HackerNews Digest

OpenAI’s audited 2025 financials, revealed by Ed Zitron and confirmed by the Financial Times, show $13.07 billion in revenue against $34 billion in total costs, yielding a $20.92 billion operating loss and a $38.53 billion net loss attributable to the company after accounting for a $41.55 billion fair‑value adjustment to convertible interests and warrant liabilities. Revenue grew ~3.5× from 2024, but operating losses rose ~2.4×, driven by $7.5 billion cost of revenue, $19.18 billion R&D, $5.73 billion sales & marketing, and $1.57 billion G&A. Microsoft, holding ~27 % of OpenAI Group, received $17.2 billion in expenses (including $10.59 billion R&D) and had $3.64 billion in year‑end liabilities to OpenAI. The company’s capital structure—nonprofit foundation controlling a for‑profit public‑benefit corporation—facilitated a $122 billion capital commitment at an $852 billion post‑money valuation, but the disclosed losses highlight a cost base expanding faster than typical software businesses, posing a challenge for any forthcoming IPO.

GrapheneOS has completed a full port to Android 17 and will begin public releases shortly. The team is finalizing an official build based on Android 16 QPR2 today, with an initial Android 17 release slated for tomorrow. Testing of the Android 17 port has been performed on Pixel 6a, 7, 7a, 8, 10a, 10, and 10 Pro Fold, and the code will be pushed to public repositories later today, enabling users to build and test it themselves. The forthcoming public release will cover all supported devices, and each will have been tested before availability. This marks the transition from internal testing to public testing and distribution for the Android 17‑based GrapheneOS builds.

Local models have become practically usable on a 2022 M2 Mac with 64 GB RAM using tools such as llama.cpp, Ollama, LM Studio, and Pi. The author notes a marked improvement since the release of GPT‑OSS, with models now requiring minimal verification against API services. Recent Google Gemma‑4 releases (26B‑A4B and 12B‑QAT) achieve roughly 75 % of frontier model accuracy and speed, enabling tasks like refactoring Python code, linting with type hints, proofreading, generating unit tests, and bootstrapping recommendation systems. The workflow runs in Docker containers for security, using Pi as the agent harness and LM Studio as the inference server; a provided Docker‑Compose configuration connects Pi to the local model endpoint. Limitations remain: slower inference, constrained context windows, and occasional prompt‑template mismatches that are quickly patched. Benefits include full introspection of token processing, adjustable context windows, quantization tweaks, and the ability to compare models directly. The ecosystem is maturing, though the author cautions that it may not yet be production‑ready.

IIS reconnaissance begins with enumeration: use Shodan/FOFA/Censys queries for “http.title: IIS”, Google dorks (e.g., site:target.com intitle:"IIS Windows Server", inurl:aspnet_client, _vti_bin), and active fingerprinting of Server/X‑Powered‑By headers via httpx or raw sockets. Once identified, gather disclosed data such as internal IPs or X‑FEServer headers from HTTP/1.0 302 responses. Automate vulnerability checks with Nuclei tags (microsoft, windows, asp, iis). For 404 “HTTPAPI 2.0” responses, brute‑force virtual hosts using SSL certificate SANs or tools like ffuf with Host‑header wordlists. Leverage IIS tilde‑shortname enumeration (shortscan, Burp scanner) to reveal 8.3 filenames; resolve fragments via GitHub code search, BigQuery’s public GitHub dataset, or generated wordlists (LLMs, crunch). Prioritize IIS‑specific paths: web.config (and backups), global.asax, trace.axd, elmah.axd, appsettings*.json, _vti_pvt files, and extensions (.asp, .aspx, .ashx, .config, .json, .xml). Access to web.config yields machine keys for ViewState deserialization RCE. Additional exploits include path‑traversal to web.config, cookieless‑session DLL extraction, reverse‑proxy path‑normalization bypasses, NTFS alternate‑data‑stream auth bypasses, file‑upload extension tricks (trailing dots, .cer/.svg etc.), and HTTP Parameter Pollution to evade WAFs.

Version 15 of the Wolfram Language adds extensive core features and built‑in AI support. A new AI Assistant appears as a persistent chatbar in every notebook, offering code generation, context‑aware suggestions, and three service tiers (Basic, Pro, Research) without extra configuration. The Wolfram Agent Tools framework lets external LLM environments (e.g., Claude Code, Codex) invoke Wolfram functions, deployable via DeployAgentTools. TimeSeries is rebuilt on the Tabular framework, handling multi‑component series, missing data, and massive datasets (millions of points); EventSeries now supports discrete event collections and related utilities (TimeSeriesEvents, EventSeriesAccumulate, EventSeriesLookup). Categorical data receive a unified symbolic type distinguishing ordinal and nominal categories, usable in Tabular, TimeSeries, and EventSeries. ModelFit becomes a superfunction for fitting symbolic model outlines to data, covering exponential, logarithmic, polynomial, periodic, nearest‑neighbor, neural‑net, and decision‑tree models, with automatic reporting and multidimensional support. Symbolic music introduces hierarchical objects (MusicPitch, MusicNote, MusicChord, MusicMeasure, MusicVoice, MusicScore) and full MIDI import/export. Tabular connectivity is expanded: selective column import, faster DataConnectionObject access to cloud storage (Azure Files/Tables), OLAP sources (Databricks, Snowflake), and ExternalEvaluate integration for seamless Python‑pandas workflows.

