A weird git flag turns out to be a real fix for a security bug hiding in nearly every package manager.
What the article says
- Git has a flag called end of options that most developers have never heard of, and the author first assumed it was made up by an AI.
- It exists because git already used a plain double dash for something else, separating branch names from file paths, so a second marker was needed to safely mark the end of options.
- Without it, a script that passes an untrusted value straight to git can have that value misread as a hidden option, letting an attacker run arbitrary commands.
- This exact flaw has hit git, Mercurial, Subversion, and CVS, and most recently caused a real vulnerability in Go's package manager.
- Checking nineteen package managers, the author found only one, Go, actually uses this safer flag, while most others rely on weaker fixes or just haven't patched it.
What HN is saying
- Commenters mostly agree that git's command line design is a mess, full of inconsistent special cases that have piled up over the years.
- The sharpest disagreement is whether that messiness is a real design flaw or just the unavoidable cost of a powerful, flexible tool.
- One person jokes about naming a branch using the exact symbol that causes this problem, and someone else jabs back with an old joke about renaming the default branch.
- A few commenters note the article's title itself got mangled, showing a dash turned into a different kind of dash, which nicely proves the whole point about how easily these symbols get mixed up.
Terence Tao shares his ChatGPT chat where he worked out a counterexample to a famous unsolved math conjecture.
What the article says
- The link is a shared ChatGPT conversation, not a written article, so this is inferred from the thread and Tao's own blog post about it.
- Mathematician Terence Tao used ChatGPT to explore a counterexample to the Jacobian Conjecture, a long standing open problem.
- He drove the conversation with sharp, expert level questions, and the model helped verify and extend the reasoning.
- The counterexample itself is not a random guess. The polynomial involved is built in a deliberate structured way that produces the result.
- Tao wrote up his own account of the process on his blog the same week.
What HN is saying
- Many commenters were struck by how the exchange reads like two expert colleagues talking, not a person using a tool.
- A recurring theme is that getting real value from these models takes deep domain expertise, not just clever prompting.
- Some pushed back, noting the model still leans on stock hedging phrases and that not every user gets this quality of answer.
- A sharper disagreement over whether this shows genuine intelligence or just very convincing pattern matching, with several people arguing that debate misses the point of the result itself.
- One person flagged that the mathematician's first name is Terence, not Terrence, as the headline has it.
A historian built a free search tool for great non-fiction books, then made the case that books beat AI slop.
What the article says
- A former library shelver turned historian built the Book Prize Index, a free searchable database of award winning non-fiction books.
- It pulls finalists and winners from major literary prizes, on the idea that prize recognition is a decent filter for quality.
- You can search with natural phrases, like books that feel like a certain memoir, and it finds similar titles using semantic search.
- He argues genuinely good non-fiction has quietly kept getting better for decades, even as fewer people read it.
- The tool also includes visualizations, like which publishers win the most awards and how prize counts have changed over time.
What HN is saying
- Many commenters tried the tool immediately and found new books to read, calling it a genuinely useful discovery engine.
- A recurring theme is that reading builds understanding in a way that chatting with an LLM does not, though some pushed back that this depends entirely on how a person uses the tool.
- Several readers debated whether prizes are a trustworthy quality signal, noting publishers mass submit books for consideration and some judging has been scandal prone.
- One sharp side argument: is most published nonfiction actually just as padded and derivative as AI slop, just produced by humans instead.
- A few practical notes came in too, like a broken award filter and a stray localhost link in the original post.
One person made tokenizing text roughly a thousand times faster than the tools everyone already uses.
What the article says
- A solo developer built Gigatoken, a drop in replacement for the tokenizers used by most language models.
- It processes text at gigabytes per second, far outpacing HuggingFace tokenizers and tiktoken.
- The speed comes from heavy CPU level optimization, smarter caching, and cutting out overhead from Python.
- It works across common chip types and supports nearly every popular tokenizer, though a couple of older formats are not fully optimized yet.
- The author says a full technical writeup is coming, but the code is already public and installable now.
What HN is saying
- Commenters were impressed by the craftsmanship, especially that one person pulled this off alone.
- The main debate was whether it matters, since tokenizing is normally a tiny sliver of total processing time.
- The author pushed back, explaining it matters a lot for preparing huge training datasets and for how quickly a model produces its first response.
- Several people just enjoyed the pursuit of speed for its own sake, comparing it to over-engineering a word cloud generator no one asked for.
- Others pointed out real practical uses, like estimating costs before sending requests to a model.
A whole editable slideshow, animations and live collab included, lives inside one HTML file you can email.
What the article says
- Bento is a single HTML file that works as a full slide editor, viewer, and presenter, with no install or cloud login needed.
- It runs entirely offline once you have the file, and the whole default deck is only about half a megabyte.
- You can share it by email or Airdrop, and anyone with a browser can edit it or collaborate on it live.
- Live editing works through an encrypted relay that never sees your actual data.
- The creator built it with reveal.js and other libraries, using Claude Code, and released all the code free to use.
What HN is saying
- People are excited about single file web apps generally, comparing Bento to older tools like TiddlyWiki and mdwiki that packed everything into one file.
- Several commenters shared their own similar tools built with AI coding assistants, suggesting this pattern is catching on fast.
- The sharpest criticism was that the site claims nothing phones home, but a tracking beacon was found in the files, which the creator is still investigating.
- One reviewer said the writing on the landing page reads too much like AI generated copy, while the original HN post text felt far more natural.
- Someone pointed out there is no way to add alt text to images, meaning accessibility was not built in from the start.