UFC's Five Greatest Lightweight Champions of All Time Ranked

Khabib Nurmagomedov is widely regarded as the greatest UFC lightweight champion in history, known for his undefeated record and dominant grappling style. His compatriot Islam Makhachev has carried forward the Dagestani legacy with an equally commanding reign as current champion. Brazilian fighter Charles Oliveira earned his spot through a remarkable personal resurgence, becoming one of the division's most prolific finishers. Justin Gaethje is recognized for his aggressive, crowd-pleasing approach and a series of high-stakes bouts. UFC Hall of Famer B.J. Penn rounds out the list as a foundational figure who helped establish the lightweight division's early prestige.

Webb telescope finds signs of ancient disaster for Neptune's moons

Article URL: https://www.reuters.com/science/webb-telescope-finds-signs-ancient-disaster-neptunes-moons-2026-08-03/ Comments URL: https://news.ycombinator.com/item?id=49171172 Points: 11 # Comments: 2

Security flaw in Coldcard hardware wallets leads to $130M in crypto theft

A security vulnerability discovered in Coldcard, a popular cryptocurrency hardware wallet, has been exploited by hackers to drain funds from user accounts. Blockchain monitoring firms estimate total losses from the attacks exceed $130 million. The flaw targets offline hardware wallets, devices typically considered among the most secure methods for storing cryptocurrency. The breach has raised serious concerns about the safety of hardware-based crypto storage solutions.

77% of Firms Hit by Software Supply Chain Attacks in Past Year, Omdia Finds

A Docker-sponsored Omdia survey published on August 4 found that 77 percent of organizations experienced a software supply chain security incident in the preceding twelve months. Exploits targeting known vulnerabilities in third-party software remained the leading attack type at 38 percent, while AI has emerged as the top-ranked supply chain risk, cited by 40 percent of respondents. Reported consequences included unauthorized access to applications and data (46 percent), SLA disruptions during remediation (37 percent), and theft of developer credentials or secrets (35 percent). Omdia projects that third-party code will account for 58 percent of organizational codebases within a year, up from a current majority share reported by 38 percent of respondents. Sixty-two percent of teams anticipate increased supply-chain security spending in the next budget cycle, while 45 percent do not currently rate their own supply chain security as adequate.

Ex-Deloitte Auditor Open-Sources Full SOC 2 Methodology for AI Systems

A former Deloitte auditor has publicly released a complete SOC 2 audit methodology on GitHub under the Chiaro-HQ repository. The resource is aimed at helping teams apply structured compliance frameworks to AI systems. The release was shared on Hacker News, where it received minimal early engagement. SOC 2 is a widely recognized auditing standard focused on security, availability, and data privacy controls. The open-source approach is intended to make professional audit methodology more accessible to developers and organizations building AI products.

Developer Recovers Tour Booking Site After Supabase Permanently Deleted Inactive Project

A developer built Kenya Tours, a Next.js and Supabase-powered tour booking site for the Kenyan coast, but neglected it after starting a demanding new job. Supabase's free tier pauses and eventually permanently deletes inactive projects, and the developer returned to find the project gone well beyond the 90-day restore window. Recovery required creating a brand-new Supabase project and manually rebuilding it using a downloaded pg_dump backup for the database schema and a separate zip archive for stored images. The process surfaced several technical hurdles, including Windows-generated metadata files blocking CLI migrations and the absence of a CLI command to run SQL files against a remote database. After re-uploading images, reconnecting auth providers, and resetting environment variables, the site was fully restored with tours and bookings functioning again.

Why Domain Expertise Makes You Better at Using AI Language Models

A software developer's hands-on experience with GPT-4 reveals that the quality of output from large language models is closely tied to the user's subject-matter knowledge. Vague prompts tend to produce generic or inaccurate results, while detailed, context-rich instructions yield more precise and useful responses. The author found that framing requests with technical specificity — such as describing exact component behavior in React — dramatically improved code quality. However, LLMs are not infallible; the developer encountered cases where the model produced entirely off-target outputs, underscoring the need to validate AI-generated content rigorously. The key takeaway is that LLMs work best as collaborative tools when guided by users who already possess a strong foundation in the relevant domain.

SOC Foundations Explained: Compliance, Analyst Roles, and Operational Processes

A detailed breakdown of Security Operations Center (SOC) fundamentals covers key regulations including GDPR, PCI-DSS, and HIPAA, each imposing strict monitoring and breach-reporting obligations on organizations. GDPR requires breach notification within 72 hours, with penalties of up to 20 million euros or 4% of global turnover, making rapid SOC detection and documentation essential. PCI-DSS mandates continuous monitoring of payment systems, while HIPAA requires healthcare SOC teams to track access to protected patient information and maintain thorough audit logs. SOC operations are structured around three pillars — people, process, and technology — with analysts tiered from alert triage at Level 1 to advanced threat hunting at Level 3, all guided by standardized playbooks. The material emphasizes that regulatory compliance is not merely a legal formality but is directly tied to the speed and efficiency of real-time security monitoring.

How to Block Disposable Emails in Next.js Apps Using Clerk Authentication

Developers building on Next.js with Clerk authentication face a growing threat from bad actors using disposable email addresses to create fake accounts and abuse free trials. Disposable emails allow users to bypass sign-up verification before the inbox self-destructs, leading to database bloat, skewed business metrics, and email deliverability problems. Static blocklists and client-side regex validation are insufficient defenses, as temporary email providers continuously rotate through new domains to evade detection. A technical guide published on DEV Community outlines how to intercept and block disposable emails using custom sign-up flows and asynchronous webhooks within the Next.js App Router and Clerk ecosystem. The guide argues that real-time threat intelligence at the point of registration is now essential for any SaaS or freemium application operating at scale in 2026.

