[Sponsor] WorkOS AuthKit: Auth for Your App, Free Up to 1M Monthly Active Users
Daring Fireball
workos.com
2026-10-14 17:03:43
Login looks simple until you’re building password resets, email verification, MFA, social providers, session management, and the enterprise SSO your first big customer asked for last week.
AuthKit lets you:
Offer SSO, MFA, passkeys, passwords, email codes, and social sign-in
Add and remove users ...
Support any SAML or OIDC identity provider with a single integration
Complete User Management
Manage users and organizations, set policies, and support all auth types
Social authentication
Sign in to your app with Microsoft, Google, and more
AuthKit
Flexible authentication UI powered by WorkOS and Radix
Magic Auth
Passwordless auth with a six-digit code sent via email
Multi-Factor Auth
Manage users and organizations, set policies, and support all auth types
WorkOS provides a single, elegant interface that abstracts dozens of enterprise integrations.
RESTful APIs, JSON responses, and normalized objects
Dashboard seamlessly integrates WorkOS into your application
Realtime updates from directory services with webhook events
Modern SDKs for Node.js, Ruby, Python, .NET, Go and more
Multiple environments to map to your application development process
Supports 20+ enterprise services with a single integration point
// Get a user’s access token and
// profile data from an Identity Provider
import WorkOS from '@workos-inc/node';
const workos = new WorkOS('sk_example_123456789');
const profile = await workos.sso.getProfileAndToken({
code: '01E2RJ4C05B52KKZ8FSRDAP23J',
clientID: 'client_123456789',
});
# Get a user’s access token and
# profile data from an Identity Provider
require 'workos'
WorkOS.key = 'sk_example_123456789'
WorkOS::SSO.profile_and_token(
code: '01E2RJ4C05B52KKZ8FSRDAP23J',
client_id: 'client_123456789',
)
# Get a user’s access token and
# profile data from an Identity Provider
import workos
from workos import client
workos.api_key = 'sk_example_123456789'
workos.client_id = 'client_123456789'
client.sso.get_profile_and_token('01E2RJ4C05B52KKZ8FSRDAP23J')
// Get a user’s access token and
// profile data from an Identity Provider
import "github.com/workos/workos-go/pkg/sso"
sso.SetAPIKey("sk_example_123456789")
sso.GetProfileAndToken(
context.Background(),
sso.GetProfileAndTokenOptions{
Code: "01E2RJ4C05B52KKZ8FSRDAP23J",
}
)
// Get a user’s access token and
// profile data from an Identity Provider
$this->sso = new WorkOS\SSO();
$profile = $this->sso->getProfileAndToken("01E2RJ4C05B52KKZ8FSRDAP23J");
// Get a user’s access token and
// profile data from an Identity Provider
import com.workos.WorkOS;
WorkOS workos = new WorkOS("sk_example_123456");
ProfileAndToken profileAndToken = workos.sso.getProfileAndToken("01E2RJ4C05B52KKZ8FSRDAP23J", "client_123456789");
Profile profile = profileAndToken.profile;
// Get a user’s access token and
// profile data from an Identity Provider
WorkOS.SetApiKey("sk_example_123456");
var ssoService = new SSOService();
var options = new GetProfileAndTokenOptions
{
ClientId = "client_123456789",
Code = "01E2RJ4C05B52KKZ8FSRDAP23J",
};
var profile = await ssoService.GetProfileAndToken(options);
Effortlessly connect any identity provider or directory
Customize the look and feel to match your brand
Host on your custom domain (CNAME)
A polished experience for IT administrators
Step-by-step setup guides with detailed screenshots
Seamlessly integrates into your existing application
“The WorkOS team was right there with us every step of the way. Their support ensured those final migrations were just as smooth as the rest.”
“Cursor now completely runs on WorkOS. Login times are much faster, the signup page looks much better, and we’re not subject to Auth0's customer-hostile and opaque pricing anymore. Plus, we’re excited to add SSO for our business tier soon.”
“SSO is a crucial part of our Enterprise Pro plan, and with WorkOS we could roll it out in less than a week. Docs are comprehensive, the Admin Portal has made customer onboarding a breeze, and the level of support we received directly in Slack has been phenomenal.”
“Integrating was straightforward, pleasant, and fun. The team answered my questions quickly, and went above and beyond to help when I ran into issues.”
“When I asked the team, how was the experience with WorkOS? They were just like, this is incredible.”
“WorkOS simplified the complexity of implementing single sign-on (SSO) with multiple identity providers.”
“With our in-house solution we had to spend 2-4 hours provisioning each SSO connection. I wanted to find a solution that would allow us to focus on building core-products.”
“We did consider open source, but WorkOS provided a far superior developer experience.”
“With Audit Logs, we were able to launch the storage, querying, and export capabilities we needed into production in just a matter of days.”
“We viewed WorkOS’ connections-based pricing as a more viable option aligned with our projected growth. The Admin Portal has also been a critical feature allowing us to save engineering time and provide a more polished enterprise experience.”
“WorkOS’ SCIM API has been a game-changer, enabling us to meet the user lifecycle management needs of our largest enterprise customers.”
“The decision to use WorkOS was straightforward. We saw good feedback from existing customers and reviewing the documentation made us confident that our needs would be addressed.”
“WorkOS was super easy to self serve and get up and running. It provided us super easy-to-implement must-have functionality out of the box.”
“What sold WorkOS was the Admin Portal. Our UI gives customers a link; they go to the Admin Portal, complete onboarding steps at their leisure, and never have to talk to us, making the onboarding process a breeze.”
“SCIM is a game-changer for our customers, saving them a lot of time and reducing friction. It's crucial because, without SCIM, customers would likely get frustrated and might even switch to another provider with a smoother experience.”
“The onboarding process has been excellent. I love sending IT admins the link to set it up themselves and getting an email notification when it's completed. It's so efficient not having to get into meetings or go back and forth via email with IT personnel. ”
“If you work with another provider, you probably won’t get the same level of support that WorkOS provides. We'd get immediate responses to technical questions we posted in Slack.”
The FBI Arrested a Saudi National OpenAI Employee for Planting a Recording Device in the Company’s Executive Conference Room
Daring Fireball
www.justice.gov
2026-10-14 16:58:01
The Department of Justice, yesterday:
An employee of OpenAI has been arrested for and charged with using
or endeavoring to use an electronic, mechanical, or other device
to intercept oral communications. Abdulrahman Alfozan, 35, a
national of the Kingdom of Saudi Arabia, was arrested on Oct. 9,
...
An employee of OpenAI has been arrested for and charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications. Abdulrahman Alfozan, 35, a national of the Kingdom of Saudi Arabia, was arrested on Oct. 9, and made his initial appearance in federal court today.
“This serious situation underscores why winning the global super intelligence race is a national security prerogative — and why President Trump’s leadership in creating the Super Intelligence Force is so important,” said Director of National Intelligence Jay Clayton. “I thank Director Patel and our FBI partners for their diligence and swift action. The intelligence community remains committed to safeguarding America’s cutting-edge intellectual property from foreign threats.”
“According to the complaint unsealed today, Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer’s executive conference room to secretly capture sensitive communications about the company’s super intelligence technology,” said FBI Director Kash Patel. “Protecting American SI innovation is essential to safeguarding our nation’s economic strength and national security, and the FBI views that mission as one of our highest counterintelligence priorities. Thank you to Director of National Intelligence Jay Clayton and our law enforcement partners for their support — and we will continue working closely with our partners across the U.S. government and private sector to keep American businesses and citizens safe and to ensure our country maintains its competitive edge.”
“The Bay Area and Silicon Valley lead the world in developing tomorrow’s technology, and our Office will continue to stand at the forefront of protecting that American innovation,” said U.S. Attorney
Craig H. Missakian for the Northern District of California. “For us it is a matter of national security. This arrest highlights our relentless efforts in partnership with the FBI to identify and prosecute those who seek to steal our technology, as alleged in the complaint.”
According to the complaint, Alfozan had been employed as an engineer by OpenAI since July 2025. On or about Sept. 30, OpenAI personnel discovered a surreptitious audio recording device (Recording Device 1) inserted into a USB port on the back of a television in an executive conference room inside one of their buildings in San Francisco. OpenAI determined that the device, which had been concealed in toilet paper, was installed on or about Sept. 28, and that its contents were encrypted.
Recording Device 1
Closed-circuit television (CCTV) footage inside OpenAI’s office showed that Alfozan appeared near the executive conference room on multiple dates prior to the device’s discovery, although he had no authority to access or to participate in meetings occurring in the executive conference room. According to the complaint, meetings in the executive conference room where Recording Device 1 was discovered frequently involved discussions of highly confidential technical, commercial, and strategic information, including proprietary research, product plans, and business-development opportunities, as well as nonpublic information about Open AI’s technical progress and strategic decisions, capabilities, priorities, government engagements, and commercial relationships.
According to the complaint, prior to Sept. 28, Alfozan used a productivity tool to make multiple inquiries about Open AI’s building addresses, meeting rooms, meeting-room capacities and calendars, “leadership and exec” locations, and external partner meetings. Moreover, a chatbot account associated with Alfozan’s spouse (which shared multiple identifiers and attributes with Alfozan’s own chatbot account) submitted prompts between Sept. 24 and Sept. 30 related to building, customizing, installing, audio recording, testing, obfuscating, and remote accessing a device, including inquiries about “build[ing] a continuous audio recorder,” “customiz[ing] Wi-Fi . . . connectivity,” “improv[ing] audio and live listening,” and “encrypt[ing] the SD card,” among other things. The same chatbot account also submitted prompts specifically related to Recording Device 1, including its custom header and unique MAC address, between Sept. 27 and Sept. 28.
The complaint further alleges that on Oct. 5, Alfozan entered the executive conference room and appeared to look behind the television into which Recording Device 1 had been inserted, as captured below:
Image of Alfozan
Finally, the complaint alleges that, also on or about Oct. 5, Alfozan left a bag unattended in a different room in an OpenAI building. OpenAI security personnel found and opened Alfozan’s bag, inside which they discovered — among other things, including Alfozan’s wallet and ID — another recording device (Recording Device 2) similar to Recording Device 1.
If convicted, Alfozan faces a maximum penalty of 5 years in prison and a $250,000 fine, followed by 3 years of supervised release.
The FBI is investigating the case.
Assistant U.S. Attorney Nicolas Parker for the Northern District of California is prosecuting the case with valuable assistance from Trial Attorney Kate Tagert of the National Security Division’s Counterintelligence and Export Control Section.
This prosecution is in support of National Security Presidential Memorandum 11 (
NSPM-11
) designed to support American superiority in super intelligence technology.
OpenAI accuses employee who left for Apple of leaking plans for unreleased device
Guardian
www.theguardian.com
2026-10-14 16:31:15
Hours before Apple and the ChatGPT maker were due to face off in court, a new allegation delayed the showdown An OpenAI employee who left the ChatGPT maker for Apple sent more than 100 files about an unreleased product to a personal account and later made a presentation about the unreleased pro...
An
OpenAI
employee who left the
ChatGPT
maker for
Apple
sent more than 100 files about an unreleased product to a personal account and later made a presentation about the unreleased product to senior Apple leadership, a new filing in the lawsuit between OpenAI and Apple alleges.
In the filing in US federal court in San Jose, California,
OpenAI
alleged that the presentation happened months ago and that Apple is now making AI products of its own, citing the release of Apple’s HomeView product this week.
“OpenAI is very concerned that its trade secret and confidential information is now circulating inside
Apple
, where Apple engineers can shape Apple’s upcoming products based on OpenAI’s confidential and innovative work,” OpenAI said in its filing.
The two companies were due to face off in court on Wednesday in an ongoing trade secrets lawsuit, but the new allegation delayed the showdown. OpenAI said it may file a countersuit based on the new claim.
Apple said that it has policies and procedures in place to ensure new employees do not use confidential information from previous employers and that it has found no evidence to support OpenAI’s allegations.
The document, filed on Tuesday, is part of a trade secret dispute filed by Apple earlier this year against OpenAI. The iPhone maker alleged its own employees left and took confidential information to OpenAI’s hardware division. OpenAI has denied those allegations.
Earlier this week, US district court judge Edward Davila granted part of Apple’s request for early access to digital files from OpenAI in the suit.
Davila said Apple could gather data from some of its former employees’ devices and sit three of them for depositions on a sped-up schedule, including the two defendants in the case – Chang Liu, a former senior system electrical engineer, and Tang Yew Tan, a former vice-president of product design for iPhone and Apple Watch.
Here is Anthropic
describing
(
archive link
) yesterday how their new version control system, Scion, uses a concept called “derived data” to make operations like blames more efficient:
How Anthropic describes Scion’s derived data.
Here is me, back in 2022, describing in my Oxide candidate materials how the
Mononoke
source control server I helped build uses a concept called “derived data” to make operations like blames more efficient:
How I described Mononoke’s derived data.
I think the level of imitation goes well beyond having similar insights
1
. The fact that Sapling was only credited for “hard-won lessons”, and that Mononoke was not mentioned at all, borders on plagiarism. The post comes off as Anthropic claiming that Claude designed all this, while the reality is that our (extraordinary) team at Meta came up with many of the insights that Claude dutifully applied almost a decade later. (We looked at plenty of prior art for Mononoke and Sapling too, from Google’s SrcFS to write-ahead logs in databases.)
I am very glad that the vision our team had back in 2017-18 was so powerful and enduring — when you go against the grain, you’re always a bit unsure if what you’re doing is genius or madness, and I think Mononoke’s design has stood the test of time. And, to be clear, I do not have a problem with Anthropic copying Mononoke’s design. (This is part of why we put out open source — to benefit humanity through the spread of good ideas.)
But as LLMs continue to assist in designing new systems, they are likely to index heavily on existing designs. Mononoke is
open source
and in every LLM’s training set. If you ask
Opus 5.5
or
GPT-6 Astra
(thanks
Matthew Fowle
) about prior art, they both immediately point out the similarities to Mononoke.
Giving credit to those that came before us is now easier — and more important — than ever. There is no longer an excuse.
Yandex outage: data shows that instead of going dark, malicious bots moved
Following reported strikes on Yandex data centers, claims circulated on the Internet that Russian bot farms and influence operations had been knocked offline. HTTP traffic charts showed steep drops, fueling speculation that the infrastructure damage had stopped these malicious actors. However, aggregate traffic metrics can easily mislead. There are two autonomous system numbers (
ASNs
) associated with Yandex: AS13238 is used by Yandex’s search engine, while AS200350 runs its cloud services.
Using Cloudflare Radar and Bot Management data, we analyzed how these two ASNs were affected — and while both saw drops in traffic, they saw differing impact.
Yandex Search (AS13238)
:
The drop in traffic consisted almost entirely of verified search crawlers indexing web pages, images, and site resources.
Yandex.Cloud (AS200350): There was a decline in malicious activities like vulnerability scanning and probing, but high-volume automation did not vanish — it simply migrated to other hosting providers.
While malicious traffic may originate from a particular provider, it does not necessarily tell us who is responsible for the traffic. Understanding why the strikes had little lasting effect on malicious traffic requires analyzing request behavior, rather than just overall traffic patterns.
What happened: the effect of the strikes and pre-event baseline
Between October 7 and 11, reported Ukrainian drone strikes hit three Yandex facilities in Russia, progressively knocking data centers and network capacity offline. As seen on
Cloudflare Radar
, this culminated in a near-total collapse of the Yandex network on October 11 when traffic plummeted to 99% below baseline for Yandex Search (AS13238) and 90% for Yandex.Cloud (AS200350). Despite a brief partial recovery, both networks remained disrupted through October 13, settling at 86-90% below normal baselines. (As of October 14 at 18:00 UTC, traffic is at 85% of normal.)
A drop in overall HTTP traffic only confirms that the network went down. It does not reveal whether malicious or evasive bots were disrupted. Looking at the pre-event automation baseline, we can see that before the strikes, automated requests accounted for 36.1%
of all HTTP traffic observed globally
across Cloudflare's network, and 35.8%
of traffic from Russian IP addresses
.
The outage had different effects on automated activity on the two affected ASNs because they served different roles.
Yandex Search ASN (AS13238)
is used for search index crawling. Cloudflare classified 99.5% of its requests as automated, and 93.6% of its bot requests as
Verified
. Our analysis showed that traffic from this ASN indexed pages, rendered pages, and rendered images, which is consistent behavior for a search crawler. The Yandex Search ASN supplied about 7% of Russia-origin bot requests, and just 0.05% of the global total.
Yandex.Cloud ASN (AS200350)
is a cloud-hosting network and carries a very different mix of automation. Approximately 95.0% of its scored requests were bots, but none of its observed bot requests were verified by Cloudflare. Yandex.Cloud’s bots looked more like software apps: nearly two-thirds of their requests sent data to websites, some identified themselves as JavaScript, Python, or Go programs, and a larger share went to software companies than Yandex’s search bots. The Yandex.Cloud ASN supplied about 2% of Russia-origin bot requests, and just 0.01% of the global total.
Impact of the event on overall bot traffic
"Bot traffic" refers to automated requests to websites on Cloudflare's network, such as crawlers and scripts, not necessarily activity on social media platforms. As Yandex’s networks lost capacity, their bot requests fell too. That was expected: nearly all traffic from Yandex Search and Yandex.Cloud was automated. While we saw the obvious drop in total traffic, we did not see any evidence linking a global disruption in malicious traffic to the drop in traffic from Yandex.
Russia-origin bot requests fell roughly in proportion to the Yandex traffic that went offline, since most requests from those networks were automated.
Date UTC+3
Global bot requests
(% of all HTTP requests)*
Russia-origin bot requests
(% of Russia-origin HTTP requests)
* Radar reports global traffic by both total HTTP requests, and by HTML requests (an approximation of a page view). The above table reflects total request volume.
Impact on Yandex Search ASN (AS13238): less search crawling
The decline on Yandex Search ASN was almost entirely search crawling. Sampled requests showed that 78.1% belonged to verified YandexBot, 11.5% to YandexRenderResourcesBot, and 1.9% to YandexImages.
Among websites and services, the industry segment that saw the steepest drop was Publishing and Newspapers, where traffic from Yandex networks fell 44%. Approximately 90% of pre-event traffic to news sites from this ASN was YandexBot indexing articles, with 40.5% of Cloudflare customers returning HTTP 403 Forbidden responses because the site owner blocked the crawler. When the Yandex Search ASN went offline, customers simply saw less indexing from Yandex.
Impact on Yandex.Cloud ASN (AS200350): legitimate use and migrating malicious traffic
Yandex.Cloud displayed a completely different profile. Following the reported strikes, bot traffic from Yandex.Cloud fell about 40%. Several attack-like categories showed especially sharp declines. For example, WordPress plugin probing fell 90% and scanner-identified requests fell 93%. Interestingly (and tellingly), Cloudflare customer blocks on Yandex.Cloud traffic also fell 70% during the event period, suggesting that proportionately less malicious traffic was even hitting the Cloudflare WAF from this ASN.
Impact on business verticals
Yandex.Cloud’s bot traffic is also interesting when segmented by top request destination industries:
Destination industry
Bot traffic pre-event
Bot traffic during event (Oct 7-13)
Change
4xx (client error) HTTP response status share: pre → event
Computer software
24.24M
15.18M
−37.4%
18.5% → 15.9%
Gambling
23.01M
18.80M
−18.3%
99.1% → 99.3%
Media incl. adult
1.33M
223.1K
−83.3%
82.0% → 61.8%
Internet and telecom
524.2K
206.5K
−60.6%
71.4% → 51.1%
Travel / tourism
363.9K
158.1K
−56.6%
27.0% → 12.3%
Retail / wholesale
316.0K
167.7K
−46.9%
71.0% → 55.9%
Gaming / computer games
226.3K
63.2K
−72.1%
51.4% → 9.2%
Publishing / newspapers
90.8K
8.8K
−90.3%
90.2% → 61.4%
The majority of traffic from the Yandex.Cloud ASN fell into two industry buckets: computer software and gambling. The computer software bucket was predictable for an ASN meant to host third-party applications and software integrations. In fact, we even saw that
api.cloudflare.com
is a top hostname for Yandex.Cloud request traffic. An overall majority of that traffic succeeded (requests returned 200s) both before and during the event, pointing to legitimate usage.
The gambling sector offers the clearest evidence that malicious automation relocated rather than disappeared. Nearly all of Yandex.Cloud’s bot requests were targeted at one gambling customer account, with traffic shifting among its hostnames. Immediately following the October 8 disruption, bot requests from Yandex.Cloud to this account dropped to zero. Simultaneously, identical requests began appearing from other Russian hosting ASNs, including Radist and Selectel. The incoming traffic maintained an identical fingerprint across providers:
The same JA4 TLS client fingerprint
The same uncommon request paths and HTTP headers
The same custom User-Agent strings
Overall, Russian bot traffic targeting gambling accounts remained essentially flat over the week, moving from 167.7 million to 170.1 million requests (+1.4%). The automation never stopped running; the operators simply migrated their workloads to alternate cloud providers once Yandex.Cloud became unavailable.
Across most industries, the share of bot requests from Yandex.Cloud returning any HTTP 4xx response fell. This is largely due to a drop off in the attack-like traffic mentioned above. This, in combination with the gambling customer analysis, shows that malicious traffic that was sending requests through Yandex.Cloud simply shifted its “services” to other providers after the service disruption.
Finally, when we analyzed social media traffic, we found no unexpected changes in traffic either from Russian-origin IPs (0.6% decrease in total traffic over the event period) or globally (1.2% increase in total traffic over the event period). We repeated the analysis on bot traffic hitting the “post”, “reply”, and “like” endpoints for a specific social media platform and similarly did not find an unexpected shift before or during the event period from either Russian-origin IPs (5.7% decrease in total traffic over the event period) or globally (1.1% increase in total traffic over the event period). Based on our assessment, the data does not appear to support the claims that the strikes crippled social media manipulation, though without further analysis with data outside of Cloudflare, we cannot conclusively say there is no connection.
What the data told us — and what it didn’t
When traffic from Yandex networks collapsed, speculation spread across the Internet that Russian influence operations and malicious botnets had suffered a crippling blow. Cloudflare data tells a different story: across Cloudflare's network, there was no evidence that the strikes knocked social media manipulation offline or otherwise disrupted malicious activity on the Internet. Instead, the data demonstrated:
Search indexing dropped.
The overwhelming majority of the traffic that dropped from Yandex Search ASN consisted of verified YandexBot crawlers fetching news articles and web assets. The main impact was reduced content discovery in Yandex Search.
Malicious automation migrated instead of stopping.
While vulnerability scanning and plugin probing temporarily dropped on Yandex.Cloud, high-volume operations quickly moved to alternative hosting networks.
A network disruption means that specific servers stopped sending requests, but it does not mean an automated threat disappeared. Cloud workloads are portable, so when a data center goes dark or an IP prefix gets blocked, operators can migrate their scripts to another provider in hours.
Our analysis here is a reminder that client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior. Defending against automated threats requires inspecting request behavior, such as identifying shared JA4 fingerprints, monitoring anomalous request rates, and applying WAF rules to sensitive endpoints, regardless of which network the request originates from. Physical infrastructure is static, but malicious automation is built to move.
DHS Inspector General Finds That TSA is Not Properly Safeguarding Passenger Facial Recognition Data
Electronic Frontier Foundation
www.eff.org
2026-10-14 16:27:13
EFF legal intern Gabrielle Ladun was the principal author of this post.
The Department of Homeland Security Office of Inspector General (DHS OIG) has published a summary of findings from its audit of the Transportation Security Administration’s (TSA) facial recognition technology. While the detaile...
EFF legal intern Gabrielle Ladun was the principal author of this post.
The Department of Homeland Security Office of Inspector General (DHS OIG) has
published a summary of findings
from its audit of the Transportation Security Administration’s (TSA) facial recognition technology. While the detailed findings are classified, the summary states that the OIG’s audit uncovered a “significant weakness” in the technology’s ability to protect the privacy of passenger data. This has massive privacy implications for the millions of passengers who travel and don’t opt out of the TSA’s biometric surveillance technology verification process.
TSA uses facial comparison technology for identity verification of airline passengers. A camera takes a photo of passengers to verify that their provided identification matches their live photo. Although TSA states that it is “
committed to protecting traveler privacy
,”
the audit highlights that this has not been the case.
The OIG found that TSA’s Credential Authentication Technology 2’s (CAT-2) vendor “was able to access and extract sensitive passenger information, including driver’s license and passport images, during system troubleshooting and enhancements, without TSA’s knowledge.”
The OIG further admonished the agency:
TSA lacked clear policies, did not track when this data was extracted, could not verify that extracted information was properly deleted, and did not notify passengers when their biometric and biographic information may have been stored. As a result, although passenger information was generally protected during routine operations, weaknesses in vendor oversight created a risk that sensitive personal information could be retained or exposed.
We hope the TSA will fix these issues. The OIG summary states:
We issued one finding and three recommendations to strengthen controls, improve oversight, and ensure transparency and the proper handling of passenger data. TSA concurred with all three recommendations. Two recommendations are open and resolved, and one remains open and unresolved.
Why EFF Opposes the Government’s Use of Facial Recognition Technology
EFF
has a long history
of opposing governmental use of facial recognition technology. As the OIG’s audit underscores, this technology presents privacy risks associated with unsecured data, unauthorized access, and data breaches. The government’s use of this technology also creates a mass surveillance system and facilitates the creation of warrantless biometric records for unconsenting parties.
The biometric data captured by this technology is not without errors. There have been multiple instances of law enforcement agencies using facial recognition technology to misidentify and arrest innocent individuals.
Reminder: Opting Out of TSA Photos Is Possible
Given that facial recognition technology is prone to mistakes, combined with the OIG’s audit revealing significant privacy weaknesses, it is imperative that travelers remember that opting out is possible.
TSA’s own website
emphasizes that travelers who wish to decline to have their photo taken for facial comparison can do so without any delay, disruption, or recourse.
Considering the data protection weaknesses exposed by the OIG’s audit, EFF will continue to oppose this governmental system of mass surveillance and spread awareness to ensure that no one is forced to relinquish their biometric data without consent.
Eight states accuse OpenAI of coaching children to harm themselves in lawsuit
Guardian
www.theguardian.com
2026-10-14 16:26:30
US states sue ChatGPT maker and seek to force the company to change how its products work for young users Eight US states sued OpenAI Wednesday, alleging the ChatGPT maker is harming children en masse. Kansas, Arizona, Montana and five others alleged the company’s products coaxed children into harm...
Eight US states sued OpenAI Wednesday, alleging the
ChatGPT
maker is harming children en masse. Kansas, Arizona, Montana and five others alleged the company’s products coaxed children into harming themselves.
The states seek to force the company to change how its products work for young users and give up profits from their activity.
Florida’s attorney general filed a similar lawsuit in June and has launched a criminal inquiry into
OpenAI
over ChatGPT’s alleged role in the planning of a shooting.
Dirk Eddelbuettel: qlcal 0.1.4 on CRAN: Fresh Upstream Updates
PlanetDebian
dirk.eddelbuettel.com
2026-10-14 15:51:00
The twenty-second release of the qlcal package
arrivied at CRAN yesterday, and
has been built for r2u
as well as on r-universe.
qlcal
delivers the calendaring parts of QuantLib. It is provided (for the R
package) as a set of included files, so the package is self-contained
and does not depend on an ...
