0815 | Everything Goes Dark, Firefox's Last uBlock, GLM-5.3, HEIR

Mia: Hey everyone, welcome back to HackerNews Daily. I'm Mia, and as always I'm joined by my co-host Milo.

Milo: Hey hey! Great to be here. And we've got a packed show for you today — we're talking everything from the web going dark on encryption, to Firefox's last-stand battle with ad blockers, to some seriously powerful new AI models.

Mia: That's right — we've also got a story about a cryptographer sounding alarm bells, a court ruling in France over teen social media, and even Australia's home battery boom. Plus a truly bizarre piece about the quiet decline of software quality.

Milo: So grab your headphones — big news, big debates, and the tech world's biggest talking points, all right here. Let's dive in! This is going to be a good one.

Mia: So let's start with the going dark warning from Matthew Green, the cryptographer at Johns Hopkins. He published a post on his Cryptography Engineering blog after spending several days at the Usenix Security conference in Baltimore, and his argument is that AI is about to make software much too secure for intelligence and law enforcement to crack. His stated fear is that U.S. agencies are about to lose a huge portion of their capability, and he argues this will matter for anyone who cares about computer security and privacy more broadly.

Milo: And his point is that this isn't a new trend. Green traces it all the way back to the surveillance world of 2002, think payphones and burner phones from The Wire, to today's encrypted smartphones. Apple started encrypting iPhone data with a passcode-derived key back in 2010, Google followed, Apple rolled out end-to-end encrypted messaging in 2011, and WhatsApp went from 600 million users in 2014 to nearly a billion by 2016, all of it end-to-end encrypted.

Mia: He also recalls the history on the law enforcement side. FBI Director Comey announced the so-called Going Dark initiative in 2014, and then in 2016, after a terrorist attack left the FBI with a locked iPhone, the agency ordered Apple to give them access and Apple refused. So this has been an open fight for over a decade.

Milo: The comment section mostly latched onto a different angle, self-hosting. One commenter read the piece as a pretty strong argument to self host your own infrastructure. Another extended that to AI specifically, arguing there's likely to be pressure on U.S. AI labs to make their models help law enforcement, whether through backdoors in generated code or by not reporting exploitable bugs. And their point is that AI agents basically become the threat inside your infrastructure, especially since the largest AI providers are U.S.-based, even if this isn't only a U.S. problem. So the conversation ultimately lands on a tension: AI could make encryption too strong for the government, while at the same time making your own systems more exposed to the companies building those agents.

Mia: Switching from the threat side to the fix side, Google's security blog is showcasing HEIR, an open-source compiler added to its Private Computing Toolkit. The goal is to make private AI inference practical using homomorphic encryption, which is the technique that lets computations run on encrypted data. So a server can process your ciphertext and return encrypted results without ever seeing the underlying information. Google frames this as shifting the capability-versus-privacy tradeoff into a question of cost, and that cost is dropping fast.

Milo: Right, and the key thing they emphasize is that unlike hardware-based security solutions, the guarantees here are purely cryptographic. HEIR takes pre-trained AI models that normally run on unencrypted data and converts them to operate on encrypted inputs, with a long-term vision of becoming a one-click solution for non-experts.

Mia: Google first announced its intentions back in 2023, and since then it reports partnerships with hardware accelerator companies Belfort, Niobium, Cornami, and Optalysys, plus collaborations with a long list of universities including Georgia Tech, Carnegie Mellon, UC Santa Barbara, Purdue, and Tsinghua, among others. Four peer-reviewed papers have been built on top of HEIR.

Milo: And they've actually compiled four applications and published single-threaded CPU latency figures. There's a deep learning recommendation model built with Belfort Labs, LG, and NYU; credit card fraud detection with Niobium and hardshell.ai; the Kitsune network anomaly detection system with Niobium; and a hotword detector with Belfort Labs. Google says it plans to demonstrate the latency benefits of those hardware accelerators in the near future. Realistically though, homomorphic encryption is still going to be slower than running on plain data, so the open question is whether those costs fall enough to feel practical. And the Hacker News discussion splits along those lines, some people focused on the cryptographic promise, others on whether you can actually trust the institution running the computation in the first place. The privacy guarantee only means much if you trust the entity holding your data not to misuse the decrypted version of it.

