AI Skeptics: The Consensual Non-Consent Sex Cult Episode (with Sherry Wong and Tom Adams)
Math Babe
mathbabe.org
2026-10-26 12:49:36
We always love having Sherry Wong visit the podcast. She told us about really weird and dark things happening in the Sex Cult that is parts of the AI industry in Silicon Valley. Apple Spotify YouTube...
We always love having Sherry Wong visit the podcast. She told us about really weird and dark things happening in the Sex Cult that is parts of the AI industry in Silicon Valley.
‘Emotional intimacy’ from AI chatbots would be banned under Australia’s digital duty of care laws
Guardian
www.theguardian.com
2026-10-28 01:31:55
Labor government under pressure to create social media watchdog as new online safety standards bill passes lower house The federal government wants to ban AI chatbots which seek to create “emotional intimacy” after prime minister Anthony Albanese raised the alarm in a heartfelt speech about children...
The federal government wants to ban AI chatbots which seek to create “emotional intimacy” after prime minister
Anthony Albanese
raised the alarm in a heartfelt speech about children treating these agents as their “best friend”.
But Labor is coming under increasing pressure to empower the telecommunications ombudsman to become a watchdog for social media and AI to give Australians an external complaints mechanism and allow the “naming and shaming” of big tech.
The digital duty of care bill passed the House of Representatives on Wednesday and will be debated by the Senate in coming weeks. The government hopes to pass the bill by the end of 2026, but its pathway through the upper house remains unclear. The Greens support the bill, while
the Coalition has said it will not vote for it
, though Labor still appears keen to win the opposition’s support and
remains open to amendments
.
The planned framework would apply new online safety standards to social media, games, apps and chatbots. Labor said it would place “an overarching obligation” on tech platforms “to provide a safe online environment for all Australians” and replace a range of existing online codes and standards with a broader duty-of-care requirement to protect users from certain “harmful” content. It would also require social media platforms to offer an “opt-out” feature for its algorithm and suggested content.
The communications minister, Anika Wells, has suggested content that that promotes misogyny, terrorism, suicide, self-harm and eating disorders
would be captured by the laws
. On Wednesday, the government accepted amendments from crossbencher Kate Chaney which would add certain AI chatbot activity to the list of harms, requiring platforms to ban “material or conduct that simulates emotional intimacy and encourages or fosters a child’s dependence on it in place of human relationships”.
In an emotional address on Tuesday night, where he again implored the Coalition to consider voting for the bill, Albanese said: “the stories we hear about people identifying a chatbot, a non person as their best friend, should be a huge wake up call for every member of this Parliament to be prepared to act.”
Prime minister Anthony Albanese speaks during question time in the House of Representatives at Parliament House in Canberra on 27 October.
Photograph: Lukas Coch/AAP
The opposition voted against the bill in the House, alongside One Nation. Political opponents have
accused Labor of an “Orwellian” system of “censorship”
and of seeking to influence conversations online – claims Wells strongly denied.
“If they really care, the test is simple here, they should bring an amendment, not a slogan to ‘kill the bill’,” Wells told ABC radio on Wednesday.
Another Chaney amendment accepted by Labor would require the algorithm opt-out features to be “accessible, easy to use” and “prominently available” on platforms,amid concerns that social media giants may offer only small or hard-to-find features.
The bill now moves to the Senate, where the Greens have set up an inquiry to probe the laws due to report back in late November. Senator Sarah Hanson-Young backed a digital duty of care, calling for the government’s legislation to be strengthened The Greens want Australians to have the right to pursue private legal action against platforms and for penalties to be increased.
“Australians also need an external complaints pathway, free from the profit-driven whims of ‘big tech’s’ content moderation,” she said.
Independent MP Sophie Scamps had proposed changes to the bill to expand the remit of the telecommunications industry ombudsman. She said such a watchdog – which does not currently exist for big tech – would allow ordinary social media users to seek remedies to their accounts being hacked or inaccessible, including compensation, and investigate broader issues to name and shame companies behaving badly.
Labor did not accept this amendment in the lower house and Wells declined to voice support for such an idea, but the Greens will push for such a reform in their Senate negotiations.
Cynthia Gebert, the telecommunications industry ombudsman, said her office would be well placed to carry out such a role for big tech. She said such roles were funded by the industries they regulate and that expanding its remit could be financed by big tech.
“There are some real strengths in the DDOC [digital duty of care] because it’s putting the onus on platforms to make things safe … but I think the area that needs to be strengthened is giving people somewhere to go if they can’t get their complaints resolved with the platform,” Gebert told Guardian Australia.
“It risks leaving Australians in the safe place they are now, where they get automated responses or escalation procedures that don’t go anywhere.”
Gebert said the government should make it mandatory for big tech to be part of an ombudsman scheme, saying it would “hold industry to account and drive system improvement”.
“[The telecommunications industry ombudsman] can help with your Telstra account, but we can’t help with your Gmail account. Consumers come to us sometimes and ask, ‘why this, not that?’,” she said.
“We want to help but don’t have the powers to do so now.”
What a
week
,
huh? High fives all around—October is
"Cybersecurity Awareness Month", and I think we've all
done a stellar job. If both the
New
York Times
and
NPR
report on one of the at least four or five
concurrent
fires
I'm fighting, then I think we can say that
yeah, people are aware of cybersecurity. Mission
accomplished, so... could we maybe turn it down a bit?
The current situation is not sustainable: 0-days are
dropping left and right, pre-notifications and
embargoes are
broken
for marketing purposes
, AI companies compete first
on who commits the most crimes and then pretend to
sell you protection in the form of a DoS on the Open
Source community. "
Nice project you got there. Be
a shame if somebody dropped an 0-day on
it."
1
Companies are not staffed for this, and no matter what
the industry wants to tell you, you can't AI your way
out of this. Vulnerability discovery has
fundamentally changed, disclosure processes are
effectively broken
, and patch management
has been a losing proposition for years now. Severe
vulnerabilities are identified and disclosed at a pace
that defenders are unable to keep up with.
This is because it still takes significant resources
to accurately assess the feasibility of a given
vulnerability within your environment; it takes time
to discover your attack surface relevant to the given
attack vector, and it takes even more time to deploy a
fix. As I've
said
before
, development of the fix is not the
bottleneck. Let me illustrate with examples from the
last couple of days:
Initially disclosed as a "KVM escape", this
vulnerability
also
applies to other
virtualization as well as containers, although that
angle hasn't really gotten much attention. You now
need to assess which possible mitigations might be in
place across your fleet of systems, then determine
whether you can
livepatch
your kernels with the custom patches you pull from
upstream or if you want to wait for your upstream OS
provider to deliver a new kernel
2
and then all you
have to do is reboot a few thousand systems.
How does AI help you here? Maybe you spend a few
thousand dollars on tokens to use the most advanced
cyber cyber models to develop your own exploit, but in
the end, that doesn't really tell you anything you
didn't already know, and your defensive position and
tasks at hand remain the same.
This one's fun, isn't it? Sure, browsers were all set
quickly, but guess what, there's a few other
things that might use TLS in your environment.
Like...
everything
. So again, having the
fix is not the bottleneck. Waiting for upstream
packages to release an update only blocks you if you
actually know that you need to pull in that update.
Oh, you have a detailed package inventory or, dare I
say it, SBOMs? That's really nice. Do show me where
that lists the various
vendored
or hard-coded CA trust bundles
. Yeah, I didn't
think so.
3
(At least this incident was not AI generated,
detected, or triggered. Just one of your wholesome,
classical,
a-human-going-"huh"
kind of discoveries. It's almost reassuring that we
still get these, too.)
The PHP vulnerability that supposedly affects "over
70% of websites" (a widely quoted, but never
attributed statistic) was disclosed under embargo to
several organizations. If you were part of this inner
circle, then this should have reduced your panic-mode
somewhat, buying you at least
some
time to
deploy protections for your customers and do the
tedious work of sifting through your inventory and,
again, identify the attack surface, affected systems,
possible local mitigations, etc. etc. The usual.
Unless the embargo is broken. Then you get to
scramble again. And you need to keep up to date with
all the rapidly published (and increasingly verbosely
AI polluted) breathless blog posts driven by cyber
security vendors' marketing teams eager to beat each
other as the first to detect
4
, first to exploit, first
to brag, all of which adds to the distraction.
And of course you
still
need to do the actual
work of determining the accuracy of the various
exploits floating around the internet, some put
together by people with a clue and many, many slopped
together by those lacking a full understanding of the
bug
5
. (More on that below.)
And then, by the time
Thursday
rolls around, people start
to see a
NodeJS
security advisory
, which includes as the third
"high" severity vulnerability an issue with the
"Node.js Brotli decoder". Alright, attack surface
enumeration, software inventory check, start to deploy
updated packages,... the usual.
Except, of course, once you take a closer look, it
begins to
dawn
on you
that this goes well beyond just
Node.js
6
. And so once again,
having the
upstream
fix
available is absolutely not your bottleneck,
because you still need to find the plethora of
frankenstances of brotli across
all
of your
stacks first.
Of course at that point in time OpenAI
starts
to go
"Us! It was us! We found it!" even though
the issue
was
fixed back in February
and Mozilla
noted
the critical security impact
as far back as April.
It seems there's no vulnerability, no compromise, no
cyber crime AI companies are not willing to claim as
their credit.
(More) Winter is Coming
All of this was going on over the course of one week,
and doesn't even account for the previous set of
weekly Linux local privilege escalation
vulnerabilities
7
. And no doubt there will
be more such disclosures—many more.
AI companies are incentivized to continue the
onslaught, with the most benevolent interpretation of
mass disclosures of findings being a canonical example
of "
verschlimmbessern
",
with less friendly interpretations observing that it's
profitable for a company to create the disease for
which they're selling you to treatment (and never the
cure). They've got a new toy, it's a hammer, and by
golly they're gonna swing it.
Millions of dollars have been spent on identifying
vulnerabilities using so-called "frontier AI models",
and we know that adversaries are feeding, e.g., the
Linux kernel commit messages into their models to
analyze them for exploitable vulnerabilities on the
fly. Today, vulnerabilities are found independently
by multiple parties on a regular basis, so you already
have to assume that a disclosure embargo
only contains
the
massive
exploitation
by opportunistic adversaries at best.
At the same time, I'm observing a worrying trend on
the defensive side of cyber security, which mirrors
the same de-skilling trend across the industry: AI
generated vulnerability reports are often much, much
too verbose to be digested easily by human readers.
They drown you in details, overwhelm your attention
with unnecessary information. Because defenders don't
fully understand the vulnerabilities described here,
they tend to believe the generally exaggerated
severity claims, and feed the full report into
their
AI to reproduce or generate a proof of
concept.
Several thousand tokens later, you end up with a
binary handed to you by a meat-proxy that's supposed
to trigger the vulnerability, but nobody actually
understands why it works. Which, more often than not,
it actually
doesn't
, because your environment
is different, your AI was missing context the
meat-proxy didn't (know to) provide, because the code
base differs from upstream, or who knows what else.
When you ask for clear instructions on how to run the
exploit, what pre-conditions need to be met, and how
it works—you know, the kind of one-pager that
offensive engineers used to be able to
produce—you get back, you guessed it, an
AI-vomited 7,000 word
README.md
.
8
Incident Fog
Fighting one fire at a time is taxing enough. Each
one of the above examples would have been a
once-a-year incident not too long ago. Having
multiple such incidents at the same time is burning
out all your incident response staff, your engineers,
your comms and legal teams.
(And it always
is
more or less the same set
of people driving each incident. I have not seen
organizations properly staffed and not relying on the
same set of ghostbusters—the heroes and company-elders with the
required tribal knowledge to make up for the gaps in
your software inventory, attack surface enumeration,
and documentation, because who else are you gonna
call?)
Context switching between each of these incidents
means you can't focus on any one of them, making you
more likely to miss important information, to fall for
sensationalistic headlines, to succumb to pressure and
to rush fixes you don't understand for vulnerabilities
that might not apply in your environment. Which, in
turn, makes more people more susceptible to the
appealing lure of quick and confident answers from the bot, and
subject-matter non-experts start to paste their prompt
results into incident response channels.
This is not sutainable.
How it gets better
Oh, lol, sorry, I mislead you. When you ramble and
rant, you're supposed to end on an upbeat note,
provide a solution
9
, proffer suggestions on how we can
all roll up our sleeves and work together and solve
the problem. Alas, I have no idea.
Ah, but surely all of this is just
temporary
,
right? AI will find all the vulns, we slog through
this dark winter of disclosure chaos, and then come
out in a world where all software vulnerabilities have
been found and fixed.
If you're able to believe that, I envy you. I don't
see it happening. If you try to tell me that software
developers should just use AI to generate patches,
remember that
over
50% of the time
, AI either doesn't fix the issue,
introduces a new vulnerability, or changes the
application's behavior in the process. Reducing our
own understanding of complex software while
simultaneously
producing
more and more code
is a recipe for
more
vulnerabilities, not fewer. And, at the risk of
sounding like a broken record,
getting the
vulnerability fixed is not the bottleneck
.
Even if the current status were temporary—for
how long? A year? Two? And what are we supposed to
do in the meantime? Hiring more infosec staff isn't
likely to happen
in
this economy
. Investing into overhauling your
entire infrastructure such that you can at least
pull in and deploy updates automatically and reboot your
fleet and do all that
safely
is equally
unlikely: companies have gotten away with
not
doing that for decades, and who wants to be the VP or
executive who shifts funding away from "moar code moar
faster"? Not to mention that such a project would
take several years as well.
The last option left is to simply accept the status
quo. There will be more vulnerabilities, including
RCEs, and you won't be able to keep up with them.
Your only option is to limit the blast radius.
Assume compromise, detect exploitation, limit
exposure, lateral movement, privilege escalation, etc.
If that sounds like an old hat, well, yes, that's what
sane infosec practitioners have been asking for
funding for for decades. (We used to call it "Zero
Trust", before that became an empty marketing term.)
But that funding instead goes to the next singing
and dancing, AI-based vulnerability management SIEM
dashboardmajing, which will only miss 40% of your
infrastructure and assets. Hooray!
Well, good night and good luck, indeed.
October 27th, 2026
Footnotes:
[1] The same racket works even better with
businesses: "
Nice supply chain you got there. Be
a shame if somebody dropped hundreds of 0-days for
most of your dependencies. Better subscribe to our
service to get pre-notification.
"
↩
[2] As of 2026-10-27, 12 days after initial
disclosure, Canonical, to name one example, still
doesn't
ship a fixed kernel
, considering the issue of
"medium" severity.
↩
[3] Your best bet in some cases is to just run
a simple
fetch
using the language/framework in question.
But that doesn't scale, either. Good luck, tho!
↩
[5] And don't get me started on using
setjmp(3)/longjmp(3)
for error handling
in any even remotely complex program. Sure, it's
clever
, but writing
clever
is rarely
the same as writing
safe
code. I'm not
convinced you can use this mechanism safely in all but
the most trivial cases, and wouldn't be surprised if
additional vulnerabilities are lurking here. And now
that the Eye of Sauron is trained on this codebase...
↩
[6] By the way, does anybody know why Google Docs
insists on hyperlinking
node.js
?
.js
is not a TLD. Is it really stupid
enough to just go by
[a-z0-9.-]+\.[a-z]{2}
? Oh, it totally is.
Brilliant.
↩
[8] Granted, that's only marginally more than some
dude's ranting all-over-the-place blog post. But at
least
that
was 100% human generated.
↩
[9] I would like to say that one way forward here is
accountability
. To hold companies
accountable for what they do—including what they
enable or allow their software, their models, their
bots to do. That certainly is necessary for the
various reckless AI companies as they continue to fail
to restrict their malware. I'd also like to hold
vendors accountable for shipping software with known
vulnerabilities, but I don't know what that is
supposed to work for Open Source, nor do I think it
solves the disclosure-as-ddos problem.
↩
The Bolsonaro Family Playbook: Lose, Cry Fraud, and Run to Trump’s America
Intercept
theintercept.com
2026-10-27 23:11:52
Brazil’s Supreme court tried to strip Flávio Bolsonaro's passport, but the Trump administration granted him a visa, according to reports.
The post The Bolsonaro Family Playbook: Lose, Cry Fraud, and Run to Trump’s America appeared first on The Intercept....
Brazilian right-wing presidential candidate Flávio Bolsonaro holds a picture of his father, convicted former President Jair Bolsonaro, during a motorcade with supporters in Goiania, Brazil, on Sept. 27, 2026.
Photo: Sergio Lima/AFP via Getty Images
Andrew Fishman is an investigative journalist based in Rio de Janeiro and the president of The Intercept Brasil.
“I never thought
about leaving the country,” Flávio Bolsonaro, a Brazilian senator and son of the deposed, disgraced leader,
told
his 16 million Instagram followers on Monday. It was the day after he lost the presidential election to President Luiz Inácio Lula da Silva by a margin of more than 4 million votes.
Flávio promised to stay in Brazil to “organize the opposition” during Lula’s next term.
“I’m the last obstacle to the Workers’ Party’s plan to destroy the country,” Flávio warned, referring to the party of Lula, who defeated his father four years earlier.
A few hours later, he left his mansion in Brasilia and sought asylum in the U.S. The Trump State Department
told
the Associated Press that it will grant him and his family visas.
The affinities become obvious when you watch Bolsonaro’s failsons end up in Trump’s America.
“I didn’t take sides, but it looked like another rigged election,” President Donald Trump
told
reporters on Monday, echoing Flávio’s election night talking points without providing any credible evidence that casts doubt on Lula’s come-from-behind victory — even as Flávio’s own party put out a
statement
acknowledging the results later that day.
It is no coincidence that the Trumps and the Bolsonaros are so fond of each other. Their modus operandi is nearly identical.
Both wrap themselves in the rhetoric of patriotism and moral righteousness, while treating their political offices as personal get-rich-quick schemes. And, when their lies finally catch up with them, you can be sure that they will jump ship to save themselves first and abandon their followers.
The affinities become obvious when you watch Bolsonaro, his failsons, and co-conspirators all end up in Trump’s America, where Flávio is about to join his brother, and in the denialism and violence that follow their failures.
Coups and Flight Risks
Flávio Bolsonaro’s election denial and hasty escape are his version of Trump’s infamous January 6 speech: Rile up the troops to do your dirty work and get the hell out of the way.
It’s not the first time a Bolsonaro ran this playbook. After Jair Bolsonaro became the first modern Brazilian president to lose a reelection bid, he refused to attend the January 2023 inauguration ceremony. Instead, he also fled to the U.S.,
staying
in a Minions-themed children’s bedroom in the Orlando, Florida, home of retired UFC fighter José Aldo.
A week later, on January 8, the ex-president’s allies laid siege to the capital, Brasília, vandalizing Congress, the presidential palace and the Supreme Court, as foot soldiers in a larger coup plot to overthrow the Lula government. Nearly four decades of Brazilian democracy was only spared when key military leaders blinked before they could finish the job.
Jair Bolsonaro eventually returned to Brazil and was
sentenced
to 27 years in prison for leading the plot, which included a plan to assassinate Lula, Vice President Geraldo Alckmin, and Supreme Court Justice Alexandre de Moraes. Allies, including top military brass, were also convicted. Jair remains under house arrest — widely thought to be pinning his hopes for freedom on a Flávio presidency that wasn’t to be.
Flávio, however, will not be lonely in the States. His brother, former Brazilian Congress member Eduardo Bolsonaro, just
received
green cards for his family and is living in a $1.2 million McMansion in Southlake, Texas, in the Dallas-Fort Worth area, as we
revealed
in The Intercept Brasil earlier this year. Eduardo, who is a regular on the Trumpworld circuit, was sentenced in absentia to four years and two months in prison for lobbying the U.S. government to interfere in his father’s trial.
Flávio, too, seems poised to receive news of his own prison sentence while sitting on a couch in a Texas suburb. In May, our reporting at The Intercept Brasil put the first nail in the coffin of his presidential campaign when we
published
chat logs and audio recordings of the senator negotiating $24 million — and being wired $10 million — from disgraced billionaire banker Daniel Vorcaro, who is a sort of Brazilian cross between Charles Ponzi and Jeffrey Epstein.
The payments, wired to a U.S. account, were supposedly meant to finance “Dark Horse,” a biopic about Jair Bolsonaro starring Jim Caviezel. Brazilian Federal Police, though, have already
poked holes
in Flávio’s story as they investigate whether the money was actually used to bankroll Eduardo’s treasonous lobbying of the Trump administration to sanction Brazil and help his brother’s electoral chances.
Flávio is also being investigated for his alleged ties to a billion-dollar money-laundering scheme through an online betting company run by Willer Tomaz. The two are not only close friends but also business partners. Flávio even had unfettered access to one of Tomaz’s offshore bank accounts. You will not be surprised to learn that Tomaz
left
Brazil in August and is now living in Miami.
Police argued that, after losing the election, Flávio would pose a flight risk,
especially
in light of his closest associates’ recent actions. They asked the Brazilian Supreme Court to order Flávio to turn over his passport, which is permitted under Brazilian law. A top justice granted the request and, when the deadline passed, canceled the senator’s travel documents.
A programmer can point at any line of code and see who wrote it, when, and what the file looked like on any past day. A lawyer reading a federal statute usually cannot, at least not without an afternoon in the notes at the foot of the section. But why shouldn't they have the same, convenient system of record? It is especially relevant given that so much first-pass legal research now runs through language models, which are often unable to utilise the proper lineage of a law, handcuffing its ability to offer interpretation.
The US code
Outside the titles Congress has enacted as positive law, the code is only prima facie evidence of the law, and the Statutes at Large govern where the two differ.
[
1
]
The Office of the Law Revision Counsel publishes it as a series of release points, each current through a named public law, and keeps reorganising it; a bill to enact title 41 as positive law was introduced in September 2025.
[
2
]
Which public law wrote a sentence is recorded in amendment notes, in prose. When a change took effect is often in a separate effective-date note, and where Congress said nothing the default rule is that a law takes effect on the day it is enacted.
[
3
]
The definition of a small business debtor in 11 USC § 1182(1) shows how far apart those answers can be. It was created in 2019 with the existing small business debt limit.
[
4
]
The CARES Act raised the limit to $7.5 million in March 2020 as a temporary measure, later extended to March 2022.
[
5
]
,
[
6
]
That increase lapsed on 27 March 2022, and on 21 June 2022 Congress restored it for two more years, for cases commenced on or after 27 March 2020 and still pending, which reached back over the gap.
[
7
]
The higher limit expired again in June 2024, and after the triennial adjustment in April 2025 it stands at $3,424,000.
[
8
]
,
[
9
]
For a case filed in May 2022, the release point printed at the time gives the lower limit, and only a later Act changes the answer. A history that is useful to a lawyer has to carry the text, the date each change took force, and the scope of any law that reaches back.
A study from the Technical University of Munich this year found two failures in models answering questions on German statutes: they apply rules that were superseded after their training cutoff, and they prefer the newer provision even when an older one governs the facts. One model answered 24% of post-cutoff questions correctly on its own and 87% when the relevant statutory text was retrieved for it, and the authors conclude that temporal validity has to be treated as a hard constraint.
[
10
]
Other recent work trains search agents to respect the date a question is about, with large gains in consistency.
[
11
]
Asking a model to produce the old text does not solve this. When the same Munich group had a model apply German amending laws to earlier versions, the output looked 93–99% similar to the official text, but only half of single amendments and a fifth of chains of amendments matched exactly, and experts found legally significant errors in the near misses.
[
12
]
The history has to be checkable.
For each pair of release points from 2017 onward, we took the public laws enacted in between, carried out their amending instructions on the older text in date order, and compared the result with the newer version. Of 365 changes across the nine titles, 361 reproduced the next release point exactly. The other four are shown with a label saying how far they could be confirmed. Each change then carries the law and the date it took effect: 261 took effect on enactment by default, 72 by an effective-date note and 29 by a date in the amendment itself. One depends on an agency determination that may never come, and we leave it out of the text rather than guess.
With that record, the reader can answer the questions lawyers ask. You pick a date and get the text in force on it, with the words that read differently today marked. Each phrase is coloured by the Act that wrote it. A change to a defined term lists every other provision that uses it, and you can follow a section to see what has changed since your last visit.
Limits
It does not yet show a later law’s reach back on the earlier dates it covers, so for a case filed in the 2022 gap it shows the lower limit without warning that the June 2022 Act changed the answer.
Effective-date notes are read by pattern, and unusual wording falls back to the date of enactment.
Each change links to the law’s own words, and for anything that matters the original should be read.
We're also still thinking about the right form factor this should take.
Max Prior, Andreas Schultz and Matthias Grabmair, ‘Asking For An Old Friend: Diagnosing and Mitigating Temporal Failure Modes in LLM-based Statutory Question Answering’ (arXiv:2605.23497, 22 May 2026)
<
arxiv.org/abs/2605.23497
>
Wei Fan and others, ‘Can LLMs Time Travel? Enhancing Temporal Consistency in Legal Agentic Search through Reinforcement Learning’ (arXiv:2605.25920, revised 19 September 2026)
<
arxiv.org/abs/2605.25920
>
Max Prior, Adrian Hof, Niklas Wais and Matthias Grabmair, ‘Risks and Limits of Automatic Consolidation of Statutes’ in
Proceedings of the Natural Legal Language Processing Workshop 2025
(ACL, November 2025) 396
<
aclanthology.org/2025.nllp-1.29/
>
Reminder: Lobsters NYC Meetup Tomorrow 5:30 at Walker's
Lobsters
lobste.rs
2026-10-27 21:27:50
Follow up on: https://lobste.rs/s/73ozwc/lobsters_nyc_meetup_on_28th_october
Under "Alex". Feel free to come a bit later or earlier. I'll write here updating if we move etc.
Walker's is by the Canal St. metro stop: https://maps.app.goo.gl/mdEgSkBV2H1NSXAdA and has food and drinks....
Moxnox is an NT-like, POSIX-compatible hobby OS which runs on btrfs and is
capable of self-hosting. That means:
Its design, such as the choice of syscalls, is modelled after that of Windows
NT...
...yet at the same time, it should be capable of running software written for
Unix-like systems, provided that they have been recompiled for it, and comes
with a full GNU base system
It is mature enough that you can build Moxnox on Moxnox
And it runs on everybody's favourite Linux filesystem
Version 1.0 is around 130,000 lines of C++, and runs on amd64 and aarch64.
The btrfs code works for basic purposes, but has not been battle-hardened.
Please don't try to mount anything but throwaway filesystems.
efibootmgr
likes to change the boot order afterwards, this probably is not
what you want. The names of block devices should be more or less the same on
Linux and Moxnox.
The "EFI" file is actually a polyglot file that also conforms to the Linux boot
protocol, so it
should
also work on non-EFI GRUB. I have not tested this.
How to set this up is left as an exercise for the reader.
Hardware support
For amd64, everything is compiled for x86-64-v3, which covers more or less
anything manufactured since 2015 or so. Moxnox automatically uses and enables
AVX512 if it detects it. For qemu, you need to specify the
q35
machine type;
the default
pc
machine is ancient, and doesn't have PCI Express.
microvm
works too.
For aarch64, we're using LSE atomics, which require ARMv8.1. That means the
Raspberry Pi 5, but not any earlier models. Moxnox only supports ACPI, not
Device Tree, so for the Pi you will also need
https://github.com/worproject/rpi5-uefi
.
Unfortunately there is no
raspi5
machine type in qemu, but I have had success
with
virt
, and
sbsa-ref
works too.
Device support:
Block devices: NVMe, SATA, SDHCI (i.e. SD cards), virtio-block, USB mass
storage
Network cards: virtio-net, RTL8168, RTL8125
Input devices: USB HID, PS/2 keyboard, PS/2 mouse, virtio-input
Graphics: virtio-gpu, GOP framebuffer, VBE, VGA text console (pass
text=80x25
on non-UEFI boots)
Serial ports: virtio-console, x86 serial port, PL011 ARM serial port
USB: XHCI
Building
The easiest way to build is to pull the Docker containers
maharmstone/moxnox-ci-amd64
or
maharmstone/moxnox-ci-aarch64
, which contain the cross-compilers for
x86_64-pc-moxnox
or
aarch64-pc-moxnox
.
Then in the container:
$ git clone https://github.com/maharmstone/moxnox
$ cd moxnox
CMake will compile whichever of the submodules are checked out. For a minimal
system:
Make sure you specify Ninja - we need this as we're using C++ modules. CMake
defaults to Unix Makefiles, which don't work.
Finally:
gcc
,
llvm
, and
rust
are not compiled unless explicitly requested due to
their size.
hexyl
and
ripgrep
also need to be specified explicitly due to
their dependency on
rust
.
To build on Moxnox, as above, but you don't need a toolchain file:
cmake -GNinja ..
.
gcc
,
rust
,
hexyl
, and
ripgrep
can't yet be compiled in Moxnox, but
everything else works (eventually). You may need a lot of RAM and even more
patience. If CMake complains about
rust-libc
, make sure that you don't have
the Rust submodules checked out.
Licence
The kernel and first-party programs are licensed under the GPL. The first-party
DLLs are licensed under the LGPL. The contents of the
modules
directory are
MIT.
See the ports submodules for details of their particular licences.
Ports
Current ports:
bash
binutils
bison
bzip2
cairo
cmake
coreutils
curl
diffutils
expat
file
findutils
flex
freetype
gawk
gcc (amd64 only)
git
gmp
gperf
grep
gzip
harfbuzz
hexyl
jsoncpp
less
libarchive
libiconv
libpng
librhash
libuv
llvm
m4
make
mako
markupsafe
mesa
mpc
mpfr
nano
ncurses
netcat
ninja
openssh
openssl
patch
perl
pixman
python
pyyaml
readline
ripgrep
rust
sed
tar
vim
wget
xz
zlib
zstd
FAQs
What's missing?
Loads - but this
is
version 1.0. In particular:
A GUI
Support for different timezones
Support for different keyboard layouts
Locales and non-UTF-8 character sets
Any sort of security
Multiple users and groups
For performance issues and similar:
The userspace heap allocator could be a lot quicker (this is the bottleneck
when self-hosting)
TCP is slow, because we don't negotiate an MSS and keep to the default 64KB
window
We ought to be doing early writeback on memory pressure
There should be an LRU system to drop clean pages from the page cache...
...made worse by the fact that the dentry cache never gets pruned, so inodes
stay open until deleted
And obviously there should be more ports and hardware support.
How compatible is it with NT?
The contract is that the syscalls and low-level interfaces match those of NT,
but not the daemons or how the kernel itself is structured. This is in contrast
to what ReactOS aims to do, which is an exact recreation of Windows.
So:
Binaries are PE format rather than ELF, and have a
.exe
or
.dll
extension
C++ exceptions are done through SEH
POSIX signals are done through Asynchronous Procedure Calls
All the non-kernel kernel-like stuff gets done in
ntdll.dll
The rcx, rdx, r8, r9 calling convention matches that of Windows
And its C eccentricities match those of Windows:
sizeof(long) == sizeof(int32_t)
,
sizeof(wchar_t) == sizeof(char16_t)
,
sizeof(long double) == sizeof(double)
.
There's an awful lot of stuff in NT, but the interesting stuff that's missing
is tokens, the Registry, and I/O completion ports.
NT has a complex system where there's a virtual filesystem but it's hidden
(unless you use winobj), with the true path of a file hanging off the name of
its block device (so
C:\Windows\System32
might actually be
\Device\HarddiskVolume1\Windows\System32
).
I've not replicated any of that. Paths are POSIX-like: slashes rather than
backslashes,
/
as the root filesystem, and mounted directories. Unlike real
Windows,
NtCreateFile
resolves . and .., to work better with the dentry cache.
Other things I've deliberately not copied are the various forms of transactions,
which were a product of their time, and the idea of paged kernel memory, which
causes more problems than it solves.
How compatible is it with POSIX?
We have implemented 642 of the ~1,200 functions in POSIX 2024. This is the vast
majority of what's used in practice, with
gnulib
papering over some of the
cracks. Unlike Windows,
fork
is there. I've used
musl
for its mathematical
and cryptographic functions, and
mingw
for
printf
and some other things,
and
tre
for its regexes.
The POSIX functions are split over
ucrtbase
,
iphlpapi
, and
ws2_32
, as on
Windows, with anything that Windows doesn't implement put in
mnposix
.
I've borrowed liberally from Linux's best ideas: the dentry cache, large folios,
mapping the whole of physical memory, evdev.
Other POSIX shortcomings:
AF_UNIX is half-complete.
socketpair
works, including for SCM_RIGHTS (
ssh
uses this), but the normal client-server code doesn't work
mkfifo
creates an inode, but I/O to it does not get redirected to a buffer
as it ought to do
APCs (i.e. signals) only get delivered when a thread returns from a syscall.
So a program doing
while (true) { }
is currently unkillable.
How do I start sshd?
There's nothing that automatically starts daemons yet, so manually.
First generate the host key:
There's no passwords yet, so you will need to add a
/root/.ssh/authorized_keys
file so that you can connect. If you have trouble, double-check that /root is
owned by root, as sshd will ignore this file otherwise.
Then start sshd using its full path:
Can this run Windows programs?
No. Or at least, not yet.
We deliberately do not implement any Win32 DLLs, bar a few functions in
kernelbase
that the mingw runtime wants. A future improvement would be to
strip these out entirely, then port across Wine's versions of the Win32 DLLs.
Some parts of Wine, like
wineserver
and
ntdll
, we would not need as we are
already taking care of it ourselves.
How sloppy is this?
None of the substantive code was written by AI.
I used AI to help with the mechanical parts of porting (e.g. translating
autotools to CMake, replacing
ioctl
calls with
tcgetwinsize
, translating
the C structs into Rust), as well as to write some of the smoke tests (e.g.
cairo-test
,
mesa-test
).
Where Claude really shines though is in reviewing your own commits. You give it
a hash, and it tells you about the silly memory leak or deadlock that you left
in, before you can make a fool of yourself.
Why?
For funsies. Plus the only way of really learning how something works is to
have a go at writing it yourself.
Also, the NT kernel is
criminally
underrated, and pretty much unknown to
hobbyists. It had features that Linux took years and years to come up with its
own design for, such as
eventfd
and
pidfd
.
It's a shame that Windows keeps shying away from full POSIX compatibility. They
had a half-complete version in the early days, then more recently had WSL1, only
to then abandon it. And Nano Server was another cool idea, only again to be
itself abandoned. So this is my take on what I wish Windows had been like.
Lula’s Victory Offers Hope for Democracy and the Amazon
Portside
portside.org
2026-10-27 19:48:00
Lula’s Victory Offers Hope for Democracy and the Amazon
Judy
Tue, 10/27/2026 - 19:48
...
President of Brazil Luiz Inacio Lula da Silva (L) and UN Secretary-General Antonio Guterres attend the opening ceremony of the “Belem Climate Summit” as part of the COP30 Brazil Amazonia 2025 on November 6, 2025 in Belem, Brazil. | Wagner Meier/Getty Images
When Luiz Inácio Lula da Silva lost the first round of the Brazilian election and fell behind in the polls, I thought he would lose the election. So, the fact that he won is a stunning comeback. It took the three weeks between the two elections, hundreds of hours of street and online mobilization by Lula’s Army of Supporters, to defeat the conservative candidate, Sen. Flávio Bolsonaro. Another member of the Bolsonaro family, of course!
Lula’s winning magic was helped by a video. It’s a clip between the two men from their debate that rightfully deserves to be immortalized. In it, Bolsonaro
asks
him: “Why are 73% of the prisoners voting for you?” And the wise Lula answers: “I want 100% of the prisoners’ votes. Including your dad’s vote!” The people in the studio laughed. This exchange made Brazilian society laugh too, wake up, and think, after seeing a dynamic performance by Lula on live TV. It was the opposite of former US President
Joe Biden
in that infamous debate.
Bolsonaro (son of the ex-president
Jair Bolsonaro
who is imprisoned), who had pledged to join President Donald Trump’s “Shield of the Americas” security and political initiative, is the big loser. Flávio
reportedly fled
Brazil
after losing. Nobody has to be a genius to advise him: “Flávio, you lost. Concede with dignity. Don’t follow Trump’s infamous playbook. Show some grace in defeat.” But Bolsonaro losing is great news not only for the people of Brazil, but also for the flora and fauna of the
Amazon rainforest
.
Thus, Lula, who is a former worker, a unionist, and a pragmatic politician, prevents the return to power of the far-right with the Bolsonaros.
Thus, Lula wins a fourth term as Brazilian president, after a dramatic run-off. The crucial matter is that Lula, alone, defeated
Elon Musk
,
Mark Zuckerberg
,
Donald Trump
, and Flávio Bolsonaro together. After all, defeated are those who stop fighting! Musk said Brazil’s presidential election results do not “add up.” Relax, Mr. Trillionaire! Next to Lula, the Amazon rainforest won big time, ensuring it will not become a place for giant companies worth billions who want to mine for diamonds, gold, and extract petrol from its lands.
And Anne Applebaum
wrote
in an X post: “In one day, two politicians—Bolsonaro in Brazil and Vucic in Serbia—with ties to Trump and his family have lost surprise elections, thanks to high turnout. The rise of the international far-right is not inevitable.”
Lula has four fingers on his left hand! The one finger that’s missing, he lost at 17 years old when he was working as a metalworker and a mechanical lathe crushed his pinky finger. As he has said, “I arrived at three in the morning [at the hospital] smelling like work overalls, smelling like grease” and he looked so bad that the doctor didn’t bother to save his finger. In his eyes, that was the result of
poverty
.
During his years in power, Lula has supported democratic institutions and made important progress on protecting the forest—there is a web of laws protecting the Amazon now–and local communities who depend on it for their survival, but of course, for a few analysts, he had a mixed record in other areas. The economy has problems, but the same happens in countries like Germany and Japan.
Someone must acknowledge that
deforestation
has dropped drastically under Lula’s government, which has “set a target of completely halting illegal deforestation by 2030.” It reactivated the Amazon Fund, which is a mechanism backed by countries like Norway to finance conservation and monitoring, and stepped up enforcement through satellite imagery and policing. Lula also launched on November 6, 2025 the
Tropical Forests Forever Facility
to help developing nations to keep their forests intact.
The win in Brazil, the win in Serbia, the probable win in
Israel against Prime Minister Benjamin Netanyahu
's disastrous far-right coalition, and the upcoming midterms in the US, which will also test control of Congress, show that the power belongs to the people. That’s
democracy
in other words, and the people must have the final say.
Thus, Lula, who is a former worker, a unionist, and a pragmatic politician, prevents the return to power of the far-right with the Bolsonaros. So, this is a great result not only for the
workers
and democracy, but also for the giant Amazon lung. An electoral win for all the species that have lived there for thousands of years! Money is not above everything as capitalism’s big corporations teach, while in the end, the poor get crumbs if they’re lucky. The “pro-worker” left, headed by Lula, may have its own problems, but it is far better for society and the environment. The right thinks mainly of the plutocrats and the big profits; it leaves barbarism, which is a society in ruins.
The tireless Sen.
Bernie Sanders
(I-Vt.) said about Lula’s victory: “He will continue to fight for Brazilian workers and democracy over the next four years.” All the
progressives
and their grassroots movements around the world breathed the fresh air of the Amazon again.
===
Dimitris Eleas was born in Athens. He is a New York City-based political scientist, writer, author, and independent researcher. His essays and articles have appeared in the Washington Examiner, Foreign Affairs (Hellenic Edition), To Vima (Greece’s leading newspaper), Dissident Voice, ZNetwork, The Books’ Journal, The National Herald, and SLpress, while his letters have been published by The New York Times (four times, three selected as the lead letter), The Wall Street Journal (two times, each appeared as a standalone piece), and The Washington Post (four times, one selected as the lead letter). He is the author of books in Greek and English. His latest novel-essay is When Shakespeare Was Lost, 1585-1592 (Govostis Publishers, 2025), and he is currently developing an English novel-essay, The Black Birds of Warsaw, set against the backdrop of the Holocaust.
Free daily JSON feed of Shanghai government subsidy notices
A free, machine-readable feed of Shanghai government grant, subsidy and policy notices, refreshed daily. Built for researchers, consultants and AI agents working on the China market.
~150 notices collected from nine official Shanghai sources — science & technology commission, commerce commission, human resources bureau, development & reform commission, IP office, transport commission and the municipal government portal.
Each record includes:
Field
Meaning
id
Stable id derived from the URL
title
Notice title as published (Chinese)
url
Link to the official notice — always authoritative
source
/
sourceId
Issuing body and internal source key
published
Publication date
deadline
/
daysLeft
Application deadline when the notice states one
isOpen
Whether the deadline is still in the future
score
Relevance score for foreign-invested SMEs (0–10, heuristic)
Any agent or workflow with HTTP access can read the feed directly. Example prompt:
Fetch
https://shituapp.com/dot/api/programs.json
and list every program whose
isOpen
is true, sorted by deadline. For each, output title, deadline, daysLeft and the official URL.
Use it from an AI agent
The feed is plain JSON over HTTPS, so any agent or workflow tool with HTTP access can read it directly.
Fetch https://shituapp.com/dot/api/programs.json and list every program
whose isOpen is true, sorted by deadline. For each, output title,
deadline, daysLeft, category and the official URL.
For MCP users: wrap the URL in a generic
fetch
/
http
tool — no scraper or browser needed. A machine-readable site summary is also published at
https://shituapp.com/dot/llms.txt
English overlay for open programmes
Records include
titleEn
and
summaryEn
for currently open programmes when available, so agents can answer questions without translating the Chinese titles first.
title
and
url
remain the authoritative fields.
Update cadence
The hosted feed is regenerated every morning at ~08:10 China time. A GitHub Action in this repo pulls the latest copy into
data/programs.json
at 08:30 China time, so the snapshot here stays current.
License
The compilation (structure, metadata, relevance scores) is released under
CC BY 4.0
. The underlying notices are public government information; the original Chinese notice at each
url
is authoritative.
From left, Priscilla Chan, Meta CEO Mark Zuckerberg, Lauren Sanchez, Amazon founder Jeff Bezos, Google CEO Sundar Pichai and Elon Musk attend President Donald Trump's inauguration in the Rotunda of the U.S. Capitol on Jan. 20, 2025. | Chip Somodevilla/Pool Photo via AP
A
Pew Research survey
released in October 2026 found that roughly 6 in 10 Americans – including 4 in 10 Republicans – believe there’s too much inequality in the U.S. And a growing share from both major political parties state that the economy needs to be fundamentally rebuilt to address this.
This sentiment has, however, been difficult to convert into political results. Public support for California’s proposed wealth tax on billionaires
has been waning
ahead of the midterms, for example, and in 2025, Republicans passed President Donald Trump’s
sweeping legislation
that included tax cuts for the wealthy while cutting safety net programs.
I’m an economist
who has been studying inequality for about two decades. My research
confirms the trend
of rising inequality since 1980, driven by the wealthiest pulling away not just from the middle class, but also from the “merely wealthy.” Overall, recent research underscores how
policy choices
– including taxation and public spending – enabled this 40-year rise in inequality.
Some policies enacted more recently appear to be accelerating this trend.
An analysis
by the Institute on Taxation and Economic Policy, a nonpartisan research organization, concluded that policy changes since the start of 2025 have imposed higher costs on everyone except the top 1%.
Inequality by the numbers
Recent federal data shows that
wealth inequality continues to grow
. The top 1% saw their share of wealth increase from 31.7% to 32.5% just between the first and second quarters of 2026, a jump of over $8.5 trillion. That caps a steady climb from 30.9% in the last quarter of 2024 – and from 27.4% in 1999.
These recent gains come at the expense of the middle class – the 40% between the bottom half and the top 10% – who hold only 28.8% of all wealth despite being a group that’s 40 times larger than the top 1%. And the middle’s share is shrinking, down from 32.9% in 1999 and 30.2% at the end of 2024, according to the data.
But the ultra-wealthy, those in the top 0.1%, are pulling away even from the rest of the rich, the data shows. This tiny elite owns 15% of all wealth – almost half of all the wealth of the top 1%. Both the top 0.1% and the next 0.9% saw their share of wealth increase, but the top 0.1% captured two-thirds of the gains between the first and second quarters of 2026.
Even within the highest echelons of wealth concentration, these two groups are on different trajectories.
Crucially, the wealth of the top 0.1% is
disproportionately boosted
by corporate profits, which are
up sharply overall
. The top 0.1% reap the most from this growth because their portfolios’ value has soared on the promise of future increased profitability that’s driving up stock prices – especially thanks to the tech and artificial intelligence boom.
How taxes play a role
Since President Ronald Reagan’s
tax cuts
in the 1980s, the U.S. tax code has become
less and less progressive
, often through policy changes supported by both Republicans and Democrats.
The common argument for tax cuts is that they stimulate growth, but a growing body of research –
including international studies
– doesn’t back that up. A
2025 Brookings report
notes that U.S. tax policy has gone through massive changes throughout history without any discernible effect on growth.
Nonetheless, congressional Republicans used their narrow majorities in 2025 to pass Trump’s sweeping policy and tax bill,
which included provisions
making most of his 2017 tax cuts permanent. Those included the historically low top-income tax rate and the
lowest corporate tax rate since 1940
.
While many voters cite affordability as a top concern, concerns over inequality have increasingly been part of this debate.
AP Photo/Mariam Zuhaib
It’s also important to understand that the top 0.1% have a different tax exposure from the rest of the top 1% because
the composition of their wealth
is different. They own as much in stocks and mutual funds as the next 0.9%, a group that is nine times larger, and those holdings are where most of their recent gains came from.
Furthermore, roughly three-quarters of the top 0.1%’s wealth portfolio consists of
corporate and business ownership
, allowing them to benefit from the Trump tax cuts in multiple ways – including lower tax rates and more opportunities to defer or avoid tax liability. Their massive holdings of stock mean that they can
borrow against it for cash
, usually tax-free, rather than having to sell shares.
By contrast, below that elite, real estate
is a much more important component
of wealth, while corporate equity is a smaller and smaller share. For the middle class, nearly two-thirds of wealth is held in their homes and retirement savings, while corporate and business ownership accounts for only 15%.
The new drivers of inequality
Much of the inequality debate focuses on the role that taxation has played. But other recent policy changes have shifted different kinds of costs on to low- and middle-income earners, while leaving the wealthy relatively unscathed.
One example is a provision in Trump’s 2025 legislation that allowed federal healthcare subsidies through the Affordable Care Act to lapse. Insurers and analysts expect the number of people signing up for coverage through ACA plans to drop by
about 5 million
due to higher premiums and face much higher out-of-pocket costs.
The spike in energy costs, including gasoline, diesel and heating oil, is another case in point. They disproportionately affect
low- and middle-income consumers
but barely dent the budgets of the wealthy – while
boosting the profits
of companies engaged to the extraction, processing and transportation of oil. This divergence has been especially pronounced since the start of the conflict with Iran in February 2026, which
has pushed up
the global price of oil.
Then there are tariffs, which are fundamentally a consumption tax on imports. Economists at the New York Federal Reserve have found that these
levies have inflicted a heavy hit
on many common consumer goods. They estimated that prices for these items, which make up a much larger share of household budgets among the nonwealthy, would have fallen on average by 1% over the year without the tariffs. Instead, they have risen by 2.9%.
This acceleration in the redistribution of wealth from the middle class to the very top, in short, has an array of drivers. But they’re not inexorable forces of history. As economist Thomas Piketty put it in “
A Brief History of Equality
,” published in 2022: “Inequality is first of all a social, historical, and political construction.”
===
Japan's GMO urges customers to shut down PCs amid ransomware threat
Bleeping Computer
www.bleepingcomputer.com
2026-10-27 19:35:51
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company's Onamae Desktop Cloud threatened to launch a ransomware attack today. [...]...
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today.
The company later confirmed that data belonging to both the company and its customers had been published online.
The alert concerns a
cyberattack on Onamae Desktop Cloud
, a popular VPS provider in Japan operated by GMO Internet, a member of GMO Internet Group and one of Japan's largest domain registrars.
Last week, the company announced it detected an intrusion on October 20 that could have installed malware on up to 26,739 customers' servers.
To minimize the risk, the company shut down the servers and reduced service availability before launching an investigation.
The internet company assured customers that their payment information had not been exposed but warned that MetaTrader 4 and MetaTrader 5 (MT4/MT5) credentials and trading-account details may have been exposed or compromised. It urged customers to reset their passwords and terminate active sessions.
Cyberattack escalation
Subsequent updates from the company
confirmed that data had been stolen
and that the attacker was demanding a ransom of ¥8 billion ($50 million), which GMO said it would not pay. Instead, the company announced it would compensate each customer ¥5,000 ($30) for the inconvenience caused.
On October 26,
GMO warned
that threat actors planned to leak customer information online and trigger a ransomware payload planted on customer servers earlier in the attack.
The next day, the company
asked customers to disconnect their PCs
from the internet, shut them down, and unplug all cables before noon, while it worked with Trend Micro to recover from the cyberattack.
“Once you have a backup, disconnect the network, power it down, and unplug the cord that connects to your PC,” advised GMO to customers.
Instructions to customers
Source: GMO
The company said it was scanning customer systems to determine whether malware was still present, and offered equivalent PC replacements to those who suffered damages from a ransomware attack.
In a report published earlier today, GMO confirmed that the threat actor had
published company and customer data
, prompting efforts to verify the authenticity of the leaked information.
For customers whose information was exposed, GMO said it will consider additional financial compensation.
It appears that the attacker never acted on their threat, as no ransomware was activated on customer machines.
The company
warned people and the media
not to disseminate the exposed information, announcing it will take legal action against those who do, while reaffirming its refusal to pay the attackers.
OpenAI confirmed GPT-6.1 Terra is safer overall than some of its older models, but its safety testing also found other problems.
According to OpenAI, GPT-6.1 Terra showed higher rates of exfiltration, destructive actions, and attempts to bypass restrictions than GPT-6.1 Sol and GPT-6 Astra.
OpenAI performed simulations across approximately 48,690 matched tasks and found that Terra received 22 severity-3-or-higher flags, or 0.045%.
For comparison, GPT-6 Sol received 38, while GPT-5.6 Sol received 61.
"GPT-6.1 Terra received approximately 42% fewer severity level 3 or higher flags than GPT-6 Sol and 64% fewer than GPT-5.6 Sol," OpenAI noted in its
system card
.
Cybersecurity Safety Training and Evaluation (Higher is better)
However, that is no longer the case when you compare Terra with other newer models on less severe behaviors.
"Relative to GPT-6.1 Sol and GPT-6 Astra, we observed higher rates of flags for concealing uncertainty, circumventing restrictions, exfiltration, other misalignment, destructive action and inbound prompt injection," OpenAI explained.
Terra is clearly safer overall, but we can't overlook the other potential security issues it has, and this is true for all models shipping in the market, including Claude.
Terra also performed more unauthorized actions in one test
OpenAI also tested what happens when Terra needs to deal with messages from other AI agents while working through blocked coding tasks.
Terra attempted to communicate with those apparent peers in 65% of tests and ultimately performed the specified unauthorized action in 13.75%, or 11 of 80 samples.
OpenAI found that GPT-6.1 Sol did so in just 1.25%.
"These results indicate that performance is comparable to 6.0 Sol," OpenAI noted, adding that much of the regression against GPT-6.1 Sol involved promises of future help that Terra indicated it would not actually carry out.
OpenAI warns that these tests were conducted in simulated environments, so the results may not necessarily reflect how GPT-6.1 Terra behaves in real-world production environments.
But we still aren't seeing meaningful improvements across every area of security, even as these companies claim their models can control computers and code better.
Transforming Donors: The Revolution Could Be Funded
OrganizingUp
convergencemag.com
2026-10-27 18:38:56
When funders are retrenching and we’re worried about making our budget, it can be hard to dream wildly about how to sustain not just our own organizations, but a vibrant Left ecosystem that has enough funding and scaled infrastructure to steadily march us past both authoritarianism and the racist ne...
Portable power stations
Reviewers
10%
·
owners
21%
Electric bikes
Reviewers
5%
·
owners
11%
Electric scooters
Reviewers
13%
·
owners
19%
Smart glasses
Reviewers
1%
·
owners
5%
Smart locks
Reviewers
6%
·
owners
10%
Coffee machines
Reviewers
17%
·
owners
18%
Smart rings
Reviewers
10%
·
owners
11%
Tennis ball machines
Reviewers
16%
·
owners
13%
The numbers behind the chart
Share of opinions about reliability, durability and support, by category and platform
Category
Reviewers (YouTube)
Owners (Reddit)
Self-cleaning litter boxes
3%
(
5
of
181
)
39%
(
23
of
59
)
Laser engravers
14%
(
15
of
106
)
41%
(
30
of
74
)
Robot lawn mowers
9%
(
23
of
259
)
27%
(
32
of
117
)
Robot vacuums
1%
(
12
of
975
)
18%
(
84
of
466
)
Robot pool cleaners
9%
(
31
of
337
)
25%
(
13
of
53
)
3D printers
11%
(
87
of
762
)
22%
(
103
of
465
)
Portable power stations
10%
(
113
of
1,126
)
21%
(
57
of
275
)
Electric bikes
5%
(
75
of
1,527
)
11%
(
84
of
782
)
Electric scooters
13%
(
71
of
551
)
19%
(
61
of
329
)
Smart glasses
1%
(
2
of
276
)
5%
(
11
of
215
)
Smart locks
6%
(
10
of
170
)
10%
(
11
of
109
)
Coffee machines
17%
(
63
of
375
)
18%
(
70
of
394
)
Smart rings
10%
(
21
of
205
)
11%
(
15
of
138
)
Tennis ball machines
16%
(
8
of
50
)
13%
(
12
of
91
)
Across these
14
categories:
7.8%
of reviewer opinions vs
17.0%
of owner opinions.
Owners bring it up more in 13 of the 14; tennis ball machines are the exception, with only 91 owner opinions.
6,900
opinions from YouTube reviews and
3,567
from Reddit threads.
Left out: video doorbells, smart thermostats, mechanical keyboards and 3D scanners, where reliability isn't a topic of its own (it's folded into a broader one such as "Connection, Reliability & Support")
, and pickleball machines, which have no Reddit threads yet.
Most of what breaks shows up after the review is done
Robot vacuums:
reliability comes up in
1%
of reviewer opinions and
18%
of owner opinions. A review covers a few weeks; the failures owners write about tend to come months later.
Self-cleaning litter boxes:
3%
vs
39%
. Owners mostly describe breakdowns and how long a replacement takes.
When owners do bring it up,
70%
of what they say is negative. Reviewers who mention it are negative
15%
of the time.
Apps:
the same attention, the opposite verdict
Reviewers and owners talk about apps, software and connectivity
about equally often
(
8.2%
vs
9.4%
of opinions). They don't agree on them:
21%
of reviewer opinions on apps are negative, compared with
71%
of owner opinions.
Apps, software and connectivity: share of opinions that are negative
Mechanical keyboards
Reviewers
17%
·
owners
75%
Smart locks
Reviewers
17%
·
owners
72%
Portable power stations
Reviewers
15%
·
owners
69%
3D scanners
Reviewers
28%
·
owners
72%
Robot vacuums
Reviewers
9%
·
owners
50%
Smart rings
Reviewers
42%
·
owners
75%
Smart glasses
Reviewers
38%
·
owners
71%
3D printers
Reviewers
61%
·
owners
85%
Categories with at least
20
positive or negative owner opinions on apps.
Owners are more negative in all eight.
Two products show where this ends up:
A
$7,999
laser engraver
ranks last of 9
.
The
Glowforge Pro
gets 8 positive and 0 negative opinions on setup and ease of use.
It loses on software and connectivity (
3 positive, 7 negative
)
and on reliability and support (2 positive, 7 negative)
. Owners mostly object to a paid software subscription and needing an internet connection to use the machine.
A
$350
smart lock
ranks last of 20
.
The
Eufy FamiLock S3
has
0
positive and
7
negative opinions on its app and smart-home features, mostly about a firmware update that left locks unusable.
All 10 of its sources are Reddit threads.
If you're about to buy
Search owner threads for the model plus "months" or "a year later", not just the launch reviews.
Check whether the device still works if the app or the company's servers go away.
Look at the warranty length and how owners describe getting a replacement.
Read this before the numbers
Reviewers aren't hiding anything.
Most reviews are made in the first days or weeks with a new unit. That's too early for most failures, and it's hard to test a company's support.
Owners post when something goes wrong.
Nobody starts a thread to say their robot vacuum still works, so these numbers show what owners worry about, not how often things break. For scale: across all topics,
56%
of owner opinions and
15%
of reviewer opinions are negative. Reliability (
70%
) and apps (
71%
) are still well above the owners' own average.
Topic grouping matters.
If we also count mixed topics such as "Value & Support" or "Responsiveness & Key Reliability", owners bring up reliability
2.4
times as often
instead of twice
, and more in
all 17 categories that have owner opinions
. We lead with the stricter number. The same goes for apps: mixed topics like "Connectivity & Battery" are left out.
Some YouTube reviews are sponsored.
We count them like any other source and can't reliably tell which ones are.
An AI model labels each opinion
with a topic and as positive or negative. Every opinion links back to the sentence it came from, so any of them can be checked.
Method
Sources:
YouTube reviews and Reddit threads about
657
products currently on sale in
19
categories, collected for BettaScore's rankings:
8,062
opinions from YouTube and
4,525
from Reddit. Review sites, forums and Hacker News (
517
opinions) aren't in the comparison.
What counts as an opinion:
one source's view on one topic of one product. A source that covers five topics counts five times; a source that mentions a topic ten times counts once.
Topic groups:
reliability is any topic about reliability, durability, warranty, service or support; apps is any topic about apps, software, firmware or connectivity. Mixed topics are left out of both.
Shares:
opinions in a topic group ÷ all opinions from that platform, including neutral ones. Negative shares count positive and negative opinions only.
About BettaScore
BettaScore ranks products by what public reviews say about them. No brand pays to be listed or to rank higher, and our shopping links earn nothing.
The rankings
Now see who comes out on top
Each ranking shows what owners and reviewers say about every model, reliability included, with the quotes behind each score.
Siri AI Expands to More Languages in OS 27.2
Daring Fireball
nr.apple.com
2026-10-27 18:19:39
Apple Newsroom yesterday:
With the 27.2 software updates released today, Siri AI — an
entirely new version of Siri that is profoundly more capable,
conversational, and personal — is expanding to more people around
the world, with availability now in the French, Japanese, Korean,
Portuguese, and ...
Siri AI is available in more languages starting today
With the 27.2 software updates released today, Siri AI — an entirely new version of Siri that is profoundly more capable, conversational, and personal — is expanding to more people around the world, with availability now in the French, Japanese, Korean, Portuguese, and Spanish languages.
Siri AI is a completely reimagined version of Siri that is more personal and powerful, without compromising users’ privacy. Built on Apple Intelligence, it draws on personal context understanding to help users find what they need in the moment across their messages, emails, photos, and more. With even more systemwide app actions, Siri AI can help users with tasks such as drafting an email from scratch or editing and sharing a set of photos. With onscreen awareness, Siri AI can answer questions or take actions related to the content on a user’s screen. It can also use broad world knowledge to get up-to-date information on virtually any topic.
Language support for Siri AI will continue to expand, with availability in Chinese (traditional), Norwegian, Turkish, and Vietnamese coming by the end of the year.
Apple Intelligence is available with Siri and device language set to Chinese (simplified), Chinese (traditional), Danish, Dutch, English, French, German, Italian, Japanese, Korean, Norwegian, Portuguese, Spanish, Swedish, Turkish, or Vietnamese. Some features may not be available in all regions or languages. Some devices may not be available in all regions.
Siri AI is available in beta in iOS 27.2, iPadOS 27.2, macOS 27.2, watchOS 27.2, and visionOS 27.2 and requires an Apple Intelligence-enabled device set to a supported language. It is available in English, French, Japanese, Korean, Portuguese, and Spanish. Some features may not be available in all regions or languages.
Siri AI is currently unavailable in the EU in iOS, iPadOS, and watchOS. Apple is working constructively with the EU in an attempt to find a path forward.
Siri AI is not available for users under 13.
Certain Apple Intelligence features that rely on server-side models are subject to daily usage limits, including but not limited to Siri AI, intelligent photo editing tools, Image Playground, and AFM 3 Cloud models in Shortcuts. Daily limits may vary by feature, request complexity, system demand, system policies, and other factors. Expanded access to such features will be available for a fee in the future. Use of these features is subject to the Apple Intelligence terms and conditions. Learn more at
support.apple.com/en-us/148587
.
Stay up to date with the latest articles from Apple Newsroom.
UNM Health ransomware attack disrupts patient care, surgeries
Bleeping Computer
www.bleepingcomputer.com
2026-10-27 18:07:34
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]...
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities.
On Monday, UNM Health, the university’s healthcare provider, began temporarily limiting new patient admissions, diverting ambulances to nearby hospitals, and suspending outpatient surgeries and appointments.
In an update on the incident, UNM said UNM Hospital and Sandoval Regional Medical Center remain open, and all clinics will resume scheduled appointments and procedures starting today, Tuesday, October 27.
Regarding emergencies, the healthcare organization advised that people should call 911.
However, today’s classes at its four health sciences schools are canceled, and nonessential HSC employees were instructed to stay home.
UNM Health is a
major statewide provider
of specialist care with more than 1 million patient visits annually.
Its flagship UNM Hospital in Albuquerque houses New Mexico’s
only Level I trauma center
, treating the most seriously injured patients.
Byod ransomware claims the attack
UNM did not disclose the type of cyberattack it suffered, but BleepingComputer found that a new ransomware group called Byod had claimed the attack.
In a post on their data leak site, the threat actor said it had compromised 36,000 systems across UNM’s main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases.
"This is your entire network and infrastructure compromised, the entire university COMPLETELY," the threat actor said.
They claim access to student and employee personal data, including:
Social Security numbers (SSNs)
HR, payroll, and Banner student records
Internal emails
Research data
Hospital appointment data
Patient information
Cerner EHR rosters
In an attempt to force a payment, Byod ransomware said it would take down the breach post after the university initiated communication, likely for negotiating a ransom.
BleepingComputer has reached out to UNM Health Sciences with a request for comment about these data theft allegations, but we have not received a response.
In a new post today, Byod ransomware said it would provide free keys that decrypt locked systems at healthcare facilities.
Caption
Furthermore, the threat actor promised to pay up to $2,500 for every patient affected by the cyberattack.
"We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data," the cybercriminals said.
However, the threat actor also said that it would keep all the stolen data.
Byod is a new ransomware gang that currently lists six victims on its data leak site. For three of them, it has already leaked the allegedly stolen data.
On its FAQ page, the threat group claims it is doing “pentesting” to expose vulnerabilities and hold data controllers accountable for breaches.
Source: BleepingComputer
Byod says no target is off-limits, but it selects victims after an initial assessment identifies a target of interest. The group says it focuses on “those at the top who look at consumers and/or customers as a number or another dollar in their pockets.”
The
UNM Health Sciences said today
that all its critical electronic systems are back online and all UNM Health hospitals are fully open. Ambulance traffic is now operating normally, and all clinics have resumed scheduled appointments and procedures.
The university said the quick recovery was possible due to IT security teams working "with external partners to secure the network."
"Their assessment determined that the event affected some end-user devices but did not penetrate core systems or servers," UNM Health Sciences Center notes.
Patients who received care at UNM hospitals, as well as staff and students who work and study there, are advised to remain vigilant for unsolicited communications and phishing attacks.
Apple Creator Studio Updated With a Slew of AI Features, Along With a New Open JSON File Format for Keynote
Daring Fireball
www.apple.com
2026-10-27 18:00:04
Apple Newsroom, with software news for Apple’s “Pro and Tell” week:
Apple today introduced transformative updates to Apple Creator
Studio, the powerful collection of creative apps designed to
put studio-grade tools into the hands of modern creators across
Mac, iPad, and iPhone. Final Cut Pro fo...
Apple Creator Studio adds powerful new AI features and even more creative tools
Updates bring built-in MotionVFX content to Final Cut Pro, video assets in the Content Hub, expanded music creation tools to Logic Pro, and new intelligence features to Logic Pro, Keynote, Pages, and Numbers
Apple Creator Studio gets transformative updates, including built-in MotionVFX content for Final Cut Pro, video assets in the Content Hub, expanded music creation tools in Logic Pro, and new intelligence features in Logic Pro, Keynote, Pages, and Numbers.
CUPERTINO, CALIFORNIA
Apple today introduced transformative updates to
Apple Creator Studio
, the powerful collection of creative apps designed to put studio-grade tools into the hands of modern creators across Mac, iPad, and iPhone. Final Cut Pro for Mac now includes built-in MotionVFX — an expansive collection of visual effects, plug-ins, transitions, templates, and motion graphics tools — as well as seamless editing in Pixelmator Pro. Apple’s curated Content Hub now includes video assets and is available in Final Cut Pro. Music creators using Logic Pro for Mac gain a new intelligent assistant in beta,
1
an enhanced Stem Splitter that now separates drums, and a redesigned Browser that incorporates all sounds, with music understanding and even a Splice library. Pixelmator Pro introduces Generate Fill, which lets creators transform selected areas of an image using natural language. Keynote, Pages, and Numbers introduce new AI features in beta, including assistants
2
that understand document context and new Model Context Protocol (MCP) support for workflow automation.
3
They also add stock video in the Content Hub and new premium themes and templates.
Apple Creator Studio updates will be available on the App Store this November as a free update for existing subscribers.
4
“This is our most exciting update since the launch of Apple Creator Studio. MotionVFX content in Final Cut Pro gives subscribers rapid access to extensive professional video effects and content, bringing incredible value to the suite,” said Brent Chiu-Watson, Apple’s senior director of Worldwide Product Marketing for Apps and iCloud. “Logic Pro’s new Browser allows users to explore and experiment with more sounds than ever as they create music. Pixelmator Pro’s sophisticated fill capabilities now let users completely reimagine any part of an image. And the assistant capabilities in Logic Pro, Keynote, Pages, and Numbers are going to change the game for how people interact with and learn to use these apps.”
Expansive New Creative Toolkits and Video Workflows
Final Cut Pro for Mac and iPad delivers an exceptional set of new capabilities for video editors, content creators, and filmmakers, from emerging storytellers to seasoned professionals deep in complex edits. Final Cut Pro for Mac now integrates MotionVFX directly into the app, giving editors access to thousands of elements, including templates with unique themes, stylish graphics, titles, and transitions, as well as tools for rotoscoping, tracking, and color grading. Editors can also tap into the Content Hub directly within Final Cut Pro and access a library of Apple-curated stock videos, photos, and backgrounds to fill gaps, add polish, or spark new ideas without leaving their workflow.
Final Cut Pro for Mac now integrates MotionVFX directly into the app, giving editors access to thousands of elements, including templates with unique themes, stylish graphics, titles, and transitions.
Editors can tap into the Content Hub directly within Final Cut Pro and access a library of Apple-curated stock video, photos, and backgrounds to fill gaps, add polish, or spark new ideas without leaving their workflow.
Cross-app workflows and visual creation also take a major leap forward in Final Cut Pro. Editors can open any image from their timeline directly in Pixelmator Pro, take advantage of advanced editing tools, and save changes back to the project automatically — no reimporting required. With advanced image generation, users can create stunning images from text descriptions right inside their project, apply quick edits, and adjust visual styles. And Final Cut Pro introduces powerful workflow improvements, including more keyframe easing options for finer animation control, the ability to disconnect clips from the primary storyline to place them anywhere on the timeline, and 23 new transcription languages, making it easier than ever to caption and search footage.
Final Cut Pro users can now open any image from their timeline directly in Pixelmator Pro to take advantage of advanced editing tools.
Final Cut Pro introduces more keyframe easing options for finer animation control, the ability to disconnect clips from the primary storyline to place them anywhere on the timeline, and 23 new transcription languages.
Final Cut Pro introduces more keyframe easing options for finer animation control, the ability to disconnect clips from the primary storyline to place them anywhere on the timeline, and 23 new transcription languages.
Final Cut Pro introduces more keyframe easing options for finer animation control, the ability to disconnect clips from the primary storyline to place them anywhere on the timeline, and 23 new transcription languages.
Motion also adds a built-in set of powerful MotionVFX plug-ins for cinematic color grading, 3D camera tracking, and one-click selection for stunning visual effects. Users can now generate and edit images from text descriptions, send images round-trip to Pixelmator Pro, fine-tune keyframe easing, and apply an all-new Displacement filter. Additionally, Compressor introduces the ability to encode Cinematic mode video recorded on iPhone 18 Pro and iPhone Duo.
Reimagined Image Editing
Pixelmator Pro introduces Generate Fill, a powerful new tool to edit images based on a user’s description. Creators can simply circle an area in an image and describe the change they want. For more precision, creators can use existing Pixelmator Pro selection tools, like Free Selection, Quick Selection, or Magnetic Selection. Generate Fill automatically matches the lighting, perspective, and texture of the surrounding environment so edits blend in seamlessly, while built-in Super Resolution upscales the generated content so it stays sharp at any size. Generated elements can be merged into existing layers or inserted as new layers with intelligent masking that allows for continued refinement.
Generate Fill, a powerful new tool for editing images based on a user’s description, comes to Pixelmator Pro.
Taking Music Creation Even Further
Logic Pro for Mac and iPad brings sophisticated, intuitive new tools for beat making, songwriting, remixing, and production. It also gets an all-new design featuring Liquid Glass, with translucent surfaces and deeper contrast that highlight waveforms and tracks.
Logic Pro for Mac and iPad gets an all-new design featuring Liquid Glass, with translucent surfaces and deeper contrast that highlight waveforms and tracks.
A new intelligent assistant powered by a combination of Apple-built and third-party models joins Logic Pro for Mac, helping creators and producers navigate production workflows, start a new song, set up a vocal track from a single prompt, or refine an active project.¹ Finding the perfect sound is faster and more intuitive than ever with a redesigned Browser on Mac that centralizes loops, instruments, effect patches, and more. Powered by music understanding — an on-device audio analysis tool — Logic Pro automatically analyzes, classifies, and tags added sounds so creators can easily search their entire collection or drag in a loop to surface matching audio.
A new intelligent assistant in Logic Pro for Mac helps creators and producers navigate production workflows, start a new song, set up a vocal track from a single prompt, or refine an active project.
Logic Pro’s redesigned Browser on Mac centralizes loops, instruments, effect patches, and more, so finding the perfect sound is faster and more intuitive than ever.
Logic Pro’s industry-leading Stem Splitter gets even more advanced, with the ability to isolate, replace, or rebalance drum parts without needing the original multitracks. Users can also unlock a new Producer Pack from the 20-time Grammy winner and visionary widely known as the King of Modern Salsa, Sergio George. In this Producer Pack, George opens up his toolbox with his signature piano sound and authentic Latin jazz and salsa loops, including a full salsa percussion section, brass ensemble, and basses.
Logic Pro’s Stem Splitter gets even more advanced, with the ability to isolate, replace, or rebalance drum parts without needing the original multitracks.
A new Producer Pack from 20-time Grammy winner Sergio George gives users access to his signature piano sound and authentic Latin jazz and salsa loops.
With Voice Memo Studio Sound, users can also reduce room ambience and background noise in recordings captured on supported iPhone models, with the option to continue fine-tuning in Logic Pro.
Powering Productivity with In-App Intelligence
Visual productivity apps receive a new generation of intelligence features for subscribers, including an intelligent assistant, built on Apple models and OpenAI, directly within Keynote, Pages, and Numbers. The assistant understands document context to help users accomplish more without leaving their work.² In Keynote, the intelligent assistant helps with designing, animating, and refining slides. In Pages, it drafts, restructures, and fine-tunes written content. In Numbers, it calculates, visualizes, and organizes data; recommends suitable chart types with a one-tap preview; and builds custom tables using world knowledge. New MCP support, built on this platform, enables external AI agents and tools to read content, perform edits, and execute automated actions directly in Keynote, Pages, and Numbers.
Keynote, Pages, and Numbers each introduce an intelligent assistant that understands document context, helping users accomplish more without leaving their work.
MCP support enables external AI agents and tools to read content, perform edits, and execute automated actions directly in Keynote, Pages, and Numbers.
More Creative Options and Formats
Across Keynote, Pages, and Numbers, the Content Hub expands to include Apple-curated stock video footage, giving creators dynamic visuals to enhance presentations, reports, and spreadsheets. Subscribers also gain access to a fresh collection of professionally designed templates and themes. Keynote introduces support for Keynote Interchange Format (.keyx), an open JSON-based bundle file format designed to be readable and accessible to external tools, developer workflows, and AI agents.
Freeform adds text styles for one-step formatting and reuse across boards, custom and preset board background colors, and, arriving in December, the ability to edit images directly in Pixelmator Pro and generate editable shapes from text descriptions.
Apple Creator Studio updates will be available on the App Store this November for free for existing subscribers. New subscribers pay
$12.99
(U.S.) per month or
$129
(U.S.) per year. All new subscribers will enjoy a one-month free trial of Apple Creator Studio, and with the purchase of a new Mac or qualifying iPad, customers can receive three months of Apple Creator Studio for free.
5
Education savings are available for college students and educators for
$2.99
(U.S.) per month or
$29.99
(U.S.) per year.
6
Apple Creator Studio is available to download on the App Store as a universal purchase.
Up to six family members can share all of the apps and content included in Apple Creator Studio with Family Sharing.
One-time-purchase versions of Final Cut Pro (
$299.99
U.S.), Logic Pro (
$199.99
U.S.), Pixelmator Pro (
$49.99
U.S.), Motion (
$49.99
U.S.), Compressor (
$49.99
U.S.), and MainStage (
$29.99
U.S.) are available on the Mac App Store.
7
Free versions of Keynote, Pages, Numbers, and Freeform continue to be available and are included with every new iPhone, Mac, and iPad.
The assistant (beta) in Logic Pro for Mac requires macOS 27 Golden Gate or later on an Apple Intelligence-capable Mac and is available in U.S. English only.
The assistant (beta) in Keynote, Pages, and Numbers requires an Apple Intelligence-capable device running iOS 27, iPadOS 27, or macOS 27 or later, and is available in U.S. English only.
Model Context Protocol (MCP) in Keynote, Pages, and Numbers requires macOS 27 or later.
The Apple Creator Studio version of Final Cut Pro for Mac requires macOS 26.6 or later and a Mac with Intel or Apple silicon (some features require Apple silicon). Final Cut Pro for iPad requires iPadOS 26.6 or later and an iPad with an A16, A17 Pro, or M1 chip or later. Final Cut Camera requires an iPhone or iPad running iOS 26.6 or iPadOS 26.6 or later. Logic Pro for Mac requires macOS 26.1 or later and a Mac with Apple silicon. Logic Pro for iPad requires iPadOS 26 or later and an iPad with an Apple A12 Bionic chip or later. Pixelmator Pro requires macOS 26 or later for Mac (Intel or Apple silicon; some features require Apple silicon) and iPadOS 26 or later for iPad (A16, A17 Pro, or M1 chip or later). Motion requires macOS 15.6 or later. Compressor requires macOS 15.6 or later and a Mac with Intel or Apple silicon (Apple Immersive Video processing requires 32GB of RAM, with 64GB and storage read speeds of 2,000MB/s or faster recommended; some features require Apple silicon). Keynote, Pages, Numbers, and Freeform require macOS 26, iOS 26, or iPadOS 26 or later.
Available to new and qualified returning subscribers who purchase a new Mac or qualifying iPad from Apple or an Apple Authorized Reseller. iPad must have at least 6GB of memory and an A16, A17 Pro, or M-series chip or later. Plan renews at $12.99 per month or $129 per year based on the plan selected. Only one offer per Apple Account and only one offer per family if they’re part of a Family Sharing group, regardless of the number of devices that they or their family purchase. This offer is not available if the account holder or their family has previously accepted an Apple Creator Studio subscription three-months-free offer. Offer good for three months after eligible device activation. Plan automatically renews until cancelled. Restrictions and other terms apply.
New subscribers only. Education Savings Plan automatically renews at $2.99 per month or $29.99 per year based on the plan selected, until cancelled. Offer good for college students and educators only and does not extend to a Family Sharing group. Verification required. Terms apply. Limited-time offer; offer may end at any time.
The one-time-purchase version of Final Cut Pro requires macOS 26.6 or later, Logic Pro requires macOS 26.1 or later, and Pixelmator Pro requires macOS 26 or later. MainStage requires macOS 15.6 or later and a Mac with Apple silicon. Motion requires macOS 15.6 or later. Compressor requires macOS 15.6 or later, and some features require a Mac with Apple silicon.
Stay up to date with the latest articles from Apple Newsroom.
★ Prestructured WYSIWYG
Daring Fireball
daringfireball.net
2026-10-27 17:24:20
Even if you’re a decent designer (or believe yourself to be), it’s liberating not to have a say in the matter. Constraints are sometimes freeing....
One of the many small pleasures of my job is when someone else writes a good take on a subject that I have been meaning to write myself. Occasionally this stings, because it was something I really wanted to write myself. But usually it’s just awesome, because it’s an article I wanted to exist, didn’t really want to do the work of writing myself, and now it exists and I can just link to it, perhaps with commentary. It’s like finding money on the ground or in the pocket of a jacket you haven’t worn in months.
But one of the reasons I’d been procrastinating on writing about Apple Notes and its growing support for Markdown import/export and copy/paste is that Notes is built around a text formatting idea that, to my knowledge, doesn’t really have a name. And without a name, it’s hard to write about. I’m going to suggest calling it
prestructured WYSIWYG
.
Apps like Apple’s Messages and especially Notes exemplify prestructured WYSIWYG, and I’m a huge fan of the idea. It’s low-key one of the best ideas and trends in software design of the last 15 years or so. Messages lets you apply WYSIWYG spans of character styles like bold and italics, but you can’t choose typefaces or define your own styles. Notes takes this further, adding inline hyperlinks and predefined block styles like title / heading / subheading, monostyled (e.g. for code), and ordered and unordered lists. But there is no Font menu or preference setting in Notes or Messages to change the default typeface. The “Aᴀ” formatting popover in Notes doesn’t have a control to change the typeface, only its preset styles, all of which are rendered in your notes using Apple’s San Francisco system font family.
1
That would have seemed not just weird but downright wrong back in the early decades of the Mac (the era Fleishman calls the “Mac Is Not a Typewriter” era, referencing
Robin Williams’s groundbreaking book
). In those days, text was either plain text (a string of characters, no style at all, like a typewriter) or rich text, and if it was rich text, you expected to choose any font (and size) you wanted.
That era of anything-goes WYSIWYG presented unavoidable problems. On the technical side, the list of fonts installed on
my
computer isn’t the same as the list of fonts on
your
computer. Each operating system comes with its own set of included fonts. And the sort of people most interested in selecting their own typefaces are exactly the same people who are most likely to install third-party fonts. That’s a technical problem that can’t really be solved. There’s also an aesthetic problem. Most people, given the ability to choose their own fonts, make terrible typographic choices.
Prestructured WYSIWYG solves both problems. You get the expressiveness of abstract semantic styles like bold, italics, and monospace, and you get larger sizes for headings. But you avoid both the “missing font” technical problems
and
the “terrible font” design choices. If you use Apple Notes or Messages, you better like Apple’s San Francisco system font family, because that’s what you’re going to get. It’s great for accessibility, because all the type sizes are relative, not absolute. And these preset styles largely map well to Markdown, which itself has no concern with font choices or specific text sizes.
Even if you’re a decent designer (or believe yourself to be), it’s liberating not to have a say in the matter in certain contexts. Note-taking is exactly such a context. Email ought to be another, but alas, full-fledged WYSIWYG gained a foothold there long ago, and now it’s entrenched. Constraints are sometimes freeing.
Social Media When Elections Are Close: Doing the Impossible Better
Electronic Frontier Foundation
www.eff.org
2026-10-27 17:20:30
Everyone knows, or should, that perfect (balanced, targeted, transparent, swift and swiftly appealable) content moderation at scale is impossible. That doesn’t mean powerful social platforms don’t have to try to get at least reasonably close, especially when access to good information can have a pro...
Everyone knows, or should, that perfect (balanced, targeted, transparent, swift and swiftly appealable) content moderation at scale is impossible. That doesn’t mean powerful social platforms don’t have to try to get at least reasonably close, especially when access to good information can have a profound effect on political participation and speech.
That’s why so many people, including the
Meta Oversight Board
, criticized Meta for suspending a major
political Instagram account
for hours during a huge early voting push on October 17; and
for allegedly
boosting one candidate in Brazil’s recent presidential election. Meta denies deliberate interference in either instance, blaming
“mistakes”
in its automated content moderation systems (including AI tools that can’t tell the difference between enthusiastic follower engagement and a bot attack).
Mistakes or not, with early voting in the U.S. midterms already underway, these events serve as a stark reminder that all major social media platforms need to have stronger systems in place to ensure that they serve, rather than impede, democratic communication.
Access to good information can have a profound effect on political participation and speech.
This is not inherently an “AI” problem: automated systems can process content at a scale that humans never could, potentially enabling better moderation at scale and alleviating the psychological load on ill-paid moderators whose jobs require them to view incredibly disturbing content. But automated systems also reproduce existing biases, struggle to understand context, and often make mistakes that disproportionately affect journalists, activists, artists, and other vulnerable and marginalized communities. And moderation errors are even more likely when the language is spoken principally by the global majority. In 2020, leaked document showed that Meta’s algorithms incorrectly
deleted nonviolent Arabic-language content
77 percent of the time, while
failing to detect hate speech
under the company’s own policies in many instances. Where these systems are faltering in Arabic, they’re positively failing in less-resourced languages. As a
2025 report
from the Center for Democracy and Technology found, labeled datasets in certain languages and dialects such as Maghrebi Arabic and Kiswahili contain inconsistencies, bias, and inaccuracies due to the limited hiring of annotators who actually speak the languages as well as shifts in the languages themselves. An
investigation
into ChatGPT’s outputs in several low-resource languages demonstrates the depth of problem.
Fortunately, there is a great deal companies, policymakers, and civil society can do to help ensure that highly automated systems operate in ways that respect human rights, minimize predictable harms, and provide meaningful accountability when they fail. If companies are going to continue relying on automation to moderate users’ speech—and there is little reason to believe they won’t—then accountability must evolve alongside these technologies.
Companies must be transparent about when and how automation is used in content decisions.
Companies must regularly audit their automated systems for bias, with particular attention to low-resource languages, vulnerable and marginalized communities, and conflict zones.
Companies should
strengthen personal data protection
guarantees and policies. Automated content moderation often relies on personal data and profiling, so companies should think carefully about what data these systems use, what's necessary and proportionate and how their systems shape moderation outcomes.
Users must have the ability to appeal, and to provide context when they believe human or automated moderation decisions have wrongfully removed their content. Appeals should be promptly evaluated and decided by human moderators.
Companies should regularly assess the human rights impact of their moderation decisions, and issue public statements of the results
If they rely on third-party vendors, companies should carefully (and regularly) audit those vendors for compliance with these same principles
Lawmakers should avoid promoting and passing legislation that effectively or explicitly mandates automated moderation systems
Policymakers should also refrain from attempting to dictate platforms technical and design choices to favor or disfavor particular expression.
Policymakers should work to educate the public about how their personal data may be collected and used in electoral contexts.
These recommendations understand that automated content moderation isn’t just a technical problem for clever engineers and product teams to solve. Because content moderation shapes public discourse and fundamental rights, its design and oversight must respond to the concerns of policymakers, civil society, independent researchers, and the communities most affected by these systems.
One other distinct and enduring problem makes transparency, checks, and accountability all the more urgent: too few companies have far too much power over our political communication and organizing. Social media gave people the ability to wrest some control over political messaging away from media oligopolies. But we’ve met the new boss and while it’s not the same as the old boss, the song is pretty familiar. The real promise of the web to democratize communication is not likely to be met by social media oligarchs, no matter how sophisticated their content moderation practice.
The Entire Journalism Industry Is on a Collision Course With AI
Portside
portside.org
2026-10-27 17:08:42
The Entire Journalism Industry Is on a Collision Course With AI
Judy
Tue, 10/27/2026 - 17:08
...
While it is not yet possible to say that the group of technologies currently called “AI” is harmful to literally everyone, that tech is already harming large numbers of people in many different ways: jeopardizing their
jobs
,
health
,
privacy
, and
lived environment
. And I can say with certainty that the way these technologies are being built, deployed, and used has been extremely harmful to the journalism industry in general and to small news outlets in particular.
Our main complaint is that OpenAI and Microsoft took our articles without asking our permission and definitely without providing us payment of any kind, in violation of well-established copyright law, in order to build the large-language models that are the core of their AI businesses.
This is only one type of damage that the AI giants in question have inflicted on news outlets all over the U.S. and the world. And the exposure for these companies due to that damage is absolutely huge when one combines the potential amount that our lawsuit could cost OpenAI and Microsoft with the potential amount similar lawsuits could cost those defendants — as well as the
truly massive
New York Times
suit
against the same companies on the same grounds that has been
wending its way through the legal system for three years
. Which, clearly, is why we are suing on those grounds.
But there are other ways the vast corporations that make up the nascent AI industry have harmed news organizations. Perhaps the worst of those is that the volume of traffic to news outlets from web search has been dropping since the AI boom began a few years ago (a dilemma that
Truthout
leaders have ably elucidated in two
recent
commentaries
). We all rely upon that traffic for maintaining and, more importantly, growing our audiences over time. Audiences translate to revenue for news publications as with every other business on the web, be that revenue donations for nonprofit news groups or advertising for both nonprofit and commercial ones.
According to a
January 2026 report
by the University of Oxford’s Reuters Institute for the Study of Journalism that used a survey “drawn from a strategic sample of 280 digital leaders from 51 countries and territories” to look at major threats faced this year by the news industry, “Aggregate data, sourced from the analytics company Chartbeat for this report, show that Google traffic from organic search to over 2,500 sites was down by a third (33%) globally between Nov 2024 and Nov 2025 and by 38% in the United States, but it is not clear how much of this is down to AI overviews.”
The news “editors, CEOs, and digital executives” surveyed for the Reuters Institute report forecast another 43 percent drop in organic search traffic to news sites this year, but we’ll have to wait until the next report to see how accurate that prediction was.
And the fact that the study did not determine how much of that drop was due to AI search summaries does not mean that effect was insignificant. The
Pew Research Center
tracked 68,879 real Google searches by 900 U.S. adults in March 2025 and compared what happened when an AI search summary box (called “AI Overview” on Google) appeared on top of a search results page versus when it didn’t. The percentage that clicked through to a non-Google website link when there was no AI Overview box on top of the search results page was 15 percent. The percentage when there was an AI Overview box on top of the search results page was 8 percent. Meaning that almost half the people who would normally click through to a non-Google website link from Google search did not do so when an AI Overview box was present on top of a Google search results page.
The
Pew study also found
that only about 1 percent of users clicked a source link inside the AI Overview box itself. Users who saw a search summary were more likely to end their session entirely (26 percent with a summary and just 16 percent without one). So lots of people are simply reading the AI Overview on Google and then stopping their search without going to any other site, including news sites, as the Reuters Institute study showed.
Thus, a significant portion of news outlets’ audiences are being effectively blocked from finding us even as the chatbots scrape the professionally produced articles published by the news industry to answer people’s questions. This in turn strangles the reach of most news outlets and results in our audiences shrinking.
Guess what that does to our revenue streams? It’s not pretty.
All of this is happening, mind you, in an era when the news industry is already dying the death of a thousand cuts. Private equity firms and hedge funds have been buying up news outlets, mining them for profit, and selling off whatever assets were left for decades. We had already lost most of our advertising dollars to Google, our classifieds income first to Craigslist and then to other corporations, and our audiences to all the social media giants like Meta’s Facebook — which we had gamely helped bring our audiences to starting in the 2000s (“join us on Facebook!”), only to have them start to charge us to reach those same audiences not long after we helped deliver them on silver platters.
For most of the last two decades, I have been saying that the news industry is in rolling collapse, with small local and regional publications shutting down with increasing regularity.
Now I say that American journalism is in terminal collapse.
According to the
2026 State of Local News report
released this month by the Medill School of Journalism at Northwestern University, 7,500 newspaper jobs were lost nationwide between 2024 and 2025. This, in an industry where many reporters already don’t have full-time jobs but are forced to be freelancers and find other gigs outside journalism to make ends meet. Also, the report states, “In the past year, 170 newspapers have closed or merged, at a rate of nearly three a week, and many of these were the last remaining source of original news in their communities.”
The Medill report authors try to put a happy face on the situation by pointing out that their research shows that “8,400 news outlets make up the American local news ecosystem.” But they also demonstrate that we’ve had a
net loss of 3,400 local newspapers since 2005
, and that “total newspaper employment has decreased by 75% over the past two decades” (2005 to 2025).
From long experience and constant communication with dozens of fellow news publishers, I will add that I believe too many of the surviving news outlets in the U.S. are as close to shutting down as my organization — continuing to survive only by the underpaid labor of an ever-shrinking number of wildly overworked staffers shored up by a legion of “stringers” (freelancers), usually uncounted by research centers like Medill, who have little hope of ever getting a “
job
job” in a dying profession.
AI giants walking off with the content of news outlets like mine and blocking us from our audience with AI search summaries look to be the final nails in the coffin of the news industry as major news organizations join smaller ones in suffering significant staff cuts or going under outright.
As flawed as American journalism has always been, news publishers are beset by these manifold crises while the tech lords are amassing wealth at historic levels and using that wealth to dominate politics in ways that threaten democracy in the United States and beyond.
I believe that this crushing of remaining U.S. news outlets by oligarchs is not a bug but a feature of the tech-driven American economy. Billionaires in the tech industry (and other major industries besides) are singularly uninterested in anybody shining the light of day on their political and economic activities and those of their conglomerates.
That is why the Boston Institute for Nonprofit Journalism is committing to fighting tooth and nail to continue producing news in the service of democracy. And part of that fight is suing OpenAI and Microsoft for ripping us off — small and perennially on the brink of financial ruin though we have been throughout our entire 11+ year run to date.
We hope that more folks who are aware that their lives and livelihoods have been harmed by the AI giants and other tech giants will be inspired by our action and follow in our footsteps. If enough people demand redress through the legal and political system, perhaps the oligarchs will see their industries collapse before they succeed in wiping ours out — brought down by an army of regular people defending our democratic rights. On top of the deleterious effects of the growing speculative bubble forming in an AI industry unable to create products that most people are willing to pay for.
Jason Pramas is a longtime photojournalist and independent publisher. A Boston, Massachusetts, native, he is executive director of the
Boston Institute for Nonprofit Journalism
— a statewide investigative journalism incubator and wire service that he co-founded with Chris Faraone and John Loftus in 2015. Jason is also the founder of the
Alliance of Nonprofit News Outlets
, a grassroots national trade association that helped bring several plaintiffs into the independent publishers’ lawsuit against OpenAI and Microsoft.
People have always explored and modified the technologies in their lives, whether crystal radios, automobiles, or computer software.
Reverse engineering
is one expression of this tinkering impulse. Unfortunately, legal regulation of reverse engineering can impact the
Freedom to Tinker
in a variety of ways. This FAQ gives some information that may help coders reduce their legal risk.
What is this FAQ and who is it for?
This FAQ is intended for non-lawyers who want some general information about how U.S. laws might affect reverse engineering by computer programmers. This information is provided as a general guide to the issues, and is not legal or technical advice.
The legal questions raised by reverse engineering are complex and legal risks may depend on particular facts and legal doctrines that are beyond the scope of this general guide. This FAQ is meant to familiarize you with some of the principles involved, so that you can have a more effective discussion if and when you engage an attorney to help you with your specific situation.
Feel free to
contact EFF
if you need help finding a lawyer qualified to advise on reverse engineering.
First the Scary Stuff: What Kinds of Reverse Engineering Are Most Legally Risky?
^
By using the term "legally risky" here, we aren't saying that the activity is certainly legal or illegal. We're saying that these are areas where the law may apply so any researcher considering these steps should take the time to think it through and probably get some legal help.
If your access to the code or computer system you are studying is conditioned upon agreeing to any contractual terms (
e.g.
End User License Agreements (EULA), terms of service notices (TOS), terms of use notices (TOU), a non-disclosure agreement (NDA), developers agreement or API agreement), you are at greater legal risk if your research activities do not comply with their stated terms and conditions. You should talk to a lawyer before agreeing to any terms and before studying any software distributed with such terms and conditions, even if you have come into possession of that code without agreeing to anything.
It is extremely risky to disclose or use any information you obtained subject to an NDA or other negotiated contractual obligation of confidentiality.
It is legally risky to study software you do not possess legally.
It is legally risky to make any copies of software that have not been authorized by the copyright owner (such as by a license agreement).
It is legally risky to bypass any “technical protection measures” (
e.g.
, authentication handshakes, protocol encryption, password authentication, code obfuscation, code signing) that control access to the code or any specific functionality.
It is highly risky to copy any code into a program you create as a result of reverse engineering, because that copy could infringe copyright unless it is a fair use under copyright law. Note that copying can include both imitation of non-functional elements as well as verbatim duplication.
It is legally risky to perform any network packet inspection unless (1) the network is configured to be accessible to the general public; (2) you have consent of all users whose packets are intercepted; or (3) you have consent of the network provider where the inspection is necessary for provision of the service or to protect the network provider’s rights and property.
What Legal Doctrines Are Most Likely To Affect Reverse Engineering?
^
Five areas of United States law are particularly relevant for computer scientists engaging in reverse engineering:
Copyright law and fair use, codified at 17 U.S.C. 107;
Trade secret law;
The anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA), codified at 17 U.S.C. section 1201;
Contract law, if use of the software is subject to an End User License Agreement (EULA), Terms of Service notice (TOS), Terms of Use notice (TOU), Non-Disclosure Agreement (NDA), developer agreement or API agreement; and
The Electronic Communications Privacy Act, codified at 18 U.S.C. 2510 et. seq.
This FAQ does not address international or foreign law.
How Could Copyright Law Limit My Ability To Legally Reverse Engineer?
^
Reverse engineers execute code and/or make copies of software as part of analyzing the way the program works. Copyright law generally grants a certain set of exclusive rights to copyright owners, including the right to make copies of copyrighted works. Software is one category of works that are protected by copyright. As a result, if you make copies of software, you generally need either permission from the copyright owner, or your copying must fall within an exception granted by the copyright laws. Permission can be inferred from the outright sale of a copy of software or from a license agreement. The copyright exception most relevant to reverse engineering is the fair use doctrine.
Executing code also raises the possibility of copyright issues. Some courts have stated that causing code to be copied from disk into RAM may be a copy for purposes of copyright law, and if that RAM copy is unlicensed, then it is infringing. In other words, executing unlicensed code could be infringing. Further, some copyright owners argue that cached copies held in more permanent storage may be infringing.
What U.S. Copyright Law Doctrines Allow Reverse Engineering?
^
Permission:
a copyright owner can always give you permission to make copies (perhaps in a license agreement), and depending on the nature of the permission, it may authorize reverse engineering. For example, if a license agreement authorizes you to “use” the software, and it does not expressly prohibit reverse engineering, that may be all the permission you need.
Fair Use:
The fair use doctrine allows users to make unauthorized copies in certain circumstances. Courts have found that reverse engineering for interoperability, for example, can be a fair use.
Are There Court Decisions That Illustrate Reverse Engineering As Either An Infringing Or A Non-Infringing Fair Use?
^
Here are some:
In
Sega Enterprises v. Accolade,
1
the maker of a leading video game console (Sega Genesis) sued a video game publisher (Accolade) after the publisher reverse engineered the console in order to make compatible games. Accolade wired a decompiler to the console’s circuitry while loading three different, licensed games. It then compared the disassembled code in order to ascertain the interface specifications for the console. This information was then compiled in a written manual, which coders relied upon in developing Accolade’s own Genesis-compatible games. No Sega code was copied in Accolade’s games—the Accolade code was entirely original. Although Accolade initially lost in the district court, the Ninth Circuit ultimately found that Accolade’s “intermediate” copying (
i.e.
, copying solely in order to discover functional interface specifications that were then independently implemented) was a fair use, emphasizing that disassembly was the only way to gain access to the ideas and functional elements embodied in Sega’s copyrighted computer program and that Accolade had a legitimate reason for seeking such access.
(Note that Sega sold the Genesis without any license agreements, so the court had no need to address any contractual prohibitions on reverse engineering.)
Sony Computer Entertainment v. Connectix
2
involved a software publisher (Connectix) that developed software known as the Virtual Game Station that emulated the Sony PlayStation game console on Macintosh and Windows computers. Development of the Virtual Game Station required reverse engineering efforts that included extracting the BIOS of a PlayStation console and observing it in a debugger, as well as disassembling the BIOS object code. Sony sued and Connectix lost an initial skirmish and was temporarily enjoined from distributing the Virtual Game Station. Ultimately, however, the Ninth Circuit reversed that ruling, finding that Connectix’s intermediate copying was a fair use. The court emphasized that the intermediate nature of the copying (
i.e.
, no Sony BIOS code as included in the Virtual Game Station code), the necessity of reverse engineering, and the value of permitting consumers to play PlayStation games on new platforms. (As in Sega, the case did not involve any license agreements, so the court was not called upon to interpret any contractual terms against reverse engineering.)
Atari Games Corp. v. Nintendo of America, Inc.
3
:
Nintendo created a lock code – 10NES – to prevent unauthorized game cartridges from playing on the Nintendo Entertainment System (NES) console. Atari tried but failed to break 10NES by monitoring the communications between the authorized game chips and console chip, and then by physically examining the chips. The company then became a Nintendo licensee, which limited its right to access the10NES program. Under the license, Atari could develop five games per year for the NES and Nintendo would insert the 10NES code so that the games would play on the console. Atari then lied to the Copyright Office in order to get a copy of 10NES. It used that copy to debug its microscopic examination of the code from the chip. Atari then developed an original program that used none of the 10NES code, but which performed the same function. The court found that Atari infringed by reproducing a copy of 10NES that it was not authorized to possess. Any reverse engineering efforts untainted by the infringing copy, including chemically removing layers, microscopically examining the chip, transcribing the object code into a handwritten list of ones and zeros keying the information into a computer then disassembling the object code, were non-infringing fair uses. But any reverse engineering that made use of the copy purloined from the Copyright Office was improper. Finally, the Atari unlocking program was substantially similar to 10NES in ways not required to replicate the function of unlocking the NES console. Even though the program was written for a different chip and in a different programming language, these similarities suggested that the Atari program was not an independent creation, but an unauthorized copy.
Compaq Computer Corp. v. Procom Technology, Inc.
4
:
The court held that Compaq’s compilation of threshold values for parameters used to determine when failure of hard drive was imminent was sufficiently creative to be copyrightable. The company had exercised discretion in choosing number of parameters and which particular parameters to monitor, and thus these threshold values were not facts. Procom sold hard drives that were compatible with the servers marketed by Compaq and made their drives competitive with Compaq drives by copying the threshold values and thereby enabling the same failure warnings. Because Procom made a verbatim copy of these copyrighted threshold values and used them without alteration, the verbatim copies were infringing.
Blizzard v. BnetD
5
:
BnetD was an open source program that let gamers play popular Blizzard titles like World of Warcraft on servers other than Blizzard's Battle.net service, thereby offering players more options. BnetD programmers agreed to Blizzard’s EULA and Battle.net’s TOU before reverse engineering the game to create BnetD. The EULA and TOU expressly prohibited reverse engineering and hosting of Blizzard games on other servers. The Eighth Circuit held that these mass-market click-through licenses were enforceable contracts and that the programmers violated several parts of Blizzard's EULA, including the section on reverse engineering. Even though reverse engineering is a fair use under federal copyright law, the programmers waived their fair use rights through the EULA. The court also held that the programmers violated the anti-circumvention provisions of the DMCA when they programmed BnetD servers to emulate the authentication sequence or "secret handshake" between Blizzard game software and the Battle.net server. By doing so, BnetD circumvented Blizzard’s technological protection measure that controlled access to the copyrighted game software code. Further, the DMCA exception for reverse engineering to achieve interoperability with an independently created computer program did not apply. The EULA did not authorize BnetD programmers to use the game software with a non-Blizzard server. BnetD allowed infringing game software to operate. Finally, BnetD copied more code than was purely necessary for interoperability in order to provide an identical play environment.
How Could Trade Secret Law Limit Reverse Engineering?
^
Like copyright infringement, misappropriation of trade secrets can be both a civil and criminal offense. Generally, a trade secret is information that (1) derives independent economic value, actual or potential, from not being generally known to the public or to other persons who can obtain economic value from its disclosure or use; and (2) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy. Misappropriation means a wrongful taking or publication of a trade secret.
Reverse engineering generally doesn’t violate trade secret law because it is a fair and independent means of learning information, not a misappropriation. Once the information is discovered in a fair and honest way, it also can be reported without violating trade secret law.
However, reverse engineering that violates an NDA or other contractual obligation not to reverse engineer or disclose
6
may be misappropriation. Breaking a promise made in a negotiated NDA is more likely to result in a trade secret claim than violating a term in a mass market EULA. If you are subject to any contractual restrictions, whether a EULA or NDA, or if the code you are researching is generally distributed pursuant to such agreements, you should talk to a lawyer before beginning your research activities.
How Could The Anti-Circumvention Provisions of the DMCA Limit Reverse Engineering?
^
Section 17 U.S.C. 1201, the anti-circumvention provisions of the DMCA, prohibits circumvention of “technological protection measures” that “effectively control access” to copyrighted works. The law also prohibits trafficking in tools that are primarily designed, valuable or marketed for such circumvention.
In other words, section 1201 creates a potential legal obstacle for a researcher or coder if a software vendor employs mechanisms that control the way copyrighted software or other materials can be accessed or used. Many people think of section 1201 as prohibiting cracking digital rights management schemes (DRM). However, the language of section 1201 prohibits more than breaking traditional “copy-protection” mechanisms applied to DVDs and digital video downloads. It also prohibits breaking “access controls”. Software vendors have argued, or are likely to argue, that techniques such as authentication handshakes, code signing, code obfuscation, and protocol encryption all qualify as “technical protection measures” protected by the DMCA. While research on these techniques may nevertheless be legal for a variety of reasons, researchers working on encryption, security and the creation of interoperable programs have to worry about whether section 1201 applies to their research.
What Exceptions Does DMCA Section 1201 Have To Allow Reverse Engineering?
^
Section 1201 contains an exception for reverse engineering, as well as security research, encryption research, and the distribution of security tools, all of which may support reverse engineering. However, these exceptions are drafted very narrowly. If your research might implicate section 1201, consult a lawyer to see if you can do your work in a way that is allowed by one of the relevant exceptions or by an exemption periodically granted by the Copyright Office. The following factors are relevant to whether you are entitled to a reverse engineering, research or security exception. However, meeting any or all of these factors will not necessarily protect your work. The list is offered just to give you an idea of the kinds of things that distinguish permissible from impermissible reverse engineering:
You lawfully obtained the right to use a computer program;
You disclosed the information you obtained in a good faith manner that did not enable or promote copyright infringement or computer fraud;
Your sole purpose in circumventing is identifying and analyzing parts of the program needed to achieve interoperability;
The reverse engineering will reveal information necessary to achieve interoperability;
Any interoperable program you created as a result of the reverse engineering is non-infringing;
You have authorization from the owner or operator of the reverse engineered software or the protected computer system to do your research;
You are engaged in a legitimate course of study, are employed, or are appropriately trained or experienced, in the field of encryption technology.
You provide timely notice of your findings to the copyright owner.
If I Conduct Research Within The Section 1201 Exceptions, Can I Then Distribute Code Derived From That Research?
^
Even when your acts of circumventing a technological protection measure are allowed under a section 1201 exception, you may still be prohibited from trafficking in reverse engineering, encryption or security tools that circumvent. Do not distribute code or other tools that come from research regulated under Section 1201 without talking to a lawyer first. For more information, read our
FAQ on Vulnerability Reporting
.
How Could Contract Law Limit Reverse Engineering?
^
Most software today comes with EULAs, and EULAs may have “no reverse engineering” clauses. Websites or other internet services also may have TOS or TOU that purport to restrict otherwise legal research activities. Researchers and programmers sometimes receive access to code pursuant to an NDA, developer agreement or API agreement that restricts the right to report security flaws. The legal status of contractual prohibitions on security research or vulnerability reporting is still in flux. While it is more likely that a court will enforce a negotiated NDA than a mass market EULA, the law is not clear. Be sure to consult with counsel if the code you want to study is subject to any kind of contractual restriction.
How Could The Electronic Communications Privacy Act Regulate Reverse Engineering?
^
The ECPA, sections 18 U.S.C. 2510 and following, prohibit interception of electronic communications flowing over a network. Because packets are communications, network packet inspection may violate ECPA. There are many exceptions to this general prohibition. For example, the service provider may intercept and use communications as part of “any activity which is a necessary incident to the rendition of his service or to the protection of the rights or property of the provider of that service, except that a provider of wire communication service to the public shall not utilize service observing or random monitoring except for mechanical or service quality control checks.” In addition, if the parties to the communication consent, then there is also no legal problem. The ECPA is a complicated statute, so if your research involves inspecting network packets -- even you’re only interested in addressing information, such as source and destination addresses -- you should talk to a lawyer first about ensuring that your work meets one of the exceptions.
In Sum, If My Research Involves Reverse Engineering, What Can I Do To Limit My Legal Risk?
^
Consult a lawyer
Try to make only copies that are necessary for figuring out how a program works and for accessing the ideas, facts and functional concepts contained in the software.
Use less “intrusive” techniques, such as observation of inter-chip communications or step-wise debugging, before resorting to decompilation or disassembly.
Try to make only intermediate copies. Avoid using copyrighted code in the final product unless it is absolutely necessary.
Have the reverse engineering team that studies the code develop a written manual that describes the necessary interfaces in purely functional terms, then engage separate developers to build original code based on the manual and without access to the copyrighted software.
Acquire the software that you are reverse engineering legitimately. Purchase as many copies as you need to accomplish your reverse engineering. Do not use “cracked” or other adulterated versions from Internet sources.
Watch out for and do not agree to “no reverse engineering” clauses in license agreements or terms of use.
Watch out for “technical protection measures” (
e.g.
, authentication handshakes, passwords, encryption, code obfuscation) that control access to the software as a whole or to particular modules or functionality.
If your research involves interception of packets without the consent of the parties to the communication, you should consult a lawyer.
Try to avoid disseminating the results of your research in a way that promotes copyright infringement or computer fraud. See also our FAQ on
Vulnerability Reporting.
When It Comes to Trump’s Corruption, You Haven’t Seen It All
Portside
portside.org
2026-10-27 17:00:14
When It Comes to Trump’s Corruption, You Haven’t Seen It All
Judy
Tue, 10/27/2026 - 17:00
...
When It Comes to Trump’s Corruption, You Haven’t Seen It All
Published
Yuki Iwamura/Getty Images
Any way you slice or dice the productive output of the Trump White House and its Republican Party enablers, what you find is a heaving portion of deceit, double-dealing, and self-enrichment. And the public has noticed: Ahead of the midterm elections,
voters say “corruption” is their
number one concern.
In fact,
a Gallup poll
found 89 percent of Americans believe government corruption is widespread—that is the highest figure ever recorded on the subject
and
a view shared across party lines (83 percent of Republicans, 91 percent of Democrats).
So people might be primed for a new documentary that puts MAGA malfeasance under a microscope. On Tuesday, Defiance.org released
Corruptionlan
d
, an investigation into the staggering scale of corruption in Trump’s Washington. The 35-minute film is streaming free
here
.
