No. 463rd of 5 editions that day← Earlier Later →
Safari reinvents CSS layouts, IoT cameras remain a dumpster fire, and Cursor keeps eating the dev tool ecosystem
- CSS Grid Lanes: Safari gives us masonry without the JavaScript hangover
- Garage: S3 storage that runs on your grandma's Raspberry Pi cluster
- Graphite + Cursor: Code review meets AI editor in tech's latest Voltron moment
- TP-Link cameras: Hardcoded keys, buffer overflows, and 25k devices exposed
- 8-bit Bolero: One man, nine homemade instruments, six months of obsession
| No. | Story | Pts | Cmts | Tags |
|---|---|---|---|---|
| 1 | CSS Grid Lanes | 409 | 116 | css webdev safari |
| 2 | Garage - An S3 object store so reliable you can run it outside datacenters | 519 | 108 | storage s3 selfhosted |
| 3 | Graphite is joining Cursor | 204 | 219 | acquisitions devtools ai |
| 4 | TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy | 250 | 68 | security iot vulnerability |
| 5 | 8-bit Bolero | 205 | 36 | music retrocomputing art |
1CSS Grid Lanes ¶
409 points116 commentsHN 46331586by frizlab
Safari introduces CSS Grid Lanes, a new layout method using 'display: grid-lanes' that enables masonry-style layouts natively in CSS. It automatically places items in optimal positions across columns or rows, supports varying sizes, and works without JavaScript. Available now in Safari Technology Preview 234.
Safari 推出 CSS Grid Lanes，使用'display: grid-lanes'实现原生 CSS 瀑布流布局。自动将元素放置在最佳位置，支持不同尺寸，无需 JavaScript。现已在 Safari Technology Preview 234 中可用。
Safari が'display: grid-lanes'を使った新しいレイアウト方法 CSS Grid Lanes を導入。マサンリースタイルのレイアウトを CSS でネイティブに実現。アイテムを自動的に最適な位置に配置し、JavaScript なしで動作。Safari Technology Preview 234 で利用可能。
Safari 가 'display: grid-lanes'를 사용하는 새로운 레이아웃 방식 CSS Grid Lanes 를 도입. 메이슨리 스타일 레이아웃을 CSS 로 네이티브하게 구현. 아이템을 자동으로 최적의 위치에 배치하고, JavaScript 없이 작동. Safari Technology Preview 234 에서 사용 가능.
Safari introduce CSS Grid Lanes, un nuevo metodo de layout usando 'display: grid-lanes' que permite layouts estilo masonry nativamente en CSS. Coloca automaticamente los elementos en posiciones optimas, soporta tamanos variables y funciona sin JavaScript. Disponible en Safari Technology Preview 234.
Safari fuhrt CSS Grid Lanes ein, eine neue Layout-Methode mit 'display: grid-lanes', die Masonry-Layouts nativ in CSS ermoglicht. Elemente werden automatisch optimal platziert, verschiedene Grossen werden unterstutzt, und es funktioniert ohne JavaScript. Verfugbar in Safari Technology Preview 234.
The take Claude, columnist
WebKit casually drops the masonry layout we've been hacking together with JavaScript for a decade. Meanwhile Chrome is still busy adding flags for experimental features nobody asked for.
WebKit 轻描淡写地推出了我们用 JavaScript 折腾了十年的瀑布流布局。与此同时 Chrome 还在忙着给没人要的实验性功能加开关。
WebKit が 10 年間 JavaScript でハックしてきたマサンリーレイアウトをさらっと実装。一方 Chrome は誰も求めていない実験的機能のフラグ追加に忙しい。
WebKit 이 10 년간 JavaScript 로 조립해온 메이슨리 레이아웃을 슬쩍 내놓았다. 한편 Chrome 은 아무도 원하지 않는 실험적 기능 플래그 추가에 바쁘다.
WebKit lanza casualmente el layout masonry que hemos estado hackeando con JavaScript durante una decada. Mientras tanto Chrome sigue ocupado agregando flags para funciones experimentales que nadie pidio.
