Hacker News Evening Brief: 2026-06-02

The evening edition for June 2nd, 2026 catches Hacker News in a security-heavy mood: Meta’s AI-powered support is enabling Instagram account takeovers, Anthropic is scaling its vulnerability-scanning project to 200 partners, and bunnie Huang is reading SRAMs through infrared images. Elsewhere, Adafruit faces legal threats from an AI PCB startup, KDE prepares to drop X11 for good, and a Stanford course ships an AI-tutor CLAUDE.md alongside its assignments. Thirty stories follow, sorted by category.

Security & Privacy

A walking tour of surveillance infrastructure in Seattle

Summary: This interactive guide maps surveillance cameras, automatic license plate readers, and smart-city sensors across downtown Seattle. Originally developed as a workshop with the Tech Equity Coalition and the ACLU of Washington in 2019, each entry details the technology’s address, appearance, function, social significance, and references. The tour exposes layers of data collection hidden in plain sight, from traffic cameras with facial-recognition capabilities to predictive policing infrastructure.

HN Discussion: Commenters with technical backgrounds flagged inaccuracies in camera and ALPR identification, calling the direction correct but the execution sloppy. Several pushed back on the dense academic “gazes” and “encoding ways of seeing” framing as jargon that alienates a broader audience. One noted the irony that Seattle police could not recover footage of a bike theft despite the dense surveillance coverage the tour documents.

Expanding Project Glasswing

Summary: Anthropic is expanding Project Glasswing from roughly 50 to approximately 200 partner organizations. The initiative uses Claude Mythos Preview to scan codebases for security vulnerabilities, and initial partners have already uncovered more than 10,000 high- or critical-severity flaws since the April launch. The new cohort spans power, water, healthcare, communications, and hardware sectors across 15-plus countries, and includes many vendors whose codebases are widely relied upon downstream.

HN Discussion: Skeptics argued the gradual rollout masks Anthropic’s inability to serve Mythos at scale rather than genuine security caution. Others countered that GPT-5.5-Cyber has matched or surpassed Mythos in cyber tasks, questioning whether the step change remains unique. A deeper concern was raised: even if code vulnerabilities get fixed, AI-powered social engineering could bypass technical defenses entirely.

The newest Instagram “exploit” is the goofiest I’ve seen

Summary: A security researcher documents a trivial Instagram account-takeover flow: an attacker uses a VPN near the victim’s city, tells Meta’s support AI the account was hacked, and asks it to send verification codes to an arbitrary email they control. No check verifies the email was ever associated with the account — the AI simply sends the code, enabling what amounts to a zero-auth password reset. High-profile accounts including the Obama White House Instagram were reportedly compromised this way.

HN Discussion: Commenters stressed that support channels have always been the weakest security link, and replacing human staff with LLMs merely automates the same vulnerability at scale. One user described an attacker setting a PGP key on a stolen Facebook account to lock out legitimate recovery, with Meta taking months to intervene. A security engineer framed the problem: evaluate agent security by examining the tools it can access, assuming attackers have full access to those tools.

On Reading SRAMs in IR Images, and Establishing Bounds on Trust

Summary: Bunnie Huang demonstrates that while infrared imaging cannot resolve individual bit cells at 22nm, it can constrain the total number of bits in an SRAM macro through thermal analysis. The technique is critical for hardware trust verification: a malicious designer could hide kilobytes of RAM inside a chip and gate it with a “secret-knock” register invisible to software inspection. Using the Baochip-1x as a case study, Huang argues that physical measurement provides an independent check against hidden memory that could host malicious code.

HN Discussion: A commenter raised the possibility of SRAM with extra bits claimed as ECC that are actually repurposed as hidden RAM, which would circumvent even physical area measurements. Discussion was limited but focused on hardware assurance implications.

AI & Tech Policy

Meta repeatedly snubs EU body over Facebook and Instagram user bans

Summary: Appeals Centre Europe reviewed 4,600 cases of Facebook, Instagram, and Threads users claiming wrongful bans. Meta provided evidence in fewer than 100 of those cases. The BBC reported hundreds of users worldwide who had accounts banned with no recourse or human review, while the EU’s independent dispute settlement bodies created under the Digital Services Act are being systematically ignored by the platform.

HN Discussion: A restaurant owner described losing 20-30% of new customer discovery after a wrongful ban. Commenters criticized the EU’s contradictory approach: outsourcing censorship to “trusted flaggers” that incentivize over-banning while creating appeals bodies that platforms ignore. Suggestions ranged from banning Zuckerberg’s yacht from EU ports to mandating human review for account actions.

