Hello. I&#x27;m an Information Technology university student from Greece. I&#x27;m older than most of my peers and i feel anxious about my professional future with all the advancements of AI. What advice do you have for someone who just starting out?

Ask HN: What are your advice for a CS/IT student for the future?

I love open-source software and open protocols, but my family and friends primarily communicate through SMS for exactly the reasons in https:&#x2F;&#x2F;xkcd.com&#x2F;2365&#x2F;Whenever XMPP or Matrix threads pop up on HN, several commenters casually mention their &quot;friends and family XMPP (or Matrix) server.&quot;How did you convince friends and family to move away from SMS&#x2F;WhatsApp and replace it with a niche messaging app?My family and friends aren&#x27;t hardcore nerdy, but they&#x27;re more tech-savvy than average. Their needs in messaging are mainly pragmatic: they want ease of use, reliability, and fun features. They don&#x27;t care that much about privacy, decentralization, or extensibility (though I care about those things a lot).I&#x27;ve been experimenting with self-hosting XMPP and Matrix servers and clients in the past week, and the UX is even worse than I expected. It seems like all the clients either imitate Slack, imitate Discord, or imitate hot garbage. I haven&#x27;t seen any that try to be a simple, friendly replacement for SMS. I&#x27;m a software developer who uses computers all day, and I find the UX for most of the clients incredibly hard to use.The only angle I could see to pitch XMPP&#x2F;Matrix to people for non-philosophical reasons are that there&#x27;s a more consistent experience across iOS&#x2F;Android. The biggest shortcoming I think is visible to regular users is that there&#x27;s feature degradation and missing information when iOS users have SMS conversations with Android users, especially in group chats.For people who have successfully won family and friends to XMPP or Matrix, what was your pitch? What do you recommend others do to make XMPP or Matrix an attractive experience for a regular person?

Ask HN: How did you convince family and friends to join your XMPP/Matrix server?

Ubuntu has CVE-2026-98432 marked as a 9.8, but yet it&#x27;s coming up on a week with no update to fix it. It&#x27;s still marked as &quot;work in progress&quot; (though at least now they&#x27;ve listed a mitigation):https:&#x2F;&#x2F;ubuntu.com&#x2F;security&#x2F;CVE-2026-98432I&#x27;ve had mitigations in place for a week, but this response is really shaking my confidence in Ubuntu. I&#x27;m just trying to understand what is going on with Ubuntu. Do they have too many kernels (that page is loooong), do they not have enough automation in the build&#x2F;test pipeline, are their engineers overwhelmed?We are moving into a world where there are going to be vastly more security issues; if you can&#x27;t keep up now, where are you going to be in the next 6 months?For a long time keeping on top of OS updates has been a huge part of keeping the attackers at bay. However, the world is changing.

Ask HN: What in the world is taking Ubuntu so long?

If you have a personal Google AI subscription, all your saved chat history in Gemini can be used for training and there is no way to opt out unless you turn off chat history or use temporary chat sessions. These chat transcripts may even be read by human reviewers. Although Google claims to disconnect them from your account when human-reviewed, they explicitly warn not to enter confidential information.https:&#x2F;&#x2F;support.google.com&#x2F;gemini&#x2F;answer&#x2F;16836988“[Gemini app activity] is used to improve Google services for everyone, including by training generative AI models, if your Keep Activity setting is on.“https:&#x2F;&#x2F;support.google.com&#x2F;gemini&#x2F;answer&#x2F;13594961?hl=en#human_review“A subset of chats are reviewed by human reviewers”https:&#x2F;&#x2F;support.google.com&#x2F;gemini&#x2F;answer&#x2F;13594961?hl=en#pn_retain_data“Chats reviewed by human reviewers [...] are not deleted when you delete your activity. Instead, they are retained for up to three years.”https:&#x2F;&#x2F;support.google.com&#x2F;gemini&#x2F;answer&#x2F;13594961?hl=en#pn_data_usage“Please don’t enter confidential information that you wouldn’t want a reviewer to see or Google to use to improve our services, including machine-learning technologies.”To disable their training on your chat sessions, you need to turn off “Keep Activity” in Gemini’s settings. Turning that off means you’ll lose any chat sessions after 72 hours.I learned this too late, thinking that having a paid subscription = not being turned into the product. Apparently paying is not enough.Thank you to this user on HN for mentioning in another thread: https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=50355424

Tell HN: Gemini trains on chat history, even for subscribers (personal accounts)

