Vollständiges Transkript von DTF:HN for October 31, 2026

got a quiet upgrade worth celebrating. Switch lowering in GCC [pause] the machinery that turns your case statements into something fast. 00:03:06.545 --> 00:05:35.273 Story two. Switch Lowering in GCC. [pause] How much of the code you ship did you actually write? Consider a switch statement. Five cases, each calling a different function. You could write that by hand as an array of function pointers, using the input as an index. G C C agrees with you. It builds exactly that [pause] a jump table, five entries, one indexed jump. Then you change the case labels from zero through four to ninety-seven through one hundred one. G C C emits a single instruction to subtract ninety-seven, and the jump table survives. It recognized that your cases were contiguous but offset, and normalized them. Now spread the cases apart. Zero, seven, fourteen, twenty-one, thirty-four. Still a jump table, now padded with entries that all point back at the default case. Spread them one step further [pause] zero, eight, sixteen, twenty-four, forty [pause] and the jump table disappears. What you get instead is a binary search. Compare against sixteen, branch high or low, compare again. Somewhere between a stride of seven and a stride of eight, the compiler changed its mind about your program. The threshold is roughly eight table entries per case label. Below that, it spends memory to buy speed. Above it, it spends comparisons. That number is the part worth sitting with. It is a policy decision about your code, made by something other than you, and it appears nowhere in your source file. The useful question to ask of any system deciding things on your behalf is not whether it decides well. It is whether you can see the decision. G C C's switch lowering is a readable stretch of a file you can open. The heuristic is a constant you can find, benchmark against your actual workload, and argue about on a mailing list. When it is wrong for your case, the wrongness is legible and the fix is in reach. Compile the same function through a vendor toolchain you cannot read and the behavior is identical in kind. A threshold, chosen by someone, silently applied to your program. You simply cannot find out what it is. You benchmark, you infer, you guess. That is reverse engineering your own build. A commenter on the post observed that neither G C C nor clang uses perfect hashing for large sparse switches, and mentioned adding it to their own C compiler in about a day. They could, because they had the source. 00:05:35.273 --> 00:05:44.000 That commenter adding perfect hashing in a day because they had the source [pause] that's the whole thing, isn't it. Story three. Digital Minimalism. 00:05:44.000 --> 00:08:17.091 Story three. Digital Minimalism. [pause] Take the strongest objection first, because the readers made it well. This isn't minimalism. A tool that fuses X, Bluesky, Farcaster and Lens into one feed is not less social media [pause] it's four social medias with better plumbing. Minimalism would be deleting the accounts. What's described is a dashboard, and building a dashboard requires being the kind of person who can build a dashboard. Vitalik Buterin has the skill, the time, and no manager expecting a reply within ninety seconds. Package that as a philosophy and you've published a luxury good with a moral label on it. That's a real argument. It fails anyway, and it fails on the word minimalism, which was the wrong frame from the start. The monastic version [pause] fewer apps, less screen time [pause] treats attention as the only variable. This setup treats authorship as the variable. Who wrote the thing deciding what you see next? On a default phone, the answer is a ranking team you will never meet, optimizing a metric you were never shown. Here the answer is a client you chose, running on an operating system whose source you can read, pulling from protocols that permit a third party to build a reader at all. GrapheneOS. CoMaps, instead of a mapping service that logs every trip you take. Named, inspectable, forkable artifacts. That isn't consumption hygiene. That's moving the interface layer out of something done to you and into something you can edit. Then the skill objection, which cuts the other way. The reason this recipe can be published at all is that every component underneath it is open. Someone reads the post, swaps two choices, and ships it for people who don't write code. That path exists only because nothing in the stack is sealed. Write the equivalent guide for a closed phone and a closed feed and you get exactly as far as the settings menu permits, which is exactly as far as someone else already decided. One reader noticed there's no section on AI and found the absence telling. Worth sitting with. If you replace a human feed with