OpenAI open sourced its security scanner, and early testers say it can burn a quarter of your weekly usage in one run.
What the article says
- OpenAI open sourced Codex Security, a command line tool that scans code for vulnerabilities using its models.
- You install it, sign in, and point it at a repository to get a scan, with support for reviewing changes and running checks in continuous integration.
- It is not offline. Your code and context get sent to OpenAI's hosted model, so it is not meant for codebases that cannot leave the building.
- Scans can be blocked by the model's own safety guardrails, which the team admits are sometimes overly cautious.
- There is a separate approval path for security researchers and open source maintainers who keep hitting refusals.
What HN is saying
- Several users ran it and had scans crawl for forty minutes to an hour, then fail or get interrupted, after eating a big chunk of their weekly usage allowance.
- One tester's run got flagged outright as a cybersecurity risk and stopped, pointing them toward a separate trusted access program instead.
- A commenter noted the real value might be the plain English instructions that tell the model what to look for, which could be reused elsewhere.
- The sharpest jab compared AI companies selling security tools to a fire department run by arsonists, with replies split on whether that is unfair or exactly the point.
- Others worry this floods open source maintainers with a wave of low quality automated vulnerability reports.
Andrew Ng's new AI tutoring startup just landed $100 million, and HN thinks the website was written by AI too.
What the article says
- LearnVector is a new company from Andrew Ng, backed by $100 million from Coursera, where he is also a cofounder and chairman.
- The pitch is one to one AI tutoring that builds a learning plan with you, adapts to how you learn, and sticks around until you actually master something.
- Ng frames it as a bet that AI creates opportunity rather than replacing people.
- Beyond that mission statement, the launch page says almost nothing about how the product actually works, which comments below note is inferred since the site itself is thin.
What HN is saying
- Biggest complaint is that the website itself reads as AI generated and vibe coded, which people find ironic for a learning company.
- Several are uneasy that Coursera, which Ng also chairs, is funding his new venture, comparing it to Elon Musk style self dealing between companies.
- Skeptics ask what makes this different from just asking Claude to teach you something, and bring up Khanmigo as a similar AI tutor that never really took off.
- A teacher of 25 years says she has watched wave after wave of tech promises to fix education without seeing real results.
- One commenter jokes that Ng now seems to run about twenty AI companies at once.
A tiny userscript fixes the annoying two tab dance of reading an article and its HN comments at once.
What the article says
- A developer got tired of opening one tab for the article and another for the HN comments, so he built a userscript to merge them.
- Clicking a link from Hacker News now opens the article with a resizable side panel showing the discussion.
- If you land on any page that was previously posted to HN, the script finds that old discussion and adds a button to open it.
- No login needed, and the code is easy to tweak or customize yourself.
What HN is saying
- Plenty of people say they have been doing the exact same two tab shuffle for years and are relieved someone finally fixed it.
- The sharpest pushback is that this is really a workaround for bad window management, since split views and tiling window managers already solve it.
- Commenters swap their own tricks instead, like Firefox and Chrome split view, middle clicking both links, or a browser extension that does the same thing.
- One person flagged a privacy issue, since the script pings HN's search index with every page you visit, leaking your browsing to it, and the author is already looking into fixing that.
- There is a side thread about wanting layered comment sections across the whole web, not just Hacker News.
A blogger argues Substack writers are tenants, not homeowners, and it could bite them without warning.
What the article says
- The writer says Substack is a distribution tool, not a home. Your own domain should be the real base.
- Building an audience entirely on someone else's platform makes you a tenant, and landlords change the rules eventually.
- Her fix is to publish on your own site first, then push copies out to Substack and social media.
- She points to novelist John Scalzi, who has run his own blog for almost three decades, as the model to copy.
- Platforms come and go in cycles of hype and decline, so an owned website is what survives the next one.
What HN is saying
- Plenty of writers push back hard, saying nobody visits personal sites anymore and Substack's built in audience and email delivery are what actually gets you read.
- Simon Willison describes his workaround, he blogs on his own site first then copies each post into Substack by hand just for the email reach.
- Several commenters say Substack's real value is solving payment processing and taxes, not hosting or writing tools.
- A sharp disagreement over whether social networks have genuine value or just network effects that let platforms extract fees forever.
- Some say quality still finds an audience regardless of platform, others say bots now make up nearly all traffic to any new site.
Half-Life just got a working PowerPC port, 26 years after Apple and Valve killed the original.
What the article says
- A developer named doctashay ported Half-Life to Mac OS 9, playable start to finish with multiplayer.
- Valve had a real Mac OS 9 version ready back in 1999, then cancelled it right before launch.
- The new port runs on old G3 and G4 Macs and uses a fan built engine that recreates the original Half-Life engine.
- It also bundles the two expansion packs, Blue Shift and Opposing Force.
- Performance depends on your graphics card, so some classic iMacs and iBooks may struggle.
What HN is saying
- Commenters dug up the sad history of Valve's cancelled 2000 Mac release, including an old interview with one of the developers who worked on it.
- Someone points out this engine recreation has quietly existed since 2011, so the port isn't as sudden as it looks.
- A side argument breaks out over whether the underlying engine really counts as open source, since it started from leaked code.
- Several people note this was built by hand with no AI help, pushing back against a comment guessing AI tools made it possible.
- Plenty of nostalgia for the era, people recalling being jealous of PC owning friends and joking about wanting the same treatment for modern Macs.