HackerNews Digest

The page titled “Let's Encrypt Status” informs users that support for Let’s Encrypt services is provided through the community. Current service status, outage reports, and related updates are available on the Let’s Encrypt Community forum at https://community.letsencrypt.org. The page includes two visual elements: a logo image and an “Add to Slack” image, each identified only by their alternative text. No additional technical details, operational metrics, or procedural instructions are presented.

None

MIT’s CSAIL team built Fractal, a custom OS kernel designed to study processor microarchitecture with minimal software noise. By booting on bare metal and exposing “outer kernel threads” that can switch privilege levels within a single address space, Fractal enables precise experiments on internal structures such as branch predictors, caches, and TLBs. Using this platform on Apple’s M1 chip, researchers confirmed that CSV‑2 protections block speculative execution of indirect branches but discovered that instruction‑cache fetches still occur across privilege boundaries, exposing a side‑channel. They also provided the first evidence of “Phantom” speculative attacks on Apple Silicon and showed that conditional branch predictors lack privilege isolation on both performance and efficiency cores—contradicting earlier macOS‑based results. Fractal supports x86_64, ARM64, and RISC‑V, includes POSIX APIs, a C library, and common tools, and is intended as reusable infrastructure for microarchitectural research, analogous to QEMU or FFmpeg. The findings were disclosed to Apple, and the work was funded by NSF, the Air Force Office of Scientific Research, and DARPA‑related programs.

DuckDB is an in‑process analytical SQL engine optimized for large‑scale scans, aggregates and joins. Its speed derives from several architectural choices: column‑oriented, compressed storage with per‑row‑group zone maps; vectorized operators; morsel‑driven parallelism; optimistic MVCC; and zero‑copy data access via Arrow or direct NumPy buffers. Queries are parsed (PostgreSQL‑based parser) into an AST, then bound to catalog objects, type‑checked, and passed through ~30 optimizer passes (e.g., filter push‑down, join reordering, runtime filter generation). The logical plan is converted into a physical plan composed of pipelines—streaming operator chains that run concurrently on separate threads, with pipeline breakers (GROUP BY, ORDER BY, hash‑build) handling stateful phases and merging results in parallel. Storage uses fixed 256 KB blocks; columns are stored separately and grouped into row groups (≤122 880 rows) with min/max statistics used for data skipping. DuckDB reads Parquet directly, leveraging its columnar layout and statistics, and auto‑detects CSV dialects, types and headers via a sampled sniffer. The library model eliminates client‑server serialization overhead, enabling sub‑second queries on multi‑gigabyte files without a separate server.

Enterprise‑Managed Authorization (EMA) is a stable MCP extension that lets organizations control server access centrally via their identity provider (IdP). During single sign‑on, the client receives an Identity Assertion JWT Authorization Grant (ID‑JAG) from the IdP, exchanges it for an MCP access token, and bypasses per‑server consent screens. Key outcomes are: one‑time authorization that propagates to all authorized servers, centralized policy‑definition and audit in the IdP console, and separation of corporate and personal accounts. Early adopters include Okta (first supported IdP with Cross App Access), Anthropic and Visual Studio Code (client implementations), and servers such as Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase. The extension aims to eliminate the high‑friction, per‑user consent model that hinders enterprise MCP deployments, improving security, observability, and user experience. Participation is invited through the EMA Interest Group, and the spec is documented in SEP‑990 and the ext‑auth repository.

The author discovered a large‑scale malware distribution on GitHub involving ~10 000 repositories that periodically replace their latest commit with a README update linking to a zip archive. Each archive contains four files (a script, a loader executable, a random‑named payload file, and lua51.dll) that together form a Trojan; VirusTotal flags the zip but not the individual files. The repositories are newly created, have unique contributors and names, and are not forks; they copy full commit histories from other projects to appear legitimate. By analyzing GitHub event archives (gharchive) and filtering for repositories with frequent push events (1–24 updates per 24 h) and README‑only changes, the author narrowed the set from millions of pushes to 40 000 candidates, confirming 10 000 exact matches. The campaign evades detection by repeatedly deleting previous commits and reposting the malicious README, using generic commit messages (“Update README.md”). GitHub’s rate limits slowed the author’s search, but the platform eventually began deleting the identified repositories after the findings were publicized.

