AI & Tech News Digest — November 9, 2026

AI NewsTop 5

• Jensen Huang Publishes “A Message to Our Company” — Apology Plus a Board Investigation (Nov 8)

  Nvidia newsroomAxiosHN, 463 points

  Nvidia’s founder-CEO posted a public letter admitting he was unfaithful to his wife, and confirming the part that matters for the industry: “Regarding the national security concerns raised in news reports, NVIDIA’s Board of Directors has initiated an independent investigation. I support the investigation and will cooperate fully.” The reporting stack behind it: Axios (Nov 8) on the affair, a NYT report (Nov 6) that a businesswoman close to Huang was passing intelligence to Beijing, and CNN (Nov 8) on the board probe; investor threads also track a reported Congressional summons. Practical read: the single point of dependency for most of the AI supply chain just became a governance story — if your roadmap assumes Nvidia supply and pricing stay boring, write the contingency line now.

• Goldman Sachs Restricts Claude Code and GitHub to Engineers Only (Nov 2, hit HN’s front page Nov 8)

  BloombergThe DecoderHN, 682 points

  After months of letting bankers and traders use Anthropic’s Claude Code and Microsoft’s GitHub for work — monitoring client trading flows, writing scripts — Goldman has pulled access; only engineers keep it, with strats reportedly grandfathered. The 383-comment thread became the sharpest debate this week on who may run agents inside a regulated firm: non-engineers were using coding tools as end-user automation with no code-review surface. If your org rolled coding agents out horizontally, expect the same correction — access follows auditability.

• Anthropic Explains How Claude’s Agent Memory Actually Works (Nov 6)

  Anthropic research

  Anthropic published an engineering breakdown of the memory system behind Claude’s cross-session behavior: a MEMORY.md file of which only the first 200 lines or 25 KB load into each session’s context, plus periodic offline “dreaming” sessions that re-read old transcripts to extract and consolidate lessons. The design choices are the useful part for anyone building agent memory — hard context caps, deliberate summarization, scheduled reflection — rather than stuffing everything into context. Steal the architecture, not the branding.

• Google ADK 2.14 Graduates A2A to Stable — Agent Interop Has an API Contract Now (Nov 7)

  GitHub releasesaitoolsrecap

  Google’s Agent Development Kit v2.14.0 moves the Agent2Agent protocol integration, execution environments, evaluation, and core runtime from experimental to stable, and adds adk generate_agent_card to emit an A2A agent card from the CLI. Long multi-turn workflows run 23% faster, and one breaking fix closes a real hole: RunSkillScriptTool no longer accepts a free-form shell command, which had let a prompt-injected model run arbitrary shell commands. Also this week: Claude Code 2.1.319 backgrounds MCP tool calls instead of blocking on them. If you build multi-agent systems, A2A stable is your cue to standardize agent cards before your vendors do it for you.

• “How I Fight AI Brain Fry” (Nov 8)

  sergeykuhne.comHN, 195 points

  A developer essay on noticing skill decay after a year of delegating thinking to models, and the habits he rebuilt: writing before prompting, reading primary sources, doing small tasks by hand on purpose. The 158-comment thread is full of practical variants; the consensus is to treat AI as a reviewer you must be able to overrule, not a driver you can’t. Weekend reading that doubles as a personal retrospective checklist.

Also tracked: Thinking Machines’ Inkling 2 Small still has no downloadable weights — the Apache 2.0 release remains promised with no date, so the “highest-scoring open-weights model” claim stays provisional — aitoolsrecap | Artificial Analysis.

Developer & DevOps NewsTop 5

• Outlook.com Is Bouncing Mail From Domains Without DMARC (since Nov 5)

  MailRouteMicrosoft Q&AHN, 325 points

  Since November 5, Outlook.com and Hotmail (outlook.com, hotmail.com, live.com, msn.com) have been rejecting mail from domains with no DMARC record — 550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records (AS9031519) — and Microsoft Q&A threads confirm even M365 tenants with valid SPF are getting caught, because the check is on the DMARC record existing. Small senders and self-hosted mail servers are hit hardest. The fix is an afternoon: publish SPF and DKIM, add a DMARC TXT record starting at p=none with reporting, tighten once reports look clean. Check your outbound domains today — the bounces are silent until a customer emails you.

