The time the x86 emulator team found code so bad they fixed it during emulation
Summary
During Windows’ era of an x86‑32 processor emulator that used binary translation (JIT‑style code generation), the team encountered a function that allocated ~64 KB on the stack and zero‑filled it. The compiler handling that function unrolled the initialization loop, emitting 65,536 separate “store byte” instructions—each 4 bytes—resulting in ~256 KB of generated code to initialize 64 KB of data. The emulator’s translators detected this pathological pattern and replaced it with a compact loop that performed the same initialization, restoring expected performance and code size. This incident illustrates how aggressive loop‑unrolling optimizations can produce inefficient code for large memory operations, prompting runtime systems to add corrective translation logic.
Read full article →
Community Discussion
The discussion references historical compiler behavior, suggesting that past optimization flags could unconditionally unroll loops, while questioning why modern compilers would support such options. It notes that current compatibility layers like Proton and Wine can apply hot‑fixes to improve game performance, contrasting this with earlier patches that addressed bugs directly in the operating system rather than requiring developers to ship fixes. Anecdotes about architecture support and specialized translator optimizations are mentioned, alongside the idea of disabling problematic optimizations for specific code sections.
A backdoor in a LinkedIn job offer
Summary
A recruiter on LinkedIn sent a public GitHub repository, claiming a “deprecated Node modules” issue needed a lead engineer. The repo contains a React frontend and Node backend, but the backdoor resides in `app/test/index.js` (~250 lines). It builds the URL `https://rest‑icon‑handler.store/icons/77` from string fragments and executes any code returned by that server on line 225, hidden among commented‑out tests. The backdoor is triggered automatically because `package.json` defines a `prepare` script that runs `node app/index.js`; `npm install` runs `prepare`, loading `app/index.js`, which requires `./test` and thus executes the malicious test file. The commit history is falsified: all 39 commits are attributed to a real full‑stack developer who never touched the repo, and the recruiter’s LinkedIn profile belongs to an unrelated arts journalist who pretended technical expertise. The author avoided execution by using a read‑only analysis agent, reported the repo to GitHub and the recruiter to LinkedIn, and warned that similar supply‑chain attacks can arise from unsolicited code‑review requests.
Read full article →
Community Discussion
Comments converge on strong concern about increasingly sophisticated recruiter scams that distribute malicious npm packages via LinkedIn and GitHub, exploiting job‑seeker desperation and supply‑chain vulnerabilities. Contributors criticize the platforms’ inadequate reporting channels and slow remediation, noting repeated exposure and limited impact of reports. Advice emphasizes isolating any untrusted code, using virtual environments, and treating unsolicited installation requests as high‑risk. Several remarks suggest possible state‑backed actors and call for coordinated defensive measures, while overall sentiment remains wary and critical of current safeguards.
Banned Book Library in a Wi-Fi Smart Light Bulb
Summary
The project repurposes a Wi‑Fi smart bulb (ESP32‑C3, 4 MB flash, Tasmota pre‑installed) as an unobtrusive dead‑drop for banned‑book PDFs. After purchasing two bulbs, the author opened the housing, identified the ESP32C3 and its exposed GPIO pins, and soldered wires for serial programming. Using an FTDI adapter and the ESP‑tool, the original firmware was dumped, then a minimal Arduino sketch was flashed to run an open Wi‑Fi access point and AsyncWebServer. Attempts to add a microSD reader failed due to inaccessible pins and the need to dismantle the bulb’s potting compound. Partition analysis showed a 320 KB SPIFFS partition insufficient for book storage; the author edited the partition CSV, regenerated the binary table, and re‑flashed it to allocate ~2 MB to SPIFFS while shrinking the app partition. The resulting firmware hosts a small web server with expanded flash storage, enabling local retrieval of digital books without cloud dependence. The work highlights hardware teardown, OTA flashing, partition manipulation, and the practical limits of using off‑the‑shelf smart bulbs for covert data distribution.
Read full article →
Community Discussion
The comments collectively express enthusiasm for the light‑bulb mesh‑network concept, praising its creativity, low cost, and potential community uses while noting practical hurdles such as Wi‑Fi auto‑disconnect behavior and ease of disabling the devices. Participants suggest alternative hardware and expanded applications, including broader mesh protocols and content hosting. A secondary thread debates censorship in the United States, with differing views on the legitimacy of “banned books,” concerns about financial and workplace speech restrictions, and occasional calls for stricter bans on extremist material.
