Hacker News
1Notepad++ hijacked by state-sponsored actors
- A security investigation revealed that Notepad++ update servers were compromised from June to December 2025 through infrastructure-level attacks by suspected Chinese state-sponsored actors. The hosting provider's shared server was compromised, allowing attackers to redirect update traffic and serve malicious updates to targeted users. The issue was resolved with migration to a new hosting provider and enhanced security measures including certificate verification and signed XML updates.
Firewall protection and network security
Users discuss using firewalls to block unnecessary internet connections, with recommendations for tools like LittleSnitch (macOS), Fort (Windows), and Lulu. Many argue text editors shouldn't need internet access except for updates, which should be handled through OS package managers.Update postponement as inadvertent protection
Discussion reveals that users running older Notepad++ versions (8.8.1 or earlier) were safer than those with newer versions. This sparked debate about whether staying on older software versions is sometimes more secure than auto-updating.Political messaging as attack motivation
Users connect the attack to Notepad++'s history of political statements about Taiwan and Uyghurs, suggesting this may have motivated Chinese state actors. Debate emerges about whether open source software should include political messaging.
2Defeating a 40-year-old copy protection dongle
- A person helped an accounting firm migrate away from 40-year-old RPG software that required a hardware dongle for copy protection. By reverse engineering the software's parallel port communication and discovering it only checked for a constant value, they successfully bypassed the dongle with a simple four-byte patch, making the historic compiler freely usable.
Hardware dongle reliability and business impact
Users shared stories of dongles breaking frequently, causing business disruptions. Civil engineering software developers explained they still use dongles because some customers prefer them over cloud licensing, despite replacement parts becoming unavailable and dongles being easily cracked.Simple copy protection cracking techniques
Commenters reminisced about easily bypassing software protection by modifying jump instructions, finding hardcoded values in memory, or using simple bit flips. Many shared stories of cracking software with basic assembly knowledge and hex editors in the 80s-90s.Legacy software still in production
Discussion about old systems like Windows 95/DOS still running mission-critical business applications decades later. Examples included medical software, nuclear power plants using PDP-11s, and companies maintaining vintage systems due to regulatory or operational requirements.
3Show HN: NanoClaw – “Clawdbot” in 500 lines of TS with Apple container isolation
- The author has been using Clawdbot but finds it concerning due to security issues. They created NanoClaw as a more secure alternative with containerized agents and filesystem isolation, designed for their specific needs rather than as a general-purpose tool.
AI-generated documentation concerns
Users express strong preference for human-written READMEs over LLM-generated ones, feeling AI docs lack authentic care and may contain inaccuracies. Discussion includes whether AI assistance diminishes personal investment in projects and communication quality.Security and safety risks
Major concerns about giving AI agents broad system access, with examples of agents getting banned from services, burning through thousands in API costs, and violating terms of service. Comparisons made to giving "drunk robot the keys to everything."Terms of service violations
Debate over whether using Claude subscriptions with automated agent services violates Anthropic's ToS. Discussion includes technical workarounds, authentication methods, and uncertainty about legitimate usage boundaries for AI agent deployments.
4The Codex App
- OpenAI introduces the Codex app for macOS, a command center for managing multiple AI coding agents simultaneously. The app enables parallel work across projects, includes skills for extending capabilities beyond code generation, supports automations for background tasks, and offers configurable security. Codex is temporarily available to free users with doubled rate limits for paid plans.
Native vs Electron apps
Debate over AI companies using Electron instead of native applications. Critics argue native apps would perform better and enable deeper OS integration, while defenders cite development efficiency and cross-platform compatibility benefits.Performance comparison of coding agents
Users comparing Codex, Claude Code, and other AI coding assistants. Mixed experiences reported - some find Codex slower but more reliable, others prefer Claude's speed and accuracy despite token limits.Platform availability and tech stack
Discussion about Codex being initially macOS-only and built with Electron. Linux/Windows users expressing frustration, with OpenAI promising broader platform support soon.
5My iPhone 16 Pro Max produces garbage output when running MLX LLMs
- The author discovered their iPhone 16 Pro Max produces incorrect mathematical outputs when running machine learning models using MLX framework, while their older iPhone 15 Pro and MacBook Pro run the same code perfectly. After extensive debugging, they found the tensor values were orders of magnitude wrong, suggesting a hardware defect in the Neural Engine or ML systems of their specific device.
MLX bug fix and hardware detection
A bug in MLX library was fixed that misdetected iPhone 16 Pro as having Neural Accelerator support, causing incorrect results. The fix came just days after a blog post about the issue, sparking debate about whether Apple prioritizes fixes based on viral blog posts.Floating point reproducibility
Discussion about non-reproducible floating point operations across different hardware, with experts noting that identical results shouldn't be expected between devices. However, the complete failure of Apple's own LLM on specific devices suggests a deeper hardware issue.Calculator apps and math tools
Users shared preferences for calculator apps on mobile devices, with many favoring HP Prime emulator, TI calculator emulators, and other specialized math tools over the built-in iOS calculator, which lacks features like calculation history.
