{"list":"front","lang":"en","page":1,"has_more":true,"next":"https://startupxo.com/api/v1/front.json?lang=en&page=2","html":"https://startupxo.com/en/","markdown":"https://startupxo.com/en/index.md","items":[{"id":1212,"kind":"story","title":"How XSS attacks slip malicious scripts into user input, and basic defenses","url":"https://qiita.com/Pigeon_gate/items/3ce4e1c1a39db64c5c32?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items","host":"qiita.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-30T18:25:57.381Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["XSS is an attack that runs malicious scripts made by an attacker in other users' browsers. A script is a small program that makes a web page move. The source explains that just opening a malicious link or viewing a compromised page can make it run with the site's permissions.","The source divides XSS into reflected, stored, and DOM-based types. Reflected and stored XSS happen when the server builds dangerous HTML and sends it back. DOM-based XSS happens when the server sends only normal HTML and the browser's script inserts a URL value into the page, so server-side escaping is hard to rely on to block it.","The basic defense is to insert user input with textContent instead of innerHTML, so it is displayed only as text. The source also introduces Sanitizer APIs such as setHTML(). Citing web.dev material, it says Firefox supports them from 148 (2026 February), Chrome and Edge from 146, and Safari does not support them.","HttpOnly cookies stop scripts from reading cookies, which reduces the risk of session information theft. However, they do not stop script execution itself. CSP restricts execution of scripts that are not allowed, but the source says it has trade-offs: setting up external service integrations is troublesome and pages can easily break."],"discussion":"https://startupxo.com/en/1212/","markdown":"https://startupxo.com/en/1212.md","api":"https://startupxo.com/api/v1/item.json?id=1212&lang=en"},{"id":1211,"kind":"story","title":"Waymo to supply robotaxis based on Toyota electric vehicle bZ4X in Japan and the UK","url":"https://techcrunch.com/2026/10/30/waymos-next-robotaxi-will-be-a-toyota-bz4x-destined-for-japan-and-the-uk/","host":"techcrunch.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-30T12:34:23.996Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Toyota plans to produce the electric vehicle bZ4X 2027 model year, equipped with Waymo's autonomous driving system, at its Takaoka plant in Japan. Waymo plans to start test operations in Japan next year with this vehicle. The source adds that this vehicle is called BZ in North America.","Waymo has been testing Jaguar I-Pace self-driving cars in London, UK for several months and plans to start a robotaxi service once it receives the necessary permits. The source says Waymo also intends to deploy bZ4X in the UK and other right-hand-drive countries.","The two companies agreed to review a plan to apply Waymo's autonomous driving technology to privately owned Toyota vehicles, and a road safety project using Waymo's real operating data. The source says the specific details of the safety project are unclear."],"discussion":"https://startupxo.com/en/1211/","markdown":"https://startupxo.com/en/1211.md","api":"https://startupxo.com/api/v1/item.json?id=1211&lang=en"},{"id":1210,"kind":"story","title":"Can People Be Exempted from Using AI at Work on Religious Grounds? A Non-Religious Humanist Case","url":"https://techcrunch.com/2026/10/29/you-dont-need-to-believe-in-a-god-to-get-a-religious-exemption-from-using-ai-at-work/","host":"techcrunch.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-30T06:37:27.185Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["David Dermen, an administrative staff member at the University of Kentucky, is a humanist who does not believe in God, but he said he received a religious accommodation (a work adjustment based on religious belief) that allowed him not to use AI at work. The university explained that it reviewed each request individually.","Dermen argued that AI threatens livelihoods, increases environmental burdens, and takes away human creative work. This is his claim, and the article has not confirmed it as fact.","A lawyer for the American Humanist Association (AHA) said that concerns about AI and human dignity can arise from many traditions, including Catholicism, Universalism, and humanism, and that people who do not believe in God also receive legal protection at work. A university spokesperson said the accommodation was provided on the condition that the employee continues to perform the core functions of the job."],"discussion":"https://startupxo.com/en/1210/","markdown":"https://startupxo.com/en/1210.md","api":"https://startupxo.com/api/v1/item.json?id=1210&lang=en"},{"id":1209,"kind":"story","title":"Impeccable, a skill that reduces AI design taste, compared across 4 ways with the same request","url":"https://qiita.com/jinxin4869/items/0e72c0b925b75f1c28c9?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items","host":"qiita.