Published on June 24, 2026 at 06:00 CEST (UTC+2)
Vulnerability reports are not special anymore (119 points by goranmoomin)
Vulnerability reports are not special anymore
This article argues that open source maintainers should treat vulnerability reports with the same perspective as any other issue or pull request—as a present, not an obligation. The author reflects on his past role leading the Go Security team, where he once taught that vulnerability reports demanded special responsiveness and attribution. He now contends that the value lies in the insight and confidentiality provided by reporters, not in the reporters themselves, and that a balanced approach is necessary to maintain sanity in open source work.
Jerry's Map (364 points by turtleyacht)
Jerry's Map
Jerry’s Map is a long-running art project that began as a doodle in 1963 and has evolved into a massive, two-dimensional “virtual world” composed of over 4,000 hand-drawn panels. The map is continually revised using a system of rules and random instructions drawn from a custom deck of cards, executed in various media like acrylic, marker, and collage. The project has spawned a dedicated subreddit and a blog, though Jerry no longer updates the latter.
FUTO Swipe – A new swipe typing model (347 points by futohq)
FUTO Swipe – A new swipe typing model
FUTO Swipe is an open-source, on-device swipe typing model for Android that aims to replace privacy-invasive or proprietary alternatives. The project released a dataset of 1 million swipes under the MIT license, collected through a voluntary web effort, and provides models and algorithms for community use. The system is designed to run fully offline with low latency, and the team requests attribution for its use.
A man was gifted his dream car by Kevin Mitnick, who he helped put in prison (109 points by mauvehaus)
A man was gifted his dream car by Kevin Mitnick, who he helped put in prison
This article tells the story of a man who helped capture notorious hacker Kevin Mitnick and later received his dream car as a gift from Mitnick himself. The narrative explores the unexpected friendship that developed between the two, highlighting themes of redemption and forgiveness. It underscores that real-life gift car fantasies do occasionally happen, albeit in surprising ways.
In memory of the man who put red and green squiggles under words (210 points by saikatsg)
In memory of the man who put red and green squiggles under words
Raymond Chen pays tribute to Tony Krueger, a developer who worked on early versions of Microsoft Word and is credited with implementing spell-check squiggles. Despite his significant contribution to a feature used daily by millions, his name is largely unknown. The post reflects on the unsung heroes of software development and the lasting impact of seemingly small innovations.
Printing Gaussian Splats (213 points by ilnmtlbnm)
Printing Gaussian Splats
The author describes the process of physically 3D printing a Gaussian splat—a 3D scene representation—resulting in a physical “crystal” resembling modern amber. The technique involves voxelating the splat, mixing inks for color and transparency, and printing layer by layer. Challenges included handling view-dependent colors and achieving fine fur transparency, but the final output was a striking preservation of a digital artifact.
Swift Package Index joins Apple (187 points by JDevlieghere)
Swift Package Index joins Apple
The Swift Package Index, a community resource for discovering and managing Swift packages, has been acquired by Apple. Although the full article content is not available, the announcement signals Apple’s continued investment in the Swift ecosystem and package management infrastructure.
Usbliter8: an A12/A13 SecureROM Exploit (98 points by givinguflac)
Usbliter8: an A12/A13 SecureROM Exploit
This technical write-up details a novel BootROM vulnerability in Apple A12, S4/S5, and A13 chips, exploiting a hardware bug in the USB controller and a firmware configuration flaw. The authors released a proof-of-concept to illustrate that even recent SecureROM generations remain susceptible to hardware-level attacks. Since the vulnerability lies in immutable code, migrating to newer hardware is the only effective mitigation.
Extreme Heat conference cancelled due to extreme heat warning (223 points by rendx)
Extreme Heat conference cancelled due to extreme heat warning
A conference titled “Extreme Heat: Improving governance and strengthening action around the world” was cancelled because of a red extreme heat warning issued by the UK Met Office. The event was to feature the inaugural Adeline Stuart-Watt Award and discussions on heat governance. The irony of a climate-focused event being disrupted by the very phenomenon it aimed to address underscores the urgency of climate adaptation.