Japan’s railways were once operated by the state‑owned Japanese National Railways (JNR), which accrued heavy debt in the 1980s. To improve efficiency, the government split JNR into six regional passenger companies and one freight company, forming the JR Group. Despite becoming independent entities, the companies adopted a single corporate identity to preserve continuity. The Nippon Design Center, led by chief director Yūsuke Kaji and art director Yōji Yamamoto, created the “JR” logotype and visual system in 124 days, selecting the letters “JR” over “NR” and standardizing the mark across all companies. A limited palette of 15 heat‑transfer colors dictated each company’s primary and secondary hues, tied to regional imagery (e.g., green for Hokkaido, orange for Central). The kanji for “railway” was altered from a character implying “loss” to one meaning “arrow” to avoid negative connotations. On 1 April 1987, crews manually applied the new logo to roughly 10 000 vehicles within a four‑hour window. The logo’s simple, heavy‑stroke design, balanced orientation, and alignment with the companies’ Mind, Behavior, and Visual Identities have kept it unchanged for four decades.

Gribouille 0.3.0 adds concise guide control, themed composition, and several default‑behavior changes. - **Guide syntax**: `guides(x: none)` or `guides(y: none)` hide axis ticks/labels while preserving axis lines, grids, and titles; `labs(x: none)` removes the title. `guides(default: none)` suppresses all legends, `guides(none)` hides a specific legend, and `guides(auto)` restores defaults. The same syntax works with `coord‑radial` (`guides(theta: none)`, `guides(r: none)`). - **Compose**: a new `theme:` argument styles the composition chrome (shared title, hoisted legend, panel tags) and cascades to panels lacking their own theme. - **Defer helper**: `plot(..., defer: true)` is replaced by `defer(plot, ...)`; panels inside `compose()` no longer accept individual `width`/`height`. - **Geom‑area**: defaults to `stat: "align"` and `position: "stack"`; `stat: "align"` resamples mismatched x‑values before stacking. - **Annotate**: new `clip:` flag (default true) allows marks to overflow panel bounds when set false. - **Legend and stat fixes**: improved horizontal legend alignment, grid layout for continuous legends, error‑checked `guide‑legend` parameters, `stat-bin-2d/hex_density` now reports cell fractions, validated sqrt/log10 transforms, and proper handling of scale expansion and `geom‑linerange` alpha. - **Editor support**: Tinymist‑compatible docstrings expose parameters and examples directly in IDE tooltips.

A compact tabletop robotics research platform was built for under €5,000 (excluding VAT and compute). It uses a UFACTORY xArm Lite 6 industrial‑grade arm with a parallel gripper, an Intel RealSense D405 wrist‑mounted RGB‑D camera, and a Logitech C920 static webcam. Control is provided via a 3Dconnexion SpaceMouse (6‑DOF input) constrained to translation (x, y, z) and yaw rotation. The system fits on a small IKEA table beside the researcher’s desk and meets constraints of ≤ €10 000 cost, desk‑size footprint, off‑the‑shelf parts, Python accessibility, and stack‑agnostic design. The software stack, named robo, is a ~3 000‑line Python package handling sensing, control, teleoperation, visualization, data logging, and telemetry, running on macOS without ROS 2 or LeRobot abstractions to retain full low‑level control. The arm offers TCP‑space actuation, self‑collision avoidance, configurable speed/acceleration limits, and a teach mode. Cameras provide raw RGB and depth data without extrinsic calibration, emphasizing rapid iteration over precise geometric setup. The overall design demonstrates that a single researcher can conduct meaningful manipulation experiments on real hardware with modest resources.

Datasette Apps is a plugin that lets developers embed self‑contained HTML + JavaScript applications inside a Datasette instance via sandboxed iframes. The iframes use `sandbox="allow-scripts allow-forms"` together with a strict `Content‑Security‑Policy` (`default-src 'none'`) to block cookies, localStorage, and external network requests unless explicitly allowed. Communication with the parent window occurs through `postMessage()` or, preferably, `MessageChannel()`, enabling a controlled protocol for read‑only SQL queries that are validated against an allow‑list of databases. Write operations are possible only via Datasette’s stored‑query feature, where specific insert/update queries are pre‑approved and invoked from the app (`await datasette.storedQuery(...)`). The plugin supplies a “copy prompt” that contains the full schema and API usage (`await datasette.query(...)`) so large language models can generate or modify apps automatically. Security hardening includes restricting CSP host allow‑listing to a new `apps-set-csp` permission and optional `allowed_csp_origins` configuration for trusted domains. A demo instance (`agent.datasette.io`) showcases simple and complex timeline apps, visible query/error logs, and AI‑assisted app creation.