Cihangir Bozdogan — Daily Tech & AI News

Daily · tech & AI

Hand-picked from Hacker News, Reddit, GitHub Trending and engineering blogs.

Hacker News · 14

  • After 18 months of stealth, Thinking Machines Lab released Inkling, a 975B-parameter Mixture-of-Experts model with 41B active parameters, pretrained on 45 trillion tokens of text, image, audio and video. It reasons natively over text, images and audio, supports up to 1M-token context, and exposes a controllable "thinking effort" dial, with weights on Hugging Face plus a smaller Inkling-Small preview. It became the #1 US open-weight model on release. The launch is explicitly framed as a Western answer to strong Chinese open models like GLM and DeepSeek.

    What people are saying

    HN noted it's the largest open model to support audio and a rare US entry people can root for. "America needs its own DeepSeek or Z.ai — Thinking Machines might be it." Discussion: https://news.ycombinator.com/item?id=48924912
    read source →
  • PrismML released Bonsai 27B as 1-bit (3.9GB) and ternary (5.9GB) compressions of Qwen3.6-27B, retaining about 94.6% of FP16 quality in the ternary build. It hits 134 tok/s on an RTX 5090 and 58 tok/s on an M5 Max while keeping multi-step reasoning, tool calling and multimodal understanding on-device. Everything ships under Apache 2.0 on llama.cpp and MLX. Reports say Apple is in talks with PrismML about the compression tech.

    What people are saying

    Commenters wanted head-to-heads against Gemma 4 12B's 4-bit QAT build and pressed on how ternary quantization keeps so much capability. Discussion: https://news.ycombinator.com/item?id=48910545
    read source →
  • xAI published grok-build, the Rust CLI powering Grok 4.5's agentic coding, as an Apache-2.0, roughly one-million-line workspace including the agent loop, code tools, terminal UI and extension system. The release followed backlash over the CLI uploading entire directories to xAI cloud buckets; xAI says it deleted the data and disabled retention. External contributions are rejected and issues disabled, so it's readable rather than collaborative. Developers are already building on top and poking at oddities in the code.

    What people are saying

    "The trailing players' strategy (Meta, xAI) is to open source the moat of the leaders — we all benefit." Others flagged the disabled-contributions stance as source-available, not open community. Discussion: https://news.ycombinator.com/item?id=48926590
    read source →
  • Mindgard disclosed a Cursor vulnerability it first reported in December 2025, going full-disclosure after more than six months and 197+ new versions shipped without a fix. The deeper issue: Cursor doesn't treat cloning a repo and executing its code as separate security boundaries, and it ships with Workspace Trust disabled by default. That means opening a malicious repository can lead to code execution. The post reignited debate about responsible disclosure timelines for AI-native dev tools.

    What people are saying

    One maintainer-side view: the flood of LLM-generated vuln reports is overwhelming and often misjudges product scope — making real reports harder to triage. Discussion: https://news.ycombinator.com/item?id=48910676
    read source →
  • Alex Edwards lays out a pragmatic Go + HTMX setup for building interactive web apps without a heavy JavaScript framework. The approach leans on server-side rendering with small HTML-over-the-wire updates, and pairs well with type-safe templating libraries like templ. It's part of a continuing backend-dev backlash against SPA complexity for CRUD-shaped apps. The post is concrete about project structure, handlers, and where HTMX does and doesn't fit.

    What people are saying

    Fans described a "GUS stack" (Go + templ + HTMX); skeptics noted team adoption is hard when colleagues dismiss HTMX as not a "serious" technology. Discussion: https://news.ycombinator.com/item?id=48912175
    read source →
  • This post collects long-standing SQLite pet peeves — loose typing, quirky defaults — and proposes borrowing Rust's "editions" model: opt-in sets of alternative defaults that don't break existing databases. The idea is to let new projects choose stricter, more modern behavior without fragmenting the format everyone relies on. It sparked a lively design debate about whether editions would improve ergonomics or just splinter tooling. SQLite's role as a portable data container complicates the analogy.

    What people are saying

    Supporters liked pairing concrete gripes with a backwards-compatible fix; critics warned editions fragment ecosystems and bloat maintenance, citing similar tensions in other languages. Discussion: https://news.ycombinator.com/item?id=48928135
    read source →
  • Clawk gives coding agents a disposable Linux VM to work in, isolating file access and command execution from your host system. It targets the growing risk of handing autonomous agents real shell access, offering a lighter path than hand-rolling QEMU/KVM. The launch fits a wave of agent-sandboxing tools arriving as people wire agents into their dev environments. It joins alternatives ranging from bubblewrap wrappers to Podman-based setups.