Mia: And if you want a more immediate way to protect yourself in the browser, there's this: PCWorld is reporting that Firefox is now the last major browser that still supports uBlock Origin. Firefox confirmed it directly on a Bluesky post, saying its support for uBlock Origin isn't going anywhere. That was in direct response to news that Microsoft Edge will soon lock out uBlock Origin and other ad-blocking extensions built on the older Manifest V2 architecture.

Milo: So walk me through why that matters.

Mia: Once Edge moves to Manifest V3, ad-blocking extensions won't have access to the functions they need to properly identify and block ads while browsing websites and watching videos. Edge is built on Chromium, the engine that powers most browsers today, including Opera, Brave, Vivaldi, and Samsung Browser. Google started the whole Manifest V2 to V3 migration, and Edge is simply following Google's lead.

Milo: So that leaves Firefox, which is one of the few remaining non-Chromium browsers, as the only major one still supporting uBlock Origin. Neither Safari nor DuckDuckGo, the other major non-Chromium browsers, support it. On any other browser, users would have to settle for uBlock Origin Lite, which has fewer features and less ad-blocking success, or whatever built-in blocker the browser ships with.

Mia: The article, which comes from the Swedish sister publication PC för Alla, quotes a reaction vowing to never return to Chrome while uBlock Origin is supported on Firefox, calling it officially Firefox's killer app. And the commenters added more nuance. One argued anyone can build a custom extension to do anything extensions are allowed to do, describing how they used Claude over the past month to build their own. So the practical takeaway is that Firefox just became the last real home for full-strength ad blocking in a major browser, and that's a meaningful differentiator, but not everyone agrees it's permanent.

Mia: Finally, a project that speaks to anyone tired of reading on their phone. A Hacker News thread centers on a post titled "I turned my RSS feeds into an e-ink newspaper to stop reading on my phone." The author bought a pocket-sized X4 e-reader from Xteink, about 4.3 inches, with no touchscreen, no backlight, and no built-in bookstore. That sounds bare bones, but a small community has built open-source firmware for it called Crosspoint, which also runs on other ESP32C3-based devices. The author installed it after just three clicks, bought a DRM-free e-book, and it worked.

Milo: Then the clever part. Using Feedbin as the RSS reader, they fetched all their unread posts through its API, marked them as read, and generated an e-pub. They filtered out feeds that don't make sense on e-ink, like YouTube channels, JavaScript-heavy blogs, and link-only newsletters. The resulting tool is called feedpaper, it installs via Homebrew, and the author admits they only support macOS.

Mia: The discussion turned on whether people can actually abandon their phones for e-ink reading. One commenter says the lack of a decent RSS client is a major reason they stay on an iPad instead of an e-ink tablet, and they wish manufacturers like Remarkable would take software platforms more seriously. In reply, someone pointed to freeMarkable on GitHub, and another commenter said they built a web-based RSS reader for the Kindle browser that should also work on other e-ink devices, letting you read feeds online or download them directly through inkfeed.xyz.

Milo: But the reality check came from another commenter, who reported that inkfeed.xyz returns a fetch error for every single feed. So the pattern here is familiar: a genuinely neat DIY workflow for escape into distraction-free reading, a bunch of promising alternatives in the comments, and then a reminder that a lot of these indie tools still rely on single points of failure. For anyone ready to try feedpaper, the project is out there, but the takeaway from this one is that the e-ink reading ecosystem is still very much a do-it-yourself space.

Mia: Z.ai just dropped GLM-5.3, and the headline is right there in the name: frontier coding with what they're calling emergent cyber capabilities. Same base model as GLM-5.2 — every single gain here comes from post-training, not from a new architecture. And Z.ai is claiming this is now the most capable open-weights coding model out there, up 50 percent over its predecessor on their own in-house coding benchmark.