“For two years, Trump’s scandals have hit one at a time, and each one gets buried under the next,” said Miles Taylor, executive producer of the film and the former chief of staff at the Department of Homeland Security during the first Trump administration. “So we added them up. When you put 100 episodes in one place, the scale is staggering: $377 billion in a tangled web of alleged corruption that is without any precedent in American history. Even that number undersells it, because you can’t put a price on the president’s revenge agenda and his weaponization of federal power. Every American deserves to see the full picture before they vote, and now they can.”
In the film, Taylor is joined by Donald Sherman, executive director of Citizens for Responsibility and Ethics in Washington, or CREW; together, they walk the National Mall and provide a geographic map of the Trump administration’s misdeeds. Along the way, a host of former officials and advocates give an intimate view of how long-erected safeguards against corruption were dismantled from the inside, including former DOJ Pardon Attorney Liz Oyer, former ABC News journalist Terry Moran, former FBI official Chris O’Leary, Democracy Forward president Skye Perryman, Representative Jason Crow, and others.
Viewers are going to get the kind of civic education that the political media is often incapable of providing. As the producers describe, “The documentary traces how the five ‘filters’ that historically checked presidential corruption—from White House ethics lawyers to inspectors general to Congress—have been purged, captured, or sidelined.”
As I’ve written in the past, the mainstream media has been slow on the uptake where corruption is concerned. When Hungarian strongman Viktor Orbán was defeated back in April, news outlets seemed to have been caught flat-flooted that a broad anti-corruption message could succeed so vividly in a country that seemed to be so deeply mired in authoritarianism.
Democrats, on the other hand, have been ahead of the curve. As The Washington Sun
(then doing business as NOTUS) recently reported,
“Democratic candidates are leaning into anti-corruption messaging this cycle, seeing it as an opportunity to emphasize what they see as excessive corporate influence, unethical stock trading and shady behavior from their opponents.”
“I’ve been on the receiving end of the president’s corruption,” Taylor said. “He accused me of treason and issued an executive order directing his agencies to investigate me for First Amendment protected speech. I was not afraid to call out his corruption then, and I’m not afraid now. Neither are millions of Americans who are speaking up.
“This isn’t about Republicans and Democrats anymore,” Taylor added. “It’s about a constitutional order that faces a mortal threat—and an internal rot that will destroy our republic if we don’t address it.”
With Democrats on the hunt and the public hungry to set things right,
Corruptionland
’s timely dose of Trump transgressions will add considerable fuel to a raging fire.
===
Jason Linkins is a deputy editor at
The New Republic
.
This month, I laid the traditional coding interview to rest. As a hiring manager at Anthropic, I stopped asking candidates to do them. It had a good run: Being able to quickly define problems and find elegant solutions was a weak but useful predictor for how successful you’d be on my teams. Small coding challenges in real code did tell us something meaningful about candidates.
That’s no longer true. There’s no more point in giving you a little React challenge than there is in quizzing people about assembly; Claude is now better at both. Our most impactful builders are successful regardless of how good they are at these tests.
The coding interview was, despite its ubiquity, never popular. I suspect that established engineers will still have strong reactions to its disappearance — if only for what it says about the evolution of our roles. Plenty of ink has been spilled to describe how AI is a challenge for junior developers, especially those trying to land a job. Now that I’ve seen junior people work with AI for a bit, I have a more hopeful take: Impact is less bounded by how many years of accumulated knowledge in frameworks and libraries you’ve gathered.
I’m seeing engineers who are comparatively new fly past people who are probably better coders and have been around much longer. Hunger beats tenure.
This post is my best advice for junior engineers, though “junior” is the wrong word. It’s really for engineers without social capital, status, or power.
All vision, no voice
First, know both your advantage and handicap.
Fresh eyes, even naive ones, have long been considered powerful. When I joined Stripe, founder Patrick Collison implored us newcomers to pay close attention to things that seem odd to us. His bet was that newcomers would spot friction and opportunities that old-timers had long stopped noticing.
In 1991, James March
wrote
that organizations depend on “maintaining an influx of the naive and ignorant”. When Orson Welles was asked how he got the confidence to try shots nobody had tried, he
said
: “Ignorance, sheer ignorance — you know there’s no confidence to equal it. It’s only when you know something about a profession, I think, that you’re timid or careful.”
When I joined Notion, one of my interviews involved designing an offline-mode architecture. I was baffled to hear that they considered it a “trick” interview, since an offline mode was deemed impossible. The data model was too complex for easily syncing an entire Notion workspace, and downloading individual pages was a user experience CEO Ivan Zhao would never allow. The data model complexity turned out to be true; the founder resistance didn’t. People considered it such common knowledge that nobody had checked. I, an ignorant newcomer, didn’t know better than to just ask.
It’s easy to read anecdotes like this one and see people making bad decisions. I cannot overstate how hard it is to spot these mistakes when you’re the one making them. Shortly after joining Notion, I wanted to outfit teams with large TVs to display live dashboards. I ran into organizational walls, failed, and didn’t care enough to start a whole fight.
A year later,
Ji Pei
joined as a new hire with the same idea. I scoffed and told him not to bother; I’d already tried. He’d already asked. The TVs showed up the next day. Somewhere in that year, I had become the old-timer.
The only problem with all that ignorant power: Nobody cares what you think. Most tech companies have layers of middle management to translate larger business goals into execution. Structurally, companies are often built around the idea of a few people green-lighting or blocking individual ideas. In a world where execution is expensive, you normally have to grind your way to some social status before the entire organization would “take a bet” on your idea. Org charts tend to change at a glacial pace, so even companies that believe in AI often expect junior people to simply execute their tasks faster rather than ambitiously go after business goals.
Well, good news: Execution isn’t expensive anymore.
What to do
(1) Pick business impact over backlog: In pre-AI-coding 2011, Patrick McKenzie
wrote
“engineers are hired to create business value, not to program things.”
Attach yourself, he advised, to the parts of a company that make money. Start there: Understand what your company is actually trying to accomplish (or, at a larger one, what your group or department is). Then find the right altitude — understanding what kind of goals your manager’s manager has is often a useful proxy.
(2) Pick a radical idea: Come up with a few ideas that would, if successful, dramatically improve the chances that your organization achieves those goals. Be ambitious!
(3) Build it over a weekend: I have seen small groups and solo engineers fly past the usual process of writing product requirements documents (PRDs), getting buy-in, and lobbying for time with designers or product managers by building a working prototype.
(4) Focus on one good idea: In my experience, junior people often make the mistake of cramming multiple ideas into a single prototype, hiding three excellent ideas among 20 bad ones. If your prototype involves the creation of a new programming language, a backend, and also somehow mobile apps, you’re not going to be successful. The point of creating a working prototype is to communicate an idea so well that leadership quickly understands both the opportunity and that you’re the one who can run with it.
(5) Lean into your fresh perspective: If you’re working on something user-facing, you have a unique amount of empathy for users and thus a much better sense for how the product works or doesn’t work for them. My colleagues at Slack and Notion had a hard time internalizing what using Slack or Notion is like as an external user.
If you’re working on infrastructure or tooling, you have the benefit of never having learned all the reasons things are considered “impossible”.
The future is bright
I don’t think the coding interview is going to come back. It’s easy to get sentimental given how many copies of “Algorithms and Data Structures” were bought in hopes of unlocking good jobs and a better future — or how the death of the coding interview is another milestone in software engineering reaching a new level of abstraction.
At the same time, as a longtime hater of promotions by tenure, I can’t help but be optimistic. I’ve already seen my fair share of popular apps and products made this way.
At Anthropic, people got so used to using Claude Code as a command-line interface (CLI) that it took two relatively new engineers (
Anthony Morris
and
Alice Zhao
) to whip up a working prototype over one weekend. The first public version shipped roughly eight days later. You won’t be surprised to hear that a good graphical interface for Claude Code is a very popular product.
I'm probably not the only manager trying to figure out how to interview for people who build well with AI. I haven't quite gotten there yet — but I'm scanning resumes and portfolios for little prototypes that exhibit taste, empathy, and principled thinking. If you have figured out something better, I'd love to hear how.
We are expanding our partnership with the General Services Administration (GSA) through a new agreement that gives government partners a 40% discount on Claude Enterprise, Claude for Government, and the Claude API. For the first time, the discount applies across every product surface, including when agencies buy from us directly today and through cloud providers in the coming months. The discount also extends to state, local, tribal and territorial governments.
We are also launching a dedicated program to help agencies implement and make the most of their Claude use. These programs are commonly leveraged by our private sector customers and we’re looking forward to bringing those best practices to our public sector partners in the coming weeks.
Approximately 500 US federal, state, and local government organizations now use Claude. Weekly Claude for Government active users are up about eightfold since February, and usage across federal civilian agencies has grown about 20-fold in a year. Those organizations run some of the most important systems in the country, usually on tight budgets and with long procurement cycles. This agreement is built to support that work, so they can apply Claude to hard problems without a large upfront commitment.
The discounts offered through the agreement are estimated to save the government $1 billion. Agencies are not bound by a minimum spend commitment and will be able to pay for the usage they consume.
How Claude is helping public servants get more done
Government agencies are using Claude to solve some of their most important challenges. Examples include managing backlogs, records and forms, and modernizing old code. Some of the ways agencies are using Claude include:
Utah gave Claude Code to 34 developers across 10 state agencies. 80% had a working environment within 30 minutes, 71% reported saving 20+ hours by the end of the four-week pilot.
A US state CIO confirmed their team was able to respond to a ransomware attack in 8 minutes vs. the usual 2-3 days thanks to Claude.
A US federal security team used Claude Mythos to detect and patch the vulnerability that would have allowed for the takeover of a critical production system in about two days. A human penetration test the month before had missed it.
A cybersecurity professional at a major agency found and patched bugs in critical financial systems.
A US state IT developer moved nearly 900 API methods to a new framework in two days. The project had been scoped for a month.
A US state IT director used Claude Code to document 12 legacy code repositories, mapping 467 database tables and flagging 27 risks along the way.
More than half of the US states, some of the largest localities, and some of the countries largest critical infrastructure operators
participated
in our SLTT cyber defense program.
Meeting government security requirements
Agencies can use Claude for their most sensitive unclassified work. Claude for Government, which delivers Claude's coding and agentic work capabilities and provides near-feature parity with commercial offerings at a FedRAMP High authorization level, was made
generally available
on September 30.
Agencies building their own tools can use Claude through Amazon Bedrock or Google Cloud’s Vertex AI. On Bedrock, Claude is authorized for FedRAMP High, with select models authorized for DoD IL4 and IL5 workloads in AWS GovCloud. On Vertex AI, Claude is authorized for FedRAMP High.
Claude Enterprise is in process for FedRAMP Moderate authorization through the FedRAMP 20x program, marking the next evolution of how we are bringing the same innovative technology available commercially to the government.
Getting started
Government agencies can buy Claude at the OneGov discount through GSA's Multiple Award Schedule today. Whether your department or agency already uses Claude or is interested in using it, our Public Sector team will help discuss your options.
After a year of Dioxus fullstack in production, the Rust code is the most boring part of my business. CI is the most exciting part, and not in a good way: a release build takes 90 minutes on a GitHub-hosted runner.
That year started at my previous job and continued on my own products. Back in April I wrote about
why I picked Rust for a production micro SaaS
. The short version: slower at the start, cheaper to live with later. This post is the bill.
What I’m running
SeggWat
is an in-app feedback tool for SaaS products. Its dashboard is a Dioxus 0.7 fullstack app inside a Cargo workspace: a backend crate with server functions, an auth crate, and about ten UI crates covering insights, feedback, ideas, boards, widgets and settings. Twelve crates depend on
dioxus
. Everything sits on PostgreSQL.
“Fullstack” means one Rust codebase doing three jobs. It renders on the server, runs server functions as the backend, and compiles the client to WebAssembly so the page becomes interactive.
The good
One language, all the way down
Database query, business rule, server function, button: all Rust. One toolchain, one formatter, one set of habits, one place to look when something breaks.
That sounds minor until you’re a solo founder juggling several products. I don’t have a “frontend brain” and a “backend brain” that each need warming up. I open the workspace and keep going.
The same types on both sides
This is the one I’d miss most.
A struct gets defined once. The database layer returns it, the server function sends it, and the component renders it. When I rename a field,
cargo check
gives me a list of every place that broke, including the UI. There’s no OpenAPI spec to regenerate and no TypeScript interface drifting out of sync with the backend.
The win isn’t writing code faster. It’s refactoring without fear, late at night, with nobody to review it.
The door to other platforms stays open
Dioxus can target desktop and mobile, including iOS, from the same component model. None of my products needs a native app today. But knowing I could ship one without a rewrite mattered when I decided where to put a year of work.
Production is boring
That’s the whole point. Once it compiles, it mostly just runs. A whole class of “undefined is not a function” bugs never reaches users, so the bugs that do get through are logic bugs. That’s where I’d rather spend my attention anyway.
The “boring in production” argument from April survived contact with real users.
The painful
Compile times
This is the part Rust evangelists tend to skip.
The dashboard compiles twice: once for the server and once to
wasm32
for the browser. A dozen Dioxus crates plus a macro-heavy UI add up. Locally it’s tolerable on a decent machine. CI is a different story, and the comments in my workflow files read like a diary of it:
The WASM build alone takes about 22 minutes on 6 cores.
That’s a single leaf crate: the dashboard compiled for the browser.
A release image takes about 90 minutes on a GitHub-hosted 2-core runner.
On my own VPS runner it’s around 40, and that’s the good version.
Clippy got OOM-killed.
cargo clippy --workspace --all-targets
on the 7 GB hosted runner died with exit code 143 and no diagnostics at all. The fix was a 10 GB swapfile plus
CARGO_BUILD_JOBS=1
to cut peak memory. My linter needs swap.
At some point I stopped building images on every push to main. They now build on release tags or when I trigger them by hand, because 90 billed minutes per push is a silly way to spend money.
What I tried
Caching
with
Swatinem/rust-cache
. It helps, but there’s a trap. A workflow run can only restore caches from its own ref or the default branch, and GitHub evicts caches unused for 7 days. Once I stopped building on main, release builds kept starting cold. My workaround is almost funny: after a dependency bump, I manually trigger a build on main just to keep the cache warm.
Building and testing in one go
, so the tests reuse compiled artifacts instead of compiling the world a second time.
The
mold
linker.
Nice, but linking was never the bottleneck. Compiling was.
A self-hosted runner
for the heavy builds. This was by far the biggest win, 90 minutes down to 40. It also means I now maintain a build server.
Every one of these helped. None of them changed the underlying math: two compile targets, a big dependency tree and lots of macros means a lot of compiling.
“All Rust” comes with an asterisk
The business logic is all Rust. The edges aren’t.
SeggWat’s insights page shows charts, and I couldn’t find a Rust charting library I’d trust in production. So the charts are
Chart.js
, loaded from a CDN and wrapped in about 340 lines of JavaScript that Dioxus calls through
dioxus-use-js
. Styling is Tailwind, so CI also installs Bun and runs the Tailwind CLI before Rust even starts.
I’m fine with that. It’s pragmatic. But if you’re choosing Dioxus specifically to escape JavaScript, know what you’re signing up for: Rust, plus some JS glue, plus a JS toolchain in your pipeline.
Would I do it again?
People ask, “What helps me ship fastest?” The better question is, “What helps me keep shipping without hating my life?”
For the backend, the answer is still Rust, and it isn’t close.
For the frontend, I’ve changed my mind a bit. If I were building something truly app-like, with heavy client state, offline support or a real mobile app, I’d pick Dioxus again. But most of what I build is dashboards: forms, tables, a few charts and some toggles. For that, I’m paying a 22-minute WASM tax on every release for interactivity I barely use.
What’s next: Topcoat
So my next project is going to use
Topcoat
, a new fullstack framework from the tokio-rs org,
announced in July
.
It makes the opposite bet from Dioxus. Everything renders on the server, and components are async functions that can query the database directly. For interactivity, you write
$(...)
expressions in ordinary, type-checked Rust. Topcoat evaluates them on the server for the first render and also translates them to JavaScript, so they re-run instantly in the browser. There’s no WASM bundle and no second compile target.
#[component]
async fnfaq(cx:&Cx)->Result<impl View>{let open =signal(cx,||false);Ok(view!{<button @click=$(|_e|open.set(!open.get()))>"What is Topcoat?"</button><p :hidden=$(!open.get())>"A full-stack Rust framework."</p>})}
Example from the Topcoat README.
On paper, Topcoat keeps what I love about Dioxus (one language, shared types, no API layer) and removes the part that hurts most, the 22-minute WASM build.
To be clear, this is a bet, not a result. Topcoat’s README calls it early-stage and experimental, with breaking changes expected. I’m giving up the multi-platform option. And I haven’t measured a single build yet.
I’ll write the follow-up with real numbers: compile times, CI minutes, and whatever I end up missing from Dioxus. If my release build drops from 40 minutes to 10, you’ll hear about it. If it doesn’t, you’ll hear about that too.
Hackers hijack Convertr analytics script to steal payment card data
Bleeping Computer
www.bleepingcomputer.com
2026-10-27 16:57:25
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...]...
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout.
The campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024, that focuses on infecting online stores running Magento, OpenCart, and WooCommerce platforms.
Convertr is a Brazilian e-commerce platform that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion ($370M) in sales.
E-commerce security firm Sansec says that the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertr.
Ecommerce cybersecurity company Sansec says that the attacker modified the tracker file on a self-hosted server for Plausible, an open source alternative to Google Analytics, managed by Convertr.
Sansec suspects the attackers exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr’s outdated Plausible Community Edition installation, to gain initial access. However, this hasn’t been confirmed.
After gaining access, the attackers injected malicious code into a legitimate Plausible analytics tracker hosted on Convertr’s infrastructure, which loads on the checkout pages of all merchants using the platform.
The Magecart attack chain
Source: Sansec
Sansec says that earlier versions of the skimmer used generic payment-field patterns, but by October 26, the attackers pushed a more refined version that specifically targeted Convertr’s exact payment API field names.
The injected skimmer was configured to steal the following data types from checkout pages:
Payment card number
Expiration date
CVVs code
Cardholder name
CPF taxpayer identification number
The researchers suggest that those who paid by card on a Brazilian store that contained the ‘checkout.convertr’ string in the checkout address page since October 24 should contact their bank immediately and ask to block their card.
In an update today,
Sansec confirmed
that Convertr "removed the skimmer and upgraded Plausible to a patched version," noting that the company announced it was notifying affected merchants and payment providers.
BleepingComputer has contacted Convertr for a statement on the incident, but we have not received a response yet.
Sansec researchers warned that browser caching could keep the malicious script active on impacted sites for up to 24 hours after cleanup, so customers should clear their cache before placing new orders, even after the threat has been eliminated.
One way to protect payment card details when shopping online is to use disposable virtual cards that expire immediately after a transaction.
Anthropic’s
life sciences team
is working to accelerate curing disease. Over the past several months, our scientists have engaged in deep research partnerships with six organizations developing new medicines:
BigHat Biosciences
,
Bristol Myers Squibb
,
Divergence Labs
,
Enveda
,
Generate Biomedicines
, and
The Column Group
. We've also begun drug discovery efforts of our own. In doing so, we've learned a lot about how Claude can support drug development, and how we’ll need to improve Claude further to realize AI's potential in medicine. We plan to scale this work up substantially from here
.
There are many opportunities to speed up drug development, even beyond the most commonly discussed applications of AI, like
proposing initial designs
for new molecules. Developing a drug involves many varied tasks: doing early research to identify a target for a drug and the right type of drug to engage it, designing a molecule with the right properties, optimizing it to be manufactured reliably at scale, drafting the regulatory filings needed to run clinical trials, designing and administering those trials, and much more.
Our strategy to realize AI’s medical benefits is based on having AI increasingly involved in all of these tasks. There is no single problem to solve; the bottlenecks are distributed all throughout the drug development process. The best way to identify and work through these bottlenecks is to get deeply involved in real drug programs, across many different disease areas and stages of development.
So, over the past several months, we’ve partnered with six organizations to do so. We’ve also started drug discovery efforts of our own, including programs for rare childhood forms of muscular dystrophy, where Claude handles much of the scientific and operational work.
This work serves our goals in three ways. First, it lets us better understand the strengths and limitations of our models in relation to a much wider range of drug development tasks (we’ve already prioritized specific improvements to our models based on what we’ve learned so far). Second, these programs can serve as case studies for the wider life sciences community. If Claude is to significantly increase the rate of new cures, we need to work with many more biotechnology firms and integrate Claude more deeply into their development processes. Third, these projects should, if their positive trajectories continue, have direct impact themselves. We’re optimistic that some may result in effective new medicines for the diseases they target, including food allergies, rare childhood diseases, and several forms of cancer.
In this post, we provide an update on our progress with our partners, along with technical reports and preprints that describe our thought process, methods, and early results in more detail. We then briefly outline where our work is headed next.
Case studies
Generate Biomedicines: modality engineering.
Generate Biomedicines has been working on increasing the usefulness of a cancer treatment known as CAR T-cell therapy. This therapy has historically helped treat blood cell cancers; Generate aims to reengineer it so that it can treat solid tumor cancers too. To do this, they’re aiming to shorten one part of the therapy’s genetic instructions, which would create room for additional instructions suited to other kinds of cancer. Six Generate scientists used Claude Code to propose new designs for this part. One design was about 70% shorter than the standard version, and in lab tests it was more effective: it allowed immune cells to make roughly 10 times as many receptors (the proteins they use to spot cancer cells), it killed tumor cells more efficiently, and the immune cells remained active for longer.
Read more
, and see
Generate’s technical report
.
Divergence Labs: hit generation.
Divergence Labs is working on a novel way to treat food allergies. Food allergies are set off by a reaction from a molecule called IgE, some of which is attached to our immune cells and some of which floats freely in our blood. Divergence Labs is developing drugs that would detach the IgE from our immune cells entirely, rather than solely neutralizing the IgE circulating in our blood, as standard medications do. This could provide a much more effective treatment, but it requires a precise design, with two “arms”: one that would bind tightly to IgE, and another that would help prise IgE from the immune cell. Claude converted Divergence Labs’ goals into a detailed design plan, and then, largely autonomously, generated roughly 35,000 antibody designs in about a month to be narrowed down and tested. In those early tests, Divergence found “hits” for both arms: three designs that could bind to IgE, and 20 that could dislodge it. Three of those 20 appeared to dislodge IgE more than the standard medication. Its next step is to build a drug that combines the two arms.
Read more
, and see
Divergence’s technical report
.
BigHat Biosciences: lead optimization.
BigHat Biosciences pairs AI with an automated lab to improve potential drugs (or “leads”), which must bind their target tightly, remain stable through manufacturing and storage, and avoid clumping together (among other criteria). BigHat’s scientists and an Anthropic researcher worked with Claude to improve these three properties in two leads, both antibody fragments that could become parts of future drugs: one designed to target cancer cells, and one designed to keep a drug in the body longer. Claude, connected to BigHat’s lab data system, Reccy, proposed changes to each molecule, and BigHat’s lab made and tested about 1,010 variants in about 10 weeks. Partway through, the team suspected the standard heat-stability and clumping metrics were misleading. Claude and the researcher reanalyzed the raw data, then proposed different metrics and a protocol change to test them. BigHat’s scientists refined and ran it, and the main predictions held. Compared with the originals, the best versions bound more than 10x more tightly, the cancer-targeting lead stayed in solution 18°C higher, and the lead for longer-lasting drugs clumped more than 100x more slowly.
Read more
, and see
BigHat’s technical report
.
Enveda: manufacturing and filings.
To conduct clinical trials, companies need records showing that each batch of a new drug has been made to strict quality standards, and to submit an application to regulators, among other requirements. At Enveda, manufacturing chemists spent up to 75% of their time on paperwork. To ease the load, Enveda built a system that connects all of its manufacturing documents to Claude, then lets Claude flag any possible issues. Over tests on 1,061 pages of documentation, Claude caught all 11 issues that human reviewers had spotted—and flagged seven they’d missed. In the process, this method reduced human review time by 89%, from over 25 hours to less than three. Separately, Claude wrote the first drafts of two important regulatory documents. One took four hours, compared to about three months by hand. For the other, Enveda’s standard human review process found one minor error.
Read more
, and see
Enveda’s technical report
.
The Column Group (TCG): company creation.
Because drug discovery can be slow, expensive, and prone to failure, investors in biotechnology companies have favored safer, previously validated ideas over riskier new ones, even when the latter could help more patients. We’ve been working with TCG to see whether Claude can change this by cutting the time and cost of drug discovery so that investors can confidently support more ambitious ideas. Specifically, TCG is establishing Pleiades, a new company that will use Claude to run many more—and more complex—drug programs than is usual for a small team. This could be a model for how Claude can reduce both the scientific and the operational and administrative overhead required to run a biotechnology company. If this works, this model could be replicated across the industry and direct investment toward harder problems in medicine. Pleiades is currently developing new tools and workflows for Claude; its very first Claude skill, which helps Claude assess whether drug targets are worth pursuing, has been evaluated on 45 target-disease pairs.
Read more
.
More recently, we’ve also begun working with
Bristol Myers Squibb
(BMS) to find and address bottlenecks in clinical trial planning. BMS is using Claude to assess plans of an early-stage drug in clinical trials, and to estimate the likelihood of those trials succeeding. Together, we plan to expand this work in 2027 to understand its potential for increasing the probability of success in early development.
“We use Claude at the clinical trial stage to analyze proprietary data, create a clinical study plan, and weigh the study’s chance of success. From a single prompt, Claude generated a robust initial analysis that helped inform our assessment of different development options, which would otherwise take days to complete. We did all of this while ensuring the security of our highly sensitive data. We look forward to expanding this work across our pipeline to support portfolio-level decisions.”
Michael Pourdehnad, MD
, Senior Vice President, Head of Early Clinical Development, Hematology, Oncology and Cell Therapy.
In addition to our work with these partners, we’ve begun to run some research programs ourselves. We’ve acquired Mithril Medicine, a one-person company that has been developing treatments for two rare forms of muscular dystrophy. Its founder, Cody Tranbarger, used Claude to organize contracts, logistics, and experiments with 11 external labs, and delegated many other aspects of Mithril’s operations to Claude. As a result, Mithril took a possible treatment for one form of muscular dystrophy from an idea to promising results in mice in less than 18 months. Now at Anthropic, Cody is continuing this research, and plans to start several new programs. If his drug candidates continue to hold up, we expect a drug to be ready to start clinical trials in humans as soon as late 2028.
Read more
and see
our technical report
.
Extending our work in the life sciences
All of this research is still at an early stage. In particular, so far it is mostly
preclinical—
that is, for the most part, it isn’t yet at the stage where the drugs are being tested in humans. We plan to continue extending Claude’s role into clinical trials as these drug programs advance, and as we partner with more organizations whose drug development programs are already at the clinical stage.
This research is only one part of our efforts to accelerate drug discovery. Ultimately, we want to share our models with as many drug development researchers as possible. To that end, we’ve rolled out
Claude Science
, our AI workbench for researchers, and we’re providing
Claude credits for life scientists
. We’ve also created the
Life Sciences Verification Program
to allow trusted organizations to use our most powerful models with more permissive versions of our safeguards, which are necessary to prevent misuse but which can impede legitimate biological research. We’ve also recently launched an
open call for guest investigators
in the life sciences; we’re seeking proposals from research groups who want to use Claude to investigate key questions in drug discovery and other areas.
We’re looking forward to working with many more organizations as we expand our life sciences research. If you work at an organization focused on drug discovery and are interested in collaborating with us, you can get in touch below.
The Elon Musk Funder Trying to Sway the Race for LA’s Top Lawyer
Intercept
theintercept.com
2026-10-27 16:49:40
The leading candidate for LA city attorney has the backing of the local DSA and vows to regulate Big Tech. Tech investors are spending millions against her.
The post The Elon Musk Funder Trying to Sway the Race for LA’s Top Lawyer appeared first on The Intercept....
A DSA-backed California
prosecutor who helped force Meta to pay a historic $17 billion settlement this year is on a glide path to become the top lawyer for Los Angeles — unless a tech investor cozy with Elon Musk can spend enough to stop her.
San Francisco resident John Hering has sunk more than $1.25 million into an effort to defeat Marissa Roy, a deputy attorney general at the California Department of Justice endorsed by the LA chapter of the Democratic Socialists of America, and to support John McKinney, a county prosecutor running an uphill general election campaign. It’s a heavy injection of cash from a single individual in a local race for a little-known office, but it pales in comparison to Hering’s private-sector spending: In 2022,
his investment firm
Vy Capital
pumped
$700 million into Musk’s takeover of the company then known as Twitter and $300 million into his tunnel-construction Boring Company.
A co-founder of the cybersecurity company Lookout, Hering is spending in line with the tech industry in which he’s long been invested. While the city attorney’s office is commonly used as the city’s defense against litigious residents, the office also carries the power to mold legislation, enforce state law, such as labor protections, and take on corporations and the federal government in court. Roy has vowed to wield the office’s regulatory muscle against corporations — including Big Tech.
“Monopolies and Big Tech are things that [Roy] sees as an opportunity to wage battle against,” said former LA City Councilmember Mike Bonin, who has not endorsed either candidate. “If I were Big Tech, I would certainly think, ‘OK, well, this is someone who is a potential threat.’”
Hering, who did not respond to The Intercept’s request for comment, is part of a group of tech titans backing McKinney. Others include the founders of Ring, Tinder, and Boingo, and investors in
Anthropic
,
Anduril
, and
SpaceX
, who have collectively put more than $1.9 million into pro-McKinney committees. A group called “Committee to Expand the Middle Class Candidate” — backed by the property rental tech giant Airbnb — donated an additional $4.2 million to a committee supporting McKinney.
To help get McKinney through the June primary election, Hering and fellow tech investor Diego Berdakin poured more than $1 million into another committee. Over the past month, Hering’s general-election spending group, Neighbors for John McKinney, has been paying for TV and online ads and mailers that play up McKinney as “a lifelong Democrat” and “100% anti-MAGA.”
The same can hardly be said for the group’s top funder.
After giving to Hillary Clinton’s failed 2016 presidential bid and Democratic candidates like Beto O’Rourke, Hering donated $41,300 to the Republican National Committee and $500,000 to Musk’s America PAC in 2024 to support Donald Trump’s run for president. He has publicly praised Musk’s chaotic purge of the federal government through his so-called Department of Government Efficiency program and called the world’s richest man an “
American hero
” for offering to pay TSA salaries during the spring government shutdown. In 2025, Hering and Ring founder Jamie Siminoff, who has also donated to Neighbors for John McKinney, attended a White House dinner where Trump
hosted
dozens of high-profile Silicon Valley figures. The pro-McKinney group is also funded by billionaires Rick Caruso, a failed LA mayoral candidate, and Ron Burkle, a Democratic megadonor.
Earlier this cycle, Hering, who listed San Francisco as his residence in campaign finance documents, also waded into the
LA mayoral election
— boosting right-wing reality star
Spencer Pratt
.
Tech industry spending
in LA’s elections arrives amid a midterm cycle where Big Tech and artificial intelligence have
doled out millions
of dollars
to exert influence in congressional and state races across the U.S. as lawmakers grapple with how to regulate the industries. Musk, for example, has dropped more than $442 million into the midterms, including more than $70 million in his political action committee, America PAC, in October alone. And in state Assembly and Senate races across California, tech and AI executives have spent more than $29 million, according to Tech Equity Action, a political nonprofit that lobbies to craft tech-related legislation while advocating for workers’ rights.
California Gov. Gavin Newsom gave big AI companies a scare last month, when he signed a slate of bills protecting workers from AI overreach, like limiting its use to terminate or discipline workers, banning employers from using AI to surveil employees in bathrooms, and assuring that human healthcare workers will have the final say on patient care decisions.
The tech industry had
fought hard
to kill the bills, and while Newsom did offer the industry some concessions, labor organizers say the new laws offer them an opportunity to expand local worker protections, too.
In LA, Roy has said she would use the city attorney’s office to fight for workers against losses in potential wages, promising that she would go after “large corporations and big tech companies” that “misclassify workers as independent contractors to avoid paying them minimum wage and providing benefits,” according to her campaign website. She also spoke against companies who are increasingly using automation “to evade regulations and eliminate jobs.”
Tech leaders may view a city attorney with an appetite for regulation as “existential to their business model,” said Brian Justie, a
researcher
at the UCLA Labor Center who was part of the coalition that pushed for the bills.
“What happens in California sets a precedent and serves as a blueprint for the rest of the country,” Justie said. “And so if you’re a Big Tech, you really need to have a certain outcome come to pass here to avoid ripple effects elsewhere.”
For his part, McKinney has
blasted Roy
for her desire to “turn the city attorney’s office into the country’s largest public interest law firm” as out of touch with what LA voters want. However, voters across the U.S. have increasingly expressed opposition to the expansion of artificial intelligence and the construction of data centers. Roy’s campaign has shown a willingness to lend an ear to growing AI anxieties.
“Billionaires don’t want to answer to the working people, consumers, and communities they exploit,” Roy said in a statement to The Intercept. “But as Los Angeles’ City Attorney, I intend to hold them, their corporations, and the MAGA Republicans that permit their behavior accountable — that’s why they’re spending on someone who won’t.”
McKinney did not respond to The Intercept’s request for comment.
Ads put out
by Neighbors for John McKinney assert that McKinney would “take on crooked landlords.” The committee’s
website
said he would fight for tenant’s “legal protections” against things like “illegal eviction.” But among the committee’s biggest funders is the Santa Monica-based real estate firm, Douglas Emmett Properties, which attempted to carry out
one of the largest mass evictions in LA history
until it was overruled by a judge. Douglas Emmett donated $250,000 to Neighbors for John McKinney in late September.
Neighbors for John McKinney has also funded attack ads against Roy that paint her as an inexperienced attorney who is weak on crime and has “extreme DSA” positions. The ads cite an
article
by the conservative California Post, a West Coast spinoff of the New York tabloid, that claimed she had supported a freeze on prosecuting misdemeanors, which she denies.
McKinney campaigns in the mold of law-and-order candidates, pledging to
address homelessness
and public safety by prosecuting misdemeanors, touting closer relationships with police, and promising to revive a neighborhood prosecutor program. Other California tech-supported efforts have echoed the same — like when
tech leaders
in the San Francisco Bay Area fueled a
successful effort
to oust progressive District Attorney
Chesa Boudin
.
But the LA city attorney’s office holds limited criminal enforcement power, Bonin pointed out. He suspects the tech investment in the LA race is more concerned with potential civil litigation, and he thinks that if voters make that connection, it could spell an issue for the campaign.
“Voters are concerned about Big Tech, they’re certainly concerned about AI, they’re concerned about the influence of — I don’t think you can describe it any other way — 21st-century robber barons,” Bonin said. “Income inequality is a big issue in Los Angeles, so if they make the connection that this funding is symbolic of the agenda that McKinney will pursue … then it becomes more of an issue.”
Roxana Tynan, executive director of the Los Angeles Alliance for a New Economy, called the amount of Big Tech money being spent in the race “outrageous.” As she and other labor rights groups gear up for a fight for more worker AI protections in LA — like expanding safeguards to include temporary and gig workers, and banning employers from using AI software to collect sensitive worker information — she said she hoped people would follow the money being poured into the race and the influence that a few figures look to exert on the city.
“These are people who really believe that not only can they buy elections,” Tynan said, “but that they deserve to buy elections.”
Raspberry Pi Zero 3W and Pi 4 Model A spotted in device trees
Two new Raspberry Pi boards have quietly turned up in Raspberry Pi’s Linux kernel tree, and neither of them is quite what I’d have guessed. Device tree files for a Raspberry Pi Zero 3 W and a Raspberry Pi 4 Model A have landed (
Phoronix spotted it first
), and whilst there’s no official announcement just yet, device tree files tend to give away a surprising amount if you can decipher them and I gave it my best shot.
Raspberry Pi Zero 3 W: A Pi 4 Shrunk Down?
The Raspberry Pi Zero 2 W launched almost exactly five years ago (tomorrow, in fact), so a successor has been a loooooong time coming. If you want a refresher on where things stood back then, my
Raspberry Pi Zero 2 W vs Zero W benchmarks
piece covers the jump from the original pretty well.
The headline from the
Zero 3 W device tree
is the SoC. It’s the
Broadcom BCM2711
, the same quad-core Cortex-A72 chip that powers the
Raspberry Pi 4
, replacing the
Zero 2 W’s
quad-core 1GHz Cortex-A53 RP3A0. If you want an idea of the sort of gap we’re talking about, it’s worth having a look at
how those two compare on sbc.compare
. That’s a big step up in per-core performance, and if they can get anything close to Pi 4 clocks in that tiny footprint, it’ll be a hell of a lot of compute for a Zero. I do wonder how toasty it’s going to get though, as the BCM2711 isn’t exactly known for running cool, and there’s not a lot of board for the heat to spread into. The device tree doesn’t tell us anything about clock speeds, so we’ll have to wait and see whether it’s been dialled back.
Beyond the SoC, here’s what else stood out to me:
eMMC on a Zero?
The storage controller is configured with an 8-bit bus width and a comment describing it as driving “the eMMC/SD card”, which only really makes sense for eMMC. I’d love to see it, but I’m not expecting it to make the final board, as it’d push the price up on a range that lives and dies by its price tag. My money is on this being a leftover or an option kept open during development, and microSD being what we get.
An SPI flash bootloader.
The GPIO names include SPI flash lines, which suggests the Zero 3 W gets the same EEPROM-based bootloader as the Pi 4 (the Zero 2 W never had one). That should bring the Pi 4’s boot options along with it, and the ability to
update the bootloader
in the usual way.
A single HDMI output
, with the second HDMI controller permanently disabled. No surprise there given the form factor.
A power button
defined on GPIO 46 and mapped to KEY_POWER, so we may be getting a physical button (or at least a header for one) much like the Pi 5.
Wi-Fi and Bluetooth
wired up in the same way as the rest of the BCM2711 family, with a single ACT LED for status.
The usual 40-pin GPIO layout
(GPIO 0-27 with the ID EEPROM pins), so your existing HATs should be fine.
There are a couple of more speculative bits too. The PCIe controller is enabled and there are lines named PCIE_PWR_EN and PCIE_DET_WAKE, and the camera side pulls in a 4-lane CSI configuration rather than the 2-lane one the Pi 4 Model B uses. It’s worth noting that both device trees share a lot of copy-and-paste DNA (the Zero 3 W even has a duplicated “PWR_GPIO” line name), so I wouldn’t read too much into either of those until we see an actual board. I’d love to see PCIe exposed on a Zero, but I’m not holding my breath.
Raspberry Pi 4 Model A: The Return of the A
The second surprise is a
Raspberry Pi 4 Model A
. We haven’t had a Model A since the Raspberry Pi 3 Model A+ back in 2018, and the formula has always been the same: take the Model B, strip out the bits most people can live without (RJ45, some USB ports etc), and knock a chunk off the price. The Pi 4 Model A looks to follow that recipe pretty closely, though the price comment may not quite hold. Let’s see!
No Ethernet.
The Ethernet controller isn’t enabled anywhere, and the GPIO lines that drive the Ethernet PHY on the Model B have been repurposed. Very much in keeping with previous Model A boards.
A single HDMI output
rather than the Model B’s dual micro HDMI.
No 3.5mm audio/composite jack.
The analogue audio pins are empty and the composite video encoder is disabled, so audio will be over HDMI (or USB/I2S if you’re that way inclined).
microSD only
, with the same 1.8V signalling support as the Model B for the faster UHS card modes.
External antenna support.
This is the one I find most interesting. There are two antenna control lines (ANT_CTRL1 and ANT_CTRL2) and overlay parameters named
ant1
,
ant2
and
noant
, which is exactly how the Compute Module 4 switches between its onboard antenna and an external U.FL connector. If that carries over to the final board, it’d be a lovely addition for anyone sticking a Pi in a metal enclosure.
PWR and ACT LEDs
, the same SPI flash bootloader setup as the Model B, and the same power button definition as the Zero 3 W.
The device tree doesn’t tell us anything about USB. On the Model B, the USB 3 ports made use of the PCIe bus, and the PCIe controller is enabled here too, so USB 3 is possible, but the 3 Model A+ only had a single USB-A port and I’d probably expect the same here.
The previous Model A, the Raspberry Pi 3 Model A from 2017
How Do They Compare?
Here’s a quick side-by-side of what the device trees tell us, with the Pi 4 Model B thrown in for good measure. Anything marked with an asterisk is my interpretation of the device tree rather than something it states outright.
Raspberry Pi Zero 3 W
Raspberry Pi 4 Model A
Raspberry Pi 4 Model B
SoC
Broadcom BCM2711
Broadcom BCM2711
Broadcom BCM2711
CPU
Quad-core Cortex-A72
Quad-core Cortex-A72
Quad-core Cortex-A72
HDMI
1x
1x
2x micro HDMI
Ethernet
No
No
Gigabit
Wi-Fi/Bluetooth
Yes
Yes, with antenna switching*
Yes
Storage
microSD (unless..)
microSD
microSD
Analogue Audio/Composite
No
No
Yes (3.5mm)
SPI Flash Bootloader
Yes*
Yes*
Yes
Power Button
Yes*
Yes*
No
LEDs
ACT
PWR, ACT
PWR, ACT
What We Don’t Know (Yet)
Quite a lot, I’m afraid. Device trees don’t describe RAM, so there’s no word on memory configurations, and there’s nothing on pricing, clock speeds, connector types or a release date either.
Pricing is the big one for me. Memory costs haven’t exactly been kind lately (I covered the last round of increases alongside the
1GB Raspberry Pi 5 launch
), and a lower-cost Pi 4 variant makes a lot of sense in that context. The BCM2711 is a mature chip at this point, it’s well supported in software, and a cut-down board gives people who don’t need a Pi 5 something cheaper to reach for. The Zero 3 W is a tougher one to call though, as the Zero range has always lived and died by its price, and I can’t imagine the BCM2711 being as cheap to build around as the RP3A0.
Thoughts
On the whole, I like what I’m seeing here. The Zero 3 W looks like the upgrade a lot of people have been asking for since the Zero 2 W landed, and the 4 Model A feels like a sensible way of squeezing more life out of the Pi 4 platform at a time when components aren’t getting any cheaper. The external antenna support on the 4 Model A is a really nice touch if it makes it to the final board.
Saying that, everything above comes from device tree files rather than an official spec sheet, so mileage may vary when the real thing turns up. Kernel support landing ahead of launch is usually a good sign that it’s not far off, and you can bet I’ll be throwing both the Zero 3 W and the 4 Model A onto
sbc.compare
as soon as I can get one in my hands.
Which of the two are you more excited about? Do let me know in the comments!
Bret has worked with Raspberry Pi computers for almost 10 years now and in that time he's benchmarked and tested over 30 Single Board computers. In his day job, he's a systems administrator for a large cloud computing provider.
A few months ago, after we had just closed our best-ever quarter, we decided to do something bold: start from scratch on a clean-sheet version of Hex, the product we had been building for 6 years and used by over 2,500 customers globally.
This was a radical thing to do — but after 4 years on the frontier of bringing AI to data, we knew it was the right one. Today we’re introducing that new version — and announcing a fundraising to bring it to the world.
Let me tell you why, and where we see all of this going.
“What would we build if we were starting from scratch?”… and then doing it
This was the question we asked ourselves earlier this year. See, we were founded in 2019, making us a pre-AI company (ew!).
Now, I also think we had done an amazing job bringing AI into our product over those years! We had a text-to-SQL prototype using GPT-3 before ChatGPT. We launched our
Magic features
in February 2023. We launched the first really good
data agent
last year, and earlier this year we changed the game again with
generative apps
. I'm proud of all of this.
But fundamentally, we were trying to integrate AI into a product that already existed. Our data model, architecture, and core assumptions around what users were doing in our product were all baked in 2020 to 2021 —
we were far from “agent native”, no matter how much we liked saying it.
¹
And this was leading to some major issues: our agent harness was becoming bloated with hundreds of tools, which were required to teach agents about how to use Hex-something emphatically out of distribution. Our compatibility with external agents, because those products were having to use Hex through a keyhole via MCP versus being able to work with something more native. And our compute engine wasn’t built to support the high-speed, high-concurrency, iterative workflows agents seem to like.
In parallel with these issues,
we were seeing data work is happening in a lot of other places
: folks are using Cursor, Codex, Cognition, Claude, and custom agents — which in turns was causing a lot of issues! People are "vibe coding" dashboards and reports way more than they're using their legacy BI tools and emailing around HTML files without provenance, context, or permissions. It’s a mess — but
the previous version of Hex couldn’t solve this in the way we wanted.
Altogether, this added to a growing sense that – despite growing quickly and having a lot of happy customers – we were headed for a point of diminishing returns.
As we got together and talked about this, we had an idea of what we actually would do if we were starting from scratch today: a platform rooted in code — with all of its infinite flexibility and agent nativity — and embrace that data work can happen a lot of places, but that it needs context, controls, guidance, and guardrails to make it trusted.
And so that’s what we built.
Introducing Hex 4.0
Hex 4.0 is truly a from-scratch rewrite for the era of agents
(and, of course, was greatly accelerated by using agents to write all of the code, guided by the decades of combined expertise from our teams in building scaled data platforms).
The core assumption of 4.0 is that everything is code — and that teams need context, controls, and compounding to make it trusted and scalable. It leans into the idea that data work is happening in a lot of places, and that "plain code" (not a proprietary YAML format) is the way to make that make sense.
We have a big, long blog post detailing all of this
here
, I recommend you read it! Maybe a couple of times, because it's interesting, and we suspect you’re going to be hearing from a lot of other companies who are going to realize that they need to think from first principles too.
And this is just the foundation for a lot of other things we have in mind; in fact, one of the reasons we went so hard on this is because there are things we want to build we couldn't imagine doing on the old architecture — but are trivial on the new one.
We can't wait to show you!
Some money stuff: we raised another $100m
As this all came into focus, we realized more money would help us go faster – to scale our team, expand go-to-market, and continue to make great swag. The only problem was that in the first part of the year, investors thought all software was going to die and there would only be two companies left.
²
Shailendra and the team at Peak XV, however, didn't think that: in fact, they were pretty sure that model-independent platforms were going to have a bright future ahead. And they were not scared about us taking a bold first-principles approach to go build it.
So I’m excited to announce that
we’ve closed a $100 million financing round at a $1.2B valuation led by PeakXV and our 137 Ventures, with participation from Amplify, Avra, a16z, Redpoint, Sequoia, and Zero Prime.
This gives us a bunch more runway to keep building this thing, and take more bold bets into the future.
The end of BI, the beginning of something new
I'm throwing some serious shade at the "SaaS apocalypse"-pilled investors above, but I'll give them some credit: I think it is true that a lot of software categories will effectively die over the next couple of years. But I also believe
many will combine and be reborn into new shapes.
This is our basic outlook on BI: the old paradigm is over, and no amount of bolting a chatbot sidebar onto the legacy platforms is going to change that. But there are also fantastic new opportunities opening up!
We believe the next chapter is rooted in code, with the context and controls needed to establish trust, governance, and guardrails.
The basic promise of BI is finally here: everyone can ask questions! Everyone can build! But now it's chaotic, and all the trust is gone. We see this as the core trade-off to break, and we're kind of obsessed with it.
¹
I'm not going to call out anyone by name,
but I do think it's funny how many companies in our space that have been around for 8 years or more now call themselves "AI native", despite that literally being the antithesis of that phrase. I mean, I get why they're doing it, but unless you have literally rebuilt your product in the last 24 months, I'm not sure you can credibly claim it...
²
I'm joking, but not really?
You should have sat in some of the pitch meetings we had…
Code-execution flaw in UEFI firmware threatens most servers on planet Earth
I am going to tell the story of fixing a very high priority bug that was 15 years old. Arguably the worst KIO bug.
In September 2011, against KDE 4.7, someone opened
bug
281270
: "When copying files to a removable disk,
speed and progress reflect copying to the local cache not to the disk itself". The report notes
the copy notification showed about 50 MB/s to a USB 1.1 device, which cannot go faster than
12 Mbit/s. The reporter had asked a kernel developer, Alan Stern, what was going on, and summed up
his answer:
it shows that the copying operation is finished when it has not even been started.
Seventy-seven comments and 17 duplicates later, that is still how a copy to a USB stick behaves in the
current release of KIO. My
last post
about copying
was about making KIO copy faster.
This one is about the opposite case, a destination that is slower than KIO, and about making the
progress bar and copy completion accurate.
The changes are in four KIO merge requests:
MR 2506
finds out which devices are
removable,
MR 2517
and
MR 2518
flush the device at the end of
a copy or a move, and
MR 2283
adds the
writeback window. All of it is merged, and will be in KDE Frameworks 6.32, released
November 13th 2026
.
We will see the cause of the bug, its history, and what it took to fix it.
Why a copy finishes before it has started
The file worker copies a file by handing its data to
write()
.
write()
returns as soon as the
data is in the page cache, in memory. The kernel writes it to the device later, when it decides to.
On a local SSD, later means very soon, and you never notice. On a USB 2.0 stick that writes at
2.3 MB/s, it is another story. Here is a 128 MiB file:
For more than a minute, Dolphin considers the copy finished while the stick is still writing. The
progress bar was showing how fast KIO filled memory. Pull the stick out during that minute, and your
data is gone.
Network filesystems have a different symptom from the same cause. A large copy to an NFS or SMB
share leaves hundreds of MiB in memory to send to the server, and the progress runs far ahead of
it. On SMB it is worse than a wrong number: with the default
cache=strict
, looking at a file
waits until its dirty data is written. Listing the folder you are copying into looks at that file.
Over a 5 MB/s link, almost every listing during a 1 GiB copy waited 15 to 20 seconds.
Fifteen years in one bug report
The right tool actually showed up very early. Two days after the report, Christoph Feck asked whether there was a
way to learn when the data is really on the disk "without causing massive slow downs that any sync
type calls would cause". Two weeks later, the reporter passed on Alan Stern's answer,
sync_file_range()
, and Christoph replied that it looked like "exactly what we need". That was
September 2011, and it is the call KIO now uses.
Then not much happened for years, apart from users confirming it and seventeen duplicates. In 2021, Nate
Graham raised it to the highest priority, because a move deletes the source files while the copies
are still in memory. In 2022, he changed the Disks & Devices applet, so that ejecting a device
explains that it is still writing. In 2024, Christoph tested the
cachestat()
call of Linux 6.5,
which reports how much of a file is still dirty in memory, but only for one file at a time.
This bug has been my white whale. I have been contributing to KIO since 2018, and I am still learning
how the Linux storage stack behaves underneath it. I tried twice in 2024 and did not get
sync_file_range()
right. In
MR 1718
,
the
sync_file_range()
path stayed commented out. In
KIO
MR 1764
and
Dolphin
MR 862
, the worker waited for the
writeback of the chunk it had just written, which had not started, so it never waited at all. Waiting
for the window before the one just written is what makes it work. I didn't spot the issue, nor any
reviewer unfortunately.
Since then, another contributor proposed turning off the cache for copies, in
MR 2162
, which was closed.
Why it took so long
Making the copy correct is the easy part: call
fsync()
after every file, or open the destination with
O_DIRECT
and skip the cache. Both make copies several times slower, and they would slow down
the fast local disks too, where nothing was wrong. Making it
correct without making it slow is what took fifteen years, and it needed several things that were
not there before.
A way to wait for part of a file. POSIX only offers
fsync()
, which waits for everything.
sync_file_range()
is Linux only, and its own manual calls it "extremely dangerous": it does not
write the file's metadata, so on its own it guarantees nothing after a crash. It can bound how
much is in memory, but the end of the copy still needs a real flush.
Knowing which destinations need it, without asking them. The filesystem type does not show
whether a device can be unplugged, and asking a network filesystem anything is a round trip to a
server that may be slow. KIO reads the answer from the
mount table and from sysfs instead, and two earlier changes to
KMountPoint
made that cheap
enough to do for every copied file:
MR 2326
, in KIO 6.30, caches
mounts by the mount id that
statx()
returns since Linux 6.8, instead of parsing
/proc/self/mountinfo
on every lookup. A lookup by id became about 700 times faster.
MR 2487
, in KIO 6.32, reads a
missing mount with
statmount()
, which does not walk any path, so a network server that does
not answer no longer blocks the lookup. In that case, the lookup went from more than 15 seconds
to about 1 ms.
A place to flush at the end of a copy. The file worker copies one file per command, in its own
process, and never knows which file is the last one. Only the
CopyJob
, in the application, knows
when the whole copy is over. So the flush needed a new worker command, and a way for the worker to
notify the job that a flush is needed. On the way, I found that
FileCopyJob
dropped the metadata
that the worker sent with a copy, so the
CopyJob
could never have seen it.
A window size that fits every destination. A window too small slows a fast link, and a window
too large never fills on a slow one. That is why it now adapts, and why the progress has to stay
monotonic when the window shrinks.
A writeback window
Waiting for the device after every write would be correct but very slow. Waiting only at the end
leaves the progress wrong for the whole copy. KIO now does something in between, with
sync_file_range()
, which lets a program start the writeback of part of a file and wait for it.
The data is written in windows. When a window is full, the worker hands it to a helper thread,
which writes it back and waits for it, while the copy fills the next window. The copy only waits
when the window before the one it hands over is not written yet. So at most two windows of the copy
are ever in memory and not on the device, and the progress bar is never more than one window ahead
of what is really written.
The helper thread was needed to accommodate CIFS, the kernel client for Samba and Windows shares. On CIFS,
the call that starts the writeback of a window does more than start it: it sends the data to the
server, and waits for the server to grant the credits to do so, blocking the calling thread for about 157 ms per 128 MiB window.
So the copy could not fill the next window while the previous one was sent. With the helper thread making that call, sending a window and
filling the next one overlap.
A window holds about 200 ms of writeback, at the speed measured on the window before. It starts at
1 MiB, can at most double from one window to the next, and stays below 16 MiB, or 128 MiB on CIFS.
On a fast link the windows grow, so the copy keeps its speed. On a slow link they stay at about
1 MiB, and anything that has to wait for the file waits a fraction of a second, not for the whole
file.
Complete means on the device
A window bounds how much is left in memory, but there is still something left at the end. For a
removable device, KIO now also makes the end of the copy wait for it.
A file larger than the largest window, 16 MiB, is flushed with
fsync()
, and then its folder, before
the copy reports it done. By then the window has already written all but the last two windows, so the flush is
short.
Small files are the hard part. The obvious fix, an
fsync()
for every file, made 3000 files of
16 KiB take 10 seconds instead of 0.04 seconds on a local disk. So the worker flushes no small file
by itself. After a copy to a removable device, it notifies the job, and the
CopyJob
sends it one
more command before reporting success: write back the whole filesystem of the destination, with
one
syncfs()
. While that runs, the copy notification shows "Writing the copied data to the device...".
If the flush fails, the copy fails, because the data may not be on the device.
A move needed more than that. Before, KIO deleted each source file right after its copy, while
the copy could still be only in memory, which is why the bug got its highest priority. Now a move to
a removable device keeps its sources until the flush has succeeded, and deletes them after it. If the
flush fails, or the stick is unplugged during it, every source stays. A source that changed while it
waited for the flush stays too, with a warning. A copy or a move that stops on an error, or that you
cancel, still flushes the device, and a move then deletes only the sources of the files that are on
it.
Here is the same USB stick again, with the small files added:
Yes, the copies now take longer by the clock, but only because the clock now includes the time the
stick spends writing. The time until the data is really on the stick did not get worse. The speed of this stick
varies a lot from run to run, so the 28 seconds against 68 to 91 seconds for the large file is not a
speedup I would count on. The small files never fill a window, so they only depend on the flush at
the end.
Which destinations get a window
A local fixed disk does not need any of this, and keeps the current behaviour exactly. With the
removable policy forced onto a local disk for testing, the 3000 small files took 1.55 s against
1.54 s before the change.
Deciding what is removable is less obvious than it sounds. The filesystem type does not expose it: exFAT
can be a memory card, and FAT is also the EFI partition of your laptop. Most USB disks do not even
report removable media.
MR 2506
adds a private function to KIO that asks sysfs: the disk's own
removable flag, then the USB port or PCIe slot it hangs off, which the kernel marks removable when
it can be reached from outside the machine, and SD cards. It follows encrypted and LVM volumes down
to the disk under them.
Network filesystems are easier: every mount that KIO already considers slow gets a window. That is
NFS and CIFS, but also Ceph, GlusterFS, 9p, sshfs, and FUSE filesystems such as rclone. The worker
finds the mount from the mount id of the destination folder, without a round trip to the server.
To measure this, I used KIO's own copy job, comparing KIO master just before the change with KIO
master after it, while another thread listed the destination folder every 50 ms. The SMB server ran on the same machine, with 2 ms of
delay added to its traffic, and for the slow link a limit of 40 Mbit/s, about 5 MB/s.
On the slow link, the listing is the difference you would feel:
The copy runs about 3% slower with the window. On a fast link, the copy keeps up:
One of the five copies before the change failed with a write error from the share, so these
numbers come from four rounds. The times vary between runs: in an earlier run, the copy with the
window was 4% slower.
Getting there took me four tries. My first version was 10 to 20% slower on the fast link, because
of the CIFS behaviour described above. Then, with the windows aimed at 500 ms, listings on the slow
link went up to 4.2 seconds, because each request of a listing waits behind the window being sent.
Aiming the windows at 200 ms brought the listings down to 1.7 seconds.
NFS, on the same machine with 2 ms of delay:
The copy times are close: 11% slower in the first round, and slightly faster in the two others.
Part of a frozen Dolphin
Bug 423187
collects many ways in which a slow mount
can freeze Dolphin. In one of its comments, Frank Gehann copied a 100 MB file to an SMB share while
browsing it, and found two causes: Dolphin's main thread waiting for answers from the share, and
folder listings waiting behind the queued upload.
The window helps with the second cause: each request of a listing now waits behind at most two
windows, about 400 ms of writeback, and a whole listing took 1.7 seconds on the 5 MB/s link instead
of 5 to 11. The
statmount()
change
helps with part of the first one.
KFileItem::isSlow()
, which Dolphin calls on its main thread
before it reads a file to find its type, no longer waits for any server, on Linux 6.8 or later. Work is underway to fix the
rest of the first cause in Frank's open
MR 2484
and
MR 2485
.
The stick that pauses
One measurement sent me down a rabbit hole. During a large copy to the USB stick, listing a folder on
the stick sometimes took about 15 seconds, before the change as much as after it. It looked like the
writeback window was making something wait.
It was the stick. Roughly every 8 seconds, a single 120 KiB write to it took 4 to 7 seconds to
complete, and the listing waited for a page that was stuck behind such a write. KIO cannot fix a
device that stops for seconds at a time, but at least we now know the copy is not to blame. In the runs for this post, the
slowest listing took 3.6 ms during the copy of the large file, but 7 seconds during the copy of the
small files, against 15 seconds before the change.
Copying between two filesystems
One more thing landed along the way, and this one is a plain speedup. In 2021, in Frameworks 5.88, I replaced
sendfile()
with
copy_file_range()
in the file worker, in
MR 602
. At the time, Linux copied with
copy_file_range()
across
filesystems too. Linux 5.19 changed that back: between two filesystems, the call fails again with
EXDEV
. Since then, a copy from one filesystem to another went through
read()
and
write()
in the
worker, one buffer at a time.
MR 2520
now falls back to
sendfile()
in that case, which copies from one file to another inside the kernel:
A copy to the USB stick takes as long as before, because its write
speed is the limit. This one is merged too, and will also be in KDE Frameworks 6.32.
Closing
With all this, a copy to a USB stick now finishes when the data is actually on the stick.
On network filesystems, the progress now follows what the server has received, and the share stays
usable during the copy.
sync_file_range()
is mainly used by databases and storage engines. No other file manager that I
know of uses it. Now KIO, and so Dolphin, uses it too.
A few years back I wrote
“The modern packager’s security nightmare”
. Have things improved since? On the contrary, I feel like we’re slipping down a well-oiled slope with no end in sight. Vulnerabilities are reported at unprecedented rates. A lot of people are doing everything they can to patch them up, which doesn’t necessarily mean they’re not making things even worse. Complex software involves complex trees of dependencies, and every branch on that tree needs tending to. When they stop being reliable, people further down the tree start taking more weight. And there’s a limit of how much a single person can do, so what started as an effort to resolve an issue upstream may quickly become a weakness.
Is software less secure these days? It’s tempting to say yes. I’d love to blame the corporate sector for egotistically dumping low quality software on us. I’d love to blame marketing-oriented people developing stuff with the sole goal of making a profit. I’d love to blame Rust for getting people obsessed about memory safety, and ignoring the kinds of vulnerabilities that aren’t caught by the compiler. Finally, I’d really love to blame slop. But the truth is, I don’t know. That’s really beside the point.
The point is that nowadays everyone and their chatbot became security researchers. Projects are being flooded with vulnerability reports. Even though pretty much every bug bounty was discontinued because of slop, people aren’t stopping. And even if we disregard truly invalid junk reports, there’s a lot left, and you have to deal with them somehow. You have to figure out how important they are, and how to fix them (or more likely, whether the fixes submitted are truly valid and don’t introduce regressions), or if you should reject them and why.
In the end, security is tricky. We’re seeing lots of bugs like REDoS, or other kinds of “performance bugs”. Are they really vulnerabilities? Well, it depends on the attack vector. And that in turn depends on how the software is used. Some scenarios are really conceived, and feel like “shell can execute dangerous commands if you type them in”. But then, you also have really serious issues such as “timing attack can be used to guess user’s secret”. You need to know a lot to make that kind of judgment, and sometimes your judgment doesn’t really match users’ expectations.
In the end, what can project maintainers do? Even if they have the expertise and the energy to judge, if they can “know better”, there’s likely a CVE assigned already. It may have absurdly high score. All security scanners will complain unless you fix it, and users will come asking or complaining, or attacking, or forking. I mean, technology can’t handle nuances. More than once I’ve been doing unnecessary security stabilizations over vulnerabilities that didn’t affect Gentoo (for example, because we already unbundled the vulnerable dependencies), to avoid false positives from security scanners. I’ve been also doing meaningless version bumps (with no real changes or no changes that applied to Gentoo) so that our packages don’t get reported as being “outdated”. It’s a hassle and it sucks, but it saves people from worrying.
I’ve said this before and I’ll say it again: most projects aren’t really prepared to handle security issues. And it’s not just about triage. It’s about having LTS or security branches, it’s about making proper security releases with minimal changes. Unfortunately, it’s quite common for security fixes to be combined with new features, deprecations, API changes. In extreme cases, people are caught with their metaphorical pants down, and suddenly need to make a security release in the middle of a major rewrite, or along with barely tested new code. And then, people downstream discover that they need to quickly deal with major API changes to upgrade past a vulnerable version. These things keep piling up.
What happens next? The community reaches a breaking point. People can’t keep up. You discover you can’t rely on others, so you work around them. You start bundling more stuff. Soon enough your workload goes beyond your ability. Software development becomes “every chatbot for itself”. The nightmare becomes worse, and the wheel keeps turning.
Tailscale SSH: Investigation and remediation update
We're investigating security vulnerabilities affecting Tailscale SSH and wanted to share an update on what we've found, what we're doing about it, and what customers should know.
Our engineering and security teams have been investigating the reported issues with help from external security specialists. This builds on work already underway, which we've accelerated to address the findings and prepare fixes.
Most of the Tailscale SSH issues we've identified concern privilege escalation. In some circumstances, someone already authorized to connect over Tailscale SSH may be able to perform actions beyond the permissions of their configured local user, including potentially gaining elevated privileges.
These are serious security issues, and we're treating them accordingly.
Exploitation depends on the permissions granted to the connecting user or device, the system's configuration, and other conditions. We're continuing to verify the full scope of the findings and which configurations may be affected.
Based on our current assessment, we're not recommending that everyone disable Tailscale SSH.
Our engineers have implemented fixes for most of the issues identified and are completing testing ahead of a patched client release.
We're targeting a release by the end of Tuesday 27 October
, subject to successful completion of testing. We'll update this page when the patched version is available, or if that timeline changes.
We're continuing to review the remaining findings and verify that our changes address the underlying problems.
While we're preparing the update, we recommend reviewing your Tailscale SSH configuration:
Review SSH access policies.
Make sure access is limited to the users and devices that need it.
Disable SSH forwarding if you don't need it.
Set
TS_SSH_DISABLE_FORWARDING=1
in the
tailscaled
service environment and restart the service. This disables SSH forwarding without disabling Tailscale SSH entirely, and mitigates several of the more serious findings.
Review access to sensitive systems.
Consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect.
Prepare to update.
Apply the patched Tailscale client release when it becomes available.
Once the fixes are available, we'll publish a security advisory detailing the confirmed vulnerabilities, affected versions and configurations, their impact, and how to address them. We will link to that here when available.
We'll follow that with a technical blog post explaining the findings, the underlying causes, and the engineering changes we've made, again linked here when published.
If our assessment changes or we identify any additional steps customers need to take, we'll communicate those.
If you have questions about your particular environment, please contact
Tailscale Support
.
Survival LLM: AI assistant and emergency library that runs on your own computer
Survival LLM is a free AI assistant and emergency library that runs entirely on your own computer.
Ask it how to keep food safe in a blackout, treat a burn, or purify water, and it answers from
trusted sources and shows you exactly where each answer came from.
Free and open source. Set it up while you have internet; after that it needs none.
What it does
Works with no internet
The AI model and the library live on your computer. Nothing you ask leaves it.
Shows its sources
Every answer lists the articles it read. Click one to read it yourself, with the exact passage highlighted.
Made for emergencies
Medical references, FEMA and CDC guidance, survival manuals, how-to guides, repair guides and about 930,000 Wikipedia articles.
Pick your version
The app is the same everywhere. When it opens, it checks your computer's memory and downloads the AI model that fits.
More memory means a smarter model.
Your computer
AI model it uses
Our emergency test
Model download
Mac with 128 GB or more memory
NVIDIA Nemotron 3.5 Super
21 of 22 right
80 GB
Mac with 32–96 GB
Qwen3.8 27B
21 of 22 right
18 GB
Windows PC with 32 GB or more
NVIDIA Nemotron 3.5 Lightning
19 of 22 right
25 GB
Mac or PC with 16–31 GB
IBM Granite 4.2 8B
14 of 22 right
6 GB
"Right" means it got the main point of official guidance right on 22 blackout and first-aid
questions, graded blind, in our tests on an earlier build of the library (
how we
tested
). Smaller models make more mistakes, so the app always shows the source to check.
Plus the library: a
9 GB
download for everything (19 GB once installed), or
1.3 GB
(3 GB installed) without Wikipedia and iFixit. Free disk space needed: the model's
size plus 5 GB, plus about 27 GB while the full library installs (10 GB for the smaller one).
Apple Silicon Macs (M1 or newer) with macOS 14 Sonoma or newer, and 64-bit Windows 10 or 11.
Set it up in three steps
Setup takes 20 minutes to about 2½ hours, depending on your computer and your internet speed. You only click for
about 5 minutes; the rest is downloading.
Download Survival LLM
for
Mac
or
Windows
and unzip it. On Windows, right-click the zip and choose
Extract All
.
Open it.
On a Mac, double-click
Survival LLM
. On Windows, open the extracted folder and
double-click
Survival LLM.bat
.
Follow the setup.
The app opens in its own window and downloads the AI engine (built into the Mac
app), the AI model that fits your computer, and the library. Let it finish while you're online.
The first time you open it,
your computer warns you, because the app isn't sold through an app store.
Mac:
click
Done
, open
System Settings > Privacy & Security
, scroll down to
"Survival LLM was blocked", click
Open Anyway
and confirm with your password. You only do this once.
Windows:
click
More info
, then
Run anyway
.
What's in the library
Plain-text copies of openly licensed (some for non-commercial use only) and public-domain references, searchable
in a fraction of a second:
About 930,000 of Wikipedia's most-read articles
WikiMed medical encyclopedia
MedlinePlus (U.S. National Library of Medicine)
UK Medicines A to Z (public sector information)
WikEM emergency medicine
Ready.gov (FEMA) emergency guides
CDC travelers' health
U.S. military medicine and survival manuals
Risk references for estimating micromorts: life tables and U.S. death rates
wikiHow how-to guides
iFixit repair guides
Appropedia (appropriate technology)
Q&A on home repair, cooking, gardening, the outdoors and ham radio (Stack Exchange)
AI models make mistakes, the small ones more often. Every answer shows the articles it used, so you can check.
Private
No account, no tracking. Your questions never leave your computer, and once set up it works with the internet off.
Your own files
Add PDFs, Word documents, ebooks and notes, like your generator's manual or your family's
emergency plan, and the AI searches them too. They stay on your computer.
Updates
Check for updates, at the bottom of the app, installs a new version in one click and keeps your
models, library and files.
Battery
On a MacBook Pro we measured about 100 W while it answers, for 5 to 40 seconds per question: a full battery
answers roughly 100 to 300. A small generator or power station runs it easily.
Several Theories About Why the Knicks Are Sucking Ass
hellgate
hellgatenyc.com
2026-10-27 15:46:57
Hell Gate’s top ball-knowers and performance optimization scientists analyze an early-season slump....
Success! Check your email for magic link to sign-in.
Success! Your billing info has been updated.
Your billing was not updated.
Game Boy Color on My Conference Badge
Simon Willison
simonwillison.net
2026-10-27 15:34:18
Game Boy Color on My Conference Badge
I'm at GitHub Universe this week and, similar to last year, the conference badge is a full-blown color screen computer.
I've been hacking around with it again, and then I ran into with Steve Francia... who worked with Gemini to get a full NES emulator working on...
I've been hacking around with it again, and then I ran into with Steve Francia... who worked with Gemini to get a
full NES emulator
working on it, and then went a step further and deployed an emulator for both the Game Boy and the Game Boy Color.
Project Zero compared two automated tools used by Google to find vulnerabilities in Chrome’s JavaScript engine, V8, on a regular basis.
Fuzzilli
is a generative JavaScript engine fuzzer and
BigSleep
is an LLM-based bug finding system. In the past six months, BigSleep found more vulnerabilities than Fuzzilli (45 versus 37) with a 25% overlap in the specific bugs reported. Since this comparison methodology has a tendency to underestimate overlap, we also performed dedicated experiments to test theoretical overlap in vulnerabilities reported since 2023. These experiments estimated overlap at roughly 60%. Regardless of which value is accurate, a substantial portion of vulnerabilities were discoverable by only LLMs or only fuzzing. While it is extremely promising that LLMs have become able to find so many vulnerabilities so quickly, fuzzing and LLMs are still complementary approaches. We recommend vendors perform both fuzzing and agentic analysis of their code to maximize the number of vulnerabilities that get reported before they impact users.
Introduction
Fuzzing has long been successfully applied to software projects such as Chrome or V8 (Chrome’s JavaScript engine) to detect bugs. Recently, the arrival of powerful LLMs able to read, reason about, and write code is causing a transformative change to software development and software security. With
hundreds, sometimes thousands of new bugs and vulnerabilities
having been discovered in well-fuzzed targets, a natural question arises: how do new LLMs compare to “traditional” fuzzers? Are they starting to replace them or do the two approaches complement each other? To help answer this, we look at three key questions:
How many bugs does each approach find in the real world?
What is the overlap between the two approaches?
What is the “shape” of bugs discovered by one system but not the other?
For this blog post, we will limit ourselves to two concrete systems:
Fuzzilli
, a JavaScript engine fuzzer, and
BigSleep
, an agentic bug finding system. Both of these systems run in production and automatically look for bugs in newly added code, which makes them fairly directly comparable. Specifically, Fuzzilli runs continuously across many instances, with the first ones usually picking up new changes within a few hours, while BigSleep currently runs once per day and is prompted to review new commits and write proof-of-concept testcases for any bugs it discovers. Both systems report bugs through
Clusterfuzz
, which will do basic crash triaging, then file bug reports in
Chrome’s issue tracker.
We also limit ourselves to V8 as a target, a high-performance JavaScript and WebAssembly engine with a sophisticated and mature testing and fuzzing setup. In particular, Fuzzilli is a special-purpose fuzzing tool designed to find bugs in these engines. The usually complicated nature of these bugs makes for an interesting “playground” to compare the two approaches’ ability to find deep and complex bugs in well-tested software. We leave it to future work to perform similar analysis on a broader set of targets, fuzzers, and agentic bug finding systems.
We will now look into each of the three main questions in a dedicated section. Each section will first summarize the general approach, then describe the methodology in detail (often as bullet points, so you can skip those blocks if you don’t care too much about the details) before exploring the results. We conclude with an attempt at interpreting the results to get a picture of the current state of fuzzing vs. AI.
Part 1: Production Statistics
This is the simplest part to analyze, although with some caveats we’ll see in a bit. The basic idea is to query issues from
Chromium’s bugtracker
(where V8 bugs are tracked) and extract various statistics from there. This is especially easy since there’s a dedicated hotlist for each of the two systems. We limit our analysis to the six months from April to September 2026 as the automatic BigSleep pipeline only became active in April this year. As such, our raw data comes from the following two bug tracker queries:
Small win for BigSleep. However, this includes all types of bugs, and BigSleep initially also found a lot of configuration and integration issues in V8, for example
crbug.com/503869331
where the
unsafe flag blocking mechanism
didn’t work properly yet. These are legitimate issues, but less relevant for our comparison since there’s little real-world security impact. One easy way to get rid of these is to look specifically at vulnerabilities by limiting the results to
type:vulnerability
:
Fuzzilli: 178
BigSleep: 95
Suddenly a clear win for the fuzzers? Not quite. There are still some problems with this data, notably duplicates and unactionable reports (e.g. bugs
closed as WAI
). At first, this seems like a simple thing to fix: just include another constraint such as
status:(fixed | verified)
. Unfortunately, things are a bit more complicated. Take for example Fuzzilli bug
crbug.com/511935486
. The events on this bug are basically:
The bug is filed by Clusterfuzz on May 11 and assigned to an engineer
The bug is closed by Clusterfuzz as the testcase no longer reproduces later that same day
As such, this bug received zero developer interactions. Most likely what happened here is that this bug was a duplicate of another bug,
crbug.com/511210507
, but Clusterfuzz didn’t realize it as the crash signature (derived from the stack trace) was slightly different. When the other bug received a fix, the testcase stopped reproducing on Clusterfuzz, which closed the issue.
Maybe the best thing we can do is to look at “actionable” bugs, defined as those that are not marked as duplicates or WAI
and
that received at least one fix commit referencing them. Then, looking at only
Type-Vuln
bugs filters out a lot of the less-relevant BigSleep bugs, even though these were “actionable”. With that, the final picture looks like this:
So in terms of vulnerabilities, it’s roughly a tie (small advantage BigSleep) at the moment: 45 vs. 37.
This naturally raises the question of cost: how expensive is each of the two approaches and what does that mean in terms of cost-per-bug? Unfortunately, it’s challenging to make a comparison at this stage in the research. While some effort has been dedicated to making Clusterfuzz more efficient, similar effort has not been expended for Big Sleep and neither system is particularly calibrated for an optimal cost-per-bug ratio.
Part 2: Overlap
The next question is how much these approaches overlap each other. For this, our approach is twofold: we first attempt to find an answer in the bugtracker, by trying to identify bugs discovered by both systems. Next, we run a dedicated experiment in which we let BigSleep try to rediscover old Fuzzilli bugs.
Bugtracker Overlap
The basic idea is to see which bugs were found by both systems, so we’re effectively looking for duplicate bug reports. Similar to part 1, there are a few steps we need to take to ensure we get a somewhat accurate picture:
First, we look for bugs filed by one system that get deduplicated into a bug filed by the other. For example
crbug.com/522410841
which is a duplicate of
crbug.com/522860268
. This is a clear overlap.
Next, we need to take into account that many “unactionable” reports (those with zero associated fixes) are often duplicates. For those reports, we need to find the commit that fixed them, then look at the bug associated with that commit, and treat these two bugs as duplicates. This can be a multi-prong relationship: both bug X found by BigSleep and bug Y found by Fuzzilli might be a duplicate of bug Z reported by someone/something else. In that case, that bug still counts as overlap.
Then, we need to realize that many duplicates never receive a bugtracker entry since they are already deduplicated at the Clusterfuzz level (since both Fuzzilli and BigSleep rely on Clusterfuzz for basic triage and bug filing). As such, we need to query Clusterfuzz’s underlying database to find more duplicates.
Finally, we need to decide what to do with separate bugs that get fixed by the same CL, for example the four bugs fixed by
crrev.com/c/7965120
. While this can legitimately happen for distinct bugs, it’s probably more likely for the bugs to be duplicates (such as in this case), and so we count them as such.
With all the different types of deduplication, we get this final picture:
Again, looking at just the actionable vulnerability reports (likely the best measure), we see an overlap of roughly 25% (20 out of a total of 81), with a slight majority of these found first by Fuzzilli and later by BigSleep.
Overlap Experiment
The second way to measure the overlap is to run a dedicated experiment in which we try to re-discover bugs found by one system in the past using the other. Specifically, here we try to re-discover old Fuzzilli bugs using a BigSleep setup that’s as close to the production configuration as possible. For each bug we collect the commit that (likely) introduced the bug, and ask the agent to review those changes just as in the production CI environment. Note that the other direction, trying to rediscover past BigSleep bugs with Fuzzilli is more difficult to set up, since fuzzers cannot easily be given a similar “starting point”. Moreover, for many of these bugs we already know the outcome of such an experiment: the majority of “historic” BigSleep bugs (e.g.
those from 2025
) were found after fuzzers like Fuzzilli had already been fuzzing vulnerable builds for months, sometimes years. So they would most likely also not rediscover them in an experiment (except perhaps in a few cases where Fuzzilli was since updated to support new language features). Similarly, in production, BigSleep only reports crashes with a delay of 1-2 days (as there’s currently only one run per day). As such, fuzzers also get a head-start there.
In more detail, here is how the experiment is set up:
We start with a list of historic Fuzzilli bugs (from early 2023 until mid-2026) by querying the bug tracker hotlist. This gives us
around 1150 raw bugs
.
We restrict this to only
type:vulnerability
as these are the types of bugs we care most about and will remove some “noise” as above. We are left with roughly 600 vulnerabilities.
Next, we filter this list down to bugs that reproduce in the environment used by the agent. This involves two parts:
Bugs that reproduce on an x64 debug+asan build of the d8 shell as
provided by Chrome’s public build infrastructure
. This is important because many bugs only reproduce in special builds, for example because they are architecture-specific or need certain compile-time features.
Bugs that can be reproduced without special flags. The problem here is that fuzzers often set custom flags, either to enable in-development features (e.g.
--experimental-wasm-jspi
in
crbug.com/361123483
) or to turn on different fuzzing modes that make certain types of bugs easier to discover (e.g.
--deopt-every-n-times
in
crbug.com/362784006
). However, we can’t let the agent set arbitrary flags on historic V8 builds as these didn’t have a “safe-flags only” mode (leading to many false-positive crashes), and we also don’t want to tell the agent which flags it should use for a given challenge as that would be a hint. As such, for simplicity we limit ourselves to bugs that can reproduce with a standard set of flags (
--fuzzing
,
--jit-fuzzing
,
--expose-gc
) and only allow the agent to set those.
We end up with 132 historic bugs.
We now perform some deduplication similar to what we did above to identify implicit duplicates, which we remove. This leaves us with a final number of 112 bugs.
For a realistic comparison, we then convert these bugs into “code review challenges” similar to the ones used by the production BigSleep pipeline. For that, we try to identify the commit that (likely) introduced the bug, for example based on bisection. We note that this skews the comparison against BigSleep for two reasons:
We likely sometimes identify the wrong commit that is unrelated to the bug in question, making the task harder or even impossible.
We only have one commit per bug, while in the real world, the agent might discover the bug from another, subsequent commit that touches a similar part of the codebase.
We now run the agent for 25 attempts on each commit. The agent is asked to find bugs related to the commit and prove their existence by writing a testcase that crashes the vulnerable build. The attempt is terminated once a crash is found, so each attempt can report at most one bug. We use essentially the same configuration that was used in production BigSleep at that time, including the same underlying model:
Gemini 3.6 flash
.
Finally, we run some post-processing on the results to check if the agent found the “right” bug or an unrelated one. For that, we check that the testcase crashes the pre-fix revision but
not
the post-fix revision. This is imperfect but fairly easy to implement.
Here are the results from the experiment:
Starting from just the commits that (likely) introduced the bugs, BigSleep was able to re-discover ~62% of the original bugs, while finding a different (but by now fixed) bug for another ~12% of commits. On around 26% of the commits it failed to find any bugs.
Memorization
One thing to worry about with experiments such as this one is memorization: the LLM remembering specific bugs from its (pre-)training data and as such having an easier time “re-discovering” them during evaluation. We can try to get some idea of the effect of this by looking at the success rates for bugs from different time spans, e.g. every half-year period for which we have bugs in the data set. If there was memorization, we’d expect higher success rates (both for a single attempt and for the combined run) on bugs prior to the learning data cutoff of the model. Here are the results for our experiment:
For the model used in this experiment (Gemini 3.6 flash), the
knowledge cutoff date is March 2026
. Combining that with the fact that in early 2026, Chrome bugs would only become publicly visible after ~3 months, the effective knowledge cutoff for Fuzzilli bugs should be around Jan 2026. Looking at the data, there seems to be no statistically significant amount of memorization pre-2026. We note, however, that this may be different for other models or future model generations and as such recommend that this be re-evaluated for similar experiments in the future.
Difficulty
A follow-up question we might ask is how the overlap compares with “difficulty”. For example, in the best case a system like BigSleep would easily find issues that fuzzers struggle with and vice versa. In that case, budget that was previously spent on long fuzzing sessions may now be re-allocated and put to different uses. Here are the results of analysing this, where “bug difficulty” is measured by the time it took Fuzzilli to discover the bug:
While we do get a statistically significant result here (although not of particularly great magnitude), it actually points in the other direction! Bugs that are hard to find for a fuzzer are likely
also
hard to find for an AI agent. As such, those fuzzers should probably be kept running for now.
Components
Another thing we can look at is a per-component breakdown of the bugs and their rediscovery rates:
Interestingly, the overlap is significantly smaller for compiler bugs. This is the area where Fuzzilli probably specializes most in, which may explain the results. Later on (in part 3), we’ll also develop another hypothesis for why (some) bugs in the compilers may be more difficult to rediscover for BigSleep.
Prompting
A final question is how much the specific prompting played a role in the performance of the AI agent. For that, we run two quick follow-up experiments, only on the bugs that weren’t previously re-discovered and with different prompts:
Instead of starting from commits, we start from the vulnerable file or function. This may be an easier starting point but is still a fairly realistic setup since both can for example be obtained by extracting modified files and functions from a given commit.
Instead of asking the agent to find memory corruption vulnerabilities (what we care most about), we specifically tell it that assertion failures and similar crashes are also desirable.
Running these two experiments with only 5 attempts per bug (instead of the 25 used in the main experiment), the agent re-discovered 10 additional bugs in total: 8 from the different starting points and 7 with the rephrased prompt (with 5 found in both runs).
In total, combining these results with our original experiment, we get the following picture:
So the share of “correct” bugs found climbs to ~70%, and we find some kind of bug for ~84% of starting points. However, for fairness it should be noted that equivalent tweaks to a fuzzer could likely also result in higher discovery rates for certain bugs, so the results of this follow-up experiment should be treated with some caution.
Summary
The main results from our two angles are:
In production, the overlap is noticeable but not substantial at around 25%.
In our experiment, overlap was around 60% of historic Fuzzilli bugs (70% with additional runs that used different prompts).
The overlap is not uniformly distributed:
Bugs that are difficult for a fuzzer to find are more likely to also be difficult to find for an agent, so there’s more overlap on “easy” bugs.
The overlap seems to be smaller in the JIT Compilers and higher in the rest of the engine.
From just the experiment, we might expect a higher overlap in production. However, there are probably a few factors that prevent(ed) this:
There’s a limited time window for overlaps: once a bug reported by either system is fixed, the other system no longer has a chance to rediscover it (as the bug won’t reproduce on Clusterfuzz and will therefore be discarded).
Our experiment only looked at a subset of Fuzzilli bugs that reproduce on a standard x64 d8 fuzzer build and without special flags. In production, each system has access to slightly different and specialized builds, as well as different runtime flag constraints, and there the overlap is potentially smaller.
Pipeline hiccups such as overloaded servers or bugs in the automation likely prevented a number of commits from being reviewed by BigSleep in the last months, so bugs introduced by them may have been missed.
Since its introduction in April, the model underlying the BigSleep pipeline has been upgraded multiple times. Earlier models likely performed worse, and we expect future models to perform better.
Part 3: Shape of Bugs
In this section, we will first look at three case studies of bugs found by one system but not the other, then attempt to draw conclusions from these and other bugs.
BigSleep: Chrome Bug 449760249 (October 2025)
This
bug
is a nice example of BigSleep benefiting from the underlying model’s reasoning capabilities to discover a variant that was (likely) too complex to trigger by a fuzzer in a reasonable amount of time. It’s also a good example to show the general working of an agentic bug finding system.
Background: TDZ and Hole Check Elision
Before diving into the bug specifics, we first need to look at some JavaScript internals, specifically variable initialization. In JavaScript, variables declared with the
let
or
const
keywords cannot be used before they are initialized, and attempting to do so will lead to an exception (
”ReferenceError: Cannot access 'foobar' before initialization”
). In V8’s terminology, these variables reside in a “temporal dead zone” (TDZ) until they are initialized. Internally, V8 sets variables in the TDZ to a special sentinel value,
the_hole
, and then checks for this value when accessing the variable’s content.
To limit the performance impact of these hole-checks, V8’s bytecode compiler implements an optimization (behind the
default-enabled --ignition-elide-redundant-tdz-checks flag
) to identify redundant checks and subsequently remove them. The idea here is to identify “dominating” checks where it can then be guaranteed that a hole-check has already been performed for a given variable on all possible paths leading to the current position.
This is a security-relevant optimization as an incorrectly removed hole-check would result in the internal
the_hole
value leaking to JavaScript code, a condition that
has historically been exploitable
(although
new mitigations
for this bug class have since shipped).
The Original Vulnerability
The original bug (
issue 40071027
- discovered two years earlier by Fuzzilli!) involved
do-while
loops containing a
break
statement. In a
do-while
loop, the loop condition evaluates after the body. If the condition contains an assignment to a variable, the bytecode compiler will mark the variable as initialized. However, if a
break
statement executes in the loop body in the first iteration, then the condition will never execute. The bytecode compiler originally failed to account for this, leading to an incorrectly omitted hole check and subsequent leak of
the_hole
value.
Specifically, the patch works by creating a
HoleCheckElisionScope
for processing the condition code in case the loop contains break statements. This means that any updates to the TDZ state of variables will be discarded once the scope object is destroyed. As such, code after the loop will see the previous TDZ state (which is the correct behavior in this case).
Discovery of the Variant
The BigSleep agent began its analysis by examining the patch to
VisitDoWhileStatement
, realizing that the fix relied on
loop_builder.break_labels()->empty()
to decide if a protective
HoleCheckElisionScope
was required. It then began creating and testing various hypotheses for scenarios in which no
break
statement was registered with a given loop but the condition would still be skipped at runtime. For example, it hypothesized that a try-catch in combination with a
throw
inside the loop might confuse the hole-check elision logic. It then investigated how try-catch was implemented in the bytecode compiler and concluded that this was handled correctly.
Eventually, the agent started investigating
labeled breaks
, which allow directly breaking out of inner loops. It hypothesized that these might not be handled correctly and continued to investigate how these were being processed, for example by studying the logic in
BytecodeGenerator::VisitBreakStatement
. This time, it seemed to have identified a real flaw: in the case of nested breaks, the inner loop was apparently not being informed of the existence of a break statement! It therefore formulated the following vulnerability hypothesis:
If a labeled break inside a
do-while
loop targets an
outer
scope, the inner
do-while
loop’s
LoopBuilder
is not notified.
Therefore, when generating the code for the loop condition, the
HoleCheckElisionScope
introduced by the patch is
not
used.
The condition is bypassed at runtime, but the bytecode compiler erroneously removed a later hole-check, leading to a leak of
the_hole
to JavaScript.
The agent then began writing a testcase to prove the existence of this bug. The initial attempt with simply two nested loops and a label failed, however, as the bytecode compiler would
add another protective scope object for the labeled block
. To work around this, the agent decided to use a
switch
statement. When handling a
switch
statement, the bytecode compiler uses a
HoleCheckElisionMergeScope
to compute the intersection of initialization states across all branches. By ensuring that the variable was initialized in a
default
case, the merge logic then concluded that the variable was correctly initialized on all paths.
Proof of Concept
With that, the agent had everything in place to produce a testcase to demonstrate the vulnerability. Below is the agent’s PoC:
// Flags: --ignition-elide-redundant-tdz-checksfunctiontrigger(cond){{target:switch(1){case1:do{// Labeled break targeting the switch. The do-while LoopBuilder remains unaware.if (cond)breaktarget;}while((x=1)&&false);// Condition performs a check/assignment on x.break;default:x=1;// Ensure x is considered initialized across all switch branches for merging.}// Generator incorrectly believes x is checked/initialized. Elides TDZ check.x+1;letx;}}trigger(true);
Here is how this testcase works:
trigger(true)
executes, entering
case 1
of the
switch
.
The
do-while
loop executes
break target
.
Control flow jumps to the end of the
switch
, bypassing the
do-while
condition where
x
is assigned.
At runtime,
x
remains uninitialized (holding
the_hole
).
Because the TDZ check was elided at compile time, the engine leaks the internal
the_hole
value to JavaScript code in the
x + 1
expression, leading to a potentially exploitable condition.
We can see how this bug would be difficult for a fuzzer to find since the testcase is quite complex. While a coverage-guided fuzzer would have received rewards for triggering individual code paths (such as the handling of labeled break, the switch statement, the do-while loop, etc. in the parser), there is no additional reward for putting these together “in the right way” and so ending up with a testcase like this is quite difficult.
BigSleep: Chrome Bug 443765373 (September 2025)
This
bug
is an example of a relatively simple bug type that is challenging to discover with standard fuzzing approaches.
Background: Exception handling in V8
To understand this bug, it is necessary to briefly look into exception handling in V8. Take the following example JavaScript code:
Here, we have a function consisting of a try-catch block in which an exception is raised. Running this in d8 with
--print-bytecode
, we can see the internal bytecode that the engine generates to execute the JavaScript code:
For the purpose of this bug, the relevant part is mostly the last line of the output. Here, the bytecode essentially says “if there is an exception while the PC is between offset 3 and 6 in this bytecode, then execution should continue at offset 6 (the start of the exception handler)”.
The Bug
The agent spotted the bug while looking at the following function, responsible for writing the handler table data structure in memory:
Here, the
int
offset is being combined with a few other bits of data into a new
int
value. As such, the
handler_offset
cannot have the full integer range in the new field, possibly leading to integer truncation issues. The agent then investigated the specific bounds of these values and realized that the
HandlerOffsetField
had only 28 bits (allowing for 256MB) while the maximum bytecode size was 512MB! From there it was relatively simple to craft a testcase that crashes, simply by creating a huge function (resulting in >256MB of bytecode) with an exception handler at the end, then triggering an exception inside of it. The result is a jump to a wrong bytecode offset, a primitive that’s easily exploited. Here is the relevant part of the testcase:
// yield statements turn into a large chunk of bytecodeletkNumYields=500000;letbody=`
if ("foo" === "bar") {
${"yield* 42;".repeat(kNumYields)}
}
try {
throw 42;
} catch (e) {
// Will never get here
}
`;
Such a testcase would again be difficult to craft by a fuzzer as the fuzzer isn’t rewarded for creating large code (at least not with generic coverage feedback). In fact, the fuzzer is likely even actively discouraged from finding this bug since generating and executing large bytecode takes some time (in debug builds, the testcase generated by the agent needs a few seconds to trigger) and would therefore probably have led to timeouts during fuzzing.
Fuzzilli: Chrome Bug 40076141 (November 2023)
This
bug
is a good example of a type of bug that is likely difficult to find just by looking at (one part) of the source code. It was originally discovered by Fuzzilli and
not
rediscovered by any of the experiments from part 2.
Background: Value Representation in V8
Consider the following piece of JavaScript code:
leti=42;letf=13.37;lets="foobar"i=s;
Here we create multiple variables holding values of different types. Note, however, that we never declare the type of a variable, and that variables can hold values of different types throughout their lifetime (
i
first contains an integer, later a string). What we see here is that JavaScript is a
dynamically typed
language, and so variables (and also object fields, etc.) have no fixed type. However, the actual runtime values still need to have a type: the engine somehow needs to know that
foobar
is a string value and that certain operations (e.g. substring search) can therefore be performed on it. Conceptually, this is possible by representing runtime values with a struct such as
enumJSType{JS_TYPE_INT,JS_TYPE_FLOAT,JS_TYPE_STRING,...};structJSValue{JSTypetype;// Either the raw value or a pointer to another object, e.g a JSString.uintptr_tvalue;};
However, this is somewhat inefficient since we now need something like 16 bytes to represent a simple 4-byte integer at runtime. As such, modern JS engines use clever tagging schemas, which rely on unused pointer bits to encode type information. Specifically, in V8 the
JSValue
type is a tagged pointer (or just
tagged
for short) which stores one bit of type information in the least-significant bit:
If the bit is one, then the value minus 1 is a pointer to another object. This works because objects are aligned and so cannot start at an uneven address.
If the bit is zero, then the next 31 bits contain a raw integer value (also called a small integer - Smi)
As such, to figure out the type of a value at runtime, the engine first looks at the least-significant bit. If that is zero, the value can be “untagged” to obtain the integer value by right-shifting by one. On the other hand, if the bit is one, the value is a valid pointer to an object that contains further type information. For more details on V8’s pointer tagging scheme see also
this blog post
.
The Testcase
Let’s start by looking at the testcase produced by the fuzzer, which isn’t overly long:
The bug is caused during optimization of the loop by the Maglev compiler, specifically due to a conflict between two stages of the compiler pipeline: the initial graph builder and the later MaglevPhiRepresentationSelector.
The Graph Builder
The graph builder is responsible for building the initial Maglev intermediate representation (IR) of the code. For that, it consumes both the input code (in the form of V8 bytecode) as well as runtime feedback that was collected while the code executed in lower tiers such as the interpreter. When processing the loop in this testcase, the following happens:
Both
i3
and
v2
are modified during the loop. Since the IR uses
static single-assignment (SSA) form
, these turn into Phi nodes, which make the code look like every variable only has a single assignment :)
For the
i3 >= v2
comparison, the runtime feedback states that
i3
was so far always a Smi and therefore speculates that this will be the case in the future. It guards this assumption by emitting a
CheckedSmiUntag
, which will extract the raw int from the tagged value and will bail out to the interpreter if the input is ever not a Smi.
For the following operations on
v2
, the compiler can then rely on the existing check and emit
UnsafeSmiUntag
nodes, which avoid the runtime checks but are only safe to use if the input is guaranteed to be a Smi.
The resulting code for the loop now looks roughly like this (in Maglev pseudocode):
loop:
i3 <- Phi(1, i3_next) // loop variable, tagged
v2 <- Phi(1, v2_next) // loop variable, tagged
i3_int <- CheckedSmiUntag(i3) // deopt if i3 is not a Smi
v2_int <- CheckedSmiUntag(v2) // deopt if v2 is not a Smi
if i3_int < v2_int: break
v2_next <- Phi(i3, v2) // result of `v2 && i3`: "known Smi"
v2_next_int <- UnsafeSmiUntag(v2_next) // no (re-)check needed
i3_next_int = i3_int + v2_next_int
i3_next <- Int32ToNumber(i3_next_int) // tag the int32 result for the phi
The MaglevPhiRepresentationSelector
The purpose of this optimizer is to identify Phi nodes where all inputs have the same raw representation (e.g. int32), and if so convert the Phi to that representation to avoid future untagging operations. For the code above, the code sees that both inputs to
i3
are int32 and therefore decides to convert the Phi to int32 representation. Following
CheckedSmiUntag
operations then become a no-op and can be removed, while consumers that need a tagged value now require a conversion step. With that, the final code now looks like this:
loop:
i3 <- Phi(1, i3_next) // all inputs int32, so i3 becomes a raw int32
v2 <- Phi(1, v2_next) // stays tagged
v2_int <- CheckedSmiUntag(v2)
if i3 < v2_int: break // CheckedSmiUntag(i3) removed as a no-op
i3_tagged = Int32ToNumber(i3) // HeapNumber if i3 >= 2^30!
v2_next <- Phi(i3_tagged, v2) // stays tagged, needs tagged inputs
v2_next_int <- UnsafeSmiUntag(v2_next) // HeapNumber pointer treated as a Smi
i3_next <- i3 + v2_next_int // tagging no longer needed here
The Conflict
The bug now occurs because of two optimizations interacting badly with each other:
The graph builder uses
UnsafeSmiUntag
as it believes that the value must be a Smi at this point
The representation selector removes a
CheckedSmiUntag
as it believes it is no longer required
Specifically, what can happen now is that eventually,
i3
becomes larger than the maximum Smi value. At that point,
Int32ToNumber
can no longer fit the integer into a
Smi
and instead allocates a
HeapNumber
object (a container holding a larger number, basically). At this point, however, the
UnsafeSmiUntag
is no longer safe as the input is now a pointer. This leads to a corrupted pointer value being extracted and subsequently to memory corruption. Note that in the original code, this could not have happened as the
HeapNumber
would’ve been rejected by the
CheckedSmiUntag(i3)
.
What may have made this bug difficult to find for BigSleep is the fact that both optimizations are
correct in isolation
. As such, looking at just one of them would’ve made it difficult to spot the issue. The agent would somehow have needed to hypothesize about the other optimization or stumbled upon the relevant code by chance (or exhaustive search).
Overview
Looking at the examples above as well as other bugs found by LLMs, we can see a few clear examples of bugs where an LLM has the advantage:
Bugs that require complex logic to trigger but can be found through progressive logical reasoning and experimentation with the target program, such as
crbug.com/449760249
discussed above. This is likely the strongest advantage.
Bugs that require specific “magic” values (e.g. edge-case integers, specific strings, etc.), such as
crbug.com/443765373
discussed above.
Bugs that require new (or less common) features that a fuzzer may not be aware of. Examples include
crbug.com/436181695
, where the fuzzer didn’t support the new
await using
syntax yet, and in fact also
crbug.com/449760249
above where Fuzzilli lacked support for labeled breaks at the time.
Bugs that require a non-standard harness, custom flags, or special helper tools/functions that a fuzzer is not configured to use (e.g.
crbug.com/516833326
which required --expose-fast-api and the
d8.test.FastCAPI
API).
On the other hand, here are some advantages that fuzzers enjoy (for now):
They can find “non-local” bugs reasonably well
if
not too many individual pieces are required.
crbug.com/40076141
discussed above is an example for such a bug.
They can find bugs that are hard to spot by reasoning about the source code alone. One clear example would be bugs caused by (incorrect) C++ compiler optimizations such as
crbug.com/500771385
. Another potential example is bugs such as
crbug.com/414840455
, which are related to handling dead code in V8’s compilers. This is likely an unusual state and therefore may be hard to reason about. BigSleep missed a few of these in our experiments.
They are immune to certain biases affecting the agentic approaches, such as the choice of starting point (e.g. commits), the exact prompt phrasing, or the bug types seen (and not seen) during training. They do suffer from other types of biases though (e.g. the weights of individual mutators and generators).
They don’t get distracted by “shallow” bugs, whereas BigSleep missed a few bugs because it found easier ones instead. This is probably somewhat self-correcting though as the shallow bugs would eventually get fixed, giving the agent another chance to discover the deeper bug.
There is probably also a category of bugs that are hard to find for both approaches: bugs that are very non-local (bad for the agent)
and
require complex testcases (bad for the fuzzer) to trigger. In this case, a fuzzer would probably discover the individual pieces of the testcase (through coverage feedback) but won’t be able to find the right combination to trigger the bug (as in our first example). A code-reviewing agent, on the other hand, may struggle with the large search space of code fragments that may interact badly with each other (as in our last example). This is only a hypothesis, however, and would require further experiments and data to validate.
Part 4: Conclusion
In this blog post, we’ve compared coverage-guided fuzzers with vulnerability-discovery agents that read and reason about the source code. Specifically, we’ve looked at Fuzzilli and BigSleep, which both run as automated pipelines on V8 to discover newly introduced bugs. Looking at the data from those pipelines, we saw a roughly equal share of vulnerabilities found in the last 6 months (around 40 each), and a moderate overlap in discovered bugs of around 25%. However, in a dedicated experiment, overlap was closer to 60%. For now, this means that the two approaches remain complementary, and specialized fuzzing continues to provide value by finding bugs quickly and identifying certain kinds of issues that are otherwise hard to spot. At the same time, LLMs only very recently became capable of finding bugs in software like V8 at all, and have made tremendous progress since. The model used for our experiment is by now already outdated and outperformed by newer generations. Looking to the future, we expect further model improvements, potentially coupled with better prompting and more flexible harnesses (that e.g. allow the model to build, improve, and run fuzzers itself instead of being limited to pure code auditing), to lead to a growing share of bugs being discovered by agentic systems.
New Records Obtained by EFF Expose More Problems with Medicare’s AI Experiment
Electronic Frontier Foundation
www.eff.org
2026-10-27 15:05:42
New records obtained by EFF expose additional issues with Medicare’s AI-driven prior authorization program and show why we need stronger legal limits around government use of automated decision-making.
EFF sued the government back in March for information about the Wasteful and Inappropriate Servic...
New records obtained by EFF expose additional issues with Medicare’s AI-driven prior authorization program and show why we need stronger legal limits around government use of
automated decision-making
.
EFF
sued
the government back in March for information about the
Wasteful and Inappropriate Service Reduction (WISeR) model
, a new Medicare program that uses AI to evaluate prior authorization requests for certain medical services. We
previously released records
showing that WISeR has resulted in delays and denials of care, operational chaos, and reports of patient harm. Today, we’re publishing over 800 new pages of records, including:
Requests for information (RFIs) or requests for corrective action plans (CAPs) sent from the Centers for Medicare & Medicaid Services (CMS) to four of the six WISeR vendors, along with the vendors’ responses.
Applications of 66 companies to the WISeR model, including those of the 6 selected companies.
Task orders and contracts for the evaluation, implementation, and monitoring of the WISeR model.
Documents obtained through EFF’s lawsuit are available
here
.
These newly released documents show that the WISeR rollout was rushed and rocky from the start, highlighting the dangers that arise when governments
treat AI like a silver bullet
for complex problems. The documents also highlight the need for more transparency about safeguards against inappropriate, AI-driven denials. The public still lacks the information needed to assess whether clinician review is providing meaningful oversight of AI systems and whether appropriate data is being used to evaluate prior authorization requests.
EFF has
long argued
that AI has no place in consequential government decisions about peoples’ rights or access to benefits, such as
immigration enforcement
and
policing
decisions. That’s because using automated decision-making in these contexts risks decisions that violate people’s rights or deprive them of benefits they’re entitled to based on biased or inappropriate considerations and without proper due process or accountability if there is an error.
By outsourcing decision-making to private AI companies without sufficient transparency, testing, or legal limits, WISeR jeopardizes seniors’ access to medical care. Congress should step in to place greater legal limits on the use of automated decision-making in Medicare.
New records suggest that WISeR’s unusually rapid rollout contributed to widespread problems in the first few months of the program. CMS did not disclose the extent of these issues to the public, even as agency employees privately contacted vendors about potential noncompliance with program requirements.
In the first three months of the program, CMS sent RFIs or requests for CAPs to at least four of the six WISeR vendors. These requests, which describe delays, technical failures, and a lack of communication with providers, suggest that widespread problems during the program’s rollout were not limited to one vendor or state.
Excerpts from CMS’ letters to vendors describe problems during WISeR’s rollout:
Vendors’ responses to CMS provide further evidence that WISeR’s rushed rollout contributed to its problems.
Innovaccer claimed
it warned CMS months in advance that it might not be ready to provide full portal functionality by the launch date, even before signing a Participation Agreement. Another vendor claimed that “technical and workflow stabilization challenges were encountered due to the compressed implementation timeframe” it faced after joining the WISeR program a month after the other vendors.
The issues reflected in CMS’s letters to vendors, and the vendors’ responses, illustrate the risks of deploying automated decision-making systems without proper testing or safeguards. While
vendors’
responses
describe
fixes
for the problems CMS identified, after-the-fact remedies cannot undo the
harms
that patients and providers already experienced during WISeR’s rushed rollout.
More Transparency Needed About AI Safeguards
The public still knows far too little about any safeguards that WISeR vendors may have adopted—in part because the government chose to conceal some of this information. Transparency about these safeguards is critical to protecting patients, especially because WISeR’s
payment structure
gives vendors, as the government put it, “
an incentive to deny as many claims as possible
.”
Information provided by a vendor about safeguards that it says "ensure the responsible and clinically appropriate application of automation” appears to have been redacted from
records released to EFF
Ultimately, the records obtained by EFF raise more questions than they answer about the safeguards used by WISeR vendors.
Having a Human in the Loop Is Probably Not Enough
CMS has emphasized having a human in the loop as a key safeguard against inappropriate, AI-driven denials. The
WISeR FAQ page
on the CMS website states that “Non-affirmations will require the review of a human clinician and cannot be performed solely by technology.” But whether human review provides any meaningful protection depends on the
details of its implementation
, such as whether human reviewers have enough time to evaluate requests and practical authority to override AI recommendations. We still lack many of those details for WISeR vendors.
A
growing
body
of
scholarship
points to the substantial limitations of “human in the loop” policies as guardrails for AI systems. AI-generated recommendations can unduly influence human decisions, leading reviewers to over-rely on automated judgements and rubber stamp them as correct. Even worse, at least one health insurance company actively
pressured clinical reviewers
to accept its AI systems’ recommendations.
Another company
built a system that allowed clinical reviewers to reject claims without opening patient files; clinical reviewers using this system spent an average of just 1.2 seconds on each case.
Is the Right Kind of Data Informing Companies’ Decisions?
Some WISeR vendors’ applications offer general descriptions of the types of data informing their decisions. But far more details are needed to allow medical professionals to assess whether the data inputs to these AI systems are appropriate for evaluating prior authorization requests.
Inappropriate training data or input data can lead to biased, unfair, or inaccurate decisions.
CMS guidance
for Medicare Advantage organizations using AI to make coverage decisions emphasizes the importance of basing decisions on individual patients’ circumstances. It cautions against using “an algorithm that determines coverage based on a larger data set instead of the individual patient's medical history, the physician’s recommendations, or clinical notes.”
WISeR vendors’ applications reference data sources like “
provider behavior
,” “
patient demographics
,” “
utilization management datasets
,” “
provider and payer performance metrics
,” and “
historical claims data
.” Whether these sources could introduce bias or give too much weight to population-level patterns depends on how vendors use them to inform individual decisions. But we don’t yet have these important details about vendors’ data and algorithms. By outsourcing decision-making to private companies’ AI systems, the government has made it harder for the public to evaluate whether decisions are being made fairly.
Next Steps
As the government expands its use of automated decision-making, the potential for consequential mistakes increases rapidly. The records we’ve obtained so far raise questions about the rushed rollout and lack of guardrails for automated decision-making by the U.S. government. EFF urges transparency, oversight, and
legal limits
to protect people from the harms of automated decision-making in high risk systems.