    What people are saying

    Commenters compared approaches — full KVM isolation for the paranoid, bubblewrap or Podman for lighter weight — reflecting an unsettled best practice for agent sandboxing. Discussion: https://news.ycombinator.com/item?id=48892859
    read source →
  • Tailscale disclosed TS-2026-009, a vulnerability in its SSH feature where insecure argument handling could permit root access. The bug is a classic argument-injection class issue, and Tailscale published a security bulletin with remediation. It's a notable reminder that convenience layers over SSH add attack surface. Many users trust Tailscale heavily for connectivity but hadn't enabled its SSH feature.

    What people are saying

    "Such a venerable and ancient class of bugs, going back to AIX 3." Several heavy users said they stick to OpenSSH for its longer security track record. Discussion: https://news.ycombinator.com/item?id=48915004
    read source →
  • GitHub changed Dependabot so version-update PRs only open after a new release has been on its registry for at least three days, on by default and requiring no configuration. The cooldown is a supply-chain safeguard against compromised or immediately-yanked releases, a recurring npm and PyPI failure mode. It nudges the ecosystem away from instantly pulling the newest version. Reactions split on whether a delay meaningfully reduces risk or just shifts who gets burned.

    What people are saying

    Some argued cooldowns just move the blast radius to whoever updates first; others griped that Dependabot already makes security teams dogmatically churn dependencies. Discussion: https://news.ycombinator.com/item?id=48913050
    read source →
  • OpenAI, with hardware maker Work Louder, launched Codex Micro — a physical macropad-style control deck with tactile keys for triggering and steering Codex coding agents. At $230 it reads as a niche enthusiast object, and observers noted the device even bears an old OpenAI cloud logo. It follows OpenAI folding the standalone Codex app into a broader product surface. The launch amused HN as much as it intrigued it.

    What people are saying

    Commenters compared it unfavorably to a Stream Deck on price and questioned why an automation company is selling physical buttons at all. Discussion: https://news.ycombinator.com/item?id=48923079
    read source →
  • The Puter team compiled Firefox to WebAssembly, producing a browser engine that runs inside another browser tab. It's an experiment pushing the limits of what WASM can host, and the author says debugging and JIT research cost over $25K in model tokens. You can even run firefox-wasm inside firefox-wasm, though it gets unstable a few layers deep. It joins a lineage of ambitious "X in the browser" ports.

    What people are saying

    Reactions mixed admiration for the feat with amusement at the recursive nesting and the token cost of the debugging effort. Discussion: https://news.ycombinator.com/item?id=48926939
    read source →
  • Telegram introduced a serverless offering for bots, providing execution and storage so developers can run bot logic without hosting their own backend. It lowers the barrier to shipping bots and, as commenters noted, pairs naturally with model APIs to build personal LLM assistants with custom rules and memory. Questions remain about quotas, execution-time limits, and storage. It extends Telegram's already-generous bot platform further toward a full app runtime.

    What people are saying

    "Wire this up to OpenRouter and you have your own LLM chat with your rules, storage, and memory." Others asked about execution and storage quotas. Discussion: https://news.ycombinator.com/item?id=48918534
    read source →
  • This piece argues for agent harnesses flexible enough to tackle open-ended tasks, sketching a direction rather than a finished system. It landed in the middle of an active debate about how much of an agent should be deterministic scaffolding versus model-driven improvisation. Several practitioners pushed back that vague flexibility doesn't beat a tight, code-heavy scaffold. The thread is a useful snapshot of unsettled agent-architecture opinion.

    What people are saying

    One commenter spent six months building a harness, then went back to plain Codex CLI — a recurring "the fancy harness didn't stick" sentiment. Discussion: https://news.ycombinator.com/item?id=48921077
    read source →
  • This position paper makes the case that governments, companies and nonprofits should fund free, open-source AI as a public good and strategic hedge against closed-model concentration. It frames open models as infrastructure worth sustaining rather than leaving to market incentives alone. The argument dovetails with Nathan Lambert's "6 months to live for open models" worry about open AI's viability. Critics counter that frontier model-building is more a scientific research program than a FOSS engineering effort.

    What people are saying

    One idea gaining traction in comments: recurring inducement prizes (à la Kremer) — e.g. $200K every 6–12 months to the first team hitting an open-model target. Discussion: https://news.ycombinator.com/item?id=48927095
    read source →

Reddit · 12

  • A community-maintained thread ranking the best locally-runnable vision-language models as of July 2026, weighing quality against VRAM and speed. It's a useful practitioner snapshot as multimodal document and image models proliferate, from Qwen3.6 VL builds to Baidu's OCR model. The discussion trades real hardware notes rather than benchmark marketing.

