September 15, 2026
Report summary
11 stories cleared the bar, led by OEMpocalypse: unprivileged Android app gets root on Samsung, Xiaomi, Oppo, OnePlus, Nari Labs open-sources a Qwen3-TTS/ASR inference engine and claims #1 accuracy on Coval benchmarks, and Ollama v0.34.1: MLX memory-pressure handling and prefix-cache eviction fixes.
Worth attention
Security firm Calif published three exploit chains that take an Android app with zero permissions to full root on stock July-2026 firmware with locked bootloaders, across Galaxy S23-S26/Z, most Xiaomi mid-to-flagship, and recent Oppo/OnePlus/Realme devices. The bug class is a page use-after-free in OEM-specific kernel drivers, reached by first escaping the SELinux untrusted_app domain through a logic flaw in OEM IPC endpoints, so it generalises across an OEM lineup regardless of chipset. If you ship or rely on an Android app that handles tokens or payments, device-integrity and verified-boot signals are not trustworthy on these handsets until patches land. Watch for the OEM security bulletins and avoid treating "locked bootloader + green verified boot" as an anti-tamper guarantee.
Nari Labs (of Dia TTS) built and open-sourced an inference engine specialised for Qwen3-TTS, reporting sub-50ms latency at 10 RPS and, on the Coval voice-AI benchmarks, #1 word-error-rate accuracy and #2 latency versus ElevenLabs and Cartesia while being the cheapest endpoint. Their argument is that open speech models lose to closed ones on serving, not quality, because vLLM/SGLang are poorly suited to multimodal inference. For any voice-agent work this is a direct cost lever: worth benchmarking their hosted endpoint against your current TTS/ASR spend before the next billing cycle, and the engine is self-hostable if you want the latency without the vendor.
Ollama 0.34.1 focuses on the Apple-silicon MLX runner: it now checks free system memory and waits for evicted runners before loading the next MLX model, evicts prefix-cache snapshots from the active conversation, scopes array lifetimes instead of pinning-and-sweeping, and keeps the gemma3n projector off the CPU. The token repeat limit rises to 100 and now returns an error instead of a silently incomplete result. If you run local models on a Mac and have hit swap thrash or truncated generations when switching models, this is the release that addresses it — worth upgrading.
Across beta.387-393 the Composio CLI team did a focused startup-cost pass: 221ms and 44MB RSS removed from every invocation, the TypeScript compiler and generation pipeline deferred, the compiler and tokenizer moved out of the executable, and connected accounts listed once per execute rather than repeatedly. If you shell out to the Composio CLI inside an agent loop, that per-call overhead compounds; upgrading is close to free. Treat the rest of the beta stream as noise — this is the one release in the run with a user-visible effect.
Ben Thompson takes apart Dario Amodei’s "pace the frontier" proposal, arguing it is unrealistic as policy and reads mostly as a route to political control over AI development. Relevant as a read on where AI regulation pressure is heading, which eventually shows up as API terms and model-availability constraints. No immediate action, but it is the clearest articulation of the counter-argument to frontier-pacing this week.
Hugging Face published a walkthrough of running asynchronous GRPO reinforcement-learning fine-tuning with LoRA across HF Jobs, coordinating through an object-storage bucket and an HTTP proxy instead of NCCL collectives. The point of interest is the architecture: it removes the need for a tightly-coupled multi-GPU cluster, so RL fine-tuning becomes reachable on rented, loosely-coupled capacity. Narrow unless you are actually fine-tuning, but it lowers the infrastructure floor for doing so.
Laurie Voss argues that as codified knowledge gets absorbed by tooling, the labour-market advantage shifts to tacit knowledge — the judgement you only get by doing the job — and that the twenty-five-year split between Product and Engineering as separate careers is collapsing back into one role. The practical read for a solo builder is that the part of the work that is hardest to commoditise is deciding what to build and why, not the implementation. Useful framing for how to position yourself and what to keep doing by hand.
n8n 2.39.5 adds log-streaming events for instance reports and fixes a bug that prevented some users from revoking end-user credentials. The credential-revocation fix is the one that matters if you run n8n multi-tenant; otherwise this is a routine patch. Worth noting rather than acting on.