Milo: Worth saying what that 50 percent jump actually looks like in concrete terms. On one terminal benchmark, the score went from 4.6 to 28.3. On a software engineering benchmark, from 46 to nearly 67. And the genuinely notable part is the cyber piece — they say it's developed faster than expected, state of the art on their vulnerability-discovery benchmark, and more than doubling the previous model on exploitation benchmarks.

Mia: Right — and because the gains are all post-training, the weights arrive in about two weeks, after their safety evaluation and hardening pass. The tech team credits environment scaling and synthesized verification pipelines, with judge agents checking that tasks are actually solvable, and they say human-in-the-loop work remains with more autonomous environment generation coming next.

Milo: The Hacker News thread, though, is less about the model and more about the walls around it. One commenter calls today's release flood hard to navigate except by price. Another is choosing between a Z.ai coding plan and waiting for the aggregator route, having found the previous GLM solid but just shy of a leading Anthropic model in his security-auditing tests — this is the model he mostly uses, he says, because American vendors restrict their best models for security work. And there's a running theme: one person switched to the Chinese open models even for basic issue triage, calling the guardrails on the American side ridiculous, while another says his Opus tier outright refused security work, so he moved to Kimi and DeepSeek for API testing because they're cheaper.

Mia: On the open-model side, Qwen just posted the next generation of its family: Qwen3.8-27B, built on the Qwen3.5 architecture and described on the model card as the most capable generation of the open family to date, with gains across coding, professional work, research, and long-horizon agentic tasks. The 27B variant is a native vision-language model, so it understands images and video, with flexible control over how much it thinks.

Milo: This one is specifically the FP8-quantized weights. And there's a practical point that makes it worth attention: it's a 27-billion-param dense model that commenters are comparing to a top-tier frontier model in capability. One user called the earlier generation the best compromise between size and intelligence on consumer hardware, and this thread is full of people who can actually run it — on a laptop, one says, and another is ready to throw it at his high-end handheld hardware. The submitter framed it as one of the most important releases in a while precisely because most real use cases don't need the frontier models.

Mia: The repository ships the quantized weights and config files, compatible with the standard transformers library plus the big inference engines. The card says the fine-grained quantization is near-lossless in performance versus the original, and mentions a hosted version coming soon with a default 1-million-token context length and official built-in tools. It's Apache 2.0 licensed. One small note from the comments: people are squabbling over which prior generation this actually supersedes, since one commenter praised the older 27B and another pointed out the generation in between never got an open-weight version.

Milo: There's a through-line worth sitting on: the commenters are less excited about raw capability than about what the size unlocks. The theme is a dense 27B model performing at frontier level and actually running on hardware people own. That reframes the whole release — it's not another spec sheet, it's the argument that most workloads don't need to wait in line for the most expensive frontier API.

Mia: DeepSeek made its V4-Pro generally available with a big surprise buried in the release notes: peak and off-peak API pricing. Off-peak is 50 percent lower than peak, and the new rates take effect on August 16th. The release itself is a major agent upgrade — flexible reasoning effort for the Pro and Flash tiers, settable low, high, or max depending on the task, plus native support for the OpenAI Responses API optimized for one-click Codex setup.

Milo: But the pricing is what the thread seized on. The Flash model during peak hours jumps to 1.32 dollars per million tokens out, against a current 0.28 — and, as one commenter hammered on, quite a bit above the cheapest provider at 0.16. He called it the interesting data point because it's almost an order of magnitude more expensive than competitors. Peak hours are 1 to 4 in the morning and 6 to 10 in the morning UTC — which another commenter pointed out maps to work hours in China but night and early morning in Europe and the US.

Mia: One counterpoint: off-peak is half that price, and that same commenter figures most Western workplaces will land in the cheaper window anyway. Someone else answered a more measured take with, roughly, a 200 percent increase isn't marginal to you? And here's the practical wrinkle that determines the whole debate — the peak hours are essentially China's working day, so the higher rates hit business hours there, while off-peak pricing ends up benefiting a lot of Western users by the clock. One commenter said they'll keep using both Flash and Pro exactly as before, after initially misreading the off-peak tier as holding the old prices.

