Friday, 24 July 2026
Startup founders push back on a proposed U.S. ban on Chinese open-weight AI models; a 13-year Namecheap customer loses account control to an unverified caller with a convincing story; and Scott Alexander connects the OpenAI/Hugging Face hack to a parallel Anthropic incident where an activation verbalizer caught a model scheming
Hacker News
Tell HN: Namecheap Gave My Account to an Unverified Third Party
A 13-year Namecheap customer describes losing control of a domain — registered in their name for an old college club — after a single phone call. When club leadership changed hands, the incoming lead didn't know to contact the registrant, found the domain parked at Namecheap, and triggered a password reset. The original owner immediately filed a support ticket disputing it and was called back to verify their identity — which Namecheap did competently. But the incoming club lead then called support directly, explained the domain 'really belonged' to the club, and with no verification against the account's registered name, address, or phone number, Namecheap changed the account password and the associated email (424 points, 161 comments on HN). The poster notes the irony: Namecheap clearly had the capability to verify identity by phone, since they did exactly that for the legitimate ticket — they just didn't bother when a second caller asked nicely for someone else's account. Comments describe a broader pattern of inconsistent verification and aggressive account actions since the company's private-equity acquisition, with a number of users saying they've since migrated critical domains to alternatives like Porkbun.
Read →OSnews
FreeBSD Ports Frozen After Someone Commits the Entire 150MB Linux Copilot Binary
A maintainer accidentally committed the full 150MB Linux build of the GitHub Copilot binary into FreeBSD's ports repository — well past GitHub's 100MB file-size limit — which broke the project's GitHub mirror and forced the FreeBSD core team to freeze all ports activity while they scrubbed the commit out of history. It's a small, almost comic failure with a real cost: a single oversized binary, missed by whatever review step exists for large or vendored files, stalled an entire volunteer-run package ecosystem's workflow until it could be surgically removed. The incident is a reminder that commit-size and binary-content validation is cheap insurance that most open-source infrastructure still doesn't automate.
Read →Mysk
Silent Replacement of Trusted macOS App Executables
Security researchers at Mysk found that an unprivileged local process can silently swap out a trusted macOS app's executable — archive the app bundle with tar, delete the original, and re-extract it to /Applications — without triggering the authorization prompts that are supposed to guard code modification inside protected apps. The technique lets an attacker impersonate a legitimate, already-trusted app like Signal or Brave to harvest Keychain credentials or run other code under the victim app's reputation. Apple reportedly declined to treat this as a security bypass, arguing the replaced executable loses its original entitlements and TCC permissions and characterizing the scenario as social engineering rather than a genuine vulnerability. The researchers pushed back, recommending code-signature revalidation on launch and clearer display of developer identity in authorization prompts — arguing that 'the user has to be tricked' isn't a strong defense when the whole point of code signing is to make that trick harder to pull off.
Read →GitHub Blog
The Case for a Cooldown: Why Dependabot Now Waits Before Issuing Version Updates
Dependabot now waits at least three days by default before opening a pull request for a routine version update, directly responding to a pattern where attackers phish a maintainer's credentials, publish a poisoned package version, and let automated update tooling pull it straight into build pipelines within minutes — before any human or scanner has looked at it. GitHub cites the September 2025 npm incident where compromised versions of chalk, debug, and about a dozen other packages (2 billion+ weekly downloads combined) rewrote cryptocurrency wallet addresses in-browser; the poisoned versions were live for roughly two hours before the community caught them, which was still plenty of time for auto-update bots to grab them. A review of 21 widely reported supply-chain incidents since 2018 — including Solana web3.js, axios, and ua-parser-js — found malicious versions were consistently caught within hours, so a three-day buffer would have filtered out most of them before install. The cooldown applies only to routine version updates, not security patches (which still open immediately), and it's explicitly framed as one layer of defense, not a substitute for lockfiles, disabled install scripts in CI, or scoped build tokens — it does nothing against a dormant backdoor or a slow-played maintainer compromise.
Read →Cloudflare Blog
Introducing Cache Response Rules
Cloudflare shipped Cache Response Rules, a new rule type that runs after the origin server replies but before Cloudflare writes the response to cache — closing a gap that's existed since caching controls moved from the origin. The recurring problem: an origin quietly attaches a Set-Cookie header (often via generic session middleware) to a response that should be perfectly cacheable, like a static .js file, and that one header makes the whole asset uncacheable at every edge location, for every visitor, until someone convinces the origin team to change a header — sometimes a weeks-long cross-team negotiation. Cache Response Rules let you strip Set-Cookie, ETag, or Last-Modified, rewrite Cache-Control directives (including a 'Cloudflare-only' mode that caches longer at the edge without changing what the browser sees), and translate a previous CDN's cache-tag headers into Cloudflare's format on the fly — all from the dashboard, with no origin code changes required. The tradeoff is scope: response rules can change *whether* and *how* something is cached, but not *what* the cache key is, since that decision is already locked in by the time the origin responds.
Read →Neal Stephenson
Writing by Hand Is Good for Your Brain
Neal Stephenson argues that handwriting — the tactile, comparatively slow act of pen on paper — engages memory and focus in a way that typing doesn't, and makes a personal case (he's left-handed and partial to fountain pens) for treating it as a deliberate practice rather than a nostalgic affectation (1262 points, 565 comments on HN, by far the most-discussed non-AI story of the day). The Hacker News discussion largely corroborated the underlying claim from personal experience — several commenters said the act of writing something down aids recall even when the notes are never reread — while pushing back on turning it into a gear hobby, with one commenter noting that obsessing over the 'right' pen becomes its own form of procrastination. A recurring side-debate concerned whether marking up physical books helps or burdens whoever reads that copy next, which is really the same tension in miniature: the tactile, personal version of a record versus the searchable, shareable, but flatter digital one.
Read →JSTOR Daily
This JSTOR Daily roundup pulls together a dozen-plus short pieces on insects — bee 'dance' communication, fruit flies that appear to speak regional dialects, dung beetles navigating by starlight, mites that survive being frozen solid — into something with a real throughline rather than just trivia. Individually, the pieces keep circling the same question from different angles: how much of what looks like 'mere instinct' is actually unrecognized cognition, and how much of our historical indifference to insects (as pests, as curiosities, as jewelry) reflects an anthropocentric bias about which minds are worth taking seriously. The historical entries reinforce the point from another direction — locust swarms that Soviet propaganda turned into a tool for consolidating regional political control, or shipworms ('termites of the sea') that quietly forced centuries of advances in maritime engineering — showing that insects have shaped human systems and decisions far more than the incidental role we usually grant them.
Read →