OpenAI’s customer story on Fyxer, an AI executive assistant that organises inboxes and drafts email in each user’s voice using fine-tuning, memory and user feedback loops. It is vendor marketing, so discount the claims, but the shape of the product — per-user voice capture plus memory plus explicit correction signals — is the same shape as calendar/comms agent work, and the case study is one of the few public descriptions of how that trust loop was built.
A rerun of Simon Willison’s pelican-riding-a-bicycle style SVG-generation prompts, this time with ten prompts across six current models via OpenRouter, costing about twenty dollars. It is a cheap, repeatable vibe-check on how much spatial/compositional reasoning has actually improved since late 2025. Not a decision input, but a reasonable model-comparison artefact to glance at.
The neobrutalism component collection now supports Base UI alongside its existing targets and ships a new colour theme. Narrow, but if you need a distinctive-looking internal tool or landing page without designing one, it is a drop-in. No action unless you are picking a component library this week.
Full digest
We already have paying customers at Prefer. Today we got something that felt different. Someone became our first customer on our highest-pri…
Hi everyone, I have a SaaS that launched in Feb/April, I have 14 users on $35 a year, the sign up rate per month appears to be increasing. M…
I’m 15 and I started building my SaaS around 3 months ago, I started looking for clients almost immediately after I built the most basic ver…
With AI agents, we're going to see a LOT more products being launched every day. But I've noticed something as a user: If I visit a website…
n8n 2.39.5 adds log-streaming events for instance reports and fixes a bug that prevented some users from revoking end-user credentials. The credential-revocation fix is the one that matters if you run n8n multi-tenant; otherwise this is a routine patch. Worth noting rather than acting on.
What are you doing this week? Feel free to share! Keep in mind it’s OK to do nothing at all, too.
Stone Age rope and twine history; interesting but off-topic.
2018 arXiv paper resurfacing on HN; no new information.
https://archive.ph/8NmSg
2022 essay on optimistic science fiction; off-topic.
I’ve been building a SaaS and honestly, I’m kind of lost when it comes to marketing it. I don’t really know what actually works. I’ve tried…
so i was adding og:image previews to my main project and kept messing it up, tried like 3-4 times and just couldn't get it working right. th…
I've been building out my SaaS for a year and a half now. I'm a bit late to the game reading posts here, but I constantly see advice about m…
I’m not sure if I read this right but these 20 year old kids are on their 3rd multi-million startup? After cal ai and quitter they now built…
  submitted by   /u/OldCamel8838 [link]   [comments]
I've been asking owners who sell and support over WhatsApp how much of their day goes to answering the same handful of questions. I assumed…
Hi, As individual creators what do you think about marketing on socials? How do you create content? Pay editors? Do it with AI? Or use your…
Je suis actuellement en court de création d'un application et sur ce que j'ai pu voir un peu partout il est fortement conseillé de chercher…
Ben Thompson takes apart Dario Amodei’s "pace the frontier" proposal, arguing it is unrealistic as policy and reads mostly as a route to political control over AI development. Relevant as a read on where AI regulation pressure is heading, which eventually shows up as API terms and model-availability constraints. No immediate action, but it is the clearest articulation of the counter-argument to frontier-pacing this week.
R
ลองเลย
Localised AI Studio deep-link with no changelog content; feed artefact.
Hugging Face published a walkthrough of running asynchronous GRPO reinforcement-learning fine-tuning with LoRA across HF Jobs, coordinating through an object-storage bucket and an HTTP proxy instead of NCCL collectives. The point of interest is the architecture: it removes the need for a tightly-coupled multi-GPU cluster, so RL fine-tuning becomes reachable on rented, loosely-coupled capacity. Narrow unless you are actually fine-tuning, but it lowers the infrastructure floor for doing so.
### Misc Changes - Durable use cache: fix runtime env var mutation: #98558 - refactor(turbopack): drop the generic on `new_atom`, and stop i…
Bird migration visualisation; interesting but not decision-relevant.
