A bug hiding in Linux since 2011 lets any local user grab root, containers included.
What the article says
- Researchers found a use after free bug in the Linux kernel's futex locking code, sitting unpatched since 2011.
- Any regular unprivileged user can trigger it with normal system calls, no special access required.
- They turned it into a reliable path to root and a way to break out of containers, and Google paid them over ninety thousand dollars for it.
- The trick is grabbing a pointer to memory the kernel already freed, refilling that memory with their own data, then hijacking what the kernel does next.
- The kernel is now patched, so the fix is simply updating.
What HN is saying
- People tried the proof of concept on Android phones. A few boot looped and had to be recovered.
- A side argument broke out over the phrase the researchers used, some readers pegged it as an AI writing tell. The team admitted they ran the writeup through AI for a grammar pass.
- HN's dang stepped in to say AI assisted wording doesn't take away from how solid the actual research is.
- A few readers grumbled the title hid that this needs local access first, not a remote attack, though others noted it still lets you escape a container.
- Another tangent debated whether use after free is old, established security jargon or something AI popularized. Veterans confirmed it's decades old.
A deeply opinionated tour of fifty years of cyberpunk comics and manga, from 1975 to now.
What the article says
- The list runs in order from 1975's The Long Tomorrow, the French comic that helped shape Blade Runner's look, up through a 2023 Cyberpunk 2077 tie in.
- Ghost in the Shell gets the deepest treatment, tracing every manga spinoff back to the original and judging how well each one actually fits the genre.
- Blade Runner's comic sequels get a clear ranking too. The writer loves the first one and finds the later follow ups tired rehashes of the films.
- Smaller, stranger picks get real love, like Shatter, drawn entirely on an early Macintosh, and Night Hunters, which sets its cyborg story in Caracas instead of the usual American or Asian city.
What HN is saying
- Most of the thread is people adding what the list missed, especially Transmetropolitan, Judge Dredd, and the mecha series Patlabor.
- A side conversation compares the brand new Ghost in the Shell anime to past reboots. One reader says they are burned out on remakes and would rather see something wholly new from the creator.
- Someone shares a link to their own robot comic and gets a genuinely warm reception from other commenters.
- A few people push back gently on where the genre line sits, arguing Battle Angel Alita and Eden read more as post apocalyptic than true cyberpunk.
An Ask HN thread on flagging AI written articles got a long, candid reply straight from HN's own admin.
What the article says
- This is a self post, so these points come from the question and the discussion rather than a linked article.
- The poster asks whether Hacker News should let readers flag articles as AI generated, just as a marker, not something that buries the post.
- HN admin dang jumps in. Comments made by AI are already banned on the site, but there is no rule yet for AI written articles people link to.
- He says readers are developing a real allergy to writing that sounds machine made, and that stigma alone is already changing what gets shared.
- He is open to letting people give a reason when they flag something, with AI generated as one option, though he still resists formal tagging.
What HN is saying
- Many worry a flag would misfire constantly. AI detection is unreliable, so honest writers could get falsely accused and publicly shamed.
- The most common counterargument: low effort is the actual problem, not AI itself. A well edited AI assisted piece should count the same as a human one.
- Some suggest flipping it, a not AI badge for writers who want to prove they typed it themselves.
- A smaller, blunt camp says they will reject AI writing no matter how good it is, comparing it to a kosher or vegetarian label.
- Several note HN already restricts downvoting, so this flag debate is really about the site's only real dislike button.
Tiny browser emulators bring ZX Spectrum and Commodore 64 games back with almost no load time.
What the article says
- The page is a JS heavy interactive site with no extractable text, so this is inferred from the title and comments.
- It's a collection of small emulators for classic home computers like the ZX Spectrum and Commodore 64.
- Each machine is built from tiny, self contained parts that mimic real chips down to their pins.
- You can click in and start playing old games right away, no tape loading required.
What HN is saying
- Commenters are drawn to the pin level design, where each chip is a small modular piece with a clearly defined interface.
- One person suggests this kind of tightly scoped, well defined component could be a good model for checking AI generated code behaves correctly.
- There's real nostalgia in the thread, with people remembering slow tape loading and naming favorite games like Bruce Lee on the Spectrum.
- A few want more machines supported, someone points to a broken link needing a fix, and another notes the project is actually years old.
A full self study path through physics, from high school math to grad school quantum mechanics and general relativity.
What the article says
- This is a complete do it yourself physics curriculum, built by someone who taught herself the subject and has now guided over six hundred thousand readers through it.
- It starts with basic math and works up through mechanics, electrodynamics, quantum mechanics, statistical mechanics, and general relativity.
- Each stage names the specific textbooks worth buying, in order, plus which chapters actually matter.
- The author insists that solving problems by hand, not just reading, is the only way any of this sticks.
- She also lists popular physics books to read for inspiration when the coursework gets grinding.
What HN is saying
- The top comment argues nobody needs the whole syllabus. Learn the physics tied to something you actually care about and skip the rest.
- Others push back hard, saying working through an entire course end to end reveals the shape of the subject in a way piecemeal learning never does.
- One commenter shares how rereading Feynman on energy conservation, a concept most people think they already understand from school, completely changed how they saw it.
- A skeptic does the math and notes a proper university physics sequence would eat about fifteen hundred hours of study time.
- Others swap alternate recommendations, including a companion math guide from the same author and a set of classic Soviet era physics books.
