OpenArcanum is an open-source, decentralized chat system intended to offer Discord-style communities without user accounts or a single company controlling the service. Users create a cryptographic key on their device and use it to join communities; by default, each community gets a separate key, limiting the ability to link someone’s activity across communities. The feature set includes text channels, roles, permissions, moderation, direct messages, and voice and video calls with screen sharing. Direct messages are end-to-end encrypted, while community messages are encrypted on the community server’s disk.
The design separates community servers, relays, and maintainer nodes. A server manages one community and connects outward to relays, so it does not need an open port; relays forward encrypted messages and call media but do not store them. Maintainer nodes provide community and relay directories and hold encrypted messages for recipients who are offline. Users can try the browser version or install desktop apps for Linux, Windows, and macOS, and a community owner can host a server on a home machine or VPS. The repository includes extensive deployment, user, security, and architecture documentation, plus automated tests and build instructions. It is licensed under AGPL-3.0, and running the full system locally requires development tools and setup rather than simply launching a finished hosted service.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A Linux kernel use-after-free vulnerability, CVE-2026-98432, can enable remote code execution, and Go 1.24 enables MPTCP by default on Linux, exposing listeners to the demonstrated exploit. Upgrade to a patched kernel; disabling MPTCP in Go is only a fragile mitigation. (groups.google.com)
Scribd disclosed a security incident in which an unauthorized party may have accessed users’ email addresses, partial payment card details, country, issuer, expiry date, and payment history. The company says it secured the affected system, notified authorities, and advises users to watch for phishing. (news.ycombinator.com)
Flock camera searches in Highland Heights fell 95% after a dispatcher was caught misusing the system. The sharp drop followed the discovery of the misconduct. (wkyc.com)
AT Protocol apps can store user data publicly on personal data servers, where it is easy to search and retrieve. Skyreader subscriptions exposed more than 1,300 RSS feeds, including private and paywalled feeds, while other apps also publish messages openly. (melaniekat.com)
At least nine AI developer platforms disclosed breaches in October, with attackers targeting stored credentials and environment variables that grant access to AI services. The incidents point to coordinated agent-driven attacks fueled by the resale of stolen AI access, though investigations are still ongoing. (wiz.io)
The CVE-2026-112816 page requires JavaScript to display properly. The supplied content gives no details about the vulnerability. (cve.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.