Security firm Calif published three exploit chains that take an Android app with zero permissions to full root on stock July-2026 firmware with locked bootloaders, across Galaxy S23-S26/Z, most Xiaomi mid-to-flagship, and recent Oppo/OnePlus/Realme devices. The bug class is a page use-after-free in OEM-specific kernel drivers, reached by first escaping the SELinux untrusted_app domain through a logic flaw in OEM IPC endpoints, so it generalises across an OEM lineup regardless of chipset. If you ship or rely on an Android app that handles tokens or payments, device-integrity and verified-boot signals are not trustworthy on these handsets until patches land. Watch for the OEM security bulletins and avoid treating "locked bootloader + green verified boot" as an anti-tamper guarantee.
Laurie Voss argues that as codified knowledge gets absorbed by tooling, the labour-market advantage shifts to tacit knowledge — the judgement you only get by doing the job — and that the twenty-five-year split between Product and Engineering as separate careers is collapsing back into one role. The practical read for a solo builder is that the part of the work that is hardest to commoditise is deciding what to build and why, not the implementation. Useful framing for how to position yourself and what to keep doing by hand.
Comments
OpenAI’s customer story on Fyxer, an AI executive assistant that organises inboxes and drafts email in each user’s voice using fine-tuning, memory and user feedback loops. It is vendor marketing, so discount the claims, but the shape of the product — per-user voice capture plus memory plus explicit correction signals — is the same shape as calendar/comms agent work, and the case study is one of the few public descriptions of how that trust loop was built.
## What's Changed * perf(cli): list connected accounts once per execute by @sudodaksh in https://github.com/ComposioHQ/composio/pull/4475 **…
## What's Changed * docs: explain token custody architecture and deployment options by @olearycrew in https://github.com/ComposioHQ/composio…
## What's Changed * perf(cli): move the compiler and tokenizer out of the executable by @sudodaksh in https://github.com/ComposioHQ/composio…
## What's Changed * perf(cli): defer the TypeScript compiler and generation pipeline by @sudodaksh in https://github.com/ComposioHQ/composio…
## What's Changed * fix(cli): stop tiktoken special-token literals from failing execute by @sudodaksh in https://github.com/ComposioHQ/compo…
Across beta.387-393 the Composio CLI team did a focused startup-cost pass: 221ms and 44MB RSS removed from every invocation, the TypeScript compiler and generation pipeline deferred, the compiler and tokenizer moved out of the executable, and connected accounts listed once per execute rather than repeatedly. If you shell out to the Composio CLI inside an agent loop, that per-call overhead compounds; upgrading is close to free. Treat the rest of the beta stream as noise — this is the one release in the run with a user-visible effect.
## What's Changed * docs(agent-setup): fix client links and OpenClaw install guidance by @jkomyno in https://github.com/ComposioHQ/composio/…
Ollama 0.34.1 focuses on the Apple-silicon MLX runner: it now checks free system memory and waits for evicted runners before loading the next MLX model, evicts prefix-cache snapshots from the active conversation, scopes array lifetimes instead of pinning-and-sweeping, and keeps the gemma3n projector off the CPU. The token repeat limit rises to 100 and now returns an error instead of a silently incomplete result. If you run local models on a Mac and have hit swap thrash or truncated generations when switching models, this is the release that addresses it — worth upgrading.
Niche hobbyist MIDI pedalboard macro tool; no broader leverage.
A rerun of Simon Willison’s pelican-riding-a-bicycle style SVG-generation prompts, this time with ten prompts across six current models via OpenRouter, costing about twenty dollars. It is a cheap, repeatable vibe-check on how much spatial/compositional reasoning has actually improved since late 2025. Not a decision input, but a reasonable model-comparison artefact to glance at.
P
Nari Labs open-sources a Qwen3-TTS/ASR inference engine and claims #1 accuracy on Coval benchmarks
Nari Labs (of Dia TTS) built and open-sourced an inference engine specialised for Qwen3-TTS, reporting sub-50ms latency at 10 RPS and, on the Coval voice-AI benchmarks, #1 word-error-rate accuracy and #2 latency versus ElevenLabs and Cartesia while being the cheapest endpoint. Their argument is that open speech models lose to closed ones on serving, not quality, because vLLM/SGLang are poorly suited to multimodal inference. For any voice-agent work this is a direct cost lever: worth benchmarking their hosted endpoint against your current TTS/ASR spend before the next billing cycle, and the engine is self-hostable if you want the latency without the vendor.