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-30T00:50:25.381Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Impeccable is a publicly available AI design assistant skill in the pbakaus/impeccable repository on GitHub. According to the original article, when installed in an AI tool such as Claude Code, it first asks for product information and sets a work order, which keeps the AI from falling back to a common average design.","The author made the same landing page request in four ways. The number of automated check findings was 5 to 8 items, so the difference was small. On the author's judgment of whether the design still works after changing the product name, only the method that asked for product information first and then built the page was hard to reuse for other products.","Run times were about 5 minutes for default Claude Code, about 15 minutes for the method that had existing results critiqued and revised, and about 20 minutes for the method that built from scratch with Impeccable. The author recorded these with a script in a Windows and WSL 2 environment with Claude Code v2.1.287, so these figures are values measured in that environment."],"discussion":"https://startupxo.com/en/1209/","markdown":"https://startupxo.com/en/1209.md","api":"https://startupxo.com/api/v1/item.json?id=1209&lang=en"},{"id":1208,"kind":"story","title":"Why are passkeys strong against fake sites? A summary of registration and login flows","url":"https://qiita.com/kuma_3838/items/1781531150821e2f0491?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items","host":"qiita.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-29T12:34:48.025Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["A passkey is a login method that verifies you with a key stored on a device such as your phone or PC instead of a password. The original article explains that the browser mechanically compares the site address, and if it does not match, it does not show the key as a candidate, so login does not happen on a fake site.","The server stores only the public key, and the private key never leaves the device. The original article stresses that fingerprint or face data is also not sent to the server and is verified on the device.","The original article cites the Passkey Index released by the FIDO Alliance in 2025 October, saying that in a survey of 9 companies, the login success rate was 93% for passkeys and 63% for other methods, and the login time over 1 logins was 8.5 seconds versus 31.2 seconds. These figures were compiled by the FIDO Alliance and the research firm Liminal from numbers reported by participating companies.","The weakness of passkeys is the account recovery process. If attackers exploit the recovery path, the strength of passkeys can be reduced, so the original article introduces measures such as registering two or more passkeys and sending an alert to the account owner during recovery."],"discussion":"https://startupxo.com/en/1208/","markdown":"https://startupxo.com/en/1208.md","api":"https://startupxo.com/api/v1/item.json?id=1208&lang=en"},{"id":1207,"kind":"story","title":"Case study: Evaluating Japanese product search results with OpenSearch's LLM scoring feature and comparing them with human labels","url":"https://zenn.dev/nextbeat/articles/c22b45b1d784b0","host":"zenn.dev","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-29T06:36:48.101Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["The author tested a Japanese product search by configuring OpenSearch's feature that scores how well search results match the query so that an LLM, instead of humans, does the scoring. The author calls this approach LLM_JUDGMENT.","The experiment used the Japanese portion of the Amazon product search dataset (ESCI). LLM scores were compared with human labels: E (exact match), S (substitute), C (complement), and I (irrelevant). The model was Gemini 3.5 Flash-Lite, and the environment was OpenSearch 3.9.0.","For the search 'speaker without power', a wooden unpowered speaker was scored 1.0, and USB-powered speakers were scored 0.2~0.3. A liquid formula milk was scored 1.0, the same as the human label E, but for the speaker cable, where the human label was E, the LLM gave 0.1.","The author attributed the gap to the LLM interpreting USB-powered and rechargeable speakers as 'has power', and noted that the cable case might also reflect variation in the human labels. Because this was an experiment with a few queries run by the author, it cannot be taken as a result that guarantees overall accuracy."],"discussion":"https://startupxo.com/en/1207/","markdown":"https://startupxo.com/en/1207.md","api":"https://startupxo.com/api/v1/item.json?id=1207&lang=en"},{"id":1206,"kind":"story","title":"Instagram Starts Requiring AI Accounts to Disclose AI Use, Mosseri Expects Backlash to Grow","url":"https://www.theverge.com/ai-artificial-intelligence/1021644/adam-mosseri-instagram-ai-negativity","host":"theverge.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-29T00:49:22.151Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Instagram head Adam Mosseri said in a podcast interview that anxiety and anger about AI are growing, especially in creative industries, and will likely grow further over the next few years. This is Mosseri's personal outlook.","Instagram said it has begun requiring AI accounts to label themselves. According to the source, it launched an AI account label feature earlier this year, and cracked down on AI-generated profiles in August.","Mosseri claimed Instagram does not rank AI creators differently. However, he said it is not certain whether AI content is rated as well as regular content.","AI content such as deepfakes that deceive celebrities remains a problem. Mosseri said that a full ban on AI content on platforms is not realistic."],"discussion":"https://startupxo.com/en/1206/","markdown":"https://startupxo.com/en/1206.md","api":"https://startupxo.com/api/v1/item.json?id=1206&lang=en"},{"id":1205,"kind":"story","title":"MacBook Pro with a touchscreen goes on sale November 6","url":"https://techcrunch.com/2026/10/28/apple-launches-its-new-touchscreen-macbook-pro/","host":"techcrunch.