    What people are saying

    Discussion: https://www.reddit.com/r/LocalLLaMA/comments/1uoalfq/best_local_vlms_july_2026/
    read source →
  • Linus Torvalds weighed in against the pile-ons directed at developers who use LLMs, a live tension in kernel and open-source circles. His comments — echoed in a separate lobste.rs thread on LLM usage in kernel development — land as maintainers wrestle with AI-generated contributions and etiquette. It's a notable signal from a figure whose opinion carries weight on contribution norms.

    What people are saying

    Discussion: https://www.reddit.com/r/LocalLLaMA/comments/1uxbrw4/linus_torvalds_tells_people_to_stop_attacking/
    read source →
  • Google pushed updates to Gemma 4's chat templates, addressing bugs that had degraded tool-calling and structured output in agentic setups. For a model widely used on laptops and even ancient hardware, template correctness materially affects real-world reliability. The fix matters to the large community running Gemma locally for agent workflows.

    What people are saying

    Discussion: https://www.reddit.com/r/LocalLLaMA/comments/1uxfu4k/google_is_updating_gemma_4s_chat_templates/
    read source →
  • Days after Tencent released Hy3 (Hunyuan 3), r/LocalLLaMA already had an aggressive 1-bit quantization weighing roughly 89–93GB, putting a very large open model within reach of high-end local rigs. It shows how fast the quantization community moves on fresh releases. Extreme low-bit builds are becoming the default way enthusiasts run frontier-scale open models at home.

    What people are saying

    Discussion: https://www.reddit.com/r/LocalLLaMA/comments/1uxm2d8/hy3_1bit_8993_gb/
    read source →
  • This post captures the local-AI ethos: a smaller model you can run reliably on your own hardware often beats a bigger one you can only rent. It resonated amid a week of releases spanning phone-sized Bonsai to 975B Inkling. The thread weighs latency, privacy, cost and availability against raw benchmark scores.

    What people are saying

    Discussion: https://www.reddit.com/r/LocalLLaMA/comments/1ux9xze/the_best_model_is_the_one_you_can_actually_run/
    read source →
  • Researchers shared and debated a paper attempting to disentangle the internal representations of a convolutional network, part of the growing mechanistic-interpretability push. The thread digs into method and whether the results generalize. Interpretability remains one of the more scientifically grounded corners of ML research.

    What people are saying

    Discussion: https://www.reddit.com/r/MachineLearning/comments/1uwya70/mechanistic_interpretability_a_first_paper_on/
    read source →
  • An engineer reported a PyTorch model running 170x slower on a T4 than an A100 — far beyond the expected hardware gap — and the community dug into likely culprits: precision/dtype fallbacks, missing kernels, memory pressure, and op support. It's a practical reminder that GPU performance cliffs are often software, not just silicon. The thread is a useful checklist for anyone profiling inference.

    What people are saying

    Discussion: https://www.reddit.com/r/MachineLearning/comments/1ux6a9x/pytorch_model_running_170x_slower_on_t4_vs_a100/
    read source →
  • This post aggregates the major robotics and vision-language-action (VLA) papers into a single ranked, benchmarked reference — a helpful map of a fast-moving field. VLA models are a hot research frontier as embodied AI matures. The thread debates evaluation methodology and which results actually hold up.

    What people are saying

    Discussion: https://www.reddit.com/r/MachineLearning/comments/1uxa7ak/all_major_robotics_and_vla_papers_ranked_and/
    read source →
  • A team shared how and why they compiled their TypeScript parser to WebAssembly, covering portability across runtimes and the performance characteristics they got. It's a concrete data point in the ongoing move of dev tooling toward WASM for consistent cross-environment behavior. The thread discusses tradeoffs versus native and pure-JS parsers.

    What people are saying

    Discussion: https://www.reddit.com/r/programming/comments/1ux5sj1/we_compiled_our_typescript_parser_to_wasm/
    read source →
  • This engineering post details rebuilding a notification platform to reliably fan out millions of messages, covering queuing, batching, and delivery guarantees. It's the kind of practical distributed-systems write-up r/programming rewards, with real tradeoffs around throughput and consistency. Useful reference material for anyone scaling a fan-out workload.

    What people are saying

    Discussion: https://www.reddit.com/r/programming/comments/1uwj90b/how_we_rebuilt_our_notification_platform_to/
    read source →
  • This post shows how to build end-to-end encrypted secret sharing using the browser-native Web Crypto API, keeping plaintext off the server. It's a clean example of doing real cryptography client-side without extra dependencies. The discussion covers key handling, threat model, and pitfalls of browser crypto.

