HackerNews Digest

The post updates a three‑year‑old project that reverse‑engineered the head‑unit of a 2021 Honda Civic. Honda’s OTA update mechanism accepts a signed AOSP test‑key package via USB; the recovery binary’s signature verification matches stock AOSP, allowing anyone with physical USB access to install arbitrary code without root privileges. This “evil valet” attack enables arbitrary execution on the head‑unit when the vehicle is unattended. The author released **ota‑builder**, a tool that formats USB drives and signs updates with the public test key, and **apk‑rebuilder**, which extracts resources, decompiles smali, repacks APKs, and pulls the ramdisk from Honda OTA files, facilitating analysis without distributing proprietary code. Ongoing tasks include cataloguing head‑unit firmware versions, refining a clean ARMv7 toolchain, supporting custom UI themes (complicated by Mitsubishi’s AOSP fork), and improving an aidl‑rebuilder for mapping AIDL interfaces. Documentation is minimized in favor of deterministic tooling that can be queried by LLMs. The repository remains open for contributions and pull requests.

The U.S. Department of Commerce issued an order banning “noise infusion”—the addition of random noise to statistical outputs—from all Census Bureau and Bureau of Economic Analysis products. The order mandates coarsening (generalizing data) as the primary disclosure‑avoidance method and permits suppression only as a last resort, explicitly prohibiting differential privacy and any technique relying on randomness. Historically, the Census used swapping until 2010, then adopted differential privacy for the 2020 Census because it offered the best balance of privacy protection and data utility. Removing noise‑based methods eliminates the most effective tool for quantifying privacy‑utility trade‑offs, forcing reliance on blunt techniques that either destroy utility (especially for small or minority groups) or increase vulnerability to re‑identification attacks. Consequently, future releases may become either substantially less useful or markedly less safe, undermining the confidentiality obligations that statistical agencies must meet.

GLM‑5.2, Zhipu’s latest open‑source large language model, has been released publicly. The announcement emphasizes that access to frontier AI models should remain unrestricted and globally available, criticizing recent abrupt limitations on such models for non‑technical reasons. GLM‑5.2 features a 1 million‑token context window and superior performance on long‑horizon tasks, positioning it as a foundation for complex agent applications and as the primary engine for Zhipu’s domestic coding model. The model becomes immediately available to all users of the GLM Coding Plan (Lite, Pro, Max), with an API slated for release the following week. The release is framed as a step toward open, collaborative development of artificial general intelligence rather than a monopolized resource.

- Wayland’s design goal “every frame is perfect” is proposed as a universal UI principle: any screenshot taken at any moment should present a coherent, complete state. - Consistency across frames builds user trust, signaling that developers have invested effort in both visual polish and underlying code quality. - Practical criteria for perfect frames include eliminating white flashes, avoiding partially loaded content, preventing layout changes during loading, and ensuring internal UI text consistency (e.g., “1 update available” vs. “Checking for updates…”). - Precise, synchronized animations are essential; jank or mismatched motion (e.g., placeholder text moving from the center while the cursor animates from the left) creates a perception of desynchronization and can mislead users. - Real‑world examples (Safari address bar, Photos crop mode, YouTube UI transitions) illustrate how imperfect intermediate frames—due to technical constraints or overlooked design—undermine the user experience. - The overall message: developers must treat every intermediate frame with the same rigor as start and end states, ensuring all visual transitions are smooth, accurate, and semantically consistent.

Graphical user interfaces increase interaction complexity, requiring architectural strategies to contain it. Simple applications can use a Forms‑and‑Controls pattern, but as the flow grows, developers often adopt Model‑View‑Controller (MVC). MVC is frequently misunderstood and implemented under various names—Application Model, Model‑View‑Presenter, Presentation Model, MVVM—each reflecting nuances but sharing core ideas. The essential principles of MVC are: (1) strict separation of presentation (view) from domain logic (model), and (2) synchronization of presentation state via events, typically employing the observer pattern. This separation isolates UI concerns, facilitates testing, and allows independent evolution of business logic and user interface components.

A DIY “everything console” was built from a used IBM 1U 7316‑TF3 rack unit (17‑inch LCD, USB Travel Keyboard with UltraNav) to replace bulky CRT terminals and laptop serial adapters. The author installed a Tattler Solutions VT100‑compatible terminal emulator (USB‑powered, 115200 bps, VGA output, DE‑9 serial) and added USB/VGA switch boxes to toggle the keyboard and monitor between the emulator and external devices. Cable management employed Velcro strips, cable guides, and a small USB power strip; the monitor’s power brick was rerouted to the strip. The keyboard was secured with silane‑glued metal braces, reinforced with Flexseal tape, and later supported by Z‑brackets and shims to prevent contact with the screen when closed. Additional components included a miniature power strip, Velcro tape, and manually fabricated supports. The finished unit functions as a VGA‑to‑HDMI console for a POWER9 system and as a serial console for an AT&T 3B2/310, demonstrating a compact, rack‑mountable solution for serial and video console access.

The author created a small game that lets players control the ghosts from the classic Pac‑Man arcade title. In this version, Pac‑Man is driven by its original AI, and the player’s objective is to intercept and capture him before he clears the maze of dots. When Pac‑Man consumes a power pellet, the standard role reversal occurs: the ghosts become vulnerable, and Pac‑Man briefly pursues them, forcing the player to evade. The post includes a link to the playable version and references two images—a generic placeholder and a cover illustration titled “Five Years of Blogging.” The game is presented as a reversal of the traditional Pac‑Man experience, emphasizing the ghost perspective.

Free Oberon is a cross‑platform integrated development environment (IDE) for the Oberon programming language, styled after classic Pascal pseudo‑graphic screens. It runs on Windows, macOS, and Linux and includes the console‑based compiler fob. **Key dependencies** (Linux): Allegro 5 development packages, Git, GCC. Installation commands are provided for Debian/Ubuntu/Mint (apt), Fedora (dnf), Arch (pacman), and openSUSE (zypper). **Installation steps**: download the tar.gz archive from free.oberon.org or the latest ZIP from the GitHub repo (https://github.com/kekcleader/FreeOberon), unpack to a directory without non‑Latin characters, rename to FreeOberon, and run install.sh. An optional Bash alias (`fo`) can launch the IDE. **Usage**: source files are stored in a `Programs` subdirectory; compiled binaries go to `bin` (or alongside the main module if outside `Programs`). Press F9 to compile/run; the IDE auto‑links multi‑module projects and opens files with compilation errors, indicating line and message. Scripts `Data/bin/compile.sh` (Linux) and `Data\bin\compile.bat` (Windows) handle the build process.

None

Python 3.14.0 introduced an incremental cycle‑collector that replaced the traditional three‑generation collector with a two‑generation (young/old) scheme, aiming to cut pause times by collecting the young generation and a slice of the old one on each run. Users reported increased “memory pressure,” so the change was reverted in 3.14.5, restoring the classic generational collector. The article details CPython’s memory model: objects are reference‑counted; `sys.getrefcount` shows counts, and deallocation occurs when the count reaches zero. Circular references break pure reference counting, requiring the cyclic GC; examples demonstrate leaks when objects reference themselves and how weak references (`weakref.ref` or `weakref.finalize`) can break cycles. The author built both 3.14.4 (incremental GC) and 3.14.5 (traditional GC) from source to compare behavior, noting identical reference‑count outputs but differing GC invocation frequency. Both builds exhibit a reproducible seg‑fault during finalization, with a stack trace involving `free_object`, `_PyGC_ClearAllFreeLists`, and `gc_collect_main`. The change was not gated behind a PEP and lacked a runtime toggle.