Hacker News Daily: Top Stories and the Threads Everyone’s Talking About

A security researcher just recovered the cryptographic signing keys used for the barcodes on U.S. driver's licenses. This is a perfect follow-up to our conversation last week about Apple's new walls and the hackers who climb them—because it turns out the walls around your physical ID might be less like a fortress and more like a puzzle with the solution printed on the back. A puzzle that states like California are actually inviting you to solve, by publishing the public keys and open-source tools needed to verify an ID is real. This isn't a breach, it's a fundamental shift in how we prove who we are, moving from something you just look at to something you can mathematically prove. And it changes everything.

Okay, so that's the big one we're going to circle back to. But first, let's sweep the rest of the day's threads. First up is a story for anyone building, running, or paying for large language models. A new paper introduces a storage format called BITCOS. Now, stay with me. For a long time, there's been this theoretical floor for how compactly you can store the 'weights' in a certain type of model—about one point five eight bits per weight. BITCOS just smashed right through it, getting as low as one point four eight five bits. So what does that mean in practice? It means models can be smaller and faster. We're talking up to a twenty-seven percent improvement in inference throughput on GPUs. This is the kind of deep-in-the-weeds optimization that doesn't make headlines, but it's what makes the next generation of AI actually feasible to run without needing a personal power plant.

Next, a fantastic study out of UC Berkeley called HarnessTax looked at the tools we use to get AI to perform tasks—these things called harnesses. They tested seven different AI models with three different harnesses, including popular ones like Claude Code. The finding? The choice of harness has almost NO effect on whether the AI succeeds at the task. But—and this is a huge but—it can create up to a FIVE TIMES difference in cost. The same model, doing the same job, could cost you five times more just because of the wrapper you put it in. Even better, a simple, open-source harness called Pi was just as good as the expensive proprietary ones. It’s a powerful reminder to question what you’re actually paying for in the AI gold rush.

Is it performance, or is it just packaging? Speaking of tools, a project called OpenSpec is absolutely exploding. It's a framework that uses AI to generate software specifications—the documents that define what software is supposed to do. It has sixty-eight thousand stars on GitHub, and a new spec is created using the framework literally every two seconds. The goal is to keep human developers and AI coding agents on the same page, building the right thing, and building it right. Of course, the discussion online immediately raised a great point: if AI is generating the specs, who's checking the AI's work? A flood of spec files doesn't help if they're not the right specs. It's a classic problem—new tools create new kinds of work.

From the world of open source, here's a story that just makes you feel good. The Servo project, which is an open-source browser engine, is celebrating one year of being able to pay a full-time maintainer, Josh Bowman-Matthews, entirely through community donations. In that year, he personally reviewed eleven hundred and fifty pull requests. One person. He nominated eight new maintainers and dramatically improved the documentation, making it easier for new people to contribute. It’s such a clear demonstration of what’s possible when a community directly supports the infrastructure it depends on. It’s not a big corporate initiative; it's just people chipping in to keep a vital project moving forward.

I love that. Then there's a quick dispatch from Xiaomi. They have a public AI training dashboard for their new Mimo two point six models. You can just… go look at it. You can see the training steps in real time, the number of data samples being accepted, the performance metrics ticking up. It’s a level of transparency into the nitty-gritty of model training that you rarely get to see. There’s a 'pro' model and a 'flash' model, and watching the numbers go up is a surprisingly compelling view into how these things actually get made. And finally, a timeless piece of advice that surfaces on Hacker News every few months, and every time it's essential. A developer wrote a fantastic, detailed post about backups.

Not just having them, but understanding what a backup actually IS. His point is simple: mirroring your drive, like with a RAID setup, is not a backup. If you accidentally delete a file, it's gone from both places. If you get hit with ransomware, both drives get encrypted. A real backup strategy needs snapshots. It needs the ability to roll back in time. He uses a great quote: "There are two types of people: those who have suffered a catastrophic loss of data, and those who will." It’s the kind of post you read, nod along to, and then immediately go check if your own backup system would survive a real disaster. Okay, let's go back. Let's really dig into those first two stories, because they connect in a way that I think defines a major shift happening right now.

First, the driver's licenses. The idea that a researcher "recovered" the signing keys sounds like a huge security failure. But it's the opposite. This is security working as designed, just in a way we're not used to. For decades, the security of an ID card has been based on physical features—holograms, microprinting, weird textures. Things that are hard to fake. The problem is, fakes get better and better, and the only way to check is to have a perfectly trained human, or a special machine, who knows what to look for. It's an opaque system. You trust the ID because it looks right. What California is doing, with their vendor IDEMIA, is moving to a cryptographic system. They sign the data in the barcode on the back of the license using a private key.