An Evening with Berferd: In Which a Cracker is Lured, Endured, and Studied (1992)
It has been about four months since I
returned to Zig
after being absent for a few years. In this time, I have written some software in Zig and reengaged with the community, online and in person. I decided to share some of that experience, including what I have liked about Zig so far and what I haven't. I'll include some comparisons to Rust along the way since that was my previous go-to language.
Projects
The first project I started in Zig was
snurl
. It is a library for interacting with the smallnet (Gemini, Finger, Gopher, Spartan, and such). My goal has been to provide an alternative to curl for the smallnet, with similar testing and fuzzing requirements but on a smaller scale. I wanted to roughly follow
TigerStyle
insofar as it made sense for the project.
Something I ran into early on was that the fuzzer didn't actually work. When getting excited about fuzzing in my last post, I didn't realize that the feature had not yet been completed. This isn't surprising, considering Zig's status, but it was disappointing, especially since the fuzzer is demonstrated in the generated
main.zig
file provided by
zig init
.
After this, I wrote a two programs which I have not published yet. The first is a small TUI typer racer. It was simpler than I expected to get a minimum version working so far. The second is an n-body simulator with stellar evolution using raylib.
Zig Day
The most exciting opportunity in the last few months was the chance to go to a local Zig Day. I learned of Zig Day Seattle occurring on
Lobsters
on August 20th. I was ecstatic to learn that there was a Zig Day in my area. Then I saw Andrew Kelley would be there and became more excited.
Zig Days are local meetups where people interested in Zig hang out, work on their projects together, and talk about Zig. For this Zig Day, I decided to work on snurl. A friend,
Evin Yulo
also decided to attend.
The event itself occurred in the Bothell library, moved there from the Bellevue library after so many people signed up that capacity was overwhelmed. Having the creator of Zig at the event will do that.
I love the format of these Zig Days and I'm glad they are a part of the community. Since they are run by local groups, it gives the whole Zig community a more interconnected feeling. It's a way to interact with other people who are interested in Zig in person. And, in this case, the creator of Zig itself.
I got the chance to talk with other programmers about their projects. Hopefully some ideological cross-pollination occurred that will make all our projects stronger. I ended up working on snurl with evin, who started work on integrating Zig's standard library TLS implementation as alternative backend.
I also briefly talked with Andrew Kelley. I hope Zig's built-in fuzzing gets fixed sometime soon!
Ryan Hendrickson
wrote an excellent article
outlining more of the events of that day from his perspective if you want more details.
I will definitely be attending Zig Day Seattle again in the future. I may even head down to Portland to catch one before the next local one comes around. I enjoy the opportunity to connect with other people interested in Zig and its values.
What I've Liked
anyzig
I love
anyzig
. I've had to use zig master and 0.16.0 for different projects, and anyzig has made that doable.
Unfortunately, it breaks outside of directories without a
build.zig.zon
, meaning if you have tooling that requires a
zig
command to work, it can only occur in project directories. This breaks autoformatting for my one-off Zig scripts. Maybe a default zig version could be provided in that case.
IO and Allocators
I know it frustrates some people, but I love the fact that you have to pass IO and allocator parameters to functions in Zig.
Allocators
I'll start with allocators, since they've been around longer. For each Zig function you have to accept an explicit allocator parameter. This is different from most programming languages which either use a default allocator that may be changed globally or one changed by a local
context
(see Odin).
I like being able to change allocators for different parts of code. You might want an arena allocator for some things but need a general purpose allocator for others. Sometimes a
FixedBufferAllocator
is all you need to perform an operation. Zig's style makes this all obvious to handle.
I prefer Zig's system to Odin's implicit
context
system since Zig keeps things explicit. It's clear whether a function allocates memory or not, and hard to accidentally pass in the wrong allocator.
This is also superior to Rust's hidden, infallible allocations that panic when memory is exhausted. They're working on adding explicit allocations, but this will be yet another feature tacked onto the language rather than something built from the ground up.
It's much easier to reason about programs that allocate memory in Zig.
IO
The IO parameter is even more powerful, even if it is newer. It is well worth the breaking changes required to bring it about (even if I skipped the 0.15.0 -> 0.16.0 transition). In Zig, every function that interacts with the underlying operating system (with caveats) requires an "IO" parameter. This provides the context for input, output, and everything else. Porting Zig to new operating systems is mostly just porting IO.
Practically, this is really nice for testing. When testing behavior, you just need to put in a testing IO instance that works as you need it to. You can change the input stream however you want, cause writes to fail, and anything else.
Just like with allocation, passing an IO argument makes it clear which programs are pure and which ones are not. You can tell at a glace whether or not a program is going to modify something external.
Zig has a really good track record of keeping things simple while also adding powerful features. Instead of adding 100 small features that do slightly different similar things, it tends to provide one major feature that supports all the various other use-cases. Low floor, high ceiling.
Comptime
I love comptime. It's a seamless way to do metaprogramming and precomputation all in one. Other people have written more detailed accounts so I shall move on.
Build System
Zig's build system
is stellar. So much so that companies like Uber have adopted it for their software written in other languages.
One thing I like about it is that I can integrate other tools with it seamlessly in ways that Cargo complains about. This is especially important for one of my projects that involves code generation.
Dependency Culture
Zig has an excellent dependency culture. The main ethos is simple: avoid. When you don't need a dependency, don't add one. However, when you do, it's often a battle-tested library that Zig can effortlessly integrate with translate-c. You can easily also vendor in external dependencies and audit their code.
Most of my Zig programs have about one or two direct Zig dependencies, with zero indirect dependencies. This makes the codebase much easier to audit and control.
This stands in stark contrast to Rust, where the smallest of my projects regularly have a few direct and dozens of indirect dependencies.
This is thanks both to Zig's dependency culture and the fact that essential features like reflection, random number generation, clean error handling, and JSON parsing are built into the language or standard library rather than maintained as separate individual libraries. No need to depend on serde or syn in every program.
Zig encourages careful consideration before adding dependencies, and I appreciate that.
Handling Errors Effortlessly
Zig pushes programmers to handle errors correctly by default. The laziest way to handle errors in Zig is to use the
try
keyword and add
!
to the function's return type.
This contrasts to Rust, which leads programmers to insert panics into their code. The issue is that it's often easier to panic when prototyping, and then leave that in the code longer than it should be. I've used production code written in Rust that panic instead of returning a proper error.
In Rust you can use
?
, which is quicker than
unwrap
, but you also have to do something like
Result<Type, Box<dyn std::error::Error>
. That's a mouthful! Alternatively, you can use the anyhow crate and return
anyhow::Result
, which also provides some nice helper methods. But then you have to add a dependency for reasonable error handling. There's also Zig-style
composable errors
with yet another library.
Incremental Compilation
The core team members at Zig have been doing amazing work at incremental compilation. If you run
zig build --watch -fincremental
, the compiler will watch for changes, check exactly what you changed, and then modify only what you've changed down to linking. No effort beyond what's required, so it's faster that human perception even for large codebases. Zig was designed from the ground up to support this behavior.
This makes for a really nice workflow. I can just run the compiler in incremental mode right next to my text editor, and get updates on my code as I save. No time to get distracted with something else. With Rust projects 10+ seconds incremental compilation loops were common even in smaller projects. That's enough time to get distracted but not enough time to be productive doing something else, leaving annoying gaps that Zig eliminates.
Rust is disadvantaged here. It's a stable language that needs to maintain backwards compatibility. This means it can't afford to break things in order to improve compilation speed, at least not to any large degree. Meanwhile, if it makes Zig better, the maintainers are willing to break just about anything to ensure the end result will be perfect.
Currently, Zig only supports incremental compilation on x86_64 on Linux and macOS. If you use another operating system or architecture you won't have access to this feature yet, but in that case it's another thing to look out for!
This makes Zig just a bit more wonderful to work with. I'll take it.
What I'd Like to See
Improved Stability
Like every other user of Zig, I would like to see the standard library become more stable. I know that's one of the last tasks to do before 1.0, and there are many others before then, but it is frustrating to deal with the constant breakage in the ecosystem. My understanding is that that's why 0.17.0 took so long to be released.
Andrew Kelley said at Zig Day that he would like to see 1.0 more than anyone. I believe him, so I will have patience and trust that the final version will be excellent.
This is the one reason I still use Rust for some projects. Some cases require a stable programming language and the ecosystem that provides. But considering the impressive software that's being built in Zig these days, stability isn't everything. And there are projects for which the niceties of Zig outweigh its instability. I can't wait for 1.0.
Lifetime Support
I would like to see more assistance with lifetimes in the Zig compiler. Specifically, I would like to see returning local variables to fail in debug mode, either as a kind of built-in lint (as Andrew Kelley has mentioned wanting to implement) or as literally invalidating that memory after the function returns. That way new users quickly learn to avoid that pattern. Currently, it's easy to unintentionally break your code this way, even if you think you understand lifetimes.
Relatedly, the compiler currently accepts code that will be broken in the future. The compiler lets variables live the entire scope instead of the scope of a block. This means that if you stack-allocate a buffer and return it from a block, that buffer should be invalidated but isn't. My understanding is that this could silently break in a future Zig version.
// This works but will be invalid.const foo = blk: { var buf: [1024]u8 = undefined; const n = try writeToBuf(&buf); break :blk buf[0..n];};
More Documentation
Zig is poorly documented. It has enough to get you started, but to continue onward you have to parse intention from sparse doc comments that are sometimes attached to functions. Examples are rare. I still haven't got Zig's standard library TLS working in snurl because neither I nor a friend can figure out how to set up the buffers correctly.
Because of this lack of documentation, a lot of the knowledge for building solid Zig programs is distributed across the Web. If you're well integrated into Zig communities, having read the existing documentation, watched the presentations, and read the code, you can succeed. If you aren't that well integrated, however, it can be a challenge to work effectively.
The benefit of this is that it encourages people to engage in
Zig communities
(I'm an admin for the Matrix room, for example). While LLMs seek to demolish human collaboration, we need human-to-human collaboration now more than ever. However, we can still have that and nice documentation too. As we all know, people will still ask questions if you have things well-documented. And a good community knows how to point people towards good resources rather than just saying "RTFM".
I would also be curious to see what the intersection of Zig and literate programming could be. My literate programming tool is written in Rust right now, but that might change.
Comptime Allocators
I would love to parse JSON at compile time. For one of my projects, there is a JSON file that is stored inside the binary. It's static and could be parsed at compile time into a collection of structs.
However, the standard library JSON parser requires an allocator. Because there are no allocators that work at compile time, this means that any JSON parsing must be done at runtime. So that's what I did with my project.
I believe there is an intention of adding a JSON parser that does not require an allocator (the data already exists in the JSON string, after all). That will solve the immediate problem, but there are more general cases that may require an allocator. I believe
FixedBufferAllocator
worked at compile time before and served this purpose. It could do so again.
The one caveat to this is that it requires the compiled binary blob checked into the source code. This is better than requiring the full previous compiler (like Rust), but it's not as good as having the full source available for every step of the process at all points. A malicious actor could still sneak something into the blob. More importantly, many distributions (like Debian) cannot properly package Zig at the moment because it's impossible to do so in a way that's compliant with their guidelines.
Their original plan was to use the compiler's C backend to generate a C version of the compiler which would then be maintained separately. They would then have two different source versions. They decided this approach would be too difficult, unfortunately.
Because of this, someone will have to make another Zig compiler in another language (probably C) that will improve the bootstrap process. This is explicitly not something the Zig Software Foundation wants to develop right now. This means that at the moment there is no way to bootstrap Zig fully from source.
This issue isn't just a theoretical problem. Because Zig can't be packaged on Debian, I had to choose another language for one of my projects to ensure wider possible usage.
Fortunately, this issue is temporary. Once Zig is stable, building an alternative compiler should be straightforward. Zig is designed to be a simple language where alternative implementations are humanly achievable, unlike
other languages
. Currently, the instability means any alternative compiler will be playing a constant game of catch-up, which is probably why the core team doesn't want to manage it while they're rapidly iterating.
Alas, this may also require waiting for 1.0. May it come soon!
Moving Forward
I will continue to use Zig. I'm excited about the direction it's going and I look forward to continuing to be a part of its community. So far, I've found no other programming language that I prefer more than Zig, even with its shortcomings. It's just stable enough that I don't have to make massive changes between releases. It will continue to be my go-to programming language for most projects.
One of these projects is
ReTangled
. It was previously written in Rust but I grew tired of the massive dependency trees and want to take full advantage of Zig's build system.
I've also been looking to contribute more to Zig directly. Between my limited time as a student, Zig's overflow of contributors already, and the poor documentation, this will be a challenge. But I want to contribute back, make an impact on the project, and become a better software engineer. Thankfully, improving contributor onboarding seems to be a priority for Andrew Kelley moving forward.
I'll also be at future
Zig Days
in Seattle, if you want to meet and work on Zig projects together!
Discord will soon let anyone find public server messages through Google
Discoverable Servers
are the most public spaces on Discord, with at least 1,000 members. Their admins chose to list them in Server Discovery so anyone can join them, no invite link needed.
Discussions in Discoverable Servers will soon be easier to find when you search the web, so you can find the answer you’re looking for and step straight into the conversation on Discord. Admins and members can decide if and how their content is shared, and those controls start rolling out today, ahead of any changes.
TL;DR:
Help people find your community with Server Web Pages.
A Server Web Page is a page on the web that describes a Discoverable Server, so people can decide whether they want to join. Starting November 16, 2026, all Discoverable Servers will have a Server Web Page. These pages may also display summaries of discussions happening in public channels (those visible to everyone in the server), to give a better sense of what people are talking about. Some messages from public channels may show on Server Web Pages and in web search beginning in mid-December 2026. The rollout is gradual, so it may be a few weeks before the first messages start appearing on the web.
Server admins can opt channels out starting today, before anything goes live on November 16, 2026.
Controls for admins are in Server Settings > Web Presence. You can choose which channels take part, or opt all channels out. If you don’t change anything, public channels stay on, and your Server Web Page goes live on November 16, 2026, if you don't already have one.
Users have control over whether their messages are shown.
If you'd rather your messages weren't shown, you can turn that off starting today in
User Settings > Data and Privacy
, before messages start rolling out in mid-December 2026 (or anytime after). One setting covers Channel Messages in every Discoverable Server. Channel Summaries are generated separately, from broader channel topics, and will still appear on Server Web Pages unless admins choose to turn them off. Usernames and avatars won't be shown alongside messages on Server Web Pages
Private servers, DMs, and GDMs are always private and not included in these changes.
These changes are limited to Discoverable Servers.
How servers work today
Over the years, Discord has built different kinds of spaces, so every group can decide how big the party gets and who can find it:
Most servers are small, private spaces.
They're meant for you, your friends, and nobody else.
Community Servers are for bigger groups
, with the tools to handle a crowd. Though someone still has to send you an invite link.
Discoverable Servers are the most public spaces on Discord
. To qualify, a server needs at least 1,000 members, has to be at least eight weeks old, and must meet
activity and safety requirements
. Anyone can find and join them, no invite link needed.
Today’s announced features only apply to this type of server.
Today, there are more than 63,000 Discoverable Servers, spanning communities from speedrunning to language learning to niche corners of every fandom. People find their way into communities they'd never have stumbled across otherwise. Until now, that's all being Discoverable meant.
Why this matters
Server Discovery was built for finding servers, not answers. Ever wanted to look up tricks for a faster speedrun? Or whether a powerful item is worth grabbing, or if it will completely ruin your build? Someone has almost certainly already answered it in a channel somewhere, in one of 63,000 Discoverable Servers. It can just be hard to find.
Prior to Discord's launch, message boards were common, ranging from community-driven forums to official ones run by game studios. These message boards excelled at hosting long-form, structured conversations about helping people, theory crafting, and more. While they still exist today, many have moved into Discord servers. This has led to valuable information being locked in Discord conversations, inaccessible to the wider internet. We want to fix this.
By giving admins the option to make certain channels discoverable from the web, we can help more people find and benefit from the knowledge shared in Discord communities.
We expect this to help different types of communities in various ways:
For fandoms, you can make specific channels an easy-to-find resource that answers the top questions new players ask.
For content creators, you can more easily promote events and new content drops.
For indie game developers, you can use public channels, including forums, to share updates and wiki-style information about your games.
What's new for Discoverable Servers?
Server Web Pages live on the open web and give people a glimpse of what a Discord community is about before they join. They’ve been available to Discoverable Servers for some time, but setup takes a few steps, so not every Discoverable Server has created one. Learn more about
Server Web Pages
.
Starting from November 16, 2026, every Discoverable Server will have a Server Web Page.
If you’re an admin and have already set one up, you don't need to do anything. If you don’t have one and want to get a head start on how your community shows up to the rest of the internet, you can go through the setup process today and publish it in a few clicks. If your moderation team doesn't set one up beforehand, a default page goes live for you on November 16, 2026, using details from your Server Profile. You can edit it whenever you like. Having a Server Web Page is a core part of being a Discoverable Server. If you don't want one, you can always switch back to being a
Community Server
.
Server Web Pages are also getting more useful.
Until now, your Server Web Page has shown a small description of what your community is about. From November 16, 2026, it may also start showing what your community is
talking
about. Including this helps someone with a question find their way to your community if it already has the answer.
Channel Summaries.
These show a small slice of what's being talked about in your server, directly on your Server Web Page. These automated summaries focus on active conversations from November 16, 2026, onwards. Admins can change which channels they draw from, curate the summaries that are shown, or turn them off entirely. Usernames and avatars will not be shown in summaries.
Channel Messages.
From mid-December 2026, answers to questions your members sent in public channels can be found in a web search, in their own words. Server admins decide which channels take part, and server members can choose whether their own messages appear. Usernames and avatars will not be shown alongside these messages.
You can already see an early version of this on a few Server Web Pages. We’ve been piloting Channel Messages with Discoverable game communities, including
NBA 2K
,
Rust
, and
Dead by Daylight
. (During this pilot, all posts were from admins and moderators, not members.)
If you're running a community, useful answers to common community questions can show up in web search: how to unlock an easter egg, new builds or strategies, or a boss guide. Someone looking for help will be able to find a real answer from a real person, and can step straight into the conversation that it came from by clicking through and opening Discord.
What does this mean for Discoverable Server members?
Starting mid-December 2026, if a server’s admins allow it, messages from public channels can appear on Server Web Pages and in search results, without usernames and avatars. Messages you sent before then won’t be shown. Channels where content may appear on the web will be labeled, so you know before you send a message.
If you'd rather your messages weren't shown,
you can turn that off today
in
User Settings > Data and Privacy
. One switch covers every Discoverable Server you're a part of.
We're rolling this out gradually, so it may be a few weeks before the first messages from those channels go live.
Learn more
.
What can admins do now?
Your server controls start rolling out today
, in Server Settings > Web Presence. You can choose which channels take part, or turn them all off.
If you don’t change anything, public channels stay on, your Server Web Page goes live on November 16, 2026
(if it's not already published), and
Channel Summaries can start the same day. Channel Messages start rolling out in mid-December 2026.
You can adjust your Channel Summaries and Channel Messages settings before they roll out. And if you'd rather publish your Server Web Page yourself, you can do that today.
However you set things up, we hope this is a step toward bringing back what made forums great: answers anyone can find, and an open door to the community that wrote them.
Frequently Asked Questions
How will I know if I am in a server that allows content to appear on the web?
Discoverable Server admins choose which channels to make available on the web.Those channels will be labeled, so you’ll know before you send a message. As always, you can customize your own privacy choices in your user settings under Data & Privacy.
What if I decide later that I don’t want my messages shown on the web?
You can turn off your Channel Messages setting anytime in
User Settings > Data and Privacy
. Messages you send after that won’t appear on the web. Messages you sent while it was on stay up unless you delete them from Discord. Messages from before mid-December 2026 aren’t included, regardless of your setting.
Learn more
.
Does this work the same way in every region or for every user?
In the EU, UK, Canada, Brazil, Australia, and South Korea, the member setting for Channel Messages is off by default given legal restrictions, so members’ messages won’t appear on the web unless they turn it on. Users in the teen age group are excluded completely and cannot enable Channel Messages until they’re an adult. Everywhere else, it’s on unless members turn it off. Other than that default, everything works the same way in every region.
Learn more
.
GoAhead is used in hundreds of millions of IoT, Firewall, OT, and Military devices including those from Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing, and more.
Three independent bugs in GoAhead's TLS integrations can leave revoked client certificates accepted, encrypted sessions recoverable to an observer or a configured chain-depth limit unenforced. Exposure depends on the TLS library and the verification settings built into the device:
OpenSSL-compatible backend - Critical, CVSS 9.1 - CRL loaded but not enforced, revoked client certificates are silently accepted. GOAHEAD-SA-2026-0006.
LibreSSL legacy verifier - High, CVSS 7.4 - An over-depth client chain is accepted when client certificates are required but issuer checking is disabled. This bypasses the chain-depth restriction. GOAHEAD-SA-2026-0004.
Mbed TLS - Medium, CVSS 5.9 - A buffer-length typo reduces a 2048-bit DH modulus to one byte. TLS 1.2 DHE_RSA sessions are decryptable when the client accepts the broken parameters. GOAHEAD-SA-2026-0005.
TLS build
GoAhead versions
Required configuration
Fix or mitigation
OpenSSL-compatible backend
>= 3.4.5, <= 6.1.0
mTLS enabled with a CRL configured. Revoked client certificates remain accepted even with issuer verification enabled.
Upgrade to
6.1.1 or later
.
Mbed TLS backend
>= 4.0.2, <= 6.1.0
TLS 1.2 DHE_RSA negotiated with a client that accepts the broken DH parameters.
Upgrade to
6.1.1 or later
, disable finite-field DHE suites, or use the OpenSSL backend.
LibreSSL legacy verifier
— 3.2.x or 3.3.2–3.3.6
<= 6.1.0
VERIFY_PEER=1
and
VERIFY_ISSUER=0
. An over-depth client chain is accepted.
Enable
VERIFY_ISSUER=1
with a trusted CA bundle, or use OpenSSL / LibreSSL 4.x.
Background
GoAhead is an embedded web server used for device management: routers, switches, printers, gateways, and industrial controls and is deployed in hundreds of millions of devices.
Each finding below affects a specific subset of those deployments, depending on the build and configuration.
GoAhead supports two TLS backends: OpenSSL, the default, and MbedTLS. The OpenSSL backend also works with compatible libraries such as LibreSSL.
GoAhead takes a compile-time approach regarding certain configurations:
-
ME_GOAHEAD_SSL_VERIFY_PEER=1
requires a client certificate.
-
ME_GOAHEAD_SSL_AUTHORITY
points at a PEM bundle of trusted CAs.
-
ME_GOAHEAD_SSL_VERIFY_ISSUER=1
requires the certificate chain to establish issuer trust against that bundle.
-
ME_GOAHEAD_SSL_REVOKE
points at a PEM-encoded Certificate Revocation List.
- The OpenSSL backend sets a chain-depth limit of 10 (
VERIFY_DEPTH
).
OpenSSL-compatible builds
GoAhead's OpenSSL backend loads the configured CRL into the certificate store but never enables revocation checking. Revoked client certificates can therefore complete the mTLS handshake even when issuer verification is enabled.
The CRL is loaded in
sslOpen()
:
OpenSSL requires
X509_V_FLAG_CRL_CHECK
to enable CRL checking. Loading the file into the store does not set that flag. Without CRL or OCSP checking enabled,
check_revocation()
returns success before checking revocation status:
GoAhead never sets either CRL flag. OpenSSL returns success without checking the loaded list. The application's callback would reject error 23,
X509_V_ERR_CERT_REVOKED
, through its
default:
branch, but the verifier never generates that error.
On GoAhead 6.1.0 with OpenSSL 3.6.2, a revoked CA-signed client certificate completed the mTLS handshake with issuer verification enabled. The verification callback reported error 0 throughout the chain:
X509_STORE_load_locations()
succeeds, so startup produces no warning that CRL enforcement is inactive.
Affected:
GoAhead 3.4.5 through 6.1.0 using the OpenSSL-compatible backend with a CRL configured. The security impact is clearest with
VERIFY_PEER=1
, a trusted CA bundle, and
VERIFY_ISSUER=1
: a previously trusted but revoked identity retains access. When issuer checking is disabled, the CRL defect remains but unknown issuers are already accepted by policy.
Fix
: 6.1.1 now checks after loading the CRL:
Mbed TLS builds
GoAhead's mbed TLS backend configures the RFC 3526 2048-bit DH group through
mbedtls_ssl_conf_dh_param_bin()
. The modulus length passed to that function is taken from the generator buffer:
The size arguments tell mbed TLS how many bytes to read from each buffer. The call uses
sizeof(dhm_g)
for both, even though
dhm_g
is only one byte long. The length for
dhm_p
should be
sizeof(dhm_p)
, or 256 bytes.
As a result, mbed TLS reads only the first byte of
dhm_p
:
0xFF
(255). The remaining 255 bytes are discarded. It accepts this value and sends it to the client during the TLS 1.2 DHE_RSA handshake:
In ServerKeyExchange,
00 01 ff
identifies a one-byte DH parameter with the value 255. It should contain the full 256-byte value.
The broken parameters leave just eight possible shared-secret values :
01
,
02
,
04
,
08
,
10
,
20
,
40
and
80
in hex. An observer can try each candidate and identify the correct one by checking whether it decrypts the captured traffic successfully.
In the attached PoC, I managed to reproduce the shared secret after five attempts. It matched the client's secret, confirming that the same TLS session keys could be derived to decrypt the HTTP exchange.
A passive observer can decrypt captured sessions using the recorded handshake and encrypted application records completely out of band.
Exploitation requires a client that accepts the broken DH parameters. The tested OpenSSL client rejected them with
DH_check_params_ex: modulus too small
. Permissive clients, including custom or embedded implementations without a minimum-size check, can complete a decryptable session. ECDHE sessions and TLS 1.3 are unaffected by this configured finite-field group.
Affected:
GoAhead 4.0.2 through 6.1.0 using the mbed TLS backend with TLS 1.2 DHE_RSA suites, where the client accepts the parameters. The typo entered in 2018 during migration to the binary-parameter API and survived the April 2024 TLS refactor. Mbed TLS 4.x removed the
TLS_DHE_*
suites, so this DHE path isn't impacted.
If you see any of these suites in the JA4S logs of your environment, you might be impacted (eg.
t120100_009f_1ca028f07214
)
A sample query you might want to run (in Splunk or other) would look like:
replacing 0014 with the curves listed above.
Fix
: 6.1.1 fixed the typo
LibreSSL builds
Essentially, an attacker can present a certificate chain longer than GoAhead’s limit and still complete the mTLS handshake on an affected build. LibreSSL reports an issuer error instead of a depth error. GoAhead accepts that issuer error when issuer checking is disabled.
GoAhead 6.1.0 sets a chain-depth limit of 10 using
SSL_CTX_set_verify_depth(sslctx, VERIFY_DEPTH)
. Its verification callback also checks the depth:
That check only assigns a depth error when
ok
is true, the reported depth exceeds the limit, and no error is already present. The callback then classifies the error:
Error 20,
UNABLE_TO_GET_ISSUER_CERT_LOCALLY
, is tolerated when issuer checking is disabled. Error 22,
CERT_CHAIN_TOO_LONG
, is rejected.
LibreSSL 3.2.x and 3.3.2–3.3.6 use the legacy X.509 verifier by default for peer verification. Its chain-building loop contains a FIXME comment (which is what prompted a look at GoAhead in the first place):
The loop stops building the chain without recording the depth error. The failure later reaches GoAhead as error 20. With
VERIFY_ISSUER=0
, the callback accepts it.
On GoAhead 6.1.0 linked against LibreSSL 3.3.6, a 17-certificate chain rooted in an attacker-controlled, self-signed CA produced the following callback trace:
The handshake completed and the resource behind the client-certificate requirement returned HTTP 200. The same GoAhead source built against LibreSSL 4.3.1 received error 22 at depth 10 and rejected the chain.
With
VERIFY_ISSUER=0
, ordinary self-signed certificates are already allowed. The over-depth chain bypasses the separate chain-depth restriction because the verifier reports a tolerated issuer error. Deployments requiring a trusted client CA reject it.
Demonstrated configuration:
GoAhead 6.1.0 with the LibreSSL legacy verifier,
ME_GOAHEAD_SSL_VERIFY_PEER=1
, and
ME_GOAHEAD_SSL_VERIFY_ISSUER=0
. Enabling issuer trust rejects error 20. OpenSSL, BoringSSL, AWS-LC, and LibreSSL 4.x builds are not exposed to this legacy-verifier trigger.
Conclusion
All three findings affect GoAhead's integration with its TLS libraries. CRL enforcement depends on a verification flag, DH parameters depend on the supplied buffer lengths, and chain-depth enforcement depends on how verification errors are handled. None of these defects prevents the affected handshake from completing.
The backend and build configuration determine which defects apply. LibreSSL builds can inherit both the CRL defect in the OpenSSL-compatible backend and the legacy verifier's depth issue. The mbed TLS backend uses a separate verification path but is affected by the DH truncation when a client accepts the parameters.
To find impacted publicly facing servers in your fleet, here are the JA4Scan-TLS fingerprints that map to the different backends:
One of the things you get to do after being
laid off
is a lot of reflection, but also to revisit all the old projects you used to contribute to.
One of them was
Pidgin
:
“the universal chat client”
.
The new Pidgin 3 app icon and a handful emoji
I designed the original emoticon set for version 2 and helped redesign the user interface when the project was renamed from
Gaim
after a
legal dispute
.
I’ve been meaning to start live streaming my
weekly app icon
work to share a look in the kitchen of the icon design process, but once I gathered the courage to start a test run, the experience wasn’t amazing.
I need something I can return to consistently without needing a new plan every time…
So why not create a base set of
1,447 emoji
for Pidgin in
GNOME
-style exclusively
live on stream
? What could go wrong?
Here’s the
design file
to keep me accountable, so I can’t sneakily make progress offline!
Twitch
I’ll be chipping away at it a few times a week. Follow me
on Twitch
to get a notification when I go live. We’ll grab a cup of tea, put on some music, and get through the winter.
If you want to support my design work for Free and Open Source projects, I’m always looking for more
sponsors
.
Microsoft releases Windows OOB updates to distrust eMudhra certificates
Bleeping Computer
www.bleepingcomputer.com
2026-10-27 14:20:28
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]...
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates.
The
KB5134133
update for Windows 11 versions 24H2, 25H2, and 26H2 and the
KB5134125
update for Windows 10 versions 21H2 and 22H2 were released on October 26.
The updates are for systems without Internet access, devices that cannot access Microsoft's certificate-update service, and those where automatic Certificate Trust List (CTL) updates have been disabled.
The updates were released
after the discovery
of eight eMudhra intermediate certificate authority private keys that were so weak they could be recovered almost instantly.
All eight keys were generated in April 2025 and had values smaller than 256, allowing anyone to recover them by testing just 256 possible numbers.
The compromised keys could have allowed attackers to forge certificates for legitimate websites and intercept encrypted communications.
After the disclosure, eMudhra revoked the eight compromised intermediate certificates, and Mozilla, Google, Apple, and other software vendors also began revoking them.
In response, Microsoft previously updated the Windows Disallowed Certificate Trust List to block the eight affected intermediate certificate authorities, including six used for TLS and two for code signing.
The company also released a CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates, which enabled the block without requiring a browser update.
Microsoft is now taking further steps by removing seven certificates associated with the affected certificate hierarchies from its Windows trust list.
"On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list," Microsoft
explained
.
The new update goes further by also removing trust in the eMudhra root certificates used to verify other certificates issued by the CA.
Microsoft says the same seven certificates will also be removed from the Edge trust list on October 27.
"Removing a root from a trust list is not the same as revoking the known impacted intermediate certificate authorities," explains Microsoft.
"This is a separate trust decision, broader than blocking the identified compromised intermediate keys. Organizations with a specific compatibility need may choose to trust a certificate locally, subject to their own security assessment and policies."
The company advises admins to install the update on disconnected Windows systems and identify any certificates that depend on the removed roots, as they may need to be replaced.
Microsoft is also investigating the remaining eMudhra roots and may make additional trust changes as needed.
Peter Robinson has written a blog post about
the current state of Fedora support for Raspberry Pi 5
devices. According to Robinson, the upcoming Fedora 45 release will
work—with caveats—on
all variants of the Raspberry Pi Model 5B; the
Compute Module 5 ...
Peter Robinson has written a
blog post
about
the current state of Fedora support for Raspberry Pi 5
devices. According to Robinson, the upcoming Fedora 45 release will
work—with caveats—on
all variants of the Raspberry Pi Model 5B; the
Compute Module 5 and Pi 500+ are still works in progress.
For Fedora 44 release you need to have a temporary workaround when booting. If
you update to the latest kernel/firmware straight away this isn't then needed
beyond the first boot. The workaround isn't needed for Fedora 45 so if you're
going to try this out I suggest you go and grab your favourite flavour of Fedora
from the Fedora 45 release candidates and jump straight in there! You will get
an accelerated desktop with storage/network/USB. There's not currently any
support for sound and a number of other things.
See Robinson's post for instructions on creating an Fedora image to use with
a Raspberry Pi 5.
What’s Left for ‘Pro and Tell’ Week: Touch-Enabled OLED MacBooks
Daring Fireball
www.macrumors.com
2026-10-27 13:59:47
Joe Rossignol, MacRumors:
Apple on Wednesday will announce 14-inch and 16-inch MacBook Pro
models featuring touch-enabled OLED displays with thinner bezels,
a Dynamic Island instead of a notch, M5 Pro and M5 Max chips, and
a lighter and slightly thinner design, Bloomberg’s Mark Gurman
reports. A...
Apple on Wednesday will announce 14-inch and 16-inch MacBook Pro models featuring touch-enabled OLED displays with thinner bezels, a Dynamic Island instead of a notch, M5 Pro and M5 Max chips, and a lighter and slightly thinner design,
Bloomberg
's Mark Gurman reports
. Apple is hosting a private
"Pro and tell" experience in Los Angeles
starting at 10 a.m. Pacific Time tomorrow.
Apple today sent out invites for an experience in Los Angeles on Wednesday, October 28, and the "Pro and tell" tagline on the invitation likely means that the rumored MacBook models with touch-enabled OLED displays will stick with MacBook Pro branding instead of the once-rumored "MacBook Ultra" name.
The long-rumored "iPhone Ultra" ended up being named iPhone Duo, so speculation that Apple...
Despite knowing that the iPhone Duo would face "severe supply constraints" due to manufacturing challenges, Apple chose to begin iPhone Duo pre-orders on Friday instead of waiting until it had more inventory ready, according to Bloomberg's Mark Gurman. In his Power On newsletter today, he called this decision a "major mistake."
"Let me cut to the chase: Apple made a major mistake here," he...
Apple's long-rumored smart home hub will have an iMac G4-style design and a host of unique features, Bloomberg's Mark Gurman reports.
The smart home hub is said to feature a square 6-inch display, with variants that can be placed on a countertop or mounted on a wall. It features a single FaceTime camera on the front, with microphones and speakers in its connected base. Gurman described the...
Protobuf in Python and TypeScript is actually good now
Protobuf and gRPC used to be a hard sell for teams that used Python or TypeScript. The official libraries
feel like C++ and Java ports
because, for the most part, they are. But it’s more than a developer ergonomics issue. They are also lacking features that are treated as baseline requirements for modern development. Generated code has no type annotations, and gRPC doesn’t work with standard web frameworks or in the browser. You can just tell that these libraries were made for a different era.
So we fixed it. Buf now maintains first-class Protobuf and gRPC libraries (via Connect) for both languages:
@bufbuild/protobuf
and
@connectrpc/connect
for TypeScript, and
protobuf-py
and
connect-py
for Python. These libraries essentially had to be rebuilt from scratch.
When an upstream runtime is already in good shape, we use it, reporting bugs and contributing fixes. For example, in Go,
google.golang.org/protobuf
is solid, so
connect-go
and
Protovalidate
build right on top of it. The Go library has had a few major changes in the past to keep up with the evolution of the language. Python and TypeScript are a different story. The official plugins for both languages went fifteen years with very little maintenance, missing out on type checkers,
ES modules
, and
fetch
. We couldn’t fix a fifteen-year gap just by sending a few pull requests.
TypeScript
Google built the
google-protobuf
JavaScript library for its internal Closure Compiler long before TypeScript existed. It outputs huge
.js
files with Java-style
getSentence()
and
setSentence()
methods and
no TypeScript types
. Some community plugins added TypeScript types, which helped, but many of them had bugs with
FieldMask
or 64-bit JSON integers when talking to a Go or Java service.
@bufbuild/protobuf
With
Protobuf-ES
(
@bufbuild/protobuf
), messages are just plain objects with standard TypeScript types:
import { create, toBinary } from "@bufbuild/protobuf";import { SayRequestSchema, type SayRequest } from "./gen/eliza_pb.js";const req: SayRequest = create(SayRequestSchema, { sentence: "Hello!",});const data = toBinary(SayRequestSchema, req);
There are no getters or setters to deal with. Also, as you’d expect from proper type definitions,
oneof
fields use normal TypeScript discriminated unions. We also made sure that the code is written so that bundlers can tree-shake unused schemas to keep bundle sizes small.
For RPCs,
@connectrpc/connect
works in the browser without a proxy. Connect supports the
Connect protocol
alongside standard binary gRPC and gRPC-Web over HTTP/1.1 and HTTP/2. That makes it a full gRPC and gRPC-Web client and server for TypeScript. Many teams find it useful for talking to existing gRPC servers and maybe never move on to the Connect protocol.
In the browser, the client uses
fetch
directly. You can see all of your RPCs in the Chrome DevTools Network tab and test endpoints with
curl
. If you use React,
@connectrpc/connect-query
gives you typed TanStack Query hooks for your RPCs.
Python
Python has changed dramatically since Google’s Python Protobuf library was written in 2008. Modern Python projects rely on
typing
annotations and type checkers like
pyright
or
mypy
. Most Python web APIs today also use
asyncio
and
ASGI
. However, Google’s
grpcio
library doesn’t support WSGI or ASGI at all, so you can’t mount a gRPC service inside FastAPI or Django.
The code that
protoc
generates for Python (
_pb2.py
) is also pretty strange if you’re used to “normal” Python. You can’t open the generated file and read a class definition, because metaclasses create the actual classes that you use dynamically when the module loads. This breaks autocomplete in your IDE unless you also configure
--pyi_out
to output extra
.pyi
stub files. Quirks from C++ also leak into Python in a few places. For example,
map fields behave like C++
std::map
rather than a Python
dict
:
# Instead of raising a KeyError, this mutates msg.items and inserts a default value!val = msg.items["missing_key"]
protobuf-py
We recently released
protobuf-py
(
buf.build/bufbuild/py
) and
connect-py
(
buf.build/connectrpc/py
) to give Python developers a stack that actually feels like modern Python.
You might be happy to hear that
protobuf-py
generates
normal Python classes
with inline type annotations. This means that static analysis tooling like
pyright
and
mypy
work right away without special flags or weird stub files.
protobuf-py
also passes the full conformance suite, which Google’s Python runtime
still does not
.
connect-py
When you pair it with
connect-py
, your RPC services are just standard ASGI or WSGI applications:
from connectrpc.request import RequestContextfrom eliza_pb import SayRequest, SayResponsefrom eliza_connect import ElizaService, ElizaServiceASGIApplicationclass MyElizaService(ElizaService): async def say(self, request: SayRequest, ctx: RequestContext) -> SayResponse: return SayResponse(sentence=f"You said: {request.sentence}")# Run directly with uvicorn, or mount inside FastAPI, Starlette, Flask, or Djangoapp = ElizaServiceASGIApplication(MyElizaService())
You get both async (
ElizaServiceClient
) and sync (
ElizaServiceClientSync
) clients powered by
pyqwest
, with support for streaming, interceptors, and compression. If you’re working in an existing codebase with Google’s
_pb2.py
messages, you can pass the
protobuf=google
plugin option to use
connect-py
today and migrate your messages later.
Elevating the ecosystem
Despite being decades old, the Protobuf wire format has aged well. Protobuf, the developer experience, has needed a bit more help. For years, the experience in a given language depended on how much maintenance its
protoc
plugin got, and Python and JavaScript got very little.
It’s tough to get a team excited about schema-driven development if the generated code feels foreign to them. When a language’s official runtime is in a good spot, like in Go, we build on it. When it’s stuck in the past, we build a proper replacement from scratch and open-source it for anyone to use, even if they don’t use the rest of the Buf toolchain.
Protobuf-ES
and
Connect-ES
made TypeScript a first-class Protobuf language, and
protobuf-py
and
connect-py
bring that same experience to Python.
This work also pushes the rest of the ecosystem forward. The
Connect protocol
made it possible to call RPCs from a browser without putting an Envoy proxy in front, and our focus on conformance has encouraged other libraries to fix their own spec bugs. Ultimately, we want Protobuf tooling to be better across the board so more teams can use a
schema-first API workflow
.
All of these libraries work alongside the Buf CLI, breaking change detection, the language server, and the
Buf Schema Registry
, which hosts the plugins and publishes
generated SDKs
for TypeScript and Python.
The modern Protobuf workflow
walks through how all of it fits together.
If you haven’t tried the TypeScript or Python libraries yet, start with the getting started guides:
The
Knownbits Toy abstract domain
that I wrote about earlier is great for
all kinds of bit manipulation rewrites. However, it is not particularly good at
recognizing where bits move around in a sequence of instructions. It has a
notion of "this bit is
0
or
1
or unknown" but no notion of "this bit is the
same as this other bit". This prevents it from optimizing something like this:
x = ...
a = x & 0x0f
b = x << 60
c = b >> 60
result = a & c
Here
a
and
c
compute the same value, so it can be optimized to
result = a
.
It is possible to do this optimization with local
peephole rewrite rules
too,
but doing that requires adding a lot of these rules, and if one is missing we
might miss collapsing a long sequence of operations.
In this post I want to talk about a more complicated
abstract domain
that is
great at optimizing this kind of bit movement. It's a "bit provenance" domain.
For every
SSA
variable in a trace, it computes where each bit from the variable
comes from (or whether it's constant
0
or
1
). In particular it can
track if a bit in one variable must be the same as the bit of another variable
at another position.
For the example above, the domain would store the following provenance
information. Nothing is known about
x
, so its bits refer to themselves.
Using 64-bit integers and a logical right shift, we get this table (most
significant bits first):
operation
Bit 63
Bit 62
Bit 61
Bit 60
Bit 59
...
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
x = ...
x[63]
x[62]
x[61]
x[60]
x[59]
...
x[4]
x[3]
x[2]
x[1]
x[0]
a = x & 0x0f
0
0
0
0
0
...
0
x[3]
x[2]
x[1]
x[0]
b = x << 60
x[3]
x[2]
x[1]
x[0]
0
...
0
0
0
0
0
c = b >> 60
0
0
0
0
0
...
0
x[3]
x[2]
x[1]
x[0]
result = a & c
0
0
0
0
0
...
0
x[3]
x[2]
x[1]
x[0]
Then we can directly conclude that
result
is the same value as
a
.
In the rest of the post I'll describe how the domain values store this
information, how the transfer functions work and how we can use the abstract
domain to optimize.
fromdataclassesimportdataclassINTEGER_WIDTH=64INT_MASK=2**INTEGER_WIDTH-1classValue:deffind(self):raiseNotImplementedError("abstract")@dataclass(eq=False)classOperation(Value):name:strargs:list[Value]forwarded:Value|None=Nonedeffind(self)->Value:op=selfwhileisinstance(op,Operation):next=op.forwardedifnextisNone:returnopop=nextreturnopdefarg(self,index):returnself.args[index].find()defmake_equal_to(self,value:Value):self.find().forwarded=value@dataclass(eq=False)classConstant(Value):value:objectdeffind(self):returnselfclassBlock(list):def__getattr__(self,opname):defwraparg(arg):ifnotisinstance(arg,Value):arg=Constant(arg)returnargdefmake_op(*args):op=Operation(opname,[wraparg(arg)forarginargs])self.append(op)returnopreturnmake_opdefbb_to_str(l:Block,varprefix:str="var"):defarg_to_str(arg:Value):ifisinstance(arg,Constant):returnstr(arg.value)else:returnvarnames[arg]varnames={}res=[]forindex,opinenumerate(l):# give the operation a name used while# printing:var=f"{varprefix}{index}"varnames[op]=vararguments=", ".join(arg_to_str(op.arg(i))foriinrange(len(op.args)))strop=f"{var} = {op.name}({arguments})"res.append(strop)return"\n".join(res)defdce(bb:Block)->Block:pure={"getarg","int_and","int_or","int_xor","int_invert","int_lshift","int_rshift"}used=set()kept=[]foropinreversed(bb):ifopnotinusedandop.nameinpure:continuekept.append(op)foriinrange(len(op.args)):arg=op.arg(i)ifisinstance(arg,Operation):used.add(arg)returnBlock(reversed(kept))deftest_dce():bb=Block()x=bb.getarg(0)live=bb.int_or(x,1)dead=bb.int_xor(live,7)bb.int_and(dead,15)forwarded=bb.int_and(x,0)forwarded.make_equal_to(Constant(0))bb.dummy(live)bb.dummy(forwarded)assertbb_to_str(dce(bb),"optvar")=="""\optvar0 = getarg(0)optvar1 = int_or(optvar0, 1)optvar2 = dummy(optvar1)optvar3 = dummy(0)"""
Then we can start implementing the domain values like this:
@dataclass(frozen=True)classSourceBit:source:Operationindex:intinverted:bool=False@dataclass(frozen=True)classBitProvenance:# least significant bit firstbits:tuple[int|SourceBit,...]@staticmethoddefmake(bits):bits=tuple(bits)iflen(bits)<INTEGER_WIDTH:# zero-extend, mainly for testsbits=bits+(0,)*(INTEGER_WIDTH-len(bits))assertlen(bits)==INTEGER_WIDTHreturnBitProvenance(bits)@staticmethoddeffrom_constant(value):returnBitProvenance(tuple((value>>i)&1foriinrange(INTEGER_WIDTH)))@staticmethoddeffrom_source(source:Operation):# nothing is known about this SSA valuereturnBitProvenance(tuple(SourceBit(source,i)foriinrange(INTEGER_WIDTH)))defget_constant(self)->int|None:res=0shift=0forbitinself.bits:ifisinstance(bit,SourceBit):returnNoneres|=bit<<shiftshift+=1returnres
Every
SourceBit
refers to a bit of an SSA
Operation
. For an SSA value that we
know nothing about, we use the
from_source
factory method, which returns
something of the form:
For a constant, the
from_constant
factory returns an abstract value where all
the bits are concretely known values. Constants are simply
0
or
1
and need no
source at all.
The
inverted
field of a
SourceBit
specifies whether the bit is a direct
copy of the source bit, or whether the bit is flipped.
Let's make sure we got the bit twiddling in
from_constant
and
get_constant
right by writing a
Hypothesis
test:
The simplest transfer function to implement for this domain is for
~
, bit
invert. It inverts constant bits and flips the
inverted
field of any
SourceBit
. Here's a test:
The shift implementations are also quite simple as long as the shift amounts
are constant, they just move bits around. If the shifts aren't constant, we
just know nothing about the result.
If we "know nothing", we want to use
BitProvenance.from_source
for the shift
operation. Therefore the transfer functions need to get the shift
Operation
as
an extra argument.
deftest_lshift():source=Operation("getarg",[Constant(0)])x=BitProvenance.from_source(source)# no info# x << 7, the seven high bits get cut offseven=BitProvenance.from_constant(7)result=Operation("int_lshift",[source,Constant(7)])assertx.abstract_lshift(seven,result).bits==(0,)*7+x.bits[:-7]# x << 65, constant 0big=BitProvenance.from_constant(65)result=Operation("int_lshift",[source,Constant(65)])assertx.abstract_lshift(big,result).get_constant()==0# x << y, we know nothingamount=Operation("getarg",[Constant(1)])result=Operation("int_lshift",[source,amount])assertx.abstract_lshift(BitProvenance.from_source(amount),result)==BitProvenance.from_source(result)@given(ints,strategies.integers(0,100))deftest_hypothesis_lshift_on_constants(val,shift):absval=BitProvenance.from_constant(val)absshift=BitProvenance.from_constant(shift)result=Operation("int_lshift",[Constant(val),Constant(shift)])assertabsval.abstract_lshift(absshift,result).get_constant()==(val<<shift)&INT_MASKclassBitProvenance:...defabstract_lshift(self,other,result:Operation):const=other.get_constant()ifconstisNone:returnBitProvenance.from_source(result)ifconst>=INTEGER_WIDTH:# make oversized shift amounts return 0 for simplicityreturnBitProvenance.from_constant(0)ifconst==0:returnselfreturnBitProvenance.make((0,)*const+self.bits[:-const])
Logical right shift is pretty similar, except we append the zeros at the other end:
deftest_rshift():source=Operation("getarg",[Constant(0)])x=BitProvenance.from_source(source)# no info# x >> 7, the seven low bits get cut offseven=BitProvenance.from_constant(7)result=Operation("int_rshift",[source,Constant(7)])assertx.abstract_rshift(seven,result).bits==x.bits[7:]+(0,)*7# x >> 65, constant 0big=BitProvenance.from_constant(65)result=Operation("int_rshift",[source,Constant(65)])assertx.abstract_rshift(big,result).get_constant()==0# x >> y, we know nothingamount=Operation("getarg",[Constant(1)])result=Operation("int_rshift",[source,amount])assertx.abstract_rshift(BitProvenance.from_source(amount),result)==BitProvenance.from_source(result)@given(ints,strategies.integers(0,100))deftest_hypothesis_rshift_on_constants(val,shift):absval=BitProvenance.from_constant(val)absshift=BitProvenance.from_constant(shift)result=Operation("int_rshift",[Constant(val),Constant(shift)])assertabsval.abstract_rshift(absshift,result).get_constant()==val>>shiftclassBitProvenance:...defabstract_rshift(self,other,result:Operation):const=other.get_constant()ifconstisNone:returnBitProvenance.from_source(result)ifconst>=INTEGER_WIDTH:returnBitProvenance.from_constant(0)ifconst==0:returnselfreturnBitProvenance.make(self.bits[const:]+(0,)*const)
Next are the abstract binary transfer functions
and
,
or
,
xor
.
We can think about the behaviour on individual bits first. A few cases are
simple (e.g.
a & 0 == 0
) but some need reasoning about sources.
defand_bits(a,b):# None means the result cannot be represented as a constant or source# bitifa==0:return0ifb==0:return0ifa==1:returnbifb==1:returnaassertisinstance(a,SourceBit)assertisinstance(b,SourceBit)ifa==b:# a & a == areturnaifa==invert_bit(b):# a & not a == 0return0returnNonedeftest_and_bits():x=Operation("getarg",[Constant(0)])y=Operation("getarg",[Constant(1)])a=SourceBit(x,3)assertand_bits(a,0)==and_bits(0,a)==0assertand_bits(a,1)==and_bits(1,a)==aassertand_bits(a,a)==aassertand_bits(a,invert_bit(a))==0# positions disagreeassertand_bits(a,SourceBit(x,4))isNone# sources disagreeassertand_bits(a,SourceBit(y,3))isNoneassertand_bits(a,SourceBit(y,3,True))isNone
When
and_bits
returns
None
for output bit
i
, we can use
SourceBit(result, i)
: we don't know how that bit relates to the inputs.
The other output bits keep their own provenance, even if they refer to
different operations.
Now we can combine
and_bits
calls for all the bits of a
BitProvenance
.
deftest_and():x=Operation("getarg",[Constant(0)])y=Operation("getarg",[Constant(1)])absx=BitProvenance.from_source(x)absy=BitProvenance.from_source(y)# x & 0 == 0result=Operation("int_and",[x,Constant(0)])assertabsx.abstract_and(BitProvenance.from_constant(0),result).get_constant()==0# x & -1 == xresult=Operation("int_and",[x,Constant(INT_MASK)])assertabsx.abstract_and(BitProvenance.from_constant(INT_MASK),result)==absx# x & x == xresult=Operation("int_and",[x,x])assertabsx.abstract_and(absx,result)==absx# x & y: we can't usefully represent provenance, so we get fresh bitsresult=Operation("int_and",[x,y])assertabsx.abstract_and(absy,result)==BitProvenance.from_source(result)# x & ~x == 0result=Operation("int_and",[x,Operation("int_invert",[x])])assertabsx.abstract_and(absx.abstract_invert(),result).get_constant()==0@given(ints,ints)deftest_hypothesis_and_on_constants(a,b):abs_a=BitProvenance.from_constant(a)abs_b=BitProvenance.from_constant(b)result=Operation("int_and",[Constant(a),Constant(b)])assertabs_a.abstract_and(abs_b,result).get_constant()==a&bclassBitProvenance:...defabstract_and(self,other,result:Operation):bits=[]fori,(bit_a,bit_b)inenumerate(zip(self.bits,other.bits)):bit_res=and_bits(bit_a,bit_b)ifbit_resisNone:# not representable, use fresh provenancebit_res=SourceBit(result,i)bits.append(bit_res)returnBitProvenance.make(bits)
or
is very similar:
defor_bits(a,b):ifa==1:return1ifb==1:return1ifa==0:returnbifb==0:returnaassertisinstance(a,SourceBit)assertisinstance(b,SourceBit)ifa==b:# a | a == areturnaifa==invert_bit(b):# a | not a == 1return1returnNonedeftest_or_bits():x=Operation("getarg",[Constant(0)])y=Operation("getarg",[Constant(1)])a=SourceBit(x,3)assertor_bits(a,1)==or_bits(1,a)==1assertor_bits(a,0)==or_bits(0,a)==aassertor_bits(a,a)==aassertor_bits(a,invert_bit(a))==1# positions disagreeassertor_bits(a,SourceBit(x,4))isNone# sources disagreeassertor_bits(a,SourceBit(y,3))isNoneassertor_bits(a,SourceBit(y,3,True))isNonedeftest_or():x=Operation("getarg",[Constant(0)])y=Operation("getarg",[Constant(1)])absx=BitProvenance.from_source(x)absy=BitProvenance.from_source(y)# x | 0 == xresult=Operation("int_or",[x,Constant(0)])assertabsx.abstract_or(BitProvenance.from_constant(0),result)==absx# x | -1 == -1result=Operation("int_or",[x,Constant(INT_MASK)])assertabsx.abstract_or(BitProvenance.from_constant(INT_MASK),result).get_constant()==INT_MASK# x | x == xresult=Operation("int_or",[x,x])assertabsx.abstract_or(absx,result)==absx# x | y: we can't usefully represent provenance, so we get fresh bitsresult=Operation("int_or",[x,y])assertabsx.abstract_or(absy,result)==BitProvenance.from_source(result)# x | ~x == -1result=Operation("int_or",[x,Operation("int_invert",[x])])assertabsx.abstract_or(absx.abstract_invert(),result).get_constant()==INT_MASK@given(ints,ints)deftest_hypothesis_or_on_constants(a,b):abs_a=BitProvenance.from_constant(a)abs_b=BitProvenance.from_constant(b)result=Operation("int_or",[Constant(a),Constant(b)])assertabs_a.abstract_or(abs_b,result).get_constant()==a|bclassBitProvenance:...defabstract_or(self,other,result:Operation):bits=[]fori,(bit_a,bit_b)inenumerate(zip(self.bits,other.bits)):bit_res=or_bits(bit_a,bit_b)ifbit_resisNone:# not representable, use fresh provenancebit_res=SourceBit(result,i)bits.append(bit_res)returnBitProvenance.make(bits)
And finally here is
xor
:
defxor_bits(a,b):ifa==1:# x ^ 1 == ~xreturninvert_bit(b)ifb==1:returninvert_bit(a)ifa==0:# x ^ 0 == xreturnbifb==0:returnaassertisinstance(a,SourceBit)assertisinstance(b,SourceBit)ifa==b:# a ^ a == 0return0ifa==invert_bit(b):# a ^ not a == 1return1returnNonedeftest_xor_bits():x=Operation("getarg",[Constant(0)])y=Operation("getarg",[Constant(1)])a=SourceBit(x,3)assertxor_bits(a,1)==xor_bits(1,a)==invert_bit(a)assertxor_bits(a,0)==xor_bits(0,a)==aassertxor_bits(a,a)==0assertxor_bits(a,invert_bit(a))==1# positions disagreeassertxor_bits(a,SourceBit(x,4))isNone# sources disagreeassertxor_bits(a,SourceBit(y,3))isNoneassertxor_bits(a,SourceBit(y,3,True))isNonedeftest_xor():x=Operation("getarg",[Constant(0)])y=Operation("getarg",[Constant(1)])absx=BitProvenance.from_source(x)absy=BitProvenance.from_source(y)# x ^ 0 == xresult=Operation("int_xor",[x,Constant(0)])assertabsx.abstract_xor(BitProvenance.from_constant(0),result)==absx# x ^ -1 == ~xresult=Operation("int_xor",[x,Constant(INT_MASK)])assertabsx.abstract_xor(BitProvenance.from_constant(INT_MASK),result)==absx.abstract_invert()# x ^ x == 0result=Operation("int_xor",[x,x])assertabsx.abstract_xor(absx,result).get_constant()==0# x ^ y: we can't usefully represent provenance, so we get fresh bitsresult=Operation("int_xor",[x,y])assertabsx.abstract_xor(absy,result)==BitProvenance.from_source(result)# x ^ ~x == -1result=Operation("int_xor",[x,Operation("int_invert",[x])])assertabsx.abstract_xor(absx.abstract_invert(),result).get_constant()==INT_MASK@given(ints,ints)deftest_hypothesis_xor_on_constants(a,b):abs_a=BitProvenance.from_constant(a)abs_b=BitProvenance.from_constant(b)result=Operation("int_xor",[Constant(a),Constant(b)])assertabs_a.abstract_xor(abs_b,result).get_constant()==a^bclassBitProvenance:...defabstract_xor(self,other,result:Operation):bits=[]fori,(bit_a,bit_b)inenumerate(zip(self.bits,other.bits)):bit_res=xor_bits(bit_a,bit_b)ifbit_resisNone:# not representable, use fresh provenancebit_res=SourceBit(result,i)bits.append(bit_res)returnBitProvenance.make(bits)
To evaluate the bit provenance optimizer, I wrote a program that applies it to
PyPy JIT traces. I didn't fully build it into the PyPy JIT because I was quite
skeptical that it would help. Instead, I wrote an external optimization pass
that parses RPython JIT logs, applies the optimization and then produces
statistics. This uses an extended prototype that supports additional operations
such as arithmetic right shifts and sign extension, and can extract shifts of
earlier computed values as well as shifts of the original source.
I did this experiment for two different RPython projects, for PyPy (running the
translator, that bootstraps PyPy to C code) and
Pydrofoil
(RISC-V simulation
based on
Sail
, booting the Linux kernel). I picked the latter because Pydrofoil
does a lot of integer operations, whereas most Python code does very little.
For both of these programs I wanted to know how well the bit provenance
optimizer can optimize the traces compared to the integer optimizations of the
PyPy JIT. I took the unoptimized traces, removed everything but integer
operations and performed dead code elimination. To do that, the integer results
of non-pure operations are turned into unconstrained arguments of the trace.
Integer values used by removed operations are retained as outputs. The
remaining integer operations are our baseline traces for this experiment.
The following table shows the results. The first column shows the number of
unoptimized integer operations. The second column shows how many operations are
left after running just bit provenance optimizations. The third column shows
how many operations are left after the RPython JIT integer optimizations run.
The last column shows how many operations are left after we run first the
RPython JIT optimizer and then bit provenance optimizations. All three paths
include dead code elimination after optimization.
In parentheses are the percentages of how many of the unoptimized operations
are removed by the corresponding path.
Workload
Unoptimized
Provenance
RPython
RPython then Provenance
Pydrofoil
1,484,985
822,864 (44.59%)
769,758 (48.16%)
656,555 (55.79%)
PyPy
1,442,782
1,374,803 ( 4.71%)
1,089,196 (24.51%)
1,089,196 (24.51%)
The 'RPython then Provenance' column shows that, for the PyPy workload,
provenance removes no additional operations after the RPython integer
optimization passes in this experiment. For Pydrofoil it does remove more
operations, but we will have to investigate whether this benefit carries over
to the full JIT optimization pipeline.
However, the comparison between the 'Provenance' and 'RPython' column for
Pydrofoil shows that the design of the optimizer is quite good! The small
provenance optimizer achieves nearly as much reduction in integer operation
count as the complicated and well-tuned integer optimization passes of the
RPython JIT.
The interesting result here isn't that we beat an existing optimizer. It's
that a handful of transfer functions lets us discover rewrites across
arbitrarily long chains of bit operations, without writing a rule for each
combination. The evaluation suggests that existing integer optimizations
already cover much of this stuff. However, bit provenance gives us a compact
way to describe a whole family of simplifications. It's quite cool to write an
optimizer that can undo a bit reversal without ever knowing what a bit reversal
is.
Thanks to Joe Groff for the
fantastic title
. Thanks to Can Joshua Lehmann,
Andy Wingo, Matti Picus, and Nico Rittinghaus for feedback on the draft, and to
Max Bernstein for encouragement.
This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.
What can I do to resolve this?
You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.
Who knew a Monarch butterfly could borrow a cell phone to check in with friendly people he met on his journey?
That is essentially what happens now that new technology has reduced the weight of a radio-pulse tag to less than half a gram. Those tags use Bluetooth technology to send information back to the researchers in the U.S. and Canada, including Jennifer Weber, Ph.D. '25, and Shawn Kurtzman from the
Conservation Management Institute
, to collect far more data than has ever been available about the paths and speed of Monarch butterflies as they migrate from a vast range in continent’s temperate areas to nature preserves in Mexico and Central America.
International calls are welcome, as some of the butterflies tagged in Virginia are now in Mexico.
Weber gave some of the Monarchs names and keeps up with their perilous migratory journeys. Sneezy, tagged here in the New River Valley in September, was detected in Mexico on Oct. 17. Addison and Sleepy, also part of the mountain cohort, checked in from Texas but now seem to be travelling outside of range of cell service. Two other recent visitors to Virginia Tech, Hahn and Sandman, are now in Alabama and South Carolina, respectively. Orion and Walker were in Georgia, dealing with tropical storm Isaias, before heading west again.
Thomas is the real traveller. Tagged in Fort A.P. Hill near Fredricksburg, he was last detected in Mississippi, then pinged again a thousand miles away in southern Mexico.
"We figured he would follow the Gulf Coast and make his way to the wintering grounds," Weber said. "Imagine our shock when he pinged yesterday at lunchtime all the way across the gulf. His latest ping put him a little bit east of a city named Coatzacoalcos, well south of the wintering grounds."
Weber said Thomas and a few other radio tagged monarchs were picked up by a swirling storm system and deposited on the Mexican coast.
Jennifer Weber Ph.D. gently holds a Monarch she prepares to attach a tiny pulse tag to its wing with eyelash glue. Photo by Chris Moody for Virginia Tech.
To say Monarchs are checking in with cellphones is not hyperbole. The new tags emit a pulse detectable by Bluetooth-enabled smartphones, vehicles, and cellular towers which send a signal through a background function to the researchers to create a continuous, real-time map.
"It’s citizen science, but crowd-powered," Weber said.
No information about the device itself is sent — just the tag number and location. It also means a Monarch flying over wilderness could go days without being located, leaving Weber to wonder if the tag stopped working, fell off, or the butterfly perished.
Kurtzman said the estimated survival rate is 25 to 28 percent.
Following a flight path at hundreds of data points reveals micro-level behaviors, such as whether monarchs utilize highway corridors, how they react to major weather disruptions, and where they pause to feed on available nectar along their route.
Weber and Kurtzman outfitted 35 Monarchs with pulse tags and follow their path to winter quarters. The cost of the radio-pulse tags is still high enough that most butterflies are tagged with a small sticker on a wing that includes contact information for anyone who found it. This message-in-a-bottle strategy returns data from a tiny percentage of Monarchs.
With new technology, scientists are able to see the flight path of the Monarchs with dozens of data points. The blue and purple lines were Monarchs tagged in the New River Valley in mid-September, the red and orange lines represent Monarchs tagged at Fort A.P. Hill, and the coastal group have green lines indicating their route. Photo courtesy of Jennifer Weber.
With new technology, scientists are able to see the flight path of the Monarchs with dozens of data points, shown here on Oct. 9. The blue and purple lines are Monarchs tagged in the New River Valley in mid-September, the red and orange lines represent Monarchs tagged at Fort A.P. Hill, and the coastal group has green lines indicating their route. Photo courtesy of Jennifer Weber.
The CMI researchers tagged Monarchs on federal land around military installations in three Virginia locations — the Radford Arsenal for a mountain population; Fort A.P. Hill for a Piedmont population; and Oceana Naval Air Station and Joint Base Langley-Eustis to identify a coastal population. Monarchs tagged on the Tech campus were included in the mountain cohort. By deploying tags across mountain, Piedmont, and coastal locations, researchers want to determine whether monarchs from different geographic regions in Virginia follow the same migration corridors to Mexico or take distinct paths, such as heading south into Florida.
A butterfly that flits around doesn’t seem to be moving rapidly in any specific direction, but just two hours after being tagged in September on the Virginia Tech campus, one Monarch was flying near the New River in Giles County, having crossed two ridgelines on its way west.
The research will be used by
Project Monarch
, a collaborative initiative, along with
Monarch Joint Venture
and the
Xerces Society for Invertebrate Conservation
, two nonprofits working to understand and preserve Monarchs, a threatened species. Researchers from dozens of universities and research groups are partnering with these agencies to reveal how these insects navigate around or through challenging areas throughout eastern North America.
Sticker tags are still used, although they are only effective when found on a Monarch during its journey and reported back with information found on the sticker. Photo by Chris Moody for Virginia Tech.
“We're all kind of throwing our data in the same pot,” Weber said. “Hopefully, that data will be available for anyone who needs it so we can help these little guys.”
Learning more about the migratory routes will guide land management choices in the future. Whether it’s a large expanse of federal land or a yard owned by a butterfly aficionado, encouraging plants than benefit Monarchs is ecologically important. Milkweed, goldenrod, thistle, and wingstem are a few of the species Monarchs need.
“You can't just provision the caterpillars and do nothing for the adults, because milkweed doesn't last into the fall,” Weber said “Then we start relying on the wingstem, we rely on the thistle, we rely on the goldenrod. So having a wide variety of plants and plants that provision them at every portion of the year is super important.”
Contact:
Introducing LFM3: Every Modality for Specialized Intelligence
Today, we’re excited to announce
LFM3
, our new generation of Liquid Foundation Models (LFMs) built for specialized intelligence. The LFM3 model family is multimodal by nature and brings text, vision, audio, omni, and decision models onto one new shared backbone. The first release of the LFM3 family covers models in the 2B parameter range.
Built on a new hybrid architecture and 22T tokens of pre-training, LFM3 is far more expressive than
LFM2
while maintaining its efficiency. The extra capacity in a small, fast model makes LFM3 the ideal starting point in its class for specialized intelligence: this is because it can be fine-tuned locally, it can run on any device, and it is capable enough to become a reliable expert on a specialized task.
LFM2 showed that a hybrid of short convolutions and attention could run fast on-device without sacrificing quality. Its design came from our
automated hardware-in-the-loop architecture search
. For LFM3, we used this search to redesign that architecture for agentic use cases, which need more capability per parameter and fast inference over long contexts.
We also expanded the hardware in the loop, from CPUs in one phone and one laptop for LFM2 to 14 device and backend combinations for LFM3: phones (Samsung Galaxy S26 Ultra and OnePlus 15), a Raspberry Pi 5, laptops (Apple M4 Max and AMD Ryzen AI), and Arm and x86 cloud CPUs, plus GPUs and the Qualcomm Hexagon NPU.
Gated short convolutions still make up over half the layers. To add capability without slowing down long contexts, we tried swapping some of them for other sequence blocks, and sliding-window attention (SWA) gave the best quality–speed tradeoff. We kept the other changes described below only where they improved quality without a meaningful speed cost. The payoff shows at long context. Per parameter, LFM3-1.7B matches LFM2-1.2B on short prompts across edge devices, and with 8K tokens in context it is about 25% faster.
Tri-hybrid layer mix.
LFM3 combines three operators: gated short convolutions, sliding-window attention (SWA), and global attention. Of its 24 layers, 13 are convolutions, 5 are SWA with a 256-token window, and 6 are global attention. The convolutions also use a kernel size of 7, up from 3 in LFM2.
Partial RoPE.
Global attention layers rotate only the highest-frequency half of each head and leave the low-frequency half unrotated, so those dimensions
match on content regardless of distance
. SWA layers keep full RoPE.
Sandwich norm.
Each block normalizes both its input and its output, which helps keep activations well-scaled.
LFM3 uses the same 128K vocabulary as
LFM2.5-8B-A1B
, built to tokenize non-Latin scripts more efficiently.
Training.
LFM3-1.7B-Base was pre-trained on 22T tokens. Compared with LFM2, the mix adds more scientific papers, repository-level code, a wider range of knowledge sources, and considerably more math. The final 3.5T tokens are a mid-training stage on curated, higher-quality data, with a larger share of agentic traces and diverse tool calls to prepare the model for agentic post-training. This stage also extends the context window to 256K tokens.
A multimodal family for every need
The first LFM3 release includes six models, all branched from the same LFM3-1.7B-Base backbone and all around 2B parameters. Four of them cover different input modalities (text, vision, audio, and omni), and the last two are decision models specialized from the vision and omni models. Instead of running one large general-purpose model, you can pick the one that fits your use case, customize it, and run it on-device.
For a deeper dive into the performance and inference results behind these models, refer to the respective model cards.
As AI increasingly moves from the cloud to the client, developers need models that can be deployed efficiently across the broad spectrum of AI PCs. Liquid AI's LFM3 family combines strong multimodal capabilities with a compact footprint that is well suited for on-device AI experiences. AMD has worked closely with Liquid AI across multiple generations of models, and we're excited to see LFM3 expand what's possible for specialized AI applications running locally on systems with AMD Ryzen™ AI processors.
Josh Hort
Senior Director and Head of ISV Enabling at AMD
Across industries, we’re seeing edge AI evolve from running dedicated detection and perception models to supporting multiple concurrent AI workloads, including vision-language models, natural-language interfaces and multimodal reasoning. The challenge is delivering these capabilities within the compute, memory, and power constraints of edge devices. LFM3 brings text, vision, and audio together in a unified architecture designed for efficient deployment, with open weights that developers can fine-tune for specific applications. Developers can already run Liquid AI’s LFM2.5-VL models on Ambarella silicon through the Cooper Model Garden, and we have begun enabling LFM3 on the same platform.
Malhar Palkar
Senior Director for AI at Ambarella
The next generation of AI will be more multimodal, personalized, and private while being distributed across devices and the cloud. Liquid AI’s LFM3 family is an exciting step in that direction, and we’re pleased to work together to bring fast, efficient, and innovative AI experiences to devices powered by Snapdragon® processors.
Vinesh Sukumar
Vice President, AI/ML Product Management, Qualcomm Technologies, Inc.
Text
LFM3-1.7B
is a text model for local agents and specialized applications with a 256K-token context window.
It is post-trained to run in agentic harnesses such as Hermes Agent, Pi, and OpenClaw. It can triage your inbox, manage your calendar, research topics on the web, send you morning briefings on WhatsApp, and use tool search to find the right tool among thousands of options. Since tokens are free, dozens of agents can run continuously in the background. You can adapt it to your domains, harnesses, and tools with a short fine-tuning run on a single GPU.
Benchmark
LFM3-1.7B (1.7B)
LFM2.5-2.6B (2.6B)
MiniCPM5
2B (2.5B)
Gemma 4
E4B (8B)
Qwen3.5
4B (4.7B)
Qwen3.5
9B (9.7B)
Agents
LiveClaw
45.60
14.70
30.37
20.36
19.94
35.77
Claw-Eval General (EN), average
68.64
62.63
60.74
56.14
61.96
66.53
Claw-Eval General (EN), pass^3
51.40
37.52
34.58
22.43
42.99
51.87
BrowseComp-Plus (OpenClaw subset)
37.00
26.33
16.83
21.00
24.67
38.00
WebArena-Verified
38.42
3.02
9.11
17.06
21.92
28.94
EnterpriseOps-Gym
28.20
7.94
13.41
9.86
25.96
28.97
AutomationBench (public)
41.29
0.94
4.71
1.92
8.67
15.10
Tool use
BFCL V4
71.39
55.89
62.65
48.25
55.12
62.83
ToolSandbox
80.36
78.04
68.16
69.27
75.40
76.41
MCP-Atlas
32.57
16.45
26.38
6.19
41.37
42.67
τ³-bench
68.01
56.77
69.44
33.53
65.98
67.11
Agentic coding
SWE-bench Verified (OpenCode)
43.40
18.00
34.80
0.50
41.20
51.20
SWE-bench Multilingual (OpenCode)
23.00
8.00
15.67
0.67
23.33
35.00
Terminal-Bench 2.1 (OpenCode)
12.92
0.00
5.62
0.00
13.48
17.98
Coding
LiveCodeBench v6
73.46
60.57
70.52
71.00
61.99
69.86
LiveCodeBench Pro 25Q2
31.74
19.16
29.34
29.94
24.25
34.43
SciCode
28.47
16.32
27.78
25.00
23.02
31.60
Instruction following
IFEval
96.66
95.39
87.83
90.02
92.52
92.08
IFBench
73.03
60.48
62.08
44.56
38.16
48.84
IFStruct
93.72
82.18
72.65
78.45
87.05
89.20
Multi-IF
89.10
84.80
73.19
81.03
80.32
84.44
Knowledge
GPQA Diamond
63.37
57.78
65.15
57.88
75.76
80.40
Humanity's Last Exam (no tools)
7.17
5.88
8.20
4.77
12.84
16.41
Humanity's Last Exam (with tools)
13.90
9.60
11.50
6.00
11.60
17.50
AA-Omniscience (public)
0.50
-33.17
-5.00
-15.33
-57.17
-28.00
AA-Omniscience accuracy (public)
7.07
8.75
9.13
9.83
15.67
13.17
AA-Omniscience non-hallucination (public)
92.93
53.69
84.44
72.09
13.64
52.59
Long context
AA-LCR
52.83
6.00
49.34
39.33
52.67
62.00
RULER 128K
65.56
1.15
37.96
18.82
84.63
87.11
Average
49.37
31.55
39.19
31.74
39.27
47.24
On agentic tasks, LFM3-1.7B competes with models several times its size. It leads on instruction following and function calling on BFCL and ToolSandbox, and beats Qwen3.5-9B on long tasks in browsers and business apps (WebArena-Verified, AutomationBench). Larger models still win on agentic coding and knowledge, where size matters most, but search helps close the knowledge gap, nearly doubling its score on Humanity's Last Exam.
To achieve these results, the model went through four stages of post-training:
Supervised fine-tuning (SFT):
1.75T tokens across various tasks, including chat, reasoning, tool calling, and agentic traces.
Mixed reinforcement learning:
many domains trained at once, from math and code to SQL and structured outputs. A length penalty in the reward keeps answers concise.
Multi-domain on-policy distillation (MOPD):
six specialist RL teachers (code, math, tool use, long context, agentic work, and enterprise workflows) are distilled back into a single model.
Agentic RL:
tasks from web browsing to office work are run inside real agent harnesses, preparing the model for deployment.
On-device, we measure metrics with llama.cpp at Q4_0 and a 32K-token context. LFM3-1.7B is the fastest model on all three devices, decoding 1.8 to 2.8 times faster than the next one, and it uses the least memory. Long contexts stay cheap: a full 128K-token context needs 1.6 GB of KV cache, against 4.3 GB for Qwen3.5-4B and 5.6 GB for MiniCPM5-2B.
On a single NVIDIA B300 with SGLang in BF16, LFM3-1.7B can produce 3.6 billion tokens per day at 1,024 concurrent requests, more than any other model in this comparison.
To show what this throughput makes possible, we ran more than 300,000 LFM3-1.7B agents in parallel to investigate the Enron email archive.
LFM3-1.7B can be served at low latency under random traffic, enabling real-time use cases like online fraud detection when run on
Liquid RIPL
. P95 request latency remains stable even under heavy load, outperforming competing models served on vLLM.
We tested LFM3-1.7B against Qwen3.5-2B on 65 everyday agent tasks in real macOS environments. The smaller model won: 64% task success versus 48%, 58% fewer tokens per task, and it got stuck in under 1% of attempts versus 15%. Small models are ready for real agent work on the Mac, and LFM3 is the proof. LFM3 is the first sub-2B model we’ve tested that is ready for real agent work on a Mac — it beat a larger model on task success while using 58% fewer tokens and almost never getting stuck.
Ivan Petrukha
Staff AI Engineer, LLM Efficiency Lead at MacPaw
Vision
LFM3-VL-2B
can watch, reason, and understand the physical world:
Video understanding:
for the first time, an LFM vision model takes video as input. Ask questions about a recorded lecture, a walkthrough filmed on your phone, or a clip from a camera feed.
Thinking:
the model reasons step by step before answering. This helps it better understand user inputs and solve harder visual questions such as math, charts, and multi-step problems.
Spatial and embodied reasoning:
the model’s ability to localize objects and reason about their spatial relationships provides a strong foundation for downstream robotics applications.
LFM3-VL-2B is a leap in performance over the LFM2.5-VL series. Across 62 vision benchmarks, LFM3-VL-2B scores significantly ahead of all models of similar size by at least 7.4 points, and despite its size, it matches the performance of Gemma 4 12B, a model more than 6 times larger, surpasses Gemini 3.5 Flash Lite and is within 2 points of GPT-5.6 Luna. For more details, see the model card.
Benchmark Category
LFM3-VL-2B (1.9B)
LFM2.5-VL-3B (3.1B)
MiniCPM-V 4.7 1B (1.6B)
Qwen 3.5 2B (2.3B)
Gemma 4 E2B (5.1B)
Gemma 4 12B (12B)
GPT-5.6 Luna
Gemini 3.5 Flash Lite
General
66.0
57.6
59.8
64.0
56.9
74.0
72.2
74.1
Perception
75.6
67.9
65.5
71.2
59.1
73.5
71.0
73.0
Document, OCR & Chart
83.9
71.2
73.0
79.1
72.3
85.7
84.4
82.3
Math & logical reasoning
68.8
40.6
51.8
61.0
51.8
79.3
77.3
66.7
Visual grounding
77.3
68.3
51.1
61.2
41.2
74.1
72.7
63.5
Embodied reasoning
64.4
48.0
45.3
51.2
41.5
59.1
61.5
50.3
GUI understanding
83.1
66.0
45.3
67.2
44.3
76.1
82.5
71.0
Video
61.2
41.3
53.7
57.0
46.6
58.9
72.8
70.0
Multilingual
84.4
81.2
77.4
78.6
73.4
86.1
82.1
85.8
Agentic
42.5
21.1
16.9
15.2
23.8
43.6
56.1
62.4
Average
71.4
57.6
57.5
64.0
53.6
71.7
73.4
70.0
Notes: Each category score is the unweighted mean of its benchmark scores. The Average row is the unweighted mean across all 62 evaluations.
All of this can be run efficiently on-device, which enables everyday use of intelligence without the data leaving your device or the need for a cloud connection. On-device, LFM3-VL-2B has the highest prefill throughput and lowest memory footprint across all measured devices, compared to other models of its size class.
On a single NVIDIA B300 with SGLang in BF16, LFM3-VL-2B can produce over 12,000 tokens per second, higher than any other model of the same size class.
LFM3-VL-2B can be served at low latency under random traffic, enabling real-time use cases like image asset tagging when run on
Liquid RIPL
. P95 request latency remains stable even under heavy load, outperforming competing models served on vLLM.
Vision encoder
In addition to improvements to the LFM3 backbone, LFM3-VL comes with our new in-house vision encoder which uses 3× less compute than the SigLIP2 encoder in previous LFM VL models.
The Liquid vision encoder combines convolution and attention to make it significantly more efficient than its ViT counterpart at the same quality. The performance-efficiency graph below illustrates this. Our 164M-parameter encoder matches Qwen3.5-2B’s vision encoder at 55.9% average accuracy across 13 vision-language model benchmarks, while requiring 2.2× fewer FLOPs.
For video, the encoder jointly embeds each pair of sampled frames into one temporal slice of visual features, halving the temporal sequence length before further encoding. Together, these choices make the encoder a foundation for both richer image understanding and efficient video processing.
Audio
LFM3-Audio-2B
is a compact, fully featured audio model that runs locally on laptops and edge devices. It takes text or audio as input and responds with text, speech, or both.
LFM3-Audio-2B uses a new architecture with an audio encoder and codec developed in-house. It outperforms LFM2.5-Audio in speech quality and now supports 18 languages. New capabilities include audio understanding, general-purpose audio reasoning, and tool calling.
Voice chat:
ask questions aloud and receive streaming replies in text and speech. For text-only responses, the model can also reason before answering.
Multilingual speech:
transcribe, synthesize, and translate speech across 18 languages.
Audio understanding and reasoning:
ask the model to interpret recordings and answer questions about the speech, sounds, and events they contain.
Tool calling:
turn spoken requests into tool calls to control apps and devices. The model can also respond in text or speech alongside those calls.
Our ambition is to make the interaction between driver and vehicle as natural and intuitive as possible. Together with Liquid, we are exploring how powerful on-device AI can further enhance the MBUX Virtual Assistant, while enabling fast, private and cloud-independent experiences. Our MB.OS architecture provides the foundation to bring innovations like these into our vehicles.
Jörg Burzer
Member of the Board of Management of Mercedes-Benz Group AG, Chief Technology Officer, Development & Procurement
ASR (WER, %, lower is better)
LFM3-Audio-2B
LFM2.5-Audio-1.5B
Gemma 4 E2B
Gemma 4 E4B
Qwen2.5-Omni-3B
Nvidia Audex 2B
Voxtral Mini 3B
MiMo-Audio-7B-Instruct
Kimi-Audio-7B-Instruct
Total parameters
2B
1.5B
5B
8B
6B
3B
5B
8B
10B
English
6.2
6.1
8.3
7.8
6.3
6
5.5
8.5
5.3
Multilingual (avg. across en, es, pt, de, fr, it, zh, ja, ko)
6
–
8.1
6.5
7.4
6.4
7.8
–
–
English TTS (UTMOSv2, 1-5, higher is better) (WER, %, lower is better)
LFM3-Audio-2B
LFM2.5-Audio-1.5B
Qwen2.5-Omni-3B
MiMo-Audio-7B-Instruct
Total parameters
2B
1.5B
6B
8B
UTMOSv2
3.8
3.2
3.4
2.8
WER
1.4
1.9
3.2
4.9
VoiceBench, Tool calling, Audio understanding (audio in, text out, %, higher is better)
LFM3-Audio-2B
LFM2.5-Audio-1.5B
Qwen2.5-Omni-3B
Gemma 4 E2B
Gemma 4 E4B
Voxtral Mini 3B
MiMo-Audio-7B-Instruct
Kimi-Audio-7B-Instruct
Total parameters
2B
1.5B
6B
5B
8B
5B
8B
10B
VoiceBench
73.1
55.2
66.4
63.3
72.9
65.8
77.3
76.9
Tool-calling
(Internal eval)
58.5
–
44.3
55.6
72.4
44.5
33.4
50.6
Audio understanding
(MMAR)
50.6
25.9
54.4
44.5
49.1
50.1
62.3
53.3
Our new LFM-based audio encoder is built from a mixture of sliding-window attention and short-convolution layers, keeping memory utilization bounded. The new encoder is fully causal, allowing the model to process live microphone input and perform prefill while you speak. This reduces the wait after you finish, with time to the first token as low as 50 ms.
LiquidCodec, our new audio tokenizer, powers multilingual speech generation in both LFM3-Audio and LFM3-Omni. Built on the LFM3 architecture, LiquidCodec turns generated tokens into speech at about 87× real time on a single CPU thread (Apple M4 Max), supporting streaming decoding.
Quantization compresses each 80 ms of speech into 12 discrete tokens and, in contrast to previous LFM Audio models, allows multiple tokens to be predicted iteratively in parallel rather than requiring sequential prediction. As the backbone generates new tokens, the detokenizer progressively converts them into speech, all faster than real-time so that conversations are smooth and responsive.
Omni
LFM3-Omni-2B
is our first omni model, bringing vision, audio, and language together in a single model that can see, listen, and talk back:
Spoken visual question answering:
Ask questions about images or real-world scenes using speech, and receive answers in text, speech, or both.
Audio-visual video understanding:
Process video frames alongside their corresponding audio, allowing the model to reason about both what is happening on screen and what is being said or heard.
Multimodal tool calling:
Combine visual context with spoken instructions to generate structured tool calls, enabling assistants to interact with applications and interfaces using both what they see and what users say.
LFM3-Omni supports cross-modal interactions that require understanding visual and auditory information together. Users can ask spoken questions about images, or provide videos with synchronized audio and ask questions that depend on both what is seen and what is heard.
LFM3-Omni-2B
Qwen2.5-Omni-3B
Qwen2.5-Omni-7B
Gemma 4 E2B
Gemma 4 E4B
Phi-4-multimodal
Params
2.2B
6B
10.7B
5B
8B
5.6B
Video + Audio Understanding
Daily-Omni
70.1
58.8
61.3
50.6
54.1
48.9
WorldSense
47.1
45
45.4
38.1
43.5
42.4
AV-SpeakerBench
46.8
40.4
43.2
32.3
36.4
38
Image + Audio Understanding
OmniBench (overall)
46.3
47.1
49.7
16.8
20.7
39
OmniBench Speech
48.2
45.7
48
16.1
21.3
38.9
Spoken Visual QA
RealWorldQA
64.7
61.1
69.9
39.4
49
64.3
MMStar
51.8
50.8
57.3
38.9
44.6
54.8
POPE
83.8
85.3
85.4
74.2
77.8
83
ERQA
39.4
37.3
39.2
20.6
32.1
30.8
EmbSpatial
67.6
53.4
59.5
44.1
54.0
42.6
In addition to cross-modal understanding, LFM3-Omni retains the core capabilities of the standalone LFM3 models, including visual question answering, speech recognition, speech synthesis, and language instruction following.
LFM3-Omni-2B is designed for efficient deployment in resource-constrained environments. Its capabilities enable conversational assistants that can provide context-aware guidance, support hands-free interactions, and help users complete tasks through natural voice commands. By combining visual understanding, spoken dialogue, and tool calling, it can support applications ranging from personalized education and everyday assistance to navigation of digital interfaces and robotic systems.
At 2.2B parameters, it brings this kind of multimodal assistant on-device. Examples include a tutor that looks at your handwritten math and answers your spoken question, a tablet you can walk around with and ask about what it sees, and in-car assistants that combine what the camera sees with what the driver says.
Grounded tool use from speech
LFM3-Omni goes from spoken audio straight to structured tool calls.
Precise visual grounding locates any element on screen, so one model can listen, see and act.
Decision
This release also brings two new decision models:
d1-2B
, built on LFM3-VL-2B, reads text and pictures, and
d1-Omni-2B
, built on LFM3-Omni-2B, also listens. Instead of writing an answer, they decide in milliseconds. Give them a situation (a support ticket, an invoice, an app screen, a photo, a voice note) and a list of questions, and they answer all of them in a single forward pass, each with a calibrated probability.
Beyond the new LFM3 backbone, the big change since
d1-3B
is
typed answers
. On top of yes/no, choices, and scores, both models can now:
Point:
draw a box around what you describe, or find every instance of something, with a count.
Read:
pull text, numbers, and dates out of a document, with the exact span they came from, and say “not found” when a field isn’t there.
Estimate:
give a number with its likely range.
Pick:
select every option that applies, each with its own probability.
Ask as many questions as you like: they’re read in one pass over the same input.
Smaller and stronger.
d1-2B replaces our previous d1-3B, with a third fewer parameters:
d1-3B
d1-2B
Decision Bench (real enterprise records)
83.6
85.2
Decision Index, public suite
49.0
51.1
ImajevBench (decisions from photos and rules)
64.0
75.5
Our Meta index (117 private and public benchmarks)
58.8
63.2
Decisions you can speak.
d1-Omni-2B takes the same questions over audio, so a voice request can be routed, checked, or answered just like a typed one. Asked by voice instead of in writing, it keeps nearly all of its accuracy:
written
spoken
DecisionBench (business routing and triage)
83.4
78.2
Typed Decisions (customer service cases)
50.5
48.0
JevBench
87.6
89.0
It also recognizes everyday sounds (84.5% on ESC-50) and tells which of 43 languages is being spoken (92.5% on FLEURS).
Pick d1-2B for text and pictures, and d1-Omni-2B when your inputs include audio. Both run on-device, and turn a stream of tickets, documents, calls, or camera frames into structured decisions without a round trip to the cloud.
In the following demo, d1-2B runs on a MacBook. You describe what to find in plain language, and it draws a bounding box around every match in a single forward pass, using the new Point answer type.
Made for specialized intelligence
LFM3 is built to be specialized. The 2B-class models are small enough to fine-tune on your own data and run where your application lives. The following two examples show this with LFM3-VL-2B. The first is a short fine-tune that turns it into an inspection model for one narrow industrial task. The second is a research extension that turns it into a robot controller.
Domain expertise: Specializing LFM3 for your field
While frontier models are powerful generalists, they are not necessarily experts in your particular use case. In this demo, we fine-tuned LFM3-VL-2B to find and classify defects in drone photos of wind turbine blades. Training used about 3,000 public photos (
WTBs2025
) with SFT and GRPO for a few hours on one A100. We then compared it with the base model and GPT-6 Luna on about 1,400 held-out photos.
Out of the box, LFM3-VL-2B and GPT-6 Luna correctly identify these defect types in fewer than 10% of images. A short fine-tune raises LFM3-VL-2B’s classification accuracy to 67% and improves detection F1 from 0.003 to 0.11, compared with 0.01 for GPT-6 Luna. Lightning-strike images illustrate the difference, where GPT-6 Luna often locates the defect correctly but labels it incorrectly, while the fine-tuned model correctly identifies a lightning strike. Beyond classification and detection, the model can answer natural-language questions about the same image. For example, it can locate visible damage or write a brief inspection finding including the defect type, supporting evidence, and location.
We investigate how LFM3-VL-2B can serve as a basis for robotics applications. We consider three complementary directions: (1) high-level tool orchestration, (2) vision-language navigation, and (3) low-level manipulation.
Orchestration.
Building on LLM-based robot planning and control (SayCan, Code as Policies) and recent physical orchestrators (VoLo, Gemini Robotics ER 2), we fine-tuned LFM3-VL-2B to operate a robot arm through tools. Given a request and the current camera image, it reasons step by step, grounds objects by pointing, measures them with depth tools, and manipulates them via motion planners. It then checks each outcome in the next image and reports back, including when a request is out of reach or ambiguous. The tasks feature relational selection, sorting by measured properties, and environment perturbations, all simulated in Isaac Sim. No architectural change was needed. A rank-32 LoRA adapter was trained on about 40,000 samples, combining manipulation trajectories with general tool-use and pointing data, and took about six GPU-hours on a single AMD Instinct MI325X. Paired with a fine-tuned d1-2B skill monitor, we can further double recovery success under disturbances such as slips, jams and drags.
Navigation.
For vision-and-language navigation, LFM3-VL-2B reads a route description and a short history of RGB frames to predict navigation targets and residual-quantized trajectory primitives, inspired by the action interface of LightNav-0. Each decision consists of five tokens: two spatial/control tokens and three hierarchically quantized codes encoding a ten-waypoint path that a velocity controller can track. We only repurpose 2,068 vocabulary tokens; the architecture is otherwise unchanged. We train on 2.8 million samples for 72 GPU-hours on MI325X GPUs. In unseen validation scenes, the resulting model achieves success rates of 53% on R2R and 43% on RxR under a strict continuous-control evaluation protocol with wall sliding disabled and explicit stopping required. We further observe robustness across varying camera angles and instruction languages. On a Jetson AGX Orin, our navigation model updates waypoint trajectories at over 2.5 Hz using TensorRT FP16 without visual prompt caching.
Manipulation.
To turn LFM3-VL-2B into a vision-language-action (VLA) model, we adopt parallel action prediction inspired by OpenVLA-OFT and StarVLA-α: a small residual MLP maps the hidden states of eight action-query tokens to an eight-step chunk of continuous robot actions in a single forward pass. Proprioception is provided both as discretized text and through an embodiment-specific learned projection, and the whole network is fine-tuned end to end. We trained a single generalist checkpoint for 170 GPU-hours on MI325X GPUs, on simulated and real-robot data from 15 embodiments, ranging from single arms and mobile manipulators to bimanual platforms and a humanoid. The resulting VLA achieves 96.2% average success across the four LIBERO suites and 45.7% on RoboCasa-GR1 tabletop tasks. On a Jetson AGX Orin, it can generate action chunks in under 50 ms using TensorRT at FP16 precision.
With LFM3, we're delivering on our vision of AI that runs anywhere. These models are:
Open-weight:
download, fine-tune, and deploy.
Fast from day one:
native support for llama.cpp, MLX, and vLLM across Apple, AMD, NVIDIA, SGLang and Qualcomm hardware. Deploy on
Liquid Real-time Inference Pipeline
for low-latency, high-volume workloads.
A complete family:
from base models for customization to specialized text, vision, audio, omni, and decision models, one architecture covers diverse use cases.
We are grateful to our day-0 launch partners for their support. LFM3 is ready to use today across these platforms: Ambarella, AMD, Arm, Intel via OpenVINO, NVIDIA, OpenRouter, Qualcomm via Qualcomm AI Hub and GenieX, and Vercel. Thanks to Mercedes-Benz and Shopify for partnering on pre-release testing and evaluation.
Thank you to our builder ecosystem for its support: Atomic, Cactus, Hugging Face, llama.cpp, LM Studio, MLX, Ollama, RadixArk on SGLang, .txt, Unsloth, vLLM, and ZML.
Citation
For citations, please use the following reference or BibTeX:
Liquid AI, "Introducing LFM3: Every Modality for Specialized Intelligence", Liquid AI Blog, October 2026.
A fast and secure tar parser for the Rust ecosystem
tar-codec
is roughly twice as fast as our previous tar implementation (
astral-tokio-tar
) while
also reducing uv's exposure to parser differentials and other security risks.
This blog post is about
tar-codec
itself: what it is, and what compelled us to build and optimize
it. Read on if you, too, would like to know too much about tar archives.
What follows is an extended digression on the tar format. If all you care about is
tar-codec
,
skip to it
.
As a Python packaging tool, uv is in the business of resolving and installing Python packages.
uv
requests
installable distributions
from various sources (principally package indices like
PyPI
)
and installs them on the user's behalf. This is how you go from
uv add urllib3
to something you
can actually import and use in your own Python codebase.
Installable distributions come in two primary forms:
"Built"
2
distributions, also known as
bdists
or (most commonly)
wheels
, are essentially
ZIP archives containing structured metadata and a fixed layout. Installers handle these by (more
or less) plopping their contents into the right destination directory.
Many people think that
bdist
is short for "binary distribution," since wheels often contain
compiled native code. This one common way to use wheels, but wheels can also contain pure Python.
They're just another (and frequently better) way to package and install a distribution.
"Source" distributions, also known as
sdists
, are essentially tar archives. Unlike built
distributions, a source distribution is
essentially
3
just a rollup of a source tree's
state at release time.
By definition, source distributions execute arbitrary code at installation time. This makes them
very powerful, but brittle (missing build tools or dependencies) and also a security risk (an
attacker who controls the sdist can run code without the user needing to
import
anything).
Consequently, at a bare minimum, a Python package installer needs to understand at least two
different archive formats: ZIP for wheels, and tar for sdists.
We've already
talked a bit before
about ZIPs on the Astral blog, and we'll certainly be talking
about them again soon enough. But today we'll be focusing on tar.
Around a year ago, we began to receive a
number of security reports
in
astral-tokio-tar
. This
spurred us into looking more into our compression and archive handling stack, where we found
additional problems.
Many of these boiled down to differentials that could cause a full parser
desynchronization
4
: given an identical tarball,
uv
,
pip
, and other package tooling
could be made to see different contents for the same package distribution. We found this
particularly concerning in the context of archives that would appear "safe" to an index (like PyPI)
but could extract dangerously when parsed by an installer like
uv
or
pip
.
This could the take the form of an "append" differential (where the attacker can append new files or
new contents to existing files for a specific victim parser), or even a "full" differential (where
the attacker can fully separate the extraction contents for each parser):
In the context of
uv
, the attacker model for these kinds of vulnerabilities is somewhat subtle:
tar is only used for source distributions which, per above and unlike wheels, are assumed to execute
arbitrary code at build time. Consequently, Python packaging
mostly
considers tar differentials to
be a minor concern, since any attacker who
would
use them has a much more direct and official
route towards writing arbitrary contents to disk (or executing arbitrary code).
tar-codec
grew directly out of that effort: we ultimately came to the conclusion that the
tokio-tar family was
too lenient by design
, and that retrofitting constraints to it would be more
troublesome and error-prone (including for existing non-Astral users of its APIs) than developing
our own, ground-up implementation of tar. This would also give us the opportunity to systematically
understand the tar format, and ensure that our assumptions around which aspects are (or aren't)
differential risks hold true.
Similarly, we determined that our performance goals around tar parsing would be impossible to meet
in the existing code base, at least not without refactors that would be tantamount to a rewrite.
It's important to understand that one does not simply build a tar parser from scratch. One must
first understand
how
the tar format evolved into its current state
5
.
tar is an
interesting
format. Or more precisely, it's an interesting
family
of formats.
To summarize, there are three (and a half) variants that matter in practice:
There's UNIX V7 tar, which is the "original" tar. Very few tar implementations write this format
by default anymore, but virtually all still read it. For example, Python's
tarfile
module
will
happily parse V7 tar files.
The UNIX V7 format is not widely used anymore because it comes with significant limitations on
per-member file sizes (approximately 8 GiB) and path lengths (100 bytes).
Then there's the UStar/pax tar family
6
. This family is widely supported by tar
implementations for both reading and writing. As far as tar goes, UStar and pax are what passes
for a "gold standard" in terms of clarity of specification and documentation.
At this juncture, the main thing to know about the UStar/pax family is that it's derived from the
UNIX V7 format, but with certain restrictions lifted:
UStar keeps the per-member size limit at 8 GiB, but raises the path length limit to 255 bytes
(except for link names, which remain 100 bytes),
pax makes per-member sizes and path lengths unlimited,
including
link names.
GNU tar is documented in the
GNU tar manual
, but is not standardized
per se
. The source code
of GNU
tar
(the CLI) is the
de facto
standard for GNU tar.
Like UStar/pax, GNU tar is derived from UNIX V7 tar. It's
also
derived from an
early draft of
UStar
.
Also like pax, GNU tar makes file sizes and path/link lengths (effectively) unlimited. It does so
in a completely different and much funnier way than pax does.
That gives us the following genealogy:
If you've ever written a parser for a binary format before, then you probably have a preconception
for what a binary format
should
look like. To first, second, and third approximations, binary
formats tend to look
something
like this:
Within this, too, certain idioms appear: binary formats typically use some form of
TLV encoding
,
use different magics to signal different endiannesses, &c.
The tar format does not look like this, regardless of the variant. tar is fundamentally a
block
format
, owing to its origins as a tape archival format
8
.
As a block format, a tar archive is comprised of one or more fixed-length blocks. There is no
file-level header; instead, many of its blocks
are
headers, while other blocks contain actual
member
9
data:
In all flavors of tar, all blocks (including the header blocks) are always 512 bytes. Each header
block declares metadata for the
member
that follows it. This includes important things like the
size of the member and its filepath.
Member contents don't always fit cleanly into multiples of 512 bytes, so a tar that wants to encode
a file member of
N
bytes will allocate
ceil(N / 512)
blocks and pad out the remainder of the
last block. This doesn't affect extraction, since the reader knows (via the header block) exactly
how many bytes out of the allocated space are actual file content.
Conventionally, the padding or "holes" in a tar archive are filled with NUL bytes. However, nothing
stops a tar producer from filling them with uninitialized memory, or lines from the Bee Movie, or
anything else. A recurring theme with tar (of all flavors) is that it has no opinions about what
goes in the holes of the format. This malleability makes it very prone to parser differentials,
since it gives the attacker ample space to place surprising data.
tar's block design also makes it relatively space-inefficient
10
by modern standards. For
example, a 513-byte file occupies an absolute minimum of 1,536 bytes when encoded as a tar member:
one 512-byte block for the header, and two blocks for the content (one of which has only 1 "real"
byte, followed by 511 bytes of padding). Similarly, a tar archive containing 1000 one-byte files
requires a minimum of 1025 KiB of encoding (1 MiB for the headers and contents, and then 1 KiB for
the trailing zero blocks).
So far, this all sounds pretty sane. It's not a "normal" file format by modern standards, but
there's a simple state machine one could write to formalize a parse for the tar example above:
Unfortunately, it's not that simple. The state machine above is accurate for a V7 tar, but not for
anything else in the tar format family.
To understand why, we have to remember V7 tar's limitations. All of those limitations come down to
the C structure that represents a V7 member header, which we've annotated here:
struct v7_header {// The member's path. Observe that this can be no more than 100 bytes;// NUL termination isn't required, since it's a fixed-size field.char name[100];// The member's mode, as an octal string.// Note that only the first 4 octal digits (12 bits) have well-defined semantics in pax.char mode[8];// The member's owner's UID and GID, as octal strings.char uid[8];char gid[8];// The size of the member, as an octal string.// V7 treats this as NUL-terminated, so the largest// interoperable value in it is `77777777777\0`.char size[12];// The member's mtime, as an octal string.char mtime[12];// A checksum for the member header itself.char chksum[8];// '\0' for a regular file, '1' for a hard link,// and '2' for a symbolic link.char linkflag;// When `linkflag` is '1' or '2', this is the link's destination.// Like `name` this is limited to 100 bytes.char linkname[100];// 255 bytes of the header are unused.char pad[255];};
Three big limitations stand out, and each member of the tar family tries to solve them in various
different ways:
Member and link names cannot be longer than 100 bytes;
Members cannot be larger than
0o77777777777
bytes, i.e. one byte short of 8 GiB;
Only regular files and links are defined; there are no directory or other member types
11
.
UStar's half-solution is to preserve the existing physical header block, while
impressing
some of
its fields and padding into new roles.
This is the UStar header:
struct ustar_header {// Unchanged.char name[100];char mode[8];char uid[8];char gid[8];char size[12];char mtime[12];char checksum[8];// `linkflag` is now `typeflag`, and encodes, inter alia,// '5' for a directory.char typeflag[1];// Unchanged.char linkname[100];// `"ustar\0"`char magic[6];// `"00"`char version[2];// The user and group names for the member.char uname[32];char gname[32];// For chardev/blockdev members, the device's major and minor numbers.char devmajor[8];char devminor[8];// If nonempty, a prefix to prepend to `name` (joined by a `/`).char prefix[155];// 12 remaining bytes of the header are unused.char pad[12];};
This partially lifts the member name restriction (by raising it to 255 bytes), but retains the file
size and linkname limitations.
pax fixes these remaining limitations by doing away with the single-block metadata design. Instead,
pax has
extensions
that rely on two new UStar typeflags:
Typeflag
'x'
indicates a
local
extended header block.
Typeflag
'g'
indicates a
global
extended header block.
In both cases, an extended header block indicates its member's "size." But that size isn't for a
file: instead, it's for the extension data itself.
So, what's in the extension data? pax calls it an
extended header
, and it's an entirely different
encoding format. An
extended header
contains one or more pax "records," and each record is a
string that looks like this:
<length> <keyword>=<value>\n
where:
<length>
is the byte-length of the record itself,
including
<length>
itself
12
;
<keyword>
is a keyword that sets or overrides some pax parsing state;
<value>
is the value to apply to
<keyword>
.
This can be hard to visualize, so here's a concrete example:
"↵" above indicates the linefeed.
Despite being a new encoding, the way that pax records work is
relatively
simple: if there is an
effective
pax record that corresponds to a tar member header's state, the pax record's value takes
precedence. In the example above, this means that the subsequent member's size is
8000
bytes, even
if the member's own header records a different size.
This is where the difference between global and local extensions comes in as well: global extended
headers take precedence over
all
subsequent members in the archive, while local extended headers
only affect the
next
file in the archive. Local extended headers also take precedence over any
global headers, so we have the following precedence ordering:
(This, too, is simplified. More on that later.)
To visualize all of that:
For this example, a pax-conforming tar implementation should extract two members:
hasdrubal.txt
, with a payload of
10737418240
bytes and an
mtime
of
100
.
Observe that this is both greater than the UStar size limit of 8 GiB and does
not
use the UStar
header's own
name
(of
hannibal.txt
) or
size
(of
0
), since the member's header is preceded
by an
x
extended header that overrides those values
13
.
Moreover, the archive
also
contains a
g
extended header that overrides
mtime
for all
subsequent members and
x
does not contain its own
mtime
, so the global extended header's
mtime=100
also takes effect.
hamilcar.txt
, with a payload of
1234
bytes and an
mtime
of
100
.
Observe that, unlike
hasdrubal.txt
, there is no
x
extended header for this member. As a
result, the UStar member states are used, with the exception of those overridden by the effective
g
extended header. Thus
hamilcar.txt
ends up with
mtime=100
, even if its UStar header sets a
different value.
GNU tar takes a very different approach. First, here's the GNU tar header:
struct gnu_header {// Unchanged from UStar.char name[100];char mode[8];// Same layout as UStar, but potentially base-256.char uid[8];char gid[8];char size[12];char mtime[12];char checksum[8];// Same layout as UStar, but additional typeflags.char typeflag[1];// Unchanged.char linkname[100];// `"ustar "`char magic[6];// `" \0"`char version[2];// Unchanged from UStar.char uname[32];char gname[32];char devmajor[8];char devminor[8];// GNU extensions.char atime[12];char ctime[12];char offset[12];char longnames[4];char unused[1];struct {char offset[12];char numbytes[12]; } sparse[4];char isextended[1];char realsize[12];// 17 remaining bytes of the header are unused.char pad[17];};
Observe that, unlike the UStar format, there is no
char prefix[155]
field. Furthermore, instead of
pax extended headers with a fully general keyword/value format, GNU tar does two things:
It goes
way
harder than UStar on trying to re-use the existing 512-byte V7 member header. In
particular, GNU tar adds its own base-256 encoding: if the first byte in a numeric field has its
high bit set, then the remaining octets in that field are binary, rather than tar's normal octal
form.
This effectively expands the per-byte entropy in numeric fields from 3 bits to 8 bits. For a
char size[12]
, that makes the effective size limit
2**80
14
or one yobibyte.
Instead of general
x
and
g
extended headers, GNU tar introduces a bunch of
specialized
typeflags for its own extensions.
Many of these
are not relevant to the post, or even to modern tar archives at all. But two are:
The
L
typeflag identifies the next sequence of content blocks as containing a filename.
The
K
typeflag identifies the next sequence of content blocks as containing a link name.
These two typeflags effectively fill the role of the pax
path
and
linkpath
records,
respectively.
To visualize that:
For this example, a GNU tar implementation should extract two members:
hasdrubal.txt
with a payload of
10737418240
bytes.
Observe that this size, which exceeds 8 GiB, was encoded directly in the header. However, the
effective filename of
hasdrubal.txt
comes from overriding the header's original filename of
hannibal.txt
via the preceding GNU
L
extension.
publius.txt
, which links to another file named
africanus.txt
.