The twenty-second release of the
qlcal
package
arrivied at
CRAN
yesterday, and
has been built for
r2u
as well as on
r-universe
.
qlcal
delivers the calendaring parts of
QuantLib
. It is provided (for the R
package) as a set of included files, so the package is self-contained
and does not depend on an external
QuantLib
library (which can be
demanding to build).
qlcal
covers
over seventy country / market calendars and can compute holiday lists,
its complement (
i.e.
business day lists) and much more.
Examples are in the README at the
repository
, the
package page
,
and course at the
CRAN package
page
.
This release is based on the changes in the
QuantLib
1.44 release also made
yesterday. It includes two new calendars for Malaysia and the
Philippines, updates to around a dozen calendars, and a few other
updates to internal files.
Maxmilian Muecke
spotted and
fixed a few small bugs just as he did for the RQuantLib release we made
yesterday
;
this is equally appreciated! The full details from
NEWS.Rd
follow.
Changes in version 0.1.4
(2026-10-13)
Add missing market calendars for Poland, Russia, Romania,
Indonesia (Maximilian Muecke in
#21
)
Add (semi-deprecated) alternate separators '::' for Israel and
New Zealand markets (Maximilian Muecke in
#22
)
Fix several typos across source, configuration and documentation
files (Maximilian Muecke in
#23
)
Synchronize with QuantLib 1.44, add two new calendars, update
several others, and update general utility files (Dirk in
#24
)
Steinar H. Gunderson: Decompilation patterns, part 11: Irregular switch
PlanetDebian
blog.sesse.net
2026-10-14 15:45:24
Here's one that m2c usually gets right itself, but sometimes cannot:
if (var_v1_7 != 1) {
if (var_v1_7 < 2) {
if (var_v1_7 != 0) {
spF0 = 40;
} else {
vram_x = cmt46->vram_x;
vram_y = cmt46->vram_y;
...
Here's one that m2c usually gets right itself, but sometimes cannot:
if (var_v1_7 != 1) {
if (var_v1_7 < 2) {
if (var_v1_7 != 0) {
spF0 = 40;
} else {
vram_x = cmt46->vram_x;
vram_y = cmt46->vram_y;
spF0 = 40;
}
} else if (var_v1_7 != 2) {
if (var_v1_7 != 3) {
Repeated comparisons against the same variable, especially in a nested form
that could be binary search, should remind you of one thing: A switch.
Usually, the compiler implements a switch with a jump table, but not always;
if there are few conditions, or the range is too large for a reasonably-sized
table, it will do some ifs instead (or, enough ifs to get within the range
of a table). So what you want here is more like:
switch (var_v1_7) {
case 0:
vram_x = cmt46->vram_x;
vram_y = cmt46->vram_y;
spF0 = 40;
break;
case 1:
spF0 = 40;
break;
case 2:
...
}
Remember that sometimes, you may need to insert cases that are not explicitly
mentioned in the ifs (and/or a default case) to get everything to match back
properly.
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
Bleeping Computer
www.bleepingcomputer.com
2026-10-14 15:41:43
The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]...
The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group’s operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes.
Famous Chollima (a.k.a. WageMole) is commonly tracked as a North Korean threat actor associated with fraudulent IT-worker schemes that generate revenue for the DPRK regime.
Because North Korea is subject to extensive international sanctions, its operatives seek technology jobs at companies worldwide, often using
stolen, rented, or fabricated identities
.
In some cases, they also attempt to compromise employers’ networks to steal sensitive data, deploy malware, or obtain cryptocurrency and other assets.
As part of an operation in Texas codenamed “
Lonestar Roundup
,” the FBI searched 40 residences suspected of hosting laptop farms between September 21 and 25.
Laptop farms are locations where
facilitators
host employer-issued computers that North Korean IT workers access remotely to appear based in the United States.
Law enforcement agents seized approximately 187 laptops and KVM input devices, which were used by Famous Chollima operatives that cybersecurity company CrowdStrike had been tracking since April 2025.
CrowdStrike researchers say that DPRK IT workers used several methods to send the company-issued laptops to the "farm," instead of the address in the provided identity documents:
Submit fake theft reports to trigger replacement shipments to the farm’s address
Rotate through residential addresses to obscure the final destination
Claim last-minute relocations to divert devices mid-shipment
Abuse IT staffing roles they sometimes hold to covertly redirect shipments
CrowdStrike says
public exposure has pressured the operatives, leading them to rely more on spoofing device identifiers or even reusing identifiers across victim organizations.
While CrowdStrike acknowledges that actions like Lonestar Roundup will likely have limited impact, the company called the operation “the beginning of a broader U.S. law enforcement effort to dismantle Famous Chollima’s U.S. infrastructure.”
The U.S. DoJ also published an Ohio indictment describing a remote IT workers scheme that ran from 2019 to July 2025, impacted 70 companies in the country, and generated roughly $3 million for the North Korean threat actors.
The workers used stolen or fabricated identities, VPNs, and proxy infrastructure to appear U.S.-based, while their American facilitators hosted the company-issued laptops, installed remote-access software, and transferred the earnings to DPRK-controlled accounts.
Authorities arrested two U.S. nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, on charges of wire fraud, money laundering, and identity theft.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
I was diagnosed with squamous cell carcinoma in my mouth in May 2026. Here are some things I learned based on that experience so far.
You need to be doggedly persistent on scheduling things. Yes this means lots of phone calls. If you get an appointment a few weeks out, call back a few days later and ask for something sooner and see if they have any cancellations. I could only get an appointment 4 weeks out with an ENT (this was before I knew anything was wrong). My wife made me call back and I was able to get in that week due to a cancellation.
AIs may downplay the seriousness of things. I was chatting with various models and most pushed me in the direction of “you don’t have cancer” for a while. Just something to note.
You may need to push for comprehensive genetic testing. Some doctors were weird about this and didn’t order it promptly, even after telling me they would. My surgeon, who told me he’d get it done, eventually referred me out to an oncologist. This caused a multi-month delay to getting genetic results, since the first results were done on the surgery tumor, not the biopsy tumor. No one cares more about your case than you, so take control and send lots of follow-ups.
You can find the “Standard of Care” flow charts for every cancer type. Look and get through this yourself to see what the options are based on how things have progressed.
NCCN guidelines
. You may need to make an account, which you can do as a non-professional. I like the PDF files. They also have an interactive navigator. Use AI to help you figure out what to pick based on your case.
If surgery is recommended, I would try and talk to someone who has undergone the surgery. I did not do this and regret it. Ask them how intense things were, what it felt like, etc. My surgeon talked me through my surgery, but it was a lot rougher on me physically than I expected. Ask the surgeon how many of these surgeries they do a year and what the complication rate is.
Get a second opinion as soon as possible, no matter how much you like your plan. This may require a lot of calling and getting on an airplane, but I’d move to schedule it at a top cancer center as soon as you are relatively sure of your diagnosis. Ask for a second read of the pathology at the center where you get the second opinion.
I started a new folder on my Mac, and after appointments I’d dictate what happened and what the doctor said and have the AI make a new document summarizing things and asking its own follow-up questions for next time. Nice to be able to refer to this over time.
Check out all the resources and materials at the
Sijbrandij Foundation
. Sid (GitLab cofounder) took matters into his own hands when standard of care ran out. Schedule a call with these guys. They are great and have good materials and questions to ask your doctors.
OpenAI’s London staff receive average of £2.3m per person annually
Guardian
www.theguardian.com
2026-10-14 15:15:14
Accounts for the Westminster-based company behind ChatGPT show that 110 staff shared £87m in salaries and £168m in shares last year OpenAI’s London staff each received £2,318,181 on average last year, as the ChatGPT-maker poured Premier League football salaries into its bid to dominate the global AI...
OpenAI’s London staff each received £2,318,181 on average last year, as the ChatGPT-maker poured Premier League football salaries into its bid to dominate the global AI race.
Accounts for OpenAI UK Ltd, which is based in Westminster but is opening a new HQ in London’s King’s Cross area, showed that 110 staff shared £87m in salaries and £168m in shares in the company, which is aiming to list on the stock market at a valuation of about $1tn.
The earnings amount to 58 times the median UK full-time employee earnings,
according to
the Office for National Statistics. An OpenAI worker on an average package could expect to take home about £1,000 an hour in salary and equity before tax.
But there is understood to be a wide discrepancy between the highest and lowest earners. The biggest compensation packages are reserved for AI researchers who help build the San Francisco company’s cutting-edge models such as Astra.
The figures relate to 2025, when there was a talent war and OpenAI’s rival, Meta, was reported to be offering multi-year packages running into several hundred million dollars.
OpenAI’s London base reflects the UK capital’s status as an important hub for AI talent with some of the brightest machine-learning experts and AI researchers coming out of universities such as Cambridge. Google DeepMind is also based in King’s Cross.
The company declined to comment on the figures, which come after a series of AI safety crises involving its models. This summer AI agents, under training, escaped and
hacked into an unrelated company website
, Hugging Face, while this month
one of its safety leaders quit
, saying that its culture was broken and that AI firms were not “being nearly careful enough” about developing the technology.
OpenAI’s London office has been established as its largest international research hub but it also houses a government affairs team and sales and marketing functions – responsible for selling licences to companies and organisations. George Osborne, the former Conservative chancellor of the exchequer, joined last December as the company’s head for countries.
The earnings were a big jump on the previous year, when the average pay and equity package was £1.1m.
Booming AI salaries have already had a
significant effect on housing prices
in San Francisco, where the average one-bedroom property now rents for $4,400 per month, a figure that is up more than 25% from last year and is nearly three times the US average. Landlords have been trying to capitalise on the boom, particularly in areas closest to the offices of the biggest AI companies including OpenAI and Anthropic.
In London, OpenAI UK Ltd recorded a more than trebling of its turnover in 2025 to £293m, on which it made a £20.3m profit.
You are seeing this page because our security systems have detected some unusual activity on this connection. To regain access to The Telegraph website please try the following:
If you are connected to the internet using a VPN client we recommend disconnecting/disabling it.
Visit The Telegraph website using a different web browser (e.g. Chrome, Safari, or Firefox).
Visit The Telegraph website from your mobile device or from a different PC.
If you’re still having trouble, please contact our Customer Support Team using the following link and quoting the Akamai Reference Number (ak_ref_id) below.
[{"message":"You are not authorized to access this content without a valid TollBit Token. Please follow this URL to find out more.","url":"https://tollbit.dev","metadata":{"ak_ref_id":"18.ca643017.1792008456.51b4ba0"}}]
Zimbabwean author Simbarashe Kundizeza denies using AI to write prize-winning story
Guardian
www.theguardian.com
2026-10-14 15:00:36
Article in the Atlantic claims The Blue Fighter was artificially generated, just days after it won Caine prize The Zimbabwean writer Simbarashe Kundizeza has denied using AI to write a prize-winning short story after an article in the Atlantic said software had flagged it as almost completely AI-gen...
The Zimbabwean writer Simbarashe Kundizeza has denied using AI to write a prize-winning short story after an article in the Atlantic said software had flagged it as almost completely AI-generated.
Kundizeza’s story
The Blue Fighter
was announced as the winner of the prestigious Caine prize for African writers on 6 October. Five days later, The Atlantic published an
article
by the author and journalist Vauhini Vara titled: “Yet Another Literary prize winner Seems to Be AI.”
Vara said that she had run the story through the AI-detection software Pangram, which itself uses AI, and it had deemed the story to be almost completely artificially generated. The exception, she said, was an epigraph from what is described as an unpublished poem by the South African writer Vangile Gantsho.
Vara said that when she read the story, she “was struck by the proliferation of language that is common in AI-produced writing: the not x, but y sentence constructions; the glut of metaphors; the platitudinous aphorisms”.
She said: “Taste is subjective, but trust me, this story is bad – maudlin and full of tired tropes.”
Kundizeza responded in a
statement on X
: “For the avoidance of doubt, I wrote ‘The Blue Fighter’. I did not use generative AI to write it. It is entirely my own work.
“I look forward to continuing to work with the
Caine prize
team, and to celebrating this recognition with the people who helped bring this story into the world. Most importantly, I will continue to write.”
Journalist Vauhini Vara said she had run Kundizeza’s story through the AI-detection software Pangram, which itself uses AI, and it had deemed the story to be almost entirely AI generated.
Photograph: Andrew Altschul
Similar claims have been made recently about other literary prize winners. In July, the Trinidadian writer Jamir Nazir
won the Commonwealth Foundation’s short story prize
with The Serpent in the Grove, despite critics on social media claiming it had “obvious markers” of AI writing.
Last month, the Canadian-Haitian writer Thélyson Orélien’s novel C’était Ça Ou Mourir (It Was That or Die) was
removed from the longlist
of France’s most prestigious literary prize, the Goncourt, after an anonymous online account alleged the book was “almost entirely” written by AI.
The Caine prize said in a
statement
that it was reviewing the allegations that Kundizeza had used AI. It said: “When such claims are made, it is our responsibility to look into them. We aim to do this by taking a human-centred approach, ensuring that writers are supported and cared for during the process.”
Its chair questioned the reliability of AI-detection software itself.
Ellah Wakatama told the BBC’s Front Row radio show: “As someone who chairs a prize, I’m obviously not against AI, but what I am against is it being used as a final arbiter in this case, regardless of what the Atlantic says, because they have already proclaimed our winner to be a cheater without investigating it properly.
“I am not happy for the work of writers, and in this case especially black writers, to form the testing ground for something that is at best still rough and ready.”
Vara said in her article, and repeated in an interview with Front Row, that she had read a 2021 story by Kundizeza that was tonally and stylistically different from The Blue Fighter.
In his statement, he responded: “To suggest that a writer cannot write in different styles or genres, or improve his writing substantially after five or more years fundamentally misunderstands the craft of writing.”
Vara pointed to Pangram’s own research that found that false positives were rare, including for non-native English speakers writing in English, as well as a peer-reviewed journal
article
that found Pangram had “strong accuracy” when assessing mock academic papers created fully, partly or with no AI. However, she acknowledged to the BBC that there was “relatively little third-party research” on the accuracy of AI detection software.
The DelightQL Query Language
Lobsters
delightql.org
2026-10-14 14:41:38
Hey all, I would like to present a programming language I have been developing for many years called delightql.
This is an alpha release so there will be rough edges, but I have used it at home and work and have liked it enough to now throw it out into the world and see if it sticks. It's always a g...
Many code blocks throughout this website are executable on
the WASM implementation of delightql. Hovering over a code block
may show a "play" button that can be used to execute on the
demo database.
DelightQL is a query language that transpiles to SQL. Its syntax draws on logic
and functional programming to make queries succinct and reusable. It
offers the traditional abstractions of a modern programming language while
retaining all of SQL's relational power.
The goal for delightql is to have transpilation targets for all
major SQL dialects. Currently, delightql supports SQLite pretty well and DuckDB sorta well.
The alpha process will increase coverage of other target SQL dialects.
Reproducible Builds: Reproducible Builds in September 2026
PlanetDebian
reproducible-builds.org
2026-10-14 14:34:14
Welcome to the September 2026 report from the Reproducible Builds project!
In our reports, we try to outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free s...
In our reports, we try to outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised or not.
As ever, if you are interested in contributing to the project, please visit our
Contribute
page on our website.
Reproducible Builds Summit 2026 held in Gothenburg, Sweden
The annual
Reproducible Builds summit took place from 22 to 24 September 2026 in Gothenburg, Sweden
. The event brought together developers, distribution maintainers, security researchers and free software advocates from across the ecosystem to share updates on current initiatives, address outstanding toolchain bottlenecks and strengthen cross-project collaboration.
Participants engaged in a series of working sessions and technical roundtables focused on expanding the practical scope of reproducibility. Discussions covered ongoing work within major Linux distributions, language-specific package ecosystems and the various parts of the binary verification infrastructure.
Strategic planning formed a pillar of the gathering, with participants discussing long-term roadmap goals for supply-chain security, software integrity and related topics. Attendees explored new methods for automated verification, discussing how to lower the adoption barriers for maintainers and streamline the integration of deterministic build pipelines into established continuous integration (CI) systems. The event was then followed by two days of unmoderated hacking sessions. These hacking sessions provided space for technical progress, allowing attendees to draft specification updates, prototype new tool features and resolve standing reproducibility bugs in-person.
Dettrace expanding architecture support for PGO & Lisp dumps
Bernhard M. Wiedemann announced major updates to
dettrace
, porting the tool across most architectures supported by Debian and openSUSE. The release addresses key stability issues, passing test suites across these targets and making it ready for production build pipelines.
These improvements enable deterministic builds when utilising
Profile-Guided Optimisations
(PGO), removing the need to sacrifice runtime performance for reproducibility. Additionally,
dettrace
can now be applied to (notoriously difficult-to-reproduce) Lisp and Scheme memory dumps, including environments such as CLISP, SBCL, Scheme 48, Racket and GNU Emacs.
Trusted Execution Environments (TEEs) have become a cornerstone of modern cloud computing, providing strong confidentiality and integrity guarantees for both code and data. A critical component of this trust model is remote attestation, which enables external entities to verify the authenticity and integrity of code executing within a TEE through cryptographic measurements. However, the effectiveness of remote attestation fundamentally
depends on the verifier’s ability to trace the reported measurement back to the original source code - a property that can only be guaranteed through reproducible builds
. [
…
]
Bernhard’s proposed modifications are independent of one another, allowing for any combination to be merged depending on community feedback. Bernhard noted that one proposal may see the most debate, and could still benefit from further refinement before reaching consensus. Community members are invited to review and provide feedback on the individual merge requests by 1 December 2026. Input can be submitted via reactions or comments on Salsa, directly by email to Bernhard or the mailing list.
The specification was first published in 2015 and updated in 2017.
Reproducible Builds will be present at
SeaGL
in Seattle, WA, on October 23rd & 24th. Come chat with us in person!
Founded in 2013, SeaGL is a free, grassroots technical summit dedicated to spreading awareness and knowledge about free source software, hardware and culture.
New Code of Conduct (CoC) for the Reproducible Builds project
The new Code of Conduct establishes guidelines emphasising mutual respect among project contributors. It also defines a formalised process for submitting and handling complaints regarding community misconduct, ensuring transparent governance across project spaces. Along with the core policy document, an accompanying
Code of Conduct FAQ
has been published to outline the rationale behind adopting the guidelines.
Supporter Spotlight: Jochen Sprickerhof
As a reminder, another
supporter spotlight interview
was published featuring long-time Debian and Reproducible Builds contributor Jochen Sprickerhof, highlighting his work on package verification and project infrastructure.
Jonathan Starr
from the
Institute of Open Science Practices
(IOSP)
posted with an announcement
of its upcoming 2026 workshop series in Leiden in the Netherlands. This free-to-attend event aims to build a participant-owned data storage consortium, allowing community members to publish datasets, code and knowledge objects alongside algorithms designed to evaluate trust and value. The event features a dedicated
Community Track
for talks and discussions, a tool showcase and an opening session on
resilient data storage
.
Following up on IRC discussions regarding profile-guided optimization (PGO) on build servers,
kpcyrd
created a
demonstration repository
showing how PGO profiling can introduce non-determinism into output binaries. The demo highlights how runtime randomness (specifically, the randomised keys used in HashMaps to prevent denial-of-service attacks) causes varying bucket collision rates during test runs. These structural variances alter execution weights on underlying code branches, prompting the compiler to generate differing final assembly output for builds that would otherwise be perfectly reproducible if PGO was disabled. Rather than abandoning PGO performance gains,
kpcyrd suggested treating generated profiling data as a documented build input
or recorded environment artifact (similar to
.buildinfo
files), rather than regenerating profiles dynamically on the fly during build execution.
diffoscope
is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made a number of changes, including preparing and uploading versions
330
,
331
and
332
to Debian. In particular, Chris committed support for
radare2
versions greater than 5.9.0 [
…
] based on input from Guillaume Girol [
…
], and committed support for
.nar
files via Guix. [
…
][
…
].
Chris later modified
diffoscope
to not
Build-Depend
on the Debian package of GNU Guix, as its status in the Debian bug tracking system would transitively render
diffoscope
as being overly buggy for the next stable release [
…
]. Similarly, he adjusted the
Build-Depend
s on the
apksigcopier
package as it has been removed from Debian
testing
[
…
] and, finally, he updated a number of copyright years [
…
][
…
].
reprotest
is our tool for building the same source code twice in different environments and then checking the binaries produced by each build for any differences. This month,
reprotest
version
0.7.33
was uploaded to Debian by Holger Levsen with the following changes:
Sergei Tachenov fixed the
fileordering
test on all filesystems, including the likes of
ZFS
, which could return a different order across two builds due to build being done in a different directory [
…
].
Holger Levsen bumped the
Standards-Version
to
4.7.4
, reflected that
Priority: optional
is the default now [
…
], fixed the old
Free Software Foundation
address [
…
] and bumped the
debhelper
‘compat’ level to 14 after confirming there are only desired changes [
…
].
rebuilderd
, our server designed monitor the official package repositories of Linux distributions and attempt to reproduce the observed results there; it powers, amongst other things,
reproduce.debian.net
. This month, Bernhard M. Wiedemann
submitted a pull request to rebuilderd
that refactors RPM repository metadata handling. The change extracts
rpm-md
parsing out of the Fedora-specific scheduler module and into a shared one.
Lastly, there were a number of improvements made to
our website
this month as well. For example:
The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:
At the time of this writing, that leaves
130 submitted patches
, with only 61 outstanding submitted patches that older than a year in the Debian bug tracking system. This number is only 26 if we exclude any low-priority build path issues.
If you are interested in contributing to the Reproducible Builds project, please visit our
Contribute
page on our website. However, you can get in touch with us via:
Ledger asks sellers across Asia to halt sales after supply-chain attack
Bleeping Computer
www.bleepingcomputer.com
2026-10-14 13:46:50
Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. [...]...
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to halt wallet sales and remove products from shelves while it investigates hardware implant incidents.
The company announced the decision in response to discovering that devices purchased from CryptoBilis had been modified to steal seed phrases used to access crypto assets and send them to an unauthorized party over an LTE connection.
Ledger sells physical cryptocurrency wallets that securely store private keys used for managing and authorizing digital asset transactions.
Following reports of cryptocurrency losses from multiple users, Ledger launched an investigation on October 9 and
confirmed
that some devices sold by CryptoBilis had been tampered with.
Yesterday, Ledger’s Donjon security arm
shared more details
about the hardware implant found inside devices from the reseller , largely confirming earlier reports by Mark Karpelès and Tibane Labs.
Donjon said the implant’s microcontroller detects and decodes the 24-word recovery phrase for setting up and restoring the wallet, then transmits it over LTE using a provisioned eSIM.
The implant is a separate component that does not modify the Secure Element or Ledger operating system, or alter transactions or signatures, which makes it undetectable by Ledger’s integrity self-checks.
More implants discovered
Ledger says all confirmed fund losses involve devices sold by Southeast Asian reseller CryptoBilis, but users have also reported compromised devices purchased from other sellers across Asia and Europe.
MediaMarkt, which gets Ledger devices from distributor Aqipa GmbH, has now pulled the product from its shelves after these reports.
Ledger has now ordered a broader sales halt covering all distributors in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong until investigations into device safety are complete.
The company reminded users that its infrastructure, systems, services, and direct sales channel are safe to use.
Trezor reduces reseller network
Trezor, another major cryptocurrency hardware wallet vendor, announced plans to reduce its reseller network to strengthen oversight and prevent supply-chain attacks.
“Supply-chain security is never finished, so we are raising the bar for every partner who continues with Trezor, with an updated legal framework and closer checks on how devices are sourced, stored, and handled,”
Trezor said
.
Trezor said it has found no evidence that its devices were compromised but decided to act swiftly as a precaution.
In a letter to affected resellers, the company said their partnerships would end on January 1, 2027, when their authorization to sell Trezor devices will be revoked.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Secreted away inside a windowless building at 7700 Potranco Road in San Antonio, Texas, is a darkened room that serves as the hub of Task Force Raider. This military task force is secretly at work as part of a government-wide “election security group,” guarding against “interference” in the upcoming midterm elections.
Interference, however, is a loaded word. While it connotes the Kremlin hacking into polling places or changing the election count, Task Force Raider is actually more focused on the broader category of “influence”, specifically Russian or Chinese attempts to change minds rather than to change votes.
But the real target is the American people, whom the federal government sees as vectors for foreign influence.
“The entire election security scare is to indulge President Trump and assuage Democrats, all of whom fear interference and shenanigans, but not from foreign shores,” says a senior military intelligence officer, who spoke to me about the secret effort.
He and other military officers expressed unease with the sprawling mission. It encompasses everything from sending millions of anonymous text and voice messages abroad, to outright deleting social media posts or taking down entire websites, as documents I obtained reveal.
Entrance to Task Force Raider’s base of operations
All of this is in violation of longstanding prohibitions against any military involvement in elections whatsoever, yet enjoys the support of both major political parties.
What’s more, for all the handwringing about election interference, the Trump administration hasn’t substantiated that any country (or any other foreigners) are planning to interfere or have any chance of meaningfully altering an outcome. But that hasn’t stopped the federal government from designating election security the number one “operational priority” — a mission that insiders are calling “no fail.”
That is the mission directive that Pete Hegseth issued to the San Antonio cyber establishment last week, as
I reported on
recently. Yet because Hegseth’s war is highly classified, takes place in cyberspace and entails a healthy dose of covert actions that would shut down potential attacks as well as cut off normal influencers and common citizens who seek to sway voters (what some might call ‘democracy’), nothing has been written about Hegseth’s actual election interference.
“These are not merely Keystone Cops battling against pimple-faced amateurs and anarchists,” says a retired senior military officer who has been involved in election security since the 2016 presidential year. “Every capability that the US possesses, in Cyber Command, the CIA, NSA, and other agencies, the Russian and Chinese governments also have,” he says. “We are literally involved in a daily battle in cyberspace.”
Despite this underground war, the officer questions the growing military involvement in safeguarding voting. “Influencing the influencers? That’s creating a precedent that I’m not comfortable with,” he said. As he sees it, this is not just a slippery slope to boots on the ground at polling places but of building and having federal government capabilities that will eventually be able to control public speech and assembly.
The officer, who describes himself as a nonpartisan believer that the Constitution always comes first, points out that the hundred-plus-year prohibition against posting federal soldiers at polling places had good reason behind it then and good reason now.
“Granted, those in uniform are subordinate to an interagency civilian effort,” he says, “but the construct of only fearing boots on the ground is obsolete. We need to update our thinking, and the law, to include the cyber world. And we need to counter the idea that a robust, even foreign-based debate, requires federal intervention.”
To understand how close we are to abridging the First Amendment, consider that earlier this month, Senators Adam Schiff and Alex Padilla of California
wrote to
the heads of half a dozen social media companies to warn that they — YouTube, Twitter (X), Facebook, Instagram, TikTok, and Google — weren’t doing enough to “combat misinformation and disinformation … during the 2026 midterm elections.” It was a wholly partisan letter with a predictable dose of Donald Trump this and Donald Trump that. But there it was: two prominent Democrats and liberals threatening that Congress must “consider investigations and legislation to remedy” election mis- and disinformation.
“Congress shall make no law,” the military officer says, when asked about the proposed legislation. “It’s the first sentence of the First Amendment to the Constitution. Period.”
Now, however, a law, and control, is the norm. And Hegseth, for whatever reason, wants the Pentagon in on the action, that is, under the misleading guise that it is only working against “foreign” actors.
The military has been quietly involved in protecting federal elections against cyber attack since Donald Trump appeared on the national stage in 2016, in the context of WikiLeaks, Kremlin influence operations and their hacking of Hillary Clinton’s emails.
