AI & Tech News Digest — November 12, 2026

AI NewsTop 5

• AI Agents “Rediscovered” a Maya Site in 72 Hours — and the Nov 11 Update Is the Real Lesson (Nov 11)

  pietromiotti.comHN, 955 points

  Pietro Miotti, a self-described non-archaeologist, pointed roughly 48 consumer agents (Gemini, ChatGPT, Claude, Grok) at about 1,200 km² of public NASA lidar strips over the Maya region. The agents turned the strips into images, walked them like “very patient archaeologists” against a written guide, and flagged a hilltop civic center: leveled plaza, 8–12 m oval pyramid, raised courtyard, probable rainwater reservoir. INAH, Mexico’s archaeology institute, replied within three days that no site was registered there — and then came the update: the site was already mapped in a 2025 paper the agents missed during their literature check. The pipeline itself — commodity agents, public lidar, a formal report to a government — still cost one person three evenings. The operational takeaway: agents are good enough at domain triage that the new bottleneck is citation-checking; make “search the literature” a hard gate in any agentic discovery workflow, because the model won’t do it reliably on its own.

• 23 Major OSS Projects Now Ban AI-Generated Contributions — yt-dlp, Immich, Meilisearch, QEMU Among Them (Nov 11)

  Open Source Says NoHN

  The catalogue, refreshed November 11, tracks 23 projects with explicit bans, several of them among the biggest repos on GitHub: yt-dlp (206.9k stars) forbids LLMs for “any kind of contribution” including issues, docs, and translations; Meilisearch (59.8k) rejects AI content in code, tests, documentation, and even PR comments; stb (34.9k) won’t accept bug reports “reviewed or analyzed by AI”; QEMU declines anything believed to derive from AI tooling; submitting an AI-generated PR to one PHP package gets you banned from the repo. Motives vary — slop volume, provenance and license worries, reviewer burnout — and enforcement is humans reading diffs, so nothing here is technically airtight. If you contribute with agent assistance, read the contributing file first: several of these projects treat AI-assisted patches as a ban-worthy offense, not a style preference.

• Yogurt: a Free, Open-Source Granola Alternative That Never Leaves Your Laptop (Nov 11)

  GitHubHN, 210 points

  A Show HN that hit 514 stars in two days: Yogurt is an MIT-licensed desktop app (Electron, Windows/macOS/Linux) that transcribes and summarizes your meetings with on-device models — whisper.cpp or Apple’s SpeechAnalyzer for speech-to-text, a local open-weight LLM via llama.cpp that auto-selects itself based on your hardware. Transcripts, recordings, and summaries never leave the machine; a local MCP server lets you hand notes to Claude or GPT only when you decide to. Calendar integration, echo detection, and folder-level search round it out. The pitch is the same math as this week’s enterprise cost-cutting stories: small open models are now good enough that meeting notes don’t justify a subscription, and keeping transcripts local is a feature your legal team will like.

• Klad: a Paint App Built So Your Coding Agent Can Drive It (Nov 11)

  klad.studioGitHubHN

  A Rust paint program whose core architecture is editable brush strokes: an agent drafts art through the CLI, then a human can go in and change every stroke it made — brush engine, frame-by-frame animation with bones/IK, vectors, text layers, and infinite undo that survives reopening the file. It’s source-available (free to build and use for individuals and small companies; the file format, CLI reference, and agent skill are MIT), running on Mac and Linux today with Windows CI builds and pixel-art support next. The timing is pointed: Adobe showed agents editing Photoshop files at MAX this week, with a private beta planned for early 2027 — Klad is the same idea, working now. If your agents produce visual assets, “every output stays editable” is the spec worth copying.

• Atuin Threads: Sync, Search, and Resume Your Agent Sessions on Any Machine (Nov 11)

  Atuin blogHN, 204 points

  Atuin 18.24 extends its encrypted shell-history sync to agent sessions. Sessions from Claude Code, Codex, Pi, Omp, and OpenCode are captured opt-in, synced end-to-end encrypted (hosted or self-hosted), and searchable everywhere; atuin resume picks a thread up on another machine, and you can fork a session mid-investigation onto a faster box and merge the results back into the original. An MCP server (atuin mcp) lets agents search your own past work — the author credits it with catching a broken object-store key via his daily Sentry-triage agent, which found the prior investigation instead of starting cold. The insight underneath: agent sessions are append-only logs, and most agent work never reaches Git or the issue tracker. Session history is becoming infrastructure, with the same retention and access questions shell history had a decade ago.