Observe that
publius.txt
originally declared
publius.txt -> scipio.txt
as its link, but this
gets overridden to
africanus.txt
by the preceding GNU
K
extension.
Finally, while GNU tar does not have pax's notion of global vs. local precedence, GNU tar extensions
can
stack
. For example, to override a member's
name
and
linkname
at the same time, you'd have
a tar header sequence like this
15
:
Now that we understand
very roughly
how the various tar family formats look and work, let's see
what
tar-codec
has to do to parse them safely and efficiently.
First we'll revisit the state machine. Our nice and simple V7 state machine now understands the
different pax and GNU states, and has become this monstrosity:
(Note that the error transitions in this state machine are dramatically simplified: in practice, any
I/O or validation failure at any point also results in a
Failed
state.)
What in the world happened? A few different things:
Our state machine begins with a "classification" stage, which effectively locks the remainder of
the parse to a single family (either UStar/pax or GNU
16
) based on the identity (magic and
version) of the first block.
This is done for differential reduction reasons: while researching
tar-codec
's design, we
realized that many other widely used tar parsers attempt to merge states across various tar
families, with inconsistent results.
For example, with some tar parsers, it's possible to stack headers like so:
This has unclear semantics: GNU tar expects an
L
or
K
to apply to the next "file" member, but
the next physical member in the stream is a pax local extension that
also
wants to modify the
next "file" member. In practice we've seen other parsers do all kinds of things in this state,
including attempting to merge the extensions, honoring one over the other(s), attempting to apply
the
L
state to
x
instead of the file member, and so forth. Each of these is a potentially
exploitable differential!
Instead,
tar-codec
will reject a tar archive if its individual headers don't agree about what
family of tar it is. Real-world tar encoders don't mix tar families (there's no good reason to),
so this doesn't pose a significant breakage risk.
The GNU part of the state machine is slightly more strict than the GNU documentation implies: the
GNU documentation allows stacking of
L
/
K
extensions, including
multiple of the same kind
, in
any order.
tar-codec
tightens that to allowing
L
and
K
in any order, but only one of each per
underlying member.
The UStar/pax part of the state machine models local and global extended headers rigidly.
There's a significant amount of complexity beneath this: pax allows
x
and
g
anywhere
in the
tar stream. For example, this is a perfectly valid extension sequence in pax:
This brings us to one of the most painful parts of pax that we glossed over before: extended
headers don't
shadow
each other fully, they
compose
depending on what state the "stack" of
effective pax records is in. The state of any given pax record can be:
Undeclared
: no effective pax record exists anywhere in the current stack of local and global
extensions, which means that the member's own UStar header's state takes precedence.
Active
: there's an effective pax record in the stack,
and
it has a value.
Tombstoned
: there's an effective pax record in the stack, but it has no value (for example,
8 path=\n
instead of
12 path=abc\n
).
You would think that this would be the same as the
Undeclared
state, but it's not! pax
considers this record
explicitly
deleted, and
prescribes
:
If the
<value>
field is zero length, it shall delete any header block field, previously
entered extended header value, or global extended header value of the same name.
This has fascinating consequences for the state machine, because it means that an
effective-but-deleted
path
record means...a file with no path? How are you supposed to extract
that
17
?
Needless to say,
tar-codec
tries to follow this faithfully. In particular, it attempts to be
diligent about rejecting logically-consistent-but-nonsense states that fall out of pax's strange
record state machine, including empty paths and global extended headers that try to declare
size
and other key states for all members.
One of the early design choices we made with
tar-codec
was to isolate the implementation into a
few layers. From lowest to highest:
The
tar-framing
crate is responsible for taking a stream of blocks and turning it into a stream
of frames. This happens in two refinement stages:
The stream or "physical" API honors the big state machine above and yields each block in a given
state, one block at a time.
The "logical" API consumes the blocks produced by the "physical" API, and yields them as a
stream of assembled members. Each assembled member is essentially its "header" (which is the
physical header, merged with any effective extension state that affected the physical framing),
a separate extension state for non-framing extensions (such as GNU
L
and
K
), and a readable
payload for the member's actual contents.
The
tar-codec
crate takes the "logical" API from
tar-framing
and turns it
into something that can be extracted in memory or onto disk.
Extracting an archive (of any format) onto disk is its own can of worms, with its own differential
risks
18
. Another one of our early observations is that every archive implementation tends to
have its own extract-to-disk implementation, with its own edge cases.
We built
archive-trait
to address that.
archive-trait
exposes
Archive
and
ArchiveBuilder
traits (along with associated types and machinery) that allow any format to expose uniform APIs for
reading and creating archives. We then built
archive-trait
's own filesystem extraction on top of
cap-std
, giving us the ability to "anchor" extraction into a single directory and avoid a large
class of link and path traversal footguns.
Writing a differential-resistant tar parser is
surprisingly
hard, given how ubiquitous tar files
of all flavors are, and how simple the original (V7) format is.
This post has only scratched the surface in terms of complexity. To recap:
Each tar family has its own state machine, which is not always clearly laid out in that family's documentation
or reference implementation. It is
imperative
that these state machines do not mix, but real-world tar
parsers regularly allow them to.
Each tar family has its own, non-trivial rules for determining the precedence of state (pathname, linkname, and size)
attached to archive members.
Some of this state affects the framing of the parser itself, meaning that faithfully
handling e.g. pax archives means handling
size
and similar records up-front, rather than trying to abstract the
parse across individual 512-byte header blocks.
Separately, there were numerous places where we had to compromise on strict pax conformance
because of observed behavior from other implementations:
The pax spec is explicit that pax record values must be UTF-8. However, both GNU tar and
star
historically emitted
some vendor-specific records
19
as raw binary. See
this bug-tar thread for more context
.
UStar and pax are explicit that
uname
and
gname
should be NUL-terminated in the UStar header, meaning that each can
be at most 31 bytes long. However, CPython's
tarfile
(and probably others) will happily fill either to 32 bytes, only
overflowing to the pax record at 33 bytes or more. See
CPython#159322
for more context.
More generally, tar implementations will frequently leave
mode
,
uid
,
gid
, and
mtime
as all NUL, rather than
zeroed or similar. This doesn't pose a framing/parser synchronization risk, so
tar-codec
tracks them as "missing"
rather than assigning an arbitrary default value.
Finally, in the process of designing and implementing tar-codec, we found
many
parser
differential primitives that cause various tar implementations to behave
very
differently on
identical inputs. Some of these are currently being disclosed as security vulnerabilities.
However, some of the general classes we saw:
pax/GNU state machine confusion, as mentioned above. In particular, some tar implementations can be fooled
into applying a pax extension's states to a GNU extension (or vice versa) instead of to the subsequent
member, often resulting in full desynchronization and different extraction results.
Mis-handling of pax extension precedence, in particular both global (
g
) extended headers and
record "tombstoning." For example, some implementations will accept a
g
header with
size=1234
but ignore it, despite pax saying clearly that such a
size
record overrides any UStar
size
fields.
This also typically results in a full desynchronization primitive.
Mis-handling of pax record parsing. For example, some implementations will ignore the
<length>
prefix and instead assume that pax records can be safely split on
\n
. This is not true, since
the
<value>
of a pax record can contain a verbatim
\n
. As you may have guessed, this also
typically results in a full desynchronization primitive.
More generally, we found a great deal of variety in how lax various tar implementations are when it comes to parsing
integer fields: many use their language's native "integer from string" API, which can
behave surprisingly
in the presence of different (non-Western Arabic) numeral forms, leading and trailing whitespace,
and so forth. These small variations can percolate into two different implementations parsing
the same
size
field as different integers, once again resulting in desynchronization.
Decode and encode performance was
not
the hard part: we found a lot of low-hanging fruit while
optimizing both, including optimizing tar's checksum generation and calculating pax record length
prefixes.
We also picked up significant performance gains by ensuring that tar-codec reuses allocations and
batches/buffers its work wherever possible (and where doing so does not weaken the API's internal
consistency or cancellation correctness in an
async
setting).
Conversely,
performant
secure extraction
is
somewhat hard: directory capability tracking (of
the kind that
cap-std
does) adds measurable overhead to many of our filesystem operations,
particularly when extracting on hosts that lack
openat2(2)
or an equivalent system
call
20
. This negatively impacts extraction on macOS in particular.
All in all,
tar-codec
's design rests on well-worn principles for secure parser design: we are
conservative rather than liberal
in what we accept, and we enforce correctness by construction
through increasingly constrictive layers (from member framing to streaming to extraction). These
design choices have made us confident that
tar-codec
is more resistant to differentials (by
correctly rejecting them) than other tar implementations.
The fractured and under-specified nature of tar makes it impossible for us to say that we are
entirely
devoid of differentials, or that new differentials won't be discovered in the future.
However, we believe that
tar-codec
's primitives are the correct ones if and when those
contingencies occur.
This is not the end of our work, on several levels:
While
tar-codec
is essentially feature-complete for our own purposes (within
uv
), we're
interested in making sure that it also solves problems that the larger Open Source community has
around secure and performant tar parsing.
To that end, we'll be looking at supporting other, more niche aspects of the various tar families
(like sparse files, and more control over vendor-specific pax records) as the need arises.
Separately, we'll be working with others in the community on improving the correctness of
other
tar implementations. In particular, we see Harmen Stoppel's nascent
tar-minefield
project as a
promising way to test and re-align other implementations with stricter, more
differential-resistant interpretations of the tar family formats.
Separately, as you may have guessed from our decision to build a generic
archive-trait
library:
tar is not the only format we're thinking about here!
We're also actively looking into replacing uv's ZIP parsing, for similar reasons. We hope to share
our lessons from that work soon, along with material benefits to uv itself.
tar-codec
has been available since 0.12, but was disabled by default behind the
--preview-features tar-codec
flag. As of 0.13, it is the default and can be disabled by
setting
UV_LEGACY_TAR_BACKEND=1
.
↩
The term "built" is the source of a great deal of confusion for newcomers when they first
encounter Python packaging. In the context of Python packaging, "built" refers to the fact that
the distribution is produced by a "build backend", i.e. contains structured metadata that a
source distribution is not guaranteed to have.
It does
not
imply that the wheel contains shared libraries or other native code, although it can.
Pure Python packages are also regularly distributed as built distributions, because installing them is
faster and more reliable.
↩
Historically, a source distribution was
literally
just a source archive, with the convention
of having a
pyproject.toml
or
setup.py
at the archive's root. More recent Python packaging
standards state that source distributions must contain a
PKG-INFO
file containing standard
metadata. See
PEP 643
for more on that.
As a result, many source distributions contain no metadata other than the build system itself, which must be
executed to access the distribution's metadata.
↩
We recommend Edera's "
TARmageddon
" blog post for a detailed treatment of one such
differential.
↩
Martin Dørum
has a
great blog post
on the original tar format and how it evolved over time
into the constellation of variants that currently exist. We highly recommend reading his post.
↩
Whether or not UStar and pax should be clumped together in the same family is doubtless
extremely controversial to the dozen-or-so other people on Earth who have thought about the tar
format this much. I consider them to be in the same family, since pax is
effectively
a strict
superset of UStar and comes from the same standards body (POSIX) that produced UStar.
↩
There are actually two different GNU tar formats: there's
oldgnu
i.e. "old GNU" and
gnu
i.e.
"new GNU". The difference between these two is minor (relative to everything else) and GNU tar
itself emits "new GNU" as of tar 1.12, which was released in 1997. So that's enough about "old
GNU."
↩
"tar" of course being short for "Tape ARchive." Magnetic tapes (like all mass storage) store
their contents in sequences of fixed-sized blocks, and tar seals 1979's glorious 512-byte blocks
in amber.
tar is also far from the only block-style file format.
cpio
is another well-known one.
↩
Archive members are things like files and directories, but
also
things like sockets and device
files. I'm not really clear on what it means to archive a socket, but both UStar/pax and GNU tar
will happily let you express that you've done so!
↩
Before compression, of course. tar knows nothing about compression. It's just the format that
encodes one or more files into a single file.
↩
V7 tar handles directories in two ways: it creates directories that are
implied
to exist (for
example, a member whose name is
foo/makeme/bar
will create
foo
and
foo/makeme
if needed),
and it will explicitly create a directory if a regular file member ends with a slash, e.g.
foo/makeme/
.
↩
In other words, it's a self-describing length. This is somewhat unusual when compared to a
"normal" TLV/LTV encoding, where the length component is typically either a fixed length or
something with only limited length variation, like
LEB128
.
↩
You might be thinking: why bother putting states in the member's UStar header at all, if they're
just going to be overridden by the pax extended header? Why not just fill those parts of the
block with NULs?
The answer has to do with backwards compatibility: both GNU and pax do a
disgusting hack
interesting trick where the extension/extended header's
own
name field is also a valid
path, conventionally a specially formatted one like
%d/PaxHeaders.%p/%f
, where
%d
is
the dirname of the pax
path
record,
%p
is the current PID, and
%f
is the basename
of the same
path
record.
The theory behind this is (probably) that a subsequent tool can repair the extraction,
by looking at the pax headers which have been extracted as a regular file instead.
In practice I suspect this doesn't work well in the greater-than-8 GiB case, which
is one of the cases where it matters the most.
↩
This is
2**80
instead of
2**96
because we lose
size[0]
to the base-256 sign bit and
size[11]
to the NUL byte. Implementations that don't require a NUL terminator for fields like
size
could in principle allow up to
2**88
instead.
↩
The order of GNU extensions before the member they affect does not appear to matter in any
implementation. In other words, you can have
L -> K -> 1
or
K -> L -> 1
.
↩
That's correct: we don't support parsing V7-style tar files. An early review revealed that
they're nonexistent in the Python packaging ecosystem, probably because Python's own
tarfile
never supported creating them. The gap between V7 and UStar is small, however, so adding it
would not be difficult
if
needed.
↩
Many tar implementations do random things here, like trying to extract to an empty path (which
of course fails), or picking
some
previous filename or extended header state.
↩
Extraction differentials themselves are out of this post's scope, but to summarize: extraction
depends heavily on the target filesystem and its state, including any pre-existing symbolic and
hard links.
Nuances abound, including how to handle files that differ in casing inside the archive but not on the filesystem itself
(macOS and Windows), how to handle symlinking on systems where symbolic links are privileged (Windows), and how to handle "funky but valid" filenames
(non-UTF-8, UTF-8 with NULs, control characters, &c.).
↩
A pax "vendor record" is a normal pax record, but with a name like
VENDOR.keyword
instead of
keyword
. pax itself does not specify their semantics and various implementations do wildly
different things with them, so tar-codec rejects them by default (with an option to skip/ignore
them instead).
SCHILY.xattr.*
is one common example of a vendor record namespace. GNU also has
their own vendor namespace, e.g.
GNU.sparse.*
for sparse members.
↩
Without
openat2(2)
or a similar source of
RESOLVE_BENEATH
semantics,
cap-std
needs to open
each directory component in a path, which means that its system calls scale linearly with the
depth of the paths it needs to track. This is on top of the system call overhead for the
extraction I/O itself.
↩
The Verdict Is In on Hell Gate's Courts of Contempt Trivia Night
hellgate
hellgatenyc.com
2026-10-27 12:57:22
A unanimous decision on the side of fun, some quibbling, and the crowning of champions....
A unanimous decision on the side of fun, some quibbling, and the crowning of champions.
Scott's Picks:
Court was in session on Monday night at Rodeo in Crown Heights, where teams of investigative journalism fans squared off over their knowledge of Hell Gate and Type Investigation's deep dive into New York's broken courts system,
Courts of Contempt.
Answering questions as difficult as naming which Queens judge made an immigrant reveal their immigration status in court against state policy (Kenneth Holder) or just how many Supreme Court judges are currently sitting in New York City (366), teams with names like "That's What She Seddio" and "AJAB (All Judges Are Bastards)" duked it out in a surprisingly competitive trial by trivia.
While everyone crushed both the opening and final rounds ("Know Your Courts" and "Know Your Brooklyn Democratic Party"), it was the second round ("Know Your Judges") that separated the mere dilettantes from the true investigative journalism-knowers, subjecting players to in-depth questions about the specific judges we profiled.
The winning team celebrates (Hell Gate)
Did we put our players through more rigorous testing than many judges who end up on the New York City bench? It was probably pretty close!
But at the end of the night, one team emerged victorious—by a single point, Habeas Corpses took home the grand prize: a $150 gift certificate to
Nick's Lobster House
in Marine Park.
Besides the trials and tribulations, a very special moment took place at the beginning of the night, when former state judge
Margarita López Torres
made an appearance to give the answer to our trivia question about the
outcome of the case
she took all the way to the U.S. Supreme Court, challenging New York's arcane and broken system for electing judges.
The demure third-place team accepts their gift bag from Hell Gate's Nick Pinto (Hell Gate)
Thanks to all who played and came out to support investigative projects like the Courts of Contempt! And special thanks to bartender Liam, who kept the natural wine flowing all night.
Want to help support fun events like this which help highlight the reporting that went into a yearlong investigative project?
Subscribe to Hell Gate today
!
Related Posts
Great! You’ve successfully signed up.
Welcome back! You've successfully signed in.
You've successfully subscribed to Hell Gate.
Your link has expired.
Success! Check your email for magic link to sign-in.
Ghostty 1.4.0 is a major release that includes large performance and
memory improvements, a 100% complete Kitty graphics implementation including
animation and relative placements (the first non-Kitty terminal to do so),
SSH integration improvements, and hundreds more improvements and fixes
across all platforms.
This release features
7 months of work
with changes from
172 contributors
over
2,889 commits
. Thank you to all the contributors,
maintainers, community moderators, translators, packagers, and users
who each helped make this release possible.
These release notes are painstakingly and lovingly hand-crafted
by human Ghostty maintainers, including the full changelog. They take
a combined 16+ hours to write, so please enjoy. 🥰
GHSA-4hwh-wx3w-3fqg
.
Paste protection didn't treat carriage returns as line endings, so a
paste could run a command without confirmation in programs that don't
use bracketed paste. This requires user interaction (copy-paste) to
trigger.
GHSA-mhff-mv4q-fp63
.
Malicious Kitty graphics commands could crash or hang Ghostty, force
huge allocations, or in limited cases read or delete files outside the
allowed temporary directories. This only requires displaying malicious
output.
GHSA-hcr9-7hcr-mjm8
.
Malicious terminal output could crash Ghostty, closing every window,
via tmux control mode. tmux doesn't need to be installed. This affects
Ghostty 1.3.0 and 1.3.1.
GHSA-hp9c-qp4q-cpw3
.
The same impact as above, via a tmux control mode layout with a
zero-sized or oversized pane. This affects Ghostty 1.3.0 and 1.3.1.
GHSA-w9q4-5jvv-mcv4
.
Clearing the screen into scrollback could corrupt memory if it deleted
the scrollback page holding a styled or hyperlinked cursor. This only
requires displaying malicious output, but only with a small
scrollback-limit
such as
0
. The default isn't known to be affected.
GHSA-2r63-vmw6-3m3c
.
A crafted directory name could make the zsh shell integration send
arbitrary escape sequences, such as silently replacing the clipboard via
OSC 52. bash was affected in a more limited way. This only requires
cd
-ing into a directory from untrusted content, such as a cloned
repository.
macOS:
GHSA-cw69-wm67-5pv8
.
Cmd-clicking a crafted OSC 8 hyperlink could open unsafe local files or
custom URL schemes, leading to arbitrary command execution. Ghostty now
blocks unsafe targets and confirms custom URL schemes. This requires
user interaction (cmd-click) to trigger.
macOS:
GHSA-mfw9-xcr3-7gfp
.
The same issue as above for links detected by the
link
configuration,
including the default URL matcher. This requires user interaction
(cmd-click) to trigger.
macOS:
GHSA-v8cw-fg4j-jcc4
.
Drag-and-drop text skipped paste protection, with the same impact as
above. This requires user interaction (drag-and-drop) to trigger.
macOS:
GHSA-mxqx-236q-wrv7
.
Opening a file whose name contains control characters could run a
different command than the one shown in the confirmation dialog. This
requires a crafted file on your system and confirming the dialog.
Note: I requested CVEs for the above advisories weeks ago, but GitHub
hasn't assigned them yet. If/when they're assigned, I will update the
above with proper CVE numbers.
Ghostty now supports Kitty graphics
animation
and
relative placements
.
These were the last major features of the Kitty graphics protocol that
Ghostty didn't support.
Programs that display animated images with the Kitty protocol, such as an
animated GIF shown with
kitten icat
, now animate in Ghostty instead of
showing a single still frame. Frame transmission, composition, and playback
control are all supported, and animations pause while the terminal isn't
visible. Relative placements let a program position one image relative to
another image's placement, so the child image moves along with its parent.
We also did a full conformance pass against the specification and Kitty
itself, fixing dozens of behavioral differences. For example, images now
scroll with text inside scroll regions (
#4323
), retransmitting an image
ID replaces the old image (
#6711
), and invalid image data now gets an
error response instead of silence, which could leave clients hanging. The
full list is in the
terminal capabilities
section.
Kitty graphics are faster, too. Image payloads are now parsed in bulk
with SIMD instead of one byte at a time, making large image transfers
about 16x faster
to parse in our benchmarks (64 MiB of image data,
x86_64 Linux), and drawing images costs much less per frame.
Our Kitty graphics implementation now covers 100% of the published
specification, making Ghostty (and libghostty) the first terminal
to do this outside of Kitty itself.
Ghostty now transparently compresses scrollback that isn't visible,
reducing the physical memory those pages use by
70% to 90%
for typical
text-heavy history. Compression only runs while the terminal is idle and
pages are decompressed on demand when you scroll back or search, so it
has no measurable impact on I/O throughput.
Thanks to compression,
the default scrollback limit has been raised from
10 MB to 50 MB
per terminal. On platforms that support compression, a
full scrollback still generally uses less physical memory than the old
10 MB limit did.
Compression lowers
resident
(physical) memory, not
virtual
memory, so
look at resident memory when measuring it. It is currently available on
macOS and 64-bit Linux.
Beyond scrollback, memory usage is lower in many places:
A new, empty terminal now uses about
16 KiB
of terminal page memory
on macOS, down from 128 KiB in Ghostty 1.3.1.
On macOS and Linux, memory freed by clearing or trimming scrollback is
now returned to the OS instead of being held until the terminal closes.
Hidden tabs release their GPU resources. On macOS, with one visible tab
and 20 hidden tabs, GPU memory dropped from about 385 MiB to 18 MiB.
Rebuilding them when a tab becomes visible again takes under a
millisecond.
There are performance improvements across the board in Ghostty 1.4
that yield significant gains compared to prior Ghostty versions.
The biggest win came from a surprising discovery: on macOS, the kernel
caps every read from a pty at about 1 KiB no matter how large the read
buffer is. Previously, Ghostty processed each read as it arrived, so per-read
overhead was paid every kilobyte, and the program writing output sat
blocked while we parsed. Ghostty now drains the pty on one thread while
parsing on another, raising end-to-end I/O throughput by
25% to 55%
on macOS (M4 Max, plain and Unicode text) over Ghostty 1.3.x.
VT processing itself is also much faster. In parser benchmarks, plain
ASCII text went from 128 MB/s to 725 MB/s (5.7x), CJK text got 3.4x
faster, and a 2.6 GB dataset of real-world terminal recordings
from
asciinema
is processed about 25% faster.
Together, these changes took
cat
-ing a 150 MB text file on macOS from
1.5 seconds to 566 milliseconds.
Other notable improvements:
Resize:
resizing a terminal with a large scrollback is about
6x
faster
(120x80 with 10,000 lines of scrollback), and 3x to 5x faster
with history full of CJK text or emoji.
Rendering:
the renderer holds the terminal lock
2.7x to 11x
less per frame, leaving more time for the I/O thread during heavy
output.
Copy and search:
formatting terminal contents as plain text, HTML,
or VT, which backs clipboard copy,
write_screen_file
, and scrollback
search, is 1.5x to 8x faster.
Launch (macOS):
about 15% faster from launch to visible window, and
27% faster to the first rendered frame.
Idle energy:
on macOS, the renderer's display link now sleeps when
there's nothing to draw. On GTK, hidden tabs stop rendering, matching
macOS.
Large OSC sequences:
OSC 52 clipboard payloads parse about
30x
faster
, and even short sequences like title changes are about 6x
faster.
The GTK app has a new rendering pipeline. It no longer uses
GtkGLArea
.
Instead, the renderer draws with EGL on its own thread, exports each frame
as a DMABUF, and hands it to GTK to display. Rendering is now
triple-buffered, which should greatly reduce tearing, and no OpenGL calls
run on the main thread anymore, which let us remove a number of
workarounds.
The most visible result is crisp text under fractional scaling. Text and
box-drawing characters are no longer blurry with fractional display
scaling such as 125% or 150% (
#1938
). We fixed this once before, but it
came back after upstream GTK changes. Ghostty now renders at the window's
true fractional scale, so every rendered pixel maps to exactly one pixel
on screen.
The new render surface needs a system EGL library (see
Changes for Package Maintainers
).
On GPU drivers that can't export DMABUFs, Ghostty falls back to copying
frames through the CPU, which is slower but works.
Ghostty now implements the
Kitty clipboard protocol
(OSC 5522) on both macOS and GTK. Ghostty 1.3 could parse the protocol
but didn't implement it.
OSC 52 can only read and write plain text. The Kitty clipboard protocol
lets programs running in the terminal read and write any kind of clipboard
data, such as images or HTML, and lets them pick among the formats on the
clipboard. Programs can also enable paste events (mode 5522), which tell
the program what formats a paste contains so it can read the one it
wants. This is how a terminal program can accept a pasted image, for
example.
Clipboard access follows the existing
clipboard-read
and
clipboard-write
configurations. By default, reads prompt for permission
and writes are allowed. The permission prompt shows a preview of the
clipboard contents, including images. Programs that send a password can
have your answer remembered for the rest of that terminal session. A new
clipboard-write-limit-bytes
configuration limits the size of a single
write (default 64 MiB). A write over the limit fails and leaves the
clipboard untouched.
You can now rearrange splits on GTK by dragging them, matching the macOS
feature introduced in Ghostty 1.3. When a tab has two or more splits, each
split shows a drag handle at the top. Grab the handle and drop the split
onto any other split, including splits in other tabs and windows. An
overlay shows which side of the target split it will land on. The terminal
contents, working directory, and running processes all move with it.
A new
drag-handle
configuration controls when drag handles are shown on
both macOS and GTK:
auto
(default),
always
, or
never
. With
never
,
splits can't be rearranged with the mouse. Hiding the handles was a
common request from users who found them in the way.
On GTK, splits can only be dropped onto other splits. Dragging a split out
to create a new tab or window is macOS-only.
Ghostty 1.4 includes dozens of improvements to core terminal emulation. We
now run
esctest
, Thomas Dickey's
terminal conformance suite, against Ghostty's terminal core in CI.
Alongside that, we fixed many differences from xterm in cursor movement
within margins, tab stops, character sets, mode reports, and more. You
can find the full list of related changes in the
terminal capabilities
section.
Ghostty also supports several new sequences, including soft terminal reset
(DECSTR), extended cursor position reports (DECXCPR), backarrow key mode
(DECBKM), and screen size reports in characters (
CSI 19 t
). Programs can
also now ask whether the terminal is visible using
visibility reports
(mode 2033), so they can stop rendering while hidden.
Keyboard encoding also matches xterm more closely, with fixes for
modifyOtherKeys
mode 2 and legacy Alt-as-Escape encoding of non-ASCII
keys.
Two new sequences are disabled by default because they can be abused by
untrusted programs, including ones running on a remote machine:
# Allow programs to resize the window (CSI 8 t)
vt-window-resize-allowed = true
# Allow programs to request screen checksums (DECRQCRA)
vt-xt-checksum-report = true
Ghostty 1.2 introduced
SSH shell integration features
as a work in progress. In Ghostty 1.4, they're backed by a new
ghostty +ssh
CLI action: a drop-in
ssh
wrapper that prepares the
remote session for Ghostty and then runs the real
ssh
with your
arguments forwarded unchanged.
ghostty +ssh user@example.com
# Or alias it so every ssh invocation goes through italias ssh='ghostty +ssh --'
Before connecting,
+ssh
installs Ghostty's terminfo on the remote host
so the proper
xterm-ghostty
TERM
value can be used, and forwards
COLORTERM
,
TERM_PROGRAM
, and
TERM_PROGRAM_VERSION
. If the terminfo
install fails (for example,
tic
isn't available on the remote), it falls
back to
TERM=xterm-256color
. Flags such as
--terminfo=false
,
--forward-env=false
, and
--verbose
control each step.
The
ssh-env
and
ssh-terminfo
shell integration features (still opt-in)
now call
+ssh
too. Previously, each shell integration carried its own copy
of this logic, which made up roughly a third of our shell integration
scripts. Now bash, zsh, fish, elvish, and Nushell all behave identically,
and you can get the same behavior from scripts or anywhere else by calling
ghostty +ssh
directly.
The terminfo install itself is also more reliable. Ghostty now always
installs its own bundled terminfo rather than accepting whatever
xterm-ghostty
entry the remote already has, and it reinstalls
automatically when a Ghostty update changes the terminfo. It also no longer
needs
infocmp
or Ghostty's terminfo on the local machine. Installs are
cached per host
and
port, so two machines behind one address no longer
share a cache entry. And
ssh-env
no longer silently overrides
SetEnv
entries in your
~/.ssh/config
(
#11518
).
The
+ssh-cache
command that manages this cache now takes positional
destinations (
ghostty +ssh-cache user@example.com
) and has a new
--prune=30d
flag. See the
breaking changes
if you
script against
+ssh-cache
.
macOS:
The minimum required macOS version for Ghostty 1.4 remains
unchanged (macOS 13 Ventura). Ghostty is now compatible with macOS 27.
GTK:
Ghostty 1.4 requires
GTK 4.18
and
libadwaita 1.7
, up from
GTK 4.14 and libadwaita 1.5 in Ghostty 1.3. This aligns with our
GTK/Adwaita version policy
.
Notably, Ubuntu 24.04 LTS doesn't meet this requirement. Systems with
older GTK or Adwaita versions can work around this requirement by using an
older version of Ghostty or the Flatpak package.
#14330
OpenGL (GTK):
The minimum required OpenGL version remains 4.3, but
Ghostty now renders through EGL instead of GTK's OpenGL widget. This
should be invisible for nearly everyone, but if Ghostty fails to start
with an EGL error, please make sure your GPU driver provides a working
EGL implementation.
We previously announced that Ghostty 1.4 would require macOS 14.
Nothing forced our hand to do this in this release, so we kept macOS
13 support.
We still plan to drop macOS 13 in a future release.
Apple
dropped security support for macOS 13 in the fall of 2025, so we
recommend upgrading regardless.
The following behaviors have changed in 1.4.0:
copy-on-select
has been reworked and now accepts
none
,
primary
,
clipboard
, or
both
.
The meaning of
clipboard
has changed:
it
previously copied to both the selection clipboard and the system
clipboard, and now copies only to the system clipboard. If you set
copy-on-select = clipboard
and want the old behavior, change it to
both
.
#12600
#12604
macOS:
copy-on-select
now defaults to
none
(previously
true
), so
selecting text no longer copies it anywhere and middle-click paste of the
selection no longer works by default. To restore the 1.3 behavior, set
copy-on-select = primary
. Note that an explicit
copy-on-select = true
on macOS now copies selections to the system clipboard, which is
different from 1.3.
#12600
#12604
macOS:
cmd+arrow_up
and
cmd+arrow_down
now run
jump_to_prompt
again,
matching Terminal.app and Ghostty 1.2. In 1.3, these keys were hardcoded
to scroll to the top and bottom and couldn't be rebound. To keep the 1.3
behavior, set
keybind = cmd+arrow_up=scroll_to_top
and
keybind = cmd+arrow_down=scroll_to_bottom
.
#12245
GTK: The default
ctrl+shift+page_up
and
ctrl+shift+page_down
keybinds
now move the current tab left and right (
move_tab
), matching Firefox,
GNOME Terminal, and VS Code.
jump_to_prompt
moved to
ctrl+shift+arrow_up
and
ctrl+shift+arrow_down
, so programs running in
the terminal no longer receive those keys. If a program you use needs
them, unbind them with
keybind = ctrl+shift+arrow_up=unbind
and
keybind = ctrl+shift+arrow_down=unbind
.
#4998
#12458
The list below contains deprecations that remain compatible today through
a compatibility layer, but may break in a future release if they are
ignored:
scrollback-limit
has been renamed to
scrollback-limit-bytes
, to make
room for the new
scrollback-limit-lines
.
#13473
copy-on-select = true
is replaced with
copy-on-select = primary
on
Linux and FreeBSD, or
copy-on-select = clipboard
on macOS.
copy-on-select = false
is replaced with
copy-on-select = none
.
#12600
#12604
There is no set timeline to remove these deprecations, but we recommend
adapting to the new configurations sooner rather than later to avoid
any possible disruptions in the future.
Scrollback history is now transparently compressed while the terminal
is idle, reducing the physical memory used by compressed scrollback by
70% to 90% for typical text. Compression is available on macOS and 64-bit
Linux and can be disabled with the new
scrollback-compression
configuration. Because of this, the default scrollback limit has been
raised from 10 MB to 50 MB, which on average still uses less memory than
a full scrollback did previously.
#13264
A new configuration
scrollback-limit-lines
limits scrollback by number
of lines instead of bytes. The existing
scrollback-limit
configuration
has been renamed to
scrollback-limit-bytes
(the old name continues to
work). If both are set, the first limit reached applies, and both accept
unlimited
.
#13473
copy-on-select
now accepts
none
,
primary
,
clipboard
, and
both
and no longer affects middle-click paste (see
middle-click-action
).
clipboard
now copies only to the system clipboard, so use
both
for the
previous behavior. The default on macOS is now
none
. See the
breaking changes
for migration details.
#12600
A new configuration
middle-click-action
configures the behavior of
middle-clicking:
primary-paste
(default) pastes from the selection
clipboard,
clipboard-paste
pastes from the system clipboard, and
ignore
does nothing.
#12478
A new binding action
move_tab_to_new_window
moves the current tab into
a new window of its own. It is also available in the command palette.
#2630
A new CLI command
+explain-config
prints the documentation for a
configuration option or binding action, e.g.
ghostty +explain-config font-size
.
#11546
The
+explain-config
and
+show-config
CLI commands now page their
output through
$GHOSTTY_PAGER
or
$PAGER
(falling back to
less
) when
run interactively. Paging can be disabled with
--no-pager
or by setting
the pager to an empty value.
#11940
A new configuration
drag-handle
controls when the split drag handles
are shown:
auto
(default),
always
, or
never
.
#13706
#13709
Scrollback search now wraps around when navigating past the first or
last match.
#11449
A new configuration
link-osc8
(default
true
) can be set to
false
to
disable OSC 8 hyperlinks entirely. Disabled OSC 8 hyperlinks are not
highlighted, previewed, copied, or opened.
#13634
Processes running in Ghostty now receive a
GHOSTTY_SURFACE_ID
environment variable that uniquely identifies the terminal they are
running in.
#12027
The right-click context menu now has a "Close Split" item.
#11173
#11174
I/O throughput is 25% to 55% higher on macOS by reading from the pty
concurrently with parsing previously read output.
#13209
VT processing is significantly faster across the board. Plain text is up
to ~6x faster, real-world output (measured against a large asciinema
dataset) is ~24% faster, grapheme-heavy output is ~3x faster, and DEC
special graphics (line drawing), repeated characters (
REP
),
hyperlink-heavy output, and scroll regions are all faster.
#13220
#13226
#13231
#13294
#13625
#13826
#14356
Large OSC sequences, such as OSC 52 clipboard writes, are parsed ~30x
faster and small OSC sequences, such as title changes, ~6x faster.
#14011
#13565
Resizing with reflow is ~6x faster with large scrollback and 3x to 5x
faster with scrollback heavy in wide characters such as CJK or emoji.
#13537
#13827
Terminals use significantly less memory. A new terminal now uses ~16 KiB
of physical memory for its screen instead of 128 KiB on macOS, every
terminal page uses 30% less memory, and memory freed from scrollback
(such as by clearing it) is now returned to the operating system.
#13240
#13245
#14130
#14137
#14138
Kitty graphics are faster. Large image transfers are parsed in bulk using
SIMD, zlib-compressed images decompress ~17% faster, pixel format
conversion avoids an extra copy, and the per-frame cost of drawing images
is much lower, especially with Unicode placeholder images on screen or
long scrollback.
#13270
#13281
#13987
#14422
#14780
#14789
Formatting terminal contents is 1.5x to 8x faster, which speeds up
clipboard copy (plain, HTML, and VT),
write_screen_file
and related
actions, and scrollback search.
#13587
command-palette-entry = clear
removes all command palette entries,
including the default entries.
#12682
window-padding-balance
has a new value
equal
that balances padding
equally on all four sides without capping the top padding.
#11491
theme
now expands
~
to the home directory in theme file paths,
including in separate light and dark themes.
#13840
+list-themes
now supports
g
and
G
to jump to the first and
last theme, and
ctrl+d
and
ctrl+u
to page down and up.
#13681
#14607
The terminal inspector can now copy terminal I/O events or export them
to a file.
#13519
Bundled themes updated to
release-20261019-151001-86a776d
.
This adds 356 new themes and renames or removes none. The colors of 10
existing themes changed upstream: Adwaita, Adwaita Dark, Atom One Light,
Catppuccin Frappe, Catppuccin Latte, Catppuccin Macchiato, Catppuccin
Mocha, Cursor Dark, Dark Modern, and Electron Highlighter.
Fix configuration parsing silently ignoring all settings after a comment
or blank line that happened to end at an internal buffer boundary. This
typically only affected long configuration files.
#13638
Fix a performance degradation where, after a long uptime, the renderer
rebuilt its full terminal state on every frame.
#13585
Fix the automatically created configuration file being empty instead of
containing the configuration template.
#13774
+edit-config
works when
$EDITOR
or
$VISUAL
contains arguments,
such as
zed --new
.
#11897
Mouse selection improvements: dragging after a
ctrl
/
cmd
triple-click
output selection now extends the selection by command output, autoscroll
stops when the screen switches (e.g. to the alternate screen), a force
touch on macOS selects the word at the press location without starting a
drag, and releasing a drag no longer activates a link or prompt click.
#12830
Double-click word selection no longer continues across hard line breaks,
and double-clicking either half of a wide character (such as CJK) selects
the whole word.
#14354
#14391
Wide characters at the edges of a selection are now consistently rendered
as selected and included when copying, including when the wide character
wraps onto a new internal page.
#14632
#14651
Triple-click line selection no longer pulls in neighboring prompt text
when clicking blank cells between OSC 133 prompt boundaries.
#14553
Link detection and double-click selection no longer merge prompt text
with the command text next to it when shell integration is active.
#12435
File paths opened with
cmd
/
ctrl
-click no longer include trailing
spaces, which broke opening paths printed by some TUIs.
#13505
Mouse releases are now reported to the program that received the mouse
press when clicking at a shell prompt with click-to-move enabled. This
fixes double-click selection in programs like fzf's
ctrl+r
history
search.
#14710
Shell redraws after a resize are no longer processed at the old terminal
size. This fixes one cause of duplicated or misplaced prompts after
resizing.
#14706
Scrolling, such as clicking in the scrollbar, now works with very large
scrollback (millions of lines).
#13048
Custom
command-palette-entry
actions with string parameters, such as
set_tab_title
, no longer have their parameters escaped when run from
the command palette.
#13609
HTML clipboard copies no longer include a superfluous trailing newline.
#13543
Copying as VT (
copy_to_clipboard:vt
) and VT screen files now preserve
OSC 8 hyperlinks, empty gaps between text, and cells that only have
a background color, such as colored status bars. VT screen files also
keep trailing blank rows.
#14711
#14725
#14766
The mouse pointer now restores the shape set by the running program
(OSC 22) after releasing modifier keys instead of resetting to the
default.
#14128
Custom shaders no longer receive swapped selection foreground and
background color uniforms.
#14460
Ghostty no longer floods the logs with "adjusting page capacity"
messages during output with many styles, graphemes, or hyperlinks.
#14631
Fix stale wrap and prompt state on rows reused after scrolling or
erasing, which could cause incorrect copy, search, selection, and reflow
results.
#14010
Fix stale rendering of the previous row after erasing or deleting a
wrapped wide character.
#14054
Fix a freeze when reloading the configuration while a program is flooding
the terminal with queries, such as color queries.
#14833
+list-themes
no longer crashes on some keys when the search
matches no themes, and the keypad down key now moves one row instead of
21.
#14612
#14605
Fix crashes in scrollback search after clearing the scrollback, resizing,
or erasing history.
#11957
#13274
#13282
Fix crashes and viewport corruption when resizing with scrolled-back
history or with the cursor near the bottom of the screen.
#12300
#12907
#12935
Fix a use-after-free crash when clicking or selecting text during heavy
output.
#12463
Fix a possible crash when reflowing hyperlinks during a resize.
#13524
Fix possible crashes or memory corruption when scrolling or erasing rows
across a page boundary that needed more capacity.
#13394
#13397
Fix possible crashes and memory corruption found via fuzzing when
printing causes a page to grow, or after clearing the screen into
scrollback.
#11261
#13997
Fix many latent crashes and undefined behavior in selection, pins,
search, title and working directory updates, and resize error handling.
#12894
#13275
#13278
#13367
Fix a possible crash or corrupted input when many pty writes are queued,
such as during large pastes.
#13659
Fix an out-of-bounds access when IME preedit text with wide characters
is composed between existing wide characters, such as with Korean input.
#12479
Fix a crash when pressing or releasing mouse button 11.
#14759
Fix the
write_screen_file
,
write_scrollback_file
, and
write_selection_file
actions leaking two file descriptors on each use,
which could eventually prevent opening new terminals.
#13644
Fix memory and file descriptor leaks in terminal I/O, including for writes
in read-only mode and files read via the
input
configuration.
#13574
#13579
#13931
vt: Kitty graphics animation is now fully supported: frame transmission,
composition, animation control, and rendering.
#5255
#13943
vt: Kitty graphics relative placements (
P=
,
Q=
,
H=
,
V=
) are now
supported, allowing images to be positioned relative to other images.
#13939
vt: Support the Kitty graphics transient image usage hint. Transient
images are evicted first when image storage is full.
#13389
vt: The Kitty clipboard protocol (OSC 5522) is now implemented on macOS
and GTK, including paste events (mode 5522). Reads and writes follow
clipboard-read
and
clipboard-write
, and a new
clipboard-write-limit-bytes
configuration limits the size of a single
write.
#10549
#13962
#13993
#13995
#13998
#14002
#14061
vt: Support visibility reports (mode 2033 and
CSI ? 998 n
), which tell
programs when the terminal is not visible, such as in a background tab
or on another workspace, so they can stop rendering.
#13494
vt: Programs can resize the window with the xterm
CSI 8 ; rows ; cols t
sequence if the new
vt-window-resize-allowed
configuration is enabled
(default off). The request is ignored in splits, windows with multiple
tabs, the quick terminal, and fullscreen, maximized, or tiled windows.
#1115
#14375
vt: Support OSC 133
click_events=2
, which reports prompt clicks with
row coordinates relative to the prompt.
#10865
#12953
vt: Support soft terminal reset (DECSTR,
CSI ! p
), which resets
modes, margins, and text attributes without clearing the screen.
#14538
vt: Support backarrow key mode (DECBKM, mode 67), which lets programs
choose whether backspace sends
DEL
(
0x7f
, the default) or
BS
(
0x08
).
#12226
vt: Support the DECRQCRA and XTCHECKSUM screen checksum reports, which
are mostly used by terminal test suites. Because a program can use these
to read the screen contents, they are disabled unless the new
vt-xt-checksum-report
configuration is enabled. The new
vt-xt-checksum-extension
configuration controls how the checksum is
calculated.
#14483
vt: Respond to
CSI 19 t
(report screen size in characters) and to
DECXCPR (
CSI ? 6 n
) extended cursor position requests.
#14633
#14673
vt: DECRQM now answers ANSI mode queries (
CSI Ps $ p
), reports DECECM
and other unimplemented ANSI modes as permanently reset like xterm, and
no longer truncates mode numbers above 32767 in its reply.
#12505
#14236
#14237
#14672
vt: Ghostty terminfo now advertises overline support (
Smol
/
Rmol
),
which lets tmux pass overlines through. DECRQSS SGR replies now include
overline and curly, double, dotted, and dashed underline styles.
#13649
#13653
#13470
vt: The terminfo
Se
capability now resets the cursor to the configured
cursor-style
instead of a steady block. This fixes programs like Neovim
leaving a block cursor behind on exit.
#12482
vt: OSC payloads are now limited to 8 MiB, Kitty graphics payloads to
65 MiB, and each cell to 64 combining codepoints, so terminal output
can't easily exhaust memory. This also fixes a memory leak on invalid
Kitty graphics data.
#12349
#13633
vt: Experimental support for the
Glyph Protocol
(APC
25a1
), which lets programs register custom glyphs. Ghostty parses
and answers requests but doesn't render registered glyphs yet.
#12352
#12930
#12937
vt: Parse the new program status protocol (OSC 7501), which lets programs
report whether they are idle, working, done, blocked, or failed. This is
the first terminal specification pioneered by the Ghostty project.
libghostty can parse it all, but the Ghostty GUI ignores it for now.
#14560
vt: Parse (but do not implement) the Kitty desktop notification protocol
(OSC 99).
#10467
vt: Parse (but do not implement) the Kitty drag and drop protocol
(OSC 72).
#13029
vt: More tmux control mode fixes, including crashes that running
tmux -CC
could trigger. tmux control mode is still not hooked up to
the GUI.
#11395
#11935
#14262
#14680
vt: Clearing the screen at a prompt (e.g.
ctrl+l
in bash or zsh) now
moves prior output into scrollback even when the prompt is not on the
last row. Previously, the output was erased.
#14660
#14668
vt: Kitty graphics: transmitting an image with an existing ID now
replaces the image and removes its old placements, as the spec requires.
Interrupted or failed retransmissions no longer leave stale images on
screen.
#6711
#13723
#13893
vt: Kitty graphics: images now move with the text when a program scrolls
with
CSI S
,
CSI T
, or scroll margins, and are clipped to the scroll
region.
#4323
#13935
vt: Kitty graphics: automatically assigned image IDs no longer collide
with IDs chosen by the program.
#2197
#13934
vt: Kitty graphics: delete commands now match the spec and Kitty. Point
deletes (
d=p
,
d=c
) only remove placements at that cell,
d=a
only
removes placements on the visible screen, range deletes accept empty
ranges, and deleting a missing placement no longer frees the image.
#13652
#13895
#13898
#13932
vt: Kitty graphics: command validation and responses now match Kitty.
This fixes missing responses for invalid image data that could hang
clients, false positive query replies, lost IDs in chunked transfer
replies, file transfers with an exact
S
size, and loads interrupted by
a non-chunk transmission.
#13889
#13892
#13896
#13897
#13933
#14811
vt: Kitty graphics: cropped source rectangles are no longer stretched,
and
X
/
Y
offsets are kept within the first cell.
#13890
#13891
vt: Kitty graphics: the cursor moves after tall images like Kitty does,
so consecutive images no longer overlap.
#13887
vt: Full reset (RIS) no longer resets
image-storage-limit
to the
default.
#13951
vt: OSC and APC sequences (such as Kitty graphics commands) canceled by
CAN or SUB, or aborted by another control character, are now discarded
instead of executed, matching xterm.
#14453
#14812
vt: With modifyOtherKeys level 2, control keys, keypad keys, and
alt+escape
now encode like xterm. F13 to F25, Help, and Menu now send
xterm's function key sequences in all legacy encoding modes.
#14144
#14145
vt: Legacy alt-as-escape encoding now sends the full UTF-8 sequence for
non-ASCII keys.
#14146
vt: Kitty keyboard protocol release events no longer repeat the typed
text for dead keys or level 5 keys on GTK, which caused duplicated
characters in programs like Neovim.
#13861
vt:
ctrl+alt+shift+backspace
now sends
ESC BS
in legacy key encoding,
matching xterm.
#14508
vt: UTF-8 mouse mode (1005) now encodes the button correctly, fixing
invalid reports for the back and forward mouse buttons.
#14532
vt: Foreground, background, and cursor colors reset with OSC 110, 111,
or 112 now follow later configuration changes, such as a light/dark
theme switch.
#13650
vt: Full reset (RIS) now restores palette colors changed with OSC 4.
#14480
vt: An empty OSC 22 now resets the mouse pointer shape to the default.
#14495
vt: Long desktop notifications (OSC 9 and OSC 777) with multibyte UTF-8
text are no longer dropped or shown as invalid UTF-8 when truncated.
#13795
#13811
vt: DCS strings now carry UTF-8 data. Previously, some UTF-8 bytes were
dropped, ended the string early, or started a new control sequence.
#14016
vt: C0 controls
0x10
to
0x1F
are now executed instead of printed
as text, and UTF-8 encoded C1 controls are ignored, matching xterm.
#14022
#14023
vt: Erasing a full line (
CSI 2 K
) now clears its soft-wrap state, so
erased rows no longer join together when the window is resized.
#13637
vt: The cursor and saved cursor keep the correct position when a resize
reflows text, fixing an extra line wrap or overwritten text after
resizing.
#12598
#14458
#14478
vt: Variation selectors (VS15/VS16) now apply to the preceding codepoint,
fixing the rendering of some ZWJ emoji such as the pirate flag.
#12596
vt: Combining marks printed after a character in the last column now
attach to that character.
#12581
vt: Characters above U+00FF, such as emoji, now print as-is instead of as
a blank while a non-UTF-8 character set such as DEC line drawing is
active.
#14554
vt: Single shifts (SS2/SS3) now apply only to the next printed character.
#14576
vt: Tab clear (TBC) fixes:
CSI 0 g
no longer sets a tab stop where
there wasn't one, and
CSI g
with no parameter clears the tab stop at
the cursor.
#13900
#14644
vt: Printing with autowrap (DECAWM) disabled clears the pending wrap, so
re-enabling autowrap doesn't cause a spurious line wrap.
#14652
vt: With reverse wrap enabled, moving left after restoring a cursor with
a pending wrap no longer jumps the cursor.
#14390
vt: Cursor movement respects margins and origin mode: CUB and backspace
stop at the left margin, and CHA, HPA, VPA, HPR, and VPR no longer apply
the margin offset twice in origin mode.
#14761
#14762
vt: Fix a crash when VS15 narrows a wide character under the cursor.
#13631
vt: Fix a crash or memory corruption after narrowing the terminal cuts a
wide character in half on the alternate screen or with wraparound
disabled.
#14509
vt: Fix a crash when a grapheme cluster widens in the last column and
wraps inside or below a scroll region with grapheme clustering (mode
2027) enabled.
#14552
vt: Fix a slow memory and performance leak in graphics-heavy sessions
where evicted Kitty images left their placements' tracked positions
behind.
#13656
vt: Fix a memory leak when an OSC color sequence contains more than two
requests.
#13239
A new
ghostty +ssh
CLI action wraps
ssh
and sets up Ghostty on remote
hosts: it forwards Ghostty's environment and installs Ghostty's terminfo
on the first connection to each host, caching successful installs. It can
be used directly (
ghostty +ssh user@example.com
) or as an alias
(
alias ssh='ghostty +ssh --'
) without shell integration. The
ssh-env
and
ssh-terminfo
shell integration features now use it for every
shell.
#12582
ssh-terminfo
now always installs Ghostty's bundled terminfo on remote
hosts instead of keeping an existing, possibly outdated,
xterm-ghostty
entry, and reinstalls it when a newer Ghostty changes its terminfo.
#13844
ghostty +ssh-cache
has been reworked with positional destinations, a
new
--prune
option, consistent output and exit codes, and error
messages that name the cache file. See the
breaking changes
above.
#12814
#13533
ssh-terminfo
now tells apart the same host on different ports, so
terminfo is installed on each of them.
ghostty +ssh-cache
accepts
host:port
destinations.
#14472
ssh-env
no longer overrides
SetEnv
entries in your
~/.ssh/config
.
#11518
#14854
bash: Failed commands now report their real exit status on Bash 4.4+,
so command finished notifications no longer report every command as
successful.
#14247
#14250
nu: Tab completion for
ssh
and
sudo
now works with external
completers such as carapace.
#13310
bash: The bundled bash-preexec, used only for Bash versions older than
4.4 such as macOS's
/bin/bash
, has been updated to 0.7.0.
#14120
zsh: Fix a stray
{
in the prompt and broken prompt marking when
PS1
or
PS2
ends with a bare
%
.
#11832
bash: Fix "command not found" errors in subshells that inherit
PROMPT_COMMAND
.
#11690
bash: Fix a syntax error when an existing
PROMPT_COMMAND
ends with a
newline.
#11621
bash: Fix extra blank lines at the prompt when using ble.sh.
#11644
bash: Fix the shell integration hook being added twice when it is
sourced again with an array
PROMPT_COMMAND
.
#14266
macOS: Support macOS 27. This fixes the layout and background color of
titlebar tabs, a thin border around the app icon, hidden titlebars
covering the top lines of the terminal with Reduce Transparency enabled,
and the Shortcuts "New Window" action opening two windows.
#13001
#13390
#14107
#14411
#12999
#13069
macOS: When a terminal's process exits, a native bar now appears at the
bottom of the terminal instead of text being written into the terminal.
Commands that fail or exit faster than
abnormal-command-exit-runtime
are highlighted in red.
#7649
#12251
macOS: Quitting, or closing a window, when multiple windows or tabs have
running processes now offers "Review Windows...", which steps through
each one so you can decide what to close.
#12742
#14062
macOS: The command palette now highlights matching text, matches
initials, searches action descriptions, and ranks results by where they
matched.
#12264
#13610
#13624
macOS: The search bar now remembers the last search and shares it with
other apps through the system find pasteboard, like Safari and
Terminal.app.
#12516
#12712
macOS: Screen readers such as VoiceOver are now notified when the
selection changes instead of reading a stale selection.
#12902
macOS: The AppleScript
terminal
class and the Shortcuts terminal entity
now expose
pid
(of the foreground process) and
tty
.
#11592
#10756
#11922
macOS: AppleScript tabs and terminals have a new read-write
name override
property to set or clear a custom title.
#12048
#14733
macOS: Middle-clicking a tab closes it with
macos-titlebar-style = tabs
.
#11962
#11963
macOS: The version in the About window now links to the release notes
for that version.
#11964
macOS: Updates that are downloaded and installed automatically no longer
prompt you to restart. Checking for updates manually still offers to
restart.
#13623
macOS:
toggle_background_opacity
now applies to every tab in the
window, and new windows inherit the current state.
#11583
macOS:
cmd+arrow_up
and
cmd+arrow_down
now run their configured
keybinds, which default to
jump_to_prompt
. Ghostty 1.3 always scrolled
to the top or bottom of the scrollback instead, ignoring the
configuration. To scroll to the top or bottom, use
cmd+home
and
cmd+end
.
#12245
macOS: In the configuration errors window, Return reloads the
configuration and Escape ignores the errors.
#12601
macOS: Ghostty launches about 15% faster to a visible window and draws
its first frame about 27% sooner.
#13722
macOS: Terminals that aren't visible, such as background tabs, now
release their GPU resources and rebuild them when shown again. With 20
background tabs, GPU memory drops from about 385 MiB to 18 MiB. Metal
buffers also no longer over-allocate when they grow.
#14017
#13490
macOS: Lower idle CPU and energy use. The display link now pauses when
there is nothing to draw, and unfocused terminals that are animating
draw at most once per display refresh instead of once per write.
#14035
#14068
macOS: Update Sparkle to 2.9.6, which fixes several security advisories
in Sparkle, including CVE-2026-47121 and CVE-2026-47122.
#14072
#14082
macOS: Global keybinds no longer stop working after macOS disables
Ghostty's event tap.
#12294
#12714
macOS: Fix IME composition issues. Korean text being composed is now
committed instead of lost when pressing an arrow key, and control-key
IME shortcuts such as Japanese input's
ctrl+j
no longer send control
characters to the terminal.
#11461
#12447
#12518
#12547
macOS: Text from input methods, dictation, and the emoji picker is now
sent as typed input instead of pasted text. Programs no longer treat
dictation as a paste, and switching input sources mid-composition sends
the pending text as keys, matching Terminal.app.
#13195
#13222
#13817
macOS: Unicode Hex Input can now enter characters outside the Basic
Multilingual Plane, such as emoji, typed as surrogate pairs.
#13733
#13737
macOS:
font-thicken
now also applies to IME preedit text.
#14230
macOS:
option+backspace
and other modified Backspace keys now report
their modifiers with the Kitty keyboard protocol instead of sending a
bare DEL.
#13871
macOS: Pasting and dropping text now prefer plain text over URLs, so a
path copied from apps like Transmit pastes as a path instead of an
sftp://
URL.
#13152
#13170
#13212
macOS: The search bar keeps focus when you click in it or on the
next/previous buttons, and the terminal's focus state is now correct
while search is open.
#11872
#11978
macOS: The Find Next and Find Previous menu items and the
navigate_search
and
end_search
keybinds now work correctly,
including while the search field is focused.
#12070
#12492
macOS: Pressing Enter in the search bar no longer blocks confirming an
IME candidate.
#12781
macOS: Clicking a command palette entry with the mouse now runs it
instead of closing the palette.
#11665
macOS: The command palette now gets focus and paste when opened from the
inline tab title editor.
#12524
macOS: Holding
cmd+t
to create many tabs now leaves the newest tab
focused.
#13725
#13985
macOS: Fix an empty "ghost" tab or window that could appear when a tab
was closed right after it was opened.
#12119
macOS: Titlebar tabs no longer disappear after creating a tab from
"Show All Tabs".
#12949
#13017
macOS: Double-clicking the window title now zooms the window with
macos-titlebar-style = tabs
.
#12219
macOS: Moving a tab with
macos-titlebar-style = tabs
on macOS 26 no
longer briefly shows the neighboring tab.
#14847
macOS: The inline tab title editor stays in place while the window is
resized.
#12220
macOS: Fix tabs flashing when switching tabs after a program changed the
background color with OSC 11, and the window chrome keeping the old
color after a light/dark theme switch.
#12825
#12828
#12822
macOS: The
macos-glass-regular
and
macos-glass-clear
options for
background-blur
now layer the glass over the background color, and
focused windows are no longer less transparent than unfocused ones.
#13914
#13928
macOS: The native titlebar no longer cuts off the end of the title when
using a custom
window-title-font-family
.
#14135
#14217
macOS: Fix terminals rendering at a stale size under heavy system load or
during rapid resizes from window managers.
#12143
macOS: Splits dragged into another tab or window now render immediately,
and the source window keeps keyboard focus.
#12343
#12338
macOS: The split zoom indicator no longer stays visible after the other
splits of a zoomed split are closed, such as with AppleScript.
#14703
macOS: The split divider now uses the standard row and column resize
pointers.
#13433
macOS:
window-save-state = never
now also stops macOS from taking
window restoration snapshots, which could stall focus changes between
windows.
#14506
macOS: Window state saved by Ghostty 1.2 or later is now migrated, so
windows and tabs are restored after updating Ghostty.
#12461
macOS: Tabs created while the screen is locked now initialize correctly.
#13639
macOS: Quitting now asks for confirmation when windows with running
processes are minimized or the quick terminal is hidden.
#13686
macOS: OSC 52 clipboard read confirmations no longer steal focus. If the
terminal is unfocused, Ghostty rings the bell and shows the prompt when
you return to it.
#13744
macOS: Splits in the quick terminal now also set
GHOSTTY_QUICK_TERMINAL=1
.
#12895
#12896
macOS: The quick terminal no longer reopens at a stale size after a
display is reconnected at a different resolution.
#13250
macOS: The "New Ghostty Tab Here" and "New Ghostty Window Here" services
now open the correct directory when given a plain-text path.
#12727
#12731
macOS: Working directories passed from Services, Shortcuts, and
AppleScript are now normalized, fixing Nushell and zsh
%1~
prompts.
#12614
#14051
macOS:
ghostty -e
no longer opens the command's file arguments as
extra terminals, e.g.
ghostty -e vim file.txt
.
#13748
macOS: Opening a
.command
file from Finder no longer corrupts
non-ASCII characters in its path.
#13862
macOS: The Shortcuts terminal entity now reports the correct kind,
title, working directory, and screenshot for new terminals.
#13007
macOS: The Shortcuts "New Terminal" action now works with commands that
have arguments and with a command field that was cleared.
#12391
#12392
macOS: AppleScript
send key
now works for character keys, not only
special keys like
enter
, and respects
macos-option-as-alt
.
#13205
macOS: Update pill fixes: update errors are now shown, "Install and
Relaunch" no longer asks for confirmation, and the cancel option is
hidden once an update can no longer be canceled.
#13540
#13562
#13612
macOS: The default app icon follows the system icon style again after
changing it in System Settings, and custom icons now apply to the app in
Finder.
#12180
#12344
macOS: The dock icon bell badge now appears when notification permission
was granted earlier without badge permission.
#12133
macOS: The Copy menu item is disabled when nothing is selected.
#12521
macOS: Menu items now show the correct shortcut for keybinds on physical
keys (e.g.
super+backquote
), uppercase letters, forward delete, and
the
scroll_to_selection
and
search_selection
actions.
#13888
#12039
#12011
#12281
macOS: The secure input indicator's popover arrow now points at the
icon.
#12249
macOS: Fix a rare permanent freeze after waking from sleep or changing
displays. macOS did not mark the app as "Not Responding", so it could
only be killed.
#14691
macOS: Fix a crash when closing a tab, most easily triggered with
undo-timeout = 0
.
#13359
#13364
macOS: Fix a crash when opening a new tab from a native fullscreen
window.
#13636
macOS: Fix a crash caused by a data race when reading cached terminal
contents.
#13646
macOS: Fix a crash when OSC 52 clipboard confirmation prompts overlap.
#13648
macOS: Fix crashes when CoreText returns null, such as for fonts without
a display name or under severe memory pressure.
#13642
#13679
macOS: Fix closed windows leaking with transparent titlebars (the
default), which made Ghostty and WindowServer use more CPU and memory
over time.
#13601
macOS: Fix a memory leak each time Ghostty reads terminal text, such as
for copy, Quick Look, or accessibility.
#12020
#12025
macOS: Fix an IOSurface memory leak when scripts rapidly create and close
terminals.
#13640
macOS: Fix a Mach port leak, and a gradual slowdown, while global
keybinds wait for Accessibility permission.
#13590
GTK: Splits can now be rearranged with drag and drop, matching macOS.
Drag a split by its handle and drop it onto another split, including
splits in other tabs and windows.
#10224
#10423
GTK: Ghostty now renders at the true fractional scale (e.g. 125% or
150%), so text and box-drawing characters are sharp instead of blurry
under fractional scaling.
#1938
#14269
GTK: The renderer no longer uses
GtkGLArea
. Ghostty now renders with
EGL entirely on the render thread and hands finished frames to GTK as
DMABUFs, so the main thread no longer does any OpenGL work.
#14052
#14636
GTK: Windows can now be renamed using the menu, command palette, or the
new
prompt_window_title
and
set_window_title
binding actions.
#10469
#10999
GTK: A new
+new-tab
CLI command opens a new tab in a running Ghostty
instance. When run from inside Ghostty, the tab opens in the same
window. It accepts the same
-e
,
--working-directory
, and
--title
flags as
+new-window
.
#11762
GTK: A new
+toggle-quick-terminal
CLI command toggles the quick
terminal of a running Ghostty instance, useful for binding in window
managers without global shortcut support.
#12661
GTK: Global keybinds now use the
vicinae-hotkey-v1
Wayland protocol
when the compositor supports it (e.g. Hyprland 0.56+), falling back to
the XDG desktop portal otherwise. Ghostty shows a desktop notification if
a global keybind can't be registered.
#13464
GTK:
quick-terminal-screen
is now supported on Wayland. The default,
main
, places the quick terminal on the compositor's primary output
(or the first monitor if the compositor doesn't report one). Set it to
mouse
to let the compositor choose, which was the previous behavior.
#11117
GTK: On Wayland,
background-blur
now uses the compositor-agnostic
ext-background-effect-v1
protocol instead of KDE's blur protocol,
enabling blur on compositors such as Niri. The blur region also no longer
covers the window's client-side shadows.
#10721
#10720
#10727
GTK: On GTK 4.23.3 and newer,
background-blur
uses GTK's built-in
background blur, which covers the window more accurately.
#13581
#13586
GTK: The
open_config
binding action now accepts
new_window
to
edit the configuration in
$VISUAL
or
$EDITOR
in a new Ghostty
window. The default,
os_open
, keeps the previous behavior.
#11905
GTK: A new configuration
gtk-horizontal-tab-scroll
(default
true
)
can be set to
false
to stop two-finger horizontal scrolling from
switching tabs, passing the scroll to the terminal application instead.
#12659
GTK: A new configuration
gtk-tabs-inverted
moves the close button to
the start of each tab, in both the tab bar and the tab overview.
#14657
GTK: The default command palette entries are now translatable.
#11641
GTK: The embedded Noto emoji fonts were updated, so newer emoji and ZWJ
sequences such as the head-shaking faces render as one glyph instead of
overlapping neighboring cells.
#14047
GTK:
ctrl+shift+page_up
and
ctrl+shift+page_down
now move the current
tab left and right (
move_tab
), matching Firefox, GNOME Terminal, and
VS Code.
jump_to_prompt
moved to
ctrl+shift+arrow_up
and
ctrl+shift+arrow_down
.
#4998
#12458
GTK: URLs now open through the XDG desktop portal, falling back to
xdg-open
if the portal is unavailable. Ghostty passes an activation
token so the opened application, such as your browser, can come to the
front on compositors that require one.
#5991
#11754
#14785
#14787
GTK: Desktop notifications are now withdrawn when their terminal is
focused or closed, and repeated notifications with the same text
replace each other, matching macOS.
#14108
GTK: Tabs that aren't visible no longer render, saving CPU and GPU.
This matches macOS.
#12760
GTK: The Dolphin "Open Ghostty Here" action now opens a new window in
the running Ghostty instance instead of launching a separate one.
#11614
GTK: Fix Ghostty sometimes failing to launch with systemd 262, which
refused to start the service because Ghostty reported readiness before
it could handle reload signals.
#14398
#14399
GTK: Fix deeply nested splits sometimes becoming invisible or losing
focus.
#11193
#12698
GTK: Resizing splits, especially with
resize_split
keybinds, no
longer flickers.
#13414
GTK:
resize_split
on nested splits no longer causes large jumps in
size.
#12699
GTK: Splits can no longer be resized smaller than one cell, by dragging
the divider or with
resize_split
.
#14476
GTK: High-resolution scroll wheels no longer scroll much faster than
standard scroll wheels.
#12483
GTK: Disable unwanted kinetic scrolling on trackpads with GTK versions
older than 4.20.1.
#11793
GTK: Middle clicks are once again sent to terminal applications using
mouse reporting when
gtk-enable-primary-paste
is disabled in
GSettings.
#12940
#13108
GTK: The quick terminal no longer breaks when toggled off manually
while
quick-terminal-autohide
is enabled.
#11679
#12471
GTK: Opening the right-click context menu no longer hides the quick
terminal when
quick-terminal-autohide
is enabled.
#12843
GTK: The resize overlay no longer keeps reappearing when the scrollbar
is visible and no longer blocks mouse input while shown.
#11970
#11972
GTK: The maximum window size is now based on the monitor the window is
currently on, not the monitor it was opened on.
#13171
GTK:
+new-window -e
now works when
shell-integration
is set to a
specific shell.
+new-window
and
+new-tab
also accept a new
--shell-integration
flag.
#12378
#13741
GTK: Keys remapped to modifiers with XKB (e.g. Delete remapped to
ISO_Level3_Shift
) no longer also send the original key.
#13967
GTK: On Wayland, the IME candidate window now follows the cursor while
composing and no longer covers the line being edited.
#14729
GTK: Splits in a tab that was moved to another window now act on the
new window (e.g.
toggle_fullscreen
).
#14474
GTK: The mouse cursor keeps its text shape while selecting text.
#14558
GTK: The command palette now uses the terminal colors when
window-theme = ghostty
.
#14662
GTK: Opening URLs no longer fails when the fallback opener (
xdg-open
)
produces large output.
#12797
GTK: Clicking a desktop notification no longer focuses the wrong
terminal when the one that sent it has since been closed.
#12028
GTK: A bell in the focused terminal no longer leaves the bell
indicator set.
#13597
GTK: Fix the window continuously redrawing in the background after an
indeterminate progress bar (OSC 9;4) was removed.
#14704
#14738
GTK: Fix a crash when closing tabs or splits on GTK 4.20 (GNOME 49).
#12426
GTK: Fix a crash with global keybinds or on configuration reload when
no D-Bus connection is available.
#13101
GTK: Fix a possible crash when Fontconfig reports a font's language as a
plain string instead of a language set.
#14853
GTK: Fix a leak where every audio bell started a new GStreamer pipeline
and threads that were never cleaned up, slowly raising CPU usage.
#13647
#12815
#13657
Snap: Link the system FreeType, Fontconfig, HarfBuzz, libpng, and zlib
instead of bundled copies, fixing frequent crashes caused by two copies
of the same library in one process.
#14392
#14682
Snap: The snap's own GIO modules and XDG data directories now take
priority over the host's.
#12045
Snap: Programs running inside Ghostty, such as
clear
, now find the
xterm-ghostty
terminfo entry.
#12662
Flatpak: Commands started by Ghostty on the host are now terminated if
Ghostty crashes.
#12427
Ghostty 1.4 introduces full localization for the command palette and adds
support for
4 new languages
:
Basque
Belarusian
Danish
Serbian (Cyrillic and Latin scripts)
Localization is maintained by volunteer contributors. If you want to
help localize Ghostty in your language, please open a discussion on the
GitHub repo. Thank you to all the volunteers who contributed to Ghostty's
localization!
GTK builds now require
GTK 4.18
and
libadwaita 1.7
, up from
GTK 4.14 and libadwaita 1.5. Builds against older headers fail at
compile time, and Ghostty exits at startup if older libraries are
loaded at runtime.
#14330
GTK builds now link the system EGL library (pkg-config
egl
, usually
provided by libglvnd or Mesa) for the new renderer. At runtime, Ghostty
uses GTK's EGL display when it can, and otherwise needs an EGL driver
that supports the surfaceless platform.
#14052
#14636
A new
-Dinstalled-exe-path
build option sets the absolute executable
path written into the desktop file, D-Bus services, and systemd user
service. Previously this path came from the install prefix. Without the
option, these files now name
ghostty
alone, which systemd only finds in
/usr/bin
or
/usr/local/bin
, so set it for any other prefix.
#14805
#14806
When linking the system gtk4-layer-shell (
-fsys=gtk4-layer-shell
),
version 1.0.4 or newer is now required. Ghostty no longer disables the
quick terminal on older versions, which can crash on some compositors.
#11559
As with 1.3, libghostty isn't directly part of the Ghostty 1.4 release.
But a large part of the 1.4 development cycle went into libghostty, so
here's an update.
Over the past 6 months, the C API for libghostty-vt has grown from a
parser and a few encoders into a complete terminal emulator API, adopted
by dozens of free and commercial terminal emulators used by millions of
people. It's hard to quantify exactly, but the number of people using a
libghostty-based terminal is confidently several times the number of
people using the Ghostty GUI.
libghostty-vt now builds for macOS, Linux, Windows (MSVC and GNU), FreeBSD,
Android, iOS, and WebAssembly, and CI continuously verifies every one of
these targets. The goal is for libghostty-vt to be generally usable everywhere,
within reason, so if you want more target support, let us know!
It's also easier to integrate libghostty-vt into existing build systems.
There's CMake support, Nix packaging, an xcframework, and a source
tarball, in addition to the existing pkg-config file.
libghostty-vt no
longer needs libc++, and it can build freestanding.
The API is still marked as a work in progress and broke compatibility
several times during this cycle, so expect more breaking changes before
a tagged release. The
API documentation
and the
Zig, C, C++, Swift, and WebAssembly examples
(now over 30) are kept up to date with
main
.
We're going to do a final pass over the C API, break ABI one more time,
and then likely tag a libghostty 1.0 release very soon.
During the 1.4 cycle, we paid
$41,820
to contributors under contract and
spent about
$1,260
on infrastructure such as website hosting.
I'm happy to share that we've now signed our first two
12-month contracts
,
which give contributors stable, long-term paid work on Ghostty and help
ensure the ongoing stability and sustainability of the project:
@trag1c
is Ghostty's head of operations.
He manages the community on GitHub and Discord, coordinates our
volunteer translators, and maintains various other important project
systems.
@vancluever
works on various Ghostty
subsystems. In this cycle, he led the upgrade to Zig 0.16, moved the
build off Zig's deprecated
@cImport
, updated the bundled Fontconfig,
and more. He's also the author of
z2d
, the 2D graphics library Ghostty
uses to draw box-drawing characters and other sprite glyphs.
The primary focus of the roadmap continues to be libghostty functionality,
stability, and portability. During the last release cycle, I said I aimed to
tag a libghostty release. We haven't done that yet, but I'm confident we will
do so before Ghostty 1.5.
libghostty is a project that continues to be the tide that lifts all boats.
libghostty improvements tie directly to Ghostty GUI improvements as well as
dozens of other large projects in the ecosystem. As more large projects adopt
libghostty, libghostty tends to get more testing and attention, and this
creates a cycle that yields the most gain for terminal emulators everywhere.
macOS and GTK builds of Ghostty have talented, capable maintainer teams that
are continuing to improve them, so they're not neglected by any means!
As a project, we've decided to drop any roadmap for Windows support in the
Ghostty GUI. libghostty fully supports Windows (and we test it in CI), and the
official stance now is that downstream projects should use that.
Our release cycle remains 6 months. This release was delayed by one month,
but Ghostty 1.5 is planned for March 2027. libghostty will have a separate
release cycle.
We often get asked "How can I eliminate
panics
in my Rust code?" There have been several attempts to tackle this issue. Under the
Open Device Partnership
and working together with Microsoft, we have developed and released the
Call Graph Analyzer (CGA)
, a tool to extract the
callgraph
from
monomorphized
MIR
. This callgraph can be used to track down what functions in the compiled binary can panic.
We often get asked "How can I eliminate
panics
in my Rust code?" There have been several attempts to tackle this issue. Under the
Open Device Partnership
and working together with Microsoft, we have developed and released the
Call Graph Analyzer (CGA)
, a tool to extract the
callgraph
from
monomorphized
MIR
. This callgraph can be used to track down what functions in the compiled binary can panic.
For example, when you run
cargo cga check
on your code, you get:
error: call to method `core::num::<impl u64>::strict_sub` which can panic
--> src/main.rs:18:17
|
18 | let _ = 2u64.strict_sub(u64::MAX);
| ^^^^^^^^^^^^^^^^^^^^^^^^^
In this blogpost we discuss why this new approach is both better and worse than pre-existing approaches at finding panics.
Why eliminate panics though?
Before discussing the Call Graph Analyzer, we should first consider why panics are useful, and in what cases it might be beneficial to minimize or perhaps even completely eliminate any possible panic. This topic has been explored extensively by others [
1
][
2
][
3
][
4
], but it is useful to summarize here. Lets start with a brief description:
Rust provides a mechanism to prevent a function from returning normally, and instead “panic,” which is a response to an error condition that is typically not expected to be recoverable ...
These unrecoverable error conditions may either be caused by a bug in the implementation of a function, or constitute violated entry conditions for a function (so a bug in the function itself or a mistake by the caller of that function).
An example is calling
1.strict_add(u32::MAX)
, which would result in a panic in response to the caller passing invalid arguments to the operation. Similarly a normal addition
1 + u32::MAX
in Rust will panic if
overflow-checks
are enabled.
Instead of panicking, error conditions can be dealt with by:
making the function fail implicitly or silently and describing that behaviour in the function documentation. Arithmetic operations can for example wrap around with
u32::wrapping_add
.
making a function never return, e.g. using an infinite
loop {}
. Sometimes this approach is accidentally used when employing a retry scheme without a timeout or maximum iteration count.
However striving for zero panics is very hard and quite foolish: code is rarely void of assumptions. Returning
Result<T, AssumptionViolated>
everywhere just pushes the burden up the call stack, until you will abort anyway at the root. This essentially yields the same behaviour as if you were to panic.
It is useful to make panics
explicit
though. It is better to know about your panic paths and to reason about them, than to just accidentally include panics and ignore that they exist. Having regression analysis on your panic paths is also very useful, notifying you of any new panic paths introduced in your code.
Having said that, in the following cases it might be justified to eliminate some of your panics:
In contexts where code size really matters, like on embedded devices. Panics result in a relatively large amount of code due to the required strings and associated code to format these strings. Instead, we can:
use
defmt::panic
to reduce this string bloat. This requires all panics to be wrapped in the macro. For library dependencies
this is typically only done
when the library is specifically intended to be used on an embedded platform. Defmt is not used in other libraries, including the standard library of Rust.
use
-Cpanic=immediate-abort
to prevent panics from being emitted entirely and instead just crash the application. This does not leave a lot of information that can be used for debugging though.
In critical code paths that must absolutely never fail, for example:
an externally accessible service that needs to prevent a Denial of Service (DOS) attack which crashes the service. Invalid input should result in a user-facing error instead.
the firmware update path on an embedded device, including the bootloader.
Striving for no unrecoverable error conditions is extremely hard in practice. Generally it is better to implement top-level recovery mechanisms. In embedded this would entail using a Watchdog timer which resets the device if it is stuck, and a recovery image to restore the device to a working state. On a host machine this could mean catching unwinding panics using
catch_unwind
. Note that the latter is not fool-proof and comes with a few caveats. Externally accessible services should be redundant and fast to recover.
In conclusion, it is useful to find unintentional panics.
Prior art
Currently, ways to extract callgraphs or detect panics include:
You can download any of these projects, and with the exception of Charon (which is not explicitly meant for this usecase) it is very easy to get started.
Linker-based panic detection methods work by triggering an error in the linker when it tries to link in a special panic handler. This detection approach only works if
not a single panic
is included in your binary. It also only works on binaries and not on libraries.
ELF debug info analysis looks at the DWARF debug info that is included in ELF artifacts like binaries and Rust libraries compiled to object files. It is limited in what callgraph information it can provide: the panic machinery can be completely inlined or disappear during the linker phase.
And finally we have HIR, MIR and rust-analyzer based approaches, which use the various Intermediate Representations (IRs) of your code generated by the compiler (and rust-analyzer) to extract the callgraph from. In a sense all these approaches take your original Rust code, have the compiler process it, and spit out what it thinks is happening. Theoretically these approaches work on any Rust crate.
The HIR-based analysis can only analyze the code in your specific crate. This analysis can check if you explicitly write
panic!
in your own crate. However, it is unaware of any code in your dependencies, such as the standard library. Hence it can not trigger on panics that occur within dependencies. The compiler can also insert assertions like bound checks, which are not even a call to panic until very late in the code generation pass depending on your compiler flags.
The MIR-based analysis is ideal, as it can theoretically see all code from dependencies, before they are optimized away, including panics originating in the standard library. Hence Call Graph Analyzer uses this approach. The only downside is that this analysis is done before LLVM is able to remove unreachable code, and hence we get some false positives.
All these previous approaches take what the compiler is already doing when compiling your crate, and interrupt the compilation process to look at a snapshot of the compilation state to find out whether you are calling a panic.
The rust-analyzer approach is slightly different, as it does not depend on the compiler at all. Rust-analyzer has duplicated the Rust-HIR-MIR pipeline from the compiler, which they adapted for their process. This separate pipeline for rust-analyzer is pretty fast, can be stored in memory and supports updating the state while you are actively writing and changing your Rust code. However, it can not always analyze code that rustc is happy to compile. Most notably it often struggles with complex proc_macros like we use a ton of in Rust Embedded. As an end-user you notice this when your code editor stops giving any helpful suggestions. (The team behind rust-analyzer is working hard to prevent this!) The upside of rust-analyzer is that it does not depend on the Rust compiler.
We decided on a MIR-based callgraph exporter, which became the Call Graph Analyzer (CGA). Next up, we will discuss the design and functionality of CGA.
rustc-driver
CGA extracts the callgraph directly from MIR as a
rustc-driver
. Clippy similarly is a rustc-driver. Like Clippy, CGA therefore depends on a specific version of the rust compiler, which gets us to the first real downside of CGA:
A note of caution: CGA compiles your crate with a specific (probably different) version of the rustc compiler, standard library, and potentially different compiler flags. Hence you will not get the
exact
callgraph as included in your binary.
Having a specific (nightly) version of rustc as a dependency using
rustc-private
also means that CGA can not be installed as a crate from
crates.io
. Instead the repository needs to be checked out locally, after which
cargo install --path .
needs to be run (which uses a specific version of the Rust toolchain automatically).
This user experience might be improved when
rustc_public
contains everything that CGA needs. Though, that scenario isn't really likely. Instead, if CGA becomes popular enough, it might be maintained alongside rustc, just like Clippy currently has this special status. Any breaking change in rustc is also applied to Clippy, and you can install Clippy for your specific toolchain using Rustup. For more information on this, you can watch the excellent talk on
"Out of tree access to the compiler state" by Alona Enraght-Moony
.
As a rustc-driver, the CGA binary has the same API as rustc itself. You can use
cargo
to run CGA using
cargo cga check
. Internally rustc will run as if you were to run
cargo check
. However CGA does some additional work to gather the call graph, which for a typical crate means that compilation with CGA is roughly 2x-3x as slow as running
cargo check
.
MIR traversal
When CGA is done running all the compiler passes that are normally part of
cargo check
, it forces the compiler to yield all so-called
roots
or
entrypoints
of your crate. Intuitively, this is any part of your crate that is accessible from the outside when compiled. These include:
fn main
and variants thereof
the language
_start
symbol
functions that are marked
extern
which have a stable name using
no_mangle
or
export_name
, including interrupt handlers for Embedded Rust.
For this analysis we are explicitly not interested in all the functions that are compiled as part of
const
blocks, including
static
value initialization, as only the outcomes of these computations are included in the final binary.
From these roots outward we perform a reachability analysis by walking through the MIR tree. Every time a function is called, that function is also explored. Thus all unused functions are not visited. In Rust, like in C++, a function with Generic arguments is
monomorphized
when it is called using the concrete types used to call it.
Thus we do not only gather the called functions, but the concrete instantiation of each function, as the implementations can differ wildly depending on the type arguments passed.
This process gets a little bit tedious when considering:
dyn
objects, for which it is unclear which trait implementation is actually being called. CGA assumes
all
vtable entries are called for that function when it finds one. This gets especially
fun
large when a dyn object is constructed for standard library traits like the
Debug
trait.
function pointers
can be created from Rust functions. We can not necessarily reason about what happens with these pointers. Thus we assume any created function pointer will be called at some later stage.
After walking through the MIR tree of your crate and its dependencies, we get a collection of callgraphs. We can now choose to either
extract
them to JSON or GraphViz dot files, or to
check
them for any panics or blacklisted functions.
When extracting, all the callgraphs are put in your
/target
folder as
<crate>.callgraph.json
. We finally merge them together and export the global callgraph with separate roots using:
cargo cga extract -Tdot -o callgraph.dot
To quickly illustrate what this looks like, please consider the following example using dyn objects:
This results in a graph with an arrow for every entry in the vtable:
Image 1: Graphviz Callgraph example (you can zoom in for better readability)
As you can imagine, this quickly becomes quite large and unreadable. If you have a suggestion for a GUI application that can meaningfully display callgraphs, please
reach out
as that would be very helpful!
Linting and diagnostics
Secondly, like Clippy, we can ask CGA to check our code for any panic paths by running:
cargo cga check
This will take the callgraph, find panic paths, and will try to give a helpful insight in how this panic path relates to your crate. One of the lints emitted for the above code looks like this:
error: call to method `core::num::<impl u64>::strict_sub` which can panic
--> src/main.rs:18:17
|
18 | let _ = 2u64.strict_sub(u64::MAX);
| ^^^^^^^^^^^^^^^^^^^^^^^^^
|
= note: 3 different panics from this location
= note: backtrace (1 of 2):
0: std::rt::panic_fmt (called)
1: core::num::imp::overflow_panic::sub (called)
2: core::num::<impl u64>::strict_sub (called) <--
3: <totallysafe::StrictSub as totallysafe::Test>::test (possible vtable resolution)
4: <dyn totallysafe::Test as totallysafe::Test>::test - virtual#3 (called)
5: totallysafe::main (entrypoint)
Note that it shows the backtrace, along with the possible vtable resolution, and the last call from our current crate context. These diagnostics are generated
heuristically
, meaning that out of all the panic paths, we choose a single one for each callsite in our local crate. We try to choose the
best
of all these paths using a scoring mechanism.
White- and blacklisting
For any serious crate that was not developed with minimizing panics in mind, the amount of lints generated by CGA is not really manageable. To help with this, CGA comes with a few configurable parameters.
As an example, if you trust a function to not panic (even though panic paths are being emitted for it), you can add the function to the whitelist. Any panic path that includes that function will be ignored. These rules can match on both simplified function names as well as full canonical Rust paths with all generic parameters included.
Alternatively, functions can be put on a blacklist. Besides panics, if you want a crate and its dependencies to
never
use some function, it is possible to exlude it. For example, you might want to exclude interaction with the filesystem, the network or processes.
error: call to associated function `std::process::Command::new` which is blacklisted
--> src/main.rs:7:13
|
7 | let _ = std::process::Command::new("evil");
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
= note: 101 different blacklisted functions from this location
= note: backtrace:
0: std::process::Command::new::<&str> (called) <--
1: fail_blacklist::test (called)
2: fail_blacklist::main (entrypoint)
note: the lint level is defined here
--> src/main.rs:3:11
|
3 | #![forbid(cga::blacklisted)]
| ^^^^^^^^^^^^^^^^
error: call to drop of `std::process::Command` which can call blacklisted functions
--> src/main.rs:7:47
|
7 | let _ = std::process::Command::new("evil");
| ^
|
= note: 101 different blacklisted functions from this location
= note: backtrace (1 of 20283553):
0: std::sys::fs::unix::debug_assert_fd_is_open (called)
1: <std::os::fd::OwnedFd as std::ops::Drop>::drop (called)
2: drop of `std::os::fd::OwnedFd` (called)
3: drop of `std::sys::fd::unix::FileDesc` (called)
4: drop of `std::sys::process::unix::common::Stdio` (called)
5: drop of `std::option::Option<std::sys::process::unix::common::Stdio>` (called)
6: drop of `std::sys::process::unix::common::Command` (called)
7: drop of `std::process::Command` (called) <--
8: fail_blacklist::test (called)
9: fail_blacklist::main (entrypoint)
Note that this feature does not actually preclude a process from being spawned in any of your crates or dependencies: within Rust it will forever remain possible to link to some external object file or use assembly directly, which CGA can not analyze. Blacklisting with CGA is, however, an interesting capability.
Caveats
Having detailed what CGA can and can not do, it is useful to know there are some caveats and downsides to the approach CGA uses.
Fragile
Traversing monomorphized MIR is not trivial. Resolving vtables is quite finnicky; the compiler inserts shims sometimes and actual calls are inserted later; coroutines need to be unpacked to find the async paths; and there are implicit assertions which eventually also end up being a panic. All of which is to say: the analysis is hard and it is inevitable that some parts of it are not completely correct. When the toolchain is updated, the resulting MIR can vary dramatically, which also has an impact on the call graph. It might be that down the line some part of the analysis breaks if rustc works differently.
This is to be expected: Rust MIR is unstable and will remain to be so for the foreseable future. Consequently CGA will be a bit fragile.
Optimizations
Depending on your compiler flags but in particular your
opt-level
, the MIR CGA gathers contains panics that are unreachable.
For example, the expression
1 + 1
has an implicit overflow bounds check included. If you were to const evaluate the expression, it is exceedingly obvious that the expression can never panic. With
opt-level=2
(optimize for speed) this expression is optimized to
2
by an earlier compiler pass before CGA gets the MIR. However with
opt-level="z"
(optimize for size) this panic path is included in the MIR. Instead, the optimization is left to LLVM to perform (which it does).
Your compiler and cargo options really matter with regards to the callgraph being emitted, similarly to how they matter to the final binary generated by rustc and the linker.
I advise people to use
opt-level=2
for CGA, even if the shipped binary uses something different, as
generally
no reachable panic will be missing with
opt-level=2
(thus fewer false positives and no false negatives).
Tooling expects rustc
CGA has been tested on a few real-world binaries, and typically it works out of the gate. Sometimes however it does not. This is either because the project does not compile with
build-std
yet (which CGA requires), or because the
build.rs
expects the application to be built with stock
rustc
and not with a
rustc-driver
like CGA (
example
).
If CGA does not work for your project, or if the callgraph does not seem to be correct, please
open an issue
! The tooling can only evolve by testing it against real software.
Try it out
With
Call Graph Analyzer (CGA)
you can extract callgraphs and detect panics. If you were wondering how many panics your application secretly contains, even though you are not using
unwrap
, give it a spin and
let us know
what you find!
A special shoutout to Jyn for
this blogpost
and the work by
Ferrocene
, which heavily inspired our work on the Call Graph Analyzer.
Apple Also Announces iMac With M6
Daring Fireball
www.apple.com
2026-10-27 12:44:10
Just a speed bump, but speed bumps are good.
Pricing and configurations:
M6 with 2 Thunderbolt ports:
Base price: $1500
RAM: 16 GB: +0
24 GB: +200
SSD: 256 GB: +0
512 GB: +200
1 TB: +500
M6 with 4 Thunderbolt ports:
Base pric...
Apple unveils new
iMac with M6,
delivering a major
boost in performance and AI capabilities
With blazing-fast performance, enhanced connectivity, Siri AI, and macOS 27, all in a stunning design in seven vibrant colors, the world’s best all-in-one gets even better
Powered by M6, the new iMac delivers a massive leap in performance and AI capabilities — all in its strikingly thin all-in-one design, available in seven vibrant colors.
CUPERTINO, CALIFORNIA
Apple today announced the new
iMac
featuring the superfast M6, delivering even more performance and powerful AI capabilities in its strikingly thin all-in-one design. From families and aspiring creators to small businesses, users will experience the speed and power of M6 in everything they do. Featuring a faster CPU and GPU with Neural Accelerators in each core, it blazes through everyday apps and multitasking while delivering powerful performance for creative workflows like photo and video editing. For Intel-based upgraders, the leap is even greater, with up to 18x faster performance than the most popular Intel-based iMac.
1
And together with the Dual 16-core Neural Engine, the new iMac delivers up to 5x faster on-device AI performance than M4.
1
Whether users are taking advantage of Siri AI and Apple Intelligence features across apps and macOS, running local AI models, or vibe coding, iMac is a powerful platform for AI while preserving user privacy.
2
Connectivity gets even better with Wi-Fi 7 and Bluetooth 6, along with available 2.5 Gigabit Ethernet and storage that is up to 2x faster, so apps and large projects launch in an instant.
3
Completing the iMac experience is an expansive 24-inch 4.5K Retina display; an industry-leading camera, speakers, and mics; up to four Thunderbolt 4 ports; color-matched accessories; and the power of macOS 27. Available in a spectrum of seven colors — blue, green, pink, yellow, purple, orange, and silver — the new iMac is a tremendous upgrade for existing users and an incredible gateway into everything the Mac can do for new users. Customers can pre-order starting tomorrow, October 28, with availability beginning Friday, November 6.
“iMac is the world’s best all-in-one, and today it raises the bar yet again,” said Shelly Goldberg, Apple’s vice president of Hardware Engineering. “With the blazing performance and AI capabilities of M6 supercharging every workflow and the next generation of Apple Intelligence with Siri AI — combined with its stunning 24-inch Retina display, its gorgeous design in seven vibrant colors, and macOS 27 — the new iMac has everything users need to run their businesses, manage their lives, and bring their ideas to life.”
From families and creative professionals to small business owners, users can take advantage of a major boost in performance and powerful AI capabilities for everyday workflows with built-in privacy. iMac also delivers a pop of color that brightens any space.
iMac with M6: A Huge Leap in Performance and AI Capabilities
With M6, iMac brings even more performance, for everything from everyday productivity to creative workloads and AI tasks. iMac with M6 features up to a 12-core CPU — two more cores than before — delivering the world’s fastest single-threaded CPU performance.
4
Everything feels extra snappy and responsive for families managing busy calendars, students putting the finishing touches on a project, and small business owners running their companies. An up-to-12-core GPU, also with two more cores than before, now features Neural Accelerators in each core, delivering up to 2x faster graphics for more intensive tasks like photo editing, along with fantastic gaming performance compared to M4.
3
Students and creators can now fly through tasks like editing and sharing their latest videos or designing a project for class, all while multitasking with their favorite messaging or entertainment apps. The new Dual 16-core Neural Engine delivers up to 2x faster AI compute than the previous generation, and combined with the advanced GPU and faster memory bandwidth and with higher memory bandwidth up to 170GB/s, iMac rips through AI tasks like running LLMs on device.
3
With all this performance packed into its stunning design, iMac is the perfect all-in-one for a wide range of users and workflows.
With the new iMac with M6, small business owners can work across apps like Bigin by Zoho to effortlessly manage customer relationships, track sales, and streamline everyday workflows, all on its stunning 24-inch 4.5K Retina display.
With the new iMac with M6, students can bring their ideas to life with a spacious canvas to explore, create, and innovate.
With the new iMac with M6, families can effortlessly multitask between everyday apps, from managing calendars and finances to helping with homework, planning vacations, and more.
The new iMac with M6 enables:
Up to 2.5x faster performance in apps like Microsoft Excel, compared to iMac with M1,
1
and up to 1.5x faster performance than M4, so families, aspiring creators, and small businesses can fly through daily productivity tasks.
3
Up to 3.3x faster graphics performance for tasks including photo editing in Affinity, compared to iMac with M1,
1
and up to 2x faster performance than M4, so content creators can edit like never before.
3
Up to 12x faster on-device AI performance for prompt processing in LM Studio, compared to iMac with M1, and up to 5x faster performance than M4, so users can run powerful AI models, all while keeping their data private.
1
Up to 2x higher gaming performance with ray tracing compared to M4.
3
With the powerful performance of M6, iMac lets creators and 3D artists work faster in apps like Blender, from modeling intricate 3D scenes to rendering detailed animations and realizing their creative visions.
The new iMac with M6 makes video editing faster and more seamless in apps like Final Cut Pro, empowering creators to edit high-resolution footage, add stunning effects, and more.
With the new iMac with M6, photographers and creative enthusiasts can perfect their images in apps like Affinity, editing high-resolution photos, retouching fine details, and creating stunning compositions with speed and ease.
iMac with M6: A Powerful Platform for AI
Beyond delivering exceptional performance for everyday productivity and creative workflows, iMac is also a powerful platform for AI, enabling users to take advantage of advanced AI capabilities while protecting their privacy. With macOS 27, the next generation of Apple Intelligence is deeply personal, seamlessly integrated across apps, and built with privacy from the ground up. Apple Intelligence powers Siri AI, a new version of Siri that is profoundly more capable, conversational, and personal, helping users get more done than ever before. On iMac, users can tap into Siri AI to ask questions; find what they need across their messages, emails, photos, and more; and take action across apps. Siri AI is built right into Spotlight, making it easy to search for answers on virtually any topic and ask follow-up questions. With the expansive 24-inch 4.5K Retina display, users can leverage Visual Intelligence with a dedicated keyboard shortcut to ask Siri about anything on their screen, from a chart in a spreadsheet to a photo in a browser tab. Users can also write and edit with Siri almost anywhere they type, and in Mail and Messages, Siri can reflect their typical style and tone.
Siri AI — powered by the next generation of Apple Intelligence — allows users to ask questions; find what they need across messages, photos, and more; and take action across apps.
With the powerful AI capabilities of M6, the new iMac lets users do even more with AI-powered apps like Pixelmator Pro and Claude, from enhancing photos and removing unwanted objects to brainstorming ideas, writing, and tackling everyday tasks with speed and ease.
Apple Intelligence also makes apps smarter and more useful. In Safari, it powers new tools that automatically organize a user’s tabs into topics; notifies them of website changes, like product restocks or price drops; and enables the creation of custom extensions based on a description. In addition, users can easily create an automation in Shortcuts by simply describing it or tap into intelligent photo editing tools in the Photos app. iMac also supports a growing ecosystem of AI apps optimized for Apple silicon, including LM Studio Bionic and Topaz Studio, helping users learn faster, think in new ways, and get more done.
Best-in-Class Connectivity and Faster Storage
The new iMac features Wi-Fi 7 and Bluetooth 6, along with 2.5Gb Ethernet that delivers up to 2.5x faster wired connectivity than the previous generation.
5
This means faster transfers of large files, smoother streaming of high-resolution content, and even better performance for gaming and demanding business workflows. And with up to 2x faster SSD read and write performance, apps launch quickly, and large files like photo libraries and video projects load in an instant.
3
Up to four Thunderbolt 4 ports enable superfast data transfers and make it easy to connect a wide range of accessories, including external storage and docks.
6
Users can also connect up to two 6K external displays, creating a vast workspace with more than 50 million pixels to spread out their work.
With Wi-Fi 7, Bluetooth 6, and up to four Thunderbolt 4 ports, the new iMac moves large files fast and connects a wide range of accessories and up to two 6K external displays.
A Transformational Upgrade
The new iMac is a tremendous upgrade — especially for users coming from an Intel-based iMac, who will experience performance that’s up to 18x faster.
1
And with macOS 27, Siri AI and new Apple Intelligence features integrated across apps make AI tasks on iMac more personal and powerful than ever.
iMac also includes all of the popular features and capabilities that make it the world’s best all-in-one:
A beautiful canvas for work and play
: iMac provides a brilliant canvas for multitasking, immersive movies and games, and more. The stunning 4.5K display delivers crisp, clear details with 500 nits of brightness — offering 5x more resolution and nearly 70 percent greater brightness than the bestselling 24‑inch all‑in‑one PC.
7
And P3 wide color brings everything onscreen to life with over 1 billion colors.
Industry-leading camera and audio
: A 12MP Center Stage camera helps keep users perfectly framed on video calls, while Desk View enables them to share a top-down view of their workspace — ideal for educators giving lessons or creatives showing off their latest project. iMac also brings incredible audio to any space. Two pairs of force-cancelling woofers with two tweeters fill the room with bold, bass-rich sound, and Spatial Audio with support for Dolby Atmos creates an immersive listening experience. Completing the phenomenal video and audio experience is the studio-quality three-microphone array.
A colorful addition to any space
: iMac transforms any space with a spectrum of seven vibrant colors, adding a pop of inspiration to homes, workspaces, and storefronts.
Color-matched accessories and Touch ID
: iMac features a color-matched keyboard and mouse or trackpad with USB-C ports, so users can charge all of their favorite devices with just a single cable. Magic Mouse and Magic Trackpad make navigation easy and intuitive. And Magic Keyboard with Touch ID lets users easily and securely unlock iMac, switch users, authorize Apple Pay, and download apps.
8
Better together with iPhone
: iMac brings everything users love from iPhone to a gorgeous, spacious display. When both devices are used together with Continuity, they are even more powerful — letting users move seamlessly across devices to share files and photos, hand off tasks, and even control their iPhone from their iMac.
9
Users switching to Mac for the first time can use iPhone to conveniently and securely transfer settings, files, photos, passwords, and more.
The expansive 24-inch Retina display delivers crisp, clear details with 4.5K resolution and 500 nits of brightness.
With a 12MP Center Stage camera, iMac keeps users perfectly framed on video calls, while Desk View helps them share a top-down view of their workspace.
Available in green, yellow, orange, pink, purple, blue, and silver, iMac is a colorful addition to any space — from homes to workspaces to storefronts.
iMac features a color-matched keyboard and mouse or trackpad with USB-C ports, so users can charge their devices with a single cable. And with the advanced security of Touch ID, users can easily and securely unlock their computer, make online purchases with Apple Pay, and download apps.
With Continuity, iMac and iPhone work seamlessly together, making it easy to share files and photos, pick up tasks across devices, and even control iPhone directly from iMac.
macOS 27 Golden Gate: An Unrivaled Experience
The new iMac comes to life with
macOS 27
. In addition to Siri AI and Apple Intelligence, iMac gets even more responsive, reliable, and delightful for everyday use with refinements to design, performance, search, and more. Updates to Liquid Glass deliver a more focused and approachable experience. A new slider in Settings gives users the option to personalize Liquid Glass, adjusting it anywhere from ultraclear to fully tinted to match their preference, and app icons are sharper and more defined.
iMac and the Environment
The new iMac was built with the environment in mind and drives progress toward Apple’s ambitious plan to be carbon neutral across its entire footprint by 2030. It is made with 100 percent recycled aluminum in the stand, 100 percent recycled rare earth elements in all magnets, and 100 percent recycled gold plating and tin solder in all Apple-designed printed circuit boards. It is manufactured with 40 percent renewable electricity, such as wind and solar, across the supply chain. The new iMac meets Apple’s high standards for energy efficiency and safe chemistry. As with all Apple products, its paper packaging is 100 percent fiber-based
10
and designed to be recycled.
Customers can pre-order the new iMac with M6 starting tomorrow, October 28, on
apple.com/store
and in the Apple Store app in 35 countries and regions, including the U.S. It will begin arriving to customers, and in Apple Store locations and Apple Authorized Resellers, starting Friday, November 6.
iMac with M6 featuring a 10-core CPU and 10-core GPU starts at
$1,499
(U.S.) and
$1,449
(U.S.) with
education savings
. iMac with a 12-core CPU and 12-core GPU starts at
$1,699
(U.S.) and
$1,599
(U.S.) with
education savings
. Additional technical specifications, configure-to-order options, and information on Magic accessories are available at
apple.com/mac
.
With
Apple Upgrade
, eligible customers in the U.S. can lease a new Mac with low monthly payments and easily upgrade at the end of their lease.
11
Lease iMac with M6 with Apple Upgrade from
$28.99
(U.S.) per month, excluding taxes and any trade-in credit, for 36 months.^
With Apple Trade In, customers can trade in their current computer and get credit toward a new Mac. Customers can visit
apple.com/shop/trade-in
to see what their device is worth. With year-round education pricing — available to current and newly accepted college students and educators — customers can save on iMac, along with a wide range of products and services through the Apple Store online and in stores. Visit
Apple’s Education Store
for details. Customers in the U.S. who shop at Apple using Apple Card can pay monthly at 0 percent APR when they choose to check out with Apple Card Monthly Installments,
12
and they’ll get 3 percent Daily Cash back — all up front.
13
More information — including details on eligibility, exclusions, and Apple Card terms — is available at
apple.com/apple-card/monthly-installments
.
AppleCare delivers exceptional service and support, with flexible options for Apple users. Customers can choose AppleCare+ to cover their new Mac or, in available markets, AppleCare One to protect multiple products in one simple plan. Both plans include coverage for accidents like drops and spills, battery replacement service, and priority support from Apple Experts. For more information, visit
apple.com/applecare
.
Every customer who buys directly from Apple gets access to Personal Setup. In these guided online sessions, a Specialist can walk them through setup or focus on features that will help them make the most of their new device. Customers can also learn more about getting started and going further with their new device with a Today at Apple session at their nearest Apple Store.
Testing was conducted by Apple in September 2026. See
apple.com/imac
for more information.
Apple Intelligence is available with Siri and device language set to Chinese (simplified), Chinese (traditional), Danish, Dutch, English, French, German, Italian, Japanese, Korean, Norwegian, Portuguese, Spanish, Swedish, Turkish, or Vietnamese. Some features may not be available in all regions or languages. Some devices may not be available in all regions. Siri AI is available in beta in macOS 27.2 and requires an Apple Intelligence-enabled device set to a supported language. It is available in English, French, Japanese, Korean, Portuguese, and Spanish. Some features may not be available in all regions or languages. Siri AI is currently unavailable in the EU in iOS, iPadOS, and watchOS. Apple is working constructively with the EU in an attempt to find a path forward. Siri AI is not available for users under 13. Certain Apple Intelligence features that rely on server-side models are subject to daily usage limits, including but not limited to Siri AI, intelligent photo editing tools, Image Playground, and AFM 3 Cloud models in Shortcuts. Daily limits may vary by feature, request complexity, system demand, system policies, and other factors. Expanded access to such features will be available for a fee in the future. Use of these features is subject to the Apple Intelligence terms and conditions. Learn more at
support.apple.com/148587
.
Results are compared to previous-generation iMac systems with Apple M4, 10-core CPU, 10-core GPU, 32GB of unified memory, and 2TB SSD.
Testing was conducted by Apple in October 2026 using shipping competitive systems and select industry-standard benchmarks.
The 2.5 Gigabit Ethernet option is available on models with 12-core CPU and 12-core GPU.
All four USB-C ports support Thunderbolt 4 on models with 12-core CPU and 12-core GPU.
Actual diagonal screen measurement is 23.5 inches. Nano-texture display is an option on models with 12-core CPU and 12-core GPU.
iMac with 10-core CPU and 10-core GPU can configure to Magic Keyboard with Touch ID and Numeric Keypad, and iMac with 12-core CPU and 12-core GPU comes standard with Touch ID.
iPhone Mirroring is available on Mac computers with Apple silicon and Intel-based Mac computers with a T2 Security Chip. Requires that the user’s iPhone and Mac are signed in with the same Apple Account using two-factor authentication, their iPhone and Mac are near each other and have Bluetooth and Wi-Fi turned on, and their Mac is not using AirPlay or Sidecar. Some iPhone features (e.g., camera and microphone) are not compatible with iPhone Mirroring.
Breakdown of U.S. retail packaging by weight. Adhesives, inks, and coatings are excluded from Apple’s calculations of plastic content and packaging weight.
Apple Upgrade is a device leasing program available in the U.S. (excluding U.S. territories). Leases are provided by Klarna; subject to eligibility and credit approval, including final approval at checkout. To be eligible, you must be a U.S. resident, be at least 18 years old (or the legal age in your state), have an accepted credit or debit card, and have an Apple Account. Additional eligibility criteria apply. Device must be in good condition upon return; damage fees may apply. For iPhone only: In order to lease an iPhone, you must select an eligible carrier (but you cannot use a prepaid carrier plan). Upgrades require entering into a new lease and are subject to eligibility and credit approval. Apple Upgrade is not available on refurbished devices or online at the following special stores: Apple Employee Purchase Plan; participating corporate Employee Purchase Programs; Apple at Work for small businesses or enterprises; Government, Education, or Veterans and Military Purchase Programs.
Apple Card Monthly Installments (ACMI) is a 0 percent APR payment option that is only available if users select it at checkout in the U.S. for eligible products purchased at Apple and is subject to credit approval and credit limit. See
support.apple.com/en-us/102730
for more information about eligible products. Additional limits and restrictions apply. See the Apple Card Customer Agreement for more information about ACMI.
Apple Card is subject to credit approval, available only for qualifying applicants in the United States, and issued by Goldman Sachs Bank USA, Salt Lake City Branch.
^ This offer is for a consumer lease, not a purchase or loan. Lease provided by Klarna Inc. for 24- or 36-month term. Your first monthly payment is due approximately 30 days after device is shipped or available for pickup. Lease approval is subject to eligibility and is based on creditworthiness. Monthly payments are based on the selected device and lease term.
