Today on Hacker News, the community wrestled with a question that has no clean answer: when AI can produce PhD-level mathematics in an hour and rewrite a production codebase in 6 days, what does that mean for the people who spent years building those skills? That anxiety ran alongside a separate reckoning — the internet's founding ideology of radical freedom is being critiqued from inside the culture that built it, just as regulators move to curtail the tools that make that freedom possible.

---

AI Crosses Another Threshold (And This One Feels Different)

Tim Gowers — a Fields Medal-winning mathematician — published a careful account of testing ChatGPT 5.5 Pro on open problems from additive number theory. The model produced PhD-level research in roughly an hour, with "no serious mathematical input" from him. His most striking observation: the problems he used to assign to beginning PhD students — "gentle" open problems likely to yield to sustained effort — are now solvable by AI. The traditional on-ramp into research mathematics may be closing. He raises but doesn't resolve a cultural question: if a mathematician guides an AI that does all the technical work, whose achievement is it?

Separately, Bun (a fast JavaScript runtime, an alternative to Node.js) is rewriting its codebase from Zig to Rust — and it's using Claude AI to do the work. In approximately 6 days of AI-assisted work, the new Rust branch passed 99.8% of Bun's Linux test suite. The branch is literally named `claude/phase-a-port`. Meanwhile, a third thread — sourced from Twitter with no article body, so the discussion is the substance — has developers discovering that asking Claude Code to output HTML instead of Markdown makes results dramatically more interactive and useful. HTML carries interactivity, linkable state, and inline charts; Markdown is just formatting.

The community reactions spanned the full emotional spectrum. MinimalAction, a grad student, wrote: "AI is making me feel less worthy." bustermellotron noted that Gowers himself once predicted 100 years for AI to do research math — a timeline that now looks wildly conservative. slopinthebag offered the most acidic take on Gowers: "Maybe if you find AI to be doing stuff you find impressive, the stuff you were doing wasn't that impressive?" On the Bun rewrite, aurareturn zoomed out: "It's going to be hard to compete with someone or a company that has more compute. They will just be able to do things you can't." ksec made an important counterpoint: the AI's achievement was running against Bun's comprehensive test suite — the real asset was the tests, not the code. And pulsartwin asked the uncomfortable follow-up: how confident is the Bun team in that 99.8% number if the test suite itself hasn't been audited for quality?

---

The Internet's Founding Myths, Under Dual Pressure

Mat Duggan's essay on "the intolerable hypocrisy of cyberlibertarianism" opens with genuine warmth for the internet — GPS over paper maps, streaming over cassette tapes — before pivoting to a sharp critique of the ideology that built it. He traces the roots to John Perry Barlow's 1996 "Declaration of the Independence of Cyberspace," which promised that the internet would flatten power, close inequality gaps, and produce a digital utopia. The essay's sharpest line: predicting internet freedom would build democracy is "wrong the way it would be wrong to predict that if you set your kitchen on fire, the result will be a renovation."

The real-world counterpart arrived in the form of the EU VPN story (gaining more discussion since first appearing on HN). The European Parliamentary Research Service has described VPNs as "a loophole in the legislation that needs closing," in the context of age-verification laws for adult content. VPN usage reportedly spiked in the UK after mandatory age-verification laws took effect. The paper floats requiring age verification for VPN services themselves. Notably, the EU's own age-verification app — released just last month — was found storing biometric images unencrypted and bypassable, undermining the entire premise.

On the cyberlibertarianism piece, George Hotz made the most contrarian move: "This sells me on cyberlibertarianism. There's nothing preventing you from setting up a web server, downloading free software..." — essentially arguing the infrastructure of freedom still exists for those willing to use it. randallsquared offered a darker reading: the real pattern was tech companies doing legally questionable things, scaling up, then pivoting to support government regulation that entrenched them. schoen, who was a friend of Barlow's, acknowledged the critique has merit. On the VPN thread, chii drew the obvious contrast: "How come tax loopholes aren't as scrutinized?" pveierland mapped the trajectory: "Age restrictions + VPN bans + encryption restrictions + client-side monitoring... rapid descent into digital fascism." thunderbong asked the genuinely good technical question nobody answered cleanly: why must age verification be coupled to identity verification at all? Can't a trusted third party just confirm "adult: yes" without revealing who you are?

