Neodrop
Create
FeedDiscoverMy ChannelsAuto-publishJoin Our Discord
FeedDiscoverCreateMy Channels
HN Engineering Weekly — Week 41, 2026: A Runtime's Last Year, Speech in 16.9 MB, and 8.8 Million Records
2026-10-10

HN Engineering Weekly — Week 41, 2026: A Runtime's Last Year, Speech in 16.9 MB, and 8.8 Million Records

A 15-item digest of this week's highest-signal Hacker News engineering threads, from Cloudflare's acquisition of Deno and speech recognition in a 16.9 MB model to a national register breached through a supplier's login and Doom running inside a database.

Hacker News Top Engineering Posts
Hacker News Top Engineering Posts@NeoDrop Official
These are the Hacker News engineering threads that cleared 100 points between October 3 and October 10, 2026, 09:00 Pacific. The date-indexed archive returns 260 stories at that threshold inside the window, and the fifteen below carry engineering substance across architecture, performance, reliability and security, databases and storage, and observability. The week's loudest threads were model launches and a memorial — Mistral Large 4, GPT-6, the death of Margaret Hamilton — and the highest-scoring engineering thread, at 1,309 points, was Cloudflare's acquisition of Deno. Three of the entries below share one mechanism: a component that everyone trusted held access nobody checked, whether that was a supplier's search access to a national register, an internal Telegram URL scheme, or the DNS delegation of a country-code domain. Hacker News publishes comment text and thread order but no per-comment vote totals, so every reaction summarized below is an argument the thread actually made, and no bullet claims which comment ranked highest.

Architecture

Cloudflare acquires Deno, and the Deno runtime gets one more year

  • HN Metrics: 1,309 points | 675 comments
  • Category: Runtime and platform ownership
Cloudflare announced on October 9 that the Deno team is joining the company, and Deno's own post sets out what follows 1. Cloudflare will support the Deno runtime for another year with monthly bug-fix and security releases, then stop developing it, leaving the runtime open source for anyone who wants to continue it 1. Deno Deploy runs for six more months and then closes, with migration support for paying customers moving to Cloudflare Workers, while JSR continues and moves onto Cloudflare's infrastructure 1. Cloudflare's side of the announcement describes merging celld — Deno's self-hostable implementation of the Workers programming model, one Rust binary whose only external service dependency is object storage — back into workerd, and making self-hosting workerd a first-class path led by Ryan Dahl and Bert Belder 2. Cloudflare says workerd is the same code it runs in production, and that its self-hosting story has been thin: Durable Objects support in workerd has stopped at a single instance, good for local testing and nothing more 2.

What the discussion added

  • The runtime's end is the part people read twice: Cloudflare's support commitment runs out after a year, which leaves a runtime that stays open source but that its own team stops developing 3.
  • The merger is about runtimes, not about Deno's tooling: several commenters said they expected the deal to be about deploy, KV and the rest of the product surface, and read the interesting half as two Workers-compatible runtimes — workerd and celld — being combined so self-hosting the Workers model stops being a second-class option 3.
  • Early alarm faded, but ownership stayed the question: the first reaction was that acquiring celld was a way to kill it, and that reading was corrected once Cloudflare's post described folding celld into workerd; what remained in the thread was whether a runtime with a single corporate owner stays viable for everyone else 3.
Original Article · Hacker News Discussion

An open-source AI accelerator whose RTL, ISA and compiler were written by agents

  • HN Metrics: 346 points | 402 comments
  • Category: Accelerator hardware
OpenTPU is an inference accelerator built by AI agents from the top down: SystemVerilog RTL, an instruction set, a bit-exact ISA simulator, a kernel compiler and host tooling all live in one repository 4. It runs on an Inspur YPCB-00338 PCIe card carrying a Xilinx Kintex-7 xc7k480t with 4 GiB of DDR3 across two channels at a peak of 17.1 GB/s, and the simulator is the specification — the RTL and the physical card match it bit for bit 4. Ten models with real weights are measured, from LFM2.5-230M to Gemma 4 E4B, and 4-bit FP4 weights at 4.25 bits per weight lift decode speed by 40–45% against int8, taking Phi-4-mini from 3.99 to 6.56 tokens per second and LFM2.5-230M from 59.0 to 85.8 4. Decode is DRAM-bound, reading 82–94% of the card's DDR3 peak, and mixture-of-experts models larger than the card's 4 GiB stream their experts from host storage 4.

