At the meeting, they asked me to clone their product's (public?!) repo and open it in Cursor or VSCode. I was immediately suspicious and refused. They disconnected and vanished from LinkedIn.

I took a look over the repo (without touching, of course) and spotted the exploit - VSCode will happily auto-run tasks listed in `tasks.json`. In this case, a task ran that harvested credentials from `process.env`, sent them to a remote server and then executed further code that the server sent back.

"Don't touch strange repos" isn't exactly revolutionary advice, but this isn't an exploit that I see talked about often - scammers are actively using it. It doesn't help that some recruiters are actually asking candidates to clone repos as part of their hiring process; if you're doing that, it's time to stop!

Comments URL: https://news.ycombinator.com/item?id=49931454

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=49931346

Points: 1

# Comments: 0

OVH's own post: an Advance-1 Gen 2024 renews at $114.99 instead of $89.99 (+28%). RAM options on new orders are up 68% to 652%, the Game range up to 87%. The stated reason is DDR5 costing six times what it did a year ago.

Hetzner did the same in February and June, both threads had 500+ points here.

I run a small PHP hosting company, so I am biased. But I wonder: Who here still runs OVH or Hetzner dedicated boxes?

Sources:

https://blog.ovhcloud.com/en/posts/dedicated-servers-pricing-update-h2-2026/

https://itdaily.com/news/cloud/ovhcloud-price-increase-ram/

https://www.reddit.com/r/webhosting/comments/1wvfu5i

https://news.ycombinator.com/item?id=47120145

https://news.ycombinator.com/item?id=48540844

Comments URL: https://news.ycombinator.com/item?id=49931175

Points: 1

# Comments: 1

Wedding, Birthday, Party ya kisi bhi event ke liye Shamiyana, Tent, Chairs, Tables, Bartan aur Decoration items ek hi jagah book karein.

Features: • Easy Online Booking • Shamiyana & Tent • Chairs, Tables & Sofa • Bartan & Catering Items • Birthday & Party Setup • Direct WhatsApp Support • Quick Call Support • Clear Booking Receipt

Price: ₹2000 (was ₹2478 — 19% OFF) Get it here: https://wbthemes.com/product/tent-shamiyana-booking-php-script-complete-bartan-event-booking-system/ Live Demo: https://tent.dktheme.com All products: https://wbthemes.com/shop/

#PHPScript #WebDevelopment #Startup #WBThemes

Comments URL: https://news.ycombinator.com/item?id=49930929

Points: 2

# Comments: 0

I built PetnTrip because every time I booked a hotel with a dog or cat, I'd end up with multiple tabs open — one to check if "pet friendly" actually meant anything specific (fees, weight limits), one for reviews to see if it was enforced in practice.

It pulls pet policy details, Agoda ratings, and guest review highlights into one page per hotel, organized by city. Currently covers South Korea in depth, with a handful of US cities (LA, NYC, SF) so far.

Tech stack: Next.js (App Router/RSC), Supabase/Postgres, deployed on Vercel. Bookings route through Agoda, so I get a small affiliate commission there.

https://petntrip.aeihi.com/en

Would love feedback, especially on what's missing for US coverage.

Comments URL: https://news.ycombinator.com/item?id=49929833

Points: 1

# Comments: 0

Those were his words.

I was on the official Discord, among thousands of players wanting to create servers and mods. Everyone wanted to move fast.

I saw an opportunity. A huge wave I could surf.

So I decompiled the server JAR and started creating comprehensive modding documentation.

Three sleepless nights. Two more days. Twenty coffees. My reverse-engineering skills, boosted by AI, working overtime.

Finally, it was ready. I published it on GitHub and shared it with the community. Developers thanked me. Two people joined the project.

Then I woke up on Sunday morning.

Account suspended.

Both collaborators? Suspended too.

GitHub said my account had been suspended for violating the rules. No specific rule. No explanation.

I’m an introspective person. I can connect the dots. All three collaborators suspended after working on the same documentation project—we know what triggered this.

