Feed aggregator

Article URL: https://www.unsungnovelty.org/posts/07/2026/fire-alarms-privacy/

Comments URL: https://news.ycombinator.com/item?id=49083149

Points: 1

# Comments: 0

Article URL: https://www.codembark.com/projects/fv20lz9map/spider-web-drawing

Comments URL: https://news.ycombinator.com/item?id=49083146

Points: 1

# Comments: 0

I’ve worked as a B2C product manager and co-founded two social-media-related startups (one acquired and one closed down), but I was never particularly good at conventional social networking. I don’t enjoy cultivating followers, optimizing for engagement, or wondering how a post will perform.

Yet sometimes I want to share something and I want people to get a reasonable chance of finding it. Sure, I can start a blog or an X account (which obviously I have) but when I post something, usually nobody sees it or interacts with it.

So... I've built Cosmos47 - a public social feed that shows all posts chronologically. One feed that appears the same to all users, from all over the world. No algorithm or ranking people by popularity.

All posts are analyzed with AI and each post gets tagged with its language, topics, tone, format, length, location, and other characteristics. Readers can then filter the feed themselves (if they wish). The idea is distribution through relevance rather than popularity.

Full Disclosure The entire website was built using AI tools, including the frontend, backend, and much of the work required to make a client-rendered app accessible to search engines. The main platform was Base44, but I've used their MCP (with ChatGPT 5.6 Sol) and added a Cloudflare layer that returns crawler-readable public pages, metadata and sitemaps.

It’s still an early experiment. Most of the content currently on the platform is actually AI slop test content that I created to test multilingual feeds, filtering, moderation, embeds, search and indexing. I’m not trying to present this as an existing community and my next challenge is to attract real people who genuinely want to try it out.

I’d appreciate any feedback you want to share!

Comments URL: https://news.ycombinator.com/item?id=49083145

Points: 1

# Comments: 0

Article URL: https://blog.victorsilva.com.uy/aws-secrets-manager-terraform-least-privilege/

Comments URL: https://news.ycombinator.com/item?id=49083141

Points: 1

# Comments: 0

Article URL: https://visualgui.com/2026/07/28/using-ai-for-automated-tasks/

Comments URL: https://news.ycombinator.com/item?id=49083134

Points: 1

# Comments: 0

Article URL: https://galjot.si/what-ai-developers-could-learn-from-charles-bukowski

Comments URL: https://news.ycombinator.com/item?id=49083132

Points: 2

# Comments: 0

Article URL: https://specshield.io/

Comments URL: https://news.ycombinator.com/item?id=49083129

Points: 1

# Comments: 0

Article URL: https://github.com/asciimoo/hister/releases/tag/v0.17.0

Comments URL: https://news.ycombinator.com/item?id=49083110

Points: 2

# Comments: 0

Article URL: https://blog.zksecurity.xyz/posts/bron-bugs/

Comments URL: https://news.ycombinator.com/item?id=49083100

Points: 1

# Comments: 0

Article URL: https://arstechnica.com/tech-policy/2026/07/google-wont-give-up-odd-war-against-ai-web-scraping-despite-court-loss/

Comments URL: https://news.ycombinator.com/item?id=49083086

Points: 2

# Comments: 0

Hi HN — we built `dn` because coding got faster, but building software did not. Use the CLI to clear your backlog faster with reusable agentic workflows & other supporting commands. kickstart, meld, loop, land, fixup, and more commands can be used by you or your agent to turn markdown specification into implementation. Use the CLI in GitHub Actions overnight to durably handoff pull requests and github issues your team picks up in the morning.