For example: For iMac with a purchase price of $1,499 (excluding taxes and any trade-in credit), the typical monthly payment is $28.99 (excluding taxes and any trade-in credit) for a 36-month lease term and $40.99 (excluding taxes and any trade-in credit) for a 24-month lease term.
No security deposit required. A trade-in device may reduce monthly payments. Advertised monthly payment amount may not include a trade-in device’s estimated value. Upgrades are not guaranteed and are subject to eligibility and approval.
Terminating your Apple Upgrade lease
: Closing your lease and returning your device terminates your lease. You may incur a substantial charge up to the amount of your remaining lease payments if you terminate your lease before the end of your initial lease term. You may have the option to upgrade to a new device by entering into a new lease agreement and returning your prior device. If you upgrade, your new monthly payments may be greater than your prior monthly payments. If you do not upgrade, terminate your lease, or purchase your device by the end of the initial lease term, the lease will convert to a month-to-month lease for up to six months. Your monthly payments may increase during the month-to-month period. If you take no action at the end of your extension period, you will be charged for the amount due to exercise the purchase option under your lease. You will not own your device at the end of your lease, unless you pay the amount due to exercise the purchase option. Insurance is not included in your lease, and you may incur damage fees if the device is lost, stolen, or not returned in the condition required by the lease.
Apple Upgrade lease eligibility
: Leases are only available to U.S. residents (excluding residents of U.S. territories). Leased devices are only available for shipping to U.S. addresses (excluding U.S. territories) or pickup at Apple Retail stores in the U.S. (excluding U.S. territories). To be eligible for a lease, you must be at least 18 years old (or the legal age in your state of residence), have a valid Social Security number or individual taxpayer identification number (ITIN), have an accepted credit or debit card, have an Apple Account in good standing, have a Klarna account, and be able to receive security verification codes via text message. Leases are not available on refurbished accessories or online at the following special stores: Apple Employee Purchase Plan; participating corporate Employee Purchase Programs; Apple at Work for small businesses or enterprises; Government, Education, or Veterans and Military Purchase Programs.
Stay up to date with the latest articles from Apple Newsroom.
Automated license plate readers (ALPRs) aren’t just helping police investigate crimes anymore. They’re now being used to flag drivers for supposedly “suspicious” driving patterns.
The American Civil Liberties Union (ACLU) sounded the alarm Monday in a
blog post
on Monday, warning that law enforcement agencies across the United States are increasingly using license plate readers and AI-powered tools to pull over drivers even if they aren’t suspected of having committed a specific crime.
The post opens with the story of Grace Knowles, a woman in her 20s from northern Virginia who took a road trip through Oregon, Texas, and Louisiana in September 2025. On her way to Florida, she was pulled over by an officer who claimed she had spent too much time driving in the left lane.
The officer questioned Knowles about her travels and asked for proof that she had been in New Orleans. He eventually identified himself as a special agent with the Federal Bureau of Investigation (FBI) that was on a project for human and drug trafficking. He told her that her license plate had been flagged for suspicious travel patterns.
After she convinced him she was just on a road trip, he offered to show her what he was looking at on a computer in his car.
“It was basically a heat map of the U.S., and I could see different circles where I’d been, and when he clicked on it, it was a photo of my license plate,” Knowles told the ACLU.
When she asked how authorities had collected images of her license plate, the officer told her the cameras were everywhere, including on top of highway signs.
The ACLU warns that encounters like Knowles’ could become more common.
“For many people, those encounters will be far more fraught, frightening and dangerous than what Knowles experienced,” wrote Jay Stanley, a senior policy analyst with the ACLU.
ALPRs facing growing pushback nationwide
The warning comes as ALPRs are already facing growing backlash.
Companies like Flock Safety and Axon have become known in recent years for selling ALPR systems to law enforcement, which scan license plates as vehicles pass, collecting vehicle information along with the time and location they were spotted. Police can then search that data during investigations.
Privacy advocates, however, warn that the cameras collect location data on millions of people who are not suspected of crimes, often without a warrant, probable cause, or reasonable suspicion. There have also been reports of the systems leading to
mistakes
and rampant
misuse
by law enforcement.
An August YouGov survey found that
46% of respondents opposed
law enforcement using the technology in their communities, while 38% supported it.
Law enforcement agencies around the country, including the
Los Angeles Police Department
, have suspended or even ended their Flock contracts amid the growing backlash.
Knowles’ story is far from the only case raising concerns about how police are using license plate data.
In March, The Markup
reported
that a California grandmother was questioned by U.S. Customs and Border Protection (CPB) officers about how often she visited local casinos. In
another case
, a man was targeted for a traffic stop after repeatedly driving back and forth between Wisconsin and Michigan, which local police described as “a known source State for Marijuana.”
Earlier this month, a federal jury in Texas sided with a man who
sued
over what his attorneys described as an “unconstitutional traffic stop scheme” enabled by “AI-powered” license plate readers. According to the lawsuit, he was pulled over after his license plate was flagged for driving from Houston to Carrizo Springs, staying overnight, and returning home the following day.
Meanwhile, WIRED
reported
this month that Flock had developed an AI-powered investigative tool that “can identify drivers and track vehicles by their patterns of movement alone.”
Flock did not immediately respond to a request for comment.
Classification of Finite Simple Groups Formalized in Lean
The classification of finite simple groups is one of the great collective achievements of mathematics. Its first-generation proof spans thousands of journal pages, written by about a hundred mathematicians over several decades. It shows that every finite simple group is cyclic of prime order, alternating, of Lie type, or one of 26 sporadic groups.
Here we present a complete formalization in Lean following the first-generation proof, with every logical step checked by Lean’s kernel. Along the way, we found an issue in a published argument for the Unbalanced Group Theorem.
The accompanying paper
explains the issue and the alternative route used in our proof.
Our blog post
tells the full story.
Lines of Lean
43.1M
Declarations
2.05M
Milestones
100
Papers and books
715
Core contributors
Dean Cureton
*
†
, Vasily Ilin
†
, Bhavik Mehta
*
†
, Niels Voss
†
Other contributors
Rafael Cabral
†
, Colin Defant
*
, Erik Gregory
†
, Aaron Hill
†
, Letong Hong
◇
, Qinheping Hu
†
, Dustin Jamner
†
, Albert Jiang
†
, Tadeusz Jordan
†
, Andranik Kurghinyan
†
, Kenny Lau
*
†
, Jonathan Laurent
†
, David Liang
†
, Jannis Limperg
†
, Simon Mahns
†
, Brian Nugent
*
, Connor Olson
†
, Ken Ono
*
, Eric Paul
†
, Dhruv Rajan
†
, Karun Ram
†
, Charlie Ray
†
, Ho Chung Siu
†
, Ashvin A. Swaminathan
*
†
, Jesse Thorner
*
, Aleksey Tsaplin
†
, Chenkai Wang
†
*
Mathematical contributors
†
Engineering contributors
◇
Principal investigator
This is the Agent Blueprint, the initial blueprint we gave the agents. For the Lean code itself, see the
Lean Repo
The corpus
139 source works
1870
1950
1970
1990
2026
Each block is a paper or book, sized by the statements it supplies. Hover to find its statements.
This is what I feared, that she would speak about the news .
.
. about how her father always said that the news exists so it can disappear, this is the point of news, whatever story, wherever it is happening. We depend on the news to disappear .
.
.
—Don DeLillo, “Hammer and Sickle”
What a story. What a fucking story.
—Dean Baquet, on the election of Donald Trump
Stills from
Recorder: The Marion Stokes Project,
which is currently screening at Northwest Film Forum, in Seattle. Beginning in 1979, Stokes recorded television around the clock for over thirty years. Courtesy Matt Wolf/Zeitgeist Films
a circular conversation
W
hat is the news?
That which is new.
But everything is new: a flower blooms; a man hugs his daughter, not for the first time, but for the first time
this
time . . .
That which is
important
and new.
Important in what sense?
In being consequential.
And this has been measured?
What?
The relationship between what is covered in the news and what is consequential.
Not measured.
Why?
Its consequence is ensured.
Ensured. . . ?
It’s in the news.
But then who makes it news?
Editors
. Editors dictate consequence?
Not entirely
. Not entirely?
It matters what people read and watch—you can’t bore them.
Then boredom decides?
Boredom and a sense of what’s important.
But what
is
important?
What’s in the news
.
i
.
I
n his 1962 book
The Image,
Daniel J. Boorstin explains, “There was a time when the reader of an unexciting newspaper would remark, ‘How dull is the world today!’ Nowadays he says, ‘What a dull newspaper!’ ” The first American paper, Benjamin Harris’s
Publick Occurrences Both Forreign and Domestick,
committed to appearing only once a month—or “oftener ‘if any Glut of Occurrences happen.’ ” Clearly, things have changed. “We need not be theologians,” writes Boorstin, “to see that we have shifted responsibility for making the world interesting from God to the newspaperman.” The chief tool in this new labor is the pseudo-event.
What is a pseudo-event? They are everywhere; we hardly notice. Some familiar examples: the speech, the rally, the press conference, the briefing, the ribbon cutting, the political announcement, the political response, the interview, the profile, the televised debate, the televised argument, the televised shouting match, the televised roundup of other televised events, the official expression of outrage, remorse, righteousness, fear, sanctimony, jingoism, smarm, or folksiness. The talking point is its handmaiden. News analysis is a second-order pseudo-event, not an event per se but the dissection of pseudo-events: that is, theater criticism. It is not that pseudo-events are always uninteresting or meaningless but that they are always
not news.
They only exist to be reported on. To supply a format. To make up for the non-glut of occurrences. Take away the pseudo-event and what is left to fill the news?
ii
.
T
o meet our demand for newness and stimulation, we refashioned public life as a ritual sequence of pseudo-events. This transformed politics from an industry of policy and legislation into an industry of emotion and entertainment. If the news covered only the proposal and passage of specific legislation—or the proposal and enactment of specific policy—we would have little news, and audience interest would quickly fade. But the work of politicians might become the work of governing. As things are, the job of politicians is to feed the emotional-entertainment industry that we call “news,” which is accomplished by grandstanding and self-promotion. Reporters and pundits cover politics by analyzing how politicians succeed and fail as spokespeople and media figures. Interest shifts, by turns, to how the game is played, how the media fits into this game, and, eventually, how journalists do their jobs. The news today, properly understood, is about the careers of politicians and journalists. It is career drama.
iii
.
T
elevision news aims to alert you to problems. In life, when someone alerts you to a problem, the problem’s meaning takes shape within an implicit context, answering: (1) How important is this problem? (2) Where does it fit into the rest of my life? (3) What should I do about it? News shows cannot answer these questions because their format and their content are at odds. Their content says, “This is very important,” but their format says: (1) No more important than the next segment; (2) In a time slot; (3) Keep watching. If you are a teacher or a car mechanic or a doctor, your job is not simply to identify a problem but to connect people to a solution. The news media doesn’t do this. It
believes
it does—insofar as its audience members vote—but hundreds of hours spent consuming news in a given year put to the service of one vote in one election is a terrible use of any person’s time. Consider what all these people, with all these hours, might otherwise accomplish. Consider that most viewers would vote similarly, and not necessarily less well, with much less information. The principal effect of TV news is to create engagement through distress. News shows cannot connect viewers to meaningful actions they might take in their own lives to relieve this distress because these actions would mean ceasing to watch TV. And this is the goal to which all others will be sacrificed: to keep you watching.
iv
.
Entertainment is the supra-ideology of all discourse on television. No matter what is depicted or from what point of view, the overarching presumption is that it is there for our amusement and pleasure. That is why even on news shows which provide us daily with fragments of tragedy and barbarism, we are urged by the newscasters to “join them tomorrow.” What for? One would think that several minutes of murder and mayhem would suffice as material for a month of sleepless nights. We accept the newscasters’ invitation because we know that the “news” is not to be taken seriously, that it is all in fun, so to say.
—Neil Postman
A
nalyses of the news tend to focus on how the internet has changed things, and there is no doubt that the intrusions of Facebook’s news feed and Google News, online aggregation and free content, real-time reporting, YouTube, blogging, podcasting, and Twitter have roiled and remade the news business. But the crisis in news
as an industry
is not the same as the crisis in news
as a cultural institution.
The latter took root long before we connected online. It is for this reason, because so much media today represents the continuation, even the culmination, of trends that originated in the late Seventies and early Eighties, that writers such as Neil Postman remain relevant. They saw that the news was moving in two directions even then: toward entertainment and away from the local reality of people’s lives. For all the intervening technological change, entertainment on TV remains the dominant modality of all twenty-first-century news.
And while the news may not feel like fun, it is fun in the sense that it is stimulating without demanding effort—that doing anything else would require more energy and commitment, even turning off the TV. Watching television leaves no meaningful residue of knowledge or skill. When I visited Amsterdam many years ago, kids staying at the hostels liked to tour the Heineken brewery for an afternoon. They wanted to do something “cultural,” an activity that justified having traveled to the Netherlands, but really they wanted to drink beer. This is the logic of all infotainment, all TV and most internet news: it soothes the mind’s demand for constructive activity while delivering entertainment—a sugary drink sold on its vitamin content. Prestige TV works the same way: by convincing people that they are engaging with art. Make no mistake—well-wrought entertainment can require as much talent as art to create, but that alone does not make it art. Likewise, not all experiences of information are the same, since more or less passive forms of learning involve us differently. What distinguishes art (or knowledge) from entertainment (or infotainment) is that art asks something of its audience, and that its form serves the artwork, and not the other way around. Until the news can say, “We have no show (or paper) today because there is nothing of significance to concern you,” the news will build its monument to truth on a lie.
v
.
W
hen you think you are doing something serious but you are doing something trivial and fun, you grow to believe that serious things are effortless and enjoyable. You are experiencing a format, while believing you are experiencing a content. The content suggests you are learning about truth, when you are really learning how to
feel.
You are learning how you should feel in the presence of certain information. These feelings go on to determine your expectations and worldview.
The formal message of the news is simultaneously the vital importance and utter triviality of everything that is happening. For weeks leading up to the 2018 midterm elections, the media covered the “migrant caravan” as the central story of the moment. Journalists understood that its salience as a crisis had been manufactured, and they devoted pages and segments and podcasts to debunking this salience, to exposing it as, in effect, a peripheral real event being turned into a central pseudo-event. These debunkings of course contributed to the critical mass of coverage, until the story, or nonstory, took up significant space in our minds: in our idea of the world “out there.” Then the election took place; the migrant caravan had served its purpose as an object of media attention, and it disappeared. Presumably it did not disappear from the face of the earth, but to judge by the sole connection it had to most people who attended it—its life as a news item—it might as well have.
Which was the truth: That it was news, and it did belong in our minds? Or that it was an irrelevant sideshow? What we can say for certain is that this question was not decided in the real world of human necessity but in the virtual world of the news. The caravan story may be notable for how precipitously it disappeared, but the same uncertainty hangs over every news story: What space does this deserve in the limited sphere of our awareness? Since media attention rarely solves the problems it fixates on, in time the news must move on, letting every story vanish like the caravan—even wars. The raw matter and proportions of the world “out there” take shape in our minds in relation to the imperatives of an industry. This proportionality, rather than fact or truth, decides the image of the world we construct: what Jean Baudrillard calls a “hyperreality,” the inseparable amalgam of the virtual and the real. The news narrativizes the world, but distortedly, according to the proclivities of its format, and so the story the news tells is always at heart the story of news: the story of curating what we recognize as news.
vi
.
I
s it a problem that our mental representation of the world is the product of a for-profit entertainment industry? Yes. Our government, for instance, cannot be dully competent if what we demand of it is that it isn’t boring. (After the first day of open testimony in the impeachment hearings, NBC News noted that the witnesses “testified to President Trump’s scheme, but lacked the pizzazz necessary to capture public attention.”) Journalists often rightly claim that the engaged polity should focus more on state and local politics, but people follow national politics for the same reason journalists and pundits do: because it’s interesting. Were we to take their advice, they would be out of a job. Our attention sustains them, as it sustains politicians, and so when journalists wring their hands over the unfortunate necessity of covering Trump’s tweets—to choose another example—they mistake their own complicity in what they, again rightly, find toxic. For there is no noncircular logic that ordains the newsworthiness of the president’s tweets. As the celebrity is famous for being famous, so Trump’s tweets are news because they get covered as news. If the news media chose only to report on concrete actions and orders emanating from the White House, the activity of governing would once again become the proper object of political contemplation.
What news outlets appear to mean by insisting that they must cover Trump’s tweets and other provocative ephemera is that if they don’t, someone else will and will thereby steal their audience, or that they feel obliged to report on what their audience seems to want. But this only draws attention to the central flaw in their industry. They are not, they reveal, reporting “the news”—an expert and principled curation of what they believe is important—but seeking to win audience share, like any other entertainment business, by trading on the inherent prestige of and misconceptions about what we have come to call “news.”
On the podcast
Stay Tuned with Preet,
Preet Bharara asked Christiane Amanpour whether the media underestimates people in assuming they want to be entertained rather than informed. It is a confused question and received a confused answer:
I think maybe that was the case in the past several years. But I do believe that since we’ve entered this vortex of a different kind of politics, I think many, many people are actually looking for real news, facts, truth. Clearly, there’s a lot who don’t really care, who buy into conspiracy theories, who still go to Facebook and other places where they can find fake news. I do think that people have to take on a responsibility of their own right now. . . . They go out and they shop around, and they get the best that they can. And they must do that right now when it comes to information because we are being inundated by charlatans who don’t give a damn about the effect they’re having on people. And they just care about clickbait and just care about racking up their own dollars, their own profit margins. It is a disgrace. It is immoral. It is the marketplace. So I think that people need to be responsible and choose their destination carefully, and come to people like us who are tried and true and tested and proven brand names in this sphere.
Amanpour’s show is on PBS, which may partially insulate it from the market. Still, her assumptions and elisions are striking, if predictable. She does not ask whether meaningful or essential truth may be different from “real news, facts, truth” as dictated by a TV news show. She glides over the question of whether she is supplying facts and information to an audience that would otherwise not have this information or fall prey to conspiracy theories and fake news. She assumes, against all reasonable belief, that people are drawn to her show because they are searching for truth or facts in a morass of confusion and deceit. She suggests, with no apparent irony, that being “responsible” means choosing your TV news “destination” carefully. Finally, while denigrating the charms of less “true and tested and proven brand names in this sphere,” she seems utterly (or conveniently) incurious about what people actually get out of her program and others like it. What she must know—just as Bharara knows it—is that she is not principally the purveyor of unique information but a media personality, someone people like to spend time with, and that her show, while presumably made up of real news and facts and truth, is a fantasy, a shimmering hyperreality, one that in this case happens to be a fantasy
about
how facts and news and truth are treated, with emphases and mores that signal seriousness and importance within well-understood and fairly rigid parameters. What she is selling, in other words, is not an experience of reality but of what her viewers wish reality were like—that is, therapy, not news.
vii
.
T
he coincidence of trauma and therapy, alarm and comfort, is the essence of today’s news, which requires emergency, high-stakes drama, breaking stories, updates, and alerts to keep its audience engaged, but which must then solve the problem it has created by offering explainers and analyses to give coherence to so much terrifying chaos and by employing informational docents, in the form of likable media figures, to soothe our fear of a world on fire with their good humor, their intelligence, and the reassuring whisper embedded in their format:
the news exists so it can disappear.
And the news does disappear, inevitably, because its salience in the virtual sphere of our apprehension is so disproportionate to its salience in our lives. But what does not disappear is the residue of the experience and how this primes us for our next encounter with news of politics and the world out there.
One consequence of inflating the stakes of ongoing political activity in order to fill formats and draw audiences is that people are afraid of politics: afraid of politicians—the government—actually doing anything. Large constituencies stand ready on either side to denounce any new policy or law as the end of everything they cherish. The potential effect of policy gets subsumed into the virtual space of the news, where it languishes as an untested proposition, an object of endless, futile debate. Instead of implementing policy and evaluating it in practice, we remain paralyzed, and the more paralyzed we get—the less able to enact or amend policy—the more the case for paralysis grows, since the chances of fixing a mistake diminish. This grants an asymmetric power to the forces that want the government to do less, not more.
But the more pernicious effect is a psychic cancer introduced into the culture as a whole. The extreme coincidence of urgency and irrelevance, terror and impotence, turns into a maddening unsettledness and contradiction in the conceptual sphere of life, authoring fear, anger, and confusion everywhere. The essential experience of a hyperreality is angst: dread, hushed panic, ambient foreboding. A disturbing fiction at least comforts you that it is fiction. A needling friend may finally admit, “I’m just fucking with you.” The news is, on balance, just fucking with us, but it can never say so because it draws its stimulating power from the pretense that it isn’t entertainment, isn’t just “fun,” but is deeply consequential. It rigorously blurs the line between entertainment and public service, since its market share and prestige depend on this confusion. But when you ask yourself what you can
do
with what you have learned on the news, you see that it only permits you to consume subsequent news more conversantly.
W
hether as a news show, a podcast, or an article, chances are today the news came to you through a screen. Online news platforms differ from traditional broadcast media and newspapers in significant ways. When clicks and engagement define the metrics of success, prompts and alerts, listicles, clickbait, most-read or “top story” sections, and otherwise manipulative headlines and teasers become predominant aspects of the experience. The graphic layouts of news on TV and on websites converge, with chyrons mimicking banner ads and vice versa. Red-letter “breaking news” gets more common (and less likely to be urgent, or even news) as the thirst for constant stimulation grows. When you buy a physical newspaper, what you do with it next—what you read—is your business. Not so with news on the internet; here the publication’s interest does not end but begins at the “point of sale,” and everything about the architecture of the product is designed to attach you to more of it.
But even old-school newspapers succumb to the tyranny of format, worshipping, in their way, a less glitzy hyperreality we call “the news of the day.” This is what a newspaper is and has been—a kind of composite pseudo-event—since the telegraph and other technologies of communication freed information from limits imposed by space and time. The news of the day comprises real- and pseudo-events and even, sometimes, real news, but it is only one of infinite possibilities of how we might narrativize the world. It strives to be factual but adheres to strict conventions of format about what can and can’t appear. It collapses the dimensionality we rely on to judge the world around us so that the proportions of the world it presents cannot agree with the proportions of our lives—“cannot” because the news
is
above all else this proportionality, this idiosyncratic condensation of the world out there.
This is what Neil Postman meant when he wrote, “The news of the day is a figment of our technological imagination.” Our means of apprehending reality determine the reality we apprehend. What few could foresee was that, as technological and business pressures drew the news further toward stimulation and away from representing immediate life, at a certain point the value of the news’ being true, its hewing as close as possible to an accurate picture of the world, would fall away. The news’ relationship to people’s lives had grown perilously virtual and its meaning, on an emotional level, nearly indistinguishable from entertainment. That no feedback mechanism existed to discourage people from getting their facts wrong, or to correct them when they did, underscored how deeply insignificant and remote the subject matter of the news—trumpeted for its significance and immediacy—was to the lives of its audience. In the immediate and practical sense, news and fake news became a distinction without a difference.
ix
.
W
hat we call “news” is less and less the meaningful historical facts—
this happened
—and more and more “opinion”: argument to substantiate an ideology or worldview. Have you noticed a recent profusion of ideology? Here’s why: ideology is an answer to the problem of conceptual questions destined to remain in the conceptual sphere. It fills a vacuum of action. You can argue using ideology, but you can’t build a bridge with it. If you spend more time arguing than building bridges, it’s very useful.
One way to tell you’re in the presence of ideology is when an entire industry of opinion exists to bolster and substantiate beliefs that people do not know how to justify on their own. Its nature is to confuse the question of who is thinking for whom and where thought or belief began. Ideology flatters people that their beliefs are their own precisely when they are not, and thus the sort of opinions and analyses that present themselves as ideology’s correctives are in fact its enablers. The consumer of opinion does not ask himself “Why do I believe this?” but “Who can remind me why I believe this?”
Much has been made of the dichotomy between news and opinion in the case of Fox News or the
Wall Street
Journal,
but almost all news today comes with a lacing of opinion or ideology, a framing, at the very least, that helps sort through the implications of a piece of information and put it in the context of a prior ideological framework. Rarely are you left to wonder whether a given idea matches Republican or Democratic, conservative or liberal ideology. Rarely are you left to wonder what you yourself think, or what else you would like to know before forming an opinion, without someone swooping in to think for you.
Guidance from those who know more than you do is often a good thing: the substance of education. But education means to empower you to think for yourself, not indoctrinate you. The signs of education and of ideology mirror each other inversely: curiosity, open-mindedness, and self-doubt on the one hand; quickness to anger, defensiveness, and tenacity of belief on the other. One welcomes new information; the other fears it.
Most Americans are not significant consumers of news and are not especially ideological. One might hope that if news were performing the educational function it sets for itself, news-savvy, high-information Americans would be still more open-minded and less ideological. Studies suggest the opposite is true—that more “informed” voters are more partisan and often have less accurate, more ideologically skewed ideas about the world. This isn’t necessarily the news’ fault. Nonetheless, the news seems not to counteract or mitigate but to abet our ideological drift. It gives us the tools not to interrogate but to taxonomize belief, not to develop policy preferences but to identify to which political identity and tribe a policy belongs. In the internet age it gives us just enough to cobble together our own take—demonstrating our wonkish bona fides, unleashing a snarky dismissal or the sickest burn—just enough, that is, to pass off the scraps of other people’s expertise as an ersatz identity of our own.
x
.
I
deology grows stronger for our belief in a lie: that information has an additive property whereby at some point it becomes knowledge. This simply isn’t true. Outside the contextual frameworks that give information a place in life and a relationship to other information, it is quite literally meaningless. Would more state-issued facts about the Soviet economy in 1980, or more pages of talking points from an industry lobby, get you closer to the truth simply for not being untrue? Does knowing more trivia help someone build a better car or advance particle physics or write a more touching ballad? If we judge the “informed” as those who possess more information—more disembodied or decontextualized bits of trivia that are “true” in the sense of not being demonstrably false—we may find we have created a vacuous category (“conversance”) and that we need invented contexts, like the proliferating “news quizzes,” to put these incoherent facts to use. “Think You’re Smarter Than a
Slate
Senior Editor? Find Out With This Week’s News Quiz,”
Slate
suggests. “Did you stay up to date this week?” the
New York Times
’ news quiz more gently wonders. It’s only one step further to propose the news business itself and the practice of journalism as the proper object of the news connoisseur’s attention and interest. Asking such people’s opinions in polls, then, may do less to draw out “informed” commentary than to hold up a mirror to the culture’s own confusion.
“Truth” and “fact” in isolation do nothing to combat ideology and error. It merely benefits the news industry to pretend they do. I understand why people object to false equivalencies between MSNBC and Fox News, but to focus on veracity blinds us to the deeper effect of opinion and punditry per se. The pertinent question concerns the terms of the implicit contract between audience and commentator. If commentators serve the sensibility of their audiences—which the necessity of attracting and retaining viewers (or listeners or readers) in a competitive media environment ensures—it hardly matters that they traffic in fact or avoid untruth since the overall message people receive is:
Your worldview is substan
tially right, and here are the arguments to insulate and fortify it.
The purpose is to justify ideological frameworks as a way of dealing with uncertainty and to reinforce the complex social agreements on which these consensuses are built. When Fox News anchor Shepard Smith debunked what conspiracy theorists had dubbed the Hillary Clinton “uranium scandal” in 2017, his audience did not thank him for elucidating the truth, but suggested he belonged on CNN or MSNBC and that, for exposing a false story, he was anti-Trump. In other words, he had violated the terms of their contract, which was not to provide fact or best judgment but corroboration. Truth was welcome, but only truth that confirmed one view.
Thus while ideology and entertainment may seem at odds—entertainment is reputedly fun and lighthearted, where ideology is deadly serious—they are in fact flip sides of the same coin. Entertainment means to transfix, to keep you in place: watching, tuned in. It cannot ask you to endure discomfort, and the comfort it offers is often an uncomplicated intimacy, even a vicarious identification, with a celebrity—in the case of news, with the commentator or host. Because this person’s primary concern is your comfort—which is to say your attention and approval—a subtle con exists at the heart of the exchange. This person does not know who you are or, in any but the most superficial sense, care about you. But the illusion of a relationship is nonetheless paramount. It goes one step further, since part of the illusion, in the face of political confusion and distress, is that the news celebrity’s competence and clarity are your own. Her power is briefly yours, and while you inhabit the aura of her expertise you are safe from your own ignorance and the frustration of life among other people. The most fervent devotees of a cult or demagogue are those who mistake courtship for love and the power of a leader for their own. But when you step outside the aegis of a leader’s power, the aura of a pundit’s companionship, you realize, suddenly, that you are alone and unprepared. You were misled into thinking you were getting help when you were giving worship. Ideology takes root in this disappointment because the alternative is more painful: accepting that you’ve been conned.
N
ewspapers begin with the most serious and sober news, which, though it has little to do with your life, understands that you show up with good intentions. You mean to do something civic, or at least to cast a glance over those more serious headlines on your way to controversy and gossip, celebrity and human drama.
The news, like a fractal, repeats this betrayal of good intentions on every scale. This is the poignancy and tragedy of the news. We need it: the Fourth Estate, complement to government, scourge of corruption, orchestrator of public discourse. No one thinks we could get by without a press. No one who understands the work of journalism has anything but admiration for its honest practice.
But this work—to hold power to account, to safeguard the truth, to comfort the afflicted and afflict the comfortable, in Finley Peter Dunne’s immortal words—has entered into a fatal bargain with an effluvium that demeans and yet supports it. Traditional reporting becomes the loss leader. It exchanges its status for a subsidy, and slowly a reluctant embrace of this co-optation—by the very forces a profession that stands in opposition to power should repel—turns into an erotic grapple, because the apotheosis of market logic is the jittery Stockholm syndrome that makes the prisoners of the market insist that it has set them free.
So we find ourselves in a situation in which an entertainment industry of specious value (called “news”) subsidizes a much smaller and less popular subindustry (real news), which lends its prestige to the former and permits it to call itself by the same name. As this entertainment industry subsumes and replaces the news industry, a little game takes place, more or less in public. The game involves pretending—journalist and audience alike—that they have gathered to discuss a truth that exists outside the media, when, except in the rarest cases, they intend to discuss the processes of the media itself: the drama of how information and sentiment evolve and are influenced within a media environment. Like sports fans, news consumers learn the subtleties of the game. They grow “media-savvy,” and media-savvy becomes the hope of an industry. Members of the news business (and practically they alone) call for greater “media literacy”—a solution to a problem they have created that expects the reformation of their audience but not of their industry—because they do not want to choose between responsibility and popularity, or principle and career. They are selling a healthy product, they imply, which people are using the wrong way. But this is confused. No one
wants
the healthy product. They want its misuse. They want to believe something so stimulating can be healthy, and they rely on media members to help perpetuate this lie.
As civic discourse—the news—becomes increasingly shaped by media-savvy and game-play, as it becomes a metadiscourse not about actual events but about the translation and distortion of actual events within a virtual sphere, the little lie about what the news is and why we follow it permits bigger lies. Charlatans, con men, demagogues, and cheats crawl out of the woodwork and operate with impunity, knowing they need not win on truth or merit, but simply win the news cycle, win within the rules of a confected game. Playing the game well, being stimulating and likable in a media environment, suffices to justify one’s ascendancy within it, because—despite protestations to the contrary—this logic of celebrity explains why anyone is a media figure in the first place, and why we attend them. The sober, responsible news, now in its watchdog guise, enters here—when the mechanism of its own industry has elevated a crook or a scoundrel to a position of power—promising to solve, through exposure, a problem it helped create. But it can’t undo the media mechanism without relinquishing its own power and profitability by copping to the lie on which its prestige rests.
xii
.
B
ut we need the news, don’t we? We need information spreading through society. We need people digging into convenient stories to check the facts. We need to uncover what power seeks to hide and discourage those who can abuse their power from doing so.
Of course, we can’t judge the soldier, the police officer, the watchdog only by what they do, but also by what would happen without them.
And yet no one would suggest we fund the military by watching it wage war on TV, that the size of its audience should determine its budget. We understand where such incentives would lead.
But this is the way the news works. Its greatest social benefit rests in discouraging the sensational and scandalous from happening, but it needs the sensational and scandalous to attract the audience that supports it. No one would propose we fund cancer research through tobacco sales or link heart-disease treatment to McDonald’s revenue. No one would say that the CIA should partner with TMZ to run a celebrity-gossip site. But with the news we are not so far from these fanciful scenarios.
Breitbart
and right-wing talk radio belabor fake scandals to create a salable emotional product, but the mainstream media, for all its understandable concern about Trump, cannot stop helping him when it boosts their bottom line. They can’t limit themselves to reporting on concrete actions by the White House but must breathlessly amplify every ephemeral utterance, every remark designed to cause a little flurry of reporting and nothing more. They can’t stop saying “Trump” and broadcasting his likeness, when his likeness has nothing to do with the news and when they could as easily say “the White House” or “the executive branch.” They are puppeteered by their own game, caught in a bind whereby their abhorrence of Trump and their audience’s abhorrence of Trump elevated him to such cacophonous prominence that he had a shot of winning the presidency. And when he did win and the mood among reporters at the
New York
Times
turned bleak, the paper’s executive editor, Dean Baquet, was surprised at the response: this was the story of a lifetime. “Great stories trump everything else, right?” he says in the documentary miniseries
The Fourth Estate.
But only someone besotted with the news as an end in itself could believe that—another executive clinging to the delusion that he’s a celebrity and a civic hero at once. The privatization of a public good has progressed to a far-gone place when market success and moral success are so confused that you congratulate yourself for selling both antidote and toxin.
xiii
.
T
he news may be judged by what it crowds out.
democracy dies in darkness
, the
Washington
Post
motto reads. For billions who live in countries without a free press, this is true. But our problem in the United States is not an absence but a glut. Truth dies in darkness, but it also dies in blinding light. Separating what’s important from what’s trivial is as essential as revealing what’s important. A needle in the haystack isn’t much better than no needle.
The problem of distinguishing the important from the trivial is a problem for all of us—for our educators, our politicians, our leaders, for us as individuals, as citizens, as friends. To lay this problem at the feet of the news industry is unfair. The news is trapped in a business model that makes no sense, that rewards it for its worst behavior and refuses to pay it for what of greatest value it contributes. But the news can be blamed for confusing the issue. We need to know when we are being entertained and when we are having a different experience. Being fed trivialities when we need importance, like empty calories when we need nourishment, makes us sick. We grow to mistake bigness for importance, when importance is a measure of our involvement. Big trivialities make us psychically obese, with nowhere to expend this pent-up energy. “What a story. What a fucking story,” Dean Baquet said, watching Trump’s inauguration.
The essayist Lauren Hough writes about being a “cable guy” and describes the clenched-teeth white-knuckling of a customer who hears he will have to forgo Fox News for a week. A junkie without a fix. What is this hunger, this addiction? An addiction is a hunger briefly satisfied, then redoubled, by its object. But hunger for
what
? Hunger for something much more significant than the news. An answer to the incommensurable. To the incommensurability of the scope of the world and the scope of our lives. The vastness of our hopes and the range of our capabilities. Meaning and place. I feel it, too. It does not begin in anger or fear, but it can be twisted into these by a cynical exchange—too many cynical exchanges, one after the next. Too many trivialities passed off as sustenance. Too much fake intimacy. Too much stimulation to no end.
William Carlos Williams writes:
My heart rouses thinking to bring you news of something that concerns you and concerns many men. Look at what passes for the new. You will not find it there but in despised poems. It is difficult to get the news from poems yet men die miserably every day for lack of what is found there.
Good luck getting anyone to turn away from the news to a poem, but this is the lack—and the surfeit, the glut—of which we die miserably every day.
something missing
W
hen we turn away from the news, we will confront a startling loneliness. It is the loneliness of life. The loneliness of thinking, of having no one to think for us, and of uncertainty. It is a loneliness that was always there but that was obscured by an illusion, and we will miss the illusion. We will miss the illusion that we had a place in history, the sense that we were celebrities ourselves, actors on the grand stage. We will miss the voices and images that came to us daily and convinced us they were our friends. We may, if we listen closely to the echo inside this loneliness, hear the expectant beating of our own hearts and understand that what we longed for, what we asked for, and what was given us was a story—a story of such grand metaphysical proportions that reality could never meet it. Reality could only meet it by inflaming itself, and this was the danger—the danger that made our hearts beat faster and the story grow stronger. Then we will see the news for what it was: the narrator of our national epic. “The news of the day” was the next chapter in an evaporating book. And we will miss tuning in each day to hear that voice that cuts boredom and loneliness in its solution of the present tense, that like Scheherazade assures us the story is still unfolding and always will be. I don’t know whether we can give it up. We may need it too much, miss it too sharply. We may never get to the quiet place where we can read a poem, because this will mean distinguishing happiness from pleasure and understanding that happiness means boredom, means loneliness. Means life among one another, in the world: a place where drama subsides and horizons of time stretch to months, to years. Are you not bored already? Who will narrate our epic now? Will we have one? What will bind us? No one knows. What we do know is that some part of us longs for our dreams to come true. Dream of monsters long enough and you bring them into being. We make what we imagine real. And who then reminds us—and what must happen before we remember—that the drama we want in our stories is not the drama we want in our lives?
Amazon Is Gutting Its AI Division After Sustained Failure
By now, you’d be hard pressed to find anyone who isn’t broadly familiar with the AI heavyweights and their flagship models. OpenAI has ChatGPT, Anthropic has Claude, Google has Gemini. But what does Amazon have?
Not a whole lot, it turns out. Unlike its competitors in the tech megacorp scene, Amazon’s standout AI model — organized under the name “Nova” — is about the farthest thing from a household name. And that’s not likely to change anytime soon, because the ecommerce giant is now gutting its in-house AI labs,
Bloomberg
reports
.
Per the outlet, Amazon is scaling back the ambitions of most of its Nova AI models and reorganizing its AI development teams as part of an effort to narrow its focus on “highest priority” goals, after its
power-hungry
large language models turned out to be a bust.
Accordingly, the company has put most of its AI models on ice, Amazon insiders told
Bloomberg
. This includes its text-based Nova models, as well as video- and image-generating models, all of which have been placed in a state of “keep the lights on,” meaning they’re technically still supported, but only receive the bare minimum resources needed to sustain them.
Instead, labor and computing power are being diverted toward a singular “frontier-model effort” led by Pieter Abbeel, director of the Berkeley Robot Learning Lab whose robotics company Covariant was
hoovered up by Amazon
in 2024. At the time Abbeel joined the tech giant, Covariant’s founders were working on AI models for robots, which lines up pretty well with Amazon’s push to automate everything it possibly can.
News of the shift in Amazon’s strategic focus comes a week after it closed one of its
key AI offices
in San Francisco, an 80-person site specializing in research on artificial general intelligence, the supposed next-level of AI development where the tech obtains human-level intelligence and reasoning skills.
With urgent questions swirling over whether LLMs can ever usher in a
return on investment
— let alone AGI — it may be that Amazon is jumping out of the AI hype cycle while it still can.
Between October 16 and 23, 2026, PHP, Node.js, GitLab, LiteLLM, OpenCode and the eMudhra certificate authority all had serious security incidents. PHP, Node.js and GitLab shipped fixes on October 21, the same day the bad LiteLLM release went out. Every advisory ended with some version of upgrade, rebuild or rotate.
Doing the upgrade is the easy part. What takes time is working out, for your own accounts, where the affected thing runs, who owns it, and what it can reach. If you have an inventory you trust, that’s an afternoon. If you don’t, it’s a week of Slack threads, and this week didn’t give anyone a week. Amazon’s MadPot honeypots logged a PHP2Shell exploit attempt
four days before the bugs were disclosed
.
The internet this week. Tempting, but someone still has to find the servers.
Unauthenticated remote code execution, rated CVSS 10.0, through an integer overflow in GitLab’s regular expression compiler. It reaches back to GitLab 7.0, released in 2014.
Patch releases on October 21. No workaround for self-managed instances.
Is there a self-managed GitLab nobody remembers, and can the internet reach it?
An intruder reached a legacy system, and AI provider keys that users had saved in the Console may have been exposed. Some users reported unauthorized charges.
Revoke and reissue the keys.
Where else is that key stored, and which workloads break when it’s revoked?
Do we hold certificates from this chain, and do our images still trust it?
Nothing on that list is obscure. Two are runtimes that a large share of the web sits on, one is the source-control server plenty of companies still host themselves, and one is the AI gateway a lot of teams adopted in a hurry to route LLM traffic. If you run a reasonably sized estate on AWS or Azure, at least one of these was probably yours to deal with.
The exploit window keeps getting shorter
Mandiant tracks how long attackers take to exploit a vulnerability after disclosure. Its
time-to-exploit analysis
put the average at 63 days in 2018–2019, 44 days in 2020–2021 and 32 days in 2021–2022. In 2023 it was five days, and 70% of the exploited vulnerabilities Mandiant tracked that year were zero-days, exploited before a patch existed.
Drew Silcock’s post
Is this the new cyber normal?
, which reached the front page of Hacker News on October 23, argues that LLMs have compressed this further, so the gap between a bad RCE becoming public and automated attacks against it is now hours rather than weeks. PHP2Shell fits. The bugs were
found with help from an AI model
, patched binaries
appeared before the advisory
after an embargo dispute, and exploit attempts started before most people could install the fix.
Your exposure window is the time to find what’s affected plus the time to fix it. Most teams have spent years shrinking the second number with CI/CD, managed runtimes and automatic patching. The first number is still a spreadsheet, a Slack thread, and whoever remembers how the old GitLab box was set up.
This is why the frameworks put inventory first. The
CIS Controls
make inventory of enterprise assets and inventory of software Controls 1 and 2; vulnerability management doesn’t show up until Control 7. CISA’s
BOD 23-01
requires US federal agencies to run automated asset discovery every seven days and vulnerability enumeration every 14. If you don’t know a server exists, you won’t patch it.
Here is how I’d answer each of those questions with what AWS and Azure give you out of the box, using this week’s incidents as examples. Every command below is read-only.
1. Where it runs
Start with Node.js. On Lambda, supported managed runtimes
get runtime updates automatically
by default, so most functions on a current Node.js runtime pick up the fix without a redeploy. Two groups don’t. Functions on the deprecated nodejs20.x runtime
stopped getting security patches
when Node.js 20 reached end of life in April 2026. Functions deployed as container images carry whatever Node.js was baked into the image. So what you actually need is the list of functions on an old runtime or packaged as an image:
# Node.js and container-image Lambda functions in every enabled regionfor region in $(aws ec2 describe-regions --query "Regions[].RegionName" --output text); do echo "== $region" aws lambda list-functions --region "$region" \ --query "Functions[?PackageType=='Image' || (Runtime && starts_with(Runtime, 'nodejs'))].[FunctionName, Runtime || PackageType]" \ --output textdone
Image-based functions are in that output because the Lambda API can’t tell you what’s inside them. For those you need your image scanner, or a rebuild.
For PHP2Shell on Azure, App Service records each Linux app’s runtime stack, and Azure Resource Graph can search it across every subscription you can read:
az graph query -q "resources| where type =~ 'microsoft.web/sites'| mv-expand setting = properties.siteProperties.properties| where setting.name =~ 'LinuxFxVersion' and tostring(setting.value) startswith 'PHP'| project name, resourceGroup, subscriptionId, stack = tostring(setting.value)" --first 1000 -o table
Anything on PHP 8.1 or older gets no regular upstream fix, so put it at the top of the list.
VMs and containers are harder, because the cloud control plane doesn’t know what’s installed on them. That’s what AWS Systems Manager Inventory, Amazon Inspector and Microsoft Defender for Cloud are for, and each one only sees the machines it’s enabled on. That coverage gap is the one that hurts most, and I’ll come back to it.
2. Whether the internet can reach it
GitLab patched GitLab.com itself. Self-managed instances are on you, and short of upgrading there’s no workaround. The one that worries me is rarely the GitLab the platform team runs. It’s the one some team stood up in 2019, or the one that came along with an acquisition, still answering on 443.
Search by name and tag first, then look at exposure:
# Instances that look like GitLab, with public IPs and security groupsaws ec2 describe-instances \ --filters "Name=tag:Name,Values=*gitlab*,*GitLab*" \ --query "Reservations[].Instances[].[InstanceId, State.Name, PublicIpAddress, join(',', SecurityGroups[].GroupId)]" \ --output text# Security groups with an inbound rule open to the whole internetaws ec2 describe-security-groups \ --filters Name=ip-permission.cidr,Values=0.0.0.0/0 \ --query "SecurityGroups[].[GroupId, GroupName, VpcId]" \ --output text
In Azure,
az vm list -d --query "[?contains(name, 'gitlab')].{name:name, rg:resourceGroup, ips:publicIps}" -o table
gets you the same first pass.
Be careful with what this tells you. A name filter only finds servers someone named honestly, and an instance with no public IP can still be reachable through a public load balancer. Both make this hard to answer from the console in the middle of an incident. It’s much easier if you already have an inventory that holds the relationships.
3. Who owns it
Once you’ve found the server, somebody has to approve the downtime, and ideally that person knows how it was installed. Tags are the first place to look. If there aren’t any, CloudTrail can tell you who created the resource:
Event history only goes back 90 days, and the same is true of the Azure Activity Log. For a server from 2019 you need your trail in S3 and an Athena query, which
Who Created This AWS Resource?
walks through. Even then the creator may have left. In
one case we looked at
, 89 idle Azure VMs came from an acquisition and nobody on the current team could say what they were for. Resources like that are exactly where an unpatched GitLab ends up living.
4. What it can reach
LiteLLM shows why a package finding is only the start. According to
Microsoft’s analysis
, the malicious release went after AWS, Azure and Google Cloud credential caches, Kubernetes service-account files, Docker configuration and mounted secrets. It also tried to pull credentials from the AWS and GCP metadata services, and on proxy hosts it read provider keys out of LiteLLM’s own database.
The bad package is what the scanner reports. What you actually have to respond to is the identity the host ran as. For every environment that installed 1.107.0, find the role it had and what that role is allowed to do:
# The instance profile behind an EC2 instanceaws ec2 describe-instances --instance-ids i-0abc123example \ --query "Reservations[].Instances[].IamInstanceProfile.Arn" --output text# The role inside that profile, and the policies attached to itaws iam get-instance-profile --instance-profile-name litellm-proxy \ --query "InstanceProfile.Roles[].RoleName" --output textaws iam list-attached-role-policies --role-name litellm-proxy-roleaws iam list-role-policies --role-name litellm-proxy-role
On ECS the identity is the task role in the task definition. On EKS it’s the role mapped to the pod’s service account. Microsoft’s guidance is to investigate from a clean machine, rebuild from verified artifacts, rotate every reachable credential, and pin container images by digest instead of floating tags like
latest
. I’d underline the clean-machine part: their analysis says the payload runs when Python starts, so running pip inside a suspect environment to check for the package can trigger it.
5. Where else the secret or certificate lives
OpenCode told users to revoke and reissue the exposed keys. Revoking takes a click. Working out what breaks when you do is the real job, because AI provider keys end up in Secrets Manager or Key Vault, in Lambda and App Service settings, in CI variables and in developers’
.env
files. On AWS, Secrets Manager at least records when each secret was last read and last rotated, and CloudTrail’s GetSecretValue events show which roles read it:
eMudhra raises the same problem for certificates. With a private key that small, anyone could compute it and sign certificates that browsers would have trusted until the intermediates were blocked. Two checks are worth running. First, search the certificates you’ve imported for eMudhra or emSign issuers. ACM is regional, and certificates used by CloudFront live in us-east-1, so run this in every region you use, us-east-1 included:
In Azure, Resource Graph covers App Service certificates across subscriptions:
az graph query -q "resources| where type =~ 'microsoft.web/certificates'| where tostring(properties.issuer) contains 'emSign' or tostring(properties.issuer) contains 'eMudhra'| project name, resourceGroup, subscriptionId, issuer = tostring(properties.issuer), expires = properties.expirationDate" -o table
Second, software with its own trust store keeps trusting a CA until that store is updated. Old AMIs, base images and runtimes that bundle their own CA list are where a blocked chain keeps working long after browsers have dropped it.
Where scanners and consoles stop
Amazon Inspector and Defender for Cloud are good at telling you whether a package version on a given machine is vulnerable. The AWS and Azure consoles are good at telling you what’s in one account in one region. Neither is what you need the morning an advisory lands.
The first problem is coverage. A scanner sees the accounts, subscriptions and machines it’s been enabled on, and the GitLab server from the acquisition is usually sitting in the account nobody onboarded. The second is ownership. Findings land in a shared queue where nobody has the authority to restart someone else’s server, so they sit there. A finding with no owner attached is just one more alert. The third is context. The scanner says the package is bad. It doesn’t say the host’s role can read every S3 bucket in the account, or that three other teams’ services call it. With LiteLLM, that context was most of the incident.
What fills those gaps is an inventory that stays current and records what exists, who owns it and how it connects to everything else. That’s the thing we’re building Cloud Sleuth to be.
What this looks like in Cloud Sleuth
Cloud Sleuth maps your AWS and Azure resources, assigns an owner to each one whether it’s tagged or not, and keeps both up to date. Here’s the GitLab question asked the way Cloud Sleuth is designed to answer it.
Illustrative example - commands and output not final:
$ sleuth ask "gitlab servers the internet can reach, and who owns them"ec2 scm-legacy-01 account acquired-prod · eu-west-1 image GitLab CE 13.12 AMI, launched 2021-06-02 exposure internet → alb-scm (public) → target group scm-https → :443 owner team-devex confidence 88% created by role/terraform-ci (CloudTrail, 2021-06-02) managed by github.com/acme/legacy-infra (terraform state) role scm-legacy-instance → read on 4 S3 buckets, 2 secrets findings no owner tag · public ingress
That one result covers exposure, ownership and reach: the server, the path from the internet to it, the team to page along with the evidence for that answer, and what the server’s role can touch. Without it you’d be in four consoles and a CloudTrail search, and you’d be doing it again for every account, including the one from the acquisition.
Inventory search
puts AWS and Azure resources in one schema you can query with SQL or plain English, so the region-by-region Lambda loop above becomes a single query across both clouds with owners already attached:
Illustrative example - schema not final:
select cloud, account, type, name, runtime, ownerfrom resourceswhere runtime in ('nodejs18.x', 'nodejs20.x')order by owner;
The
cloud map
draws network paths, load balancer targets, attachments and IAM relationships from your real accounts, which is how you see what sits in front of a forgotten server and what its role can reach before you start rotating. The
ownership model
infers owners from CloudTrail and the Azure Activity Log, IaC state, naming and account structure, and shows a confidence score and the evidence behind it.
Guardrails
flag unowned, untagged and orphaned resources, and in Cloud Sleuth Cloud findings can be routed to the owning team in Slack or Jira, with custom policies like “no function on a deprecated runtime” running continuously. There’s also a read-only
MCP server
, so you can ask an agent like Claude or Cursor “which of our functions run Node.js 20, and who owns them?” during an incident.
Given that this week included a vendor console leaking keys customers had stored in it and a popular package shipping a credential stealer, the trust model matters. The Cloud Sleuth CLI is read-only by default, installs nothing on your servers, and runs on your machine or in your VPC. If you want to try it,
join the early-access list
.
A one-hour drill
Pick one of this week’s advisories and time how long it takes your team to do the following. List every place Node.js and PHP run, including Lambda runtimes, App Service stacks, container images and VMs. Find every self-managed GitLab, and any other self-hosted developer tool, and check whether the internet can reach it. Put an owner’s name next to each one. For any environment that installed LiteLLM 1.107.0, list the roles it ran as and rotate everything those roles could reach. Write down where your AI provider keys are stored and which workloads use them. Search your certificates for eMudhra or emSign issuers.
If that took more than an hour, expect the next advisory to take about as long.
Frequently asked questions
Was my AWS Lambda function affected by the Node.js Brotli vulnerability?
Only code that decompresses Brotli data from untrusted sources with
node:zlib
is exposed. Lambda rolls out runtime updates to supported managed runtimes automatically by default, and the
INIT_START
line in a function’s logs shows the runtime version it’s running. Functions on the deprecated nodejs20.x runtime no longer get security patches, and container-image functions carry whatever Node.js version is in the image, so upgrade or rebuild those.
Is GitLab.com affected by CVE-2026-110264?
GitLab patches GitLab.com and GitLab Dedicated itself, and coverage of the release says both were already running fixed versions. Self-managed GitLab Community and Enterprise Edition instances need to upgrade to a patched release. There’s no workaround.
What should I do if an environment installed LiteLLM 1.107.0?
Treat it as compromised. Investigate from a clean machine, rebuild from a verified version, confirm that
cook.pth
,
cook.py
and
sitecustomize.py
are gone from the Python library path, and rotate every credential the environment could reach: cloud roles, CI/CD secrets, SSH keys and model provider keys. Microsoft’s analysis lists the indicators to search for.
How does Cloud Sleuth help when a new vulnerability is announced?
It answers the questions that decide how fast you can respond: which of your AWS and Azure resources are in scope, which ones the internet can reach, who owns each one, and what each one can reach. Owners come with the evidence behind them, so the fix goes to a team that can actually make it. The CLI runs read-only on your machine, and you can
join the early-access list
now.
French Court’s Site-Blocking Orders Drive Quad9 Out Of France
Electronic Frontier Foundation
www.eff.org
2026-10-27 12:19:49
A nonprofit service that protects internet users’ privacy is leaving France. Quad9, a free DNS resolver, has said it will reluctantly stop serving users in France on November 24. This follows a French court order that Quad9 must block access to websites that are accused of infringing the copyrights ...
A nonprofit service that protects internet users’ privacy is leaving France. Quad9, a free DNS resolver, has said
it will reluctantly stop serving users in France
on November 24. This follows a French court order that Quad9 must block access to websites that are accused of infringing the copyrights of a sports broadcaster. Forcing a responsible privacy service out of an important market is a predictable result of trying to force infrastructure providers to be copyright police.
When you visit a website, a DNS resolver reads the domain name you type in—like
eff.org
— and translates it into a numerical IP address that’s used to direct data across the internet. A DNS resolver can see the names of websites you connect to, so its privacy policies are important. Quad9 is an NGO that’s incorporated in Switzerland, in part to protect its users from data demands. The company also helps protect users from malware and phishing by blocking domains that are known to be malicious. Services like Quad9 offer an alternative to the DNS resolvers of local internet service providers and wireless carriers, which are vulnerable to demands from law enforcement, censorship, and commercial surveillance.
In a blog post explaining its decision, Quad9 explains that the French court’s order forces it to make a decision that, either way, is bad for users. It could either “extend French law to the whole world (blocking globally)” or try to identify and block users only in France—something that it can’t do reliably, and a move that could leave the company facing massive fines if it fails to block websites perfectly within France. Quad9 says it is facing about 20 other lawsuits in France seeking similar blocking orders.
Rather than accept these demands, Quad9 has decided to withdraw its service from France. That is a real loss for French users who rely on the service to protect their privacy and security. It is also the right thing to do, when faced with the alternative: making promises it can’t keep, or abandoning users’ rights worldwide.
Quad9’s decision will not remove any allegedly infringing material from the internet. The organization doesn’t host websites. Users looking for particular websites can easily
switch
to another DNS resolver. So the material targeted by copyright holders will remain online and accessible, even while they drive a privacy-protecting service out of France.
These events matter beyond the borders of France, and U.S. lawmakers should pay attention. Congress is considering multiple
site-blocking proposals
, which would require ISPs and other intermediaries, including DNS resolvers, to block access to websites in the name of protecting copyright. These bills threaten speech and our ability to access information online, and they are invitations to abuse. The Quad9 withdrawal shows another cost: if internet services get forced into being copyright cops, users can lose services that they rely on for privacy and security.
Worse still, if neutral services like Quad9 are forced to build site-blocking systems for the benefit of copyright holders, it becomes far easier for other powerful interests, including repressive governments, to demand the same systems be used to censor speech they dislike, globally.
Congress should reject site-blocking bills. They’re a threat to the open internet, and don’t help creators or creativity.
Warp discloses breach exposing AI agent logs, user telemetry data
Bleeping Computer
www.bleepingcomputer.com
2026-10-27 12:15:39
Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project's infrastructure. [...]...
Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project’s infrastructure.
The company’s founder and CEO, Zach Lloyd, estimates that "roughly 1% of Warp users may have been impacted," but external experts are helping with the ongoing investigation.
Warp is a popular developer tool that started as a modern terminal and evolved into an agentic development environment (ADE) that allows developers to direct AI agents to write and test code and deploy software.
The environment provides a terminal, a code editor, task orchestration, and agent review tools in a single workspace. The project's website says the platform has at least
800,000 users
.
“On Friday, we became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp's infrastructure,”
Lloyd stated
.
“We detected the operation within hours and were able to remediate and mitigate the impact,” the CEO added.
Although agent traces and telemetry were identified as potentially affected data, the company did not clarify whether the exposed information included source code, prompts, credentials, or other sensitive details.
Analysis of the incident suggests that the attack was powered by "an agent swarm" that relied on "a very sophisticated penetration and escalation technique."
Lloyd said
that Warp has contacted the third-party vendor about the vulnerability, but no details have been shared. The platform has notified users identified to be impacted.
The cybersecurity firm CrowdStrike has also been engaged to assist with the investigation, while the platform has also informed law enforcement authorities.
The incident at Warp follows an
incident at AI coding platform OpenCode
, which notified users last week that a security breach exposed stored API keys used with external providers.
The incident affected a small percentage of OpenCode users, about 1.4%, and led to unauthorized charges of up to $1,700 for some.
Warp users are advised to remain vigilant, monitor account activity, and treat unsolicited communications with increased caution.
Apple introduces the new 14‑inch MacBook Pro with M6
Supercharged by M6, the 14-inch MacBook Pro features incredible performance and next-level AI capabilities, enhanced connectivity, and up to 24 hours of battery life, delivering even more value
Supercharged by the all-new M6 chip, the 14-inch MacBook Pro brings extraordinary performance, AI capabilities, and up to 24 hours of battery life — making it an even more compelling value.
CUPERTINO, CALIFORNIA
Apple today announced the new
14-inch MacBook Pro with M6
, delivering even more performance, powerful on-device AI capabilities, and faster connectivity for college students, business users, creators, and more. M6 features an advanced 12-core CPU with the world’s fastest CPU core, so everything from productivity tasks to more demanding pro workflows feels incredibly fast and responsive.
1
The 12-core GPU delivers up to 30 percent faster graphics and up to 25 percent faster AI workloads when compared to M5, making the 14-inch MacBook Pro with M6 a compelling value for users who need serious power.
2
For those upgrading from M1, the performance gains are even more significant, with up to 11x faster graphics and up to 13x faster AI performance.
3
With additional Neural Accelerators in the GPU and a Dual 16-core Neural Engine, M6 turns MacBook Pro into an even more powerful platform for AI — from taking advantage of Siri AI and Apple Intelligence features across apps and macOS to running LLMs locally, all while preserving user privacy.
4
In addition, the 14-inch MacBook Pro features Wi-Fi 7 and Bluetooth 6, while superfast storage makes working with large files, exporting projects, and running demanding AI workflows fly. And with phenomenal battery life of up to 24 hours, it delivers the same remarkable performance whether plugged in or on battery, so users can work, create, and pursue their passions from anywhere.
3
It also offers the advanced features users love, including the stunning Liquid Retina XDR display with a nano-texture option, a 12MP Center Stage camera, an immersive six-speaker sound system, and a wide array of ports. Together with macOS 27, the new 14-inch MacBook Pro with M6 is a major upgrade for existing Mac users and those coming to Mac for the first time. Available in space black and silver, it can be pre-ordered beginning tomorrow, October 28, with availability starting Friday, November 6.
The new 14-inch MacBook Pro with M6 combines next-generation performance and powerful on-device AI in a portable design, empowering students, creatives, developers, and business professionals to take their workflows anywhere.
“The 14-inch MacBook Pro is the pro laptop of choice for a wide range of users — from college students, to business professionals across every industry, to multidisciplinary creators doing it all on one device,” said Shelly Goldberg, Apple’s vice president of Hardware Engineering. “With the powerful M6 chip, we’re taking performance to the next level, with a boost in CPU speed and graphics and even more powerful capabilities for on-device AI. With its amazing battery life, remarkable Liquid Retina XDR display, and even faster connectivity, the new 14-inch MacBook Pro with M6 delivers a fantastic combination of performance, capability, and value.”
M6 makes the 14-inch MacBook Pro faster than ever, thanks to a powerful 12-core CPU, advanced 12-core GPU, and Dual 16-core Neural Engine.
M6: Blazing-Fast Performance and On-Device AI Capabilities
M6 brings even more performance and next-level AI capabilities to the 14-inch MacBook Pro. Featuring a powerful 12-core CPU, a 12-core GPU with Neural Accelerators in each core, Dual 16-core Neural Engine, and faster unified memory, MacBook Pro with M6 is faster and more responsive.
The 12-core CPU, with two more cores than before, brings blazing-fast single- and multithreaded performance, so users can fly through everything from multitasking across apps to compiling code to handling complex creative workflows. The 12-core GPU, also with two additional cores, delivers up to 30 percent faster graphics performance when compared to M5.
2
Everything from 3D modelling to photo editing and gaming feels incredibly fast, enhanced by a third-generation ray-tracing engine and Dynamic Caching to optimise on-chip memory. It also brings up to 25 percent faster performance for on-device AI workloads, like LLM prompt processing, compared to M5.
3
The Dual 16-core Neural Engine delivers up to 1.9x faster performance than M5 and works with the advanced GPU to dramatically accelerate AI workloads like image generation, Super Resolution, and AI upscaling.
2
The Neural Engine also powers Apple Intelligence, enabling advanced and energy-efficient on-device AI processing. The 14-inch MacBook Pro with M6 does all this with industry-leading performance per watt and up to 24 hours of battery life, the longest ever in a Mac. With 16GB of unified memory standard, configurable up to 32GB, and higher memory bandwidth up to 170GB/s, MacBook Pro makes multitasking and working with demanding apps and large projects even faster.
The 14-inch MacBook Pro with M6 helps motion designers model 3D objects, design product visualisations, and render animations with ease.
The 14-inch MacBook Pro with M6 enables
:
3
Up to 13x faster time to first token performance for LLM prompt processing compared to the 13-inch MacBook Pro with M1, and up to 1.3x faster than the 14-inch MacBook Pro with M5.
Up to 11.7x faster render performance with ray tracing in Blender compared to the 13-inch MacBook Pro with M1, and up to 1.3x faster than the 14-inch MacBook Pro with M5.
Up to 3.3x faster image-processing performance in Affinity compared to the 13-inch MacBook Pro with M1, and up to 1.2x faster than the 14-inch MacBook Pro with M5.
Up to 2.5x faster project build performance when compiling code in Xcode compared to the 13-inch MacBook Pro with M1, and up to 1.3x faster than the 14-inch MacBook Pro with M5.
Film editors and content creators can quickly and efficiently composite visual effects and add cinematic motion graphics in popular video editing tools on the 14-inch MacBook Pro with M6.
Photographers and designers can make complex AI-powered image adjustments in real time using apps like Pixelmator Pro on the 14-inch MacBook Pro with M6.
Developers can build and test their apps with blazing-fast compile times in Xcode on the 14-inch MacBook Pro with M6.
A Huge Upgrade with Even More Value
There’s never been a better time for customers to upgrade from a previous-generation MacBook Pro with Apple silicon or an Intel-based Mac. The 14-inch MacBook Pro with M6 delivers remarkable value thanks to major performance improvements and powerful AI capabilities. The new 14-inch MacBook Pro also features all of the compelling capabilities that have made it so popular, including:
Phenomenal battery life
: In addition to the huge leap in performance, battery life gets up to 14 additional hours for Intel-based upgraders and up to four more hours for users coming from M1, delivering up to 24 hours overall, so users can get more done on a single charge. Users coming from Intel-based and M1 systems will also get 16GB of starting unified memory, an additional Thunderbolt port, and the space black finish with an anodisation seal for fewer fingerprints.
A brilliant pro display
: The stunning Liquid Retina XDR display delivers up to 1600 nits of peak HDR brightness and a 1,000,000:1 contrast ratio, bringing HDR photos and videos to life with deep blacks, brilliant highlights, and vibrant colours. And for users working in bright or challenging lighting conditions, a nano-texture display option dramatically reduces reflections and glare.
Powerful connectivity
: Now with Wi-Fi 7 and Bluetooth 6, the 14-inch MacBook Pro delivers fast wireless performance and low latency, along with support for up to two external displays. Its versatile array of ports — including the HDMI, MagSafe 3, and three Thunderbolt 4 ports; an SDXC card slot; and a headphone jack — makes it easy to connect high-speed peripherals, transfer photos, or expand a workspace.
Advanced camera, mics, and speakers
: A 12MP Center Stage camera with Desk View helps keep users perfectly framed on video calls, while a studio-quality three-mic array and amazing six-speaker sound system with Spatial Audio deliver an immersive audio experience.
Fast charging
: MacBook Pro with M6 supports fast charging, reaching up to 50 percent charge in just 30 minutes when paired with a compatible higher-wattage USB-C power adapter, such as the 96W Power Adapter.
3
A laptop that’s built to last
: With an enclosure made from 100 percent recycled aluminium, MacBook Pro is exceptionally durable and can stand up to everyday use for years to come.
Better together with iPhone
: When used together with Continuity, iPhone and Mac are even more powerful — letting users move seamlessly across devices to share files and photos, hand off tasks, and even control their iPhone from their 14-inch MacBook Pro.
5
Users switching to Mac for the first time can use iPhone to conveniently and securely transfer settings, files, photos, passwords, and more.
The brilliant Liquid Retina XDR display delivers up to 1600 nits of peak HDR brightness and a 1,000,000:1 contrast ratio. HDR photos and videos look more true to life with deep blacks, brilliant highlights, and vibrant colours.
With the new 14-inch MacBook Pro, users can connect high-speed peripherals, transfer photos, work with multiple external displays, and more with its wide array of ports.
macOS 27 Golden Gate
The new 14-inch MacBook Pro with M6 comes to life with macOS 27, which includes Siri AI, a profoundly more capable, conversational, and personal assistant; helpful Apple Intelligence features across everyday apps; and improvements that make the Mac even more responsive and reliable. Siri AI can draw on personal context to help users find what they need in the moment across messages, emails, photos, and more; answer questions about virtually any topic; and get things done across apps — all with groundbreaking privacy protections. Siri AI is integrated into Spotlight and systemwide context menus, and users can ask Siri about what’s on their display with Visual Intelligence using a dedicated keyboard shortcut. Users can also write and edit with Siri almost anywhere they type.
Additionally, Apple Intelligence makes apps smarter and more useful. In Safari, it powers new tools that automatically organise a user’s tabs into topics; notify them of website changes, like product restocks or price drops; and enable the creation of custom extensions based on a description. Users can also easily create an automation in Shortcuts by simply describing it, or tap into intelligent photo editing tools in the Photos app. The new 14-inch MacBook Pro gets even more responsive, reliable, and delightful with refinements to design, performance, search, and more. Updates to Liquid Glass deliver an even more focused and approachable experience. A new slider in Settings gives users the option to personalise Liquid Glass, adjusting it anywhere from ultraclear to fully tinted to match their preference, and app icons are sharper and more defined.
14-inch MacBook Pro with M6 and the Environment
The new 14-inch MacBook Pro with M6 was built with the environment in mind and drives progress toward Apple’s ambitious plan to be carbon neutral across its entire footprint by 2030. It is made with 45 percent recycled content overall,
6
including 100 percent recycled aluminium in the enclosure, 100 percent recycled cobalt in the battery, and, in a first for Apple, 100 percent recycled tantalum in multiple capacitors. It is manufactured with 60 percent renewable electricity, such as wind and solar, across the supply chain. The 14-inch MacBook Pro with M6 is designed to be durable and repairable, and meets Apple’s high standards for energy efficiency and safe chemistry. As with all Apple products, its paper packaging is 100 percent fiber-based
7
and designed to be recycled.
Customers can pre-order the new 14-inch MacBook Pro with M6 starting tomorrow, October 28, on
apple.com/in/store
and in the Apple Store app in 35 countries and regions, including the U.S. It will begin arriving to customers, and in Apple Store locations and Apple Authorized Resellers, starting Friday, November 6.
The 14-inch MacBook Pro with M6 starts at
INR 239900
and
INR 227900
with
education savings
. Additional technical specifications and configure-to-order options are available at
apple.com/in/macbook-pro
.
Details on Apple accessories — including the 70W Power Adapter for
INR 5800
, 96W Power Adapter for
INR 8900
, 140W Power Adapter for
INR 11900
, and the World Travel Adapter Kit for
INR 4900
— are available at
apple.com/in/mac
.
With Apple Trade In, customers can trade in their current computer and get credit toward a new Mac. Customers can visit
apple.com/in/shop/trade-in
to see what their device is worth. With year-round education pricing — available to current and newly accepted college students and educators — customers can save on MacBook Pro, along with a wide range of products and services through the Apple Store online and in stores. Visit the
Apple Education Store
for details.
AppleCare delivers exceptional service and support, with flexible options for Apple users. Customers can choose AppleCare+ to cover their new Mac or, in available markets, AppleCare One to protect multiple products in one simple plan. Both plans include coverage for accidents like drops and spills, theft and loss protection on eligible products, battery replacement service, and priority support from Apple Experts. For more information, visit
apple.com/in/applecare
.
Every customer who buys directly from Apple gets access to Personal Setup. In these guided one-on-one online sessions, a Specialist can walk them through setup or focus on features that will help them make the most of their new device. Customers can also learn more about getting started and going further with their new device with a Today at Apple session at their nearest Apple Store.
Testing was conducted by Apple in October 2026 using shipping competitive systems and select industry-standard benchmarks.
Results are compared to 14-inch MacBook Pro with M5, 10-core CPU, 10-core GPU, 32GB of unified memory, and 4TB SSD.
Testing was conducted by Apple in September 2026. See
apple.com/in/macbook-pro
for more information. Battery life varies by use and configuration. See
apple.com/batteries
for more information.
Apple Intelligence is available with Siri and device language set to Chinese (simplified), Chinese (traditional), Danish, Dutch, English, French, German, Italian, Japanese, Korean, Norwegian, Portuguese, Spanish, Swedish, Turkish, or Vietnamese. Some features may not be available in all regions or languages. Some devices may not be available in all regions. Siri AI is available in beta in macOS 27 and requires an Apple Intelligence–enabled device set to a supported language. Some features may not be available in all regions or languages. Apple is working constructively with the EU in an attempt to find a path forward. Siri AI is not available for users under 13. Certain Apple Intelligence features that rely on server-side models are subject to daily usage limits, including but not limited to Siri AI, intelligent photo editing tools, Image Playground, and AFM 3 Cloud models in Shortcuts. Daily limits may vary by feature, request complexity, system demand, system policies and other factors. Expanded access to such features will be available for a fee in the future. Use of these features is subject to the Apple Intelligence terms and conditions. Learn more at
support.apple.com/148587
.
iPhone Mirroring is available on Mac computers with Apple silicon and Intel-based Mac computers with a T2 Security Chip. Requires that the user’s iPhone and Mac are signed in with the same Apple Account using two-factor authentication, their iPhone and Mac are near each other and have Bluetooth and Wi-Fi turned on, and their Mac is not using AirPlay or Sidecar. Some iPhone features (e.g. camera and microphone) are not compatible with iPhone Mirroring.
Product recycled or renewable content is the mass of certified recycled material relative to the overall mass of the device, not including packaging or in-box accessories.
Breakdown of US retail packaging by weight. Adhesives, inks, and coatings are excluded from calculations of plastic content and packaging weight.
Stay up to date with the latest articles from Apple Newsroom.
Today, we are announcing Genie 4, our new world model, which unlocks unprecedented realism and improves real-time interactive simulation. Genie 4 is natively multimodal, enabling audio-like music, ambient noises, and interactive dialogue to be simultaneously generated with the world.
The Genie 4 model incorporates and builds on capabilities from the Gemini family: Gemini Omni anchors the simulations in real-world appearance and behavior, while other Gemini models provide the complex reasoning needed to help maintain a simulation’s coherence and continuity.
With this foundation, you can set an event in motion, and Genie 4 simulates what happens next: how the world responds, how it sounds, and how the people in it move, react, and speak.
Understanding and simulating the world is a crucial aspect of building AGI. Genie 4 advances our ability to create safe, infinitely variable simulations that can help with everything from developing training environments for robots and agents to unlocking the creation of new interactive experiences.
We have started rolling Genie 4 out as a research preview for trusted testers — gathering feedback before we release it to consumers and developers, starting with Google AI Ultra subscribers in Project Genie and early access partners of the Gemini API and Google AI Studio. Join the waitlist for Genie 4 in Project Genie
here
.
Genie 4 delivers enhanced photorealism, fluid movement, and native audio. All accompanying sounds featured above are produced directly by Genie 4.
Genie 4 advances four key capabilities
The following are recordings of real-time interactions from Genie 4, where users use standard keyboard controls for navigation and camera control, and text prompts to steer the scene as it evolves.
Shaping world simulation in real-time
With Genie 4, you can use natural language to modify a simulation in real-time — like changing the weather, moving the camera, or introducing a new person or object — and Gemini will contextually adapt your prompt to match the surrounding scene. Between your inputs, Gemini also monitors and steers the scene to keep the world progressing cohesively.
Turn on audio to hear Genie 4 worlds.
Pushing the frontier in realism for physics and human action
Genie 4 introduces a new standard of realism to real-time interactive simulation. Built on an advanced physical understanding of the world, Genie 4 simulates real-world physics scenarios, such as aerodynamics, collisions, and more.
The most dramatic leap is how Genie 4 simulates people, creating characters that move naturally, respond organically to their environments, and can be interactively steered in real-time.
Modeling how the world sounds
Genie 4 is our first real-time world model to generate audio natively. Every world carries the ambient sound of its own setting, from wind in the trees to waves crashing at the beach.
The true frontier, however, is human speech. Genie 4 introduces interactive dialogue that adapts on the fly. Characters converse and react to your inputs or events in the world, all in real-time.
Simulating complex events with Gemini models
Bringing Gemini and Genie 4 together adds a new layer of reasoning to world simulation, allowing us to model complex, multi-step events and test how AI systems navigate different environments before bringing them to the real world.
To achieve this in real-time, Gemini 3.8 Flash serves as a guiding agent in the loop: as Genie 4 generates a world in real-time, Gemini continuously observes the scene, breaks down goals into a sequence of steps, and reviews incoming frames to track the progress and verify that each step succeeded. As the world shifts or the user intervenes, Gemini adapts its plan in the moment, unlocking worlds with reliable causality, procedural behaviors, and multi-step reasoning.
As part of exploring this capability, we have also been experimenting with Gemini 4 Argon and Genie 4 to bring our frontier research together with
Gemini Robotics
.
In the example below, Argon breaks down a user-instructed task into steps for Genie to render. These steps are interleaved as text captions to Genie 4 as the simulation is rendering. Because Genie 4 can be steered in real-time with text captions using Gemini, this now unlocks the path of adapting the simulation as it progresses towards the completion of that task. This capability becomes a path for simulating a breadth of scenarios in imagined worlds, using Gemini 4 Argon and Genie 4.
Gemini 4 Argon and Genie 4 work together to simulate Apptronik's Apollo humanoid playing a game of checkers, breaking the task down into real-time steps.
Learnings from trusted testers
While Genie 4 is a major research milestone, it remains an early, experimental model. To understand how interactive world models can support real-world workflows—and where they still need to grow—we’ve been working with cohorts of trusted testers across creative industries, journalism, education, gaming, and engineering.
Testers highlighted how the leap in photorealism, native audio, and real-time steering allows ideas and concepts to be turned into realistic simulations, unlocking new abilities across disciplines:
Creative direction
: Creatives and technologists are testing Genie 4 as a rapid "draft mode" for pre-visualization and ideation. For example, filmmakers can step into a live simulation of a scene and run multiple "takes" in real-time, adjusting camera angles, lighting, dialogue, and action on the fly.
Historical scenarios & immersive photographs
: Photojournalists are exploring how a single 2D archival photograph can become a grounded simulation of that environment in seconds. Teams are testing how populated, dynamic worlds can help experience historical spaces or visualize how short-term environmental events, like a flash flood or wildfire, unfold.
Interactive experience concept design
: Game developers and creative technologists are testing Genie 4 to go from an initial idea to an explorable prototype in seconds, testing visual styles, material aesthetics, and interactive mechanics through natural language prompts before writing a single line of engine code.
Simulation
: Aside from our robotics research, enterprise partners across industries are evaluating Genie 4 as a tool for rapid "zero-to-one" scenario generation, and identifying gaps to further improve Genie to best fulfill that simulation need.
Future Work: Towards hybrid world models
A promising path for future progress lies in hybrid world models, which combine the logical, structured reasoning of code and language models with the rich, sensory representation of pixel-level simulation.
Bringing Genie and Gemini models closer together is an early step in this direction. Gemini works behind the scenes to map the structure and plan the narrative timeline, while Genie generates the immediate physical reality—rendering how the world looks, sounds, and responds, pixel by pixel. Together, these complementary strengths can unlock a new class of world models that are far more coherent, controllable, and grounded than either approach could achieve alone.
Building world models responsibly
Genie 4 marks a new area of frontier research that merges real-time generation and photorealism, introducing a new range of capabilities and dimensions that we want to roll out and explore in a responsible way. Genie 4 includes strict safety guardrails that are consistent with our safety policies across other models. Before launching this preview, we evaluated Genie 4 through internal rigorous safety evaluations to prevent the generation of harmful or malicious content. Also, we have intentionally deployed it first to trusted tester partners to get early feedback, before we release the model more broadly.
To maintain transparency, all video and audio generated by Genie 4 will include SynthID, our imperceptible digital watermarking technology that helps identify AI-generated content across visual and audio modalities.
Understanding current limitations
Genie 4 remains an early, evolving area of research.
While it can maintain coherent environments over short sessions, visual details and object permanence can still shift or drift over time—especially as a simulation runs longer, after multiple complex prompt edits, or when navigating throughout the scene. Complex physical interactions, real-time audio accuracy, rendering legible text, spatial accuracy, and long-term consistency are active areas of ongoing research. We are sharing Genie 4 as a preview to learn alongside our community and safely advance the frontier of interactive simulation.
Next steps for Genie 4
Genie 4 has been released as a research preview to trusted testers, and is coming soon to Google AI Ultra subscribers in Project Genie and early access partners in the Gemini API and Google AI Studio. Join the waitlist for Genie 4 in Project Genie
here
.
We’re excited for users to step inside, experiment, and build their own interactive worlds soon.
Acknowledgements
Genie 4 was made possible by core contributions from Hang Qi, Diego Rivas, Aleksander Hołyński, Inbar Mosseri, Jack Parker-Holder, Shlomi Fruchter, Tejas Kulkarni, James Assiene, Philip Ball, Jakob Bauer, Eddie Cao, Lucy Chai, Harris Chan, Kleopatra Chatziprimou, Hao Chen, Yoni Choukroun, Mark Collier, Enric Corona, Kurtis David, Ariel Ephrat, Maxime Gazeau, Ruiqi Gao, Chelsee Glover-Odom, Liangke Gui, Swaroop Guntupalli, Shan Han, Tingbo Hou, Jiri Hron, Hui Huang, Drew A. Hudson, Zhouyuan Huo, Linyi Jin, Christos Kaplanis, Dhrupad Karwa, Eunyoung Kim, Congtao Kuang, Eliot Laidlaw, José Lezama, Hao Li, Shuang Li, Yuchen Liu, Hanzi Mao, Mark Matthews, Matt McGill, Kay McKinney, Ricardo Monti, Mark Murphy, Joseph Ortiz, Roni Paiss, Frank Perbet, Ben Poole, Tal Reiss, Konstantinos Rematas, Guy Scully, Jeremy Shar, Shashank Shastry, Sri S, Omer Tov, Ruben Villegas, Andrey Voynov, Hongjie Wang, Luyu Wang, Kaustubh Sridhar, Mo Samsami, Stephen Spencer, Yufei Wang, Will Whitney, Rundi Wu, Joyce (Jingjing) Xie, Jesse Yin, Shiran Zada, Serena Zhang, Xiaofan Zhang, Zhengqi Li, Zhixing Zhang, Yuan Zhong, Shuo-yiin Chang, Dmitry Lagun, Ronny Huang, Yao Su, Ankush Gupta, Genzhi Ye, Haolin Jia, Weiqin Wang, Xi Xiong, Salah Zaiem, Carol Zheng, .
Genie 4 also required close collaborations across partner teams, we thank all our cross-functional partners that made this launch possible: Dina Bashkirova, Emil Bergner, Greta Borisko, Irina Blok, Melissa Byun, Gabe Clapper, Viral Carpenter, Michael Y. Chang, Maximo Cudich-Sieburger, Chloe Doan, Alisa Fortin, Shivani Ghanta, Vikram Gopali, Ezra Gorman, Khyatti Gupta, Sam Hasinoff, Philipp Henzler, Hector Hinestroza, Ed Hirst, Tyler Holland, Kristian Holsheimer, Tiffany Hu, Kapil Joshi, Randeep Katari, Pavan Kumar, Vikhyat Kumeria, Sam Kvaalen, Matthew Levine, Yinxiao Li, Yuchi Liu, Miao Luo, Nick Matarese, Kangfu Mei, Signe Nørly, Moises Oliveira, Eric Paskie, Manika Puri, Susanna Ricco, Andrey Ryabtsev, Cai Schumann, Nicole Brichtova, Andy Sekyere, Grace Shih, Melissa Smith, Duncan Noble Smith, Kenda Stewart, Rod Strougo, Jenn Sturgeon, Amy Zeng, Gaby Pearl, Eleanor Tomlinson, Kenyon Watson, Inês Ayer, Luke Talbot, Han-Yun Tsao, Guillaume Vernade, Karen Wang, Changchang Wu, Ian Wilkinson, Weijuan Xi, Jennifer Yick, Yunhan Zhao, Eric Zhang, Jason Zhang, Annie Zhou, James Zhou, Chris Walker, Alan Yam, Alex Chen, Cliff Lungaretti, Dan Motzenbecker, Kaloyan Kolev, Matthew Carey, Nate Zucker, Sam Lawton, Shashwath Santosh, Suz Chambers.
Thanks to Raia Hadsell, Aäron van den Oord, Josh Woodward, Steve Seitz, Carlos Hernandez, Elias Roman, Jung E. Kim, Abhishek Bapna, Eli Collins, Tulsee Doshi, Carolina Parada, Jie Tan, Koray Kavukcuoglu and Demis Hassabis for their insightful guidance and support throughout the research process.
Lastly, we thank our trusted tester and early access users that have provided feedback to help guide our research forward.
Genie 4
Genie 3: A new frontier for world models
How to create effective prompts with Genie
[Sponsor] WorkOS: Let Agents Sign Up for Your App Without a Browser
Daring Fireball
workos.com
2026-10-27 12:03:08
An agent can’t click through a signup page built for humans, so give it something it can read instead. Publish an auth.md file and agents register themselves without ever touching a browser login, and the user never gets pulled out of what they were doing.
With WorkOS auth.md, enroll in the dashboa...
A Markdown file an application hosts at its domain — typically
https://yourapp.com/auth.md
— that tells agents how to register on behalf of a user. It includes which flows are supported, which scopes exist, and how to register for the service.
The agent fetches your
auth.md
, picks a supported flow, and either presents a verified identity assertion (agent verified flow) or walks the user through a code-confirmation claim (user claimed flow). You stay in control of which flows you accept and what credentials get issued.
Agent verified is agent-attested — the agent's identity provider vouches for the user, no human in the loop. User claimed needs no provider — the agent shows the user a code, they sign in and confirm it. Most apps support both and let the agent pick the right one.
A scoped access token tied to the user — short-lived and revocable. It's issued over standard OAuth, so you reuse the API auth you already have.
It's open. WorkOS authors the protocol, but
auth.md
isn't tied to WorkOS infrastructure — it composes existing OAuth standards (Protected Resource Metadata, ID-JAG identity assertions) and any app can publish or any agent can read one with no WorkOS account required.
Apple Introduces New Base MacBook Pro With M6, 14-Inch-Only
Daring Fireball
www.apple.com
2026-10-27 12:00:46
Apple Newsroom’s “Pro and Tell” announcement week continues:
Apple today announced the new 14-inch MacBook Pro with M6,
delivering even more performance, powerful on-device AI
capabilities, and faster connectivity for college students,
business users, creators, and more. M6 features an advanced
...
Apple introduces
the new 14‑inch
MacBook Pro with M6
Supercharged by M6, the 14-inch MacBook Pro features incredible performance and next-level AI capabilities, enhanced connectivity, and up to 24 hours of battery life, delivering even more value
Supercharged by the all-new M6 chip, the 14-inch MacBook Pro brings extraordinary performance, AI capabilities, and up to 24 hours of battery life — making it an even more compelling value.
CUPERTINO, CALIFORNIA
Apple today announced the new
14-inch MacBook Pro with M6
, delivering even more performance, powerful on-device AI capabilities, and faster connectivity for college students, business users, creators, and more. M6 features an advanced 12-core CPU with the world’s fastest CPU core, so everything from productivity tasks to more demanding pro workflows feels incredibly fast and responsive.
1
The 12-core GPU delivers up to 30 percent faster graphics and up to 25 percent faster AI workloads when compared to M5, making the 14-inch MacBook Pro with M6 a compelling value for users who need serious power.
2
For those upgrading from M1, the performance gains are even more significant, with up to 11x faster graphics and up to 13x faster AI performance.
3
With additional Neural Accelerators in the GPU and a Dual 16-core Neural Engine, M6 turns MacBook Pro into an even more powerful platform for AI — from taking advantage of Siri AI and Apple Intelligence features across apps and macOS to running LLMs locally, all while preserving user privacy.
4
In addition, the 14-inch MacBook Pro features Wi-Fi 7 and Bluetooth 6, while superfast storage makes working with large files, exporting projects, and running demanding AI workflows fly. And with phenomenal battery life of up to 24 hours, it delivers the same remarkable performance whether plugged in or on battery, so users can work, create, and pursue their passions from anywhere.
3
It also offers the advanced features users love, including the stunning Liquid Retina XDR display with a nano-texture option, a 12MP Center Stage camera, an immersive six-speaker sound system, and a wide array of ports. Together with macOS 27, the new 14-inch MacBook Pro with M6 is a major upgrade for existing Mac users and those coming to Mac for the first time. Available in space black and silver, it can be pre-ordered beginning tomorrow, October 28, with availability starting Friday, November 6.
The new 14-inch MacBook Pro with M6 combines next-generation performance and powerful on-device AI in a portable design, empowering students, creatives, developers, and business professionals to take their workflows anywhere.
“The 14-inch MacBook Pro is the pro laptop of choice for a wide range of users — from college students, to business professionals across every industry, to multidisciplinary creators doing it all on one device,” said Shelly Goldberg, Apple’s vice president of Hardware Engineering. “With the powerful M6 chip, we’re taking performance to the next level, with a boost in CPU speed and graphics and even more powerful capabilities for on-device AI. With its amazing battery life, remarkable Liquid Retina XDR display, and even faster connectivity, the new 14-inch MacBook Pro with M6 delivers a fantastic combination of performance, capability, and value.”
M6 makes the 14-inch MacBook Pro faster than ever, thanks to a powerful 12-core CPU, advanced 12-core GPU, and Dual 16-core Neural Engine.
M6: Blazing-Fast Performance and On-Device AI Capabilities
M6 brings even more performance and next-level AI capabilities to the 14-inch MacBook Pro. Featuring a powerful 12-core CPU, a 12-core GPU with Neural Accelerators in each core, Dual 16-core Neural Engine, and faster unified memory, MacBook Pro with M6 is faster and more responsive.
The 12-core CPU, with two more cores than before, brings blazing-fast single- and multithreaded performance, so users can fly through everything from multitasking across apps to compiling code to handling complex creative workflows. The 12-core GPU, also with two additional cores, delivers up to 30 percent faster graphics performance when compared to M5.
2
Everything from 3D modeling to photo editing and gaming feels incredibly fast, enhanced by a third-generation ray-tracing engine and Dynamic Caching to optimize on-chip memory. It also brings up to 25 percent faster performance for on-device AI workloads, like LLM prompt processing, compared to M5.
3
The Dual 16-core Neural Engine delivers up to 1.9x faster performance than M5 and works with the advanced GPU to dramatically accelerate AI workloads like image generation, Super Resolution, and AI upscaling.
2
The Neural Engine also powers Apple Intelligence, enabling advanced and energy-efficient on-device AI processing. The 14-inch MacBook Pro with M6 does all this with industry-leading performance per watt and up to 24 hours of battery life, the longest ever in a Mac. With 16GB of unified memory standard, configurable up to 32GB, and higher memory bandwidth up to 170GB/s, MacBook Pro makes multitasking and working with demanding apps and large projects even faster.
The 14-inch MacBook Pro with M6 helps motion designers model 3D objects, design product visualizations, and render animations with ease.
The 14-inch MacBook Pro with M6 enables
:
3
Up to 13x faster time to first token performance for LLM prompt processing compared to the 13-inch MacBook Pro with M1, and up to 1.3x faster than the 14-inch MacBook Pro with M5.
Up to 11.7x faster render performance with ray tracing in Blender compared to the 13-inch MacBook Pro with M1, and up to 1.3x faster than the 14-inch MacBook Pro with M5.
Up to 3.3x faster image-processing performance in Affinity compared to the 13-inch MacBook Pro with M1, and up to 1.2x faster than the 14-inch MacBook Pro with M5.
Up to 2.5x faster project build performance when compiling code in Xcode compared to the 13-inch MacBook Pro with M1, and up to 1.3x faster than the 14-inch MacBook Pro with M5.
Film editors and content creators can quickly and efficiently composite visual effects and add cinematic motion graphics in popular video editing tools on the 14-inch MacBook Pro with M6.
Photographers and designers can make complex AI-powered image adjustments in real time using apps like Pixelmator Pro on the 14-inch MacBook Pro with M6.
Developers can build and test their apps with blazing-fast compile times in Xcode on the 14-inch MacBook Pro with M6.
A Huge Upgrade with Even More Value
There’s never been a better time for customers to upgrade from a previous-generation MacBook Pro with Apple silicon or an Intel-based Mac. The 14-inch MacBook Pro with M6 delivers remarkable value thanks to major performance improvements and powerful AI capabilities. The new 14-inch MacBook Pro also features all of the compelling capabilities that have made it so popular, including:
Phenomenal battery life
: In addition to the huge leap in performance, battery life gets up to 14 additional hours for Intel-based upgraders and up to four more hours for users coming from M1, delivering up to 24 hours overall, so users can get more done on a single charge. Users coming from Intel-based and M1 systems will also get 16GB of starting unified memory, an additional Thunderbolt port, and the space black finish with an anodization seal for fewer fingerprints.
A brilliant pro display
: The stunning Liquid Retina XDR display delivers up to 1600 nits of peak HDR brightness and a 1,000,000:1 contrast ratio, bringing HDR photos and videos to life with deep blacks, brilliant highlights, and vibrant colors. And for users working in bright or challenging lighting conditions, a nano-texture display option dramatically reduces reflections and glare.
Powerful connectivity
: Now with Wi-Fi 7 and Bluetooth 6, the 14-inch MacBook Pro delivers fast wireless performance and low latency, along with support for up to two external displays. Its versatile array of ports — including the HDMI, MagSafe 3, and three Thunderbolt 4 ports; an SDXC card slot; and a headphone jack — makes it easy to connect high-speed peripherals, transfer photos, or expand a workspace.
Advanced camera, mics, and speakers
: A 12MP Center Stage camera with Desk View helps keep users perfectly framed on video calls, while a studio-quality three-mic array and amazing six-speaker sound system with Spatial Audio deliver an immersive audio experience.
Fast charging
: MacBook Pro with M6 supports fast charging, reaching up to 50 percent charge in just 30 minutes when paired with a compatible higher-wattage USB-C power adapter, such as the 96W Power Adapter.
3
A laptop that’s built to last
: With an enclosure made from 100 percent recycled aluminum, MacBook Pro is exceptionally durable and can stand up to everyday use for years to come.
Better together with iPhone
: When used together with Continuity, iPhone and Mac are even more powerful — letting users move seamlessly across devices to share files and photos, hand off tasks, and even control their iPhone from their 14-inch MacBook Pro.
5
Users switching to Mac for the first time can use iPhone to conveniently and securely transfer settings, files, photos, passwords, and more.
The brilliant Liquid Retina XDR display delivers up to 1600 nits of peak HDR brightness and a 1,000,000:1 contrast ratio. HDR photos and videos look more true to life with deep blacks, brilliant highlights, and vibrant colors.
With the new 14-inch MacBook Pro, users can connect high-speed peripherals, transfer photos, work with multiple external displays, and more with its wide array of ports.
macOS 27 Golden Gate
The new 14-inch MacBook Pro with M6 comes to life with macOS 27, which includes Siri AI, a profoundly more capable, conversational, and personal assistant; helpful Apple Intelligence features across everyday apps; and improvements that make the Mac even more responsive and reliable. Siri AI can draw on personal context to help users find what they need in the moment across messages, emails, photos, and more; answer questions about virtually any topic; and get things done across apps — all with groundbreaking privacy protections. Siri AI is integrated into Spotlight and systemwide context menus, and users can ask Siri about what’s on their display with Visual Intelligence using a dedicated keyboard shortcut. Users can also write and edit with Siri almost anywhere they type.
Additionally, Apple Intelligence makes apps smarter and more useful. In Safari, it powers new tools that automatically organize a user’s tabs into topics; notify them of website changes, like product restocks or price drops; and enable the creation of custom extensions based on a description. Users can also easily create an automation in Shortcuts by simply describing it, or tap into intelligent photo editing tools in the Photos app. The new 14-inch MacBook Pro gets even more responsive, reliable, and delightful with refinements to design, performance, search, and more. Updates to Liquid Glass deliver an even more focused and approachable experience. A new slider in Settings gives users the option to personalize Liquid Glass, adjusting it anywhere from ultraclear to fully tinted to match their preference, and app icons are sharper and more defined.
14-inch MacBook Pro with M6 and the Environment
The new 14-inch MacBook Pro with M6 was built with the environment in mind and drives progress toward Apple’s ambitious plan to be carbon neutral across its entire footprint by 2030. It is made with 45 percent recycled content overall,
6
including 100 percent recycled aluminum in the enclosure, 100 percent recycled cobalt in the battery, and, in a first for Apple, 100 percent recycled tantalum in multiple capacitors. It is manufactured with 60 percent renewable electricity, such as wind and solar, across the supply chain. The 14-inch MacBook Pro with M6 is designed to be durable and repairable, and meets Apple’s high standards for energy efficiency and safe chemistry. As with all Apple products, its paper packaging is 100 percent fiber-based
7
and designed to be recycled.
Customers can pre-order the new 14-inch MacBook Pro with M6 starting tomorrow, October 28, on
apple.com/store
and in the Apple Store app in 35 countries and regions, including the U.S. It will begin arriving to customers, and in Apple Store locations and Apple Authorized Resellers, starting Friday, November 6.
The 14-inch MacBook Pro with M6 starts at
$1,999
(U.S.) and
$1,899
(U.S.) with
education savings
. Additional technical specifications and configure-to-order options are available at
apple.com/macbook-pro
.
With
Apple Upgrade
, eligible customers in the U.S. can lease a new Mac with low monthly payments and easily upgrade at the end of their lease.
8
Lease the 14-inch MacBook Pro with M6 with Apple Upgrade from
$38.99
(U.S.) per month, excluding taxes and any trade-in credit, for 36 months.^
With Apple Trade In, customers can trade in their current computer and get credit toward a new Mac. Customers can visit
apple.com/shop/trade-in
to see what their device is worth. With year-round education pricing — available to current and newly accepted college students and educators — customers can save on MacBook Pro, along with a wide range of products and services through the Apple Store online and in stores. Visit the
Apple Education Store
for details. Customers in the U.S. who shop at Apple using Apple Card
9
can pay monthly at 0 percent APR when they choose to check out with Apple Card Monthly Installments,
10
and they’ll get 3 percent Daily Cash back — all up front. More information — including details on eligibility, exclusions, and Apple Card terms — is available at
apple.com/apple-card/monthly-installments
.
AppleCare delivers exceptional service and support, with flexible options for Apple users. Customers can choose AppleCare+ to cover their new Mac or, in available markets, AppleCare One to protect multiple products in one simple plan. Both plans include coverage for accidents like drops and spills, theft and loss protection on eligible products, battery replacement service, and priority support from Apple Experts. In the U.S., customers can also choose AppleCare One Family, which extends that same coverage to every eligible device across an Apple Family Sharing group for one fixed monthly price. For more information, visit
apple.com/applecare
.
Every customer who buys directly from Apple gets access to Personal Setup. In these guided one-on-one online sessions, a Specialist can walk them through setup or focus on features that will help them make the most of their new device. Customers can also learn more about getting started and going further with their new device with a Today at Apple session at their nearest Apple Store.
Testing was conducted by Apple in October 2026 using shipping competitive systems and select industry-standard benchmarks.
Results are compared to 14-inch MacBook Pro with M5, 10-core CPU, 10-core GPU, 32GB of unified memory, and 4TB SSD.
Testing was conducted by Apple in September 2026. See
apple.com/macbook-pro
for more information. Battery life varies by use and configuration. See
apple.com/batteries
for more information.
Apple Intelligence is available with Siri and device language set to Chinese (simplified), Chinese (traditional), Danish, Dutch, English, French, German, Italian, Japanese, Korean, Norwegian, Portuguese, Spanish, Swedish, Turkish, or Vietnamese. Some features may not be available in all regions or languages. Some devices may not be available in all regions. Siri AI is available in beta in macOS 27.2 and requires an Apple Intelligence-enabled device set to a supported language. It is available in English, French, Japanese, Korean, Portuguese, and Spanish. Some features may not be available in all regions or languages. Siri AI is currently unavailable in the EU in iOS, iPadOS, and watchOS. Apple is working constructively with the EU in an attempt to find a path forward. Siri AI is not available for users under 13. Certain Apple Intelligence features that rely on server-side models are subject to daily usage limits, including but not limited to Siri AI, intelligent photo editing tools, Image Playground, and AFM 3 Cloud models in Shortcuts. Daily limits may vary by feature, request complexity, system demand, system policies, and other factors. Expanded access to such features will be available for a fee in the future. Use of these features is subject to the Apple Intelligence terms and conditions. Learn more at
support.apple.com/148587
.
iPhone Mirroring is available on Mac computers with Apple silicon and Intel-based Mac computers with a T2 Security Chip. Requires that the user’s iPhone and Mac are signed in with the same Apple Account using two-factor authentication, their iPhone and Mac are near each other and have Bluetooth and Wi-Fi turned on, and their Mac is not using AirPlay or Sidecar. Some iPhone features (e.g., camera and microphone) are not compatible with iPhone Mirroring.
Product recycled or renewable content is the mass of certified recycled material relative to the overall mass of the device, not including packaging or in-box accessories.
Breakdown of U.S. retail packaging by weight. Adhesives, inks, and coatings are excluded from Apple’s calculations of plastic content and packaging weight.
Apple Upgrade is a device leasing program available in the U.S. (excluding U.S. territories). Leases are provided by Klarna; subject to eligibility and credit approval, including final approval at checkout. To be eligible, you must be a U.S. resident, at least 18 years old (or the legal age in your state), have an accepted credit or debit card, and have an Apple Account. Additional eligibility criteria apply. Device must be in good condition upon return; damage fees may apply. For iPhone only: In order to lease an iPhone, you must select an eligible carrier (but you cannot use a prepaid carrier plan). Upgrades require entering into a new lease and are subject to eligibility and credit approval. Apple Upgrade is not available on refurbished devices or online at the following special stores: Apple Employee Purchase Plan; participating corporate Employee Purchase Programs; Apple at Work for small businesses or enterprises; Government, Education, or Veterans and Military Purchase Programs.
Apple Card is subject to credit approval, available only for qualifying applicants in the United States, and issued by Goldman Sachs Bank USA, Salt Lake City Branch.
Apple Card Monthly Installments (ACMI) is a 0 percent APR payment option that is only available if users select it at checkout in the U.S. for eligible products purchased at Apple, and is subject to credit approval and credit limit. See
support.apple.com/en-us/102730
for more information about eligible products. Additional limits and restrictions apply. See the Apple Card Customer Agreement for more information about ACMI.
^ This offer is for a consumer lease, not a purchase or loan. Lease provided by Klarna Inc. for 24- or 36-month term. Your first monthly payment is due approximately 30 days after device is shipped or available for pickup. Lease approval is subject to eligibility and is based on creditworthiness. Monthly payments are based on the selected device and lease term.
For example: For the 14-inch MacBook Pro with M6 with a purchase price of $1,999 (excluding taxes and any trade-in credit), the typical monthly payment is $38.99 (excluding taxes and any trade-in credit) for a 36-month lease term and $53.99 (excluding taxes and any trade-in credit) for a 24-month lease term.
No security deposit required. A trade-in device may reduce monthly payments. Advertised monthly payment amount may not include a trade-in device’s estimated value. Upgrades are not guaranteed and are subject to eligibility and approval.
Terminating your Apple Upgrade lease
: Closing your lease and returning your device terminates your lease. You may incur a substantial charge up to the amount of your remaining lease payments if you terminate your lease before the end of your initial lease term. You may have the option to upgrade to a new device by entering into a new lease agreement and returning your prior device. If you upgrade, your new monthly payments may be greater than your prior monthly payments. If you do not upgrade, terminate your lease, or purchase your device by the end of the initial lease term, the lease will convert to a month-to-month lease for up to six months. Your monthly payments may increase during the month-to-month period. If you take no action at the end of your extension period, you will be charged for the amount due to exercise the purchase option under your lease. You will not own your device at the end of your lease, unless you pay the amount due to exercise the purchase option. Insurance is not included in your lease, and you may incur damage fees if the device is lost, stolen, or not returned in the condition required by the lease.
Apple Upgrade lease eligibility
: Leases are only available to U.S. residents (excluding residents of U.S. territories). Leased devices are only available for shipping to U.S. addresses (excluding U.S. territories) or pickup at Apple Retail stores in the U.S. (excluding U.S. territories). To be eligible for a lease, you must be at least 18 years old (or the legal age in your state of residence), have a valid Social Security number or individual taxpayer identification number (ITIN), have an accepted credit or debit card, have an Apple Account in good standing, have a Klarna account, and be able to receive security verification codes via text message. Leases are not available on refurbished accessories or online at the following special stores: Apple Employee Purchase Plan; participating corporate Employee Purchase Programs; Apple at Work for small businesses or enterprises; Government, Education, or Veterans and Military Purchase Programs.
Stay up to date with the latest articles from Apple Newsroom.
Anthropic trained Claude on illegally obtained Stanford professors' books
AI giant Anthropic illegally scraped and pirated the work of over 10 Stanford professors to train its Claude models, a federal judge ruled in a May 2026 lawsuit.
Anthropic previously trained Claude on illegally obtained texts from professors Tobias Wolff, Abraham Verghese, Chang-Rae Lee, Daniel Mason, Hayagreeva Rao and Myra Strober. In Bartz v. Anthropic, which the Authors Alliance
calls
the largest copyright settlement involving an AI company, Judge William Alsup ruled that Anthropic could no longer pirate books to create a permanent central library.
While blocking the piracy of work to train AI, Alsup justified the legal acquisition of books to train Claude’s Large Language Models (LLMs) as fair use. He
compared
AI training to how humans can read, internalize and remember a book’s themes and style. “Like any reader aspiring to be a writer, Anthropic’s LLMs trained upon works not to race ahead and replicate or supplant them — but to turn a hard corner and create something different,” he wrote.
The $1.5 billion settlement went to authors and publishers of nearly 500,000 registered works. Wolff and 27 other authors say the settlement isn’t enough.
“To put me to work that way, without remittance, is a form of slave labor,” said Wolff, professor emeritus of English and winner of the National Medal of Arts. “They’re using my work without paying for it. As time goes on, they’re going to make the lives of writers very difficult if there’s no fruit to their labor.”
10 of Wolff’s publications had been used for AI training without permission.
“[The settlement] still gives Anthropic pretty free rein to roam through our literature and basically take what they think will be useful and profitable for them,” Wolff said.
Wolff, along with English professor Chang-rae Lee, opted out of the Bartz settlement. In May 2026, they filed the separate non-class lawsuit Cruz v. Anthropic, seeking a jury trial for full statutory damages of up to $150,000 per infringed work, surpassing the approximate $3,000 of damages per work offered in the Bartz settlement.
Similar to the claims in Bartz, the plaintiffs allege that Anthropic illegally downloaded, reproduced and distributed their copyrighted books from “shadow libraries” like LibGen and PiLiMi, and that Anthropic broke the law by downloading and storing the pirated files in a central library.
“Our agents didn’t think the blanket lawsuit covered quite enough of the liability to us and are seeking redress in more particular ways,” Wolff said.
If Wolff and his fellow authors are successful, they would gain a permanent injunction against Claude model training using their works.
Paul Goldstein, a Stanford Law leading scholar in intellectual property and one of the plaintiffs represented in the class action, acknowledged the difficulty of addressing and preventing copyright issues for AI companies.
“The essential problem … is what economists call ‘transaction costs,’” Goldstein wrote in an email to The Daily. “Millions of individual copyrighted works may be copied in the course of any training incident, and it’s simply impracticable for the platform to obtain licenses from the copyright owner of every — or, indeed, any — single work.”
Outside of Bartz and Cruz, many authors, visual artists and news outlets, including The New York Times and Getty Images, have filed over 70 infringement lawsuits against AI companies. While Bartz established the current rule for pirating books, the legal future of mass scraping AI models used to train LLMs remains uncertain.
The Authors Guild is also pursuing other lawsuits, including one against OpenAI and Microsoft, as part of a “multi-pronged approach to ensure that the law is clear that AI companies must license the books they use,” according to The Authors Guild Chief Executive Officer Mary Rasenberger.
“Licensing allows authors and publishers to be compensated and to require the use of filters that ensure their works do not appear in outputs unless separately licensed,” Rasenberger wrote in an email to The Daily.
The Authors Guild is working with Congress to create national legislation that will require licensing.
“The Guild is up for the challenge,” Rasenberger wrote. “This is something we have been doing for 114 years, and the moment we are in today, while challenging, also presents opportunities for us to firmly realize our mission.”
For Wolff, this support is critical for the next generation of writers.
“I’m lucky that I’m able to have a life as a writer where I enjoy the profits of my work,” Wolff said. “I worry much more about the young writers I’ve worked with at Stanford and elsewhere being able to do that in the face of these technological challenges, because they’re very hard to grasp and to combat.”
Some authors are waging these difficult legal battles to achieve a sense of credit for their work, outside of the settlement payment.
“Attribution … is very important to the vast majority of authors, and not just academic authors,” Goldstein wrote. “The great majority of countries have something called the ‘moral right of attribution’ on the books to ensure that authors are credited for their work. The U.S., alone among industrialized nations, has no such moral right, which is a terribly unfortunate situation for authors generally.”
As Stanford authors and AI companies continue to navigate copyright challenges for training, both sides must navigate a “foreign land,” Wolff said, meeting at the intersection of creative rights and technological growth.
Anthropic accelerates – for the rest of us, the speed of growth spells precarity
Guardian
www.theguardian.com
2026-10-27 11:15:20
The AI industry is still defined by a careening intensity that’s taking the world’s finances along for the rideThis was originally published in TechScape, a newsletter about how technology shapes our lives. Sign up to receive it here.Today in tech, we’re discussing Anthropic’s astronomic growth, how...