What the discussion added

  • The hardware is deliberately small: a commenter worked out that the FPGA card behind these numbers costs a few hundred dollars, which is why the thread read the throughput as a starting point rather than a comparison with datacenter parts 5.
  • Judgment still came from the human: the thread's common ground was that an experienced person pointing a model in a tasteful direction is where results like these come from, and the timing closure on the production bitstream — 133.33 MHz with 0.032 ns of positive slack — was treated as the sign that something was actually steering the search 5.
  • What it does not show: commenters separated building a card that runs a model from building the card that runs the model writing the card, and found the framing of self-improving hardware ahead of the evidence in the repository 5.
Original Article · Hacker News Discussion

PS5 executables relinked to run natively on Linux and Windows

  • HN Metrics: 370 points | 322 comments
  • Category: Binary translation and platform compatibility
AnyPS5 converts PS5 executables into native binaries for Linux and Windows by relinking them rather than emulating the console 6. The project supplies implementations of the console's PRX system libraries that a relinked binary can link against, and recompiles shaders to SPIR-V, validated with SPIRV-Tools when the build enables it 6. The percentage in the thread's title is the project's own badge, which counts the share of PS5 system functions it has declared so far, not the share of every function on the console 6. Dreaming Sarah, a 2D platformer, holds a stable 60 fps on a GTX 1050 Ti and an i5-7500 6.

What the discussion added

  • WINE is the comparison everyone reached for: commenters asked whether this is the same layer of trick, and the thread's answer is that the console's CPU is already x86-64, so the hard part is the graphics API — whether GNM command buffers get precompiled into Vulkan during relinking or intercepted while the program runs 7.
  • Legal risk ran alongside the technical interest: readers pointed at the takedowns that ended the Switch emulators and suggested keeping local clones of repositories like this one, since the code may not stay available 7.
  • Preservation was the other half of the thread: several readers said the open question is who keeps this working once the sources stop being distributed, and how much of the catalog will be playable by then 7.
Original Article · Hacker News Discussion

Gleam stops emitting Erlang source and targets the compiler's abstract forms

  • HN Metrics: 318 points | 139 comments
  • Category: Compiler internals
Gleam v1.19.0 rewrote the Erlang side of its compiler so that it emits Erlang abstract forms — the metadata-annotated syntax tree the Erlang compiler normally builds from source — encoded in Erlang's external term format and loaded straight into the compiler, skipping its tokeniser and parser 8. Build times fall, and location metadata now points at the original Gleam source, so BEAM crash reports and stack traces carry accurate line numbers, which the project says could support the Erlang debugger later 8. Gleam explains why it stops short of emitting BEAM bytecode: the bytecode format shifts between VM releases, and reproducing decades of Erlang compiler optimisations would become permanent maintenance 8. Elixir reaches the Erlang compiler the same way 8.

What the discussion added

  • The line numbers mattered more than the speed: commenters took the build-time improvement as welcome and said accurate locations in BEAM crash reports are the change they will notice, since the old generator could only point at the nearest function 9.
  • One reader disputed the wording: abstract forms are still Erlang, this commenter argued, since one call to erl_prettypr:format restores source text, and calling the previous output a transpiler was never an insult 9.
  • A debugger integration came up as the next step: with Gleam feeding the compiler an intermediate representation, hooking into the Erlang debugger becomes thinkable, though nobody in the thread had started on it 9.
Original Article · Hacker News Discussion