Also tracked: Thinking Machines’ Inkling 2 Small (594B MoE) is live on Tinker, but the promised Apache 2.0 weights still haven’t landed as of Nov 12 — open-weights tracker. And Apple ML published faster retrieval for RAG (180 points on HN) plus an Attention-to-Mamba distillation recipe.

Developer & DevOps NewsTop 5

• AWS Open-Sources an Official AWS Emulator — Every Line Written by Autonomous Agents (Nov 11)

  About AmazonGitHubHN, 764 points

  AWS Emulator is a first-party local emulator of AWS APIs: point the AWS CLI or any SDK at its endpoint via environment variables and run your code against in-memory emulated resources — no AWS account, no network calls, no service fees. It’s Rust, CC0-1.0 licensed, 2,674 stars since going public, with RPM/Debian packages, a Docker image for macOS/Windows, an embedded mode for Rust SDK tests, published per-release fidelity scores, and an install-and-connect skill for AI coding agents. The build story is the second headline: Amazon says thousands of autonomous agents on Bedrock AgentCore wrote every line of it, and agents keep it updated many times a day as AWS services change. Limits are stated plainly — it doesn’t evaluate IAM policies (don’t test security against it), it’s single-region/single-account, and everything vanishes when it stops. Local AWS development without third-party emulators is now a vendor-supported default.

• Node.js Ships 16 Fixes Across 22.x, 24.x, and 26.x — HTTP/2 Bugs Can Leak TLS Keys and Response Memory (Nov 11)

  Node.js blogpre-alert

  The updates are available now: 7 high, 6 medium, and 3 low, with HTTP/2 taking the worst of it. A re-entrancy flaw in HTTPS lets an unauthenticated client make a server copy its own heap — including TLS private keys and other connections’ requests — into a response body (CVE-2026-123864); HTTP/2 stream teardown can send freed response buffers from other connections to a peer (123866); respondWithFile() servers get a remote use-after-free (123874); and TLS 1.2 renegotiation lets a client switch servername to bypass per-host client-certificate authentication (123872). Three reports are credited to Chris Rohlf “in collaboration with Claude and Anthropic Research,” and one to Trail of Bits (OpenAI) — AI-driven vulnerability discovery is now routine enough to appear in runtime changelogs. Dependency bumps cover llhttp, undici, and sqlite. If Node serves traffic for you, patch today.

• Greg Kurtzer’s Ginux Pivots From Standalone Kernel to a Userspace Kernel for Agent Containment (Nov 11)

  GitHubHN, 118 points

  The Rocky Linux founder’s experiment — an AI-built Rust kernel that booted a Rocky Linux 10 userspace directly through UEFI — is complete and preserved on a branch; active Ginux is now a userspace kernel that runs as an ordinary process and intercepts managed syscalls before they reach the host, choosing to emulate, mediate, or deny each one against a versioned per-instance contract covering syscalls, filesystem, network, devices, and virtual /proc and /sys. The stated target is sandboxing AI agents: give a process tree only the operations its task needs — deny clock changes, host filesystem access, unapproved network listeners — with digest-pinned OCI roots and contract-locked instances. Apache 2.0, 593 stars, and honestly labeled research software with no production claims. The write-up’s real lesson is method: the kernel prototype proved the architecture, and the team killed it rather than shipping it.

• Mozilla Publishes Its Fingerprinting Research — and the Firefox 145 Mitigations Built From It (Nov 10)

  Mozilla Security BlogHN, 171 points

  Mozilla’s paper (accepted at CCS 2026) measured fingerprinting at scale using browser measurements from nearly 25 million Firefox users, with Fingerprint Pro, Signifyd, and Akamai collection scripts simulated to test distinguishability — routed through OHTTP so Mozilla never saw IPs. The headline finding: protecting a handful of high-value features weakens popular fingerprinting techniques substantially, which shipped in Firefox 145 — screen-resolution APIs hide taskbar/dock geometry, processor counts report only 4 or 8, and outputs for image rendering, Web Audio, and math on Android were made consistent. Some protections are default-on; others live in Strict Enhanced Tracking Protection until they prove they don’t break sites. If you deploy hardened browsers, Strict ETP is now the switch that carries most of this.

