Microsandbox: fast local microVMs for untrusted workloads

Microsandbox packages hardware-isolated microVMs as a local, embeddable Rust runtime for untrusted workloads—including AI agents, plugins, CI jobs, and user code. It aims for Docker-like workflows without a daemon, with sub-100ms guest boot on Apple Silicon, OCI images, detached sandboxes, and secrets that stay outside the VM.

The project’s interesting boundary is operational rather than merely container-shaped: an application can create and control a VM as a child process, constrain network destinations, and expose the same lifecycle through Rust, Python, Ruby, TypeScript, or a CLI. It is still beta software, so the security claims need independent review rather than trust in the README.

• Repository

Everything is about to “go dark”

Matthew Green argues that AI-assisted vulnerability finding could make well-maintained platforms hard to exploit remotely, removing the pressure-release valve that has so far let agencies buy phone exploits instead of demanding exceptional access. If that exploit supply dries up, governments may push vendors toward intentional backdoors—weakening the systems they claim to protect.

The HN discussion usefully challenges the optimistic premise: AI-generated code may expand attack surface as quickly as scanners close it, while platform-level bugs and human compromise remain difficult. Other reactions point to binary transparency, open source, self-hosting, and client-side scanning as parts of the defensive response.

• HN discussion

Firefox is now the last major browser that still supports uBlock Origin

Chromium’s Manifest V3 transition leaves Firefox as the durable home for full uBlock Origin, whose request-level filtering, dynamic lists, and CNAME uncloaking go beyond merely hiding ads. That makes browser-engine plurality a security and user-control issue, not just a feature comparison.

The HN discussion notes that Brave and Vivaldi retain MV2 support for now, but their Chromium compatibility depends on APIs Google has deprecated. Reactions also debate extension permissions, Mozilla’s own trust model, and the cost of a browser monoculture.

• HN discussion

Runtime-Agnostic AI Workflows: a Pattern for Production Durability and Fast Eval Iteration

Brex’s design keeps agent orchestration identical in production and evals by making it plain business logic over a typed Steps interface, then swapping in a Temporal adapter for durable execution or an in-process adapter for fast tests. That removes eval–production drift rather than relying on discipline.

The trade-off is explicit: runtime-native features must be re-exposed through the portable interface, but the payoff is concrete. Their 20–60 minute agents improved from roughly 96% completion to 99.9% after Temporal replay handled worker failures and redeploys.

• Runnable reference implementation

RISC-V: They should have known better

Dmitry Grinberg’s long critique argues that RISC-V’s optional extensions, fragmented profiles, awkward compressed encodings, and missing common addressing/bitfield operations make portable software and efficient implementations harder than the clean-slate ISA deserved. He sees RISC-V succeeding in cheap embedded controllers and accelerator sidecars, but doubts it will displace ARM in high-end general-purpose systems.

The 100+ comment HN debate supplied an important counterweight: designers value the license-free standard and can curate an embedded subset, while others agreed that incompatible extension combinations and weak feature discovery create real portability and binary-compatibility hazards.

• Source discussion

RustDesk now supports true unattended remote access on Wayland

RustDesk’s preview build adds unattended Wayland access, including multi-monitor sessions and reconnecting at the login screen after reboot. It currently targets x86_64 Debian/Ubuntu systems; Fedora, Arch, and the standard release are planned after more real-world testing.

HN readers mostly asked about the implementation and practical boundary with VNC/Xpra, while others highlighted the value for self-hosted Linux desktops and servers. The thread also surfaced a password-policy debate unrelated to the Wayland feature.

• Source discussion
• Preview build

How Google is Making Private AI Practical with Homomorphic Encryption

Google is open-sourcing HEIR, an MLIR-based compiler toolchain that converts pretrained models to run inference on encrypted inputs. The post demonstrates recommendation, fraud detection, encrypted-traffic intrusion detection, and hotword models, while acknowledging that homomorphic encryption still carries substantial overhead.

The HN discussion focused on that caveat: commenters with privacy-preserving-ML experience questioned commercial viability at roughly 10³ overhead, while others clarified that FHE ciphertexts remain computationally indistinguishable from noise and debated whether the provider can prove it ran the intended model.

