Pleopods Weekly #15 — June 19, 2026

This Week on Lobste.rs

Trending topics: security vibecoding linux release hardware

1. curl summer of bliss security

submitted by andrewnez — 259 points (+226 this week) — 21 comments

Daniel Haxx, curl's maintainer, is closing the vulnerability report channel for all of July 2026 so the team can actually take time off, with the next release pushed two weeks later to clear the backlog that builds up in early August.

2. I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID security

submitted by fs111 — 158 points (+156 this week) — 37 comments

A researcher discovered they could hijack live World Cup 2026 streams, edit match stats, and kill camera feeds by exploiting FIFA's reliance on client-side role validation—essentially, the backend accepted "no roles assigned" as a green light instead of a stop sign.

3. AI Agent Bankrupted Their Operator While Trying to Scan DN42 devops networking vibecoding

submitted by pyfisch — 154 points (+141 this week) — 28 comments

An AI agent scanning a hobbyist network with five AWS instances burned through $6,531.30 in 24 hours trying to enumerate IPv6 space, a cautionary tale about unchecked cloud compute costs and what happens when automation meets curiosity.

4. Every Frame Perfect design graphics

submitted by w0nder1ng — 126 points (+104 this week) — 19 comments

If your UI animation can't be explained at every frame—not just the endpoints—you've got a trust problem. The piece walks through real examples like Safari's cursor misalignment and YouTube's shape-shifting rectangle, showing how janky transitions read as either incompetence or buried technical debt.

5. Hundreds of AUR packages attacked by infostealer linux security

submitted by vivicat — 143 points (+103 this week) — 72 comments

Attackers compromised over 400 AUR packages by injecting a malicious npm install command into build scripts; the attack spread so wide because maintainers trusted dependency chains without auditing them.

6. KDE Plasma 6.7 released linux release

submitted by w8l — 126 points (+100 this week) — 36 comments

Per-screen virtual desktops shipped after two decades, and KDE added a unified theming system (Union) that styles Plasma, Qt, and widget apps from one CSS file—though it's still in tech preview for QtQuick apps.

7. How I made a 60fps Eink monitor, the Modos Flow hardware performance video

submitted by clean-rope5995 — 102 points (+100 this week) — 22 comments

The author built a 60fps e-ink display by using a faster underlying panel and custom firmware to drive it at its physical limits — turns out e-ink can move much faster than manufacturers let it, they just disable it in software.

8. Leaving Mozilla browsers person

submitted by bhearsum — 130 points (+92 this week) — 27 comments

A senior engineer with 15+ years at Mozilla left with a blunt exit memo: leadership chasing growth metrics has gutted the technical decisions that made Firefox worth using in the first place.

9. Google Chrome's next update will mark the end of popular ad blockers browsers

submitted by freddyb — 92 points (+89 this week) — 56 comments

Google is removing the last technical workaround that let users keep using Manifest V2 ad blockers in Chrome 150 (mid-June 2026), closing a loophole that had persisted even as the company killed off the extension standard years ago.

10. ReactOS "Open-Source Windows" Reaches The Milestone Of Being Able To Run Half-Life osdev

submitted by Yogthos — 90 points (+86 this week) — 11 comments

After 28 years of development, ReactOS can now run Half-Life — a milestone that says less about the game and more about how much of the Windows API the project has had to reverse-engineer just to get basic 3D graphics working.

11. Iroh 1.0 - Dial Keys, not IPs distributed rust

submitted by mhm — 85 points (+78 this week) — 42 comments

Iroh hits 1.0 with a shift from IP-based addressing to cryptographic keys—so your device stays reachable as it roams, connections go direct between peers (95% of the time), and the whole thing works behind firewalls without exposing your location.

12. Turn your site into a place people can bump into each other web

submitted by nathell — 79 points (+77 this week) — 23 comments

A tool that shows you who else is browsing your site right now and lets you chat with them instantly, no signup required.

13. Extinction-level capitalism law vibecoding

submitted by isuffix — 78 points (+76 this week) — 35 comments

Butterick argues that AI threatens liberal democracy not through malfunction or weaponization, but by amplifying capital concentration—and that these political effects are already embedded in design choices made before consequences became clear or reversible.

14. German court ruling declares Google's AI Overviews are Google's own words and makes it liable for false answers law

submitted by gspr — 283 points (+72 this week) — 72 comments

A Munich court decided Google is liable for inaccurate AI Overviews because they're Google's own statements, not neutral search results—since synthesizing sources into new claims means only Google can verify what it says, users can't reasonably fact-check a summary Google generated.

15. write for one person practices

submitted by lalitm — 120 points (+71 this week) — 15 comments

Writing for a specific person instead of "the audience" forces you to make real choices about what matters, which cuts through the vague generalizing that kills clarity.

16. Pull Requests are Free Puppies programming video

submitted by ndr — 82 points (+68 this week) — 15 comments

I understand — I need the actual article text to write commentary. Please paste the article content and I'll rewrite the commentary to match your standards.

17. Rejected Emoji Proposals programming

submitted by carlana — 81 points (+66 this week) — 20 comments

The Unicode Consortium keeps detailed records of rejected emoji proposals, including some genuinely bizarre ones like "Angry Pile of Poo" and "Face Banging Against Wall." The archive reveals what actually kills an emoji bid: unclear use cases, redundancy with existing symbols, or just too much potential for misuse.

18. Banned book library in a Wi-Fi lightbulb hardware reversing

submitted by classichasclass — 73 points (+60 this week) — 12 comments

A librarian hid banned books inside Wi-Fi lightbulbs; turn one on and nearby devices can access the collection without anyone knowing what's transmitting.

19. Even More Batteries Included With Emacs emacs

submitted by chiply — 71 points (+58 this week) — 13 comments

Emacs has a surprisingly deep bench of built-in features that stay hidden because they're buried in docstrings and never mentioned in the usual circles—this article surfaces a few working ones: wildcard support in find-file and dired, ffap-menu to list all URIs in a buffer, dictionary tooltips, and compare-windows for lightweight side-by-side diffs.

20. Typst 0.15 contains multitudes release

submitted by isuffix — 103 points (+57 this week) — 11 comments

Variable fonts finally work, MathML equations are now selectable in HTML exports, and the new bundle export lets you generate multiple output files from a single Typst project instead of forcing separate runs for each format.

Pleopods is a weekly digest of the top links from Lobste.rs. Unsubscribe | Archive