What GitHub has never explained is WHY that work warranted suspending our entire accounts.

The game’s owner explicitly said we could decompile unobfuscated code. If GitHub had a concern about permission, why not contact the studio? Why were other documentation efforts still available while ours resulted in three account suspensions?

The repository was hosted under a separate organization. Our personal accounts were attached to it. But if one organization or repository was the problem, why block three entire accounts, including unrelated projects?

We also wondered whether a competitor had reported us. That remains speculation. I don’t know whether the suspensions were automated. But when nobody explains the decision, you’re left guessing.

And before anyone tells me to contact support: I HAVE.

I followed GitHub’s official appeal process. I sent appeals and emails. I even emailed the game’s official studio asking for help.

Neither side answered.

From January through September, I waited. It’s October now. Still no account. Still no way to retrieve all my repositories.

Since that day, I host a fucking Gitea instance on a private VPS. I no longer trust cloud platforms with so many customers that your life, your life’s work, and your history stop mattering—unless you’re Elon Musk.

I have local clones of some repositories. Not all of them.

But the loss goes beyond source code.

My GitHub account was a witness to years of my life as a developer. Projects, commits, dates, experiments. Thousands of hours of work, long before ChatGPT and the current wave of vibe coding.

Today, people can look at what you build and casually dismiss it with “AI did that.”

My history was right there. Years of commits showing that I was already building things before any of this existed. That history could speak for itself.

Now I’m supposed to start over, looking like just another account created during the AI boom?

“Create a new account” doesn’t restore a professional history.

And the worst part is the data retention. As far as I can tell, my account still exists. The work is still there. I just can’t access it or extract it.

It feels like they’re holding a part of my life hostage.

We’re encouraged to publish, push our work to the cloud, and trust it to survive a dead computer. Then the platform suspends your account, locks you out of unrelated work, and leaves you waiting for nine months after you follow its own appeal process.

How is this acceptable?

If there was a problem with the documentation, identify it. Explain the rule. Answer the appeal.

But what possible justification is there for keeping years of unrelated repositories inaccessible?

I’ve already spent nine months trying the official channels.

I want my work back.

P.S. I’m not giving my name. If they care about their customers, they’ll find me. Or not…

Comments URL: https://news.ycombinator.com/item?id=49929822

Points: 6

# Comments: 2

If anyone has recommendations for models that are not fine tuned to stop continuous coding, that would be much appreciated.

Comments URL: https://news.ycombinator.com/item?id=49928960

Points: 1

# Comments: 2

https://github.com/tiliondev/fortress

launch vid:

i am arham, cto of tilion (ycf26), and we (arman, abdul, and fardin) are building browser infra for agents.

before tilion, we were running thousands of web agents to collect multimodal school board data across the web. our agents kept getting blocked: cloudflare, akamai, captchas, and 200s that were actually empty pages. so we dug into chromium itself.

what we found:

- sites fingerprint the browser in about 40 places (gpu, canvas, fonts, timezone, and so on). a real machine is consistent in all of them, unlike a program-driven browser.

- plugins like puppeteer-stealth and undetected-chromedriver mostly patch from javascript, and the patch itself is detectable. (the irony)

- residential proxies fix the ip, but they're expensive. and if the fingerprint is wrong, you get blocked anyway. so we built and open sourced fortress.

our latest build has 81+ patches in c++. if an anti-bot system checks the browser, it all green-lights on its end.

in practice that means:

- you have higher success rates against blocks. - your proxy bill drops by half. - your agents can do more shit.

theres also a cli and mcp so you can get setup fast. we have windows, mac, and linux native builds. we'll also be launching our cloud browsers, for which we are running millions of agents every day for our pilots request an invite here. [https://tilion.com]

much love. arham

Comments URL: https://news.ycombinator.com/item?id=49928454

Points: 3

# Comments: 2

Today I have a Dell Pro Max GB10 (2, actually)

I started thinking about how far tech has come since those days so I asked Grok to try and calculate for me how many C64s would be required to match the processing power of one GB10.