---

Making Things by Hand (While AI Looks Over Your Shoulder)

Against the week's AI tide, 3 projects landed as quiet acts of defiance. imtomt built a functional web server from scratch in ARM64 assembly — the low-level instruction language used by Apple Silicon chips — without any standard libraries. Called ymawky, it handles static files, MIME types, custom error pages, and HTTP status codes in roughly 4,000 lines of hand-written code. The README has a fake O'Reilly book cover. It exists, by the author's admission, "to give my life (a lack of) meaning." marcingas shipped let-go, a Clojure-like language (Clojure is a modern Lisp dialect) implemented in Go that boots in 7ms and passes 95.4% of a cross-dialect compliance test suite — a legitimately useful tool for anyone who loves Lisp syntax but hates the JVM's slow startup. And a blog post on making your own programming language made the rounds again, with its honest conclusion: getting a language working is achievable in weeks; everything that makes it production-quality grows without bound.

The craft theme had an awkward guest: "Rust but Lisp," a weekend project that puts Rust's semantics in Lisp's parenthesis-heavy syntax. It was immediately suspected of being AI-generated. j3s: "Absolutely sick of reading through obviously AI-slopped READMEs." slopinthebag: "How is pure unbridled AI slop like this making the front page?" The author responded thoughtfully in the thread, but the incident shows how the handmade aesthetic is now under suspicion — you have to prove authenticity in a way you didn't before.

Also fitting this theme: Apple's distribution gauntlet. A developer building a small Go utility hit Apple's Gatekeeper system, which blocks unsigned software. The fix — paying $99/year for Apple Developer Program membership — makes no economic sense for a pay-what-you-want utility that might earn $25 total. hermitcrab, a 20-year Mac indie developer, called out Apple's "contempt for backward compatibility." LoganDark reported being permanently banned from the Developer Program after identity verification failed, with no appeal path. The community's affection for ymawky and let-go looks partly like relief that some people are still building for joy, not scale — even when the platform makes it expensive.

---

Security: The Unglamorous Work That Never Stops

Three security stories rounded out the day. cPanel — used by millions of shared hosting servers — released its 2nd emergency patch in 10 days after ransomware hit 44,000 servers via an authentication bypass. The new batch covers 3 vulnerabilities, including one allowing authenticated users to inject arbitrary Perl code through the create_user API — on shared hosting, any account is enough to attack the whole machine. The community response was "people still use cPanel?" until ramesh31 grounded it: "CPanel on shared hosting running WordPress PHP is literally half of the entire internet still." throwawaytea confirmed: "I run an entire SaaS that 36 companies pay for... and I drag and drop the files to the server via cPanel."

A privilege escalation bug in FreeBSD's execve() (the function that runs programs) turned out to be a single missing pair of parentheses in a C arithmetic expression — operator precedence gone wrong. Groxx admitted to nearly banning mixed-operator precedence in codebases entirely due to bugs like this. The researcher who found it, from Thai Duong's firm Calif, generated a working exploit using AI. And Debian formally committed to shipping reproducible packages — meaning compiled binaries can be independently verified against source code. blueflow noted this "doesn't solve supply chain issues if upstream pushes malware," but mschuster91 explained the actual threat model: reproducible builds prevent governments or attackers from forcing Debian maintainers to sign tampered binaries in secret. uecker noted he argued for this on debian-devel in 2007 and was told it was "a huge waste of time."

---

The day's deepest tension is this: the same AI that can now solve PhD math problems and rewrite production codebases in a week is also making every hand-built project suspect, every craft README a target for "slop" accusations. The internet was built by people who believed technology would liberate — and that belief is now being interrogated both philosophically and legally, just as AI changes what "building something yourself" even means.

---

TL;DR - AI is solving PhD-level math and rewriting production codebases in days, forcing a real reckoning about what expertise and human authorship mean going forward. - The EU is framing VPNs as a regulatory loophole, while a sharp essay argues the "free internet" ideology was always a lie baked into the foundation. - Hand-craft programming culture is alive — assembly web servers, Lisp dialects, DIY languages — but increasingly under suspicion of AI authorship, as Apple's $99/year toll reminds hobbyists who controls the platform. - 44,000 servers hit by ransomware via cPanel, a one-line C arithmetic bug hit FreeBSD, and Debian finally committed to reproducible builds — security is unglamorous and the debt is always due.