REA reverse engineers any app
REA reverse engineers any app for your coding agent, Telegram Desktop’s one-click leak, and Bitwarden’s new license
On Saturday's HN front page, REA, short for Reverse Engineer Anything, gives Claude Code, Codex, Cursor and other coding agents the tools to take apart a program you have no source code for, and explain how a feature inside it works. Telegram Desktop closed a hole where one clicked link could hand a stranger your account. And Bitwarden changed the license on the apps you download from a store.
Why 200 + 10% is 220
REA finds why Windows Calculator says 200 + 10% is 220
One npx command adds REA to your agent as an MCP server, and then you ask in plain English. The worked example asks why Windows Calculator turns 200 plus 10 percent into 220. REA pulls the percent handler out of the installed Calculator library, and the agent reads the rule. After a plus, the percent is a share of the first number. After a times, it is divided by 100. For native code REA drives Ghidra, IDA or Hopper, and it also maps Electron apps, .NET assemblies and websites. The analysis runs on your machine, and REA is open source under the MIT license.
More than Claude freestyling
Why not just ask Claude to install Ghidra?
“you still want something more than just Claude freestyling, at least for now”
In the thread, a commenter posting as ethin asked what REA does that telling Claude to set up Ghidra on your own machine doesn't. tptacek answered that everyone who does this work keeps their own skills and scripts around a tool like Ghidra, and you still want something more than Claude freestyling, at least for now. REA packages that layer, the tools plus the workflow instructions it installs into your agent, so the answers come back with the evidence behind them.
Update Telegram Desktop
Update Telegram Desktop: one clicked link could hand a stranger your account
A stranger could add you to a Telegram group, post a few small text files and a link, and if you clicked that link, Telegram Desktop would upload files from your disk to the stranger's group without asking. Those can include the files that hold your login, and without a local passcode they are enough to open your account somewhere else. The fix shipped in the September 17 release, whose changelog mentions only a rendering fix. Update, set a local passcode, and limit who can add you to groups to your contacts.
Bitwarden's store apps change license
Bitwarden’s store apps switch to a commercial license
From its next release, the Bitwarden apps in the app stores, and the downloads on Bitwarden's own site, are commercially licensed builds. The GPLv3 version keeps being updated on GitHub, and every current feature is in both. New features are where the two split. Some future components will exist only in the commercial build, decided feature by feature, with that code still readable on GitHub. Self-hosting doesn't change. The license is aimed at anyone repackaging and reselling Bitwarden. In the thread, josephcsible pointed out that the announcement never uses the words dual license.
WSL 3 benchmarks
WSL 3 copies memory 60% faster, and a Go build barely moves
On Windows, the WSL 3 releases move the Linux kernel inside from the 6.6 line to 6.18. On a small six-core Intel desktop, memory copies ran about 60 percent faster, and switching between processes about 11 percent faster. A full Go build of GoReleaser finished only about 4 percent sooner, because compiling is mostly work in user space, bound by the two virtual CPUs it had. In-memory databases and busy containers gain the most. In the thread, tonymet, the post's author, added that Microsoft still calls the version 3 releases WSL 2.