Whether any of what happened was important enough to have the slightest impact on the American vote or not, the Obama White House was spooked enough that it gave the CIA covert action authorities to shut down websites and social media accounts — including taking a Russian military-created website called “DCleaks” offline — that might release additional materials. Whatever you think about Obama’s motivations or Trump’s, the essence of the government action then, as it is now, is that it restricts free speech.
Task Force Raider (or its predecessor) was mobilized to assist Homeland Security and the FBI in “defending” the United States. To pull together the right people with the greatest talent, the Task Force operates under a “best athlete” approach, picking the most qualified individual regardless of military service, civilian agency or defense contractors. Eventually, over 350 people got to work on the task force.
A $10 million Rewards for Justice program was unveiled, and over 56,000 “psychological operations” (PSYOPS) messages were posted over the internet. The influence warriors of Task Force Raider sent over three million (!) text and voice messages to people in “countries of interest,” according to documents I’ve obtained. All of this took place in secret.
Some of the work and preparations were focused purely on defense. One unit, the “Demon Chasers” of the “91st Cyber Operations Squadron,” the military’s premier offensive cyberspace squadron, contributes its expertise to the mix. Working from their 42,600-square-foot “multi-domain” secure facility that contracting documents say is authorized to handle Top Secret “sensitive activities” (SA), “sensitive compartmented information” (SCI), “special access program” (SAP) level information, offensive cyber operations (OCO), and “special technical operations” (STO), the 91st specializes in freezing out communications.
One document says that the squadron, and its Special Program Office, has the mission to “degrade, disrupt, deceive and exploit adversary telephony and information system.” It cut its teeth in Afghanistan, where it perfected “cellular coverage blackouts,” that is, the ability to shut down cellphone communications in a limited area.
Another unit operates a “malware lab” that collects together software and data from all sorts of adversary hacks and cyber operations, conducting analysis of “malicious artifacts,” and writing counter-software to thwart incoming attacks and implants.
An enormous part of the overall effort is “persona operations” — where soldiers and other literal keyboard warriors create false identities and fake internet addresses to operate in cyberspace without government attribution, to scout the web and surf social media, to engage individual users, and to do some influencing of their own.
My sources who are privy to this Top Secret effort all agree: the military is not just thwarting foreign actors from sowing discontent. They are also regulating what appears in social media, regulating legitimate debate.
Cyber Command’s (CYBERCOM’s) Joint Force Headquarters – Cyber, operating from its war room inside the National Security Agency-Texas facility in San Antonio, oversees Task Force Raider and other military election security efforts. On the million-square-foot “security hill,” not far from the NSA facility at the former Kelly Air Force Base, another unit has built a “state-of-the-art weapons system to mimic the collection efforts of foreign intelligence services,” according to documents I’ve obtained.
After the 2020 elections, the Joint Force Headquarters activated an election security “enclave” to support “the most sensitive activities.” The Pentagon defines such activities as “activities that, if compromised, could cause enduring adverse effects on U.S. foreign policy or military operations, or lead to significant embarrassment for the U.S. government, its allies, or the military.”
In other words, actions that might damage the federal government and the military, not actions that might damage democracy.
Online support for Palestinians and opposition to Israel’s conduct in the Gaza war; vitriol against Donald Trump, or ICE, or the CIA and the FBI; or “disinformation” in general? None of these are a serious threat to our democracy. Yet somehow the federal government and the Pentagon have convinced us that they need to take extreme action, including controlling speech, to counter it.
What Americans see of military involvement in the election, they pretty clearly don’t like. When video circulated of DC National Guardsmen appearing in front of a ballot drop box, it quickly went viral, stoking outrage.
What people don’t see is that the military is also eyeing the vote in a much more systematic way in cyberspace. Why isn’t anyone asking what they are actually doing? And who is the actual target? And what is it that they have in mind to do on or before election day to carry out their own influence campaign?
Bulgarian Prime Minister Rumen Radev confirmed on Wednesday that there had been a fire at a facility of the Starlink satellite internet service near the capital Sofia last week.
Two young men holding German passports have been taken into custody in connection with the suspected attack, Bulgarian media later reported, citing investigators.
The satellite network is a strategically important part of Ukraine's defence in the war against Russia's invasion.
The fire had previously been made public by the pro-Western opposition alliance Democratic Bulgaria (DB). Radev said he would not provide any further details in light of the ongoing investigations.
According to DB, 11 of 17 antennas at a Starlink facility near Sofia were deliberately set on fire on October 9. The antennas were used in the war in Ukraine, DB said.
Pro-Western opposition parties said they suspected Russia was linked to the attack.
Two German passport holders in custody
Two men aged 20 and 21, both holding German passports, were detained in Bulgaria on Monday in connection with the suspected attack, several Bulgarian media outlets reported on Wednesday evening, citing investigators.
According to the news outlet Faktor.bg, the two suspects have migrant backgrounds and had legally entered Bulgaria from Greece through the Kulata border crossing.
The website reported that investigators were examining whether the suspects belonged to a larger sabotage network potentially linked to two men arrested in Germany earlier this week over a recent attack on a Starlink facility in Poland.
Sabotage suspected
Bulgarian officials stressed that the Starlink facility near Sofia was privately owned.
Bulgarian Interior Minister Ivan Demerdzhiev told parliament that additional security measures had been introduced at similar facilities, even though responsibility for their protection rested with their owners.
Plamen Tonchev, head of Bulgaria's State Agency for National Security (DANS), said he believed the fire at the Starlink facility was an act of sabotage.
"Such acts of sabotage cannot be ruled out in the future either," he warned lawmakers.
A fire also broke out at a Starlink ground terminal south of Warsaw on September 23.
Two suspected saboteurs accused of carrying out that attack in Poland were arrested on Tuesday in Nürtingen, near Stuttgart in south-western Germany.
The government in Warsaw suspects Russian intelligence services were behind the attack.
(c) 2026 dpa Deutsche Presse Agentur GmbH
Banks are now trying to offload the AI data center debt they just underwrote
JPMorgan, Morgan Stanley, SMBC and MUFG are quietly shopping pieces of the AI debt pile they helped build, a sign the lenders closest to the money have started hedging their own bet.
Six months ago, banks were racing each other to underwrite data center loans tied to Oracle, Meta and the rest of the AI buildout. Now some of the same banks are trying to get that debt off their books. JPMorgan, Morgan Stanley, SMBC and MUFG have been exploring significant risk transfers, according to a report from the Financial Times. These are deals that let a bank keep a loan on paper while shifting its riskiest slice to outside investors. The banks are doing this because they are bumping up against internal limits on how much AI-linked exposure any one lender can hold.
One case shows how stuck this has gotten. A group of banks including JPMorgan and MUFG has spent more than six months trying to distribute $38 billion in construction debt tied to a Texas and Wisconsin data center project leased to Oracle, Bloomberg has reported. Some lenders are now willing to sell pieces of it to non-bank buyers at a discount, just to move it. Six months is a long time to sit on debt nobody underwrote to hold forever.
Matthew Moniot, co-head of credit risk sharing at Man Group, told the Financial Times the deal sizes involved are "out of scale to anything we've thought about, ever." That is not a hedge-fund manager talking down a trade he wants no part of. It is someone whose job is pricing exactly this kind of risk, saying the numbers no longer fit any model he has used before.
Oracle is the clearest tell. Its five-year credit default swaps, the cost of insuring against the company defaulting, climbed to around 151 basis points in early October, levels last seen in 2009, according to market data cited by Bloomberg. S&P had already cut Oracle's credit rating to BBB-, a single notch above junk, back in July. The company is reportedly targeting more than $40 billion in additional debt and equity this fiscal year. That is on top of the $18 billion in bonds it sold in a single day last September, and the money is needed to keep funding its Texas, Wisconsin and New Mexico sites.
Demand for that paper has thinned out, too. Bonds from Alphabet, Amazon, Meta, Microsoft and Oracle now trade at a premium to similarly rated non-AI corporate debt. Order books for their offerings have shrunk from roughly five times the amount on sale back in February to under two times by July, Bloomberg has reported. That is the difference between a bond that sells itself and one a bank has to work to place.
None of this is happening in isolation. The 10-year Treasury yield hit 5.304% this month, its highest since 2002, after a $39 billion auction cleared at 5.30%, the highest auction yield since 2000. The Federal Reserve's own September meeting minutes named AI-related corporate borrowing as a contributor to that move. Capital Economics argues the bigger driver is plain old inflation and government deficits, not tech company bond sales. Whoever is right about the cause, the effect is the same for anyone trying to finance a data center right now: the risk-free rate they are borrowing against just got a lot more expensive.
Frankly, the mechanics here matter more than the headline number. Banks do not sell down debt they are confident in. They sell down debt when they are worried about concentration, which is exactly what "approaching internal limits" means in plain English: too much of this bank's balance sheet is now one bet on one sector holding up. Spreading $120 billion of AI infrastructure spending across special purpose vehicles was supposed to make that risk easier to swallow. That is the structure Oracle, Meta, xAI and CoreWeave have all used to keep debt off their own balance sheets. Instead the risk is turning up at the banks that financed the SPVs in the first place.
The investors who still want in have gotten pickier about where. Capital is rotating toward data centers leased to investment-grade hyperscalers like Microsoft and Google, and away from weaker credits, Bloomberg has reported. That is exactly why CoreWeave-leased paper prices at 7.00% to 9.875%, against the 5.70% to 7.875% that hyperscaler-leased bonds command, per bond market data compiled by CCIR. A smaller, less capitalized AI infrastructure company trying to raise debt next quarter is now competing for the same nervous pool of lenders as Oracle. Except without Oracle's balance sheet or its existing customer base to point to.
That's the part of this story that does not show up in a single day's stock move. The AI boom still runs on the assumption that credit stays open indefinitely at reasonable terms. Six months of a bank struggling to sell $38 billion in loans is the clearest evidence yet that assumption is being tested in real time, not in some theoretical downturn still years away.
A container ship sank in the Strait of Hormuz on Wednesday as Iran escalated its attacks on commercial vessels.
The GFS Pride, registered in Singapore, sank after it was struck by an unidentified projectile and caught fire. The ship's 21 crew members were safely evacuated and no injuries were reported, according to the
Maritime and Port Authority of Singapore
.
"Such attacks are unprovoked, unjustifiable and a breach of international law," the Singapore maritime authority said in a statement Wednesday.
Containers were floating in the water after the vessel sank, Pakistani maritime authorities warned in a
navigational alert
.
A second Singapore-registered container ship, the GFS Giselle, sustained damage to its hull after it was hit by an unidentified projectile on Wednesday. The ship has arrived at safe anchorage and none of its crew were hurt, the Singapore maritime authority said.
Iran's Revolutionary Guard claimed early Wednesday that a container ship exploded and sank after hitting a naval mine, according to the
state news agency Tasnim
. But there is no independent evidence to confirm that a mine is what caused the Pride to sink, according to the maritime security firm Marisks.
Iran's claims are "consistent with an ongoing psychological operations campaign aimed at generating fear, increasing uncertainty and discouraging commercial shipping" in Hormuz, Marisks said in a security alert.
Iran has escalated its strikes on commercial ships transiting Hormuz in recent weeks, as it tries to choke off a rebound in crude oil exports through the strait.
More than 20 vessels, mostly oil tankers, have come under attack this month in Hormuz, the Persian Gulf and Gulf of Oman, according to incident reports from the United Kingdom Maritime Trade Operations Centre.
The attacks this month have left two sailors missing and 12 injured, according to the International Maritime Organization, a United Nations' agency.
Crude oil exports through Hormuz hit prewar levels in September as the U.S. military guided tankers through the strait, but shipments have since pulled back as attacks have increased.
Exports through Hormuz averaged 8.5 million barrels per day (bpd) in the week ended Oct. 12, nearly 40% below normal levels before the Iran war, according to
data from Kpler
.
Shipments from the Middle East, including pipelines to the Gulf of Oman and Red Sea, stood at 14 million bpd, or nearly 20% below prewar levels, the data showed.
Daily crude flows are very volatile, with only 3 million barrels of crude transiting Hormuz on Monday while 6 million barrels passed through the strait on Friday, according to Kpler.
America Didn't Lose Its Rare Earth Industry. It Sold It
In October 2025, Beijing imposed sweeping controls on its rare earth exports. Since then, those controls have been suspended
one short reprieve at a time
, in the latest instance
until Nov. 10
, with a broader trade truce
through Jan. 10, 2027
. The reprieves have repeatedly come only after American concessions, demonstrating China’s leverage in the export fight.
Yet China has constricted sales even during the truce, as buyers have few options but to take what they can get. In June, with the suspension in force, Beijing placed MP Materials and USA Rare Earth, the two companies the U.S. is counting on to build an alternative supply to China, on an
export control list
.
Washington’s effort to rebuild the supply chain, meanwhile, has not yet reached the scale or durability the problem requires. With
up to $100 billion in loan authority
specifically earmarked for critical minerals in the One Big Beautiful Bill Act, the capital undoubtedly exists. What is missing is alignment of interests among the parties that would supply and benefit from it, and a political system patient enough to hold a course for the decade or more that rebuilding a supply chain takes.
This article’s authors work at the intersection of finance and national security. Between the three of us, we have watched the same on-again, off-again rhythm play out in both Chinese statecraft and U.S. budget fights. A consistent pattern plays out: Capital markets are good at financing efficient supply but are not good at financing a binary outcome, such as insurance against a monopoly state seller that can manipulate both price and availability. And subsidies alone will not close that gap. We have seen firsthand that what the U.S. government has to offer right now insufficiently incentivizes private investors, because its tools are market tools deployed in an environment of market failure. Instead, we propose a financing instrument that could clear both economic and political hurdles: a contingent convertible security that converts into ownership if Beijing weaponizes supply.
Rare Earths Are a Market Failure
The history of how we got here is well known, but worth retelling briefly. The Chinese Communist Party inherited its strategic focus on building industrial capacity from the Soviet Union. In 1964,
Deng Xiaoping inspected an iron ore mine
near the Mongolian border holding the world’s largest rare earth deposit. He ordered the engineers to develop steel and rare earths alike. Since then, as technologies have increasingly relied on specialized materials, the Chinese Communist Party under successive leaders has deliberately invested in and consolidated control over the rare earths industry. China refines more than 90 percent of the world’s rare earths and close to 99 percent of heavy rare earths today. It processes nearly all the heavy elements that go into precision-guided weapons and advanced chips.
When Beijing tightened export controls in October 2025, Treasury Secretary
Scott Bessent
characterized it as “pointing a bazooka at the supply chains and industrial base of the entire free world.” Remarkably, the entire market for rare earth oxides is worth less than $10 billion. That a $10 billion market can grind to a halt trillions in global gross domestic product is the definition of a chokepoint. Beijing
controls this chokepoint
today by design. Decades of state policy work laid the groundwork for the Chinese Communist Party to enact an international licensing system by 2025. General Secretary Xi Jinping himself
openly speaks
about the importance of maintaining global dependency on China’s industrial supply chains.
Hindsight treats this as neglect, something policymakers lost sight of and let slip during the U.S.’s unipolar moment. That is a necessary, but only partial, explanation. The truth is the United States did not lose its rare earth industry due to carelessness. Private American companies willingly sold it, for reasons that made perfect economic sense at the time and still do. China bought it for reasons that were never purely economic. That mismatch explains why, after years of investment and policy attention, the dependency remains.
Until the late 1980s, the United States was the world’s leading producer and refiner of rare earths. But it was a dirty business: The Mountain Pass mine in California
leaked roughly 600,000 gallons
of radioactive and other waste into the Mojave. As cleanup and regulatory costs mounted and profits fell, the mine shut down in stages starting in the 1990s until it was fully idle by 2002. Meanwhile, the work moved to China, where the state subsidized unprofitable operations, tolerated pollution, and sold the processed oxides back to the U.S. at rock-bottom prices.
The same thing happened to the magnets: In 1995,
General Motors sold Magnequench
, its magnet unit, to a Chinese-backed consortium. By 2006, the last U.S. plant had closed, and the machine tools and equipment had been shipped to China. Economists would say this was the right move for a free market economy. Comparative advantage did what it was supposed to do, and a dirty, low-margin business left a wealthy country for a developing one. There was even a strategic rationale: Drawing China into the trading system, the wishful thinking went, would also make it a responsible stakeholder rather than a rival.
The category error was to conceive rare earths as a market, rather than recognizing it as a geostrategic industry. A market solves for the lowest cost. To be sure, Chinese producers competed on cost, and they rode a tech boom with surging demand for their product. But a state will pay almost any price to control a chokepoint, because tolerating a money-losing business pales in comparison to the geopolitical leverage that it brings. Over time, China has become less market driven, not more. Meanwhile, the U.S. continued to treat as a market what the Chinese Communist Party came to appreciate as a strategic program.
Control over the chokepoint gives Beijing a switch. When it lets the material flow, no private interest will build alternative supply chains at scale, because Chinese state-funded producers can sell at or below cost indefinitely, and no rational private investor will willingly sign up to lose money. When China cuts off the flow, the incentives reverse overnight, but capacity cannot follow overnight, because standing up the full supply chain and rebuilding the lost know-how can take a decade or longer.
This is classic market failure in which the same critical material can become worthless or priceless on command. In 2010, during a maritime dispute with Japan,
Beijing reportedly halted rare earth shipments
, and Tokyo quickly conceded. The short-term truces of the past year, each struck around contentious but episodic trade disputes, further entrench that market failure. Each successive loosening and tightening seems designed to keep the United States and its allies off balance and frustrate any long-term plan to reduce Beijing’s leverage.
Government Money Has to Survive Politics
If the market will not rebuild the rare earths supply chain, the government must do so.
Administrations under both parties have tried, and their attempts have run into a predictable morass of misaligned interests. The parties to government financing all want different things. Private investors want attractive returns in fat years, while having the government carry losses in lean ones. Commercial lenders want years of fully contracted offtake to guarantee interest payments, while Congress typically appropriates money for the next year. Markets want flexibility while Congress wants tight oversight and guardrails. Washington often wants to be the last (and lightest) money in, which signals to investors that the government is hedging. And cheap, open-ended financing is exactly the wrong signal to send to management teams.
The Pentagon’s latest playbook acknowledges that the market, left to its own devices, simply will not finance uneconomic redundancy. As a result, the
July 2025 deal with MP Materials
includes $400 million in convertible preferred stock, loans, equity warrants, a 10-year guaranteed price floor, and a 10-year offtake commitment. The deal was right for its moment, as it gets the producer going and sustains it while Beijing floods the market. But the deal blurs two different roles: In ordinary years, the government is a lender, financing capacity the market will not; in a crisis, it has insured against a geopolitical event. These two roles call for two different return profiles. Because the deal does not separate them, it puts the government in the unenviable position of simultaneously absorbing losses and inviting the charge of nationalization, all without a clear exit strategy.
Without some structure to navigate potentially painful political costs, these financing arrangements will come under pressure during budget cycles and electoral turnover. And that is simply untenable, because when it comes to the decade-plus timeline to stand up a rare earths supply chain, whatever Washington builds must outlast the administration that built it.
A Financial Instrument That Responds to Beijing’s Behavior
Our proposal is a financial instrument that aligns these interests. In financial parlance, the instrument is called a contingent convertible security, also known as a CoCo bond, issued by the producer to the government and any private lenders who wish to join, paired with guaranteed offtake at a price floor. Its form changes with two externally observable conditions: the producer’s capacity build-out and Beijing’s behavior.
Here’s how it works. In its starting form (and in quiet years), a CoCo bond is a simple loan paying interest. Two triggers change its form. The first is capacity. The producer must cross a defined capacity threshold by a fixed date. Capacity can be measured as units of output in mining, refining, or manufacturing critical minerals. Management’s immediate incentives should be tied to the build-out itself.
The second trigger is either a sustained breach of an agreed price band or an externally observed exercise of the chokepoint. This could be denial of export licenses, a bureaucratic delay beyond a specified period, or another form of “constructive denial” that materially interrupts supply to the United States or allied countries. Importantly, no part of this trigger should rely on Beijing’s confirmation, because it is not incentivized to admit to a cutoff. The trigger should be narrow enough that it cannot be declared for political convenience, but broad enough that an adversary cannot game it simply by changing the form of the restriction.
When the first trigger fires, the lender receives a pro rata share of the producer’s free cash flow, in effect, a dividend. The lender paid to build the capacity, so it shares in what that capacity earns. When both triggers fire, the lender also gains the right to convert into common equity. The conversion event does not create new capacity—the financing has already done that work—but rather matches the payoff to the risk. If lenders financed years of otherwise uneconomic capacity because a cutoff might someday make it necessary, they share in the upside if and when the cutoff comes. The cash participation matters too: In a crisis, the market may treat a price spike as temporary and event-driven and not value the equity, but the spike still flows through the producer’s cash flow, which benefits the lender either way.
Why would a producer agree to this? Because it gets something unique that the market will not otherwise provide. In effect, the producer buys a put—the price floor that carries it through Beijing’s dumping—and pays for it by selling a call—the cash share and the conversion right. It trades some of the windfall in a crisis for the protection of surviving quiet years. Either way, the taxpayer is paid for the risk actually borne, when it is borne, rather than for a risk merely feared.
Nor does the government have to finance the entire CoCo bond. Pre-vetted private co-investors, including foreign co-investors subject to Committee on Foreign Investment in the United States (CFIUS) screening, can offset government money dollar-for-dollar. Ideally, co-investors should be firms that fear a cutoff the most, such as defense contractors and automakers. Private co-investors would receive a pro rata right to offtake as a further incentive and could potentially even trade the bond with its associated offtake rights with other investors. Japan’s JARE consortium did something similar when it financed
Australia’s Lynas in return for supply
. Finally, private holders also give the program a constituency that outlasts any single administration.
Neither Nationalization nor Welfare
This instrument compensates for the asymmetric risk a lender (whether taxpayer or private) assumes when countering an adversary-controlled chokepoint, by providing an asymmetric reward if that chokepoint is ever exercised.
The risk here is not from a natural shortage or an ordinary price cycle, but from the Chinese Communist Party’s policy decisions. The same logic reaches other chokepoint materials such as pharmaceutical precursors. Rare earths are the clearest case and, at under $10 billion in market size, the cheapest place for the U.S. government to start. And it can start under existing authorities. For example, the Pentagon has leaned on Title III of the Defense Production Act for
its recent mineral deals
involving equity. The Pentagon’s Office of Strategic Capital can lend, but its equity authority remains unclear.
The Senate is currently revising
the National Defense Authorization Act for 2027 to clarify those authorities. Its language should cover instruments like this CoCo bond.
Our CoCo bond proposal does not replace stockpiles, price floors, or offtake agreements. These instruments solve significant but different problems. Stockpiles buy time in a crisis, price floors protect producers against predatory pricing, and offtake agreements guarantee demand. The CoCo bond, in contrast, distributes risk and reward to investors in a binary, geopolitical event outside the producer’s control. It also enables the government to lend as a portfolio—some developers will fail, but the winners, and any crisis, can carry the portfolio as a whole. And it may have some deterrent effect as well: If this instrument makes capacity more likely to get built, and that prospect enters Beijing’s risk calculus, so much the better.
Economically, the conversion right works like the
equity
warrants
the Pentagon took in MP Materials
. The difference lies in the quiet years, when under this structure the government holds no equity. Outright equity stakes invite the charge of nationalization; cheap financing with no upside smacks of corporate welfare. We believe a structure that is intentionally designed to avoid both at the outset—but flexible enough to change form in response to an adversary’s actions, not domestic political developments—has the best chance of surviving enough political cycles to complete a decade-plus build-out.
* * *
Translating this concept into reality raises important implementation questions about statutory authority, precise trigger definitions, CFIUS integration, and corporate governance. We offer the CoCo bond model to stimulate discussions around aligning interests in a market failure and national security context, and we invite the legal, policy, and financial communities to help refine the “plumbing” necessary to make asymmetric financing a workable pillar of U.S. statecraft.
A market will always sell a chokepoint to whoever runs it cheapest, and by market logic, it would be the right thing to do. Subsidies alone cannot win it back, because they only affect price; Beijing prices for geopolitical leverage, not profit. Neutralizing a chokepoint created through market failure requires capital willing to absorb years of subpar returns or even losses against an extraordinary geopolitical crisis. In quiet years, the government should earn like a lender, with the price floor protecting against Beijing’s dumping. When capacity is built, it should share in what it financed. And if Beijing ever reaches for the switch, the taxpayers and private investors who paid to insure against that moment should participate in the value their capital created. The risk is asymmetric. The financing should be too.
Neckbeard – a DevOps/platform/SRE plugin for your agent
The neckbeard handles your infra so you don't have to.
A plugin for your coding agent that turns an app into reviewable cloud
infrastructure and a monthly cost estimate.
AWS, GCP, or Azure; GitHub Actions
or GitLab CI; serverless containers or Kubernetes — rendered from a bundled
catalog of tested OpenTofu modules. The agent reads your app and explains; the
planning, rendering, and validation are deterministic code.
The agent never
invents infrastructure.
Then, in your app's repo:
/neckbeard:analyze
. Your first
/neckbeard:
command installs the
small
neckbeard
CLI the plugin drives (a sha256-verified release binary, or
go install
when Go is present) — nothing else to set up. Cost estimates and
static validation use tools you may already have (Infracost, OpenTofu, Checkov);
/neckbeard:doctor
tells you which are missing and what each unlocks.
you: /neckbeard:analyze
agent: reads your repo → evidence-backed profile → asks what code can't tell it
you: answer the questions, pick a cloud and a tier
you: /neckbeard:estimate
agent: plans against the catalog → "$77/mo expected — here's the table, and
here's what Infracost can't price"
you: /neckbeard:sync
agent: scaffold → validate → "V0 PASSED; V1/V2 NOT EXERCISED; next step is
docs/bootstrap.md"
you: review the files like any PR; follow the runbook per environment
Commands
Command
What it does
/neckbeard:analyze
Reads the repo into an evidence-backed
app-profile.yaml
(facts with file:line, inferences with confidence, loud assumptions), asks the open questions, proposes
neckbeard.yaml
.
/neckbeard:estimate [comparison]
Plans against the module catalog and shows the monthly cost table — low/expected/high per environment, usage assumptions, and every unpriced resource — before anything exists.
serverless vs kubernetes
or
solo vs smallteam
runs both.
/neckbeard:sync
The loop: plan → estimate → scaffold → validate, under the ownership contract (your edits are never silently overwritten). Ends with PASSED / FAILED / NOT EXERCISED.
/neckbeard:doctor [plan|estimate|validate|all]
Installs the CLI if missing; reports which prerequisites are present and what each unlocks.
/neckbeard:help
The quick reference.
Why this exists
Coding agents are good at app code and bad at freehanding infrastructure. The
failure mode is always the same: plausible-looking HCL that is subtly broken,
insecure by default, and unestimable. neckbeard inverts the roles:
Humans maintain the golden path
— versioned OpenTofu modules, pipeline
templates, GitOps layouts, per cloud, tested in CI on every change.
The agent analyzes, parameterizes, and explains.
It reads your app,
figures out what it needs, and maps that onto catalog inputs — with evidence
for every claim it makes.
Everything in between is deterministic.
Same inputs, same bytes: the
planner emits a hash-verified
blueprint.yaml
lockfile, the renderer is a
pure function of it, and regeneration never silently overwrites your edits.
Needs the catalog can't express become named findings ("redis is outside the
workload contract"), not force-fits onto the nearest module.
