Writing by hand is good for your brain

<a href="https:&#x2F;&#x2F;littletech.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;littletech.org&#x2F;</a><a href="https:&#x2F;&#x2F;static.politico.com&#x2F;4a&#x2F;bf&#x2F;9c4021d8404386b0a311dcccf0e5&#x2F;lta-open-weight-ai-letter-7-22-26.pdf" rel="nofollow">https:&#x2F;&#x2F;static.politico.com&#x2F;4a&#x2F;bf&#x2F;9c4021d8404386b0a311dcccf0...</a>

Startup founders urge U.S. government not to shut off Chinese open weight AI

AI Companies Are Trying to Hide a Staggering Amount of Debt

I’ve been a NameCheap customer for 13 years. I’ve also helped out an old college club paying for a .com they use (that is registered to me under my name, address, and phone number). During a recent leadership transition, the incoming club lead wanted to make changes to the DNS and didn’t know to contact me. They figured out the domain name was parked at NameCheap, so they initiated a password reset using the domain name. I got a password reset email and immediately filed a NameCheap support ticket saying “I did not initiate this”. They called me to verify I was the one who filed the ticket, and then followed up with a canned email with tips like check your anti-virus.The incoming club leader was persistent though, and called NameCheap support. He convinced them the domain registered in my name and address really belonged to his club, and with no verification or validation whatsoever, NameCheap changed my password, and changed the email address associated with my account. All because someone simply asked nicely on a phone call.Meanwhile in the background, someone advised the new club leader who I was and we were able to connect and get things transferred over. Ultimately I was happy to give them access or even ownership if they wanted (student club turnover being what it is, it’s likely a domain doesn’t get renewed and gets gobbled up by a squatter, which is why I was keeping it current for them).But NameCheap had no way of knowing any of this. As far as NameCheap was aware, this was a personal account of mine. They demonstrated they were perfectly able to pick up a phone and call me (to verify my initial support ticket) but when someone calls them and says “but I really want access to that account” they don’t bother?I’d hesitate to even call this social engineering. It’s clearly a massive vulnerability. I’ve already moved a dozen of my most critical domains out of NameCheap after seeing just how easy it is for a third party to completely take over a NameCheap account: just ask nicely.

Tell HN: Namecheap gave my account to an unverified third party

What happened to TheNumbers.com

Software rendering in 500 lines of bare C++

Astronomers may have found the first exomoon

The arguments against open source AI are bad

I’ve been building Echo (<a href="https:&#x2F;&#x2F;echo.tracerml.ai&#x2F;" rel="nofollow">https:&#x2F;&#x2F;echo.tracerml.ai&#x2F;</a>), an experiment in making one AI system out of a pool of open-weight models rather than choosing a single model and using it for every task.It started with a simple experiment. I took a group of models, including GLM-5.2, Kimi K2.7 and others, and ran them on the same evaluations. Then I measured what would happen if, for each problem, you somehow knew in advance which models would be useful and how their outputs should be combined.That hypothetical system performed substantially better than any individual model in the pool. Of course, it is not something you can actually deploy because it relies on knowing which decisions were good after seeing the result. Echo is my attempt to recover some of that advantage without having that information in advance.For each request, Echo decides how much computation to allocate, which models should participate, and how their work should be combined. Some prompts may only need a relatively small amount of inference, while others benefit from multiple models working on different parts of the problem.One thing that surprised me while building it was how complementary the models are. A model that is clearly weaker overall can still be extremely useful on particular problems or as part of a combination.On my first evaluation mix, Echo consistently performed better than the best individual model in its pool. It also reached roughly the same aggregate result as Fable, which I used as one of the stronger comparison systems, at around one third of the inference cost.There are still some cases where Echo makes the wrong allocation or combination decision. I’m currently spending a lot of time understanding those failures, as well as testing whether the same approach holds up on coding and agentic tasks where measuring the quality of each decision becomes much harder.I built a chat interface (echo.tracerml.ai) and an OpenAI-compatible API (<a href="https:&#x2F;&#x2F;echo.tracerml.ai&#x2F;docs&#x2F;api" rel="nofollow">https:&#x2F;&#x2F;echo.tracerml.ai&#x2F;docs&#x2F;api</a>) so the system can be tested outside the evaluation setup.Here is a short&#x2F;high level video on how it works: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=lJFJSvOdXhg" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=lJFJSvOdXhg</a>I wrote up the evaluation methodology, individual model results, costs and current limitations here: <a href="https:&#x2F;&#x2F;echo.tracerml.ai&#x2F;eval" rel="nofollow">https:&#x2F;&#x2F;echo.tracerml.ai&#x2F;eval</a>I would love for you to try it! Especially if you hit any weird failure cases or places where the allocation looks unintuitive.

