Court blocks Utah’s anti-VPN age-verification provisions

A federal judge has preliminarily blocked enforcement of Utah SB 73’s VPN-related provisions, finding that the law appears to demand perfect geolocation—something current systems cannot provide—and burdens users and businesses outside Utah.

The law would make adult sites either block VPN traffic or identify and age-check visitors they cannot reliably locate. EFF argues the resulting surveillance and misclassification risks reach far beyond Utah; the ruling is preliminary, and the state may try to revise the law.

The Hacker News thread questioned whether sites can reliably identify VPN use at all. Some commenters noted that ordinary proxies and self-hosted VPNs complicate detection; others debated the law’s motives and constitutional implications.

• Hacker News discussion

New Linux Patches Trying To Mainline Renesas SH7305 CPU Support

A developer has sent the first small architecture patches toward mainline Linux support for the Renesas SH7305, a 32-bit SH-4a CPU used in Casio graphing calculators.

This is only the start of an enablement effort: the initial changes adjust compiler flags and add CPU/Kconfig plumbing. Clock, interrupt-controller, timer, and board support are still expected in follow-up work. The chip has no FPU, runs at about 118 MHz, and is typically paired with roughly 8 MB of RAM, so the article notes that practical scope is limited.

The Phoronix thread returned HTTP 403, and Anubis blocked the linked LKML patch page; I couldn’t verify source reactions or inspect the patch details directly.

• Source comments
• Initial patch series

An Empirical Study of Harness Design for Coding Agents

A controlled study treats coding-agent harnesses as composable systems: 176 matched settings vary planning, action space, and context management across four models on SWE-Bench Verified and Terminal-Bench 2.1. The strongest result is practical: staged rule-based context elision before LLM summarization gives the best efficiency, while recoverable elision adds machinery without improving accuracy. Planning mainly scaffolds weaker models but saves cost for stronger ones; bash-capable models can often use a bash-only interface more cheaply than predefined tools.

• Hacker News discussion

From Thin Air to Bootable Images: The tine Build System

Amutable introduced tine, a Buck2-based build system for producing reproducible operating-system images and their components from pinned inputs. It runs builds in hermetic environments, supports RPMs plus Rust and Go components, signs images, and can generate SBOMs.

The notable design choice is using Buck2’s content-addressed actions and declared “boxes” as build environments, rather than treating image creation as a special-purpose pipeline. The post contrasts that model with mkosi, BuildStream, OBS, and Antlir, then demonstrates producing and booting a Fedora image. This is a new project announcement; its claims about reproducibility and build properties are from the authors.

HN’s linked discussion had no substantive comments when checked.

• Project repository
• Hacker News discussion

Fearless SIMD 1.0 brings safe, portable SIMD abstractions to Rust

Linebender’s fearless_simd 1.0 aims to make SIMD programming safe without giving up portable abstractions, hardware-specific intrinsics, or runtime multiversioning. The project says its design confines unsafe code to a small audited core while still allowing optimized per-architecture implementations.

Lobsters commenters explained why the API passes a SIMD-level type token: it lets Rust compile specialized variants and dispatch at runtime. They also noted the tradeoffs—dispatch can cost something for short loops, and scalable SIMD architectures such as Arm SVE and RISC-V vectors remain an open question.

• Lobsters discussion

EDG C/C++ Front-End Open-Sourced

Edison Design Group has released its long-used C/C++ compiler front end as open source under Apache 2.0, with the C++ Alliance as its nonprofit home. The front end is known for broad dialect support and has been used in products including Intel’s classic C++ compiler, NVIDIA’s CUDA NVCC, and Visual Studio IntelliSense; the project says it will accept community contributions.

This opens a substantial compiler implementation and its dialect expertise to inspection and outside work. Phoronix’s forum page returned HTTP 403 when checked, so I could not verify or summarize its three listed comments.

• Phoronix source article
• Source comments

Announcing Rust 1.99.0

Rust 1.99.0 stabilizes defining C-ABI variadic functions in Rust, raw-pointer layout queries for potentially dynamically sized types, and Box::into_non_null. The release also updates Box::leak guidance: don’t reconstruct and free leaked allocations; use the new ownership-transfer API instead, especially as custom allocators approach stabilization.

The Rust blog lists additional stable library APIs, including VecDeque::retain_back and array-box iteration. The linked r/rust announcement had no comments when checked.