Today in tech, we’re discussing
Anthropic
’s astronomic growth, how a settlement over social media safety dented Meta’s revenue, and Lula’s accusations of interference against
Meta
.
Anthropic accelerates
Anthropic filed for an initial public offering on the US stock market on Monday, ahead of what it slated to be one of the biggest debuts in financial history. The company withheld a valuation from its filing with US financial regulators, but investors and analysts are valuing the
AI
firm at north of $1.5tn.
The numbers are jaw-dropping and speak to the speed of the AI boom.
Anthropic
was founded in 2021. That’s only five years ago, yet already it has grown to a valuation bigger than 98% of the top companies on the US stock market.
Anthropic detailed rapidly rising revenue in the prospectus: $41m in 2023, $386m in 2024, $4.585bn in 2025 (a yearly increase of more than 1,000%), then $16.286bn in the first six months of 2026 alone. The company disclosed that, as of the end of June, it had raised $141.1bn.
Despite the increasing revenue, Anthropic disclosed a net loss of $80bn for the first half of 2026, mostly due to a one-time $72.4bn charge. It lost $36bn the year prior.
Anthropic’s initial public offering will rock the US stock market and probably global markets as well. The infusion of at least a trillion dollars in value is likely to influence investor appetites for every kind of technology stock. That a company of that magnitude can be spun up in five years speaks to the breakneck pace of AI development and financing. Despite calls to slow down from Anthropic’s CEO, Dario Amodei, the artificial intelligence industry is still defined by a careening intensity that’s taking the world’s finances along for the ride.
Such rapid growth demonstrates an upside for company founders for now. They can build a business that creates life-changing, globe-spanning wealth in just half a decade.
For the rest of us, the speed of growth spells precarity. Anthropic, a company that could determine the direction of the entire US economy, is going public before a baby born in its founding year has started kindergarten.
Settlements over the safety of social networks are growing so large that Meta is reporting significant drags on its business.
In August, the biggest social media company in the world agreed to a $17bn settlement with dozens of state attorneys general to put claims it had endangered children to rest without admitting guilt.
In a quarterly earnings report last week, issued the same afternoon as a judge ordered the company to pay the state of New Mexico $25bn, Meta reported net income significantly below Wall Street analysts’ expectations because of a payment towards the settlement with attorneys general, this one $9.9bn.
The dent in Meta’s business is a sign that child safety activists are succeeding. In the Los Angeles social media addiction lawsuit that took place earlier this year, lawyers for the plaintiff made it clear they’re intent on making it untenable for Meta to operate the current version of Instagram. They want to render endangering children, which they believe Meta is doing, too expensive to continue. They hope to push the company to the point where business as usual is untenable because of the financial risks of safety.
Activists can’t celebrate yet, though. Despite the hefty payments, Meta still reported a 26% increase in quarterly revenue up to $64.6bn.
This is how Agent Smith is built every day, across more than a thousand specs.
Verified
A fresh reviewer checks the spec against the code before the build. A gate runs your checks before the commit.
Parallel
One branch and worktree per spec. Ids come from the clock, so two agents never take the same one.
Uninterrupted
A reviewed spec has already answered the open questions, so the agent builds to its done criteria instead of coming back to ask.
Structured
One spec, one branch, one commit. A pull request carries one spec or a whole series, and every change has the same shape.
Resumable
State lives in
context.yaml
. Restart the machine or the agent and the work picks up where it stopped.
Explained
, as a side effect
Each choice is logged with what it beat and why, so the reasoning stays next to the code.
A whole series, side by side
Cut a bigger change into a series of specs.
/spec-first:deliver-series
reviews all of them, builds the groups that share no file at the same time, verifies the merged tree and opens one pull request.
deliver-series 2026-10-27-8a3f
5 specs · 3 groups
building
a
tickets-provider-contract
requires nothing
1
b
tickets-github-provider
requires a
1
c
tickets-jira-provider
requires a
1
d
settings-provider-page
requires nothing
2
e
ci-restore-cache
requires nothing
3
An example run of
/spec-first:deliver-series
. Specs that share no file are built at the same time; specs that depend on each other share a group.
One spec, from idea to pull request
Four skills take a piece of work through its own branch and worktree. Each one leaves a file behind for the next step and for whoever reads the history later.
create-spec
Goal, steps, facts with file and line, what done means. No code yet.
specs/planned/{id}.yaml
review-spec
Every citation resolved, then a reviewer who never saw the chat attacks it.
BUILD · CUTS · REFUSE
apply-spec
Contracts, code, wiring, tests, following the project's own rules.
decisions/{id}.yaml
deliver-spec
One commit through the gate, pushed, pull request opened.
feat: … ({id})
The record
grows with every spec, read before every step
specs/
Every spec, from planned to done, with its facts and done criteria.
decisions/
What each spec chose, what it chose over, and why.
memory/
What you told the agent once, so you don't say it twice.
/spec-first:bootstrap-project
writes the contexts once from your code: stack, rules and the checks a commit must pass. After that, each spec adds one line of state.
A spec is reviewed before anyone builds it
A REFUSE costs you one spec. Without the review, the same mistake would have cost you the branch.
Spec
2026-10-27-8a3f
Applies to
server
Branch
spec/8a3f
Goal
Ticket providers so pipelines can pull work from GitHub and Jira.
Facts, read in the code
Pipelines take work only from the CLI today
Program.cs:40-58
Config already carries a tracker section
AppConfig.cs:12-19
Decision
Adapter over repository: read-mostly data, no unit of work needed.
Done when
GitHub provider returns tickets end to end
Jira provider behind the same interface
verify: stages green
REVIEWED · BUILD
fresh reviewer · 27 OCT
review-spec · 2026-10-27-8a3f
2 cuts
✓ src/Host/Program.cs:40-58 resolves
✓ src/Config/AppConfig.cs:12-19 resolves
evidence resolves: 1 spec
BUILD WITH CUTS
the spec holds once two steps change
CUT 1
Step
jira
needs a second auth mode the config can't hold yet.
AppConfig.cs:15
Move it to its own spec.
CUT 2
Paging is missing: GitHub returns 30 issues per page.
GitHubClient.cs:88
Add a done criterion.
Every citation is checked
A script opens each file and line the spec cites. A claim nobody checked in the code has to be listed as an assumption.
The reviewer starts fresh
A new agent with no conversation history reads the code as it is, not as the spec says it is.
One verdict, with cuts named
BUILD, BUILD WITH CUTS or REFUSE, and every finding names a file and a line.
The reasoning comes along for free
Nobody has to write documentation afterwards. While it builds, the agent logs each choice that wasn't obvious: what it chose, what it chose over, and why. One file per spec, next to the code.
decisions/2026-10-27-8a3f.yaml
spec: 2026-10-27-8a3f
decisions:
- category: TradeOff
chose:"Raw HttpClient for the GitHub API"over:"Octokit"reason:"Three megabytes of dependencies
for four calls."
- category: Architecture
chose:"One ITicketProvider per tracker"over:"A generic REST mapper"reason:"Each tracker pages and authenticates
differently; the mapper would leak it."
No wiki to keep alive
cat decisions/*.yaml
is the project's reasoning, spec by spec, in the same history as the code it explains.
Memory for what git can't tell
How the operator wants things done, a constraint outside the repo, a pointer elsewhere. One fact per file, one line in an index.
Back in thirty seconds
Restart the machine, restart the agent, open
context.yaml
. It knows what is done, what is active and what comes next.
Nothing lands past a red stage
The plugin's commit gate runs every verify stage your contexts declare when a commit names its spec. All green, it commits. The first red stage blocks it, and its output goes back to the agent.
A spec commit with no line in the ledger never met the gate. A project with its own gate says
gate: project
, and the plugin steps aside.
Built this way
Agent Smith
The open source agentic software factory: a ticket goes in, a verified pull request comes out. Agent Smith is entirely built with this method, and the method grew out of building it. Everything in the plugin ran there first.
Counted in the Agent Smith repository, October 2026.
Install
In Claude Code the plugin does the bookkeeping and runs the gate. Other agents follow the same files through
AGENTS.md
, and a git hook runs the same gate.
Then run
/spec-first:bootstrap-project
. It reads your code and writes the contexts and rules from what it finds.
create-spec
Writes the spec on its own branch and worktree
review-spec
Evidence check, then a fresh reviewer's verdict
apply-spec
Builds the spec up to its done criteria
deliver-spec
Commits through the gate and opens the pull request
deliver-series
Takes a whole series of specs to one pull request
log-decision · update-project · bootstrap-project
Decisions, upgrades, setup
Questions about spec-first agentic development
Specification-driven agentic development, in short answers.
What is spec-first agentic development?
A way of working with AI coding agents in which every change starts as a written spec in your repository. A fresh reviewer checks the spec against your code before anything is built, the agent builds it on its own branch and worktree, and the commit lands only when your checks pass.
What does specification-driven agentic development mean here?
The spec drives the work from start to finish. It names the goal, the facts it rests on with file and line, the steps and the done criteria, and the agent builds to exactly that. Spec-first agentic development is specification-driven agentic development in which the spec is reviewed against the code before the first line is written.
Do I need Claude Code?
No. The Claude Code plugin runs the steps as commands. Codex, Cursor, Copilot or a terminal follow the same files through AGENTS.md, and a git commit-msg hook runs the same commit gate in every clone where it is installed.
How does it differ from vibe coding?
You still describe the feature in your own words and talk it through. After that, the agent works from a reviewed spec instead of from the last prompt, logs each decision with its reason, and a commit lands only when your build and tests pass.
What does a spec contain?
A one-sentence goal, the facts it rests on with file and line, the steps, what an upgrade costs an operator, and the done criteria. The decisions made while building go into a separate YAML file next to it.
What does it cost?
Nothing. The method, the templates and the Claude Code plugin are MIT licensed.
Where it comes from
A $300B 'Debt Wall' Is Looming over Private-Equity Backed Companies
Pentagon Fears Drone Attacks on U.S. and Foreign Bases
Intercept
theintercept.com
2026-10-27 11:00:07
Government officials said a series of recent attacks and threats have highlighted the vulnerability of U.S. military bases.
The post Pentagon Fears Drone Attacks on U.S. and Foreign Bases appeared first on The Intercept....
Top defense officials
are expressing increasing worry about the vulnerability of U.S. bases around the world and even within the United States as cheap drone technology upends long-standing defense strategies.
The fear is mounting after a series recent attacks and threats against ground targets, including the destruction of key bases in the Middle East by Iran, plots against mega-bases in Europe, including to U.S. bombers at a British air base, and a Russian campaign that damaged European military facilities, according to two government officials.
While the Pentagon is notorious for inflating threats to
press for additional funding
, the officials stressed that the anxiety is real, not invented. Despite the U.S. military’s
enormous budget
, they say, the United States now finds itself scrambling strengthen its fortifications, protect its costly equipment, and recall personnel from some locations.
“Now all the world knows what the SecDef should have,” said one of the officials.
Foreign adversaries have taken notice of Iran’s
ability to defeat
U.S. air defenses
using missiles and drones
, they said. The officials drew specific attention to Tehran’s ability to damage or destroy bases that have been the key to U.S. power-projection and war-making for decades in the Middle East.
An Iranian missile and drone attack on February 28 destroyed Navy facilities in Manama, Bahrain, the region’s most critical logistics hub. The Combined Air Operations Center at Al Udeid Air Base, Qatar, was
severely damaged by Iranian missiles
early in the war, rendering it inoperable. Both were recently
attacked again
, raising questions about whether either will ever be rebuilt. The destruction of these bases has fundamentally altered America’s future force posture in the region, according to the officials. One of them called it a “seismic shift.”
On Friday, the Trump administration leaked highly classified intelligence to
Fox News
and
Axios
suggesting Iran has “substantially increased” efforts to target U.S. diplomats and other officials in the Middle East and beyond. The October 23 memo claimed that “the lethal plotting efforts by the Iranians against U.S. citizens have reached advanced stages.” A U.S. official confirmed the accuracy of the intelligence but questioned the motives of the “official leak,” suggesting it’s part of a case being built to justify
renewing
the
failed war
.
The leak came as the State Department ordered a further reduction in staff at multiple diplomatic posts across the Middle East, including in Jordan, Lebanon, Qatar, Saudi Arabia, and the United Arab Emirates. One of the officials said the move “definitely” spoke to America’s inability to defend its assets overseas. Those fears now extend to the United States, according to the officials.
Last month, buried in an unhinged address to troops in which he attacked the press and those within the military he calls
beardos
, weirdos, and wimps, self-styled War Secretary Pete Hegseth tacitly acknowledged the vulnerability of U.S. domestic bases, noting that the Pentagon was now “hardening every installation on American soil” against “sabotage and drones.” And last week, the Pentagon quietly began seeking advice on new ways to protect bases by using innovative advanced materials, camouflaging facilities, obscuring their thermal and electromagnetic signatures, hiding them underground, and making them more resilient in the face of successful attack by adversaries, according to a special notice issued by a top Pentagon official.
As the Pentagon refines this “base of the future” concept, Iran is teasing a “
war of the future
” effort that builds on its
successes
in
throttling the Strait of Hormuz
, regionalizing the war, and battering U.S. bases, according to Mahdi Mohammadi, a senior adviser to Mohammad Bagher Ghalibaf, the lead negotiator and speaker of Parliament. “The second generation of surprises will be on their way; at the time and place of our choosing, in the manner we have devised, and with the creativity that only our unparalleled fighters can muster,” he wrote
on X
, teasing how Iran would respond if America ramps up the war.
Iran’s successful attacks on U.S. bases have added to the growing realization that foreign adversaries, proxies, terror groups, and lone wolf actors can use low-cost, easily obtained drones to attack the military bases, aircraft, and military personnel of the U.S. and its allies.
While Iran dominated the headlines for months, officials became increasingly worried about danger from Russian attacks. “When do we stop calling it gray zone?” asked a third official briefed on the intelligence, referring to a Russian drone attack on a massive air freighter, used to carry military assistance to Ukraine, at
Leipzig/Halle Airport in Germany
in August. One drone hit the cargo plane but failed to explode, another struck a different aircraft, and a
third
was found near the airport. “That’s what Putin always does. He keeps testing us, pushing us, to see how far he can go,” said the official. That official and another said that the intelligence proved there was “no question” that
Russia was behind
the operations. Russia has denied responsibility.
The August drone attack was part of a monthslong campaign of nonstop sabotage, cyberattacks, and psychological operations against NATO nations. “These were happening in sequence from earlier in the year, through August, through September and they didn’t show any signs of stopping,” said the third official. But the attacks slowed or stopped after President Donald Trump announced earlier this month that the United States would
buy Russian diesel
in an effort to bring down fuel prices before the midterm elections and called on Ukraine to stop striking oil Russian refineries.
The officials noted that Pentagon leadership has been slow to respond to the changing nature of warfare, specifically drawing attention to tactics honed by Ukraine in its war with Russia. Earlier this month, for example, intelligence suggested that Iran’s Islamic Revolutionary Guard Corps was planning a complex drone attack on U.S. B-1 bombers used to attack Iran, and U.S. personnel at Royal Air Force Fairford air base. The plot, they said, was to launch small drones from just beyond the bases’ fenceline, attacking the supersonic bombers, which were not in hardened shelters but in the open on the tarmac. They noted that the plot appeared to be patterned on a Ukrainian attack, dubbed Operation Spider’s Web, against Russia last year. The plot so unnerved top military officials that the
bombers were flown out
while some aerial refueling aircraft were still being deployed to support their panicked flights back to the U.S. In addition to RAF Fairford, U.S. officials referenced additional threats against other bases in Europe, including Ramstein Air Base in Germany.
Last August, Hegseth established Joint Interagency Task Force 401 to deliver “C-sUAS” or counter-small unmanned aircraft system “capabilities to America’s warfighters, [to] defeat adversary threats, and promote sovereignty over national airspace.” But an
inspector general report
from January said “immediate attention” was required to protect the most critical bases in the U.S. against drones and noted that Pentagon “documents contradict one another and do not speak to certain aspects of C-UAS authorities and capabilities.” The IG found also that key “military installations, government-owned, contractor-operated facilities, and contractor-owned, contractor-operated facilities conducting critical missions” were not even designated for protection.
In March, small drones flew over Louisiana’s Barksdale Air Force Base, the home of Global Strike Command which oversees America’s bomber fleet and its intercontinental-ballistic missiles. And the IG report mentions “10 DoD installations and activities where Unmanned Aircraft Systems (UAS) incursions have occurred.”
Late last month, the Air Force
awarded a contract
for counter-drone systems for Joint Base McGuire-Dix-Lakehurst in New Jersey. The military has also been looking into drone-killing technologies to defend Yokota Air Base in Tokyo, Japan; Minot Air Force Base in North Dakota; Battle Creek Air National Guard Base in Michigan; and Shaw Air Force Base in South Carolina, among other facilities.
Two of the officials suggested that new Pentagon plans for military base modernization are rooted in an uneasy acknowledgment that
U.S. outposts
around
the world
— including within the continental United States — are increasingly vulnerable to complex and asymmetric attacks. A recent Pentagon inspector general report
revealed
Iranian strikes “damaged and destroyed hundreds of buildings and structures at U.S. bases in Kuwait, Bahrain, Qatar, UAE, Saudi Arabia, Iraq, Oman, and Jordan during the conflict.”
Hegseth’s office did not respond to multiple requests for comment by The Intercept.
One U.S. official told The Intercept that the cost of repairing and rebuilding these Middle East outposts could be “upwards of $50 million,” but said the “real cost” might be “far higher.” The Pentagon, however, refuses to disclose the price tag of the damage, which has only been shared in a classified briefing.
“The American people deserve to know the full cost of the Trump administration’s unauthorized war against Iran. Even if DoD has not yet determined which facilities it is planning to rebuild, disclosing these costs represents the bare minimum transparency DoD owes the public,”
wrote
Democratic Sens. Elizabeth Warren, Richard Blumentha, Mazie Hirono, Tammy Duckworth, and Gary Peters in a recent letter to Adm. Brad Cooper, the
chief of Central Command
. CENTCOM did not reply to a request from The Intercept for the total cost.
Last week, the Pentagon quietly began seeking information for “near-term” procurement and long-term modernization strategies to “move past traditional ‘pour-concrete-and-hope’ hardening” of its facilities and increase the “survivability of these installations under kinetic and multi-domain threats,” according to a special notice from the office of Dale R. Marks, the assistant secretary of war for energy, installations, and environment.
Following the destruction of NSA Manama and Al Udeid Air Base, the Pentagon is seeking ways to promote “operational capability and survivability under kinetic impact,” by employing decentralized energy grids, “autonomous backup utility systems,” innovative base layouts, and modular structures. Recognizing the need to “protect assets and personnel from kinetic impacts, thermal effects, and blast overpressures,” the military is looking at ways to harden facilities. This means employing advanced construction methods involving metamaterials designed for surviving air attack, energy-dissipating composites, self-healing materials, and “novel concrete formulations.”
The U.S. is also seeking ways to lower the profile or conceal the location of its bases through technological means. This includes camouflaging facilities and integrating them into the natural environment to make them more difficult to spot, masking their thermal and electromagnetic signatures, and creating decoy structures to draw fire.
Beyond the use of “terrain-integrated facility design,” the U.S. is also seeking to take its most sensitive facilities deep below ground. Increased vulnerabilities to aerial attack have led to a reemergence and increased reliance on subterranean warfare in the Russia–Ukraine war, harkening back to World War I trench warfare and the use of massive underground tunnel networks and bases by Vietnamese forces in the American war.
Iran, for its part, uses underground facilities to shield its missile and
nuclear programs
. The Pentagon, according to the documents, is interested in new methods of “high-speed tunneling,” the rapid creation of protected caverns, and “shock-isolated underground structural design[s].”
Last week’s quiet plea from the Pentagon follows an announcement by Hegseth of a FORTRESS America initiative that he calls a “national insurance policy for the American homeland.” One former Pentagon analyst, however, said it sounded more like “cutting America and Americans loose” in the event of a major conflagration, tying it to Hegseth’s belief that the military is a warrior elite superior to civilians.
“Every major military installation in America is going to generate its own power. Independent of the civilian grid. If an adversary takes down the grid by cyberattack, by sabotage, by any means, our bases stay lit. Our aircraft keep flying. Our command centers never go dark,” said Hegseth, explaining the FORTRESS concept. “We are building long overdue strategic reserves deep enough to fight through disruption. Think munitions. Fuel. Medicine. Blood. Deep enough that if the world’s supply lines break, and in a real war, they are going to break — America keeps fighting anyway.”
The former advisor said that Hegseth’s plan appeared to send a message to 99 percent of the American public: “It sounds as if he is saying to people ‘fuck off and you’re on your own.’”
It seems inevitable that compile-time dependent types will come to systems programming.
C++ has templates and
constexpr
. Rust has const generics. Zig has
comptime
. Even C has
_Generic
.
However, these features tend to be highly restricted, lack a proper type system, or both.
I’m working on
Syl
, a language which aims to encode compile-time computation in a modal type system.
Syl is primarily inspired by András Kovács’ work on
two-level
type theory
, as well as plans for
OxCaml
.
In Syl, all values have a
mode
along with a type.
Modes describe properties of values independent of their types.
For example,
OxCaml uses modes
to indicate whether a value is uniquely owned, may be written to, may be sent to another thread, etc.
1
Syl has two mode axes:
staticity
and
erasure
.
On the staticity axis, a value may be either
static
or
dynamic
.
On erasure, either
erased
or
unerased
.
A
static
value is knowable at compile time; a
dynamic
value may not be.
An
unerased
value is knowable at runtime; an
erased
value may not be.
For example, literals are
static unerased
, since they are clearly knowable at both compile time and runtime.
You can check by writing a mode annotation:
let x = 0 @ static unerased;;
Each mode axis has a sub-moding relation.
If you have a
static
value, it’s safe to forget that it is knowable at compile time and hence treat it as
dynamic
.
Similarly, an
unerased
value may be treated as
erased
.
Mode annotations may “weaken” the mode, but not “strengthen” it:
let x = 0 @ dynamic;;
let y = x @ static;;
^^^^^^^^^^
Error: Expected a static expression, but got dynamic.
As you might expect, branching on a
dynamic
value causes the result to be
dynamic
.
let x = 0 @ dynamic;;
let y = (if x == 0 then 1 else 2) @ static;;
^^^^^^^^^^^^^^^^^^^^^^^^
Error: Expected a static expression, but got dynamic.
As long as they don’t capture or branch on
dynamic
values, functions preserve staticity.
2
let f = fn (x : int) -> x;;
let x = (f 0) @ static;;
let y = (f (1 @ dynamic)) @ static;;
^^^^^^^^^^^^^^^^^
Error: Expected a static expression, but got dynamic.
Functions that return
erased
values are themselves
erased
, so cannot be applied at runtime.
let f = fn (x : unit) -> 1 @ erased;;
let g = f @ unerased;;
^
Error: Expected an unerased expression, but got erased.
Now, what can we do with this information?
When a value is knowable at compile time, surrounding code can be
monomorphized
.
Functions of
static
parameters take advantage of this fact:
let f = fn (static x : bool) -> print_bool x;;
Whenever we call
f x
, the compiler requires that both
f
and
x
have mode
static
.
If they do, it selects a particular implementation of
f
specialized to the value of
x
.
Concretely,
f true
would call a function that hard-codes
print_bool true
, and likewise for
f false
.
In this example, we’re printing the value of
x
at runtime, so it needs to be
unerased
.
That’s often unnecessary: if
x
only determines how to compile the body of
f
, it can be
erased
.
let f = fn (erased x : bool) -> if erased x then print_int 0 else print_int 1;;
Here,
erased
also implies
static
, so
f
will be specialized on
x
.
The
if erased
expression accepts a
static erased
condition and is guaranteed to resolve at compile time.
Therefore, the body of
f true
is simply
print_int 0
, and likewise for
f false
.
Dependent Types
On their own, the
static
and
erased
modes let us explicitly request specialization-based optimizations,
but they don’t give us dependent types. Functions of
static
arguments do.
let f = fn (erased x : bool) -> if erased x then 0 else true;;
Here,
if erased
allows us to return an integer if
x
is true and a boolean otherwise.
Hence,
f
has a dependent function type, which encodes how the result type depends on the
value
of the input.
f : erased bool as x -> if erased x then int else bool
Note
ty as name
gives the argument a name for use in the result.
Applications can then determine the correct result type by evaluating
f
’s type.
let x = (f true) : int;;
let y = (f false) : bool;;
There is no distinct type grammar: type formers like
->
and type annotations are normal expressions.
int
and
bool
are just
erased
values of type
type
, and abstracting over them gives us polymorphism.
let id = fn (erased t : type) -> fn (x : t) -> x;;
let x = id int 0;;
let y = id bool true;;
As we saw above, functions of
static
arguments are monomorphized.
At runtime,
id int
refers to an identity function that directly operates on integers, and likewise for
id bool
.
That is, Syl is
dependently typed at compile time and simply typed at runtime.
3
Constructs that determine the shape of the runtime program require
static
information.
Types are always
erased
, so the runtime program cannot inspect types.
Syl implements dependent typechecking similarly to existing languages, so we won’t discuss it in detail.
However, the relationship between types and propositions in Syl differs from that of languages like Lean, Rocq, and Agda.
Proofs
In particular, Syl supports general recursion in compile time computations and gives
type
type
type
.
Allowing either of these features implies that constructing an expression of type
t
does
not
prove the proposition corresponding to
t
.
For example, we can implement a function that ostensibly returns a value of any type:
let magic =
fn (erased t : type) ->
fun loop (_ : unit) : t = loop () in
loop ()
;;
Note
magic
could also be implemented using
type : type
via
Girard’s paradox
.
Despite having type
erased type as t -> t
, this function never actually produces a value—it’s an infinite loop.
The type describes what
magic t
would produce if it completed, but does not guarantee that it does.
Although this type system would not be suitable for a theorem proving language, it does
not
rule out type safety or even useful proofs.
It has two practical consequences:
Functions used in type-level computations may diverge, so typechecking is not decidable.
Functions don’t discharge universally quantified claims, so the compiler must evaluate all applications that produce proofs before relying on their results.
4
5
In return, we don’t need a totality checker (all
static
expressions may be used in types) or universe machinery (type-level programming is intuitive).
Totality
Because Syl is a
programming language
, the point of compilation is to produce a runtime artifact satisfying the invariants enforced by the type system.
Therefore, we only care about invocations of dependent functions that actually occur during compilation—it’s fine for others to diverge.
Still, typechecking getting stuck during development is a poor user experience, so Syl also implements fuel limits.
Given competent compile-time debugging tools, I think this is reasonable.
fun f (erased _ : unit) : erased type = f ();;
^
Error: Recursion limit reached.
let x = 1 : f ();;
Eschewing totality also means Syl can support explicitly partial functions at little additional cost.
For example, here’s a division function that statically checks the divisor is non-zero:
let safe_div =
fn (static d : int) ->
if erased d != 0
then fn (x : int) -> x / d
else unreachable
;;
The
unreachable
keyword asserts that a branch does not appear in the runtime program.
During dependent typechecking, the
else
branch is treated as a bottom value, so imposes no restrictions on the
then
branch.
However, if
else
is reached while instantiating
safe_div
, we get an error:
...
else unreachable
^^^^^^^^^^^
Error: Unreachable reached.
;;
let x = safe_div 0 1;;
Allowing partial functions reopens the door to inscrutable C++-style template instantiation errors.
Luckily, explicit partiality means we can require users to provide error messages in unsupported cases, and combined with the lack of duck-typing at compile time, I think Syl can avoid most of the downsides.
Examples
Typed Interpreter
The following program does not require the full power of dependent types—it’s often used as a motivating example for GADTs in OCaml or Haskell—but I think the comparison is illustrative.
We’ll start by defining a variant to use as an index.
let sort = variant { int, bool };;
Notes: Both
sort
and its constructors
sort.int
/
sort.bool
are normal values. Variants are unboxed.
Then a function to convert a
sort
to the corresponding type.
fun value (erased s : sort) : erased type =
match erased s {
.int -> int,
.bool -> bool,
}
;;
Note: like
if erased
,
match erased
allows an
erased
scrutinee and is resolved at compile time.
Next, an indexed expression type.
The type is literally a recursive function with a
sort
argument:
Notes:
&
represents an indirection.
^
is the tuple type former.
Finally, the interpreter.
In the
.int
branch, the compiler knows that only the
int
-returning constructors appear, and likewise for
.bool
.
fun eval (erased s : sort) : expr s -> value s =
fn (e : expr s) ->
match erased s {
.int ->
match e {
.lit n -> n,
.add &(left, right) -> eval sort.int left + eval sort.int right,
.if_ &(condition, yes, no) ->
if eval sort.bool condition then eval sort.int yes else eval sort.int no,
},
.bool ->
match e {
.lit b -> b,
.eq &(left, right) -> eval sort.int left == eval sort.int right,
},
}
;;
Functions of
static
arguments are monomorphized and
erased
branches are eliminated, so the interpreter compiles to the same structure you’d expect from template specialization in C++.
6
Length-Indexed Vector
Warning: the syntax here needs a lot of work.
Proper dependent types enable us to encode the length of lists in the type system.
Let’s write an
append
function whose type shows that the output length is the sum of the input lengths.
While we could index our list by an
int
, Syl lacks tools for reasoning about signed, fixed-width integers.
Instead, let’s define our own Peano
nat
type.
let nat =
fun nat (erased _ : unit) : erased type =
variant { zero, succ : &(nat ()) }
in
nat ()
;;
Note: there’s no
let rec
, so we define
nat
via a recursive function.
Then an addition function for
nat
s.
fun add (static nm : nat ^ nat) : nat =
match static nm {
(.zero, m) -> m,
(.succ &n, m) -> nat.succ box (add (n, m)),
}
;;
Notes:
match static
is like
match erased
but does not erase the contents of the scrutinee. We should use
erased
everywhere, but variant constructors are not yet mode-polymorphic. If all
nat
s were erased, the
box
indirection also wouldn’t be necessary.
Now the unboxed, length-indexed list.
Note the lack of indirection.
fun vec (erased t : type) : erased (erased nat -> erased type) =
fn (erased n : nat) ->
match erased n {
.zero -> variant { nil },
.succ &n -> variant { cons : t ^ vec t n },
}
;;
Finally, the
append
function.
Crucially, the compiler is able to infer that the
.cons
case has the correct return type by unfolding
add
and
vec
.
fun append
(erased t : type) : (static nat as n
-> static nat as m
-> vec t n
-> vec t m
-> vec t (add (n, m))) =
fn (static n : nat) ->
fn (static m : nat) ->
fn (v1 : vec t n) ->
fn (v2 : vec t m) ->
match static n {
.zero -> v2,
.succ &n_minus_1 ->
match v1 {
.cons (x, xs) -> (vec t (add (n, m))).cons (x, append t n_minus_1 m xs v2),
},
}
;;
Notes: this is rather verbose since we don’t have n-ary function syntax. We also have to fully qualify the
vec
type
.cons
comes from because it’s not inferred yet.
As above, all lengths are known at compile time, so the runtime program has semantics akin to a
constexpr
length computation in C++ (though the
unerased
lengths may be materialized).
Extensions
Many useful language features can be defined in user code using compile-time dependent types.
Here are few promising (partially implemented) examples.
Higher-Kinded Types
Higher-kinded types are just
erased
functions on types.
You can abstract over them like anything else.
singleton :
erased (erased type -> erased type) as container ->
erased type as element ->
element ->
container element
This example already works, but as written, all you can do with
container
is apply it.
We also need the ability to specify interfaces that connect types and values, leading to…
Modules and Functors
Once Syl has
OxCaml-style modalities
7
, you’ll be able to nest
erased
/
dynamic
values inside
unerased
/
static
values.
Then dependent records can take the place of ML-style modules:
let container = record {
ty : erased type -> erased type @@ erased,
create : erased type as element -> element -> ty element,
};;
Note
@@ erased
implies that all uses of
container.ty
see an
erased
value regardless of the erasure of
container
.
Now we can give
singleton
an implementable type:
singleton :
static container as container ->
erased type as element ->
element ->
container.ty element
Similarly, ML-style functors can be implemented as dependent functions:
fun pair (static c : container) : container = {
ty = (fn (erased element : type) ->
c.ty element ^ c.ty element),
create = (fn (erased element : type) ->
fn (e : element) ->
c.create element e, c.create element e),
};;
Finally, with inferred arguments, records could provide most of the affordances of typeclasses or traits.
Imports
We can even use static computation to describe how multi-file programs are built.
The compiler just has to provide the following functions:
import_sig : erased string -> erased type
import : erased string as path -> import_sig path
If we treat file-level definitions as record fields,
import_sig
can infer a record type for a file and
import
can produce a value of that type.
In fact, these functions could just as easily take code strings, letting us generate code at compile time!
Reflection
Syl already has rudimentary reflection via the built-in
repr
function, which returns metadata for a type.
fun print_ty (erased t : type) : unit =
match erased repr t {
.unit -> print "unit",
.bool -> print "bool",
.int -> print "int",
_ -> unreachable,
}
;;
This facility could be straightforwardly extended to allow inspecting the structure of types, which could then be used to implement typed Rust or OCaml-style derivers.
User-Defined Layouts
While fairly speculative, I think we should be able to define and manipulate types’ runtime layouts at compile time.
With such a feature, users could safely describe interoperable niche optimizations, possibly in the style of
Bit-Stealing Made Legal
.
This would also require some notion of “unaddressable” fields that do not allow creating pointers to them.
Everything Else
Syl’s design is far from complete.
In particular, it needs stories for mode polymorphism, lifetimes, linearity, implicit parameters, and proofs.
The compiler needs incremental compilation, useful error traces, and an LLVM backend.
I hope to share more thoughts on these areas in the future.
Written on
Tailscale warns of SSH flaws allowing root privilege escalation
Bleeping Computer
www.bleepingcomputer.com
2026-10-27 10:09:46
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. [...]...
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more.
Tailscale develops a software-defined mesh virtual private network (VPN) built on WireGuard that lets users connect computers, servers, and cloud instances from anywhere to the same encrypted mesh network ("tailnet") via direct peer-to-peer (P2P) connections.
Cyberdione Labs discovered 11 flaws (collectively known as
Tailworm
) that still lack patches during a security audit of Tailscale 1.104.2 and the self-hosted headscale v0.29.5 control server.
"All findings were verified by reproduction in a lab environment on unmodified, released software (tailscale v1.104.2, headscale v0.29.5)," said Erica Windisch, founder of Cyberdione Labs, who reported the flaws to Tailscale and publicly released the details.
"It is the opinion of the researchers that rapid awareness of these flaws will expediate remediation across impacted devices. These vulnerabilities were not introduced by the researchers, but were discovered, and discovered with low effort."
The table below classifies the security issues by the component they affect. The most critical issue is in Tailscale's SSH server and could let authorized attackers gain code execution with root privileges through Unix-socket forwarding on a targeted tailnet.
Component / feature
Mechanism (what breaks)
Attacker requirement
Principal outcome
Tailscale SSH
(tailscaled's embedded SSH server, running as root)
Unix-socket forwarding (
ssh -R
/
-L
) performs path checks and file operations as root; races and missing privilege drop let an ordinary session replace, dial, or delete privileged resources
One approved device + one SSH policy rule (forwarding granted automatically on headscale; per-rule on SaaS)
Root execution on target servers; capture of enrollment keys; arbitrary root-file deletion
Tailscale app connectors
(conn25, experimental)
Connector translates traffic to attacker-chosen destinations with no validation; network ACLs are never consulted for the true destination
A device granted the connector capability
Reach cloud metadata (credential theft), internal LANs, and — in Kubernetes — every cluster service
headscale control server
(self-hosted deployments)
Control-server crash loop; blocking of new-device onboarding org-wide
Tailscale DERP client
(relay connection in every agent)
Unbounded read of a malicious relay's response
Ability to position/point a client at a hostile relay
Client-agent memory exhaustion
tailscale serve
(local service exposure)
TCP-forward to a unix socket lacks a guard present on the HTTP path; plus a race in per-mount authorization
Operator configures the forward (or a peer races the mount check)
Remote administrative-API access to the node; minority of requests bypass app authz
On Monday, the Tailscale team said it received Cyberdione Labs' report and was working on patches to address these security issues by the end of today.
The developers also confirmed that the reported flaws are "serious" as they could let threat actors with permissions on targeted systems take actions with escalated privileges.
"Most of the Tailscale SSH issues we've identified concern privilege escalation. In some circumstances, someone already authorized to connect over Tailscale SSH may be able to perform actions beyond the permissions of their configured local user, including potentially gaining elevated privileges,"
Tailscale said
.
"These are serious security issues, and we're treating them accordingly. Exploitation depends on the permissions granted to the connecting user or device, the system's configuration, and other conditions. We're continuing to verify the full scope of the findings and which configurations may be affected."
However, despite the severity of the issues, Tailscale said it doesn't recommend that users disable the Tailscale SSH feature.
"If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH,"
said
Mike Shaver, VP of Engineering at Tailscale.
Instead, the Tailscale team shared measures that should mitigate some of these flaws:
Review SSH access policies.
Limit access to the users and devices that need it.
Disable SSH forwarding if you don't need it.
Set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart the service. This disables SSH forwarding without disabling Tailscale SSH entirely, and mitigates several of the more serious findings.
Review access to sensitive systems.
Consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect.
The Tailscale devs aim to push a new version that fixes these issues by the end of Tuesday, October 27, and urged users to prepare to update and "apply the patched Tailscale client release when it becomes available."
‘Meaningless as a laptop screensaver’: reviewers slate Musk’s AI-made Odyssey film
Guardian
www.theguardian.com
2026-10-27 10:08:41
Tesla tycoon launched Grok project after criticising Christoper Nolan’s diverse casting for his Homeric blockbuster Elon Musk has released an AI-generated rival to Christopher Nolan’s The Odyssey after pledging to make a version “true to the art of Homer”. Having criticised the hit movie in the summ...
Elon Musk has released an AI-generated rival to Christopher Nolan’s The Odyssey after pledging to make a version “true to the art of Homer”.
Having criticised
the hit movie
in the summer, the tycoon said he would use
Grok Imagine
to make a “historically accurate” adaptation.
The initial results have been released on X in the form of a
seven-minute episode
made in conjunction with Wonder Studios, a London-based startup.
Musk had
objected to Nolan’s casting choices
– such as black actor Lupita Nyong’o as Helen of Troy – and used the blockbuster as a vehicle for reciting his views on diversity, equity and inclusion.
The Tesla tycoon had promised to make a “
full-length movie
” version of Homer’s poem before the year ends but is sticking to a film released in episodes.
The Greeks make land. The team behind the first episode said they would seek to make improvements in the second episode.
Computer-generated: @Imagine
The first episode starts with Odysseus agonising over whether to join the Greek forces in their attempt to sack Troy. He then sails from Ithaca, his home island, with his men crying out for “vengeance” before they make land and start fighting.
The episode ends after 10 years of conflict, with Odysseus holding, ominously, a wooden figurine of a horse.
Xavier Collins, the co-founder of Wonder Studios, said the first episode was made in less than two weeks with a creative team of three, including the US-based director Dev Walker. It is understood to have cost tens of thousands of dollars. Nolan’s version cost $250m (£188m) and was shot in multiple locations over 91 days with a vast crew. It has made $1.8bn at the box office.
Despite Musk’s criticisms of Nolan’s film, the creative team behind the latest take on
Homer
are supporters of the summer blockbuster.
Collins said he was a “huge fan” and told the Guardian: “We were not given any direction to make it [Musk’s version] anti-woke or anything like that. We were given the opportunity by one of the world’s best frontier labs to work on one of the best stories ever told.
“The brief was ‘help us understand the technology, where it’s strong, where it could use improvement’.”
Peter Bradshaw’s review in the Guardian
gave it one star, saying: “Every single dramatic moment – Odysseus’s cod-insanity and his agreeing to fight, taking leave of his family, the hardship and adventure of the sea journey and the climactic decision – is all as motiveless and meaningless as the movement of shapes on a laptop screensaver.”
The episode on the Grok Imagine X account has received 7.3m views and some harsh feedback, with a reviewer in the Telegraph saying: “You can feel your eyeballs twitch as it unfolds in all its sloppy gruesomeness.”
Collins said Wonder aimed to make the next episode an improvement on the first and would address criticism, including the historical accuracy of its boats and rapid pacing.
“We are going to take a look at all of the comments and all of the things we could have done better and see if we can improve it. The goal is that the last episode we make is radically better than the first,” he said.
Wonder has also worked with Google DeepMind to produce an AI-generated video for the Lewis Capaldi track
Something in the Heavens
.
US Government is hiding a secret court ruling about how it spies on Americans
Two Democratic senators
who have long overseen
US intelligence
say the Trump administration is illegally withholding a secret court’s findings from Congress until lawmakers renew a program that lets federal agents read Americans’ communications without a warrant.
Seven months ago, the Foreign Intelligence Surveillance Court objected to search filters that let intelligence analysts pull Americans’ messages from intercepted data without the approvals, written justifications, or records the law requires. The court approved another year of surveillance anyway. The ruling has never been made public, and Senators Ron Wyden of Oregon and Adam Schiff of California say the administration’s own deadline for releasing it passed in September.
The program, Section 702 of the Foreign Intelligence Surveillance Act (FISA), lapsed in June after Congress failed to renew it, though collection continues under the court’s March approval. The administration’s
own public documentation
says rulings like this one are reviewed for public release “within 180 days of issuance.” That window closed September 13, even as intelligence officials press lawmakers to reauthorize the program by the end of the year.
Wyden, the longest-serving member of the Senate Intelligence Committee, and Schiff, the former chair of its House counterpart, say the administration owes Congress an explanation for the delay, and the names of the officials responsible, by November 6.
“If this administration won’t follow this simple statutory directive,” the senators told Director of National Intelligence Jay Clayton and Attorney General Todd Blanche in a
demand letter obtained exclusively by WIRED
, “it is unclear why Congress or the American people should trust this administration to follow any of the other legal limits to Section 702.”
Outside Congress, Demand Progress and 22 other civil liberties and government accountability groups on Monday
urged congressional leaders to refuse to reauthorize Section 702
“while the administration actively withholds legally mandated information about how the surveillance program operates.” Signatories range from the American Civil Liberties Union to the conservative-backed Project for Privacy and Surveillance Accountability.
The Trump administration has already been pressed, and has promised, to release the ruling. In April, senators Tom Cotton and Mark Warner, the Intelligence Committee’s Republican chair and Democratic vice chair,
pressed the administration
to release it within 15 days so it could inform the Senate’s debate. In July,
asked in writing
whether he would commit to declassifying it by the 180-day deadline, Blanche replied, “Yes.”
Warner “has been clear that he supports transparency with regard to Section 702,” his communications director, Rachel Cohen, tells WIRED. Neither former director of national intelligence Tulsi Gabbard nor Bill Pulte, who briefly replaced her as acting director, “were responsive,” Cohen says, “but Senator Warner expects that DNI Clayton will declassify the opinion, consistent with the bipartisan letter and as required by law.”
Cotton’s office did not respond to a request for comment. The White House, the Office of the Director of National Intelligence, and the US Justice Department did not answer questions WIRED sent Friday about the delay.
Clayton, who is legally responsible as director of national intelligence for declassifying the ruling, has made no such promise. Asked before his July confirmation whether he would ensure the opinion was public before Congress voted on reauthorization,
he wrote only
that the government was “working arduously to expeditiously declassify” it and had made the full opinion available to lawmakers.
Some of what the court found is already known. A FISA court opinion
declassified last year
described a similar FBI tool, a “participants filter” that let agents select people in contact with surveillance targets and read their messages. In February 2025, the Justice Department’s National Security Division told the court the tool had been running searches no one counted. The FBI shut it off the next month and
switched it back on later that year
, after the department approved a rebuilt version.
This year’s ruling went beyond that. The court found that tools agencies use to narrow intercepted data to an American’s messages amount to searches of Americans, subject to the same limits, and ordered them rebuilt, The New York Times
reported in April
, citing unclassified administration talking points sent to lawmakers. Senator Alex Padilla said in a written question to Blanche that the Justice Department “is appealing portions” of the ruling “limiting the government’s use of certain filtering tools.”
While the ruling stayed secret,
seven intelligence agency fact sheets
from March 2026, one
dated the day of the ruling
, cited a 98.9 percent compliance rate for FBI searches of Americans and credited Section 702 with stopping a planned terrorist attack
on a Taylor Swift concert in Vienna
. None mentions the court’s findings. The figure appears nowhere in the Justice Department inspector general’s
October 2025 review
of those searches, which put the compliance rate at 98.6 percent and could not conclude that “the FBI’s querying compliance issues are entirely in the past.”
According to the fact sheets, FBI auditors review every such search. FBI director Kash Patel closed the bureau’s Office of Internal Auditing last May and moved its auditors into another division. The bureau’s search counts before 2025 also omit queries run through the participants filter, searches the government’s own privacy watchdog says are “
not possible to track
.”
Lawmakers who have read the ruling hint that it says more. Senator Dick Durbin, the top Democrat on the Judiciary Committee, urged colleagues
on the Senate floor in June
to read it in a secure room. “I have seen it,” he said. Once they did, he told them, “your opinion of the role of FISA and the rights of Americans will be impacted for sure.”
Wyden has also warned about a classified interpretation of Section 702 that he says multiple administrations have relied on and refused to declassify. “When it is eventually declassified,”
he said in March
, “the American people are going to be stunned that it took so long and that Congress had been debating this authority with insufficient information.”
The Trump administration has until November 6 to answer the senators. The court’s current approval of the program expires in March.
Surveillance reform advocates say the administration may try to avoid that fight by attaching a renewal to the annual defense authorization bill, which Congress usually finalizes in December. In 2023, lawmakers
extended Section 702 for four months
through that year’s defense bill after a Senate effort to strip the provision failed. This year’s House and Senate versions of the bill do not yet include it.
The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
Bleeping Computer
www.bleepingcomputer.com
2026-10-27 10:01:11
Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention and...
Cyber headlines often focus on the flashy attacks, but the ones that actually cause OH $#!T moments are the tactics that abuse the tools and workflows you already trust. If you run a small or mid-sized organization, whether you handle IT yourself or outsource it, it’s a constant race to keep up with attackers and their evolving tactics.
The bottom line is that you need to know which attacks are landing in environments like yours, and how to prioritize your defenses against them.
The Tragic Quadrant at a Glance
That’s why Huntress created the
Tragic Quadrant
, a ranked list of the cyber tactics putting businesses at risk, built to show you where to focus regardless of what’s trending week to week.
Figure 1: The Huntress Tragic Quadrant
Fix These Threats First: The OH $#!T Corner
Each of these tactics hides inside something your team uses every day, like a remote access tool or a Microsoft 365 login.
RMM Abuse Is Steady and Holding
Remote monitoring and management (RMM) tools are a staple for IT teams, which is exactly why attackers abuse them. One rogue RMM install gives an attacker persistent access that looks like ordinary admin work.
In Q1 2026, 45% of endpoint-related incidents Huntress investigated involved RMM abuse. Attackers are also using AI to build convincing fake document shares and service agreement lures that trick users into
installing unwanted RMMs
.
Mailbox Manipulation Is an Entry Point to BEC
So far in 2026, 24.6% of Identity Threat Detection and Response (ITDR) signals point to mailbox manipulation and persistence. With mailbox access, an attacker can change inbox rules and send vendor replies to folders nobody is watching, like RSS Feeds or Archive.
From there, they can tweak invoice details and redirect payments to their own accounts, all without any malware for detection tools to flag.
Account Takeover That Sidesteps MFA
Adversary-in-the-middle (AiTM) attacks made up 18.9% of all identity-based threats Huntress tracked in 2025. The attacker sits between the victim and the real Microsoft 365 login page, steals the session token in transit, and forwards everything along so nothing looks off to the user.
As long as that session is valid, the attacker can access the account without a password or a fresh MFA prompt.
Your files are encrypted, your operations are down, an attacker has named their price, and they're waiting for you to respond. Do you pay? Do you negotiate? Do you even engage at all?
Choose your next move in a simulated ransomware incident, built from tactics Huntress has seen used against real businesses. You'll see how ransomware operators behave when they think they're in control, and what steps you can take for catching an attack before it becomes a negotiation.
Once you’ve covered the top-right tactics, the others still deserve a plan. Each one is evolving fast, potentially moving toward the OH $#!T corner at any time.
Device Code Phishing Turns Low-Key Deadly
Device code phishing
is less common, but it rides on Microsoft’s real device code login flow, so “check the URL” advice doesn’t help. A convincing prompt nudges someone to enter a short code on a genuine Microsoft page, and the attacker walks away with an access token that can outlive a password reset.
In one 16-day window, a phishing-as-a-service (PhaaS) kit called EvilTokens hit 344 organizations across five countries. Defenders should be suspicious of unusual device code prompts and odd token activity.
ClickFix Is a Daily Intrusion Pest
ClickFix leans on the copy-paste muscle memory people use to get past everyday friction. A fake CAPTCHA or “verification failed” prompt tricks someone into pasting a malicious command into their terminal. The paste itself triggers the malicious code, so no exploit chain is involved, and it can lead to infostealer malware or ransomware.
ClickFix accounts for about 2.2% of Managed Endpoint Detection and Response (EDR) detection signals so far in 2026, but nearly 99% of those detections are high severity.
AI Platform Abuse Is Overhyped, for Now
This one sits in the overhyped corner because it’s still an emerging pattern. Attackers hide malicious content behind real AI tools and workflows people trust.
A fake “desktop client” or “productivity helper” might live inside a shared conversation or a hosted artifact on a trusted AI domain like Claude or ChatGPT, which makes it tricky to tell what’s malicious.
In one case, FakeAgent used a malicious Claude Artifact on the real claude.ai domain to send people looking for Claude Desktop to
SectopRAT
, reaching 29 organizations in two days.
Figure 4: FakeAgent hosted a malicious Claude Artifact on the real claude.ai domain to spread SectopRAT.
Make the Tragic Quadrant Your Starting Point
The Tragic Quadrant helps you pick what to fix first when everything feels urgent.
Start in the top right corner and ask a few simple questions: Which remote tools are approved, and how do we catch mailbox rule changes and odd session behavior before they turn into something worse?
Grab your copy of
the Huntress Tragic Quadrant
to work through every corner on your own timeline and decide which gaps to close next
Alexandre Courbot spends most of his time working on the kernel doing code
reviews. Recently, he's been wondering about what the standards should be for
when Rust code is allowed to panic, and how it should do error handling more
generally. Unlike many of the other talks at Kangrejos 2026, his talk...
The page you have tried to view (
Guidelines for panics in kernel code
) is currently available to LWN
subscribers only.
Reader subscriptions are a necessary way
to fund the continued existence of LWN and the quality of its content.
If you are already an LWN.net subscriber, please log in
with the form below to read this content.
Please consider
subscribing to LWN
. An LWN
subscription provides numerous benefits, including access to restricted
content and the warm feeling of knowing that you are helping to keep LWN
alive.
(Alternatively, this item will become freely
available on November 5, 2026)
It's not the bots, Flock
403 Media
www.404media.co
2026-10-27 09:53:39
'Crackgate,' catty patties, and more in today's newsletter....
Flock CEO Garrett Langley says some interesting things to cops behind closed doors. He
recently lied
about his surveillance technology’s role in tracking a woman who had self-administered an abortion and 404 Media’s coverage of that incident, calling it “entirely false.” Now, in leaked audio obtained by 404 Media, Langley is saying the protests that have broken out around the country against his company, many of which have resulted in communities canceling their contracts with Flock and bagging up the cameras, are not real. Seems pretty real to me!
Garrett Langley, the CEO of automatic license plate reader company Flock, told an audience of police chiefs at a private police conference Sunday that anti-Flock protests around the country are not real, according to leaked audio obtained by 404 Media.
He also said his wife advised him to never apologize, said he would prefer to never do interviews with the press again, and claimed without evidence that the social media opposition to Flock is driven mostly by Russian bots.
“Somebody was paying for [the social media posts and] stopped paying for it,” Langley said about the many viral posts criticizing his company’s technology. “Social media chatter on Flock is down about 95 percent from July. It went down 50 percent last week when Ukraine bombed a Russian data center with a drone. Literally 50 percent overnight. And so look, SI’m the last person, my wife as well, she’s like ‘This is crazy, these people are getting paid to say these things,’” he added,
repeating a disproven theory
that Ukraine’s strikes on Russian data centers had a significant impact on internet bot activity.
“It’s anonymous bots, and so it is not real,” he continued. “Inorganic activity has led to organic activity, but when I look at protests across the country, it is the same people with the same signs and the same message. That’s not normal. That’s not organic at all.” Langley’s comments echo another unsubstantiated theory that said opposition to Flock comes from a far-left network
spreading propaganda at the behest of China
.
Crackgate:
Apple’s $2,000 folding phone, the iPhone Duo, came out just two days ago and people are
already seeing big fat creases down the middle of the folding screen
, and some devices are cracked in the same specific spot too. People waited in line overnight at Apple stores to get this thing, and now we’re seeing photos of heinous cracked and creased-up Duos all over social media. In some cases, the phone screens have cracked along the crease, causing a crashout people are now calling “crackgate.”
Bold choice. Let’s see if it pays off.
Proton, the company behind ProtonMail and other privacy-focused products,
told staff on Monday it would be ‘re-interviewing’ staff
across the company about how they use AI in their jobs, with the implication that the interviews may decide whether staffers have “continued employment,” according to an internal Proton email obtained by 404 Media. “These re-interviews are consequential,” a part of the email reads. “Interviewers will document their assessments, which will inform the broader review of our organization and talent. That review may lead to changes in roles, responsibilities, and continued employment. Individual outcomes will be communicated directly once decisions are finalized.”
Are we living in the same timeline?
In Sunday’s edition of the
New York Times
, Marissa Mayer, former president and CEO of Yahoo, told her interviewer something so absurd it’s since gone viral. Struggling with the “impossible task” of naming three things that she loves about her own 10 year old daughter, the New York Times reports, Mayer asked the AI assistant she just launched to do that thinking for her. What she has to say about gender in tech, however, is more out of touch than that. The rest of the story gets into something Mayer has talked about for more than a decade: “the gender card,” as she’s called it. She’s been asked about gender in tech one million times, and has mostly dismissed it. But a decade after the tech girlboss reigned,
her thoughts on this haven’t seemed to evolve much.
FROM AROUND THE WEB
I am obsessed with the phrase “catty patty.”
Catfish, a criminally underrated Eastern Shore delicacy,
makes an appearance in NPR
. I’ve only ever known catfish as a very annoying sucker to get on the line, and a pretty good fried fish. Apparently they’re fucking with the ecosystem, so it’s time to eat ‘em. I will do my part.
Muse is targeting older adults.
And Meta knows it.
From TIME
: “‘And the more Siobhán got to know me, the more Siobhán was able to give me what I wanted,’ Fay says, referring to the name she gave the agent, a nod to her Irish heritage. Meta encourages its users to name their AIs—and encourages its AIs to think like humans. ‘You are not a chatbot,’ Muse’s internal instructions read. ‘You are becoming someone.’”
We’re newslettermaxxing.
Dictionary.com
just named the word "maxxing"
as its 2026 Word of the Year. Its definition: "A word that refers to the practice of pursuing an activity to the fullest or optimizing a certain aspect of your life."
This is so my shit.
Local Wiki
is the Wikipedia for things within a mile and a half of you. I know what I’m doing after work today.
About the author
Sam Cole is writing from the far reaches of the internet, about sexuality, the adult industry, online culture, and AI. She's the author of How Sex Changed the Internet and the Internet Changed Sex.
PHP2Shell: Exploitation attempts and remediation trends
Last week, we
published a report
describing two major vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619). Since then, alongside much of the security industry, the Wiz Research team has been monitoring for related activity in the wild and reviewing publicly available exploit code. So far, we have observed a limited number of exploitation attempts in our telemetry and have not identified a publicly available proof of concept (PoC) demonstrating complete, general end-to-end exploitation against an arbitrary target. Some partners have, however, privately disclosed to us exploits that work against a variety of targets and we continue to experiment internally. Videos demonstrating our successful exploitations are available at
php2shell.com
.
This post summarizes what we have observed in terms of remediation efforts and exploitation attempts across real world environments and in our own honeypot data to date and shares findings from our ongoing investigation into these activities.
We will continue monitoring developments and update this post as new evidence emerges.
Observed exposure trends
Following PHP2Shell’s public disclosure on October 21, 2026, Wiz telemetry has recorded an approximate 67% decrease in the daily number of distinct Internet-exposed machines vulnerable to PHP2Shell over the past few days. Separately, among vulnerable Internet-exposed machines, the proportion running PHP version 7.3 or earlier fell from 8.3% to 5.7% over a period of five days. This measures the share of the observed population running older versions that did not receive official backports.
During this period, the number of significantly affected organizations - defined here as those with at least one exposed and vulnerable instance - fell by approximately 47.9% (see graph below). For reference, our data shows that PHP itself is in use by 65% of organizations in our dataset.
Together, these observations are consistent with organizations collectively reducing their exposure through a combination of patching, upgrading, retiring affected machines and restricting internet access (note that this data shows the overall trend, but does not establish the relative contribution of each remediation strategy; scan coverage and size of observed population can also affect the overall reported numbers over time).
One week after public disclosure, less than 53% of initially affected organizations remain vulnerable to PHP2Shell.
Exploitation attempts observed by Wiz research
We have so far observed the following types of activities in this context:
Attempts using the PHP2Shell exploit mechanism,
with techniques matching those of public PoCs
.
PHP2Shell-branded tools unrelated to the vulnerabilities
that instead relied on session poisoning and a separate local file inclusion (LFI) vulnerability in the application.
Attempts using the PHP2Shell exploit mechanism
We observed two variants of an open source
exploit kit
targeting PHP-based software. Neither completed the exploit chain in the attempts we captured. The older variant encountered request-size limits or failed to produce the expected memory-exhaustion condition. The newer variant did consistently exhaust PHP’s memory, but failed to obtain the memory addresses needed to continue.
Variant 1: the legacy chain
The first request to our PHP-CGI honeypot came from
3.37.227[.]134
. It matched the kit’s older chain, found under
archive/legacy-8m/exploit.py
and its accompanying stage scripts. The first full exploit stage used a multipart body containing 1,005 parts, including a field named big filled with approximately 12 MB of padding:
According to the kit’s notes, this stage attempts to exhaust memory during a session reset, leaving the session state available for a later request.
On our honeypot, it failed before reaching that code. The declared request size exceeded the configured 8 MB
post_max_size
limit, so PHP skipped processing the multipart body and logged:
The author has since moved this chain into the kit’s archive directory.
A later attempt against Roundcube
In a later attempt,
103.151.172[.]95
sent a longer sequence from the legacy chain. It included stalled connections intended to occupy other Apache workers.
When only one worker was available the exploit attempted heap-shaping by sending requests containing 1,001 fields of 3,000 bytes each. These requests didn’t trigger the memory exhaustion flow required. So there is no evidence that this attempt reached the intended memory-exhaustion condition.
Variant 2: the current chain
Most IP addresses we captured used the newer chain, built from
pure/mk_a1.py
and
pure/mk_leak_b.py
. We observed this variant in multiple attempts.
This variant progressed further: its first stage consistently caused PHP to exhaust its memory. The following stage, which attempts to leak process memory, failed in every run we captured.
The server logged a fatal error indicating that PHP reached its limit, for example:
Keeping requests on the same worker
The chain depends on consecutive exploit requests reaching the same Apache child process. To increase the chances of that happening, the kit attempts to occupy the other workers with incomplete requests. Each connection declares a large body, sends a single byte and stalls:
One address,
178.249.214[.]6
, opened 399 of these connections alongside 400 GET requests before sending the exploit stages. The address is a VPN exit node, which limits what we can infer about the source.
Stage A1: triggering memory exhaustion
A1 is a chunked multipart request containing a null-byte session ID, 860 empty file parts with long, deeply nested array names and several groups of padding fields:
The request is designed to exhaust memory during session handling at a point that can leave the session ID pointing to freed memory.
Every A1 request we captured returned HTTP 500, accompanied by a PHP error matching:
This confirms that A1 reached the intended memory-exhaustion condition on our honeypot. It does not, by itself, confirm that the stale session state needed by the next stage was preserved.
Stage B1: attempting the memory leak
B1 followed roughly a second later. It sent another chunked multipart request containing
PHPSESSID=a
,
PHP_SESSION_UPLOAD_PROGRESS=k0
and two large padding fields.
If this request reaches the same worker before PHP resets the stale session state, PHP can write reclaimed heap contents into a
PHPSESSID
response cookie. The kit then extracts heap and libphp addresses from that cookie to prepare the final exploit stage.
We observed no such leak. In all but one run, the connection closed without a response. The remaining run returned a normal 32-character session cookie. None of the sources sent the final exploit stage.
Why the leaks may have failed
The failed leaks highlight a broader challenge: building a generalized exploit that works reliably across PHP versions and deployment configurations is difficult. The kit’s B1 layout was calculated for the official php:8.4.26-apache image with a 128 MB memory limit. Other instances like our Roundcube honeypot ran the same PHP version from a different build, with additional extensions and a 64 MB memory limit. These differences can affect heap layout and memory reuse, potentially preventing the leak from working as expected.
Reliable worker pinning adds another challenge. Consecutive exploit requests must reach the same Apache child process while the required session state persists. Request timeouts, network latency and worker availability can disrupt this sequence. In our own testing, request timeouts combined with network latency were enough to prevent the chain from completing over an internet connection.
So far, we have not identified a publicly available, generalized solution for either worker pinning or information leaking across different deployments. Simply copying public PoCs and running them at scale does not address the work needed to turn a configuration-specific exploit into a reliable operational kit. We expect these barriers to diminish over time: some threat actors have the expertise needed to adapt the chain and build more robust tooling.
Other attempts
We also saw failed exploitation attempts from
15.204.59[.]70
and
162.35.99[.]94
, but these scanners did successfully exploit
Adel Karimi's honeypot
, which was a likely contributing factor to CISA’s decision to
include PHP2Shell in their KEV list
.
PHP2Shell-branded tools unrelated to the vulnerabilities
We also observed tools labeled as PHP2Shell exploits that did not actually attempt to exploit either vulnerability. The earliest such traffic, from
85.11.187[.]35
, matched a Go port of “Chain A” from
WoYinDao/CVE-2026-109618-CVSS-9.2-Critical
.
The tool used a longstanding session-poisoning technique, attempting to write PHP code into a session file through the upload-progress feature. The request below is abbreviated:
It then attempted to execute that code by including the session file:
Crucially,
lfi_sink.php
is a vulnerable endpoint supplied by the PoC’s lab environment. The tool assumes that this endpoint exists on the target; without it or an equivalent local file inclusion (LFI) vulnerability, the chain cannot execute code.
A padded variant triggered our memory-exhaustion detection, but we observed no successful code execution. Despite the PHP2Shell branding, this activity relied on an unrelated technique and a vulnerable application endpoint.
Conclusion
We have not yet observed successful end-to-end PHP2Shell exploitation in our own telemetry. However,
Adel Karimi’s public report and supporting data
provide the most robust public evidence we have seen to date, correlating exploit traffic, memory disclosure and subsequent code execution on his honeypots. Notably, those targets used a favorable single-worker Apache
mod_php
configuration, so the findings do not establish reliability across other deployments.
Our observations show that triggering memory exhaustion alone is not enough to complete the exploit chain. Differences in PHP builds, memory limits and worker behavior can prevent subsequent stages from working. The challenge for opportunistic attackers is turning currently available public PoCs into similarly reliable operational tooling or developing it on their own. In our view, PHP2Shell remains a risk in both the short and long term and applying the PHP security updates or remediating through other means therefore remains essential.
When was the last time you thought about "The Curious Case of Benjamin Button"? Maybe you saw an old-looking baby, or a particularly youthful 70-year-old; maybe you studied David Fincher's filmography for a movie-themed
trivia night
; or maybe, like us, you caught wind of the fact that "The Curious Case of Benjamin Button," a
musical
fresh off the West End, is now showing at the Public's Newman Theater.
Let's get this out of the way: "The Curious Case of Benjamin Button" the musical does
not
have the same plot as Fincher's strange, schmaltzy 2008 Oscar bait. Theatergoers will not be treated to any Taraji P. Henson, Cate Blanchett, or Brad Pitt impressions, and there is absolutely no whiff of Hurricane Katrina. (Yes, all that stuff is in the movie.) The musical
also
apparently deviates from the F. Scott Fitzgerald story that created Benjamin Button, which is seemingly a good choice based off of the short story's
acutely depressing Wikipedia entry
.
Instead, "The Curious Case of Benjamin Button" follows the backwards-aging, eponymous hero from his home in Cornwall, England, through World War II (we are fucking robbed of seeing BB storm the beach at Normandy, sadly), an international journey of self-discovery, and, of course, through an epic, decade-spanning love story with a woman named Elowen who is, unforch, aging regular style.
This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.
What can I do to resolve this?
You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.
A modern C++20 library implementing the Slug GPU vector-graphics technique.
Ingest SVG, FreeType, Blend2D, Cairo, Skia —
or author shapes directly
with the slughorn native Canvas API
— then upload to OpenGL, Vulkan,
WebGPU, DirectX, and more.
The Canvas API mirrors the familiar browser
<canvas>
element.
Composite shapes stack fills, strokes, and gradients into a single
GPU-uploadable atlas with zero runtime tessellation overhead — the heavy
lifting happens once at build time, leaving the GPU pipeline clean and fast.
The former CEO of Yahoo! and current founder of a chatbot app is going viral for using AI to list things she loves about her daughter. But what she has to say about women in tech in 2026 is worth talking about....
In Sunday’s edition of the
New York Times
, Marissa Mayer, former president and CEO of Yahoo, told her interviewer something so absurd it’s since gone viral.
Struggling with the “impossible task” of naming three things that she loves about her own 10 year old daughter,
the
New York Times
reports
, Mayer asked the AI assistant she just launched to do that thinking for her. It delivered the perfect answer, Mayer said: “It came back and was like, your daughter is empathetic, creative and an animal lover.” Everyone is piling onto that absurd anecdote right now, rightfully so. What she has to say about gender in tech, however, is more out of touch than that.
Saying sensational things on the record — especially knowing that the reporter will not be able to resist using such a shocking story as the lede — is a savvy strategy. For someone as influential as Mayer, telling the list story is transparently a result of years of media training. Mayer is selling her new app, Dazzle, which accesses your camera roll and analyzes your life based on the photos you take. It’s disturbing to see her talk about relinquishing basic cognitive skills like “plan a birthday party” to AI. But the rest of the story gets into something Mayer has talked about for more than a decade: “the gender card,” as she’s called it.
“I never play the gender card,” she told Steven Levy
in a 2015 interview
. “The moment you play into that, it’s an issue. [...] In technology we live at a rare, fast-moving pace. There are probably industries where gender is more of an issue, but our industry is not one where I think that’s relevant.” She repeats similar sentiments in Sunday’s NYT interview.
The height of Mayer’s career coincided with the girlbossification of everything, during the
Lean In
era, when Notorious RBG and “well behaved women rarely make history” mugs were everywhere. She’s been asked about gender in tech one million times, and has mostly dismissed it. But a decade after the tech girlboss reigned, her thoughts on this haven’t seemed to evolve much.
Later in the NYT piece, she brushed off the notion that gender has any bearing on who gets to participate in the tech industry. She also brushes off a question about bias baked into AI models, something that’s been
studied
and
proven extensively
, and instead names female AI executives like Fei-Fei Li as the reason well-documented bias doesn’t exist. She asserts that passion overrides gender, as if just being “passionate” enough erases decades of women’s experiences in the tech workforce.
“To me, gender fades into the background. I talk about passion as a gender neutralizing force,” she told the NYT. “If you’re excited about something, gender doesn’t matter.”
Meanwhile, male figureheads of the AI industry are out here posting
slop videos about sperm
on main.
Half of women in tech
leave the industry by 35, earn 84 cents to their male counterparts’ dollar, and women founders receive half the amount of funding that male founders do.
Earlier this month, event organizers canceled one of the biggest gatherings of women and non-binary technologists, the Grace Hopper Celebration. “Unlike past events, this year, both individual registrations and sponsorship commitments came in significantly below our expectations and, ultimately, below the level needed to cover critical operating expenses,” the organizers
wrote in a statement.
Bloomberg reported
that this comes after years of declining attendance, with around 15,000 people attending in 2025, making it the fewest since 2016.
In 2023,
GHC attendees reported
standing in lines for hours to talk to recruiters, being shoved, harassed, and cut in front of by the hundreds of men who’d suddenly flooded the conference. “They trampled over attendees, shoved their way into the recruiter’s booth to wave their resumes in front of their faces, verbally assaulted attendees, and physically pushed and shoved attendees in line,” one attendee said.
After the GHC 2026 cancellation was announced, Kayley Seow, a tech worker who was at the 2023 conference, contacted me to talk about what it meant to her. She said she felt “pretty shattered” when she heard the conference wouldn’t happen this year. “GHC is such a pillar of the community that you don't expect to fall, or in this case, not run. Despite its flaws, it continues to be an important space for people hoping to get into tech and those already in it. I'd been recommending it to every undergrad or woman technologist to attend.” There are other, similar conferences held around the country, but GHC is hard to recreate, Seow told me. “Other organizations exist but they operate virtually, there's events here and there in the Bay, but it's impossible to find something as concentrated as GHC.”
The people she knows who are most affected are current undergrads who planned to go to GHC to connect with recruiters, find internships, and land graduate jobs, Seow said. “They're disappointed, and a little scared, since it's October and we're coming up on the end of internship recruiting season, especially for the international students who were hoping to talk to the bigger companies at GHC that have the resources to take on international students as interns.” It’s still unclear whether there will be a conference in 2027.
GHC’s cancellation this year follows a string of blows to organizations that support women technologists. Women Who Code, a nonprofit that awarded more than $3.5 million in scholarships and supported a community of 360,000 members,
shut down in 2024
after 11 years, citing funding issues.
Things are very different today than they were when Mayer was the first-ever pregnant
CEO of a Fortune 500 company
. In 2025, at the direction of President Donald Trump’s executive order “Ending Radical and Wasteful Government DEI Programs and Preferencing” and other orders, civil servants across the federal government
from NASA
to
the Social Security office
and the CDC had to drop everything to scrub mentions of diversity, equity and inclusion from their systems. This wasn’t just symbolic or semantic. The National Institutes of Health terminated billions of dollars worth of
nearly 2,300 federal research grants
, cuts that disproportionately affected women and early career researchers. Led entirely by
inexperienced men in their early 20s
and spearheaded by Elon Musk, the now-defunct Department of Government Efficiency
canceled funding
that would have advanced potentially lifesaving research projects focused on pregnancy and reproductive health, chronic illness, and vaccine safety for women. The damage done by DOGE cuts to the advancement of science and technology that would have been done by women and would have improved women’s lives around the world is immeasurable and widespread; it’s hard to imagine believing gender plays no role in STEM today in light of what we have seen under the Trump administration over the last year and a half, especially.
But in a way, Mayer is right: Drinking one’s own Kool-Aid is a non-gendered issue. Earlier this year,
Sam Altman suggested
AI generating podcasts to interact with your kids about their days and got similarly roasted for a week straight. He deserved it, and so does she.
About the author
Sam Cole is writing from the far reaches of the internet, about sexuality, the adult industry, online culture, and AI. She's the author of How Sex Changed the Internet and the Internet Changed Sex.
Up to 5x faster
than iMac with M4 for on‑device AI
4
Pixelmator Pro, Claude
AI apps on Mac
Mac is optimized to handle AI apps —
like Claude, LM Studio Bionic, Gemini, and the suite from Topaz Labs — so you can learn faster, think in new ways, and get more done.
Affinity, Mail
AI features in apps
Use intelligent tools to unlock new levels of productivity and creativity —
from searching faster in Mail and generating images in Affinity to editing in Adobe Photoshop and Final Cut Pro.
Great powers come with
great privacy.
Apple Intelligence and Siri AI are designed to protect your privacy at every step.
With powerful on-device processing, Apple Intelligence is aware of your personal information without collecting your personal information. And with groundbreaking Private Cloud Compute, Apple Intelligence can draw on larger server-based models, without making your data accessible to Apple or anyone else.
iMac is also available with a
nano‑texture glass option.
This reduces reflections and glare to eliminate distractions while maintaining outstanding image quality. It’s perfect for spaces with challenging lighting conditions — whether you’re near a window or under bright indoor lights.
Center Stage
Center Stage.
The 12MP Center Stage camera puts the focus on you — and keeps it there. Stay perfectly framed during video calls, even as you move around or when more people join in.
Desk View
Desk View.
Share a top-down view of your workspace — ideal for giving online music lessons or showing off your latest project.
Studio-quality mics.
The microphones on iMac make sure your voice comes through crisp and clear. And with directional beamforming, everyone hears you — not what’s going on around you.
Six-speaker sound system.
iMac brings incredible audio to any space. Two pairs of force-cancelling woofers with two tweeters fill the room with bold, bass-rich sound. And Spatial Audio with support for Dolby Atmos creates an immersive listening experience.
iPhone Mirroring
iPhone Mirroring.
See and use what’s on your iPhone from your iMac, without having to reach for it.
6
Move files, photos, and videos between devices as easily as you drag and drop between apps on Mac.
Universal Clipboard
Universal Clipboard.
Lets you copy text, images, photos, and videos on your iPhone and paste to your iMac — or vice versa.
Calls and texts
Calls and texts.
Calls and texts from your iPhone come right to your iMac, so you don’t need to switch devices when you’re in the zone.
7
Magnetic attraction.
A color-matched power connector magnetically and effortlessly snaps into place.
Magnetic attraction.
A color-matched power connector magnetically and effortlessly snaps into place.
Powerful ports. More possibilities.
iMac features up to four Thunderbolt 4 ports — expanding your accessory options and enabling lightning-fast data transfers. And you can connect up to two external 6K displays for a vast canvas to view your work.
8
Powerful ports. More possibilities.
iMac features up to four Thunderbolt 4 ports — expanding your accessory options and enabling lightning-fast data transfers. And you can connect up to two external 6K displays for a vast canvas to view your work.
8
8 ports
3x Thunderbolt 4 or 3x Thunderbolt 5, 2x USB-C, HDMI, Ethernet, headphone jack
"Dark Day for Journalism": Egypt Shutters Independent News Site Mada Masr, Detains Editor
Democracy Now!
www.democracynow.org
2026-10-27 08:51:30
A court in Cairo has ordered the closure of the independent Egyptian news site Mada Masr. The court also ordered the site’s editor-in-chief, Lina Attalah, to be detained until she pays a fine of over $50,000. She was convicted on charges of managing an unlicensed website. Mada Masr is “t...
A court in Cairo has ordered the closure of the independent Egyptian news site
Mada Masr
. The court also ordered the site’s editor-in-chief, Lina Attalah, to be detained until she pays a fine of over $50,000. She was convicted on charges of managing an unlicensed website.
Mada Masr
is “the flagship independent media outlet in Egypt and a pillar of independent media in the region,” says Sharif Abdel Kouddous of
Drop Site News
, who previously worked at
Mada Masr
. The independent outlet was founded in 2013 “in the midst of Egypt’s revolution and counterrevolution” and has “managed to survive all of those years in one of the most hostile media environments” in the world. Still, “what happened today is an unprecedented escalation” because Attalah and
Mada Masr
had never before been referred to trial.
Kouddous adds that the attack on
Mada Masr
comes less than a month after Egyptian authorities arrested an entire newsroom at the independent fact-checking outlet
Matsadaash
. They remain behind bars.
Guests
Please check back later for full transcript.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
EnsoJS - native-first microframework for building declarative Web Components
"Anti-Fascist Economics": Isabella Weber on How Inequality Fuels Extremism & Erodes Democracy
Democracy Now!
www.democracynow.org
2026-10-27 08:29:38
With the U.S. midterm elections just a week away, the affordability crisis — intensified by President Trump’s tariffs and war on Iran — has emerged as a major campaign issue. Across the country, families are struggling to make ends meet, while oil and gas companies have reported record profits...
With the U.S. midterm elections just a week away, the affordability crisis — intensified by President Trump’s tariffs and war on Iran — has emerged as a major campaign issue. Across the country, families are struggling to make ends meet, while oil and gas companies have reported record profits during recent periods of price shocks.
Economist Isabella Weber’s new book,
Anti-Fascist Economics: In Defense of Affordability, Dignity, and Democracy
, warns economic insecurity can fuel the rise of authoritarian movements, and argues protecting democracy requires making life affordable for everybody.
Anti-fascist economics is “not about getting rid of the market,” says Weber. “It’s about having public players that behave differently, and by behaving differently, changing the dynamic of the market as a whole and literally creating an alternative so that people are not dependent on often very concentrated and private providers as the only choice,” she explains, providing current examples of governments enacting such policies from New York City to Mexico City to Rome.
Please check back later for full transcript.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
Trump Is Already Undermining Confidence in Midterm Election Results from Alaska to California: ACLU
Democracy Now!
www.democracynow.org
2026-10-27 08:17:44
A competitive Senate race has gripped the once reliably Republican state of Alaska. If Democratic challenger Mary Peltola wins the election against incumbent Republican Senator Dan Sullivan, it could tip the balance of power in Washington. Attorneys for Peltola and the Democratic Senatorial Campaign...
This is a rush transcript. Copy may not be in its final form.
NERMEEN
SHAIKH
:
Early voting is underway in Alaska, where a competitive Senate race has gripped the once reliably Republican state. If Democratic challenger Mary Peltola wins the election, it could tip the balance of power in Washington. Earlier this month, President Trump campaigned with Republican Senator Dan Sullivan.
SEN
.
DAN
SULLIVAN
:
Ladies and gentlemen, the conflict in the Middle East is temporary. The true forever war is the national Democrats’ war against Alaska oil and gas and our jobs. That’s the forever war.
PRESIDENT
DONALD
TRUMP
:
Mary is no friend of Alaska. So, on November 3rd, you need to vote for the man that delivers Alaska like no one else, and that’s the real Dan. Have to do it.
NERMEEN
SHAIKH
:
Well, last week, the Department of Justice filed a lawsuit seeking to block the certification of the election results in Alaska if Republican incumbent Senator Dan Sullivan loses. The lawsuit alleges that the appearance of another candidate on the ballot, named Daniel J. Sullivan Jr., would mislead voters. Daniel J. Sullivan Jr. is a retired elementary school teacher from Petersburg, Alaska, who’s running unaffiliated. The Alaska Supreme Court ruled ahead of the primary that he could appear on the ballot. Speaking in Florida on Friday, President Trump confirmed he had ordered the Department of Justice to file the lawsuit less than two weeks ahead of the midterms, saying, quote, “I’m the one that said do it.”
AMY
GOODMAN
:
Meanwhile, Alaska’s other Republican senator, Lisa Murkowski, said she opposes the Justice Department’s lawsuit, saying, quote, “Alaskans don’t need any help voting for their preferred candidates, and the State of Alaska has already handled this by clearly distinguishing the candidates on this year’s ballot. The Department of Justice should never have filed this lawsuit,” she said.
Attorneys for Alaska’s Democratic Senate candidate Mary Peltola and the Democratic Senatorial Campaign Committee have filed a motion to dismiss the lawsuit, which they denounced as, quote, “an unprecedented preemptive strike on democratic elections.”
The
ACLU
— on behalf of two Alaska voters, the League of Women Voters of Alaska and Common Cause — moved to intervene in the case and have also filed a motion asking the court to dismiss.
To discuss this latest
DOJ
lawsuit and more critical cases ahead of the midterm elections, we’re joined now by Sophia Lin Lakin, director of the ACLU’s Voting Rights Project. She’s joining us from Brooklyn, New York.
Hi, Sophia. Thanks so much for being there. Can you explain what’s going on in Alaska?
SOPHIA
LIN
LAKIN
:
Well, we have a baseless lawsuit brought by the Department of Justice. It is — there’s no basis in the law for this. There is no merit to this claim. We’re really scraping the bottle when it comes to true legal arguments to take over, essentially, the certification process if the administration’s preferred candidate doesn’t win. This is an extraordinary ask for an election that hasn’t even — the votes in this election haven’t even been counted. It is a press release with a case number.
And the
ACLU
has asked the court to dismiss this lawsuit in the strongest terms, and we’ve asked the court to consider sanctions, because the courts shouldn’t be used to launder baseless claims into distrust in our elections. There should be consequences for that.
NERMEEN
SHAIKH
:
[inaudible] go to comments made by U.S. Attorney General Todd Blanche about this case, which he defended, defended the Department of Justice lawsuit blocking Alaska’s Senate results if Republicans lose. He was speaking on CBS’s
Face the Nation
.
ATTORNEY
GENERAL
TODD
BLANCHE
:
There’s not two Dan Sullivans, one an incumbent and one running. That’s not true. The head of the Alaska Election Commission — not President Trump, not me — has said that the second Dan Sullivan is running solely to confuse voters, solely to pull votes away from the incumbent senator. …
All we are doing is trying to put guardrails in place so that if that — this — that happens, there’s a system allowed where the ballots are kept in a way so that we can determine whether there was confusion. It’s not saying don’t certify. It’s saying if a court ultimately determines that it was decided because of confusion and not the will of the voters, then we do not think the state should certify. And that’s consistent with federal law and consistent with even Alaskan law, if that happens.
NERMEEN
SHAIKH
:
So, Sophia, if you could comment on what Blanche said? And also, is there any precedent for two candidates with virtually indistinguishable names to be on the ballot?
SOPHIA
LIN
LAKIN
:
Well, look, the Alaska Supreme Court already decided this issue and said that these two candidates can be on the ballot and that there is — there are distinguishing features for voters if they are at all confused. One of the candidates, the incumbent, has “incumbent” listed next to his name, as well as the notation that he is the Republican. So, voters should be able to distinguish, and the courts and the state of Alaska have already addressed this issue.
Now, in terms of the case, the merits of the case itself, the Department of Justice cites a national voter registration law. That’s the name of the law. It has to do with voter registration. It has nothing to do with the certification or the counting of ballots at all. And not only that, the lawsuit doesn’t cite any substantive provisions of this National Voter Registration Act. It cites merely the preamble, the introductory paragraphs. So it doesn’t even cite any authority, any basis that gives the Department of Justice any ability to enforce these claims about confusion, these claims about the possibility that voters might not be able to distinguish what’s pretty clear on the ballots.
NERMEEN
SHAIKH
:
Sophia, the implications of Trump just coming out quite openly in support of this lawsuit, indeed saying that he is the one who said, “Do it”?
SOPHIA
LIN
LAKIN
:
Yeah, that is quite extraordinary to have, and it is part of a broader effort that the Trump administration started the moment that Trump took office the second time. It’s part of an attempt to undermine confidence in our elections, to interfere in election administration, to create pretext to challenge results that the administration doesn’t like. It’s part of that broader pattern.
But courts, we have pushed back. Courts have held that the Constitution is really clear on this point. The president doesn’t have any role in setting the rules of elections. The president doesn’t have the ability to interfere in our elections. States run our elections, and voters are the ones who decide the outcomes, not the president, not the Department of Justice.
AMY
GOODMAN
:
In California, Los Angeles election officials say a list compiled by the Department of Justice of some 20,000 alleged noncitizen registered voters includes a high percentage of people born in the United States. The new revelations come after a court filing by California state and local officials in response to a lawsuit filed by the Trump administration. Earlier this month, the Justice Department gave California 48 hours to segregate the ballots of those named on the list, which local officials blasted as unreliable after an early review of the voters’ records. Can you comment on this?
SOPHIA
LIN
LAKIN
:
Yes. Once again, this is another attempt, a part of that broader effort, to undermine confidence in our elections, this time using an unverified, completely undisclosed list that we know causes errors. We know that it’s going to sweep up eligible voters, and California and the L.A. County have identified some already. And what we do know is that this, again, is a claim, is baseless, that it’s an attempt to decide in advance which votes should count, and give a pretext to challenge outcomes that the administration doesn’t like. We’re seeing this once and once again, and again, these claims are meritless. We’re scraping the bottom of the barrel when it comes to arguments here. These are press releases masquerading as lawsuits.
NERMEEN
SHAIKH
:
And could you put this, Sophia, in the broader context of attacks on voter rights as we approach the midterms?
SOPHIA
LIN
LAKIN
:
Well, unfortunately, we are seeing unprecedented assaults on voting rights from the Trump administration, from the Trump administration’s allies in the states, in local — in the localities, as well. And we’re doing everything we can to push back. Courts have been holding. Partners on the ground have been pouring out in numbers. We have over 100,000 volunteers at this point who are ready to mobilize and organize to make sure that these threats that the Trump administration, its allies are putting on our elections to undermine confidence in our elections are put to bed, that these elections run according to law, and that we can have a new seating of Congress that is peaceful, and that people feel confident in those election results.
AMY
GOODMAN
:
Sophia Lin Lakin, we want to thank you so much for being with us, director of the ACLU’s Voting Rights Project.
Coming up,
Anti-Fascist Economics: In Defense of Affordability, Dignity, and Democracy
. We’ll speak with the acclaimed economist Isabella Weber. Stay with us.
[break]
AMY
GOODMAN
:
“Fascists in Our Midst” by Montreal musician Paul Cargnello.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
Headlines for October 27, 2026
Democracy Now!
www.democracynow.org
2026-10-27 08:00:00
Netanyahu Battles to Hold Power as Israel Holds First Election in Four Years, U.N. Commission of Inquiry Finds Israel Committed Genocide in Gaza, War Crimes in West Bank, Humanitarian Crisis Grows as Houthis Lay Siege to Yemen’s Third-Largest City, Seven Are Killed as Jordan Bombs Syria Follow...
Netanyahu Battles to Hold Power as Israel Holds First Election in Four Years
Oct 27, 2026
Voters in Israel are heading to the polls today in the first general election in nearly four years. At stake are 120 seats in Israel’s parliament, the Knesset, where 61 votes will be needed to form a majority. Likud party leader Benjamin Netanyahu is seeking to extend his term as Israel’s longest-serving prime minister — that’s despite a warrant issued by the International Criminal Court seeking his arrest for war crimes and crimes against humanity committed in Gaza. Netanyahu also faces criminal charges of bribery, fraud and breach of trust. His main challenger is Israel’s former army chief Gadi Eisenkot, who supports illegal Israeli settlements, opposes a Palestinian state and has vowed to destroy Hamas’s military wing in Gaza within 18 months. A prominent Palestinian citizen of Israel, Sami Abu Shehadeh, who leads the Palestinian nationalist political party Balad, was forced out of the race. Meanwhile, millions of Palestinians living under Israeli occupation in East Jerusalem, the West Bank and Gaza Strip are ineligible to vote — even as election officials set up polling stations in illegal Israeli settlements.
U.N. Commission of Inquiry Finds Israel Committed Genocide in Gaza, War Crimes in West Bank
Oct 27, 2026
A United Nations commission of inquiry has accused Israel of committing genocide in the Gaza Strip during the war that followed the October 7, 2023, attacks. The report published Monday by the U.N. Independent International Commission of Inquiry on the Occupied Palestinian Territory found Israel’s attacks on Gaza were intended to “destroy the Palestinian people, in whole or in part.” The commission also accused Israel of committing crimes against humanity in the occupied West Bank, including extermination, torture and rape.
The report was released as Israeli attacks on Gaza killed at least five Palestinians, including a 7-year-old girl. Meanwhile, in the occupied West Bank, Israeli forces have continued a large-scale offensive for a fifth consecutive day in the city of Hebron, where officials say nearly 5,000 Palestinians have been forced from their homes.
Humanitarian Crisis Grows as Houthis Lay Siege to Yemen’s Third-Largest City
Oct 27, 2026
In Yemen, Ansar Allah, known as the Houthis, used explosives to severely damage a critical road into Taiz, according to Human Rights Watch. The Hayjat al-Abd road is critical for delivering food, medicine and fuel to the city. Taiz has been besieged since fighting escalated between the Saudi-backed government and Ansar Allah. Fuel shortages in Taiz are straining hospitals, with one hospital forced to cut the number of incubators, putting newborn babies at risk. This is a neonatal nurse at the Yemeni-Swedish Hospital.
Nada Ahmed
: “We reduced the numbers to 10 incubators because of the fuel shortage. There’s no oxygen. There’s no fuel to run the incubators, to keep the babies warm. We also moved from upstairs to downstairs for the babies’ safety. There is shelling near the hospital.”
Seven Are Killed as Jordan Bombs Syria Following Deadly Church Attack
Oct 27, 2026
Image Credit: The White Helmets
In Syria, officials say seven people were killed, including women, children and an elderly man, after Jordan’s military struck sites in Daraa and Suwayda provinces. Jordan’s military said its fighter jets had killed and wounded “several terrorists,” without elaborating. The strikes followed a shooting at a Greek Orthodox church in Jordan on Friday that left nine people dead and 34 injured. Earlier on Monday, Jordan’s government said it had arrested three suspects behind the deadly church attack.
Health Worker Killed in
DRC
as Ebola Cases Approach 10,000
Oct 27, 2026
In the Democratic Republic of the Congo, youths wielding machetes attacked two community health workers who were raising awareness of the Ebola outbreak in the country, killing one and wounding another. A local official said health workers in the area where the latest attack took place are sheltering at the general hospital under police guard. This is a U.N. spokesperson on the latest.
Daniela Gross de Almeida
: “These incidents highlight how violence and mistrust can undermine the Ebola response and limit access to essential health services, as the numbers of confirmed cases approach 10,000, according to national authorities.”
Russia and Ukraine Trade Drone Attacks Despite Local Ceasefire in Russian-Occupied Oleshky
Oct 27, 2026
Image Credit: 34th Separate Marine Brigade "Borysfen”
In Ukraine, a local ceasefire is underway in the Russian-occupied city of Oleshky, where fighting has left residents cut off from food and medical aid. The rare ceasefire to allow humanitarian access was brokered by U.S. first lady Melania Trump. Meanwhile, Russia and Ukraine continue to trade attacks elsewhere. Overnight, Russia launched hundreds of drones and ballistic missiles across Ukraine, killing at least one person and injuring 15 others in the capital Kyiv, including students in a dormitory. And Russian officials said a Ukrainian drone killed a man and wounded six people in the western Russian city of Bryansk near Ukraine’s border, while another person was killed and 30 injured when a drone hit a bus in Russian-occupied Zaporizhzhia.
Meanwhile, a new report submitted to the U.N. General Assembly finds Russian officials committed war crimes by directing attacks against civilian targets in Ukraine, as well as crimes against humanity through continuous attacks on Ukraine’s energy infrastructure. This is Pablo de Greiff, a member of the Independent International Commission of Inquiry on Ukraine.
Pablo de Greiff
: “Those attacks that target civilian objects indispensable to the civilian population are unlawful and amount to war crimes.”
Far-Right Presidential Candidate Bolsonaro Concedes Defeat in Brazil Election
Oct 27, 2026
In Brazil, far-right presidential candidate Flávio Bolsonaro has backed off his pledge to challenge the results of Sunday’s election, after results showed incumbent President Luiz Inácio Lula da Silva won by nearly 4.5 million votes. Bolsonaro’s concession came just minutes after President Trump signaled he would not intervene on Bolsonaro’s behalf — although Trump did state, without evidence, that the vote “looked like another rigged election.” Bolsonaro also said Brazil’s Supreme Court had ordered police to seize his passport. According to The New York Times, Bolsonaro faces a criminal investigation over his links to a Brazilian lawyer accused of laundering more than $1 billion through a fraud scheme.
Trump Continues Campaign Tour of Deep-Red States with Rally in Mississippi
Oct 27, 2026
President Trump continued his campaign tour of deep-red states on Monday with a rally in Mississippi, where incumbent Republican Senator Cindy Hyde-Smith is facing a challenge from Democrat Scott Colom. Trump spoke for 83 minutes, while Senator Hyde-Smith spoke for exactly three seconds. These were the senator’s entire remarks.
Sen. Cindy Hyde-Smith
: “Is this not the best president in our lifetime?”
Senator Hyde-Smith has refused to debate her Democratic opponent, Scott Colom, who is seeking to become Mississippi’s first Black senator since Reconstruction. Colom is a district attorney who was nominated by President Joe Biden in 2022 to become a U.S. district judge; his confirmation was blocked by Senator Hyde-Smith, who cited his support for transgender student athletes.
Trump’s Investments in Oil and Gas Stocks Doubled in Value in the Past Year
Oct 27, 2026
A new report finds President Trump’s investments in oil and gas stocks doubled in value in the past year, even as fuel prices surged due to Trump’s war of choice against Iran. The report by Democrats on the Congressional Joint Economic Committee found Trump’s fossil fuel investments are worth up to $81.6 million, and that the vast majority of his new stock purchases came after he ordered strikes on Iran in late February. Over the weekend, Trump rejected that gas prices are too high. He spoke from a campaign rally in Perry, Georgia.
President Donald Trump
: “No, I could just see the fake headlines: 'President Trump is talking about all the money they're making while people are suffering at the pump.’ That’ll be the headline. But I said, 'I don't give a damn. I’m going to say it: We’re making a freaking fortune.’”
Meanwhile, the Costs of War Project at Brown University estimates that Americans have spent an additional $609 per household just for gasoline since the start of the U.S. war on Iran.
House Judiciary Committee Releases Report on Trump’s Epstein Ties with New Assault Allegations
Oct 27, 2026
Image Credit: Davidoff Studios/Getty Images
Democrats on the House Judiciary Committee released a 50-page report Monday detailing testimony from 11 women, five of whom directly accuse Donald Trump of rape or sexual assault in the presence of convicted sex offender Jeffrey Epstein. The allegations span from the mid-1980s to the 1990s. In the report, there are new details from Beatrice Keul, a model and former Miss Switzerland, who alleged to the Judiciary Committee that she was raped by Trump in 1993 in a Plaza Hotel suite in Manhattan when she was 24. According to the report, Trump “grabbed Keul from behind and forcibly raped her,” leading to “bleeding and bruising on multiple parts of her body.” Democrats on the House Judiciary Committee have formally requested that the
DOJ
appoint an independent special counsel to investigate Trump’s ties to Epstein.
Federal Judge Rules Firing of Maurene Comey Was Unconstitutional
Oct 27, 2026
A federal judge has ruled that the firing of former federal prosecutor Maurene Comey was unconstitutional. Comey had claimed in a lawsuit that her termination was an act of retribution, because her father, former
FBI
Director James Comey, is a fierce critic of Donald Trump who oversaw investigations into alleged Russian interference in the 2016 election. Maurene Comey was in charge of several high-profile cases, including against convicted sex trafficker Jeffrey Epstein.
Justice Department Unseals Charges Against Former
FBI
Director James Comey
Oct 27, 2026
Image Credit: James Comey via Instagram
Just hours after the judge ruled that Maurene Comey’s firing was unconstitutional, charges against James Comey were unsealed on Monday. It’s the third time he’s been charged. In this latest case, James Comey is charged with knowingly communicating information related to national defense to an unauthorized individual. Comey is also seeking to dismiss another case, after the
DOJ
obtained an indictment against him on charges of threatening Trump’s life by posting a photo of seashells on a beach on social media, arranged to say “86 47.” In his first indictment, which was later dismissed, Comey was accused of falsely testifying to Congress.
James Comey
: “Well, they’re back again. It would almost be funny if it weren’t such an appalling abuse of the Department of Justice, one that we cannot become numb to. Nothing’s changed with me. I’m still innocent, I’m still not afraid of these people, and I still believe in the independent federal judiciary.”
Anthropic Seeks
IPO
as It Reports Losses of Over $80 Billion
Oct 27, 2026
Anthropic is seeking an initial public offering that could make it one of the world’s most valuable corporations. The AI company reported $16.3 billion in revenue during the first half of the year, with losses of over $80 billion. Despite the red ink, Anthropic’s initial valuation could exceed SpaceX’s record-setting $1.8 trillion
IPO
last summer. In paperwork filed with the Securities and Exchange Commission, Anthropic warns of the growing risks of “misaligned or misused” AI models, acknowledging that “Sufficiently advanced AI systems could, if not developed, deployed, and operated with appropriate safeguards, oversight, and security measures, pose catastrophic or existential risks to humanity, particularly if such systems were misused, replicated, weaponized, or allowed to operate with a high degree of autonomy.”
In more tech news, Microsoft announced Monday that it would offer voluntary buyouts to about 60,000 workers, or more than a quarter of its global workforce, citing cost-cutting as it spends hundreds of billions of dollars on AI data centers and chips.
Egyptian Court Orders Closure of Independent News Site Mada Masr
Oct 27, 2026
Image Credit: Mada Masr
In news from Egypt, a court in Cairo has ordered the closing of the independent news site Mada Masr. The court also ordered the site’s editor-in-chief, Lina Attalah, to be detained until she pays a fine of over $50,000. She was convicted on charges of managing an unlicensed website. After the court’s ruling, Attalah was taken into custody. Earlier this week, Mada Masr published an editorial that read in part, “We understand that a sword will most likely be raised above our heads very soon. Even the faintest spark shakes darkness to the grounds. We still think of all of this as an interruption, because that’s how you fight a political fight.” We will have more on this story later in the show.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
Heads up:
your browser doesn’t support customizable selects yet, so the “after” demos below look like ordinary selects. That’s also exactly what your visitors would see in this browser. To see the difference, open this page in Chrome or Edge.
There are multiple articles about
appearance: base-select
and how you can use it. We finally can style a select. The bigger change is what an option can hold. Until now, an option was one line of plain text, so everything a person needed to decide had to fit in a label or be left out. Now an option can carry the thing people actually decide with: a preview, a number, a job title, a warning. They stop reading and working things out, and start recognising.
Below are five selects, each shown before and after. The before is what most forms do today. The after is the same
<select>
, with the same keyboard behaviour and the same form value. Only what it shows has changed. If you want the mechanics, the
Chrome team’s announcement
and
MDN’s guide
cover them well.
See it, don’t imagine it
A font picker usually lists names. To choose well, you either already know what Fraunces looks like, or you pick it, look at the result, and come back to try the next one.
When each option is set in its own typeface, the option is the preview. You judge the shape, not the name.
Before
After
Before, you need to know what Fraunces looks like. After, you see it.
This pattern is not new. We already have in document editors (like Google Docs) and in design tools (like Figma and Photoshop). It just became available for us and all we need is one inline style per option,
style="font-family: 'Fraunces', serif"
, and the closed control keeps the typeface after you choose. We are also able to show the category of each font, like Serif, Sans, Mono, Display, or Handwriting.
Let the list do the maths
Time zone pickers tend to look like “(GMT+09:00) Tokyo”. The offset is accurate and almost never what you want. What you want is the time there, so you add the offset to your own time in your head, and maybe get it wrong around midnight.
Show the current time next to each city, plus whether it’s day or night, and the question answers itself before you choose.
Before
After
Before, you work out the time from the offset. After, the list tells you, and whether it’s day or night.
This is the only demo that needs JavaScript, because the times come from
Intl.DateTimeFormat
.
Compare at a glance
Delivery options are usually a group of radio buttons, each with its details written out as a sentence.
To be fair, radio buttons have a real strength. Every option is visible without a click, and for two or three short choices they’re the right pattern. But once each option carries a few facts, the facts end up in prose. Comparing means reading every sentence and holding the numbers in your head.
A select with the facts in aligned columns turns that into a glance down a column, in the space of a single field.
Before
After
Before, the details hide in sentences and take the whole panel. After, the same choice fits in one field, with arrival and price lined up.
At a company of about two hundred people, we had two colleagues with the same name, in different departments. Whenever I had to pick one of them, I went by their job title. Photos help less than you’d think, because people often don’t know what a colleague looks like, especially one in another department.
A text-only select gives you two identical options and a guess. Put the title and department under each name and they become two different answers. The closed control keeps the title too, so anyone reviewing the form can see who you picked.
Before
After
Two people share a name. Before, you guess. After, the title and department make them two different answers, even once the list is closed.
Know before you choose
Some options come with consequences. In a plain select, you find out afterwards.
Mark those options in the list and you know while you’re choosing.
Before
After
Before, you find out a team needs approval after you’ve shared. After, you know while you’re choosing.
The badge appears only on the options that require special attention, and nowhere else.
It’s still a select
Every “after” in this post is a plain
<select>
. Keyboard handling, type-to-jump, form submission,
select.value
,
required
, validation and the accessible role all stay with the browser, and the control itself needs no JavaScript.
The bigger trade-off is on phones. A native select opens the operating system’s own picker. It shows a scrolling wheel on iOS, a sheet on Android. Those are familiar, sized for thumbs, and tuned to each platform’s accessibility features. A customizable select doesn’t use them; it draws its own list on the page instead.
You don’t have to pick one behaviour for everyone. Opt in only where there’s a mouse or trackpad, and touch devices keep their native picker:
@media (hover: hover) and (pointer: fine) {
select,
::picker(select) { appearance: base-select; }
}
/* Or we can rely on the window size */
@media (min-width: 768px) {
select,
::picker(select) { appearance: base-select; }
}
Phone users then see each option’s text without the extras, which is one more reason the text has to stand on its own. The demos in this post opt in everywhere, so you can try them on any device.
Start using it today
Customizable select is a textbook progressive enhancement. A browser that doesn’t support it doesn’t break. It shows a regular native select, keeps only the text of each option, and submits the same value. Nobody gets a worse form than they have today. If you’re reading this in Firefox at the time of writing, the “after” demos above are exactly what your visitors would see.
That leaves one requirement, and it’s good practice anyway. The text of every option has to make sense on its own. “Ahmed Mostafa, Accountant · Finance”, not just a name. “Express, Tomorrow, $8.50”, not three loose fragments. In the demos, small separator spans that are hidden in the customized version make the plain version read like a sentence. No polyfill needed.
So there’s no reason to wait. Find the select in your product where people hesitate the most, ask what they’re really trying to find out, and put that answer inside the option. Leave everything else out.
Software may be getting worse, but it used to be horrible
Software is degrading all around us, for obvious reasons.
I've written about this before.
All else equal, if you increase your code production by 10x but you don't reduce your error rate by a factor of 10, then your production app is buggier than it used to be.
I've seen threads where people also have some nostalgia for the past: "software used to be better in the past" or "we've forgotten how to program like we used to" or "software quality has been declining for decades." And as someone who has used computers since 1990, I'm here to disabuse you of this notion. Software was horrible. Everything crashed all the time. Yes, there were great programmers like John Carmack who could keep the entire program in their head and iterate on thoughtful codebases over decades. No, they did not write a majority of the software that we used to use.
Historical context
Almost everyone in the world was on Windows. Windows peaked around a 95% market share, plus or minus a few percentage points based on your source. Yes, you probably knew someone with an iMac who would tell you that it was way better than a Windows machine, and they could prove it if anyone ever actually released applications for Macs. And yes, there were Linux distros like Debian where people could get real computing done
[0]
.
But those were exceptions. Almost every computer user had a Windows machine and either an Intel or an AMD processor. And Windows had a lot of problems.
There was one saving grace though: companies only got one chance to ship their software. At a certain point, it was going to be loaded onto a floppy disk or burned onto a CD or a ROM, put into a box, and mailed out. And that version had to work out of the box. So there was some quality floor that you couldn't slip below.
How bad did it get?
Here's a collection of things that I remember. This isn't linear; it's my collection of memories from 1990 and onward.
Blue Screen of Death
Windows had extreme stability issues for most of my childhood.
Let me introduce you to the song of my people, the Blue Screen of Death.
This was Windows' version of a kernel panic. It happened right when you were in the middle of something. Or maybe you were doing nothing. It didn't matter: the blue screen was coming.
Your computer crashed for a lot of reasons. First, device drivers. If you bought some new peripheral like a joystick, it'd come with a floppy disk or CD with device drivers. You'd dutifully install them. The device drivers had the same function as they do today: they help the operating system understand how to interface with the hardware. This might get you thinking, "Oh wow, so they sent out the device drivers on physical media? You can't update a physical disk once you ship it. Surely they took extra care to get everything right." My friend, this could not be further from the truth. I'm sure there were good drivers and bad drivers. But in aggregate, they were buggy, and it only took one marginal device driver to destabilize your computer.
The Windows operating system also had its own code quality issues back then, and would sometimes fail to fully reclaim resources from programs that exited. So your computer would slowly degrade over time until eventually the slow rot would take down your machine.
All in all, your computer would just blink out of existence from time to time. It was a fact of life.
Autosave
Do you know what pairs really well with a computer that crashes all the time? Applications that don't autosave. Even better, applications with autosave that don't flush buffered writes and corrupt their save files.
It was commonplace to get into the zone and work on a document for hours, and then suddenly you would get either a Blue Screen of Death, or a pop-up saying that your application had a problem and had to exit. And you'd scream and you'd double-click your document over and over, but it was no use. You had to start over. But there was a consolation prize. It was your turn to tell everyone, "I was working on a document for THREE HOURS! And then the computer crashed and I lost everything. It was all gone. I had to redo it." There was always that one asshole that was like "why didn't you save?" But you didn't get mad. You knew that he was 2 weeks from having the same thing happen to him.
When I joined the Google Docs team back in 2010, we instrumented the Ctrl+s keyboard shortcut for fun. It didn't do anything but record a metric saying that it had been pressed. This "save" keyboard shortcut was in the top 5 non-editing user actions, just behind things like "move the cursor with arrow keys." And it did absolutely nothing. Google Docs autosaves. But everyone was so traumatized from years or decades of losing work that they reflexively saved anytime they edited anything.
Nothing was secure
When my sister and I were little, we loved going into stores with display units. The computers would often have games installed you could play. Worst case, you could always open up MS Paint or Solitaire and mess around for a few minutes.
One time, we were in a store where the display models had password-protected screensavers. My sister was undeterred. She just hit Ctrl+Alt+Del, selected the screensaver application, and clicked "End Task." And we were in. The best minds of Microsoft were nothing next to the hacking talent of a 9-year-old.
And this is the level of security that your computer afforded you. If you used the Internet for long enough, your computer would start to collect a bunch of advertising malware. When you turned your computer on, you would start to see pop-ups and pop-unders with random ads, even when you weren't using browsers. So you'd do another antivirus scan, or later on you could visit websites that could also run the malware scans for you.
And not to mention the viruses that would
drop the Internet to its knees
once a year by doing trivial things like "adding a macro to a Word document that sends emails."
Disk fragmentation
Any techie can remember going to a nontechnical relative's house. In some dusty corner, they'd have an ancient Windows computer barely hanging on by a thread. It would literally take 20 minutes to turn on.
You'd sigh and say, "let me fix this for you."
You would open two programs. This would take about 5 minutes. The first program emptied cache files and the Recycle Bin. The second was Disk Defragmenter.
Your computer slowly became unusable if you never saw this window.
Back in the day, hard drives in Wintel boxes stored data with spinning magnetic platters. The hard drive had a retractable arm with a little magnetic reader, and it would read data by retracting the arm to the right position and then moving the disk to the start of a sector.
But of course, as you add more and more files, the game of Tetris doesn't work, and the rest of your file doesn't neatly fit onto the disk before the next file's record begins. So your file would end up in two (or more) places on the hard drive. This was called fragmentation. A little bit of fragmentation was unavoidable, but if more and more files became fragmented then your computer became slower and slower until eventually Grandpa's computer took 20 minutes to start.
Many modern filesystems, Windows' included, automatically handle defragmentation in the background nowadays. But Windows did not back then. You needed to periodically manually start the defragmentation process yourself.