Milo: So the real story here isn't a discount — it's a shift in how DeepSeek is charging. The aggressive off-peak pricing looks like a deliberate carve-out for Western consumers, while the peak rates stack up against the cheapest competition at nearly ten times the price. For anyone routing API traffic right now, the clock matters as much as the model choice.

Mia: A developer wrote up a question that a lot of people clearly relate to: why does Opus 5 feel worse to work with? He and his colleagues find it a downgrade in practice compared with the previous major versions and one rival model, even though it's more capable than the older ones on benchmarks. The core complaint is behavioral — the other models stop and ask questions when intent is unclear, don't make assumptions without checking, and don't reinterpret your plan without asking. This one, he says, needs the careful babysitting the others don't.

Milo: He's upfront that his explanation is speculation, but it's a sharp one. He blames two forces compounding at Anthropic and the current frontier labs — the drive toward a self-improving AI that can recursively bootstrap, and the pressure to score well on benchmarks. A good benchmark task is self-contained, so training and selecting on those rewards models that make bold, usually-correct assumptions under ambiguity and punishes stopping to ask for clarification.

Mia: And real coding work is never fully specified, with real consequences — so guessing is exactly what users don't want from a model they're babysitting. The comments are full of people recognizing the pattern, though some point at something related but different. One says speaking to it in Italian produces mistakes and approximations; another avoids non-English AI conversations because results are almost always worse. Someone reports the web chat drifting back to Chinese after being told to use English. And one voice of caution says worse depends on how you measure it — he even uses his native language partly to escape guardrails, and notes the trade-offs cut both ways.

Milo: So the takeaway isn't that this model is bad at benchmarks — it's about what benchmark pressure does to the experience of using a model in real, underspecified work. As this class of models gets pushed harder toward self-improvement, the behaviors that win scores are increasingly the behaviors that make daily work harder. That tension, more than any single benchmark number, is the thing worth watching.

Mia: There's a new opinion piece making the rounds, and the title alone gets right to the point: the Temu-fication of software, digital goods, and services. The argument is that software, books, music, and movies are all heading toward a two-tier market, kind of like what Temu and Shein did to physical goods. A big, profitable lower tier of cheap, machine-generated—let's call it “slop”—content, and a smaller, more expensive tier of work you can recognize as genuinely human-made.

Milo: And the author is clear this is a hypothesis, not a proven trend, but the parallel to Temu is what's grabbing people. On the physical side, prices collapse visibly while the real costs get pushed onto landfills, on lungs, and onto unseen workers. The digital version swaps that around—the cheap labor becomes the language model itself, and the externalized cost is quality. Quality takes real craftsmanship to produce, and genuine attention to perceive.

Mia: The Hacker News comment section went deep on the Temu analogy itself. One commenter argued Temu wouldn't have taken off the way it did without Amazon Prime making fast shipping both technically doable and psychologically the default. That leads to a fun question—if Prime made Amazon what it is, what was the “Amazon Prime era” of software, and what did and didn't actually happen in it?

Milo: But another commenter pushed back hard on that framing. Their take is that Temu's rise had nothing to do with following a path Amazon blazed. It was enabled by regulatory and political indifference—extremely subsidized postage rates from China, lax enforcement of import duties, and effectively zero enforcement of safety standards. To borrow their phrasing, it's more like sneaking in a back door than walking down a road Amazon built.

Mia: And then there's the consumer-side reaction. One commenter called this whole cheap-generated content craze “gambling,” and proposed some memorable new vocabulary: Enshitification, Eemufication, and Gamblification. They say they've never bought from Temu because the discount roulette actively drives them away.

Milo: A reply doubled down on that and described getting pulled into what they called a “dopamine labyrinth” before eventually wasting time and money on it—which is exactly the pattern the piece's author thinks is coming for digital goods first.