• Node.js Pre-Announces Security Releases for Wednesday, Nov 11 — Highest Severity HIGH

  nodejs.org

  The Node.js project will ship new releases of the 26.x, 24.x, and 22.x lines on or shortly after Wednesday, November 11, with the top severity rated HIGH on all three lines, and a standing note that EOL versions are “always affected.” Details stay undisclosed until release, which is normal for these pre-announcements. Practical move: clear a patch window Wednesday morning, and if you run containers from pinned digests, queue the rebuild now so images are ready when the versions land.

• KetchUp: an Open-Source SketchUp Alternative in Rust + WebGPU (Nov 8)

  ketchup3d.github.ioHN, 338 points

  KetchUp runs a parametric 3D modeler in a browser tab — push/pull faces, snapping, the SketchUp workflow — built in Rust with a WebGPU renderer, no install and no account. The HN thread is the SketchUp diaspora comparing it against the real thing after Trimble’s licensing shuffle moved everyone to paid tiers. If you keep one 3D doodling tool around for quick box models and joinery plans, this is now the one to evaluate.

• Researchers Chain a Connected-Car Platform From License Plate to Remote Unlock (Nov 8)

  shubs.ioHN, 178 points

  Shubham Shah and Sam Curry published a full teardown of a major automaker’s connected-car platform (brand redacted): number plate → VIN via public registries → subscriber GUID through an admin tool whose API needed only hardcoded keys from its JavaScript bundle → ForgeRock OpenIDM admin credentials also embedded in a vendor JS bundle → WAF bypass via a /static%2f..%2fopenidm/ path traversal → MFA skipped through a Resource Owner Password Credentials flow → remote door-unlock and engine-start for any car in Australia, the US, and Canada. Two details worth your time: the WAF bypass the humans missed was found by letting GPT 5.6 grind on the routing quirk for six hours, and every stage traces back to secrets shipped to browsers. Audit your own bundles.

• Aphyr on Harvest: $13.32 → $133.98 a Month After the Bending Spoons Acquisition (Nov 9)

  aphyr.comHN, 195 points

  Kyle Kingsbury (Jepsen) documents what happened to the time-tracking tool he recommended for a decade after Bending Spoons — the firm that gutted Vimeo — bought it: customers migrated onto an “enterprise” plan at ten times the price, a cheaper “flex” plan skims an extra 2% on top of card fees, and support emails are now answered by an LLM generating thousands of words that don’t read the ticket. It’s the cleanest recent case study of post-acquisition enshittification, and the thread is a working list of freelancer-billing alternatives. If your invoicing stack has private-equity fingerprints on it, budget a migration weekend before renewal season.

Also tracked: “When a language’s creator and its owners strongly disagree” — an ISO C++ paper (P4454R0) on the C++ governance drama, 99 points — paper PDF | discussion.

Self-Hosting & HomelabTop 4

• llama-modchip: DeepSeek-V4-Flash at 284B Parameters on a 64 GB CPU-Only Box (Nov 8)

  GitHubsamcodeman’s analysisHN, 399 points

  A patched llama.cpp fork with an expert-cache engine fits DeepSeek-V4-Flash, a 284B MoE, in under 59 GiB of system RAM with no GPU: independent measurements report 9.1–14.7 tok/s decode on a Zen 5 CPU, while 30B-class MoEs run up to 111 tok/s at 256K context. The trick is aggressive expert offloading plus quantization tuned against a quality baseline, so read the measurements, not just the README. For homelabbers with big-RAM servers and no GPUs, a frontier-scale model at one-digit tok/s changes the “do I need a GPU” math for batch jobs — not chat.

• Dux: a Free, Open-Source Wayland Desktop Shell With a Built-In File Manager (Nov 8)

  duxlabs.devHN, 233 points

  A complete desktop shell for Wayland — panel, launcher, file manager, theming — positioned as the lightweight alternative to GNOME/KDE for people who want a working desktop without the stack, and it hit 233 points on its first night. The thread is mostly Wayland-compositor architecture debate, which tells you the audience. For imaged Linux fleets and family machines it’s a candidate to watch; daily-driver status is a release cycle or two away.