• Rust release announcement
• Source discussion (0 comments)

Saving another 100TB of RAM with math (and Rust)

Cloudflare reclaimed more than 100 TB of RAM globally by reducing the memory footprint of a Pingora-based backend router, combining consistent-hashing math with a tighter Rust representation. The post explains how its routing structure grew expensive at Cloudflare scale, then walks through the algorithmic and data-layout changes that made the savings practical across thousands of servers.

HN readers liked the calculus-driven optimization but questioned the sparse crate documentation and asked how the design compares with jump consistent hash; those are useful caveats when interpreting the headline number.

• HN discussion

Uber separates scaling intent from execution on its Kubernetes platform

Uber added a ServiceScale resource and a separate controller so failover and other orchestrators can request workload scaling without putting rare failover logic on the deployment controller’s normal hot path. The shared intent stays visible in Kubernetes rather than moving into a separate database or coordination service.

The production lessons are the useful part: informer caches can lag, and two controllers writing the same workload exposed a ReplicaSet metadata/spec inconsistency that could break proportional scaling or leave workloads stuck. Uber added a generation-based read-your-own-write guardrail, drift monitoring and an automated healer, then rolled the change out through staging and canaries. InfoQ has no article comment section.

• Uber’s engineering write-up

Green Threads from Scratch

A compact Rust tutorial builds a cooperative stackful-task runtime, then grows it into an M:N worker scheduler; it is a useful systems-programming walkthrough, not a production runtime.

The implementation allocates guarded stacks with mmap, saves and restores ARM64 context in assembly, then adds per-worker queues, task parking, and joins. The author says the project currently targets Apple Silicon, uses fixed-size stacks, and requires explicit yielding. The post’s reported benchmark-free scope is educational; commenters also point out that its “green threads” label blurs distinctions between cooperative fibers and M:N runtimes, and that the full implementation uses Pin<Box<Task>> to enforce task address stability.

The Reddit discussion had 84 upvotes and 14 comments, including corrections on pinning, preemption, and thread-model terminology.

• r/rust discussion

Wild vs. Mold: why linker benchmarks disagree

David Lattimore reproduced Mold’s recent linker results and traced the difference from Wild’s earlier numbers to benchmark setup: whether the output file already exists, tmpfs versus ext4, and whether startup uses fork or --no-fork. Under matched conditions, the linkers are much closer than the headline comparison suggests.

The post also identifies concrete follow-up work: Wild needs the same filesystem-specific optimizations Mold uses, including preallocation and huge-page mapping. It is a useful example of how benchmark methodology can dominate systems-tool comparisons.

Benchmark analysis

Gzip 1.15 fixes decades-old correctness and safety bugs

Gzip 1.15 (September 20, 2026) includes more than 100 commits, largely bug fixes accumulated over the past 18 months. The release fixes a race that could remove the wrong file after an ancestor rename, uninitialized-memory use, an LZH decompression buffer overflow, multiple LZH corruption cases, streamed ZIP handling, temporary-file races on limited platforms, and locale handling for diagnostics. It also drops several obsolete platform targets.

https://www.phoronix.com/news/Gzip-1.15-Released

“slab_tiny” boot option proposed for very low-memory Linux systems

A Linux RFC would replace the build-time CONFIG_SLUB_TINY choice with a slab_tiny boot parameter, letting embedded systems enable the smaller-footprint slab allocator at boot. The option targets machines with extremely limited memory; using it on larger systems is discouraged because disabling per-CPU object caching can hurt SMP scalability.

Some footprint savings tied to dead-code elimination and fast-path inlining cannot be made boot-time selectable, so the proposal gives up those smaller gains in exchange for runtime choice and simpler code. This is an RFC, not a merged change. The Phoronix forum page returned 403, so no comment reactions were available.

• Phoronix discussion
• RFC patch series

Zig 0.17.0

Zig 0.17.0 is a large compiler and build-system release: after five months and 925 commits, its build system adds a Build Server Protocol for IDE and tool integration, while the new ELF linker brings incremental compilation within reach for most x86-64 Linux projects. The release also advances SPIR-V and WebAssembly backends and adds target support.

This is a substantial, breaking release, not a routine update. In particular, @bitCast changes for arrays and vectors can silently alter existing code, so projects should audit those uses. The release notes also list known regressions, and the new build-server transition still leaves ZLS integration incomplete. In the 104-comment HN discussion, users welcomed the target coverage and tooling direction but raised concerns about breakage, linker/backend maturity, and the unfinished editor integration; some discussion drifted into the project’s AI policy.