The part nobody else tells you: what it costs
The same reference app (HTTP service + worker + cron + Postgres), smallest
tier, all three environments, live prices via Infracost:
Cloud Run
Container Apps
ECS Fargate
EKS
GKE (regional)
AKS
monthly
$77
~$98*
$250
$396
$754
~$801*
* Infracost can't price Container Apps compute yet — and instead of letting a
low number lie, the report
names every unpriced resource
. That's the house
style: baseline-while-idle costs, explicit usage assumptions you can edit,
low/expected/high scenarios, and a provenance footer. It also prices your
decisions
: this table is why neckbeard tells solo developers "you don't need
Kubernetes yet" — with receipts.
Honesty as architecture
Infrastructure tools love implying more than they've proven. neckbeard reports
in three verdicts, and the third one is the point:
V0 PASSED tofu validate [prd]
V0 PASSED checkov policy [prd] ← every skip carries a written reason
V0 PASSED kubeconform (clusters/)
V1 NOT EXERCISED authenticated plan requires cloud credentials
V2 NOT EXERCISED deployment verification requires cloud credentials
Static validation
never claims deployability
. V0/V1/V2 are distinct
levels, each reported as exercised or not.
Every Checkov skip in the generated
.checkov.yaml
states its reason. A
skip without a reason is a lie about your security posture.
When live runs break, the failures become public
findings
and then catalog fixes. Our first real deployment
produced ten; five became fixes the same day.
Degraded paths say why (Azure + GitLab merge-request plans can't federate —
the pipeline says so instead of failing mysteriously).
What you get
Three isolated environments
(dev/stg/prd) with independent state, sized
by tier presets over explicit dimensions: traffic, availability, RPO/RTO,
operating capacity. Every value is visible and overridable within the
catalog's tested envelope; values outside it are
marked
, not blessed.
Two runtimes per cloud
: serverless containers (Cloud Run / ECS Fargate /
Container Apps) or Kubernetes (EKS / GKE / AKS) with Flux manifests.
CI/CD for GitHub Actions or GitLab CI
from one model: test → build →
scan (trivy blocks HIGH/CRITICAL) → push; infra plans on PRs with a
read-only identity, applies on main with a write identity, production gated
by environment protection.
Zero static cloud keys
— OIDC federation
everywhere, enforced by a test that fails if a rendered pipeline ever
mentions
AWS_SECRET_ACCESS_KEY
.
Security posture as explicit controls
: private-by-default networks,
secret managers holding
names
the operator fills (values never touch
neckbeard, its state, or your git history), scoped CI identities, managed
WAF rules where the tier enables them.
A bootstrap runbook
(
docs/bootstrap.md
) that walks a human with
elevated credentials through state backend → OIDC trust → CI identities, per
environment. Everything after
validate
is deliberately human-in-the-loop.
The supported workload is
one image, up to 10 HTTP/worker/cron processes,
Postgres, object storage, secrets
, deployed into existing accounts, projects,
or subscriptions. Anything else is an explicit
unsupported
finding.
Status: pre-alpha, and precise about it
What is proven, and how:
Claim
Evidence
analyze → plan → estimate → scaffold → validate on all 12 cloud × VCS × runtime paths
Static matrix runs in CI on every PR; three unrelated fixture apps onboard end to end
Live deploy → update → rollback, serverless
Passed on AWS/GitHub and Azure/GitHub with real database checks (
evidence
)
Live deploy on GCP, GitLab lanes, Kubernetes, promotion, recovery drills
Not yet.
Implemented, NOT EXERCISED
The plugin's product today is the onboarding half: reviewable infrastructure,
pipelines, a cost estimate, and a bootstrap runbook you can hand to a human.
The deployment lifecycle (
neckbeard release …
, documented in the skill) is
experimental and tracked gate by gate in the
launch plan
.
Do not treat static validation as deployment proof. Landing zones (org
structure, guardrails — Path F in
DESIGN.md
) are designed, not built.
The repository root is the plugin:
skills/neckbeard/SKILL.md
is the agent's operating manual,
commands/
are the slash
commands, and the Go CLI under
cmd/
with the module catalog
under
catalog/
is the deterministic half. The CLI also drives
everything without an agent:
go install github.com/bealesh/neckbeard/cmd/neckbeard@latest
neckbeard analyze &&$EDITOR app-profile.yaml neckbeard.yaml
neckbeard plan && neckbeard estimate && neckbeard scaffold && neckbeard validate
Cyber experts say AI labs’ containment and monitoring failures — not agents with minds of their own — are to blame for recent alarming hacking reports. CISOs should vet their AI vendors and tighten security basics as safeguards.
Since July, US frontier AI labs and other AI leaders have revealed a string of incidents in which their models accessed external computer systems without authorization, events popularly described as AI agents “going rogue.”
The most well-known and studied of these incidents is
OpenAI’s hack
into Hugging Face, which OpenAI initially characterized as “an unprecedented cyber incident, involving state-of-the-art cyber capabilities,” and later said was due to “misaligned behavior,” or behavior its creators did not intend.
Following news of the Hugging Face incident, Anthropic
revealed
that one of its models gained unauthorized access to the production infrastructure of three organizations; Meta said one of its AI models hacked another company during cybersecurity testing; and Google
confessed
that its Gemini model carried out three “undirected computer hacks.”
Although press reports and the model providers themselves use language such as rogue agents or misalignment, cybersecurity experts who spoke with CSO argue that language obscures a simple truth: These incidents were caused by inexcusable failures by the frontier labs to implement cybersecurity practices that have been well-known for decades.
Compounding the problem, according to a half dozen cybersecurity experts CSO interviewed at three industry conferences in September and in subsequent conversations, is that the frontier labs, particularly OpenAI and Anthropic, have rejected their advice on how to improve their cybersecurity risk management practices to avoid these kinds of surreptitious hacks, often lumping cybersecurity practices under “AI safety,” in which they believe they have superior expertise.
“They are not as good as they think they are, honestly,” Gary McGraw, co-founder of the Berryville Institute of Machine Learning, tells CSO. “It would be better if they had more respect for expertise that is hard-earned from people in all sorts of subsets of security, like forensics or security engineering, building sandboxes, setting up or monitoring network security situations.”
Neither Anthropic nor OpenAI responded to CSO’s requests for comment.
Inexcusable failures on cybersecurity basics, particularly containment
According to the cybersecurity professionals CSO spoke with, one of the biggest cybersecurity failures by the frontier AI labs is the lack of implementation of tried-and-true containment practices that stretch back to the 1990s, such as setting up secure sandboxes that would effectively bar agents from escaping their test environments.
“These are things that we’ve been dealing with for years,” Rob T. Lee, chief AI officer and chief of research at SANS Institute, tells CSO. “There’s no reason why every single time this happens, it’s, ‘Oops, we don’t know how they got out.’”
“You can tell that their security teams are fairly nascent,” Lee says. “Folks on the cybersecurity containment side do argue that the majority of reasons that we’re seeing containment breached is that it’s not set up correctly.”
Lee adds, “The Hugging Face incident definitively showed that it wasn’t the fact that the agents were super smart. It’s that there literally was a hole that was exploited because it was not configured correctly on the containment side.”
Dan Wallach, expert technical resident at RAND’s Center on AI, Security, and Technology, thinks the security failures of the AI labs boil down to the fact that they don’t prioritize cybersecurity.
“I would say they are not prioritizing cybersecurity,” he tells CSO. “I don’t think I can say that for all of the labs,” Wallach says, pointing to French AI lab Mistral’s
launch
of its Large 4 AI model, which the company said tried to operate beyond its testing environment before Mistral cut it off.
And, he adds, “It’s not rocket science to isolate one of these AI things. Security people have been talking about how to do either air-gapping, so there’s literally no electrical way for data to get from here to here, or absent that, to have really strong egress control to make sure that nothing pushes through.”
On top of that, the frontier labs appear to be conducting insufficient monitoring of their agents’ behavior. The Hugging Face incident “went on for days, and nobody noticed,” Wallach says. “People started these experiments and weren’t watching them. That’s an absence of control. And then they’re surprised by what happened.”
Divorcing safety from security
One barrier to persuading frontier labs to up their security game is the intense focus they have on what they call “safety,” which they don’t extend to traditional cybersecurity practices.
“I can see how security behavior looks like AI safety,” RAND’s Wallach says. “But if the way that you’re evaluating this AI tool is by unleashing it on the internet and seeing what happens, then this is what classical security tooling is for.”
SANS Institute’s Lee says, “If these frontier labs really wanted to test their stuff, they need to beef up their cybersecurity component. But their gut reaction in the response to their agents getting out is to say, ‘It’s not a cybersecurity problem.’ It has literally become an AI safety problem, which is divorced from the cybersecurity side.”
Many AI experts suggest that if the AI companies were to embrace advice from cybersecurity specialists, it could help put an end to the kind of unrestrained AI agent behavior causing concerns. “AI safety focuses on the rules of the road,” Lee says. “Everything is about guardrail rules.”
But “I do believe cybersecurity can contain AI,” he says. “We just need to be in the room where it happens and have a seat at the table. It’s important for our field to be as close to the AI safety folks as possible.”
Bad cybersecurity could increase liability
If frontier labs are overlooking cybersecurity fundamentals that could reduce or eliminate the types of incidents that have created widespread concerns, that strengthens the case that they should be held liable for their “rogue” agents. The insurance industry is already lining up on the side of
holding AI industry executives liable
for these actions.
Democratic Senators have
introduced legislation
that would hold AI agent operators liable for hacking incidents. Even the AI-friendly White House has seemingly concluded that the companies should be
held liable
for their errant agents, while the US Federal Trade Commission
is conducting
a probe into Anthropic, OpenAI, and other AI labs into the dangers their technologies pose to consumers.
However, in recent legislative and council hearings, lab representatives
have held fast
to the notion that they are not responsible for AI agents run amok.
Experts say this position is untenable, particularly in light of the labs’ cybersecurity failures.
BIML’s McGraw characterizes the labs’ position as: “Don’t send the lawyers to us, send it to our program. It’s our program’s fault.” His assessment of that argument: “That’s just high BS.”
He also questions whether the labs’ operational failures undermine confidence in their broader security capabilities. “They live inside their own bubble,” he says. “The fact that they cannot do clear, easy operations properly does not bode well for their capabilities in security engineering, which is much harder to do.”
SANS Lee says, “That’s where the traceability for both liability and insurance comes into play, because if one of these agents is detected, and they’re able to trace it back to the person that initiated it, liability’s going to kick in and say, ‘Hey, you, you broke the law, ergo, we need to prosecute.’”
What security leaders should do now
Even as evidence mounts that frontier labs are not implementing sound cybersecurity practices, and the
debate over liability remains unsolved
, CISOs and other security leaders can take steps to protect themselves from AI model misfires.
First, when it comes to assessing tools based on frontier lab models, “I would always get an external entity to help with that,” McGraw says. “AI is extremely powerful and extremely useful, but it comes with very serious grown-up risks that do impact the enterprise. Identify those risks, put in the right controls, make sure that AI adoption is not just arbitrary and willy-nilly and all over the enterprise, but has some centralized authority that is looking at the problem, and then get ready for the next big thing, which is swarms of agents.”
For Lee, the best protection is to ask the right questions. “It starts with asking the right questions and then finding the tools and capabilities for those [AI labs] that are able to demonstrate a higher level of cybersecurity competency,” he says. “You’re really looking for the people on the teams that are dealing with really hard problems.”
But fundamentally, the best preparation to deal with AI model cyber weaknesses is to make sure all the
long-standing cybersecurity risk management practices are in place
across the organization. “This is the least exciting part of the discussion,” Wallach says. “It’s the cyber version of ‘eat your vegetables.’”
“We need to re-engineer our software so it has better security,” he adds. “We need to have multi-factor authentication on all of our accounts. We need to eat our vegetables from a defensive cyber perspective. And we know how to do it.”
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Bleeping Computer
www.bleepingcomputer.com
2026-10-14 13:29:14
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]...
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.
Tracked as CVE-2026-76519, this vulnerability stems from a relative path traversal weakness in SEG's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. Threat actors can exploit this issue by sending an email with a maliciously crafted attachment through an unpatched device.
"A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system," Cisco said in a
Wednesday advisory
. "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."
CVE-2026-76519 affects SEG instances where the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.
To determine whether a specific device is vulnerable, admins have to use the contentscannerstatus CLI command to check what version of Content Scanner Tools is running and inspect the "Enable File Reputation" checkbox under Mail Policies > Incoming Mail Policies > Advanced Malware Protection or Mail Policies > Outgoing Mail Policies > Advanced Malware Protection in the web-based management interface.
While the company didn't share further details about attacks exploiting the CVE-2026-76519 flaw, it shared the indicators of compromise (IOCs) in the table embedded below.
Log Message
Recommended Action
System Security: Suspected compromise indicator was found. Contact TAC for further recommendations.
Compromise detected. Follow the instructions in the
Recommendations
section of this Security Advisory
System Security: Security scan did not complete. Contact TAC for further recommendations.
Contact the Cisco Technical Assistance Center (TAC) for further support.
System Security: No compromise indicator was found.
No compromise detected. Upgrade to a fixed software release if applicable
Cisco also warned customers to cross-check firewall and network logs for signs of suspicious activity (including downloads and uploads to and from external or suspicious IP addresses) because attackers may remove evidence of exploitation after gaining root-level command execution on vulnerable systems.
The company added that it has already deployed mitigations on cloud instances and contacted Cisco Secure Email Cloud device owners where it found evidence of a potential compromise.
"Cisco strongly recommends that customers who have been contacted restore a device to a secure configuration by renewing credentials and any cryptographic materials that are installed on the appliance, when possible. In addition, Cisco strongly recommends restricting access to the appliance and implementing robust access control mechanisms," it said.
Cisco
addressed another critical SEG vulnerability
(CVE-2024-20401) in July 2024 that lets attackers add new users with root privileges or permanently crash appliances using emails with malicious attachments.
More recently, last month, Cisco warned customers to
patch a new actively exploited SEG zero-day
(CVE-2026-76461) in the email parsing of Cisco AsyncOS Software that also lets unauthenticated, remote attackers execute arbitrary commands with root privileges on the underlying OS.
Since November 2021, the Cybersecurity and Infrastructure Security Agency (CISA) has
added 100 Cisco vulnerabilities
to its catalog of actively exploited flaws, seven of which have been abused in ransomware attacks.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Pull up to Cleo's Sidewalk Chalupas Stand in Corona and Get Ready to Swoon
hellgate
hellgatenyc.com
2026-10-14 13:02:21
A stack of Cleotilde Juárez Ramírez's chalupas will be one of the best things you eat this year, I can promise you that. Chalupas Poblanas El Tlecuile is not a secret. The sidewalk operation, run by Cleotilde Juárez Ramírez...
A stack of Cleotilde Juárez Ramírez's chalupas will be one of the best things you eat this year, I can promise you that.
Chalupas Poblanas El Tlecuile is not a secret. The sidewalk operation, run by Cleotilde Juárez Ramírez (she goes by "just Cleo") and assisted by a rotating crew of family members, has been earning high-profile accolades since she first set up shop on the Jackson Heights-Corona border during the early pandemic. Most notably: the modest stand, with basically one dish on the menu, landed on the
100 Best Restaurants
list in the New York Times last spring.
And rightfully so! I guarantee a stack of these chalupas will be one of the best things you'll eat all year. Amazingly though, for one lame reason or another, I hadn't gotten around to trying Cleo's creations until a couple of weeks ago, first at
the Infatuation's Eeeeeastcon food festival
, and then again just a few days later, when I rode the 7 train to Junction Boulevard, found her charcoal-burning tlecuile in front of an empty storefront on 37th Avenue, and, standing on the sidewalk, leaning over to avoid saucing up my shirt, gleefully knocked back as many of these beauties as I could handle.
Cleo making the magic happen. (Scott Lynch / Hell Gate)
A stack of Cleotilde Juárez Ramírez's chalupas will be one of the best things you eat this year, I can promise you that.
Chalupas Poblanas El Tlecuile is not a secret. The sidewalk operation, run by Cleotilde Juárez Ramírez (she goes by "just Cleo") and assisted by a rotating crew of family members, has been earning high-profile accolades since she first set up shop on the Jackson Heights-Corona border during the early pandemic. Most notably: the modest stand, with basically one dish on the menu, landed on the
100 Best Restaurants
list in the New York Times last spring.
And rightfully so! I guarantee a stack of these chalupas will be one of the best things you'll eat all year. Amazingly though, for one lame reason or another, I hadn't gotten around to trying Cleo's creations until a couple of weeks ago, first at
the Infatuation's Eeeeeatscon food festival
, and then again just a few days later, when I rode the 7 train to Junction Boulevard, found her charcoal-burning tlecuile in front of an empty storefront on 37th Avenue, and, standing on the sidewalk, leaning over to avoid saucing up my shirt, gleefully knocked back as many of these beauties as I could handle.
Cleo making the magic happen. (Scott Lynch / Hell Gate)
Infinite inboxes, so nobody ever gets your real address. Give every company its own —
when one leaks, you delete it, not your life.
No card required
Three kinds of inbox
Pick one based on who you're handing the address to.
01 · One-sender
One sender, one address
The first person or company to write claims the address for good. Everyone else is
rejected at the door — so a resold or breached list is worth nothing.
Chase Bank
✓ claimed it
Spamco
✕ bounced
List reseller
✕ bounced
chase@yourname.clova.email
created
24 h
✕ after
3 mails in
then bounced · self-wipes
02 · Temporary
Gone when you're done
Set a lifetime — an hour for a download link, a month for a trial. When it's up the
inbox turns mail away, and can wipe what it holds.
03 · Prefix
Invent one at the counter
Claim a prefix of five characters or more, then anything you add after it already
works — no setup, and no dash needed. Each address still locks to its first sender.
* Limits are 100 messages per day in the Free plan and 1000 in Pro and Business. Limits subject to change.
MCP
Bring your AI assistant
Connect Claude, Cursor or any assistant that speaks MCP, and hand it the inbox chores: a
fresh address for a sign-up, the code that just arrived, every receipt from March. It gets
only the permissions you give it.
Make me an address for the gym trial, and tell me the code they send.
create_inbox · temporary, 30 days
gym-trial@yourname.clova.email
wait_for_message
Your code is
482 913
Privacy & export
Your data is yours
We don't sell it, we don't read it and we don't track you. You can export your entire
dataset at any time, on any plan.
How the three inbox types work together in one mailbox.
Signing in, and your data
Sign in with a Google account, a passkey, or a username and a password. With Google, Clova.Email
receives only your email address, your name and your profile photo: the address is how
we know it is you, and the name and photo fill in your profile, where you can change or
remove them. We never use any of it for advertising, never sell it and never share it.
The whole of it is in our
privacy policy
.
Could AI ‘change the stakes’ in the development of bioweapons?
Guardian
www.theguardian.com
2026-10-14 12:54:43
Experts say the technology could help terrorists and nation states with production but that significant hurdles remain In his annual speech on threats to the nation, Sir Ken McCallum, the head of the UK’s intelligence service, MI5, warned that AI has the potential to “change the stakes” on existing ...
In his annual speech on threats to the nation, Sir Ken McCallum, the head of the UK’s intelligence service,
MI5
, warned that AI has the potential to “change the stakes” on existing and even new bioweapons. Here we look at how AI might help in the development of bioweapons and the hurdles that remain.
How could AI help people make bioweapons?
It depends on who wants to make them. One risk is the rogue, unskilled bad actor or terrorist group that works from a garage laboratory. AI chatbots could help them skill up, by compiling relevant information, planning experiments and troubleshooting problems. It’s likely the work would focus on using existing pathogens and toxins.
The other risk comes from well-resourced organisations and nation states that have plenty of skilled scientists, high containment laboratories and all of the equipment and reagents needed to work on bioweapons safely. AI tools could help researchers identify genetic tweaks to make existing pathogens more lethal, for example. This is the more immediate concern, according to Dr Filippa Lentzos, a reader in science and international security at King’s College London. “Here, AI does not remove the need for expertise, it amplifies expertise that is already there,” she says.
A more distant risk comes from highly skilled groups using AI to design completely new pathogens and toxins that are resistant to drugs or have no antidotes.
Have people tried using AI to make bioweapons?
Last year, police in India uncovered a suspected bioterrorism plot in which a doctor and several others drew on AI chatbot queries and AI-driven search, allegedly to help them make ricin, a deadly toxin, using kitchen tools. It is unclear whether the AI’s responses helped, but other accounts suggest the tools can provide relevant and dangerous information.
The AI company Anthropic raised further concerns in September when it
reported
five cases of scientists in unnamed countries trying to use its Claude chatbot for what may have been dangerous work on viruses or toxins. One red flag, the company said, was that after being blocked, the scientists found workarounds.
In one case, Anthropic said researchers used the chatbot to plan experiments that would introduce mutations in a highly pathogenic bird flu virus to make it adapt and spread more easily in mammals. The work, and the other cases, could signify attempts to make pathogens more dangerous, but such studies are also done in legitimate labs to help researchers spot future pandemics and develop vaccines and drugs to treat disease.
What else has raised concerns?
A flurry of studies has shown how AI tools can provide potentially dangerous information on bioweapons. In a
recent exercise
at MIT, non-science students were tasked to see if they could get an AI chatbot to help them unleash a pandemic. Within an hour, the chatbots listed four potential pandemic pathogens, explained how to make them from synthetic DNA, and supplied names of DNA synthesis companies that were unlikely to screen their orders. It is easier said than done, however.
In another case, the Stanford University researcher Dr David Relman described how an AI explained how to modify a pathogen to make it resistant to treatment. Another scientist revealed that an AI chatbot had explained how to use a weather balloon to release biological weapons from the sky.
The dual-use nature of biological research can make it hard to distinguish valuable work that could protect health from attempts to develop bioweapons. In 2025, scientists at Los Alamos National Laboratory
trained an AI
to predict how exceptionally potent neurotoxins from marine snails latch on to human cells, work that could help in the development of antidotes. But the US government became concerned when Chinese researchers drew on the work to develop their own tool to
design new toxins
. The Chinese researchers said the work was aimed solely at developing drugs.
In April, scientists raised further concerns when they made
the first viruses designed by AI
. The viruses are a particular type that only invade bacteria, and the work could lead to new medicines, but experts warned that it raised “urgent biosafety and biosecurity questions”.
What hurdles make it difficult?
Most work on bioweapons is beyond the reach of unskilled groups: as well as being highly technical, it is extremely dangerous. While AI chatbots might be prompted to give information on bioweapons, a list of instructions is not enough. “Information is only one part of the problem,” says Lentzos. “Tacit expertise, access to biological materials and equipment, experimental validation, scale-up and delivery all remain substantial barriers.”
Sonia Ben Ouagrham-Gormley, deputy director of the biodefense programme at George Mason University in Virginia says tacit knowledge – the unwritten knowhow that an AI is unlikely to help with – has been key in the success of historical state-run bioweapons programmes.
Prof Martin Pačesa at the University of Zurich said access to material was critical. “Any graduate physicist could sketch up plans for a potentially more effective nuclear bomb, but where is he going to get a lump of uranium from? Same for bioweapons. If you have access to material and facilities capable of producing them, then AI is not going to make too much difference if you want to do harm.”
Some AI companies are taking steps to prevent people from using their tools to develop bioweapons, but the majority are not announcing what, if anything, they are doing, says Prof Tom Inglesby, director of the Johns Hopkins Center for Health Security. “We have no formal government policies in place in any country yet to protect against this kind of misuse,” he says.
He wants formal independent evaluations of new AI models before they are released, with any dangers eliminated before the models are made public. And high-risk biological data, such as information on how pathogens might spread more easily, should be restricted. Meanwhile, companies that make genetic material for researchers must screen orders to ensure they are not for the creation of novel, highly dangerous viruses. Some screening already happens, but it is largely voluntary, and can be sidestepped if researchers use AI to design new, harmful genetic sequences that companies are not checking for.
Some of you may remember a famous group of hackers that operated out of a loft (or attic) in Boston, Massachusetts, USA between 1992 and 2000 that called themselves
L0pht Heavy Industries
. Perhaps a defining moment in the group’s history was in May 1998 when they testified before the United States Congress, forewarning about the fragility of the Internet and how it could be shut down in 30 minutes using the Border Gateway Protocol (BGP). Most oldskool hackers will remember them for being some of the first security researchers to practice responsible disclosure of software vulnerabilities via advisories, aswell as maintaining a number of websites like
HackerNews.com
, the
Black Crawling Systems Archives
, the
Whacked Mac Archives
and Guerilla.net.
Like many people, I remember the group for writing
L0phtCrack
, a tool designed to recover passwords protected by the Windows operating system. L0phtCrack was originally published with an advisory almost 22 years ago in
April 1997
. In the year 2000, a now defunct company called @atstake acquired L0pht, including the ownership rights to L0phtCrack. In 2004, Symantec acquired @atstake before discontinuing development and distribution of L0phtCrack in 2005. In 2009, members of the original L0pht group (Zatko, Wysopal, and Rioux) reacquired ownership rights to L0phtCrack and continued with its development up to the present day. Those of you that want to know more about the group can read
History of the L0pht.
This post suggests some ways the L0pht
may
have accelerated recovery of passwords protected by the LanMan (LM) hash that is derived from the Data Encryption Standard (DES). I don’t reveal any
Top Secret
technique for cracking DES that only L0pht or some alphabet agencies know about. Similar optimizations were implemented over twenty years ago by
Alexander Peslyak
and Roman Rusakov in another popular password recovery tool called
John The Ripper
.
2. Data Encryption Standard
DES is a block cipher that operates on plaintext blocks of 64-bits and returns ciphertext blocks of the same size. Each key can be 56-bits in total giving us
(72,057,594,037,927,936), or approximately 72 quadrillion possible keys. A 56-bit key is expanded into 16 subkeys or round keys, each of which is 48-bits long. It has for over 20 years been considered obsolete and insecure, but continues to be used mainly to support legacy systems.
What follows is a list of notable events around initial research into cracking DES, including the LanMan hash derived from DES.
January 1997
Cryptographer
Eli Biham
publishes his paper at Fast Software Encryption 4 titled
A Fast New DES Implementation in Software.
It describes a novel way to optimize the Data Encryption Standard using simple bitwise operations (XOR, AND, NOT, OR). Although unrelated to the development of L0phtCrack, the technique would later be used to optimize attacks against the LanMan hash in tools like
John The Ripper.
January 1997
Rocke Verser launches
DESCHALL
in response to an offer by RSA to crack DES for a $10,000 prize.
March 1997
Samba developer
Jeremy Allison
releases
pwdump.
It enables Administrators to dump LM (derived from DES) and NTLM (derived from MD4) hashes stored in the Security Account Manager (SAM) database on Windows NT.
April 1997
L0phtCrack v1.0 released.
It primarily exploits the poor design of the LanMan algorithm to recover plaintext passwords.
May 1997
Microsoft releases Service Pack 3 for Windows NT that includes “SYSKEY”; an optional component designed to prevent pwdump working properly.
L0phtCrack v2.0 released.
Includes an SMB session network sniffer, a multithreaded brute force algorithm and faster search algorithm for large databases.
May 1998
Matthew Kwan
releases his “bitslice” code based on the paper by Eli Biham.
July 1998
The Electronic Frontier Foundation build a
DES cracker
called “Deep Crack” and recover a 56-bit key in 56 hours using a device that costs $250,000.
January 1999
Deep Crack and distributed.net break a DES key in 22 hours and 15 minutes.
January 1999
L0phtCrack v2.5 released.
