A US citizen faces federal charges after his GrapheneOS phone auto-wiped during an airport search, in what privacy advocates call an attempt to criminalize a built-in security feature; an investigation traces a black market reselling stolen LLM API keys as deep-discount tokens; and a new paper finds cross-disciplinary diffusion of scientific ideas has been declining for four decades as research language grows more specialized

Hacker News

An Inside Look at the Relay Market Powering Token Resellers and Fraud

A relay market has emerged, mostly based in China, where resellers offer deeply discounted access to LLM APIs — sometimes 97% below official pricing — by pooling credentials obtained through free-trial abuse, chargeback fraud, and unprotected or stolen API keys. The relays run on open-source gateway software, mainly "one-api" and its fork "new-api," which load-balance requests across the aggregated credentials, making the underlying infrastructure technically neutral even as it's exploited for abuse. Buyers range from cost-sensitive developers seeking cheap inference to state-backed model-distillation operations — described as a multi-billion RMB industry chain — training domestic models on frontier LLM outputs; tracked relay and price-comparison sites see roughly 3.6 million monthly visits. Simon Willison, who amplified the investigation (also discussed on Hacker News at 193 points, 120 comments), argues LLM vendors need much stricter per-key spending caps, since the mere existence of this ecosystem means any unprotected endpoint or leaked key will eventually be found and monetized — forcing providers and app builders alike to raise their baseline defenses around account creation, spend-anomaly detection, and key rotation.

Hacker News

We Have Proof Automation Now

Adam Langley describes using an LLM, combined with proof irrelevance, to automatically discharge a formal proof for a Zstandard decompressor written in Lean — specifically a proof about the FSE table-construction algorithm verifying state validity — in roughly 20 minutes of machine time, a task that would traditionally demand deep specialist intuition. The post, which drew 165 points and 53 comments on Hacker News, frames this as a genuine inflection point: projects like seL4 historically spent about ten times as much effort on proofs as on the underlying design and implementation, and earlier automation via SMT solvers still required developers to build near-intuitive knowledge of solver quirks. What's different now is that an LLM can absorb that intuition-building burden itself, making dependent-type-style formal verification look "dramatically more practical" for everyday systems code — not just isolated formal-methods research — which matters directly for anyone trying to get real correctness guarantees on foundational, widely-depended-upon libraries like compression codecs.

Hacker News / Lobsters

PGSimCity: How PostgreSQL Works, in 3D

PGSimCity is an interactive 3D visualization that renders PostgreSQL's internal architecture as a SimCity-like world, turning abstract database mechanics — query execution, buffer management, write-ahead logging, and vacuum — into a navigable, game-like environment rather than a documentation page. The project's appeal lies in externalizing internals that are normally hard to build a mental model for: instead of reading about how WAL or the buffer pool works, you watch it happen as a small, visual, interconnected system. It was the top story on Hacker News today (581 points, 57 comments) and was cross-posted to Lobsters, reflecting a broader developer appetite for creative, intuition-building ways to understand the systems software they depend on every day, beyond what prose explanations or architecture diagrams typically deliver.

Hacker News / Lobsters

What Does GitHub's Security Team Even Do?

This piece uses a case study of malware-repository proliferation to argue GitHub's security response is largely reactive rather than proactive: the author shows thousands of malware-distributing repos are trivially discoverable through basic searches, and that after GitHub deleted roughly 10,000 repos following public exposure of the problem, no further systemic action followed — new malicious repos kept evading detection for months afterward. Rather than describing internal processes directly, the piece exposes what a large platform security team's day-to-day actually looks like when squeezed between scale, resource constraints, and reactive incident response, even backed by Microsoft's resources. It drew 107 points on Hacker News and was also discussed on Lobsters, reflecting engineer interest in a rare, unvarnished look at the gap between security ambitions and operational reality at scale — a sharper picture than the polished narratives typically found in postmortems or bug-bounty announcements.