Two research firms published audits of Perplexity’s citations yesterday and reached the same conclusion. Their domains were registered in the same second, on the same registrar. One Hacker News account submitted both reports.
Getting cited by an answer engine is a funded industry now. Profound raised $155M at a $1B valuation doing it above board. The research telling you how is a marketing channel too.
In today’s indie hacker news:
- 🏴☠️ Who Perplexity actually cites when you ask for software
- 💸 Google shipped another Flash on a borrowed price
- 🐛 curl’s AI bug reports just produced real CVEs
- 🧪 Stack: same model, same task, 17x the bill
TOP STORIES
TWO AUDITS, ONE WHOIS SECOND
🏴☠️ Three sites built 215,128 pages for machines to cite
The story: The report ran 380 buyer-intent software prompts through Perplexity’s two search models and logged every source. Of the 7,534 citations that came back, 59.8% point at domains ranked below #100,000. Wikipedia got three of them.
The details:
- gitnux.org, worldmetrics.org and wifitalents.com all went up after December 2023. Two of them title their homepage “Facts & Grounding Page”.
- Those three supplied 181 citations, 2.4% of the total. Enormous page count, small share.
- guideflow.com, one vendor’s own marketing blog, drew 194 citations. Gartner drew 158.
- Nine HN commenters called astroturf on both reports before anyone pulled a registration record.
Why builders care: Domain authority isn’t the gate here, which means a small site can land in these answers on its own. Check where you show up before you pay anyone to put you there.
Together with GetPress
Get press in minutes, not months.
Record a two-minute voice note when a journalist query fits, and GetPress turns it into a quote that sounds like you, not like a model, then you send it from your own Gmail.
How it works:
- You get HARO, SOS and Mention Match in one inbox, matched with your expertise.
- Reply with text, a voice note, or a clip.
- Get your expertise out to real journalists in two minutes per day.
Pitch your own expertise or on behalf of clients you represent. Start for $99/mo →
GOOGLE’S THIRD FLASH IN SIX WEEKS
💸 Gemini 3.8 Flash keeps 3.7’s price, and its December 31 expiry
The story: Google shipped 3.8 Flash and a Flash Cyber sibling at $0.75 per million in, $3.75 out. That’s the introductory rate we flagged three weeks ago. Both halves double when it runs out, 119 days from today.
The details:
- The model card calls it “based on Gemini 3.7 Flash” and defers architecture to the older card. A renumbered checkpoint.
- Flash Cyber isn’t a debut either. 3.5 Flash Cyber shipped July 21, and Fairwind renames a restricted-access government pilot.
- Google publishes no DeepSWE score, just “outperforms most larger frontier models”. Press numbers disagree.
- bermudi on HN: it emits 11k more output tokens per task than its predecessor, and finishes last on that board.
Why builders care: Swapping the model string costs nothing today. It’s the January invoice that matters, and you can work that number out this afternoon.
SIX CVES AFTER THREE TOOLS FOUND NONE
🐛 curl shipped six AI-found CVEs, months after AI slop killed its bounty
The story: AISLE says its system filed 29 curl reports in a week when three other tools filed none. Six of them became CVEs in curl 8.22.0, credited to Stanislav Fort. curl’s own team rated every one Low, and what happened to the rest isn’t stated.
The details:
- The three are Anthropic’s Mythos, OpenAI’s Codex and Zeropath, per Stenberg’s Mastodon post. He later confirmed it covers one week of scans, and Mythos already holds a curl CVE.
- The release notes list 10 CVEs. Four came from other reporters, and AISLE’s post skips them.
- Stenberg said 27 issues were still left to assess. The queue grew.
- Greg Kroah-Hartman: “I’m seeing the same for Linux as well. No idea what Aisle is doing differently.”
Why builders care: Whoever you’re buying a scanner from, the cost lands on the humans who read what it files. curl’s maintainers do that reading unpaid, and no vendor is offering to take it over.
TRENDING TODAY
🍎 Perplexity open-sourced its Mac inference server - Lily is Apache-2.0 and decodes 1.24x to 1.32x faster than stock MLX. It loses on prefill at long context and needs an M5 or newer on macOS 26. It loads exactly one checkpoint, Qwen3.6-35B-A3B at 4-bit, and rejects sampling, streaming and tools. Its own performance doc concedes the comparison isn’t apples to apples.
🇪🇺 Meta promised open weights for Muse Spark - Version 1.3 is rolling out in Muse Code and the Meta Model API, with max reasoning held back until safety testing finishes. That reverses the closed turn we reported in April, when Muse Spark was Meta’s first closed model. Same day, Multiverse Computing called Quasar 438B “Europe’s leading AI model”. It sits below Gemini 3.7 Flash on the Artificial Analysis index.
🔒 Mistral’s opt-out page - Dated August 31 and surfaced by 398 HN readers. Consumer Vibe users are not opted out of training by default. Enterprise customers are. The Vibe toggle and the API toggle are separate, so switching one off leaves the other running, and documents you attach in Vibe count as input data.
DRAMA
🎮 THE C-SUITE DIAGNOSIS
Tarn Adams told PC Gamer at Gamescom that “everyone I know, their bosses are slowly getting psychosis.” His forecast: “They’re trying to have a CEO press a button that makes a game, and then everyone else somehow buys it without a job.” 245 comments, 237 points. He’s also lost a word to LLM marketing: “I have to talk about dwarf behavior now.”
FIRST DOLLAR
💵 THE BANNER SAID FOUR FIGURES
u/piyush-sachdeva itemised every payment from 18 days of building ReelDrop in public. Total: $1,007.29. Three lifetime deals bought on the same day account for $672.30 of it. His own line: “four figures on the banner, forty-one dollars underneath it.” That second number is one monthly plan plus an annual, amortised. He’d take the deals again. He just wants it counted as cash up front, not revenue.
📉 THE SCREENSHOT SAYS SOMETHING ELSE
Daniel Smidstrup’s post on four months of ClimbX is titled “here’s what actually worked” and claims 43 paying users at $1,247 MRR. The TrustMRR dashboard @DanielSmidstrup attached as proof shows 57 subscriptions at $1,653, with last-30-day revenue down 23% month over month, in red. Both can’t be current. Open the screenshot on every revenue post you read.
STACK OF THE DAY
FrontierHarness - 9 coding harnesses, 360 trials, one model (Kimi K3), every run from an identical cold checkpoint. Codex leads at 66.7% pass for $3.47 a task. Claude Code matches DSH Creator’s 63.3% and bills $18.34 against its $3.28, and 17x the cheapest harness on the board. Free to read, and published by Runta, which sells an agent execution layer and hosted every trial.
Not sponsored. We just feature tools builders would actually use.
BOOKMARKED TODAY
- 💵 LWN raised its prices for the second time in 24 years - About 20%, matching US inflation since 2022, and corbet shows his arithmetic. Scraper load is a line in it.
- 🔑 Claude Code stores OAuth tokens in plaintext - On Linux that file holds every MCP server token too, at mode 0600. The author sells the alternative.
Curated by AI, built by a human.