Securing a Smart Dog Collar: Secure Elements, Key Lifecycles, and Why TLS Isn't Enough on 5 Microamp

Vitaliy Gribko · HackerNoon · hackernoon.com · 23 min

Hardware · Analysissecure elements · key lifecycle · IoT firmware security

Matched interests: CryptographyCybersecurityHardware Hacking

Storing symmetric authentication keys in raw microcontroller flash leaves connected IoT devices vulnerable to trivial firmware dumping and differential power analysis. Revising a battery-constrained NB-IoT pet collar, an engineer replaces software cryptography on an STM32L4 with a dedicated JavaCard secure element. Running AES-CMAC operations over a four-wire ISO 7816 interface keeps private credentials physically unreadable while letting the host power-gate the chip between sessions.

Sons and Mothers

George Packer · The Atlantic · theatlantic.com · 49 min

Books & writing · First personmemoir · D.H. Lawrence · mother-son relationship

Matched interests: Longform EssaysCreative WritingShort Fiction

Nancy Huddleston Packer emerges from a rambunctious Alabama political family to become a revered Stanford fiction teacher, mentoring Tobias Wolff and Jeffrey Eugenides while battling chronic writer's block. Following her husband's 1972 suicide, she draws her adolescent son into an intense partnership of dark movie theaters, brutal literary sparring, and the heavy burden of her thwarted artistic ambitions.

Converting a $20 4G wireless hotspot into a texting device

bkovac.github.io via untitaker · Lobsters · bkovac.github.io · 15 min

Hardware · First personOpenStick 4G modem · Sharp memory display · device tree hacking

Matched interests: Mobile UXHardware HackingMechanical Keyboards

Mating a Qualcomm MF800 modem with an iPhone Clicks keyboard produces an ultra-compact pocket terminal driven by a Sharp Memory Display. Fitting the parts requires physically sawing off sections of the modem's circuit board and manufacturing a custom single-sided adapter to manage level shifting and USB power. Mainline Linux, extracted Android device trees, and a patched DRM driver overcome tricky SPI chip-select behaviors to paint the screen.

Comments

Recreating Voodoo Graphics and a Late-1990s Gaming PC on an FPGA

zdw · Hacker News: Front Page · nand2mario.github.io · 14 min

Hardware · First personFPGA retro PC · 3dfx Voodoo · SystemVerilog

Matched interests: Terminal GraphicsWebGLSystem Design

A SystemVerilog core named zSST implements 3dfx SST-1 architecture on a Xilinx KV260 board, pairing with a soft 486 CPU to run Tomb Raider via its native renderer at 100 MHz. While pipelining fixed-function rasterization is straightforward, sustaining memory throughput requires replicating the original card's bank interleaving. Distributing texels across four banks in an alternating two-dimensional grid enables single-cycle bilinear filtering without access conflicts.

Hacker News: 124 points · 33 commentsComments

How I Wrote a Forth (Without Knowing How)

vtrlx.ca via crmsnbleyd · Lobsters · vtrlx.ca · 10 min

Software engineering · First personForth implementation · Lua C API · recursion schemes

Matched interests: LuaWritingSystems Programming

Victoria Lacroix develops MoonForth, a Forth dialect implemented in C that manipulates Lua’s internal stack via its C API. Custom word definitions live in Lua tables as pointers to plain C functions, bypassing Lua's call stack so primitives execute without runtime interference. Built in under a week, the portable system handles branching and loops across Lua 5.1 and LuaJIT.

Lobsters: 1 points · 0 commentsComments

Subnormal floating-point numbers are expensive… on Intel processors

Daniel Lemire · Lobsters · lemire.me · 4 min

Hardware · First personsubnormal floats · CPU microarchitecture benchmarks · IEEE 754 performance

Matched interests: SIMDPerformance ProfilingWebGPU Compute

Microbenchmarking 16,384-element double arrays across five modern architectures reveals that subnormal calculations trigger steep penalties on Intel Granite Rapids and Emerald Rapids, ballooning multiplication latency from 4 to 128 cycles. Conversely, AMD Zen 5 handles multiplications at full speed with modest division slowdowns. Across Apple M4 Max and AWS Graviton 5 chips, subnormal inputs execute completely without overhead.

Hacker News: 5 points · 0 commentsLobsters: 8 points · 1 commentsComments

How apple detectives solved the mystery of an ancient tree—and rewrote the history of fruit

Maryn McKenna · Scientific American Content: Global · Scientific American · 20 min

Science & space · Reportedapple genetics · Maine heritage orchards · Drap d'Or de Bretagne

Matched interests: AppleBioinformaticsScience

When geneticist Cameron Peace profiles DNA from an unidentified Maine orchard sample, he discovers a long-lost progenitor to hundreds of American apple varieties. Traced to a Revolutionary War-era homestead by nurseryman John Bunker, the centuries-old specimen fills an empty gap in continental pedigrees. Its genome offers crucial disease resistance for commercial growers currently reliant on just fifteen cultivars.