• TrueNAS Marks the Home Assistant App Deprecated — HAOS VM Is the Supported Path

  TrueNAS forums

  The Home Assistant app in TrueNAS SCALE’s catalog (12,000+ installs) now shows as deprecated and scheduled for removal, and a TrueNAS staffer explained why in the thread: HA keeps moving settings from configuration.yaml into its web UI, which breaks the app’s configuration model from the outside. Home Assistant’s position is unchanged — HAOS in a VM is the only supported install; containers still run but get no HA bug-tracker support. If you run HA as a TrueNAS app, the thread has the migration path: take a backup, spin up a HAOS VM, pass through the Zigbee stick, restore.

• Playing With the STM32MP2 (Nov 8)

  serd.esHN

  A hands-on with ST’s STM32MP2, the Linux-capable MPU line that pairs Cortex-A cores with a real-time Cortex-M, walking through boot, Yocto, and what the board is actually good for. The homelab niche: always-on gadgets that need proper Ethernet, a real-time coprocessor for hardware, and sips of power rather than a Pi’s appetite. Not a Raspberry Pi replacement — a different point on the curve.

Trending GitHub RepositoriesTop 10, last 7 days

Also tracked: Jane Street published its internal agent skills as janestreet/agent_skills (595★, MIT); the trending fork-farms are still farming — “Google AI Pro” giveaway and SheerID-verifier repos with fork ratios above 0.4 — so the verify-before-you-star rule stands.

Hacker News Top Stories

1. Writing as a thinking tool(312 points, 84 comments)

   muratbuffalo.blogspot.comdiscussion

   A distributed-systems researcher’s case for writing as the debugging pass for your own reasoning — lands differently in the same week the top AI thread was about not letting models do your thinking.

2. Ask HN: What are you working on? (November 2026)(177 points, 587 comments)

   discussion

   The monthly thread is the biggest discussion on HN today; the agent-infrastructure side projects in it are a free market survey.

3. I’m not convinced the AI bubble exists(120 points, 156 comments)

   matteoraso.github.iodiscussion

   A data-backed argument against the bubble framing from someone who isn’t selling anything; the thread is the calmest version of this fight you’ll read.

4. The Web Is More Than Enough, by Paul Ford(105 points, 60 comments)

   ftrain.comdiscussion

   Ford’s classic resurfaced; the argument that boring web technology won reads differently in 2026.

5. When a language’s creator and its owners strongly disagree [pdf](99 points, 88 comments)

   isocpp.orgdiscussion

   The C++ governance fight, in committee-paper form — a rare public look at what happens when a language’s steward and its corporate owners diverge.

6. JIT bitmap text rendering for microcontrollers(95 points, 20 comments)

   linebender.orgdiscussion

   The Linebender team generates optimized glyph-drawing code at build time so tiny MCUs can render text fast — compiler tricks leaking into embedded.

Also tracked: Chimera Vocal Synth, a Rust vocal synthesizer that sings, speaks, and beatboxes (151 points) — demo | discussion.

Reddit HighlightsTop 5

• r/technology — NVIDIA CEO Admits Infidelity With Suspected Chinese Spy

  Thread

  The discussion pairs the apology with the national-security reporting and what a board investigation means for the company the whole AI stack depends on.

• r/ClaudeCode — Goldman Sachs restricted Claude Code to engineers only

  Thread

  Practitioners on what non-engineers were actually doing with coding agents, and why access control caught up with them.

• r/microsoft365 — PSA: Outlook.com/Hotmail now rejecting M365 mail with “550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records”

  Thread

  Affected admins comparing fixes; the missing piece is the DMARC record even when SPF is valid.

• r/hackernews — Llama-modchip: 284B DeepSeek on 64GB RAM, no GPU

  Thread

  Thread skepticism worth reading alongside the benchmarks: what’s measured versus what’s claimed.

• r/NVDA_Stock — Another Problem. CEO Jensen Huang being summoned by Congress over Chinese espionage concerns

  Thread

  Investors tracking the political dimension that arrived before the apology did.