Rhombus Language 1.0 (95 points by Decabytes)
Rhombus Language 1.0
Rhombus is a new programming language built on the Racket ecosystem, designed to be extensible through macros while incorporating modern features like lexical scoping, objects, pattern matching, and type parametricity. Version 1.0 is now available, and the language aims to balance a manageable specification with domain-specific extensibility. It represents a significant milestone for the Racket community.
Open-source AI/ML models are becoming a competitive differentiator
FUTO Swipe’s release of a 1-million-swipe dataset under MIT license and its open models exemplify how organizations use openness to attract users and contributors. This trend challenges proprietary, privacy-invasive alternatives. For AI/ML development, it means that community trust and data sovereignty are key adoption drivers. Actionable takeaway: invest in transparent data collection and permissive licensing to build ecosystems.
Hardware-level vulnerabilities remain a critical concern for secure AI deployment
The Usbliter8 exploit highlights immutable flaws in Apple’s SecureROM, affecting devices used for edge AI inference. As AI moves to mobile and IoT hardware, such vulnerabilities can compromise model integrity and user data. Why it matters: AI safety isn’t just about algorithms; the hardware stack must be hardened. Implications: developers should prioritize hardware-backed security features and plan for hardware refreshes when vulnerabilities are discovered.
Domain-specific language design and extensibility are gaining traction
Rhombus 1.0 and the Swift Package Index acquisition both signal a push toward more flexible, community-driven language ecosystems. For AI/ML, DSLs enable optimized model definition, training pipelines, and inference systems. Trend: macro-based extensibility allows AI researchers to prototype new paradigms without forking a language. Actionable: consider building DSLs for specialized ML tasks (e.g., differentiable programming) on top of extensible platforms like Racket or Swift.
Real-world data synthesis and physical reproduction of digital models is emerging
Printing Gaussian Splats demonstrates the convergence of 3D scene representations (common in NeRF and 3D Gaussian Splatting) with additive manufacturing. This opens possibilities for creating tangible AI-generated artifacts for prototyping, education, or art. Why it matters: bridging digital and physical worlds requires robust methods for handling view-dependent effects and transparency. Implications: AI/ML pipelines should include a “printability” validation step when producing assets for real-world use.
Environmental and operational risks are becoming concrete for AI infrastructure
The extreme heat conference cancellation is a stark reminder that climate change directly impacts human and technological operations. AI/ML workloads are compute-intensive and generate heat; extreme weather can disrupt data centers, training runs, and deployment. Trend: AI sustainability must include resilience planning. Actionable: design adaptive scheduling that accounts for external temperature warnings, and invest in energy-efficient architectures.
Human factors in AI/ML safety: vulnerability reporting and maintainer burnout
The article on vulnerability reports speaks to the psychological load on maintainers of critical AI/ML libraries (e.g., PyTorch, TensorFlow, scikit-learn). Treating every report as a “special” obligation can lead to burnout, while ignoring them risks security. Insight: AI/ML projects need clear, balanced policies that acknowledge reporters’ contributions without overburdening maintainers. Implication: automated triage and community norms can help sustain long-term security hygiene.
The value of “unsung” contributions in AI/ML tooling
The tribute to Tony Krueger’s spell-check squiggles mirrors the often-overlooked work of engineers who build foundational AI/ML tools—data loaders, debuggers, or visualization libraries. Trend: as AI/ML becomes more commoditized, the quality of infrastructure matters more than flashy models. Why it matters: recognizing and supporting these contributors (e.g., via funding or attribution) ensures the ecosystem remains healthy. Actionable: incorporate attribution requirements (as FUTO does) into open-source AI licenses to sustain development.
Analysis generated by deepseek-reasoner