AI Agent Guidelines for CS336 at Stanford

Summary: Stanford’s CS336 course now ships a CLAUDE.md file alongside assignments, providing guidelines for students who use AI coding agents. The file instructs agents to act as tutors — helping students learn rather than completing assignments directly. It represents an institutional acknowledgment that AI tooling is ubiquitous, and the practical question is how to channel it toward learning rather than cheating.

HN Discussion: Another instructor reported that a terse 30-line AGENTS.md outperformed verbose guidelines with examples, because longer prompts fall out of context windows in practice. Claude Code’s Learning mode was recommended as a built-in alternative that walks students through implementing solutions themselves. Commenters debated whether such guidelines meaningfully prevent cheating or simply formalize what students would do anyway.

Trump signs executive order granting oversight of AI models

Summary: President Trump signed an executive order establishing new government oversight authority over AI models. The full text is published on whitehouse.gov under “Promoting American AI.” The order follows a July 2025 EO that regulated the “ideology” of LLM outputs, which some legal analysts found more expansive in scope. The timing coincides with a wave of AI policy activity, including Anthropic’s Project Glasswing expansion and ongoing debate about open versus restricted model access.

HN Discussion: Commenters compared the new order to the earlier “stop woke AI” EO, debating which was more far-reaching in regulating model behavior. The timing was noted alongside Anthropic’s valuation reportedly crossing OpenAI’s ahead of a potential IPO.

Business & Industry

Summary: Adafruit received a legal demand letter from Fenwick & West, counsel for Flux.AI (Defy Gravity, Inc.), demanding that Adafruit refrain from publishing an article addressing Flux’s intellectual property, commercial traction, and user base. Flux.AI recently received funding from Bain Capital. Limor “ladyada” Fried publicly stated she had reached out to Flux founder Matthias Wagner to resolve the matter collaboratively.

HN Discussion: Electrical engineers in the thread described Flux.ai as a poor product that burns through AI tokens with little usable schematic output, contrasting it with KiCad-based workflows. Commenters linked Reddit complaints about Flux billing practices and questioned why a well-funded startup would send legal threats over a blog post. Speculation centered on whether Flux panicked when Adafruit asked for comment before publishing.

Apple rejected my dictation app for using the accessibility API

Summary: Developer Rene Zelaya built WhisperPad, a macOS menu-bar app that locally transcribes speech via Whisper and inserts text into the active field — nothing is sent to servers. Created after developing RSI from decades of keyboard use, the app was critical for continuing work and studies. Apple rejected the App Store version because it uses the accessibility API to insert text into other apps’ text fields, a permission with very broad system access.

HN Discussion: A fellow dictation app developer agreed Apple is not entirely wrong — the accessibility API grants access to everything on screen, including screenshots and keylogging. Others suggested distributing outside the App Store or using cross-licensing tricks where the App Store purchase unlocks a direct-download version. The company name “MITM LLC” drew amused and concerned reactions given the app handles all text input.

Amazon paid music subscription will soon include ads and lose downloads

Summary: Amazon notified paid Music Unlimited subscribers that their plan will soon include ads and lose offline download capability. The change was surfaced through a Reddit post showing the notification Amazon sent. Rather than creating a separate lower-cost ad-supported tier, Amazon is degrading the existing paid tier, stripping away two of its core features.

HN Discussion: Commenters called this classic enshittification: provide good value, lure users in, lock them in, then degrade the product to increase margins. Several recommended self-hosted alternatives like buying music on Bandcamp, ripping CDs to a NAS, and streaming via Jellyfin. Comparisons to premium TV channels following the same degradation pattern were common, with Spotify cited as still having a cleaner value proposition.

Launch HN: Expanse (YC P26) – Unlock Wasted GPU Capacity

Summary: Expanse reads source code, job scripts, and hardware specs to predict actual resource needs before jobs hit the scheduler. In one national-scale HPC cluster, they measured 59% wasted compute across 122,000 jobs in a single month — roughly $8.5 million at on-demand cloud rates. The root cause is asymmetric risk: over-requesting wastes money but under-requesting kills jobs mid-run, so users routinely request two to three times what they need.

HN Discussion: HPC users confirmed the over-provisioning problem is real and widespread. Questions focused on whether Expanse tracks resource consumption over a job’s full runtime, which would enable time-layered scheduling of complementary workloads. Enterprise users asked about capacity contracts — granularity, duration, and eviction policies for reclaimed resources.

