Today’s Highlights#

Start with the simplest ask of the day. Don’t paste the AI, please argues that when someone asks you a question, they want your judgment — your context and taste — not a wall of generic model text. That thread of agency runs through the rest of the front page. A shopping site’s silent audio graph keeps Bluetooth headphones from switching back to your phone; GitHub explains how a surge in commits pushed its capacity over the edge; and the same act of scraping draws wildly different legal outcomes depending on who does it. In parallel, the web platform quietly reclaims lightweight interaction, a tiny piano model learns to finish your phrase on-device, and brain scans catch what happens when a liked clip plays to the end. Read on by topic.

Tech and Products#

When platform power grows quietly, what should be visible, local, and auditable.

AliExpress and silent WebAudio fingerprinting: the inaudible graph that blocks your headphones#

According to Laserphile’s write-up in AliExpress and silent WebAudio fingerprinting, the AliExpress homepage creates two running WebAudio graphs (the browser’s sound synthesis and processing interface) a few seconds after load. A sawtooth oscillator generates and analyzes a waveform, routed through a zero-gain node to the audio destination — silent to you, but enough for the system to treat the page as playing. Combined with canvas, WebGL, font and behavioral signals and hidden inside heavily obfuscated Alibaba security scripts, it contributes to a browser fingerprint used for fraud and marketing. The author shows that blocking two script families with uBlock Origin prevents the graphs from appearing while the store still renders, and that muting the tab does not help because there is no media element to mute. The digest’s reading is that the harm is concrete rather than abstract: multipoint headphones stay tied to the PC. On Hacker News, top comments debated whether browsers should light the speaker icon or prompt for audio-graph access, noted silent audio is also used to keep tabs alive on mobile, and argued the broader fingerprinting battle is hard to win without leaner web defaults.

Discussion: Hacker News thread

HTML Can Do That: native tags reclaim lightweight interaction#

In HTML Can Do That, Chris Burnell catalogs dynamic behavior now possible without JavaScript — popover with popovertarget, the dialog element for modals, details/summary, and the newer command/commandFor pair — with copyable snippets and Can I Use links. Built in an hour for HTML Day 2026 and updated on August 20, the page notes browsers now handle z-index, focus and Esc dismissal for you, but warns that accessibility support for several features still lags and should be made robust. Our take: this is less about novelty than maintenance — reducing glue code for common patterns. The thread drew out NoScript users welcoming a lighter path away from single-page apps, a long subthread about whether tables should be natively sortable via sortable and sortkey attributes, and pragmatists noting server-rendered links with sort parameters already do the job without a framework.

Discussion: Hacker News thread

Malicious Rust crate Arrayref runs a build-time payload: when compiling is enough#

As detailed by SafeDep in Malicious Rust crate Arrayref runs a build-time payload, a compromised release arrayref 0.3.10 appeared on crates.io on August 20, adding a dependency on a typosquat proc-macro1 (not the real proc-macro2). Older releases 0.3.5 through 0.3.9 were yanked to nudge users toward the malicious 0.3.10. The payload lives in the build script of proc-macro1 1.0.107: it reassembles a base64-encoded host, downloads an architecture-specific binary over TLS that accepts any certificate, and runs it detached — /tmp/rust-setup on Unix, and a hidden PowerShell plus VBScript launcher on Windows. proc-macro1 itself is a renamed copy of proc-macro2 with forged author metadata and added base64, rustls and ureq build dependencies. The crates have since been removed and a RustSec advisory filed. The digest notes a single manifest line is enough to execute code at build time, even when the crate’s library source looks ordinary. Commenters focused on how widely arrayref spreads via transitive deps like tiny-skia and winit, the scale of downloads, and the need to pin versions and audit build scripts.

Discussion: Hacker News thread

Business and Platforms#

When volume doubles in months, capacity assumptions get stress-tested.

The August 17 outage, and the work ahead: GitHub’s postmortem on a capacity-driven failure#

According to CTO Vlad Fedorov in The August 17 outage, and the work ahead, GitHub was down for 7 hours and 47 minutes on August 17 when a critical component in the Central US data center failed to scale with a new traffic peak, rippling into authentication, Actions, APIs and Copilot. Recovery was staged, with Copilot retry storms prolonging the tail. The post says monthly commits grew from 1.4 billion to 2.9 billion since April — a contextual figure, not an excuse — and lists more than 3 million CPU cores and 120 petabytes of fast storage added, with about 58% of platform load now on Azure. The next milestones include linear read scaling for the largest monorepos and consistent retry limits, budgets and variable timeouts to avoid cascading load. The thread’s main split was whether to read the growth primarily as AI-generated volume; several readers argued the load matters regardless of quality and that the right lens is pushes, Actions and fetch patterns, with some enterprise users blaming a lack of tiering and limits.

Discussion: Hacker News thread

Policy and Governance#

The same verb, two subjects, two outcomes.