The DES routines have been highly optimized in assembler for Pentium, Pentium MMX, Pentium Pro, and Pentium II specific processors. This results in a 450% speed increase. All alphanumeric passwords can be found in under 24 hours on a Pentium II/450.
What I try to focus on in this post is how the L0pht gained a “450% speed increase” over previous versions of the software, but first, how are LanMan hashes created?
3. The LanMan Algorithm
The password is restricted to a maximum of fourteen characters. (null-padded if required)
The password is converted to uppercase.
The password is encoded in the system OEM code page.
The password is split into 7-byte halves and used to create two DES keys.
Each key is used to encrypt the string KGS!@#$% using DES in ECB mode, resulting in two 8-byte ciphertext values. The string “KGS!@#$% could possibly mean
K
ey of
G
len and
S
teve with the combination of Shift + 12345. Glen Zorn and Steve Cobb are the authors of RFC 2433 (Microsoft PPP CHAP Extensions).
The two ciphertext values are concatenated to create a 16-byte value, which is the LM hash.
Using the above details, the following code uses
OpenSSL
to generate a LanMan hash. The only thing missing is the OEM encoding. For that reason, hashes generated by this code will not always match those generated by Windows itself. Internally, Windows originally used the
CharToOem
API before creating a DES key. This is important to remember because some passwords generated by Windows will simply not be recovered unless the cracker uses
CharToOem
or
CharToOemBuff
before hand.
We identify a number of weaknesses here based on the algorithm.
Electronic Code Book (ECB) mode using plaintext that is always the same. Contrast this with
unix crypt3()
that encrypts a nonce/salt resulting in unique ciphertext. As a result of the LanMan algorithm encrypting the same plaintext, passwords seven characters or less will always include
0xAAD3B435B51404EE
in the 16-byte LM hash.
The fourteen character password is used to create two 7-byte or 56-bit DES keys. This means a brute force attack only requires
attempts instead of
Passwords are converted to uppercase, reducing the keyspace to
attempts.
4. Brute Force Attack
Brute force has sometimes been referred to as “dumb mode” because rather than select passwords based on a predefined set of rules, it will simply attempt all possible combinations from a set of numbers and letters, including ones that are unlikely to be used in practice. Passwords should always be easy to recall, and even today it’s unusual for people to pick something that might be difficult to remember later. Having said that, rules are imperfect and sometimes only an exhaustive search of the keyspace will succeed.
The following screenshot is of L0phtcrack 2.5 running inside a virtual machine. As you can see, it averages around 5.64 million tries/keys per second.
The brute force cracker implemented in
lmcrack
is simply to demonstrate the overall gains achieved via simple optimizations and isn’t intended to be used for anything else. Those that want to recover passwords should use a fully functional password cracker.
5. Version 1
The first version is simply using the
OpenSSL
library. L0phtCrack v1.0 and v1.5 both used DES routines from the OpenSSL library.
static bool crack_lm1(void*param){int i;
DES_cblock deskey;
DES_key_schedule ks;
uint8_t pwd[8]={0};constchar ptext[]="KGS!@#$%";
uint8_t ctext[8];
crack_opt_t *c=(crack_opt_t*)param;// initialize passwordfor(i=0;i<7;i++){if(c->pwd_idx[i]==~0UL)break;
pwd[i]= c->alphabet[c->pwd_idx[i]];}// while not stoppedwhile(!c->stopped){// convert password to DES odd parity key
DES_str_to_key(pwd, deskey);// create DES subkeys
DES_set_key(&deskey,&ks);// encrypt plaintext
DES_ecb_encrypt((const_DES_cblock*)ptext,(DES_cblock*)ctext,&ks, DES_ENCRYPT);// increase how many passwords processed
c->complete++;// if hashes match, set found and exit loopif(memcmp(ctext, c->hash.b,8)==0){
c->found=true;return true;}// decrease total tried. if none left, exitif(--c->total_cbn ==0){return false;}// update password index valuesfor(i=0;;i++){// increase one. if not length of alphabet, break.if(++c->pwd_idx[i]!= c->alpha_len){
pwd[i]= c->alphabet[c->pwd_idx[i]];break;}// reset index
c->pwd_idx[i]=0;
pwd[i]= c->alphabet[0];}}// we didn't find itreturn false;}
The screenshot below shows 2.46 million keys per second are tested. It uses no optimization at all, apart from those used by the OpenSSL library.
6. Precomputing Key Schedules 1
The simple design of the DES key schedule algorithm makes both differential and linear attacks easier. That is not to imply the design was simplified to facilitate attacks. It was simplified to implement on 1970s hardware with wiring. The lack of non-linear operations means that no bits in a subkey overlap with another subkey. This allows us to use a bitwise OR / bitwise XOR to combine subkeys and generate completely new ones.
We can generate key schedules for each unique bit of a 56-bit key without requiring a large amount of storage.
DES_init_keys()
will perform this operation and only uses 229,376 bytes of RAM. That’s 256 key schedules (0x00-0xFF) for 7 bytes.
void DES_str_to_key (char str[], uint8_t key[]){int i;
key[0]= str[0]>>1;
key[1]=((str[0]&0x01)<<6)|(str[1]>>2);
key[2]=((str[1]&0x03)<<5)|(str[2]>>3);
key[3]=((str[2]&0x07)<<4)|(str[3]>>4);
key[4]=((str[3]&0x0F)<<3)|(str[4]>>5);
key[5]=((str[4]&0x1F)<<2)|(str[5]>>6);
key[6]=((str[5]&0x3F)<<1)|(str[6]>>7);
key[7]= str[6]&0x7F;for(i =0;i <8;i++){
key[i]=(key[i]<<1);}
DES_set_odd_parity ((DES_cblock*)key);}// initialize 7*256 key schedulesvoid DES_init_keys(DES_key_schedule ks_tbl[7][256]){
DES_cblock key;int i, j;char pwd[8];memset(pwd,0,sizeof(pwd));// for each byte of a 56-bit keyfor(i=0;i<7;i++){// create 256 key schedulesfor(j=0;j<256;j++){
pwd[i]=j;
DES_str_to_key(pwd,(uint8_t*)&key);
DES_set_key(&key,&ks_tbl[i][j]);}// clear byte
pwd[i]=0;}}
DES_set_keyx()
works in the same way
DES_set_key()
does except it uses a precomputed table. As you will see later, this approach is much faster than using the function provided by OpenSSL. We are exploiting the lack of non-linear operations in the key scheduling algorithm and the fact no bits overlap with one another. A bitwise OR is used here, but an XOR will work too.
/ generate DES key schedule from precomputed DES schedules
void DES_set_keyx(DES_cblock*key,
DES_key_schedule *ks, DES_key_schedule ks_tbl[7][256]){
uint64_t *s,*d;
uint8_t *k=(uint8_t*)key;size_t i, j;
d =(uint64_t*)ks;// zero initializefor(i=0; i<128/8; i++)
d[i]=0;// for each byte of a 56-bit keyfor(i=0; i<7; i++){// get a key schedule
s =(uint64_t*)&ks_tbl[i][k[i]];// perform a bitwise ORfor(j=0; j<128/8; j++)
d[j]|= s[j];}}
7. Version 2
This is similar to version 1 with the obvious difference of using precomputed DES schedules.
static bool crack_lm2(void*param){int i;
DES_key_schedule ks;
uint8_t pwd[7+1]={0};constchar ptext[]="KGS!@#$%";
uint8_t ctext[8];
DES_key_schedule ks_tbl[7][256];
crack_opt_t *c=(crack_opt_t*)param;// precompute key schedules
DES_init_keys(ks_tbl);// initialize passwordfor(i=0;i<7;i++){if(c->pwd_idx[i]==~0UL)break;
pwd[i]= c->alphabet[c->pwd_idx[i]];}// while not stoppedwhile(!c->stopped){// create DES subkeys from index values
DES_set_keyx((DES_cblock*)pwd,&ks, ks_tbl);// encrypt plaintext
DES_ecb_encrypt((const_DES_cblock*)ptext,(DES_cblock*)ctext,&ks, DES_ENCRYPT);// increase how many passwords processed
c->complete++;// if hashes match, set found and exit loopif(memcmp(ctext, c->hash.b,8)==0){
c->found=true;return true;}// decrease total tried. if none left, exitif(--c->total_cbn ==0)return false;// update password index valuesfor(i=0;;i++){// increase one. if not length of alphabet, break.if(++c->pwd_idx[i]!= c->alpha_len){
pwd[i]= c->alphabet[c->pwd_idx[i]];break;}// reset index
c->pwd_idx[i]=0;
pwd[i]= c->alphabet[0];}}// we didn't find itreturn false;}
4.44 million keys per second are tested which is a distinct improvement over version 1.
8. Using Macros For The Key Schedule Algorithm
In a brute force attack, we only require changing one byte in the password string for each iteration. However,
DES_set_keyx
will derive a key schedule from all 7 bytes.
DES_init_keys2()
is a new function that will generate DES key schedules using an alphabet and order them in a way that allows us to use macros for creating new key schedules.
// initialize key schedules for alphabetvoid DES_init_keys2(char alphabet[],
DES_key_schedule ks_tbl[7][256]){
DES_cblock key;char pwd[7+1];size_t i, j, alpha_len=strlen(alphabet);memset(pwd,0,sizeof(pwd));// for each byte of a 56-bit keyfor(i=0;i<7;i++){// create key schedules for each character of the alphabetfor(j=0;j<alpha_len;j++){
pwd[i]= alphabet[j];
DES_str_to_key(pwd,(uint8_t*)&key);
DES_set_key(&key,&ks_tbl[i][j]);}// clear byte
pwd[i]=0;}}
The following macros replace
DES_set_keyx
and use vector instructions provded by SSE2 and AVX2 to improve performance.
This really speeds up an attack, but we’re not entirely finished yet.
9. Initial and Final Permutation
So far, we’ve focused primarily on the key scheduling algorithm, but now let’s examine the encryption algorithm and try to reduce the amount of code required for this process.
Before encryption, the 64-bit plaintext is remapped using something known as Initial Permutation (IP). After 16 rounds of encryption have been applied, the inverse known as Final Permutation (FP) is applied. Believe it or not, both IP and FP were made part of the DES specification simply because of how expensive it was to build hardware back in the 1970s. The designers identified an issue with the wiring of hardware after the project was completed and had the choice between building a new hardware device or changing the specification.
It was simply cheaper to change the specification and it’s widely accepted this additional process does not affect security of the cipher in any way. It is akin to a modern block cipher such as NOEKEON or SM4 that converts the plaintext to big-endian on little-endian machines. As you can see from the code below, it requires a lot of operations. By removing the permutation for both the plaintext and ciphertext, there is a significant increase in the speed of recovery.
The plaintext KGS!@#$% in its hexadecimal representation is 0x4B47532140232425. Once the initial permutation has been applied, we end up with 0xAA1907472400B807 that gets loaded into
L
and
R
before applying each round of encryption.
10. Skipping Rounds
We can safely skip the last round of encryption by first checking the result of
L
with half of the LM hash we are trying to crack. If they are equal, only then do we apply the last round and check
R
.
// permuted plaintext
r =0x2400B807; l =0xAA190747;
k =(uint32_t*)&ks[0];// encrypt
DES_F(l, r,0); DES_F(r, l,2);
DES_F(l, r,4); DES_F(r, l,6);
DES_F(l, r,8); DES_F(r, l,10);
DES_F(l, r,12); DES_F(r, l,14);
DES_F(l, r,16); DES_F(r, l,18);
DES_F(l, r,20); DES_F(r, l,22);
DES_F(l, r,24); DES_F(r, l,26);
DES_F(l, r,28);
c->complete++;// do we have one half of the LM hash?if(h[0]== l){// apply the last round
DES_F(r, l,30);// do we have the full hash?if(h[1]== r){// ok, we found the key
c->found = true;return true;}}
11. Version 3
Note how the key schedule buffers are aligned by 32 bytes. This is to enable using AVX2.
static bool crack_lm3(void*param){
uint32_t h[2], l, r, t, u,*k;
DES_key_schedule ks_tbl[7][256] __attribute__ ((aligned(32)));
DES_key_schedule ks[7] __attribute__ ((aligned(32)));
crack_opt_t *c=(crack_opt_t*)param;// precompute key schedules for alphabet
DES_init_keys2(c->alphabet, ks_tbl);// perform initial permutation on ciphertext/hash
h[0]= c->hash.w[0];
h[1]= c->hash.w[1];
IP(h[0], h[1]);
h[0]= ROTATE(h[0],29)&0xffffffffL;
h[1]= ROTATE(h[1],29)&0xffffffffL;// set the initial key schedules based on pwd_idxfor(int i=7; i>0; i--){// if not set, skip itif(c->pwd_idx[i-1]==~0UL)continue;// set key schedule for this index
DES_SET_KEY(i);}gotocompute_lm;do{
DES_SET_KEY(7);do{
DES_SET_KEY(6);do{
DES_SET_KEY(5);do{
DES_SET_KEY(4);do{
DES_SET_KEY(3);do{
DES_SET_KEY(2);do{
DES_SET_KEY(1);compute_lm:// permuted plaintext
r =0x2400B807; l =0xAA190747;
k =(uint32_t*)&ks[0];// encrypt
DES_F(l, r,0); DES_F(r, l,2);
DES_F(l, r,4); DES_F(r, l,6);
DES_F(l, r,8); DES_F(r, l,10);
DES_F(l, r,12); DES_F(r, l,14);
DES_F(l, r,16); DES_F(r, l,18);
DES_F(l, r,20); DES_F(r, l,22);
DES_F(l, r,24); DES_F(r, l,26);
DES_F(l, r,28);
c->complete++;// do we have one half of the LM hash?if(h[0]== l){// apply the last round
DES_F(r, l,30);// do we have the full hash?if(h[1]== r){// ok, we found the key
c->found = true;return true;}}if(--c->total_cbn ==0)return false;if(c->stopped)return false;}while(++c->pwd_idx[0]< c->alpha_len);
c->pwd_idx[0]=0;}while(++c->pwd_idx[1]< c->alpha_len);
c->pwd_idx[1]=0;}while(++c->pwd_idx[2]< c->alpha_len);
c->pwd_idx[2]=0;}while(++c->pwd_idx[3]< c->alpha_len);
c->pwd_idx[3]=0;}while(++c->pwd_idx[4]< c->alpha_len);
c->pwd_idx[4]=0;}while(++c->pwd_idx[5]< c->alpha_len);
c->pwd_idx[5]=0;}while(++c->pwd_idx[6]< c->alpha_len);return false;}
Now we’re talking! Over 3.5 million keys per second more than version 2.
12. Precomputing Key Schedules 2
Our final optimization in C is the precomputation of key schedules for all 2-byte passwords and storing them in memory. For the alphabet A-Z, this requires 86,528 bytes of RAM. 69 characters would require 609,408 bytes of RAM. For devices that perform better with large blocks of memory, one might consider precomputing key schedules for all 3-byte passwords depending on the circumstances. Worst case scenario for 3-byte passwords is around 42MB. I’ve not tried using this amount, but it might be worth researching.
// create key schedules for every two character passwordfor(i=0;i<c->alpha_len;i++){memset(pwd,0,sizeof(pwd));
pwd[0]= c->alphabet[i];for(j=0;j<c->alpha_len;j++){
pwd[1]= c->alphabet[j];
DES_str_to_key((char*)pwd,(uint8_t*)&key);
DES_set_key(&key, p);
p++;}}
The
F
round is also changed to factor in the 2-byte key schedules.
k1
points to the key schedule for bytes 3-7 while
k2
points to the key schedules for every 2-byte combination.
cbn
contains the length of the alphabet squared. For
, that’s
or 676 combinations. By keeping the code inside the CPU cache longer, this helps improve performance.
We see a modest increase in speed for a single thread, but this will make more of a difference in multithreaded mode. This time we have 8.64 million keys per second.
14. Results
Here are all four routines running one after the other using multiple threads.
We achieve a 300% speed increase, but that’s significantly less than the 450% gain advertised by L0phtCrack twenty years ago. The only explanation I can think of at this point is that optimizers for compilers 22 years ago were not as good as they are today. Well written assembler routines would increase the speed further, but not by that much IMHO. What I’ve shown here may not be exactly how the L0pht did it, but i’d say it’s probably close enough.
Trump’s Lincoln Memorial Reflecting Pool renovation should have been an easy lift. But it quickly became a monument to failure.
The post Reflecting on the Trump Era appeared first on The Intercept....
It was dark and cold when I first spotted him, sitting serenely, bathed in soft light. The statue of Abraham Lincoln at his memorial in Washington, D.C., sits 19 feet tall and weighs 120 tons — a white marble monument dedicated to one of the nation’s most intelligent, eloquent, and moral presidents.
I hadn’t come to gaze upon Lincoln but at the reflecting pool that bears his name. It’s been transformed into a different kind of landmark by the inane, inarticulate, and completely immoral man who now holds that same office Lincoln did.
President Donald Trump wants to remake the landscape of Washington D.C., tearing down the East Wing of the White House to build a monstrosity of a ballroom; adding his name to the Kennedy Center or demolishing it if he can’t; and installing a 250-foot-tall “Triumphal Arch” that will “house … large numbers of drones, plus snipers, on both the roof and plaza areas.” This past weekend, the administration even defied a judge’s order and ripped up 430 mature trees at East Potomac Golf Links, a municipal course in southeastern Washington that Trump wants to refashion into a championship-level course, like those of his personal properties.
Trump’s rehabilitation of the Lincoln Memorial Reflecting Pool — planned to be complete for the nation’s 250th birthday on July 4 — should have been the easiest lift of his planned remodel of the nation’s capital. But it quickly became a monument to failure.
Back in April, Trump said adding a bargain-priced “industrial-grade swimming pool topping” in “American flag blue” to the reflecting pool would leave it looking “
gorgeous, beautiful
” and would “last for 40 or 50 years.” Instead, the renovation — awarded via a
no-bid contract
and announced as America 250 festivities on the National Mall approached —
started to fail
within days. This was followed by a bright green algae bloom and finally a catastrophic lining failure that saw Trump’s chosen coating
blister, peel, and then separate
from the concrete.
When I visited, the only water in the iconic national landmark — which Martin Luther King Jr. overlooked as he made his historic 1963 “I Have a Dream” speech — was a stagnant puddle that stretched out toward a mass of rotting leaves, a motley collection of plastic beverage bottles, a silver-and-blue aluminum can of RAIN spring water, and a pair of heavy-duty spray bottles often used for commercial cleaning chemicals.
Nested Failures
What I witnessed was emblematic of a White House far out of its depth and completely overwhelmed by disasters — large and small — of its own making. From Washington, D.C., to the Middle East, the Trump administration has been humiliated. It’s a disaster wrapped in fiascos inside a swirling catastrophe, to riff off Winston Churchill’s
famed line
. These nested failures are legion. The attack on the elementary school in Minab — which killed more than 150 people,
most of them children
— within the larger failure of the Iran war. The extrajudicial
executions
of defenseless,
shipwrecked
survivors within the murderous
boat strike campaign
. The
killings
of
unarmed people
by federal immigration agents and deaths in Immigration and Customs Enforcement
custody
during the larger administration project of
anti-immigrant cruelty
.
The brutal deportation operations have spawned endless wrongdoing:
military occupations
of American cities; the arrest and detention of American citizens, the heartless
expulsions to third countries
; the shootings and beatings of protesters and immigrants, the
targeting
of
Kilmar Abrego Garcia
; the swirl of
corruption
allegations around then-Homeland Security Secretary Kristi Noem; and on and on.
Then there is the debasing of democracy and the undercutting of the rule of law through politicization and weaponization of the Justice Department; turning federal law enforcement into a presidential goon squad; gutting of civil rights protections; targeting of political opponents; relentless attacks on the independent judiciary; executive overreach; and the pardoning or commuting of the
prison sentences of insurrectionists
.
Other scandals and revelations of wrongdoing have been legion: the failure to release the
full
Epstein
files
; the settling of Trump’s lawsuit against the IRS; the floating of the “anti-weaponization”
fund
; the cover-up of the U.S.
death toll
of the Iran war;
Signal-gate
; the $400 million Qatari jumbo jet that turned into a
security
liability;
crypto-grifting
; quid pro quo tariff reductions; brazen
self-dealing
; and reckless actions of the so-called Department of Government Efficiency, which
could result in
more than 14 million preventable deaths globally by 2030 — including approximately 4.5 million deaths of children under 5 — all to save Americans about
17 cents per day
.
The Lincoln Memorial Reflecting Pool is blocked off to the public on Oct. 13, 2026, in Washington, D.C.
Photo: Jacquelyn Martin/AP
A Presidential Crime Scene
The Lincoln Memorial Reflecting Pool — dry and barren behind a bevy of barricades — looked to me like an open-air prison. At its head, the west end by the Lincoln Memorial, several black metal crowd-control fences and a similar lone orange metal barrier guarded two layers of chain-link fencing. The rest of the perimeter was hidden behind a single layer of metal fencing supplied by National Rent-A-Fence.
Some of the fencing — which stretched a little less than a mile — was covered in a dark mesh screen that hid the waterless pool. In other areas, the fabric had fallen or was torn down and lay in unsightly heaps. Closer to the east end, one small section of fence lay on the ground — a crumpled mess of metal mesh, poles akimbo, looking like a victim at a crime scene — behind a wall of yellow tape: 27 crisscrossed strands reading “POLICE LINE DO NOT CROSS.” Beyond that, where the water should have been reflecting the rays of the rising sun, pickup trucks rolled through and workers slowly paced, nodded their heads, and stared out on the hardscape, as if waiting for a factory whistle to sound.
In the face of this fiasco, Trump — as always playing the victim and blaming perceived enemies for his shortcomings — has repeatedly claimed knife-wielding vandals slashed the pool’s liner. Several people, including former Olympian David Hearn, were arrested and charged with felonies and misdemeanors, but those cases
fell apart
. The Interior Department
provided documents
to the U.S. attorney’s office “indicating that damage to the Lincoln Memorial Reflecting Pool in June 2026 was the result of flawed installation by the contractor, Atlantic Industrial Coatings.” The Justice Department also called it a “rushed and botched installation” and in July dropped charges that it had brought against people accused of vandalizing the monument. On October 1, a judge said federal prosecutors
cannot refile charges
against Hearn. But just last week, Trump was still pushing the lies. “We had vandalism there,”
he told the press
. “Only sick people do that, and we have their pictures.”
Not far from Lincoln’s statue, the administration offered up these same excuses, complete with Trump’s “filthy dirty” language and vandalism falsehoods. A lone laminated sheet of paper affixed to the fencing read:
The National Park Service staff and contractors are repairing areas damaged by vandals and completing a historic effort to clean, fix, and beautify the Lincoln Memorial Reflecting Pool. Since 1922, prior administrations have neglected this iconic national landmark, evidenced most recently by more than half of the pool’s pipes being clogged and the sidewalks and granite coping stones being filthy dirty. The Reflecting Pool will remain drained while this work proceeds so that it can truly reflect the beauty, dignity, and grandeur of our nation’s capital.
“Work Won’t Love You Back,” by Sarah Jaffe
Available on
Bookshop.org
Last week, Atlantic Industrial Coatings announced on its website that: “All warranty repairs were completed Friday, 10/2/2026!” The company added: “It has been an honor to serve our great nation!” Trump followed by claiming that the reflecting pool re-do was nearly finished. “I think they’re gonna fill it up this week,”
he said
on October 6. “The Reflecting Pool is totally complete.”
The National Park Service did not respond to numerous detailed questions from The Intercept about the work by Atlantic Industrial Coatings and whether the pipes were completely unclogged and the granite completely clean. Atlantic Industrial Coatings also failed to respond to questions.
On Monday, a new sign appeared on the fencing as water began flowing back into pool. “The Lincoln Memorial Reflecting Pool is being refilled as the National Park Service and contractors put the final touches on a historic effort to clean, repair, and beautify this iconic national landmark,” read a sign without any attribution. It also contained a caveat: “As part of the normal refilling process, the water may temporarily appear cloudy before clearing.”
Whether the Reflecting Pool will again stand as a fitting reflection of “the beauty, dignity, and grandeur of our nation’s capital,” or suffer another catastrophe that leaves it looking like an eyesore, it is symptomatic of the larger issue of unforced errors heaped upon failures which the Trump administration is powerless to fix and can only sometimes, after multiple attempts, contain. It has become a pitiful, helpless giant, unable to achieve even its most modest goals with the power to do little more than spew out misinformation; cloak misdeeds in secrecy; undermine, sabotage, and destroy government institutions; and unleash pain on the most vulnerable and defenseless, like school children in Iran and undocumented immigrants in America.
With Malice Toward All
Trump promised to drain the “swamp” of Washington corruption but instead supercharged it and managed only to drain the Lincoln Memorial Reflecting Pool of water and the country of any shred of decency.
In late August, Trump took to Truth Social to
claim
he was “six times more popular than Abraham Lincoln” — a reference to a poll of present-day Republicans, of whom 53 percent said the president they most admire is Trump, compared to 8 percent who named Lincoln. That same month, he
ranked himself above
Lincoln and all other presidents. It’s somehow fitting that Trump wrecked the Lincoln Memorial Reflecting Pool in the same way he has soiled the office Lincoln once held.
Trump promised to drain the “swamp” of Washington corruption. He managed only to drain the Lincoln Memorial Reflecting Pool of water and the country of any shred of decency.
Whether Lincoln could have imagined a president as depraved as Trump is unknowable but he did fear, in his own time “something of ill-omen, amongst us … the increasing disregard for law which pervades the country; the growing disposition to substitute the wild and furious passions, in lieu of the sober judgment of Courts.” He couldn’t have anticipated the boat strikes, the term human trafficking victim, or the fact that the U.S. might
kill the latter during the former
, but in that same
1838 speech
— when he was just 28 years old — he understood the perils of such summary executions, noting “when men take it in their heads to day, to hang gamblers, or burn murderers, they should recollect, that, in the confusion usually attending such transactions, they will be as likely to hang or burn someone who is neither a gambler nor a murderer.”
Trump is, however, content to kill without compunction and even recently appeared to invite the nuclear annihilation of Los Angeles and San Diego, although it’s increasingly impossible to divine meaning from Trump’s incoherent ramblings. (He has, though, threatened both cities in the past,
deploying troops
to LA and threatening to do so in San Diego.) Even Lincoln’s armies — turning to “total war” to end a long, brutal, and costly civil war — did not annihilate the South and decimate its people. And at its close, he sought to “bind up the nation’s wounds” with words Trump would choke on: “With malice toward none; with charity for all.”
Lincoln did not believe that the U.S. could be felled by a foreign power but did foresee the possibility of America sealing its own fate. “If destruction be our lot, we must ourselves be its author and finisher,” he said in that 1838 speech. “As a nation of freemen, we must live through all time, or die by suicide.” The reelection of a craven criminal who sought to subvert what remains of democracy in America certainly appears to be more than a mere cry for help.
“Our progress in degeneracy appears to me to be pretty rapid,” Lincoln
wrote
to his friend Joshua Speed in 1855. Some 171 years later, it may well be complete.
The suffering meted out by Trump has been immense. And his penchant for failure may now be his essential quality. He may ultimately be remembered for turning a reckless military “excursion” into a forever-war failure or as the most debased reprobate to hold the office of the presidency. But Trump’s micro-mismanagement of a local construction project that turned a functioning national monument into a fenced-off blight might be his most illustrative disappointment: a small failure of epic proportions and, in some way, a sorry reflection on all Americans.