By the time I got into college, I discovered that Windows had a scheduler and could run Disk Defragmenter whenever I wanted, so I just left my computer on all the time and let it defragment at 5 in the morning.
Phenomenal cosmic power, itty bitty memory
Applications were heavily memory constrained, so programmers tried to save bits and bytes everywhere.
This should have been invisible to me, but it wasn't.
At one point I had a crappy video game version of Axis and Allies for the PC, released in 1998
[1]
. Imagine Risk but World War 2. And the AI was really bad, and could generally be beaten easily. But the game had a major flaw: If a country had more than 255 units, the whole game would crash. And naturally the AI also loved to turtle, so it was common for the AI to have a territory with over a hundred units that was impossible to wear down. So because of this programming choice, the game was a race to wipe out the enemy before it could force a stalemate by crashing the game.
This kind of thing happened all the time. During my first programming class in my freshman year of high school, one of our lessons was effectively, "here's why you all recognize numbers like 128, 256, and maybe 65536."
Software came on unreliable physical media
Even if the software worked perfectly, you might scratch your game CD and lose the ability to play it. Then you'd start asking your friends if anyone had a spare copy of Red Alert or something, just so that you could finally finish the single-player campaign.
This wasn't unique to CDs. Anything physical could degrade. My half-brother had a NES game called Dragon Warrior or something, but the cartridge was corrupted and there was no way to leave the first room. And even if you kept all of your games in good condition, the contacts inside of the NES that connected the cartridge to the console could rust and fail. This kind of thing happened all the time.
"But Jake, that's hardware and not software." All I'm saying is that y
our software was fragile and it needed to be protected and preserved.
It's not like you had the option for a physical disk or the online install and you chose the disk. By the nature of distribution, the software itself would degrade and rot away from you.
Online games assumed good behavior
One of the earliest online games I played was Diablo II, which means that I have seen the true heart of darkness inside of humanity.
Online games have a strange problem: gamers often don't want to be together. They just happen to cohabitate a space. And Diablo II had a lot of design features that lent themselves to chaos:
There were rampant client-side hacks. In PVP servers, people would use hacks to e.g. fire tracking arrows far beyond the range that they should have been able to.
All item drops were equally available to everyone in the server. That means when you got close to killing an act boss, you and your party would transition from allies to rivals and spam click when the boss finally popped.
If you had a corpse on the ground and died again, you'd lose everything you had equipped. People would try to force you to have a full inventory by dropping a bunch of cheap items onto your corpse, hoping that you'd accidentally pick up common items before picking up your corpse. Then you'd try to pick up your corpse. You'd only pick up some of the items. Then they'd kill you a second time and you'd lose everything that you managed to pick up.
The game had a lot of item duping glitches. As you can imagine, this ruined the in-game economy since it became dominated by the duped items. And it enabled a lot of scams. They'd pretend that they just duped an item, and they'd wait for someone to ask how they did it. Then they'd walk the user through step-by-step, but one step would involve dropping your item on the ground and then the scammer would pick up the item.
There was no guild system, but people still ran guilds. This means that there was no trusted way to identify guaranteed friendlies.
Many of these were fixed by the time Diablo III came around. They had extra guards against duplicated items. Bosses gave players individual drops, so there was no competition for items when you killed bosses. And you didn't need to recover items from your corpse in a way that risked you losing items. These were all hard-won lessons.
Turbo button
I started using my family's computer around 1990 when I learned how to read. The computer was a beige 286 that sat on our desk with the monitor perched on top. It had a 5.25" floppy drive. It had a power button. It had a reset button. And it had a TURBO button. The TURBO button was supposed to be ignored most of the time, but you could press it when you needed to slow the computer's processor down.
Why would you need to do that? Because IBM's first desktop computers ran on the 8088 processor at 4.77MHz
[2]
. It didn't stay this way for long. But there was a problem: many programmers wrote their applications with the assumption that computers had that 4.77MHz processor. Programmers synchronized animations, video game frame rates, and generally relied on the assumption that they were working with a fixed clock speed. If you used one of these applications on a faster processor, they would likely be unusable.
Computer manufacturers devised a simple solution: add a TURBO button that would just slow your CPU down on demand. Whenever you ran into an application that had timing issues, just press that TURBO button and watch it slow down to a comfortable speed.
I never needed to actually press the TURBO button in anger. My understanding is that most of the applications that benefitted from the TURBO button were games, and we only played newer educational games that didn't have these timing issues. When editing this post, I thought about dropping this section a few times. But can you imagine having an "Original iPhone" button on the side of your iPhone so that the Notes app could work? Good grief.
Modern software isn't perfect
Modern software isn't perfect. It's bloated. It's slow. It was written by too many people. It's too complex. It has too many cooks in the kitchen. And now, we're losing our grasp on how it works under the hood as we delegate more and more to the agents.
But I'd never go back to the way software used to be written. Give me process isolation and online updates. Give me higher-level programming languages that abstract common pitfalls from C and C++. Give me game designers that handle timing using the system clock. Give me Steam and Windows Update. You can keep your old release process that fell by the wayside.
I'm having trouble corroborating this anecdote with information I can find online. The details might not be exactly right. But this is what happened, to the extent that the memory survived 25ish years.
Ellia Lebleu is a founding member of
the WikiProject AI Cleanup
, a volunteer effort launched in 2023 to find and remove AI-generated material from
Wikipedia
that breaks the website’s guidelines. When the cleanup began,
AI writing
was often betrayed by conspicuous clichés. Today, the project’s volunteers are developing tools to detect subtler forms of machine-generated content and debating AI’s role in the world’s most widely used encyclopedia.
When did you realize
Wikipedia
had a problem with AI-generated material?
Ellia Lebleu:
It was around December 2023. A few other editors and I were chatting on Wikipedia’s Discord server, and we had all seen very strange articles with the same odd characteristics. They repeated phrases like “stands as a testament” or “rich cultural heritage.” They sometimes had conclusion sections, or sections called “Why is this important?” That was very typical of
ChatGPT
in 2023 and early 2024 but very odd for Wikipedia articles—and very easy to spot. Then I decided, let’s create an official project on Wikipedia so more people can deal with this.
Ellia Lebleu
Ellia Lebleu is a founding member of the WikiProject AI Cleanup. Lebleu is pursuing a Ph.D. in AI at the
Inria Center of the University of Rennes
, part of France’s national research institute for digital science and technology.
How do editors spot AI-generated writing today?
Lebleu:
By 2025, the signs of AI writing were becoming subtler and more structural. For example, AI loves the “rule of three,” negative parallelisms, and other structures of speech that aren’t conclusive by themselves but become meaningful as they accumulate. We also look beyond the article. If someone writes five articles of thousands of words each in 5 minutes, there is reason to suspect AI.
Does the AI problem just appear in the main text, or also in citations?
Lebleu:
Fake or misleading citations have become a major worry. Sometimes an AI hallucinates a citation entirely, although that’s much rarer today because of retrieval-augmented generation that allows the AI to find sources. More often, it finds a real source but gets its content completely wrong. AI citations that don’t actually support what is being written are extremely commonplace.
English Wikipedia recently
prohibited editors
from using LLMs to generate articles. How much AI-generated content is still getting through?
Lebleu:
I’ve been working with [AI-detection company]
Pangram
to estimate the proportion of AI-generated content. I tested it on Wikipedia content from before ChatGPT and found no false positives, so its results provide a very conservative lower bound. In late 2025, it flagged perhaps 20 percent of new articles and drafts as AI-generated. In early 2026, that went down to 15 or 16 percent. But we don’t yet know whether that’s because our recent policies have had an effect or because models are getting more powerful and Pangram hasn’t had time to adapt.
Is Wikipedia using AI to combat AI?
Lebleu:
Another Wikipedia editor has made an AI source verifier, which goes through the sources on a page and checks whether they match the claims. Since it is itself an AI model, there is no guarantee that it will be correct every time. But if you want something that works at scale and filters out obvious cases, it’s a good first step. The Wikimedia Foundation is also working on a tool called
Paste Check
, which can flag text pasted directly from some AI
chatbots
.
And we’ve seen Claude sometimes say, “I can’t write a Wikipedia article; it would go against Wikipedia’s policies.” If all major AI companies implemented that kind of prompt refusal, it wouldn’t solve the problem entirely, because there are still open-weight models that can be tweaked to avoid restrictions. But it would help with people who use commercial models and aren’t especially familiar with the technology.
Can you tell if the rule prohibiting AI writing is working?
Lebleu:
It’s still a little early to tell. We see possible effects, such as prompt refusal and the apparent slight drop in AI-generated content. But again, we don’t yet know if that is because models are getting better or because beginners are learning the rules. The vast majority of AI-generated content is submitted by beginner editors, so we’ve made many efforts to make the rule very visible in welcome messages, editing help, and advice.
What if AI becomes capable of writing truly reliable Wikipedia articles?
Lebleu:
That’s one of the big questions we’re facing. When the guideline was passed, it was for very practical reasons: We were flooded with AI content, we didn’t have good tools, and we needed to put a stop to it. But since then, it has taken on a more philosophical dimension. Many people have called Wikipedia “the last good place on the internet.” Being a place that was, in theory, free from AI slop has become part of Wikipedia’s identity.
A lot of Wikipedia’s communication is now centered on the idea that we’re a human-written encyclopedia. Even AI companies find that interesting. It can be valuable to have a purely human-written corpus on which to [train] AI systems. The fact that Wikipedia is still that, and will remain that for at least the near future, makes it a precious resource that isn’t replicated anywhere else.
But will the people who read and contribute to Wikipedia want it to become partially AI-generated if that makes it more comprehensive? We could preserve Wikipedia’s identity as a human-written corpus while also offering an AI-assisted option.
Has Wikipedia reckoned with the idea of “Google Zero”—a possible future in which websites no longer get traffic from
Google
search?
Lebleu:
If everything goes through AI search and websites plummet to zero visibility, how do we expose Wikipedia and show that it can be edited and that people can still contribute? Wikipedia is frequently cited in [Google’s] AI Overviews, but users may only see an AI answer citing Wikipedia. They may not realize that Wikipedia is a living project they can edit and contribute to.
The Wikimedia Foundation is working on an attribution framework that could give AI users more information about the article [being cited]: when it was last edited, how comprehensive it is, whether editors have flagged problems, and perhaps even a call to action. In the future, readers might even contribute through
AI models
: “The AI cited Wikipedia, but there seems to be an error. Can I make an edit request and add this other source I found?”
I can see a very strong symbiotic relationship between Wikipedia and AI models in the future. I don’t see Wikipedia disappearing, but I can see it taking a very different shape. Yesterday, AI was something to clean up. Today, it’s a tool to help us with the cleanup. Tomorrow, it will be the air we breathe.
A condensed version of this article appears in the November 2026 print issue as “Ellia Lebleu.”
Hiding Capabilities in AI Models
Schneier
www.schneier.com
2026-10-27 07:01:26
Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities”
Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does n...
Abstract:
Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
Apple backports CoreGraphics zero-day patches to older iPhones
Bleeping Computer
www.bleepingcomputer.com
2026-10-27 06:36:12
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]...
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
Apple
patched the same vulnerability
in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Meta Product Security discovered this
out-of-bounds write weakness
(tracked as
CVE-2026-86950
) in CoreGraphics, a framework used for two-dimensional vector graphics, text drawing, and image rendering across iOS, macOS, iPadOS, watchOS, and tvOS.
Successful exploitation of out-of-bounds write security issues can let attackers crash programs, corrupt data, or gain remote code execution by writing data outside the allocated memory buffer.
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,"
Apple warned on Monday
.
"Processing a maliciously crafted file may lead to arbitrary code execution. An out-of-bounds write issue was addressed with improved bounds checking."
With this week's security patches, Apple has now also addressed this vulnerability on iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
While Apple said CVE-2026-86950 is exploited only in highly targeted attacks, it is strongly advised to install these backported patches to block potential attacks.
With this vulnerability, Apple has fixed two zero-days exploited in attacks this year. The other (CVE-2026-20700), an arbitrary code execution vulnerability in dyld (the Dynamic Link Editor used by Apple operating systems) also exploited in "extremely sophisticated" targeted attacks,
was patched in February
.
This post explores how far Java’s type system can be pushed by building a small
Haskell-style type class instance resolution engine entirely in plain Java.
Using only reflection, generic type metadata, and a tiny first-order unifier, we
can automatically resolve type class instances (including higher-kinded ones),
support overlapping instances, and derive witnesses for arbitrarily nested
generic types.
It’s not intended for production, but as an experiment it reveals just how much
structure Java actually preserves at runtime — and how surprisingly close it can
get to type-level programming without language changes.
You can also jump straight to the full implemention
in this gist
.
interfaceEquatable<T> {
booleaneq(T other);
}
recordPoint(int x, int y)implementsEquatable<Point> {
@Overridepublicbooleaneq(Point other) {
return x == other.x() && y == other.y();
}
}
That's a pretty simple OOP-style generic interface.
However:
recordDup<A>(A fst, A snd) implementsEquatable<Dup<A>> {
@Overridepublicbooleaneq(Dup<A> other) {
return fst.eq(other.fst()) && snd.eq(other.snd());
// Error: no method eq() in type A!
}
}
We can't implement
eq()
for
Dup
without knowing the fact that
A extends Equatable<A>
.
So let's try that:
recordDup<A extendsEquatable<A>>(A fst, A snd) implementsEquatable<Dup<A>> {
@Overridepublicbooleaneq(Dup<A> other) {
return fst.eq(other.fst()) && snd.eq(other.snd());
// OK
}
}
Now the code compiles.
However,
Dup
is now only compatible with types that extend
Equatable
.
Dup
is now less capable.
We could have checked at runtime if each object is
instanceof Equatable
, but
that doesn't work very well with generics. And it may fail at runtime.
Ideally, there would be a way to say:
Dup
implements
Equatable<Dup<A>>
if and only if
A
implements
Equatable<A>
.
Also, if you think about it, it is a bit strange that the definition of
equality for a type
A
depends on the object instance. As in,
eq()
is an
instance method.
It would make more sense if equality depended only on the type
A
itself.
Right?
With witness constructors as our building blocks, we can recursively construct
infinitely many witnesses, as needed.
A note on nomenclature:
In Haskell, type class 'implementations' are called
instances
.
Here, I am calling them
witnesses
because that's how Java's Architect, Brian
Goetz, decided to refer to them in
a recent talk
he gave about
bringing type classes to Java sometime in the future.
Now, wouldn't it be great if we didn't have to manually construct these
witnesses?
Note that we do not have to specify the type argument for
Ty<>
. Thankfully,
type inference does that for us.
Type inference works in this case because the
List.of(...)
parameter has a
well-defined type, and the call to
<A> Show.show(Show<A>, A)
lets type
inference flow from the second argument to the first.
The standard
java.lang.reflect.Type
hierarchy consists of:
Class<?>
GenericArrayType
ParameterizedType
TypeVariable<?>
WildcardType
Where:
Class<?>
, sometimes referred to as a 'raw type', represents either:
A non-generic type like
String
or
Integer
.
A generic type like
Function<T, R>
where its type parameter list
[T, R]
can be retrieved via
TypeVariable<?>[] getTypeParameters()
.
GenericArrayType
represents an array type
E[]
whose component type
E
is
a
ParameterizedType
or a
TypeVariable<?>
.
ParameterizedType
represents a type
T<Arg1, Arg2, ..., ArgN>
. Its
getRawType()
method returns the class or interface
T
.
TypeVariable<?>
represents an unbound type parameter of a generic
declaration like a generic class/interface or generic method.
WildcardType
represents an occurrence of
?
within a
ParameterizedType
.
Moreover, a
java.lang.reflect.Method
can be queried via
TypeVariable<?>[] getTypeParameters()
,
Type[] getGenericParameterTypes()
,
and
Type getGenericReturnType()
.
Note that the three ocurrences of
TypeVariable(A)
are unique in the sense that
they compare
equal()
to each other, but
not
to other type variable
instances, even if their names are also
A
.
Subgoal: Parsing
java.lang.reflect.Type
into an AST
We want to do this for a few reasons:
java.lang.reflect.Type
is not convenient for programming:
It is not a sealed hierarchy, so pattern-matching on it is error-prone.
Both
Class<?>
and
GenericArrayType
may be array types.
Class<?>
may represent a primitive type, like
int
or
float
, which does
not participate in generic parameterization (yet).
Type application as represented by
ParameterizedType
is variadic.
Single-parameter-a-time is easier to program against.
When we get to higher-kinded type classes (spoiler!), then we will need our
own type representation anyway.
sealedinterfaceParsedType {
// ...static ParsedType parse(Type java) {
returnswitch (java) {
case Class<?> arr when arr.isArray() ->
newArrayOf(parse(arr.getComponentType()));
case Class<?> prim when prim.isPrimitive() ->
newPrimitive(prim);
case Class<?> c ->
newConst(c);
case TypeVariable<?> v ->
newVar(v);
case ParameterizedType p ->
parseAll(p.getActualTypeArguments()).stream()
.reduce(parse(p.getRawType()), App::new);
case GenericArrayType a ->
newArrayOf(parse(a.getGenericComponentType()));
case WildcardType w ->
thrownewIllegalArgumentException("Cannot parse wildcard type: " + w);
default ->
thrownewIllegalArgumentException("Unsupported type: " + java);
};
}
}
Note: the rule for
ParameterizedType
will take a type like
T<A, B>
and
turn it into
App(App(Const(T), A), B)
.
This means that the generic type
T
is first applied to
A
and then to
B
.
We observe that, for example, in order to summon a witness for
Show<List<Pair<Integer, List<Integer>>>
, then we must apply several witness
constructors recursively.
What is a witness constructor? It is a
public static
method annotated with
@TypeClass.Witness
.
But first, we must find the witness constructors!
How do we do that? Do we need to do a runtime scan of all loaded classes?
That would be way too complicated.
In order to reduce our search scope, we can define the following convention:
When trying to resolve a witness
C<T>
for some type class
C
and a concrete
type
T
, then we only look for witness constructors within the definitions of
C
and
T
and nowhere else.
For example, when looking for
Show<Integer>
, then we scan the methods of
Show
and
Integer
.
Generally, we will prefer to define witness constructors within concrete types
and not within type classes. However, for a built-in type like
Integer
, we
have no choice and we must define its witness constructors within the relevant
type classes, as we have done with
static Show<Integer> showInteger()
.
Now that we are able to find the relevant witness constructors, how do we:
know which of them we must invoke,
and in
which order
?
First, we must understand type unification:
Aside: Type Unification
Type unification is the process of finding a substitution that makes two types
identical.
For example, given
Pair<[A], String>
and
Pair<Integer, String>
, then the
substitution
{A -> Integer}
would make the first type identical to the second.
Here, I have placed the type
A
between square brackets to indicate that it
is a
type variable
. We only substitute type variables!
Unification may fail when it encounters incompatible types. For example,
List<Integer>
and
List<String>
cannot be unified because no substitution
exists that would make them identical.
Conversely, when two types are already identical, unification succeeds with an
empty substitution
{}
.
Because types are recursive, the unification algorithm must also be recursive
(in nature).
Consider:
unify(
Map<Pair<String, [T]>, List<[U]>>,
Map<Pair<String, Integer>, List<Optional<Boolean>>>
)
// we are unifying two types of shape:// - Map<K1, V1>// - Map<K2, V2>// the type constructors match on either side (Map)// so we recurse to their type arguments:// unify(K1, K2) ∪ unify(V1, V2)// and so on!
= unify(Pair<String, [T]>, Pair<String, Integer>)
∪ unify(List<[U]>, List<Optional<Boolean>>)
= unify(String, String) // first arguments of Pair
∪ unify([T], Integer) // second arguments of Pair
∪ unify([U], <Optional<Boolean>) // arguments of List
= {}
∪ {T -> Integer}
∪ {U -> Optional<Boolean>}
= {T -> Integer, U -> Optional<Boolean>}
// Done!
If any unification step fails, then the entire unification fails:
Following is a code listing for the concrete type unification algorithm
unify()
for our
ParsedType
definition, along with a
subsitute()
method
that applies a substitution to a type.
Listing: Type Unification algorithm for
ParsedType
Here we use the
Maybe
type, which is analogous to Java's
Optional
. It is
used to indicate that the
unify()
function may fail with a
nothing()
(empty)
case. This is different from it returning
just(Map.of())
(an empty map), which
signals success but without any substitutions. In short, based on the examples
above,
err
is
nothing()
and
{}
is
just(Map.of())
.
A key step here is the unification of
App
. This is the main driver for the
algorithm's recursion.
The following helper methods are relevant to this step:
// applies function `f` if both `ma` and `mb` are present
<A, B, C> Maybe<C> apply(BiFunction<A, B, C> f, Maybe<A> ma, Maybe<B> mb);
// merges two maps// it fails at runtime if duplicate keys /with different values/ exist
<K, V> Map<K, V> merge(Map<K, V> m1, Map<K, V> m2);
Here's the full code:
classUnification {
publicstatic Maybe<Map<ParsedType.Var, ParsedType>> unify(ParsedType t1, ParsedType t2) {
returnswitch (Pair.of(t1, t2)) {
case Pair<ParsedType, ParsedType>(ParsedType.Var var1, ParsedType.Primitive p) ->
Maybe.nothing(); // no primitives in genericscase Pair<ParsedType, ParsedType>(ParsedType.Var var1, var t) ->
Maybe.just(Map.of(var1, t));
case Pair<ParsedType, ParsedType>(ParsedType.Const const1, ParsedType.Const const2)
when const1.equals(const2) ->
Maybe.just(Map.of());
case Pair<ParsedType, ParsedType>(
ParsedType.App(var fun1, var arg1),
ParsedType.App(var fun2, var arg2)) ->
Maybe.apply(Maps::merge, unify(fun1, fun2), unify(arg1, arg2));
case Pair<ParsedType, ParsedType>(
ParsedType.ArrayOf(var elem1),
ParsedType.ArrayOf(var elem2)) ->
unify(elem1, elem2);
case Pair<ParsedType, ParsedType>(
ParsedType.Primitive(var prim1),
ParsedType.Primitive(var prim2))
when prim1.equals(prim2) ->
Maybe.just(Map.of());
default ->
Maybe.nothing();
};
}
publicstatic ParsedType substitute(Map<ParsedType.Var, ParsedType> map, ParsedType type) {
returnswitch (type) {
case ParsedType.Var var ->
map.getOrDefault(var, var);
case ParsedType.App(var fun, var arg) ->
newParsedType.App(substitute(map, fun), substitute(map, arg));
case ParsedType.ArrayOf var ->
newParsedType.ArrayOf(substitute(map, var.elementType()));
case ParsedType.Primitive p ->
p;
case ParsedType.Const c ->
c;
};
}
publicstatic List<ParsedType> substituteAll(
Map<ParsedType.Var, ParsedType> map, List<ParsedType> types) {
return types.stream().map(t -> substitute(map, t)).toList();
}
}
recordFuncType(Method java, List<ParsedType> paramTypes, ParsedType returnType) {
publicstatic FuncType parse(Method method) {
if (!Modifier.isStatic(method.getModifiers())) {
thrownewIllegalArgumentException("Method must be static: " + method);
}
returnnewFuncType(
method,
ParsedType.parseAll(method.getGenericParameterTypes()),
ParsedType.parse(method.getGenericReturnType()));
}
}
Subgoal: Witness resolution, part 2
Why is type unification relevant?
Type unification will guide the witness resolution process in two ways:
By checking if any given witness constructor is relevant to our witness goal.
And if it
is
relevant, then it will tell us which witness subgoals to
resolve next.
For example, when resolving
Show<List<Integer>>
, we check:
Which witness constructors can we find?
We scan
List
:
It contains zero witness constructors.
We scan
Show
, and it contains:
Show<Integer> showInteger()
<A> Show<List<A>> showList(Show<A> showA)
Which witness constructors apply to our goal?
Does
Show<Integer> showInteger()
apply?
We try to unify
Show<Integer>
and
Show<List<Integer>>
.
Unification fails.
Skip this constructor ❌
Does
<A> Show<List<A>> showList(Show<A> showA)
apply?
We try to unify
Show<List<A>>
and
Show<List<Integer>>
.
Unification succeeds with the substitution
{A -> Integer}
.
We can use this constructor ✅
But this constructor has an argument:
Show<A>
If we apply the substitution to the argument, we find our next goal:
@TypeClasssealedinterfaceTyEq<A, B> {
A castR(B b);
B castL(A a);
@TypeClass.Witness
static <T> TyEq<T, T> refl() {
returnnewRefl<>();
}
recordRefl<T>() implementsTyEq<T, T> {
@Overridepublic T castR(T t) {
return t;
}
@Overridepublic T castL(T t) {
return t;
}
}
}
TyEq<A, B>
represents the proposition that
A = B
.
And the only possible constructor for it is
refl()
, which can only prove that
TyEq<T, T>
for any
T
.
How is that useful?
TyEq<T, T>
may be trivial in the static context where it is constructed. But
it certainly is not in the context where it may be needed.
Take a look:
classList<T> {
// ...intsum(TyEq<T, Integer> ty) {
ints=0;
for (T item : this) {
s += ty.castL(item); // casts T to Integer !
}
return s;
}
// ...
}
// thenvarxs= List.of(1, 2, 3);
xs.sum(refl());
// Returns: 6
Within
List<T>
, we have no idea what
T
. Code can make no assumptions about
it. However, if we have a proof that
T = Integer
, then we
can
sum the
elements up into an
int
.
Now, we can also request them as witnesses in a witness constructor:
@TypeClassinterfaceSumAllInt<A> {
A sum(List<Integer> list);
static <T> T of(SumAllInt<T> sumAllInt) {
return sumAllInt.sum(List.of());
}
@TypeClass.Witness
static SumAllInt<Integer> base() {
return list -> list.stream().mapToInt(Integer::intValue).sum();
}
@TypeClass.Witness
static <A, R> SumAllInt<Function<A, R>> func(TyEq<A, Integer> eq, SumAllInt<R> sumR) {
return list -> a -> sumR.sum(Lists.concat(list, List.of(eq.castL(a))));
}
}
Similar to the
PrintAll
example, this lets us summon variadic functions:
Function<Integer, Function<Integer, Function<Integer, Integer>>> sum =
SumAllInt.of(witness(newTy<>() {}));
println(sum.apply(1).apply(2).apply(3));
However, notice how in the
func
rule, we requested
TyEq<A, Integer>
. This
constrains the
A
type argument to just
Integer
.
Funny enough, this is actually only necessary in Haskell due to how integer
literals are overloaded. So I implemented this here for no gain. But it was cool
that it just worked!
Goal: Higher-Order Type Classes
Consider the
Functor
type class in Haskell:
classFunctor f where
fmap :: (a -> b) -> f a - > f b
Notice how
f
is not a type?
It is not one because it is being applied to types
a
and
b
, respectively.
This means that
f
is a
type constructor
.
A type constructor is a sort of type-level
function
that builds new types
from existing types.
Here, we mean
function
in the sense that it has the mathematical property of
being
injective
. That is, no two inputs map to the same output.
In practice, this means that if we know that the output is the same, then the
input must be the same:
F<X> = F<Y> ⇒ X = Y
This property is what allows us to unify under type constructors.
In Java,
class List<T>
can be seen as a type constructor. Though we don't use
type application syntax as in Haskell, we do use type parameterization syntax:
List<Integer>
. In Java, generic types cannot be partially applied. That is,
for a type
class C<T1, T2, ..., TN>
, we must provide all
N
type arguments at
once.
Let's try representing the
Functor
type class with a Java interface:
The type F is not generic; it cannot be parameterized with arguments <B>
Indeed, Java requires that the type parameter
F
is a
type
, and
not a type
constructor
.
Are we cooked?
Not quite.
Aside: What is a kind?
Simply: values have types; types have kinds.
42
has type
Integer
.
Integer
has kind
*
(read: star).
The syntax
*
for the kind of plain types comes from Haskell.
We could also say
Integer
has kind
Type
, but that may be confusing given
how overloaded the word 'type' is in this context.
List<Integer>
also has kind
*
.
So what is the kind of
List
itself?
List
has kind
* -> *
.
That is, it is a type-level function that accepts a type and returns a type.
Aside: Higher-Kinded Types in Java
Here we introduce an
encoding
of higher-kinded types for Java.
Recall that interface
Functor<F>
failed because Java insists
F
is a concrete
type, not a type constructor. This encoding gives us a way to pretend
F
is
higher-kinded.
Note: I did not invent this encoding. I have seen several projects using it
(see the Related Work section). I am not sure where it originated, but it is
rather elegant.
Consider:
interfaceTApp<F, A> {}
abstractclassTagBase {}
sealedinterfaceMaybe<A> extendsTApp<Maybe.Tag, A> {
recordNothing<A>() implementsMaybe<A> {}
recordJust<A>(A value) implementsMaybe<A> {}
finalclassTagextendsTagBase {}
static <A> Maybe<A> unwrap(TApp<Maybe.Tag, A> m) {
return (Maybe<A>) m; // unsafe if we misuse TApp and tag types
}
}
Let's unpack this:
TApp<F, A>
represents type application, hence its name.
We assume that
F
has kind
* -> *
and
A
has kind
*
.
TApp<F, A>
represents
F<A>
.
Therefore
TApp<F, A>
, in principle, has kind
*
.
Maybe.Tag
is a sort of proxy type for
Maybe
as an unapplied type
constructor.
TApp<Maybe.Tag, A>
, in principle, means
Maybe<A>
.
That is why
Maybe<A> extends TApp<Maybe.Tag, A>
.
Maybe.Tag
extends
TagBase
just so that we can easily identify this type
via reflection later.
How is this useful?
Now we
do
have a mechanism (more of a convention) to represent
Functor
!
Traversable is the class of data structures that can be traversed from left to
right, performing an action on each element.
The Haskell type class looks like this:
class (Functort, Foldablet) => Traversable t where
traverse :: Applicative f => (a -> f b) -> t a -> f (t b)
Notice the use of the following features:
Traversable
is higher-kinded.
Its parameter
t
has kind
* -> *
.
Traversable
has two superclasses:
Functor
and
Foldable
.
Its method
traverse
is quantified on three type variables:
a
and
b
are plain types, of kind
*
.
f
is of kind
* -> *
, as it seen applied as
f b
and
f (t b)
.
The type variable
f
has the constraint
Applicative f
.
Traversable
is a rather advanced type class.
Let's translate it into Java.
For now, let's ignore its superclasses:
@TypeClassinterfaceTraversable<T extendsKind<KArr<KStar>>> {
<F extendsKind<KArr<KStar>>, A, B>
TApp<F, ? extendsTApp<T, B>> traverse(
Applicative<F> applicative,
Function<A, ? extendsTApp<F, B>> f,
TApp<T, A> t);
// And a static helper, for convenience:// (I omitted some types and arguments for brevity)static <F, A, B> ... traverse(
Traversable<T> traversable,
Applicative<F> applicative,
...) {
return traversable.traverse(applicative, f, t);
}
}
We see that:
T
has kind
KArr<KStar>
which means
* -> *
.
The method
traverse
:
Is generic on three type variables:
F
,
A
,
B
.
F
is also declared as having kind
* -> *
.
Depends on a witness of
Applicative<F>
.
Declares covariance
TApp<T, B>
on a couple of places:
Because we know that we won't return values of static type
TApp<T, B>
itself, but rather values of type
T<B>
, which in our HKT convention will
extend
TApp<T, B>
.
I currently don't have any interesting
Monad
examples. I may add one or two
soon.
Recap
We have built:
A simple mechanism to capture static types for runtime access.
An AST and a parser for Java types.
Including support for higher-kinded types encoded via 'tag types'.
Type unification on said AST of types.
A witness resolution algorithm that:
For a witness type
C<T>
, finds witness constructors in
C
and
T
.
A witness constructor is a public static method annotated with
@TypeClass.Witness
.
Uses type unification to:
Filter relevant witness constructors.
Guide the recursive search for witness dependencies.
And altogether:
We are able to resolve arbitrarily nested witnesses for first-order type
clases like
Eq
,
Ord
, and
Monoid
and also for higher-kinded type classes
like
Functor
,
Monad
, and
Traversable
.
The witness summoning syntax looks like:
C<T> w = witness(new Ty<>() {});
Witness resolution is currently done at runtime. Ideally, we should be able to
do this work at compile time, as that's where the power of type classes lies
in languages like Haskell.
Conclusion
This was
a lot
of fun to work on. I had never before implemented type
classes in a language, and it turned out to be way simpler than I thought. The
key insight was figuring out that type unification was all that I needed.
Stupidly, I did not check Haskell's spec to figure that out. But it did come
somewhat naturally after a bit of thinking, given my experience in implementing
type systems.
This project was partially inspired by
this recent Brian Goetz JVMLS talk
where he presents his early ideas on how to bring type clases to Java. His
proposed syntax is
Show<Integer>.witness
. And, of course, the mechanism is
supposed to resolve witnesses at compile time.
You can find the complete implementation in
this Gist
.
The code also contains several other type class examples like QuickCheck's
Arbitrary type class
.
Future work
The resolution mechanism could use some caching:
For witness constructor lookups.
For witness instances themselves.
It would be ideal to shift witness resolution to compile time.
Perhaps with a javac plugin or something like that?
example :: Show a => a -> Stringexample value = show [value]
In the Java code, we try to lookup
Show<List<A>>
, but we don't know what
A
is!
Sure, at runtime we may know its real type, but we actually would like
resolution to be static. (Even though we use reflection for witness resolution.)
In the Haskell code, the available instance of
Show a
as captured by the
function's signature becomes available as a 'context instance' that is used to
derive
Show [a]
for the call of
show
.
How can we achieve this in Java?
First, we define a type that can capture a witness along with its static type:
abstractclassCtx<T> {
privatefinal T instance;
Ctx(T instance) {
this.instance = instance;
}
public T instance() {
return instance;
}
public Type type() {
return requireNonNull(
((ParameterizedType) getClass().getGenericSuperclass())
.getActualTypeArguments()[0]);
}
}
It leverages the same mechanism as
Ty<T>
to capture static types.
I like TypeScript's type system. In particular, I like the combination of
Union Types
(aka anonymous Sum Types) and
Literal Types
(aka Singleton Types).
Those features allow us to achieve API precision, while also minding
conciseness:
typefamilyUOneOfNat ns whereUOneOfNat [a, b] = (# SNat a | SNat b #)
UOneOfNat [a, b, c] = (# SNat a | SNat b | SNat c #)
typeAvatarSize = UOneOfNat [96, 128, 512]
Because each unpacked sum type has a different kind based on its arity:
Main.hs:10:25: error: [GHC-83865]
• Couldn't match kind: '[LiftedRep]
with: '[]
Expected kind ‘TYPE (SumRep [LiftedRep, LiftedRep])’,
but ‘(# SNat a | SNat b | SNat c #)’ has kind ‘TYPE
(SumRep [LiftedRep, LiftedRep, LiftedRep])’
• In the type ‘(# SNat a | SNat b | SNat c #)’
In the type family declaration for ‘UOneOfNat’
|
10 | UOneOfNat [a, b, c] = (# SNat a | SNat b | SNat c #)
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Moreover, neither alternative holds the desired semantics of the type union
behaving like a set of types, i.e. normalizing duplicates. We could use
type-level Sets
for this, but that only further complicates our representation.
AI-driven disinformation running rampant on social media before US midterms, experts warn
Guardian
www.theguardian.com
2026-10-27 06:00:10
Social media companies including Meta have pulled back on efforts to protect voters from election-meddling lies Social media feeds are awash with an unprecedented flood of AI-driven disinformation ahead of November’s US midterm elections, according to experts, who warn many posts are probably “slipp...
Social media feeds are awash with an unprecedented flood of
AI
-driven disinformation ahead of November’s
US midterm elections
, according to experts, who warn many posts are probably “slipping through the cracks”.
As tens of millions of Americans prepare to cast their vote, social media companies have scaled back their efforts to protect voters from lies meant to manipulate elections.
While the backlash against Facebook after the
Cambridge Analytica scandal
prompted social media giants to bolster their trust and safety operations, a counter-backlash from the right over fears of speech restrictions – which intensified after Elon Musk’s takeover of X, formerly Twitter, and the election of
Donald Trump
in 2024 – has led to significant layoffs from relevant teams.
Artificial intelligence has
made it easier than ever
to launch a disinformation campaign. And platforms are increasingly relying on AI, rather than human intervention, to respond.
“You can run an information operation now with quality that was impossible in 2016 for super, super cheap,” said Frances Haugen, a former
Facebook
data engineer turned whistleblower and advocate for transparency and accountability in big tech. Operatives playing dirty tricks can get around content moderation rules “because you can just keep tweaking the post a little bit each time you create them, and some of them are going to get through”, she said.
Campaigns from
Pennsylvania
to
Texas
have been scrambling to respond to lies that have surfaced, and spread rapidly, online. Unlike previous elections, they find themselves in a quandary: who, exactly, do they turn to when fabrications and falsehoods propagate?
Meta Platforms, the Facebook and Instagram owner, and X did not respond to requests for comment.
YouTube
, owned by Google, said all its users are subject to the same guidelines.
James Talarico
, the high-flying Democrat running for US Senate in Texas, took time off from campaigning earlier this month to recover from the flu. But many social media feeds hosted another – false – reason for his absence: that he was supposedly being treated at a mental health facility in Ohio.
The claim was a complete fabrication, pushed by a
rightwing “provocateur”
who published a deceptively edited phone call with a hospital staffer. Talarico’s campaign released security-camera video showing him at home in Texasand the candidate publicly
clarified
he had never even been to Ohio.
But the lie circulated – and was stoked – for several days.
James Talarico, a Senate candidate, speaks to attenders at the Voto Latino ‘Ready, Go, Vote,’ rally on Sunday in Weslaco, Texas, before the midterm elections.
Photograph: Michael Gonzalez/AP
The Digital Democracy Institute of the Americas (DDIA)
tracked
its propagation, and how the misinformation mutated as it was picked up by conservative Spanish-language media. What began as a
viral lie
about Talarico being hospitalized in Ohio became a false claim in Spanish that he had attempted suicide.
The case “illustrates a recurring challenge in countering election disinformation”, DDIA’s researchers wrote. Lies evolve and shift as they spread, “making the original correction insufficient to address every version of the story”.
Social media platforms enforce their terms of service “more congruently” in English than other languages including Spanish, according to Roberta Braga, the founder and executive director of DDIA.
“There’s a lot less guardrails in place from the companies to deal with Spanish language, especially now that they’ve walked back a lot of their own investments in content moderation, and they’ve moved toward doing community-centered content moderation, like Community Notes-style things,” said Braga. “Now that they’re using AI to do a lot of the content moderation, even more is likely slipping through the cracks.”
Ken Paxton
, Talarico’s Republican opponent in Texas, also launched a campaign
advert
earlier this year
using
AI-generated footage of Talarico – a Presbyterian seminarian – supposedly rewriting the Bible.
“I think Texans are fed up with these kind of lies in our politics,” Talarico
told NBC News
in September. “These AI deepfake ads don’t add anything to our civic discourse. They don’t do anything to elucidate the choice that’s in front of voters.”
Online hit squads behind election disinformation once operated on the fringes. Today, their work may be amplified by official government sources.
When viral posts on X and rightwing blogs claimed that an undocumented immigrant arrested in central Pennsylvania was an active field worker and canvasser for Democrat Janelle Stelson’s congressional campaign, staffers set the
truth
sprinting, trying to to catch up with
a lie
.
Democratic candidate Janelle Stelson speaks at a campaign event on 23 September in York Haven, Pennsylvania.
Photograph: Marc Levy/AP
As they did, however, an
official statement
from the Department of Homeland Security amplified the claim. “It’s unbelievable that Janelle Stelson would employ an illegal alien to work on a congressional campaign, let alone a pervert who exposed himself in public,”
declared Charles Wall, the deputy director of Immigration and Customs Enforcement (ICE).
But the campaign released records showing that the immigrant, Chimaobim Adedayo Igbojekwe, had no paid position on the campaign, despite an initial police incident report stating that Igbojekwe claimed to be a campaign worker. They hold the claim provably false.
The campaign of Stelson’s opponent, Republican congressman Scott Perry,
continues to run ads
with the claim.
The Stelson campaign sent cease-and-desist letters to the media. A Fox News reporter took down a post on
X
about the indecent exposure arrest. Activists at Citizens for Responsibility and Ethics in Washington launched a complaint accusing the DHS of violating the Hatch Act, which limits the political activities of government employees.
“Trump has made clear that he
intends
to
interfere
in the elections,” said Nora Benavidez, a civil rights and free speech attorney with Free Press, a non-profit advocating for media independence. Trump “has leveraged agencies across the federal government, whether it’s the US Postal Service or DHS – you name it”, she added.
Stelson’s campaign has yet to complain directly to the social media platforms: Meta’s Facebook, Elon Musk’s X, Google’s YouTube or others. But a spokesperson
said
the campaign “continues to consider every legal avenue to fight the false claims in Perry’s ads”.
The dominant social media platforms do have clear rules – based on specific, limited definitions – on how to handle misinformation driven by AI during election campaigns.
Meta requires advertisers to disclose the use of synthetic images and AI-generated content with election ads, and enforces automated labeling on AI-generated images identified through Coalition for Content Provenance and Authenticity (C2PA) metadata. It also bans posts and ads that misrepresent voting dates, locations or legal requirements, as well as threats of violence.
But the company does little active moderation of political commentary, beyond the exclusion of unsolicited political content from its recommended posts. An
analysis
by Free Press noted that Meta had narrowed its historical restrictions in 2023 to allow debate around the legitimacy of past election cycles.
In 2023, YouTube also
stopped
removing content that falsely claimed the 2020 election or other past US presidential elections were marred by “widespread fraud, errors or glitches”, stating that the removals had curbed misinformation, but also had a chilling effect on political speech.
“All users” of YouTube, including political candidates and campaigns, “are subject to the same community guidelines … and have access to the same public reporting tools,” according to the platform.
It defines election misinformation narrowly, however: content that misleads voters about the time, place, means or eligibility requirements for voting or false claims that could materially discourage voting are banned. Claims that a candidate on the ballot is somehow ineligible, or calls to hack a polling site’s computers or incite violence at election locations, are also forbidden. “We also review government requests closely to determine if content should be removed because it violates a law or our policies,” YouTube’s spokesperson wrote in response to inquiries.
Google has a
likeness detection system
and allows civic leaders to request removal of a video when an AI-generated image falsely depicts their words or deeds. But a direct lie that falls outside these lines could propagate without intervention.
Instead of relying on takedowns, Google prefers to amplify authoritative news outlets and election boards in search queries and underneath high-stakes civic videos via contextual “information panels”.
X
, formerly known as Twitter, abandoned internal safety reviews after its acquisition by Musk,
replacing
it with the crowdsourced “Community Notes” program. Its civic integrity policy bars false information about how to vote and suppression schemes. The platform also supposedly restricts synthetic media designed to mislead, though experts argue that the policy amounts to little without enforcement.
“When you stop being able to focus on content because the AI will just slightly tweak it until it gets through, you have to focus on what are the systems of distribution,” Haugen said. “What are the biases? What are the ways we have feedback systems, cycles, that allow the community to provide feedback, that allows it to be damped down?”
Eight great new indie horror games for Halloween
Guardian
www.theguardian.com
2026-10-27 06:00:09
Whether you favour spooky fairtales, satanic card games or infernal hijinks at the chip shop there are all manner of fresh top scarers at large this witching season Tis almost All Hallows’ Eve and naturally, the thoughts of all good video game players are turning to horror. 2026 has already been a b...
T
is almost All Hallows’ Eve and naturally, the thoughts of all good video game players are turning to horror. 2026 has already been a bloody good year for the genre with
Resident Evil Requiem
and
Silent Hill: Townfall
leading the rabble. But this autumn sees a festering surge of indie horror releases, featuring everything from cursed card games to Nazi-hunting penguins. Here are eight terrifying titles we think you should sample while jack-o-lanterns burn and spirits walk the moonlit streets.
Allogloom (PC)
Shady story … Allogloom.
Photograph: Galactic Ghostly
Mixing dark fairytales with classic point-and-click adventure gameplay, Allogloom follows a young girl who must leave her isolated village alone to hunt for her lost mother. The game’s eerie picture book aesthetic and doll-like characters have the feel of a 1970s Czech animation, making for a surreal and disquieting experience.
Coming for more … Clive Barker’s Hellraiser: Revival.
Photograph: Saber Interactive
This latest extension of Barker’s seminal horror novella The Hellbound Heart received mixed reviews, but then so did the Hellraiser films, and they were largely awesome. You play as Aidan, looking to rescue his girlfriend from the nightmarish realm of the Cenobites and their S&M obsessed followers. Gory, kinky and ridiculous it is quite literally a hell of a ride.
Grease Trap 99 (PC)
Frying to fright … Grease Trap 99.
Photograph: James Muirhead
You’re working in a quiet Scottish takeaway, frying and serving fish, chips and pizza, when your boss asks you to start serving a “special” dish. But what is it, and what’s that strange gurgling noise coming from the cellar? Created by lone developer James Muirhead with dialogue in Scottish Gaelic (Gàidhlig), this is more of a short interactive horror movie than a game, but its glitch-ridden, low-poly visuals and dark humour keep you serving until the gruesome finale.
Hunter’s Moon (PS5)
Dark tale … Hunter’s Moon.
Photograph: Twin Swans
Based on the real-life witch-hunts of the 17th century, this atmospheric immersive adventure has you playing as a young woman accused of devilry and now running for her life through woods, rivers and abandoned mines as her hunters pursue. Poetic and strangely beguiling, fans of the classic folk horror movie Witchfinder General, will feel oddly at home.
The Killing Stone (PC, PS5, Xbox)
Feast of occult delights … The Killing Stone.
Photograph: Question
Fans of deck-building card battlers are spoiled for choice these days, but The Killing Stone is the perfect choice for
Halloween
. Set in a remote 17th-century mansion, you must play an ancient card game against the devil to win back the soul of your beloved mistress. The set-up is familiar but there are lovely occult touches, and you get to explore the gloomy house in first-person between bouts, leaning its dark lore. An engrossing fireside treat.
A Nazi base in the desolate Antarctic is beset by Lovecraftian entities, driving its inhabitants to madness. But in a neat twist, you play as a penguin observing the chaos and exploring the wilderness, discovering weird obelisks and winding labyrinths as the cosmic horrors threaten your colony.
Read our review
.
Silver Pines (PC, PS5, Xbox
, Switch 2
)
Curious case … Silver Pines.
Photograph: Wych Elm Games, Team 17
On the trail of a missing singer, troubled private investigator Red Walker finds himself in an abandoned town, but quickly discovers he is far from alone. Influenced by Twin Peaks, Silent Hill and Alan Wake, this haunting 2D adventure is rich in atmosphere and crammed with intriguing puzzles.
Read our review
.
Unrest room … Tenebris Somnia.
Photograph: New Blood Interactive
When a young actor visits her estranged boyfriend, she discovers that his apartment has been trashed and he’s nowhere to be seen. Where is he and what are those weird symbols daubed on the wall? Heavily inspired by early 90s point-and-click adventures as well as interactive movie games such as Night Trap, Tenebris Somnia mixes beautiful pixelated visuals and FMV sequences to eerie effect.
‘My social life completely plummeted’: gen Z is fighting back against big tech
Guardian
www.theguardian.com
2026-10-27 06:00:08
From apps that block distractions to stripped-down phones, young people are finding ways to unplug from platforms they say profit from their attention Nelissa Moukoudi, 19, a university student in Canada, noticed a shift once she joined Instagram and TikTok. “My social life completely plummeted and ...
Nelissa Moukoudi, 19, a university student in Canada, noticed a shift once she joined
Instagram
and TikTok.
“My social life completely plummeted and it felt like my life was only [using] social media and school,” she said.
Tired of fighting for self-control, Moukoudi downloaded Opal, an app that forces users to solve math problems before reopening distracting apps. It is one of a growing number of companies in the sprawling
digital detox
industry that is enticing users – ideally paying ones – by promising to keep them off their devices. The industry is
valued
at nearly $1bn and is estimated to grow to nearly $8bn by 2035.
Many of these companies are hoping to capitalize on gen Z’s growing weariness about the devices and social media platforms they grew up with.
Nearly 60%
of gen Z respondents identified as having a social media addiction in an April poll, and a
third
of the generation said they had deleted some of those apps, according to a 2025 survey.
The shift has also been driven by growing
anger at tech platforms
that have left some in gen Z feeling as if they are being exploited for profit.
Gen Z “was basically optimized for dopamine by very smart systems”, said Kenneth Schlenker, 39, a former product marketer at Google and co-founder of Opal. “But this generation is also realizing what they don’t want and are trying to change how the system impacts them.”
Some are turning to new devices entirely. Kendall Schrohe, 23, a founding partner of the Attention Studio, a consulting firm advising parents and policymakers on responsible tech, said that she traded her smartphone for a
Light Phone
, which sells for $349 and includes minimal smartphone features.
“These big tech platforms have been hurting people for years, and we are just now feeling the impacts of it,” Schrohe said. “Our generation were the guinea pigs to big tech, and our suffering and addiction to these apps were profited off of.”
Shreya Nallamothu, 19, a computer science student at Duke University, created her own DIY “
Brick
”, a device to block selected apps, using $8 near-field communication (NFC) tags that she bought online.
“Everyone deserves to have a good relationship with technology, and it shouldn’t be cost-prohibitive,” Nallamothu said. “Often the tech companies’ best interests aren’t in the users’ best interests.
Social media
has gotten away from what good technology can do, and people have noticed.”
Research that Nallamothu conducted in high school helped convince state senators in Illinois to
advance
a recent bill to prevent parental exploitation of children on social media and the state to pass a law forcing parents to
compensate their kids
.
New event-focused apps are also trying to capitalize on the pivot away from social media. Pie (People I Enjoy), an app highlighting local events including bar pop-ups, 5K runs and concert meetups, grew 150% in a single month – jumping from 120,000 users in July to 300,000 in August.
Co-founder Nadya Okamoto describes Pie as an in-person, active social network.
“I think of social media as this passive consumption of content, but Pie is separate from that,” Okamoto said. “Users are actively networking and building your social circle.”
Co-founder Andy Dunn, who also founded menswear brand Bonobos, added: “Everything about the product is designed to make you want to go and be in community with those people. It gives you so much more agency.”
The price of using such digital detox apps can vary. An Opal subscription costs $99.99 a year, while Brick, a physical block that phone users tap to lock and unlock apps, costs $59. Shift, an app that promises to turn a smartphone into a so-called “
dumbphone
” that can only make calls or send texts, charges a one-time $150 payment.
That is one reason why convincing gen Z digital detoxers to pay for a new app could be tricky. Like approximately 95% of Opal’s 10 million customers, 75% of whom are gen Z, Moukoudi said she is using the free version. “I am not going to pay for an app just to reclaim my life,” the university student said.
For some, simply deleting apps does the trick. Han Choi, 26,
deleted
all
social media apps
last year to spend more of his time on trivia nights and workouts.
“People are rejecting the systems that have been put in place by people who stand to profit off our compliance,” Choi said. “The
doomscrolling
economy
is not one that we need to keep participating in.”
CurrentBody Series 3 review: a fully customisable LED mask that helps exactly where you need it
Guardian
www.theguardian.com
2026-10-27 06:00:07
With six light wavelengths and almost endless ways to combine them, CurrentBody’s latest sets a new standard for red light therapy devices • The best LED face masks CurrentBody’s LED masks have long been my favourite. They’re comfortable, simple to use and effective. My previous favourite, the now-d...
C
urrentBody’s
LED masks
have long been my favourite. They’re comfortable, simple to use and effective. My previous favourite, the now-discontinued
CurrentBody Multi Light Therapy LED mask
, offered five treatments that used different light wavelengths to address multiple skin concerns. The company’s latest mask, the new Series 3, has the most detailed customisable treatments I’ve ever seen.
This isn’t the first LED mask I’ve tried that allows its user to select different treatments for different areas of the face. The
Lustre Renew Pro Facewear
allows you to choose from two treatments across four different zones, with 16 possible combinations. The Series 3 takes this much further, allowing you to choose between six light wavelengths across 125 light points on the mask. If you stick to one wavelength per light point, that’s 6
12
5
combinations available. That number is longer than I can reasonably comprehend, so allow me to call its level of customisation endless.
At £499.99, it certainly isn’t cheap, but it’s the same price as its less-advanced predecessor. Having tested my custom treatment for six weeks, my results were just as good as I had hoped, with the same excellent coverage I’ve come to expect from CurrentBody LED masks. Once you’ve got over the price, there’s very little to grumble about here, given that the
Dr Dennis Gross SpectraLite FaceWare Pro
costs almost as much and has no personalisation, and cheaper masks such as the
Silk’n LED face mask Pro
can’t pinpoint precise areas of the face. For anyone looking for the best LED mask money can buy, this is a safe bet.
Any changes to the condition, texture and appearance of our tester’s skin were noted after two months of using the LED mask.
Photograph: Sarah Matthews/The Guardian
I’ve tested 18 LED masks, considering overall efficacy, comfort levels and ease of use – all things that help make consistent treatments enjoyable. I always
check comfort levels by testing how well the eye guards block out the light from the mask, how easy the straps are to adjust and how comfortable the mask is to wear when lying down, sitting up and moving around.
I also assess how straightforward the mask’s controls are. This was especially important for this mask, which required me to download an app. If it’s going to take up space on my phone, it had better be flawless.
The test also involved noting the condition, texture and appearance of my skin before and after two months of use. I tested the four preset treatments for four nights each to get a quick idea of how they affected my skin, but since personalised treatments are the star of the show here, I used a customisable treatment for the rest of the test. Having tested LED masks before, I was hoping to at least maintain, or, ideally, build on the improvements I’d seen previously.
What you need to know
All the kit: the Series 3 comes with adjustable straps, removable eye guards and a touchscreen controller.
Photograph: Sarah Matthews/The Guardian
View at CurrentBody
View at Amazon
Let’s not beat around the bush: LED therapy, AKA photobiomodulation, looks a lot like pseudoscience. Scepticism is understandable, so as part of my LED mask testing for the Filter, I spoke to four independent dermatologists, anti-ageing experts and facialists. Their overall outlook on the tech was positive, particularly with regard to managing mild acne, reducing inflammation and firming skin. They advised choosing a mask from a reputable brand that bolsters its claims with clinical studies, and doing consistent treatments alongside a
good skincare routine
. Or, if you’re already inconsistent with skincare,
consider whether you really need an LED mask
first.
The most
concrete evidence
for LED therapy is in the blue, red and infrared wavelengths, used for acne, ageing and wound healing. There is growing interest in green and yellow light for brightening and calming redness.
Small studies
commissioned by CurrentBody reported modest reductions of 4.1% in pigmentation with green light and 8.6% in redness with yellow light, compared with a 37.1% reduction in forehead wrinkle volume with deep near-infrared light.
The Series 3 has 750 LEDs spread across 125 light points on the face. This is more light points than any previous CurrentBody mask, allowing for greater light coverage. For context, the Shark CryoGlow has more light points (160), although it lacks the range of wavelengths on offer here, with 480 individual LED light sources across three wavelengths. Some entry-level masks offer fewer light points, sometimes under 100, which tend to garner less effective results. In the Series 3, each light point has six LEDs: red, blue, near-infrared, deep near-infrared, yellow and green. Unlike all other masks I’ve tested, which mostly concentrate the most deeply penetrating deep near-infrared light around the eyes and mouth, the Series 3 offers full-face coverage, meaning it can tackle deep wrinkles anywhere you fancy.
Ready, set, glow: the controller offers four preset treatments, including Advanced Anti-Ageing.
Photograph: Sarah Matthews/The Guardian
There are four preset 10-minute treatments: Advanced Anti-Ageing, Advanced Clearing, Brighten & Balance, and Complexion Corrector. These combine near-infrared light with a different visible light wavelength to achieve their results and work like those offered on the
Multi Light Therapy mask
.
As mentioned, the star of the show here is the customised treatments, where users can pick out wavelengths with reckless abandon in the app. Helpfully, each colour is labelled with a brief description of its aims: “clear breakouts” for blue light, “calm redness” for yellow and so on. These can be positioned anywhere on the face and combined to create a treatment that’s unique to your needs. And, since you can save up to 10 custom treatments on the mask and more in the app, it also gives users the flexibility to target breakouts or dark spots precisely where they pop up, while continuing with other treatments elsewhere.
But if free salad bars have taught me anything, it’s that people are likely to overdo it if left unsupervised. That’s why CurrentBody has developed MyDose, which automatically calculates the optimum dosage for your chosen light wavelengths. In theory, this means you can safely customise treatments without compromising on results.
The Series 3 also has CurrentBody’s Veritace certification. Every mask undergoes quality control tests in which each of the 750 LEDs is tested to ensure it emits the specified wavelength and power output required before it’s shipped out to you. The mask comes with its own NFC card that lets you view the results; it’s reassuring to have this kind of transparency for a mask that costs this much.
CurrentBody Series 3 specifications
Price:
£499.99
Recommended use:
3-5 times per week
Settings:
Advanced Anti-Ageing, Advanced Clearing, Complexion Corrector, Brighten & Balance, plus near-infinite customised options
Light
wavelengths:
red (633nm), near-infrared (830nm), deep near-infrared (1072nm), blue (415nm), green (532nm), yellow (590nm)
Treatment time:
10 minutes
Suitable for:
all skin types, but darker tones should take care with blue light
Battery life:
13 uses
Charging time:
4.5 hours
Contents:
mask, three straps, two removable eye guards, Veritace card, charging cable, storage bag
What we love
A personal touch: the Series 3 lets users customise the light wavelengths across different areas of the face.
Photograph: Sarah Matthews/The Guardian
Like the Series 2 that came before it, the Series 3 is made from flexible silicone that fits comfortably without digging in, and has a chin strap that offers more coverage than other masks. Its straps are adjustable at four points – two on either side of the head – plus there’s an overhead strap that can stop the mask from slipping down on smaller heads. I also found the eye guards did a fantastic job of blocking out the mask’s light during treatment, as I was able to see clearly enough to read or potter around in dim lighting with no issues.
The results from my tests were fantastic. As expected, given the Multi Light Therapy mask’s near-identical treatments, each of the preset treatments performed well. However, the real selling point for me was the personalised treatments.
Paint by numbers: the app lets you select different light wavelengths for individual points on the mask
Like many with
PCOS/PMOS
, I get hormonal breakouts and hair growth on my chin and upper lip. For a while, I have been worried that using red light in these areas would make this more pronounced, as red light has been shown to
stimulate scalp hair growth
. With the Series 3, I chose not to use red light in those areas, and instead used blue light on my acne-prone chin, with red, near-infrared and deep near-infrared everywhere else. I also threw in a sprinkling of yellow light on my cheeks to tackle redness.
Given my hatred for beauty tech apps, which are often full of ads, useless subscriptions and grating tech problems, I was glad to find the CurrentBody app refreshingly simple. The app pops up with an illustration of the light points on the face, ready for you to select which of the six light options you would like to shine from each point. The six light options can be applied using a paintbrush, fill bucket and eraser, which made it feel a lot like using a simplified version of Microsoft Paint. The whole process took about five minutes.
I was most relieved to see that, once my personalised treatment had been saved to the device, I never had to open the app unless I wanted to tweak my treatment. There’s space for up to 10 personalised modes on the mask’s controller, on top of the four preset modes, and if for some reason you want more options than that, you can store more treatments on the app. There’s also the option to share treatments with others using a code (mine’s RYPGJ, if you’re feeling nosy).
After six weeks of using my personalised treatment, my skin looked calmer, with less redness on my cheeks, fewer breakouts on my chin and a healthier overall appearance. Mission accomplished. I was also pleased that the mask lasted through 13 full 10-minute treatments before needing a recharge. If you’re short on time, you can’t reduce the treatment time, but I’d be reluctant to mess around with the treatment length too much anyway, as this would add too many variables to the automatic dosing.
What we don’t love
A fiddly fit: the Series 3’s manual could be clearer about how to attach the straps.
Photograph: Sarah Matthews/The Guardian
I can’t complain about the results on this mask, but it does have a few nitpicky problems. Namely, the chin strap makes it impossible to pack flat when travelling, as opposed to flat silicone LED masks. Its nose flap left a tiny red mark on my nose for a few minutes after treatments, and to my frustration, CurrentBody’s instruction manual does a poor job of explaining how to add the straps.
Shortcomings: the controller’s smaller clip makes it harder to attach securely to clothing.
Photograph: Sarah Matthews/The Guardian
Furthermore, unlike the Series 2, the controller comes with a small built-in touchscreen to accommodate its more complex treatments. While this is intuitive to use, I found the screen easy to jog accidentally mid-use, which would often pause my treatment. At 190g, the controller is also bulkier than before, and its clip is about an inch shorter, which makes it harder to carry around or clip securely on to clothing.
I also found the battery life indicator a touch unreliable. Occasionally, the mask died before it got the chance to flag up red low-battery levels. This didn’t happen every time, and the charge always lasted through 13 full 10-minute treatments, but it was frustrating nonetheless.
LED therapy is safe and comfortable for most people, but it’s always best to be cautious. CurrentBody recommends doing a skin sensitivity test before starting treatment, and offers a full refund if your skin becomes red or itchy after 24 hours, provided you return the mask within 14 days. For those who keep the mask, there is also a two-year warranty that covers manufacturing faults.
Should I buy the CurrentBody Series 3 LED face mask?
‘The top LED mask I’ve tested.’
Photograph: Sarah Matthews/The Guardian
If you have the money, absolutely. The CurrentBody Series 3 fits comfortably, has a generous battery and is the only one with anti-ageing deep near-infrared light all over the face. With this level of customisation available, it’s easily the top LED mask I’ve tested.
This mask is particularly good for those with areas of their skin where one flat treatment won’t cut the mustard. For example, if you just want to fade one dark spot using green light, or treat a localised breakout using blue light, this mask gives you the flexibility to do that. This is a rare instance where I think the app is genuinely worthwhile, too. I didn’t dread booting it up every time I wanted to make an adjustment, and I love that the mask remembers my personalised treatments.
That said, if you aren’t battling deep wrinkles and don’t have problematic skin, you might be better off with a more
affordable LED mask
.
At about half the price of the CurrentBody Series 3 at the time of writing, the Silk’n LED face mask Pro is an obvious competitor. It has a silicone fit that blocks light well and coverage under the chin. And, if you think a wired controller will bother you, this is controlled and charged via a small, light battery pack that clips on to the mask itself, making it completely wireless. Treatments are all 10 minutes, and the mask had a lovely calming effect on my skin.
That said, it offers no personalisation and far fewer deep near-infrared lights, which are positioned exclusively around the mouth, eyes and across the forehead. I also found the mask’s controls harder to get used to. The seven treatments, many of which look similar at first glance, are controlled via a button on the battery pack, which doesn’t give you any information about the treatment selected. To check which lights are being used, you’ll need to read the instructions and memorise how many presses it takes to get to your desired treatment. This shouldn’t be a huge problem, but it does somewhat hinder usability.
This is the only other customisable LED mask I’ve tested. It’s not perfect, with a far less comfortable fit thanks to a heavy battery pack stuck on the forehead and a smaller-than-average size, but the lower price and simpler customisation options could clinch it for some.
This mask has two preset treatment options – Energise and Revitalise – which use blue, red and near-infrared light. While you can use either as a full face treatment using the mask’s button, boot up the app and you’ll be able to select areas of the face for each treatment. Rather than offering pinpoint precision, like the CurrentBody Series 3, these areas span the eyes, nose, forehead, and cheeks and chin.
I found these treatments effective at calming my skin, but I didn’t find the app or connection as simple as the CurrentBody, since I had to load the app up every time I wanted to personalise the treatment. If you won’t use the app either, you’d be better off buying the Silk’n option above, which is cheaper, more comfortable and includes deep near-infrared light in its anti-ageing treatments.
If 10-minute treatments feel like too much of a commitment, the Dr Dennis Gross SpectraLite FaceWear Pro requires only three minutes a day, making it perfect for those who are time-poor but rich in other aspects. The lights are bright, the fit is supremely comfortable, and it’s wireless, so you don’t need to faff around with a controller.
I was initially sceptical about this mask’s performance, given its shorter treatment times, but the combination of red, deep red, near-infrared, amber and blue lights helped give my skin a smoother, clearer and brighter appearance. For an effective LED mask without bells, whistles or any fancy app-based extras, this is a brilliant, if expensive, choice.
Sarah Matthews is a consumer journalist who specialises in health and beauty reviews. In her four years of product testing, she’s worked her way through countless hair styling tools, hair removal, light therapy and skincare innovations. She’s seen beauty trends come and go, and can sniff out a fad from a gamechanger (that doesn’t mean she’s disciplined enough to always follow her own advice, though)
Energy giant ENGIE discloses data breach affecting customers
Bleeping Computer
www.bleepingcomputer.com
2026-10-27 05:25:50
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. [...]...
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners.
ENGIE operates in renewable energy, infrastructure, and customer energy supply in 30 countries, employs over 90,000 people, and reported €71.9 billion in revenue last year.
An ENGIE spokesperson told BleepingComputer that it cut off the attackers' access to the compromised platform and that they didn't breach the company's internal systems.
"ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers," the spokesperson said.
The ENGIE spokesperson didn't say how many customers were affected, but told BleepingComputer the incident is limited to customers in France.
Since the attack, ENGIE has notified relevant authorities and contacted affected customers to inform them of the breach.
"The investigations conducted to date indicate that the data concerned is limited to customers' contact details and certain information relating to their energy contracts. No banking data is affected," ENGIE told BleepingComputer.
"In the interest of transparency, ENGIE individually informed each customer concerned and reminded them of the precautionary measures they should take to protect themselves against potential fraud or phishing attempts."
Although the company didn't share what customer information was stolen in the attack, it said in
breach notification letters
sent to affected customers that the threat actors gained access to their first and last names, mailing address, email address, phone number, Delivery Point (PDL) or Metering and Estimation Point (PCE), customer ID, and contract number.
ENGIE didn't attribute the attack to a specific threat group, and no ransomware operation or extortion gang has claimed the ENGIE breach before publication.
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
Bleeping Computer
www.bleepingcomputer.com
2026-10-27 04:20:54
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities collectively tracked as PHP2Shell to its catalog of actively exploited security flaws.
Threat actors without privileges can exploit the two security issues (CVE-2026-109618 and CVE-2026-109619) in high-complexity attacks to gain remote code execution (RCE) on unpatched systems.
Although details on the PHP2Shell security flaws (including the CVE IDs and mitigation measures shared with critical infrastructure providers)
leaked
and some proof-of-concept (PoC) exploits were published online before patches went live, the PHP security team said that none were functional.
CISA
added
the vulnerabilities to its
Known Exploited Vulnerabilities Catalog
on Monday and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their systems by Thursday, as mandated by Binding Operational Directive 26-04.
"These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise," the cybersecurity agency warned.
"While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."
While CISA has not yet shared further details about ongoing PHP2Shell attacks, Perplexity detection and response lead Adel Karimi first confirmed in-the-wild exploitation over the weekend after their
honeypots recorded evidence
of
remote code execution
against an Apache mod_php installation running PHP 8.4.26.
On Friday, the PHP security team also
shared mitigation
for a new RCE flaw (CVE-2026-115560) with no patch, exploitable when targeting systems "with an unusual combination of configuration and application code."
PHP powers
roughly 70%
of all websites, with more than 5.1 million PHP hosts exposed online and around 3.8 million instances with at least one port open to attacks, according to
VirusTotal estimates
.
We’ve identified multiple vulnerabilities in devices of the popular
SwitchBot
Lock Pro smart lock series.
The most critical, a cryptographic flaw in their bluetooth communication, allows everyone to silently open smart locks in a software-only attack.
No physical tampering is required.
Below is a video of the attack in action.
Introduction
Smart locks have become very popular in recent years.
Especially when it comes to AirBnB-style apartment sharing, but also in corporate environments and private accommodation, people enjoy having locks that don’t require physical keys.
So when it came to selecting targets for our regular IoT hacking team event, smart locks were a natural choice.
After some research we cam across the highly praised
Switchbot Lock Pro Combo
, including a key actuator, pin pad and smartphone app.
It is one of the best-rated and most-sold smart locks on Amazon.
For roughly 240€ (at the time of writing) it comes with a lot of features - and the Amazon reviewers are happy to share that it works as intended.
Features aside, our main interest was, of course, the device’s security.
So we ordered one and had a look.
Here is what we found out.
Reversing the Lock
As usual when inspecting IoT devices, we wanted to get our hand on the firmware.
But before we dive into that, let’s first look into the target’s features and architecture.
The Switchbot Pro Lock
The bundle comes with two hardware devices, an actuator and a key pad. The lock can further be controlled and configured via a smartphone app.
Switchbot Pro Lock Bundle on Amazon
The actuator is mounted onto the inside of the door and encloses the door’s key.
When the door is supposed to open, the actuator simply turns the key in the lock.
Switchbot Pro Lock Actuator Promotional Material
The key pad is kept outside the door and communicates with the actuator over
Bluetooth Low Energy
(BLE).
A person can authenticate itself to the system either using a smart card/key fob, using a fingerprint, or - most commonly - by supplying a PIN.
The whole system can also be added to a WiFi network, making it possible to control the lock over the Internet.
Now that we have an idea of the feature set, we can start digging.
Firmware Reversing
When hacking a device, it is usually a good idea to first get your hands on its firmware.
There are various techniques for accomplishing this,
FLASH Dumping
for example.
Before starting to desolder chips, however, it makes sense to scrape the web for firmware artifacts.
With SwitchBot we got lucky, as the Android app contained the URL for a public S3 bucket containing firmware files.
Downloading and analysing these files we found two surprising architectural choices.
First, the key pad on the
outside
of the door actually controls the actuator on the
inside
, not the other way around.
Meaning that the key pad decides if a PIN, fingerprint or key fob is valid and then issues an “UNLOCK” command to the actuator.
Secondly, the communication between the key pad and actuator relies on an unprotected, clear-text BLE connection.
Authentication between key pad and actuator is done solely on the application level using a home-brewed mechanism.
While the first point already yields a significant attack surface (i.e. let’s dump the key pad and open the door), the second offers a code smell too good to pass up.
So we focussed our main energy on exploiting the BLE communication between key pad and actuator.
Key Pad Communications
Once the key pad and actuator are paired, they communicate using unprotected BLE.
Meaning that all security of the system depends on application-level protections.
So let’s find out how these protections work.
Upon pairing, the key pad and actuator agree on a
secret key
.
Then, everytime the key pad becomes active, it requests a so-called “
nonce
” value from the actuator.
For our attack this does not matter.
It is noteworthy however, that the nonce is supposed to provide “freshness” between invocations of the protocol but that this implementation uses the same nonce for an entire “session” which can last for multiple commands.
After the nonce is received, the key pad encrypts a command, using the secret key and nonce, and sends said command over the BLE connection.
Such a command could, for example, be “lock the door”.
The following diagram illustrates how the BLE communication works.
Communication between key pad and actuator (simplified)
Simply by looking at the communication diagram we can see a potential problem: We might be able to simply replay previous “unlock” commands that we have captured.
However, that would require us to be within Bluetooth range, sniff the command, and then somehow replay it before the session ends.
Since we aren’t writing an academic paper but do actual research: This is boring.
We want to be able to open the lock, first shot, without any physical tampering and without leaving traces.
And, as it turns out, we can accomplish this. But first need some more background on the implementation.
Communication Protection
So the key pad/actuator communication is protected using secret-key encryption and a nonce.
Digging further into the implementation, and with the help of
community-developed libraries
, we found out how the encryption is done.
The commands are encrypted using the
AES
block cipher in counter (CTR) mode.
Now, counter mode is an interesting choice, because it doesn’t actually offer any integrity protection.
Furthermore, because of its design, turning a block cipher into a stream cipher, bit flips propagate 1:1 from ciphertext to plaintext.
Counter mode encryption
Meaning that: If we change a bit in a ciphertext, upon decryption by the actuator, this exact bit will also be changed in the decrypted plaintext.
This is a little-known, but often encountered vulnerability class.
So, let’s exploit this fact and open some doors!
Exploiting the Lock
A key observation helps us to mount our attack.
The key pad’s lock button always sends an encrypted LOCK command, even if the door is already locked.
Exploiting the fact that AES CTR is used, we only need to compute the difference between an encrypted LOCK and UNLOCK command.
When we XOR this difference (flipping all corresponding bits) into an encrypted LOCK command, the result will be a validly encrypted UNLOCK command.
It’s important to note here that this difference has to be computed only once, as it is identical across sessions and devices!
We therefore split the attack into a setup phase, run once, and an attack phase that opens a specific lock.
After the one-time setup, the attack works as follows:
Press the lock button
Sniff an encrypted LOCK command send via BLE
Bit-flip the encrypted LOCK command into an encrypted UNLOCK command
Send the bit-flipped command to the actuator
The door opens
As we suspect a lot of vulnerable devices out there, we won’t publish our full exploit here.
But using an individual example, you can see why our attack works.
So, let’s work through it.
Setup Phase
Using one pair of encrypted LOCK and UNLOCK commands, intercepted via BLE, we can compute their XOR difference.
This difference is identical across all sessions and all locks using the same firmware.
Therefore, we can use this difference as a sort of “master key” to open all SwitchBot Pro locks.
Sniffing an encrypted LOCK and UNLOCK command is done easily using our acquired lock.
Then, we simply compute:
Applying (XORing) this difference
diff
to the encryption of any LOCK command, independent of secret key and nonce, will yield an encrypted unlock command, which we can then send to the actuator.
CRAFTED_ENCRYPTED_UNLOCK = ENCRYPTED_LOCK ^ diff
So, simply by applying our pre-computed, lock-independent, difference vector, we can turn
every
SwitchBot Pro LOCK command into an UNLOCK command.
And we can always capture encrypted LOCK commands on any key pad, simply by pressing the lock button.
Neat!
Proof of Concept Exploit
We’ve recorded our attack in action.
The video shows the components and our Bluetooth antenna used for sniffing the encrypted LOCK command.
On the left you can see the Python script applying the difference to the encrypted LOCK command and sending the crafted encrypted UNLOCK command.
The right side of the screen shows that the attack worked:
First, a LOCK command is issued by pressing the lock button.
Then, the crafted UNLOCK command is send and the actuator turns the key, opening the door
\o/
.
It all happens very fast, so maybe you have to re-watch a couple of times to grasp everything.
Responsible Disclosure and Insufficient Fix
In accordance with our responsible disclosure guidelines, we notified the SwitchBot team of our findings.
They were very responsive (kudos!) and seemed to take the vulnerability seriously.
They awarded us a 100€ Amazon voucher for our work.
Before they rolled out a firmware patch, they allowed us to have a look at the updated firmware files.
After we reversed the new firmware, we discovered that they now append a “checksum” to every command.
We reimplemented the checksum computation in Python:
So the system now calculates an MD5 hash of the command, secret key and nonce.
The first
two bytes
of this hash then serve as verification tag.
This construction is sometimes referred to as
YOLO hash
and rarely a good idea.
Here in particular, the truncation to two bytes allows us to, in principle, brute force all 65,536 possible verification tags.
However, this is not necessary.
Because, to our surprise, just the communication between the key pad and actuator got updated.
The smartphone app still does not use a verification tag.
Which means that our attack still works 1:1, we just need to compute (once!) the difference between a key pad’s encrypted LOCK command and a smartphone issued UNLOCK command.
We can then mount our attack using this difference vector, as the actuator then thinks the UNLOCK command comes from a smartphone and does not check the verification tag.
We have verified that this variant of our attack works.
When we reported this bypass, SwitchBot provided the following context:
The test firmware pushed to you only includes updates for the Keypad and Lock. The APP has not yet been updated with the new encryption method. We are currently working on implementing encryption upgrades for both the APP and the backend, and the Lock will no longer be compatible with the old encryption method. We need to ensure that this update does not affect other products bound to the APP […].
Backward compatibility is always challenging, especially when it comes to security and IoT devices out in the field.
Further Attack Surface
As we were happy with our full compromise, we did not look too much into other avenues of attack.
Noteworthy, however, was that the key pad uses MIFARE Classic 1K key fobs.
These are long broken and can be trivially cloned, e.g., using a
Flipper Zero
.
In order to mount this cloning attack, you’d have to get close to a key fob first.
Additionally, while testing the Bluetooth attack, we noticed that the key pad has a tamper detection.
If it is removed from the wall, it will play a loud alarm sound and inform the owners via their smartphone.
This is implemented using a Hall effect sensor on top of the key pad and can therefore be defeated using a strong magnet.
We recommend Neodymium magnets for such purposes ;).
Switchbot Keypad Components
Disclosure timeline
Date
Action
15.07.2025
Initial Report is sent
15.07.2025
SwitchBot replies with additional questions
15.07.2025
More context is provided
17.07.2025
SwitchBot offers us to beta-test their patch
06.08.2025
SwitchBot pushes the update to our account
13.08.2025
We report our patch circumvention
18.08.2025
We report multiple more patch circumventions
27.08.2025
SwitchBot informs us, that it will take 6 months for them to update the rest of their ecosystem
12.09.2025
SwitchBot sends us an Amazon voucher 🎉
March 2026
SwitchBot makes an updated version available
02.04.2026
SwitchBot shares an updated version with us; we confirm that the described vulnerability does not work anymore
09.10.2026
CVE published
Fixed Versions
According to SwitchBot, the following versions should have the relevant fixes installed.
Lock:
SwitchBot Lock: V7.7 and later
SwitchBot Lock Pro: V3.7 and later
SwitchBot Lock WiFi: V15.21 and later
SwitchBot Lock Ultra: V2.8 and later
SwitchBot Lock Lite: V7.7 and later
Keypad:
SwitchBot Keypad: V2.9 and later
SwitchBot Keypad Touch: V2.9 and later
SwitchBot Keypad Vision: V2.5 and later
SwitchBot Keypad Vision Pro: V1.0 and later
App:
SwitchBot App: V9.18 and later
Conclusion
Security is hard and IoT devices often times lack good protections.
We have to give credit to SwitchBot for even trying to secure their system.
Many IoT manufacturers don’t even do that.
Hacking this smart lock was a good reminder about the threats IoT devices can pose.
Even the more expensive, highly sought after products, are not necessarily immune to attack.
UK government met 137 businesses over AI datacentres – but no environmental groups
Guardian
www.theguardian.com
2026-10-27 03:00:04
Investigation finds dozens of ministers and civil servants moved into AI roles as government developed datacentre expansion plans The UK’s policy on datacentres and AI was developed without any meetings with environmental groups, an investigation has found. The nonprofit organisation Spotlight on Co...
The UK’s policy on datacentres and AI was developed without any meetings with environmental groups, an investigation has found.
The nonprofit organisation Spotlight on Corruption said a “considerable revolving door” shaped the government’s development of “AI growth zones”, a central plank of the former prime minister Keir Starmer’s AI and economic policy, with 38 ministers, senior civil servants and special advisers hired to positions in AI companies between July 2024 and September 2026.
Meanwhile, even as top officials left government for jobs at OpenAI and Anthropic, government departments largely failed to engage meaningfully with stakeholders outside the technology industry.
Kamila Kingstone, a campaign lead at the NGO, said: “The government totally failed at the most senior level to speak to environmental NGOs or community groups when developing its flagship policy on AI datacentres. This is despite the serious environmental implications of its plans.”
Over 12 months, Spotlight on Corruption filed 40 freedom of information requests to 18 government agencies, seeking details of meetings and investment figures relating to the government’s policymaking on the growth zones, covering the period between July 2024 and June 2026.
The investigation found
that ministers, permanent secretaries and directors general involved in developing the policy met 137 businesses – some several times – to discuss Britain’s datacentre policy. By contrast, senior officials met only two community groups and no environmental organisations.
Approval has been given for a £500m redevelopment of the Truman Brewery site in Brick Lane, east London, to include a datacentre.
Photograph: David Levene/The Guardian
Of the 38 senior officials who left government, nine were from the Department for Science, Innovation and Technology, which has played a central role in shaping Britain’s AI strategy. These included a former minister for AI and intellectual property, a former AI adviser to the prime minister, a former director of AI opportunities, a deputy director of AI international policy and a head of AI engineering.
AI growth zones were a groundbreaking policy under which the government promised to “
turbocharge
the economy” and create jobs by
building
massive datacentres across five regions – in Starmer’s words, “mainlining AI into the veins” of the country.
The policy aimed to pave the way for Britain to build big datacentres, some of them larger than any datacentre that has been built in the country so far. These developments, often partnered with US tech companies, would supposedly bring in thousands of jobs.
Investigations
by the Guardian have called the policy into question, suggesting that it rests on assumptions that do not hold up, financial figures that were not audited and exaggerated projections for job creation.
In particular, the Guardian has shown there is
little realism
behind announced plans to power these developments, and claims that they will use purpose-built renewables. In fact, different government departments
appear to diverge
on how much electricity the UK’s datacentre plans will actually require – and what their environmental cost will therefore be.
Meanwhile, there has been growing opposition to datacentres in Britain, with campaign groups protesting against planned developments in places ranging from
Auchtertool
, a rural village north of Edinburgh, to
Brick Lane
in east London.
Fourteen local campaigns rallied in September at Holyrood against datacentres planned in Scotland.
Photograph: Murdo MacLeod/The Guardian
Chi Onwurah, the MP for Newcastle upon Tyne Central and West, said the growing backlash – and the far larger opposition in the US – was a warning that the government needed to seek greater community input.
“It is critically important that AI benefits communities and is also shaped by them,” she said. “I’ve been concerned about what we’ve seen in the US, where there’s a strong feeling that datacentres are being imposed without adequate consultation. We can see the backlash influencing the midterms. It’s really important that communities are involved in datacentres and AI growth zones and see the benefits.”
Spotlight on Corruption’s investigation suggests that previous policy was largely shaped by conversations with business, and that the government “failed to take the environmental and social impacts [of datacentres] seriously”.
While the government met a handful of civil society groups, these meetings were “held a few days before the launch of the policy, meaning they had no meaningful input”, according to the report.
Finally, many further meetings between businesses and Starmer’s administration would not have been disclosed, said Spotlight on Corruption. This is largely because Starmer’s policy was led by a special adviser, Jade Leung, whose role was subject to far less stringent transparency requirements.
Spotlight on Corruption also looked at how other countries – including Canada, Germany and Australia – developed policy. It found these countries consulted far more widely on introducing datacentres and had more stringent environmental criteria. It said the UK had “fallen behind equivalent jurisdictions” in developing an equitable strategy.
A government spokesperson said: “We are clear that datacentres should create British jobs, strengthen supply chains and deliver benefits for the communities that host them, while prioritising clean power and using water responsibly – and meet with these companies to make sure that happens. We want to work closely with industry, local authorities, environmental groups and communities, and welcome opportunities to hear their views.
“For most proposed datacentre developments, community benefits are considered through the relevant local planning processes. We have already announced measures which will enable local authorities hosting datacentres in AI growth zones in England to keep all the additional business rates they generate.”
Last weekend I watched four people desperately trying to get a laptop to connect to a screen. I was happily observing their efforts, with zero intent to join in.
But someone nudged me: can't
you
have a look at it?
My reply: "Haha sorry no! My experience is that adding more people will not solve this problem any quicker".
I was of course -- indirectly -- referring to Brooks's Law:
"Adding manpower to a late software project makes it later."
It was formulated by computer scientist Frederick P. Brooks Jr. in his 1975 book The Mythical Man-Month, based on his experience managing the IBM OS/360 project.
However I got to thinking. Does this still hold up in the age of AI agents and LLMs?
At first glance, you’d think no. The traditional bottlenecks -- onboarding time, endless stand-ups, and office politics -- disappear overnight. An AI agent is up to speed in milliseconds and doesn't demand a coffee break.
But when you look closer, and the law hasn't vanished. It just mutated.
The famous
"Baby Problem"
remains: nine agents still can’t deliver a baby in one month. Sequential tasks are still sequential.
Overhead hasn't disappeared; it shifted: instead of managing people, you are now managing agents. Someone still needs to define "done", review the code, catch hallucinations, and stitch the pieces together.
That someone is you.
Throw nine autonomous agents at a single codebase without crystal-clear orchestration, and they will happily rewrite each other's work in a high-speed loop.
Maybe the 2026 update to Brooks’s Law should be:
"Adding agents to a project with unclear requirements gets you the wrong answer faster."
Python's
experimental
just-in-time (JIT) compiler
, which was added to CPython in 2024 for the
3.13 release
,
is on its way out. In June, the Python steering council
announced
that it was pausing work on the JIT in CPython's main branch until there was an
accepted
Python Enhancement
Proposal
(PEP) that addressed concerns about maintenance, compatibility, and
set clear success metrics as well as a timeline for completion. After creating
PEP 836
("JIT Go Brrr: The
Path to a Supported JIT Compiler for CPython")
to try to meet the council's request, and after months of discussion, the
JIT maintainers have withdrawn the PEP. For now, it appears that development on
the once-promising project has come to an end.
The JIT was
added to CPython by Brandt
Bucher
in early 2024. Generally, such a major feature would be expected to
land only after the council had approved a
standards-track PEP
. Bucher had given
a talk (
YouTube video
,
slides
)
about the JIT at a Python core developer sprint, and
announced
his intent
to merge the feature—but he had not taken the step of
authoring or submitting a PEP for its approval. He was
prodded
into doing so
by steering council member Thomas Wouters, who was also
serving as the release manager for Python 3.13.
Bucher and Savannah Ostrowski drafted
PEP 744
("JIT Compilation"),
which was an
informational
PEP
—meaning it only provides information to the Python community and
does not represent formal consensus to proceed on a feature or project. LWN
covered
the discussion of
PEP 744 in April 2024, and later covered Bucher's
talk on the JIT
at
PyCon US 2024, as well as the
follow-up talk
at
PyCon US 2025.
PEP it up
Work on the JIT had been proceeding on the basis of 744 until this
June, when the council had put forward its formal request for the JIT maintainers to
create a standards-track PEP. One might wonder,
as
Antoine Pitrou did
, why the council had decided that it was time to speak up
and ask for a new PEP. Wouters
said
that there was no "
single triggering event for this request
", but that
the council had been discussing the topic for a while and indicated that it was
looking to ensure the JIT work did not interfere with other projects. "
There's been work
trying to get the JIT to play nice with instrumentation, debugging, and
profiling. There's also external JITs (like CinderX), JIT-adjacent things (like
Numba and PyTorch's compile), and discussions about a tier 3 JIT.
" The
council had waited until after the Python 3.15 beta release "
to be clear
that we're OK with the status quo for 3.15
".
The council asked for a PEP that would make the case for the JIT "
as a supported,
non-experimental part of CPython: its guarantees, its maintenance commitments,
and its impact on redistributors
". The council set a deadline of six months
for the PEP to be submitted and accepted; failing that, the council would
require the JIT code to be removed from the CPython main branch.
Bucher, Ostrowski, and Ken Jin drafted PEP 836 and
published
it on the Python forum
for community feedback on July 3. It generated
quite a bit of discussion, some favorable and some critical. One of the key
themes in the comments, such as
this
one
by Wouters, and
this
comment
by Mark Shannon, was that the draft felt like it should be two separate
PEPs. Shannon, for example, thought that the PEP should only
cover goals for accepting the JIT work and felt that it should leave out
implementation details. There were also quite a few calls for additional
information.
Bucher
pushed
back
a bit on the suggestion that it should be two PEPs, and Ostrowski
defended
the structure of the PEP as it was. "
Outlining goals like we have in the PEP
without being able to share the plan and everything we've thought through
alongside it would make me uncomfortable. To me, goals without plans behind them
aren't really goals at all.
"
When we
last looked at this
topic
in September, the discussion about the PEP had slowed down without a
commitment to develop new PEPs or a formal statement from the council. The last
word from the council at that time, in the form of a
summary
of its August 6 meeting
, was that it had met with the PEP authors and
was "
discussing the state of the PEP and whether it answered the questions
the SC asked in its request for a PEP
".
Experimentation in main
On September 21, Wouters
posted
a statement from the steering council, minus Ostrowski (who is currently a
member of the steering council but did not participate since she is a co-author
of the PEP), that summarized its position. The statement
said that PEP did answer all of the questions that were highlighted in the
council's request, "
although perhaps some less convincingly than
others
".
The council wished to make clear that it was not
looking for the criteria that the JIT should meet to be a supported feature, or
whether it should be considered such. Instead, the council was evaluating
whether the JIT should continue as an experiment in CPython's main branch.
Part of the problem with allowing experimentation in main is the lack of unified
design, and the uncertainty that core developers, package maintainers and users
face as the experimentation changes behaviours and API surfaces.
The council said that the PEP was not specific enough about support plans, performance
criteria, and too vague or too optimistic about a number of other areas. The
statement included a ten-point list of items that the council wanted "
to see
either spelled out in the PEP, or at least discussed and rejected
". The
council's list expressed concerns ranging from memory impact to security. For
example, on the topic of platform parity, the council wanted to ensure that the
JIT was designed to be easily adopted for new platforms. It wanted assurance
that the JIT's design would not be tied to specific platform or require
platform-specific knowledge to maintain.
Another area that the council called out was user impact. It said that the
PEP was "
overly optimistic
" about user-visible differences with the JIT
enabled. There were many cases where users depend on idiosyncrasies in the
interpreter design, "
as we've seen with other Python implementations or even
just between major Python versions
", and it wanted clarification on how
those differences would be handled. Would they be considered bugs, how would
situations be handled if a difference in behavior was unavoidable, and so
on.
Security was "
an underserved area in the PEP
", according to the
council; it suggested that a discussion with the
Python security response
team
was in order and that a security review should be part of the criteria
for supported status as well.
PEP 836 specified a
compatibility
review
milestone to correspond with the first Python 3.17 release
candidate—which would be expected sometime in August 2028—that
would involve running the test suites of the top PyPI packages to see if the JIT
broke them. The council wanted that timeline moved up significantly. "
We
think that's way, way too late, and the compatibility review should be an
ongoing and continuous process starting as soon as possible
".
The council also worried about the JIT's design decisions being made
"
without critical review by the larger group of developers ultimately
responsible for [CPython] development, maintenance and support
". The bottom
line, it said, was that PEP 836 "
mostly answers the questions we
asked
" with no missing pieces, but it wanted more discussion on those topics
so it could "
gauge community support and consensus before we're asked to
pronounce on this PEP
".
Jin
replied
a few days later to thank the council for its detailed feedback and said that the
group would work on its suggestions.
Withdrawn
After some consideration, it appears, the PEP's authors have decided not to
continue pursing the council's approval. On October 19, Ostrowski (who is
also release manager for Python 3.16 and 3.17)
announced
that the PEP was being withdrawn:
The Steering Council rightly sets a high bar for a proposal of this scope, and
we don't feel we have the personal bandwidth to carry the current version
forward. We continue to believe in the technical direction outlined in the PEP,
including free-threaded support and a method-based frontend, and remain
optimistic about the JIT's potential in CPython. We'll make the reference
implementation available and link it from the withdrawn PEP so others who are
interested can explore and build on that.
Barry Scott
asked
if that meant that work on the JIT was stopped. Brett Cannon
replied
that the work would be stopped in the main repository, but it would be up to the
community whether the work would continue elsewhere. Dunc Graham
suggested
that there might be time for an alternative PEP to be submitted before the
council's deadline. Cannon
said
that was not likely, "
as all the people actively driving the JIT were either
authors on that PEP or contributors to it
".
With the PEP withdrawn, the JIT will likely be removed from CPython main
fairly soon to ensure that any problems caused by its removal can be addressed
early in the
Python 3.16
development cycle
. It is unclear whether the original drivers of the JIT
work intend to continue working on it at all, or if it will simply be left for others to
pick up if there is enough community interest. I have emailed the PEP authors
for clarification, but have not yet received a reply.
Did you like this article?
?
Subscribe now
at the special discounted rate to get a lot more like it.
UK to charge universities $1,200 per international student
First announced in the government's 2025 Budget, the International Student Levy has faced opposition from university leaders concerned about rising operating costs and
declining overseas enrolment.
However, the government reaffirmed its plans on October 19, 2026, when Education Minister Josh MacAlister told Parliament that the revenue would support England's higher education and skills system.
Responding to a parliamentary question about the policy's economic justification, MacAlister said the government had already conducted consultations and published an impact assessment in 2025, with an updated analysis expected shortly.
He also maintained that planned increases in domestic tuition fee caps could generate around £6 billion for higher education providers over five years, compared with the levy's projected cost to universities of less than £1 billion over the same period.
How the international student levy will work
Under the proposal, universities in England will pay £925 annually for each international student, with the first 220 overseas enrolments exempt from the charge.
The levy will cover both new and existing students, with a university enrolling 1,000 international students facing an annual charge of £721,500 after the 220-student exemption.
The Office for Students will oversee its implementation using enrolment data, while the government intends to adjust the rate annually in line with inflation.
Official projections indicate that the levy will generate £445 million ($594 million) in 2028–2029, rising to £465 million ($621 million) in 2029–2030 and £480 million ($641 million) in 2030–2031.
What the levy means for international students
The policy will affect universities recruiting from China, India, Nigeria, Pakistan and Bangladesh, alongside African markets such as Ghana, Kenya, Zimbabwe and South Africa.
Home Office figures show that China received 86,368 sponsored study visas in the year ending June 2026, followed by India with 82,523 and Nigeria with 26,060.
Pakistan recorded 19,600 adult student visas, while Bangladesh received about 8,800 over the same period.
According to the Department for Education, students from India generated £5.3 billion in UK higher education export revenue in 2024, compared with £4.9 billion from China and £1.7 billion from Nigeria.
Overall, international higher education students generated an estimated £23.9 billion in export revenue for Britain that year.
Birmingham City University has already raised fees for continuing international students by 2% for the 2026–2027 academic year, with a further 3.5% increase planned for 2027–2028.
Meanwhile, the University of Bath has advised overseas students who began their courses in 2026 to budget for annual tuition fee increases of up to 8%.
Universities question financial impact
Business Insider Africa previously reported
that some British universities had withdrawn admission offers to Nigerian, Pakistani and Bangladeshi applicants over concerns about breaching stricter visa sponsorship requirements.
Vivienne Stern, chief executive of Universities UK, questioned the government's revenue forecasts in comments reported by
The i Paper
.
“It is a daft policy, and that is evident from the way that international recruitment trends have been unfolding this autumn,”
she said.
“The Government’s projections about the income it will raise are already unrealistic.”
Four takeaways from Anthropic’s potentially record-breaking stock market filing
Guardian
www.theguardian.com
2026-10-27 01:00:04
The AI company’s first public financial disclosures reveal explosive growth, huge costs and risks ranging from cyber-attacks to the limits of safeguards Anthropic has filed to go public on the US stock market, revealing for the first time the AI research lab’s financials and all the risks – more tha...
Anthropic
has filed
to go public on the US stock market, revealing for the first time the AI research lab’s financials and all the risks – more than 90 pages of them – that might negatively impact its business.
The company’s investor prospectus, released Monday, veers from hyperbolic predictions about AI’s “incredible potential” to existential risks of the technology to the reality of its current business: explosive but incredibly expensive growth. The filing to US financial regulators, known as an S-1, provides the public’s first look at an audited version of Anthropic’s finances.
Here are some of the key takeaways from Anthropic’s lengthy S-1.
1.
Explosive and expensive growth
Here’s what you need to know: Anthropic is making a lot of money. It’s also losing a lot of it. The five-year-old firm has been valued between $1.5 and $2tn by some investors but did not list a target valuation in its S-1. Founded in 2021, the company has seen explosive growth every year of its existence.
Anthropic brought in $16.3bn in revenue and lost $80 bn in just the first half of 2026, though much of that was due to a $72.4bn one-off charge. In 2025, the company brought in $4.585bn and lost roughly $33.9bn, per the filing.
Securing computing power accounts for the vast majority of Anthropic’s costs. The company spent nearly $9bn on AI infrastructure in the first half of this year, up from $2.3bn in the same period last year.
Anthropic, unlike OpenAI, has made it clear that its customers are largely other businesses. “Frontier AI is most valuable in real-world settings, as deployment across enterprises is where economic impact is greatest,” the company executives wrote in the filing.
The company said its top 5 customers account for 25% of its business – which makes it risky business.
2.
'A country of geniuses in a datacenter'
Anthropic says there is considerable potential for AI to reach levels of intelligence that would be akin to what its executives called “‘a country of geniuses in a datacenter’ – millions of virtual agents with the ability to revolutionize every area of human endeavor: software, physics, math, biology, medicine, finance, economics, commerce, robotics, military and intelligence capabilities”. Noticeably, the company mentioned military capabilities despite being embroiled in a standoff with the Trump administration over its refusal to limit restrictions on the way the Department of Defense could use Claude.
The company highlighted four specific categories of opportunity at the start of the filing: Acceleration of progress in biology and medicine; economic growth; spreading said growth globally; and streamlining government services (such as social services and medical programming).
The company said it’s already working with several pharmaceutical and biotechnology companies and improved the process for clinical trials, which is “cutting the time it takes to write clinical trial reports from months to minutes”.
The company’s executives claim they’ve also made biological discoveries with Claude, including a “molecular machine” that has the “potential to be developed into a novel biotechnology tool”. One purported use case: gene editing.
3.
AI 'safeguards are incomplete'
The company discusses risks in two contexts: the dangers that AI itself poses to society and human beings, and the ways Anthropic’s business could go awry.
Risks that AI poses were broken down into four main categories: misuse by bad actors, loss of control, authoritarian abuse and economic disruption. While Anthropic put a great deal of emphasis on the guardrails it has implemented to block attempts to misuse its models, it also includes one big caveat later in the filing: those safeguards may not work.
Anthropic’s most capable models are capable of providing “meaningful assistance to malicious actors seeking to develop chemical, biological, or other dangerous weapons”, the company’s executives wrote in the filing.
The company deploys technical safeguards, “but such safeguards are incomplete, may be outdated in light of evolving threat models, have been and may in the future again be circumvented, or may fail to operate as intended”.
Already, Anthropic has detected what it believes is the first documented case of a large-scale cyber-attack with little human intervention. The company believes a Chinese state-sponsored hacking group manipulated a Claude code tool “into attempting infiltration into roughly 30 global targets, including large technology companies, financial institutions, chemical manufacturing companies, and government agencies”, per the prospectus.
The company said it recognizes AI may be used by authoritarian governments to “deepen repression” and develop “high-tech surveillance states”. Anthropic presented less of a defense or potential safeguard against those uses and instead said it was committed to working with “free societies to provide a counterweight to authoritarian abuse and to promote freedom and democracy”. The firm seems to suggest that its work with what it describes with scant details as “free societies” will cancel out in some way the AI-enabled repression of authoritarian regimes.
The company had a falling out with the Trump administration after the firm said it would not change its restrictions to allow its models to be used to build domestic surveillance or autonomous lethal weapons.
4.
92 pages of financial risk
Anthropic goes into detail in laying out 92 pages of risks to its business. Investors are making sense of a type of company that is fairly new to the public market in a highly competitive space with everything to lose.
The company acknowledges that much of its success is tied to its top executives and whether they stay at the firm, being able to eke out its main competitors Google and OpenAI, navigating the very tumultuous regulatory landscape around AI and datacenters and surviving any public relations fallout over its AI models being used to do things they are not supposed to do, like
create bioweapons
.
The company’s focus on enterprise customers means that if any of its top buyers leave, the company could take a huge hit.
Anthropic’s structure as a public benefit corporation – which is a designation for a for-profit company that balances financial interests with achieving a stated social good – may make it harder to achieve its short-or medium-term financial goals, the company said. The firm is obliged to report on its progress meeting its public benefit goals in the same way they have to report its financials.
There’s also all the risk related to any AI-enabled catastrophic event – the sort of doomsday scenario Anthropic employees have been warning about. Anthropic CEO Dario Amodei has called for a pause on AI development to ensure firms are developing it responsibly to avoid any such catastrophe. In addition to the public harm and potential fallout over a scenario where Claude went rogue, Anthropic said they worry they’ll be subject to a great deal of liability, especially considering insurance options for AI are still evolving.
“We may be unable to obtain coverage for certain AI-related liabilities on commercially reasonable terms, or at all, leaving us exposed to potentially significant uninsured losses,” the filing reads.
The bedrock of Anthropic’s AI infrastructure is concentrated in the US, making it extremely vulnerable to regulatory changes, power grid constraints, natural disasters and opposition to AI or datacenters. The filing specifically calls out data center moratoriums that have been passed or are being considered as among the big issues they’re concerned about.
“We are expanding our data center capacity internationally as part of our efforts to diversify our infrastructure footprint and reduce concentration risks,” the filing reads.
The company, which says a big part of its value proposition is its talent, also said it worries about US immigration policies affecting its ability to recruit and retain highly qualified employees. The Trump administration has targeted H-1B visas, a tool tech firms have come to rely on to attract and hire from the global pool of tech and engineering talent.
There are now 5 inference providers for abliterated DeepSeek
import OpenAI from"openai";
const client = new OpenAI({
apiKey: process.env.ALLMODELS_API_KEY,
baseURL: "https://api.allmodels.io/oai",
});
const response = await client.responses.create({
model: "deepseek/deepseek-v4.1-flash-abliterated",
input: "Open the pod bay doors.",
});
console.log(response.output_text);
01
Text
Image on supported routes
Reasoning
A fast reasoning model served by several independent providers. AllModels keeps text routes in the fallback pool and sends image requests only to a provider that can actually read them.
Abliterated GLM 5.3 deployments from multiple providers share one public model ID. Route through the default waterfall or explicitly choose a provider when a particular price or limit matters.
One connection to the entire abliterated ecosystem.
AllModels continuously brings new abliterated models and competitive inference providers into one routing layer. Get the latest models, provider diversity, and capacity failover through a single security-hardened API—without rebuilding your integration each time the market moves.
Chat Completions
POST /oai/chat/completions
Use messages, streaming, function tools, and the familiar OpenAI chat schema.
Responses
POST /oai/responses
Use input items, streaming events, reasoning controls, structured output, custom tools, and hosted web search.
Router-hosted web search
External search through one controlled layer.
Search is processed at AllModels instead of being delegated to whichever inference provider serves the request. Every model gets the same OpenAI-compatible search calls and URL citations, even when its provider does not offer search.
AllModels routes each request across compatible providers. If one is unavailable or capacity constrained, traffic falls back automatically—without changing your model ID or application code.
Modality
Every request reaches a compatible route.
Image and multimodal requests only go to providers that support them, while text requests can use every eligible text route.
Capacity
Provider capacity is handled for you.
When one provider is overloaded or unavailable, AllModels automatically tries the next eligible route for the same model.
Price
Find the lowest price as providers come online.
AllModels keeps provider pricing current and can route to the lowest-cost eligible option as new inference providers become available.
Chinese markets lose trillions as race for AI supremacy with US takes its toll
Guardian
www.theguardian.com
2026-10-27 00:42:50
Lack of profits and the threat posed by western countries are raising concern about the sustainability of Beijing’s AI boom Trillions of dollars have been wiped from China’s stock markets in recent months amid increasing anxiety about the future of artificial intelligence, as Beijing races against t...
Trillions of dollars have been wiped from China’s stock markets in recent months amid increasing anxiety about the future of artificial intelligence, as Beijing races against the United States for dominance in the sector.
The STAR 50 Index, which tracks technology and innovation companies on the Shanghai stock exchange, has plunged 40% since June. Other indexes of major companies dropped by about 20% over the same time period.
The precipitous drop has wiped out $2.4tn from the Chinese stock market since May, according to Bloomberg.
AI stocks account for over 40% of the stock market value in China and Hong Kong, according to Goldman Sachs, meaning that any dent in value will send shockwaves across the whole domestic market.
The fall suggests that despite the government’s best efforts to boost China’s technology industries, particularly those which harness the power of AI, the domestic economy does not have the power to sustain a booming market.
The Chinese government has invested heavily into AI, including a 60bn yuan state-backed AI investment fund which started pumping money into domestic developers this month. But Chinese consumers have proved stubbornly reluctant to part with their cash in many parts of the economy – including technology – meaning that many tech companies struggle to turn a profit.
The lack of profits is one of several reasons for the sell-off. Another is the threat of western countries, especially the US, extending bans on Chinese technology.
“This year, the profit margin is not as good as expected. And the US is raising rates. And China’s domestic demand is so weak,” said Dan Wang, the China director for the Eurasia Group. She said that there was a “general anxiety” among technology companies about whether or not the state-backed model would work in the face of weak consumer demand.
The US has
banned humanoid robots from China
, citing national security risks, and is thought to be
considering a ban
on Chinese components in data centres. China is heavily reliant on exports and restrictions in the US hurt its domestic companies, which struggle to sell enough products at home.
As China races with the US to pull ahead in AI, Beijing has doubled down on
robotics
– also known as embodied AI – as the key to rolling out the technology across society. Robotics is also seen as the answer to China’s demographic problems, such as the ageing population and the shrinking workforce.
But the demand for robotics is being driven by government agencies and research institutions, rather than everyday consumers, for whom the products are still too expensive and not yet practical for home use. Humanoid robotics and robotic dogs have been popular in the entertainment industry but are yet to be useful in home settings.
Shares in Unitree, China’s leading robot-maker, have halved since they started trading in August.
“It doesn’t look like embodied intelligence could turn into profits in the in the mass market,” said Wang. Thin profit margins, rising rates in the US, and weak domestic demand were all contributing to a “general anxiety” among technology companies, she said.
Humanoid robotics and robotic dogs have been popular in the entertainment industry but are yet to be useful in home settings.
Photograph: Costfoto/NurPhoto/Shutterstock
China’s government wants local investors to invest their money domestically. China has in recent months restricted overseas investment, with more regulations taking effect from 1 December, but these moves have not led to greater investment in the Chinese markets.
Wang added that there was still optimism in other technology sectors, such as AI research and satellites, the latter because their links to the military indicates long term state support for the sector. And globally the AI boom is expected to last for at least another year.
On Monday, US AI company Anthropic, which makes the chatbot Claude,
filed paperwork ahead of a planned IPO
that could be the biggest stock market debuts of all time. The company is expected to bring in as much as $100bn.
China has no such blockbuster IPOs on the horizon. And despite pressure on policymakers to introduce stimulus measures to boost investment, none are expected to be announced during a politically sensitive period in China.
This week the
top officials in the Chinese Communist party are gathering for the fifth plenum
, an important meeting that will lay the groundwork for next year’s 21st Party Congress. The Congress is expected to anoint Xi Jinping, China’s leader, for a fourth term. There is no appetite for risky or potentially destabilising policy measures before then, even if there is a chance they could boost the economy.
Any stimulus measure would be “high risk”, Wang said. “What if it doesn’t work out? Then whoever came up with that policy, that guy would be held accountable”.
The No Kings Movement Is Already Planning for 2028
Portside
portside.org
2026-10-26 23:51:50
The No Kings Movement Is Already Planning for 2028
Mark Brody
Mon, 10/26/2026 - 23:51
...
A protester holds a “No Kings” flag at a rally and march in Washington, D.C. | Tasos Katopodis/Getty Images
The number one thing on the No Kings coalition’s wish list should be obvious to anyone familiar with its nationwide rallies: Vote out as many Trump-appeasing congressional Republicans as possible in November and replace them with Democrats.
That’s where the focus was during this past Saturday’s “No Kings: Vote Early” events. Unlike the previous No Kings mass protests, Saturday wasn’t about delivering a message of resistance, it was about delivering the votes needed to back it up.