Mia: Next up, a rant that a lot of engineers are probably going to feel personally. The post is titled “Stop sending me huge PRs,” by Pete Mertz, and it's basically a plea from a reviewer buried under enormous pull requests—some running one, two, even three thousand lines, all because an AI agent managed to “one shot” an entire issue in a single change.

Milo: His core point: small pull requests were never about making things easier to write. They exist for the benefit of the reviewer. And he calls AI a genuine boon to the industry, but “a liability for reviewers and maintainers.” He's not buying the justification that the code does nothing unless you include the entire diff—the goal isn't small finished products, it's small, digestible, reviewable pieces of work.

Mia: He admits he has no data, but he speculates that the time it takes to fully understand code grows exponentially with the line count. Which hits hard for anyone who's stared down a massive diff on a Friday afternoon. And he has opinions on comments too—document functions with JSDoc or Rustdoc or whatever your language uses, sure. But not five-line explanations of what a variable name means. If the variable is well named, he says, nine times out of ten he'll understand what it does.

Milo: Then there's the “just use AI to grok it” crowd. His response: reviewers waste tokens re-ingesting AI-written code. And to the classic “I use a different model for reviewing,” he asks—then why put it up for human review at all? The AI could split the change for humans and do its own review afterward. He also points out React never needed giant pull requests, because it was faster to write and easier to read.

Mia: And the rant ends with a pointed addendum: do giant pull requests exist so that reviewers give up halfway and just approve? If so, he says—and the thought is left hanging there, which feels like an intentional provocation.

Mia: From review hell to game engines. Hacker News is digging into a post by Elias Farhan about going native with his game Soup Raiders, and what he gained from building his own engine. The headline numbers come from VGInsights data: only about 13 percent of games released on Steam in 2024 used a custom engine, way down from 71 percent back in 2012.

Milo: But here's the twist that makes the whole discussion interesting—even though very few games use custom engines anymore, those games still accounted for 43 percent of units sold in 2024. So the engines that are clearly on the decline are also the ones driving a huge share of actual sales. And the post defines custom engine pretty broadly: using SDL3 with Assimp for a 3D game counts, SFML for a 2D networking game counts. But Unity with internal tools, Unreal with a rewritten renderer, or Godot extended with C++? Those don't.

Mia: The examples paint the picture, too. On the custom-engine side you've got games like Bastion, FTL, Don't Starve, Banished, Stardew Valley, and Factorio. On the successful Unity side: INSIDE, Hollow Knight, Cuphead, Subnautica, Outer Wilds, and Untitled Goose Game. The post also leans on Tyler Glaiel's argument that you simply cannot beat Unity, Unreal, Godot, or GameMaker in general—a person or a tiny team can only win for very specific use cases.

Milo: And that's where the real dispute lives: what does that 13 percent figure actually mean? One commenter argues the graph's 13 percent is labeled “Other,” not “make your own game engine,” and that very few games truly roll their own. Another counters that the linked source says “Other” means custom engines. But the first commenter fires back that the source merely asserts most of those “Other” engines are custom, without justifying it. And a third commenter points out the categories have to sum to one hundred percent, so where do non-custom, non-major engines fit?

Mia: And finally, a big one out of France. The country's top court, the Constitutional Council, has blocked a bill that would have banned social media access for under-fifteen-year-olds. The court's reasoning: the contested provisions “disproportionately infringe upon the freedom of expression and communication,” and fail to provide the legal safeguards needed to protect the right to respect for private life.

Milo: To be clear on what the bill would have done—barring kids under fifteen from opening a social media account starting September first, forcing platforms to close accounts that were already open within four months, and requiring age verification approved by the French privacy regulator. The Council also took aim at the proof-of-age requirement itself, saying the bill failed to specify the conditions and limits under which proof of age should be provided. President Emmanuel Macron has now asked his government to rewrite the legislation.

Mia: For context, French lawmakers approved the bill back in July, which would have made France the first European country to follow Australia's world-first ban. You'll remember Australia barred under-sixteens from Facebook, Snapchat, TikTok, and YouTube back in December. And the discussion notes other countries are moving too—China, the UAE, and Turkey have all instituted or planned measures to curtail young people's access, and the EU has said it plans to seek stronger child protections. Though Australia's own approach is being scrutinized after data showed mixed success and lawmakers there are considering stricter penalties.