Iroh 1.0
Summary
Iroh 1.0 is a networking library that replaces IP‑based addressing with user‑controlled cryptographic keys, enabling devices to be reachable regardless of location or NAT state. The release stabilizes the wire protocol and language APIs, guaranteeing interoperability between any iroh v1 endpoints. Core technical features include a custom QUIC implementation with multipath routing and hot‑swap capability, QUIC‑based NAT traversal with encrypted connection metadata, and local‑first discovery allowing direct peer connections without internet access. The library compiles to WebAssembly for browser use and supports custom transports such as BLE, LoRa (in development), and Wi‑Fi Aware under the same dial‑by‑key abstraction. After pausing FFI support, iroh now offers stable bindings for Rust, Python, Node.js, Swift, and Kotlin, facilitating integration into iOS and Android apps. Public relays have handled over 200 million endpoint creations in the past month; relays are open‑source, rate‑limited, and updated within 24 hours of each release. Version 0.35 support ends Dec 31 2026; future major releases will modify the wire protocol, while minor updates remain backward compatible.
Read full article →
Community Discussion
The comments convey a largely positive impression of Iroh’s ease of embedding secure, QUIC‑based peer‑to‑peer connections and its helpful developer community, with several users reporting successful production deployments and praising its Rust implementation and relays. At the same time, many raise concerns about the project’s positioning versus established tools such as Tailscale, Netbird or libp2p, question the completeness of documentation, pricing model, and lack of features like WebRTC, Go bindings, or built‑in discovery, and seek clarification on key management, anonymity, and offline‑peer support. Overall, enthusiasm is tempered by calls for clearer value articulation and broader ecosystem support.
I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
Summary
The author registered on FIFA’s public Agent Platform, which automatically added the account to FIFA’s Microsoft Entra (Azure AD) tenant used by all internal applications. Although the Angular front‑end displayed “no roles” and denied access, the backend APIs performed no role checks, allowing an unauthenticated “NO_ROLES” account to retrieve data from multiple production systems. The author accessed the Streaming Management panel (fdp.fifa.org), exposing live‑production RTMP ingest URLs and stream keys for every 2026 World Cup match and camera angle. These URLs could be used to replace live feeds, potentially hijacking broadcast content. The same account also accessed the Commentator Information System (cis.fifa.org), match‑management interfaces, analytics dashboards, and an Azure Function exposing internal spreadsheet files via direct Blob URLs. The vulnerability stemmed from client‑side only authorization. After reporting via email, phone, and contacts at MediaKind, CISA, and the FBI, FIFA patched the APIs to return 403 responses, but offered no direct acknowledgment or disclosure policy.
Read full article →
Community Discussion
The comments blend amusement with admiration for the reported FIFA vulnerability, noting the author’s similar experience with a past Qatar‑2022 exploit and the quick patch but lack of promised compensation. Readers express praise for the writing and the discovery while also highlighting serious security concerns, questioning how the API allowed unchecked JWTs and emphasizing the potential for large‑scale disruption if misused. Overall sentiment acknowledges the technical cleverness, finds the situation entertaining, and critiques FIFA’s response and oversight.
TinyWind: A pixel pirate sailing game with real wind physics (380k+ kms sailed)
Summary
The provided text contains only a single line: the title “TinyWind – Pixel Pirate Sailing.” No additional description, details, or context are included, so the content consists solely of this title, suggesting a possible game or project named TinyWind that involves pixel‑art sailing with a pirate theme.
Read full article →
Community Discussion
Overall sentiment is strongly positive, with many users describing the game as fun, well‑executed, nostalgic and visually appealing. Common praise focuses on the immediate accessibility, enjoyable combat and charming retro aesthetic. Repeated critiques point to confusing wind‑direction indicators, unintuitive mobile control placement, limited sailing‑physics realism, unclear health/healing mechanics, and a lack of difficulty or multiplayer options. Suggested improvements include larger or clearer wind displays, tutorial or auto‑trim features, more realistic turning and gust mechanics, adjustable sound, and expanded game modes such as races or regattas.
Ask HN: Has anyone replaced Claude/GPT with a local model for daily coding?