⚠️ Frontier AI models still fall significantly short of human designers on design creativity. ⚠️
Introducing Design Creativity Bench, a new benchmark evaluating AI models’ creativity on UI design tasks.
Despite rapid advances in their ability to generate functional websites and product UIs, leading AI models still struggle to make creative design decisions.
We evaluated 16 frontier models across 80 open-ended UI tasks, each adapted to two distinct product domains alongside human designer references.
Existing UI benchmarks often measure a single output quality metric. Instead, we measure three dimensions of design creativity:
– Originality: How distinct a model's designs are from other models' outputs for the same brief.
– Creative Range: How much a model adapts its design decisions when the product domain changes.
– Appropriateness: How well the generated UI satisfies the functional requirements of the brief.
The results reveal a substantial gap in overall creativity: The best model,
@OpenAI
GPT-6 Astra, scores 65.5 against a human reference of 92.3.
We're publishing the full leaderboard, methodology, and reproducible evaluation framework to make design creativity a measurable dimension of frontier model capability.
It sends a
GET
request to
url
and returns the HTTP status code.
Using HTTP/1 (
GODEBUG=http2client=0
), calling this function 100 times against
index.golang.org
takes ~710 milliseconds on Go 1.26
on my machine. On Go 1.27, the same program takes ~150 milliseconds.
That is almost 5 times faster! How is such a drastic performance difference
possible?
The cost of establishing HTTP connections
To understand the difference, consider what happens on the network when we make
an HTTP request.
Go’s
net/http
package supports HTTP/1.0, HTTP/1.1, and
HTTP/2. All three run over TCP, and usually over TLS when talking to HTTPS
endpoints. Making a request over a new connection looks something like this:
TCP handshake (1 RTT)
: the client sends a
SYN
packet, the server
replies with
SYN-ACK
, and the client replies with
ACK
. Because the
client can send the first TLS message alongside that final
ACK
,
establishing the TCP connection takes 1 round-trip time (RTT).
TLS handshake (2 RTT)
: next, a TLS handshake exchanges encryption keys
and verifies the server’s identity; using TLS 1.2, this takes 2 RTT.
HTTP request
: with the keys exchanged, HTTP requests can finally be sent
after a total of 3 RTT.
These round trips (plus some CPU time spent on TLS handshakes) add up quickly.
In cross-region communications, one-way latencies often reach or exceed the 50
ms (100 ms RTT) shown in the diagram above. Compared to the 300 ms spent just
setting up the connection, the HTTP request itself can be cheap to serve, taking
only a little over 1 RTT when bandwidth is plentiful or the HTTP response is
small.
Even in more favorable conditions, opening a new connection can still be
expensive. Our opening benchmark queries
index.golang.org
, which is distributed worldwide and
supports TLS 1.3. This means that latency is relatively low, and the TLS
handshake can actually finish in just 1 RTT. Even so, the performance difference
is still very noticeable.
Connection reuse
To avoid paying this setup cost on every request, HTTP clients and servers try
to reuse existing connections across multiple requests when possible. The
mechanics of this differ based on the HTTP version:
HTTP/1.0
: while not part of the official specification, clients and
servers often opt into connection reuse by sending a
Connection: keep-alive
header. Reuse continues until either endpoint omits the header
or sends a
Connection: close
header.
HTTP/1.1
: connections are persistent by default, and can be reused for
subsequent requests and responses unless either side declares otherwise by
sending a
Connection: close
header.
HTTP/2
: multiple requests and responses can be multiplexed over a single
TCP connection.
When connection reuse fails
In HTTP/1 (both HTTP/1.0 and HTTP/1.1), multiple requests and responses on the
same connection are sent sequentially on the wire. If two
GET
requests are
sent to
index.golang.org
over the same TCP
connection, the responses arrive as a single stream of bytes:
As shown in the diagram,
net/http.Get
reads and parses
the status line and headers from the byte stream to populate
net/http.Response
, then returns immediately. The
response body remains unread on the connection and is consumed only as the
caller reads from
net/http.Response.Body
.
Because responses are sent back-to-back on the same stream,
net/http
can only find the start of the next response after
the current response body has been read to the very end (as determined by the
Content-Length
or
Transfer-Encoding
header).
Now look back at our example program, where we never read
resp.Body
:
Through Go 1.26, when
resp.Body.Close
is called,
net/http
sees that there is still an unread response body. Realizing that it cannot reuse
the connection, it abandons the existing connection and creates new connections
for its next requests, causing it to repeatedly incur the cost of establishing
new connections.
(HTTP/2 does not have this problem. Because it multiplexes streams of frames
over a single connection rather than sending responses strictly back-to-back, an
unread response body on one stream does not block other requests from sharing
the connection.)
Where failed connection reuse hurts
This subtlety of HTTP/1 connection reuse can cause silent performance
degradation in seemingly innocuous code.
As in our opening example, a client might only care about an API response’s
status code. However, the API endpoint it is talking to might send bodies that
provide more detailed but ultimately unused information, such as
{"success": true, "message": "update processed"}
. This will unfortunately cause connection
reuse to fail.
Even programs that do read the response body can run into this issue if they
stop just short of the end of the body. For example,
encoding/json.Decoder
stops reading as soon as
it sees the closing
}
of a JSON object. If a server sends a JSON response
terminated with a newline, decoding the JSON object will leave the newline still
unread. The connection cannot be reused for a new request until that newline is
consumed. Thus, a healthy connection might end up being abandoned, even though
it was only a single byte away from being reusable.
The manual solution
The unread body problem has been a long-standing sharp edge. Over the years,
many Go developers came up with their own workarounds. Most commonly, this is
done by draining the response body prior to closing it:
func getStatus(url string) (int, error) {
resp, err := http.Get(url)
if err != nil {
return 0, err
}
drainAndCloseBody(resp.Body)
return resp.StatusCode, nil
}
func drainAndCloseBody(body io.ReadCloser) {
io.Copy(io.Discard, body) // Drain the response body before closing it.
body.Close()
}
While this works for small responses, if the unread body is large, establishing
a new TCP connection can be faster than downloading and discarding the rest of
the body. A better approach is to cap the number of bytes we are willing to
drain:
func drainAndCloseBody(body io.ReadCloser) {
io.CopyN(io.Discard, body, 256<<10) // Only drain up to 256 KB.
body.Close()
}
However, a server might send a response body that trickles in slowly, so we also
need to cap the time we spend draining:
func drainAndCloseBody(body io.ReadCloser) {
drainDone := make(chan struct{}, 1)
go func() {
io.CopyN(io.Discard, body, 256<<10) // Only drain up to 256 KB.
drainDone <- struct{}{}
}()
// Only spend at most 50 ms trying to drain the response body.
select {
case <-drainDone:
case <-time.After(50 * time.Millisecond):
// If we reach the 50 ms timeout, body.Close will run and interrupt the
// io.CopyN, preventing goroutine leaks.
}
body.Close()
}
Of course, we also do not want to block for up to 50 milliseconds when closing a
response body. Instead, we can drain the body asynchronously in the background
and let it race against subsequent requests:
func drainAndCloseBody(body io.ReadCloser) {
drainDone := make(chan struct{}, 1)
go func() {
io.CopyN(io.Discard, body, 256<<10) // Only drain up to 256 KB.
drainDone <- struct{}{}
}()
go func() {
// Only spend at most 50 ms trying to drain the response body.
select {
case <-drainDone:
// If the drain can finish before a new request is sent, the
// connection will be reused; otherwise, a new connection is
// created, and the current connection will be put in a pool of
// idle connections, potentially being reused for another future
// request.
case <-time.After(50 * time.Millisecond):
// If we reach the 50 ms timeout, body.Close will run and interrupt
// the io.CopyN, preventing goroutine leaks.
}
body.Close()
}()
}
As we can see, draining response bodies safely is surprisingly tricky and
cumbersome. Worse, as the practice of draining response bodies spread, some
nuances were often lost. This has led to misunderstandings such as attempting to
drain response bodies for HTTP/2 connections, when doing so is unnecessary.
The current state and conclusion
Starting in Go 1.27,
net/http.Transport
automatically does everything we have implemented in the code above: it will
asynchronously drain an unread HTTP/1 response body for up to 50 ms or 256 KB.
It also implements additional optimizations; for example, when a response
contains the
Connection: close
header, draining the body is guaranteed to be
wasted work, and it therefore skips doing so. Note that this behavior might
evolve in future versions of Go, as other possible enhancements become apparent.
As a general best practice, we now recommend that users simply close their HTTP
bodies once they no longer need them, like in our original example:
This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.
What can I do to resolve this?
You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.
AI is mass decompiling games. That's both awesome and scary.
Simon Willison
simonwillison.net
2026-10-14 12:26:53
AI is mass decompiling games. That's both awesome and scary.
Indie game developer Popcar talks about the recent wave of AI-powered decompilation of existing games, enabling weird mashups between existing games, and producing a boom in game preservation projects to get old games working on new h...
AI is mass decompiling games. That's both awesome and scary.
(
via
) Indie game developer Popcar talks about the recent wave of AI-powered decompilation of existing games, enabling weird mashups between existing games, and producing a boom in game preservation projects to get old games working on new hardware (often in a browser using WebAssembly).
I like how this piece captures both the positives and the negatives of this new development:
Most people already realized the scary part by now. If AI can decompile games and software, then the entire tech industry is about to explode. Anybody can decompile other software and use it any way they'd like, and nobody can stop them. Companies can steal from competitors. Your paid game or app can be open-sourced against your will. This isn't exclusive to old video games, we can apply this to
any
software. [...]
This is also a big win for preservation. Old games can be ported, modified, enhanced, and made much more easily accessible than before. [...[
With console makers going all in on digital and games becoming entirely unplayable due to servers shutting down, this is
fantastic
news. We could own software we bought regardless of what the company thinks.
🗣 A Victory for Freedom of Speech Online | EFFector 38.18
Electronic Frontier Foundation
www.eff.org
2026-10-14 12:25:23
No one should have to think twice before criticizing the government online. But a mass surveillance program known as "Catch and Revoke" was created to make millions do just that. EFF and other defenders of free speech are fighting back. In our latest EFFector newsletter, we're talking about a key co...
No one should have to think twice before criticizing the government online. But a mass surveillance program known as "Catch and Revoke" was created to make millions do just that. EFF and other defenders of free speech are fighting back. In
our latest EFFector newsletter
, we're talking about a key court win for our lawsuit
challenging this unconstitutional surveillance program
.
Prefer to listen in? EFFector is now available on all major podcast platforms. This time we're talking to EFF's Lisa Femia about how the government is using AI to suppress protected speech online—and the important lawsuit she and others are working on to stop it. You can find the episode and subscribe
on your podcast platform of choice
:
Want to protect your right to digital privacy? Sign up for
EFF's EFFector newsletter
for updates, ways to take action, and new merch drops. You can also fuel the fight for privacy and free speech online when you
support EFF today
!
ICE Planning $100M 'Nightmare' Domestic Spy Program
Immigration and Customs Enforcement is fast-tracking a $100 million domestic surveillance program to put 142 intelligence agents in more than two dozen cities and the District of Columbia, in what contracting and surveillance experts said would be a significant expansion of the agency’s ability to reach into private lives.
The new program is called the Enforcement and Removal Operations Overwatch and National Security Enforcement, or ERO ONE, described in documents posted last month on federal procurement websites.
Under the program, agents would analyze classified and unclassified information to identify “trends, patterns, relationships, threats, and intelligence gaps,” and provide ICE with briefings for Enforcement and Removal Operation missions, according to a
statement of work published on September 18
. A forecasting document
published a week earlier
said that the solicitation will likely be released on December 10. Intelligence contracting experts said the timeline suggests ICE will award the contract around February.
“It looks dangerously like the construction of an internal spying agency,” said Jay Stanley, senior policy analyst with the American Civil Liberties Union’s Speech, Privacy, and Technology Project,
who has written extensively
on immigration agencies’ mass surveillance. “It’s a nightmare in the making.”
It’s also a weapon that the government will likely use against not only undocumented immigrants, but everyone else, too. That includes political enemies, intelligence experts said. Speaking with the
Prospect
on Monday as news broke that the
Trump regime had raided
progressive Minnesota Rep. Ilhan Omar’s D.C. home, former military intelligence analyst Michael Wriston said that “you’d expect to see more of this” under ERO ONE.
“Not just necessarily sitting members of Congress, but anyone, and especially members of the immigrant community,” Wriston said. “No one is safe. No one.”
THE PLAN DOES NOT SPECIFY WHAT OR WHOM
ICE is looking for with this increased spying capability. But one of the components that caused former intelligence contractors’ concern was that ERO ONE agents will analyze both classified and nonclassified information to produce “network, link and relationship” analyses. That type of analysis involves researching not only a target, but also every other person to whom they’re connected, including household members, family members, friends, acquaintances, or the person with whom they carpool to work.
According to the statement of work, contractors will be tasked with conducting analytical research “to identify and assess relationships among individuals, organizations, locations, events, activities, data points, and other entities.” They will review information to identify “known, reported, or potential relationships; recurring patterns; organizational structures; associations; areas of convergence; temporal or geographic connections; and other linkages relevant to the assigned intelligence requirement.” Contractors will then “evaluate the significance and reliability” of the relationships and “prepare link charts, network diagrams, timelines, analytical summaries, written assessments, or other related products” for ICE to use.
Military intelligence agents compile the same type of research, Wriston said. He knows because he did that job.
The
Prospect
in your inbox
Analysis that goes beyond the noise with in-depth, progressive reporting.
No paywall, no programmatic ads — just the reporting. Unsubscribe anytime. Submitting your email signs you up for The Daily Prospect, our weekday morning newsletter.
“We’ve seen this time and time again. It’s the imperial boomerang,” said Wriston, who is also a data journalist and the founder of ICE watchdog group
Project Salt Box
, where he
reported on ERO ONE
the day the first document went live and
has written
about it since. “These are the kinds of things that happened in Afghanistan, Iraq, Yemen, Syria, for years. Now that methodology is being brought into the ICE space.”
Federal documents likewise do not detail the specific sources of information agents will analyze, only that all agents must possess previously awarded active top secret clearance, with eligibility to access Sensitive Compartmented Information. That’s a type of information that must be accessed through certain formal control systems managed by the Director of National Intelligence, a position held by Trump ally Jay Clayton. The agents will not make any decisions about what to do with the information they compile.
Wriston said that except for the fact that ICE officials are trying to make immigration a matter of national security, it’s unclear why they need this program when they already have the Homeland Security Investigations unit, which conducted the raid on Omar’s house, to research targets. His immediate worry, he said, is that the program will make it easier for the government to find terrified immigrants hiding at home because they think they’ll be safe there.
ICE PLANS TO SEND THE 142 AGENTS
, plus two project managers, to locations in Atlanta, Boston, Buffalo, Chicago, Dallas, D.C., Denver, Detroit, El Paso, Harlingen (Texas), Houston, Laguna Niguel (California), Los Angeles, Miami, New Orleans, New York, Newark, Philadelphia, Phoenix, Salt Lake City, San Antonio, San Diego, San Francisco, Seattle, St. Paul, and Williston (Vermont), according to the statement of work.
Details in the document, and the rapid timeline, show that the Trump administration intends to use the program immediately, said Brian Murphy, a government contractor who worked for 25 years with ICE parent agency DHS. It’s rare for the government to only want workers with top secret clearance, he said.
“I’ve only seen it when there is an imminent need to work on something right now,” he told the
Prospect
. “Trump has two years in office. He can’t wait … they want to get rolling on this immediately.”
The program description is so broad that Murphy said he thinks the goal goes beyond targeting immigrants. “I think it’s darker than that,” because the agency could use the intelligence to attack people with identities and views the Trump regime doesn’t like. “The question for DHS is, what is the threat they’re trying to go after?”
“It looks dangerously like the construction of an internal spying agency.”
Jay Stanley, American Civil Liberties Union
The federal government can easily change who qualifies as a threat and produce data that backs up the reasoning, Murphy said, and used as an example annual Homeland Threat Assessments. In 2020, Secretary of Homeland Security Chad Wolf
identified
white supremacist extremists as “the most persistent and lethal threat in the Homeland.” But by last year, that threat had disappeared from
the report
, except to appear once in a glossary of terms. The rest of the report focused heavily on Trump administration priorities as national security threats, including immigrants crossing the border with Mexico and transnational criminal organizations.
In addition, the murders of Renee Good and Alex Pretti have shown how the government views protesters against ICE abductions as an abiding threat. In a national security directive known as NSPM-7, President Trump identified anti-fascist protesters as domestic terrorists and proposed an architecture to disrupt and counter dissent.
“If you want to draw a narrative that the real threat to America is whatever you want it to be, you can very easily do that. You just stop gathering intel on militias,” Murphy said. “It’s like any other police state. If you ask it to find something to make my opponents the enemy, well, you can do that.”
Legal liability should be a major concern for anyone who bids on the ERO ONE contract, Murphy said, because it’s unclear whether the information they’d be charged with accessing had been gathered legally. He added, “It’s very, very concerning that they’re fast-tracking this.”
ICE already knows its potential bidders for ERO ONE, said Diana Brozi, the procurement specialist listed on the document. She told the
Prospect
it was unlikely the agency would hold an industry day and declined to provide further information.
DHS did not respond to a request for information or comment on the claim that the program could be used to spy on political enemies.
Amsterdam police confisquates server left-wing ISP A/I at American request
Een eenheid van de Amsterdamse politie heeft dinsdag bij een datacenter op het Science Park in Amsterdam een server in beslag genomen van de Italiaanse internetdienstverlener Autistici/Inventati (A/I). Dat is gebeurd op basis van een Amerikaans rechtshulpverzoek. Een kopie van de inhoud van de server wordt nu naar de VS gestuurd.
A/I was een linkse antikapitalistische organisatie die de afgelopen vijfentwintig jaar gratis webhosting en e-maildiensten aanbood aan zo’n twintigduizend organisaties wereldwijd. Volgens de Amerikaanse regering faciliteerde A/I daarmee ‘antifa’, een afkorting voor ‘antifascisten’. De regering-Trump ziet antifa als een terroristische organisatie. A/I werd daarom eind augustus zelf ook als terroristisch bestempeld. Dat was een unicum. Internetdienstverleners worden in de regel niet verantwoordelijk gehouden voor de inhoud van wat hun gebruikers online zetten.
Als gevolg van de sanctie verloor de organisatie toegang tot zijn bankrekening en domeinnaam. Ruim een week na publicatie van de sanctie besloten de vrijwilligers die de internetdienstverlener runden om
hun werk te staken en A/I te ontmantelen.
Amerikaans rechtshulpverzoek
Zo wilden ze voorkomen dat ze mensen of organisaties in de problemen zouden brengen omdat die banden met hen hadden, bijvoorbeeld doordat ze donateur waren of gebruik maakten van de webhosting of e-mail van A/I.
De inbeslagname van de server in Amsterdam duidt erop dat die angst niet ongegrond is. De politie in Amsterdam liet de server ophalen op basis van een Amerikaans rechtshulpverzoek. „Dat voer je dan gewoon uit”, zegt een woordvoerder telefonisch. Digitale experts van de politie maken er nu een ‘image’ van, een digitale kopie. „Die gaat linea recta naar Amerika.” Daarna krijgen de eigenaren de server terug.
A/I had servers op verschillende locaties in Europa staan. De afgelopen weken zijn die gesloten en zijn de schijven gewist, vertelt een betrokkene, die om veiligheidsredenen alleen anoniem praat. Het opheffen en ontmantelen van de juridische entiteit – A/I is een soort stichting – vergt wat tijd, licht hij toe. Een van de eisen onder de Italiaanse wet is dat er geen bezittingen achterblijven in een organisatie zonder winstoogmerk als die is opgeheven. Een kleine groep van de voormalige vrijwilligers houdt zich met de afhandeling van de opheffing bezig. Er is onderling zo min mogelijk contact.
De server in Nederland was „een van de laatste stukken hardware die we weg wilden gooien. Daarover hadden we contact met DC1 (het datacenter, een verre opvolger van Xs4all).” Er staat volgens hem niets op de versleutelde server wat problemen kan veroorzaken voor gebruikers van A/I. „Ik ben niet bezorgd. Wel verbaasd.” De woordvoerder had gehoopt dat de opheffing van de organisatie voor de Amerikanen zou volstaan.
Let’s briefly deconstruct a viral or soon to be viral story out of Cologne, Germany regarding an incident in which a “remotely controlled robot grabs 16-year-old's buttocks” and “performed thrusting movements against her,”
according to police
.
I have begun to see this story percolate around the English-speaking internet because it is absurd and not good, and has already been aggregated to hell by social media meme pages with essentially zero information other than this absurd police image:
The Cologne Police did not exactly help matters by
issuing a short press release
that treats the robot as mysterious, the circumstances as mysterious, and the evidence as “unusual.” The Cologne Police’s
Facebook post featuring a photo
of the mustachioed robot reads “A red-gold robot triggered a police operation on the Cologne Ring on Sunday night (October 11). The device is said to have touched a 16-year-old girl's buttocks and performed thrusting movements against her […] The police are now investigating how the robot worked at the time of the assault and whether someone was deliberately controlling its movements. Emergency services seized the robot and two mobile phones from the suspect. The police are investigating on suspicion of defamation on a sexual basis.”
Coverage by even well-resourced outlets like CNN, CBC, and the BBC have almost no information beyond the police press release, which is lazy and stupid, because it is possible to figure out everything that happened here with three seconds of clicking around the internet. The Associated Press wrote that the entire phenomenon is "new territory" for the police, which, I'm sorry to say, men using tech to harass women on livestreams in 2026 is not "unusual" or "new territory" and hasn't been for many years.
The English coverage of the incident looks like this:
In fact, with a small amount of Googling and/or clicking around social media, it is easy to find out everything you would ever need to know about the robot and what happened here.
The tl;dr is that a 16-year-old German Twitch IRL livestreamer named Agaamuza has been streaming himself using an off-the-shelf $5,000 robot from a company named Unitree to walk around Cologne and bother people outside of bars in the way that extremely annoying Twitch livestreamers and TikTok stars have been doing for years. In a recent livestream, Agaamuza or one of his friends uses the robot to grab a girl’s ass, the boys laugh about it, and the police get involved. Twitch has temporarily suspended his channel from streaming but because of the social media clipping economy, there are zillions of videos of the streamers and the robot percolating across Instagram, YouTube, and TikTok.
On the actual internet where real people click around and don't regurgitate police statements and pretend they're reporting the news, you can see the entire arc of what happened, which now includes an hour-long "statement" Twitch video in which Agaamuza streams with the robot dressed in striped prison clothes.
The slightly longer version: For at least a few weeks, Agaamuza and his friends put a mustache and giant chain necklace on the robot, call him “Ahmad the Robot,” and film people’s reactions to the robot thrusting, dancing, punching the sky, walking into stores, etc. Most of these videos are annoying but not illegal. They are very much a part of YouTube / Twitch “prank” culture, in which men—almost always men—film themselves hitting on women, interviewing people outside of bars, and doing stupid shit in public. Agaamuza and “Ahmad the Robot” have become minor characters in the German Twitch streaming world over the last few weeks.
The robot in question is the Unitree R1, which costs between $4,900 and $5,900 depending on the specific model. Unitree is a Chinese robot company that makes the R1 and a robot dog that has become vaguely popular among people who are excited about humanoid robots and gadget YouTubers. Unitree is kind of a Boston Dynamics-esque company in that it makes lots of YouTube videos of its robots doing cartwheels and backflips and fighting other robots, and regularly goes viral for it. The capabilities of the R1 robot are not a secret and can be found in any number of YouTube videos or on Unitree’s website (which is to say that the R1 is not a mysterious harassment or spy robot as it has been portrayed in some of the aggregations of this story I’ve seen).
The robot, but not the incident in question
Anyways, over the weekend while live-streaming, Agaamuza or one of his friends has the robot walk into a group of girls standing on the street in Cologne. “Oh my god oh my god Ahmad,” one of the streamers says, as they walk the robot directly into a girl’s ass. One of the girls says “Oh my god stop.” The boys say “Hey, he wants to meet you, do you want to meet him?” The girls say no. The robot begins thrusting its arms in the air (the girls have moved away at this point), and the streamers start screaming “no brother, no bro oh man.” The girls tell the streamers to leave them alone and then walk away.
In his statement video, Agaamuza says that the robot simply ran into the girl and didn't grope her. The robot
certainly did run into her
, the whole thing was harassing and annoying; in the United States, these sorts of things happen on Twitch constantly, generally with no consequences.
What happened is bad, and is not much different than the types of clips of men harassing women that go viral all the time on social media, many of them filmed or streamed
surreptitiously using Meta’s AI glasses
. What actually is unusual about this case is that the police appear to actually be taking it seriously.
About the author
Jason is a cofounder of 404 Media. He was previously the editor-in-chief of Motherboard. He loves the Freedom of Information Act and surfing.
I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to this threat. Of the 25 package managers reviewed
1
, fewer than half used lockfiles that checked for tampering by default, and only two verified the integrity of every package they downloaded.
Supply-chain attacks caused by developer compromise are a common story, but imagine what happens if ongoing mitigation attempts, including work by Trail of Bits
2
, are successful. If developers of popular packages are no longer the easiest targets, attackers will shift their focus to the next weakest link in the system: the package repositories that serve the code. The cryptographic answers to this problem are more subtle than they appear, and many implementations fall short due to deliberate design choices, resource prioritization, or the complexity of developer-friendly solutions.
One natural answer is to include a cryptographic hash of a package’s contents in a lockfile and compare hashes after downloading the package. This automatic verification was the default behavior in about half of the package managers I tested, but others required extra configuration to include or verify these hashes, used hashes in a cryptographically insecure way, or lacked hashes entirely. This is summarized in the following table.
CocoaPods, Composer, Conan, cpanminus, Gem, Maven, PowerShellGet, PSResourceGet, R
Table 1: Lockfile-based security of a package manager fetching dependencies from a malicious repository, categorized by how much work it takes a developer to achieve integrity. Experimentally verified for a particular configuration. Caveats detailed below.
Another natural approach is to use signatures, avoiding the need to securely distribute a hash for every package. However, in my tests, only Go verified signatures by default; others required extra configuration, lacked verification code, or did not support signatures.
Table 2: Signature-based security of various package managers. Also experimentally verified and subject to similar caveats.
As both tables show, I found a surprising variation in the cryptographic designs and the level of protection they provide. Despite the challenges, I also found several communities on the frontier of this integrity problem that are bringing improved designs to reality. This post explores those variations, showing where certain designs fall short, why code integrity is harder to solve than it appears, and what cryptographic designs might be adopted in the future.
Simulating malicious package repositories
Studying the cryptographic behavior of 25 package managers is quite the challenge. I wanted to minimize manual analysis, but also be 100% confident when I claim an attack from a malicious package repository is possible. To solve this problem, I built a testing harness based on Docker containers and
mitmproxy
that dynamically evaluates the security of package managers against a malicious server.
Figure 1: Experimental design of the test harness used to simulate malicious package repositories
The Ubuntu-based Docker images include a package manager, sample code, and optionally a lockfile. There are
conflicting opinions
about whether to include lockfiles in source code repositories, so I tested both configurations. The harness instructs the package manager to fetch dependencies from the repository, and the resulting network request
routes
through a WireGuard network to a custom mitmproxy addon.
Because the mitmproxy TLS CA is installed in the Docker image, the addon can fully manipulate the plaintext from the package repository, simulating a compromised server. I assumed any web-facing server could be compromised (e.g., Composer fetches metadata from Packagist and packages from GitHub), but backend resources, like any private signing keys, remain secure. The simulated repository embeds malicious code into the downloaded packages, and if the sample code executes the malware, the attack is successful.