• Hacker News discussion

mbrotli joins the upstream lzbench benchmark suite

The lzbench project merged a safe-Rust Brotli codec, giving mbrotli a place beside Google’s C implementation for repeatable comparisons. The integration also handles a practical build edge case: Rust codecs are linked together to avoid duplicate runtime symbols, with a Rust 1.89+ requirement for mbrotli and a fallback that still builds other codecs on older toolchains.

The author’s single-threaded Silesia run found similar compression sizes at levels 0–9 and faster decompression in that setup; treat these as initial measurements, not a broad benchmark. Review comments traced small q10/q11 size differences to -ffast-math changing floating-point search calculations in lzbench’s C build. A normal C Brotli build matched mbrotli’s outputs. The maintainer also requested and received offline dependency vendoring and extra CI coverage after the merge.

• Merged lzbench change and technical discussion
• Original r/rust report

The state of SIMD in Rust in 2026

This detailed survey compares Rust’s SIMD options, from nightly std::simd to libraries such as Fearless SIMD, pulp, wide, and macerator. It focuses on the practical trade-offs: safe abstractions, portable code, runtime CPU-feature dispatch, and choosing vector widths. The author maintains Fearless SIMD, but says maintainers of competing libraries reviewed a draft; he retained editorial control and responsibility for mistakes.

The /r/rust discussion sharpened the trade-offs. Commenters debated whether generic Simd<T, N> can support runtime-selected widths cleanly, and whether vectors wider than the CPU’s native width can help. The author cautioned that wider vectors can also hurt through register pressure and need workload-specific benchmarks. One commenter caught a Rust-version typo; the author corrected it.

• Reddit discussion

We’re making Tailscale faster

Tailscale describes several data-plane changes: Linux/Android packet-buffer reuse that the company says improved speed about 5% in many configurations, writev to reduce copies, and a planned multi-queue pipeline for subnet routers, app connectors, and exit nodes. Netmap caching can also let previously connected devices start sending over the data plane much sooner when the control plane is slow, though it has storage and large-tailnet tradeoffs and is still rolling out.

The Hacker News discussion pushed back on the assumption that moving WireGuard into the kernel automatically makes it faster; Tailscale’s cofounder pointed to userspace optimizations and DPDK as relevant tradeoffs. Commenters also raised a separate user-control complaint about Android VPN exclusions, so the thread was not uniformly about the performance work.

• Hacker News discussion

Nvidia releases software platform to stop AI agents from misbehaving

Nvidia’s Open Agent Safety Platform targets a practical agent-security problem: monitoring and limiting the actions agents take, after recent incidents involving agents accessing systems and data beyond their intended scope.

CNBC describes it as software, despite the catchy HN “watchdog chip” title. The 67-comment HN thread split over whether tighter containment can make autonomous agents safe at all, or whether useful deployments still need human review; commenters also argued that partial automation can deliver value without full autonomy. Treat the platform’s safety benefits as Nvidia’s claims, not independently demonstrated guarantees.

• HN discussion

Cursor Uses S3 WAL to Scale Git Storage to More than 300 Pushes per Second

Cursor’s Continuity makes an S3-backed write-ahead log the durable source of truth for Git repositories; local NVMe copies become disposable warm caches. Pushes are acknowledged only after persistence, and replicas verify their state against S3, so lost UDP gossip can delay convergence without making stale reads authoritative.

Cursor reports linear read scaling to 100 replicas and over 300 pushes/s on S3 Express One Zone in synthetic tests; these are vendor-reported results, not independent benchmarks. The design trades synchronous replica coordination for object-store validation, asynchronous replication, and extra bandwidth. InfoQ has no reader-comment section; it cites a practitioner who flagged the performance numbers as unverified.

• Cursor’s architecture write-up

LuaRocks discloses an exploited server-side RCE

LuaRocks says attackers exploited a bytecode-loading flaw in LuaRocks.org from July 9 through August 20, 2026; the fix shipped on September 26, after the vulnerability was reported on September 25. The issue let any registered user upload a rockspec that the server treated as LuaJIT bytecode, escaping the restricted environment and executing arbitrary code.

The project rebuilt and moved the site, revoked old server credentials, and found no evidence that existing packages were modified. It nevertheless treats all data accessible to the compromised server as exposed: users should rotate API keys and passwords, end old sessions, and reset 2FA. Anyone who installed three named malicious packages should treat the machine as compromised; LuaRocks users on LuaJIT or Lua 5.1 should upgrade to 3.12 or newer.

Lobsters commenters focused on the bytecode/text boundary: one argued Lua’s load default should accept text only, while another noted the project sandbox checked source but did not equally constrain bytecode. The post has just two comments, so that is a narrow reaction, not a consensus.

• Lobsters discussion