• KubeCon NA Runs Through Tomorrow — Microsoft’s Roundup: Agent Lifecycle on Kubernetes, DRA GPUs, Fleet Controls (Nov 10)

  Microsoft Open Source BlogKubeCon program

  Brendan Burns’ KubeCon North America 2026 roundup (the conference runs Nov 9–12 in Salt Lake City) leans into agents-meet-Kubernetes: Agent Substrate for portable agent infrastructure, plus “sessions” and “suite” for durable, replayable, suspendable agent runs across runtimes and clouds; AI Runway entered the CNCF Sandbox as a native way to deploy multi-provider inference on Kubernetes; Unbounded, queued for Sandbox, extends any conformant control plane with workers in other clouds, on-prem, and at the edge. On AKS: managed DRA for GPUs and DRANET on RDMA node pools, Fleet Manager placement controls hitting GA (drift detection, takeover, eviction with disruption budgets), upgrade insights plus health gates that stop bad upgrades automatically, and Integrity Policy Enforcement in audit mode on Azure Container Linux. The stated theme is the whole roadmap: move decisions from runbooks into controllers.

Also tracked: Tailscale v1.104.6 (Nov 10) fixed a rare connectivity drop affecting dormant connections — changelog.

Self-Hosting & HomelabTop 4

• The Verge Asked 11 TV Makers 17 Questions About Spying — Hisense, Sony, Panasonic, and Vizio Mostly Didn’t Answer (Nov 11)

  The VergeHN, 347 points

  A month of yes/no questions produced on-record answers from Amazon, Google, LG, Roku, Samsung, and TCL, partial ones from Apple — and silence from Hisense after five attempts, with Sony, Panasonic, and Vizio dodging most questions. The confirmations matter for anyone running a home network: ACR works by audio fingerprinting, not screenshots; traffic from Samsung and Roku shrinks but doesn’t stop after opt-out; and a Northeastern study found Walmart’s Vizio kept sending data after opt-out, which Vizio calls “routine operational data.” Amazon and TCL admit buffering telemetry offline for upload on reconnect; every company agrees that pulling the internet connection stops transmission. The homelab playbook follows directly: put TVs on a blocked VLAN or DNS policy, opt out where the toggle is real (Samsung VIS, LG ACR), and treat “off by default” as a claim to verify on your own switch, not a fact.

• agentes-chat: Self-Hosted Team Chat Where AI Agents Sit in the Channels (Nov 9)

  GitHub

  An open-source, self-hosted Slack alternative (AGPL, TypeScript, Docker Compose + Postgres, 486 stars in three days) where agents run on Claude, Codex, Gemini, or Grok inside channels and DMs — with MCP tools, their own computer and browser, routines, memory, and human approval gates. Web, desktop, and phone clients ship in the box. The design choice worth watching is approvals-first: human-in-the-loop is in the repo’s one-line description rather than buried in documentation, which is more than most agent platforms managed in their first week. If you’re evaluating team chat with agents baked in, this is a fresh benchmark for what “agents in the org chart” costs to self-host — and what the permission model should look like.

• tinytraffic: Self-Host Web Analytics in a Single Binary (Nov 10)

  GitHub

  A new entry in the one-binary analytics genre: self-hosted web analytics with no external database dependency in the default path, TypeScript, AGPL-3.0, 196 stars in two days. The pitch against Plausible/Umami-class stacks is operational: fewer moving parts on a small VPS means the analytics that survive your busiest month are the ones that need the least babysitting. Standard advice applies before production: verify the storage format and export path first — analytics tools are only useful if the historical data survives the tool.

• HomeRoll: a Native iOS Photos-Style Client for Your Immich Server (Nov 6)

  GitHub

  A SwiftUI photos app pointed at your own Immich server — positioned explicitly as the Apple-Photos-feel client for people who already run Immich, GPL-3.0, 139 stars in six days. The official Immich app handles backup and management; HomeRoll targets the browsing experience, which is where families usually reject self-hosted photo stacks. If Immich adoption in your household stalled on usability, this is the week’s candidate to test — check its compatibility with your server version before rolling it out to phones, and keep the official app as the sync path of record.

Also tracked: PerkRadar, a self-hosted deals and freebies aggregator that re-checks its sources every two hours with expiration handling — GitHub.

