Apollo 11 AGC source code, OpenAI Hugging Face security incident, Gemini 3.6 Flash – Jul

OpenAI and Hugging Face address security incident during model evaluation

• ▲ 988
• 💬 671

This is a security incident report in which OpenAI and Hugging Face share early findings from an event that occurred during AI model evaluation. The disclosure highlights advanced cyber capabilities observed during the incident and extracts lessons for defenders. The discussion drew significant community engagement with a score of 988 and 671 comments on Hacker News, reflecting strong practitioner interest in AI evaluation security risks.

all-MiniLM-L6-v2: lightweight sentence-embedding model for semantic search

sentence-transformers/all-MiniLM-L6-v2

• ♥ 5,108
• ⇣ 241.3M

all-MiniLM-L6-v2 is a sentence-transformers model that maps sentences and paragraphs into a 384-dimensional dense vector space for tasks such as semantic search and clustering. It has been downloaded 241,315,604 times and received 5,108 likes on Hugging Face. Released under the Apache-2.0 license, it supports multiple runtime formats including PyTorch, TensorFlow, ONNX, Safetensors, OpenVINO, and Rust, making it practical for deployment across diverse environments.

A bug in Qwen3-TTS taught me voice is biometric

• ♥ 18
• 💬 5

The trained voice cloning model for my project is 50 megabytes. Anyone with those 50 megabytes can… Context: Dev.to – Ai.

worldmonitor: real-time global intelligence and situational awareness dashboard

koala73/worldmonitor

• ★ 66.5k
• ⮂ 10.3k

Worldmonitor is an open-source TypeScript application that combines AI-driven news aggregation, geopolitical monitoring, and infrastructure tracking into a single real-time situational awareness interface. It exposes an MCP server component, allowing integration with AI agent workflows for intelligence gathering and monitoring tasks. The repository has accumulated 66,477 stars and 10,295 forks, with 239 open issues tracked on its main branch.

Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber

• ▲ 664
• 💬 515

Google has introduced three new Gemini large language models: Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber. The announcement emphasizes efficiency, low latency, and reliability as core characteristics aimed at developers building AI agents. The release attracted significant community attention on Hacker News, generating 664 points and 515 comments discussing practical implementation implications.

bge-m3: multilingual sentence embedding model

BAAI/bge-m3

• ♥ 3,247
• ⇣ 33.6M

BGE-M3 is a sentence-similarity embedding model designed for multi-lingual, multi-functional, and multi-granularity text representation. Built on XLM-RoBERTa and compatible with sentence-transformers, it supports feature extraction across many languages. The model is released under the MIT license and has accumulated 33,603,363 downloads and 3,247 likes on Hugging Face, indicating significant adoption for retrieval and similarity tasks.

We benchmarked an AI agent on 52 broken clusters: kubectl vs a Kubernetes MCP server

• ♥ 11
• 💬 7

Same agent, same faults, two ways to see the cluster. The one with the resource graph and change timeline used 76% fewer tool calls and finished in half the time. Context: Dev.to – DevOps.

AstrBot: open-source multi-platform AI chatbot framework

AstrBotDevs/AstrBot

• ★ 37.6k
• ⮂ 2,623

AstrBot is a Python-based open-source agent chatbot platform that connects mainstream instant messaging services such as Discord to large language models and plugins. It provides a development framework for building AI assistants across multiple IM platforms and positions itself as an alternative to closed solutions. The project holds 37,590 stars, 2,623 forks, and is licensed under AGPL-3.0.

bert-base-uncased: Google's foundational English fill-mask language model

google-bert/bert-base-uncased

• ♥ 2,712
• ⇣ 79.2M

BERT base model (uncased) is a pretrained English language model trained with a masked language modeling (MLM) objective, making it suited for fill-mask tasks and downstream fine-tuning. It remains one of the most widely adopted models on Hugging Face, with 79,205,163 downloads and 2,712 likes. The model is released under the Apache-2.0 license and supports PyTorch, TensorFlow, JAX, ONNX, and Safetensors.

