Read Tech News With Digest

Researchers scanned 159,041 Lovable projects and found many built with Supabase left sensitive data readable without a login. Among the worst cases: a German forum exposing over 80,000 profiles and 200,000 chat messages, and a provider leaking more than 1,000 identity records with passport numbers and expiration dates. Lovable's terms put security responsibility on customers, yet its marketing suggests no technical skill is needed.

SpaceX's Starship Flight 15 broadcast on X shows the company once more catching the Super Heavy booster with the launch tower's chopstick arms. The stream, scheduled for November 13 at 9:58 PM, follows a test campaign in which the booster returns to the pad instead of splashing down, while the upper stage continues its own flight. The catch remains the headline moment of the mission.

Ian Miell, who once worked as "Head of DevOps" under several other names, traced 104 software job titles from 1947 to today in a Graphviz family tree. Coding began as low-status clerical work done largely by women, the webmaster fragmented into specialists and recombined as full-stack, and the prompt engineer was absorbed almost as soon as it appeared. The forward deployed engineer, he notes, is IBM's 1960s systems engineer under a new name.

PyPI has finished its UI overhaul, adding a dedicated security tab that shows each release's provenance state and per-file attestations. Releases with full provenance have every file backed by PyPI Publish or SLSA Build Provenance attestations; those without get a clear notice that file origin can't be cryptographically verified. New warnings flag incomplete, inconsistent, changed, or lost provenance, and the project page, release files, and release history tabs were redesigned around them.

This documentary traces KDE from Matthias Ettrich's 1996 Usenet call for help building a Linux desktop to its place as the default on major distributions and the Steam Deck. It covers the Qt licensing fight, the rivalry with GNOME, KHTML becoming the basis of WebKit and Chrome, the rocky KDE 4 release, and how KDE e.V. became a model for open source governance.

Seagate's FireCuda Forge pairs a 8TB or 20TB hard drive with a user-supplied M.2 NVMe SSD, managed by its new Alkemi platform, starting at $699 without the SSD. With NAND and mechanical drive prices climbing amid the AI boom, the hybrid math from Apple's 2012 Fusion Drive era works again. But Seagate won't say how Alkemi tiers data or what happens when one drive dies.

The grey rock technique, coined in 2012 by mental-health blogger Skylar after she left a 25-year relationship with a man she came to see as a psychopath, means becoming so unremarkable that drama-hungry people lose interest and drift away. It works on stalkers and narcissists, but also on the family WhatsApp group. One writer tries it and finds it defuses old arguments — while wondering whether he still has any opinions of his own.

A maker pricing out a camera-and-lights project found that a used Redmi 13C 5G or Huawei Mate 30 5G costs roughly $45–75 on Taobao and already packs a 40–50MP camera, GPS, storage, a clock, a battery, a touchscreen, and cellular. A comparably equipped Raspberry Pi 4 build runs about $222–347. The Redmi is rooted and running scheduled wake-and-sleep tasks; the open question is sourcing hundreds of matching phones with healthy batteries.

Google researchers paired Gemini 4 models with Antigravity's /teamwork multi-agent harness to attack problems open for decades. The system proved the 2013 Courtade–Kumar conjecture in full generality with a 50-million-line Lean 4 formalization, and autonomously produced a 1.8-million-line machine-checked formalization of the Weil conjectures. Other results settled open questions in quantum query complexity, matrix multiplication, streaming algorithms, and splay-tree performance, while a 30-agent chemistry loop hit 95% top-1 accuracy on NMR structure elucidation.

After a CBC visual investigation, LinkedIn removed nearly 900 postings and Monster took down 600 — all advertising remote travel jobs paying up to $75,000 with no experience required. Applicants who applied with blank résumés were directed to virtual sessions run by people tied to Evolution Travel, a U.S. multi-level marketing company that charges hundreds upfront and a monthly fee. The ads never mentioned the MLM or the costs.

