Karpathy built a YouTube clone from videos HN recommends, in one morning
What the article says
- Karpathy got tired of YouTube's slop and asked Claude to build his own version.
- It scraped every HN comment since 2007 and kept the ones recommending a video. That left about 6,400 videos across 150 topics.
- The site wraps them in a YouTube-style interface, with middle-of-video thumbnails and recommendations that need no account.
- He barely touched anything by hand. Claude handled the code, deployment and hardening.
- The full dataset is available to download so you can build your own version.
What HN is saying
- Many say it feels calmer and faster than YouTube, with none of the bait. One commenter says it is closer to what they actually watch than YouTube's own personalised feed. thread ↗
- A popular thread says personalised feeds work against people who want to be surprised. Karpathy's view is that people like them are a rounding error in the data these systems learn from. thread ↗
- Sorting by newest was the top request. Karpathy added it within minutes, after one reader said they would not come back without it. thread ↗
- Several readers want playlists, and a few are building similar curated sites of their own. thread ↗
- Karpathy says his prompts are getting shorter, because too many instructions box the model in. He did the whole build by talking to Claude, apart from the API key, domain and server boot. thread ↗
Serbia's new parliament is packed with scientists and doctors. Can brains run a country?
What the article says
- A student-led movement won Serbia's election and holds 141 of 250 seats. Dozens of its members are academics, and more than half have a PhD or medical degree.
- It grew out of protests after a train station canopy collapse killed 16 people, which students blamed on corruption.
- The slate also includes farmers, lawyers, artists and a former basketball player. There is no official leader.
- Researchers hope for freer universities, fairer science funding and an end to brain drain after 13 years of Vucic's rule.
What HN is saying
- Many worry that clever people make poor politicians. Committees of academics argue endlessly, and politics needs people skills as much as brains. thread ↗
- Others say the old system had already failed, so a risky experiment is worth trying. Plenty of career politicians are overconfident too. thread ↗
- A Serbian student backer fears the movement's famous faces will split off, form their own parties, and the cycle will repeat. thread ↗
- A sharp debate over whether student revolutions ever end well. Czechoslovakia, South Korea and Serbia's 2000 uprising were offered as good examples. thread ↗
- One commenter claims US money backed the movement's media outlets. Others reply that this ignores the thousands of Serbians who did the actual work. thread ↗
The biggest crypto heist ever was rehearsed for a day and a half, then done in 20 minutes.
What the article says
- Hackers drained Binance wallets across at least ten blockchains in about 20 minutes, taking roughly $6.3 billion.
- Tracing firms found the attacker tested the code on small wallets and rehearsed the final version hours before the real thing.
- Binance froze about half the money with help from other crypto firms. The rest may be gone for good.
- Three tracing firms point to North Korea's TraderTraitor group, though neither Binance nor police have named a suspect.
What HN is saying
- Many think the 20 minutes is the boring part. The real work was the months of preparation, and some suspect inside knowledge of Binance's systems. thread ↗
- A sharp split on whether speed matters. One says execution is always quick, another says it points to automation or advance planning. thread ↗
- Some blame Binance for weak security, while others ask what crime it could even be prosecuted for. A bank engineer describes how locked down his own laptop is by comparison. thread ↗
- Commenters tie the timing to the Claude Code extension supply chain attack. Others call that recency bias and note the bad extension was only live for hours. thread ↗
- A correction on how exchanges work: customers have no keys of their own. Coins sit in pooled wallets, so stealing from the hot wallet means real, spendable loss. thread ↗
- The thread drifts into whether crypto is worth it at all. One reply says it has become a workaround for payment processors blocking legal but unpopular sites. thread ↗
A daily puzzle where you rig the map so the losing horse wins
What the article says
- It's a daily gerrymandering puzzle. The horse is losing the popular vote to the cow, donkey and goat.
- You draw equal-sized districts on a hex map so the horse still wins the most seats.
- It's free, needs no sign-up, and has a new puzzle every day.
- It runs on JavaScript, so the page itself says little more than that.
What HN is saying
- The biggest fight is over originality. Many say it is a near carbon copy of Gerrymandle, and the Gerrymandle developer says he turned down an offer to sell it. thread ↗
- The sister game enclose.horse was sold to new owners. Commenters accuse them of a cash grab with ads, bought assets and obviously LLM-written text. thread ↗
- Others point out the whole idea has older roots, from a 2019 board game to an unfinished New York Times game. Some still prefer this version's branding. thread ↗
- The colours are the top gameplay complaint. Horse and donkey look too alike, even to people with calibrated screens. One reader shared a hue-shifting bookmarklet. thread ↗
- A few say it teaches gerrymandering well, but one reader warns it ignores the risk that over-clever maps backfire. thread ↗
Another cloud platform got breached, and your AI API keys were the prize.
What the article says
- Northflank, a cloud platform for running apps, told every customer to assume their environment variables were decrypted.
- Users soon reported strangers burning through their AI provider keys. The company links the activity to a wider wave of attacks on AI credentials.
- The advice is blunt: rotate every secret, in workloads, secret groups and global settings, and turn off public access to databases.
- Since then it has shipped one-click secret rotation for its database add-ons and switched on audit logs for free users too.
- The first alert came from a security vendor, and fixes went out within about twenty minutes.
What HN is saying
- One commenter counts six similar attacks on hosting platforms in about a month and calls it an emergency. They want teams on a war footing, with rotated keys and tight spending caps. thread ↗
- A structural point: these platforms let you read your secrets back in the dashboard, so anyone who takes over the management server can impersonate you and read them too. thread ↗
- Disagreement on where to go next. Some expect a retreat to big cloud providers, others to simple self-hosted setups where one small server is a less tempting target. thread ↗
- A practical trick: encrypt your environment variables and bake the key into your own program. Critics call it security through obscurity that stops working if everyone copies it. thread ↗
- Some push back on the doom. Security is not impossible, they say, and the same AI that finds holes can audit your own code before you ship it. thread ↗
- Several people ask whether bring-your-own-cloud setups help, since the vendor may still hold the keys to everything in your account. thread ↗