I&#x27;m curious how people on HN are using AI day to day, and came up with a list of questions I thought could be interesting to know. No need to answer every question of course, just wanted to get a gut feel how people are using AI.1) What AI subscriptions are you personally paying for? (Claude, ChatGPT&#x2F;Codex, Cursor, etc)- Which tiers?- Have you purchased multiple subscriptions from the same provider (eg two Claude accounts)?2) Are you using models outside (or instead) of those subscriptions? For example, pay-as-you-go APIs, OpenRouter, or locally hosted models.- Which models and providers?3) What coding harnesses and interfaces are you using? Are you sticking with the default CLIs or IDE integrations, or using alternatives like OpenCode, Pi, Aider, Muse Code, or custom-built harnesses?- What made you switch harnesses (if you switched)?4) Are you using any agent orchestration or swarm tools?- For example, Munder Difflin, Gas Town, Ruflo, or something custom.5) Are you using broader agent platforms like OpenClaw &#x2F; Hermes Agent &#x2F; Grok bot &#x2F; Dots &#x2F; Muse?- If you are using them, what are your main use cases?-----I know my workflow has differed significantly from a year ago, and so it would be interesting to capture a snapshot today of what people are using and why.

Ask HN: What's your current AI agentic setup?

With the efforts to clamp down on LLM-assisted reverse engineering - I am wondering;If LLM assisted reverse engineering is deemed illegal by the courts, is that precedent for a class action that asserts OSS licenses are violated by labs that trained LLMs on that code?There are two modalities for this;1) LLM being post-trained against a decompiled binary - then used to output working source code.2) LLM being used to analyze decompiled binary and used to output working source code.How can it be &quot;clean room&quot; when an LLM is trained on or reads OSS but not clean room when the same is done for decompiled software?

Ask HN: If LLM reverse engineering is deemed illegal, is that precedent for OSS?

There have been previous outages that last 1-2 days, but I haven&#x27;t been able to get RSS feeds for the last 4 days now.This goes for new channels and previous channels in a feed reader; Google displays a 404 page no matter what.

Is YouTube starting to protect channel RSS feeds?

Hi, I’ve been working on ESP32 Tailnet Gateway, an open-source firmware that turns an ESP32-S3 into a small Tailscale&#x2F;Headscale gateway
The main use case is connecting IoT devices that can’t run a VPN client to services on another network with a low cost device.
The idea is to have a small, independently powered device that can provide connectivity and help recover a NAS or PC when the main server is offline.

I turned an ESP32-S3 into a Tailscale gateway with recovery functions

My company is pretty paranoid about leaking IP to the frontier labs through prompts, so we&#x27;ve all been diligent about disabling data sharing in Codex&#x2F;Claude Code&#x2F;etc. But yesterday my coworkers and I noticed that the setting had been silently reenabled in Codex. None of us knowingly opted back in.You can check your settings here: https:&#x2F;&#x2F;chatgpt.com&#x2F;settings&#x2F;data-controls. Look for &quot;Improve the model for everyone&quot;.Curious if this is an isolated issue or something more widespread.EDIT: looks like this has been noted before https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49643556EDIT: apparently you can also turn off data sharing here: https:&#x2F;&#x2F;privacy.openai.com&#x2F;policies?modal=take-control

OpenAI seems to be silently re-enabling model training on Codex chats

Just received this via email:&gt; Usage credits purchased on or after December 7 will expire 12 months after the purchase date. Any unused amount after 12 months will be removed from your balance.

Claude usage credits purchased after Dec 7 will expire 12 months after purchase

We had a HN meetup in Mexico City years ago. Let&#x27;s bring it back. If you&#x27;re in town next Friday, shoot me an email with your phone number and I&#x27;ll add you to the WhatsApp group. Or if you don&#x27;t want to share your phone, we&#x27;ll figure it out too.

We're bringing back the HN meeting in Mexico City

We opened a ticket with support about Gitbook availability issues and got this in reply. We have yet to see any official customer communication or breach notification. Apologies for the formatting, did the best I could as it&#x27;s a mobile paste.Update:GitBook security incident update
 Hey &lt;$name&gt;,
 The GitBook app, the GitBook API, and published docs are available again. A few services may still be degraded as we finish restoring everything to full performance.*What happened*
 GitBook has been the target of a sophisticated, highly targeted attack using AI agents. 
 At 19:00 CET, November 2, the attacker gained unauthorized access to some of our infrastructure credentials. We detected the attack immediately and acted swiftly to block further impact. 
 To make sure our infrastructure was fully secure, we then took the GitBook app and authenticated docs sites offline. We kept publicly published content live for as long as possible, using cached data.*What we did immediately*
* Blocked the attacker and closed the vulnerabilities involved
* Replaced every credential and secret across our infrastructure
* Brought services back only once we were confident they were secure
* Invalidated every customer’s API tokens on our platform*Your data*
 Our investigation shows that the attacker may have accessed the following:
* Git Sync secrets.
* GitBook API tokens.
* Third-party API tokens used to connect external tools to GitBook.
* Questions asked to GitBook Assistant by your site visitors.At this stage, we have found no evidence that any of your content in GitBook was modified.*What you need to do now*
* Rotate any existing GitBook API tokens. We revoked all personal API tokens during the incident.
* Rotate any third-party API tokens or secrets you use to connect other tools to GitBook.
* If you have published integrations that use secrets, rotate those secrets.
* If you use the GitBook MCP server, re-authenticate it.
 Please contact your GitBook organization’s admin to assist with this process.*What we are doing next*
* Monitoring the situation in case of further attacks.
* Introducing further security measures to our platform.
* Writing a full post mortem that will be published soon with more detailed information about the incident.
* If you have any further questions, please reach out to your account manager or our support team. You can also check status.gitbook.com for updatesThank you for your patience, and we apologize again for the disruption
 The GitBook team