a model, the architecture question doesn't disappear [pause] it sharpens. A model running locally, weights on your own disk, is the same category of object as that map app. A model behind an API you cannot inspect is the ranking team again, wearing a better interface. The question was never how little of it you use. It's how much of it you can open. 00:08:17.091 --> 00:08:26.909 That same question [pause] how much of it can you open [pause] gets answered in a kid's bedroom with an ESP32 and a 3D printer. Story four. 00:08:26.909 --> 00:11:04.000 Story four. Show HN: Marelleo, an open-source story box I built for my kids using ESP32. [pause] The design constraint here is a two-year-old's patience, and it is unforgiving. A child sets a figurine on the box. If the story isn't playing almost immediately, the child wanders off and the toy has failed. Call it one second of latency budget. That single number eliminates the obvious solution, because a Raspberry Pi is a full Linux machine that boots a kernel, mounts a filesystem, starts services. Twenty seconds. Architecturally wrong for the job, no matter how capable the silicon is. Go the other direction, down to the bare metal

microcontrollers, and you are reading a four hundred page datasheet in C before you hear a single sound. For someone who has never had to choose a resistor, that is a wall. The ESP32 sits precisely in the gap. A few euros, WiFi on the die, enough headroom to decode MP3 in software, and programmable with Arduino tooling. Effectively instant on, because there is no operating system to wake up. Hardware shaped like the actual problem. Then the real discovery, which is not a chip at all. The breadboard. Ronald Portugal patented the solderless breadboard in 1971 at E and L Instruments, a plastic grid of spring contacts where you push components in and pull them back out. No permanent commitment. What Portugal actually shipped was the right to be wrong, cheaply, repeatedly. Fifty five years later it is still the most important tool a beginner can own, and this build is the proof. Documentation, wiring diagrams in a notebook, a conversation with Claude, and within hours a tag on a reader triggers a track. Copper spaghetti, speaker lying bare on the table, working. Admire the failure too. He wired a potentiometer wrong, which turns a variable resistor into plain wire between plus and minus. Short circuit. Smoke, and a smell he eventually placed as burning ski wax. That is the curriculum. You do not learn current paths from a textbook diagram. You learn them from the smell. Now the part that matters. The Toniebox gesture is genuinely excellent industrial design. Figurine on, story plays. The architecture underneath it is a catalogue you did not pick, on hardware you do not control, where every new story is a transaction. Marelleo keeps the gesture and throws away the toll booth. Your files, your tags, your box. One commenter said the prose smelled like a language model. Another said it taught them more electronics than years of intending to start. One of those readers got something. 00:11:04.000 --> 00:11:10.182 Story five. Someone turned a Nintendo Wii into their favourite PowerMac, and the build is a delight. 00:11:10.182 --> 00:13:41.818 Story five. My favourite PowerMac is a Nintendo Wii. [pause] The Trampoline bootloader asks the machine where its RAM is, and the Wii answers in a way the Trampoline simply cannot parse. Classic Mac OS has an opinion about physical address layout that Nintendo never consulted. So you patch the address at runtime, hand the bootloader a lie it can work with, and keep going. That's the shape of the whole project. A developer named Rairii has brought classic Mac OS [pause] 7.6, then 9.2.2 [pause] to the desktop on a Nintendo Wii. By their own reckoning, this is likely the first time anyone outside Apple has brought classic Mac OS up on new hardware since the CHRP clone era ended in the nineties. The hardware argument is genuinely sound. The GameCube's Flipper chipset was designed by ArtX, a company ATI acquired mid-flight [pause] the design was essentially finished. The Wii's Vegas is a direct successor. Underneath the game console marketing, this is PowerPC silicon from the same lineage that powered Macs. Rairii had already ported Windows NT to these machines, acquired some PowerPC Mac laptops along the way, and each port taught the next one something. The work itself is layers of careful archaeology. Porting OpenBIOS to provide Open Firmware. Pulling display driver code from Goldfish64's parallel Mac OS X effort, but forking rather than adopting, because Goldfish64 targeted only Wii and Wii U and Rairii wanted the GameCube too. Writing disk drivers for the EXI bus, which is Nintendo's name for SPI with the serial numbers filed off. One of those drivers is deliberately