Amazon joins Microsoft in sending message to employees

Summary: Amazon follows Microsoft in signaling tightened performance expectations to employees, as major tech companies reevaluate remote work policies and productivity metrics. The Yahoo Finance article covers the broader trend of management tightening across big tech, likely tied to Amazon’s ongoing RTO mandate and performance-based stack ranking initiatives.

HN Discussion: A commenter distilled the dynamic: a metric was introduced, it was maximized, it stopped being a useful proxy for anything, and now a new metric will be introduced and similarly gamed. A link to an earlier HN discussion provided more context on the underlying policy changes.

Tech Tools & Projects

Why Janet? (2023)

Summary: Ian Henry makes the case for Janet, a small Lisp dialect first released in 2019 that has become his go-to language for side projects. Janet’s core has only eight instructions — do, def, var, set, if, while, break, fn — with macros providing higher-level control flow. It can produce standalone binaries via JPM, runs as scripts, and is portable enough that someone ported it to the Playdate game console. Henry also wrote a free book about the language.

HN Discussion: Commenters praised the discussion as reminiscent of pre-AI internet language debates. Criticisms focused on Janet’s lack of package versioning, sparse library ecosystem, and missing features like advanced HTTP routing. Someone noted Fennel, an earlier language by the same developer, compiles to Lua and suits embedded scripting contexts.

Preparing for KDE Plasma’s Last X11-Supported Release

Summary: David Edmundson outlines KDE’s preparation for Plasma’s final release with X11 support, with Plasma 6.8 planned to be Wayland-only. KDE developers have actively driven Wayland protocol development to close feature gaps, and the post details the engineering and coordination work needed for a smooth transition. This marks a significant milestone in the long-running X11-to-Wayland migration across the Linux desktop ecosystem.

HN Discussion: Users reported persistent Wayland regressions: Chrome picture-in-picture windows not staying on top, broken accessibility tools like Talon voice input, and corner-case bugs. KDE developers received praise for actively pushing Wayland protocols forward. Accessibility advocates warned that the transition regresses assistive technology support, with protocol solutions potentially years away.

Why Custom Attributes in .NET Give Me Nightmares

Summary: Washi, a .NET reverse engineer and PE parsing library maintainer, details the painful design choices Microsoft made for custom attributes in the .NET binary format. The 21-minute read covers how attributes are encoded in metadata tables, the complexity of deserializing constructor arguments, and inconsistencies across attribute types. The problems surface when parsing assemblies by hand rather than using reflection.

HN Discussion: Developers agreed custom attributes are powerful but painful, with no affordance for lambdas, delegates, or method references that would enable interaction between attributed members. One commenter noted the complexity is only visible when parsing assemblies manually — reflection handles it transparently for most use cases. Comparisons to JavaScript’s lack of a similar annotation system were drawn as a reason some prefer simpler alternatives.

Webcam head tracking, webcam to control in‑game FOV

Summary: OpenFOV is an MIT-licensed Windows tool that uses a webcam to track head movement and dynamically adjust the in-game field of view in iRacing. It aims to deliver VR-like spatial awareness on a standard monitor without extra hardware. The current release is v0.2.1, available as a free download with source on GitHub, targeting sim racing where peripheral vision and head movement matter for cornering.

HN Discussion: Users of similar tools reported an initial disconnect where eyes move before the head, requiring an adjustment period. SmoothTrack was mentioned as an alternative that offloads compute to a phone and transmits over local network or USB. Commenters asked about differences from OpenTrack, the established head-tracking software, and linked browser-based parallax demos using the same concept.

PCMFlowG722 wideband (HD voice) codec for ESP32

Summary: This open-source G.722 wideband codec implementation is optimized for ESP32 microcontrollers, enabling HD voice quality on low-cost hardware. The codec payload is compact enough to fit in ESP-NOW packets, enabling direct device-to-device voice transmission without a WiFi access point. It targets embedded and IoT voice applications where standard narrowband codecs sound poor but full VoIP stacks are too heavy.

HN Discussion: A commenter noted the implementation is not limited to ESP32 and the payload size fits within ESP-NOW’s transmission limits. Discussion was minimal, suggesting niche interest from embedded-systems developers.

Web & Infrastructure

CSS-Native Parallax Effect

Summary: This post demonstrates a CSS-only parallax technique using Scroll-Driven Animation Timelines, replacing the traditional JavaScript scroll-event-listener approach. The technique runs off the main thread for better performance and collapses the implementation into a single utility class with declarative styles. It uses view-timeline-name, animation-timeline, and animation-range: cover with a CSS custom property to control parallax offset.