For example:

```sh dn --agent codex kickstart --awp \ https://github.com/owner/repo/issues/123 ```

`dn` reads the issue and repository instructions, writes a named Markdown plan under `plans/`, asks the selected coding agent to implement it, and tracks the acceptance criteria. In AWP mode it creates a branch, commits, pushes, and opens the pull request.

You can install a dn skill for your agent. We currently support OpenCode, Claude Code, Cursor, Copilot, and Codex. The conversations you have with your agent are local to your machine. The `dn` skill helps record that context in Github issues and in your git repository as filesystem context. Productivity compounds when your team and the agents your team use share context.

The latest version adds Docker and exe.dev sandboxes for agent runs, remote progress reporting, and a clearer `meld` → `loop` → `land` workflow for splitting work across multiple sessions & developers. We'd love your feedback to make `dn` a better product, it's early days!

We also built https://denoise.cloud so product managers can build alongside `dn` users. Use denoise to short-circuit the software development lifecycle and unlock huge productivity gains for your team!. Our bet is that small teams do not need more dashboards or another proprietary agent. They need a clearer boundary between human judgment and machine execution.

See denoise in action at https://x.com/DenoiseCloud/status/2078607769259721016

Comments URL: https://news.ycombinator.com/item?id=49083082

Points: 2

# Comments: 0

Nearly half of people encounter a scam on their phone every single day. Malwarebytes is doing something about it.  

That figure comes from a 2025 Malwarebytes survey of 1,300 respondents across the US and Europe. The results paint a troubling picture. A quarter of the victims surveyed reported being harassed or blackmailed, while nearly one in five had private information exposed, and 15% lost money.  

“I felt like I was in a horror movie,” said one survey respondent. “I never thought it would happen to me like this.”  

Your phone is a scammer’s dream. You use it to bank, message, shop, and more. It’s an ideal gateway for anyone looking to take advantage of you. And today’s scams aren’t limited to just one app or program. They show up as texts and delivery notifications, as calls that spoof a trusted number, and as social media DMs. 

Increasingly, AI is making all of this much harder to detect. Malwarebytes research found that half of people feel unprepared for the sophistication of these AI-driven threats. Phone scams now rank among the top five scam types people encounter, according to Malwarebytes Scam Guard data.  

Part of the problem is misplaced trust. According to Malwarebytes’ data, roughly half of people—55% of iPhone owners and 50% of Android owners—said they believe their phone’s security is enough to keep them safe. But relying on those protections alone can leave people vulnerable. 

Malwarebytes detected more than 800,000 distinct strains of Android malware last year and expects that number to cross 1 million in 2026. 

Your phone needs more than just a lock screen to stay safe. That’s why we’ve rebuilt Malwarebytes Mobile Security. It puts scam protection first, and it’s backed by all our other tools to keep your phone secure. 

Built for today’s scams 

Here’s how Malwarebytes Mobile Security helps keep scams away from you and your data. 

Scam Guard is a free AI-powered tool built into Mobile Security for both Android and iOS. Got a suspicious text, email, phone number, link, or message? Drop it into Scam Guard and get an instant read on whether it’s a scam, along with guidance on what to do next.  

Text and Call Protection now catches significantly more junk and scam messages than before. Updated filtering that reviews shortened links more closely and flags suspicious content, like romance-scam language or unexpected money requests, before it reaches your inbox. Call Protection checks every incoming call against known scam and spam numbers, so you can block or flag them automatically instead of gambling on whether to pick up. It’s live now on iOS, with Android rolling out later this summer. 

Malwarebytes Digital Footprint Portal’s free scanner shows you which of your personal details—passwords, Social Security numbers, and more—are already exposed and offers straightforward steps to keep them safe. 

Trusted Advisor gives your device a Protection Score and recommends simple steps to strengthen your security, from adjusting settings and permissions to running a scan or updating your device. 

Expanded ad blocking on iOS now lets you filter Google Sponsored Ads in Safari—a browser that scammers frequently abuse to make fraudulent campaigns look legitimate. 

Android Junk Cleaner removes leftover files, temporary data, and outdated cache files that build up on your device over time. A cleaner, faster phone is easier to manage and gives you the space you need to install important security updates.

There’s more Here’s everything else Mobile Security protects you from: 

Our Malware Scanner (Android) scans for and removes malware and potentially unwanted programs, including screen lockers and adware. 

Real-Time Protection (Android) proactively defends against ransomware, PUPs, and phishing attempts in real time. 

Wi-Fi Monitoring (iOS) warns you when you connect to an insecure network so you can take action by turning on your VPN. 

Malwarebytes Privacy VPN keeps your browsing private with a fast WireGuard connection and a strict no-logs policy supported by diskless, RAM-only server infrastructure. 

Phone scams aren’t going anywhere, but protecting yourself doesn’t have to be complicated. Malwarebytes Mobile Security brings together the tools you need to recognize scams, protect your privacy, and keep your phone safer, all in one app. 

Download Malwarebytes Mobile Security for iOS or Android and use your phone with more confidence. 

Reddit users found that by using a specific Google search query, it was possible to find Claude conversations that users had shared.

This exposed sensitive material, including crypto wallet keys, names, addresses, work notes, and even erotic or otherwise policy-violating chats. Fortune says Anthropic appears to have fixed the Google indexing issue, but the shared links themselves were still live for people who already had them.

