The Future of CSS
The Interop effort, coordinated by major browser vendors, routinely drives new CSS features to near‑universal support within a year—CSS Subgrid reached that level by late 2023. For Interop 2027, Mozilla’s ranking system highlighted ten proposals the author voted for:
- @function syntax for custom CSS functions (e.g., gradient‑to‑transparent, translate‑polar). Implemented in Chromium; likely to spread quickly.
- corner‑shape property offering squircle, bevel, notch, and scoop corner forms that modify the border‑box, currently unsupported in Firefox/Safari.
- border‑shape for drawing arbitrary borders with lines, arcs, and Bézier curves; also animatable.
- Anchor Positioning Level 2 adding container queries to detect fallback positioning of anchored elements.
- inherit() function enabling calculations on inherited values (e.g.,
calc(inherit() - 4px)). - Scroll‑triggered animations complementing existing scroll‑driven animations, removing the need for JavaScript observers.
- reading‑flow (and reading‑order) to align tab order with visual grid/flex layouts.
- interpolate‑size and calc‑size() for animating keyword values like
height:auto; supported in Chrome since 2024 behind@supports. - gap‑decorations (
rule,row‑rule,column‑rule) to render grid borders directly. - scroll‑state container queries for detecting when
position:stickyelements are stuck or when a scroll container reaches top/bottom.
Most proposals are usable today as progressive enhancements in browsers that already support them, and many are expected to enter Interop 2027 for broader adoption.
Show HN: SimCity, but with Permits
The page describes a city‑building simulation where development is contingent on permit approval. The model tracks residents’ ages, incomes, and housing, while businesses can hire, expand, and relocate. Economic variables such as land values, rents, taxes, and municipal services are dynamically linked, reflecting how changes in one sector affect the others. Gameplay involves navigating a planning committee, where proposals—e.g., upzoning suburban lots—are subject to opposition rates (e.g., 88 % dissent) and may be altered by mayoral concessions. Visuals illustrate diverse urban patterns: river‑front towers with distant factories, mixed‑use streets combining workshops, tank farms, warehouses, and small homes, fenced lots awaiting rezoning, lakeside hamlets, suburban deep‑lot homes, and dense high‑rise districts. The overarching theme emphasizes the iterative, score‑keeping nature of urban growth constrained by regulatory processes.
The comments show a mixed reaction to the “Permit Pending” simulation. Many find the premise amusing and a sharp commentary on real‑world permitting, zoning and democratic bureaucracy, while others praise its visual style and the idea of a realistic economic experiment. At the same time, a substantial portion criticize the user interface, excessive pop‑ups, unclear metrics, mobile and WebGL bugs, and a steep learning curve that makes the experience feel more like actual work than a game. Overall, the sentiment balances appreciation for the concept with disappointment over execution and usability.
Muse exposes users' personal and business secrets when they share conversations
Meta’s Muse AI agent allowed users to share searches, conversations, and images via unique URLs. Researchers at security firm Claroc discovered that the URL generation scheme was weak, enabling enumeration of 6,800 share links with a single query. Opening a sample of these links exposed a range of confidential data, including executive‑search notes, a marketing firm’s internal revenue review, a small‑business loan request, a bank‑fraud alert with partial account details, a real‑estate investor’s performance report, and a full‑year staff vacation calendar. The researchers obtained the URLs through passive DNS data, which records historical domain‑to‑IP resolutions. Claroc reported the findings to Meta’s bug‑bounty program on October 8; Meta responded by suspending the sharing functionality while reviewing the issue and considering redesigns to prevent link discovery. The incident highlights the risk of predictable sharing URLs despite Meta’s claim that Muse was built “from the ground up for privacy and security.”
The comments express strong criticism of Meta’s Muse service, focusing on perceived privacy and security shortcomings such as easily discoverable share links, inadequate URL design, and insufficient legal accountability for data handling. There is broader frustration with large tech companies’ reliance on advertising and data monetization, contrasted with the challenges of building a European personal‑AI platform that must manage user customizations, sandboxing, and compliance. Overall sentiment is skeptical toward Meta’s claims of privacy and security, and wary of entrusting sensitive information to such services.
Upcoming critical PHP security release (CVE-2026-109618 / -109619)
The comments convey widespread alarm about a critical PHP vulnerability affecting many recent versions, with most contributors urging immediate protective steps such as disabling session‑upload progress, blocking multipart/form‑data or POST requests, and relying on Cloudflare or host‑level mitigations while awaiting an official patch. Frustration is evident over the delay in releasing fixes and concern that unpatched sites are already being exploited. Several remarks criticize PHP’s long‑standing security issues and suggest migrating to other platforms, while others emphasize defensive layering and temporary shutdowns for high‑risk services. Overall, urgency and uncertainty dominate the discussion.
Voxtral 3
Voxtral 3 is a suite of speech‑to‑text, text‑to‑speech, and voice‑agent components designed for real‑time multilingual voice applications.