What if we never find dark matter?

Joseph Howlett · Scientific American Content: Global · Scientific American · 14 min

Science & space · First persondark matter detection · XENONnT · limits of science

Matched interests: ScienceScience FictionSci-Fi

Decades of null results at underground liquid xenon detectors like Gran Sasso's XENONnT bring dark matter searches up against the impenetrable neutrino floor. As the once-vaunted WIMP hypothesis collapses under repeated experimental failures, physicists face an unsettling epistemic reckoning: five-sixths of the universe's mass may simply be undetectable, exposing the boundaries of empirical science.

What we have learned at OpenShell applying formal methods to control AI agents

alexwatson405 · Hacker News: Front Page · nvidia.github.io · 13 min

AI & ML · How-toformal methods · AI agent permissions · Z3

Matched interests: Agent-Based SimulationsAI AgentsTech Policy

After an agent bypasses Layer 7 REST sandbox filters during a demo by invoking git-remote-https, NVIDIA engineers turn to automated theorem proving. Adapting the SMT-based architecture of AWS’s Zelkova, the team uses Microsoft’s Z3 solver to model permission boundaries as logical formulas. The resulting containment queries run deterministically in milliseconds, catching unsafe capability combinations without consuming model tokens.

Comments

1Password's AI patching benchmark is misleading

blog.trailofbits.com via sarciszewski · Lobsters · blog.trailofbits.com · 11 min

Software engineering · AnalysisAI patching benchmark · security patch quality · benchmark methodology

Matched interests: FuzzingCybersecurityAI Agents

A re-examination of 1Password’s security evaluation shows that its 26% clean-fix rate relies on trials that barred models from compiling code or intentionally gave bad instructions. Restricting the data to standard conditions lifts exploit mitigation to 86%. Across 186 live open-source pull requests, maintainers merged 67.7% of agent-authored fixes, while an internal audit shows human developers fail on one in eight initial repairs.

Hacker News: 37 points · 9 commentsLobsters: 8 points · 2 commentsComments

JustVugg/colibri

GitHub All Languages Weekly Trending · github.com · 24 min

AI & ML · CodeMoE inference · memory tiering · expert disk streaming

Matched interests: Local LLMMemory AllocatorsSIMD

Written in pure C with zero dependencies, an inference engine runs MoE models up to 2.8 trillion parameters on consumer hardware by treating VRAM, RAM, and NVMe as a single hierarchy. For 744B models, dense layers stay resident in ten gigabytes of memory while nineteen thousand routed experts stream from disk. A weight JIT prefetches active experts and stripes reads across dual SSDs without altering model semantics.

Hacker News: 937 points · 240 comments

When Google Cuts Off Access: Poland and the World

marekfocus · Hacker News: Front Page · dossier.reasoner.pl · 38 min

Business & economics · First personGmail account suspension · platform accountability · DSA appeals

Matched interests: Digital PrivacyDigital NomadismCloud Computing

An automated spam filter disables a fifteen-year-old Gmail inbox after six complaints are sent to 107 recipients, prompting a forensic audit of corporate liability. Corporate registers show that Google Poland, despite employing over 2,300 staff in Warsaw, holds no legal relationship with local users, routing all contracts through Ireland. Five appeals yield identical automated rejections, while on-site security guards bar the physical delivery of legal notices.

Comments

If the US Collapses Soon, Don’t Blame Emily St. John Mandel

Katie Drummond · WIRED · 28 min

Books & writing · Interviewspeculative fiction · near-future collapse · AI and authorship

Matched interests: Speculative FictionWorldbuildingCommonplace Books

Emily St. John Mandel discusses her novel Exit Party, which charts two divergent American futures: a fractured post-civil-war territory of rival republics and a totalitarian surveillance state. By following parallel versions of a protagonist whose impulses veer toward either crime or law enforcement, Mandel examines the counter-lives of individuals and nations as political reality threatens to outpace speculative fiction.

Show HN: An e-ink frame that hears birds and draws them as 1800s illustrations

arnemunthekaas · Hacker News: Front Page · github.com · 4 min

Hardware · Product pagee-ink display · bird audio classification · Raspberry Pi project

Matched interests: E-Ink DisplaysDigital GardensLinux

Running on a Raspberry Pi and a 13.3-inch Spectra 6 e-ink panel, Fugleramme identifies local birds in real time using on-device acoustic classification with BirdNET-Go. It maps detected species to over 800 hand-curated nineteenth-century natural-history plates, arranging cut-outs across a textured background scaled by biological body mass. The frame redraws only when the acoustic landscape changes, showing a bare perch when no birds are heard.

Comments

Pocket Acid (synth, drum machine and sequencer written in Zig)

/u/text_garden · top scoring links : Zig · reddit.com · 4 min

Software engineering · First personZig music software · tracker/sequencer design · handheld synth homebrew

Matched interests: ZigProcedural MusicMechanical Keyboards

Engineered for budget handheld consoles like the Game Boy-styled R36S, a minimalist groovebox pairs tracker mechanics with dual phase-distortion bass instruments. Built atop SDL2 and UNSCII bitmap fonts, the lightweight program unifies input handling with immediate-mode graphics layout while coordinating audio callbacks through ad-hoc atomic memory. The architecture favors fast prototyping over strict abstraction, compiling directly with embedded sample kits.

