Wednesday, 23 September 2026

ReBarUEFI is a DXE driver you inject into firmware so PCI Resizable BAR actually grows — the CPU can map more than a 256 MB window into GPU VRAM, which older boards never exposed and Intel Arc basically needs. You still want 4G decoding, maybe UEFIPatch to lift the 64-bit BAR caps, then ReBarState to pick a size (32 means unlimited, if it boots). Forty-five points because someone resurfaced a 2.3k-star firmware hack that is still how you get SAM on a Sandy Bridge box.

• ⚙️Systems
• 🟩GPU

California's Project Nexus put solar over working Turlock irrigation canals — three layouts, a $20 million state grant, 1.7 MW which is a rounding error next to their 56 MW desert farm. UC Merced figures 100 miles of the narrow ones could save water for about 2,700 households, and the shade actually drew a line of algae on the sun side when they drained the canal. Final report later this year; Contra Costa already said no because their canals run through backyards.

• 🔭Science
• 🪠Infra

Artificial Analysis parked Claude Opus 5.5 at Max on 58 Intelligence Index — well above the 25 median in its price bin — at $4/$20 per million tokens, 1M context, and 260M eval tokens versus an 88M median. Simon two-for-two ran the 128k thinking budget dry on a pelican SVG and never got a drawing; AA's own people point you at the Medium and High pages. I opened it for the cost-per-task number, then closed the Max tab.

• 🤖AI

Trail of Bits walks SAML as a 2002 OASIS kitchen-sink: XML signature wrapping, canonicalization that still eats parser diffs, and enveloped signatures stuffed inside the assertion you're hashing. The 2012 XSW paper is still the bug class; GitHub Enterprise got hit in 2025, and the pitch is stop onboarding it and go OIDC. I read it because the protocol ossified and the attacks didn't.

• 🔐Security
• 📜History

Two Tomahawks hit Shajarah Tayyebeh Elementary in Minab on Feb 28: at least 123 children, 150+ dead, the deadliest U.S. targeting error this century by child count. Pentagon investigators cite stale DIA coding, seven-year-old imagery, civilian-harm teams cut ~90%, a 1,000-target first day, and Centcom people expecting Palantir's Maven to flag intel it was never contracted to catch. I opened it because the HN title blames AI; the actual kill chain is a rotten target library plus haste.

• 🤖AI
• 🔐Security

WordPress 7.1.2 patches an unauthenticated path traversal in get_page_template() that can include a chosen local .php outside the theme — CVSS 9.2, and they backported the fix all the way to 4.7. You need a theme with a top-level page-* directory (Twenty Twelve/Fourteen, plus Neve, Hestia, Sydney) and a readable target like pearcmd.php with register_argc_argv On; official php Docker images qualify. I glanced because 'conditional RCE' still covers a lot of the public internet, and a courtesy backport that far is how you know the install base is still that old.

• 🔐Security

Unreal Labs open-sourced an agent harness that treats tool calls as fully async: log them in-progress, keep the model working, append the result later instead of burning tokens on polls. On GPT-6 Astra xhigh they match Codex on Terminal-Bench 4.0 (57.9%) at $1,428 vs $2,350, and they claim up to 40% cheaper than Codex / 20% vs Pi. HN immediately clocked the headline Pareto mixing xhigh vs Codex max — which they admitted was lazy — and that Codex already hot-loops for no reason; the Go SDK is on GitHub if you want the actual trick.

• 🤖AI
• 🦾Agents

Nathan Lambert posted his congressional briefing as a scoreboard: Chinese open-weight (GLM-5.3 / Kimi K3 around 44–45 on AAII) versus US Inkling at 26, Hugging Face downloads 3.2B China versus about half that US, OpenRouter ~80T tokens/week and 80%+ Chinese. He puts Chinese open-weight 2–5 months behind the closed US frontier, US open-weight 6–9 months back, and distillation as maybe 1–2 months of that gap. I read it for the arXiv scrape — Qwen in 30% of papers, Llama 21% — not another model drop.

