AI & Tech News Digest — October 24, 2026

AI NewsTop 5

• Moonshot Ships Kimi K3.1 Pro — 3T-Class Open-Weight Contender, Weights Due Nov 4 (Oct 23)(791 points)

  Kimi blogSimon WillisonHN discussion

  The first of the K3.1 series is a post-trained Kimi K3 with much larger post-training compute across hundreds of RL domains, a 1M-token context, and a Highspeed variant claiming 2–3× the speed. API pricing is $2.00/$10.00 per million tokens ($4.00/$20.00 for Highspeed), live today across Kimi.ai, Kimi Work, Kimi Code, and the API with zero data retention. On Terminal-Bench 4.0 it scores 65.7% — ahead of GPT-6 Astra (58.2%) and just behind Claude Opus 5.5 (66.4%) — and its claim-level hallucination rate on Kimi’s stress bench fell from 23.4% to 8.3% versus K3. The notable governance move: cyber-related data was stripped from mid-training and RL before the open release, cutting xdev-bench-hard pass@3 from 90.5% to 81.0%. Full weights land by Nov 4 — for coding-agent routing that’s an open-weight option within a point of Opus 5.5 on agentic terminal work, but K3-class MoE rigs ran at ~4 tok/s on 768 GB DDR5, so start capacity planning now.

• EU Council Backs GDPR Carve-Out Letting AI Firms Process Personal Data by Default (Oct 21)

  noybHN discussion

  On Wednesday the Council approved Article 88bis as part of the Digital Omnibus: processing personal data “in the context of AI” would be presumed lawful under legitimate interest — no consent, applying to decades of previously collected data and to people who were never customers. A companion change would narrow “personal data” so pseudonymous identifiers (user IDs, tracking IDs, IPs) may fall outside the GDPR entirely. Max Schrems calls it a “digital expropriation of Europeans”; the text now goes to trilogue with the European Parliament, and noyb expects a Court of Justice challenge. If you build ML pipelines on EU user data, the compliance ceiling may move — but nothing is law until Parliament and the courts weigh in, so don’t rip out consent flows yet.

• Sweden’s Government Offices Block ChatGPT and Claude on Staff Computers From Monday (Oct 23)(316 points)

  Sveriges Radio EkotHN discussion

  Regeringskansliet is cutting off ChatGPT and Claude on staff machines from October 26, pushing workers to approved services including Microsoft Copilot — whose security Ekot reports was hardened after an internal review. The digitalization director’s on-record comment: uncontracted AI use risks “consequences for our information security.” The tax agency Skatteverket and the prison-service SiS already block both, Kronofogden is deciding, and some staff keep access through a government-built assistant platform. Public-sector AI procurement is consolidating around contracted, auditable gateways — the pattern every regulated org ends up adopting.

• ThinkingCap Cuts Gemma-4-26B’s Thinking Tokens by 39% at −0.15pp Accuracy (Oct 23)(106 points)

  Bottlecap AIHN discussion

  The fifth ThinkingCap model — and first on a Google model — retrains gemma-4-26B-A4B-it (26B total, ~4B active MoE) to spend fewer tokens on reasoning: −38.9% thinking tokens on average across twelve benchmarks, up to −69.1% on LongBench v2, at −0.15pp mean accuracy with five benchmarks actually improving. Looping responses drop from 3.64% to 0.76%, the serving stack and sampling settings are unchanged, and GGUF builds ship alongside weights on Hugging Face. If you serve reasoning models on fixed GPUs, a drop-in 39% token cut is a real capacity multiplier — the eval methodology (multi-seed, confidence intervals) is worth copying too.

• Same AI Request, 8.5× the CO2: Texas 3.2 g vs Sweden 0.38 g (Oct 21)(140 points)

  Berget AIHN discussion

  The Swedish inference provider open-sourced a per-request carbon method built with SEI, WattTime, and Klimatkollen, following the Green Software Foundation’s SCI for AI spec: a typical Kimi K3 request (5,000 in / 387 out tokens) emits 0.38 g CO2e on identical hardware in Sweden — 89% of it embodied GPU manufacturing — versus 3.2 g in Texas, 90% electricity. An idle B300 draws 236 W, a datacenter GPU carries ~1,000 kg CO2e, and open-weight models are now 29% of tokens on Vercel’s AI Gateway, which makes region a buyer’s choice. The calculator (co2.berget.ai) and method are MIT-licensed; if carbon is anywhere on your infra scorecard, this makes provider-region routing measurable.