Show HN: Echo – Fable-level results at 1/3 the cost using open-weight models

Learn OpenGL, extensive tutorial resource for learning Modern OpenGL

DARPA, U.S. Air Force fly AI-controlled F-16

Why Software Factories Fail (or: harness engineering is not enough)

Fields Medals 2026

Building on ATProto

The Beam Engine

Hi HN, we are Marcos and Harrison, cofounders of Palmier (<a href="https:&#x2F;&#x2F;palmier.io">https:&#x2F;&#x2F;palmier.io</a>). We are building Palmier Pro, an open source macOS video editor, with built-in AI generation and a local MCP server that connects to your agent. Here are a few demos:- Making some AI transitions: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=hbM_-eR1GX4" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=hbM_-eR1GX4</a>- Multicam editing with Codex: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=SjS2q2LT1q8" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=SjS2q2LT1q8</a>- Cutting long form clips into shorts: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=PR66eN2ouuQ" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=PR66eN2ouuQ</a>We built Palmier Pro as an internal tool when we were making AI launch videos for other startups. The main problem it solved in the beginning was the back-and-forth between AI generation platform and video editor. The iteration loop was awkward: AI videos → download → import to editor → edit → realize we need to change the AI video → repeat. So we built a minimal video editor where we could let Claude generate AI videos inside the editor.As we gave more and more tools to the agent, we wanted to push to see what else agents can do in the video editing space. So today, your Claude&#x2F;Codex can:- Manage projects inside Palmier Pro- Import media from a public URL or filesystem to the project, and organize them in folders- Search media (by embedding footages using SigLIP2 running locally)- Edit the timeline (tracks&#x2F;clips&#x2F;keyframes operations)- Generate images, videos, sound effects, captions, music- Export videosThere are two ways for LLMs to interact with the editor: by connecting to the local MCP server, or using the in-app chat. Both use the same tools and APIs exposed by the video editor.We have seen people using MCP server to connect to their own workflow to automate massive-scale video editing (e.g. given this same podcast style, replicate it with other footages that I have). We have also seen people using the in-app chat where it lives closer to the editor UI, with lower latency for faster iteration.We don&#x27;t believe that AI is going to replace human creativity (nor should it), but where it can really help is in automating the gruntwork in video editing. Most work in the editing workflow is more mechanical than creative. Our vision is to build a video editor where AI can enable more individuals to create.Throughout our experiments, AI is not very good at creative editing, but given a pattern (transcription-based, beat-based), it can do a decent job at rough cut.We built Palmier Pro in Swift as an MVP because we wanted better performance and minimal dependencies (no nodejs&#x2F;webview), with some native macOS APIs like SpeechAnalyzer and CoreML for us to run some models locally. We use SpeechAnalyzer for local transcriber, SigLip2 to embed video frames, beat_this for beat detection, Silero VAD for silence detection, all running locally. The tradeoff is that we don&#x27;t support Linux or Windows at the moment.Palmier Pro is open source and free to try out (macOS 26 only at the moment, though - we&#x27;ll support more platforms over time, but for now are focusing on iterating the core product).No login required except for the AI generation features, which route requests to our backend. We are offering free credits on sign up so you can try out the AI generation as well.We&#x27;d love to hear your feedback!

Show HN: Palmier Pro – Open-source macOS video editor built for AI

98.css

Learn WebGPU for C++

hey HN, Jonathan and Guy here, creators of OneCLI (<a href="https:&#x2F;&#x2F;onecli.sh&#x2F;">https:&#x2F;&#x2F;onecli.sh&#x2F;</a>). OneCLI is an open source vault for AI Agents.Traditional vaults are used to store your secrets and, on demand, provide them to you all in a secure way, trusting the person to keep them safe. We figured that in the agent&#x27;s world, this is not the case, as you don&#x27;t know what happens with the secret after it&#x27;s delivered to the agent, or where it was saved. Or maybe someone even manipulated them to hand them over...From that understanding, we decided to build a network gateway that sits between your AI agents and the services they call. OneCLI matches the request by host&#x2F;path, verifies the agent should have access, swaps the placeholder for the real credential, and forwards the request. 
the secrets set inside the OneCLI vault, encrypted on rest, or could fetch in realtime from your bitwarden &#x2F; 1password wallets.Demo - <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=5e5pbPEzZfY" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=5e5pbPEzZfY</a>.We started working on this by accident, even though our careers were in the security space. We were working on a devtool called ChartDB, an open-source DB tool. When OpenClaw took off back in January, we started using it to orchestrate agents on top of ChartDB. We quickly understood there is a big issue around auth. Agents need credentials to do real work, but to give them those secrets would not be the best idea. they keep them in their memory and also write them down to local files and their sessions as plain text. And we knew that agents can easily be fooled into giving up those API keys&#x2F;secrets. So we needed some way to control the agent and stop prompt injections from tricking it into using its services for an attacker&#x27;s benefit. Not providing the keys to the agent + adding alerts or human-in-the-loop for sensitive operations, in case someone manipulates the agent, and access logs are being audited.We use it ourselves daily. My OpenClaw runs my day across Attio, Gmail, and my calendar, with human-in-the-loop approval on sensitive actions. The approval is enforced at the network layer, so it holds whether the agent goes through MCP, CLI, curl, or code it wrote on the fly. Guy uses it to review PRs but can&#x27;t merge without his approval.Companies mostly use it for coding agents currently, which get creative about finding ways to elevate their permissions to reach the goal. With OneCLI, it doesn&#x27;t matter what the agent finds: if the request isn&#x27;t in policy, it will not go through.The proxy is written in Rust, the dashboard is Next.js, and secrets are AES-256-GCM encrypted at rest. Everything runs in a Docker container. It works with any agent framework (Claude Code, Codex, Cursor, OpenClaw, Hermes or anything that can set an HTTPS_PROXY).It won&#x27;t stop an agent from misusing access it legitimately has, so scope policies tightly!happy to answer anything. We believe we can&#x27;t trust the model to behave and have to set deterministic rules to stay in control. Comments welcome!

Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents

A solid-state “atomic channel” for separating rare earth elements