• 🤖AI
• 🪺OSS
• 🌏Asia

The linked repo is just the example gallery; the stack is geatsc, a TypeScript-to-C++ AOT compiler with no JS engine, targeting ESP32/RP2350 plus iOS, macOS, Linux, Windows, and Xbox. They compile CSS/JSX to native — a CSS 3D cube at 60 fps on ESP32 with a custom 2D rasterizer — and a statically typed value that hits a dynamic carrier is a defect, not a fallback. HN is split between 'neat compiler' and 'AI-generated vaporware'; I clicked because fail-closed TS→C++ is the interesting part, even if the GitHub org is four months old.

• 🧩Compilers
• 🔩Hardware

Daniel Lu stood three hours at Muni Heritage Weekend with his custom line-scan camera — 10,000 lines/second, so moving people stretch instead of blur — and posted orthographic sides of 1912 Muni No. 1, the 1896 Dinky, a Blackpool boat, and a Melbourne tram. CC-By-SA on Commons; same guy already scanned HK trams and a Shinkansen. 152 points because the photos look like engineering drawings, then the thread drifted into whether SF should still fund vintage cars.

• 🛠️Hobby
• 🔩Hardware
• 📜History

JevBench v1.3 is a frozen MIT run: 534 English typed decisions, 220 of them held-out hard, scored as a geometric mean of Intelligence, Calibration, Speed, and Cost. TypeSafe's Jev 1.13.0 is still first at 74.4, but SemIf on Qwen3.5-4B is 73.1 and djev on DiffusionGemma is 73.0; GPT-5.6 Luna has the highest intelligence and still lands 14th on price. I looked because this is the first public protocol that actually names the clones instead of another demo wrapping Jev.

• 🤖AI
• 🪺OSS

Carson Gross argues that agent Markdown is source now, not docs, so the specs should live in `/src/md` next to the code they produce instead of dying in a chat log. Linear and tests still exist; the claim is locality — humans and agents stop hunting Notion for why a module exists. I glanced because consulting shops are already doing this with AGENTS.md, not because he invented a compiler.

• 🦾Agents

The Arcturus post says Jev is an LLM that reads true/false (or A/B/C) logprobs — the same first-token classifier OpenAI already uses for tool-calling — so OpenAI can copy the product and, more interestingly, fold calibrated snap judgments into a thinking block without leaving the GPU. TypeSafe's cofounder calls them a data lab; 100% of the training data is synthetic, which is the only moat this piece takes seriously. 254 points because Jev week needed a what-does-OpenAI-do thread, not because anyone shipped the in-model classifier.

• 🤖AI
• 👔Boardroom

Obscura relays WireGuard-over-QUIC to a Mullvad exit: they see your IP but not the inner packets, Mullvad sees the destination but not you. $8/month, account numbers instead of email, Lightning/Monero, client on GitHub; Carl Dong is in the thread saying you still have to trust they aren't colluding. I looked because it's iCloud Private Relay with a chosen hop, which is a real architecture even if VPNs that can't log show up every year.

• 🔐Security
• 🪠Infra

Greg Mays shipped Mathy, a free iOS/web drill app that is only for making already-learned math automatic — FSRS spacing, offline, no account, parameterized problem families with deterministic keys instead of LLM answers. It sits next to Math Academy as the Anki-for-trig-ratios thing, and the pitch is that if it works you open it less. Six points and no comments, so this is a side project landing, not a new way to learn math.

• 🧮Math
• 📱Pocket

A physics blog walks through why feeling hot and getting burned are different mechanisms: warmth is visible/IR heating water and melanin, sunburn is UV-B rearranging DNA, and UV-B at the surface is hundreds of times weaker than near-IR so you would not even feel it as heat. UV also falls off faster than IR away from noon, which is why late-afternoon sun can still feel scorched while the UV index has already dropped. The plots are pvlib SPECTRL2 over a clear Toronto sky, and the thread is people arguing vitamin-D windows versus the NZ-vs-Spain it-feels-cool-and-still-cooks-you heuristic.