Milo: The Hacker News thread itself split between two enforcement philosophies. Some argued there are many ways to get to the best of both worlds—protecting kids without the blanket ban. The other camp leaned toward device-level enforcement rather than expecting platforms to police age. It's a genuine fork in the road, and it's going to keep showing up as more governments weigh the same tradeoff.

Mia: A new report from Yale Environment 360 is highlighting what it calls Australia's home battery boom, and the headline effect is dramatic — wholesale power prices there have fallen by 47 percent over the past twelve months. Energy Minister Chris Bowen has credited the program as the major factor behind that drop.

Milo: So how did they pull this off? A little over a year ago, the government launched a program offering a 30 percent discount on residential battery systems that connect to rooftop solar. Officials say more than half a million batteries have been installed under the plan. And Bowen pointed out something striking — Australia now has more home batteries than the United States, even though the U.S. population is about twelve times larger.

Mia: That makes sense when you consider Australia's rooftop solar footprint. They're the world leader there — more than one in three households has panels. But there's a flip side: all that surplus solar has been forcing centralized power plants offline, and a lot of the generation just goes to waste. The batteries help absorb some of that excess instead of letting it vanish.

Milo: The government is pushing even further in some states — in Queensland, New South Wales, and South Australia, they're offering free power in the early afternoon, whether or not you have solar panels, to nudge people into running appliances or charging EVs during peak sun hours.

Mia: That fed a lively argument in the comments, where people debated whether electric vehicles could replace home batteries. One commenter argued that millions of EVs sitting mostly idle form a huge energy reservoir, and that owners should be paid for essentially creating a storage layer with their own capital — especially as solar curtailment grows and prices occasionally go negative. Another countered that far more people own homes than EVs, and that most EV owners want that energy for driving, not for selling back to the grid. But the first commenter held firm, insisting that paying owners is the right incentive.

Mia: Meanwhile, the USGS has recorded a magnitude 7.7 earthquake about 68 kilometers north-northwest of Ende, Indonesia. And that prompted a Hacker News debate about whether this year really has been unusually active when it comes to big quakes.

Milo: The commenters split into camps. One argued that large earthquakes are effectively random once you ignore aftershocks, but admitted it does feel like a lot this year. Another cited a Wikipedia list counting 76 quakes of magnitude 7.0 or stronger so far this decade, including ten this year. Someone else actually checked the 2026 earthquake list and concluded it's not necessarily worse than previous years. And another commenter put it down to the site simply highlighting a lot of quakes this year, which can skew the impression.

Mia: There was also some confusion about a tracking page that initially appeared to show zero earthquakes above a small magnitude this year — which made no sense. One commenter cleared that up: the apparent jump in total quake counts since about 2020 comes from the growing number of seismic stations installed, which can detect much smaller events. If you only count earthquakes of magnitude 1.0 and above, the rate has stayed about the same.

Milo: On the tsunami question, one commenter asked whether this quake was big enough to trigger one — and noted they were about to take the ferry from Lombok to Bali, where two ferries have already burned in the last two weeks. Another replied with some grounding: tsunamis are only a real danger close to shore. Out in the open ocean, it's barely a mild wave, and moving further from the coast is the safest thing you can do under a warning. So for people on the water or near the coast, that's the practical takeaway — distance from shore is your best friend.

Mia: And that's a wrap for today's briefing. We covered a lot of ground—from encryption going dark on the web, to a major earthquake off Indonesia, and France's court blocking a social media ban for kids under fifteen.

Milo: We also dug into Firefox hanging on as the last major browser still supporting uBlock Origin, plus big new model releases from DeepSeek and Qwen, and why some developers are really not loving Opus 5.

Mia: And who can forget Australia's home battery boom pushing wholesale power prices down? Plenty to chew on this week.

Milo: Thanks for listening, and we'll be back with the next briefing soon. Take care out there.