Overnight the leaderboard met the clinic: a UK dermatologist sat GPT-6 Astra and Claude Fable 5.1 down with 200 biopsy-proven lesions, and a fine-tuned 2015 CNN beat both of them. Max Woolf published the spreadsheet math on why frontier model prices collapsed by up to 80% in months, JetBrains open-sourced the agentic IDE it had been incubating, and the hacker who rooted his own Samsung TV says OpenAI banned his account for the reverse engineering.

Today: the skin-cancer test, the price-collapse timeline, the banned TV hacker, JetBrains’ ThinkRail, a map of surveillance cameras, weeds in your browser tabs, a dangerous libc function, and the bitcoin bounty box from yesterday getting popped in 19 hours.

Show, don’t tell: a 200-lesion test, a price timeline, an open-sourced IDE and a popped bounty box.

🩺 A 2015 CNN just beat two frontier AIs at reading skin cancer

The lesion in figure 1 is an invasive melanoma on a patient’s ear, under 0.8 mm thick. Dr Magnus Lynch, a UK dermatologist, showed its clinical photograph and dermoscopic image to GPT-6 Astra and Claude Fable 5.1, two of the most capable models available this month. Both called it a seborrhoeic keratosis, a harmless warty growth, and said the patient could be discharged. He then showed the same pair of images to a fine-tuned version of Inception v3, a convolutional network Google published in 2015. The CNN said melanoma. It was right.

That was one of 200 biopsy-proven lesions Lynch drew at random from MILK10k, a public dermatology dataset released through the International Skin Imaging Collaboration, each photographed twice: one clinical close-up, one dermoscopic view. Final tally, his numbers: the CNN named the right diagnosis out of six possibilities for 125 lesions (62%); the two frontier LLMs managed 84 and 85 (42%). The CNN’s edge came from the dermoscopy view, the microscope image dermatologists actually use, where texture patterns matter more than semantic reasoning. His one-line summary: a ten-year-old network, fine-tuned for about twenty minutes, beat both of them at recognising skin cancer.

The test  ·  HN discussion

💸 Why frontier LLM prices collapsed 80% in a few months

The timeline reads like a clearance sale. June 26: OpenAI ships GPT-5.6 Sol at $5 / $30 / $0.50 per million tokens (input / output / cache read) and Luna, a small model, at $1 / $6. June 30: Anthropic ships Claude Sonnet 5 at $2 / $10, with “temporary” launch pricing. July 24: Claude Opus 5 at $5 / $25. July 30: OpenAI starts cutting. By October, Woolf counts, list prices for comparable frontier capability are down by as much as 80% from the summer.

The post’s value is the receipts: every price is listed with its announcement date, so the pattern is impossible to unsee. Successor models arrive at their predecessors’ prices, then get undercut within weeks, and the “temporary” discounts never actually revert. Woolf’s read of the cause is the part worth arguing with: this is what a market looks like when capability has commoditized faster than demand has grown, and the labs are buying usage share with margin they cannot afford to keep spending. Vendor framings (efficiency gains passed to you) are noted and weighed against the cadence of the cuts.

The analysis  ·  HN discussion

📺 He rooted his own Samsung TV. Then, he says, OpenAI banned him.

The thread that ate HN this weekend starts with a man taking apart his own television. The researcher who posts as log4j documented a root shell on his Samsung smart TV and, along the way, the set’s audio appetite: if your TV model has no microphone, it looks for connected devices that have one, a soundbar or a paired Bluetooth device, and ships what it hears to Bixby. The thread drew roughly 18,000 likes on X. Two days later, he says, OpenAI suspended his account over the reverse engineering he used to do the work, which he describes as entirely local, on hardware he owns.

Two stories are tangled here, and the evidence for them differs. The TV findings are documented in the thread itself, with photos and shell output; HN’s 566-comment thread added context, including that bark, baby-cry and door-knock detection are advertised SmartThings features. The OpenAI ban is his claim, posted after the fact, with no public statement from OpenAI; the only secondary coverage we could verify (ailately.com) repeats his account. We could not read the primary thread: X blocks anonymous access and every mirror we tried was dead, so treat direct quotes here as secondhand via the HN discussion.