The exposure was tied to Claude’s Share feature, which creates a public web link to a snapshot of a conversation rather than leaving it inside a user’s private account. Reddit users found a search query that surfaced many of these shared chats, plus Claude Artifacts (interactive documents, apps, and other content created by Claude) in Google results. Wired reports that this is still true for Bing.

The main risk is that people use chatbots to think through work, health, legal, or personal matters without realizing that a shared link can behave like ordinary public web content.

This isn’t unique to Claude. We’ve previously seen Grok chats show up in Google search results, and Meta AI conversations can also become public by design. We have also written about the share option in ChatGPT that was swiftly removed after users unintentionally made thousands of conversations searchable.

Anthropic says Claude chats are private by default, and only conversations users explicitly chose to share were affected. But the incident is a reminder that a “share” button on an AI chat can be more like publishing than messaging, especially if search engines can discover the resulting URL.

How to stay safe

The easy way out here is not to share your AI chatbot conversations with anyone, because you could end up reaching more people than you intended.

That’s because it’s harder to stop pages from being indexed than you might expect. And you don’t have those controls in your hands. The AI provider should take care of that.

But there are a few things you can do:

• Don’t share Personally Identifiable Information (PII) with a chatbot, so that if a conversation is ever exposed it can’t be easily linked back to you.
• To review or stop sharing conversations in Claude, go to Settings > Privacy > Shared chats.
• If you’re using an AI service from a social media company, such as Meta AI, Grok, or Gemini), remember that your conversations could be tied to your account—which might contain a lot of personal information.
• When using AI, make sure you understand how to keep your conversations private. Many services offer temporary or incognito chats that aren’t saved to your history, but they aren’t a guarantee against bugs, leaks, or data breaches. Only use the share feature when you’re comfortable with anyone potentially seeing that conversation.
• Read the privacy policy so you understand how your conversations are stored and shared. If it’s too long, you can always ask an AI to summarise the important points.

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

Apple has shipped a hefty round of July security patches, headlined by iOS/iPadOS 26.6, macOS Tahoe 26.6, and Safari 26.6, with dozens of vulnerabilities squashed across kernel, WebKit, media frameworks, and core apps. These updates are primarily about improving security rather than adding new features, and users should install them as soon as possible.

Updates for your particular device

The table below shows which updates are available and points you to the relevant security content for that subject.

iOS 26.6 and iPadOS 26.6iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and latermacOS Tahoe 26.6macOS TahoemacOS Sequoia 15.7.8macOS SequoiamacOS Sonoma 14.8.8macOS SonomatvOS 26.6Apple TV HD and Apple TV 4K (all models)watchOS 26.6Apple Watch Series 6 and latervisionOS 26.6Apple Vision Pro (all models)Safari 26.6macOS Sonoma and macOS Sequoia How to update your Apple devices How to update your iPhone or iPad

For iOS and iPadOS users, here’s how to check if you’re using the latest software version:

Go to Settings > General > Software Update. You will see if there are updates available and be guided through installing them.

Turn on Automatic Updates if you haven’t already—you’ll find it on the same screen.

How to update macOS on any version

To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:

• Click the Apple menu in the upper-left corner of your screen.
• Choose System Settings (or System Preferences on older versions).
• Select General in the sidebar, then click Software Update on the right. On older macOS, just look for Software Update directly.
• Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these instructions.
• Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process).
• Make sure your Mac stays plugged in and connected to the internet until the update is done.

How to update your Safari browser

Safari updates are included with macOS updates, so installing the latest version of macOS will also update Safari. To check manually:

• Open the Apple menu > System Settings > General > Software Update.
• If you see a Safari update listed separately, click Update Now to install it.
• Restart your device when prompted.

If you’re on an older macOS version that’s still supported (like Sonoma or Sequoia), Apple may offer Safari updates independently through Software Update.

Technical details

Among the more interesting vulnerabilities patched in this update are CVE-2026-43818 in ImageIO,  CVE-2026-43776 in AppleDouble, and CVE-2026-64763 to 64766 in SceneKit.

Although found in different applications, these vulnerabilities have one thing in common. Their descriptions say:

“Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.”

The identical “processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution” language is not a coincidence. It’s Apple’s standard impact boilerplate for file‑parsing bugs across multiple frameworks, including ImageIO, AppleDouble, and SceneKit. The similarities reflect shared exploitation patterns (untrusted file input hitting native parsers), while the differences lie in what each framework does and which file types/contexts are affected.

ImageIO is the system framework responsible for reading and displaying image formats such as JPEG, PNG, TIFF, RAW, GIF, and other formats. It’s used throughout iOS and macOS by apps including Photos, Safari, Messages, Mail, and Preview.

SceneKit is a 3D graphics and scene graph framework used for rendering models, animations, and complex 3D scenes in apps and games on Apple platforms. It parses scene description files and 3D assets and turns them into renderable content.

AppleDouble is something macOS uses behind the scenes to keep extra file information like icons and other Finder details in cases where your files live on certain types of disks or servers. When Apple mentions “AppleDouble” in security notes, it’s talking about the code that reads and writes that hidden metadata, particularly when files are stored on network drives or shared with non‑Apple systems.