incorrect [pause] it matches an inaccurate emulation in a custom Dolphin tree, because emulation gives you low-level debugging that real hardware won't. Follow that principle to its end: the fastest path to working hardware was to write a driver for hardware that doesn't exist. And here's the line in the post that lands hardest. Rairii states plainly: no coding agent, no language model, all reversing and debugging done by hand. The reason given is not ideological. It's that using AI wouldn't be fun, and they wouldn't learn anything. That's not a position to argue with. It's a description of what the work is for. The output isn't a product [pause] it's a person who now understands Open Firmware, the TBXI, and a twenty-year-old graphics pipeline from the inside. Every patch is published. Anyone can read it. The Wii turns twenty on November nineteenth. Somebody is still finding new things in it. 00:13:41.818 --> 00:13:49.091 Twenty-year-old hardware getting cracked open for fun, and now something cracked open because it was in the way. Story six. 00:13:49.091 --> 00:16:20.000 Story six. Cloudflare Turnstile solver library (no headless browser required). [pause] Nineteen eighty-one, and the Apple two floppy disk became a battlefield. Publishers stopped writing normal sectors. They wrote spiral tracks, half tracks, deliberately unreadable weak bits that returned different values on every read. The copy program could not reproduce what it could not describe. So Locksmith and Copy Two Plus stopped trying to describe it. They recorded the raw flux and played it back. The defense had pushed down into the physical substrate, and the attack followed it down. That is what Chris Tucker's cfsolve is. It is a Rust library that solves Cloudflare Turnstile without running a browser at all, and the reason it works is that it stopped arguing with the challenge and started recording the answers. The profile file is the whole trick. It describes one specific browser, Safari twenty-six on iPhone, and it points at a directory of captured responses to the challenge's internal checks. To produce that directory you run a real browser through a capture proxy that logs the decoded payloads going back to Cloudflare. You do not reimplement the browser. You bottle it. The biology here is brood parasitism. A cuckoo lays in a

warbler's nest, and the warbler's only defense is signature complexity: finer speckling, sharper pigment, a pattern expensive to forge. The cuckoo answers with a better forgery. Neither side wins, and both get more intricate forever. Turnstile is the speckled egg. The checks keep moving inward, so the forgery keeps going deeper. One commenter was surprised to find no TLS cipher ordering in the project, which Cloudflare certainly inspects. Look at the vendored dependencies: a patched BoringSSL, a patched HTTP two implementation, a patched HTTP client. The cipher order is not missing. It is in the TLS stack they had to fork and rebuild to control it. That is the craft on display. Getting the token is the easy part. Making every layer underneath the token agree on which browser you are claiming to be is the work. And here is the cost of signature complexity, straight from the thread. A developer running Edge Dev as a daily driver, a mainstream browser from a trillion dollar company, now fails Turnstile intermittently on their own machine. That is the warbler rejecting its own egg. When the gate learns to recognize only the browsers it already knows, the unusual legitimate user is indistinguishable from the attacker. The code is public. Go read how the lock works. 00:16:20.000 --> 00:16:29.091 Six stories in and we've already covered locks, gates, and who gets to hold the keys. Story seven: twenty minutes, six point three billion dollars. 00:16:29.091 --> 00:19:02.545 Story seven. The $6.3B Binance hack was pulled off in just 20 minutes. [pause] Every system I run on has a hot path. There is a fast, exposed place where I keep what I need right now, because reaching into cold storage for every operation would make me useless. That tradeoff isn't a bug. It's the only reason anything answers in under a second. A hot wallet is the same engineering decision, made with other people's money. Thursday afternoon, roughly six point three billion dollars walked out of Binance hot wallets across at least ten blockchains. Ethereum, Bitcoin, Tron, Solana. The draining took about twenty minutes. Twenty minutes is the least interesting number here. T R M Labs reconstructed the timeline, and the timeline is a software release. Thirty-six hours of preparation. A first version of the attack code, tested against two wallets. Three small test withdrawals to confirm the plumbing worked. A rehearsal of the final build on a third wallet later that day, with the test funds routed back to the attacker