Sshole
According to the write-up, OpenSSH sshd on musl Linux without PAM and with password authentication enabled accepts any password of 257–1024 characters for an account whose shadow password field is “*” when another account has a real password; the write-up says this has affected Alpine, OpenWrt, Buildroot and Yocto builds since 2016. According to the write-up, on Alpine’s official AWS and Azure images the affected “*” account is the default alpine user, which has passwordless doas and therefore root; it says OpenSSH 10.6p2 fixes the issue and that turning password authentication off is the mitigation if updating is not yet possible.
Astra can read and write weights to improve Qwen
In Experiment 8, Astra edited 0.016% of Qwen3.5-0.8B’s weights, with thinking on, without gradients or training and, with 50 forward passes under temperature 0.6, top-p 0.95, top-k 20 and presence penalty 1.5, the authors report MATH-500 rising from 7.9% to 48.1%. In Experiment 7, the authors report Astra could not tell from weights alone which of two Gemma 3 270M copies was sycophantic in four attempts; with only attention patterns from both models run on up to 16 texts it wrote, it chose the sycophant in all three pairs.
HackerTube: YouTube built from videos recommended by HN
The author says HackerTube compiles 6,454 YouTube videos recommended by a few people on Hacker News across 150 topics from 2007–2026, drawn from 40K comments that recommend a YouTube video. The author says HackerTube has no user accounts and stores state in the local browser session. The author says an export of the site’s data is available to give to an agent to easily create your own version.
DeepSeek just open-sourced its inference engine
DeepSeek released DeepInfer, which it describes as the open-source, high-performance inference framework powering its large-scale production services, providing offline inference for DeepSeek-V4.1-Flash on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs under the Apache License 2.0. The release states that a complete inference service also requires, but this release does not include, a KV cache system, load balancing across data-parallel replicas for both prefill and decode, and VE/prefill/decode disaggregation, for which it says most required engine functionality is already implemented.
Things to know if you get cancer in 2026
The author, writing in a piece dated 14 October 2026, says he was diagnosed with squamous cell carcinoma in his mouth in May 2026 and that most AI models he chatted with pushed him toward “you don’t have cancer” for a while. He advises seeking a second opinion at a top cancer center as soon as possible and, citing a Hacker News commenter, suggests that people within a 2–3 hour drive of a major cancer center go there instead of a local community hospital; he reports that speed was the largest benefit he saw, with a question at MD Anderson answered within 20 minutes of a visit.
Show HN: HackerBooks – HackerTube, but for books recommended on HN
The HackerBooks page states 15,704 books, 284,808 mentions, the range 2007–2026, and a generation date of 2026-11-07. The page says it was made by roansh and is not affiliated with Y Combinator or Hacker News. The page also offers an email when the list is refreshed and describes the frequency as a few times a year, with nothing else.
Binance-hacker-1029 – $5.6B stolen from Binance
Mistral Large 4 (Le Chonk) is now Open Weight
Mistral said it released the open weights of Mistral Large 4 (Le Chonk), a 1-trillion-parameter natively multimodal model, after a public preview. The model is offered under a modified MIT “Mistral Ecosystem Open-Weight” license that permits use, modification, fine-tuning, and commercialization, but businesses operating a Model-as-a-Service offering must obtain a separate commercial license from Mistral before commercial use. Mistral said that although it observed the model refusing to comply with black-box attacks against live targets, it saw a potential for uplift to conduct real attacks and was modifying its guardrails accordingly.
Local Wikipedia: Wikipedia, but only for things a half hour walk from you
Local Wikipedia is an unaffiliated site that shows only geocoded Wikipedia pages for things within a half-hour walk of the user, draws its content directly from Wikipedia, and says the user's location stays in the browser and is not included in shared links. It states that if fewer than 25 things are close to the user it takes the closest 25 within about 6 miles, and that if more than 500 are close only the closest 500 are included.