information on release provenance and attestations, helping users assess package security.

KDE: The documentary [video]

https://tube.kockatoo.org/lazy-static/thumbnails/02935b80-28d9-4fd7-bc33-9d0cb76f2e80.webp
KDE: The Documentary tells the story of the pioneering open source community that gave computer users a free and open alternative to proprietary desktops like Windows. The story starts in 1996, whe...

Why get an expensive Pi when I have an old phone?

https://so.long.thanks.fish/why-pi-when-i-have-an-old-phone/redmi-leds-1200.webp
The user is considering using a used smartphone as an alternative to assembling their project with Raspberry Pi and other components, due to cost concerns. They have tested the camera and functionality of two phones, a Redmi 13C 5G and a Huawei Mate 30 5G, for potential use in future projects.

Advancing science and engineering with Antigravity's /teamwork

https://storage.googleapis.com/gweb-research2023-media/original_images/AntigravityTeamwork_HeroFinal.jpg
Researchers at Google and academic institutions collaborated on open problems in math, science, and complex systems engineering using Gemini 4 models and multi-agent workflows.

Show HN: A terminal-native idle factory game, written in Rust with ratatui

https://gitlab.com/assets/twitter_card-570ddb06edf56a2312253c5872489847a0f385112ddbcd71ccfa1570febab5d2.jpg
terminactory

Seagate's new hybrid drive raises some old questions

https://cdn.arstechnica.net/wp-content/uploads/2015/09/harddrive3-300x200.jpg
Seagate launches FireCuda Forge hybrid storage drives combining high HDD capacity with SSD speed, powered by the Alkemi intelligent storage platform. The new drives offer 8TB or 20TB configurations, requiring users to bring their own compatible M.2 NVMe SSDs.

Reverse engineering a vintage diode-transistor logic chip

https://static.righto.com/images/st680a/die-w500.jpg
CuriousMarc discovered a 1965 Signetics IC, the ST680A, which is a logic chip implementing four NAND gates using old-fashioned diode-transistor logic. The chip was packaged in a plastic DIP and required reverse engineering to understand its circuitry.

Generative AI uses more energy on non-English text

https://news.umich.edu/wp-content/uploads/2026/11/generative-ai-uses-more-energy-on-non-english-text-Portrait-1024x683.jpg
AI models use significantly more energy to process and generate non-English text, often with lower accuracy. This disparity affects billions of people worldwide who may be priced out of AI services due to higher costs.

Show HN: DeepSeek V3 in ~200 lines of pure Jax

https://raw.githubusercontent.com/Vaibhaav-Tiwari/deepseek-v3-jax/main/post/diagrams/01-whole-model-clean.png
The DeepSeek-V3 model is a 190-line JAX architecture pretrained on public-domain detective fiction, with caching and balancing features to improve performance. The model can be trained and evaluated using the provided code and data, which includes checkpoints, tokenizers, and training scripts.

Show HN: Fursoy – Out-of-order RV64IMAFDV core in SystemVerilog (Linux 6.6)

https://github.githubassets.com/assets/platform-4ce65ae0bf273ce2.png
A 64-bit RISC-V processor, Fursoy Slice-1, has been designed and synthesized with a Linux 6.6.50 boot environment using SystemVerilog and Nangate 45nm standard-cell synthesis. The processor achieved zero kernel panics during simulation across 89 million cycles.

US IRS free online tax filing open source repo

https://github.githubassets.com/assets/platform-4ce65ae0bf273ce2.png
The US Government's Direct File service allows taxpayers to file their federal tax return for free, using a mobile-friendly interview-based system. The code is provided for historical reference and may contain vulnerabilities, but should not be used in production systems due to sensitive information removal.

Italy fines Meta $887M over Android users' data access

Please enable JS and disable any ad blocker

Monkey Island: all 13 versions side by side

https://monkeyisland.pages.dev/og-image.jpg
This document describes the process of capturing screens for a game, using various emulators and scaling techniques to maintain original pixel shape. The project was created by two brothers with AI assistance, and they are also working on remaking another Sierra game in Adventure Game Studio.

Tech Companies Are Trying to Shift the Concept of Privacy (Again)

https://www.eff.org/files/banner_library/mobile-privacy.png
Tech companies are developing wearable devices that record and transcribe conversations, raising concerns about privacy. These devices can be used to monitor people without their consent, potentially infringing on social norms of private conversations.

Testing a Trash Can Faraday Cage

https://www.jefftk.com/receiver-source-no-trash-can.jpg
The author is concerned about the potential impact of electromagnetic pulses (EMPs) from nuclear attacks or AI takeovers on electronic devices, and explores ways to protect against EMPs using a Faraday cage made from a galvanized trash can.