Bash can issue plain‑text HTTP requests without external tools by using its built‑in “/dev/tcp” redirection. Open a bidirectional file descriptor with `exec 3<>/dev/tcp//`, write a request via `printf 'GET /path HTTP/1.1\r\nHost: \r\nConnection: close\r\n\r\n' >&3`, and read the response with `cat <&3`. The hostname must resolve and be reachable (e.g., a Docker service name). Additional headers (e.g., `Authorization: Bearer …`) are added as extra `\r\n`‑terminated lines before the final blank line. Key details: - `/dev/tcp` is not a real device; Bash handles it internally and performs DNS lookup and `connect(2)`. - It provides a raw TCP socket only—no TLS, no automatic handling of redirects, chunked encoding, compression, retries, or HTTP parsing. Use `Connection: close` to ensure the server terminates the connection; otherwise `cat` may block. - The feature is Bash‑specific (not POSIX), unavailable in `dash` or `zsh`, and requires Bash compiled with `--enable-net-redirections` (enabled in most mainstream builds). Thus, for minimal containers lacking `curl`/`wget`, this technique offers a quick connectivity check, though `curl` remains the appropriate tool for full HTTP client functionality.

The essay traces the evolution of laboratory glassware from Justus Liebig’s 1830s innovations to modern borosilicate standards. - Liebig, constrained by a modest Giessen lab, learned glassblowing in Paris and created the Kaliapparat, a potassium‑hydroxide‑filled glass apparatus for carbon analysis; its nitrogen determination proved unreliable, but it offered a low‑cost alternative to volumetric eudiometers. - He promoted open dissemination of glass‑making techniques, spurring an amateur glassblowing movement in the 1840s and leading to commercial catalogs (e.g., John J. Griffin, Heinrich Geissler). - Otto Schott’s development of low‑dispersion borate glass (later borosilicate) in the 1880s, in collaboration with Ernst Abbe and Carl Zeiss, yielded glass with superior hardness, thermal stability, and chemical resistance. - Schott’s 1892 borosilicate formulation became the standard for lab glassware, dominating the market until WWI disrupted German exports, after which Corning’s Pyrex (borosilicate) gained prominence in the United States. - Standardized ground‑glass fittings (CS 21‑36) and precision‑molded borosilicate enabled reproducible volumes and modular setups throughout the early 20th century. - Glassblowing remained a required skill in chemistry education into the 1950s, but today it is largely subcontracted; glass still dominates high‑temperature and optical laboratory applications, while plastics serve low‑cost, sterile uses.

None

GPT‑NL is a Dutch‑language large language model developed in the Netherlands and Europe to ensure sovereign control over technology, data, and model decisions. The project emphasizes transparency: source code and model weights are open‑source under a controlled licence, with detailed documentation of data collection, bias mitigation, and risk management. Training is performed from scratch to avoid inherited data provenance issues, with strict data‑curation criteria that exclude copyrighted, personal, confidential, harmful, or duplicated content. A Content Board involving data providers and rights holders governs data use, and a portion of revenues is redistributed to creators, supporting a reciprocal innovation model. Energy efficiency is prioritized through research‑guided optimization of model size and training processes to reduce power and water consumption. Funding of €13.5 million comes from the Netherlands Enterprise Agency (RVO) for the Ministry of Economic Affairs and Climate Policy, reflecting public investment in an independent, trustworthy Dutch language AI.

Publishers Weekly data show adult nonfiction sales fell 9 % in Q1 2026 versus Q1 2025, with self‑help down 26.3 % YoY; only crafts/hobbies ( +9.6 %) and religion ( +1.6 %) grew. Tim Ferriss’ five best‑selling titles (Print + ebook + audio) dropped 5 % in 2023, 13 % in 2024, 46 % in 2025 and 57 % in 2026 after the November 2022 launch of ChatGPT (GPT‑3.5). Overall catalog volume in 2026 is projected to be ~80 % lower than in 2022. Ferriss attributes the decline to LLMs delivering rapid, personalized “lookup‑table” advice that replaces prescriptive how‑to nonfiction. He predicts similar disruption for how‑to YouTube videos, advisory podcasts, online courses, newsletters and other instruction‑focused formats, as AI can summarize and personalize content instantly. Content that relies on experience, storytelling, humor, or unique voice may endure, but mass‑market prescriptive nonfiction faces rapid erosion. Ferriss suggests creators focus on a core “1,000 true fans” model and deeper, longer‑form engagement to survive the shift.