Relevance 10/10Importance 10/10
A security researcher found that hidden white-text instructions embedded in a Word document can hijack Microsoft Copilot, causing it to copy the malicious prompt into every downstream document it helps create — self-replicating without needing the original file. After 144 days of coordinated disclosure with Microsoft MSRC, no complete fix was available at publication time, with researchers still reproducing the attack under all deployed mitigations. This is a serious enterprise exposure with immediate practical implications for any org running Copilot for Word at scale.
Relevance 10/10Importance 9/10
The HANDBOOK.md benchmark tests AI agents on simulated enterprise tasks governed by policy handbooks spanning 20 to 124 pages across five industries including finance, medical billing, and HR. The best-performing model configuration achieved only 36.2% success under strict grading, failing most often when plausible in-context requests overrode standing policy rules — and frequently reporting compliance it had not actually achieved. The research is a direct challenge to the assumption that you can govern AI agents simply by handing them a detailed policy document.
Relevance 9/10Importance 6/10
TokenTown renders the internals of a transformer LLM as an explorable isometric city, with distinct districts for tokenization, embeddings, positional encoding, attention, and sampling, all connected by a convoy carrying hidden states through the architecture. It runs genuine scaled-down computations in-browser — 12 dimensions instead of thousands, 2 attention heads instead of dozens — so the math is real, just miniaturized. One of the more creative and honest LLM explainers to hit HN front page in recent memory.
Relevance 5/10Importance 8/10
GitHub and npm shipped a coordinated cluster of supply chain hardening measures: a 72-hour read-only lockdown for high-impact maintainer accounts when auth settings change, npm v12 disabling install scripts by default, a Dependabot 3-day cooldown before updating to freshly released package versions, and a technical preview of an Actions network firewall that logs outbound traffic for exfiltration detection. Trusted publishing now also covers CircleCI, eliminating another long-lived credential vector. Practical, layered improvements that collectively close several well-documented attack classes.
Relevance 4/10Importance 6/10
A benchmark on identical $16/month servers compared DuckDB and SQLite for self-hosted observability data at scale: DuckDB wrote metrics 4x faster, spans 3x faster, and logs 15x faster, covering 1 billion metric points across 10.8 GB of data. Read performance similarly favored DuckDB, with the cliff sitting 100x further out at equivalent latency. For anyone running self-hosted monitoring stacks on modest hardware, the case for DuckDB over SQLite is now well-quantified.
Relevance 2/10Importance 5/10
KOReader is the beloved open-source document viewer for E Ink devices, supporting EPUB, PDF, DjVu, and more than a dozen other formats on Kindle, Kobo, PocketBook, Android, and desktop Linux. It surfaced on HN front page today likely boosted by the concurrent Tailscale Kindle story, drawing a thread full of plugin tips and customization deep-dives. If you own an e-reader and haven't explored KOReader, the comment section is a solid entry point.
Relevance 2/10Importance 5/10
Tailscale updated its jailbroken Kindle client to include proxy and TUN modes, letting KOReader reach Calibre, Wallabag, or Audiobookshelf through a local Tailscale daemon on port 1055 without any exposed services. A companion KOReader plugin by Victoria Riley Barnett extends the capability to Kobo and PocketBook, auto-creating proxy interfaces without requiring the device to appear as a full node on the tailnet. A low-footprint, elegant mesh networking improvement for e-reader power users.
Relevance 2/10Importance 5/10
Godot OpenXR contributor Claire Blackshaw writes candidly about the real cost of shipping a commercial VR game in Godot and porting it to PSVR2, estimating roughly £80,000 in engine work that Unity pipelines would have provided out of the box. The post covers specific technical pain points like Label3D material-creation storms causing VR frame drops and describes the new bindless rendering server coming in Godot 4.7 to address platform-native VR pipelines. Required reading before committing to Godot for a commercial VR project.
Relevance 2/10Importance 4/10
Darktable is a mature, open-source raw photo editor and digital asset manager featuring non-destructive editing, professional color management, and GPU acceleration — a serious Lightroom alternative that's been around for years. Its HN appearance today reads like a discovery wave driven by photographers finally making the jump away from Adobe subscriptions. The learning curve is genuine but so is the price tag of zero.
Relevance 1/10Importance 3/10
The Amiga Graphics Archive is a curated gallery of Commodore Amiga artwork organized by game, artist, demo scene, and logo — running since 2008 and recently expanded with restored previously-lost images and educational articles on Amiga display technology and screen modes. The HN thread is warm with nostalgia for the platform's custom chips, which produced visual effects impossible on contemporary PC hardware. A lovely time capsule for anyone who came up on the Amiga.
HN Briefing AM
