Maker Views

DeepSeek published DeepSeek-V4.1-Flash-1017 on Hugging Face, calling it a minor update to V4.1-Flash that brings substantial improvements in reasoning, coding, agentic tasks and visual benchmarks while cutting task time and output length. Its table shows, for example, Terminal-Bench 4.0 rising from 31.2 to 42.3 and DeepSWE v1.1 from 74.2 to 77.0, ahead of GPT-5.6 Sol on several tests and behind Opus 5 on others. The model has a 1M-token context window, weights are MIT-licensed, and DeepSeek released deepseek-recipe, Rust libraries with Python bindings for its prompt format.

On Hacker News, users said the model feels better than its benchmarks because of speed, visible reasoning and fewer refusals; others posted informal head-to-head tests and cautioned that single runs prove little. Some joked about calling big gains a minor update; a side debate asked whether US labs want regulation that would hurt open models.

A researcher proved that the private keys of eight eMudhra intermediate certificate authorities, chaining to roots trusted by Mozilla, Microsoft, Apple and Chrome, were compromised, and reported it on October 17. The disclosure site says the keys were incorrectly generated and anyone could recover them from the certificates since April 2025. Security researcher Scott Helme says each key was a single byte (one was literally 4) and he recovered all eight in under a second. Browsers blocked the intermediates within days, and because no certificates from them appeared in Certificate Transparency logs, CT-enforcing browsers were protected, but curl, Python, Go, CI pipelines and embedded devices that don't check revocation or CT need updated CA bundles.

On October 22 eMudhra said it will exit the global SSL/TLS business, about 1% of its revenue, saying it revoked the CAs within 14 hours, no end-entity certificates were issued from them, and scrutiny was out of proportion.

Three Hacker News threads questioned how a CA passed audits with such keys, debated whether the web's CA system needs replacing, and criticized eMudhra's statement.

Tesla showed a redesigned two-seat Roadster at a SpaceX test site in McGregor, Texas, on Thursday, Reuters reports. The car drove upside down on a ramp using suction, flipped and landed on built-in thrusters, then jumped over a truck and other vehicles. Tesla engineering chief Lars Moravy said it is designed for 0-60 mph in under a second, a top speed over 230 mph and more than 300 miles of range. Tesla's reservation page lists a Performance version ($50,000 deposit), a Thrust version with acceleration thrusters ($250,000 deposit) and an invite-only, single-seat Rocket variant. No prices were given; production is planned for 2028, more than a decade after the car was first shown. Tesla shares rose about 5% in premarket trading.

On Hacker News, many called the demo a genuine engineering feat; others called it a stunt that will never be street-legal, pointed to past staged demo videos in the industry, or said they would rather see an affordable EV.

Quad9, a free, nonprofit DNS resolver run by a Swiss foundation, says it will withdraw its service from users in France on November 24 after a French court ruled for broadcaster beIN, which wants Quad9 to block resolution of domains it says pirate its sports broadcasts. The court cut the daily penalty from €580,000 to €1,000, but Quad9 says the issue is principle: it refuses to alter DNS answers, keeps no record of which users are in France, and says blocking the names globally would impose a French ruling on everyone. It cites a German case in which a plaintiff used a VPN to get around its geo-blocking and the court fined Quad9, and says it faces about 20 other pending cases.

On Hacker News, Quad9's CTO said it will probably geo-block French users after leaving. Commenters debated whether resolvers should be held responsible for content at all, comparing it to fining a phone book, and whether copyright enforcement has gone too far.

DeepSeek published DeepInfer on GitHub, describing it as the high-performance inference framework that powers its large-scale production services. This open-source release covers offline inference for DeepSeek-V4.1-Flash on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs, with optimized kernels (FlashMLA, DeepGEMM, DeepEP and others), expert parallelism, draft-token decoding with confidence-scheduled verification, batch-invariant inference and deterministic sampling. The README says pieces needed for a complete service are not included: a KV cache system, prefill/decode disaggregation and load balancing across replicas. It is licensed Apache-2.0.

It was the most-upvoted story on Hacker News this week. The discussion centered on the economics: a commenter quoted a post on the Chinese site Zhihu claiming strong per-GPU revenue, which set off a debate over whether serving AI models is profitable and what open releases like this mean for the valuations of US frontier labs. Others asked why DeepSeek, and China more broadly, would give this away, with replies arguing it is ordinary open-source strategy rather than state direction.