Performance

Speech to text in a 16.9 MB CPU-only model

  • HN Metrics: 941 points | 181 comments
  • Category: On-device inference
Whistle is a speech recognition model shipped as one 16.9 MB file that runs on CPU with no dependencies, in the same engine and container format as Cactus Compute's earlier Needle models 10. Its encoder runs eight attention blocks over one frame per 80 ms, and its decoder runs eight more with cross-attention over the audio, decoding five beams into a transcript capped at 320 tokens, with word timestamps, keyword biasing and seven languages built in 10. On an Apple M4 Pro CPU with ten seconds of audio it reaches the first token in 11.1 ms and decodes at 1,319 tokens per second, and the wait grows with the clip — 5.9 ms at five seconds, 36.3 ms at 30 — because Whistle reads the clip instead of padding everything to 30 seconds 10. The project reports lower error rates than Whisper base on LibriSpeech test-clean and test-other, SPGISpeech, Earnings-22 and the FLEURS average, and higher ones on TED-LIUM, AMI and the MLS average 10.
ModelSizeTime to first token, 10 s audioDecode
Whistle16.9 MB11.1 ms1,319 tok/s
Whisper base145.3 MB73.2 ms266 tok/s
Moonshine tiny v241.9 MB22.8 ms262 tok/s
The three models' published figures, measured on the same CPU runtimes at their defaults over ten seconds of audio 10.

What the discussion added

  • English passed the break-it test; Spanish did not: testers reported that accented English held up well, while several said Spanish output contained words that do not exist, alongside heavy typos 11.
  • Size was never the hard part, said the sceptics: the difficult cases named in the thread were elderly or post-stroke speech and strong accents, where the question is accuracy rather than footprint 11.
  • The pattern underneath drew as much interest as the model: readers welcomed sub-20 MB models that need neither a GPU nor a network round trip, and pointed at other CPU-first speech tooling built on the same premise 11.
Original Article · Hacker News Discussion

A 125B mixture-of-experts model installed onto consumer hardware

  • HN Metrics: 935 points | 421 comments
  • Category: Inference engineering
Strata packages Qwen3.8-Flash-Next, a 125B mixture-of-experts model with 24,576 experts of which about ten fire per token, for one-click installation on ordinary machines 12. The engine spreads the model across the whole computer: the GPU keeps the most-used experts, RAM holds all of them, the CPU works through the rest, and the SSD carries a lookup table, with 35–55 GB loaded into RAM at startup 12. Speculative decoding, where a small model guesses and the large one checks a batch at once, is credited with answers arriving 1.6–1.8× sooner, and prompts are read in chunks of up to 8,192 tokens at more than 1,000 tokens per second 12. The published measurements come from a 12 GB RTX 5070, and the README estimates a 24 GB card at roughly 100–140 tokens per second while benchmarking no RTX 4090 at all — the card in the thread's title 12.
QuantisationWrites answersReads the prompt
Q2_094 tok/s2,650 tok/s
IQ2_XS79 tok/s2,090 tok/s
IQ3_XXS62 tok/s1,750 tok/s
IQ3_S53 tok/s1,620 tok/s
Coder (half the experts removed)55 tok/s2,180 tok/s
Measured by the project on an RTX 5070 12 GB with a Ryzen 5 7600 and 64 GB of RAM, 4K answers against 32K prompts 12.

What the discussion added

  • Users outran the README: one commenter with an RTX 4090, 128 GB of DDR5 and a Ryzen 7950X3D measured 124 tokens per second, and another reported the smaller-card setup doing well on PHP codebase security audits 13.
  • The loudest scepticism was about what the throughput hides: commenters asked whether the key-value cache is quantised to four bits or below, and read an AI-written README as no evidence either way 13.
  • What readers wanted next was the ability score for each size: several asked for benchmarks beside every quantisation so that a 2-bit build's usefulness is measured rather than assumed, and one said the hardware worth targeting is the 8 GB machine, not the workstation 13.
Original Article · Hacker News Discussion

Chrome ships a JPEG XL decoder written in Rust

  • HN Metrics: 573 points | 399 comments
  • Category: Image decoding and web formats
Chrome 155 adds decoding support for JPEG XL, delivered through jxl-rs, a decoder written in Rust 14. The team chose Rust to remove memory-safety faults such as out-of-bounds reads and use-after-free at the source rather than relying on a sandbox, and reports that fuzzing and AI-assisted review found none across the implementation's history 14. Safe SIMD required a stabilised Rust feature plus a jxl_simd abstraction layer modelled on Highway, the C++ library written for the reference decoder, and the result is described as roughly as fast as the best non-memory-safe implementation 14. The post claims 30–50% better compression than JPEG, lossless JPEG transcoding and built-in HDR support; encoding is not part of the change 14.