Grok's answer: Between 10- and 50-billion C64s (depending on how you compare them, they are not strictly comparable)

Anyway, that's quite a 40yr leap!

Comments URL: https://news.ycombinator.com/item?id=49928012

Points: 3

# Comments: 1

Comments URL: https://news.ycombinator.com/item?id=49927572

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=49927188

Points: 4

# Comments: 11

Comments URL: https://news.ycombinator.com/item?id=49927050

Points: 2

# Comments: 1

We still need to understand which components exist, what they are responsible for, and whether the changes and new code stick to our rules. More agents make building faster and harder to stay on track.

So we worked on the checks and the reports together. Recursive contracts, evidence for individual rules, and much better exploration of the target and actual architecture. Open a component, inspect its children, follow dependencies, see what was checked and what remains UNKNOWN.

This is what I mean by deterministic harness engineering: explicit architecture decisions, repeatable checks against the code, and missing evidence that stays visible.

Choosing the right architecture still needs judgment. I want the harness to give me something concrete to judge.

ArchKeel is open source, MIT licensed. You can explore a real report here: https://archkeel.com/#explore

Comments URL: https://news.ycombinator.com/item?id=49926046

Points: 2

# Comments: 0

This should be a case study in how to drive your company into the ground.

Comments URL: https://news.ycombinator.com/item?id=49925522

Points: 5

# Comments: 3

Comments URL: https://news.ycombinator.com/item?id=49925191

Points: 3

# Comments: 6

Has anyone been successful at using AI and a multitude of agentic tools to do things like

* identify photos as candidates for deletion based on them being blurry or poorly composed or being duplicates

* cluster photos as being part of a particular trip or particular iterinary based on their geographical and time proximity

* Cleanup photos based on other arbitrary criteria, like i do a video walkthrough of a car i rent and i dont need these walkthrough 1 year after or so.

Any other ideas ot bring some sanity to an ever-growing library of smartphone photos using AI.

Comments URL: https://news.ycombinator.com/item?id=49925054

Points: 1

# Comments: 1

This is on Fastmail where I have dozens of email addresses that are context based and then to take it even further I almost always use an on-the-fly alias. I have never received an email to the email address in question which I've had for 10 years except for this one instance immediately after visiting Germany.

I traveled with a Verizon locked iPhone 17 and had Verizon international add-on. My phone has nearly no apps on it with the exception of the iOS Fastmail app and a few small open source non-bloated apps.

I do not believe this is a coincidence. Any thoughts on what took place, how this happened?

Additional thoughts and clarification: 1. I checked the raw message and it was indeed sent to an email address that I've never used in a web form and have never received an inbound email to. 2. The email address in question is very unique and isn't something that could potentially just be guessed by spammers. 3. I haven't received an email to this email in question since. 4. The email address in question I have never used an on-the-fly alias (@..) 5. I didn't click on the link in the email but it looks to be a transactional email originated with Amazon SES to verify my email address. Subject and body is 100% in German including address information, UID (tax id?) number, etc.

Comments URL: https://news.ycombinator.com/item?id=49924570

Points: 17

# Comments: 8

If you run more than one agent against shared state or shared tools, what actually went wrong?

1. Did two agents do the same work, or different work that conflicted? 2. Were your agents copies of each other (homogenous agents), or specialized with different roles (heterogenous)? 3. What did you add to stop or prevent the failure?

Anthropic's multi-agent research found that agents are low-variance: 18 of 30 independently created a git branch with the identical name. That suggests the common failure is correlated duplication rather than disagreement. Does that match what you have seen, or do yours diverge?

Comments URL: https://news.ycombinator.com/item?id=49924268

Points: 1

# Comments: 1

I am hopelessly ignorant with the idiosyncrasies of both those tools. Any help would be appreciated muchly!

https://github.com/ue-patcher/Code_Stitcher/releases/

Comments URL: https://news.ycombinator.com/item?id=49924160

Points: 1

# Comments: 1

Comments URL: https://news.ycombinator.com/item?id=49924125

Points: 1

# Comments: 0