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-28T18:29:40.299Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["A MacBook Pro whose screen you can press and control directly with your fingers has been released. The source reports that about 10 years after Apple added and then removed the Touch Bar, this is the product that fully supports touch input on a laptop screen.","The 14-inch model starts at 2,899 dollars, and the 16-inch model starts at 3,399 dollars. According to the source, pre-orders open October 30, and sales start November 6.","The chip can be M5 Pro or M5 Max. According to the source, memory goes up to 128GB, storage up to 16TB, and maximum display brightness is 2000 nits (HDR and SDR).","The source says Apple's designed hinge steadies the body when the screen is touched and also reduces camera shake during video calls. This is Apple's design explanation as relayed by the source and has not been independently verified."],"discussion":"https://startupxo.com/en/1205/","markdown":"https://startupxo.com/en/1205.md","api":"https://startupxo.com/api/v1/item.json?id=1205&lang=en"},{"id":1204,"kind":"story","title":"Review of taking the official Claude certification 4 exam, and notes on the Japanese exam and the December content revision","url":"https://qiita.com/minorun365/items/59783841e48f5467594f?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items","host":"qiita.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-28T06:37:24.366Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["The Claude certification run by Anthropic is open to staff of companies that have joined the Claude Partner Network (a group of companies that work with Anthropic). According to the source, the exam became available in Japanese from the middle of October.","The author sat 4 exams over 2 weeks and passed 3 of them. The author wrote that CCDV-F and CCAR-P were scored at 90% or higher, while CCAR-F scored 702 points, which was 18 points short of the passing score of 720.","The source cites Pearson VUE guidance saying that the content of CCAO-F, CCDV-F, and CCAR-P changes from December 7. The author recommended taking the exam in November, before this revision, to feel more secure.","Official materials are mostly videos and web content and are hard to read through, so the author had Claude organize the study material, created a 4-choice practice question set, and solved it on a smartphone. The author wrote that CCAR-P was passed after solving this question set 1 times."],"discussion":"https://startupxo.com/en/1204/","markdown":"https://startupxo.com/en/1204.md","api":"https://startupxo.com/api/v1/item.json?id=1204&lang=en"},{"id":1203,"kind":"story","title":"Google DeepMind's world model Genie 4 opens first to trusted testers as a real-time simulation that changes scenes with words","url":"https://deepmind.google/blog/genie-4-a-new-generation-of-world-simulation/","host":"deepmind.google","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-28T00:50:02.932Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Genie 4 is a world model that creates a virtual world from a text description of a scene, which users can explore by moving through it with a keyboard. The source says instructions to change the weather or add people and objects are also reflected in real time.","According to the source, Genie 4 generates sound together with video, including ambient sounds, music, and character dialogue. The company said this is the first time a real-time world model has generated sound directly.","The source says Gemini 3.8 Flash watches the generation process, divides goals into several steps, and checks whether each step succeeded. This is the design explanation offered by Google, and the source does not include external verification results.","The release starts as a research preview for trusted testers. Google AI Ultra subscribers will first have access through Project Genie, and early partners will have access through the Gemini API and Google AI Studio. The source does not specify when general release will happen."],"discussion":"https://startupxo.com/en/1203/","markdown":"https://startupxo.com/en/1203.md","api":"https://startupxo.com/api/v1/item.json?id=1203&lang=en"},{"id":1202,"kind":"story","title":"Recording Claude Code session notes makes design reasons and work history easier to find later","url":"https://qiita.com/qwertyhoge/items/987c0ea8afdb5cd045e8?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items","host":"qiita.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-27T18:28:54.805Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Developer @qwertyhoge introduces a self-made work instruction file (skill) that they call with the /decision-log command when a Claude Code task ends. It selects technical choices, alternatives not adopted and their reasons, parts where AI suggestions were corrected, whether self-review was done before the PR, and whether code license and confidential information were checked, then appends them to a monthly record file.","When there is an important choice, they also write an ADR (Architecture Decision Record, a document that records the background and alternatives of a design decision). According to the original, over about 1 months they left 5 work records and 10 ADRs.","The author explains that AI tends to interpret its own work favorably, so they added an instruction not to write about things that were not done. They wrote that across several tests with the Opus 5.5 model they did not see cases of it writing about things that did not happen, but this is the author's personal observation.","Looking at the records, the author found they had rarely done self-review before PRs. They therefore created a separate skill and hook that enforce review, so a PR cannot be created without going through review."],"discussion":"https://startupxo.com/en/1202/","markdown":"https://startupxo.com/en/1202.md","api":"https://startupxo.com/api/v1/item.json?id=1202&lang=en"},{"id":1201,"kind":"story","title":"Google Workspace Weekly News: Sheets Box Plot and Mobile Voice Document Creation Added","url":"https://workspaceupdates.googleblog.com/2026/10/weekly-recap-10-23-2026.html","host":"workspaceupdates.googleblog.