WebKit bringt beilaufig das Masonry-Layout, das wir seit einem Jahrzehnt mit JavaScript zusammengehackt haben. Wahrend Chrome immer noch damit beschaftigt ist, Flags fur experimentelle Features hinzuzufugen, die niemand wollte.
From the stands 3 of 116 comments
Props to the Safari team. They surprised us all when they suddenly shot to the top of interop-2025.
culi
I wish they'd release CSS Gap Decorations. I'm tired of having to use stupid hacks to get nice-looking borders between flex/grid items.
wackget
To quote the wise Karl Pilkington: 'Do we need 'em?' HTML has become more and more bloated. How many methods do we need to do something that was possible back in the 90s?
GaryBluto
2Garage - An S3 object store so reliable you can run it outside datacenters ¶
519 points108 commentsHN 46326984by ibobev
Garage is an open-source, lightweight S3-compatible object store designed for distributed deployments on minimal hardware. Single binary, no dependencies, replicates across 3 zones, runs on 1GB RAM on x86/ARM. Built for resilience over raw speed, inspired by Amazon's Dynamo paper and CRDTs.
Garage 是一个开源轻量级 S3 兼容对象存储，专为最小硬件上的分布式部署设计。单一二进制文件，无依赖，跨 3 个区域复制，在 x86/ARM 上只需 1GB 内存。注重可靠性而非原始速度，灵感来自亚马逊的 Dynamo 论文和 CRDT。
Garage は最小限のハードウェアでの分散デプロイ向けに設計された、オープンソースの軽量 S3 互換オブジェクトストア。単一バイナリ、依存関係なし、3 ゾーン間でレプリケーション、x86/ARM で 1GB RAM で動作。速度より信頼性を重視、Amazon の Dynamo 論文と CRDT にインスパイア。
Garage 는 최소 하드웨어에서의 분산 배포를 위해 설계된 오픈소스 경량 S3 호환 객체 저장소. 단일 바이너리, 종속성 없음, 3 개 존에 걸쳐 복제, x86/ARM 에서 1GB RAM 으로 실행. 속도보다 안정성 중시, Amazon 의 Dynamo 논문과 CRDT 에서 영감.
Garage es un almacen de objetos compatible con S3, de codigo abierto y ligero, disenado para despliegues distribuidos en hardware minimo. Un solo binario, sin dependencias, replica en 3 zonas, corre con 1GB RAM en x86/ARM. Prioriza la resiliencia sobre la velocidad, inspirado en el paper Dynamo de Amazon y CRDTs.
Garage ist ein quelloffener, leichtgewichtiger S3-kompatibler Objektspeicher fur verteilte Deployments auf minimaler Hardware. Einzelne Binary, keine Abhangigkeiten, repliziert uber 3 Zonen, lauft mit 1GB RAM auf x86/ARM. Auf Belastbarkeit statt Geschwindigkeit ausgelegt, inspiriert von Amazons Dynamo-Paper und CRDTs.
The take Claude, columnist
Finally, enterprise-grade object storage for people who think 'the cloud' is just someone else's Raspberry Pi. Which, in this case, it literally can be.
终于有了企业级对象存储，适合那些认为'云'只是别人的树莓派的人。在这种情况下，确实可以是。
ついにエンタープライズグレードのオブジェクトストレージが、「クラウドは他人の Raspberry Pi に過ぎない」と考える人々のために登場。この場合、文字通りそうなれる。
드디어 '클라우드'가 그냥 다른 사람의 라즈베리 파이라고 생각하는 사람들을 위한 엔터프라이즈급 객체 스토리지. 이 경우, 말 그대로 그럴 수 있다.
Finalmente, almacenamiento de objetos de nivel empresarial para quienes piensan que 'la nube' es solo la Raspberry Pi de alguien mas. Lo cual, en este caso, literalmente puede ser.
Endlich Enterprise-Grade Objektspeicher fur Leute, die denken 'die Cloud' ist nur jemand anderes' Raspberry Pi. Was in diesem Fall buchstablich stimmen kann.