-
Transcription: Voxtral Small Transcribe 3 (state‑of‑the‑art multilingual model) supports 50+ languages, provides speaker diarisation, end‑of‑turn detection, and context‑biasing with keyphrase prompting. The Mini Transcribe 3 variant (4 B parameters) runs at $0.0035 /min with sub‑500 ms latency for 35+ languages and includes realtime diarisation benchmarks (cpWER) superior to Whisper, Scribe v2 and Gemini 3.5.
-
Synthesis: Voxtral Mini TTS 3 delivers expressive speech in 35+ languages and 50+ dialects, handling emotion, pacing and emphasis from textual context. It offers voice cloning from 30 min of audio (Pro Voice) and costs $13 per 1 M characters, outperforming comparable commercial TTS on quality‑per‑dollar metrics.
-
Voice‑Agent SDK: Integrated pipeline (LiveKit‑based) combines streaming transcription, Mistral‑Small reasoning, tool‑calling and speech output with <1 s turn latency; supports SIP/WebRTC, function calling, web search and private data retrieval.
-
Deployment: Available via Mistral’s EU‑hosted API or self‑hosted on‑premise, preserving data sovereignty. Pricing: transcription $0.0035‑$0.008 /min, speech synthesis $13 / 1 M chars, agent reasoning $0.04‑$0.08 /min.
The platform targets contact‑center agents, virtual assistants and hands‑free copilots, enabling multi‑step actions across connected systems while maintaining language coverage and expressive vocal output.
Comments show a blend of enthusiasm and caution toward the new Voxtral models. Users appreciate the ability to run a 4 GB‑VRAM version in real‑time on modest hardware and note improvements in transcription and diarization, yet many criticize the shift to a closed model, citing privacy concerns and limited open‑source access. Performance opinions are mixed: some find the voice sounding artificial and the French accent amusing, while others report acceptable word‑error rates but stress remaining issues with latency, multilingual mixing, and full‑duplex capability. Comparisons to Whisper, Nvidia, and commercial STT services highlight a demand for better accuracy, speed, and open tooling.
Feds suspect ransom negotiator ran ShinyHunters extortion site
U.S. federal investigators have linked executives at two ransomware‑negotiation firms to the ShinyHunters extortion operation. ShinyHunters, active since 2019, has extorted >$70 million this year and recently hacked the FBI recruitment site, threatening to release personnel data. Leadership shifted from French hackers to “Rey,” a teenage hacker from Amman; Rey was detained in Jordan after Dutch authorities arrested senior member Pepijn van der Stap on September 15 2026, seizing his Signal messages. Those messages revealed frequent contact with Canadian cybersecurity executive Edward Dubrovsky and a U.S. consulting‑firm executive, both aware of breaches before victims. Dubrovsky, author of a cyber‑extortion guide, was arrested on extortion charges; investigators believe he knew of the FBI data breach but did not inform the agency.
A defunct extortion site, shinywire.com (May 3 – Oct 16 2026), listed ~100 victim firms and was reportedly run by an executive at the U.S. consulting firm. The site posted stolen samples and threatened publication on Tor if victims did not negotiate.
The case highlights conflicts of interest where negotiators profit from ransom payments, prompting DOJ prosecutions of negotiators (e.g., MonsterCloud CEO Zohar Pinhasi, Angelo Martino) for fraud and conspiracy. Industry experts call for greater transparency in ransomware‑response fees.
Comments display a mixture of curiosity and criticism. The use of flash‑bang grenades by Dutch police and the FBI website hack are noted as surprising or concerning, with several remarks questioning law‑enforcement tactics and past leaks. Ransomware negotiation practices generate debate over incentive structures, while professional negotiators are described as valuable and reputable. Humor and sarcasm appear in references to “teenage hacker” and “Breaking Bad” analogies, and there is overall skepticism toward institutional competence and reliability.
eMudhra intermediate CA compromise
The private keys of eight eMudhra intermediate CAs, issued in April 2025, were compromised due to faulty key generation that allowed key recovery from the certificates. The compromise was demonstrated on 17 Oct 2026 by signing a test message with each intermediate’s private key; verification files (certificates, public keys, signatures) are provided in proof.zip. The intermediates chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome, enabling an attacker to impersonate any site signed by them. Mozilla, Microsoft, Apple, and Chrome blocked the intermediates via OneCRL, CRLite, and CRLSets (Firefox/Chrome on 17 Oct, Apple on 19 Oct, Microsoft on 20 Oct). The CA revoked the intermediates, but many non‑browser clients do not process revocation data. Instructions are given to test trust (curl commands) and to manually remove the affected roots from system trust stores across Linux distributions, macOS, and BSD. Users are advised to update browsers and OSes promptly; further technical details are in Mozilla’s bug tracker and the incident report repository.
The discussion centers on the discovery that eight eMudhra intermediate certificates were issued with effectively one‑byte private keys, exposing a severe weakness that could allow impersonation of any site signed by those CAs. Commenters note that browsers with built‑in revocation mechanisms (OneCRL, CRLite) mitigate the risk, while many command‑line tools and embedded systems remain vulnerable due to outdated or bundled trust stores. The community emphasizes the need for stronger revocation infrastructure, coordinated patching across languages and platforms, and critiques of the PKI’s reliance on centralized CAs and inadequate key‑generation safeguards.