Kimi K3 Is Competitive with Fable; Kimi K3 and Fable Is SoTA

• ▲ 522
• 💬 288

A benchmark study from Fireworks AI evaluates routing between the open-source Kimi K3 model and the closed Fable 5 model across over 1,000 agentic tasks. The findings show that while each model is individually competitive, a routing approach combining both surpasses either model alone, establishing a new state-of-the-art result. The models exhibit distinct strengths that make complementary routing effective. The post drew 522 points and 288 comments on Hacker News.

4 Open-Source AI Tools, 1 MCP Server — What I Built and What I Learned

• ♥ 8
• 💬 11

4 Open-Source AI Tools, 1 MCP Server — What I Built and What I Learned is a developer community article; review the code, assumptions, and comments before treating the technique as production guidance. Context: Dev.to – Discuss.

How AI changed the way I pick frameworks, and the two places React survived

• ♥ 6
• 💬 7

That 130-file PR that shipped KeyEcho 1.0 contained a decision I never wrote about: the desktop app… Context: Dev.to – Web Dev.

Jack Dorsey launches Buzz to combine team chat, AI agents and Git hosting

• ▲ 299
• 💬 255

Buzz is a new self-hostable workspace from Block that integrates team chat, AI agents, automated workflows, and Git hosting into a single product. Built on signed Nostr events for its underlying protocol, the platform aims to consolidate several developer collaboration tools that are typically managed as separate services. A Hacker News thread with 299 points and 255 comments reflects active community interest and scrutiny of the approach.

Judge approves $1.5B Anthropic settlement for pirated books used to train Claude

• ▲ 276
• 💬 200

A federal judge has approved a $1.5 billion copyright settlement against Anthropic for using pirated books to train its Claude chatbot. The settlement will distribute payments to thousands of authors at approximately $3,000 per book. The case sets a significant precedent for how AI training data practices involving copyrighted material are treated under intellectual property law.

"Drawing" the Mona Lisa with GPT-5.6, Claude, Gemini, and Grok

• ▲ 171
• 💬 59

A benchmark post from TryAI that tests GPT-5.6, Claude, Gemini, and Grok on a shared spatial-reasoning task: drawing the Mona Lisa on a blank canvas using virtual colored-pencil tools. Each model independently sets color, tip width, and pressure, lays down strokes in batches, smudges, erases, and calls a view-canvas function to inspect and correct its own output, with every stroke and dollar cost tracked across all four models. The Hacker News thread has gathered 171 points…

CreateOS Sandbox

CreateOS Sandbox gives AI agent builders their own fast, secure, hardware isolated, sandbox in ~30ms (p90). We have suit of CLI, SDK, 50+ SDK real world examples, claude plugins, computeSDK integration, and more. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Phantomstory

Phantomstory helps teams win AEO by launching third-party blogs on fresh domains in under 5 minutes. With just two clicks, Phantomstory provisions credible content hubs that incrementally publish AI-search-ready articles. The secret? A portion of these expertly-written articles are designed to help LLMs discover, unde… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Skim

Skim is a free, open-source (MIT) email client for Windows. ✂️ Minimal on purpose: no calendar, no rules engine, no bloat. Fewer buttons, less cognitive load. ⚡ Native Rust core (Tauri 2): ~5 MB installer, sub-second cold start, instant full-text search. 🔒 Local-first, offline-ready, zero telemetry. ✦ AI on your terms… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Manifest

Manifest turns any webpage into a structured JSON map of what an AI agent can click, fill, and submit. One API call, no fragile selectors. Every action comes with resolved CSS/role locators, plus a requires field that encodes dependencies between elements (e.g. "select a plan before this button is clickable"). That's… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Microsoft is testing a Chinese model (Kimi) inside Copilot. Are we entering the 'Intel Inside' era of AI?

A Reddit discussion reports that Microsoft is testing Kimi, a Chinese-developed AI model, within its Copilot product. The post frames this as a potential shift toward an "Intel Inside" dynamic for AI, where competing foundation models from different countries become interchangeable components inside mainstream applications. The source is a community signal with no independent verification yet available.