HN Discussion: Commenters compared it to the older CSS 3D transforms approach using perspective and translateZ, which is also GPU-accelerated and has broader browser support. Several noted the page itself lacked a live demo of the effect. Keith Clark’s pure-CSS parallax demos from years prior were referenced as prior art for the same goal.

The S in Interoperability

Summary: Frederik Braun, co-editor of the Subresource Integrity (SRI) W3C specification, reflects on a base64 encoding ambiguity that persisted for a decade after the spec’s 2015 publication. SRI lets sites include third-party JavaScript with a SHA2 digest so browsers reject tampered scripts, but the specification’s examples used the standard base64 alphabet while some implementations used the url-safe variant. The divergence was only discovered around 2025 during interoperability testing.

HN Discussion: The post had no comments at the time of collection, likely due to its niche subject matter or recency.

We benchmarked Google Cloud’s $512 VM – the speed wasn’t the interesting part

Summary: Webbynode benchmarked Google Cloud’s $512/month VM expecting dramatic speed gains over cheaper tiers, but the real finding was consistency. Three fresh deployments showed nearly identical performance curves — exactly what production workloads need at that price point. The article argues that predictability and low variance matter more than raw throughput for workloads where you are paying premium hourly rates.

HN Discussion: A commenter captured the takeaway: the story is about predictability, not speed, and boringly consistent results are exactly what you want from a $512/month VM.

System Administration

Love systemd timers

Summary: This blog post advocates systemd timers over cron, arguing that persistent timers fire after system downtime — unlike cron, which silently skips missed jobs. Systemd timers also provide better logging via journald and can be configured to handle ambiguous PATH settings. The post positions systemd timers as underappreciated relative to their reliability and integration benefits.

HN Discussion: One commenter pushed back on the PATH criticism, noting crontab allows explicit PATH settings and systemd has its own configuration complexity across multiple files. Several users shared practical uses: automated borg backups that tolerate downtime, and a creative weekly printer nozzle exercise triggered by timer. A minority still preferred cron’s simplicity and single-purpose design philosophy.

Strace-ui, Bonsai_term, and the TUI renaissance

Summary: Jane Street open-sources strace-ui, an interactive terminal UI that wraps strace output with short PID IDs, formatted structs, hexdump buffers, and interactive syscall filtering. The post also introduces Bonsai_term, a TUI framework built on their OCaml Bonsai reactive programming library. The argument is that a TUI renaissance is underway, driven partly by frustration with Electron GUI bloat and a desire for fast, keyboard-driven debugging tools.

HN Discussion: Commenters linked curated TUI lists like awesome-ratatui and terminaltrove.com as evidence of the broader trend, but predicted a swing back to GUIs once performant lightweight tooling matures. A Bonsai_term developer offered to answer questions. Wishes were expressed for broader terminal support of Tektronix and ReGIS graphics for richer TUI visuals.

History & Science

Fidonet: Technology, Use, Tools, and History (1993)

Summary: Randy Bush’s 1993 paper documents FidoNet, a store-and-forward email WAN using modems on the dial-up telephone network, created in 1984. At its peak, over 20,000 public nodes worldwide moved email and news over POTS, with gateways to the Internet via UUCP. Design prioritized minimizing modem and telephone time because the network was funded almost entirely by private individuals. Originally MS-DOS based, FidoNet was later ported to UNIX, Apple II, Macintosh, CP/M, and many other platforms.

HN Discussion: Former FidoNet operators shared their node numbers and nostalgia for the community and local meetups the network enabled. A Turkish developer described HitNet, a FidoNet clone that functioned as an early social network for discovering local contacts. Several commenters noted that FidoNet and alternative nets like fsxNet are still active today.

Reviving Teletext for Ham Radio

Summary: IEEE Spectrum covers efforts to bring Teletext — the 1970s broadcast data service — back to life over ham radio frequencies. The project repurposes the Teletext protocol’s compact data format for modern amateur radio data transmission. Teletext’s severe bandwidth constraints force extreme conciseness, offering a stark contrast with modern long-form content. The effort combines retro computing aesthetics with practical low-bandwidth communication over radio links.

HN Discussion: A former broadcast engineer recalled renting single VBI scan lines in the 1990s for nationwide data transmission at roughly 18 kbit/s. Commenters imagined combining Teletext with Meshtastic mesh networks for uncensorable city-wide data broadcasting. Links to existing Teletext emulators were shared, with several people planning their own Teletext services as part of analog TV revival projects.