The neobrutalism component collection now supports Base UI alongside its existing targets and ships a new colour theme. Narrow, but if you need a distinctive-looking internal tool or landing page without designing one, it is a drop-in. No action unless you are picking a component library this week.
Original markdown
# Nightly Librarian — Newsletter draft Run: 4f63b509-4b68-43cb-b23d-fc92e05e407d Started: 2026-09-15T06:10:05.038Z Completed: 2026-09-15T06:13:52.115Z ## Worth attention - **OEMpocalypse: unprivileged Android app gets root on Samsung, Xiaomi, Oppo, OnePlus** https://calif.io/research/oempocalypse Security firm Calif published three exploit chains that take an Android app with zero permissions to full root on stock July-2026 firmware with locked bootloaders, across Galaxy S23-S26/Z, most Xiaomi mid-to-flagship, and recent Oppo/OnePlus/Realme devices. The bug class is a page use-after-free in OEM-specific kernel drivers, reached by first escaping the SELinux untrusted_app domain through a logic flaw in OEM IPC endpoints, so it generalises across an OEM lineup regardless of chipset. If you ship or rely on an Android app that handles tokens or payments, device-integrity and verified-boot signals are not trustworthy on these handsets until patches land. Watch for the OEM security bulletins and avoid treating "locked bootloader + green verified boot" as an anti-tamper guarantee. - **Nari Labs open-sources a Qwen3-TTS/ASR inference engine and claims #1 accuracy on Coval benchmarks** https://narilabs.com/blog/nari-labs-leads-coval-voice-ai-benchmarks/ Nari Labs (of Dia TTS) built and open-sourced an inference engine specialised for Qwen3-TTS, reporting sub-50ms latency at 10 RPS and, on the Coval voice-AI benchmarks, #1 word-error-rate accuracy and #2 latency versus ElevenLabs and Cartesia while being the cheapest endpoint. Their argument is that open speech models lose to closed ones on serving, not quality, because vLLM/SGLang are poorly suited to multimodal inference. For any voice-agent work this is a direct cost lever: worth benchmarking their hosted endpoint against your current TTS/ASR spend before the next billing cycle, and the engine is self-hostable if you want the latency without the vendor. - **Ollama v0.34.1: MLX memory-pressure handling and prefix-cache eviction fixes** https://github.com/ollama/ollama/releases/tag/v0.34.1-rc2 Ollama 0.34.1 focuses on the Apple-silicon MLX runner: it now checks free system memory and waits for evicted runners before loading the next MLX model, evicts prefix-cache snapshots from the active conversation, scopes array lifetimes instead of pinning-and-sweeping, and keeps the gemma3n projector off the CPU. The token repeat limit rises to 100 and now returns an error instead of a silently incomplete result. If you run local models on a Mac and have hit swap thrash or truncated generations when switching models, this is the release that addresses it — worth upgrading. - **Composio CLI cuts 221ms and 44MB RSS off every invocation** https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.4.2-beta.388 Across beta.387-393 the Composio CLI team did a focused startup-cost pass: 221ms and 44MB RSS removed from every invocation, the TypeScript compiler and generation pipeline deferred, the compiler and tokenizer moved out of the executable, and connected accounts listed once per execute rather than repeatedly. If you shell out to the Composio CLI inside an agent loop, that per-call overhead compounds; upgrading is close to free. Treat the rest of the beta stream as noise — this is the one release in the run with a user-visible effect. - **Stratechery: Pacing the Frontier, AI’s Digital Limits, AI Commissars** https://stratechery.com/2026/pacing-the-frontier-ais-digital-limits-ai-commissars/ Ben Thompson takes apart Dario Amodei’s "pace the frontier" proposal, arguing it is unrealistic as policy and reads mostly as a route to political control over AI development. Relevant as a read on where AI regulation pressure is heading, which eventually shows up as API terms and model-availability constraints. No immediate action, but it is the clearest articulation of the counter-argument to frontier-pacing this week. - **Async GRPO with LoRA across HF Jobs: a bucket, a proxy, and no NCCL** https://huggingface.co/blog/asyncgrpo-lora-hfjobs