Daily reading — 2026-10-31

31 October 2026 · 04:39:18 UTC

Compromised Claude Code extensions: Cursor identifies malicious marketplace packages 2.1.312 and 2.1.313 for macOS and Windows, removes them and warns that uninstalling alone may leave persistence behind.
Opposing an AI bailout: Greg Casar and Maxine Waters introduce a resolution opposing corporate rescues after a possible AI bubble collapse while supporting help for workers and retirees.
elect.horse: A district-drawing puzzle demonstrates how packing and splitting rival voters can turn a losing vote share into a winning seat count.
Automation and SRE skills: Elizabeth at SigNoz argues that automating routine incidents can erode the practice needed for unfamiliar failures, recommending deliberate hands-on work and active human involvement.
Northflank’s security incident: Northflank tells customers to assume environment variables were exposed, reports unauthorized use of customer AI keys and enables audit logs for all accounts.
Binance’s rapid theft: Matt Burgess reports that most of the $6.3 billion theft occurred within twenty minutes; tracing firms suspect North Korean involvement, while Binance has not named an attacker.
Azure’s cross-tenant connection flaws: Haakon Wik Gulbrandsrud describes five fixed vulnerabilities where shared connector authority and inconsistent input validation enabled access across tenant boundaries.
Proton cancels AI re-interviews: Joseph Cox reports that Andy Yen cancelled the interviews and acknowledged communication failures; employees differ over whether the continuing AI push addresses their concerns.
Classic Mac OS on a Wii: Rairii describes the firmware patches and drivers that brought Mac OS 7.6 and 9.2.2 to a Wii desktop, with substantial work still needed before release.
Tech shares and AI spending: Rachel Clun reports sharp losses as earnings and spending plans increase investor scrutiny of the returns from AI infrastructure.
Tangled’s federated forge: Tangled moves issues and pull requests alongside code as Git objects, using AT Protocol attestations to support portable repositories and independently hosted services.
Patrick Stewart’s Picard: Jason Laughlin and John Hilliard remember a portrayal of leadership that combined moral conviction, patience and vulnerability.
Florilegium: Kevin Raymond generates floral LaTeX margins from parametric curves, growing ornaments into free page space while fixed seeds keep the result reproducible.
Bunny’s certificate precaution: Bunny removes a node after a provider incident and reissues TLS certificates with new keys, while reporting no evidence that its server was accessed.
Nesformer: Drew Breunig compiles an NES CPU into Qwen-shaped weights using Qwenputer’s compiler; graphics and input remain in a host program, and execution is far slower than a console.
Linode’s security advisory: Akamai is deploying mitigations for CVE-2026-98432 and advises workload OS updates, while reporting no evidence of exploitation on its compute platform.
GitHub service recovery: GitHub resolves delays affecting Actions, Pages and Webhooks, with a detailed root-cause analysis still to come.
AI work and mental overload: An Ask HN author describes fatigue from parallel tasks, generated text, guardrails and frequent decisions despite increased output.
Cisco’s refactoring experiment: Orianna Rosa Royle reports Jeetu Patel’s backing for a small AI-assisted team, with a goal of refactoring most legacy code over two years rather than a completed result.
BeOS in Infinite Mac: Mihai Parparita brings BeOS versions to the browser and explains how a second operating system exposed emulator assumptions that Mac OS had never challenged.
France’s proposed data-volume tax: Guillaume Henri reports an Assembly amendment charging content providers €0.055 per gigabyte, with revenue caps; it still faces further legislative stages.
Polymarket’s vendor compromise: Rob Wile reports a brief halt on the international platform after a third-party incident, with reimbursement promised to affected traders.
Archaeology emerging from old ice: Ida Irene Bergstrøm reports increasingly ancient hunting artefacts emerging in Norway as melting ice exposes objects preserved for thousands of years.
Nicolas Seriot shows how curl configuration slicing and nested includes could simulate a two-counter machine in versions 8.12–8.16; version 8.17’s include-depth cap breaks the construction. Essay
Vikram Singh reports OpenAI’s statement that it made over 200 law-enforcement referrals in Q3, while noting the absence of country-level figures or independent verification. Report
BBC reporters Kali Hays and Mitchell Labiak report Alphabet’s roughly $500 billion market-value decline after disappointing advertising results, as Google says AI Mode is cannibalizing traditional search ads. Report
Sofia Ojeda profiles Houston’s Blue Willow Bookshop at 30, where author visits, book clubs and more than 350 annual events help sustain a neighborhood gathering place. Profile
The Nothing Obsidian plugin satirizes workflow tinkering with zero commands, settings or dependencies—and no functionality. Repository
Mercury combines logic programming with static types, modes and determinism checks; its I/O examples thread an explicit world state through pure code.
Nick Romeo’s report on job guarantees examines public employment proposals and small pilots as responses to unemployment, including advocates’ arguments about benefits beyond income.
Claude Code and game recreations: Chasm reports a new server-supplied instruction permitting original games while prohibiting recreations of specific existing games, including renamed copies.

Conversations on X

Talia Ringer welcomes the prospect that a mathematically polynomial but impractical algorithm could force a clearer account of what computational ease means.
David Cramer imagines Sentry storing far less customer data and asks how to charge for the computation that still makes the service useful.
Jaana Dogan says Go, TypeScript, Rust and a little Bash may cover her programming needs for the rest of her life.