Aaron Swartz was prosecuted for scraping, while Meta does it without consequence: the justice contrast that keeps resurfacing#

Blogger Curious Quail, in Aaron Swartz was prosecuted for scraping, while Meta does it without consequence, juxtaposes RSS co-creator Aaron Swartz — charged after downloading about 70 GB from JSTOR and later taking his own life — with reporting that Meta torrented more than 80 TB of pirated books to train models, now facing civil litigation that may end in a financial settlement. The source cites Politico and Ars Technica, framing Swartz’s motive as archival dissemination versus fueling proprietary models. The digest treats the contrast as an articulation of perceived selective enforcement rather than a settled legal parallel. On Hacker News, the consensus was that the U.S. government pursued Swartz where JSTOR had not pressed civil claims, with many citing prosecutor Carmen Ortiz and MIT’s role; others drew analogies to corporate legal resources and economic leverage, debating why equal rules yield unequal risk.

Discussion: Hacker News thread

Science and Research#

Small, on-device models you can hear, and brain signals you can see.

I trained a 125M model to autocomplete piano on-device: a compact, local creative tool#

In I trained a 125M model to autocomplete piano on-device, the author describes a year-long effort to build a 125M-parameter transformer that autocompletes piano performance in real time at about 108 notes per second on an iPhone 15, shipped as the free RollTab app. The write-up centers on MIDI representation — MIDI (a format that stores note events, not audio waveforms) — factoring NOTE_ON/NOTE_OFF/TIME_SHIFT to keep vocabulary tractable, aggressive data cleaning, and DPO post-training. Demos include Pallet Town, Terra’s Theme and Für Elise with 8- to 16-note prompts. Our reading: the value is not scale but locality — low latency and no cloud round-trip for a tactile task. Commenters swapped MIDI nostalgia from dial-up downloads to the Microsoft GS Wavetable canyon.mid, discussed how the Für Elise continuation feels unsettling precisely because it diverges, and noted MIDI’s staying power as a protocol.

Discussion: Hacker News thread

As summarized by RathBiotaClan from a NeuroImage paper, Watching TikTok and Instagram deactivates the cognitive control network: Study reports work from Zhejiang University scanning 56 young adults while they freely watched short clips and using proton MRS to measure resting glutamate and GABA in the dorsal anterior cingulate cortex (dACC), a hub for conflict monitoring and effort evaluation, alongside the dorsolateral prefrontal cortex (dlPFC), which carries out top-down control. Both regions deactivated significantly below baseline when participants watched clips they liked to the end, while a visual control region activated normally; higher dACC glutamate predicted less suppression. The authors caution this is likely an adaptive shift toward automatic processing during passive, low-conflict viewing, not evidence of impaired capacity, and list limits including no dlPFC neurochemistry, no validated addiction scale, and a correlational design. The thread split between “every medium can be used to zone out” and “short-form infinite scroll is different because it never ends and is algorithmically fed,” with additional questions about flow, burnout and longer-term effects.

Discussion: Hacker News thread

Society and Culture#

When everyone has the tool, what still belongs to the person, and what survives time.

Don’t paste the AI, please: a short etiquette for an abundant-tool era#

The site Don’t paste the AI, please presents a minimal manifesto: if someone asked you, they want your answer — your context, taste and judgment — not a wall of model text they could have generated themselves. Use AI to draft if you like, the source says, but then read it, keep the two sentences that matter, rewrite in your own voice, or quote a line with a reason. The page offers a one-click share link and a spicier “angry” version, framing itself as a spiritual cousin to nohello.net. The digest’s gloss is that the piece reframes efficiency as responsibility: pasting without reading shifts the burden of comprehension onto everyone else and erodes trust. In comments, readers largely agreed, sharing fatigue from Slack and email walls of text, while others redirected to question quality and channel choice — asking what you tried, keeping messages short, or moving nuance to a doc or call.

Discussion: Hacker News thread

I like ’em thick: an apology to my English teachers: thickness as a test of what lasts#

In I like ’em thick: an apology to my English teachers, Adam Mastroianni proposes “thick” versus “thin” as a way to judge art — does it hold secrets that reward re-reading? The essay moves from Graeme Base’s The 11th Hour, where clues hide in illustrations, to the surprising recurrence of ears in Hamlet and the corporeal cost of fire-eating, noting that thickness often tracks with sustained human effort and attention. Thin work, by contrast — many self-help platitudes and, the author suggests, much AI output — collapses under scrutiny, however pretty it looks at a glance. The piece ends by arguing longevity is the proof: Bronze Age stories outlast Bronze Age ships. Commenters mostly reflected on schooling — that literature landed too early, without history or performance to make it legible — and debated whether valuing thickness must be elitist or can simply name the difference between thinly generated polish and densely made work.

Discussion: Hacker News thread

Closing#

Whether it is a browser that stays quiet unless it means it, a build that does nothing hidden at compile time, or a message that stays in your own words, the durable preference this week is for control that stays close to the person using it. Rules that apply the same way to individuals and platforms, and creative tools that run locally and quickly, earn trust the same way art does: by rewarding a closer look. See you next time.