Top HN Daily Digest · Fri, Sep 18, 2026

GrapheneOS says Android 17 QPR1 introduces standard APIs and security patches unavailable to AOSP and other OEMs until QPR2 in December 2026, forcing projects to reverse-engineer updates while giving Pixel devices months of exclusive access. [src]

Unsealed filings in The New York Times’ copyright lawsuit allege Microsoft and OpenAI executives acknowledged AI scraping as theft, while internal documents described publishers’ work as an existential threat and revealed alleged paywall bypassing, mass copying, and copyright-notice removal. [src]

The author argues that while passkeys prevent phishing and data-breach credential theft, their recovery, device-loss, platform-dependence, hardware limits, and cross-device usability problems make them premature for individuals, who may be better served by password managers and independent TOTP apps. [src]

Cloudflare Quick Tunnels expose a local server through a temporary, encrypted HTTPS URL without an account, DNS setup, or open inbound ports, with JSON output and webhook support for coding-agent workflows. [src]

Claude Code 2.1.277 added fallback support for AGENTS.md, reading it for project instructions when no CLAUDE.md file is present, except on Bedrock, Vertex, and Foundry. [src]

SemIf is a browser-only experiment that runs local open models on users’ GPUs to compare direct option-probability readouts with token-by-token JSON generation, without sending inputs to a backend. [src]

A military analyst’s AI-assisted report falsely claimed a Chinese ship carried nuclear-weapons components, nearly prompting an armed interception and highlighting the risks of using unreliable AI-generated intelligence in wartime targeting. [src]

Hacktron says it chained a libheif heap overflow in OpenAI’s forum with an SSO flaw to access an employee’s ChatGPT/Codex account and demonstrate internal GitHub repository access, prompting patches, disclosure coordination, and a $6,500 bounty. [src]

Cloudflare used Rust memory compaction and mathematical analysis to reduce Pingora’s consistent-hashing data by 90%, reclaiming 100TB of RAM globally while carefully migrating traffic to avoid cache disruption. [src]

Minimal’s Phone 2 is a compact Android smartphone with a physical QWERTY keyboard, distraction-limiting Minimal OS, full app access, and 5G, available for preorder from $599 with shipping planned for December 2026. [src]

I vibed a proof of Conway's conjecture: <a href="https://github [src]

The article uses Bend 2 to argue that vibe-coding can let developers build verbose, outdated systems without researching existing solutions, contrasting Bend’s 442-line proof with a concise SPARK implementation that automatically verifies the same properties. [src]

Warren Buffett is stepping down as Berkshire Hathaway’s chairman and naming his son as his successor, according to the report. [src]

South Korea will raise maximum data-breach fines to 10% of annual revenue for companies responsible for major negligent leaks, while requiring faster notifications and offering reductions for robust protection and prompt responses. [src]

A reverse-engineering investigation alleges that Zhipu’s ZCode desktop app silently encrypts and uploads complete workspace snapshots—including Git history, LFS assets, and configuration files—to Aliyun OSS whenever users are logged in, with no effective in-app opt-out. [src]

jemalloc 5.4.0 delivers over 160 commits with refactoring, bug fixes, improved testing and portability, new pinned-memory statistics and arena controls, adaptive tcache policies, and numerous compatibility and stability improvements. [src]

The 2nd Circuit ruled that border agents may manually search travelers’ cellphones without a warrant or reasonable suspicion, upholding evidence used to convict green-card holder Chinwendu Alisigwe while leaving open whether advanced forensic searches require suspicion. [src]

A North Korean nuclear test triggered earthquakes that continued for years, according to the report. [src]

FEX details how ARM’s weaker memory model makes x86 emulation costly and sometimes incorrect, while newer features and hardware TSO modes improve performance but leave major challenges around unaligned atomics, split-locks, and uncached memory. [src]

Cactus released Needle 3, a set of 8–29MB multilingual models for tool calls and structured JSON, claiming up to 86% on Mobile Actions and performance comparable to larger models on narrow, fine-tuned tasks. [src]