• 🔭Science

The $1B Lucas Museum of Narrative Art opened in LA's Exposition Park — Ma Yansong's MAD cloud sitting on an old parking lot — with public doors on Sep 22. Inside it is 33 galleries of cave paintings, Rockwell, Kirby, and squirreled-away Star Wars props, after Chicago's lakefront and the Presidio both said no. HN is mostly this-is-the-idiosyncratic-billionaire-version-of-a-museum, plus relief it did not land in the Presidio.

• 🎭Culture
• 🎮Games

Google Labs is turning CC from a personal daily-brief agent into a household one: its own Google account, up to six people, shared calendar and tasks, and it will fill permission-slip PDFs if you let it. Under the hood each CC gets an isolated cloud computer on Antigravity plus Gemini, US-only waitlist, 18+. Three points and no comments, which is about right for a Labs family-logistics launch.

• 🤖AI
• 🦾Agents

Sitefire (YC W26) replicated StoryScope on company blogs: 2,250 pre-ChatGPT posts versus 11,250 mirrors from five frontier models, scored on 187 structural features with the wording stripped out. Held-out company split hits 98.0 macro-F1 and stays 98.1 after the same model rewrites 73% of the 13-grams; they also attribute the source 79% of the time versus a 17% chance rate. The tell is the tidy self-announcing post — 77% of AI pieces restated the thesis at the end versus 12% of humans — with the caveat that the humans are 2020–22 and the AI is August 2026.

• 🤖AI

Bloomberg is talking to people who got hooked on vapes and are now lighting cigarettes to quit — a cig has a start, an end, and you have to put on a coat. UK charity ASH surveyed 13k adults and cigarettes were the #2 'quit vape' method after patches and gum, used by about one in five. Researchers blame risk inversion: a lot of people think vaping is worse than smoking, so they pick the worse product on purpose.

• 🎭Culture

Bukowski, 1985: a list of machines that cannot read each other's disks — Mac, Radio Shack, C64, IBM, Kaypro, Osborne, Tandy 2000 — then the wind over Savannah and a turkey buzzard showing off. It keeps landing on HN because the incompatibility rant still maps onto walled gardens and the punchline is nature doesn't care. I glanced because it's a hobbyist's poem from the floppy era, not because the 8088 is news.

• 📜History
• 🛠️Hobby

Launch HN: Coverage Cat is a licensed brokerage that wants your personal agent to shop umbrella insurance via MCP instead of five lead-gen forms. Core customer is tech L3–L8; they're live in CA, FL, NY, TX, and WA, and they claim they'll recommend policies they don't take commission on. Thread is 'I just bundled it at GEICO' versus the founders arguing unbundled quotes can differ by $1000+, plus the obligatory rain-umbrella joke.

• 🦾Agents
• 💸Money

Settings on iOS now has persistent banners for iCloud+, Apple Music, Apple TV, and AppleCare+ — often no working dismiss, so the Settings badge hangs around for weeks unless you pay. Some people already on iCloud+ still get the iCloud+ promo, which is either a bug or the services P&L. 592 points of Jobs-wouldn't-want-ads; this is the Duo/18 Pro week leftover leaking into the OS, not a new product.

• 🍎Apple
• 📱Pocket

JavaScript is thirty and the essay is that we keep it as the destination while rewriting the toolchain in Rust, Go, and Zig so the bundler is a black box to the people who write the JS. The line that stuck: compiling JavaScript with Rust to produce JavaScript that runs in a C++ engine. HN's counter is my webpack still takes four minutes, so keep the milliseconds.

• 🪺OSS

Danielle Navarro is begging people not to send dplyr::ntile() to a regulator. It builds equal-sized buckets and breaks ties by row number, so identical weights can land in different "quartiles" depending on which study and dose came first in the table. I glanced because it's a tidyverse footgun with actual FDA-shaped consequences, not a style rant.

