Friday · May 15, 2026

Morning Edition

Twenty stories from Hacker News and Pinboard Popular, curated for tech-leaning readers who care about Claude Code, the Apple ecosystem, and privacy.

In this issue

  1. How Claude Code works in large codebases
  2. Removing the modem and GPS from my 2024 RAV4 hybrid
  3. Rewrite Bun in Rust has been merged
  4. First public macOS kernel memory corruption exploit on Apple M5
  5. Mullvad exit IPs are surprisingly identifying
  6. New arXiv policy: 1-year ban for hallucinated references
  7. RTX 5090 and M4 MacBook Air: Can It Game?
  8. Codex is now in the ChatGPT mobile app
  9. New Nginx Exploit
  10. A few words on DS4
  11. Ontario auditors find doctors' AI note takers routinely blow basic facts
  12. Gyroflow: Video stabilization using gyroscope data
  13. reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
  14. What's in a GGUF, besides the weights – and what's still missing?
  15. LLM Policy for Rust Compiler
  16. HDD Firmware Hacking
  17. Fossils show millipede and centipede ancestors evolved legs underwater
  18. Porting 3D Movie Maker to Linux
  19. RISC-V Router
  20. Access to frontier AI will soon be limited by economic and security constraints

From Hacker News

Stories 1 – 10
No. 01AI ToolsApplies to you

How Claude Code works in large codebases

Straight from Anthropic's blog: a practical deep-dive into how Claude Code navigates massive repos, what context strategies work, and where to start if you're onboarding a large codebase. Required reading if you're already using Claude Code — and a compelling pitch if you're not yet.

No. 02Privacy & SecurityApplies to you

Removing the modem and GPS from my 2024 RAV4 hybrid

A detailed teardown of how a security researcher physically removed the connected-car modem and GPS transponder from a 2024 RAV4 hybrid — no more Toyota tracking your every move. This is the highest-scored story of the day for good reason: it's a masterclass in hardware privacy and the lengths you have to go to when software opt-outs don't actually work.

No. 03Dev Tools

Rewrite Bun in Rust has been merged

The landmark PR rewriting parts of Bun from Zig into Rust has landed, sparking one of the most heated comment threads of the week. Whatever your language allegiances, this architectural shift in one of JS's fastest runtimes has real implications for the whole ecosystem.

No. 04Privacy & SecurityApplies to you

First public macOS kernel memory corruption exploit on Apple M5

The first publicly documented kernel memory corruption exploit targeting Apple Silicon M5 is out, and it's a big deal for the macOS security community. Even if you're on an older chip, the technique is novel and the writeup is technically excellent — worth understanding before Apple patches it.

No. 05Privacy & SecurityApplies to you

Mullvad exit IPs are surprisingly identifying

Using a privacy VPN like Mullvad doesn't make you anonymous if sites can fingerprint you by which exit IP you're using — and this research shows exactly how. A sobering reminder that VPN ≠ anonymity, and that the threat model matters more than the tool.

No. 06AI Tools

New arXiv policy: 1-year ban for hallucinated references

arXiv is cracking down hard on AI-generated fake citations with a one-year submission ban. This is a significant policy moment that signals academic publishing is finally getting serious about LLM-assisted sloppiness — and will ripple into how researchers use AI writing tools.

No. 07New Apple AppsApplies to you

RTX 5090 and M4 MacBook Air: Can It Game?

Someone strapped an RTX 5090 eGPU to an M4 MacBook Air and actually tested gaming performance — and the results are more nuanced than you'd expect given Apple's GPU architecture. If you've ever wondered whether Mac gaming via eGPU is finally viable, this is your answer.

No. 08AI ToolsApplies to you

Codex is now in the ChatGPT mobile app

OpenAI's Codex coding agent is now accessible from the ChatGPT iOS app, meaning you can kick off agentic coding tasks from your phone. Direct competition with Claude Code, and worth watching to see how mobile-first AI dev workflows evolve.

No. 09Privacy & SecurityApplies to you

New Nginx Exploit

A freshly disclosed exploit targeting Nginx is making the rounds with a full PoC on GitHub. If you're running Nginx in production — and who isn't — check the details and patch status immediately. High-score, high-urgency.

No. 10Dev Tools

A few words on DS4

Redis creator antirez shares thoughts on DS4, his next data-structure project — and it reads like a manifesto for thoughtful systems design in an era of AI-generated bloat. Even if you don't follow the Redis ecosystem closely, antirez's perspective on simplicity is always worth 10 minutes.

From Pinboard Popular

Stories 11 – 20
No. 11AI Tools

Ontario auditors find doctors' AI note takers routinely blow basic facts

Ontario's auditors reviewed AI-generated clinical notes and found systematic factual errors — wrong medications, incorrect diagnoses, hallucinated patient history. A sharp counterpoint to AI-in-healthcare hype and a useful case study in where current LLMs still dangerously fail.

No. 12Creative SoftwareApplies to you

Gyroflow: Video stabilization using gyroscope data

Gyroflow is an open-source video stabilization tool that uses gyroscope data from your camera or phone for frame-perfect stabilization — far superior to optical-only approaches. If you shoot any video on iPhone or a mirrorless, this is a tool you'll want in your post-production kit.

No. 13Privacy & SecurityApplies to you

reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

Google is extending Play Integrity API attestation to desktop browsers via reCAPTCHA, which means websites could soon require your device to be "certified" before letting you in. The GrapheneOS community is sounding the alarm loudly — this is a significant threat to open-web access and privacy.

No. 14AI ToolsApplies to you

What's in a GGUF, besides the weights – and what's still missing?

A thorough technical tour of the GGUF model format — what metadata lives alongside the weights, what's still absent, and why it matters for local LLM tooling. Essential reading for anyone running models locally with llama.cpp or similar tools.

No. 15AI Tools

LLM Policy for Rust Compiler

The Rust compiler team is establishing a formal policy on LLM-generated contributions — one of the first major open-source compilers to do so. How major OSS infrastructure projects handle AI-assisted PRs is going to define governance norms for years, and this is a bellwether.

No. 16Dev Tools

HDD Firmware Hacking

A deep dive into reverse-engineering and modifying hard drive firmware at the hardware level — complete with disassembly, flashing, and unexpected quirks. Pure low-level hacker catnip, and a useful reminder of how much invisible complexity lives in the devices we take for granted.

No. 17Weird Science

Fossils show millipede and centipede ancestors evolved legs underwater

New fossil evidence suggests the ancestors of millipedes and centipedes developed their signature multi-leg body plan while still living in the ocean — flipping the assumed land-first evolutionary narrative. Wonderfully weird paleontology that rewrites the arthropod family tree.

No. 18Creative Software

Porting 3D Movie Maker to Linux

A nostalgic engineering quest: porting Microsoft's beloved 1995 3D Movie Maker to Linux, complete with reverse-engineering the old DirectX calls and resource formats. A charming mix of preservation, creative software history, and genuine systems hacking.

No. 19Privacy & Security

RISC-V Router

Start9 is shipping a RISC-V based router designed for full user sovereignty — open hardware, open firmware, no proprietary blobs. For anyone building a privacy-first home network, this is worth a close look as the hardware ecosystem matures.

No. 20AI ToolsApplies to you

Access to frontier AI will soon be limited by economic and security constraints

A sharp essay arguing that access to frontier models will increasingly be gated by cost, compute quotas, and geopolitical security restrictions — creating a two-tier AI world. If you're building products on top of powerful models, this is the strategic risk you should be stress-testing against.