Engineering &
Security Wire
Curated from Hacker News, Lobsters, Krebs on Security, and other top sources. Updated every 6 hours.
Exapunks (2018)
Article URL: https://www.zachtronics.com/exapunks/ Comments URL: https://news.ycombinator.com/item?id=48765663 Points: 173 # Comments: 66
Postgres transactions are a distributed systems superpower
Article URL: https://www.dbos.dev/blog/co-locating-workflow-state-with-your-data Comments URL: https://news.ycombinator.com/item?id=48765639 Points: 57 # Comments: 27
Vulkan is now available on NetBSD
Article URL: https://github.com/segaboy/vulkan-netbsd Comments URL: https://news.ycombinator.com/item?id=48765607 Points: 53 # Comments: 12
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. "Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remote Management and Monitoring (RMM) tooling, credential access, and hands-on-keyboard procedures used for lateral
24-bit/192kHz music downloads and why they make no sense (2012)
Article URL: https://people.xiph.org/~xiphmont/demo/neil-young.html#toc_wd2bm Comments URL: https://news.ycombinator.com/item?id=48763790 Points: 69 # Comments: 96
SwiftUI Adds New Document Protocol, Improves Performance, and More
Announced at WWDC 2026, the latest SwiftUI release brings a new Document protocol for efficient disk access and snapshot-based updates, along with improved APIs for reordering items in lists, grids, and sections. In addition, it expands presentation features, such as swipe actions on any view, better AsyncImage caching, and lazy state initialization for Observable types to boost performance. By Sergio De Simone
How GitHub used secret scanning to reach inbox zero
GitHub had 20,000+ secret scanning alerts across 15,000 repositories. Here's how we separated signal from noise, built remediation workflows, and reached inbox zero in nine months. The post How GitHub used secret scanning to reach inbox zero appeared first on The GitHub Blog.
Show HN: zkGolf – Competitive optimization of formally verified circuits
Zero-Knowledge Proofs (ZKPs) let an untrusted proved show that computation was executed correctly without revealing the inputs to the verifier. However to prove anything, the computation first has to be expressed as a circuit: a system of polynomial equations (constraints) over a finite field. Circuits are the assembly language of zk and every constraint costs prover (and sometimes verifier) time, so production circuits are aggressively hand-optimized. Over the last months, we have been experimenting with writing formal specifications instead and letting LLMs produce the circuits: as long as they could prove that their implementation was correct. It started with SHA-256: we hand wrote a specification in Lean for SHA-256 compression, and then we asked LLMs to write the circuit, targeting R1CS arithmetization and large fields. It took a few hours of work for Opus 4.7, and some light steering into the right direction, but in the end the model came up with a reasonable implementation. We
Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
20 points, 0 comments on Hacker News
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories
This week’s security news is mostly about weak spots. Browsers, bots, sandboxes, AI systems, and email flows all show the same problem in different ways. Everything looks normal until someone tests a small gap and finds a way through. This is not one big break. It is small permissions, weak checks, open systems, and normal tools doing things they were allowed to do. That same pattern runs
Launch HN: Manufact (YC S25) – MCP Cloud
31 points, 17 comments on Hacker News
Spain Orders Blacklist of Palantir from Public and Private Companies
482 points, 153 comments on Hacker News
FoundationDB's Flow – Bringing Actor-Based Concurrency to C++11
44 points, 6 comments on Hacker News
Podman v6.0.0
287 points, 107 comments on Hacker News
Show HN: CLI tool for detecting non-exact code duplication with embedding models
18 points, 5 comments on Hacker News
Show HN: Mail Memories – A desktop app to rescue photos from Gmail
44 points, 16 comments on Hacker News
Immich 3.0
231 points, 116 comments on Hacker News
The difference between "today's task" and "accretive work"
52 points, 27 comments on Hacker News
Tools or techniques for conveying mental models?
What are tools or techniques which well for conveying and growing mental model? Techniques I have seen which work well include: Building and maintaining the system (growing) Scribbling on napkins or gesturing next to someone with a furrowed brow (conveying) Documentation which enumerates surface area or catalogs features may be exhaustive but often doesn't achieve either building or conveying the mental model of the subject in question. Using a well designed tool or product directly can achieve both. What are the tools and techniques which work for you? What makes them effective?
Pure-Python symbolic regression that rediscovered Kepler's law from 8 data point
16 points, 8 comments on Hacker News
AI can't be listed as inventor on patent applications, Japan's top court rules
136 points, 55 comments on Hacker News
Show HN: ZeroFS – A log-structured filesystem for S3
66 points, 34 comments on Hacker News
Show HN: A graph paper generator that renders vector PDFs in the browser
Article URL: https://freegraphpaper.net/ Comments URL: https://news.ycombinator.com/item?id=48761294 Points: 19 # Comments: 4
The Egg Bandits Made a Thousand Times the Fine They Just Paid for Price Fixing
94 points, 22 comments on Hacker News
Comparing Fable and 10 other LLMs on refactoring a LangGraph god node
Article URL: https://wtf.korridzy.com/twilight-of-the-gods/ Comments URL: https://news.ycombinator.com/item?id=48761132 Points: 18 # Comments: 5
How to ask for help from people who don't know you
55 points, 2 comments on Hacker News
ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API
The threat actor known as ToddyCat has been attributed to a new malware called Umbrij that's designed to gain surreptitious access to a victim's email correspondence via the Google API. "In this campaign, the attackers focused their attention on corporate email communications hosted on Gmail, targeting access compromise via APIs," Kaspersky said in a detailed report published this week. "
Winamp Skin Museum
Article URL: https://skins.webamp.org Comments URL: https://news.ycombinator.com/item?id=48760840 Points: 67 # Comments: 36
Germany’s Infineon opens major chip plant as EU seeks tech autonomy
Article URL: https://www.rfi.fr/en/international-news/20260702-germany-s-infineon-opens-major-chip-plant-as-eu-seeks-tech-autonomy Comments URL: https://news.ycombinator.com/item?id=48760669 Points: 73 # Comments: 19
kernel asynchronous reads in PostgreSQL 19 (io_uring)
Comments
Aggregated from public RSS feeds & the Hacker News API · All links point to original sources · Clawship does not republish full articles