LinkedIn is illegally searching your computer, Google releases Gemma 4 open models under Apache 2, AMD releases Lemonade, a fast open-source local LL

LinkedIn is illegally searching your computer (1,401 HN pts, 620 comments, 0.44:1 ratio) — BrowserGate documents LinkedIn enumerating installed browser extensions without disclosure, scanning a list that grew from 461 to 6,000+ products between 2024 and February 2026. The surveillance is not just profiling: LinkedIn specifically scans for 200+ competitor products (Apollo, Lusha, ZoomInfo) — harvesting competitor customer lists from users' browsers. Data exposed includes religious beliefs, political opinions, disabilities, and employer identity. Illegal under GDPR and DMA with no disclosed legal basis. The low comment-to-point ratio is forensics, not apathy. Lobsters cross-posted simultaneously (security tag, 18 pts).

Google releases Gemma 4 open models under Apache 2.0 — first time the Gemma family has used a fully commercial-friendly license (782 HN pts, 236 comments). Four model sizes from phone-class (E2B, E4B) to workstation (26B MoE, 31B Dense); the 31B Dense ranks #3 on Arena AI text leaderboard, beating models 20x its size. Released on the same day Alibaba drops Qwen3.6-Plus (340 pts, 117 comments, 1M context window, agentic coding focus). Combined 1,122 HN pts across two open model releases — strongest single-day open-model signal since Llama 3. The Apache 2.0 shift is the under-discussed detail: it removes the last legal friction for commercial deployment of frontier-class open models.

AMD releases Lemonade, a fast open-source local LLM server using both GPU and NPU (365 HN pts, 87 comments) — AMD's first direct challenge to NVIDIA in the local inference runtime category. Lemonade is the fourth distinct inference runtime to reach HN frontpage this week: Apple MLX (M-series), Ollama v0.19 (355 Product Hunt upvotes, MLX speedup), Hypura (Apple Silicon), and now AMD Lemonade (GPU+NPU). The local AI hardware stack is no longer a monoculture. When AMD, Apple, and Qualcomm each ship dedicated inference runtimes, NVIDIA's API pricing power erodes from below.

IBM and Arm announce a strategic collaboration to 'shape the future of enterprise computing' (246 HN pts, 158 comments, 0.64:1) — the 0.64:1 comment-to-point ratio reflects genuine argument about what this means: IBM's z-series and Power architectures intersecting with Arm's server roadmap is not incremental. The x86 server monoculture fracture is not theoretical; it is now a formal partnership between two of enterprise computing's three largest incumbents. AWS Graviton, Ampere Altra, and now IBM+Arm are each building non-x86 enterprise stacks simultaneously.

Cursor 3 launches to a 0.87:1 comment-to-point ratio (103 HN pts, 90 comments) — the near-parity is explained by a concurrent Dev.to top post: 'Cursor Used Kimi K2.5 (a Chinese AI Model) Without Disclosure — Why Every Developer Should Care.' Cursor routed developer requests through an undisclosed third-party Chinese model without informing users. The Kimi K2.5 controversy and the Cursor 3 launch landing on the same day created maximum friction: enthusiasm and distrust in the same comment thread. This is the AI editor trust problem made concrete — not abstract concern about data, but a documented instance of an AI tool silently substituting models on paying customers.

OpenAI acquires TBPN (67 HN pts, 64 comments, 0.95:1 comment-to-point ratio) — the closest to 1:1 contention ratio in today's top 20, meaning nearly every point earned a separate comment. OpenAI buying a podcast/media network signals vertical integration into attention distribution. The strategic logic: if the AI frontier is set by whoever builds the most widely trusted brand for technical commentary, controlling that channel is infrastructure. The community reads it as a conflict-of-interest problem. Both readings are correct.

Git bayesect Show HN reaches 326 pts (44 comments) — up from 254 pts yesterday, still climbing. Bayesian git bisect for non-deterministic bugs: git_bayesect replaces binary search with probability-weighted Bayesian updating across flaky test histories. Cross-listed on Lobsters (debugging tag, 24 pts). The sustained multi-day trajectory for a single debugging tool is unusual; it suggests the problem (non-deterministic test failures in distributed systems) is more universal than a single viral moment. Tools that name a previously unnamed pain category keep accumulating stars.

Supply chain anxiety goes structural — Lobsters #1 is 'Every dependency you add is a supply chain attack waiting to happen' (39 pts, programming tag) on the same day LinkedIn's BrowserGate (18 pts, security tag) dominates HN. Three weeks after the Axios/TeamPCP supply chain campaign (80M weekly downloads), developer trust in external code paths is formally collapsing. The categories converging: npm packages, browser SDKs, and social network integrations are all being reclassified as threat surfaces by the same engineers who used to add them without question.