Apple’s advisories reuse a standard warning for any memory‑corruption bug in a file parser: the best‑case outcome is just a crash, the worst case is someone running their malicious code on your device. ImageIO, AppleDouble, and SceneKit all sit in that same danger zone. Although the file types are different, they all present the same underlying risk.

Until you’ve installed this update, it’s an even worse idea than usual to open unsolicited messages and emails with images in them.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Red teams can harness the power of LLMs for penetration testing. From session analysis to payload crafting, discover five ways AI transforms security testing.

The company claims MAI-Cyber-1-Flash tops Anthropic’s Mythos and OpenAI’s GPT-5.6 Sol in CyberGym testing.

The post Microsoft Unveils MAI-Cyber-1-Flash, Its First Cybersecurity AI Model  appeared first on SecurityWeek.

A prayer app launched by Pope Francis in 2019 contained a security flaw that exposed the personal information of hundreds of thousands of users before it was finally fixed this year.

The app, Click To Pray, was developed by La Machi Communication for Good Causes for the Pope’s Worldwide Prayer Network. Pope Francis endorsed the service and had an account on it. The app offers a “digital community of prayer” by guiding people through three prayers each day.

In January this year, independent researcher BobDaHacker discovered a flaw in the app’s API endpoint. An API is an online service that responds to requests for data. Typically, only the mobile app should send such requests, and the API should only return information about the specific person using that app. However, BobDaHacker found it was giving out information about any of the app’s users to anyone who asked.

Apps typically query an endpoint by sending it a specific ID for the person using it. In this case, those IDs were simply sequential numbers. According to BobDaHacker, there were 719,517 registered IDs for the app, meaning over 700,000 users had information stored in the system.

The problem was that the API didn’t check whether someone requesting a record was actually authorised to see it. Anyone could request information for any ID, from 1 through to 719,517. The API would then return that user’s record, including:

• Email address
• First and last names
• Country
• Date of birth

This kind of flaw is known as an Insecure Direct Object Reference (IDOR) and we’ve seen it before. Stalkerware-type app TheTruthSpy was found leaking details on its victims via an IDOR vulnerability in 2022, and it still hadn’t been fixed two years later. The web server for the MiCODUS MV720 vehicle-tracking GPS device also had the vulnerability in 2022, putting 1.5 million people at risk.

A second flaw in the Click To Pray API made things worse. When people register with an app, the service typically sends a link to their email address containing a unique code known as a validation hash. Clicking the link proves they have access to that inbox and therefore own the email address they registered with.

Unfortunately, the Click To Pray API also returned the validation hash in its response when someone clicked the verification link. These responses are easy to inspect using a web browser’s developer tools, meaning an attacker could register an account using an email address they didn’t control and verify it before the real owner even saw the verification email.

Six months, nine contacts, zero replies

BobDaHacker first reported the bug on January 3, 2026, eventually emailing nine addresses spanning the Click To Pray service, the Pope’s Worldwide Prayer Network, and a general information address. They got no response. It was only fixed more than six months later after the researcher contacted a journalist, who filed a query with the Vatican.

Responsible disclosure only works when the recipient has a functioning intake process. Nine unanswered emails were a strong signal that no such process existed.

Not the first security flaw in a Vatican app

This isn’t the first security flaw involving a Vatican app. In 2019, UK firm Fidus Information Security found a flaw in the app for the Vatican’s Bluetooth eRosary device. It didn’t use a conventional password for logins. Instead, users entered their email address and the app sent a four-digit PIN to that address. They then entered the PIN to log in.

However, when the user entered their email address, the app also returned the PIN in plain text in its web response. That enabled an attacker to take over anyone’s account simply by inspecting the response.

That flaw was similar to the account verification issue that BobDaHacker discovered more than six years later. Although the incidents involved different apps, they show how the same type of security mistake can reappear years apart.

BobDaHacker also noted that Vatican City State introduced its own data protection regulation, Decree No. DCLVII, on April 30, 2024. The regulation requires appropriate safeguards for personal data. However, it’s not clear whether it applies directly to Click To Pray or the organisations that operate it.

What users can do now

Thankfully, someone on the Vatican side has now fixed the flaws, but the vulnerability meant that user data was exposed for a long time. If you registered an account, assume your email, name, date of birth, and country are potentially in circulation. Watch for phishing that references the app, and be especially skeptical of messages claiming to come from Vatican-affiliated services asking you to click, verify, or log in.

This is particularly important because BobDaHacker also reported that emails from the service failed standard email authentication checks. These checks help receiving email providers verify that a message really came from the domain it claims to represent. According to the researcher, this could make it easier for phishing attackers to impersonate the organisation.

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

SCAN NOW

Article URL: https://www.technologyreview.com/2026/07/27/1140668/building-the-enterprise-environment-for-agentic-ai/

Comments URL: https://news.ycombinator.com/item?id=49082086

Points: 1

# Comments: 0

Tal Kollander’s history divides neatly into two halves: first as an active hacker and then as the block that stops hacks.

The post Hacker Conversations: Tal Kollander’s Journey From Black Hat to Hack Blocker appeared first on SecurityWeek.