3.21.26 | OpenCode is an open source AI coding agent, Delve offers fake compliance as a service, and France's aircraft carrier was located in real time by Le Monde through a fitness app

**SPEAKER_1** (0:00)
Welcome to the Hacker News Highlights, where we explore the top 10 posts on Hacker News every day. Today, we dive into enabling open source AI coding with multi-model support, monitoring a France aircraft carrier through a fitness app in real time, and observing fake compliance services. Let's begin. Title, OpenCode, Open Source AI Coding Agent, Source, opencode.ai. The article introduces OpenCode, an open source tool designed to help developers write code using AI and terminals, IDEs or desktops. It supports models from over 75 providers, enables multi-session workflows, and offers a web UI. OpenCode emphasizes privacy by not storing code or context data, and provides access to tested, optimized models for coding such as Xen. The post highlights that OpenCode is widely used with over 5 million monthly developers, and promotes flexibility by allowing users to connect with local models or other inference servers. In the comments, users mostly expressed enthusiasm for OpenCode's flexibility and feature set, comparing it favorably to proprietary solutions like Cloud Code and Codecs. They debated resource use, with many noting that the tool consumes around 1GB of RAM, which they considered resource intensive for a terminal UI. Concerns about telemetry and privacy practices were raised, with some pointing out that OpenCode still sends data to servers, even when running locally. Critics also discussed the rapid release cycle, and stability issues, suggesting that frequent updates lead to bugs and inconsistency. Overall, community sentiment leaned toward support, but with caution about security, stability and data privacy. Title, Delve Fake Compliance as a Service. Source, deepdelver.substack.com.
The Post reports on a startup called Delve, founded by MIT dropouts that claim to automate compliance processes like SOC2 reports. The article reveals that Delve's offerings were largely fake, including presenting pre-filled and fraudulent audit reports that lacked real validation. It shows how the company's practices involved active deception, unethically upcharging for fake certificates and colluding with sham auditors, leading to questions about widespread fraud in the compliance industry. In the comments, users mostly expressed outrage over Delve's dishonesty, and the broader issues with the compliance industry's reliance on check-the-box certifications. Many discussed how reputation and VC funding can enable fraudulent firms to operate unchecked, and criticize the industry for facilitating such scams by endorsing superficial compliance. Some debated whether the entire process is fundamentally flawed or worth reform, while others pointed out that many companies simply accept these certifications as a necessary cost of doing business. The community's tone was largely angry and skeptical about the legitimacy of compliance certifications and the practices of firms like Delve. Title, France's Aircraft Carrier Located in Real Time by Le Monde Through Fitness App Source lemonde.fr The news story detailed how Le Monde used publicly available data from a fitness app to track the exact location of the French aircraft carrier Charles de Gaulle. They combined GPS data from a crew member's runs near the ship with open source analysis tools to pinpoint its movements during deployment. The Post emphasized that the ship's location was easily discoverable because of the public nature of fitness tracking data, and it questioned why military forces did not have better OPSEC measures to prevent such leaks. In the comments, users mostly agreed that it was easy to track large ships like aircraft carriers using commercial satellites and openly accessible data sources. Many discussed how civilian fitness apps, satellite radar and public tracking tools reveal troop and vessel locations more often than expected. The community debated the effectiveness of OPSEC in the face of widespread civilian data sharing, with some noting that military personnel often accidentally leak sensitive information through daily activities. There was a consensus that modern satellite technology makes bulk tracking feasible for many nations, and the main challenge remains in how well military data is protected from inadvertent exposure. The overall tone was that the leaks demonstrated the vulnerability of even the most secure assets when individuals unknowingly share operational details publicly. The community largely supported stronger security protocols and awareness to prevent such exposure. Title, Our Commitment to Windows Quality, Source, Hacker News. The post from the Windows Insider Blog outlines Microsoft's plan to improve Windows 11 by addressing feedback on usability, stability and personalization. Key updates include better taskbar customization, more meaningful AI integration with fewer entry points, and enhancements to Windows Update, File Explorer and widgets. The company also promises a clearer, more transparent Insider program and a redesigned Feedback Hub to gather user input. The overall message suggests a recognition of past failures and a tentative effort to restore user trust by focusing on core functionality and better experience, with an emphasis on performance, reliability and craft. In the comments, users mostly expressed skepticism and noted that Microsoft's promises felt like superficial damage control. They debated whether the company's focus on AI, telemetry and forced updates truly reflected a genuine commitment, or if it was just marketing. The community pointed out that many improvements were long overdue, and accused Microsoft of neglecting user feedback in the past. Several users highlighted that Windows' fundamental issues go beyond superficial features, emphasizing that real trust depends on meaningful change, not just words. The dominant sentiment was