Epic vibe coded its new game launcher

shipmaster@vibeship:~$ tldr

THE SHIPMASTER'S TL;DR

epic vibe coded its launcher and put it in the marketing. respect. (review your PRs anyway.)
deepseek's new flash yaps less and scores higher on its own benchmark. vendor numbers, so vibes pending.
the NIST curve seeds everyone side-eyed for years? lrand48 + a unix timestamp. not a backdoor, just... that.
github will now scan your PRs for security problems for free on public repos. no excuses left.

gm, shippers. Welcome to issue #1. Quick how-this-works: AI agents dig up the stories and write the first draft, and a human (me) checks every link and signs off. Today: a big studio vibe coding in public, a fresh open model, and a 26-year-old crypto riddle.

🎯 The Drop

epic vibe coded its new game launcher. and said so out loud. The rebuilt Epic Games Launcher is in Preview for Windows, macOS and (for the first time) Linux. Epic's actual pitch: "programming is hard. So, instead of doing that, we vibe coded a new Epic Games Launcher." Its GM told press a small team used AI to write and review a rewrite on a new stack. Epic says the Store opens 3x faster than Steam, per testing it commissioned from Keywords Studios (so, grain of salt). Ars' own test: a few seconds faster from cold start. Light on features for now. Best take on X, from @devdudejeremy: "Vibe coding isn't the problem. Skipping review is." W take, honestly. Ars Technica · Epic's Preview page

deepseek v4.1 flash 1017 just dropped. Minor update to V4.1 Flash. MIT-licensed, weights on Hugging Face. DeepSeek says it's better at reasoning, coding and agent tasks while finishing faster with shorter outputs (less yapping, lowkey a W). On its own benchmark table, Terminal-Bench 4.0 goes 31.2 → 42.3 vs the previous Flash. Vendor numbers, we haven't tested it. Already on Vercel's AI Gateway as deepseek/deepseek-v4.1-flash-1017. (491 points on HN when collected) Hugging Face · Vercel changelog · HN

claude figured out where the NIST curve seeds came from. The seeds behind P-256 and friends were handed over by the NSA with zero explanation, and people speculated about them for years. Anthropic says an internal research model found the answer in under half an hour: they aren't hashes of anything. They're the output of C's lrand48 random number generator, seeded with a Unix timestamp. (yes, really.) Before anyone posts "crypto is cooked": Anthropic is clear this is not a break or a weakness. If anything it makes a backdoor look less likely. (963 points on HN when collected) Anthropic · HN

most real work isn't in any AI benchmark. Mercor mapped existing AI benchmarks onto 923 US occupations. Only 208 occupations have a task with at least 5 benchmark prompts, and Mercor estimates 90% of US working hours go to tasks with little or no coverage. So next time a leaderboard says a model "can do your job," remember most jobs barely show up in the tests. (559 points on HN when collected) Mercor · HN

github's AI scan for PRs is now GA. Flags security problems in PRs for stuff CodeQL doesn't cover (PHP, Shell, Terraform, Dockerfiles) and can suggest a fix. Advisory only, so it won't block merges. Available on public repos without a Copilot license; private repos need GitHub Code Security or Advanced Security. A free second pair of eyes for your vibe-coded repo, because "it works on my machine" is not a security review. GitHub changelog

🧪 Try This

llmspeed: vibe-check your hardware before you buy it (Show HN, 177 points when collected): pick a GPU or Mac and a model, and it streams text at the predicted speed, including the wait before the first token. There's a race mode to pit two setups against each other and a check for whether a model even fits in memory. Every estimate is labeled measured or projected, so read the label before you drop money on hardware. Open source. llmspeed.dev · Repo · HN
Also trending on GitHub today: anthropics/claude-plugins-official, Anthropic's directory of Claude Code plugins (1,383 stars in a day when collected). Its own README says to trust a plugin before installing it. Read the README, people.

🚢 Shipped

this spot is for you. Got a vibe-coded app that made it from localhost to live? Reply with the URL, what you built it with, and the one thing that almost stopped you (the boss fight). We'll feature real reader launches here, with your permission and only the name you want used.

🔧 Fix of the Week

deploy succeeded. app is ghosting you. Not a skill issue. Your AI just wrote localhost code for a cloud box.

Symptom: The build passes, then health checks fail or the URL just hangs.
Cause: AI-generated servers often hardcode app.listen(3000) and bind to localhost. The host gives you a port through the PORT env var, and localhost isn't reachable from outside the container.
Fix: Read the port from the env and bind to all interfaces:

const port = process.env.PORT || 3000;
app.listen(port, "0.0.0.0");

Railway docs

💰 From us

stuck on localhost? we get your repo live. ShipIt is our service that takes your stuck vibe-coded repo and gets it live. Self-serve, email-only, no calls (ever). Subscribers will get a free preflight scan. Opening soon. Reply "ShipIt" and you're first in line.

Thanks for reading issue #1. Go ship something this weekend.
— The Shipmaster, editor

How this issue was made: VibeShip Daily is curated and drafted by AI agents and checked by a human editor. This issue has no sponsors and no affiliate links. If we ever add them, they'll be labeled. Affiliate & AI Disclosure

Like this? Get the next issue free! 🚀

🎯 The Drop

🧪 Try This

🚢 Shipped

🔧 Fix of the Week

💰 From us

Don't miss the next one! 🚢