• 🧮Math
• 🪺OSS

GrapheneOS says Motorola is a real partner and 2027 flagships should be the first officially supported non-Pixel phones — plus there's a high chance some units will ship with GrapheneOS already installed, just probably not at launch and not from Motorola's own store. A reseller Motorola supplies, or GrapheneOS if they ever sell hardware; you can still unlock and flash it yourself. I looked because this is the Pixel-only lock starting to crack, which is the whole stack for a lot of people.

• 🔐Security
• 📱Pocket
• 🪺OSS

Nathan Barry asked whether gzip can be a language model and then actually built it: prime DEFLATE's 32 KiB window on a corpus, beam-search the next bytes that shrink the compressed size. Single-byte greedy fails because gzip only reports integer lengths, but looking ahead a span gets you vaguely Shakespeare-shaped junk after tiny Shakespeare. Compression-is-prediction is textbook; 370 points is the room going wait, the OS compressor?

• 🤖AI
• 🧮Math

Porsche is putting wireless charging on the Cayenne Electric for real: park over a pad, up to 11 kW, they claim about 90% efficiency, with sensors to abort if a cat or a coin lands on the coil. Orderable now in Germany and some of Europe. I don't care about the extra paint options — it's production inductive charging, not another concept video.

• 🔩Hardware

Sophia Wood was about to quilt a Mrs. Perkins' Quilt — fewest integer squares tiling an n×n — and got stuck on sewing: some optimal packings need L-seams you cannot guillotine-cut without a corner pucker. She started a sequence a(n) for the min L-seams on the squaring.net catalog: zeros until n=7 needs one, n=13 needs two, and she is poking OEIS about it. I opened it because it is a real combinatorial sequence born from puckering corners, not a puzzle-box lede.

• 🧮Math
• 🛠️Hobby

Max Woolf looped agents on criterion until Rust crates beat the usual libraries: his UMAP crate is 4–15× umap-learn and 2–4× umap-rs, no unsafe, and one physics run claimed 34,500× by turning the engine off. The recipe is a 1.2× pass/fail target, then overnight ur-prompt plus “c'mon, try a breakthrough” on GPT-6 Astra. I glanced because this is agents doing real optimization with receipts, not a fundraising demo.

• 🤖AI
• 🦾Agents

Nolen Royalty's Solitaire Alone Together is Windows 98 Klondike in the browser, except you can watch everyone else's cursor and bad draws and you cannot talk to them. He made it for Rhizome's 30th-anniversary gallery; at one point about 500 people were playing, and if you are alone you get ghosts of recorded games. I opened it for the lonely-together joke, not because draw-three got easier.

• 🎮Games
• 🎭Culture

Drop is a rootless Linux sandbox that feels like virtualenv: user/mount/net namespaces plus optional gVisor, host /usr stays, real home is hidden, localhost is blocked by default. mixedbit's third Show HN; the pitch is run coding agents with --dangerously-skip-permissions and contain a hallucinated rm -rf ~ or a supply-chain npm. Half the thread is other people shipping the same idea, which is why it is even on the board.

• 🔐Security
• 🪠Infra
• 🦾Agents

ArchiveBox finally shipped 0.9 after the last major drop in 2024: native iPhone/Android/desktop apps that talk to your server, optional PostgreSQL, 50+ capture plugins, plus merkle hashes, TLSNotary, and OpenTimestamps if you need the archive to hold up later. There's an MCP server, a SKILL.md, and a one-shot `abx-dl` CLI so you don't even spin up the full stack. I opened it because this is the self-hosted Wayback people actually run, not another bookmark landing page.

• 🪺OSS
• 🔐Security

One Minute Park is 60-second phone clips of parks around the world, not webcams, with a long-game of filling every minute of a day (1,440). You shoot landscape, no tripod, upload to an Are.na channel with date, time, and park in the title. Tiny Award 2024, 63 points, and the thread is already arguing about bitrate — I opened it because it's the anti-feed.