Gitbook Breached

When you send a POST request to your server, you think you&#x27;re sending the information to YOUR server, right? That was the default behaviour - as it should be. After updating the Postman client, I noticed Postman also sends the request to their internal servers, which then sends your server the actual request (proxying). I thought I was paranoid until another commenter confirmed the same (https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=50358055). It&#x27;s fucking annoying that something called POSTman does anything but that. Please don&#x27;t use Postman for anything sensitive. It&#x27;s borderline spyware, especially when you didn&#x27;t consent to this behavior.

Tell HN: Don't use Postman, they proxy your info without your permission

Interested to hear which companies come to mind for you.

Ask HN: What tech companies do you think have a good moral compass?

I transferred .com domain to wix from another domain registrar, paid for transfer and additional year of domain from my bank card, they blocked account, requested passport and bank card photo via email, and after I provided them document (same legal name of admin of domain) and bank card photo they rejected to reactivate account, so I don&#x27;t have access to my domain anymore and can&#x27;t withdraw it to another registrar.Their final reply:&quot;Hi there,
Thank you for reaching back out._As mentioned by my colleague, regrettably we are unable to restore the account or provide access to the domain in this case._At this time, we would advise reaching out to ICANN directly or continuing communication with ICANN in order to retrieve the domain. With this being said, I would recommend gathering your proof of ownership for the domain. This would include your registration&#x2F;transfer records and any related correspondence.I understand this is not the outcome you expected and I apologize on behalf of any frustrations or inconveniences this may cause.Thank you for your patience during this process. If you happen to have any additional questions or concerns please don&#x27;t hesitate to reach back out.Best Regards,Olivia | Wix Customer Care&quot;

Seeking advice: Wix stolen my .com domain

I have an old iPhone 11 Pro laying around that is no longer used for anything.What fun things could be done with it to give it a second life ?

Ask HN: What fun things to do with an iPhone 11?

TLDR - stripe made it easy for fraudsters to syphon $4,500 through our stripe account and withdraw all of it - and they expect us to cover everything and have offered absolutely zero help.I’ve been building on top of stripe for 15 years and have made about 70 products for clients using stripe.I just had an incident with a project where fraudsters were able to route $4.5k worth of charges through our stripe account and withdrew all of the funds. I structured an overall secure system - there was very little negligence on our side - and it all happened so fast.Stripe support has been very surprising - you only get to speak to folks in the Philippines and they are of absolutely zero help. They told us we are fully responsible even though they gave us no alerts or warnings the issue was happening. They expect us to cover the full 4.5k, they will not help us with the stripe fees or chargeback fees.It’s almost like they incentivize the fraud. It’s so disappointing. Stripe used to be such a decent company - it’s like they lost their soul…Lesson - there’s not much of an alternative to stripe - but if you ever use stripe connect just know they will absolutely sell you out…

Tell HN: Be Careful with Stripe Connect

Loading any page and waiting for a few seconds will redirect to a malicious site.

Slickdeals.net Is Compromised

Ask HN: What are you building – I'd try it, pay for it, or even star your repo

I was tired of copy&#x2F;pasting back and forth from ChatGPT to my terminal, so I created Pigeon-Home.aiHoming Pigeon is both a protocol and a software (daemon) which gives major cloud AI vendors a signed and secure channel to your CPU&#x2F;memory.Project: https:&#x2F;&#x2F;github.com&#x2F;Pigeon-Home&#x2F;homing-pigeonIETF Draft https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;draft-slutsky-homing-pigeon&#x2F;Feedback welcome and do not worry novice users, it&#x27;s HIGHLY secure.Here is my CV: https:&#x2F;&#x2F;github.com&#x2F;Pigeon-Home&#x2F;homing-pigeon&#x2F;blob&#x2F;main&#x2F;docs&#x2F;archive&#x2F;resume.txtThis protocol and software are &#x27;basically&#x27; unhackable!Try this prompt in your cloud SI, it should return in less than 30 seconds...Use the Homing Pigeon protocol (pigeon-home.ai)Send an email to YOUR@RUNNER.EMAIL (reply_to self)Shared Secret: &quot;YOUR_SECRET_STRING&quot;Run a job that retrieves the system clock and then display it here.

