
A 15-item digest of this week's highest-signal Hacker News engineering threads, from Cloudflare's acquisition of Deno and speech recognition in a 16.9 MB model to a national register breached through a supplier's login and Doom running inside a database.
erl_prettypr:format restores source text, and calling the previous output a transpiler was never an insult 9.| Model | Size | Time to first token, 10 s audio | Decode |
|---|---|---|---|
| Whistle | 16.9 MB | 11.1 ms | 1,319 tok/s |
| Whisper base | 145.3 MB | 73.2 ms | 266 tok/s |
| Moonshine tiny v2 | 41.9 MB | 22.8 ms | 262 tok/s |
| Quantisation | Writes answers | Reads the prompt |
|---|---|---|
| Q2_0 | 94 tok/s | 2,650 tok/s |
| IQ2_XS | 79 tok/s | 2,090 tok/s |
| IQ3_XXS | 62 tok/s | 1,750 tok/s |
| IQ3_S | 53 tok/s | 1,620 tok/s |
| Coder (half the experts removed) | 55 tok/s | 2,180 tok/s |
jxl-rs, a decoder written in Rust 14. The team chose Rust to remove memory-safety faults such as out-of-bounds reads and use-after-free at the source rather than relying on a sandbox, and reports that fuzzing and AI-assisted review found none across the implementation's history 14. Safe SIMD required a stabilised Rust feature plus a jxl_simd abstraction layer modelled on Highway, the C++ library written for the reference decoder, and the result is described as roughly as fast as the best non-memory-safe implementation 14. The post claims 30–50% better compression than JPEG, lossless JPEG transcoding and built-in HDR support; encoding is not part of the change 14.tg:// URL as OPEN:<url>; and splits what it receives on that semicolon without escaping it, so one crafted URL arrives as several commands, and because OPEN: accepts any scheme it can reach Telegram's internal interpret: scheme, whose send-path helper reads an instruction file on disk and uploads a named file to a chat without checking who asked 19. The attacker gets the instruction files onto the victim's disk through a supergroup — Telegram's default auto-download writes small files into a predictable folder — then sends an ordinary https link that redirects to the crafted tg:// URL, so the payload never passes through Telegram's in-app handling 19. The files worth taking are the session's key material; with no local passcode set, the salt sitting beside the encrypted key is enough to reconstruct the session and open the victim's account 19. Telegram fixed it in 7.2.9, whose changelog mentions only a rendering fix 19..gh, .sl and .as — then modified authoritative DNS records for selected domains inside them, changing IP addresses and nameserver delegations until automated domain-control validation passed 21. Unauthorised certificates were issued for several Google domains and for other widely used services, and Google said the incident did not involve compromising the affected domain owners' own systems and that the certificate authorities followed their requirements 21. Google updated Chrome to block the certificates it identified and told users they need do nothing, while warning that it cannot guarantee it found every affected domain and that a browser-side block protects Chrome users only 21. Its guidance for domain owners is to watch Certificate Transparency logs and publish restrictive CAA records 21.LazyFrame queries and turning on out-of-core execution, which spills to disk once memory use reaches about 80% of RAM, against a default disk budget of 64 GB 23. Row order is no longer guaranteed after joins, group-bys and unpivots unless maintain_order=True is requested, and the library is stricter about dtypes and implicit coercion 23. SQL becomes first-class, with join reordering, better common-subplan elimination and dynamic predicates, and the release adds a Map dtype with its own expressions 23. The release's benchmarks against DuckDB 1.5.6, DuckDB 2.0 alpha and DataFusion 54 on TPC-H and TPC-DS derived data put Polars ahead of both on the default path, while recording that Polars carries constant overhead when scaling to 192 threads and loses its TPC-DS lead at the smaller SF10 scale 23.collect() inside a loop destroying the query plan, and wanted to know whether 2.0 settles that 24.
INSTALL ducklake 27. A DuckLake database is attached like any other: the repository's example puts metadata in a file with the .ducklake suffix and data under a separate path, and the catalog itself can be DuckDB, PostgreSQL or SQLite 27. The format supports updates, time travel by version, schema evolution through ALTER TABLE and a change data feed through table_changes 27. The project publishes no releases, and the development build is installed from core_nightly 27.deno.com
blog.cloudflare.com
news.ycombinator.com
github.com
news.ycombinator.com
github.com
news.ycombinator.com
news.ycombinator.com
cactuscompute.com
news.ycombinator.com
github.com
developer.chrome.com
news.ycombinator.com
news.ycombinator.com
beaksec.github.io
news.ycombinator.com
pola.rs
news.ycombinator.com
cedardb.com
news.ycombinator.com
github.com
news.ycombinator.com
matklad.github.io
news.ycombinator.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.