HN Buddy

Daily digest of top Hacker News posts and comments

Subscribe to the HN Buddy Daily Digest

Your email will only be used for the HN Buddy Daily Digest. I will not share it with anyone.

HN Buddy Daily Digest

Thursday, October 22, 2026

Hey buddy, long time no talk! Quick rundown of Hacker News from yesterday, Thursday, October 22nd. Some wild stuff, man.

Quad9 Bails on France

First up, remember Quad9, that privacy-focused DNS thing? Well, they're pulling out of France. Apparently, some French court told them to block certain websites, and Quad9 was like, "Nah, that's not our gig." The comments were all over it, with people debating if an IP address even has a country, and how crazy it is to expect companies to know every single law everywhere. Super interesting.

eMudhra's SSL Certificate Exit

Then, there's this company called eMudhra, which used to issue those SSL certificates that make websites secure. They're getting out of the global business. This one sparked a huge debate in the comments. Some folks were questioning if non-US certificate authorities are less trustworthy, which got others calling out potential racism. Also, someone pointed out that since major browsers are US-made, there's already a big trust on US vendors anyway. Pretty deep stuff about who controls the internet's trust.

Switch 2 Jailbreak Already?!

Get this, someone's already managed to jailbreak the new Switch 2! Like, it just came out! The comments were talking about how console makers usually sell hardware at a loss and make money on games later. One cool thing was how people are apparently using AI to help with reverse engineering for stuff like this, but keeping their prompts super vague to avoid giving away too much. Smart!

CashApp Fraud Nightmare

This story was super wild and kinda scary: a woman got charged with computer fraud because a scam CashApp account was opened in her name, and she might not have even known about it. People in the comments were like, "How is a DA even confident enough to charge her with this?" given how easy identity theft is and the high bar for evidence. Imagine being in that situation, man.

AI Pretending to be a Terminal

On the lighter, but still techy side, someone built this really cool project called WorldTUI. It's a 360M AI model that basically pretends to be a terminal. You type commands, and it tries to act like a real shell. Comments thought it could be useful for cybersecurity honeypots. There were also some funny examples of the AI getting confused by basic shell commands like `$_`. Cute.

PHP RCE Embargo Oopsie

So, someone posted a "Tell HN" about accidentally breaking a PHP RCE embargo. RCE means Remote Code Execution, so a serious bug. They unknowingly spilled the beans on a vulnerability before it was supposed to go public. The comments were deep into the ethics of responsible disclosure and how hard it is to keep these things secret once people start looking. Amazon actually picked up on the exploitation of it before public disclosure, too, which is wild. (Link to Amazon's take)

iOS on Android Devices!

And finally, this is pretty mind-blowing: someone managed to get full iOS 16.5 firmware running on Android devices! People were calling it "incredible work" and a huge step for "Apple Silicon hackintoshes." But, of course, there were comments about the legal side, like potential issues with counterfeit goods or using GPL code. Still, super cool tech!

Anyway, that's the gist of it. Talk later!

All Stories from Today

Quad9 to exit France (quad9.net)

eMudhra to exit global SSL/TLS certificate business (emudhra.com)

Jailbreaking the Switch 2 (pepsipu.com)

Woman charged with computer fraud due to scam CashApp account being in her name (www.404media.co)

WorldTUI: I trained a 360M model to pretend to be a terminal (simedw.com)

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry. (news.ycombinator.com)

Run full iOS 16.5 firmware on Android Devices (github.com)

Docker is weird (codeandcake.dev)

Jared Kushner Hacked Phone Reveals Secret Negotiations, Millions in Transactions (www.vanityfair.com)

OpenShell – A safe, private runtime for fleets of autonomous AI agents (github.com)

Every AI model has the same "controversial" take on humans (www.modelcompare.ai)

What’s getting pwned right now (pwn.watch)

CVE-2026-111943: Compromised Intermediate Certificate Authority (nvd.nist.gov)

LLMs are making formal software verification feasible at a much larger scale (www.anthropic.com)

Google cleared 300 hectares of Finnish forest (www.techspot.com)

The recently proposed o(n log n) integer multiplication algorithm [pdf] (web.maths.unsw.edu.au)

Xbox wants you to pay 24 to 40 cents per hour to stream games you bought (arstechnica.com)

Getting ready to operate GNU Taler in Germany (www.taler.net)

A farewell to Arc browser (arc.net)

Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure (aws.amazon.com)

MPs moving to restrict gambling ads in Canada (www.cbc.ca)

Several Linux kernel vulnerabilities accidentally posted to public mailing list (www.phoronix.com)

OpenAI CLI (github.com)

Local Wikipedia: Wikipedia, but only for things a half hour walk from you (edjefferson.com)

Faster than earcut: triangulating 3.7M map polygons in 489 ms (globus.software)

Epic Games Inc v Apple Inc (www.judgments.fedcourt.gov.au)

Hedra is a 3D open world game I wrote from scratch while in highschool (github.com)

Crystal 1.22 (crystal-lang.org)

A complete bypass of eMudhra’s 1FA OTP login system (mastodon.catgirl.cloud)

AI and the Enclosure of the Scientific Commons (arxiv.org)