Hacker Newsroom for 12 May: AI Coding Rewrite, TanStack Supply Chain, Mythos Curl Bug, Ratty 3D Terminal

Hacker Newsroom for 12 May recaps major Hacker News stories, moving through ai coding rewrite, tanstack supply chain, mythos curl bug, ratty 3d terminal. 1. AI Coding Rewrite The next story is about a developer deciding to rewrite a Kubernetes dashboard after learning the limits of what fully AI-driven coding can hold together. The post argues that vibe coding helped get a real tool shipped, but also produced bloated structure, weak architectural decisions, and a codebase the author no longer felt able to steer confidently. Story link Hacker News discussion 2. TanStack Supply Chain The next story is TanStack's postmortem on an npm supply-chain compromise that briefly pushed malicious versions of dozens of its packages. The report says the attacker chained together a risky GitHub Actions pattern, cache poisoning across the fork-to-base trust boundary, and runtime token extraction on the CI runner, while stopping short of stealing npm publish credentials directly. Story link Hacker News discussion 3. Mythos Curl Bug The next story is Daniel Stenberg writing that Anthropic's heavily marketed Mythos model did find a curl vulnerability, but not in a way that justifies the surrounding panic or hype. His post says the report produced one legitimate issue, which is useful, yet still looked more like an incremental improvement in code analysis than a world-changing leap in automated vulnerability discovery. Story link Hacker News discussion 4. Ratty 3D Terminal The next story is Ratty, a GPU-rendered terminal emulator that can display inline 3D graphics, including the sort of spinning demo objects that sound like a joke until you watch them work. The project is light on manifesto and heavy on demonstration, but the core pitch is that a terminal does not have to stop at text if the rendering model is modern enough to handle richer visual output directly. Story link Hacker News discussion 5. Gmail QR Signup The next story is a report that Google account signups are increasingly requiring a QR-code flow that triggers a text message from your own phone, making disposable SMS verification much harder to use. The post frames that as a security move on paper, but the real consequence is tighter identity binding and less room for privacy-minded users who used to rely on intermediary verification services. Story link Hacker News discussion 6. Local Models On M4 The next story is a hands-on write-up about running local language models on an Apple M4 machine with 24 gigabytes of memory and finding a setup that is usable, if still full of tradeoffs. The post walks through model choices, quantization constraints, context-window goals, and the practical reality that many promising options technically fit in memory while still failing the speed or quality bar for everyday work. Story link Hacker News discussion That's it for today, I hope this is going to help you build some cool things.