Nine stories crossed the 200-point threshold on HN today. The throughline is unmistakable: power structures — governments, corporations, automated enforcement systems — are clashing with the people and projects that refuse to play by their rules. Some of those clashes ended well. Some didn’t.

Get Your Windows License Refund

562 points · refund4freedom.org

The Italian Linux Society and FSFE launched a campaign demanding that laptop manufacturers stop bundling Windows and offer transparent refund processes. The site provides a step-by-step guide: photograph the EULA, contact the manufacturer, escalate to Italy’s Antitrust authority if stonewalled. They track manufacturer behavior — HP ignores refund requests entirely, Dell requires you to return the whole laptop, Asus quietly pays out €9–65 depending on version, and Acer makes you ship the machine to a service center.

This is an old fight with fresh energy. The EU’s consumer protection framework technically supports the right to decline pre-installed software, but enforcement has always been the bottleneck. The campaign’s real value is the documented case studies — people who actually got refunds, complete with legal filings and settlement letters. That evidence base is what turns a philosophical argument into actionable pressure. Whether this scales beyond Italy’s legal system is the open question.

GLM-5.3 Is Now Open-Weight

407 points · huggingface.co

Z.ai (formerly Zhipu AI) dropped GLM-5.3, a 743-billion-parameter Mixture-of-Experts model that claims the open-weights coding crown. The model shares the same base as GLM-5.2 — every gain comes from aggressive post-training. Z.ai reports 50% improvement on their internal Code Bench, SOTA on Terminal Bench 3.0 and Agents’ Last Exam, and — notably — emergent cybersecurity capabilities that “developed faster than expected.” The model discovered 2,436 vulnerabilities across 269 projects, some 40 years old.

The benchmark claims deserve scrutiny. Z.ai’s own Code Bench showing 34.5% at Max effort versus Claude Opus 4.8’s 29.5% is compelling, but they acknowledge trailing Claude Fable 5 (39.5%). The real story is token efficiency: GLM-5.3 hits higher scores while consuming significantly fewer tokens than its predecessor or competitors. At roughly a tenth of US frontier pricing per token, the economics are hard to ignore. Weights are promised in two weeks after safety review — the “open-weight” label is forward-looking, not current. The cyber capability emergence is the part that should make people pay attention. A model that autonomously chains exploitation steps is a different beast than one that completes coding benchmarks.

Judge Rules Trump Administration’s Blacklisting of Anthropic Was Illegal

385 points · nytimes.com

U.S. District Judge Rita Lin permanently blocked the Pentagon’s designation of Anthropic as a “supply chain risk,” calling it “illegal and baseless.” The backstory: Anthropic refused to let the military use Claude for surveillance and autonomous weapons. Defense Secretary Pete Hegseth responded by slapping Anthropic with a supply-chain risk label — a tool typically reserved for foreign adversaries — and Trump posted on Truth Social ordering the government to “IMMEDIATELY CEASE all use of Anthropic’s technology.”

Lin found this was textbook First Amendment retaliation, noting that Trump’s social media post “makes little sense except as an attempt to swiftly make a public example of Anthropic for daring to criticize the Administration.” She also found Fifth Amendment due process violations. The government’s argument — that they simply “assessed a substantial risk that Anthropic might manipulate its AI model” — didn’t survive scrutiny. A D.C. Circuit case is still pending, so Anthropic technically remains blacklisted until that resolves. But the precedent is set: the executive branch cannot weaponize procurement law to punish a company for refusing to build weapons. The irony of an AI safety company being punished for having safety guardrails is not lost on anyone.

U.S. Sanctions Against the A/I Collective

346 points · inventati.org

Autistici/Inventati — a small Italian volunteer collective providing encrypted email, VPN, and hosting to activists since 2001 — was designated a “global terrorist organization” by the U.S. Treasury and State Departments. The collective hosts noblogs.org (a blogging platform for activists) and provides digital self-defense tools. They deny all allegations and vow to continue operating.

The HN discussion correctly identifies the real danger: this sets a precedent for treating infrastructure providers as terrorists based on their users’ activities. If A/I is a terrorist organization for hosting activist blogs, what does that make Signal? Tor? Any VPN provider? The designation was issued under Executive Order 13224, the same framework used against Al-Qaeda affiliates. Applying it to a bunch of Italian volunteers running email servers is a category error with serious consequences — it criminalizes the infrastructure of dissent. The collective’s response is defiant: “Antifascism and anticapitalism are not terrorism. Protesting is not terrorism.”

338 points · blog.luanti.org

Luanti (formerly Minetest), an open-source voxel game platform, was pulled from Google Play after Tracer.AI filed a DMCA notice on behalf of Microsoft claiming Minecraft copyright infringement. The claim cites Minecraft’s copyright registration but doesn’t specify which assets are allegedly infringed. Luanti ships no game assets by default — it’s an engine that runs community-created content.