DeepSeek V3 JAX is a minimalist implementation of the DeepSeek V3 architecture—including Multi-head Latent Attention, DeepSeekMoE, auxiliary-loss-free balancing, and multi-token prediction—in just 190 lines of pure JAX. No Flax, no Equinox, no PyTorch. It was pretrained from scratch on a MacBook Air using public-domain detective fiction, achieving a validation loss drop from 5.02 to 3.51 in about 2.6 hours. The code is readable top to bottom, with plain dicts of arrays and every component as a function. Perfect for learning, experimentation, and understanding modern LLM internals without heavy frameworks.

Google, SpaceX, Blue Origin, and China's Three-Body Computing Constellation are all betting on orbital data centers, and Elon Musk claims space will be the cheapest place for AI within a few years. A sober cost model finds the economics hinge almost entirely on Starship reaching Falcon-like reusability: space solar matches off-grid terrestrial power near $250/kg to orbit and beats every current energy source near $50/kg, down from roughly $1,500/kg today. Cooling turns out manageable; dead chips and bandwidth limits are the real drags.

CuriousMarc found some unidentifiable chips in an old parts bin, and after decapping one with hot air and cleaning the die with a few drops of boiling sulfuric acid, Ken Shirriff reverse engineered it as the Signetics ST680A — four NAND gates in diode-transistor logic from 1965, part of the first IC family sold in a plastic DIP. Two stray diodes on the die revealed that Signetics reused the same silicon for at least three chips, swapping only the metal layer.

University of Michigan researchers measured three open-source models—Alibaba's Qwen 3, Google's Gemma 3, and Meta's Llama 3.1—and found non-English prompts cost 1.4 to 180 times more energy, with Hindi at 7.9x and Bengali at 15.3x English. The cause: non-Latin scripts need more tokens, and accuracy often drops too. Roughly 5.2 billion people face this double penalty, which could price them out of AI.

Terminactory (tfac) is a cozy factory-building idle game that lives entirely in your terminal, built in Rust with ratatui. Dig copper, coal and iron, melt and press them, sell goods, and research your way up to computers and oil. There's nothing to fight and nothing breaks at random — the factory keeps earning while you're away. It's designed to sit in a split next to your AI agents, which can send you short Markdown messages that appear in-game via a simple `tfac msg` command or a Claude Code hook, so you can play while they work. It even ships with its own in-game browser, termweb, holding the wiki, research tree and production stats. Install with Cargo and try `tfac --demo`.

A fan-made interactive archive lines up 156 screenshots from The Secret of Monkey Island — 12 scenes across 13 releases, from the 1990 16-color PC floppy to the 1993 Sega CD. Every capture was taken in ScummVM (Hatari for Atari ST mono), scaled with nearest-neighbour pixels and 4:3 correction, and rendered through WebGL2 CRT shaders so each version appears on the monitor it was made for.

Guarini School of Graduate and Advanced Studies has paused admissions to Dartmouth's math PhD program for the 2027-2028 cycle, citing a departmental review. Current students' funding and status remain unchanged, but applicants who already submitted materials will not be reviewed. The move follows a national 15% drop in PhD acceptances and raises concerns about undergraduate course offerings and research culture.

Commercial phone unlocking tools don't invent new attacks; they industrialize known ones. This technical overview walks through Android's hardware security architecture — TrustZone's Normal and Secure Worlds, Gatekeeper and Keymaster, the boot chain — and explains why a Secure Element like Google's Titan M is the single biggest factor in resisting forensic unlocking. It also details how File-Based Encryption derives keys from user credentials and how BFU attacks break the boot chain to brute-force PINs offline.

Project Zero is replacing its "90+30" policy with a "Full X" model: vulnerabilities are disclosed X days after being reported to the vendor. Starting today, that's 90 days; on February 2, 2027, it drops to 60, and on January 3, 2028, to 30. Most special cases, including grace periods and variant policy, are gone. The reason: LLMs have accelerated vulnerability discovery and exploitation, making patch soak time meaningless and increasing the volume of bugs Project Zero finds.

Fursoy Slice-1 is a clean-slate 64-bit out-of-order superscalar RISC-V processor written in SystemVerilog. It implements RV64IMAFDV with Zba/Zbb extensions, Sv39 virtual memory, and privilege separation, and successfully boots mainline Linux 6.6.50 with BusyBox userspace. The core features a 2-wide superscalar pipeline, 128-entry reorder buffer, 160-entry physical register file, and non-blocking caches. It meets 500 MHz timing in Nangate 45nm synthesis across 8 functional blocks, with cycle-exact CPI telemetry showing zero conservation errors over 89 million cycles. This project provides a verified, high-performance RISC-V core for research and development.