6Show HN: Wikipedia as a doomscrollable social media feed
- Xikipedia is a pseudo social media feed that shows content from Simple Wikipedia using a basic algorithm that learns from user engagement to suggest similar content. The algorithm runs locally without collecting data, and users can select categories to get started. Content may include NSFW material from random Wikipedia articles.
Technical implementation issues
Users report long load times (5 minutes) and 40MB data downloads before the site becomes usable. The developer explains this is due to needing all Wikipedia data upfront to map post relationships, plus current high traffic overwhelming the server.Short-form content addiction concerns
Discussion centers on whether educational short-form content can be beneficial, or if the swiping mechanism and context switching inherently harm focus and learning ability regardless of content quality, creating dopamine addiction patterns.Content quality and learning effectiveness
Users debate whether passively consuming random information feeds is truly educational, with some arguing that intentionally sought knowledge is more trustworthy and memorable than algorithmically served content.
7Ian's Shoelace Site
- Ian's Shoelace Site is the internet's leading resource for shoe lacing, featuring over 100 step-by-step tutorials, 2,700 photos, and 25 shoelace knots including the world's fastest "Ian Knot." Created by Ian Fieggen in Melbourne, Australia over two decades, the site offers comprehensive guides on lacing methods, tying techniques, and shoelace knowledge with no AI content.
Ian knot adoption and teaching
Many users learned the Ian Knot years ago and still use it daily, often teaching it to children and friends. The technique is praised for being lightning-fast and producing secure knots that rarely come untied, with some users calling it life-changing.Website nostalgia and internet culture
Users express fondness for Ian's Shoelace Site as representing what the internet used to be - a simple, informative site maintained as a labor of love. Despite earning less than minimum wage, Ian has devoted decades to this educational resource.Alternative shoe fastening solutions
Discussion of modern alternatives to traditional lacing, including elastic laces with buckles, hands-free slip-on shoes with hidden elastic, and Chelsea boots. Some users have moved away from laced shoes entirely for convenience.
8Claude Code is suddenly everywhere inside Microsoft
- Microsoft is encouraging thousands of employees across major teams to adopt Anthropic's Claude Code, even non-technical workers, despite selling GitHub Copilot as its primary AI coding tool. The company is testing Claude Code in CoreAI and Experiences + Devices divisions, with engineers expected to compare both tools. This represents a significant vote of confidence in Anthropic's AI capabilities over Microsoft's own offerings, as the company increasingly integrates Anthropic models across its products and services.
Microsoft's confusing naming conventions
Users criticize Microsoft's overuse of "Copilot" branding across different products, making it unclear which version is being discussed. Historical patterns show Microsoft repeatedly does this with naming (previously "365", "One", "Live", ".NET", "Active").Claude Code vs. Microsoft Copilot comparison
Developers praise Claude Code's superior performance for coding tasks compared to GitHub Copilot, despite Microsoft's first-mover advantage. Many report Claude Code works better for larger codebases and longer coding sessions.Microsoft employees using competitor products
Discussion reveals Microsoft engineers often use Apple hardware and Claude Code internally while the company promotes its own Copilot products externally, highlighting potential quality gaps in Microsoft's offerings.
9Two kinds of AI users are emerging
- The author identifies two types of AI users: power users who leverage advanced tools like Claude Code for complex tasks, and casual users stuck with basic ChatGPT interfaces. Microsoft's Copilot is criticized as inferior despite widespread enterprise adoption, creating an existential risk where decision-makers dismiss AI based on poor experiences. Enterprise environments with locked-down systems and legacy software struggle to implement effective AI tools, while smaller companies without these constraints achieve dramatic productivity gains. The gap is widening as non-technical employees at smaller firms use AI agents to outperform entire enterprise teams, suggesting a future where tiny teams can outcompete massive corporations through better AI integration.
AI user behavior categories
Discussion divides AI users into two camps: those treating AI as a tool while understanding limitations vs. those outsourcing thinking entirely. The first group uses AI for boilerplate/summaries, the second expects it to replace senior developers.Greenfield vs brownfield productivity
AI provides massive productivity gains on new projects (week's work in a day) but diminishes quickly as complexity grows. Tech debt accumulates faster with AI-generated code, making it less effective on existing systems.Financial modeling risks
Converting complex Excel financial models to Python using AI raises serious concerns about accuracy and verification. Many worry about non-technical users creating models they can't validate, potentially causing systemic risks.
10Termux
- Termux is an Android terminal application and Linux environment that provides a command-line interface for Android devices. The app is available through F-Droid, GitHub, and Google Play Store, with the latest version being v0.118.3. Users should note potential instability on Android 12+ due to process limitations.
Termux capabilities and use cases
Users praise Termux's versatility for coding, note-taking, SSH access, file syncing, and running CLI tools on Android. Popular workflows include using Neovim with vimwiki, rsync for backups, and running Python scripts for photo management.Android's new Linux terminal vs Termux
Discussion compares Android 16's built-in Linux terminal with Termux. Users report the native terminal is buggy, slower, and more isolated, while Termux offers better Android integration and API access despite being more limited.Mobile keyboard solutions for terminal use
Users discuss challenges of using terminal interfaces on touchscreens and share solutions like Unexpected Keyboard, Bluetooth keyboards, S-Pen input, and specialized keyboard apps for accessing terminal key combinations.