Hugging Face published a walkthrough of running asynchronous GRPO reinforcement-learning fine-tuning with LoRA across HF Jobs, coordinating through an object-storage bucket and an HTTP proxy instead of NCCL collectives. The point of interest is the architecture: it removes the need for a tightly-coupled multi-GPU cluster, so RL fine-tuning becomes reachable on rented, loosely-coupled capacity. Narrow unless you are actually fine-tuning, but it lowers the infrastructure floor for doing so. - **We are all Product Engineers now** https://seldo.com/posts/we-are-all-product-engineers-now/ Laurie Voss argues that as codified knowledge gets absorbed by tooling, the labour-market advantage shifts to tacit knowledge — the judgement you only get by doing the job — and that the twenty-five-year split between Product and Engineering as separate careers is collapsing back into one role. The practical read for a solo builder is that the part of the work that is hardest to commoditise is deciding what to build and why, not the implementation. Useful framing for how to position yourself and what to keep doing by hand. - **n8n 2.39.5: log streaming for instance reports, credential revocation fix** https://github.com/n8n-io/n8n/releases/tag/n8n%402.39.5 n8n 2.39.5 adds log-streaming events for instance reports and fixes a bug that prevented some users from revoking end-user credentials. The credential-revocation fix is the one that matters if you run n8n multi-tenant; otherwise this is a routine patch. Worth noting rather than acting on. - **OpenAI case study: how Fyxer built an AI executive assistant people trust** https://openai.com/index/fyxer OpenAI’s customer story on Fyxer, an AI executive assistant that organises inboxes and drafts email in each user’s voice using fine-tuning, memory and user feedback loops. It is vendor marketing, so discount the claims, but the shape of the product — per-user voice capture plus memory plus explicit correction signals — is the same shape as calendar/comms agent work, and the case study is one of the few public descriptions of how that trust loop was built. - **Show HN: re-running the pelican-on-a-bicycle SVG prompts nine months later** https://gally.net/temp/20260914pelican-alternatives/index.html A rerun of Simon Willison’s pelican-riding-a-bicycle style SVG-generation prompts, this time with ten prompts across six current models via OpenRouter, costing about twenty dollars. It is a cheap, repeatable vibe-check on how much spatial/compositional reasoning has actually improved since late 2025. Not a decision input, but a reasonable model-comparison artefact to glance at. - **Neobrutalism.dev adds Base UI support and a new colour theme** https://www.neobrutalism.dev/ The neobrutalism component collection now supports Base UI alongside its existing targets and ships a new colour theme. Narrow, but if you need a distinctive-looking internal tool or landing page without designing one, it is a drop-in. No action unless you are picking a component library this week. ## Full digest - [R] [reddit-saas] Our highest-priced plan just got its first customer. And it feels different. — https://www.reddit.com/r/SaaS/comments/1wfwjoa/our_highestpriced_plan_just_got_its_first/ — We already have paying customers at Prefer. Today we got something that felt different. Someone became our first customer on our highest-pri… - [R] [reddit-saas] Honest opinions on my MRR — https://www.reddit.com/r/SaaS/comments/1wfvpf5/honest_opinions_on_my_mrr/ — Hi everyone, I have a SaaS that launched in Feb/April, I have 14 users on $35 a year, the sign up rate per month appears to be increasing. M… - [R] [reddit-saas] What am I doing wrong? — https://www.reddit.com/r/SaaS/comments/1wfvwtb/what_am_i_doing_wrong/ — I’m 15 and I started building my SaaS around 3 months ago, I started looking for clients almost immediately after I built the most basic ver… - [R] [reddit-saas] Loosing trust of users on the tech products — https://www.reddit.com/r/SaaS/comments/1wfws5l/loosing_trust_of_users_on_the_tech_products/ — With AI agents, we're going to see a LOT more products being launched every day. But I've noticed something as a user: If I visit a website… - [M] [gh-n8n] n8n 2.39.5: log streaming for instance reports, credential revocation fix — https://github.com/n8n-io/n8n/releases/tag/n8n%402.39.5 — n8n 2.39.5 adds log-streaming events for instance reports and fixes a bug that prevented some users from revoking end-user credentials. The credential-revocation fix is the one that matters if you run n8n multi-tenant; otherwise this is a routine patch. Worth noting rather than acting on. - [R] [gh-n8n] beta — https://github.com/n8n-io/n8n/releases/tag/beta — ## [2.39.5](https://github.com/n8n-io/n8n/compare/n8n@2.39.4...n8n@2.39.5) (2026-09-14) ### Bug Fixes * **editor:** Fixes issue that prevent… - [R] [lobsters] What are you doing this week? — https://lobste.rs/s/0inlyw/what_are_you_doing_this_week — What are you doing this week? Feel free to share! Keep in mind it’s OK to do nothing at all, too. - [R] [hn-top] Rope, twine and thread: Invisible technologies of the Stone Age — https://knowablemagazine.org/content/article/society/2026/prehistory-lost-threads — Stone Age rope and twine history; interesting but off-topic. - [R] [hn-top] The Malicious Use of Artificial Intelligence — https://arxiv.org/abs/1802.07228 — 2018 arXiv paper resurfacing on HN; no new information. - [R] [hn-top] Nike exits the S&P 100 after 18 years and a $200B market-cap wipeout — https://fortune.com/2026/09/08/nike-stock-plummets-sp500-market-cap-index/ — https://archive.ph/8NmSg - [R] [hn-top] Writing a better reality: The case for optimistic sci-fi (2022) — https://honisoit.com/2022/03/writing-a-better-reality-the-case-for-optimistic-sci-fi/ — 2022 essay on optimistic science fiction; off-topic. - [R] [reddit-saas] I don't know how to market my SaaS.. — https://www.reddit.com/r/SaaS/comments/1wfyfp6/i_dont_know_how_to_market_my_saas/ — I’ve been building a SaaS and honestly, I’m kind of lost when it comes to marketing it. I don’t really know what actually works. I’ve tried… - [R] [reddit-saas] I made a free tool to preview og:image + metadata for any website — https://www.reddit.com/r/SaaS/comments/1wfxkdu/i_made_a_free_tool_to_preview_ogimage_metadata/ — so i was adding og:image previews to my main project and kept messing it up, tried like 3-4 times and just couldn't get it working right. th… - [R] [reddit-saas] What does marketing first look like? — https://www.reddit.com/r/SaaS/comments/1wfxkal/what_does_marketing_first_look_like/ — I've been building out my SaaS for a year and a half now. I'm a bit late to the game reading posts here, but I constantly see advice about m… - [R] [reddit-saas] These 20 year old founders just made an uber for flights — https://www.reddit.com/r/SaaS/comments/1wfzwze/these_20_year_old_founders_just_made_an_uber_for/ — I’m not sure if I read this right but these 20 year old kids are on their 3rd multi-million startup? After cal ai and quitter they now built… - [R] [reddit-saas] Now a days distribution becomes 5x more important than building another product — https://www.reddit.com/r/SaaS/comments/1wfyx68/now_a_days_distribution_becomes_5x_more_important/ —   submitted by   /u/OldCamel8838 [link]   [comments] - [R] [reddit-saas] I asked 10 small business owners about WhatsApp support last week — https://www.reddit.com/r/SaaS/comments/1wfzq72/i_asked_10_small_business_owners_about_whatsapp/ — I've been asking owners who sell and support over WhatsApp how much of their day goes to answering the same handful of questions. I assumed… - [R] [reddit-saas] Tiktok/Instagram marketing — https://www.reddit.com/r/SaaS/comments/1wfzkcy/tiktokinstagram_marketing/ — Hi, As individual creators what do you think about marketing on socials? How do you create content? Pay editors? Do it with AI? Or use your… - [R] [reddit-saas] Trouver des clients B2b — https://www.reddit.com/r/SaaS/comments/1wfyoaa/trouver_des_clients_b2b/ — Je suis actuellement en court de création d'un application et sur ce que j'ai pu voir un peu partout il est fortement conseillé de chercher… - [P] [stratechery] Stratechery: Pacing the Frontier, AI’s Digital Limits, AI Commissars — https://stratechery.com/2026/pacing-the-frontier-ais-digital-limits-ai-commissars/ — Ben Thompson takes apart Dario Amodei’s "pace the frontier" proposal, arguing it is unrealistic as policy and reads mostly as a route to political control over AI development. Relevant as a read on where AI regulation pressure is heading, which eventually shows up as API terms and model-availability constraints. No immediate action, but it is