Senators Warren, Blumenthal urge SEC to investigate Trump memecoin

Senators Elizabeth Warren and Richard Blumenthal have formally asked the U.S. Securities and Exchange Commission to investigate President Donald Trump's memecoin. The request raises ethical concerns about Trump's involvement in cryptocurrency while holding public office. The move has also stalled progress on the Clarity Act, a proposed piece of crypto legislation, as the ethics controversy overshadows legislative efforts. The situation highlights growing tension between crypto regulation and political accountability in Washington.

MariaDB Pull Request Proposes Promoting GitHub Star Milestone in Server Logs

A pull request has been submitted to the MariaDB server repository on GitHub proposing a new feature. The proposal suggests displaying a promotional message in server logs and client prompts to encourage users to help the project reach 10,000 GitHub stars. The request appears aimed at boosting MariaDB's visibility and community engagement on the platform. The pull request has attracted minimal traction so far, with only a few points and comments on the associated Hacker News discussion.

Developer builds LLM-based workflow to detect malware in repos before opening them

A software developer revealed that a fake recruiter sent them a malicious take-home project in May, disguised as a legitimate Next.js Web3 assignment, which contained a hidden postinstall script designed to deploy an infostealer. The developer noted that such attacks typically hide payloads in lifecycle scripts, config files, and utility functions rather than main source code, making them easy to miss during a routine clone-and-install workflow. In response, they built a triage process that uses a locally-run LLM — specifically Ollama with qwen2.5-coder on WSL2 — to statically analyze unknown repositories without executing any code. The workflow involves downloading repos as tarballs into a quarantine folder, running shell-based checks for suspicious lifecycle scripts and lockfile mismatches, and then passing flagged files through the model for deeper analysis. The developer also built a dedicated scanning tool called Argus Lens that incorporates these checks, with lockfile-versus-package.json discrepancies identified as one of its highest-signal detection methods.

'Will give fitting reply': Sunetra Pawar on Congress' 'gungi gudiya' jibe

NASA and Partners Target 2028 Cargo Lander Deliveries for Lunar South Pole Base

NASA is advancing plans to establish a permanent outpost near the Moon's South Pole intended for scientific research, technology development, and future human operations. The agency is collaborating with commercial partners including Blue Origin, Firefly Aerospace, Intuitive Machines, and Voyager Lunar Systems to build out lunar surface infrastructure. These companies are working toward delivering cargo landers to the Moon by 2028. The initiative reflects NASA's broader strategy of leveraging private sector partnerships to accelerate lunar exploration goals.

Kangana, Khushbu Back Udhayanidhi Stalin's Arrest Over Remarks About Trisha

BJP MPs Kangana Ranaut and Khushbu Sundar have publicly condemned Tamil Nadu Minister Udhayanidhi Stalin over his controversial comments referencing actress Trisha. Stalin made the remarks during a DMK protest related to a water dispute, drawing swift criticism from opposition groups. The Tamilaga Vettri Kazhagam party accused him of objectifying women and pursued legal action, leading to his arrest and subsequent bail. The incident has sparked significant political controversy across Tamil Nadu and beyond.

Russian Drone Hunts Ukrainian Civilian in Suspected War Crime Attack

A video has emerged showing a Russian drone pursuing a Ukrainian street vendor in what appears to be a deliberate targeting of a civilian. Ukrainian authorities condemned the incident, describing it as a war crime under international law. The footage shows the civilian being chased by a remotely-controlled drone in a deeply disturbing sequence of events. The incident has drawn widespread outrage and renewed scrutiny over Russian drone tactics targeting non-combatants in Ukraine.

India, US eye interim trade deal: MEA

Google Pixel 11 to Feature Multicolor LED 'HiLight' Notification System

Google's upcoming Pixel 11 smartphone will introduce a new notification feature officially called HiLight. The system uses a multicolor LED light built into the camera flash area of the device. When the phone is placed face down, the LED will illuminate to alert users of notifications. This replaces the need to flip the phone over to check for alerts, offering a discreet visual cue.

Study Examines Why AI Benchmarks Lose Usefulness as Models Improve

A new research paper published on arXiv investigates the phenomenon of benchmark saturation in artificial intelligence evaluation. The study systematically analyzes what happens when AI models score so highly on standard benchmarks that the tests can no longer meaningfully distinguish between models. Researchers explore the conditions under which benchmarks plateau and why this poses a challenge for accurately measuring AI progress. The findings highlight a growing need for more robust and evolving evaluation methods as AI capabilities continue to advance.

Developer builds lightweight Kubernetes mutating webhook 'kTailor' as Kyverno alternative

A developer created kTailor, a lightweight open-source mutating webhook for Kubernetes, after finding Kyverno too resource-heavy and complex for their team's needs. Written in Go, kTailor allows engineers to inject environment variables, initContainers, sidecar containers, and volumes into deployments without modifying individual Helm charts. The tool was originally motivated by a need to inject libfaketime into deployments for time-travel testing, a practice used in banking to verify software behavior around calendar edge cases like New Year's Day. Configuration is managed through standard Kubernetes ConfigMaps and deployment labels, requiring no custom policy language. kTailor is released under the Apache 2.0 license, with its repository on GitHub, documentation at ktailor.dev, and a free interactive demo available on Killercoda.