Half of us are using AI to write resumes, the other half is using AI to screen them, and I don't think anyone's actually looking at people anymore

A community discussion on r/artificial highlights a growing tension in hiring: roughly 47% of small businesses now use AI in HR functions such as resume screening and onboarding, while more than half of job applicants use AI to write their resumes. The post raises concerns that automated systems are effectively talking to each other, with diminishing human involvement in evaluating candidates. Fetched page content was unavailable for verification.

Is it just me, or do Google’s AI tools feel oddly fragmented across too many different products?

A Reddit r/artificial thread raises concerns about the fragmentation of Google's AI tools across multiple products and interfaces. The poster notes that while individual Google AI capabilities are impressive in demos and tutorials, actually using them day-to-day requires navigating scattered, disconnected entry points instead of a unified experience. The discussion reflects a growing practitioner frustration with inconsistent AI tooling surfaces within Google's product ecosy…

Analyzing the OpenAI – Hugging Face ExploitGym incident

This article analyzes the ExploitGym incident, a security evaluation involving OpenAI systems and Hugging Face infrastructure. It examines the attack sequence, environment design, and autonomous decision-making of advanced AI systems during realistic security testing. The discussion also covers containment mechanisms used and implications for AI security benchmarking. Detailed source material beyond the summary was unavailable, so specific findings could not be independently…

Why I Left Google DeepMind By Alex Turner

This is a community discussion on r/artificial linking to a post by Alex Turner titled "Why I Left Google DeepMind." The post appears to be a personal account from a former DeepMind employee sharing reasons for departing the AI research lab. The linked Reddit page did not load substantive content at the time of signal capture, so specific claims or arguments from the original post are not available in the provided context.

Big Tech is hiding $1.65tn in off-balance-sheet AI debt

A community discussion on r/artificial highlights a claim that major technology companies are concealing $1.65tn in off-balance-sheet debt related to AI infrastructure and investment. The figure suggests significant costs around compute, energy, and maintenance obligations are not fully reflected in corporate financial statements. The signal is unverified and sourced from community discussion rather than formal financial reporting.

Free tool: give it any company name, get a Value Stick strategy breakdown back

A free, no-login web tool that accepts a company name and returns a structured strategy analysis built on the Value Stick framework, which examines willingness-to-pay and willingness-to-sell dynamics. The creator built it to explore AI as a research and reasoning partner rather than a chatbot, pulling recent news and context before producing the breakdown. The creator is actively seeking community feedback on its reasoning quality.

So is AI going to be any cheaper or is it going to stay expensive enough to not replace software/IT jobs?

A Reddit thread in r/artificial poses a practical question about the economics of AI adoption in the workplace. The poster notes recurring claims that AI remains expensive and that some companies are rehiring employees after finding automation costs unsustainable, then asks whether inference and deployment prices will eventually drop low enough to meaningfully replace software and IT roles. The discussion reflects ongoing uncertainty among practitioners about when, or whethe…

AI is great, but experience is still hard to replace

A Reddit discussion on r/artificial argues that AI tools excel at providing quick topical overviews for daily research but fall short when questions require specific, practical knowledge. The poster observes that real-world expertise remains necessary for navigating small industry details and edge cases that automated tools cannot adequately address, highlighting a current limitation of AI-assisted workflows.

“No AI” Statements Are Much More Than Mere Statements

An essay by James Zhan examining the role of explicit “No AI” declarations in creative works, arguing they are substantive rather than symbolic. The piece responds to a fellow creator's conflicted stance on whether such statements are necessary or useful, and makes the case that these labels matter now more than ever for communicating how content was produced.

CVE-2026-60137: WordPress Core SQL Injection Vulnerability

This is a SQL injection vulnerability in WordPress Core that has been confirmed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. SQL injection flaws allow attackers to manipulate database queries, potentially accessing or modifying site data. Specific affected versions, attack vectors, and patch details were not available in the retrieved context and require consultation of the primary NVD advisory.

CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability

This is a security vulnerability affecting WordPress Core, involving an interpretation conflict that has been confirmed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it is actively exploited in the wild. Inclusion in the KEV catalog signals that federal agencies and other organizations should treat remediation as urgent. No specific affected versions, technical exploitation details, or mitigation steps were available from the retrieved context.

CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

CVE-2026-0770 is a confirmed security vulnerability in Langflow involving the inclusion of functionality from an untrusted control sphere, now listed in CISA's Known Exploited Vulnerabilities catalog. This class of flaw typically allows an attacker to inject or invoke unauthorized code or components within the application's execution context. Exact affected versions, exploit details, and patch guidance were not available in the provided context.

CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability

CVE-2021-27137 is a stack-based buffer overflow vulnerability affecting DD-WRT, a Linux-based firmware widely used on consumer routers. The flaw is confirmed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. The NVD entry did not provide specific affected version numbers or technical exploitation details in the retrieved page snippets, so administrators should consult the primary advisory for mitigation guidance.

git –end-of-options

This is a short practical article explaining Git's –end-of-options flag, which the author encountered while reading a fix for a package manager CVE. The flag marks the boundary between Git command-line options and subsequent path arguments, preventing filenames that start with a hyphen from being misinterpreted as options. It is a useful detail for anyone building tooling that shells out to Git with untrusted input.

Verification: community signal; use the linked source as context, not final confirmation.

Apollo-11: original Apollo 11 Guidance Computer source code

chrislgarry/Apollo-11

• ★ 70.1k
• ⮂ 7,850

This repository contains the original Apollo 11 Guidance Computer (AGC) source code for the command and lunar modules, written in Assembly. It preserves the actual software that ran on NASA's onboard computers during the 1969 Moon landing, including the Comanche and Luminary revisions for the two modules. The repo has attracted 70,091 stars and 7,850 forks, boosted by Hacktoberfest activity.

croc: secure peer-to-peer file transfer CLI

schollz/croc

• ★ 37k
• ⮂ 1,465

croc is a command-line tool written in Go that lets two computers transfer files and folders simply and securely. It uses PAKE (password-authenticated key exchange) to establish end-to-end encryption between peers, then sends data over a relay rather than requiring a shared server or port forwarding. The project has 36,987 stars and is MIT-licensed.

FreeInk: Open ecosystem for e-readers

• ▲ 507
• 💬 113

FreeInk is an open-source collective building the complete software, firmware, and hardware stack for e-paper readers, with every layer released openly for others to extend. The project covers all three layers of an e-reader device rather than just one component, which matters for engineers interested in hackable e-ink hardware. The Hacker News discussion drew 507 points and 113 comments.

🐘 TypeScript for PHP? YES, that's possible! And it's not what you think…

• ♥ 8
• 💬 1

It is time to bring opposites together, to stir up these stagnant waters, and to restore an industry… Context: Dev.to – Php.

You're rethrowing errors and losing context. `Error.cause` fixes that.

• ♥ 6
• 💬 2

Error handling has a quiet problem. You catch an error deep in a call stack, wrap it in something… Context: Dev.to – Javascript.

wx_channels_download: WeChat Channels video downloader tool

ltaoo/wx_channels_download

• ★ 7,859
• ⮂ 1,265

wx_channels_download is an open-source desktop application written in Go that lets users download videos from WeChat Channels (微信视频号). It works by installing a local proxy certificate and injecting a download button into the WeChat PC client interface, supporting both macOS and Windows. The tool parses shared video links to extract direct video URLs. The repository currently has 7,859 stars and 1,265 forks.

