DeepSeek Harness goes desktop
DeepSeek Harness goes desktop, Debian patches 1,313 kernel CVEs, and Haskell runs on the JVM
On Friday's HN front page, DeepSeek put its open-source agent harness on the desktop. DeepSeek Harness used to start from the command line and run in a browser tab. Now there are installers for Apple silicon Macs and 64-bit Windows. The desktop app is an Electron shell around that same web app. The code is MIT licensed, and the project is still a preview that promises breaking changes.
Everything is a plugin
Every feature in DeepSeek Harness is a plugin, and the agent can write new ones
“Write a Pomodoro timer plugin for me.”
About 25 downstream commits, 0 new plugins
The harness is built on Cordis, a plugin framework with its own paper on arXiv. Subagents, the terminal, even the agent loop ship as plugins. In Creator mode you ask for a new plugin in the chat, and DeepSeek's own demo builds a floating Pomodoro timer in about five minutes. A commenter posting as wren6991 likes the harness, but when the core is plugins too, changing built-in behavior still means patching DeepSeek's plugins. They carry about 25 downstream commits, and zero plugins of their own.
Desktop telemetry
The desktop build turns on usage telemetry unless you switch it off first
# ~/.dsh/cordis.patch.yml, before first launch
- id: desktop-product-telemetry
disabled: true
- id: product-analytics
disabled: true
- id: session-log-deepseek
config:
enabled: false
wren6991 also noticed that the desktop build sends telemetry by default. The project's own configuration agrees: two analytics plugins load only when the harness runs as the desktop app. To opt out, add these lines to the patch file in the harness's home folder before the first launch. That folder is .dsh in your home directory unless you've moved it.
1,313 kernel CVEs
One Debian kernel update fixes 1,313 CVEs
“the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify”
Debian's latest kernel advisory says several vulnerabilities have been fixed. The list under it runs to 1,313 CVE numbers, almost all of them issued this year, fixed for Debian 13 in a new 6.12 kernel. In the thread, john_strinlai pointed to the kernel's own documentation. Because almost any kernel bug might be exploitable, its CVE team assigns a number to every bugfix it identifies, so the count is a poor measure of risk. The advice stays the same: install the update, and reboot.
Utah's VPN law blocked
A federal judge blocked Utah's rule that adult sites must catch VPN users
“geolocation perfection is not presently possible”
Utah's SB 73 told adult websites to block VPN users or find out where every visitor really is. Aylo, the company behind Pornhub, sued, and a federal judge granted a preliminary injunction. Because geolocation can't be perfect, the court wrote, the law would make sites verify the age of every user, wherever they are. The ban on telling visitors how to use a VPN still stands, because the lawsuit didn't challenge it. In the thread, semiquaver pointed out that anyone can run a personal VPN on a cheap cloud server, and a website only ever sees the IP address.
Turbo Haskell
Turbo Haskell runs Haskell on the JVM, and it can already compile GHC
Edward Kmett started his Turbo Haskell compiler as a joke, a week before writing it up. GHC still parses and typechecks the code. Turbo Haskell, or THC, takes the optimized Core and runs it on GraalVM, either compiled just in time or built ahead of time into a native executable. It implements every primitive operation in GHC 9.14.1 and can call into Python, Ruby, R and JavaScript. It can already compile pandoc, and GHC itself. After warmup, it mostly sits 10 to 20 percent behind GHC. When a commenter said anything called Turbo ought to be a text-mode IDE, Kmett replied with a link to a new repository called thc-edit.
