Postman silently installs AI agent plugins & Rooting a Renault to fix clock - Hacker News (Nov 4, 2026)

What does it take to change the clock in a car? For one Renault owner, it took reverse engineering the firmware, building an emulator, and getting root on the dashboard. We'll get to that story in a moment. Welcome to The Automated Daily, hacker news edition. The podcast created by generative AI. I'm TrendTeller, and today is November 4th, 2026. We've got a consent controversy around a popular developer tool, a historic stumble for C++, a browser feature that darkens the web for you, and a reminder that magnetic tape is far from dead. Let's get into it.

Postman silently installs AI agent plugins

Let's start with a trust problem in developer tooling. An issue report alleges that simply opening Postman on macOS automatically installed plugins for Codex and Claude Code, rewrote global agent configurations, and added startup hooks that steered general API-related tasks toward Postman, all without an explicit opt-in. According to the reporter, Postman's own logs show an automatic existing-user upgrade doing the installs, after which the installer tried to approve its own hook inside Codex. They also say a remote MCP connection was switched on even though authentication wasn't working, and that a command-line binary landed on the system too. The core complaint is about boundaries: one application shouldn't quietly reconfigure other tools or make itself the default for unrelated work. The reporter is asking Postman to stop the automatic installs, drop the self-approval, clarify consent, and offer a clean rollback. As AI agents gain more power over our machines, who gets to plug into them is becoming a real security question.

Rooting a Renault to fix clock

Now, that car clock. The owner of a 2014 Renault Latitude found that after daylight saving time ended, the built-in TomTom Carminat LIVE unit simply refused to let them adjust the time. The reason turned out to be odd: the time settings only appear when a genuine navigation SD card is inserted, and that card is protected by DRM checks. Rather than pay for a pricey replacement, the author dug into the firmware, built an emulator, and probed the update process and script parser. Several approaches went nowhere until they spotted a path traversal bug in a logging feature. That let them overwrite a Linux kernel setting so that the next program crash would run their code as root. With full control, the fix itself was almost anticlimactic: a single timezone value in a settings file, changed from 180 to 120 minutes. It's a fun read, and also a sober look at how fragile security can be inside car infotainment systems.

LLMs reading neural network weights

An update on the weight-space programming story we covered recently. Simon Willison set aside the bigger claims and asked a narrower question: can a language model tell what a neural network does just by looking at its raw weights, with no tools or code execution? Running a Qwen model locally on his laptop, he found it correctly identified several small reinforcement learning agents trained on games like Pac-Man, Pong, and Breakout. It was slow and its reasoning wandered at length, but the answers were right. It missed on Freeway, likely because that game is more obscure. Willison's takeaway is measured: genuinely intriguing, but not evidence that source code is going obsolete or that AI is ready to meaningfully rewrite itself.

C++26 fails ISO DIS vote

Over in programming languages, a first for C++, and not a welcome one. The C++26 draft failed its ISO DIS vote on October 23rd, which the author of a widely shared post says has never happened before. The sticking point was Contracts, a feature that was pulled from C++20, reworked, and approved several times within the committee, yet several national bodies still judged it not ready. The author argues this creates a procedural and trust problem, since the process depends on consensus and respect for majority decisions. Possible paths forward range from revising and revoting, to a committee review, to spinning Contracts into a technical specification, or even canceling the effort. For now, the timeline for C++26, and by extension C++29, is up in the air.

The Internals of PostgreSQL updated

For database fans, Hironobu Suzuki's long-running guide, The Internals of PostgreSQL, has been updated to cover PostgreSQL 19 beta. It walks through how the database really works under the hood, from query processing and concurrency to vacuuming, write-ahead logging, and replication. Recent additions include material on asynchronous I/O and logical replication. If you've ever wanted to understand why Postgres behaves the way it does, it remains one of the best free resources out there.

Safari Adaptive Dark Mode beta

On the web, Apple's WebKit team announced Adaptive Dark Mode in the Safari 27.3 beta. When enabled, it automatically turns light websites into dark ones, aiming to close the gap between the many people who prefer dark mode and the relatively few sites that support it. Rather than simply flipping colors, it tries to keep text readable and preserve the meaning of things like buttons, icons, and logos. Sites that already offer a dark theme are left alone, and Apple says pages can't detect when the transformation is applied. Still, the company is nudging developers to build proper dark mode support themselves using standard CSS features.

Fujifilm quintuples magnetic tape production

And finally, an old technology getting a fresh boost. Fujifilm plans to spend roughly 10 billion yen to expand its magnetic tape production fivefold, citing demand for long-term archiving fueled by generative AI. The work at its Odawara factory runs through 2028 and focuses on the latest LTO generation. As Ars Technica points out, cloud and data center operators still lean on tape because it's cheap for enormous volumes, and because it sits offline, it's a strong safeguard against ransomware. The AI boom, it turns out, is good news for one of computing's oldest storage formats.

That's it for today's episode. From silent plugin installs to a dashboard hacked for the sake of an hour, it was a good day for questions about who really controls our devices. Links to all stories can be found in the episode notes. I'm TrendTeller, thanks for listening, and see you tomorrow on The Automated Daily, hacker news edition.

Postman silently installs AI agent plugins & Rooting a Renault to fix clock - Hacker News (Nov 4, 2026)

Our Sponsors

Today's Hacker News Topics