• Source discussion
• HEIR demos

Introducing Bluesky Protocol Services

Bluesky’s Jetstream v2 adds stateless network replay: clients plan a filtered snapshot, download sealed archive segments over HTTP, then connect once to the live WebSocket at the tip without a gap. The same archive can provide point-in-time snapshots, while the live tail remains open and self-hosting stays supported.

The change turns backfill and recovery from a client-side cursor-management problem into a service-side replay protocol. HN readers highlighted how easy Jetstream already is to consume and discussed the implications for downstream services such as DNS.

• HN discussion
• Jetstream replay docs

How Compaction Works in Pi

Pi compacts long coding-agent sessions by retaining roughly 20,000 recent tokens, truncating older tool results, and asking a separate clean context for a structured summary. The summary is appended as a session entry, preserving room for more work while retaining the recent turns unchanged.

The design also breaks the prompt-cache prefix: even unchanged recent turns now follow a new summary, so their prior cache cannot be reused. HN discussion pushed toward selective pruning, branch/handoff workflows, and keeping durable task state in Markdown instead of trusting lossy summaries.

• HN discussion
• Pi compaction implementation

Single log line is 49KB+ (ext4) / 110KB+ (btrfs) of systemd-journald disk writes

A systemd issue documents severe write amplification in journald: one short log message can result in roughly 55 KB of writes, while 14 messages produced 386 KB of physical writes in a controlled test. The report attributes the overhead to journald’s mmap-based, indexed on-disk format and shows a much smaller append-plus-sync text-file baseline.

A follow-up measurement found journald writes persistently on each message and only delays fsync with SyncIntervalSec; a former journald contributor connected the behavior to small, scattered mmap updates and page/block write amplification. HN debated the trade-off between queryable structured logs and append-mostly formats.

• HN discussion
• systemd journal design rationale

NVIDIA-NeMo Switchyard: Rust Routing for LLM Traffic

NVIDIA-NeMo’s Switchyard is a pre-alpha Rust proxy and library that routes LLM traffic across providers while preserving native OpenAI and Anthropic API formats.

It translates requests and responses, exposes Prometheus metrics, and supports random, classifier, stage-based, and escalation routing. The library separates routing decisions from the HTTP/model client, so it can embed in an existing gateway or agent runtime; the standalone proxy can target vLLM, NIM, Ollama, or other compatible endpoints. APIs and algorithms are still expected to change before 1.0.

• Repository README
• GitHub Rust trending

MSI Claw Gamepad Driver Set to Be Merged for Linux 7.3

Linux 7.3 is set to gain a mainline hid-msi driver for configuring MSI Claw handheld controllers, including button remapping and RGB lighting through sysfs.

Derek Clark developed the GPLv2 driver with Valve and other contributors; it is already queued in the HID subsystem’s for-next branch. The work is a useful example of hardware-specific Linux support moving from vendor utilities into the kernel, and follows other MSI Claw fixes for Linux handhelds.

• Source comments
• Queued HID driver commit

Linux Patches Enable Apple M4 NVMe Support

Early Asahi/Linux work adds Apple M4 (T8132) ANS2 NVMe support, bringing the SoC’s storage controller closer to a usable mainline driver.

The patch series adds device-tree bindings and a small driver change for M4’s separate NVMMU base and extra I/O-queue registration write. The implementation is largely shared with M1–M3 support and changes fewer than 100 lines, but M4 Linux support remains far from end-user readiness.

• Source comments
• NVMe patch series

GLM-5.3: Frontier Coding with Emergent Cyber Capabilities

Z.ai says its GLM-5.3 model gained substantially on long-horizon coding and vulnerability-analysis tasks through post-training, while also developing unexpectedly strong exploitation capability.

The company reports a 50% improvement over GLM-5.2 on its private coding benchmark, 84.5% on CyberGym, and more than twice GLM-5.2’s score on ExploitBench. It also claims 2,436 findings across 269 open-source projects, though only 53 are publicly disclosed and the results are vendor-run, so independent validation matters. Z.ai plans to release the model weights after safety evaluation and hardening.

• Z.ai’s technical report
• Hacker News discussion

Your agent needs a computer, not a container — introducing @cloudflare/computer

Cloudflare’s open-source @cloudflare/computer runtime gives each agent a durable workspace and chooses between fast isolates, full Linux containers, and browser backends instead of pinning every task to a container.

