HackerNews Digest

The Vancouver Police Department (VPD) page promotes an event focused on the department’s application process and improving POPAT (Physical Operations Performance Aptitude Test) or COPAT (Canadian Police Aptitude Test) scores. Participants can run alongside recruiters in a casual setting, work toward fitness objectives, and receive answers to recruitment questions. Attendance requires completion of a mandatory waiver form. The event is scheduled for Tuesday, July 21, beginning at the Graveley location, with registration available online. The page includes the VPD logo and references to the Vancouver Police Board in image alt text.

Tailscale versions prior to 1.66.0 allowed Linux exit nodes, subnet routers, and app connectors to accept inbound packets from their local LAN when ACLs used `"src": "*"`. This shorthand was interpreted as any IP (`0.0.0.0/0, ::/0`), enabling external LAN hosts to reach tailnet nodes through the packet‑forwarding node, bypassing intended source filtering. The issue affected nodes running version 1.65 or earlier on Linux and any regular node communicating with them; tailnets without `"src": "*"` were not impacted. No known active exploitation was reported. Mitigation includes upgrading to Tailscale 1.66.0 or later, which introduces three defenses: (1) redefining `"src": "*"` to match only tailnet nodes and approved subnet routes, with an optional `autogroup:danger-all` for legacy behavior; (2) enabling stateful packet filtering on Linux forwarding nodes to drop unsolicited inbound packets; and (3) client‑side quarantining of shared nodes to reject all inbound traffic from them regardless of source IP. Server‑side changes also adjust `"src": "*"` handling for exit nodes. Auto‑updates are recommended but not required for remediation.

Bonsai 27B, built on the Qwen3.6 27B architecture, is the first 27‑billion‑parameter model able to run on a smartphone. Two low‑bit variants are released: - **Ternary Bonsai 27B** uses ternary {−1,0,+1} weights with FP16 group‑wise scaling (1.71 effective bits/weight), occupies 5.9 GB and runs on a typical laptop. - **1‑bit Bonsai 27B** uses binary {−1,+1} weights (1.125 effective bits/weight), occupies 3.9 GB, fitting within the ~6 GB usable memory of an iPhone 17 Pro and enabling on‑device execution. Both variants are fully multimodal (vision tower in 4‑bit form), support a 262 K‑token context, and use speculative decoding for speed. Across a 15‑benchmark suite covering knowledge, reasoning, math, coding, instruction following, tool calling, and vision, the ternary model retains 95 % and the 1‑bit model 90 % of full‑precision performance, with token rates up to 163 tok/s (1‑bit) on an RTX 5090. The release, under Apache 2.0, runs natively on Apple devices via MLX and on NVIDIA GPUs via CUDA, and includes a limited‑time developer preview API. It aims to enable privacy‑preserving, low‑cost, sustained agentic workloads locally on consumer hardware.

The article catalogs every computer and peripheral shown in *Jurassic Park* (1993). The first visible device is an Apple PowerBook 100 (Motorola 68000, 16 MHz, 2–8 MB RAM, 640×400 LCD, System 7.0.1). In the island’s Control Room, Dennis Nedry’s cluttered desk holds two Macintosh Quadra 700s (Motorola 68040, 25 MHz, 4 MB RAM, 80–160 MB HDD), a Motorola Envoy PDA, three monitors, and an SGI IRIS Crimson workstation (MIPS R4000/R4400 CPU, up to 256 MB RAM, multiple 3‑D graphics subsystems). Ray Arnold’s tidier desk features an SGI R4000 Indigo, a single Quadra 700, a CCTV monitor, and SGI Granite keyboards. Behind them stands a supercomputer resembling five Thinking Machines CM‑5 nodes (Sparc CPUs, 32 MiB RAM each). Additional hardware includes PLI Mini Array tape backups, SuperMatch 20‑T (or re‑branded Mitsubishi HL7965) 20″ CRTs, and assorted SGI graphics cards. Production notes state that $875 k of SGI hardware, $350 k from Apple, and $500 k of other equipment were loaned, equivalent to roughly $4 M in 2026 dollars. The on‑screen interfaces were generated by a dedicated graphics team using SGI and Macintosh systems, with some footage captured from QuickTime playback on System 7.