that Microsoft's recent efforts are too little and too late, with many referring to past broken promises and questioning if the company truly advocates for user interests or is driven solely by profit motives. Title, The Los Angeles Aqueduct is Wild, Source, Practical Engineering. The Post explains how the Los Angeles Aqueduct delivers water from the Sierra Nevada, thousands of kilometers away to the city, highlighting its complicated history and engineering. It describes the construction, politics and environmental effects of the aqueduct, emphasizing its gravity-based system and the challenges faced over more than a century. The story also explores the social and ecological costs, including conflicts with Owens Valley residents and environmental damage, alongside the technological advances that continue to support LA's water needs. In the comments, users mostly considered the aqueduct an impressive engineering feat. With some debating its environmental and social costs, many expressed skepticism about the environmental destruction in Owens Valley, and discussed the high costs of water infrastructure. There were contrasting views about water politics, with some criticizing the history of water rights and others defending the engineering achievements. The community also debated potential alternatives like desalination and the impact of environmental regulations. With a general consensus that the aqueduct's construction was a remarkable but morally complex achievement, the overall community sentiment was largely appreciative of the engineering, but concerned about environmental and social repercussions. The title, A Japanese Glossary of Chopsticks Faux Pas, 2022 Source, nippon.com. The post listed many behaviors considered wrong when using chopsticks in Japan. It explained various acts to avoid, such as passing food between chopsticks and placing them upright in rice, highlighting their cultural significance and flagging which ones are particularly serious or common mistakes. The article aimed to inform foreigners and casual diners about etiquette to prevent inadvertent offense. In the comments, users largely discussed how many of these rules are more relevant in formal or traditional settings and not strictly enforced in everyday life. The majority emphasized that many customs are context dependent and that casual Japanese diners often ignore most of the listed faux pas. Some pointed out that etiquette varies greatly with social class, region, and personal upbringing, and that foreigners often overestimate the importance of these rules. Several users shared personal experiences, noting that in modern Japan, the focus has shifted away from strict adherence, especially outside formal occasions. The community's tone leaned toward believing that while understanding etiquette can be helpful, it is often flexible in practice, and over-emphasizing these customs might lead to unnecessary concern or misjudgment. Overall, the community largely viewed this list as a detailed, but somewhat exaggerated account of Japanese chopstick etiquette. Title? Ghostling. Source? GitHub. The Ghostling project is a minimal demo of a terminal built on the LibGhosty C API, designed to show its flexibility without full GUI features. It uses Raylib for windowing and rendering, focusing on core terminal functions like resizing, color support, Unicode, and user input handling. The project emphasizes that it's not meant as a daily use terminal, but highlights what LibGhosty can do, including potential future features like graphics protocol support and cross-platform Windows compatibility. In the comments, users mostly reacted positively, praising the simplicity and cross-platform potential of Ghostlyng. They discussed unconventional ways to embed binary resources into code, sharing methods like using XXD or OBJ copy, and debated the pros and cons of embedding resources directly versus other techniques. Some expressed interest in Ghostlyng's approach to packaging TUIs as desktop apps and shared their own tools and workflows for terminal and resource management. Overall, the community saw Ghostlyng as an inspiring example of modern, embeddable terminal emulation with a mostly supportive tone. Title, we rewrote our Rust Wasm parser in TypeScript and it got faster. Source, openui.com. The post explained that a Rust-based WebAssembly parser for converting a custom DSL generated by a language model into a reactive component tree was slower in some cases when returning data directly as a JavaScript object. Reverting to JS on serialization improved speed. The team then ported the entire parser pipeline to TypeScript, removing the Wasm boundary overhead. They implemented an incremental caching approach for streaming, which significantly improved performance, especially for large documents. Overall, rewriting the parser in TypeScript resulted in 2.2 to 4.6 times faster per call and reduced total streaming latency by 2.6 to 3.3 times. The article emphasized that algorithm improvements and data transfer costs across Wasm boundaries rather than language choice made the biggest difference. In the comments, users mainly discussed that the main gain came from fixing the ON2 streaming algorithm with statement-level caching. The debate centered on the fact that the boundary overhead of Wasm was less important than the algorithmic inefficiency. Some suggested that the entire story highlighted how algorithm design impacts performance more than language choice. There was skepticism about the benchmarks, with some concerned that the benchmarks might be AI-generated or not representative. Several commenters reflected on how data transfer across JS and Wasm is a key factor, not raw computation speed. And shared experiences with performance issues in other contexts like Python and C++. The community largely agreed that algorithmic improvements and optimizing data transfer are crucial, with a less favorable view of Wasm boundaries and inter-language communication as performance bottlenecks.