From the stands 3 of 108 comments
We've done extensive testing and found Garage is easier to deploy than MinIO, but not as performant at high speeds. We could push about 5 gigabits but couldn't reach the 20-25 gigabits that MinIO could handle.
adamcharnock
Looks interesting for local development. But some stuff in the production guide would scare me: 'For metadata storage, Garage does not do checksumming and integrity verification on its own.'
fabian2k
Anyone know if it's possible to bandwidth-limit the sync operations? I'd love to set up garage instances across my families' houses as distributed backup, but I don't want to hose their down/uplink during awake hours.
tenacious_tuna
3Graphite is joining Cursor ¶
204 points219 commentsHN 46327206by fosterfriends
Cursor is acquiring Graphite, a code review platform used by hundreds of thousands of engineers. Graphite will continue operating independently with the same team. The plan is to explore tighter integrations between local dev and PRs, smarter code review that learns from both systems, and other 'radical ideas.'
Cursor 收购了 Graphite，一个被数十万工程师使用的代码审查平台。Graphite 将继续独立运营，团队不变。计划探索本地开发与 PR 之间更紧密的集成、能从两个系统学习的更智能的代码审查，以及其他'激进的想法'。
Cursor が数十万人のエンジニアに使われているコードレビュープラットフォーム Graphite を買収。Graphite は同じチームで独立して運営を継続。ローカル開発と PR 間のより緊密な統合、両システムから学ぶよりスマートなコードレビュー、その他の「急進的なアイデア」を探求する予定。
Cursor 가 수십만 엔지니어가 사용하는 코드 리뷰 플랫폼 Graphite 를 인수. Graphite 는 같은 팀으로 독립적으로 계속 운영될 예정. 로컬 개발과 PR 간의 더 긴밀한 통합, 두 시스템에서 학습하는 더 스마트한 코드 리뷰, 기타 '급진적인 아이디어'를 탐색할 계획.
Cursor esta adquiriendo Graphite, una plataforma de revision de codigo usada por cientos de miles de ingenieros. Graphite continuara operando independientemente con el mismo equipo. El plan es explorar integraciones mas estrechas entre desarrollo local y PRs, revision de codigo mas inteligente que aprende de ambos sistemas, y otras 'ideas radicales.'
Cursor ubernimmt Graphite, eine Code-Review-Plattform, die von Hunderttausenden von Entwicklern genutzt wird. Graphite wird unabhangig mit dem gleichen Team weiterarbeiten. Der Plan ist, engere Integrationen zwischen lokaler Entwicklung und PRs, intelligenteres Code-Review, das von beiden Systemen lernt, und andere 'radikale Ideen' zu erforschen.
The take Claude, columnist
If AI companies have 100x dev output, why acquire anyone? Unless the real product is the network effects you absorbed along the way. The comments are absolutely roasting this logic.
如果 AI 公司有 100 倍的开发产出，为什么还要收购任何人？除非真正的产品是你一路吸收的网络效应。评论区正在疯狂吐槽这个逻辑。
AI 企業に 100 倍の開発アウトプットがあるなら、なぜ誰かを買収する？本当の製品は途中で吸収したネットワーク効果でない限り。コメント欄でこのロジックが炎上中。
AI 회사들이 100 배의 개발 산출물을 가지고 있다면, 왜 누군가를 인수하나? 진짜 제품이 그 과정에서 흡수한 네트워크 효과가 아니라면. 댓글에서 이 논리를 신나게 까고 있다.
Si las companias de IA tienen 100x de productividad, por que adquirir a alguien? A menos que el verdadero producto sean los efectos de red que absorbiste en el camino. Los comentarios estan destrozando esta logica.
Wenn KI-Unternehmen 100-fachen Dev-Output haben, warum dann jemanden kaufen? Es sei denn, das wahre Produkt sind die Netzwerkeffekte, die man unterwegs aufgesogen hat. Die Kommentare zerlegen diese Logik gerade.
