Relevance 7/10Importance 10/10
A write-up documenting a decade-old authentication bypass in OpenSSH on musl-based Linux — Alpine, OpenWrt, and the container ecosystem built on them. Accounts locked with `*` as their password will accept any password longer than 256 characters, because a 2012 musl decision to return `"*"` on crypt failure collided with a 2016 OpenSSH timing-attack mitigation that borrows password salts. It hid for ten years because it only fires in the musl-without-PAM configuration — which happens to be Alpine's default, and Alpine is the base layer under an enormous share of production containers.
Relevance 7/10Importance 10/10
Alpine's official advisory for the same bug, covering openssh-server in versions 3.16 through 3.24 plus edge. Any reachable SSH port on a vulnerable box can be logged into without knowing a password — one connection, works every time, no retries needed. Patch and restart sshd now; the stopgap is `PasswordAuthentication no`.
Relevance 10/10Importance 8/10
Tencent dropped Hy4, an open-weights model that adds visual understanding — fine-grained image processing, chart analysis, mathematical visual reasoning — plus the ability to drive CLI and GUI software, trained on tools like Blender and CAD. Hallucination rate fell from 12.95% to 7.2% versus its predecessor, and it topped a blind financial-analysis eval against DeepSeek and Kimi. Pricing lands around ninety cents per million input tokens and $2.70 out, available via Tencent Cloud and OpenRouter.
Relevance 9/10Importance 6/10
The author built and shipped an iOS app in a single day on a hackintosh without hand-writing code, using AI coding tools end to end. More interesting is the claim that AI has triggered an explosion of activity in the hackintosh scene — macOS 27 on Snapdragon laptops, iOS on the Nintendo Switch. The thesis: agentic coding can revive communities that had been written off as dead, and keep old hardware useful instead of landfilled.
Relevance 6/10Importance 8/10
Salon is ceasing publication after 31 years, announced today. The farewell cites profoundly changed business realities for independent digital journalism without naming AI or search-traffic collapse specifically. No details on archive preservation, staff transitions, or shutdown timeline — just a thank-you to staff, contributors, and readers.
Relevance 7/10Importance 6/10
Kagi killed its signup wall — you can now search at kagi.com with no account at all. You get 50 free searches anonymously, plus another 100 if you register. The reasoning is pure startup growth math: an ad-free subscription search engine lives on word of mouth, and that's impossible when friends can't try the product without creating an account.
Relevance 5/10Importance 7/10
Motorola announced the first non-Pixel phone with official GrapheneOS support, a genuine partnership where Motorola supplies driver and firmware code rather than leaving the project to reverse-engineer it. It's a 6.8-inch flagship with USB-C 3.2 Gen 2, UWB, and up to 512GB, starting at $1,599 with GrapheneOS as an option rather than the default. HN is split on whether privacy-by-default justifies that price when a used Pixel costs a tenth as much.
Relevance 3/10Importance 8/10
CVE-2026-83844 is an out-of-bounds read in Windows Paint that lets an unauthenticated attacker execute code over a network, no user interaction required. It scores 8.1 HIGH, classed as CWE-125. Versions 11.0.0.0 through 11.2605.90.x are affected; update to 11.2605.91.0 or later.
Relevance 3/10Importance 3/10
A macOS menu-bar app that wraps your application windows in animated knitted-yarn borders, built in Objective-C on top of Felix Kratz's JankyBorders. The developer hand-picked palettes for 37 apps including Slack, VS Code, Figma, and Finder, with local icon color sampling as a fallback for everything else. GPL-3.0, macOS 13+, and already near a thousand GitHub stars.
Relevance 2/10Importance 3/10
A personal accounting of what the author chooses to pay for when free alternatives exist: a domain, a hosted platform, premium typography, and a markdown editor. The argument is that paying is partly a commitment device and partly solidarity — they pay for Bear specifically to help keep its free tier alive. Notable numbers: a £100 ceiling per font family, $12 a year for the domain, $6 a month for hosting.
HN Briefing PM
