HN rank: 1

HN score: 866

comments: 293

original url: https://earendil.com/posts/pi-1-0/

评论信号：Love pi. I tried to run some local models and pi was the only one that actually worked decently because it didn’t have a gargantuan system prompt that would take minutes to prefill on my scrawny ass laptop.Been running it almost barebones vanilla for a couple of months. Just a bunch of basic extensions and some skills.Now, if only they could fix the very annoying bug of the history jumping back at the beginning if I am not a the end while the model is reasoning that would great. reply: Couldn't agree more. The vanilla openclaw install was this byzantine mess of MD files talking about souls and identities and such, it really put me off. Stripping back to a bare install of the underlying pi, it was delightfully minimal and easy to reason about. Excellent starting point for building an assistant agent without having to read or fight with a bunch of cruft on top.Couple skills to integrate with an obsidian MD task tracker, small chat interface on the phone made public via tailscale, and bam, a reminder bot you can text from the grocery store.

评论信号：I wonder how Tolkien would’ve thought about the use of LotR names being used by all these AI and tech companies.. especially since they all seem to use the names of things that were corrupted by darkness. reply: I wonder much the same thing, but this seems like a slightly odd place to say it since so far as I can see the only LotR name in the linked article is the company name Earendil, and AFAIK Earendil-in-Tolkien was very much not corrupted by darkness.

评论信号：It's so great to see now that the folks behind Pi also try to pivot away from the idea that Pi is more than a "coding" agent. Its minimalism, and tool call primitives really lends itself to be a general purpose agent for your OS that you gradually extend on demand for your specific use case.Since January I use Pi professionally as well as personally and I can only recommend to start small and grow your harness over time. For example, for an agent in production it was so helpful for me to use Pi in interactive mode via tmux to get a feel of the agentic flow, tool calls and reasoning traces for a certain use case while only the stylized responses are rendered in Telegram via an extension to the user. As a Developer, I have full technical observability and control while providing and incrementally improving a service to a user at the same time.Excited how Pi Durable will fit in and can support more. Congrats and thank you! reply: Hey thanks for posting this. I use pi professionally too. I am curious how you used agentic workflows with pi before....

HN rank: 2

HN score: 154

comments: 83

original url: https://lwn.net/Articles/1097401/

评论信号：Fighting fire with fire... Thank you claude:Roughly 140 CVEs are in areas an unprivileged user might reach: net/sched, netfilter, bpf, io_uring, mm, kvm.About 850 CVEs are in drivers or filesystems. Those usually need specific hardware, a mount, or root.On Debian, many of the 140 also need user namespaces. Debian also blocks unprivileged bpf by default.The above three paragraphs were made up by a non-deterministic computer program. I wouldn't take them as gospel.

评论信号：note that any bugfix is assigned a cve, which makes for big numbers.>“Due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel… Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify.”https://docs.kernel.org/process/cve.html"number of cves" is a useless metric, especially when it comes to the kernel. reply: Tautologically every bug can legitimately be assigned a CVE, since every bug prevents some feature from working as intended. It's therefore a denial of service, which by the definition of the CVE system using CVSS means every bug is at least a 1/Low level vulnerability to CVSS v4.0.If you're willing to stretch, missing but planned features also deny the use of said features since they haven't been added yet, and so are CVSS 1/Low vulnerabilities.Resume-driven development for security researchers has never been easier!

评论信号：This is great, more access did provide more eyes on these problems.But, does that all of these being found now call into question, not the open source model logic itself, but the ability of human eyes to find security issues? These vulnerabilities have been sitting here for however long, but how many thousands of humans did not find them before AI? reply: The threshold for Microsoft and Apple to actually report vulnerabilities is MUCH MUCH higher than for Linux, and open source as a whole. They generally only disclose issues in Windows and macOS that are quite serious and impactful.For Linux, the threshold is nearer to the point of it being questionable whether a bug is even exploitable on a real production distro, compiled and run with any sort of sane configuration.

HN rank: 3

HN score: 456

comments: 166

original url: https://blog.cloudflare.com/clef-decision-models/

评论信号：“we’ve been testing our new Clef model on our Threat Intelligence team to help us classify website domains” Not sure if any of this testing is in production but their website classifications need lots of work. I use the cloudflare ZTNA agent on my work laptop and often run into uncategorized websites. Just last night I could not get into my insurance company’s website because it was uncategorized so I got a block page. If Clef can decide this in 2 seconds I shouldn’t have to enter a support request and wait hours for it to get categorized. Especially the main page for a Fortune 500 company.

评论信号：Am I hearing this right, that they made a decision model based on Typesafe's new paradigm, and actually made a model better than Jev based on Typesafe's own ranking?And it's only been a few weeks. reply: A lot of people claim to have made better than jev, there's a jev benchmark, I have tried many of those models and they eventually end up failing, a non trivial task which doesn't seem like much but reminds me of the svg pelican bench is games, have one of these decision/classifier models play a game, hook it up to the input, most of the ones that are supposedly on jev level end up playing a terrible game, showing that they are very narrow. Cloudflare doesn't compare to the top open bench alternatives, I just finished downloading it and will compare it to jev for non trivial tasks tonight.