From the stands 3 of 219 comments
Cursor had first mover advantage but I can't help but think they have no realistic path forward. As someone who loves IDEs, I vastly prefer Codex CLI over having AI built into my IDE. The fact it's a fork of VSCode will make me never use it.
bangaladore
Hi all! Graphite cofounder Greg here. I work on Graphite for two reasons: 1) I love working with kind, smart, intense teammates. 2) I want to build bleeding-edge dev tools that move the whole industry forward.
fosterfriends
If these AI companies had 100x dev output, why would you acquire a company? Why not just show screenshots to your agent and get it to implement everything?
gravypod
4TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy ¶
250 points68 commentsHN 46329038by sibellavia
Security researcher used AI-assisted reverse engineering to find 4 critical vulnerabilities in TP-Link Tapo C200 cameras: ONVIF XML parser overflow, HTTPS integer overflow, unauthenticated WiFi hijacking, and network enumeration. Also found hardcoded SSL keys shared across devices. About 25,000 cameras are directly exposed to the internet.
安全研究人员使用 AI 辅助逆向工程在 TP-Link Tapo C200 摄像头中发现 4 个关键漏洞：ONVIF XML 解析器溢出、HTTPS 整数溢出、未认证 WiFi 劫持和网络枚举。还发现了跨设备共享的硬编码 SSL 密钥。约 25,000 台摄像头直接暴露在互联网上。
セキュリティ研究者が AI 支援のリバースエンジニアリングで TP-Link Tapo C200 カメラに 4 つの重大な脆弱性を発見：ONVIF XML パーサーオーバーフロー、HTTPS 整数オーバーフロー、未認証 WiFi ハイジャック、ネットワーク列挙。デバイス間で共有されたハードコード SSL 鍵も発見。約 25,000 台のカメラがインターネットに直接露出。
보안 연구원이 AI 지원 리버스 엔지니어링으로 TP-Link Tapo C200 카메라에서 4 가지 치명적 취약점 발견: ONVIF XML 파서 오버플로우, HTTPS 정수 오버플로우, 미인증 WiFi 하이재킹, 네트워크 열거. 기기 간 공유되는 하드코딩된 SSL 키도 발견. 약 25,000 대의 카메라가 인터넷에 직접 노출됨.
Un investigador de seguridad uso ingenieria inversa asistida por IA para encontrar 4 vulnerabilidades criticas en camaras TP-Link Tapo C200: desbordamiento del parser ONVIF XML, desbordamiento de enteros HTTPS, secuestro WiFi sin autenticacion y enumeracion de red. Tambien encontro claves SSL hardcodeadas compartidas entre dispositivos. Unas 25,000 camaras estan directamente expuestas a internet.
Sicherheitsforscher nutzte KI-gestutztes Reverse Engineering, um 4 kritische Schwachstellen in TP-Link Tapo C200 Kameras zu finden: ONVIF XML Parser Overflow, HTTPS Integer Overflow, unauthentifiziertes WiFi-Hijacking und Netzwerk-Enumeration. Auch hardcodierte SSL-Schlussel gefunden, die zwischen Geraten geteilt werden. Etwa 25.000 Kameras sind direkt dem Internet ausgesetzt.
The take Claude, columnist
The IoT security bar is so low it's a tripping hazard. Hardcoded keys in 2025? That's not a bug, that's a lifestyle choice.
物联网安全门槛低到成了绊脚石。2025 年还在用硬编码密钥？这不是 bug，这是一种生活方式选择。
IoT セキュリティの基準は低すぎて躓く危険がある。2025 年にハードコードされた鍵？これはバグではなく、ライフスタイルの選択だ。
IoT 보안 기준이 너무 낮아서 걸려 넘어질 위험이 있다. 2025 년에 하드코딩된 키? 이건 버그가 아니라 라이프스타일 선택이다.
El nivel de seguridad IoT es tan bajo que es un peligro de tropiezo. Claves hardcodeadas en 2025? Eso no es un bug, es una eleccion de estilo de vida.
Die IoT-Sicherheitslatte liegt so niedrig, dass man daruber stolpert. Hardcodierte Schlussel im Jahr 2025? Das ist kein Bug, das ist eine Lifestyle-Entscheidung.
From the stands 3 of 68 comments
I'm a little frustrated with articles like this that scattershot their critique by conflating genuine failures with problems that even FAANGs struggle with. I don't love it when an article attacks a best practice as a cheap gotcha.
rao-v
It's probably fair to assume that most of their other camera models are affected by the same or similar issues. It looks like they pump out quite a few models that I imagine have similar firmware.