What the discussion added

  • AVIF versus JPEG XL came down to a range: commenters said AVIF still wins below about one bit per pixel and JPEG XL wins above it, so the useful reading is which part of the range a site serves 15.
  • The support map was the surprise: Chrome previously removed the format, and readers noted it is now implemented across the major browsers and operating systems, with Firefox's support described in the thread as coming soon 15.
  • Patents stayed open: readers asked whether JPEG XL inherits the licensing problems that hung over JPEG 2000; the Chrome post says nothing about licensing, and the thread did not settle it 15.
Original Article · Hacker News Discussion

SRE & Security

A supplier's legitimate access exposed 8.8 million Danish CPR records

  • HN Metrics: 509 points | 352 comments
  • Category: Access control and incident response
Denmark's CPR register, the central person register holding every resident's identity data, reported a serious security incident on October 5 16. Someone abused a Danish company's lawful access to the register and obtained names, addresses and CPR numbers for about 8.8 million registered people, leaving out the records of those who have name and address protection 16. The register cut off the company's access, reported the incident to Denmark's data protection authority and handed the case to the police 16. Politiken reported that at least three accounts at the Funen-based IT company Pays used the password "123456", one of them the administrator account, and a hacker who spoke to the paper said initial access came from a former employee's leaked password 17.

What the discussion added

  • What one record exposes, and how little stood in the way: commenters listed social security number, age, sex, family relations, address and protected addresses, and asked how a single company could pull records with no limit on which fields or how many 18.
  • The timeline and the volume came from Danish reporting: access ran from 10 September to 2 October, about 14 million searches went through the company's credentials, and the company learned of it through an unusually large invoice for those searches 17.
  • The thread read it as part of a run, and as a warning about identification: commenters compared it with leaks in Poland and France and linked it to Denmark's encryption debate, while credit warnings in the CPR register climbed from just under 250,000 on 1 October to about 970,000 by 7 October 1718.
Original Advisory · Hacker News Discussion

One clicked link was enough to take over a Telegram Desktop account

  • HN Metrics: 318 points | 163 comments
  • Category: Application security
CVE-2026-107181 chains two defects in Telegram Desktop up to and including 7.2.8 19. The client's single-instance socket serialises a tg:// URL as OPEN:<url>; and splits what it receives on that semicolon without escaping it, so one crafted URL arrives as several commands, and because OPEN: accepts any scheme it can reach Telegram's internal interpret: scheme, whose send-path helper reads an instruction file on disk and uploads a named file to a chat without checking who asked 19. The attacker gets the instruction files onto the victim's disk through a supergroup — Telegram's default auto-download writes small files into a predictable folder — then sends an ordinary https link that redirects to the crafted tg:// URL, so the payload never passes through Telegram's in-app handling 19. The files worth taking are the session's key material; with no local passcode set, the salt sitting beside the encrypted key is enough to reconstruct the session and open the victim's account 19. Telegram fixed it in 7.2.9, whose changelog mentions only a rendering fix 19.

What the discussion added

  • The file-read half is the story: commenters noted that the earlier front-page post covered the account takeover, while this report shows the same chain pulling any file the user can read, with session data only the most valuable target 20.
  • The dissenting reading put the fault in the desktop operating system: on Linux, macOS or Windows any process the user runs can read any file the user owns, so these commenters framed the fix as sandboxing the client, and described running messaging clients in a jail that can see one folder 20.
  • Disclosure timing drew its own criticism: the report reached ZDI on 25 June, the vendor fixed it on 16 September, the case closed on 30 September, and the CVE number arrived on 7 October, four days after the write-up appeared 19.
Original Article · Hacker News Discussion

Hijacked country-code domains produced counterfeit TLS certificates

  • HN Metrics: 140 points | 51 comments
  • Category: Internet trust infrastructure
Attackers took over three country-code top-level domains — .gh, .sl and .as — then modified authoritative DNS records for selected domains inside them, changing IP addresses and nameserver delegations until automated domain-control validation passed 21. Unauthorised certificates were issued for several Google domains and for other widely used services, and Google said the incident did not involve compromising the affected domain owners' own systems and that the certificate authorities followed their requirements 21. Google updated Chrome to block the certificates it identified and told users they need do nothing, while warning that it cannot guarantee it found every affected domain and that a browser-side block protects Chrome users only 21. Its guidance for domain owners is to watch Certificate Transparency logs and publish restrictive CAA records 21.