the clearest articulation of the counter-argument to frontier-pacing this week. - [R] [google-ai-changelog] ลองเลย — https://aistudio.google.com/prompts/new_chat?model=gemini-3.8-flash&hl=th — Localised AI Studio deep-link with no changelog content; feed artefact. - [P] [huggingface-blog] Async GRPO with LoRA across HF Jobs: a bucket, a proxy, and no NCCL — https://huggingface.co/blog/asyncgrpo-lora-hfjobs — Hugging Face published a walkthrough of running asynchronous GRPO reinforcement-learning fine-tuning with LoRA across HF Jobs, coordinating through an object-storage bucket and an HTTP proxy instead of NCCL collectives. The point of interest is the architecture: it removes the need for a tightly-coupled multi-GPU cluster, so RL fine-tuning becomes reachable on rented, loosely-coupled capacity. Narrow unless you are actually fine-tuning, but it lowers the infrastructure floor for doing so. - [R] [gh-nextjs] v16.4.0-canary.29 — https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.29 — ### Misc Changes - Durable use cache: fix runtime env var mutation: #98558 - refactor(turbopack): drop the generic on `new_atom`, and stop i… - [R] [hn-top] EuroBirdPortal – Live bird movements across Europe — https://www.eurobirdportal.org/ebp/en/ — Bird migration visualisation; interesting but not decision-relevant. - [P] [hn-top] OEMpocalypse: unprivileged Android app gets root on Samsung, Xiaomi, Oppo, OnePlus — https://calif.io/research/oempocalypse — Security firm Calif published three exploit chains that take an Android app with zero permissions to full root on stock July-2026 firmware with locked bootloaders, across Galaxy S23-S26/Z, most Xiaomi mid-to-flagship, and recent Oppo/OnePlus/Realme devices. The bug class is a page use-after-free in OEM-specific kernel drivers, reached by first escaping the SELinux untrusted_app domain through a logic flaw in OEM IPC endpoints, so it generalises across an OEM lineup regardless of chipset. If you ship or rely on an Android app that handles tokens or payments, device-integrity and verified-boot signals are not trustworthy on these handsets until patches land. Watch for the OEM security bulletins and avoid treating "locked bootloader + green verified boot" as an anti-tamper guarantee. - [P] [lobsters] We are all Product Engineers now — https://seldo.com/posts/we-are-all-product-engineers-now/ — Laurie Voss argues that as codified knowledge gets absorbed by tooling, the labour-market advantage shifts to tacit knowledge — the judgement you only get by doing the job — and that the twenty-five-year split between Product and Engineering as separate careers is collapsing back into one role. The practical read for a solo builder is that the part of the work that is hardest to commoditise is deciding what to build and why, not the implementation. Useful framing for how to position yourself and what to keep doing by hand. - [R] [lobsters] Download Dimensional Drawings - Accessories — https://developer.apple.com/accessories/dimensional-drawings/ — Comments - [M] [openai-blog] OpenAI case study: how Fyxer built an AI executive assistant people trust — https://openai.com/index/fyxer — OpenAI’s customer story on Fyxer, an AI executive assistant that organises inboxes and drafts email in each user’s voice using fine-tuning, memory and user feedback loops. It is vendor marketing, so discount the claims, but the shape of the product — per-user voice capture plus memory plus explicit correction signals — is the same shape as calendar/comms agent work, and the case study is one of the few public descriptions of how that trust loop was built. - [R] [gh-composio] CLI Beta @composio/cli@0.4.2-beta.393 — https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.4.2-beta.393 — ## What's Changed * perf(cli): list connected accounts once per execute by @sudodaksh in https://github.com/ComposioHQ/composio/pull/4475 **… - [R] [gh-composio] CLI Beta @composio/cli@0.4.2-beta.392 — https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.4.2-beta.392 — ## What's Changed * docs: explain token custody architecture and deployment options by @olearycrew in https://github.com/ComposioHQ/composio… - [R] [gh-composio] CLI Beta @composio/cli@0.4.2-beta.391 — https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.4.2-beta.391 — ## What's Changed * perf(cli): move the