Coding Agents and Hardware Security

In this issue

The Personal Security Risks of Passkeys
Local Server Access with Cloudflare Quick Tunnels
Saving 100 TB of RAM at Cloudflare
Bend 2 and the Vibe-Coding Trap
South Korea Raises Data Breach Penalties
The Human Brain Is Two Separate Organs
and 4 more in brief

Infrastructure and security

The Personal Security Risks of Passkeys

Ethan Hawksley argues that passkeys excel in corporate environments but fall short for personal security. Their asymmetric design prevents server breaches from exposing credentials usable for login and protects against phishing pages. For individuals, however, permanent lockouts, automated account bans, and lost devices remain major risks. Hardware-key passkeys cannot be backed up, only added or deleted. This means buying two or three keys and registering each with every site. Hardware keys typically accommodate 25–100 accounts, with higher-end models supporting up to 300. Exceeding capacity requires deleting accounts or buying another set of keys.

hawksley.dev HN discussion

Local Server Access with Cloudflare Quick Tunnels

Cloudflare Quick Tunnels turns a laptop server into an encrypted public URL connected to Cloudflare's edge with one command. The cloudflared client opens an outbound connection to the nearest edge location; traffic returns through Cloudflare's encrypted, DDoS-filtered network. No inbound port is opened, and HTTPS and edge DDoS protection are included. With edge locations in more than 335 cities, a reviewer in Tokyo and a webhook in Frankfurt connect to their nearest location. No registration, configuration file, or DNS propagation wait is required; the URL appears in roughly three seconds.

try.cloudflare.com HN discussion

Saving 100 TB of RAM at Cloudflare

Cloudflare saved 100 TB by using statistical methods to reduce RAM consumption in one of its Pingora-based services. The implementation uses Rust. The company describes its global network as large but finite, prompting a search for small resource reductions. Here, that search yielded a much larger capacity gain than expected.

blog.cloudflare.com HN discussion

Artificial intelligence and science

Bend 2 and the Vibe-Coding Trap

Liam Powell argues that Bend 2, a language designed for AI-assisted coding, has fallen into the vibe-coding trap. Its homepage demo takes 58 lines to specify that a player cannot touch the flag or win the game, while the proofs require 442. Vibe-coding allows extensive solutions before their authors sufficiently understand the problem. Powell suggests the developer may have built the language without knowing the field existed: formal verification is mentioned neither on Bend's website nor in its codebase. SPARK is an open-source language and compiler for formal verification.

blog.liampwll.com HN discussion

South Korea Raises Data Breach Penalties

South Korea's revised privacy rules allow fines of up to 10 percent of annual revenue for data leaks caused by gross negligence. Disclosures of high-risk personal information must be reported within 72 hours. Personal Information Protection Commission chair Song Kyung-hee addressed a session at the government complex in Seoul. By sharply increasing breach costs, the regulator aims to encourage companies to prioritize data protection.

koreajoongangdaily.com HN discussion

The Human Brain Is Two Separate Organs

Stanford Medicine-led research finds that the human brain comprises two organs that evolved independently over hundreds of millions of years, overturning a widely accepted developmental model. Researchers had long assumed that a single early stem cell gave rise to the entire brain. The findings instead describe two ancient nervous systems packaged together. The more primitive system regulates heartbeat, breathing, and other functions; the other enables poetry, mathematics, and reflection on our origins. The discovery could explain difficulties in growing particular brain cells in the laboratory.

med.stanford.edu HN discussion

In brief

AI-Generated Event Posters. A widely circulated Facebook post illustrates the problem of similar AI-generated posters, including those for Leamington Beer Festival 2026. Seeing the same style twenty times makes its repetition irritating, even though ChatGPT can produce other styles.

john.hartnup.uk HN discussion

A Proof of Conway's Conjecture. John Conway's fifty-year-old refinement conjecture has been proved in Lean. The proof establishes the refinement property for omnific integers: if ab = cd, there exist integers e, f, g, h such that a = ef, b = gh, c = eg, and d = fh.

overreacted.io HN discussion

Research into Coding Agents. An arXiv study examines coding interfaces through three components: planning, action space, and context management. It tests 176 matched configurations across four models on SWE-Bench Verified and Terminal-Bench 2.1. Context management becomes more valuable as the context-window budget shrinks.

arxiv.org HN discussion

An RP2350 Security Vulnerability. Photon-emission microscopy located debug-enable registers in Raspberry Pi's RP2350. Laser pulses restored permanently disabled Secure-world debug access. A secret was recovered from one-time-programmable memory after a recovery reset halted the chip before firmware applied its runtime lock.

donjon.ledger.com HN discussion