A new protocol and software suite for AIs

I quit my Head of Quant Research job last friday to go full-time on a startup. I built complex stuff before. I am good with sales and networking. I want to offload the CTO part to someone else while I can raise and sell and work on GTM.I am mainly working on agentic software for business (grokbot) and fin-agents (rolo)

Looking for a CTO

Nowadays, unless you’re training a frontier model from scratch, finding spare GPU capacity for training and post-training on some cloud is manageable.But a lot of the time, I’m just too lazy to move my work or even go through the signup processes and deal with their limits and regions and shit. So I wasted a lot of money keeping GPUs idle or gambling on a paused instance, crossing my fingers that the node would still be available when I wanted it again (usually didn’t work).So here’s my journey trying to automate this process, and it was a lot harder than you might think.1. Shared File System“Just mount a network filesystem… duhh.” Well, not so fast. Many providers have random restrictions and sandboxed compute; the RunPod containers I tested, for example, didn’t expose FUSE. To build a universal solution, I needed another way.I built a custom LISAFS adapter and, over months of refinement, got it to the point where it outperforms even network filesystems through clever syncing: packing small files into fewer transfers, fetching file ranges on demand, and using a Rust-based storage engine to reuse cached content-addressed blocks instead of copying whole files. The system works so efficently, you can transfer an uncompressed 3GB 50k file build folder on your laptop to the cloud file system faster than transfering the same folder through a wired connection to a Samsung T5 SSD (crazy right?!)Once machines can efficently share a filesystem, they can also cooperate. Imagine a TPU running a JAX teacher model, publishing training targets that GPUs on a different provider use to train a PyTorch student. It works like magic.2. Virtual ClustersBooting up separate GPUs&#x2F;TPUs into the same workspace comes in clutch in a bunch of situations I hadn’t even realized were possible until it became easy to do.Pushing the abstraction further, I (with the help of ~$50k in research agents) created a new library to optimize many core training functions across compute from different providers. It no longer mattered where my compute came from; it could run distributed workloads automatically under the hood while operating like a single machine.Some notes here: planning which regions to place the machines in, even across different providers, was extremely important. Distributed training still never matched the validation loss of single-cluster training, but it came damn close—within ~0.2%, while being 2.3x cheaper, on a post training experiment with a 27B param LLM.btw this is what I’m building at meshia.io -- check it out :) I’m a one-man team and love feedback, so please lmk your thoughts or if you have any questions about this!

I tried to connect every GPU on the planet together (kinda)

Hi, using a throwaway for obvious reasons. I&#x27;m currently in a situation where I&#x27;ll have to both create a hiring process to hire a couple of programmers at a startup where I&#x27;m working at, but at the same time I&#x27;m also starting to think about looking around and start sending out job applications.Since it&#x27;s been a while from my last job interview I&#x27;m wondering how companies are hiring programmers nowadays. Do they still require leetcode exercises? What about take-home exercises? Or is it all done in real time during a call?My last interviews all had a take-home project that I had to do (some paid and some not), is that still the case? I&#x27;d guess that with agents that changed a lot since someone could just have Claude doing all the work and submit it back.I want to both create a process that is fair and worth the time on both the parts, but also want to know what other companies are doing in order to start preparing if I&#x27;ll get lucky and move to the next interviewing steps.How is it at your company or in your [recent] experience?

Ask HN: How are companies hiring developers nowadays?

Does anyone know of an OpenClaw like SaaS or Agent saas that is a turnkey solution? Preferably not one that I have to buy a new computer or find a spare one? Something that just works as software with its own email, calendaring, etc...? I am thinking of using Muse but the idea of giving it access to all my emails is a bit daunting. And then working on a phone is not ideal for me as I find doing business on a phone very difficult. Ideally, something completely siloed with its own email, calendar, notes, and things but with an AI agent built in. 
Thanks!
Alex

OpenClaw SaaS?

So everyone is building something these days, right, probably you know what I mean.Every time I publish some new tool &#x2F; product and then list it on websites like Product Hunt &#x2F; BetaList to get some first traffic, I get dozens of emails from noname bestappsever.whatever AI-slop saying that they&#x27;ve listed my product and &quot;I&#x27;m only 1 click away from publishing it&quot; (or sometimes they just do it without asking). Then I also receive another dozen of outreach emails offering their &quot;services&quot;, but that&#x27;s another story.As a result I get a lot of spam and bad backlinks which affects the overall domain trust. And they don&#x27;t stop and create more and more PH-like &quot;app directories&quot; with voting as if the only idea their AI gives is &quot;build another product hunt, but better&quot;.Is there any way to resist it? I can use Google disavow tool to fight the backlinks problem but it doesn&#x27;t help with annoying spam.