The article presents a formal proof of Erdős Problem 123, which asks whether every sufficiently large integer can be expressed as a sum of distinct monomials \(a^i b^j c^k\) with pairwise‑coprime bases \(a,b,c>1\), under the restriction that no chosen summand divides another. Traditional induction fails because a required “finite‑seed” interval \([N, C N]\) cannot be generated by standard residue‑gluing methods. The solution proceeds by: * Working on a single homogeneous exponent level, where divisibility reduces to coordinatewise exponent comparison, making every subset primitive. * Constructing primitive subset‑sum arithmetic progressions via an edge‑code and van der Waerden/Hales–Jewett arguments, then translating these progressions with coprime homogeneous weights to form a wide lattice interval. * Adding face‑supported primitive corrections for each residue modulo a prescribed modulus, which, combined with the lattice interval, yields a genuine consecutive interval but with only constant multiplicative width. * Introducing an “interior shell” of optional monomials placed just beyond the progression bands; each optional term extends the interval without moving its lower endpoint, linearly increasing the ratio of upper to lower bounds. * Strengthening the residue‑reduction step into a flexible finite‑seed gate, establishing constants \(N_0\) and \(C>1\) such that any interval \([N, C N]\) with \(N\ge N_0\) guarantees completeness. The proof, formalized in Lean 4 using Mathlib, covers all six orderings of distinct coprime bases and verifies the intended statement without axiomatic gaps.

Dependabot now imposes a default three‑day “cooldown” before creating version‑update pull requests. The delay applies only to regular version updates; security updates continue to be opened immediately. This measure aims to reduce the risk of supply‑chain attacks by allowing time for any issues with a new release to become apparent before the update is merged. Users can modify the behavior in .github/dependabot.yml via the cooldown option to set a different wait period or to disable the cooldown entirely. The default setting is active for all supported ecosystems on GitHub.com and will be enforced in GitHub Enterprise Server 3.23.

None

The essay reflects on AI‑assisted programming as a catalyst that reduces coordination friction in large software projects. While AI agents can quickly generate code (e.g., adding OAuth, caching, UI changes) and produce documentation on demand, the author argues that the primary limitation in complex systems is not individual coding speed but the shared understanding of architectural concepts, invariants, ownership, and design rationale. Historically, this shared language is built through documentation, code reviews, and direct interaction, which synchronizes team members. AI agents bypass many of these interactions, allowing isolated changes without requiring developers to internalize the broader system model. Consequently, the collective mental model erodes, similar to the biblical Tower of Babel, yet construction continues because the agents hide the loss of coherence. The author warns that continuous development without a common architectural language may lead to increasingly opaque codebases, even as the “tower” keeps rising.

None

Cursor IDE on Windows automatically executes a git.exe found in a project’s root when the repository is opened, without prompts or warnings. This allows arbitrary code execution under the current user’s privileges; the issue is reproduced by placing a renamed calculator binary as git.exe, which Cursor repeatedly launches during normal operation. The flaw was discovered by Mindgard on 15 Dec 2025 and reported the same day, but after seven months and over 197 releases the vulnerability remains unpatched. **Mitigations** - Enterprise Windows: use AppLocker/Windows App Control to deny execution of git.exe in workspace paths (e.g., %USERPROFILE%\source\repos\*\git.exe). - Consumers: open untrusted repos only in isolated VMs or Windows Sandbox; avoid hash‑based blocklists. **Vendor response**: Initial reports received no acknowledgment; later a CISO cited an automation failure, invited the researcher to HackerOne, and closed the report as out‑of‑scope. After reproduction, the report was reopened but further communication ceased, with no remediation evidence despite continued releases. Mindgard therefore publishes full details to enable organizations to assess risk and apply compensating controls.