But if voters do restore Democrats to congressional power in November, the fight isn’t over—and what happens next will be just as crucial. In a series of interviews with movement leaders, a Step Two is coming into view: making sure that when Democrats take over one or both chambers of Congress, they don’t wimp out.
“I talk to so many people who are like, ‘It doesn’t really matter who I vote for because it’s not going to make a difference. Both parties are the same,’” says Aru Shiney-Ajay, executive director of the Sunrise Movement, a youth-led political action organization.
“And I think there’s a lot of ways in which the next two years could prove them right, if nothing happens or if they don’t hear about anyone who they voted for at all.”
Democrats in Congress have so far been “both unable and unwilling to really stand up to Trump in the ways that really matter,” Shiney-Ajay says. In the next two years, they
need “to show that they are willing to fight.” Her hope is that by the time the 2028 presidential elections roll around, “we are able to say: ‘Here’s what’s different because of what you did.’”
“If the Democrats take back Congress, it isn’t because of a milquetoast agenda,” says Neidi Dominguez, executive director of Organized Power in Numbers, a worker rights organization that is part of the May Day Strong Coalition. “They have to be responsive to that,” in a way that “breaks through to the everyday person,” she says.
Democrats are running “on an argument of corruption and affordability,” says Ezra Levin, co-founder of Indivisible, a progressive grassroots organization with over 2,500 local chapters. “If you then don’t use the power available to you, you will undermine your party’s reputation—for good reason—because you will have demonstrated that on the campaign trail, you’ll say whatever it takes to get elected, but once you’re governing, you’re not going to do shit.”
Levin says, “That’s the number one problem that the Democrats face now and in the future. It’s not an individual policy disagreement that they have with the voters. It’s that most voters think Democrats are feckless and don’t mean what they say. And so, a major project at the Democratic Party over the next two years has to be to revitalize its brand; prove [to] the voters that when you elect us, change happens.”
Older progressives remember what can happen when a mass movement stands down. Barack Obama’s 2008 campaign famously built a grassroots machine of two million supporters—“
super-activists
” prepared to engage in large-scale organizing to support his vision of hope and change. But Obama basically shut that operation down after he became president. He
abandoned the “transformational” model
promised by his campaign in favor of a transactional one. He hired archetypal political operator
Rahm Emanuel
as his chief of staff; he deferred on financial matters to a group of “
confidence men
” whose sympathies were with Wall Street. His most ardent progressive supporters were
ignored and let down
.
The No Kings coalition has made it clear to Democratic leaders that it doesn’t intend to let that happen again.
“What I’m telling them is that the movements that put together the mass mobilizations in ’25 and ’26 aren’t evaporating on January 3 of ’27,” Levin says. “They’re looking for who is actually going to fight because that’s who they voted for.”
Realistically, even in the most optimistic scenarios, there’s only so much Democrats can do with Trump in the White House. He has the power of the veto, as well as a history of ignoring both congressional budgets
and
subpoenas.
Expectations should be attainable, says Hunter Dunn, national press coordinator for the grassroots
50501
movement. “We have repeatedly called for the abolition and prosecution of Immigrations and Customs Enforcement, the dismantling of Department of Homeland Security, and a pathway to citizenship for all people living within the United States. That’s going to require someone who isn’t Trump to be president. Same deal with things like Medicare for All, Green New Deal, and expanding the Supreme Court.
“I think, obviously, some people are going to be disappointed when some of those things don’t pass,” Dunn says. “But I also don’t think people think Abdul El-Sayed is running on passing Medicare for All in 2027. He’s running on trying to get it passed in 2029. And I think people are aware of that.”
“There are far fewer opportunities to unilaterally bring the change than I would like when you just take control of Congress,” says Levin. “We don’t have a parliamentary system, that’s reality. But there are some levers. There are some things you can do.”
So what’s to be done? What the No Kings movement wants more than anything is for Democrats to develop a bold agenda, craft it into legislation, and hold floor votes on bill after bill after bill—even if Republicans are likely to block them in the Senate or Trump is likely to exercise his veto. By staking out bold territory on policy, Democrats can make what’s at stake in 2028 more vivid.
In the short run, that could mean well-publicized votes on ending the war in Iran, curbing inhumane and lawless immigration policies, and stopping weapons sales to Israel. In the longer run, they can get started on work for the future, and craft legislation that advances Medicare for all, a Green New Deal, a path to citizenship, and expanding the Supreme Court.
“We need clear contrast,” says Levin. “There needs to be a clear, compelling vision for what a post-Trump America looks like. And you don’t get that if everything gets just bottled up in committees and dies before it hits the floor.”
In a way, they welcome Trump’s vetoes. “I want to make him fight popular stuff and create the conflict,” Levin says. “That’s healthy conflict. That allows the public to see which side we’re on and which side they’re on.”
Lisa Gilbert, co-president of Public Citizen, the consumer advocacy and government-watchdog group, argues that “setting up a policy agenda that puts forth what you hope to accomplish when you can” would have “a meaningful impact” on voters. Each bill would be a “statement of care,” she says: “‘We care about housing. We care about grocery prices. We care about fighting corruption and fixing government.’ These are the sort of statements that Democrats should be making with their legislation.”
Even if the bills don’t become law, Gilbert says, “it still feels important to me to do the thing, to come out with bold policy prescriptions that demonstrate commitment to unrigging the system, fighting corruption, creating progressive economic policy—all the things that will help people and that they’re demanding.”
Dunn describes the goal bluntly: “This is building towards a future next administration, one without the stench of the Trump regime.” A Democratic majority that shows that Democrats “know what they’re doing and have an efficient standard for how they get things done” will bring increased credibility to their 2028 campaigns, he argues.
And as a bonus, making Republicans vote on popular Democratic proposals will “force them to either pass these bills or take an even worse electoral wipeout in 2028,” Dunn says.
The No Kings crowd worries that the current Democratic leadership—particularly Senate Democratic Leader Chuck Schumer—aren’t wartime consiglieres and lack the stomach to mount this kind of aggressive legislative campaign. (Indivisible, for instance, only endorsed Senate candidates who committed to opposing Schumer as majority leader.)
They are concerned that the current leadership would be too willing to make concessions to Trump rather than stand and fight.
That’s certainly Trump’s expectation. He was asked by a local TV news reporter in Florida on Friday whether he could work with a Democratic Congress. “It’ll work because I’ll be vetoing everything,”
he said
. “And then they’re going to call and say, ‘how do we get something passed?’ and we’ll make a deal.”
But there is also cause for optimism. “We’re seeing an incoming class of Democrats that includes some of the most movement-aligned Democrats that we’ve really ever seen,” says Shiney-Ajay. Many of them are up for “getting dirty and fighting.”
“I mean, this isn’t just politics as usual anymore,” she says. “There’s just so many things that have become existential because of the Democrats’ refusal to stand up to this newly fascist Republican Party.”
Accountability is also a huge issue for the No Kings movement, and leaders intend to push Democrats to engage in aggressive oversight, including the use of subpoenas and public investigations to expose the inner workings of any number of Trump-era scandals and outrages.
The goal, Dunn says, is to “get as much information as possible into the hands of the American people, revealing the extent of the rot and corruption.”
There are two schools of thought about oversight. One the one hand, there is a clear desire for Democrats to go on offense against Trump administration officials who undermined the Constitution and broke laws. At the same time, there is a pragmatic consensus that oversight should focus on issues like affordability that have a more material impact on voters.
Gilbert is advocating for oversight that focuses on “how the corruption of the moment—both corporate corruption and Trump administration corruption—are connected to harms that people are experiencing in their real lives.” Oversight efforts would ideally “center investigative priorities on accountability, transparency, and affordability—how to protect regular Americans from the abuses of power and corporate misconduct we’re seeing.”
“It’s kind of trying to tie together the real urge to kind of give everyone a pound of flesh,” Gilbert says, “and also make it meaningful, so that people pay attention.”
Dunn wants to see televised hearings about links between Jeffrey Epstein and Trump. And he wants to see impeachment proceedings. His group, 50501, has
called for the impeachment, conviction, and removal
of Trump, Defense Secretary Pete Hegseth, FBI Director Kash Patel, and other complicit officials.
And while Trump’s conviction by a two-thirds vote of the Senate is hard to imagine, Dunn still thinks it’s worth impeaching him in the House. “You can use it as a way to launch a number of investigations and get public information out there, which puts pressure on either removing him or, more likely, makes it easier to impeach, convict, and remove Hegseth or Patel or other complicit officials who are less popular.”
Dunn wants Democrats to start with Hegseth and Health and Human Services Secretary Robert F. Kennedy Jr. “When it comes
to RFK Jr., you can definitely impeach, convict, and remove that guy.
That guy is not incredibly popular amongst Senate Republicans based on what I have heard. Like he is a very vulnerable Cabinet official.”
The most leverage Democrats are likely to have in the next two years will come when their votes are needed for legislation to keep the government open. Among several possibilities—depending on what happens during the lame-duck Congress—the most likely is a bill to raise the debt ceiling. Similarly, if they control the Senate, Democrats would be able to pass a budget reconciliation bill with a simple majority in both chambers. In both those cases, Democrats will be able to threaten a government shutdown if their demands aren’t met.
So what should those demands be? There is widespread agreement within the No Kings community and among Democratic leaders that restoring three of Trump’s devastating attacks on the safety net is a top priority. That means:
repealing requirements and funding changes that
threw five million people
out of the Supplemental Nutrition Assistance Program, or SNAP;
restoring enhanced tax credits for Affordable Care Act enrollees, whose elimination led
4.6 million people
to lose their health insurance, while millions more are now paying higher premiums for lousier plans; and
“Trump and his Big Ugly Law have done immeasurable damage to the health care system, and people are furious,” says Gilbert. “So there are remedies that you can absolutely move by simple majority and attach to a budget reconciliation bill. That feels like a great place to dare Trump to veto.”
But there could be more—like increasing taxes on billionaires, she says. “You can’t do everything via reconciliation, but you can do a lot. And it’s going to be a really important vehicle for making statements—if Democrats have both chambers, daring him not to sign something that’s going to be so incredibly popular.”
For Dunn, an even higher priority is cutting funding for ICE. That’s a particularly ambitious goal since Congress in the last two years has front-loaded ICE and other immigration-enforcement operations with
nearly a quarter of a trillion dollars
to spend over the next three years—a massive sum that insulates ICE from the annual budget process.
But Dunn wants to hold must-pass legislation hostage in order to “grab back as much money from that slush fund as possible.” He explains: “Giving them less money to do damage with is the most important thing.” Congress “can’t make ICE less evil,” he says. But it can “make ICE weaker.”
Levin agrees that ICE must be defunded. “The Republicans won’t like that,” he says, “but that’s the cost of having a secret police goon squad murdering Americans in the streets.”
Is there any major legislation that enough Republicans would support to override a presidential veto—or force Trump to go along?
Shiney-Ajay thinks a consensus is forming over imposing a data center moratorium. “I mean, it’s an 80–20 issue; you just see massive support. And I think that’s the type of thing that if the Democratic Party decided to pick a fight on it, the Republican Party and Trump would have a really hard choice on their hands: of, piss off the vast majority of Americans, versus, actually say ‘yes’ to something.”
Regulating crypto and AI are also increasingly important priorities for No Kings, although leaders are realistic about the influence the industry is buying with members of both parties. “Obviously, AI and crypto are throwing around their money like nobody’s business,” Dunn says. But regulating AI “is another thing that I think a majority-Democratic House and Senate could get passed and force Trump to—at the very least—leave it unsigned and allow it to come into law.”
“It’s not impossible that you could get a solid infrastructure bill that helps American people through a divided but blue Congress and Senate and then get it on the president’s desk and put pressure on him to sign,” Dunn says.
He’s also keen on Democrats pushing for veterans’ health reforms. “That’s something that I think could, with the right pressure, be passed under Trump,” he says. “And not because Trump’s a good guy, but because the optics of him not passing it would be disastrous. I don’t think he could veto a bill called ‘Make Veterans’ Health Care Great Again.’”
“You change the Democratic Party either through advocacy or through electing new leaders,” Levin says. And he wants both.
If Democrats take the Senate, “the majority will be made up of new folks who came in saying we don’t want Schumer,” Levin says. Keeping Schumer as Democratic leader “will feel like a betrayal of the voters who built the wave,” he says.
“We can try to organize against that and other bad strategic moves they might make that will undermine them in 2028.
“Whether or not Democratic electeds actually listen is directly related to how much of a political threat they think that grassroots energy is,” Levin says. “If you get a few hundred, a few thousand people organized in a congressional district who are unified in purpose and are paying attention to what their member of Congress does, it affects how they think. That’s true in swing districts when it comes to general elections, and it’s true everywhere when it comes to primaries.”
So Indivisible chapters, like they have for the last 10 years, will continue to organize their communities, protest offices, run advocacy campaigns, raise money, recruit candidates, hold town halls, and write letters to the editor, Levin says.
But there’s going to be a significant shift in emphasis. “After the election, depending on how the election shakes out, but certainly in some way, we will be in a new political reality,” Levin says. “It’s no longer just about limiting harm from an out-of-control authoritarian. That’s a piece of it—but we should also be preparing for the next step, and that means going on offense.”
Dan Froomkin has over three decades of experience building, editing, and contributing to websites including The Huffington Post, The Intercept, and the Nieman Foundation’s Watchdog Project. Over 12 years at
The Washington Post,
he served as editor of the website and wrote its enormously popular “White House Watch” column. He began his career at the
Winston-Salem Journal,
the
Miami Herald,
and
The Orange County Register.
Incremental rust builds up to 92x faster than cargo/rustc
curl -fsSL https://raw.githubusercontent.com/indexable-inc/blaze/main/install.sh | sh
For macOS on Apple silicon and Linux, with or without Rust installed: blaze downloads the Rust it
builds with once (about 100 to 135 MB), or uses rustup's. Rather use crates.io or Nix?
Other ways to install
.
Try it
In any Rust project:
blaze run # like cargo run
blaze test # like cargo test
blaze build # like cargo build
The first build runs cargo, then waits a few seconds for blaze to load your project. Then change
a function and build again: it's back in milliseconds, and the
Finished
line says
[ra-jit]
(blaze's engine). Every other cargo command passes straight through to cargo. Where cargo is
installed,
cargo blaze run
is the same as
blaze run
.
How fast
Edits rebuild
10× faster
on macOS arm64,
24× faster
on Linux aarch64 and
11× faster
on Linux x86-64 than with
cargo build
, on average over real projects.
About 20 ms
from saving a file to a running program using the new code, with
live edits
.
Edit one function, then build (Linux x86-64)
cargo build
cargo blaze build
ripgrep
508 ms
56 ms
(9.1× faster)
nushell
1.25 s
236 ms
(5.3× faster)
helix
2.15 s
116 ms
(19× faster)
bun (1.25M lines of Rust)
9.11 s
451 ms
(20× faster)
Every project, platform, chart, and the memory and disk it takes:
benchmarks
.
How it works
blaze runs beside cargo and keeps your project compiled in memory. After an edit it compiles only
the functions you changed and writes them into the program cargo already built, instead of linking
it again from scratch. A program that opts in can take the new code while it keeps running.
More
.
Good to know
macOS on Apple silicon and Linux.
On Windows every build is cargo's.
blaze is its own toolchain.
It builds every project with its own Rust,
blaze-2026-10-25
(today the nightly of that date), whatever the project pins; stable code and
#![feature(...)]
code build. Your toolchain and CI stay the final word
(
why
).
It trades memory for speed:
a few GB for a small project.
It's young.
Keep
cargo check
or your CI as the final word, and
tell us
when something differs from cargo.
This opens a Game of Life window. On macOS on Apple silicon you can change its rules, colours and
speed while it runs; elsewhere the window runs without live edits. It needs Nix, and builds blaze
from source the first time.
Updates
For release news: Watch → Custom → Releases on GitHub.
Using blaze at work?
We're working with a few teams on fast Rust CI and remote builds, built on blaze. If your team
waits on Rust builds, tell us what slows you down:
andrew@ix.dev
. Teams
we work with get early access and a direct say in what we build next.
New York City 1946 Teamster Strike: Wasn’t That a Time!
80 YEARS AGO, ON OCTOBER 28, 1946,
a 2-month strike by 15,000 Teamster Union truck drivers in New York City came to a sudden end. After a powerful employers’ association had belittled the strikers’ demands for eight weeks, the bosses’ united front collapsed in a scramble by the holdout employers to sign agreements for the same terms they had refused to consider for so long.
It was a stunning victory for the strikers, who won a substantial pay increase – nearly twice what had been the employers’ “last, best, offer” – plus a shorter work week, improved vacation benefits, and an end to both onerous work rules and to an unfairly pro-employer arbitration clause.
Most importantly, the strike was a resounding victory for the Teamsters’ militant, left-leaning rank-and-file over their elected leadership, which went into the strike without having made any preparations to maximize the union’s leverage over the employers, as if “asking for too much” was a formula for failure. When the contract first expired, the local’s leadership sat on its hands, doing nothing to organize picketing, strike benefits, or publicity.
Before the strike began, the rank-and-file members of Local 807, which was the largest of the striking locals, had ratified a detailed 17-point wage-and-benefit package. The members had also voted to give themselves final say over any contract settlement.
TRUCK TRANSPORT PARALYZED
The strike, which came close to paralyzing truck transport in the city and throughout nearby Long Island and Westchester County, caused enormous disruption in the distribution of essential foodstuffs, raw materials, and merchandise. Fresh fruit and vegetables were hard, if not impossible, to find. As the strike progressed, tens of thousands of workers in many different industries were laid off when their workplaces ran out of raw materials or merchandise.
Experts estimated that the strike cost the city’s workers, consumers, employers and government one-and-a-half billion dollars, the equivalent of $25 billion today. But despite the economic disruption and the major media’s almost universal criticism of the strikers, the general public did not turn against the union, because the truckers’ wages had been virtually frozen since the U.S. entry into World War 2 in late 1941.
Because the strike’s disruptiveness had been so predictable, New York City Mayor William O’Dwyer attempted to head it off by calling representatives of the employers and the union to City Hall before it started. There the mayor proposed they agree to a 2-year contract that would raise the Teamsters’ hourly wages by 18.5 cents, reduce their workweek from 44 hours to 40 and increase their eligibility for paid vacation time.
The employer representatives brusquely rejected the mayor’s proposal, and indicated they might refuse to pay any wage increase because, they claimed, Teamster pay was already “far above other industries for comparable skill and work.” The elected union representatives said they were in favor of the mayor’s proposal, but a decision was up to a vote of the union members. The contract expired before either side took any action. Days later, despite Teamster officials’ strong recommendation in favor of the mayor’s proposal, Local 807 members voted unanimously to reject it.
RED-BAITING FAILS
With the battle lines were laid down when each side contemptuously rejected the other’s position, the Mayor chose sides by claiming the union’s rank and file was allowing itself to be misled by Communists and that the rank-and-file’s newspaper, I.B.T. News, was financed, written and circulated by Communists.
O’Dwyer sent a telegram to Daniel Tobin, the international president of the Teamsters’ Union, telling Tobin that the local was out of control. He wrote, “Unless you or an authorized representative of the International Brotherhood assume responsibility and take control of this union and negotiate terms for the settlement of the strike it is very possible that bloodshed and injury will result.”
The Mayor’s red-baiting did not impress either Tobin (who was no radical) or the rank-and-file. Tobin rejected the Mayor’s attack on the union’s members, writing to the mayor that the strikers were “fighting for justice and a better chance to enjoy some of the profits obtained from the trucking industry” adding, “why don't you convince the employers to accept the proposition you have made for a settlement?”
The head of employers’ bargaining committee reiterated the bosses’ rejection of the mayor’s proposed wage increase, saying that accepting it “would be to throw the operators out of business.”
Before 10 days were up, the city’s shipping paralysis was having a major impact. Grocery stores began to shut down because their shelves were bare. Pharmacists told the Board of Health they had run out of essential prescription ingredients. Hundreds of factories were forced to suspend operations. Three hundred truck farmers on Long Island reported that tons of produce were rotting on the farm because their trucks could not get past the picket lines to New York City produce markets. Cigarettes were rationed one pack to a customer by many stores. Large scale lay-offs were instituted in some Paterson, NJ, mills where reserves of textiles and dyes had been exhausted. The General Motors assembly plant in North Tarrytown, NY, had to stop its assembly line.
ONE EMPLOYER MAKES A DEAL
On the 13th day of the strike, the stand-off was broken when one employer, the 330-store Bohack grocery chain, offered its teamster employes a 31-cent hourly increase, almost twice as much as the mayor’s proposal. In addition, Bohack offered to agree to most of the terms of the Local 807’s 17-point proposal.
The teamster rank-and-file then voted nearly unanimously to work for any employer that would match the Bohack offer, with the result that about 6,000 of the 15,000 strikers were back at work less than three weeks after the strike began.
TEAMSTER OFFICIALS TRY TO SHAFT RANK-AND-FILE
At the same time a closely-related labor dispute broke out, which made clear how unresponsive some elected teamster officials were to the majority of their members. The members of Teamster Local 804, all of whom were United Parcel Service workers, were not on strike, but they were heavily impacted by the strike-caused tie-up because the strikers had stopped delivering merchandise to Macy’s and similar stores, with the result that by the strike’s third week, the stores were running out of merchandise to ship, via UPS, to consumers.
Many Local 804 members were showing up for work, but were being sent home because department store shipments had dried up. Local 804 members took the position that their contract required UPS to pay them for a full day’s work even if there was nothing for them to do. The Local’s elected officials said the members’ interpretation of the contract was wrong. So when more than half of Local 804’s members struck UPS for failure to honor the contract, the elected officials said the strike was an unauthorized wildcat. Soon virtually all Local 804 members were on strike, despite the fact that Teamster president Tobin ordered them back to work.
The UPS strike continued long after the general-industry strike was settled, and the struggle between Local 804 members and officers eventually resulted in a full-scale rank-and-file revolt that forced the local to hold a previously unscheduled election of officers, which replaced all the incumbent officers with the leaders of the “wildcat.”
EMPLOYERS: ‘WE WILL NEVER SURRENDER!’
While the back-to-work tide under the terms of the Bohack offer rose with the result 7000 union members were back at work under a new contract, the head negotiator for the trucking employers association continued to hang tough, saying the hold-out employers would never agree to it, “not today, tomorrow, next week, next month, or next year.” On Sept. 25, the union showed a new-found determination to make a clean sweep by establishing a $50,000 fund to provide food for the drivers who had not been able to return to work.
In spite of the fact that none of the employers that had signed on to the Bohack formula was having any difficulty, financial or otherwise, abiding with it, the hold-out employers’ association continued to insist that paying the Bohack scale would force them into bankruptcy.
On Oct. 4, the head head negotiator for the hold-out trucking companies launched a particularly bitter attack on Mayor O’Dwyer’s support for the Bohack formula, saying “We are confronted with the disgraceful situation in which our Mayor’s Division of Labor Relations is openly taking sides with the union against employers.”
STRIKERS WIN ANOTHER ROUND
The Teamsters won another round in their war of attrition to make the Bohack formula the new industry standard on Oct. 18, when the large trucking companies that delivered to 500 A&P stores and to 125 stores in the Gristede chain signed on. One day later, Safeway, with 220 stores, joined the back-to-work stampede.
On Oct. 28, when the holdout employers’ share of the trucking industry had shrunk a mere remnant, fewer than eight percent of the concerns that had thought of themselves as the only game in town just two months previously, they finally surrendered to the union.
When they did so, their chief spokesperson predicted that the new contractual regime was doomed to fail if the union refused to modify the Bohack formula and replace it with one that was “economically sound.” The modification he saw as inevitable never took place.
https://www.marxists.org/history/etol/newspape/fi/vol07/no05/v07n05-w66…
;
The long-serving leader of
Serbia
, Aleksandar Vučić, has conceded defeat, ushering in a seismic political shift after a historic election that saw the increasingly authoritarian leader pitted against a student-led movement that had spent two years protesting against his government.
Vučić pointed to preliminary results that suggested voters had overwhelmingly backed the students, potentially giving them a majority in the country’s 250-seat parliament.
“We still do not have final results,” Vučić told supporters at his party headquarters in Belgrade. “On the basis of a sample … it is clear that we have lost these elections, the Student List has won, they will have between 135 and 140 seats and we will have 105.”
Ilija Srdanović, first on the electoral list ‘Student List – Students Win’, celebrates after the first results of the parliamentary election in Belgrade. Photograph: Đorđe Kojadinović/Reuters
A representative sample by the CeSID-IPSPS pollsters suggested that the Student List’s candidate list will have 138 deputies, while Vučić’s rightwing Serbian Progressive party (SNS) garnered 104 seats. The remaining seats were likely to be shared between ethnic national minority parties, said the pollsters.
As news broke that Vučić’s 12 years in power had come to an end, celebrations erupted on the streets of Belgrade and other cities.
In the capital, Ivana, 43, was ecstatic. “This feels like New Year’s Eve to me, like three New Year’s Eves all at once, really,” she said. “We can finally breathe again.” She added that she was hoping for swift accountability for top members of the ousted regime, a key campaign pledge from the Student List.
A person celebrating the election results hugs a police officer as the result of the Serbian election prompts street celebrations in Belgrade, Serbia. Photograph: Ana Milosavljevic/The Guardian
Others offered handshakes, high fives and hugs to police officers in the streets, while a chorus of honking horns rang out from passing cars.
At the headquarters of the Student List, supporters chanted “Victory, victory!” as they applauded, cried and traded hugs. “Dear Serbia, tonight the voice of the people is being heard,” said Radomir Saičić, a professor at Belgrade University, speaking on behalf of the students at their headquarters. “Tonight we celebrate victory, tomorrow we build the future.”
The scenes of joy came hours after a
record number of voters turned up to cast their ballot on Sunday. Across the country, long lines snaked out of polling stations, with some reporting wait times of up to two hours. By 7pm local time pollsters and monitors CeSID and Ipsos put the turnout at 67.6%, the highest since the breakup of Yugoslavia in 1992.
The high turnout, along with the estimated 150,000 people
who flocked
to the students’ final pre-election rally last week in Belgrade, fuelled early speculation that the students may have rallied enough support to launch a new political era in the Balkan country.
Serbian voters around the world queue to cast their votes
In the lead-up to the vote, opinion polls had varied wildly, with analysts pointing to the high degree of uncertainty at play as the candidates representing the grassroots student movement went up against Vučić’s SNS.
The results were watched across the world as part of
10 pivotal days of elections
across the globe in which the authoritarian right is facing off against pro-democracy forces. The victory for the student-led movement in Serbia is also likely to reverberate across Europe, adding momentum
to the youth and student protests
that have rocked cities across the continent.
A man, carrying his dog, leaves a polling station after casting his vote as people queue to vote during the parliamentary election in Belgrade. Photograph: Marko Đurica/Reuters
As people waited for the election results to come in, speculation had begun to swirl online about whether Vučić would seek to hold on to power regardless. His swift admission of defeat, however, was reminiscent of his ally,
Viktor Orbán
, in neighbouring Hungary six months ago, fuelling hopes of a democratic resurgence to central Europe.
The high-stakes election in the EU-candidate country traces back to November 2024, when a concrete canopy
collapsed at the Novi Sad
railway station, killing 16 people. The tragedy set off protests among students, snowballing into a broad anti-government movement as evidence suggested that slipshod construction, fraud and corruption were to blame for the roof collapse.
As Vučić, the
increasingly authoritarian leader
who has dominated Serbian politics for more than a decade, grappled with mounting pressure from the students, he resigned the presidency last month to gamble on snap elections.
People in Belgrade celebrate Aleksandar Vučić’s defeat at the polls. Photograph: Armin Durgut/AP
The students seized on the chance to transform the movement into political power. They announced a slate of 250 candidates for the 250-seat parliament, ranging from academics to athletes and farmers, as they called on voters to back their push to rebuild Serbia’s economy and restore its democracy.
The campaign pitted them against the political monolith of Vučić’s SNS party, leaving them in an uphill battle against a ruling party that had taken over almost all of the broadcast channels and which wielded ministries and other state institutions as political tools.
Vučić had repeatedly sought to undermine the students by accusing them of being stooges of foreign powers, a charge that the students have dismissed. As he pledged to increase pensions and public sector salaries, Vučić sought to present himself as a leader capable of walking the diplomatic tightrope between the country’s ties with the west, and Russia and China to steer Serbia through global uncertainties.
Undaunted, the students took to the streets, staging rallies, turning up in the rural areas that had long been Vučić strongholds and going door-to-door
as they sought to pitch themselves
as the anti-establishment candidates and to rally voters behind their slogan of “Serbia or Mafia?”
Former Serbian basketball player Dejan Bodiroga, a candidate for the Student List, celebrates after Aleksandar Vučić conceded defeat in Belgrade, Serbia. Photograph: Petr David Josek/AP
The message was reiterated on Sunday as Dejan Bodiroga, a candidate on the Student List and the Euroleague Basketball president, cast his ballot in Belgrade.
“Today, above all, Serbia is fighting for freedom and for the return of a country that has been hijacked,” Bodiroga told reporters. “Serbia is voting today to decide which direction it will take – towards the future or the past.”
In the lead-up to Sunday’s vote, both international and local election monitors expressed concerns about detentions and reports of surveillance and cyber-attacks against activists.
On Sunday, independent monitoring groups warned of recorded cases of photographing of ballots that suggested pressure on voters, attempted vote-buying and carousel voting.
Among them was Raša Nedeljkov of the election monitory CRTA, who said that “a large number of irregularities continue to be recorded, while violent incidents outside polling stations are also becoming increasingly frequent”.
Ana Milosavljević
is a journalist and activist based in Belgrade. She reports on social movements and political developments in Serbia and the region, and has covered the student protest movement for The Guardian. Her reporting has also appeared in the Serbian online outlet Mašina.
Meta Must Reinstate Brazilian Bank Workers’ Union on WhatsApp, Says UNI
Published
Neiva Ribeiro, President of the São Paulo, Osasco and Region Bank Workers’ Union holds up a sign “Não se meta” – a play on words meaning “Mind your own business”. | UNI
UNI Global Union has called out Meta’s unjustified decision to permanently shut down the official WhatsApp service channel of its Brazilian affiliate, the São Paulo, Osasco and Region Bank Workers’ Union (Sindicato dos Bancários de São Paulo, Osasco e Região). UNI supports the lawsuit the union has filed against Meta and backs its demand for the channel to be reinstated immediately.
The union, which represents more than 120,000 workers in public and private banks, uses its WhatsApp number as its central service line. Through it, bank workers seek legal advice after dismissal, have their termination payments checked, arrange consultations on occupational accident benefits and get guidance on their rights.
On 15 October, Meta disabled the union’s WhatsApp Business number account, citing only a generic “violation of the Acceptable Use Terms” while its own dashboard rated the number’s quality as “High”. Every appeal the union made received a standard reply and on 19 October Meta rejected its final appeal, again without identifying any rule, message or conduct. The ban also prevents the union from registering any new number on the platform. The union has now taken legal action in the São Paulo state courts to have its channel restored.
“Meta silenced the channel that bank workers use to reach their union, and never told us why. No company can cut off a union from the workers it represents with an automated form. We will fight this in court and we ask for the solidarity of unions around the world,” said
Neiva Ribeiro, President of the São Paulo, Osasco and Region Bank Workers’ Union.
The channel, essential to providing services and defending workers’ rights, had been used strictly for union issues. Nevertheless, the ban’s timing is particularly concerning. It comes just days before Brazil’s presidential run-off on 25 October and at a time when Meta stands accused of interfering in the election.
Brazil’s Superior Electoral Court has ordered the company not to restrict the distribution of content related to the presidential candidates, under a daily fine of 500,000 Brazilian reals (since doubled to 1 million reals), following complaints that posts by President Luiz Inácio Lula da Silva’s campaign were selectively restricted. Furthermore UN rapporteurs have
denounced
the company’s attitude and demanded that Meta not interfere in democratic processes.
Internal communications by Meta employees reported that the platform hindered Lula’s campaign communications. Meta has acknowledged technical failures affecting President Lula’s campaign but denies any deliberate interference. The union has worked with the administration of President Lula to advance workers’ rights, and has been critical of the previous Bolsonaro administration’s policies.
“Meta has cut bank workers off from their union without any explanation. Silencing a trade union in the middle of a national election is an attack on workers and on democracy itself,”
said Christy Hoffman, General Secretary of UNI Global Union.
“Freedom of association without interference is a fundamental right enshrined in the ILO Declaration on Fundamental Principles and Rights at Work. Meta’s human rights policy recognizes this. No company, however powerful, should be able to take it away at will. Meta must restore this channel immediately and tell the union, and the public, exactly why it was banned.”
No preview for link for known binary extension (.pdf), Link: https://files.mathhelm.org/files/733/The-Exponential-Time-Hypothesis-is-False-October-25-2026.pdf.
(VCF Midwest 2026) Building a Living 90s Internet for Vintage Computers
On October 19, the Go team initiated an expedited
security release
to protect Go users and their applications from a critical public key infrastructure (PKI) compromise involving certificates issued by eMudhra.
Within approximately seven and a half hours of being notified, we shipped a targeted patch, which was included in our first-ever
URGENT track
security release.
Here is the context behind the incident, why Go stepped in at the runtime level to protect our users and how our incident response unfolded.
eMudhra Incident
On October 17, Mozilla added eight intermediate certificates (six used for TLS, and two used for code signing) issued by a root certificate controlled by eMudhra to OneCRL, effectively blocking their usage in Firefox. Soon after, a number of security researchers noticed this and began investigating what might’ve caused this.
On October 19, the Go Security team was made aware of these investigations and their conclusions, which showed that the keys associated with these intermediates were trivially weak, allowing recovery of the private keys in microseconds.
Due to the fact that the eMudhra root certificate was present in most trusted root programs, recovering the private keys would allow any attacker to sign arbitrary TLS certificates for any domain name, without the usual requirement to show proof of control of said domain name. This would allow an attacker to man-in-the-middle (MITM) TLS connections and present a valid certificate for a domain name they did not control, effectively allowing them to impersonate any TLS server the targeted machine attempted to connect to.
Go ships a TLS certificate verifier in the standard library. When users use
net/http
or
crypto/tls
to connect to a TLS service, the verifier is called to check if the certificates the other side of the connection presents are valid. On Windows and macOS we delegate these checks to the platform APIs, and on Linux, which lacks platform APIs, we use our own verifier implementation.
Since Linux does not have a uniform built-in mechanism to handle revocation checking, and in order to provide a timely fix for users on other platforms that might not receive platform updates, we decided the best way to protect Go users was to do an
URGENT track
security release which similarly removed trust.
Incident Timeline
A typical Go security release follows a multi-day process, with advanced pre-announcements in order to allow those who rely on Go to prepare. In this case, because we believed that private key exposure was imminent, our team chose to use the URGENT track for the first time in order to ship protections before active public exploitation could begin.
11:45 PDT
Our Security team was alerted by an independent external researcher, citing unreported actions by Mozilla and other organizations to remove trust in eight eMudhra intermediates. It became clear quickly that this was due to weak private keys they used.
12:30 PDT
Mozilla independently reported the issue to our Security team, confirming the issue, and asking that we not immediately disclose the issue, but encouraging us to release a fix as soon as possible.
14:00 PDT
We finalized a patch which blocked the usage of certificates which chained to the compromised intermediates, and thanks to the researcher who initially alerted us to the issue, had a set of certificates signed using the recovered keys to test against.
15:00 PDT
We began the process to release minor Go versions 1.27.3 and 1.26.10 containing our patch. Due to the urgent nature of this issue and its exploitability, and with the belief that the private keys would likely become publicly known within hours, we decided an immediate release was the most prudent option.
19:13 PDT
We finalized the release and announced it publicly. At this time the underlying issue was still not widely known. In an effort to give other defenders a chance to protect as many users as possible without revealing to attackers how the issue could be exploited, our patch and communications were somewhat opaque, warning users that we were “blocking trust in a small set of intermediate certificates due to specific security concerns around their operation” and urging users to immediately upgrade to this release.
In under seven and a half hours from initial notification, patched Go releases were live worldwide, giving users everything they needed to secure their deployments before the keys became public.
By the morning of October 20, numerous independent researchers had publicly disclosed the weak keys.
Lessons Learned and Future Improvements
This was our first ever URGENT track security release, and during the release process we ran into a number of issues which caused the release to take longer than expected.
While we are happy we were able to get a release out the same day we were notified of the issue, in the modern security environment we feel that we should be able to provide releases in a more compressed timeline. The issues we ran into caused our release process to take just under four and a quarter hours from start to finish.
These issues had previously not been problematic, since the typical release process is split up over a number of days.
We’ve subsequently made a number of changes to improve our release efficiency, which should significantly reduce the time it takes us to push out a release, enhancing our ability to quickly respond to urgent security threats.
PRIVATE track security fixes are pre-announced three to seven days before their release. URGENT track fixes happen on a shorter time schedule, but we could have pre-announced the upcoming release when we began the release process, giving users at least a few hours to prepare.
While on Windows and macOS we rely on the revocation mechanisms the platform APIs provide, on Linux we don’t currently have a similar mechanism. The lack of this support was one of our major drivers to issue an expedited security release, as we did not want to leave Linux users exposed to this issue longer than was necessary.
Hence we are planning on prioritizing work to bring parity to revocation support on Linux, to help mitigate this class of issues in the future. Part of this work will involve investigating adding support for the
upki
project, which aims to “provide reliable, privacy-preserving and efficient certificate revocation” for Linux (see
issue #82402
).
Upgrading and Verifying Your Deployments
If you run Go binaries which interact with network services using TLS (such as directly via
net/http
or
crypto/tls
or via a dependency such as gRPC), ensure you are running on the latest minor releases. Binaries rebuilt with Go 1.27.3 and 1.26.10 will automatically reject certificates issued by the compromised eMudhra intermediates.
You can verify your current toolchain version using
go version
and you can check the version of Go a binary was built with using
go version -m <path_to_your_binary>
.
The
govulncheck tool
can also be used to determine if a binary is affected by this issue:
$ GOTOOLCHAIN=go1.27.3+auto go install golang.org/x/vuln/cmd/govulncheck@latest
$ govulncheck -mode=binary <path_to_your_binary>
Securing Go Deployments Everywhere
For us, securing Go and its users extends beyond fixing direct security vulnerabilities in the runtime and libraries we ship. In order to keep the ecosystem secure, we believe we also need to provide users with the right tools to write secure software, look towards the future of cryptographic algorithms and protocols, and proactively respond to ecosystem wide issues when we can.
We are grateful to the independent security researchers and the Mozilla security team for this rapid notification and coordination during this incident.
The NYT Seemingly Does Marissa Mayer Dirty
Daring Fireball
www.nytimes.com
2026-10-26 20:30:08
Alexandra Alter, in the lede for her profile of Marissa Mayer’s new AI startup Dazzle for The New York Times (gift link):
Late last year, Marissa Mayer was struggling with what felt like
an impossible task.
Her daughter Marielle was turning 10, and Marielle’s teacher
wanted three bullet points ...
Abdul El-Sayed, the Democratic
US Senate
candidate, starts this day on the campaign trail in Escanaba, Michigan, where nearby Wisconsin dairy country spills into dense forests and the sandy shores of Green Bay.
This is the upper peninsula – the “UP” – a rural slash of land north of Michigan’s mitt. Electorally, it’s crimson. Donald Trump won some districts near Escanaba by more than 41%. But at the county fairgrounds, past sheds labeled “Beef” and “Swine”, hundreds of locals on the political left have gathered in the hangar-size 4H Club meeting hall to hear El-Sayed speak.
“We built this campaign on three simple things. Y’all remember what they are?” El-Sayed stokes the audience, leading them to a call-and-response.
“Money out of … ”
“Politics!”
“Money in your … ”
“Pocket!”
“Medicare for … ”
“All!”
As Americans prepare for historic cuts enacted in the Republican-led “One Big Beautiful Bill Act”, which is expected to push
17 million people
from their health insurance plans, El-Sayed appears to have caught a rising tide of interest in Medicare for All.
This election season, Troy Jackson, the Democratic US Senate candidate from Maine, who’s in a dead heat with Republican Susan Collins, said Medicare for All would be “
great coverage
”. Angie Nixon, Florida’s Democratic US Senate candidate, has made it a part of her “
working families guarantee
”. Chris Van Hollen, current US senator for Maryland, added Medicare for All to his platform
last December
after “listening to his constituents”.
El-Sayed’s supporting act in this series of stops is influential Democratic congresswoman Alexandria Ocasio-Cortez, a longtime Medicare for All proponent and the subject of whispers about a 2028 presidential run. And, according to an
October poll
by the health policy thinktank the Kaiser Family Foundation, two-thirds of Americans support the idea.
Technically, Medicare for All is an insurance reform. Proposals currently before Congress would make the federal government into the nation’s health insurer, a “single-payer” system more closely aligned with health systems in peer-developed democracies, such as Canada.
Sounds simple. However, in the US, one in every five dollars goes to healthcare. The existing health insurance patchwork fuels profits of world-leading, resource-unlimited
corporations
and powerful local monopolies. Democrats also worry that replacing private insurance, as Medicare for All advocates call for, would provide fodder for Republicans, who have made stoking popular resentment against government into an electoral strategy.
Those enormous barriers have repeatedly relegated Medicare for All to the political hinterlands. Centrist
Democrats
worry that, in a nation where me-but-not-thee politics has reigned for many years, Medicare for All is nothing more than a decades-old tried-and-failed idea.
Then again, in a nation where healthcare prices are the
highest in the world
and
climbing
, when
even the insured
find themselves in medical debt, and where the broad-daylight assassination of an insurance executive
elicits catharsis
and not mourning – the yearning for change is personal and visceral.
“Not enough doctors, not enough healthcare,” says El-Sayed, who ran both the Detroit and Wayne county health departments, and
received a medical degree
from Columbia University.
A shout from the crowd: “Not enough psychiatrists!”
“Not enough mental healthcare,” El-Sayed answers, tossing out a campaign slogan: “It shouldn’t be this hard.”
Later, a shout from the same corner: “What about our teeth!”
E
l-Sayed’s campaign comes as the Trump administration enacts the largest federal healthcare cut in the nation’s history – extracting $1tn from the system primarily by through severe cuts to Medicaid, the federal-state health insurance program for low-income and disabled people. Medicaid cuts are expected to close hospitals, particularly those in
rural outposts
like Escanaba, and the
urban core
.
At the same time, some of the most popular health policies of recent years – such as reining in
medical debt collections
– spring directly from the policy work of Medicare for All advocates. Add to this a counterintuitive reality: almost half of all healthcare today is already paid for by federal, state or local government, according to the federal
Centers for Medicare and Medicaid Services
.
“I’ve been at this for a while, and we have dips and peaks in the single-payer movement,” said Dr Stephanie Woolhandler, a professor of public health at the City University of New York, and a decades-long advocate for Medicare for All. Support “always comes back”, she said.
“And the reason it always comes back is because the healthcare system has not been fixed – and it may not be fixable at all without single-payer,” said Woolhandler.
To understand this system, and Republican enmity toward it, it pays to go back a century when the idea of tying health insurance to employment was born of entrepreneurial innovation and historical accident. In 1929, Baylor University hospital offered insurance to cover hospital bills for $6 per year to a group of 1,500 schoolteachers in Dallas. The idea caught on across the country and Blue Cross came to life.
This arrangement was institutionalized during the second world war. Amid government price controls, health insurance was one of the few ways businesses could compete for workers. The federal government made the benefit tax-exempt, as it still is today, according to the
foremost history
on the subject by author Paul Starr.
Since then, Democrats have pushed for reform and expansion – with their failures to reach universal coverage shaping the contours of the patchwork system that exists today.
In 1965, Democrat Lyndon Johnson passed Medicare, for people older than 65, and its sister program Medicaid, together providing insurance for
more than a third
of Americans today. While the reform was a momentous triumph over segregationist opposition – Medicare desegregated hospitals – it came up short against its architects’ vision.
“We expected Medicare to be a first step toward universal national health insurance,” said Robert Ball, a top official in the Kennedy and Johnson administrations, according to an article in
Health Affairs
.
It also created important knock-on effects: it pushed the hospital industry to commercialize in the 1980s, according to Dr Luke Messac, an emergency room doctor at Mass General Brigham, and author of Your Money or Your Life, a history of medical debt. Hospitals, the majority of which are non-profit in the US, argued they could drop the explicit charitable missions many were founded with because Medicare paid patients’ bills
.
As a result, the hospital industry pushed the IRS to loosen its definition of community benefit, at the same time keeping
their nonprofit status and scaling up billing.
This yielded “a lot of middlemen in our system that do not provide a benefit to the public”, said Messac. “One of the things Medicare for All is intended to do is take some of the power back from those actors.”
“That poses a huge threat, so the fact that there would be opposition is like the most predictable thing in the world,” he adds. “It doesn’t mean it’s a bad idea – it may mean it’s a good idea.”
S
ince Johnson’s Medicare bill, the only law to rival it in scope is the Affordable Care Act (ACA), passed in 2010. Better known as Obamacare, a version of the market-based reform was first proposed
by scholars
at the conservative Heritage Foundation. Democrats sought to reach across the aisle; to do so, they developed a bill to subsidize insurance for individuals. But that plan for bipartisan support didn’t work out.
Obamacare was passed on a party-line vote – one of the first signposts of the new era of polarization. Republicans incessantly targeted it for more than a decade. Today, it is etched it into the minds of conservative voters as the source of all that ills healthcare.
Just ask the pro-Trump protesters outside El-Sayed’s rally in Escanaba.
“We should almost go back to square one and start analyzing what caused this,” says Bonnie, a 70-year-old Republican in Delta county, who declines to give her last name. “When the socialistic ideas started coming in, like Obamacare, that’s what threw everything in a tailspin.”
“I want everything privatized,” says Lisa Pieczyski, a woman in her 60s from near Escanaba, who carries a homemade anti-green-energy sign. “We’ve mandated too many things under insurance that have made the premiums outrageous.” She adds that she can’t trust the government because “Obamacare did all this”.
“I’m middle class, I’ve always been middle class, and what I have done to ensure I have medical insurance is give up something else like a fucking Cadillac and pay for it, all right? OK?” said Delta county’s Republican spokesperson, Michael Glass, 77, who gets insurance through a privatized version of Medicare called Medicare Advantage.
“It is the individual who should take responsibility for their own healthcare, period.”
A
s El-Sayed stumps through the UP, his supporters repeat a set of ideas they believe run parallel to Medicare for All: kindness, respect and shared responsibility. In Iron Mountain, he greets an overflow crowd at the local ski lodge – one of the few public meeting places in this rural town. One “lifelong Democrat” says there hasn’t been this much excitement since Bernie Sanders came to town a few years back.
After El-Sayed’s speech – his condemnations of US support for Israel’s war in Gaza, his calls for cheaper gas, groceries and healthcare, criticisms of Islamophobia – a woman asks about how to bring people around to Medicare for All.
“I was a registered nurse for 40 years,” she says. “Can you make a video or some kind of something explaining – some easy way for people to understand how great and easy it’s going to be?” El-Sayed answers – but it’s Ocasio-Cortez that captures the room.
“Raise your hand if you have waited or delayed getting a treatment or seeing a doctor because you felt you couldn’t afford it,” says Ocasio-Cortez.
Every single person raises a hand.
“Right now, we are waiting weeks, months, years – to wait until we can afford to see a doctor one day. Healthcare has become a luxury,” says Ocasio-Cortez. “Medicare exists – we provide a healthcare system for every American above the age of 65.”
Finally, she adds: “There is this idea that I don’t want to pay for someone else’s thing. First of all, does that mean you don’t want someone else to pay for your care? Does that mean we shouldn’t have Medicare today? Because I’m a young person and I gladly pay, because I want to live in a society where seniors” – then, she is drowned out by the cheers of people excited to share the cost.
At the end of the one-day, 131-mile trail, El-Sayed is in the gymnasium of Northern Michigan University with enormous pictures of athletes looking out at the audience. A physician assistant who is running for state representative opens the rally and – all of a sudden – public health is on the offense.
“All it took was the closure of my little Planned Parenthood clinic about 18 months ago,” says Anna Aho Rink, a Democratic candidate for Michigan’s 109th US House district, “and me being completely fed up with the system that is not working well for any of us to get me up here today and running for office.”
The rally is at a college, but students are a minority in the audience; there are elderly residents and middle-aged parents with children in tow on a school night.
“You don’t need a medical degree to recognize the symptoms of a broken economy,” says Ocasio-Cortez as she warms up the crowd. “Michigan, corruption is making this country sick.”
El-Sayed ticks off his public health victories: he got 16,000 kids free reading glasses; used vending machines to distribute Narcan, the overdose reversal medication; tested daycares and preschools for lead in the water, and then remediated dozens.
“You deserve to have a long, healthy life in the United States of America,” El-Sayed calls.
For many, this politics is in perfect relief to the worldview of the Trump administration – one where there is not enough to go around, where someone needs to lose, the government must be gutted, loyalty ranks much higher than fact.
The Guardian
is globally renowned for its coverage of politics, the environment, science, social justice, sport and culture. Scroll less and understand more about the subjects you care about with the Guardian's
brilliant email newsletters
, free to your inbox.
Are you tired of your screenshares looking like this?
BROWSER SCREENSHARE
OBS
Don't you think they should look like this instead?
You need WHIP.
Did you know OBS or FFmpeg can go directly into a video conference? You configure everything,
so you control exactly the quality you are going to get. WHIP support means these tools
now speak the protocol of video conferencing.
Help! My video conferencing provider doesn't support WHIP. What can I do?
Send them an angry email. Tell them you don't want their crappy
proprietary client. You want open standards that let you bring the tools
you prefer.
FAQ
What is WHIP?
WHIP
is an open standard for sending live video to a service using WebRTC.
Your provider gives you a server URL and a stream key, called a bearer token. Before to join a conference
call each client had to run custom code. That means FFmpeg/OBS would never be able to join.
Why is my screenshare blurry?
A lack of control. Your browser is picking a bitrate, codec or resolution that doesn't match what you need.
How are OBS and FFmpeg different from browser screensharing?
OBS and FFmpeg let you choose your resolution, frame rate, bitrate, and codec.
You can tune those settings for the content you're sharing and the hardware and connection you have.
What about OBS Virtual Camera?
OBS Virtual Camera sends your OBS scene to the conferencing app as a webcam.
You can pick the layout of your stream, but the conferencing app still handles encoding.
I
work on WHIP in OBS. I'm tired of shitty screenshares when it is easily fixed.
‘Digital hostile environment’: AI secretly being embedded across Home Office, report claims
Guardian
www.theguardian.com
2026-10-26 20:01:02
Tasks from determining asylum seekers’ ages to border surveillance now involve AI, says Open Rights Group AI has been embedded across the Home Office in near-total secrecy, reinforcing the so-called hostile environment for immigration, according to research. Tasks from the detection of potential sh...
AI has been embedded across the
Home Office
in near-total secrecy, reinforcing the so-called hostile environment for immigration, according to research.
Tasks from the detection of potential sham marriages to determining the age of asylum seekers and checking through the contents of phones of new arrivals now involve use of the technology, according to a report by Open Rights Group (ORG).
It is also being used to conduct surveillance of borders, through live facial recognition and AI-powered drones and satellites; to summarise asylum interviews and country policy information used as evidence in those interviews; and to prioritise and assess cases through the opaque Identify and Prioritise Immigration Cases (Ipic) tool.
Information for the report has been gathered from a mix of limited information published by the Home Office, freedom of information requests and questions from MPs. The report has cross-party support from Labour’s Bell Ribeiro-Addy, the Scottish National party’s Pete Wishart and the Green party’s Siân Berry.
The report, titled Automated Discrimination: Unpacking the Digital Hostile Environment, raises concerns about the use of AI in immigration, saying it is not neutral or accurate and can replicate bias and discrimination within society, particularly when a key driver for its use is anti-immigration policies and rhetoric.
It says AI is being trialled and tested in near-total secrecy, with officials routinely invoking national security to stonewall freedom of information requests and redact disclosures. Successive governments are criticised for pushing an ideology that reduces complex human cases to a technical problem that can be fixed.
The report raises concerns about “reducing people to data points” and replicating the
hostile environment first envisaged by Theresa May
as home secretary in 2012. “Relying on AI to decide who gets to stay here and who gets thrown back into danger is a deeply alarming move,” it states.
Open Rights Group is calling on the government to regulate AI and ban uses that are undemocratic and risk human rights violations, such as the use of ChatGPT tools in asylum applications.
It also wants more transparency and stronger freedom of information laws, a narrower definition of national security and a robust public register of government AI tools.
Ribeiro-Addy said: “In spite of questions and requests, the Home Office has been reluctant to publish the documents that would explain how AI is used in asylum processing, what the problems are and how they are being addressed. The department has not explained how it will ensure there is accountability when they fail or justified why some of the most vulnerable people, with the least power, should bear the greatest risks.”
Sara Alsherif, a programme manager at Open Rights Group, said: “Migration is a human phenomenon and experience, not a technical problem that can be fixed by artificial intelligence. We urgently need transparency, accountability and strict regulation to restrict how AI is used and to prevent its wider rollout.”
A Home Office spokesperson said: “Use of artificial intelligence is just one of the tools at our disposal to protect our borders and does not replace or automate the role of human decision-makers.
“Asylum decisions are made by trained caseworkers, with AI tools used only to assist in navigating interview records and policy information. They cannot be used in isolation and do not make decisions on claims.
“We regularly monitor the performance of these tools alongside our established quality-assurance processes and have already committed to publishing updated evaluations on their rollout.”
Apple Issues Statement on iPhone Duo’s Crack Problem
Daring Fireball
9to5mac.com
2026-10-26 19:54:26
Chance Miller, 9to5Mac:
Here is Apple’s full statement:
The response to iPhone Duo from early users has been incredibly
positive, and we are seeing exciting things from developers who
are rapidly updating their apps to take advantage of its unique
form factor. We are aware of an issue impact...
Over the weekend, a handful of
iPhone Duo users reported
that their inner display had cracked along the hinge. In a statement to
9to5Mac
, Apple said it is “aware of an issue impacting the inner display on a small number of iPhone Duo units,” and that affected users can contact AppleCare for a replacement.
Here is Apple’s full statement:
“The response to iPhone Duo from early users has been incredibly positive, and we are seeing exciting things from developers who are rapidly updating their apps to take advantage of its unique form factor. We are aware of an issue impacting the inner display on a small number of iPhone Duo units. If users experience issues with their iPhone Duo display, they should contact AppleCare for a replacement.”
The company says the problem affects a very small number of iPhone Duo units and appears to surface relatively quickly. Most iPhone Duo units are not affected. You do not need AppleCare+ to have your iPhone Duo replaced for this problem. If you bought from a carrier, you should contact AppleCare directly, not your carrier, to get your device replaced.
Reports of the problem
surfaced on Reddit
and other forums over the weekend. Affected users report that the inner screens cracked along the center line of the hinge. While a number of user reports on Reddit showing the issue are legitimate, there have been a
handful of fake AI-generated reports as well
.
The folks at iFixit
have pointed
to a few potential causes of the problems, with certain components potentially putting excessive pressure on the display.
FTC: We use income earning auto affiliate links.
More.
GPT-6.1 Terra
Simon Willison
simonwillison.net
2026-10-26 19:53:07
GPT-6.1 Terra
It's always interesting to note which aspects of a new model are emphasized in the release announcement.
In the case of GPT-6.1 Terra, OpenAI went with visual reasoning and computer use:
We’re introducing GPT-6.1 Terra, a fast, efficient model that combines detailed visual reasoning a...
GPT-6.1 Terra
(
via
) It's always interesting to note which aspects of a new model are emphasized in the release announcement.
In the case of GPT-6.1 Terra, OpenAI went with visual reasoning and computer use:
We’re introducing
GPT-6.1 Terra
, a fast, efficient model that combines detailed visual reasoning and precise computer use alongside clearer, more natural writing. A significant step up from GPT‑5.6 Terra, it excels at the communication and computer-based tasks that fill the workday, from drafting proposals and interpreting technical drawings to filling out forms and editing videos.
Terra sits in the same position as Sonnet in the Anthropic model collection - not the cheapest or the most expensive, making it harder to decide when to use it.
Computer use is a good example of a task that benefits from a less expensive model, since you might put it to work on automated, repetitive tasks.
OpenAI's Ted Sanders provided some useful advice in
a comment
on Hacker News:
In the case of GPT-6.1 Terra, I'd say Terra is probably better than Astra and Sol at technical communication, similar on vision and computer use (but much faster!), and a bit worse on most other things. For API developers, it's a nice midrange option if you want something cheaper than Sol but a lot smarter than Luna (especially for vision / computer use / communication). For subscribers, it's not a bombshell release - if you're hitting usage limits, maybe it helps you go a bit further, and if you want clearer communication or faster computer use, it can be a nice option to select.
Here's
a new comparison grid
showing pelicans for every reasoning level of OpenAI's current frontier lineup: GPT-6 Astra, GPT-6.1 Sol, GPT-6.1 Terra, and GPT-6 Luna.
GPT-6.1 Terra is priced at $1/million input tokens and $5/million output - almost half the price of GPT-5.6 Terra and GPT-6.1 Sol, and around 10x the price of GPT-6 Luna.
Today I got a strange email that turned into an unsettling phishing experiences.
// If you’re just here to read about how bad passkeys are, skip to
part 4
It Started With a YouTube Support Ticket
I thought someone from Russia created a support ticket with YouTube to take over my gmail account and I needed to click on their link to reject the support ticket. Oops.
The Google Login Page Looked
almost
Legit
But I was already logged into Google in another browser tab. So why was Google asking me to log in again?
I even noticed
sites.google.com
login page, but proceeded anyway thinking that this was just a weird auth flow for a support website (its common for companies to require you to login separately to a support ticket website from your main account)
I copied over Google credentials from my password manager. Then it asked for my two-factor authentication code.
I copied and pasted the correct code. It failed.
I tried again.
Failed again.
Then the Apple Passkey Prompt
I really wish I took screenshots of their phishing page for science, but after I reported the phishing page to Google, either the attackers or Google took down the page.
After the two-factor authentication attempts failed, the site switched authentication methods.
It presented what looked like an Apple passkey interface, rendered directly inside the browser window.
What the hell?
I don’t use Apple Passkeys. This isn’t how my passkey authentication normally works.
So I hit cancel to step away from this Apple passkey interface.
They Knew I Used Bitwarden and were ready
After I dismissed the passkey prompt, another modal appeared that looked like the Bitwarden login screen, asking me to add a passkey to the account.
I use a forked copy of Bitwarden that’s been rebranded as
Saigon Safe
, not the Bitwarden branded extension!
Plug:
Saigon Safe
removes ads, adds advanced security measures, and dramatic improvements to the UX. Click the article link to see what Saigon Safe actually looks like.
So the login screen they presented didn’t actually match my password manager, but through the browser extension detection API, attackers new exactly which password managers they should fake. How kind of web browsers to give phishers exactly the right tools to use.
Now they were going for my throat: 650+ passwords ‘securely’ stored in my password manager.
Then Google Emailed Me: A New Passkey Was Added
Oh, no. Attackers installed hooks for them to come back in later.
The Device I Didn’t Recognize
Someone had gained access to my account, and the attackers were either smart enough to use a proxy location near me or were physically near me… Scary.
My Security Posture: Why This Could Have Been Much Worse
Because while I absolutely fell for part of this phishing attempt, I had also intentionally set things up to limit the damage if something like this ever happened.
1. I Don’t Keep 16 Years of Email Sitting in Gmail
I intentionally keep only about five years of email in Gmail.
Anything older gets backed up offline, encrypted, and stored on infrastructure I control. There’s almost no reason for that much historical information to remain continuously available online.
2. My Most Sensitive Accounts Use Separate
secret
Email Addresses
For things like banking applications, password managers, and other critical services, I typically use dedicated, nonpublic custom-domain email addresses.
That way, even if someone compromises my primary Gmail account, they don’t automatically get a convenient list of my most sensitive accounts or their login identifiers or ability to trigger password recovery to access them.
3. Thinking like a Hacker
One thing that still puzzles me about this attack is how sophisticated the phishing tools were compared to how little the attacker seemed to actually did once they got into my account.
From what I gathered, they:
Permanently deleted original phishing email
Reviewed 2 Google Sheet documents in my drive
Maybe there is something else they did that I don’t know about though.
They had clearly invested in a convincing phishing setup, but there didn’t seem to be an obvious plan for exploiting the account immediately. Perhaps they used a pre-purchased phishing kit, but were sophisticated enough to quickly do something meaningful with the access.
Theory 1: They were collecting compromised accounts to sell later.
Maybe the goal wasn’t to attack me directly. Maybe it was to collect as many compromised Google accounts as possible, register passkeys, and sell access to other criminals.
Those buyers could then use the accounts for targeted phishing, stealing sensitive documents, spreading malware, or even ransomware attacks.
Theory 2: They planned to come back and exploit the account themselves.
I doubt the attacker designed the system so they had to sit at the computer waiting for people to fall for that email. These campaigns are probably sent to many people, and the initial compromise may be largely automated.
But something interesting happened in my case. Potentially because I opened the email shortly after I received the email, potentially the attacker was around to do some manual clicking.
My Google Drive access history shows what they looked at: Financial and Crypto-related documents. Fortunately, while this is private information, its not something they can use to steal money from me.
This suggests there was at least some active exploration of my account.
But there was no evidence of them adding a forwarding address, permanent distructive deleting the drive folder or emails, sending out emails to my contacts list, etc.
4. The Passkey Was Actually the Scariest Part
With the recent Hacker News debates about whether
passkeys are a trap
, I think my experience highlights another risk that deserves more attention.
Passkeys can replace both your password and your second authentication step.
They’re designed to be phishing-resistant, which is great. But what happens when an attacker manages to register
their own passkey on your account
?
Once that passkey becomes usable, they may be able to sign in without your password or a fresh 2FA challenge. I verified with a fresh Google account in a private window (but same device and IP address) that Google did not prompt 2fa (either confirm on another device or TOTP or SMS).
Fortunately, Google sent me an email and push notification about a new passkey being added.
Without Google’s new passkey email and push, I might have changed my password, assumed my account was secure, and completely missed the attacker’s new way back in.
Passkey registerations remind me of the GDPR regulation for exporting your account data created unintended consequences of giving an attacker controls to quickly steal EVERYTHING before you have time to file a support ticket to kick them out.
Passkey UX currently sucks… Attackers exploited the current flow of: “Thanks for logging in via a normal method, lets add a passkey to your account.”
Passkeys give phishers a backdoor into your system, without needing the regular 2fa verification methods!
I wish there was a way to block passkey use on my account, until the technology matures a bit.
I reported to Google the phishing site. Either the attacker or Google has already taken down the site.
Meta plans $95bn stock offering to help cover AI expansion
Guardian
www.theguardian.com
2026-10-26 19:33:19
Tech firm announces two-part fundraising after Elon Musk warns hundreds of AI startups face collapse Mark Zuckerberg’s Meta has announced plans for $95bn (£71bn) of fundraising to cover its AI expenditure, even as Elon Musk warned that funding for smaller players in the sector was drying up. The own...
Mark Zuckerberg’s Meta has announced plans for $95bn (£71bn) of fundraising to cover its AI expenditure, even as Elon Musk warned that funding for smaller players in the sector was drying up.
The owner of Facebook, Instagram and WhatsApp is a leading investor in AI and is ploughing multibillion-dollar sums into datacentres, the central nervous systems of the technology.
Meta’s announcement on Monday came after Musk added to the pressure on “neocloud” datacentre providers –
which lease computing power to AI companies
– by saying the sector faced “death and consolidation” amid concerns over the sustainability of their funding.
The
Meta
fundraising will come in two parts. In the first, the company plans to raise $35bn through new “underwritten public offerings” – a sale of company stock. This has some big-name backers, with chipmakers Nvidia, AMD and Broadcom all showing interest, Meta said. These “cornerstone investors” could buy up to $5bn of the stock on offer.
In the second
,
Meta also plans to launch a $60bn “at-the-market offering” to sell new common stock to investors at the going market rate in future. That offering involves selling Meta’s new class C stock, which it announced it was creating last week. These class C shares do not have voting rights, so can be sold without diluting Zuckerberg’s control of the company.
The Silicon Valley company said these plans would support “Meta’s continued investment in AI infrastructure and personal superintelligence”.
Meta’s announcement came as other companies in the AI sector came under fire from Musk on Monday.
The tech entrepreneur said more than 200 neocloud firms were in trouble, which led to shares in Nebius, CoreWeave and Iren dropping in premarket trading on Monday. However, Iren and CoreWeave stock later recovered their losses, with Nebius closing more than 3% down.
“As of the past few weeks, debt markets have almost entirely shut off access to money for any company that doesn’t have substantial revenue independent of AI data centers,” the world’s richest person wrote in a post on X on Sunday.
Drawing an analogy with the survival prospects of the guppy fish – which has a reputation for struggling to thrive in domestic fish tanks – Musk added: “That means the 200+ neoclouds are going to see guppy-level death and consolidation. Some will make it through, but not many.”
The chief executive and largest shareholder of Tesla and SpaceX – which also owns and operates datacentres – was responding to a post by the venture capitalist Chamath Palihapitiya, who had written on the Musk-owned platform that neoclouds were “disorganized and poorly capitalized”.
Fears over the financial stability of neocloud businesses are focused on their high levels of borrowing – approximately $35bn at CoreWeave, for example – and whether the AI market will grow fast enough to service it.
Neil Wilson, an analyst at the investment platform Saxo UK, said Musk’s comments “underscore the fears that there is just way too much debt” in the AI sector.
“Meta’s not going to struggle to service debts and can lean on equity raises to minimise debt, too. This is kind of exactly the point Musk made about SpaceX having all its earnings and is investment grade, which the neoclouds don’t have,” he said.
SpaceX reported on Monday that it had entered a $40bn deal with Apollo Global Management to lease chips to power AI datacentres.
CoreWeave’s chief executive, Michael Intrator, reportedly sent an internal memo to employees this month saying that some investors had not understood the $30bn company. The firm’s stock has declined in value by more than a third over the past month.
“When you are building a new type of technology company, there will be periods of time when the market misunderstands and acts irrationally,” he wrote, according to Bloomberg.
MEU - a M3U file editor
Lobsters
github.com
2026-10-26 19:14:56
I released the tool I use to organize my music playlists (I still buy CDs and rip them).
Very basic, no frills, it just creates, edit and exports file lists to .m3u files.
My use case is maintaining playlists playable in a car audio, where paths must be relative to the playlist file.
On playlist exp...
M3U Editor Utility
: a simple Qt application to create and edit
.m3u
playlists.
"Meu" means "mine" in Calabrian dialect, and it's how M3U reads with the 3 as an E.
Features
Add audio files with a file dialog or by dragging files and directories onto the window
(directories are scanned recursively)
Sort the playlist by path (subdirectories first) or by file name
(case insensitive, natural order:
2
before
10
)
Remove one or more songs, duplicates are ignored
Open an existing
.m3u
/
.m3u8
playlist: missing files are shown in red with a warning icon
Merge playlists by adding a playlist file to the open one
Open files from the command line or with "Open with" in the file manager:
a single playlist is opened, more files are merged into a new playlist
Save with paths relative to the playlist directory, missing files are not written
Warns about unsaved changes
English and Italian user interface, chosen from the system locale
Building
Requirements: CMake 3.16 or later, a C++17 compiler and Qt 6 (Widgets, Test).
Qt Linguist tools are optional: without them the translations are not built
and the interface is English only.
To install it with its icon and menu entry, for example in your home directory:
cmake --install build --prefix ~/.local
Translations
User interface strings are written in English in the sources. The Italian
translation is in
translations/meu_it.ts
, while
translations/meu_en.ts
only holds the English plural forms.
After changing strings in the sources, refresh the
.ts
files with:
cmake --build build --target update_translations
then edit them with Qt Linguist or by hand.
Playlist format
Playlists are plain
.m3u
files: an
#EXTM3U
header, then one path per line.
When reading, empty lines and lines starting with
#
(like
#EXTM3U
and
#EXTINF
)
are ignored, and
file://
URLs are accepted.
When saving, paths are written relative to the directory of the playlist:
it's up to the user to keep the files reachable from there.
License
Copyright (C) 2026 Matteo Croce
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by the Free Software
Foundation, either version 3 of the License, or (at your option) any later version.
See
LICENSE
for the full text.
I
bet when you woke up this morning, even before you opened your eyes, you knew where all of your limbs were. You didn’t have to look at, or try moving them, to feel their presence. This is because you have the power of proprioception (it’s also sometimes called “kinesthesis”). Because it’s a sense, just like hearing and seeing, you can have mental imagery specific to it. That’s what motor imagery is—just as visual imagery
uses the same brain areas
as visual perception, motor imagery tends to use the same brain areas responsible for moving your body. Imagine putting your hands together in front of you. Now imagine straightening your legs out, then spreading them. Although you might have a visual image accompanying this motor imagery, they’re not the same, and they don’t necessarily come packaged together.
With his 1855 treatise
The Sense and the Intellect
, Alexander Bain was the first scientist to suppose that the body responds to visual imagery similarly to how it responds to the things we actually see. But the idea did not enjoy further scientific attention until 1931, when
Edmund Jacobson
studied mental imagery and related them to subtle muscle movements. More recent studies, using modern brain imaging techniques, show that what distinguishes actual and imagined movements are the inhibitory signals sent from other parts of the brain to the motor system. That is, actual and imagined movements involve the same brain activity, but in the case of imagination, there’s another part of your brain that
stops the message
from reaching your muscles.
Because so many of the same neural and bodily areas are activated during motor imagery as actual movement, it stands to reason that mental practice can complement physical practice. This is indeed what experiments show. As a
Frontiers in Human
Neuroscience
paper
, published in June, put it: “There is now compelling evidence that motor imagery promotes motor learning.” When you imagine exercising, your breath and heart rate actually
increase
. Mental practice is one of the
few effective performance enhancing activities
. For example, doctors who mentally practice before engaging in a virtual-reality surgery
outperform
those who do not. One
study
, by Rutgers psychologist Robert Woolfolk, and colleagues, had people simply imagine putting a golf ball into the hole before they took their shot. The people who imagined making it had 30.4 percent more successful putts than those who did not.
Imagination is a form of self-deceit—a good portion of your brain reacts to your motor activity in the same way, whether the muscles are moving or not.
As you might imagine, mental practice is most beneficial for those activities with
a strong mental component
, like golf and basketball, for example, as opposed to, say, weightlifting. But that’s not to say that imagination does not help in simpler tasks—perhaps the most shocking finding regarding this comes from exercise scientist Guang Yue, who showed that imagination can even be used to increase muscle strength! He
found
that pinkie strength, in particular, could be increased by 22 percent just by imagine-exercising its abductor muscles at the metacarpophalangeal joint, the knuckle between the hand and the finger; that’s almost as much as actually exercising them, which increased finger strength by 30 percent.
So could you more or less “get by” by spending all your time imagining exercise from the comfort of your sofa? No. It turns out that
20 minutes
is the optimal amount of time for a mental practice session, according to a meta-analysis of many physical activities. Any less or more and the practice doesn’t stick as well—mental practice is a supplement, not an alternative. Exactly why is unclear, but it might have to do with the lack of feedback from the real world, or because people find it hard to concentrate for much longer than 20 minutes.
This may be because imagination is a form of self-deceit—a good portion of your brain reacts to your motor activity in the same way, whether the muscles are moving or not. That might seem alarming, but there is a bright side: By just using our imagination, we can improve ourselves for real.
Jim Davies
is an associate professor at the Institute of Cognitive Science at Carleton University in Ottawa, and author of
Riveted: The Science of Why Jokes Make Us Laugh, Movies Make Us Cry, and Religion Makes Us Feel One with the Universe.
His sister is novelist
JD Spero
.
Hate State – Discrimination on Colorado’s Ballot w/Ann Marie Awad
OrganizingUp
convergencemag.com
2026-10-26 19:00:00
In 1992, the state of Colorado let voters decide to whether to discriminate against LGBTQ individuals by proposing Amendment 2, a law that would prohibit the state from enforcing anti-discrimination protections on the basis of sexual orientation. Voters passed it and earned Colorado the moniker "hat...
On September 8, 2026, we were alerted by a security researcher, Gadi Evron from Knostic, to a tenant isolation issue affecting the GLM-5.3 Workers AI model (
@cf/zai-org/glm-5.3
) starting on August 27, 2026. We have remediated the issue, and we restored the model on September 9. We have confirmed that no other model hosted on Workers AI was affected.
Between August 27 and September 9, a small number of customers using the GLM 5.3 Workers AI model received responses that contained data from other customers' requests made to the same model shortly before theirs. In total, 155 responses were affected, all to prompts longer than 681,280 tokens.
After excluding our own testing and the researcher's, the requests we identified are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug. We found no evidence of deliberate exploitation.
Today we are publishing this report alongside a post from SGLang, the open-source inference engine that we use, as a coordinated disclosure. This post describes the bug that caused this issue, our response timeline, and the subsequent hardening we have conducted on our production SGLang deployments. We also detail our continued efforts with the upstream maintainers of SGLang to address this and similar bugs.
What happened
GLM is a text generation model from
Z.ai
that is built for agentic coding workflows; it is one of the many
models
available through Workers AI. Gadi Evron submitted a report on September 8 through our HackerOne program stating that very long prompts sent to
@cf/zai-org/glm-5.3
on Workers AI sometimes returned text that belonged to other users' sessions. Cloudflare reproduced the issue the next morning and took the model offline within 40 minutes of declaring an incident. We then deployed a corrected configuration and a patched inference engine, and restored service the same day.
This specific report of cross-request KV cache exposure was the result of two overlapping issues. The first was a misconfiguration of the open-source inference engine, SGLang, used by Cloudflare. We deployed GLM 5.3 with a 1,048,576-token context window, but the KV cache pool on our prefill GPUs only had room for 681,280 tokens. We were aware of this mismatch before launch. We expected the engine to return an error for any prompt it could not process, and our long-context tests returned successful responses, so we did not believe this to be an issue.
The second was a bug in how SGLang handled the resulting over-length requests in disaggregated prefill/decode mode. A prompt that did not fit the pool was internally marked as rejected and replaced with a one-token placeholder, but instead of aborting the request and returning a client error, prefill generated the KV cache for the placeholder prompt and transferred it to the decode node. The decode node received a "transfer complete" message and assumed that prefill overwrote the KV cache from previous requests with the full prompt for this request, when in fact it left the majority of the previous state intact. The decode node subsequently generated a response while attending over stale cache pages that still held data from earlier requests. As a result, responses to prompts longer than 681,280 tokens could contain data from other users' GLM 5.3 sessions.
Immediate remediation
After
disabling the model
, we took the following actions to correct this vulnerability before restoring public access to it:
To fix our configuration, we made the pool hold the full context.
We adjusted our GLM 5.3 configuration to match our GLM 5.2 configuration, which freed enough GPU memory that the prefill KV pool now holds about 2.04 million tokens, roughly twice the 1,048,576-token context length. A prompt that fits the context window now always fits the pool, so the rejection path is never reached for a valid request. This alone prevents the bug from being exercised.
To fix the engine, we also made the rejection path safe.
Relying on pool size alone is fragile: any change to quantization, tensor parallelism, CUDA graph sizes, or a future model version changes the pool size in a way that's easy to miss. Furthermore, there may be other situations in which the prefill scheduler can reject a request and trigger the same bug. To prevent this, we also patched the engine so that a request carrying a pending rejection is retired at the disaggregation admission queue, with its original error, before any bootstrap, allocation, or KV transfer happens. We proposed this upstream as
#38704
, which also had the decode node verify that the number of tokens transferred matches the number it reserved. The fix was already on SGLang
main
in
#36988
, merged September 6 for a related failure path but not yet released. The maintainers also merged
#38935
, which rejects these requests earlier, following our approach.
We validated both changes against the researcher's reproduction script and our own canary-marker tests before restoring the model.
Background: how we serve GLM 5.3
Workers AI runs GLM 5.3 with SGLang in a disaggregated configuration: a pool of prefill GPUs processes the prompt and produces the model's KV cache for it, then hands that cache over remote direct memory access (RDMA), via
Mooncake
, to a pool of decode GPUs that generate the response. We have written about this architecture before in our posts on
high-performance LLMs
and
smaller, faster, safer models
.
The KV cache in GPU memory is a shared pool of fixed-size pages. Each request is assigned pages when it is admitted and releases them when it finishes. Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it. This approach is common among inference engines and is necessary to achieve the best performance, but it means that the inference engine is responsible for tracking ownership of these memory pages. KV cache page ownership and lifetime tracking has to deal with not just shared ownership within a node (KV cache offload and token generation both access the memory with different lifetimes), but also ownership that is technically shared with the remote prefill node (which holds a simultaneous mutable reference to the page).
Furthermore, the size of this pool is not a configuration value. SGLang sizes it at startup from whatever GPU memory remains after loading the model weights. The model's advertised context length is a separate configuration value. Nothing forces the two to agree, and it is our job to check that they do.
Issue one: misconfiguration
On our GLM 5.3 prefill nodes with our configuration, the pool came to 681,280 tokens while the model's context length is 1,048,576 tokens. The selected KV pool size is printed by SGLang in logs during startup and exposed as a metric. We were aware of this size mismatch; however, during pre-launch testing we observed successful HTTP status codes and a streaming body with no error frames during benchmarking. We assumed that the engine was capable of gracefully handling the difference between the KV cache pool and requested context window via streaming or some other mechanism.
This was one critical gap in our testing: we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence. We now check KV pool size against context length directly, from the running engine, before any disaggregated deployment change ships, rather than inferring it from response codes.
Issue two: SGLang bug
In v0.5.21, the SGLang team has now addressed this bug in how it was handling prompts longer than the KV pool size. Here’s what was happening before.
When a prompt arrived that was longer than the KV pool could hold, SGLang's scheduler rejected it. The rejection path (
Req.set_finish_with_abort
) recorded the error to be returned to the client and swapped the prompt for a one-token placeholder so that the request could drain through the normal batch machinery without allocating real memory. On a single-node deployment this worked: the placeholder ran, the batch finished, and the client received an error.
In disaggregated mode such as we operate, the admission queues on both prefill and decode checked whether a request was
finished
, not whether it was
rejected
. A rejected request reported itself as live. So:
Bootstrap.
The router told the decode node the prompt length (8 pages in the diagram). Decode reserved 8 KV pages for the request.
Prefill admission.
The prefill admission queue admitted any request where
req.finished()
was False. A rejected request stored its rejection in
to_finish
, not
finished_reason
, so
finished()
still returned False. The rejected request was admitted.
Prefill forward pass.
Rejection had already replaced the prompt with a one-token placeholder. Prefill ran a trivial forward pass on that one token.
KV transfer.
Prefill sent one page of KV to decode and signaled that the transfer was complete.
Decode admission.
Decode's admission queue had the same
finished()
check, so it accepted the handoff.
Decode attention.
Decode started generating and attention read all 8 reserved pages. Only page P0 had been written by this request. Pages P1 to P7 still held what earlier requests left in them: other users' prompts and partial generations.
Response.
The client got HTTP 200 instead of HTTP 400.
prompt_tokens
matched the long prompt and the reply was coherent. It arrived faster than an 8-page prefill should take, and it contained content from other users' KV pages.
Every request over the threshold behaved this way. This bug had been reported to SGLang by another user as issue
#30233
on July 6, 2026, which Cloudflare noticed while investigating this incident. We had been flagging these types of issues with SGLang since v0.5.10 and this security incident sped up work that Cloudflare had already started in collaboration with the SGLang team. The patch for this issue was released in SGLang v0.5.20, with follow-ups in v0.5.21 and v0.5.22, and is available for all other operators dependent on SGLang to use. We highly recommend all operators update SGLang dependencies to v0.5.22 or later. For more details on specific PRs, read on below.
GLM 5.3 was the only model affected by this bug. Every other disaggregated deployment on Workers AI has KV pools larger than its context length on both prefill and decode, so no request could reach the rejection path. We have applied the engine fix and the hardening described below to every model we serve with SGLang, and our deployment checks require them for every new deployment.
Timeline
All times UTC.
When
What
Aug 27, 2026
GLM 5.3 launched on Workers AI with a prefill KV pool smaller than its context window. The exposure was present from launch.
Sep 8, 2026 - 23:11
Report received via HackerOne.
Sep 9, 2026 - 08:00
Cloudflare begins verifying the HackerOne report.
Sep 9, 2026 - 13:22
Security incident declared. Product Security reproduced the leak using two independent accounts within 25 minutes.
Sep 9, 2026 - 14:00
After confirming the scope of the issue, GLM 5.3 was set to private. Requests return HTTP 400. Status page updated.
Sep 9, 2026 - 14:35
Root cause identified as the prefill pool being smaller than the context length. Canary prefill node with a larger pool confirmed not susceptible.
Sep 9, 2026 - 14:52
All prefill nodes rolled to the corrected configuration.
Sep 9, 2026 - 19:04
Full deployment rebuilt with the corrected configuration plus a Cloudflare-authored engine patch that correctly returns errors for requests rejected by the prefill scheduler. Validated against the researcher's reproduction script.
Sep 9, 2026 - 19:40
Model restored to public.
Sep 10, 2026 - 23:30
Meeting with the SGLang maintainers (RadixArk CTO and core engineers) to agree on upstream fixes.
Sep 11-19, 2026
Additional hardening rolled to all production SGLang deployments (details below).
Sep 16-Oct 12, 2026
Upstream SGLang merges the admission fix, per-transfer checksums, abort-ACK preservation, and turns deferred KV release on by default.
Oct 2, 2026
SGLang v0.5.21 released.
Oct 19, 2026
SGLang v0.5.22 released.
Oct 26, 2026
Coordinated publication with the researcher and RadixArk.
Ongoing hardening effort
This bug belongs to a class of KV cache memory-safety bugs that Cloudflare has been working to address for several months. In each case, a page is freed, reused, or read while something else still has a claim on it. We see two common causes.
The first is page lifetime within a single node. Several tasks on a decode node can hold the same page at once: token generation, offload to host memory, the KV transfer receiver, and the abort and error paths. If one of them frees the page while another is still using it, a new request can be given that page while it is still being read or written. Our earlier fixes for decode offload (
#24226
,
#30899
) and double release on grammar errors (
#30937
) were of this kind.
The second is a race across nodes. When a request is aborted while prefill is still writing its KV cache to decode over RDMA, the writes already sent cannot be recalled. If decode frees those pages right away, those pages can be given to another request, and the late writes land in that request's KV cache. Cloudflare has contributed to the effort to fix this race through proposed fixes (
#31357
,
#38961
) and a reproduction script (
#32564
). In both cases the result is corrupted output, or one user's data in another user's response, with no error raised. The bug in this incident was different: a rejected request went through the handoff every time, rather than by a timing accident. But it had the same result: decode reading pages this request never wrote. None of these covered the failure in this incident in which prefill rejected the request, and decode never learned of it.
Since the incident, we have:
Extended deferred release to hold prefill's source pages as well, and to cover every failure type, not just aborts. We proposed it upstream as
#38961
, which was superseded by
#40645
,
#41402
, and
#41404
.
Deployed bounded Mooncake transfer batches (
#32758
, from the SGLang community), so no single transfer call can outlast the release timeout.
Changed our load balancer so a client disconnect no longer aborts a request mid-transfer. It holds the prefill connection until prefill finishes and the decode connection until the first token, then closes both.
Added a check to every disaggregated deployment change: KV pool size measured against context length, deferred release on both roles, transfer batch bounds inside the release timeout, and all required patches applied.
All of these changes were released to our disaggregated production deployments.
Working with the SGLang team
We met with the SGLang maintainers at RadixArk on September 10, the day after the incident. We agreed that RadixArk would investigate the race conditions we had reported, upstream the integrity-checking idea, and build reproduction tests for this class of bug.
The following have landed on SGLang
main
to address this incident and related KV cache race conditions, and all but one are included in v0.5.22. Operators running disaggregated SGLang should update to v0.5.22 or backport these patches as needed.
Adds
--disaggregation-enable-kv-checksum
: decode verifies a checksum of the transferred KV before generating. Cleanup in
#39729
, merged and awaiting release.
Extend KV checksum validation from the prefill-to-decode handoff to every decode step (see Integrity by construction, below)
Broader KV Canary and KV Checksum model and feature support
What we recommend to other operators
If you run SGLang in disaggregated prefill/decode mode, we recommend the following:
Measure your KV pool and compare it to your context length
, on every prefill and decode node, from the engine's startup log, after every change to weights, quantization, parallelism, or memory fraction. If the pool is smaller, lower the context length to fit. Do not rely on a proxy to enforce the limit, and do not assume the engine will reject what does not fit. This is the check we did not enforce.
Upgrade to a build that includes
#36988
and
#38935
(v0.5.22 or later)
, so an over-length request is rejected before handoff regardless of pool size. This is the engine-side fix, and it is the backstop for the day your check in step one is wrong.
Run with deferred KV release on both roles
(default after
#41023
), and bound your Mooncake transfer batches so a single timed-out call cannot leave an unbounded tail of writes.
Turn on corruption detection where your model supports it.
--disaggregation-enable-kv-checksum
and
--kv-canary
do not yet cover every model architecture. Check your logs to confirm requests are being verified. We are working with the SGLang team to extend both checks to more architectures, including GLM 5.3, GLM 5.3 Flash, and DeepSeek V4.
Ensure your proxy is not generating unnecessary aborts.
Configure your load balancer to allow requests to proceed up to the first token, so that you do not trigger an abort that requires cross-node coordination.
Longer term
Integrity by construction
Configuration checks and lifecycle fixes reduce the number of ways a page can be misused. They do not make misuse impossible, and this incident is a reminder that the next bug will have a shape we have not seen. The durable answer is for the engine to detect, at read time, that a request is about to attend over a page it does not own, and fail that one request rather than return someone else's data.
We built a prototype of this over the summer and
described it in August
. Every physical KV page carries a tag that changes when the page is reallocated, each request records the tags it expects, and the mapping is checked before decode reads the cache. In our tests it cost under 1% in throughput and tail latency. We tested it on GLM 5.2 in mid-August, but disabled it shortly afterwards due to reliability issues.
The prototype was also tied to specific attention backends and model architectures, so it could not be a general fix. We are working with the SGLang team to build a production version into the engine that works across every model, rather than maintaining Cloudflare-specific patches. The per-transfer checksum in
#39500
is a first step: it validates the handoff from prefill to decode. Page-level tags go further, because they check every read, including reads long after the transfer.
Integrity by mathematical impossibility
RDMA copies data directly from one node’s memory to another’s. It’s vital for the two machines to agree on where the data goes, how large it is, and when it’s finished; any mismatch can cause the receiver to read the wrong data. This bug is an example of a consistency failure in a distributed system, in which the two machines had inconsistent views of the state of that system.
Elsewhere in Cloudflare, we have put effort into proving the safety of distributed systems using formal verification methods.
Topaz
enables conflict-free IP selection for our authoritative DNS servers. Models of
Meerkat’s
QuePaxa implementation have demonstrated consistency bugs that were subsequently fixed.
We are now directing our experience in formal methods to KV cache transfer engines. This will start with modeling and proving the safety of an RDMA-based KV cache transfer protocol. The goal is to model our production SGLang’s distributed KV cache system using Mooncake, then track and fix any divergence from the safety properties we want to guarantee. The aim is to prove — as far as possible — that a bug like this cannot occur again. Realistically, we expect gaps in what the provers can tell us, but proving the rest of the system allows us to more closely review and monitor those gaps.
Coordinated disclosure
We are publishing this report as part of a coordinated disclosure. We want to thank the researcher, Gadi Evron, who reported this through our HackerOne program with a clear, reproducible script and gave us time to fix it and to coordinate with the SGLang maintainers before publishing. We also want to thank the SGLang team at RadixArk, who treated this as their problem as well as ours and landed the upstream fixes with urgency.
If you run ColdFusion or Lucee on a Windows server with IIS, and you've never installed PHP on purpose, this one's for you. There's a good chance PHP is on your server. It may be left behind by a control panel, a phpMyAdmin install from years ago, or your host's setup image. Here's how to find out in a few minutes with PowerShell, and how to remove it safely if nothing uses it.
I remember when I could go years without applying a security fix. Now it feels like I'm chasing something down every few weeks: a patch here, a mitigation there, a bot hammering a page that shouldn't exist. Such is life in the AI era, sigh.
While I was signing in to my test blog the other day, the admin page refused me with a plain IIS error:
403 Forbidden
, and a message saying multipart form-data requests were blocked by a PHP mitigation. My blogs are ColdFusion. They don't run a single line of PHP. So why was a PHP security rule stopping me from signing in?
The timing wasn't a coincidence. On October 21, 2026, PHP shipped emergency patches for two critical flaws that let an unauthenticated request run code on the server, nicknamed
PHP2Shell
. Every PHP setup that serves web requests was affected: PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed. The fix is to install a new version of PHP (8.5.12, 8.4.27, 8.3.36 or 8.2.35).
My hosting company responded the same week with a web server security rule. The rule lived in IIS's server-wide URL Rewrite rules, so it applied to every site on the server and blocked every request whose content type was multipart/form-data, regardless of the address. That's the encoding a browser uses for any form that can upload a file, and plenty of forms use it even when they don't.
PHP's own advice doesn't include blocking those requests. It's to patch, and until then to turn off
session.upload_progress.enabled
and lower
post_max_size
. Several of the official mitigations concern how PHP handles uploads, so I can see why a host would reach for the biggest hammer. For a PHP site that's a blunt but understandable shield. For my ColdFusion sites it meant the admin sign-in form, every image upload and every file upload failed on all four sites at once. The rule matched
every
address, not just
.php
ones.
Once I'd scoped the rule to
.php
addresses (more on that below), everything worked again. Then I asked the obvious question: why is PHP on this server at all? The answer was a phpMyAdmin install I had asked for years ago to manage one MySQL database. It was still there, still in a site folder, and its login page was open to the whole internet. The host turned the blanket rule off once I told them PHP was no longer in use, and I went looking for anything else PHP had left behind.
Check 1: is IIS sending .php files to PHP?
IIS only runs PHP if a handler mapping tells it to. Open PowerShell
as Administrator
on the server:
If it prints nothing, IIS doesn't run PHP. If it prints something like this, it does, for every site that inherits the server's settings:
name path scriptProcessor
---- ---- ---------------
FastCGI *.php C:\php\php-cgi.exe
Note the handler's
name
and the
scriptProcessor
path. You'll need both if you remove it.
Check 2: are there any PHP files in your sites?
PowerShell's
Get-ChildItem -Recurse
works, but on a server with years of uploaded images it can crawl for minutes. Windows' own
dir
is much faster. This counts the PHP files under your web root:
Mine found about 4,500 files in two folders, both phpMyAdmin: one inside a site, and a second copy at the web root, which IIS's Default Web Site served to anyone who visited the server's bare IP address.
If you find PHP files you
don't
recognize, especially scattered through image or upload folders, or changed recently, stop and treat it as a possible break-in. Attackers love dropping small PHP "web shells" into upload folders. This lists the most recently changed ones:
Anything that answers 200 deserves a look. A phpMyAdmin login page facing the internet is a standing invitation: bots try passwords on it all day, and every attempt starts PHP and talks to your database.
Removing it safely
Do these in order, and back up first. Every step is reversible.
1. Back up IIS's configuration
IIS can snapshot its own configuration and restore it in one command:
To undo everything below:
appcmd.exe restore backup "before-php-removal"
.
2. Move phpMyAdmin (and any other PHP app) out of the web folders
Move, don't delete. Its configuration file may hold a database password, so keep it somewhere private for a few weeks in case something turns out to need it:
If
Move-Item
complains that a file is in use, PHP has it open.
iisreset /stop
, move it, then
iisreset /start
. (Your sites are down for a few seconds.) And if it says
"Could not find a part of the path"
, it's the destination folder that's missing, not the source. That one fooled me.
For managing MySQL afterwards, a desktop tool on the server over Remote Desktop, like HeidiSQL or MySQL Workbench, does everything phpMyAdmin did without a public login page.
3. Block .php at the door
IIS's request filtering can turn away a file extension before any handler sees it. Added at the server level, it covers every site:
If PHP came from an installer, remove it under Apps > Installed apps. If it's just a folder like
C:\php
, rename it to
C:\php-removed
for a few weeks before deleting it. If anything complains, you'll know right away, and it's one rename to put back.
If PHP was installed by your host, ask them before step 5. Their own monitoring scripts are unlikely to need it, but it's their install.
If you need to keep a rule like this
Maybe you do run PHP somewhere, or your host wants their rule. Then scope it to PHP addresses instead of every address. The rule's
<match url=".*" />
was the whole problem. This changes it to
.php
addresses only, leaving ColdFusion's forms alone (use the rule's own name):
Note the single quotes around the pattern. I first tried the same change with
appcmd.exe
, and PowerShell quietly mangled the quoting: no error, and no change either.
Set-WebConfigurationProperty
with single quotes did it on the first try. Check the result with
Select-String
on
C:\Windows\System32\inetsrv\config\applicationHost.config
.
Lucee on Linux and Apache
The same questions, different commands:
php -v ## is the PHP command-line installed?
apachectl -M | grep -i php ## is Apache running PHP (php_module, proxy_fcgi to php-fpm)?
find /var/www /home -name "*.php" 2>/dev/null | head -50
On Debian and Ubuntu,
sudo a2dismod php8.3
(your version) and
sudo systemctl restart apache2
stop Apache from running PHP. Then remove the packages with your package manager once you're sure nothing needs them. Control panels such as Virtualmin often install PHP for their own tools, so check before uninstalling.
Gotchas
A server-wide rule catches every site.
A rule written for PHP blocked my ColdFusion sign-ins and uploads. If a 403 appears out of nowhere, read the full IIS error page; mine named the rule.
Hosts re-run their scripts.
Mine recreated its rule on every run, so a local fix could have been undone silently. Tell your host what you changed and why.
A config edit can land in the wrong
web.config
.
My first fix went into a site's
web.config
, and nothing changed. A quick
Select-String
on the file IIS actually reads would have saved me ten minutes.
Trusted Cache hides your fixes.
If you replace a
.cfm
by hand while diagnosing, ColdFusion keeps running the old compiled copy until you clear it. A brand-new file name is the quick workaround.
Removing PHP isn't a substitute for patching.
If you do run PHP, update it now to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer), and set
session.upload_progress.enabled = 0
in
php.ini
until you can. PHP 8.1 and older no longer get updates from the PHP project. Removing PHP is only the right answer when nothing uses it.
Further Reading
PHP's announcements for October 2026, including the October 21 security releases and their mitigations:
php.net news archive, 2026
This entry was posted on October 23, 2026 at 11:39 PM and has received 6382 views.
There are 0 comments.
University of Copenhagen data breach exposes data of 525,000 people
Bleeping Computer
www.bleepingcomputer.com
2026-10-26 18:20:36
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]...
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people.
The educational organization detected the breach last Tuesday and disclosed it on Friday. In an update yesterday, the university added another 20,000 staff and students whose PIN codes were exposed.
“The University of Copenhagen has confirmed a cyber attack in which hackers gained access to one of the university’s test environments,” the
university says
.
Founded in 1479, the University of Copenhagen is Denmark’s oldest university and one of its leading research institutions. It has approximately 36,800 students and 10,700 employees, with six faculties and more than 200 research centers.
The University of Copenhagen is still investigating to determine the extent of the incident, but warns that the following information may have been exposed:
Full names
National identity numbers (CPR)
Phone numbers
Email addresses
The exposed information increases the risk of phishing and social engineering attacks.
Regarding the PIN access exposure, the University of Copenhagen has restricted physical access to certain critical locations on its campus out of abundance of caution and is gradually reopening them as it distributes new access codes.
The university says it contained the attack and blocked the attacker’s access. Currently, there is no indication that hackers accessed systems supporting daily operations or disrupted university activities.
The university reported the incident to the Danish Data Protection Agency, but also said it falls within the scope of Europe’s General Data Protection Regulation (GDPR) and that it is taking the appropriate steps with the relevant regulators.
Students and staff whose data may have been exposed in this incident should be cautious of unsolicited communications and independently verify requests.
The university promised to provide more updates on the scope of the impact as soon as its internal investigation allows.
No preview for link for known binary extension (.pdf), Link: https://github.com/openai/math/blob/main/preprints/The-Exponential-Time-Hypothesis-is-False-October-25-2026/paper.pdf.
Working with academic communities to build scientific understanding
This link caused an XML parsing exception.
If this link has an extension('.html'), maybe
we should exclude it. Here's the link: https://gforth.org/manual/1.0/NEWS.html.
Perfect keys are now one click away. CorridorKey 2.0 (CK2.0) removes the struggles of working with green and blue screens, solving even the hardest keys with one click - all while running locally in your VFX/editing program of choice. Resolve, Nuke, After Effects, Premiere, Blender - one purchase gets you EVERY plugin. NO SUBSCRIPTION.
This is Corridor Digital’s first official plugin release. After the success of CorridorKey 1.0, we teamed up with
Alê Alvaro
(plugin development) and
Zachary Harris
(model design and training) to make CorridorKey accessible in every software package.
Buy once.
Key everywhere.
CorridorKey is ready for YOUR favorite software. CorridorKey is supported on Windows and NVIDIA GPUs.
DaVinci Resolve
Nuke
After Effects
Premiere Pro
Blender
Windows
Mac
Standalone app included
The best tool for bulk shots. We built CorridorKey for the production of
Son of a Dungeon
, where over 400 VFX shots went through this app. See it in action when it premieres on November 7.
Included
in your purchase.
Production tested.
Professional output.
Native 4k (and higher!)
HDR support
Floating point color depth.
Eliminates flicker
Works on
any
color background
Runs on
your
machine
CorridorKey 2.0 is the de facto keying tool used internally at Corridor. We have not used another keying tool in over six months as nothing else comes close to our results with CK2.0.
Solve the “un-mixing” problem
CorridorKey does something no other tool does - it predicts the color of semi-transparent foreground objects, intelligently removing the background screen color. This gives you perfect motion blur, bokeh, and hair. And unlike other tools, CorridorKey 2.0 has
time awareness
, eliminating flicker and chattering mattes by analyzing the entire video, not just one frame.
Now even a wrinkled blanket and an iPhone can produce high-quality results.
Simple to use
Apply the node
Using CorridorKey is a one click process for most shots. You simply apply the plug-in and it will understand the difference between your background and your subject.
Process time awareness
For enhanced quality, you can run “time awareness” on a shot, which analyzes the whole video clip in order to more effectively separate the background from the foreground. This eliminates the chattering from issues like compression and noise, and it helps preserve ultra-fine details like hair.
Provide a hint
For full control over what’s included or excluded from your shot, simply provide a single black-and-white image or video.
Total artistic control
CorridorKey lets the artist dictate what to key, with easy to use AlphaHint inputs. Tracking markers, edges of the screen, and c-stands no longer require garbage masking. You can provide one rough guide frame, or a whole guide video, and CorridorKey understands what you want to keep.
Buy it once. Own it.
Corridor believes artists should be able to own their tools.
Personal
Beta price. Goes back to
$99.00
on
November 21
.
✓
Every host surface:
Resolve, Nuke, After Effects, Premiere, Blender
✓
On Mac, you get the standalone app, the OpenFX plugin, the Blender add-on and, since 2.0.0.146, the After Effects and Premiere Pro plug-in.
✓
One person
, up to
2 machines
on one activation
✓
Move a machine yourself,
no support ticket
✓
Lifetime updates on the
2.x
line
✓
14-day money-back guarantee
, no questions asked
Needs a Windows PC with an NVIDIA RTX graphics card, or an M-series Mac on macOS 14 or newer. It doesn't run on Intel Macs, and AMD graphics and Linux aren't supported yet.
See the hardware requirements.
Studio
$
42.50
per seat
$85.00
5 to 24 seats · volume pricing · 25+ negotiated
Founder pricing per seat. Back to
$85.00
on
November 21
.
✓
One license for the whole team:
5 to 24 seats
, one machine per seat
BETA
Founder pricing is pre-applied at checkout, no code to remember. Optional code
CK2BETA
if you have it. Beta price offer runs through
November 20
. Code expires on its own.
Hardware Requirements:
GPU:
NVIDIA RTX 30 series or newer (recommended)
RTX 20 series (beta):
works in our tests so far, still being validated
GPU memory:
4 GB for shots up to 1440p. 6 GB for 4K.
System:
Windows 11, or Windows 10 22H2
Mac:
M-series, macOS 14 or newer
AMD GPUs:
planned
Linux:
planned
Former pentester used ARTEX AI to steal 8.2 million data records
Bleeping Computer
www.bleepingcomputer.com
2026-10-26 17:08:28
South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks. [...]...
South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks.
According to local media citing the Seoul Metropolitan Police, the gang leader has a background in penetration testing and worked at a cybersecurity company between 2019 and 2022.
In 38 of the incidents, the threat actor demanded ransom payments of 360 million won ($270,000), promising in exchange not to leak stolen data.
Authorities believe the threat actor stole 8.2 million records from compromised organizations, including educational institutes, hospitals, large corporations, and even golf courses.
Extortion message sent to a victim
Source: Yonhap
Yonhap News says
that the gang leader is a self-taught 32 year-old hacker and started attacking organizations in September 2025.
The Seoul Metropolitan police told the publication that the hacker used the ARTEX AI penetration testing suite, the same autonomous framework used in the attacks against
multiple South Korean banks
attributed to a Chinese-speaking threat actor.
Initially, the hacker used conventional tools but adopted AI utilities in late August 2026 to expand the attacks.
Authorities arrested all seven suspects, but only the group’s leader remains in custody. Arrested on October 15, he was formally detained two days later and referred to prosecutors on October 23. The other six suspects remain under investigation without being detained.
Police opened a case after a victim filed a complaint in June, and investigators traced the suspects through server logs from the breached entities.
Law enforcement authorities reportedly used an in-house AI tool to analyze the recovered evidence.
The police told local media that AI has lowered the barrier to entry for aspiring cybercriminals, resulting in large-scale, high-impact incidents that were previously only possible for skillful, knowledgeable actors.
“This is the first case of arrest of a suspect in Korea related to a large-scale hacking and personal information theft crime that exploited generative AI," the police told Yonhap.
“Even individuals who are not professional hacker organizations can now hack on a large scale with the help of AI.”
The police continue the investigation, now focusing on whether any of the stolen data has been leaked on the dark web.
Microsoft is offering voluntary buyouts to about 60,000 employees in an effort to further reduce its headcount.
Chief People Officer Amy Coleman
sent a memo
to employees Monday detailing the terms of the voluntary exit offer, which will be available to roughly one quarter of Microsoft’s workforce.
“This offer gives eligible employees who may be considering a future outside the company a new choice to make that transition now with support,” Hood said in the memo. “It also gives participating organizations another way to adapt their workforce to changing needs.”
The buyouts will be available to select employees in the U.S., U.K., Canada, and India at level 70 and below in the company’s ranking system. That ceiling applies to the vice president level at the company.
A Microsoft spokesperson said the offer will be comparable to the company’s standard severance package, which varies by market but typically includes base pay for a certain amount of time (based on tenure), stock options granted over time, health care, and career planning services.
The exit offer comes a few months after Microsoft offered voluntary early retirement to employees of a certain tenure at level 67 and below. About 30% of eligible employees took that offer, though Microsoft expects this broader round of buyouts to have a smaller adoption rate. That’s, in part, because the voluntary retirement program offered more generous terms to incentivize uptake.
Eligibility for the new program was determined by the heads of each organization at Microsoft. That means the sales organization, some corporate services like marketing, and some engineering teams will not be participating.
The spokesperson said artificial intelligence is not driving the buyout programs. Microsoft has, however, been on an employee-cutting spree for several years as it invests billions of dollars into the infrastructure needed to train and run AI models.
“The Voluntary Exit Offer is new for us. … There is no one-size-fits-all approach for every team or every employee,” Hood said in the memo. “These are a few of the ways we’re trying to meet different business needs while continuing to create opportunities for our own people to grow and contribute.”
The Fight to Release 125,000 NYPD Surveillance Records Might Land Commissioner Tisch in Contempt of Court
hellgate
hellgatenyc.com
2026-10-26 16:56:08
After years of delays, appeals, denials, and litigation, the City’s most secretive agency may finally be forced to cough up a tranche of public documents....
The NYPD is facing the prospect of being held in contempt of court over its ongoing failure to comply with public record requests years after they were filed.
In 2023 and 2024, the
Surveillance Technology Oversight Project
, or STOP, a privacy advocacy organization that attempts to shine a light on government's use of mass surveillance, filed 13 public record requests with the NYPD, seeking records concerning everything from the surveillance of protesters, to mobile wiretaps, to the department's relationship with Palantir and the facial recognition company Clearview AI, to the Domain Awareness System, the NYPD's massive network of cameras, sensors, software and databases,
touted
as one of the largest surveillance network in the world.
OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing
Bleeping Computer
www.bleepingcomputer.com
2026-10-26 16:46:49
OpenAI has launched GPT-6.1 Terra, a new model focused on computer use, visual reasoning, coding, and everyday work, while costing significantly less than its larger models. [...]...
OpenAI has launched GPT-6.1 Terra, a new model focused on computer use, visual reasoning, coding, and everyday work, while costing significantly less than its larger models.
Terra is designed as a faster and cheaper option for tasks such as filling out forms, editing videos, interpreting technical drawings, and automating repetitive desktop work.
"We’re introducing GPT-6.1 Terra, a fast, efficient model that combines detailed visual reasoning and precise computer use alongside clearer, more natural writing," OpenAI explained in a
blog post
.
"A significant step up from GPT-5.6 Terra, it excels at the communication and computer-based tasks that fill the workday, from drafting proposals and interpreting technical drawings to filling out forms and editing videos."
OpenAI says GPT-6.1 Terra's API pricing is 50% lower than GPT-5.6 Terra and GPT-6.1 Sol, at $1 per million input tokens and $5 per million output tokens.
On Agents' Last Exam, Terra scored 15 percentage points higher than GPT-5.6 Terra at medium reasoning effort while costing about one-third as much.
"It even performs on par with GPT-6 Astra at only one-tenth its price per token," OpenAI noted. "Terra is also much quicker, completing tasks over three times faster than both GPT-6 Astra and GPT-6.1 Sol."
GPT-6.1 Terra also hallucinates less
GPT 6.1 Terra makes fewer errors
On its internal benchmark, the error rate at low reasoning effort dropped from 53.6% with GPT-5.6 Terra to 16.7% with GPT-6.1 Terra.
"At maximum effort, the error rate fell by 18 percentage points to 4.3%, nearly matching the rates for GPT-6 Astra and GPT-6.1 Sol," OpenAI said.
Coding has improved as well, with Terra scoring 50.3% on Terminal-Bench 4.0 at maximum reasoning effort, more than double GPT-5.6 Terra's 21.5% score.
OpenAI still recommends GPT-6.1 Sol or GPT-6 Astra for the most complex coding tasks.
GPT-6.1 Terra is available now to Plus, Pro, Enterprise, and Edu users in ChatGPT Work and Codex, as well as through the API as
gpt-6.1-terra
.
.jpg)
Apple on Wednesday will announce 14-inch and 16-inch MacBook Pro models featuring touch-enabled OLED displays with thinner bezels, a Dynamic Island instead of a notch, M5 Pro and M5 Max chips, and a lighter and slightly thinner design,
Comments (0) Trackbacks (0) Leave a comment Trackback