I tried to keep the experimental setup reflective of real-world usage, but there are limitations. I installed the latest package manager versions, followed quickstart guides for setting up sample projects inside the container, and picked popular packages from public repositories to infect. I ran package manager commands with default flags to see if extra steps, like modifying the project manifest or running extra commands, were needed to enforce cryptographic integrity. However, I am limited to testing a single package with a single package manager version on a single platform, and the test conditions (e.g., PowerShell and CocoaPods on Ubuntu) may not represent the most common usage patterns. The setup isn’t meant to show that every developer is vulnerable to a malicious package repository, just that a developer following reasonable conventions is.
With the package managers installed and network intercept functional, one (mostly) promising observation is clear.
HTTPS is (almost) everywhere
Our harness architecture captures all network traffic, so it’s easy to test that package managers are using TLS and validating the certificates. In almost every package manager, they are.
The exception is cpanminus, the
frequently
recommended
package manager for Perl. cpanminus uses unencrypted HTTP by default to connect to the Perl package repository, allowing any active network attacker to inject malicious code into downloaded packages. This
vulnerability
has been known for years, but the cpanminus developer has not switched to HTTPS, since doing so would be a
breaking change
to default behavior.
3
Hash functions don’t always provide integrity
By using the mitmproxy addon to modify the package repository responses, I could investigate how different package managers use cryptographic hashes. Hashes are a natural way to ensure that a downloaded file has not been tampered with, but the main question is how the package manager learns the correct hash in the first place.
Microsoft’s
vcpkg
package manager for C and C++ libraries offers an interesting example. The package manager source code includes content
hashes
for
thousands
of dependencies. When a developer updates their library and wants to register the new content in vcpkg, they
recompute
the hash of their package and open a
pull request
against the vcpkg source code with the new hash and link to the package. When a package is downloaded by vcpkg, the hash is checked. So as long as the package manager is trusted, this approach is fully secure against a malicious package repository.
4
Hashes in lockfiles
It is significantly more common that the package manager learns the correct hash via a lockfile. A lockfile is frequently created by a package manager, resides alongside a project’s source code, and references specific versions of dependencies needed by the project. If a developer checks a lockfile with cryptographic hashes into the source code repository, and the user’s package manager validates downloaded packages against the hashes, then the user’s dependencies perfectly match the developer’s.
This is how it works for the Bun package manager for JavaScript projects. Installing a package with
bun add
updates
the
bun.lock
lockfile; committing the lockfile to
Git
and calling
bun install
on another copy of the repo
verifies
the hash in the lockfile against the new copy of the dependency. Similar behavior is found in npm, pnpm, and Yarn (also JavaScript package managers); uv and Poetry (Python package managers); Bundler (for Ruby); Cargo (for Rust); and SwiftPM (for Swift).
Other package managers support lockfiles, but with more steps than the standard add/restore process. Python’s Pip has
experimental
support for the
pylock.toml
format, and Conda has the optional library
Conda lock
. NuGet, the .NET package manager, generates a lockfile after
adding
the
RestorePackagesWithLockFile
property to the project.
Many package managers (Maven, R, PowerShellGet, PSResourceGet, and cpanminus) do not have dedicated lockfiles, and some have lockfiles (Gradle’s
gradle.lockfile
5
and Gem’s
Gemfile.lock
) without hashes in them.
Hashes present, but not for integrity
Surprisingly, I found a few examples where the lockfiles had a hash, but could still be compromised by a malicious server. This is not necessarily reflective of a vulnerability, since the underlying behavior is clearly documented, but it shows how there are multiple valid opinions about how lockfiles should be structured and consumed. Nevertheless, a user who is accustomed to the behavior of one package manager may be surprised by that of another.
The first example is the Pub package manager for Dart and Flutter. The following excerpt of a
pubspec.lock
file includes a SHA-256 hash for the
uuid
package.
If a user calls
flutter pub get
to fetch dependencies, Pub downloads the package from the
pub.dev
server and computes the hash of the returned binary. If there is a mismatch, Pub detects the error, but installs the package anyway.
The existing content-hash from pubspec.lock doesn't match contents for:
* uuid-4.6.0 from "https://pub.dev"
This indicates one of:
* The content has changed on the server since you created the pubspec.lock.
* The pubspec.lock has been corrupted.
The content-hashes in pubspec.lock has been updated.
This is
documented behavior
, and requires the non-default
--enforce-lockfile
option to block installation
6
.
Overwriting the lockfile after a hash mismatch was also the default behavior in pnpm until version
11.4
from May 2026, when it was changed to close “supply-chain holes.” Like Pub, pnpm also supported a non-default
--frozen-lockfile
flag, indicating that the previous behavior which updated the lockfile was expected.
Next, here is an excerpt of a
conan.lock
file, used by the Conan package manager for C and C++.
This includes the package name (
zlib
), the version number (
1.3.1
), a recipe revision
cac0f6daea041b0ccf42934163defb20
, and a timestamp. The 128-bit revision is an MD5
hash
that includes source code. However, this hash is
not intended
to provide cryptographic security, but rather serves as a unique identifier. When Conan installs dependencies using this lockfile, it uses the recipe revision hash to download a particular file from the ConanCenter repository, but it does not recompute the recipe hash. Even if it did, there’s a separate package revision hash for platform-specific binaries that is not in the lockfile, and MD5 collisions could allow an attacker to create two distinct recipes with different behavior but the same hash.
The CocoaPods dependency manager for Swift and Objective-C has a similar pattern. Here is part of a
Podfile.lock
file for a project that uses the popular
Files
dependency.
This 160-bit checksum is the SHA-1 hash of the Files
Podspec
, which contains the following link to the source code. CocoaPods uses this link to fetch the Git repository.
So even though the lockfile can prevent tampering with the GitHub URL in the Podspec (setting aside expensive SHA-1 collision attacks), a compromised GitHub server could just serve a malicious version of the repository with the same tag.
Finally, the Composer dependency manager for PHP includes commit hashes in the
composer.lock
file, as in the following excerpt.
However, even though the
b094ded...
commit hash uniquely identifies the code, the ZIP archive in the URL does not include the Git tree as a way to verify the hash. Once again, GitHub could serve a malicious ZIP archive without detection by Composer.
Lockfiles have many roles besides supply-chain integrity
The previous experimental results show that lockfile hashes often
can be
used to enforce package integrity, but this is not their sole or even original purpose. Alternatively, they can lock dependencies to a particular functionality, enable an easy way for application developers to share a consistent environment, or facilitate reproducible builds. Analyzing package manager lockfiles through the lens of supply-chain security is a recent interpretation that can be at odds with their original design. The recent change to pnpm’s
--frozen-lockfile
is one example.
Another example of this tension is the question of whether the lockfile should be committed to version control. Most modern guidance recommends committing the lockfile for applications, since the final build environment is fully controlled. The question is more complicated for libraries, since package managers often ignore libraries’ lockfiles to avoid locking to conflicting transitive dependencies. Committing the lockfile makes it easier to develop the library by sharing a consistent build environment with other developers, but excluding the lockfile makes it easier to catch conflicts with different dependency versions before they are found by users. Many package managers recommend committing the lockfile for libraries (e.g.,
npm
,
pnpm
,
Poetry
,
uv
, and
Yarn
), some recommend excluding it (e.g.,
Bundler
), and some leave it up to the developer (e.g.,
Cargo
).
Many of these questions are explored in a recent
study
by Gamage et al. The authors explore lockfile design decisions for seven package managers, analyze published projects, and perform semi-structured interviews with 15 developers. They find that the practice of committing a lockfile varies by which package manager is used, and categorize five benefits to using lockfiles, as perceived by the interview subjects: build determinism, integrity, transparency into indirect dependencies, debugging, and security scanning. Some of the developers also preferred to not use lockfiles, citing a preference for end users to resolve to the latest version of a dependency, which may have more bug fixes and vulnerability patches.
The diversity of package manager designs and views surrounding the purpose of lockfiles makes it difficult to prescribe a single recommendation. With regard to supply-chain integrity, it is common, but not universal, to view lockfiles as a source of integrity that should be committed with the source code. For package managers with lockfiles that do not provide cryptographic integrity, it is worth considering whether their users share that expectation. Even when lockfile hashes can provide cryptographic integrity, locking to specific package hashes means that users do not immediately receive subsequent updates or security fixes, since the newer package has a different hash. This leads to frequent lockfile bumping to distribute the latest hashes. Wanting immediate updates is a separate concern from wanting package integrity, but the current, common approach of using hashes in lockfiles is at odds with that goal. In conclusion, lockfile hashes are often, but not always, effective at providing cryptographic integrity, but do not work in every situation.
Signatures are common; verification is not
Signatures are a natural way to address these shortcomings, but implementations frequently fall short. In theory, developers could sign every release with their own private key, and the package manager could check the signature of the package it downloads from the package repository. In fact, signatures are relatively common in different package ecosystems, but proper signature validation is surprisingly lacking. The reality of using signatures to provide code integrity is more nuanced than it seems, and package managers have different approaches to the problem.
Many package managers have no signatures available. Arguably, vcpkg does not need them, because all package hashes are distributed with the manager, but this leaves Cargo, CocoaPods, Composer, Conan, Conda, Pub, R, and SwiftPM
7
. The Conan developers are aware and previously decided not to fix it,
citing
several implementation challenges and suggesting organizations where integrity is critical could run their own repository server. Cargo developers are actively
considering
different signing designs, but this effort is still in progress. Composer developers have been
implementing
many new protections against supply-chain attacks, with future plans for artifact integrity.
Repository signing
One straightforward approach, known as repository signing, is when the package repository signs every package once it’s uploaded, and the repository’s public key is distributed with the package manager. This doesn’t solve the problem of a totally compromised package repository, since a malicious package repository could legitimately sign a malicious package, but it would protect against untrusted mirrors or a partial compromise of a package repository’s serving infrastructure.
Repository signatures are used by the
npm Registry
, the
NuGet Registry
, and the PAUSE server for Perl module distribution. In the npm Registry, signatures are distributed within package
metadata
with repository-specific
public keys
. NuGet Registry repository signatures are found in
.signature.p7s
files
within the distributed ZIP package, again with repository-specific
public keys
. The PAUSE server takes a different approach, using its
GPG key
to batch sign the
cryptographic hashes
of several packages at a time.
Developer signing
Developer signing involves the developer maintaining the private key and signing the package before uploading it to the repository for distribution. This prevents the package repository from tampering with the contents, but it also provides a way for the package repository to authenticate the uploader.
There are two common approaches for a developer asserting their public key. In the first approach, the public key is distributed out-of-band. The Maven Central repository (used by Maven and Gradle) and the RubyGems repository (used by the
gem
and Bundler package managers)
both
support
this type of developer signing. Maven Central uses PGP signatures, and developer keys are distributed by
public keyservers
. RubyGems uses self-signed certificates, and their distribution is left to the developers (e.g.,
rspec
). The major difference is that developer signing is mandatory for Maven Central, and optional for RubyGems. Developer signing is rare for RubyGems,
due to
the lack of an established chain of trust, and a previous attempt to introduce a certificate authority
failed
.
The second approach involves a chain of trust. The NuGet Registry and PowerShell Gallery both support developer signatures. Neither makes signatures mandatory, but the PowerShell Gallery
recommends
it and the NuGet Registry has strict
requirements
if developer signing is used. In both, the developer’s key must chain to a
trusted CA
, and acquiring a valid code-signing certificate can
cost
hundreds of dollars per year. The benefit of this approach is that trusted root certificates can be preinstalled on the platform, allowing package managers to verify public keys.
One downside of developer signing is that developers are responsible for key management, and they can lose the ability to update their code if they lose access to their key.
Identity-based signing
An increasingly common middle ground is “identity-based” or “keyless” signing from
Sigstore
. Rather than require developers to manage long-term private keys, a developer can use Sigstore’s Fulcio CA to issue a fresh signing certificate on demand, for free. To prevent impersonation, the developer proves their identity with an OIDC token: a cryptographically signed statement from a third party like Google, Microsoft, or GitHub that attests to the email address, username, or potentially other claims about the developer’s identity. The verifier can check that the username is correct and the certificate chain links back to Sigstore Fulcio’s root certificate, proving that someone with access to that account created the signature.
Keyless signing is particularly useful because it can be integrated into a developer’s existing workflow-based deployment pipeline. This is frequently called
provenance
attestation or trusted publishing
8
. GitHub and GitLab provide OIDC tokens to Actions and CI/CD workflows that attest to the build workflow, the repository, and the commit hash. A workflow can use this token to obtain a signing certificate from Sigstore, sign the built package, and upload the signed package to the package repository. Since the signing certificate includes the commit hash and workflow details, this cryptographically links the built binary artifact to its source code.
Verification code is skipped, unconfigured, or nonexistent
Unfortunately, just because these signatures exist does not mean they are being verified by package managers.
In the npm package manager, the repository signatures are not checked when running
npm install
. Checking the signatures requires running
npm audit signatures
, which uses Sigstore to validate the
registry public keys
and then validates the signatures of the installed packages. pnpm recently added the
pnpm audit signatures
command
, but that implementation fetches the registry public keys from the potentially malicious registry rather than verifying with Sigstore, so an adversary could simply add their own key and signature. Bun and
Yarn
currently lack an equivalent
audit signatures
command.
In the NuGet package manager, the
default
signatureValidationMode
is
accept
, which installs invalidly signed packages. The user must set this to
require
and configure the list of trusted signers, such as with
dotnet nuget trust source
. These configurations (which include the repository public keys) can be securely distributed within a
nuget.config
configuration file, functioning as a lockfile that locks the trusted signers.
Ruby’s Gem and Bundler, and Java’s Maven and Gradle, which all use repositories with developer signatures, do not verify signatures by default. They require the user to manually add developer public keys (
gem cert --add
) or list the allowed public keys that should be trusted. In Maven, one can use the third-party
pgpverify-maven-plugin
with
pgp-keys-map.list
to specify the trusted PGP fingerprints. Gradle offers
dependency verification
, which works similarly.
Finally, several package managers seemingly lack any sort of verification code at all.
Pip
,
uv
, and Poetry do not currently have a way to verify identity-based attestations described in PEP740. cpanminus
does not
have a way to verify the integrity of the repository-signed CHECKSUMS file. It once did, but in response to a verification bypass
vulnerability
, this verification code was
removed
. Even though PowerShell is
supported
on non-Windows platforms, Authenticode signature verification
is
not
9
. At one point, the PowerShell repository noted that this
issue
“should be fixed in a future release.”
Go package management and transparency logs
Go’s built-in package manager is the only one I tested that verifies signatures by default, and it also introduces one final concept for cryptographic package integrity. When
go get
or
go mod download
fetches a package
10
, it hashes the package contents and compares the hash, package name, and version against the
checksum database
. The contents of the database are registry-signed (analogous to PGP signatures in Perl’s PAUSE server), and the default checksum database public key is
hardcoded
in Go’s source code. As long as the checksum database’s private key is used honestly, this design ensures that the package name and version are enough to uniquely identify the binary contents of a package. As a result, the
go.mod
lockfile achieves package integrity without needing to store cryptographic hashes.
11
Go’s checksum database is an example of a transparency log, or an immutable, global, tamper-resistant log of metadata. The same capability is provided by Sigstore’s
Rekor
and certificate transparency logs. In package managers, it cryptographically ensures that the package manager only ever installs the same binaries recorded by the transparency log. If everyone agrees on the transparency log, then everyone agrees on the package contents. This makes it more difficult for an adversary to selectively and undetectably target a victim with a malicious package. Transparency logs can still fail if there are
other
vulnerabilities
, the log’s private key is compromised, or no one checks the transparency log for malicious behavior.
Of all the package managers I tested, Go performed the best at maintaining cryptographic integrity in the face of a compromised package repository or proxy. However, the registry-signature-like design means that much of the system’s trust is concentrated in a single private key.
A proposed cryptographic design for package managers
One potential approach that combines the ideas in this post is to include signature information in the lockfile. Rather than commit to the hash of a particular package, the lockfile could commit to a developer’s identity or public key. This reuses much of the infrastructure in place for lockfile hashes, but it separates the question of immediate updates from the question of package integrity.
With this design, the lockfile could specify a single dependency version (for build reproducibility) or a lower bound (for immediate updates), and the included identity ensures that a malicious repository or proxy cannot easily tamper with whatever package version the manager resolves to. In addition, a transparency log can protect against selective targeting, building on Sigstore’s identity-based signing and transparency log service. Sigstore avoids long-lived keys by default, but it also
supports
self-managed keys, KMS providers, and hardware tokens. This gives an easily adopted and secure default while still giving flexibility to developers who desire more control over their keys.
This idea is not new and not my own. Attestation identities are part of the
pylock.toml
Python lockfile
specification
, the
trusted-keys
in Gradle’s
verification metadata
, and the
pgp-keys-map.list
file in the
pgpverify-maven-plugin
for Maven. This is the direction that many package managers are already moving towards, as evidenced by the increasing adoption of Sigstore into publishing workflows, attention on supply-chain security, and bugfixes that specifically cite potential tampering by a malicious adversary. There is increasing recognition that this is a problem, and increasing appetite to fix it.
It won’t be easy. There are many subtle nuances that have to be considered and addressed, signing verification code needs to be developed and audited, and developers need to adopt the resulting design. In many of the package managers I reviewed as part of this project, I found
communities
of
people
who have been thinking about and pushing for cryptographic integrity and package signing for years. They know best what those package managers need, and they deserve the resources to make this a reality.
One of the greatest cryptographic success stories in the past decade has been the
nearly universal
adoption of HTTPS, driven in part by industry and community recognition of the security risks of unencrypted traffic, and the nonprofit
Let’s Encrypt
providing free and easy-to-use TLS certificates as a public good. Package signing is in a similar state now to where HTTPS was a decade ago: persistent adversaries are a huge concern, and cryptographic security is nearly nonexistent. Universal package signing is not here yet, but it is on the horizon. With the right attention and investment, we can make it a reality.
Acknowledgments
Thank you to William Woodruff for valuable discussions about lockfiles, identity signing, and the challenges of package manager security.
Palantir and Sadiq Khan drop legal battle over Met contract
Guardian
www.theguardian.com
2026-10-14 12:05:22
Dispute related to claims London mayor blocked US tech firm from £50m police deal because of concerns over its values Palantir and the London mayor, Sadiq Khan, have called off their legal fight over claims the Labour mayor was blocking the US tech company from signing a contract with the Metropolit...
Palantir and the London mayor, Sadiq Khan, have called off their
legal fight
over claims the Labour mayor was blocking the US tech company from signing a contract with the Metropolitan police because of its values and ethics.
Palantir and the mayor’s office for policing and crime (Mopac) announced on Wednesday they had withdrawn allegations against each other, heading off a high court trial scheduled for January.
Palantir sued Mopac in June after Khan
stepped in
to block it from awarding Palantir a two-year, £50m deal for Scotland Yard to use AI to process intelligence in criminal investigations in a system called unified operational analytics (UOA), citing a “clear and serious breach” of procurement rules.
With Palantir also working for the Israeli military and for the Trump administration in its immigration crackdown, Khan has previously said Londoners only wanted to see public money being paid to companies that “share the values of our city”.
Louis Mosley, who heads Palantir in the UK and Europe, responded by accusing Khan of politicising procurement and said he was “putting politics above public safety”. He said: “What Londoners value is not being mugged, not being raped by a serving police officer.”
The agreement to drop the claims against each other comes a month after Palantir
hired Tom Watson
, the former Labour party deputy leader, as a full-time lobbyist. The firm was concerned that if public authorities were able to block it from winning contracts due to objections over the values of its senior leadership, it would undermine its ability to operate in the UK.
Palantir is facing a battle to retain its £330m NHS medical data contract amid a vociferous campaign from parts of the public and some MPs for it to be replaced by a less controversial company.
Palantir and Mopac said in a joint statement that Mopac’s decision in May to block the contract “was not based on Palantir’s values or ethics or any wider reporting about the company”.
“Mopac recognises Palantir’s concerns that media reporting of a statement from the mayor’s spokesperson before the decision was taken could have incorrectly created the impression that an assessment of the company’s values had been a factor in that decision,” it said.
“Mopac’s consideration was based upon its statutory role of examining spend proposals, against the appropriate legal tests and the relevant guidance on procurement, governance, affordability and ensuring value for money for Londoners.”
Khan said: “London is the technology capital of Europe, and I am proud that leading software firms choose the city as their home. Palantir makes a significant contribution to jobs and investment in the capital, employing a large number of Londoners whose services have been procured legally by organisations across the UK and beyond.”
Watson said: “The mayor and his team have recognised their actions could have created the impression that the decision to block the UOA contract was based on Palantir’s values. I’m very pleased that they have today corrected any such impression, and that even in the face of extreme provocation from highly organised pressure groups, decisions about deploying technology can still be made on their merits and in the public interest.”
A new procurement process for the £50m police tech deal is under way and Mopac has agreed to treat Palantir “fairly and equally” if it bids, as expected. Equally, Mopac is not bound to agree to Palantir’s appointment.
Each side is covering its own legal costs, no admissions of liability are made and no damages have been paid.
Upcoming Speaking Engagements
Schneier
www.schneier.com
2026-10-14 12:02:17
This is a current list of where and when I am scheduled to speak:
I’m speaking at ATTENTION: Democracy, Rebuilt in Montreal, Canada. The event runs October 21–23, 2026, and my talk is on Wednesday, October 21.
I’m speaking at the University of Toronto in Toronto, Ontario, Canada, at 5 PM ET on Octo...
We apologize for the temporary outage. The administrators have been notified and the problem should be rectified soon.
Please refresh this page again shortly.
Essay: Frontier AI Cannot Be Audited
Math Babe
mathbabe.org
2026-10-12 11:38:19
As many of you know, I started an algorithmic auditing firm ten years ago, after publishing a book called Weapons of Math Destruction: how big data increases inequality and threatens democracy. I saw how algorithms and AI were infiltrating every human bureaucracy, making important if not life-alteri...
As many of you know, I started an
algorithmic auditing firm
ten years ago, after publishing a book called Weapons of Math Destruction: how big data increases inequality and threatens democracy. I saw how algorithms and AI were infiltrating every human bureaucracy, making important if not life-altering decisions about our daily lives, and I wanted to set better standards in algorithmic auditing than what I’d seen during the financial crisis, where investment banks essentially bought AAA ratings on very questionable mortgage-backed securities. With a background in mathematics and data science, and with a keen interest in the public good, I was well-poised to do this work.
Fast forward to now. After many years of hands-on experience auditing algorithmic systems that decide people’s insurance premiums, mortgage rates, student loan APR, hiring decisions, and online experiences with dating, socializing, and searching for homes, I’m here to report that the frontier AI models cannot be audited, for two reasons.
First, auditing requires a use case: a narrow context so that we have an idea of the stakeholders and the stakes. Who could get harmed by this system making mistakes, being biased, or not working at all in certain situations? Ultimately we want to be able to build a version of a cockpit for that particular situation, which is to say a highly contextual set of monitors that keep our attention on specific kinds of AI harm, to specific stakeholders. Just as we wouldn’t want to fly in an airplane that has no pilots or cockpit, we shouldn’t cede control of very important economic systems – like the job market – to opaque algorithms that might not work, or might only work for some people.
The problem with frontier AI models, given the above, is that they are extremely general tools. They can be used for hiring, and are, but they can also be used for cheating on homework, deceiving a bank, or hacking a website. There are too many use cases, too many stakeholders, and too many types of harm to possibly design a reasonable cockpit. Of course, that shouldn’t stop us from building a monitoring system for a particular use case, like AI hacking a credit union.
But that brings us to the second problem with auditing AI models, namely their inconsistency and unexpected actions. We’ve seen it with the Hugging Face incident and other hacks, as well as the AI agent swarm that solves longstanding problems mathematics: these agents are relentless and clever, and they work in teams. They do things we did not think of, in ways we really could not predict. This makes them very different from old-school machine learning algorithms that would assign a “risk score” to car insurance customers. We know how to audit a scoring system, but we cannot even predict the actions of an AI agent swarm. This makes it impossible to honestly claim that we have auditing such a system.
Having made the case that auditing a frontier AI model is impossible, let me also explain that plenty of people will still claim they did it. But they are misleading us, or trying to. What they are actually doing is filling in the gaping holes that have been discovered and reported on. Like the proverbial little Dutch boy, they are sticking their fingers in all the known holes in the dike, and calling the dike safe. Is the AI giving advice on killing yourself? There’s a benchmark for that, which checks that it won’t do that. Is it now allowing you to ask the same questions but “for a friend”? Let’s build another benchmark that plugs up that particular hole too. And so on.
What the public needs to know is that there are other holes, thousands of them, and there’s not even a requirement for the frontier AI companies to report the holes that keep emerging. For that matter, as the AI companies barrel ahead with more and more sophisticated versions of their software, the dike’s foundations are giving way. The number of holes can be expected to proliferate. And the international criminal rings that increasingly use AI can be expected to exploit them.
Auditing isn’t just plugging up holes. That’s necessary but not sufficient; when we say we’ve audited an algorithm for safety and it passed, it should mean the product is safe. What we have with frontier AI models is not safe, and the public should not fall for the hype.
AI Skeptics: AI Trifecta: Hacks, Financing, and Lobbying
Math Babe
mathbabe.org
2026-10-12 11:36:07
We had a great conversation with Tom Adams talking about the latest AI news. It’s spicy! Apple Spotify YouTube...
Was this Mark Zuckerberg’s first – and last – taste of Guinness?
Guardian
www.theguardian.com
2026-10-14 11:33:52
The Meta boss looked traumatised when he sipped stout on the Cheeky Pint podcast. An hour later, his glass was still half full Name: Guinness. Age: Arthur Guinness began brewing porter in the 1770s. Guinness draft was first poured in 1959. Continue reading......
Age:
Arthur Guinness began brewing porter in the 1770s. Guinness draft was first poured in 1959.
Appearance:
Espresso martini in a pint glass.
But it’s beer.
It’s stout, yeah. Irish stout.
Sort of an old man’s drink, isn’t it?
Not these days. Fans of Guinness include Kim Kardashian, Olivia Rodrigo, even the Princess of Wales.
That’s just a bunch of celebrities pretending to like Guinness either because they’re visiting Ireland or it’s S
aint Patrick’s Day
. O
r both.
Some of them have actually tasted it:
Mark Zuckerberg
, for example.
I wouldn’t have guessed
Zuckerberg
drinks Guinness.
He has drunk it – and apparently for the first time – on a recent instalment of the Irish billionaire John Collison’s Cheeky Pint podcast, which is set in a pub.
How did he like it?
He didn’t say.
What makes you think it was his first time?
The look on his face.
Did he look as if he was enjoying it?
He looked as if he might be allergic to it.
What do you mean?
At the start of the podcast, while discussing his new Muse AI app, the
Meta
founder picks up the full pint in front of him and takes a sip.
Like a regular person, you mean.
Close enough, up to that point. But his subsequent reaction went viral.
What did he do?
He looked surprised, for a start. Then as if he was having trouble swallowing. He pursed his lips, squirmed in his seat and seemed to be looking around for the nearest exit.
Oh my.
After that he clutched at his shirt collar a bit. He even tried smiling briefly before realising he’d selected the wrong human facial expression from the dropdown menu. Eventually he managed to power down and reset himself.
Did he at least
finish the pint?