The secondary coverage  ·  HN discussion

🧰 ThinkRail: JetBrains open-sources its agentic IDE

The README’s first line is the pitch: “the agentic IDE that gets better every time you use it, learning your project through living specs today, and building its own capabilities tomorrow.” JetBrains, the company behind IntelliJ, has been quietly incubating an IDE designed around an agent rather than a human typist, and the repository went public to 1,333 stars.

The architecture is the interesting part. Workspaces are git worktrees: cut one per task and agents work in parallel without touching your checkout, then merge the good branch and delete the rest. Finished workspaces settle onto a per-project shelf on their own and return when you do. The workbench is a real IDE, Monaco tabs, terminals, live git marks, all scoped to the active workspace. Several pi sessions can run per workspace, each with its own model and live token and cost readout. And the durable piece: a connected graph of SPEC.md files lives beside the code, which the agent reads and maintains through dedicated tools, so intent survives the session. Agent Skills you already keep for other coding agents are read in place. Apache-2.0.

The repository  ·  HN discussion

🗺️ Proton maps the Flock cameras watching your street

Proton, the Swiss privacy company, shipped a quiet public tool overnight: a searchable map of Flock surveillance cameras. Type a ZIP code, see the automatic license-plate readers near you, the same cameras police departments query.

The page earns its outrage with specifics. A Flock camera photographs every passing vehicle, suspected or not, and logs plate, time and location; the Vehicle Fingerprint feature adds make, model, color and details like dents and bumper stickers, so a car can be found without a readable plate. Records go to Flock’s cloud, where police search and share across city and state lines. Flock says the network processes more than 20 billion vehicle reads a month across 49 states. Proton’s page cites a Washington Post review finding at least 50 officers accused or charged with misusing license-plate readers.

The map  ·  HN discussion

🌱 Overgrown: weeds take over the tabs you abandon

The demo is the joke and the point: open tabs you keep meaning to read slowly sprout leaves. Come back after a week of neglect and the page is a garden. Charlie Gerard built a browser extension that grows procedural plants over any page you have abandoned, a physical sensation for tab guilt.

Under the whimsy is a real piece of craft: the plants are generated and animated over live pages without breaking them, which means the extension is doing non-trivial canvas work on arbitrary DOMs. Gerard’s write-up covers the build. It is the rare tab manager that makes you smile instead of sigh, and a gentle intervention: the mess is visible before it is countable.

The write-up  ·  HN discussion

⚠️ wordexp(3): the libc function that runs shell code when you feed it paths

The post opens with the kind of sentence that ruins a maintainer’s weekend: wordexp(3), the POSIX function C programmers reach for to expand globs and tildes, performs shell command substitution. Feed it a crafted path and it runs commands. The author found it the way everyone does: reading the man page’s fine print after assuming it was a string utility.

The details matter for audit work. wordexp is a libc wrapper around real shell expansion semantics, so backticks and $() in attacker-influenced input execute, and the WRDE_NOCMD flag that disables it is not the default. The post inventories the trap’s footprint: language bindings and tools that expose wordexp as “expand this path” inherit the behavior. It is a known-class bug, not a new CVE; the value is the reminder that this API is in the wild under friendlier names.

The post  ·  Lobsters discussion

Steal My Bitcoin: popped in 19.28 hours. No. 022’s lead story is over. The counter stopped at 19.28 hours on Oct 25 at 15:47 UTC, with the pot grown to 0.02511679 BTC ($2,021.22) from community additions. The winner’s writeup is already up: KillaBoi/StealMyBitcoin-PoC, a single-file, standard-library-only Python reproduction of the full chain against PHP 8.4.26, heap leak to code leak, with a Docker lab so you can run it yourself. 232 stars in a day. The operator hints more challenges may follow. Winner’s PoC and writeup →

DreamHost forces a mass password reset mid-incident. The host’s status page says reset emails are going out to all account owners with completion expected today, after a file-manager incident; the panel briefly rejected new passwords, now fixed. HN commenters suspect the Monsta FTP install behind the file manager, possibly via this month’s PHP bugs; that linkage is commenter speculation, not confirmed forensics. 133 HN points. DreamHost status page →

Tailworm: still no public Tailscale response. Three days after Erica Windisch’s five-class audit of tailscale v1.104.2 and headscale v0.29.5 (No. 022), the report page shows no vendor reply or patch. The interim mitigations section for operators remains the actionable part. The report →