Developer & DevOps NewsTop 5

• OpenSSL 4.1.0 Released With DTLS 1.3 (Oct 23)(180 points)

  Release notesHN discussion

  The feature release adds DTLS 1.3 (RFC 9147), RFC 8701 GREASE, DTLS support in the SSL listener API, the IKEv2 KDF, and initial Elbrus e2k support, plus optimized ML-DSA/ML-KEM and AVX-512 paths on x86_64. It drops Windows-on-Itanium and Windows CE targets, removes the fake no-ecdsa/no-ecdh configure options, and the tsget utility now requires Net::Curl::Easy. Four known DTLS 1.3 issues are documented up front, including dropped post-handshake retransmissions on KeyUpdate. Distros won’t ship it for a while, but if you build OpenSSL from source for QUIC/DTLS workloads, this is the release to test against — with the known-issues list open beside the terminal.

• calif.io Demos iPhone Attacks at Hexacon: Signal 1-Click and an iMessage Chain (Oct 23)(787 points)

  calif.ioHN discussion

  The team behind last week’s 37-year-old OpenBSD root bug showed four iPhone demos in Paris: a one-click Signal exploit, an iMessage chain (“who cares about a third-party app when everyone uses iMessage”), an unnamed “can your iPhone do this?” trick, and a persistence gag — “APT stands for Apple Persistent Threat.” Code will be released “in due time.” It lands the same week Ethan Arbuckle’s offline FairPlay IPA decryption tool blew past 1.6k stars, and both read one way for iOS fleet admins: exploit chains for Apple platforms are getting published at a faster clip, and patch velocity on clients matters more than MDM theater.

• Keep Android Open Counts Down: ~70 Days to Google’s Developer Verification (Oct 23)(485 points)

  keepandroidopen.orgHN discussion

  The campaign site puts full enforcement at roughly 70 days: from 2027, every Android app — sideloaded or not — must come from a developer registered with Google (fee, terms, government ID, evidence of your signing key, all app identifiers), or it gets blocked on every certified device. The “advanced” install flow is nine steps with a 24-hour cooling-off period, runs through Play Services rather than the OS, and starts rolling out in markets like Brazil, Indonesia, Singapore, and Thailand. F-Droid calls the program existential and 71 organizations have signed the open letter. If you distribute internal or FOSS APKs, decide the distribution story now — Google’s plan only works if developers comply.

• ClickHouse Removes pgrust From ClickBench: “the entry is cheating” (Oct 23)(184 points)

  ClickHouse/ClickBench#2165HN discussion

  Alexey Milovidov merged a PR deleting the pgrust entry from ClickBench, on the grounds that it wins with per-query kernels and result caching rather than executing the benchmark queries the way a database is supposed to. The HN thread turns into a referendum on benchmark governance: when does specialization stop being optimization, and who polices a leaderboard run by one vendor? Useful reminder the next time a “Postgres beats ClickHouse” screenshot crosses your feed — check what the entry actually does before rebalancing anything.

• UUIDv7 Timestamps Aren’t Time-Ordered and Other Oddities (Oct 23)(116 points)

  alexsci.comHN discussion

  A close read of the RFC 9562 quirks that bite in production: real UUIDv7s can violate the monotonic-sorting assumption people bake into indexes, cursors, and range scans, with generator skew and counter behavior doing the damage. The comments fill in the database-specific fallout. If you migrated to UUIDv7 for “sortable IDs,” verify your ordering assumptions before the migration report lies to you.

Also tracked: eMudhra ignored Mozilla’s Root Store investigation deadline and blamed social media instead — Bug 2083449 | HN (195 points), a governance sequel to Tuesday’s SSL/TLS exit.

Self-Hosting & HomelabTop 4

• Shitter: Nitter Lives On as a Codeberg Fork (Oct 23)(147 points)

  CodebergHN discussion

  A maintained fork of the dead Nitter X frontend, rebranded and moved to Codeberg after the original project went offline following X’s cease-and-desist. Self-hosters who still run read-only X frontends get a continuing option — and the name change is a reminder that the rebrand is DMCA insurance, not a legal shield, so mirror your instance config.