Then they publish the corresponding public key online for anyone to use. The researcher didn't steal a secret; they just found the public key where it was supposed to be and showed how to use it. California even ships open-source code so a bar, a bank, or you could write a little app to scan a license and mathematically verify that the California DMV, and only the California DMV, created that barcode. So where have we seen this before? This is EXACTLY how the secure internet works. When you visit your bank's website, your browser sees a little certificate. It doesn't know your bank personally. Instead, it checks the certificate's signature against a public key belonging to a trusted Certificate Authority.

It's a chain of verifiable trust. What's happening with driver's licenses is the same pattern, but for physical identity. It's moving from "trust this plastic card because it has a shiny eagle on it" to "trust this data because it has a digital signature you can independently verify." The implications are huge. It means a bouncer doesn't need a constantly updated book of every state's ID designs. They just need an app that can check a signature. It makes high-quality fakes almost impossible, because you can't fake the math. Of course, it also opens up new questions. What happens if the state's private key does leak? They'd have to revoke it and issue new IDs, just like revoking a compromised web certificate.

And there are privacy concerns. If every scan is logged, it could create a record of where you've been. But the core idea—public, verifiable proof—is a massive step forward from the security theater of holograms. It's a system built on transparency, not obscurity. Now, let's look at that HarnessTax study from Berkeley. On the surface, it's about AI development costs. But underneath, it's asking the exact same question as the driver's license story: what are we trusting, and can we verify it? For years, the big AI labs have been building not just models, but entire ecosystems around them. They offer these 'harnesses'—toolkits, command-line interfaces, special environments—that they claim are the best way to work with their models.

The implicit promise is that if you use their tools, you'll get better results. It's a classic proprietary playbook: lock the user into your ecosystem. You're not just buying access to the model; you're buying the whole curated experience. What the HarnessTax researchers did was call that bluff. They took models like Codex and Claude, and they ran them on standardized tests—like SWE-bench, which asks an AI to solve real-world GitHub issues. They tested them with their native, proprietary harnesses, and then they tested them with other harnesses, including a simple, free, open-source one called Pi. The result was stunning. The success rate—the AI's ability to actually solve the problem—was basically the same no matter which harness they used.

A model didn't get magically smarter just because it was running in its official, expensive environment. But the cost? The cost was all over the place. Using a different harness could make the exact same task up to five times cheaper. So what's the pattern here? Where have we seen this before? This is the story of enterprise software over and over again. It’s the story of expensive, proprietary databases versus open-source alternatives like PostgreSQL. For years, the big vendors sold you on the idea that their special sauce, their integrated tooling, was essential for performance and reliability. And for a while, maybe it was. But eventually, the open-source alternatives got so good that they were not just cheaper, but often better.

The value proposition of the expensive, locked-in ecosystem started to crumble. The HarnessTax study is the first major crack in the foundation of the AI harness ecosystem. It proves that the "special sauce" might not be so special after all. You might be paying a massive premium for… nothing. Or, to be generous, you're paying for developer convenience or a particular workflow, which is a valid choice. But you are NOT, according to this data, paying for better results. That's a critical distinction. It forces a conversation about value. A 5x cost difference isn't a rounding error. It’s the difference between a project being viable or not. This study gives every developer and every company the data they need to ask a hard question: are we paying for the steak, or for the sizzle?

So what does it all add up to? We have one story about making physical identity transparently verifiable through cryptography, moving trust from a gut feeling about a hologram to a mathematical certainty. And we have another story about making AI development costs transparently verifiable through benchmarking, moving trust from a vendor's marketing claims to empirical data. The thread that connects them is a powerful demand for proof. It's a shift away from accepting opaque, black-box systems just because they're familiar or because an authority tells us to. Whether it's the government issuing an ID or a tech giant selling an AI service, the expectation is changing. Don't just tell us it's secure; show us the math.

Don't just tell us it's better; show us the data. This trend is everywhere once you start looking for it. The open-source Servo project is funded by donations because the community can see the work being done—the eleven hundred pull requests are the proof. The Xiaomi dashboard literally shows the proof of the model being trained. Even the blog post about backups is a plea to test and verify your own systems, not just trust that they work. We are moving into an era defined by verifiable claims. The old world of trusting institutions based on their authority and brand is giving way to a new world where trust has to be earned, demonstrated, and constantly re-verified in the open. The systems that embrace this transparency will thrive.

The ones that rely on mystery and marketing are built on borrowed time.