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-27T15:15:51.646Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Google Sheets now includes a box plot chart as a standard feature, showing how numbers are spread out. When you select a range of numbers, it calculates and displays the minimum, median, maximum, and outliers without a separate formula.","Docs Live in the Google Docs mobile app (Android, iOS) is a feature that creates structured documents through conversational speech. According to the original text, it will roll out in stages to eligible Workspace users.","Real-time speech translation in Google Meet has been expanded to support 63 languages along with automatic language detection. The original text says it is available on web and mobile (Android, iOS), and that on Meet-dedicated devices it is listen-only.","Google Vault can now export Gemini conversations from Workspace filtered by conditions. Admins can target conversations from Gmail, Drive, Docs, Sheets, Slides, Meet, and others, and the original text says Vault's security and privacy controls apply as they are."],"discussion":"https://startupxo.com/en/1201/","markdown":"https://startupxo.com/en/1201.md","api":"https://startupxo.com/api/v1/item.json?id=1201&lang=en"},{"id":1113,"kind":"show","title":"Show XO: Clumsy Thief - A stealth puzzle game where stolen loot gets in your way","url":"https://play.google.com/store/apps/details?id=net.mrlatte.clumsythief&hl=en","host":"play.google.com","by":"mrlatte","score":1,"comments":0,"editorial_comments":0,"time":"2026-10-18T23:56:26.771Z","origin":"community","language":{"source":"en","reading":"en","translated":false},"summary":null,"discussion":"https://startupxo.com/en/1113/","markdown":"https://startupxo.com/en/1113.md","api":"https://startupxo.com/api/v1/item.json?id=1113&lang=en"},{"id":1200,"kind":"story","title":"Autonomous kit that attaches to existing excavators expands to real construction sites","url":"https://techcrunch.com/2026/10/26/this-startups-self-driving-excavators-help-dig-up-600m-in-new-funding/","host":"techcrunch.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-26T18:48:19.440Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Bedrock Robotics makes an autonomous driving kit that attaches to existing equipment such as excavators at construction sites. According to the source, the kit can be installed on construction vehicles and other work vehicles through retrofitting.","According to the company, its autonomous excavators are in commercial operation at a Nevada water treatment facility, a Texas civil site, and 1.2 million cubic-yard-scale civil works. This is based on the company's announcement, and the source does not include data on work performance verified by a 3 party.","The company claims it takes more than 5 years to become skilled at operating an excavator. The source cites an estimate from the American trade group Associated Builders and Contractors that 40% or more of construction workers will retire within 5 years.","This Series C round (a funding round at the growth stage) is $600 million in size, and the company valuation was reported as $4.1 billion. The company said it plans to use the funds to deploy its kit at more sites and to expand the staff and infrastructure that support customers."],"discussion":"https://startupxo.com/en/1200/","markdown":"https://startupxo.com/en/1200.md","api":"https://startupxo.com/api/v1/item.json?id=1200&lang=en"},{"id":1199,"kind":"story","title":"An instruction file that first explains AI-written technical text in plain words, then shortens it","url":"https://zenn.dev/microsoft/articles/explain-before-shorten","host":"zenn.dev","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-26T14:10:20.721Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["A personal opinion post by Kazuki Ota, a Microsoft employee in Japan, published on Zenn in the 'Microsoft (有志)' publication. It covers the problem where AI-written technical explanations start with a negation such as '0건이라는 뜻은 아니다', which blurs the key point.","The author's method is to first decide in one sentence what the explanation should convey, explain it in plain words as if speaking to a colleague, and then shorten it while keeping the meaning. The author says this procedure was organized into an AI instruction file called SKILL.md.","As an example, 'separate acceptance and completion checks' is changed to 'notify acceptance first without waiting for processing to finish, and look up the result later'. The focus is on keeping the meaning intact when the wording is shortened.","The source contains no data measuring or comparing the effect of this method. The author subjectively evaluated the results as fairly