Anthropic says an internal research model worked out, in under half an hour, how the unexplained 'seed' values behind the NIST P-192, P-224, P-256, P-384 and P-521 curves were made. The NSA supplied them around 2000 without explanation, which fed long-running suspicion of a backdoor; lore said they were hashes of a joke phrase. Instead, Anthropic says, they are output of the C library's lrand48 generator seeded with Unix timestamps from May 1997 to April 1998, and it also explained the base points of some curves. Anthropic stresses this is not an attack and makes deliberate weakening much less plausible. Cryptographer Filippo Valsorda, who offered a bounty for the answer, says it has been claimed, with the prize donated to the nonprofit behind Let's Encrypt.

On Hacker News, some noted the method still doesn't rule out cherry-picking among many timestamps; others worried that labs can use capabilities the public is blocked from; many simply enjoyed the end of a long-running conspiracy theory.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution: CVE-2026-109618 (out-of-memory handling leaves request data half-initialized) and CVE-2026-109619 (state from a freed request is reused by a later one). The PHP project says every installation serving web requests is at risk, mod_php most of all, and urges an immediate update; it also published minimal backports for PHP 7.4 to 8.1.

The PHP Foundation says the first signs of the memory bug surfaced during a 2024 audit, but work on a fix stalled, which it calls a structural failure. Reports from Calif, OpenAI and Wiz in August made the impact clear. After the CVE IDs leaked on October 20, the release was moved up a day; security firm Calif mistakenly published a demo video, and the Foundation says Chainguard broke the embargo by publishing fixed images hours early.

Three Hacker News threads (the top one 1,549 points) argued over embargoes versus releasing fixes at once, Chainguard's move, and admins racing to patch or shut servers down.

OpenCode, the open-source AI coding agent, said on October 17 that a breach tied to what it called a large-scale distillation attack hit 1.4% of users of OpenCode Console, its hosted service, and that it had emailed those affected. BleepingComputer and TechCrunch report that only users who had linked external providers (Anthropic, OpenAI, Google) were affected, that some reported hundreds to over $1,700 in unauthorized charges, and that Google suspended some projects. Co-founder Dax Raad said the open-source app and CLI were not affected; the company has not said how attackers got in. OpenCode told users to revoke their keys and says refunds are underway. Raad said AI models first refused to help the investigation until it switched to OpenAI's Daybreak cybersecurity model.

On Hacker News, commenters asked why a hosted service held provider keys at all, questioned the unproven 'distillation' label, and argued over earlier warnings about the project's data practices.

Developer Peter Cai's Permit Pending is a browser city simulation 'in the spirit of the classics' with one twist: you are an elected mayor, not a god. Every apartment block, bus lane and factory goes through hearings, reviews, objections, lawsuits and appeals; residents have ages, incomes and homes; a seven-seat council votes; and you face reelection every four years. It is free, needs no account, saves locally and works offline after the first visit. Scenarios range from a 200-person hamlet to 'The Unaffordable Metropolis'.

The Show HN thread turned into a debate about housing and permitting itself: whether a century of keeping every neighbor happy produced today's shortages, whether unregulated building just creates other problems, and how books like Abundance frame it. Players also flagged story text that doesn't match their town, and the author replied with fixes.

Mistral announced Voxtral 3, a family of speech-to-text and text-to-speech models plus a voice-agent SDK that combines listening, reasoning, tool calling and speaking in one real-time pipeline. Mistral says Voxtral Small Transcribe 3 handles 50 languages, identifies who spoke when and outperforms Whisper, Scribe v2 and Gemini 3.5 Transcribe; the 4B-parameter Mini version costs $0.0035 per minute. Voxtral Mini TTS 3 adjusts emotion and pace across 35+ languages, and a Pro Voice feature adapts a speaker's voice from 30 minutes of audio. It is offered through Mistral's EU-hosted API or for self-deployment.

On Hacker News, commenters joked that the demo's quick French dermatology booking was the least realistic part, regretted that the models aren't open weights, and worried that phone agents wired into company systems could be talked into things; others traded notes on local transcription tools.