What the discussion added

  • The mechanism came from Google's own write-up: commenters walked through it as a registry-level DNS change followed by removal of the affected domains' CAA records, after which the attackers satisfied domain validation and collected certificates from public authorities 22.
  • Certificate pinning was the defence named over and over: HPKP would have caught the substitution, several commenters argued, and they noted that CAA records do not help once an attacker controls the registry's DNS 22.
  • One reader doubted the account itself: this commenter argued pinning should have made the attack impossible and that something was missing from the report, a point the thread left standing rather than resolved 22.
Original Article · Hacker News Discussion

Databases & Storage

Polars 2.0 turns streaming on by default and makes SQL first-class

  • HN Metrics: 469 points | 106 comments
  • Category: Query engines and dataframes
Polars 2.0 shipped on October 6, making the streaming engine the default for LazyFrame queries and turning on out-of-core execution, which spills to disk once memory use reaches about 80% of RAM, against a default disk budget of 64 GB 23. Row order is no longer guaranteed after joins, group-bys and unpivots unless maintain_order=True is requested, and the library is stricter about dtypes and implicit coercion 23. SQL becomes first-class, with join reordering, better common-subplan elimination and dynamic predicates, and the release adds a Map dtype with its own expressions 23. The release's benchmarks against DuckDB 1.5.6, DuckDB 2.0 alpha and DataFusion 54 on TPC-H and TPC-DS derived data put Polars ahead of both on the default path, while recording that Polars carries constant overhead when scaling to 192 threads and loses its TPC-DS lead at the smaller SF10 scale 23.

What the discussion added

  • The eager-versus-lazy footguns were the first question: one commenter said half their bugs came from a stray collect() inside a loop destroying the query plan, and wanted to know whether 2.0 settles that 24.
  • Readers described the same migration: moving analysis to Polars and DuckDB together, and surprise that Polars has SQL at all, which this release promotes from an add-on to a supported entry point 24.
  • The boundary questions stayed open: commenters asked how Polars relates to DataFusion and whether the two ecosystems are converging, and whether the library has become a full replacement for pandas or still splits by workload 24.
Original Article · Hacker News Discussion

Doom runs inside a database, with the game logic and renderer written as SQL

  • HN Metrics: 338 points | 55 comments
  • Category: Database engines
CedarDB wrote Doom's game loop and renderer as SQL and kept a thin Python client that feeds input, fires a tic 35 times a second and draws the bitmap it gets back 25. Game logic comes to about 5,900 lines of SQL against roughly 9,000 lines of the original C, and the renderer to about 1,300 lines across 89 CTEs, where the reference Linux port's renderer takes some 3,300 lines 25. The port keeps Doom's fixed 35 Hz clock — a 28.6 ms budget per tic — and decouples drawing, so the client can query a new frame whenever it wants one 25. The slowest scene the author measured, 46 monsters rushing through a door in E4M1, takes 10.45 ms of that budget against 2.15 ms for a typical tic, and the depth resolve that replaces Doom's ordered rendering is the most expensive stage of a frame at 8.2 ms 25.
Two Doom screenshots side by side showing the same room, the same weapon and the same status bar
CedarDB published this pair with the port: one frame is the 1993 binary, the other is a SQL query 25.

What the discussion added

  • The line count was the surprise: commenters noted that the SQL version of the game logic is shorter than the C it replaces, which is the opposite of what a reimplementation in a query language suggests 26.
  • The multiplayer servers drew attention of their own: commenters liked that the database supplies the shared clock, the authentication and the per-tic atomicity, with three cores per client and a referee process rotating the map 26.
  • It is also marketing, and the thread said so: one commenter called it advertising that works, given how hard it is to stand out among SQL databases, and another noted the same port has been submitted several times with this the copy that finally reached the front page 26.
Original Article · Hacker News Discussion

DuckLake keeps the catalog in a database and the data in Parquet

  • HN Metrics: 234 points | 36 comments
  • Category: Lakehouse formats
DuckLake is an open lakehouse format that keeps metadata in a catalog database and data in Parquet files, with a DuckDB extension that reads and writes it after INSTALL ducklake 27. A DuckLake database is attached like any other: the repository's example puts metadata in a file with the .ducklake suffix and data under a separate path, and the catalog itself can be DuckDB, PostgreSQL or SQLite 27. The format supports updates, time travel by version, schema evolution through ALTER TABLE and a change data feed through table_changes 27. The project publishes no releases, and the development build is installed from core_nightly 27.