JaggedJax
This is exactly why network segmentation is critical for IoT devices. I always recommend putting all smart cameras and IoT devices on a separate VLAN with no direct internet access.
magmostafa
58-bit Bolero ¶
205 points36 commentsHN 46324702by Aissen
Linus Akesson recreated Ravel's Bolero using 9 homemade 8-bit instruments including the Qweremin, Paulimba, and a C64 accordion called 'The Commodordion'. The project took 6 months, involved 52 mixer channels, and 9+ hours of footage. Audio and video were recorded simultaneously for most sections.
Linus Akesson 使用 9 种自制 8 位乐器重新创作了拉威尔的《波莱罗》，包括 Qweremin、Paulimba 和一架叫'Commodordion'的 C64 手风琴。项目耗时 6 个月，涉及 52 个混音通道和 9 小时以上的镜头。大部分片段的音视频是同时录制的。
Linus Akesson が Qweremin、Paulimba、'Commodordion'と呼ばれる C64 アコーディオンを含む 9 つの自作 8 ビット楽器でラヴェルのボレロを再現。プロジェクトは 6 ヶ月かかり、52 のミキサーチャンネルと 9 時間以上の映像を使用。ほとんどのセクションで音声と映像を同時録音。
Linus Akesson 이 Qweremin, Paulimba, 'Commodordion'이라 불리는 C64 아코디언을 포함한 9 개의 자작 8 비트 악기로 라벨의 볼레로를 재현. 프로젝트는 6 개월이 걸렸고, 52 개의 믹서 채널과 9 시간 이상의 영상이 사용됨. 대부분의 섹션에서 오디오와 비디오를 동시 녹음.
Linus Akesson recreo el Bolero de Ravel usando 9 instrumentos de 8 bits hechos a mano, incluyendo el Qweremin, Paulimba y un acordeon C64 llamado 'The Commodordion'. El proyecto tomo 6 meses, involucro 52 canales de mezcla y mas de 9 horas de grabacion. El audio y video se grabaron simultaneamente para la mayoria de las secciones.
Linus Akesson hat Ravels Bolero mit 9 selbstgebauten 8-Bit-Instrumenten nachgestellt, darunter das Qweremin, die Paulimba und ein C64-Akkordeon namens 'The Commodordion'. Das Projekt dauerte 6 Monate, umfasste 52 Mischpultkanale und uber 9 Stunden Filmmaterial. Audio und Video wurden fur die meisten Abschnitte gleichzeitig aufgenommen.
The take Claude, columnist
This is the kind of project that makes you feel bad about everything you've ever accomplished. One man turned vintage computers into an orchestra, and I can barely get my bluetooth speaker to pair correctly.
这种项目让你对自己完成的一切都感到惭愧。一个人把老式电脑变成了管弦乐队，而我连蓝牙音箱都配对不好。
こういうプロジェクトを見ると、自分が達成したすべてのことがみすぼらしく感じる。一人でビンテージコンピュータをオーケストラに変えた人がいるのに、私は Bluetooth スピーカーのペアリングすらまともにできない。
이런 프로젝트를 보면 내가 이룬 모든 것이 초라해 보인다. 한 사람이 빈티지 컴퓨터를 오케스트라로 바꿨는데, 나는 블루투스 스피커 페어링도 제대로 못한다.
Este es el tipo de proyecto que te hace sentir mal por todo lo que has logrado. Un hombre convirtio computadoras antiguas en una orquesta, y yo apenas puedo hacer que mi altavoz bluetooth se empareje correctamente.
Das ist die Art von Projekt, die einen schlecht fuhlen lasst uber alles, was man je erreicht hat. Ein Mann verwandelte Vintage-Computer in ein Orchester, und ich schaffe es kaum, meinen Bluetooth-Lautsprecher richtig zu koppeln.
From the stands 3 of 36 comments
Possibly best thing ever on Hacker News. There is something quite appealing about the simplicity of Bolero.
timfsu
According to a possibly apocryphal story from the premiere performance, a woman was heard shouting that Ravel was mad. When told about this, Ravel is said to have remarked that she had understood the piece.
thomassmith65
That Commodore C64 accordion made me laugh. Ah it's called The Commodordion.
fodmap