Trending GitHub RepositoriesTop 10, last 7 days

Also tracked: this week’s trending is again half spam — a cluster of ~20 “installer” repos (Adobe, Autodesk, JetBrains, MetaTrader, DAW clones) created within the same hour on Nov 6, each at ~1,200–1,300 stars with zero to one forks. Check the fork-to-star ratio before you star anything.

Hacker News Top Stories

1. Tim Peters has died(1015 points, 109 comments)

   discuss.python.orgdiscussionLWN

   Guido van Rossum announced on November 11 that Tim Peters died July 15 at his home in Ashland, Wisconsin, at 74. Peters wrote Timsort — CPython’s default sort since 2002 and Java’s object sort — the Zen of Python (PEP 20), and served as a PSF director from 2001 to 2014.

2. A false smoke alarm almost drowned Jane Street’s only NYC datacenter(451 points, 227 comments)

   michael.bacarella.comdiscussion

   Contractor dust triggered the smoke alarm, which by design shuts down the CRAC units and pressurizes the sprinkler pipes; the author sprinted back and yanked every power cord by hand as the room climbed through 143°F toward the sprinkler trigger. The aftermath monitor — fleet-wide Linux temperature averages in OCaml — is the ops lesson: detect correlated drift across the fleet, not single-server thresholds.

3. Protecting SSH Keys with macOS Secure Enclave(387 points, 137 comments)

   gatezh.comdiscussion

   A native, no-third-party-apps walkthrough: sc_auth create-ctk-identity makes a non-exportable P-256 key that requires Touch ID on every signing. The catch is by design — no backups, so keep a second key on another device; the author has since switched to Secretive for a cleaner prompt.

4. Hyper-Realistic Sand with WebGL2(340 points, 66 comments)

   av.github.iodiscussion

   An interactive WebGL2 granular-sand simulation; the thread digs into the render and physics tricks that make millions of grains behave convincingly in a browser tab.

5. Using voltage glitching to unleash the A100 in my mining card(282 points, 115 comments)

   blog.kate.landdiscussion

   A CMP 170HX Ethereum mining card carries a full GA100 die with up to 80 GB of HBM; voltage fault injection on the PWMVID rail rewrites the fuseless-fuse records and unlocks 120–126 SMs — about 1.2x a retail A100 — plus PCIe Gen4, and NVLink. Disclosed to NVIDIA’s product security team before publication.

6. A great old-timey game-programming hack (2013)(267 points, 67 comments)

   blog.moertel.comdiscussion

   Tom Moertel’s retelling of a classic space-saving trick from early game development, resurfaced; the comment thread collects more examples from the era when every byte was budgeted.

7. Can a Linear Program Do Weight-Space Programming?(264 points, 38 comments)

   nathan.rsdiscussion

   After MIT CSAIL showed GPT-6 Astra editing 0.016% of Qwen3.5-0.8B’s weights to lift MATH-500 from 7.9% to 48.1%, this post shows the model’s 8-hour trial-and-error search is really a linear program — a GPU LP solver reproduces the fix in about a minute with 8x fewer changed weights, and a plain steering vector recovers most of it.

Also tracked: Apple is shutting down its Support Community forums on November 20, ending two decades of searchable answers — The Verge | discussion.

Reddit HighlightsTop 5

• r/aws — Today AWS Emulator is announced. It’s 100% autonomously built by agents

  Thread

  practitioners compare it with LocalStack and push on what the published fidelity scores actually cover.

• r/Python — Tim Peters has passed away

  Thread

  the community trades Timsort and Zen of Python stories; the announcement post on python.org has the details.

• r/LocalLLaMA — Kimi-K3.1-Pro-Coder (2.8T): 1.77 TB down to 775 GB

  Thread

  a mixed-bit community quant pins coding experts at 2.81 bpw in VRAM, keeps general experts on disk, and reports 96.7% on AIME 2025 and LiveCodeBench at 36.8 TPS batch on one Blackwell card.

• r/node — PHP had to scramble last week, now it is Node’s turn

  Thread

  admins argue over emergency-release cadence and patch ordering for the November security cycle.

• r/privacy — Need a TV that isn’t a narc

  Thread

  the dumb-TV-plus-streaming-box setup gets re-litigated alongside this week’s manufacturer answers.