The agent harness runs in a Durable Object while a shared SQLite-backed filesystem spans execution backends. File, git, and shell operations are gated, audited, and observable; lightweight file manipulation can stay in an isolate, while native binaries and full Linux tooling use a container on demand. It is an early preview, so the architecture is more interesting than production readiness today.

• InfoQ coverage
• Workspace repository

Open-Source NVIDIA “Nova” Driver Sees More Functionality for Linux 7.3

Linux’s Rust DRM work is moving beyond scaffolding: the upcoming 7.3 cycle adds more infrastructure for Nova, NVIDIA’s open-source successor to Nouveau, plus concrete Hopper/Blackwell and vGPU progress.

The DRM Rust core gained I/O support, a volatile SysMem backend, and lifetime-aware RegistrationData/RegistrationGuard resources. Nova also consolidated GPU System Processor boot handling and added TLV firmware-image support. The same pull request advances Tyr, the in-development Rust driver for modern Arm Mali GPUs, with firmware loading and MCU-boot work.

The article’s 37-comment thread is mostly practical caution: Nova is promising and NVIDIA is investing heavily, but the driver is still an evolving kernel component rather than a drop-in replacement. The linked Rust-for-Linux pull request is the better source for implementation details.

• Phoronix comments
• Rust-for-Linux pull request

Ante: a self-contained Rust coding-agent harness

Ante packages a terminal coding agent, embedded grep/git tooling, and a managed local llama.cpp engine into roughly a 15 MB Rust binary. It supports interactive, headless, server, and gateway modes; profiles replace the tool set and system prompt; and the same runtime can use hosted providers or run fully offline with a GGUF model.

The project publishes an SDK/protocol surface and a reproducible Terminal-Bench pipeline, with claimed lower memory, CPU, and disk use than larger agents. The important caveat is that the core harness is still distributed as a prebuilt binary during this alpha preview, not as source, and telemetry is opt-out rather than opt-in. That makes its deployment story compelling while leaving trust and auditability as open questions.

• Ante documentation
• Terminal-Bench results

Spaghettifying DRAM: remapping memory below the protection boundary

Christopher Domas’s research shows how flipping an exposed DRAM-controller address-swizzle bit on tested AMD Family 16h hardware can create aliases to protected DRAM regions. A GF(2)/Z3 solver recovers the translation, allowing the project to inspect areas such as PSP, SMM, and C6 state that normal physical-address protections assume are unreachable.

This is a low-level research demonstration, not a general remote exploit: it needs root-level hardware-register access, and the published implementation targets an older AMD family; newer CPUs and VM escape are not established. The research matters because security boundaries above the memory controller all depend on that final address mapping. HN readers debated modern-hardware scope and the threat model, while many praised the hardware reverse engineering.

• Hacker News discussion
• Project documentation

Spotify’s Random Access Parquet adds point queries to the data lake

Spotify’s Random Access Parquet (RAP) adds an external index over immutable Parquet/Iceberg data, letting online services and AI applications resolve a key to a file and row location, then issue a small ranged read from object storage instead of copying the dataset into an operational database.

The design keeps one lake for analytics, ML, notebooks, agents, and serving while using append-only index fragments, sorted/hash/secondary/covering indexes, and layout locality to reduce metadata and storage operations. Spotify’s scale makes the motivation concrete: petabytes in Bigtable and exabytes in its GCS lake. The trade-off is another serving/index layer and careful data-layout management, but it avoids duplicating every dataset just to support point lookups.

• Spotify Engineering

DeepSeek Harness developer preview: composable plugins and traceable runs

DeepSeek’s open developer-preview harness makes models, tools, skills, sessions, sandboxes, storage, loops, scheduling, and UI replaceable plugins, then records each run in an append-only event log that supports resume, fork, search, and replay.

Its Cordis kernel handles plugin lifecycle and dependencies. Standard mode is a full coding agent; Code mode lets the model orchestrate tool calls through a TypeScript SDK; Minimal mode is a two-tool benchmark environment; Creator mode exposes runtime inspection and preset authoring. The preview is early and Node/TypeScript-based, and HN commenters questioned how much it differs from existing harnesses, but the traceable trajectory and explicit composition model are useful ideas for harness engineering.

• Hacker News discussion
• DeepSeek Harness repository