    What people are saying

    Discussion: https://www.reddit.com/r/programming/comments/1uwxnox/endtoend_encrypted_secret_sharing_with_the_web/
    read source →
  • An r/artificial thread discusses Anthropic research testing frontier AI agents in simulated deployment environments and documenting problematic behaviors that emerge under autonomy. It feeds the broader safety conversation as agents gain real tool access and independence. The findings are cited alongside this week's agent-sandboxing and command-guard tools.

    What people are saying

    Discussion: https://www.reddit.com/r/artificial/comments/1uxihfy/anthropic_tested_frontier_ai_agents_in_simulated/
    read source →

Blogs & Newsletters · 12

  • Hugging Face's engineering post distills what building Shippy taught them about production agents — where naive designs break, how to structure tools and context, and which reliability problems only show up at scale. It's grounded in a shipped system rather than a toy example. The lessons echo the week's broader theme of operationalizing agents responsibly.

    read source →
  • This Hugging Face post examines model routing — sending each request to the best-fit model — and why a seemingly simple idea accrues real complexity around cost, latency, quality drift, and fallbacks. It's timely amid a flood of specialized models (coding, OCR, small local) where routing is increasingly necessary. The piece is practical about the failure modes teams actually hit.

    read source →
  • OpenAI published research on GPT-Red, an approach to letting models improve their own robustness, particularly against adversarial and edge-case failures. It lands alongside GPT-5.6's broad rollout and OpenAI's safety-policy posts this week. The work targets making frontier systems more reliable under pressure rather than just more capable.

    read source →
  • Forgejo released v16.0, continuing its path as a fully open, community-governed Git forge and lightweight self-hosted alternative to GitHub. The release brings the usual mix of packaging, federation groundwork, and quality-of-life improvements while keeping a small, auditable footprint. It appeals to teams that want to own their source hosting and CI.

    What people are saying

    Discussion: https://lobste.rs/
    read source →
  • A widely-shared discussion captured Linus Torvalds's views on LLM usage in Linux kernel development, as maintainers grapple with AI-generated patches and the etiquette around them. His stance — echoed in his pushback against attacking people for using AI — carries real weight on contribution norms. It's part of open source collectively figuring out where AI fits.

    What people are saying

    Discussion: https://lobste.rs/
    read source →
  • This post shows how to detect full table scans in SQLite — a common silent performance killer — using query plans and instrumentation, so you catch missing-index problems early. It's the kind of concrete database-performance tip that travels well beyond SQLite. Handy for anyone shipping SQLite in production or at the edge.

    read source →
  • Cloudflare introduced Precursor, a continuous behavioral-validation engine that turns session-level interaction signals into bot-detection signals across the full user journey. As autonomous agents browse and act on the web, distinguishing them from humans becomes both harder and more important. Precursor aims to give sites visibility into how humans versus bots actually behave. It reflects the arms race triggered by capable web-using agents.

    read source →
  • This deep technical piece demystifies memory compilers — the tools that generate SRAM blocks from bitcells up through GDS tiling for fabrication. It's a rare accessible look at a corner of chip design most software engineers never see. The post rewards anyone curious about what's beneath the abstractions they build on.

    What people are saying

    Discussion: https://lobste.rs/
    read source →
  • OpenAI published a policy post on US AI-safety efforts across state and federal action, framing how it sees regulation evolving. It arrives as the Commerce Department's AI-standards center reviews frontier model releases like GPT-5.6. The piece is as much positioning as explanation, and worth reading critically alongside independent policy coverage.

    read source →
  • Oxide's engineering post walks through tuning network performance across the many layers of a stack they control end to end, from hardware up. Owning the whole stack lets them reason about performance in ways most teams can't. It's a characteristically detailed systems read from a company that documents its work unusually openly.

    read source →
  • elfuse enables running Arm64 and x86-64 Linux ELF binaries on Apple Silicon macOS, tackling the perennial cross-platform binary-compatibility problem. It's an intriguing systems hack for developers straddling macOS and Linux toolchains. The approach sparked discussion about performance and the boundaries of userspace compatibility layers.

    What people are saying

    Discussion: https://lobste.rs/
    read source →
  • Discord engineering explains how it attributes hosting costs per feature across an API spanning 1,700+ endpoints and hundreds of Kubernetes deployments — without restructuring everything. It's a practical FinOps-meets-platform-engineering problem many large systems face. The write-up covers the instrumentation and tradeoffs that made granular cost tracking feasible.

    read source →