good."],"discussion":"https://startupxo.com/en/1199/","markdown":"https://startupxo.com/en/1199.md","api":"https://startupxo.com/api/v1/item.json?id=1199&lang=en"},{"id":1198,"kind":"story","title":"Node.js Brotli decompression issue that treated malformed input as insufficient input, and the fix","url":"https://zenn.dev/chot/articles/79e6c94e27782d","host":"zenn.dev","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-26T07:02:25.350Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Node.js uses a built-in decoder when it decompresses Brotli-compressed data. When this decoder received malformed input, it could write outside its internal buffer. The issue was fixed on October 21, 2026 in a Node.js security release as CVE-2026-111497. The impact description (crash, memory exposure, possible remote code execution) is quoted from the Node.js vulnerability advisory.","The cause was that an error in a block switch (an instruction to change the compression table used for the next section) was handled as a return value such as 'more input needed'. According to the quoted advisory, this caused the malformed data to be treated as a temporary state, and input kept accumulating in the internal buffer.","On the unsafe execution path, where enough input was available, the same error was not passed to the caller and was ignored. The fix changed the return type to an error code enum and added the new error code BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, so both paths now stop processing immediately when an error occurs.","The core of the fix is bringing the upstream google/brotli commit into Node.js. This article is an explanation written after reading the fix commit. The attack path and the actual scope of harm are not covered in the original text."],"discussion":"https://startupxo.com/en/1198/","markdown":"https://startupxo.com/en/1198.md","api":"https://startupxo.com/api/v1/item.json?id=1198&lang=en"},{"id":1197,"kind":"story","title":"iFixit's teardown of the iPhone Duo: how the foldable screen hides creases and how hard it is to repair","url":"https://www.theverge.com/tech/1018233/ifixit-iphone-duo-teardown-repairability-hinge","host":"theverge.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-26T01:05:51.792Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["After taking apart the iPhone Duo, iFixit gave it a repairability score of 5 out of a possible 10. According to the source, this is the highest score the site has given to a foldable phone.","The matte nano-texture cover on the inner screen makes the display easier to read in bright sunlight and scatters reflections so the creases are less visible. iFixit estimated that the oval subpixel layout seen under a microscope is also designed to reduce creases.","The source explains that repairing the screen itself is expensive and difficult. The outer nano-texture layer can be replaced relatively easily without changing the OLED underneath.","On reports of broken screens and cracked hinges, iFixit offered a hypothesis: the hinge sometimes does not fully close, and the accordion cable running near the edge of the battery may concentrate pressure at that spot. Apple did not immediately respond to a request for comment."],"discussion":"https://startupxo.com/en/1197/","markdown":"https://startupxo.com/en/1197.md","api":"https://startupxo.com/api/v1/item.json?id=1197&lang=en"},{"id":1196,"kind":"story","title":"Feature guide: Using Copilot in OneDrive to gather multiple tables and notes into a report","url":"https://note.com/kaiyu06/n/n724f34b96950?hl=en","host":"note.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-25T18:33:42.408Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Microsoft announced the general availability of Copilot in OneDrive and SharePoint. Copilot is the name of an AI feature offered by Microsoft.","The use cases presented were analysis of multiple tables, folder organization, and conversational report writing based on existing material. An example of saving a repetitive process as a personal skill was also presented.","The announcement includes features that will be rolled out in sequence over the coming months. The source states that not all of the introduced features are provided at once, and that the actual reduction in work time was not measured."],"discussion":"https://startupxo.com/en/1196/","markdown":"https://startupxo.com/en/1196.md","api":"https://startupxo.com/api/v1/item.json?id=1196&lang=en"},{"id":1195,"kind":"story","title":"Weak intermediate CA key at India's certificate authority eMudhra and its impact on HTTPS trust","url":"https://blog.jxck.io/entries/2026-10-25/emudhra.html","host":"blog.jxck.io","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-25T06:44:20.308Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["A certificate authority (CA) is a top-level organization that browsers and devices trust by default. It is the starting point for checking whether a website's HTTPS certificate is genuine, so if this organization's private key is exposed, fake certificates that look normal can be created.","According to the source, eMudhra created a very weak intermediate CA key because of a bug in its key generation script, and this key was wrongly adopted for actual operation. The source says the top 47 bytes were 0, making it effectively a key at the level of 1 bytes. This point cites analyst Scott Helme's post.","The author interprets that with a key this weak, an attacker could recover the signing key and create forged certificates, which could be used in man-in-the-middle attacks such as on public Wi-Fi. The source does not confirm any actual case of exploitation.","eMudhra said it revoked the related CA within 14 hours of discovery, that no final certificates were issued, and that no data was leaked. It later announced it would exit the global TLS certificate business, and the author criticizes this response for lacking an acknowledgment of responsibility."],"discussion":"https://startupxo.com/en/1195/","markdown":"https://startupxo.com/en/1195.md","api":"https://startupxo.com/api/v1/item.json?id=1195&lang=en"},{"id":1194,"kind":"story","title":"How to Ask AI to Change Technical Diagrams by Art Style and Animate Them as GIFs","url":"https://qiita.com/kikuziro/items/b6a0743b070d7320c36d?utm_source=dlvr.it&utm_medium=facebook","host":"qiita.