Lightpanda 1.0 is a headless browser engine released out of beta after two years and roughly 10,000 commits, designed for scale and security. Written in Zig with no graphical rendering, it runs modern JavaScript using V8 15.5.35.13 while using far less memory and CPU than Chrome. It integrates with Puppeteer, Playwright, Selenium, ChromeDP, and is available via pip/npm or a native MCP server. Conformance-wise it passes 1,739,845 Web Platform Tests subtests (about 80% of Chrome’s 2,184,491), with most remaining gaps in CSS/painting suites that Lightpanda intentionally omits. It’s already used in production by AI agents, search and indexing customers who report multi‑fold speed and cost gains.
The release makes CORS enforcement default for fetch/XMLHttpRequest and documents why that matters for headless browsers driven by unvetted agent code; Lightpanda currently passes 371/463 cors/ subtests. Recent security hardening includes opt-in resource loading, stripping Authorization on cross-origin redirects, stricter cookie handling, network filtering, and parser/protocol fixes. Several integrations (Hermes Agent, agent-browser) and customer migrations (DeveloperHub.io, Keenable) demonstrate practical performance and stability benefits. Development will continue to expand Web API coverage and WPT pass counts while preserving speed and low memory use.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Vanguard's password reset form enforces a maxlength of 20 characters, truncating longer passwords when pasted, while the login page does not have this restriction. This mismatch causes password verification failures and user confusion. (tanin.nanakorn.com)
Apple will tighten controls on Full Disk Access in macOS to prevent AI apps from accessing sensitive user data without explicit permission. This move aims to protect user privacy as AI agents become more autonomous and capable. (daringfireball.net)
The Electronic Frontier Foundation promotes Opt Out October to encourage individuals to take control of their data and devices by opting out of big tech surveillance and services. The campaign offers practical steps to reduce data collection and regain privacy from large technology companies. (eff.org)
Big Balls is managing the operations for the United States' new government network infrastructure. Concerns have been raised about potential criminal charges and security vulnerabilities associated with this management. (medium.com)
A federal judge in Oklahoma ruled that police using Flock's automated license plate reader system without a warrant violated the Fourth Amendment. The decision highlights concerns about the system's potential for indiscriminate mass surveillance, with over 100,000 warrantless searches conducted monthly. (404media.co)
ICE stored photos, license plates, and other data of protesters in a Palantir-built database called the Investigative Case Management system. Court filings reveal DHS agents used this database to track and intimidate observers during enforcement operations in Maine. (wired.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.