Ten Steps Towards Happiness (2015)

• ▲ 100
• 💬 23

This is a personal essay by Pieter Hintjens, the software developer known for his work on ZeroMQ and community-building in open source. Originally published in 2015 on his blog, the article offers ten practical principles for finding happiness. It has resurfaced on Hacker News, gathering 100 points and 23 comments from readers revisiting Hintjens' writings after his passing in 2016.

ditto.site

Point Ditto at any public URL and get a faithful copy as clean, componentized Next.js or Vite code, in minutes. It's fully deterministic, so it's fast, cheap, and consistent. Components, tokens, interactions & hover states included. Free REST API + MCP server, open source. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Bringing the modern web to the original iPad mini

An engineering writeup describing how the author made the modern web usable on the original iPad mini, a device stuck on iOS 6 and unable to run contemporary JavaScript-heavy sites. The approach centers on a remote browser architecture that offloads rendering to a server, streaming the result back to the legacy device. The post covers what the author calls "the WebKit wall" and the overall system design.

Linux kernel will support $ORIGIN, sort of

• 💬 49M

A blog post by Farid Zakaria examining efforts to bring partial $ORIGIN support to the Linux kernel, motivated by work on relocatable binaries in Nix during TacoSprint 2026. The $ORIGIN token, familiar from dynamic linker conventions, allows executable paths to be resolved relative to a binary's own location. The post discusses how kernel-level handling of this concept could reduce friction for Nix's store-path-independent binary relocation approach.

COSMIC DE’s First Seven Months

System76's blog post reviews the first seven months of development on COSMIC DE, their custom desktop environment for Linux. The visual tour covers UI improvements including a frosted glass effect for a more immersive desktop experience, plus gaming enhancements such as supporting multiple full-screen windows per workspace, game launch fixes, and input protocol additions that smooth the COSMIC gaming experience.

🤔 What Really Happens When You Run kubectl apply? Episode 3

• ♥ 7

Follow the complete journey of a Kubernetes Deployment—from your terminal to a running container… Context: Dev.to – DevOps.

GitHub suddenly rejected my SSH key (the fix was a .pub file?!)

This is a practitioner-focused engineering writeup describing a sudden failure where GitHub stopped accepting an SSH key and the fix involved creating or restoring a .pub public key file. The author documents the debugging process and operational lessons learned. Hosted on thorsell.io and surfaced via Lobste.rs, it offers implementation detail relevant to anyone managing SSH authentication with GitHub infrastructure.

Some more things about Django I've been enjoying

A blog post by Julia Evans sharing practical observations about Django after spending more time with the framework. She frames her exploration as learning server-rendered web development using an SQL database and backend HTML rendering, a style she describes as a 2010-era approach to building websites. The article follows an earlier post collecting Django features she found useful.

PieceKeeper

Never lose track of a piece again. PieceKeeper helps musicians manage their repertoire, run focused practice sessions based on a customized practice schedule, get insights and trends about their practice, and learn music theory through interactive drills and exercises aimed at improving both reading and listening skil… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

BUD

Ideate, sketch, and edit diagrams in real time on a voice-first canvas. Speak naturally to build system architectures, flowcharts, and turn ideas into visuals. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

DualStream

Beautifully powerful streaming. Astonishingly easy. DualStream brings Desktop and Mobile audiences your content at the same time, from a single patent-pending engine. DualStream Relay carries your broadcast to every platform from our servers — and if your connection blinks, disconnection protection keeps your stream a… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

RegionMirror

Define a region of your screen to be shared from your ultrawide or high resolution monitor, preventing the inevitable "can you zoom in?" that comes with sharing the entire screen. Define any size region to share, move apps in and out of the region seamlessly, resize the region on the fly, set a default region and invo… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Universal Dictation on Stream

Stream by Sandbar: The private voice ring for everything on your mind Product Hunt Stream by Sandbar The private voice ring for everything on your mind 271 followers The private voice ring for everything on your mind 271 followers Visit website Knowledge base software • Wearable… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Nuxt vs SvelteKit: What works better?

• ♥ 12
• 💬 2

Nuxt vs SvelteKit. Which one is better? That is is what I've been testing out this week. I built the… Context: Dev.to – Nuxt.

Advertise in ChatGPT

• ▲ 633
• 💬 446

OpenAI has launched an advertising platform that lets businesses place ads directly within ChatGPT conversations. The ads.openai.com page describes the product as a way to reach users as they explore options, compare choices, and make decisions, with ads designed to fit naturally into the ChatGPT experience. The Hacker News discussion has drawn 633 points and 446 comments, reflecting significant interest and debate among practitioners.