Meta and Google's camera-equipped glasses, Apple's Audio Intelligence, and Amazon's Bee devices record and transcribe daily life, but their privacy promises only protect the buyer. EFF argues bystanders can't opt out, consent becomes meaningless, and constant monitoring erodes the spontaneity of private conversation. Technical fixes and laws won't solve the social damage, so the group urges users to push back through feedback and direct engagement.

A hands-on walkthrough for building a federated chat protocol called lnchat, modeled on how SMTP servers discover and talk to each other. It covers email-shaped identities like [email protected], discovery through a .well-known JSON file, server-to-server endpoints for resolving and publishing public keys, and end-to-end encryption using HPKE-style encapsulation. The author is candid about the limits: a compromised server can lie about keys, so real E2E needs fingerprints, TOFU, or key transparency.

Italy's data protection regulator hit Meta with an $887 million penalty over how its app accessed Android users' photo galleries, ruling that the consent flow never clearly explained what people were agreeing to. Hacker News commenters were less focused on the fine than on the tally: one user added up Meta's prior EU penalties to roughly €5.2 billion, bringing the total past €6 billion — and still called it a slap on the wrist.

A brisk, hands-on walkthrough of implementing a working subset of PostScript in concise, Forth-inspired JavaScript. It covers tokenizing programs, mapping PostScript types onto JavaScript values, and driving an operand stack and dictionary stack with a small set of primitive operators. The result runs as a REPL and handles examples like `[10 20 30] {2 mul} forall` identically to Ghostscript, with exercises for extending the operator set.

Aatish Bhatia and neuroscientist Arkarup Banerjee build a simple digital creature called a spark with just four neurons and three adjustable parameters, then let it learn by trial and error. Through thousands of attempts, guided only by reward and punishment, the spark goes from spinning in place to expertly tracking light. The piece visualizes learning as a path through the space of possible brains, and shows how the same algorithm can produce fleeing, freezing, or fighting depending on the reward.

The IRS has published the source code for Direct File, its free, interview-based federal tax filing service, on GitHub. The repository includes the Scala-based Fact Graph for reasoning about incomplete returns and test cases for interpreting the 2024 tax code. However, the code is archived, unmaintained, and may contain unpatched vulnerabilities, so the IRS explicitly warns against using it in production. Certain sensitive code was removed.

A developer built a ZIP archive that is also a bootable disk image. The first bytes form a valid ZIP local file header whose filename field doubles as a jump instruction, and the Multiboot magic 0x1BADB002 hides in the header bytes. It boots under QEMU direct kernel boot, from a floppy image, or on real hardware including a Pentium MMX, i486 DX2, and Am386DX-40. The archive even contains the source code to rebuild itself.

Worried about EMPs, Jeff Kaufman tested a galvanized trash can as a Faraday cage. Using a broadband noise generator and a radio receiver, he found the bare lid leaked at the seam, but taping it eliminated detectable signal across 24 MHz to 1.7 GHz. While unplugging electronics is probably enough, a taped trash can offers strong protection if you want it.

Lexifina turned Title 26 into structured data and pointed Lean at every cross-reference, flagging 138 real faults — dead citations, typos, duplicated paragraph numbers, unclosed parentheses — each backed by a machine-checked certificate. They then modeled the 2025 income tax in Lean, validated it against PolicyEngine-US, Tax-Calculator and UsTaxes, and ran a loophole search that rediscovered known strategies and surfaced a few results they could not find documented anywhere.

Agweb is a macOS browser built on WebKit specifically for coding agents. It solves the common pain points of focus stealing and resource-heavy headless browsers by providing a single window that never takes focus, letting agents drive it via a playwright-cli-style command while you monitor all tabs live. With features like idle tab suspension, shared login profiles, and secret handling, it's designed to make multi-agent workflows efficient and unobtrusive. Perfect for developers running multiple coding agents who need a lightweight, always-visible browser that acts like a human without the overhead.