A software engineer with no hardware background designed a custom circuit board that worked perfectly on the first try.
What the article says
- A software engineer with no electronics background decided to design his own circuit board after wiring up sensors on a breadboard.
- He used a free tool called KiCad to draw the schematic and pick footprints, learning the difference between old style leaded parts and the tiny surface mounted ones now standard in electronics.
- He had the finished board made by a Chinese manufacturer, and it arrived in a couple weeks for under ten dollars.
- Assembly took about fifteen minutes with a soldering iron and a hot air tool, and despite worrying he had shorted the tiny sensor's hidden pins, the board worked exactly as planned the very first time.
What HN is saying
- Commenters are stunned by how cheap and good custom board manufacturing has become, calling it a golden era for small scale hardware projects.
- A few people reminisced about etching boards at home with chemicals in the sink, but most agreed that outsourcing to Chinese factories now beats doing it yourself on quality and cost.
- A recurring frustration is hunting for individual components that are only sold in huge minimum quantities, which can make sourcing parts more tedious than the board design itself.
- The most detailed reply was a long, generous critique of the poster's ground and power routing, which the author said he would try on his next board.
The monthly what are you building thread is back, and the side projects people share are the real draw.
What the article says
- This is a self post, just an open question asking what people are working on this month.
- There is no real article, so this is inferred entirely from the question and the flood of replies it draws.
- Hundreds of people post links to whatever they are building, from tiny hobby tools to small paying businesses.
- It works as a snapshot of what solo builders and small teams are spending their nights on right now.
What HN is saying
- A former game designer whose career was derailed by illness describes using Claude Code to build a small roguelite, and gets genuine excitement from strangers asking to try the demo.
- Someone built an app that uses on device computer vision to scan and organize a family's huge pile of Pokemon cards, now testing with a local card league.
- A few people describe pulling obscure government data, like hay prices or shipping delays, and turning it into simple readable websites almost entirely with AI agent help.
- One builder shares a niche price tracking API for a video game marketplace that quietly grew into a real paying business, and a reader immediately spots a bug on the site.
A satire site lets two founders swap ten grand each and both book it as revenue growth
What the article says
- LARP is a joke site that pairs you with another founder
- You each send the other ten thousand dollars, so cash never actually moves
- But you both get to say you booked ten thousand in new revenue
- The site is really a dig at circular deals in the AI industry, where companies invest in each other and count the money flowing back as sales
- It links out to real examples of these deals, including ones involving Nvidia and Anthropic, and notes every figure is sourced
What HN is saying
- Plenty of commenters admitted they were not sure it was a joke until partway through reading it
- Several pointed out this is the third near identical submission in three days and said the bit is wearing thin
- The big debate was whether circular deals actually create value. One commenter compared it to two people gifting each other identical amounts, arguing nothing real changes hands
- Others pushed back, noting that moving money across time and parties is exactly what gives it value, so the comparison does not hold
- A few drew a direct line to Nvidia and Anthropic's real circular investment deals, which someone said are legal but rhyme uncomfortably with the joke
Someone wired a logging proxy into Claude Code and found it burns tokens like it's trying to run up your bill.
What the article says
- A team spliced a logging proxy between two coding agents and the model, then compared exactly what got sent.
- Before you even type a prompt, Claude Code loads far more setup than OpenCode does, mostly tool definitions and injected instructions.
- Worse, Claude Code often rewrites its cached context mid session instead of reusing it, so you pay premium rates again for the same stuff.
- A hefty instructions file adds a big chunk to every single request, and Claude Code silently skipped one file format entirely unless renamed.
- Farming work out to helper subagents multiplied the token cost several times over for the same task done directly.
- One task did flip the result. Claude Code batched steps into fewer requests and actually came out cheaper than OpenCode there, so which tool wins depends on the job.
What HN is saying
- Biggest complaint from commenters is subagents. People say spinning up helper agents torches your budget fast, and one shared a settings tweak to disable them.
- A real fight breaks out over motive. Some think Anthropic profits from bloated token use, others point out most revenue comes from API and enterprise deals, so Anthropic actually wants efficient subscription users.
- Several people say even trivial requests like a one word greeting or a commit can trigger dozens of tool calls, calling it a broader industry pattern, not just Claude Code.
- A skeptical reply shows a live token breakdown from a fresh session that looks much leaner than the article claims, suggesting the numbers may already be stale or setup dependent.
- A few commenters just plug leaner alternatives, including a minimal open source agent with a tiny system prompt.
A company swapped its production AI agent from Claude to GPT-5.6 and hit three nasty surprises along the way.
What the article says
- A company that builds websites with AI agents finally found a model that beats Claude Opus, and switched over.
- The new model builds pages in under half the time and at a much lower cost.
- But it invents fake values for tool settings it is not using, which quietly made file reads come back blank.
- The team had to redesign how they cache prompts entirely, since the new provider handles caching very differently.
- They also hit a bug where the model lost track of its own earlier reasoning mid conversation.
What HN is saying
- Commenters piled on the post itself for reading like it was written by an AI, choppy phrases and all.
- Some pushed back, saying style gripes are a distraction from the useful substance underneath.
- A rival agency builder dismissed the whole comparison, insisting an older Claude version still beats every newer option out there.
- Others debated whether it is smarter to run one expensive model call or several cheap ones and combine the results.
- A few readers noted the article actually does explain the tricky fixes, like the tool call bug and the caching rebuild.