• PatchMon: A Self-Hosted Patch Dashboard for Linux Fleets (Oct 23)

  Self-Host Weekly

  This week’s spotlight from selfh.st: monitor a fleet of Linux machines for security patches and deploy them from a web dashboard, with agents for remote deployments, one-click approvals, scheduled and selective patching, Docker monitoring, patch history, and audit logs. Deploys via Docker and wants external PostgreSQL and Redis. If your homelab’s patch state lives in your head and a cron job, this is the missing control plane.

• Plex Lays Off Its Player Development Team (Oct 21)

  r/PleX threadHN discussion

  Forum posts and the subreddit report the entire player team was cut — more than 20 people — and HN commenters say Dolby Vision/HDR10 work has stopped, with a new pause-related playback bug as the visible symptom. The players are the clients that run on your devices; for self-hosters, expect slower client fixes and weigh the Jellyfin/JellyGlance exit ramp accordingly.

• hatchzip: Extract Huge Archives In Place, Without the Free Disk Space (Oct 21)

  GitHub

  A Rust extractor that deletes from the archive as it writes out, so the archive shrinks while your files “hatch” and you only need room for the output — ZIP, 7z, tar, and split archives, with crash-safe resume. The obvious use is restoring a 40 GB backup onto a VPS with 25 GB free, which is exactly when archive-extract-and-pray currently fails.

Trending GitHub RepositoriesTop 10, last 7 days

Also tracked: Spectrmachina/Ztrust (153★) — supply-chain scanning for malicious dependencies, typosquats, and leaked GitHub Actions, with researcher bounties paid in shielded Zcash.

Hacker News Top Stories

1. Apple Music 404 Not Found(654 points, 210 comments)

   music.apple.comdiscussion

   Apple Music’s 404 page turns out to be a deliberately crafted hidden feature, and the front-page thread treats it as a tour of the polish that goes into the pages users aren’t supposed to see.

2. Investor-owned utilities charge 23% more for electricity than public providers(527 points, 384 comments)

   Kadoadiscussion

   A data-driven comparison of US utility ownership models and rates; the comments audit the methodology and do the math on what it means for datacenter and homelab power bills.

3. The foolishness of “natural language programming” (1978)(364 points, 251 comments)

   EWD667discussion

   Dijkstra’s 48-year-old critique of programming in plain English reads very differently in the vibe-coding era; the thread argues about whether LLMs changed the conclusion or just the cast.

4. Dutch government had hacked into Jared Kushner’s phone(290 points, 191 comments)

   Kushner on Xdiscussion

   Disclosed in his own memoir posting, the claim that a Dutch state service compromised a senior US official’s phone turns the thread into a seminar on state-grade mobile exploitation.

5. Move Slow and Fix Things (2024)(170 points, 31 comments)

   endler.devdiscussion

   Endler’s essay on taking maintenance seriously keeps resurfacing; the discussion lands on tech debt as a choice, not an accident.

6. Hacker leaks 281 GB of data from Germany’s far-right AfD party(153 points, 106 comments)

   Bitdefenderdiscussion

   A large dump of internal party data hits the open web; the thread covers attribution, opsec of political organizations, and whether leaks change outcomes.

7. Is this the new cyber normal?(151 points, 167 comments)

   drew.silcock.devdiscussion

   Written in the middle of this month’s emergency patches and embargo breaks, it asks whether the current cadence of disclosure chaos is simply the baseline now — the comments mostly say yes.

Also tracked: Ask HN: How do people self host email and maintain deliverability? — discussion, the eternal question of full control versus Outlook spam-filter roulette, asked again this morning.

Reddit HighlightsTop 5

• r/LocalLLaMA — Kimi K3.1 Pro Tech Blog: Advancing Open Intelligence

  Thread

  The community is already doing the math on running a 2.8T MoE at home ahead of the Nov 4 weights drop.

• r/ChatGPT — Sweden’s government is blocking ChatGPT and Claude

  Thread

  Civil servants get moved to Microsoft Copilot from Monday; the thread debates whether this is security or procurement lock-in.

• r/PleX — Another Layoff Round - Player Team Laid Off

  Thread

  Reports of 20+ player engineers cut; Plex server owners start pricing the exit.

• r/sysadmin — Weekly “I made a useful thing” Thread — October 23, 2026

  Thread

  The standing show-and-tell; worth a scan for fleet tooling you didn’t know you needed.

• r/LocalLLaMA — 24GB is plenty if your engines take turns

  Thread

  A watcher service that swaps models in and out automatically so one small GPU can serve several big engines serially.