Community Discussion
Comments collectively emphasize that open‑source, locally run models such as Qwen 3.6, DeepSeek V4, Gemma, and Kimi can handle the majority of coding tasks at a fraction of the cost of commercial services, offering fast token throughput and privacy benefits. Users note that these models require precise prompting, may produce loops or less sophisticated architectural reasoning, and often need substantial hardware or careful quantization to achieve acceptable speed and quality. While many find them sufficient for personal or hobby projects, most acknowledge that frontier cloud models still outperform them on complex or large‑scale work, and that setup complexity and hardware constraints remain significant hurdles.
I hacked into the worst e-bike and fixed it [video]
Summary
The scraped text appears to be a footer or navigation panel from the YouTube website, listing standard informational and service links. Items include “About,” “Press,” and “Copyright,” which typically provide corporate background, media resources, and legal ownership details. “Contact us” offers communication channels, while “Creators,” “Advertise,” and “Developers” target content producers, advertisers, and software partners respectively. Legal and policy links such as “Terms,” “Privacy,” and “Policy & Safety” outline user agreements, data handling, and community standards. Functional links like “How YouTube works” and “Test new features” describe platform operations and beta testing. The “NFL Sunday Ticket” entry references a sports subscription service. The footer concludes with a copyright notice stating © 2026 Google LLC.
Read full article →
Community Discussion
The comment expresses enthusiasm for a bike resurrection method while noting the bikes are currently stored and unused. It recommends a creator’s detailed trail‑build videos, praising their quality but lamenting that YouTube’s algorithm favors short reaction content over longer, evergreen projects. The writer also critiques the creator’s reliance on AI‑generated script, finding the duplicated speech style off‑putting and less authentic. Overall, the tone is appreciative of the channel’s work yet dissatisfied with platform incentives and the AI implementation.
Show HN: Garden of Flowers – an archive of pictorial typography before ASCII art
Summary
Heikki’s “Garden of Flowers” is an online archive dedicated to pictorial typography, presenting a curated collection of 2,497 images that blend floral motifs with typographic elements. The site offers an adjustable grid layout ranging from 100 px to 400 px, allowing users to modify the visual density of the gallery. All images are displayed without applied filters, preserving their original color and composition. The header features a logo titled “Garden of Flowers,” reinforcing the brand identity. Navigation includes options to remove any active filters and to view the full image set, which is presented in a continuous scroll format. The archive serves as a comprehensive visual reference for designers and typographers interested in the intersection of botanical illustration and letterform design.
Read full article →
Community Discussion
The comments express a positive reception toward Arabic calligraphy, highlighting its artistic value and the practice of rendering Quranic verses, poetry, and other texts in decorative form. The idea is described as appealing, distinct, and aesthetically pleasing, with reviewers indicating appreciation for its uniqueness and overall quality. The tone is supportive and enthusiastic about the concept.
I Love the Computer
Summary
The essay recounts the author’s lifelong passion for computers, beginning with an IBM 486 DX6 running Windows 3.0 that his mother brought home in Norway when he was six or seven. Early exposure to print‑media magazines (e.g., TEKNO, Geek, Incite PC Gaming) shaped his “geek” identity and provided hardware/software knowledge before the Internet became widespread. Relocating to Malaysia gave him regular school Internet access, leading to extensive exploration of forums, Java games, and self‑directed learning. A failed early attempt at programming (renaming a .txt file to .exe) prompted later formal study; he subsequently mastered Java, C++, PHP, earned an honours degree in Computer Science, and pursued a career in web development, audio engines, and open‑source contributions. Reflecting on current industry trends, he critiques the commercialization and “dark‑pattern” tactics that exploit the technology he admires, while noting increased accessibility of programming and a shift toward decentralized, self‑hosted solutions. Despite these tensions, his affection for computers remains unchanged.
Read full article →
Community Discussion
The comments convey a strong, enduring affection for computers rooted in hands‑on tinkering, learning, and the deterministic nature of code. Many recall early experiences that shaped their enthusiasm and lament recent trends that restrict freedom, such as platform lock‑in, invasive software, and corporate ecosystems. Opinions on AI are mixed: several view large language models as useful accelerators for prototyping and learning, while others feel they undermine predictability and erode deep understanding. A recurring theme is the desire to preserve autonomy through self‑hosting, alternative protocols, and low‑level exploration.