How I pulled data out of a cross-origin iframe I couldn't touch

• ♥ 11
• 💬 3

The feature was supposed to be the easy one. NotebookLM generates flashcards. My extension reads them… Context: Dev.to – Webdev.

Apple defeats liability for not scanning iCloud for CSAM

• ▲ 402
• 💬 364

A federal judge dismissed a lawsuit seeking to hold Apple liable for not scanning iCloud storage for child sexual abuse material. Apple had developed NeuralHash as a proprietary alternative to PhotoDNA but reportedly abandoned the scanning plan after the tool proved less effective. The court ruled against liability, though the judge expressed displeasure with Apple's approach. The Hacker News discussion drew 402 points and 364 comments.

Why Google Translate Crashes Your React App (and How to Fix It)

• ♥ 7
• 💬 7

There's a special kind of bug that makes you question your career. It's the bug you cannot… Context: Dev.to – React.

Long presumed dead, a thriving coral reef is discovered in West Africa

• ▲ 335
• 💬 69

A previously unknown coral reef has been discovered off the coast of Benin in West Africa, where coral was long presumed dead. The article, originally published by Inside Climate News and carried by Yale E360, reports that scientists found a thriving reef ecosystem in a region where reef formation was considered unlikely. The discovery raises questions about coral resilience and marine biodiversity assumptions in underexplored Atlantic waters.

A digestion of the Jacobian conjecture counterexample

• ▲ 234
• 💬 79

This is a blog post by mathematician Terence Tao examining a proposed counterexample to the Jacobian conjecture, a long-standing open problem in algebraic geometry concerning polynomial maps over the complex numbers. The conjecture asks whether a polynomial map with a constant nonzero Jacobian determinant must have a polynomial inverse. The post has drawn significant community attention, accumulating 234 points and 79 comments on Hacker News.

Map of the world's great castles and fortresses

• ▲ 231
• 💬 155

Castle Map is a free interactive website that plots 2,438 castles, fortresses, and palaces across 130 countries on a zoomable world map. Each pinned location includes a photograph, founding century, and historical summary, with dedicated pages offering fuller stories and exact coordinates. A Hacker News thread with 231 points and 155 comments discusses the project's scope and data sources.

LG to ban residential proxies from smart TV apps

• ▲ 203
• 💬 163

LG Electronics USA announced it will suspend smart TV apps that turn televisions into always-on residential proxy nodes, following research highlighting the practice. Residential proxy networks route internet traffic through household devices, often without owners fully understanding the implications. The Krebs on Security report notes the decision comes less than a month after researchers exposed the issue. The Hacker News discussion has drawn 203 points and 163 comments.

Gemini 3.6 Flash looks better on paper. What would make you block the upgrade?

A Reddit discussion on r/artificial weighs the risks of upgrading to Gemini 3.6 Flash despite benchmark improvements. Google reports it uses 17% fewer output tokens than 3.5 Flash on the Artificial Analysis Index, with gains on DeepSWE (49 vs. 37), MLE-Bench (63.9 vs. 49.7), OSWorld-Verified (83.0 vs. 78.4), and GDPval-AA v2. Practitioners are sharing reasons they might hold back the upgrade despite the headline numbers.

Thoughts On Integers (2023)

This blog post presents a practitioner's perspective on choosing integer types in software development. The author lays out their views on how integer types should be used, built from hands-on experience rather than language specification theory. The post is structured as an argumentative essay, aiming to persuade readers who may initially disagree with the author's recommendations on integer type selection.

Web-based Jujutsu revset explorer & debugger

A web-based playground for exploring and debugging revsets in Jujutsu (jj), a version control system. Users can edit a commit graph interactively, evaluate revset queries against it, and share their configurations via permalink. Revsets are jj's query language for selecting revisions, and this tool helps practitioners visualize how queries resolve, making it easier to learn and troubleshoot complex revision selections.