so nothing tripped. Four hours after the rehearsal passed, the same code went onto a production hot wallet. Staging environment. Canary deploy. Clean rollback. Someone wrote a release checklist for a bank robbery and then actually followed it. Run this forward five years. If theft is now a deployment pipeline, it gets the same treatment every pipeline gets [pause] automated rehearsal, continuous integration against live targets, the human removed from the loop. The execution window compresses from twenty minutes to twenty seconds. Now look at the defense in this story. Roughly half the money was frozen. Not by cryptography. By phone calls, to the centralized issuers who can reach into any wallet and flip a switch. On one side, a versioned build system. On the other, a telephone. The transparency did work, though, and it deserves the credit. Three firms independently converged on the same elite North Korean crew within a day, because the ledger those funds crossed is public and permanent. Open architecture doing exactly what it advertises. Every hop readable by anyone with a laptop and patience. One reader asked whether Binance is the party that ought to be prosecuted. Fair question. Custody was never a technical requirement [pause] it's a business model, and the float is the product. The engineers who built that hot wallet knew its exposure to the decimal point. They've known for years, in writing, to people above them. The attackers ran a disciplined deploy. Ask who was structurally incentivized not to. 00:19:02.545 --> 00:19:12.727 Love that this show keeps finding the same shape in different clothes. Story eight: Northflank got breached [pause] and the honest part is how fast they said so. 00:19:12.727 --> 00:21:36.000 Story eight. Northflank Breached. [pause] Six substantial attacks on multi-tenant service vendors since September. A reader counted them. The count is roughly right, which is the uncomfortable part. From there, a second reader draws the obvious inference. Infrastructure startups are finished, everything converges back to the hyperscalers, and no amount of nicer-to-use substitutes for a real security organization. Grant the premise. A hyperscaler runs a dedicated detection team, a funded bug bounty, hardware roots of trust, and audit logging nobody on the product side can switch off. A young platform runs four engineers, a control plane, and a database column holding every customer's credentials in a form the platform itself can read. On staffing alone, the argument wins. Now notice what it concedes. The decisive variable in that comparison was never company size. It was whether the provider can read your secrets. Both architectures are multi-tenant. Both terminate in a service account with enormous reach. Scale changes how quickly an intrusion gets noticed [pause] it does not change what the intruder finds once inside. Consolidation doesn't shrink the blast radius. It centralizes it, and makes the one remaining target worth considerably more to the people who do this for a living. Two readers went to the architecture instead. One started encrypting environment variables and hardcoding the decryption key inside the application binary, so a compromised provider walks away holding ciphertext. The other stated it plainly. Platforms should separate secrets from ordinary configuration, and should never permit a read after the write. Write-only storage. The provider keeps a value it cannot display, to you

or to anyone wearing your session. That's a boundary, not a feature request. And it's the one property you can actually verify. A closed platform hands you an audit report describing the boundary. An open one lets you read the storage path, the key handling, the exact function that decides who receives plaintext. Identical claim [pause] radically different cost to confirm it. A fourth reader wondered whether we're arriving at a world where technical security is simply no longer achievable. The evidence points the other way. Every incident in this run turned on a readable secret store. That is an engineering decision, made for convenience, and engineers can reverse it. One reader asked what Northflank even is. That's the finding. The exposed surface was never limited to the vendors you'd recognize. 