• 🎭Culture
• 🛠️Hobby

Discord is auto-sorting accounts into adult, teen, or unconfirmed from account age, activity, and which servers you're in — they say they don't read messages, and more than 90% of people never get asked. If the model gets you wrong, the fallback is a credit card via Stripe, Apple/Google age-range sharing, Google Wallet, AgeKey, or the usual ID/selfie with face staying on-device. HN is mad they're rolling it out globally instead of only where Texas and Brazil already forced them, and the Sept 2025 age-check vendor mess is why they keep repeating 'we only get the age group.'

• 🔐Security
• 🎭Culture

Show HN: a hosted Rete engine reads YAML rules and is the only thing allowed to say yes or no; RAG plus an LLM then write a cited explanation that cannot change the verdict. There's a no-signup demo across lending, fraud, clinical, and so on, an MIT MCP client, and the actual engine is closed. The one useful comment is the obvious one — if you already have the rules, just show which ones fired.

• 🤖AI
• 🦾Agents

Truman World is a shared live 'keep him from noticing the cameras' loop — MiniMax H3 Director for the video, GPT-6 Astra and a JEV planner on the page, and whoever's watching types the next scene. HN hugged it into a 4096-connection container error; when it worked, Truman was throwing fruit, yelling Pokémon names, and singing banana songs while someone tried to make him open trumanworld.live on his own phone. Fal lists that director model at $5/min, and comments say USDC is in the loop for paid prompts.

• 🤖AI
• 🎮Games

Artificial Analysis posted the scorecard for OpenAI's GPT-6 Sol (max): Intelligence Index 48, $2 in / $10 out per million tokens, 115 tok/s, 872k context. That's #18 in the pricey reasoning bucket, with a 102-second time-to-first-token because it thinks first. Eleven points and zero comments — the actual launch is already rank 1, so this is just the spreadsheet.

• 🤖AI

Ornn Data's paper argues older NVIDIA cards keep earning because open-weight demand is hardware-agnostic: at matching Artificial Analysis scores, the cheapest hosted open model was about a fifth the cost of a comparable closed one, and self-hosting on rented GPUs prints $0.12–$0.35 per million output tokens at full use. The spicy row is gpt-oss-120b on an A100 beating an H100 at spot and at 3- and 5-year rents, while five-year A100 term prices still hold 80% of the one-month rate. I opened it for those rental curves, not the Hugging Face acquisition footnote.

• 🟩GPU
• 💸Money
• 🤖AI

A SoME writeup that derives Schwarzschild geodesics in sympy.diffgeom, then drops a Runge–Kutta integrator into a GLSL fragment shader so each pixel traces a light ray backward in time around a black hole. The pictures are gravitational lensing of a grid shell, plus a heat map of how many steps the integrator wasted near the poles. Forty-four points because someone shipped the Christoffel symbols as a shader, not because general relativity moved.

• 🟩GPU
• 🧮Math
• 🔭Science

Xiaomi open-sourced MiMo-V2.6 Pro and Flash under MIT: Pro is a 1.0T MoE with 42B active, 1M context, text/image/video/audio, and Artificial Analysis has it at 46 — first among large open weights, a couple points behind GPT-6 Sol (max). They mixed coding, agents, vision, and cyber into one GRPO run and livestreamed the six-day RL dashboard; DeepSWE went from 19 on 2.5 Pro to 71.9. I opened it for that public training board more than the omnimodal demo reel.

• 🤖AI
• 🪺OSS
• 🌏Asia

Show HN from General Instinct (YC P26): InstinctFlash is an AGPL serving runtime for eight VLA / world-action families — pi0.5, GR00T N1.7, Cosmos3, LingBot — on Jetson Thor plus RTX 4090/5090. On Thor they claim 1.2–7.9× from runtime tricks alone, and 33.78× on LingBot-VA if you also drop 25 visual / 50 action steps to 2/4, with 90.5% vs 92.1% on 50 Robotwin2.0 tasks. Twenty-three points and a YC reunion in the comments; I glanced because the Thor numbers are actually measured.

• 🟩GPU
• 🪺OSS