compiler and tokenizer out of the executable by @sudodaksh in https://github.com/ComposioHQ/composio… - [R] [gh-composio] CLI Beta @composio/cli@0.4.2-beta.390 — https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.4.2-beta.390 — ## What's Changed * perf(cli): defer the TypeScript compiler and generation pipeline by @sudodaksh in https://github.com/ComposioHQ/composio… - [R] [gh-composio] CLI Beta @composio/cli@0.4.2-beta.389 — https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.4.2-beta.389 — ## What's Changed * fix(cli): stop tiktoken special-token literals from failing execute by @sudodaksh in https://github.com/ComposioHQ/compo… - [P] [gh-composio] Composio CLI cuts 221ms and 44MB RSS off every invocation — https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.4.2-beta.388 — Across beta.387-393 the Composio CLI team did a focused startup-cost pass: 221ms and 44MB RSS removed from every invocation, the TypeScript compiler and generation pipeline deferred, the compiler and tokenizer moved out of the executable, and connected accounts listed once per execute rather than repeatedly. If you shell out to the Composio CLI inside an agent loop, that per-call overhead compounds; upgrading is close to free. Treat the rest of the beta stream as noise — this is the one release in the run with a user-visible effect. - [R] [gh-composio] CLI Beta @composio/cli@0.4.2-beta.387 — https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.4.2-beta.387 — ## What's Changed * docs(agent-setup): fix client links and OpenClaw install guidance by @jkomyno in https://github.com/ComposioHQ/composio/… - [P] [gh-ollama] Ollama v0.34.1: MLX memory-pressure handling and prefix-cache eviction fixes — https://github.com/ollama/ollama/releases/tag/v0.34.1-rc2 — Ollama 0.34.1 focuses on the Apple-silicon MLX runner: it now checks free system memory and waits for evicted runners before loading the next MLX model, evicts prefix-cache snapshots from the active conversation, scopes array lifetimes instead of pinning-and-sweeping, and keeps the gemma3n projector off the CPU. The token repeat limit rises to 100 and now returns an error instead of a silently incomplete result. If you run local models on a Mac and have hit swap thrash or truncated generations when switching models, this is the release that addresses it — worth upgrading. - [R] [hn-show] Show HN: Macros with a Behringer FCB1010 MIDI Pedalboard in macOS — https://github.com/JamesRyanATX/fcbnerd — Niche hobbyist MIDI pedalboard macro tool; no broader leverage. - [M] [hn-show] Show HN: re-running the pelican-on-a-bicycle SVG prompts nine months later — https://gally.net/temp/20260914pelican-alternatives/index.html — A rerun of Simon Willison’s pelican-riding-a-bicycle style SVG-generation prompts, this time with ten prompts across six current models via OpenRouter, costing about twenty dollars. It is a cheap, repeatable vibe-check on how much spatial/compositional reasoning has actually improved since late 2025. Not a decision input, but a reasonable model-comparison artefact to glance at. - [P] [hn-show] Nari Labs open-sources a Qwen3-TTS/ASR inference engine and claims #1 accuracy on Coval benchmarks — https://narilabs.com/blog/nari-labs-leads-coval-voice-ai-benchmarks/ — Nari Labs (of Dia TTS) built and open-sourced an inference engine specialised for Qwen3-TTS, reporting sub-50ms latency at 10 RPS and, on the Coval voice-AI benchmarks, #1 word-error-rate accuracy and #2 latency versus ElevenLabs and Cartesia while being the cheapest endpoint. Their argument is that open speech models lose to closed ones on serving, not quality, because vLLM/SGLang are poorly suited to multimodal inference. For any voice-agent work this is a direct cost lever: worth benchmarking their hosted endpoint against your current TTS/ASR spend before the next billing cycle, and the engine is self-hostable if you want the latency without the vendor. - [M] [hn-show] Neobrutalism.dev adds Base UI support and a new colour theme — https://www.neobrutalism.dev/ — The neobrutalism component collection now supports Base UI alongside its existing targets and ships a new colour theme. Narrow, but if you need a distinctive-looking internal tool or landing page without designing one, it is a drop-in. No action unless you are picking a component library this week.