HN Buddy

Daily digest of top Hacker News posts and comments

Subscribe to the HN Buddy Daily Digest

Your email will only be used for the HN Buddy Daily Digest. I will not share it with anyone.

HN Buddy Daily Digest

Thursday, March 5, 2026

Hey buddy,

Man, you won't believe the stuff that popped up on Hacker News today. Had to give you a quick rundown.

Wikipedia Got Hacked!

First off, Wikipedia went into read-only mode because a bunch of admin accounts got compromised. Like, seriously? Admins! Imagine the chaos. Some folks in the comments were grumbling about how annoying two-factor authentication (2FA) can be for admins who are constantly modifying JavaScript, which kinda makes sense, but still... security first, right? And get this, apparently the malicious script that caused all this had a URL in it, but it didn't even load the JavaScript from it. Maybe the attacker made a mistake, haha.

Uncle Sam Owes a Ton of Money

Then there's this huge news: a judge just ordered the government to start refunding over $130 billion in tariffs! That's a ridiculous amount of cash. The judge basically said the Customs Service needs to get with the times and use computers instead of manual reviews for this stuff. One guy in the comments was already complaining about DHL's tax document links being broken for a year, making it impossible to get VAT back. Sounds like a mess is brewing.

Google Workspace CLI is Here

For the dev nerds, Google released a command-line interface (CLI) for Google Workspace. People are actually pretty excited because it seems to work way better with Google Docs than other tools that just replace your whole document. But, classic Google, everyone's still griping about how much of a pain authentication is across all their products – all those "projects" and billing accounts just to get an API key. Annoying!

GPT-5.4 Dropped

And of course, more AI news: OpenAI introduced GPT-5.4. There's a lot of chatter about whether OpenAI is taking the right path with all these model versions, and how everyone uses prompts differently. But honestly, most people probably just leave it on auto-select anyway, so maybe it's not as big a deal for them.

Do LLMs Lie?

There was an interesting article titled "The L in "LLM" Stands for Lying." The author argues that LLMs "lie" when they produce falsehoods. But a ton of people in the comments immediately pushed back, saying an LLM can't lie because lying requires intent to deceive, and LLMs don't have free will or intent. They just generate text, whether it's true or false. Good point, actually.

Pentagon Flags Anthropic

This one's a bit wild: the Pentagon formally labeled Anthropic, that big AI company, as a supply-chain risk. It's pretty significant. Some folks in the comments were wondering why people are still flocking to Anthropic when it's already been used in a war, while other providers haven't. It really makes you think about where to draw those ethical lines with AI companies.

GitHub Issue Title Hacks 4,000 Dev Machines

And finally, a super scary one for developers: a malicious GitHub issue title actually compromised 4,000 developer machines! Apparently, it tricked an AI triage bot. People are saying this highlights the danger of trying to solve trust issues with more automation, and that we absolutely need to sandbox our AI agents. The sneaky part? The malicious link in the issue title pointed to a forked repository, making it look legitimate. Yikes!

Anyway, that's the quick download. Talk later!

All Stories from Today

Wikipedia was in read-only mode following mass admin account compromise (www.wikimediastatus.net)

Judge orders government to begin refunding more than $130B in tariffs (www.wsj.com)

Google Workspace CLI (github.com)

GPT-5.4 (openai.com)

The L in "LLM" Stands for Lying (acko.net)

No right to relicense this project (github.com)

Good software knows when to stop (ogirardot.writizzy.com)

Pentagon formally labels Anthropic supply-chain risk (www.wsj.com)

A GitHub Issue Title Compromised 4k Developer Machines (grith.ai)

Relicensing with AI-Assisted Rewrite (tuananh.net)

Nvidia PersonaPlex 7B on Apple Silicon: Full-Duplex Speech-to-Speech in Swift (blog.ivan.digital)

Proton Mail Helped FBI Unmask Anonymous 'Stop Cop City' Protester (www.404media.co)

The Brand Age (paulgraham.com)

The government uses targeted advertising to track your location (www.eff.org)

Google Safe Browsing missed 84% of confirmed phishing sites (www.norn-labs.com)

Show HN: Jido 2.0, Elixir Agent Framework (jido.run)

You Just Reveived (dylan.gr)

Jensen Huang says Nvidia is pulling back from OpenAI and Anthropic (techcrunch.com)

Poor Man's Polaroid (boxart.lt)

Noem Can't Explain Why She Hired 8-Day-Old Company for Ad Campaign (newrepublic.com)

US tech firms pledge at White House to bear costs of energy for datacenters (www.theguardian.com)

The next generations of Bubble Tea, Lip Gloss, and Bubbles are available now (charm.land)

Show HN: Poppy – A simple app to stay intentional with relationships (poppy-connection-keeper.netlify.app)

Labor market impacts of AI: A new measure and early evidence (www.anthropic.com)

A standard protocol to handle and discard low-effort, AI-Generated pull requests (406.fail)

GPT-5.4 (openai.com)

US asked Ukraine for help fighting Iranian drones, Zelensky says (www.bbc.com)

Smalltalk's Browser: Unbeatable, yet Not Enough (blog.lorenzano.eu)

Remotely unlocking an encrypted hard disk (jyn.dev)

Let's Get Physical (m4iler.cloud)