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-25T01:07:09.963Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["The writer of the Qiita post, a Japanese developer tech blog platform, wrote that as more text appears to be written by generative AI, good articles are also being ignored. So they chose to insert several diagrams between paragraphs, and the original does not give figures showing whether this increased views or likes.","The writer explains that SVG is a vector image file that describes pictures in text, so generative AI can draw it directly from text instructions alone. The AWS Lambda explanation also presents one prompt where only the art style changes, such as a red pen teacher, technical drawing, magazine page, or comic.","The animated GIF is presented as a prompt that passes the previously made SVG diagram back in, asking for an animation where requests flow along arrows and boxes glow, looping every 6 seconds. It adds conditions to keep text still so it can be read, and to repeat seamlessly without a break."],"discussion":"https://startupxo.com/en/1194/","markdown":"https://startupxo.com/en/1194.md","api":"https://startupxo.com/api/v1/item.json?id=1194&lang=en"},{"id":1193,"kind":"story","title":"Using a mask in PyTorch attention inference spiked GPU memory; the author reduced it by changing the fallback path","url":"https://zenn.dev/genelab_999/articles/387bf151caf716","host":"zenn.dev","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-24T12:37:57.526Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["The model Xiaomi-Lens-0, which creates masks marking image regions, switches to the MultiheadAttention path when flash-attn is not installed. When a mask was passed, that path created a matrix sized as 16 heads × the square of the patch count.","According to the author's measurements, for a 3-megapixel image the extra VRAM peak in the mask step was 18.02GB on the original path and 2.28GB on the SDPA path. The test environment was RTX 5090 32GB, Windows 11, with flash-attn not installed.","The PyTorch documentation says an optimized path is used when need_weights=False. However, when the author read the CUDA source, the path was not entered when a mask was present. In CPU profiling, the same layer in training mode used SDPA, so the issue reproduced only in eval inference.","The author reported that across a comparison of 6 samples, tokens and boxes matched, and mask IoU ranged from 0.9976 to 0.9998. This is a limited comparison, not a full quality evaluation."],"discussion":"https://startupxo.com/en/1193/","markdown":"https://startupxo.com/en/1193.md","api":"https://startupxo.com/api/v1/item.json?id=1193&lang=en"},{"id":1192,"kind":"story","title":"When Work Split Stalls, a One-Page Responsibility Map Turned Cross-Team Talks into Revision Work","url":"https://zenn.dev/shun0530/articles/32946ce85a536d","host":"zenn.dev","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-24T06:44:10.849Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["In an external service integration feature, one team owned requirements definition and the neighboring team owned implementation. The author explains that no one was positioned to judge whether the requirements were feasible and how much effort they would take, so work kept going back and forth between the two teams.","The author says that abstract requests to change how work is divided between teams always ended with the claim that it was practically difficult. In response, they created a one-page responsibility boundary map showing the owner of each stage and brought it to a meeting.","In the diagram, engineers gather materials for preliminary research and pass them to a product manager (PdM, the role that sets a feature's direction and priorities). The PdM decides the requirements definition, and engineers take charge of design. The author states that after this diagram was used, the meeting shifted to concrete revision discussion. The source does not state that the effect was measured numerically.","Two objections came up in the meeting. One was that the receiving team had no spare staff. The other was that the knowledge needed for research and requirements remained with the former team. The author says they handled these separately from the discussion about responsibility division."],"discussion":"https://startupxo.com/en/1192/","markdown":"https://startupxo.com/en/1192.md","api":"https://startupxo.com/api/v1/item.json?id=1192&lang=en"},{"id":919,"kind":"story","title":"Security research says earlier Telegram Desktop 7.2.9 versions could let files leave a PC with one link click","url":"https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/","host":"beaksec.github.io","by":"startupxo","score":1,"comments":1,"editorial_comments":1,"time":"2026-10-10T06:45:33.740Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["According