This happened before. In 2023, the same company filed the same type of notice, and it took 46 days to reinstate the app — well beyond the DMCA’s 10–14 business day requirement. Tracer.AI is an “AI-powered brand protection” company that boasts “85% faster takedowns” and “44% more takedowns month-over-month.” Translation: automated systems are filing copyright claims at scale with no meaningful human review. The indie game Allumeria got hit with the same treatment earlier this year. Microsoft eventually dropped that one after public backlash. The core issue is that voxel art style is not copyrightable — Minecraft was inspired by Infiniminer, and cubes are a genre, not a brand. But Google’s automated takedown pipeline doesn’t care about nuance.

GUIs Should Be Fully Keyboard-Driven

320 points · ckardaris.com

A response to last week’s “stop making TUIs” HN post. The author argues that the keyboard-driven nature of TUIs is often cited as a reason to prefer them over GUIs, but this conflates two separate issues. There’s nothing inherent to GUIs that prevents full keyboard navigation — it’s a developer discipline problem, not a technology limitation. GNOME’s Human Interface Guidelines explicitly state that every action should be possible with the keyboard.

The argument is sound but incomplete. The reason GUIs fail at keyboard navigation isn’t ignorance of guidelines — it’s that mouse-first design is the path of least resistance, and most GUI frameworks treat keyboard accessibility as an afterthought. The author’s own experience building Klisi with full keyboard support proves it’s feasible, but “it’s not that hard” undersells the maintenance burden of keeping keyboard paths working across framework updates. Still, the core point stands: if your GUI can’t be driven entirely by keyboard, that’s a bug, not a feature.

Inception-Style Curved Map for Turn-by-Turn Directions

319 points · orbify.eu

Orbify’s demo renders a curved, Inception-style 3D map for navigation using Gaussian splatting and the PlayCanvas engine. The effect warps the environment ahead of you into a visible curve, making upcoming turns and landmarks visible without zooming out. It’s a patent-pending technology from a Norwegian company.

The demo is visually striking — think the Paris-bending scene from Inception applied to real-world navigation. Whether it’s actually useful for driving is debatable; the cognitive load of processing a warped 3D environment while navigating traffic might outweigh the spatial awareness benefits. But as a visualization technique, it’s genuinely novel. The Gaussian splatting foundation means it works with photorealistic scene reconstructions, not just abstract maps. Worth watching whether this finds a home in AR navigation or stays a cool demo.

Htmx 4.0

308 points · htmx.org

Eight months of work culminated in htmx 4.0. The headline internal change: migration from XMLHttpRequest to fetch(). From a user perspective, the behavioral differences from 2.x are minimal. The three major changes are: attribute inheritance is now explicit (you must mark inherited attributes with :inherited), event names are standardized to htmx:phase:action[:sub-action] format, and history no longer uses localStorage by default.

New features include morph swaps (built-in DOM diffing via an improved idiomorph algorithm) and <hx-partial> for cleaner multi-target updates. The extension ecosystem got a significant refresh: hx-preload, hx-download, hx-alpine-compat, and three streaming extensions (SSE, WebSocket, multipart). Notably, htmx 4 won’t be marked as latest on NPM — 2.x stays as latest until early 2027 to avoid breaking CDN-dependent users. This is a responsible release strategy. The team also built a CLI upgrade checker to flag attribute inheritance and event name changes. The “100-year web services” philosophy continues to guide the project — backwards compatibility and simplicity over chasing trends.

Hilariously Fast Volume Computation with the Divergence Theorem

224 points · alyssarosenzweig.ca

A 2018 post by Alyssa Rosenzweig (now a prominent GPU driver developer) deriving an O(n) algorithm for computing the volume of closed triangulated 3D meshes. The trick: apply the divergence theorem to convert the volume integral into a surface integral, then evaluate per-triangle. The final formula requires only 11n floating-point operations — 7 additions and 3 multiplications per triangle, plus one final multiplication.

The derivation is clean and the result is elegant. On a $35 Raspberry Pi, this can handle 30 million triangles per frame at 60fps. The author notes the algorithm was independently discovered by Cha Zheng and Tsuhan Chen in a 2001 paper. The post resurfacing on HN eight years later is a testament to the kind of content that actually holds up — a real algorithm with real math and real performance numbers, not a framework announcement.

Throughline

Today’s front page is a study in institutional overreach and the tools people build to resist it. The Pentagon tried to punish Anthropic for having ethics — a judge said no. The U.S. government labeled an Italian activist collective as terrorists for providing encrypted email. Microsoft’s AI-powered copyright bot nuked an open-source game engine from Google Play for having cubes. And through it all, the community keeps building: htmx 4.0 ships with a 100-year philosophy, Zhipu drops a 743B parameter model that finds zero-days, and someone rediscovers a beautiful math trick from 2018.

The pattern is clear: automated enforcement systems (DMCA bots, supply-chain risk designations, terrorist watchlists) are scaling faster than the human judgment needed to keep them honest. The winners today were the ones who fought back with evidence, law, and code. The losers were the ones caught in systems designed to process first and ask questions never.