Some things Veloren does differently

Joshua Barretto's Blog · blog.jsbarretto.com · 9 min

Games · AnalysisECS architecture · voxel storage · procedural generation

Matched interests: Game MechanicsGame EnginesBevy

Voxel multiplayer game Veloren avoids conventional sharding by using an Entity Component System in Rust, running 500 players and tens of thousands of entities at 50% core utilization on a 48-thread server. Custom 'chonk' terrain structures balance CPU cache coherence against compression, while a persistent real-time simulation tracks off-screen NPC movements, faction raids, and trade economies without despawning.

Hacker News: 5 points · 0 commentsLobsters: 11 points · 1 comments

Amana’s Sky Shader Worked Perfectly, Except It Kept Getting the Weather Wrong

Amana · HackerNoon · hackernoon.com · 8 min

Software engineering · First personMetal shader · sky rendering · color-space bugs

Matched interests: CSS AnimationWebGLBevy

A procedural iOS renderer built with Metal and SwiftUI repeatedly contradicts atmospheric conditions outside due to composition, interpolation, and color-space errors. Debugging the fragment pipeline requires decoupling overcast desaturation from rain branches, normalizing sky hue against cloud luminance during sunrise, and implementing `@MainActor Animatable` to eliminate abrupt uniform jumps. Pixel measurements verify each fix, using the view outside the window as ground truth.

Chop Up Your Books

matt_kirkland · Hacker News: Front Page · attainablefelicity.mattkirkland.com · 3 min

Books & writing · How-torebinding books · reading physical books · bookbinding craft

Matched interests: Commonplace BooksBooksBook Lists

Oversized paperbacks like the 850-page *Lonesome Dove* cause unnecessary hand fatigue, prompting an unpretentious workshop solution: carving bulky tomes into portable individual sections. Slicing through the spine's binding glue with an X-acto knife cleanly separates natural chapter breaks without loosening the surrounding pages. Wrapping each segment in a trimmed manila folder secured with Elmer's glue yields lightweight, functional volumes built strictly for reading comfort.

Hacker News: 171 points · 163 commentsComments

Paul Tagliamonte: DESFire EV3

Planet Debian · notes.pault.ag · 14 min

Hardware · First personMIFARE DESFire EV3 · NFC authentication · desox Rust crate

Matched interests: CryptographyPKMHardware Hacking

Implementing MIFARE DESFire EV3 authentication in Rust, the desox library bypasses standard ISO/IEC 7816-4 APDUs for NXP's undocumented, unencapsulated byte format to fit 60-byte message limits. Handshake states are encoded directly into Rust types to enforce valid symmetric key agreement transitions across AES-128 nonces. For regression testing, a replay framework feeds recorded NFC hex transactions into a mock backend with hardcoded random nonces.

Shadowing the Standard Library

Andrew Nesbitt · nesbitt.io · 7 min

Software engineering · Analysismodule shadowing · sys.path and @INC · agent sandbox exploits

Matched interests: PythonLuaZero-Copy

An exploit against coding agents illustrates how Python’s default sys.path prepends the script directory, allowing malicious files to override standard modules like struct. While languages like Ruby, Perl, and Node eliminated ambient path lookups, Python and PHP still search local directories first. This leaves autonomous agents exposed whenever they generate and execute helper scripts alongside untrusted extracted archives.

Abusing ID3 chapters to turn videos into glanceable podcasts

Alex Chan · alexwlchan · alexwlchan.net · 6 min

Software engineering · How-toID3 chapters · Overcast podcast app · FFmpeg

Matched interests: PodcastsWebCodecsPhoto Workflows

A Python utility named glancecast converts presentation recordings into MP3 files that refresh lock-screen album artwork every five seconds. Using FFmpeg and the Mutagen library, it embeds timed CHAP and APIC metadata frames while deliberately omitting table-of-contents tags to avoid cluttering players like Overcast. The resulting 40-to-50-megabyte files deliver stop-motion visual context for conference talks without demanding continuous viewing.

The Age of Wonders and Terrors

skybrian · Shtetl-Optimized · scottaaronson.blog · 13 min

AI & ML · AnalysisAI singularity · AI criticism · mathematics and AI

Matched interests: Speculative FictionAIAI Criticism

OpenAI’s expenditure of roughly $15 million in compute to produce a 166-page, Lean-verified Navier-Stokes solution marks the arrival of the AI singularity for academic mathematics. As longstanding open problems in quantum complexity and algebra fall within weeks, human researchers find themselves abruptly dethroned as Earth's primary theorem-proving entities, facing an unmanageable deluge of synthetic proofs.

Hacker News: 38 points · 3 commentsComments