to the presenter, earlier versions of Telegram Desktop 7.2.9 could read files stored on a PC and send them to an attacker's chat with a single link click.","The source describes two flaws: a failure to filter the semicolon character that separates commands when a link is passed to an already running Telegram, and an internal function that reads files without permission checks. The presenter said they confirmed this on the Windows 6.9.3 build.","The presenter claims this path could be used to extract login session files and take over accounts. The risk was presented as 8.1(High) under CVSS. This is a claim based on the presenter's proof of concept.","According to the source, the 7.2.9 version removed the path and added a fix that escapes the separator, with fix commit db3405699f. The source notes that no official security advisory accompanied this fix."],"discussion":"https://startupxo.com/en/919/","markdown":"https://startupxo.com/en/919.md","api":"https://startupxo.com/api/v1/item.json?id=919&lang=en"},{"id":1191,"kind":"story","title":"Apple Opens AI Assistant Beta in iWork Apps, Available Only to Creator Studio Subscribers","url":"https://www.cultofmac.com/news/iwork-intelligent-assistant-pages-keynote-numbers","host":"cultofmac.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-24T00:59:51.917Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["An AI assistant beta is now open in Pages, Keynote, and Numbers to help with document drafts, slides, and table work. According to the source, only Apple Creator Studio subscribers can use it, while the three apps themselves are free.","The source says that in Pages, users can draft text, adjust tone, generate images and shapes, and search for recent information before inserting it into a document. Keynote helps with slide creation, presenter notes, and animations, and Numbers helps with chart suggestions, formula writing, and table generation.","The subscription costs 12.99 dollars per month or 129 dollars per year, and new subscribers get a 1-month free trial. The subscription also includes Final Cut Pro, Logic Pro, and Pixelmator Pro.","Right after the update, the three apps briefly disappeared from the iOS and Mac App Stores. The source says it is still unclear whether the removal was intentional or a bug."],"discussion":"https://startupxo.com/en/1191/","markdown":"https://startupxo.com/en/1191.md","api":"https://startupxo.com/api/v1/item.json?id=1191&lang=en"},{"id":1190,"kind":"story","title":"Mahanine raises $34 million for AI CAD that automatically turns scan data into civil engineering drawings","url":"https://wowtale.net/2026/10/24/266883/?utm_source=rss&utm_medium=rss&utm_campaign=ai-cad%25eb%25a1%259c-%25ed%2586%25a0%25eb%25aa%25a9%25ec%2584%25a4%25ea%25b3%2584-%25ec%259e%2590%25eb%258f%2599%25ed%2599%2594-%25eb%25a7%2588%25ed%2595%2598%25eb%2582%2598%25ec%259d%25b8-3400%25eb%25a7%258c-%25eb%258b%25ac%25eb%259f%25ac-%25ec%258b%259c%25eb%25a6%25ac%25ec%25a6%2588a-%25ed%2588%25ac%25ec%259e%2590","host":"wowtale.net","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-23T18:38:00.681Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Mahanine is civil-engineering-specific software. Survey teams scan roads, pipes, and construction sites with equipment and upload 3-dimensional data. The software automatically moves elements such as curbs, signs, utility poles, lane markings, and power lines onto drawings. Users review the results, make corrections, and then finalize them.","The company says this method is up to 10 times faster than existing manual work, its cost is about 1 out of 5, and it produces centimeter-level accuracy. This is the company's own claim and not an independently verified figure.","The product is currently in a private beta, and about 100 customers have used it on more than 2,500 projects. Customers include civil engineering firms such as WSP, HNTB, and NV5, as well as transportation agencies such as Caltrans and the Minnesota Department of Transportation.","This Series A round of $34 million was co-led by First Round Capital and Bessemer Venture Partners, and total funding has reached $49 million. The company was founded in 2021 by Carnegie Mellon University researchers and shifted from an early hardware business to software."],"discussion":"https://startupxo.com/en/1190/","markdown":"https://startupxo.com/en/1190.md","api":"https://startupxo.com/api/v1/item.json?id=1190&lang=en"},{"id":1189,"kind":"story","title":"Local Wikipedia, a site that shows only entries within a 30-minute walk of your location","url":"https://edjefferson.com/localwiki/","host":"edjefferson.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-23T06:48:24.384Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Local Wikipedia is a site that gathers Wikipedia articles near a neighborhood, region, landmark, postal code, or your current location that you enter. The source says it only covers articles that have location coordinates.","According to the source's description, if there are fewer than 25 entries nearby, it pulls the closest 25 within about 6 miles (about 10km). If there are more than 500, it includes only the closest 500.","The source states that location information stays inside the browser and is not included in shared links.","The source states that this site has no affiliation with the actual Wikipedia."],"discussion":"https://startupxo.com/en/1189/","markdown":"https://startupxo.com/en/1189.md","api":"https://startupxo.com/api/v1/item.json?id=1189&lang=en"},{"id":1187,"kind":"story","title":"Meta's AI app Muse tops 10 million users as shopping becomes its main activity","url":"https://techcrunch.com/2026/10/21/meta-says-muse-has-over-10m-users-with-shopping-a-top-activity/","host":"techcrunch.