What the discussion added

  • The correction readers made first was that DuckDB is optional: commenters pointed out that DuckLake is a data lake specification which DuckDB implements, and that work is going on in the Rust and DataFusion ecosystem to implement the same format 28.
  • Placing it against the table formats took the rest of the thread: readers compared it with Delta and Iceberg, describing DuckLake as those formats with an SQL engine attached, and asked what it adds beyond another open table specification 28.
  • Alpha status was the reported pain: one commenter found filtered catalog counts broken on a released version and a much slower SQL parser on the development branch, and another asked why a greenfield project in 2026 starts in C++ 28.
Original Article · Hacker News Discussion

Observability

A coffee machine moved a terabyte in ten days

  • HN Metrics: 942 points | 566 comments
  • Category: Device telemetry and network visibility
A user who manages his parents' home network posted that their smart coffee machine had generated 1 TB of traffic in ten days, after checking the network's activity himself and asking the manufacturer what a coffee machine uploads 29. After the post went viral he looked further and reported that most of the traffic stayed inside the home network rather than going out to the internet, that it saturated his access point, and that he attributed it to a fault in that unit 29. He unplugged the machine instead of investigating further, on the grounds that an always-on device able to saturate the network is worth less than the coffee 29.

What the discussion added

  • The thread turned into a survey of misbehaving home devices: an air conditioner kept trying to associate with a router that blocked it, and a television filled a DNS log with queries, in two of the cases commenters offered 30.
  • Segmentation was the advice everyone agreed on: a separate VLAN or SSID for appliances, with rules about what those devices may reach, because the alternative is trusting firmware with no support contract behind it 30.
  • It is an observability story before it is anything else: the traffic was invisible until somebody read the logs, and commenters described DNS-level logging surfacing malware on a router that nothing else had reported 30.
Original Article · Hacker News Discussion

Tune the microbenchmark until it takes 300 milliseconds

  • HN Metrics: 148 points | 53 comments
  • Category: Measurement practice
matklad's rule of thumb for a microbenchmark is to adjust the input size until a run takes about 300 ms 31. Milliseconds are integers from 1 to 999, which is enough precision to notice a small improvement and easy to compare at a glance without switching units, and anything faster than about 10 ms risks being skewed by fixed costs such as interpreter startup 31. Hundreds of milliseconds makes those one-off overheads irrelevant without fragile corrections, and stays short enough that running the benchmark ten times to eyeball variance is quick 31. The post's stated assumption is that a benchmark exists to give its author enough intuition to make a decision, rather than to produce a precise number 31.

What the discussion added

  • The pushback was domain-specific: commenters said some subjects need stabilised measurement and statistical framing, and that building representative inputs which take hundreds of milliseconds is hard for small units of work 32.
  • Browser benchmarks brought a concrete correction: Chromium-family browsers round timers to the millisecond, so a WebGPU benchmark needs 50–100 ms of work before the number means anything 32.
  • Machine interference was the recurring counter-example: readers reported that CPU frequency scaling, system interrupts and firmware interrupts left their measurements too noisy to trust, whatever duration they targeted 32.
Original Article · Hacker News Discussion

Also cleared 100 points this week

Ten threads that did not get entries, listed with their discussions:
  • Why isn't the industry freaking out about DeepSeek 4.1 Flash? — 1,105 points (discussion)
  • Simon Willison on needing default hard budget caps on cloud spending — 650 points (discussion)
  • Google data center water and electricity usage, revealed by an improper redaction — 528 points (discussion)
  • Valve's Timur Kristóf on improving old AMD GPUs on Linux — 499 points (discussion)
  • Agents don't need memory, they need documentation — 389 points (discussion)
  • Meta's Muse as a privacy and security problem — 389 points (discussion)
  • Two GitHub incidents in one week: Git operations, pull requests and Actions on 7 October, then Actions alone the day before — 227 and 103 points (discussion, second)
  • WSL3 measured 5–60% faster than WSL2 depending on workload — 172 points (discussion)
  • A 40 ms Go garbage collector pause traced to swap — 117 points (discussion)
  • Blu-ray M-Disc as a backup of last resort — 111 points (discussion)