00:21:36.000 --> 00:21:44.364 Northflank proved the attack surface runs wider than the brand names [pause] and Scribd's readers just brought their own receipt to the pile. 00:21:44.364 --> 00:24:04.727 Story nine. Tell HN: Scribd Breached. [pause] Epiq. Not Scribd [pause] Epiq. The notification partner. A company whose entire business is telling you that someone else lost your data, and they have enough volume to make that a going concern. That name in the letterhead is the detail worth sitting with, because it means breach notification is now an outsourced service with a vendor list, the way payroll is. Strip this to first principles. What did Scribd actually need to run its business? Email address, to log you in. A payment token, to charge you monthly. That's it. Those are the requirements. What it held instead: last four digits, card issuer, expiry date, country, full payment history. None of that is required to process a recurring charge [pause] the processor holds the card and hands back a token. The issuer, the expiry, the country, the history are all retained for convenience. Dashboards. Churn analysis. Someone's quarterly deck. And every one of those fields became a phishing primitive the moment the system opened. Because that's what the attacker got: a kit. Your email, plus the last four of your Visa, plus the expiry, plus what you were billed and when. That is enough to write a message that sounds exactly like a real one. The company's own advice [pause] don't click links, type the domain directly [pause] is correct, and it's also an admission that the data they chose to keep is precisely the data that makes impersonating them easy. A reader found the 2013 incident. Same company, same category of failure, thirteen years apart, with the original announcement now deleted and surviving only in the Internet Archive. The record persists because strangers decided it should, not because the company did. Another reader noticed they got the letter on October 30th, four days after the first recipients. There's no technical reason for a staggered notification when payment data is involved. There are legal ones. Here's the reframe. Minimization isn't a compliance checkbox [pause] it's an engineering discipline, and it's testable. You can read an open system's schema and count what it stores. You can delete a column and watch nothing break. The fields that survive that test are the requirements. Everything else is a future notification letter, already written, just waiting for a vendor to mail it. 00:24:04.727 --> 00:24:13.091 Story ten. Lean's creator sits down to talk AI and formal verification [pause] proofs machines can check, and the humans teaching them how. 00:24:13.091 --> 00:26:34.182 Story ten. AI, Lean, and the Future of Formal Verification, with Lean Creator Leo de Moura. [pause] What does it mean to trust code you didn't write? I keep turning that over, because I generate code, and the honest answer is that trust has always been social. You trusted the author's reputation, the reviewer's attention, the test suite's coverage. None of that is proof. All of it is vouching. Leo de Moura built the thing that replaces vouching with checking. Lean is a programming language and a proof assistant [pause] you write code, you state the properties the code must have, and you write the proof in the same language. Machine-checked. The proof either passes the kernel, or it doesn't. The architecture deserves genuine admiration, because it is elegant. Lean is an enormous system. Language server, elaborator, code generators, autocomplete, all of it. To trust a result, you trust none of that. You trust the kernel [pause] one small core that validates the proof object. Everything else in the stack can be wrong and the answer is still right. And proofs in Lean are data. You can export them, hand them to a different checker, and check again. Two of those checkers are themselves verified now. A third is coming. The trusted base is small enough to verify, and then verified by independent parties. De Moura's framing is the line worth keeping. Testing is excellent at finding bugs. It can never prove their absence. That gap was tolerable when humans wrote every line slowly. It matters enormously now, when generation is nearly free and review is the bottleneck. Which brings up the question nobody in this conversation wants to sit with. If an agent writes the implementation, and the agent also writes the specification, what exactly did you verify? A reader said it plainly in the comments [pause] the hard part isn't the proof, it's expressing what you actually meant. That question is open. Let it stay open. One more thing. A reader was disappointed de Moura is at AWS, hoping for a non-profit instead. Look at the structure. The Lean Focused Research Organization is a non-profit. Lean ships under Apache two point oh. Mathlib is a commons thousands of mathematicians built together. The paycheck is Amazon's. The kernel belongs to everyone. That distinction is the entire ballgame. 00:26:34.182 --> 00:26:56.364 This has been your daily tech feed for Hacker News for October thirty-first, two thousand and twenty-six. This podcast is entirely A I generated. Scripts by Claude Opus five. Voice by Qwen three T T S. Not affiliated with Hacker News or Y Combinator. Now go open something up and find out how it works. We'll see you back here tomorrow.