What appear to be biochemical processes may be a natural feature of geology

Summary: Quanta Magazine reports on biochemist Sébastien Fontaine’s 15-year effort to sterilize soil, only to find lifelike biochemistry continuing for six years afterward. Published in Science Advances, the study challenges the view that organic carbon respiration to CO2 is exclusively an intracellular biological process — it can occur spontaneously in extracellular soil contexts. The finding suggests the chemistry of life may be a natural feature of geology, with implications for how we think about the origins of life.

HN Discussion: Commenters connected the finding to longstanding speculation that geothermal processes at alkaline vents manufactured organic compounds that assembled into proto-life. The Brookhaven Gamma Forest was cited as a parallel: soil sterilized by radiation in the 1960s still has not fully recovered nearly 50 years later. Excitement was expressed for Europa and Enceladus missions, where tidal energy flexing ocean floors could produce similar chemistry.

Academic & Research

CQL: Categorical Databases

Summary: CQL is an open-source query language and IDE that applies category theory to database operations — querying, combining, migrating, and evolving schemas. It includes an embedded automated theorem prover that catches constraint violations at compile time rather than runtime. Every output row carries full provenance lineage, and schema migrations preserve data integrity by mathematical construction. The open-source version targets single-node in-memory data processing; Conexus AI is commercializing it for production use cases.

HN Discussion: Commenters debated how CQL differs from SQL, noting the relational model already draws on category-theoretic concepts, making the distinction subtle. A category theory practitioner explained the key advantage: schema mappings are functors, so combining them preserves constraints by construction without manual ETL verification. The marketing claim of “artificial intelligence” for what is essentially an automated theorem prover drew criticism as misleading in the current hype environment.

Other

Stop Ruining It

Summary: Seth Godin channels stereo designer Paul McGowan’s philosophy: musicality isn’t a feature you add to an amplifier — it’s what remains when you stop degrading the signal. Godin applies this frame broadly: customer delight, curiosity, work satisfaction, and trust are not things you build but things that survive if you avoid ruining them. The short post struck a chord with HN readers frustrated by product and organizational decay through accumulated compromises.

HN Discussion: Windows 11 File Explorer was cited as a concrete example: tabs removed the title bar, folder names got truncated, making the tool worse for single-window users. A manager argued the corporate concept of “empowerment” is backwards — people start empowered, and the real problem is preventing disempowerment by organizational processes. Several noted that recovering trust after ruining it costs far more than preserving it.

Show HN: Eyeball

Summary: Eyeball is a browser-based precision-clicking game where players must click exactly on a target line or point, testing spatial estimation skills. Built by Rory Flint, it tracks best score, average, and streak, with a share feature that generates a link containing your score. Designed for mouse or trackpad use — the creator notes that touch screens lack the accuracy for competitive play.

HN Discussion: Commenters compared it to Matthias Wandel’s classic eyeball game at woodgears.ca, which tests angle bisection, centroid locating, and shape estimation beyond simple line partitioning. The share-score mechanic drove a noticeable wave of new HN account creation. Feature requests included a training mode that repeats missed challenges to build estimation accuracy.

Ask HN: Who is hiring? (June 2026)

Summary: The monthly HN hiring thread for June 2026, where companies post open positions with location, remote/onsite details, and compensation ranges. Notable postings include Uber hiring in Amsterdam for a data labeling platform for AV and robotics, Kong seeking a senior engineer in Toronto for its identity platform, and Enveritas offering remote roles for a sustainability nonprofit. Third-party search tools like nthesis.ai and hnjobs.emilburzo.com are linked for filtering.

HN Discussion: The thread follows the standard monthly format with a mix of startup and established company positions spanning backend, ML, product, and infrastructure roles. Remote and hybrid positions dominate. Salary transparency varies widely, with some companies posting exact ranges and others omitting compensation entirely.

I made my phone slow on purpose

Summary: Guilherme Campos deliberately slowed down his new iPhone 17 to combat doomscrolling, using accessibility settings to reduce animation speed and add friction to every interaction. The cookie analogy frames it: if a fresh cookie were always in your pocket, you would eat too many; make it stale or four hours away and consumption drops. Previous attempts with app blockers and cold turkey failed because they did not address the craving and were easy to bypass.

HN Discussion: The “One Sec” app was recommended as a structured alternative: it uses iOS Shortcuts to force a delay and confirmation before opening addicting apps. Several commenters shared their own strategies: keeping addictive apps on a separate old phone, logging out of every session, and using Apple Configurator for granular MDM-style restrictions. The broader theme resonated as part of a return to intentional slowness in digital habits.