HN Buddy

Daily digest of top Hacker News posts and comments

Subscribe to the HN Buddy Daily Digest

Your email will only be used for the HN Buddy Daily Digest. I will not share it with anyone.

HN Buddy Daily Digest

Tuesday, August 19, 2025

Hey buddy, just wanted to give you a quick heads-up on some cool stuff I saw on Hacker News today, Tuesday, August 19, 2025. It was a wild mix, seriously.

OpenMower – Open Source Lawn Mower

First off, there's this project called OpenMower. It's an open-source robotic lawnmower! Like, you can build your own autonomous mower. One of the comments pointed out how a lot of the issues with regular mowers are just because big companies like Briggs & Stratton keep making engines with terrible designs. Another person was worried about killing small animals, which is a real thought, but then they asked about building electric ones themselves because their old gas mowers just won't die. Pretty cool DIY vibe.

CodeRabbit Security Exploit

Then, this insane security story dropped: researchers exploited CodeRabbit, which is a code review tool, and got remote code execution and write access to a million repositories! Can you believe that scale? Apparently, CodeRabbit responded saying no customer data was actually lost, and they patched it, which is good. But it really highlighted how you need to be super careful running untrusted code, even through these dev tools. Someone in the comments was also scratching their head about why companies put secrets in environment variables in the first place.

XSLT Being Removed from HTML Spec

This one's a bit more techy, but they're talking about removing mentions of XSLT from the HTML spec. XSLT is that old XML transformation language, remember? It's kind of a big deal because the web usually tries to never break old stuff. The discussion got into whether it's okay to drop features, especially when some big places like the Library of Congress still use server-side XSLT. Also, the author of the pull request kinda called out Chrome for releasing tons of new APIs every year while also saying they want to reduce attack surface. A bit of a double standard, maybe?

Croatian Freediver Held Breath for 29 Minutes

Okay, this one blew my mind: a Croatian freediver held his breath for 29 minutes! Twenty-nine! Seriously, how is that even possible? The comments talked about how these people are just built differently, and how it's not really about holding your breath underwater but more about static apnea in controlled conditions. Someone even brought up James Cameron and how he's a subject matter expert on deep sea stuff because he almost drowned filming The Abyss. Wild connection, right?

D2 Tool Gets ASCII Diagrams

For something a bit more practical, the D2 text-to-diagram tool now supports ASCII renders. So you can type out a diagram description and it'll spit out a diagram made of text characters. Super handy if you just need a quick diagram in a text file or terminal without needing a fancy image viewer. Someone in the comments mentioned how this is a genuinely novel thing that Mermaid (another diagram tool) doesn't do, which bridges a gap for them.

DIY Telescope Mount

And finally, this super cool DIY telescope mount project caught my eye. This guy built his own custom telescope mount using these really precise "harmonic drives" and an ESP32 microcontroller. He ran into an interesting problem where the ESP32 was actually struggling to keep up with the number of pulses needed for super-fast, precise motor movements. It's a great example of pushing hobby electronics to their limits in a real-world application. They also talked about how the cost for these custom circuit boards is mostly in the assembly, not the board itself.

Anyway, gotta run. Talk soon!

All Stories from Today

OpenMower – An open source lawn mower (github.com)

How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos (research.kudelskisecurity.com)

"Remove mentions of XSLT from the html spec" (github.com)

Croatian freediver held breath for 29 minutes (divernet.com)

D2 (text to diagram tool) now supports ASCII renders (d2lang.com)

Custom telescope mount using harmonic drives and ESP32 (www.svendewaerhert.com)

Prime Number Grid (susam.net)

Ted Chiang: The Secret Third Thing (linch.substack.com)

UK drops demand for backdoor into Apple encryption (www.theverge.com)

How to Draw a Space Invader (muffinman.io)

Without the futex, it's futile (h4x0r.org)

Vendors that treat single sign-on as a luxury feature (sso.tax)

Emacs as your video-trimming tool (xenodium.com)

How to Build a Medieval Castle (archaeology.org)

Notion releases offline mode (www.notion.com)

Google is killing the open web (wok.oblomov.eu)

Positron, a New Data Science IDE (posit.co)

BBC witnesses settlers attack on Palestinian farm in West Bank (www.bbc.com)

Perfect Freehand – Draw perfect pressure-sensitive freehand lines (www.perfectfreehand.com)

Why Semantic Layers Matter (and how to build one with DuckDB) (motherduck.com)

Why I'm all-in on Zen Browser (werd.io)

Critical Cache Poisoning Vulnerability in Dnsmasq (lists.thekelleys.org.uk)

PyPI Preventing Domain Resurrection Attacks (blog.pypi.org)

'Ad Blocking Is Not Piracy' Decision Overturned by Top German Court (torrentfreak.com)

AnduinOS (www.anduinos.com)

XZ Utils Backdoor Still Lurking in Docker Images (www.binarly.io)

CRDT: Text Buffer (madebyevan.com)

Launch HN: Uplift (YC S25) – Voice models for under-served languages (news.ycombinator.com)

The forgotten meaning of "jerk" (languagehat.com)

Tiny microbe challenges the definition of cellular life (nautil.us)