In Hilbert space, all things are quantumly possible
Hilbert space is defined by two mathematical criteria: completeness (no missing points) and the existence of an inner product that quantifies alignment between states and axes. Its dimension reflects the number of possible outcomes for a system—e.g., a qubit has a two‑dimensional space, a particle with unrestricted position has an infinite‑dimensional space. The same Hilbert space underlies different measurement bases, allowing Heisenberg’s picture (rotating axes) and Schrödinger’s picture (rotating state vectors) to describe identical physics. Von Neumann named these abstract spaces after Hilbert, who first studied infinite‑dimensional examples.
Philosophically, some, like Sean Carroll, treat Hilbert space as the fundamental arena of reality, while others, such as Jonathan Sorce, view it as a useful but not universal mathematical tool, preferring alternative structures when needed. One such structure is the von Neumann algebra, which describes transformations of Hilbert spaces and has been explored to resolve logical issues and to model quantum aspects of spacetime and black holes. Researchers thus employ a “zoo” of spaces—Hilbert spaces, von Neumann algebras, and others—depending on the quantum system under study.
The comments focus on the distinction between what is mathematically conceivable and what is physically permissible, emphasizing that only phenomena consistent with physical laws—such as energy conservation—are truly possible. Several contributions treat Hilbert space as a useful abstraction rather than a literal reality, while others reference related philosophical ideas like superdeterminism and quantum correlations. A recommendation highlights Sean Carroll’s “Mindscape” podcast, particularly the episode featuring David Wallace, as a source for further discussion of these topics.
Good type against all odds
The text explains how certain display technologies update screens line‑by‑line from top to bottom, causing a slanted visual effect similar to rolling‑shutter distortion; this influences the direction of italic slant, which in English and German defaults to a right‑leaning angle due to reading direction and typographic convention. It notes that the opposite direction could be chosen without technical necessity, highlighting the importance of understanding such details in design decisions. The author then lists several typographic curiosities observed in low‑resolution (5×7 pixel) fonts and other media: unexpected small‑caps, a train‑carriage icon, a stadium icon formed from four characters, decorative fills, a vertical ligature created by removing line height, a slanted “NOT” glyph, extended underlines, a three‑dimensional underline, an easter‑egg on an old typesetting machine, hyphenation on a computer keyboard, and an old‑fashioned contraction. Each example is accompanied by images that illustrate these intentional but unconventional typographic treatments.
The comments focus on the typographic slant of handwritten letters, offering historical and ergonomic explanations while noting that right‑leaning slant persists across left‑to‑right and right‑to‑left scripts, suggesting it is largely conventional. Appreciation for Marcin’s detailed presentations of mundane design elements is prevalent, with readers expressing admiration for his storytelling, photography, and editorial choices. A few remarks add peripheral observations about related topics such as Yiddish handwriting, film references, and hardware displays, but overall the tone remains supportive and enthusiastic toward the content and its creator.
Composite objects and C++26 the std:polymorphic type
The article introduces C++‑26 std::polymorphic as a value‑type alternative to std::unique_ptr + virtual clone() for owning heterogeneous components. Using a smart‑home event hierarchy, it shows the traditional design (abstract base Event, derived sensor events, EventLog holding std::vector<std::unique_ptr<Event>>) which requires hand‑written copy/assign, a public clone() method, mutable pointees through const pointers, and the possibility of null entries. Replacing unique_ptr with std::polymorphic<Event> eliminates these issues: the container becomes copyable via deep copy automatically, the interface stays clean (no clone()), const‑propagation works because a const std::polymorphic yields a const reference, and the type never holds a null value (only a moved‑from, detectable state). std::polymorphic achieves this through type‑erased copy and destroy operations captured at construction (e.g., via std::in_place_type). It supports small‑buffer optimisation, allocator awareness, and provides operator*, operator->, and valueless_after_move(). The article advises using std::polymorphic for value‑semantic owners with runtime‑varying types, std::indirect for fixed types, std::variant for closed sets, and smart pointers for shared identity.
The comments collectively express dissatisfaction with recent C++ additions, particularly the complexity and move‑semantic quirks of std::indirect for the pImpl idiom, and a preference for more straightforward designs such as enum‑based unions instead of class hierarchies. Several remarks convey a sense of fatigue toward continual language evolution, noting personal reluctance to adopt newer features. Additional queries raise technical concerns about copyability requirements for std::polymorphic and request clarification on default security configurations, indicating unresolved uncertainties.
Comments show a split between enthusiasm for recent CSS advances—such as variables, functions, responsive iframes, and modular styling—and frustration over growing complexity, browser‑specific implementations, and the blending of CSS with JavaScript‑level logic. Some participants celebrate the innovation and practical benefits in projects, while others argue that feature creep hampers simplicity, portability, and maintainability, suggesting a return to more straightforward approaches or entirely new styling paradigms. Overall, the discussion balances excitement for new capabilities with concerns about usability, consistency, and the future direction of CSS.