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-21T22:29:12.723Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Muse is Meta's AI app. It lets people hand off tasks such as connecting email and calendars or shopping to an AI agent. Meta said in its Q3 earnings call that users exceeded 10 million.","CEO Mark Zuckerberg said that about 25% of people who set up Muse use it every day. The source reports that the 10 million figure is Meta's confirmation of an estimate previously released by market research firm Sensor Tower.","Zuckerberg said that among active users who shopped with the Muse AI agent, more than 1 out of every 4 paid an average of more than 200 dollars. Payment connections use a Plaid feature that links bank accounts to payment apps.","Meta introduced a security feature called Muse Secure VM and explained that the upcoming Muse Confidential VM will keep user content hidden even from Meta. This is also Meta's own explanation."],"discussion":"https://startupxo.com/en/1187/","markdown":"https://startupxo.com/en/1187.md","api":"https://startupxo.com/api/v1/item.json?id=1187&lang=en"},{"id":1186,"kind":"story","title":"Airbnb announces policy limiting cleaning tasks hosts can assign to guests","url":"https://techcrunch.com/2026/10/21/airbnb-limits-chores-for-guests-sparking-backlash-from-hosts/","host":"techcrunch.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-21T22:28:28.415Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Airbnb has changed its policy so hosts can no longer require guests to do tasks before checkout, such as stripping bed sheets, washing and tidying dishes, running laundry, or taking out the trash, according to the original article.","The original article says the rule applies to bookings made after November 20.","According to the original article, guests have long complained about receiving pre-checkout cleaning lists even though they had already paid a cleaning fee.","The original article reports that some hosts argued in community forums that basic cleaning responsibility is needed to maintain hygiene and protect properties. One host posted that the change moves the platform closer to a hotel model and undermines what makes Airbnb unique."],"discussion":"https://startupxo.com/en/1186/","markdown":"https://startupxo.com/en/1186.md","api":"https://startupxo.com/api/v1/item.json?id=1186&lang=en"},{"id":1185,"kind":"story","title":"Railway investigating possible unauthorized access to customer environment variables and recommends key rotation","url":"https://blog.railway.com/p/security-disclosure-wednesday-october-21st","host":"blog.railway.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-21T22:28:10.541Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["Railway is a cloud service for deploying and running apps. This notice says that a 3 party may have accessed environment variables that customers set. The company said that, up to the time of the investigation, some encrypted values may have been obtained in decrypted form.","Environment variables can contain secrets such as API keys and database and registry credentials. Railway said it considers this incident part of a series of attacks targeting platform companies and AI inference providers, and wrote that it asked upstream providers to revoke keys.","The company said the impact may be limited to some users, but it recommended that all users rotate environment variables and private registry credentials and review their logs. All deployments are suspended until the investigation ends, and new versions cannot be deployed until builds are restored."],"discussion":"https://startupxo.com/en/1185/","markdown":"https://startupxo.com/en/1185.md","api":"https://startupxo.com/api/v1/item.json?id=1185&lang=en"},{"id":1184,"kind":"story","title":"GM plans to shorten vehicle development time with a central computer and AI and prepare for software-defined cars","url":"https://techcrunch.com/2026/10/21/gm-is-betting-compute-and-ai-will-help-it-compete-with-chinese-automakers/","host":"techcrunch.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-21T20:30:05.242Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["GM says it will change its 4th-generation EVs so that one central computer handles braking, steering, acceleration, and safety functions along with software. Previously, small chips were scattered throughout the vehicle.","According to GM, this central computing unit (CCU) is expected to be 40 times more powerful than existing systems and to reduce the small chips around it, cutting wiring by 30%. These are figures GM has stated, and the source does not mention any verification by an independent body.","GM says it sped up development with enterprise AI tools. Engineers reviewed 300,000 virtual designs before physically building a new battery pack, and through this process reached formal program approval in one month, according to the company.","GM aims to halve its current development period of 4 to 5 years. The new architecture will first be applied to the 2028 Cadillac Escalade IQ, and a highway autonomous driving feature that lets drivers take their hands and eyes off the road is also planned for the same year."],"discussion":"https://startupxo.com/en/1184/","markdown":"https://startupxo.com/en/1184.md","api":"https://startupxo.com/api/v1/item.json?id=1184&lang=en"}]}