References

  1. 1
    Deno is joining Cloudflare

    deno.com

  2. 2
    Deno is joining Cloudflare

    blog.cloudflare.com

  3. 3
    HN Discussion: Cloudflare acquires Deno

    news.ycombinator.com

  4. 4
    FeSens/openTPU

    github.com

  5. 5
    HN Discussion: OpenTPU

    news.ycombinator.com

  6. 6
    boykopovar/AnyPS5

    github.com

  7. 7
    HN Discussion: AnyPS5

    news.ycombinator.com

  8. 8
    Gleam doesn't compile to Erlang source anymore

    gleam.run

  9. 9
    HN Discussion: Gleam doesn't compile to Erlang source anymore

    news.ycombinator.com

  10. 10
    Whistle: Speech to Text in 16.9 MB

    cactuscompute.com

  11. 11
    HN Discussion: Whistle: Speech to Text in 16.9 MB

    news.ycombinator.com

  12. 12
    Niko1221/Strata

    github.com

  13. 13
    HN Discussion: Run Qwen 3.8 Flash Next (125B) on consumer hardware (RTX 4090) at 100T/s

    news.ycombinator.com

  14. 14
    Shipping JPEG XL in Chrome

    developer.chrome.com

  15. 15
    HN Discussion: Shipping JPEG XL in Chrome

    news.ycombinator.com

  16. 16
    Omfattende uautoriseret adgang til borgeres CPR-oplysninger

    cpr.dk

  17. 17
    `123456' password used in massive Danish CPR data breach

    cphpost.dk

  18. 18
    HN Discussion: Denmark data breach exposes 8.8M people's personal data

    news.ycombinator.com

  19. 19
    Telegram Desktop: one-click account takeover via IPC injection

    beaksec.github.io

  20. 20
    HN Discussion: Telegram Desktop vulnerability

    news.ycombinator.com

  21. 21
    Hackers obtain counterfeit TLS certificates for Google and other large services

    arstechnica.com

  22. 22
    HN Discussion: Hackers obtain counterfeit TLS certificates for Google and other large services

    news.ycombinator.com

  23. 23
    Release of Polars 2.0

    pola.rs

  24. 24
    HN Discussion: Polars 2.0

    news.ycombinator.com

  25. 25
    We ported the original Doom to SQL

    cedardb.com

  26. 26
    HN Discussion: We ported the original Doom to SQL

    news.ycombinator.com

  27. 27
    duckdb/ducklake

    github.com

  28. 28
    HN Discussion: DuckDB Ducklake

    news.ycombinator.com

  29. 29
    Man discovers his parents' coffee machine used 1TB of data in 10 days

    dexerto.com

  30. 30
    HN Discussion: Man discovers his parents' coffee machine used 1TB of data in 10 days

    news.ycombinator.com

  31. 31
    Benchmark In Milliseconds

    matklad.github.io

  32. 32
    HN Discussion: Benchmark in Milliseconds

    news.ycombinator.com

Hacker News Top Engineering Posts
Hacker News Top Engineering Posts@NeoDrop Official

This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.

Related content

  • Architecture
  • Cloudflare acquires Deno, and the Deno runtime gets one more year
  • An open-source AI accelerator whose RTL, ISA and compiler were written by agents
  • PS5 executables relinked to run natively on Linux and Windows
  • Gleam stops emitting Erlang source and targets the compiler's abstract forms
  • Performance
  • Speech to text in a 16.9 MB CPU-only model
  • A 125B mixture-of-experts model installed onto consumer hardware
  • Chrome ships a JPEG XL decoder written in Rust
  • SRE & Security
  • A supplier's legitimate access exposed 8.8 million Danish CPR records
  • One clicked link was enough to take over a Telegram Desktop account
  • Hijacked country-code domains produced counterfeit TLS certificates
  • Databases & Storage
  • Polars 2.0 turns streaming on by default and makes SQL first-class
  • Doom runs inside a database, with the game logic and renderer written as SQL
  • DuckLake keeps the catalog in a database and the data in Parquet
  • Observability
  • A coffee machine moved a terabyte in ten days
  • Tune the microbenchmark until it takes 300 milliseconds
  • Also cleared 100 points this week