A developer investigated macOS's ~/Library/Keyboard/VulgarWordUsage.db, which logs swear-word usage per app and recipient to help autocorrect adapt, and found it empty on their own Mac. Digging further, they used undocumented private functions from Apple's Lexicon.framework to extract the underlying system dictionary, which tags every word with a vulgarity tier (vulgar, offensive, sensitive) and up to eleven topic categories like sex, drugs, religion and politics, publishing full word dumps for 15 languages.
helgesver.re
· 2026-11-03
The New York Times and other newspaper publishers filed suit against Brave Software in federal court in New York, alleging the browser company scrapes copyrighted articles, bypasses paywalls, and resells the content through its search index and API to AI firms including Anthropic, Perplexity, Mistral, xAI and Cohere. The complaint estimates Brave has earned over $100 million from this activity while publishers received no compensation, and it alleges direct, contributory and vicarious copyright infringement plus DMCA violations for circumventing paywall protections.
arstechnica.com
· 2026-11-03
A report claims Postman's client silently installed an AI-related plugin without explicit user consent, and that the plugin attempted to transmit all API request and response data elsewhere. The claim surfaced via a developer changelog-style post rather than an official Postman announcement, and no response from Postman is cited.
github.com
· 2026-11-03
GitBook confirmed that on November 2 at 19:00 CET, attackers using AI agents gained unauthorized access to some infrastructure credentials. The company took its app and authenticated docs sites offline while keeping public content cached and live, then restored services after replacing credentials and revoking API tokens. GitBook says the attackers may have accessed Git Sync secrets, API tokens, third-party integration tokens, and visitor questions to GitBook Assistant, though no content appears to have been modified.
news.ycombinator.com
· 2026-11-03
Google's Threat Intelligence Group and Mandiant found that attackers are stealing API keys and exploiting exposed LLM endpoints to resell unauthorized access through services called LLM mixers. Victim organizations have seen fraudulent usage spike past 1,000 requests per second, with some racking up over $100,000 in charges in a single day and cumulative losses reaching $1 million. One service, Jet Night, reportedly passed nearly $1 million in token costs to a single victim after executing more than 500,000 API calls in under eight hours.
bleepingcomputer.com
· 2026-11-03
Anthropic has enabled 'message threads' by default for most Claude Code users, a feature that sends only changed data since the last turn instead of re-uploading the entire conversation history with each request. Anthropic reports this cuts time-to-first-token by a median of 35%, though total token usage and cost remain unchanged. API users can enable the feature manually via a 'thread' parameter.
zdnet.com
· 2026-11-03
A new Show HN project called HackerTV streams a continuous, synchronized broadcast of YouTube videos that have been frequently recommended in Hacker News comments, so every viewer sees the same program at the same time. The catalog is seeded from the HackerTube dataset and refreshed weekly using the HN Search API, with Claude used to label and filter entries, though video durations are estimates until YouTube metadata loads.
hackertv.org
· 2026-11-03
A developer has released an updated version of a website tracking Linux system call tables across architectures, including x64, ARM, RISC-V, MIPS and others. The site now exposes calling conventions per architecture and offers a JSON API, along with per-kernel-version data showing when syscalls were added or removed.
syscall.sh
· 2026-11-02
The Toit programming language has officially left alpha status with the release of version 2.0.0, following more than four years of development, over 2,000 commits and 200+ alpha releases. The release finalizes a key breaking change allowing peripheral APIs to accept pin numbers directly, and arrives after Toitware, the company that originally developed Toit, shut down in 2024, leaving volunteers to maintain the open-source project.
toit.io
· 2026-11-01
Cloud hosting platform Northflank disclosed on October 30 that a security breach allowed attackers to decrypt customers' stored environment variables, exposing database passwords, authentication tokens and API keys. The company confirmed multiple customers reported unauthorized use of their AI API keys and urged all users to immediately rotate every secret stored on the platform. Northflank said it was alerted to the issue by cloud security firm Wiz and deployed network policy patches within about 90 minutes.
bleepingcomputer.com
· 2026-10-31
A developer has released spinf-serve, an Apache 2.0-licensed inference server that reads a piece of content once and answers many fixed-choice questions about it in a single pass, rather than generating text. It runs on a single 24GB NVIDIA GPU, offers an OpenAI-compatible API matching the existing hosted spinf service, and supports both open instruction models and dedicated decision models.
github.com
· 2026-10-30
File conversion site Zamzar, launched by two brothers in 2006 with just 150 supported conversion types, now offers 2,128 conversion formats and has served over 550 million users. The company says it now processes more than 1 million API requests daily and has handled users from locations as remote as Tokelau, Svalbard, Antarctica, and the Vatican.
blog.zamzar.com
· 2026-10-30
GoKawiil