评论信号：I'm a big fan of Cloudflare products. I recently stuck Jev in front of a Cloudflare-hosted Ollama model for chat/username moderation, so I was excited to test out Clef. The setup is user send a message -> Jev does first pass to see if it's toxic/hate speech/profane, if Jev is unsure then Ollama on Workers AI takes a deeper look.Clef was 2-3x slower and worse (it caught less hate speech) than Jev. Overall disappointing. reply: In "How we trained Clef" section Cloudflare mentioned that they initially based their Jev-like system on DiffussionGemma (DJev) model but then changed to Qwen with post training for Clef, but never mentioned any reason and justification for the change.Although they included the benchmark against DJev and Clef is better, perhaps if you can test it to see the real-world performance.

HN rank: 4

HN score: 148

comments: 142

original url: https://automatictransmission.khoury.northeastern.edu/index.html

评论信号：I currently drive a mid 2000s Ford truck, which runs great and meets my needs, but lately I got interested in minivans/people carriers. I pretty quickly realized that newer vehicles seem to not just record, but export a lot of driving data.The minivan market is small. There are really only 4-5 available and every single one sends telemetry data from the car and makes it hard/impossible to opt out of selling your data. Additionally, without pretty extensive work there is no means of physically disabling the telemetry, which forces you to trust they'll honor your opt out request (vs re-enabling it with some update).I'm clearly in the vast minority on this, but it's so frustrating that there are no options beyond buying and installing a third-party bypass to disable this type of tracking. Worse, I'm aware that the absence of data is data itself. Is my insurance going raise my rates because my vehicle won't provide telemetry for them to buy? reply: Ford until recently sold a minivan that was ugly as sin (looked like an '87 Vanagon) because it was a panel van with seats added....

评论信号：if an owner decides they are uncomfortable with the data sharing described within them, they are faced with (arguably) unfair choices:

• 01 accept the agreements regardless of their concerns
• 02 stop using their car's connected-vehicle features - which includes remote start, the app, and other very useful features
• 03 stop using the vehicle entirely

Easy, I take #2. Is that it? This whole time I thought the article was talking about telemetry the car sends regardless. reply: I have essentially gone with option 2 in my Audi A3. Every time I turn the car on, it puts up a dialog that warns me that I've made the terrible, terrible decision to not allow remote data and forces me to say, "no, do not turn it on for me now," before I can do anything else on the screen. Every, single, time.

评论信号：> As one notable exception, Honda improved its data collection practices to prevent sending precise geolocation to a third party associated with user tracking.I know what my next car will be. reply: I already like Honda and own models before they were connected to the cell network. But they are still not 100% there for current models:> Amplitude received from HondaLink: VIN, Location. Cross-context tracking: Amplitude received the VIN plus Location from HondaLink — an unresettable identifier tied directly to other personal data.They are so close they should say "fuck it, we're going to be different, we'll disable all the crap" and then market the heck out of it.

HN rank: 5

HN score: 152

comments: 58

original url: https://svelte.dev/blog/sveltekit-3-is-here

评论信号：After far too many hours using react, Svelte has become my favorite frontend framework. I’m seeing a lot of comments about how it stacks up in the LLM age. Prior to Opus 4.6-8 (and that era of model releases) they often struggled to get Svelte 4/5 code straight and mixed it up quite a bit.But having used it A LOT this year for personal projects, large work initiatives, and one-off web tools. I’m happy to say all the modern llms seem to do just fine with it. They even handle the experimental features, like remote functions, very well. It’s mostly preference but I find reading Svelte code much more pleasant than React/Vue.

评论信号：Such a great project. I converted my React-enjoying cofounders to Svelte/SvelteKit worried they wouldn't like it, but they absolutely love it!We use Svelte extensively at Orb.net for our website (duh), but also as a framework for our desktop and mobile apps. Wails serves our golang and SvelteKit/Svelte provide the UX. It's been tremendous for multiplatform productivity, and binaries are less than 20mb! Nothing like Electron! reply: +1 for Wails mention: just discovered it recently which brought me to Svelte--couldn't be more impressed. Golang "backend" w/ a Svelte "frontend" to build desktop apps the fraction of the size of Electron is a killer imo.

评论信号：I love the hands-on developer experience of programming in Svelte. But since we're in October of 2026 I have to ask, is the vibe-coding experience in Svelte any different than in React? Can anyone with experience in both comment? reply: Yes. We open sourced an SSG based off SvelteKit about a year ago and were starting building AI tooling and product workflows around it, https://statue.dev but have since mothballed it.For most of 2024-2025 frontier models really struggled with Svelte 4 vs 5 compatibility issues. Some of the main contributors, to their credit, really put in a lot of work to create benchmarks/MCP/other tools to make AI better at using Svelte. Personally I am just not a fan of MCP and other tools like that at all, and decided I'd rather just use vanilla css/js for new projects.Look at this; it's literally multiple times more expensive to have a model sifting through all this stuff in every context use them with a tool: https://svelte.dev/docs/ai/prompts/llms.txt All of these are input tokens and turns to gather context.The "too niche to be a major training priority" dilemma is actually a really big problem that almost all new or emerging dev tools have now....