Article URL: https://www.nats.aero/news/nats-publishes-preliminary-report-on-technical-incident-of-8-september/ Comments URL: https://news.ycombinator.com/item?id=49754064 Points: 8 # Comments: 1
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
A developer building an LLM-powered recipe app found that JSON.parse fails on every incomplete token during streaming, since valid JSON only exists once the final closing bracket arrives. To solve this without discarding streaming benefits or relying on fragile regex hacks, they built a minimal open-source library called SoFar. The library exposes two functions — parsePartialJSON and createJSONStream — that return the best structurally complete value available from any partial JSON buffer without throwing errors or guessing incomplete values. It works by scanning the buffer once, tracking open containers and string state, and identifying safe cut points where valid JSON can be reconstructed by appending the necessary closing brackets. At 425 bytes gzipped and zero dependencies, it is designed as a thin complement to the native JSON.parse rather than a replacement.
Companies using AI inference services are facing significant billing surprises due to hidden reasoning tokens that are charged as output but not visible during usage. A 2025 study found that these concealed tokens can account for over 90% of total token spend on complex tasks, with a seemingly simple response potentially hiding more than 10,000 reasoning tokens. The problem is expected to grow as Goldman Sachs projects global token usage to reach 120 quadrillion per month by 2030, a 24-fold increase. In response, the Linux Foundation has proposed a Tokenomics Foundation to establish open, vendor-neutral token measurement standards, while providers like Groq and Cerebras have moved toward flat per-token pricing models. Developers are increasingly demanding greater transparency in token accounting as AI costs shift from minor line items to significant operational expenses.
A security audit of Aave V3, the decentralized lending protocol with approximately $17.7 billion in total value locked, identified 11 vulnerabilities across reentrancy and access-control domains, with three rated Critical. The review, dated September 2026, found improperly guarded external calls in flash-loan and collateral-withdrawal paths, as well as overly broad admin role assignments in the upgrade proxy. Auditors warned that a successful reentrancy exploit on the flash-loan entry point could theoretically allow an attacker to drain up to $1.2 billion before liquidation mechanisms respond. None of the vulnerabilities are currently exploitable on the live mainnet, as existing safeguards such as reentrancy guards and multi-signature governance provide interim protection. However, the audit stresses that any future upgrade or misconfiguration removing those defenses could expose the protocol to significant risk, making prompt remediation essential.
A developer investigating sideways video recordings on iPhone discovered that the iOS camera temporarily reports incorrect landscape dimensions for roughly 100–150 milliseconds after a track is created, before correcting itself to portrait. This narrow window explains why the bug went undetected: tests that wait for a preview to load before reading track dimensions always land outside the faulty window and pass cleanly. The developer confirmed the timing across multiple runs, observing the flip from 1920x1080 to 1080x1920 occurring between roughly 100 and 150 milliseconds after track creation. The finding has broader implications beyond iOS, highlighting that any value which eventually corrects itself can silently fool well-written tests that wait for things to settle. The developer also found that most major webcam libraries, including react-webcam and react-media-recorder, are largely inactive, with LiveKit being the only one showing consistent recent human contributions.
Discussion (0)
Log in to join the discussion and vote.
Log in