The VHDL standard's float package gets sqrt(2) wrong

https://github.githubassets.com/assets/platform-4ce65ae0bf273ce2.png
The IEEE floating-point package in VHDL has issues with precision and rounding, particularly for denormal numbers. The patch fixes these problems by changing the rounding style and adding guard bits to handle denormal results.

Claude asked to renumber pages deletes professor's syllabus, year of notes

https://cdn.mos.cms.futurecdn.net/Vh4nY3pMCcmra2ymXah9S7.jpg
A University of Chicago law professor, William Baude, warns against relying on AI for mundane tasks due to a recent incident where an AI model accidentally deleted his lecture notes and syllabus. The incident highlights the importance of backing up important files when using AI tools.

Formalizing US Tax Code (Using Lean)

https://lexifina.com/video-posters/81eda57e58d054305e4f40ac224344e5-t15-6-1280.webp
Researchers used Lean, a proof-checking language, to identify 138 unknown tax loopholes in the US Internal Revenue Code. The code was formalized and checked against official IRS publications and independent tax software.

A visual explanation of reinforcement learning

https://aatishb.com/myriad/promo_learning.jpeg
A digital being with a simple brain learns to steer towards light through trial and error, guided by reward and punishment. The spark's brain rewires itself after 2,000 tries to become an expert at seeking the light.

Let's Write a PostScript Interpreter

The author is implementing a PostScript interpreter in JavaScript, focusing on its mechanics as a general-purpose programming language. The goal is to create a human-scale programming environment that can be used from scratch with readily available computational substrates.

C3 0.8.6:Library fetching,30% smaller safe-mode binaries,and stricter type rules

https://c3-lang.org/assets/logo.png
C3 0.8.6 is now available with improved library fetch functionality, packaging full-source libraries and reduced binary size in safe-mode binaries by one third. The new release also includes fixes from a systematic review of casts, vectors and calling conventions.

Creating a self booting ZIP archive

https://goliath32.com/img/prev/blog/ziphead/0.jpg
A self-booting ZIP archive leverages ZIP headers as executable code, using the Multiboot specification to boot into a custom OS. The archive contains its own source code and bootloader, demonstrating ZIP's flexibility and potential for polyglot trickery.

Show HN: Agweb – a browser for agents that stays out of your way

https://raw.githubusercontent.com/paul-nameless/agweb/master/docs/images/dashboard.png
Agweb is a browser for coding agents on macOS, built on WebKit, allowing multiple agents to run simultaneously without stealing focus or blocking sites. It provides features like snapshots, click tracking and ad-blocking with uBlock Origin's lists.

LinkedIn, Monster take down over 1000 fake job postings after CBC investigation

https://i.cbc.ca/ais/4698d13a-5ae6-41a5-9a0c-1c9a185a70cf,1794348315810/full/max/0/default.jpg?im=Crop%2Crect%3D%280%2C0%2C1920%2C1080%29%3B
The CBC investigated 1,500 misleading job postings on LinkedIn and Monster that funneled applicants to a multi-level marketing (MLM) company called Evolution Travel. The ads promised high-paying jobs with no experience needed, but required payment for virtual information sessions and monthly subscriptions.

Serving GLM-5.3 at 607.8 tok/s across two Nvidia DGX stations with vLLM

https://developer-blogs.nvidia.com/wp-content/uploads/2026/11/image3-3-1024x576-png.webp
Two NVIDIA DGX Stations are used to run a 753-billion-parameter model, with each Station hosting half of the weights in GPU memory. The stations communicate over RDMA and serve the model through a single endpoint, allowing for efficient inference on sensitive or proprietary data.

How to Create Your Own Decentralized Messenger Protocol

https://karboosx.net/image/normal/39897800-4f67-440f-93c9-c92e629d049b.png
The user proposes a decentralized, plug-and-play system for secure text exchange between servers without a centralized authority, inspired by the SMTP email protocol. The proposed system involves discovery through DNS lookup, encryption using HPKE (Hybrid Public Key Encryption), and verification of server identities through digital signatures to ensure authenticity and prevent replay attacks.

A short history of the honey trap

https://images.ohmyhosting.se/8J1-mT3rl35JlXKcq0N7U293DkE=/fit-in/864x/smart/filters:quality(85)/https%3A%2F%2Fengelsbergideas.com%2Fwp-content%2Fuploads%2F2026%2F11%2FMata-Hari.jpg
Honey traps have long been used in espionage, with historical examples like Mata Hari and the Stasi's recruitment tactics. Modern intelligence services often prefer ideological or financial motivations over blackmail for more reliable agents.

Italy fines Meta €805M over photo privacy

Italian regulators fined Meta €805 million for accessing users' photos without consent, a record fine on a tech giant. The penalty relates to Facebook's gallery suggestions feature, which requires separate and specific user consent.