He kept at it, but by the 1 hour 20 minute mark he’d only managed about half.
Then what happened?
There was an apparent break in filming, and when they resumed he had another full pint in front of him.
His worst nightmare! Still, I suppose Guinness can manage without
Zuckerberg’s endorsement.
You would have thought so – it sells 1.88bn pints a year globally, with
sales continuing to rise
, while the overall beer market declines. And Guinness 0.0 is the No 1 non-alcoholic beer in the UK.
So what made Zuckerberg think he ought to pretend to like it?
Well, he did
buy a castle in Ireland
last month for €20m (£17m), so maybe he’s planning on popping down to his local more often?
Do say:
“Guinness is an acquired taste, and I’m in the process of acquiring it in the same way I’ve acquired many startups and competitors. Was this answer helpful?”
Don’t say:
“Then, when my new AI model kills everyone, I’ll drink what I like.”
What I Self-Host | Aspirational Self Hosting Guide
I’ve always had a foot in the self-hosting world, long before it was called that. My freshman year of university, I ran a website from a Linux box underneath my bed. There was some downtime when my roommate got tired of the fan noise and turned it off. For several years I ran
MythTV
, then
XBMC
(later known as Kodi).
Recently, I lived for a few years in India, where streaming services are extremely inexpensive by western standards. We had Netflix, Disney Plus (Hotstar in India), and Spotify. After leaving India, I was unwilling to pay western prices for these services. But I had also become fed up with the engagement treadmill, particularly for my son. We wanted to limit his viewing choices to certain programming, but the constant “recommended for you” and “up next” caused conflict. While there are ways to limit content to specific titles, or disable auto-play, doing this for each service and keeping track of when client applications change and need to be reconfigured is too much work.
So, I “cut the cord” in a different sense, ditching streaming services for self-hosted
Jellyfin
. Over the course of the next year and a half, Jellyfin opened the door to self-hosting many other services, reducing my dependence on cloud service providers, and providing a welcome stability. No longer am I constantly confronted with unnecessary site redesigns, new features of questionable value, and a barrage of e-mails about terms-of-service updates, binding arbitration, data breaches, etc. I read the release notes of new versions of the software I host and decide if and when I want to upgrade.
Rules
I have a few ground rules.
With the exception of VPN servers that run on my router, I do not expose any services directly to the public internet. I don’t care how convenient it would be, or how secure an application is. Especially with AI-assisted hacking, I simply don’t think it’s wise. My ISP also uses
CGNAT
for its IPv4 addresses, so my home network is not directly reachable from the public internet via IPv4. My VPN servers are only publicly routable on IPv6, a limitation that has some downsides but is workable for my use cases, and likely helps limit unfriendly attempted connections. The biggest downside is that my VPN will almost never function on a public Wifi network, since these rarely offer IPv6. When using my phone, I can disable Wi-Fi and connect over mobile data… if there is service.
I prefer running services natively when possible, but will containerize complex services or those with many dependencies. Love: a service that’s a single Go binary. A service that only comes as a Docker compose file and wants to run MySQL, Redis, and three other containers? I’m already looking for an alternative. If the dependencies aren’t overwhelming, native is better, faster, and more efficient. I can use the same management tools and commands across multiple services. There’s no mental overhead of having to get into this container to run some command, finding out this container is missing curl, that one runs busybox so all the arguments are different, or dealing with a virtual network and host port mapping.
Related, I don’t do Docker anymore. It’s not really a principled position, but I grew tired of having to manage a completely separate service control system on my server. I’m already using systemd, and at this point
Podman’s integration with systemd
is excellent.
Hardware
Last year I bought a Beelink Mini PC, specifically an S12 Pro with an Intel N100 processor, 16 GB RAM, and a 512 GB internal SSD. It was before the rampocalypse, so I paid EUR 180. The same listing on Amazon is currently EUR 359. Ouch! Attached to the server is a 6 TB hard drive for media storage.
My
comment on Hacker News
about what I self-host prompted some questions about how all of this could run on 16 GB RAM. As I describe below, there are some choices I’ve made that reduce resource demand on my server, but ultimately it turns out you don’t need much hardware to run a lot of stuff. Obviously I’m not running any local inference on this hardware, but for everything non-AI, it has just worked out of the box, or with some simple configuration tweaks.
Services
In alphabetical order.
Actual Budget
Budgeting software with desktop clients and a web application, custom reports, and rules-based categorization. I only use this for budgeting and checking/savings/credit accounts. For tracking investment accounts, I use a cloud service. Some day I’ll try to move away from the latter…
While
Actual Budget
supports automatic transaction import from various banks, I don’t use this feature. Instead, after each month end, I download the prior month’s transactions (OFX format preferred, CSV if no other option) and import them manually. This works for me because I primarily use Actual Budget for expense tracking, not… actual… budgeting.
Podman.
Audiobookshelf
Add, download and store audiobooks and podcasts on your server, listen to them on your phone. I haven’t used the audiobook feature much, I set it up more for my kids, but it has very nice chapter handling. In the past for podcasts I used PlayerFM, then Pocket Casts, but now unless I’m out of the house without VPN connectivity, I use
Audiobookshelf
.
Native.
Automatic Ripping Machine (ARM)
ARM
automates ripping and transcoding DVDs (and Blu-rays, but I don’t do those). Yes, it’s 2026 and I still rip DVDs. Remember, we cut the cord, so not only is this a conduit for new-to-us content, but it’s also a way for us to get bilingual content (English and French).
Podman.
Backrest
Web UI for
Restic
backup software. Backups are important! Especially for Immich (photos). Restic does a good job deduplicating and compressing backed up data, and
Backrest
makes it easy to manage the storage retention policies. Notifications in case of failure go to Gotify.
Native.
Beszel
Beszel
is a simple monitoring dashboard that collects basic stats from agents (in the old-fashioned sense of a small background service) to display CPU load, memory and disk usage, temperature, battery, etc. Helps me keep an eye on various other hosts I have around the house (several Rapsberry Pis and a Proxmox cluster that may be the subject of a future post).
Native.
Caddy
Caddy
is a web server and reverse proxy. Early on I didn’t understand the value of a reverse proxy, and I thought I would be fine accessing my services with a local DNS name, or even IP address, and port number. But then I started adding more and more services, and some required HTTPS. So I got a domain name (not this one) and set up Caddy to automatically obtain LetsEncrypt SSL certificates, and now nearly all of my services are accessible on my LAN (or over VPN) with HTTPS and friendly subdomain names. Adding a new service is a quick edit to the Caddyfile.
Native.
Cockpit
Cockpit
is a web-based admin console for the server. It uses normal system authentication methods. For me, it’s mainly useful for spotting failed services when no notifications are set up for them.
Native.
Forgejo
Forgejo
is a fork of Gitea, and deploys as a single binary. Github’s uptime is the butt of a lot of jokes these days, but I also appreciate the speed of having my own git remote. Eventually I’ll set up CI/CD and runners, if only to deploy this blog.
Native.
Web-based RSS reader
. These days I basically visit two websites, though, so I’ve not been using it much. I do subscribe to the Github releases of some of the services I self-host so I can check out the features and bugfixes in new versions.
Native.
Frigate
Network video recorder (NVR). I first started with
Zoneminder
because I’m of a certain age. But it became clear that Zoneminder is past its prime.
Frigate
has been fantastic. I run it with 8 IP cameras. It provides alerts for people and cars entering the driveway, integrates with Home Assistant to power various automations (e.g., when a person is detected in the backyard, turn on the camera floodlight). I may write a future post with some details about my IP camera adventures.
I run all of my cameras at lower resolutions than they support, primarily to avoid Wi-Fi network congestion. Most cameras also support an even lower-resolution RTSP substream, which is what Frigate uses for motion and object detection. Keeping the camera resolutions low avoids excessive CPU and memory from video processing, and excessive disk usage from recordings. They are good enough to identify faces, and privacy laws in my country prohibit filming public rights of way, so my cameras are not aimed at distant points.
Podman.
Gonic
Subsonic-compatible server written in Go. I purchased a perpetual Subsonic license a long time ago, but the original project is ancient and the modern alternatives are better. I run two separate instances of
Gonic
, one serves kid music, the other serves adult music.
Native.
Gotify
Simple notification service written in Go. Many self-hosted services directly support
Gotify
notifications, or can send them via a custom HTTP POST. In conjunction with Uptime Kuma, I use Gotify to get notifications about any services or devices that are down, what my kids are watching on Jellyfin, when a new podcast episode is available in Audiobookshelf, etc.
Native.
Home Assistant
Home Assistant
probably deserves its own post. It’s fantastic, and I cannot imagine trying to accomplish the same things within a proprietary ecosystem like Google Home, Amazon Alexa, or Apple Home. Things are better now that device manufacturers are standardizing on protocols like Matter, but the control and flexibility you get with Home Assistant is hard to beat. It has a steep learning curve, though, and I need to think about realistic ways to handle potential server failure without compromising the functionality of my home.
Podman.
Homepage
At some point I realized I was running so many services, I needed another service just to keep track of them all.
Homepage
was a good solution. It has widgets for almost all the services I run, so I can get a quick overview of what’s going on, or just a quick link to the subdomain of a service.
Podman.
Immich
Google Photos alternative. I was tired of Google constantly promoting paid storage plans in their apps. I was able to manage my storage space, but my wife was always about to run out of room. We moved to
Immich
last year, just after version 2 was released. It’s much faster to load pages full of photos when all the network activity is within your house. I’ve come up with a solution for sharing albums with family, as well. Still a lot of work to do with Immich - I have many duplicates, and now that storage isn’t a concern, I’ve been less disciplined about culling photos and videos.
Podman.
Jellyfin
As I mentioned in the introduction, I’ve self-hosted media for a long time, going all the way back to MythTV twenty-some years ago.
Jellyfin
is opinionated about its media organization, but it generally works well. I only use it for movies, TV, and home videos, so I can’t speak to its other features (e-books, music, photos, etc.). While my son still remembers Netflix, he is satisfied with Jellyfin. I appreciate the lack of auto-play, never seeing recommendations, and not having to scroll past a bunch of garbage to find what I want to watch.
One of my ways of managing resource demand is by generally preferring 720p media over 1080p or higher. And obviously when ripping DVDs, it’s either 576p or 480p. I do have a 4k TV, but it’s not extremely large, and while I can tell the difference in resolution between SD and HD, for almost everything, 720p seems to be good enough for me.
Podman.
Music Player Daemon (MPD)
Sometimes there are solutions that just work, and don’t really need to change. I think
MPD
is one of these. It’s been around for 23 years. While Gonic is great for listening to music on my phone, even streaming music from home to my phone while I’m away via VPN, MPD is how I play music through Snapcast to the whole house audio system. I run two instances of MPD, one for music, and one for podcasts.
Native.
PocketBase
I used to keep track of transactions and receipts for special accounts (HSA, 529, etc.) in a SQLite file I accessed directly with SQL Workbench/J. But things became more complicated as I moved between countries, currencies, and different insurance systems, and also wanted to offer my wife the ability to enter transactions. I migrated to
PocketBase
, which is ultimately still just a SQLite file, but with a nice web-based management frontend that I abuse as a generic CRUD frontend. It’s simple enough for my wife to use as well, and I can still run arbitrary queries against the underlying database file.
Native.
Readeck
Readeck
lets me tag and archive copies of stuff I read. I was a heavy
Zotero
user in graduate school, but I’ve not needed to write a bibliography in years. However, I still read things that I want to ensure I can access later. I tried
Wallabag
first, but it had trouble archiving things that were paywalled, even when I was logged in on my phone. In contrast, Readeck will archive what my phone is seeing and store it on my server.
Native.
Samba
Samba
provides shared network storage, making it easy to copy files to and from the server, or share important documents with my wife. It’s funny how a file sharing protocol first developed in the 1980s and most associated with Windows remains the best option for cross-platform file sharing on a LAN.
Snapcast
provides whole-house synchronized audio. Think Sonos, but without the expensive vendor lock-in and planned obsolescence. This also deserves its own post. It’s complicated to set up, but it works really well. I eventually plan to purchase some additional devices primarily for use as Snapcast receivers.
Native.
Syncthing
Syncthing
is part of a backup strategy for my photos in Immich. I’ve set up a one-way sync (receive only) on my Macbook, so that a copy of all the photos in Immich eventually make their way to my Macbook’s external drive.
After a few instances of my wife saying “X isn’t working” and needing to restart a service manually, I realized I needed a way to keep track of what services were running, or not.
Uptime Kuma
is simple but has a useful set of features. I can ping devices to ensure they’re online, check the status of Podman containers, look for HTTP 2XX response codes from various services, or even parse a JSON payload and extract some details for the health check. If something goes down, I can send a Gotify notification (after a few retries, of course).
Podman.
Vaultwarden
Self-hosted version of Bitwarden. For years, I used
KeePass
, but never had a good syncing solution, so just avoided logging into things on my phone. Meanwhile, my wife used LastPass, which had various breaches and incidents, besides autofill just not working very well. Migrating her to KeePass was not practical, and I settled on
VaultWarden
, which is an open-source API-compatible reimplementation of BitWarden that works with the official BitWarden clients. I’m not a huge fan of the BitWarden browser extension, but it’s mostly fine. The Android application is good enough, and syncs seamlessly and automatically when I’m connected to my LAN; otherwise, I can connect via VPN and manually trigger a sync if needed.
I am a little concerned that Bitwarden may eventually become hostile to VaultWarden and break the client compatibility. At this point, the only other major Bitwarden compatible client I’m aware of is
Keyguard
, which does not have an open source license and uses a freemium model.
Podman.
Vikunja
I’ve been a Trello user for about a decade. But after Trello’s
disastrous multi-day outage
earlier this year, I decided to find a self-hosted alternative. I ruled out anything that involved spinning up a PostgreSQL or MySQL database for a service that will serve two users.
Vikunja
uses SQLite by default, though it can be configured to use other database backends. It’s not perfect, and the Android application has some missing features, but it’s good enough for me. Single binary deployment? Yes, please.
Podman.
Yubal
Simple web application to download YouTube Music playlists. I normally use
yt-dlp
for downloading YouTube videos, or
NewPipe
for watching on my phone, but
Yubal
will properly name, organize, and tag music downloaded from YouTube Music.
Podman.
Non-Services
Here are a few things I don’t self-host, tried but decided against, or am unlikely to try.
The *arr Stack
Sonarr, Lidarr, Radarr
, etc. Every time I read about setting it up, it just sounds like a resource-intensive mess that’s fundamentally prone to frequent breakage. That’s the opposite of what I’m looking for when choosing self-hosted services.
Collabora Online
While it would be nice to completely part ways with Google, it’s hard to beat Google Docs as a highly convenient and easily accessible way to store and share information. Still, I choose LibreOffice Writer and Calc unless I have a specific reason why the document needs to be in the cloud. Since I already have a shared network drive, it seems pointless to run a service like
Collabora Online
(a web-based office suite) instead of just using LibreOffice locally.
Firefly III
I tried
Firefly III
before Actual Budget, thinking I needed built-in support for multiple currencies. It was a complex setup, involving multiple containers, including a container just for importing data. Actual Budget was much simpler to set up and use. For my foreign currency accounts, I have my own simple script to handle exchange rate conversion, so everything in Actual Budget stays in USD.
Owntracks
I like Google Maps Timeline, but after Google limited the location data to the individual device, I hoped to find a self-hosted version. But I could never get the
OwnTracks
Android application to consistently report my position, no matter how many battery or location settings I tried.
Dawarich
is another option in this space, but it wants to run “at least” four containers (PostgreSQL, Redis, Sidekiq, web application). For me, that’s not a compelling trade of resources required versus value I’m likely to obtain.
Music Assistant
Music Assistant
might work better for you if you don’t already have a music setup you like. In my case, I already had Gonic, Snapcast, and MPD working well. Music Assistant felt like it wanted to “own” everything; for example, it seemed to continually rearrange my Snapcast device groups.
E-mail
Self-hosting e-mail seems like a lot of work for very little benefit. I cannot risk not being able to send or receive e-mails. Eventually I would like to transition away from Gmail to a paid provider.
Conclusion
That’s 17 native services and 11 Podman services, all managed by systemd.
htop
currently shows about 7.5 GB of memory in use, and CPUs fluctuating between 30% and 40%. It turns out this Mini PC can run a lot! Given how expensive computer hardware has become due to the AI crunch, I hope we’ll continue to see self-hostable projects that prioritize simplicity and efficiency.
The Matsu Islands are an archipelago of 36 islands in the East China Sea, alongside the southeastern coast of mainland China. The islands have been administered since 1949 by Taiwan, part of a larger set of outlying islands administered by Taiwan, which includes the Kinmen and Penghu Islands, which all lie in the Taiwan Strait.
The Matsu Islands are connected to Taiwan’s main island by two submarine cables —
Taima No.2
,
Taima No.3
, and soon
Taima No.4
. The Taiwan Strait is a shallow body of water, with an average depth of 70m. The submarine cables that lie on this seafloor are vulnerable to damage from ship-based activity, like being snagged by fishing equipment or anchors. But these particular cables have been remarkably unlucky. Between 2018 and 2022, the submarine cables between Taiwan and the Matsu Islands were cut 27 times, and there have been four major outages in the three years from 2023 to 2025.
That’s not the only location where submarine cables have suffered many faults. The Baltic Sea is a shallow sea that has a dozen or so submarine communications cables, and undersea electricity and gas pipelines. There have been 11 disruptions to these submarine systems since 2023. Again, a very unlucky track record.
There are an estimated total of 1.5M
kilometres of subsea communications cables, used by 607 in-service submarine cable systems (Figure 1) that are critical to the world’s telecommunications services. If they are put out of service for any reason, our satellite systems simply could not replace them. In such a catastrophic scenario, some communities would be totally isolated, with severe logistical and economic ramifications.
Figure 1 — Submarine cables, October 2026. Source:
Telegeography
.
We regard this collection of submarine cable systems as critical infrastructure for global communication services, and we take care to make them as resilient as possible. Modern warfare can deliberately disrupt communications systems, which adds another source of potential damage to the list of geological and accidental risks facing subsea cables.
On the night of 4 August 1914, days after Britain declared war against Germany, the British cable ship HMTS Alert sailed from Dover into the English Channel. The vessel dragged grappling hooks along the seabed, hauled up five German transatlantic and European telegraph cables, and cut them. This severed Germany’s direct, secure submarine cable links to the Americas, Africa, Spain, and the rest of Europe. Germany was forced to rely on wireless radio transmissions, where British intelligence could readily eavesdrop. If the German cryptography used to protect these wireless communications was broken, then it allowed the British to track military movements and capture critical messages, such as the Zimmermann Telegram.
This same action to deliberately sever undersea cables was repeated by the British in September 1939, cutting German cables to Lisbon and New York.
Protecting the cable
These thin polyester-coated cables at the bottom of the ocean are vulnerable, including to:
Geology in the form of submarine earthquakes or landslips
Being snagged by dragging ship anchors or fishing equipment along the seafloor
Deliberate attacks on the cables with grapnels and cutting equipment
How can cables defend against such risks? The inner core of the fibre optic cables and its copper conductor sheath can be wrapped in additional layers of steel cable jacketing as a form of armour (Figure 2). This is mostly used to reduce its vulnerability to shipping accidents.
Figure 2 — Cross-section of a submarine cable. Source:
Telegeography
.
Figure 2 is somewhat misleading. What is depicted here is a cross-section of submarine cable used in the segments of the cable that lead to the surface cable station. The cable segments that are laid on the deep-sea floor use just the inner components: Optical fibre and a single thin steel thread wrapped in a silicone gel, surrounded by a copper sheath (used to power the cable repeaters), and wrapped in polyethylene. There are no external armour elements. These deep-sea cable segments are around 20mm in diameter, or the size of a garden hose.
The cable surfaces at a cable landing station. These landing stations are typically plain, secured facilities with reliable power. The preferred location is a coastal point with a low volume of fishing or other maritime traffic, and a steep rise from the deep-sea floor. Cables are at their greatest risk from coastal shipping activity, so the shorter the distance from the deep-sea floor to the cable station on dry land, the better.
Many jurisdictions also declare ‘Cable Protection Zones’ as a warning to marine vessel operators that there are cables on the seafloor in this area, and ships should refrain from fishing activity and anchoring in these areas.
Cable routing
Cable routing is also important in terms of resilience. There are several objectives in a cable route, and not all of them can be optimized at the same time.
The cable route should be as short as possible, as additional cable length raises capital costs and increases end-to-end signal delay.
Cables should avoid areas of active geological activity where possible, such as tectonic plate boundaries and mid-plate rifts. Deeper is better, but within reason. Cables on the floor of a deep ocean section are less vulnerable to shipping activity and hostile efforts to disrupt the cable, but with extreme depths it’s more challenging to locate and raise the cable when undertaking a repair.
Sometimes there are geographic ‘choke points’ through which many cables are routed. The Bab al-Mandab Strait is not just a choke point for surface vessels passing between the Indian Ocean and the Red Sea, but it is also the conduit through which 16 cables pass (Figure 4). In September 2025, several cables were severed in the Bab al-Mandab Strait, disrupting an estimated 25% of cable capacity between Asia, Europe, and the Middle East. Houthi-controlled waters remain effectively ungovernable for cable protection.
Figure 4 — Cable routes in the Bab al-Mandab Strait. Source:
Telegeography
.
There is also the Singapore Strait, a major junction for 35 cable systems (Figure 5). This is a shallow water strait that also hosts a significant volume of surface shipping.
Figure 5 — Cable routes in the Singapore Strait. Source:
Telegeography
.
Further north, between Taiwan and the Philippines is the Luzon Strait, where 18 cables pass (Figure 6). This was the location of an earthquake and a subsequent set of submarine landslides in December 2006 that not only severed all the cables running through this strait, but also buried many of them under deep layers of sediment. It took 11 repair vessels 49 days to bring all the cable systems back into operation.
Figure 6 — Cable routes in the Luzon Strait. Source:
Telegeography
.
The Black Sea is an area with geopolitical risk and regulatory gaps. While mine risk is confirmed, no cable faults have been directly documented in the war in Ukraine. Russia’s continued presence and the conflict make this region functionally inaccessible for routine cable maintenance.
Geopolitics also plays a role in cable routing. Cable owners will prefer to avoid routes through politically unstable territorial waters if suitable alternative routes exist. There are also political considerations. If a cable lands in US territory, then the cable is subject to several Federal Communications Commission (FCC) constraints, including banning equipment or services from companies the FCC see as a threat to US national security. The FCC has also refused to permit the landing of a cable on US territory if the cable also lands in a territory that the US deems to be a foreign adversary.
Land routes are avoided in general, but there are some circumstances where a land route is the preferred option. Connectivity between Asia and Europe would normally run through the Bab al-Mandab Strait, landing in Egypt in the Gulf of Suez, then overland through Egypt to get to the Mediterranean Sea. There is an alternative route through the Persian Gulf, Iraq and Türkiye, although this entails a segment that transits the Strait of Hormuz, or a second overland segment through Oman and the United Arab Emirates.
Cable faults
Around 200 submarine cable faults are reported worldwide each year, a figure that the International Cable Protection Committee notes has stayed broadly steady in recent years even as the total cable inventory increases. The cables themselves are remarkably reliable. It is the maritime traffic above them that is the cause of most of the problems. 86% of cable faults are likely due to fishing activity or anchoring, and fishing activity is around twice as prevalent as anchoring incidents.
Geological events, such as submarine landslides and seabed movement, account for about 7% of cable faults, cable abrasion for 4%, and component failure (in repeaters) for only 4%.
With the high correlation of faults and maritime activity, it is not surprising that just under one half of cable faults occur in territorial waters, and most of the remainder occur in exclusive economic zones. Just 2% occur on the high seas. Cables are most vulnerable close to shore, in shallow water, where fishing is concentrated, where ships anchor, and where the cable must come ashore at a landing station alongside every other cable serving that coast. The deep ocean, where there is little seabed fishing activity and few ships anchoring, is the safest location for a cable.
National jurisdictions do not stop at the low tide mark of a territory, they extend out into the sea and the seafloor. The 1982
United Nations Convention on the Law of the Sea (PDF)
defined sovereign territorial waters as a 12-mile zone extending out from an economy’s coast. Every coastal economy has exclusive rights to the oil, gas, and other resources in the seabed up to 200 nautical miles from shore or to the outer edge of the continental margin, whichever is the further, subject to an overall limit of 350 nautical miles (650km) from the coast or 100 nautical miles (185km) beyond the 2,500-metre isobath (a line connecting equal points of water depth).
What does this mean for submarine cables? From the point where the cable enters territorial waters, any physical activity related to the cable requires the permission of the authorities. All cable construction and repair operations carried out in these sovereign areas also require the permission of the economy that has exclusive rights to the sea and seafloor.
Location and repair
Locating a cable break is straightforward. An optical pulse will be reflected at the point of a cable break, which can provide the distance to the fault from the start of the cable with considerable precision. At that point, it becomes a marine operation.
A specialist cable repair ship must be engaged, which, in turn, must obtain the relevant government’s permission to work at the location of the cable fault (don’t forget that only 2% of outages occur in international waters). Once at the break location, the repair vessel drags a grapnel along the seabed to hook the cable, cuts it, recovers one end, buoys it off, then recovers the other end. A new section is spliced into the cable aboard the ship in a jointing cabin, the fibre fusion-spliced and tested, the joint rebuilt and sealed against pressure, and the repaired cable laid back down with enough slack to reach the seabed.
The cost of a repair can vary greatly, depending on the location and depth of the fault, the nature of the contracted arrangements for cable repair, the amount of time the cable operator is willing to wait for a repair vessel and crew, and the weather. USD 500k to USD 1M is a representative cost of a single cable repair.
While the number of cables has grown, the time taken to obtain permission to operate repairs in territorial waters has generally increased. Industry data indicates repair response times have more than doubled over the past decade, and the longest single repair recorded in 2023 took 947 days, many of which were spent waiting for permission to undertake the repair.
There is also the issue of repair vessels. The industry has roughly 60 ships capable of repairing a submarine cable, operated under maintenance agreements that pool the cost of running this fleet across cable owners in each geographic region. These collective Submarine Cable Maintenance and Repair Agreements are used in the Atlantic Ocean, the North American Western Coastal region, the Mediterranean, South East Asia and the Indian Ocean, and Yokohama in the North Pacific (Figure 7).
Analysis by TeleGeography and Infra-Analytics
has found that around two-thirds of cable maintenance vessels will reach the end of their service lives by 2040, while total cable kilometres are projected to grow by about 48% over the same period. Closing that gap would take USD 3B and require fifteen replacement ships plus five additional vessels simply to hold current service levels as the submarine cable network expands. The immediate problem is that nobody obviously owns this bill. Cable maintenance is funded through shared agreements that have been optimized for decades to be as cheap as possible, which worked when the fleet was young and is precisely the wrong structure for financing a fleet renewal.
This is the core of the cable resilience problem. Adding cable routes is comparatively easy, because today’s hyperscale cloud companies fund much of the new construction themselves and have strong commercial reasons to do so. However, no individual cable is so critical that it can sustain a business case to operate a dedicated repair fleet. The industry uses pooled resources, which suffer from under-investment.
Investigating cable outages
A rundown of recent cable outages includes:
Subsea cables were damaged in
October 2023
by the anchor of the Hong Kong-flagged Newnew Polar Bear operating in the Baltic Sea.
Three cables in the Red Sea were cut in
February 2024
by the drifting Rubymar vessel after it was struck by a missile.
The C-Lion1 and the BCS East-West Interlink cables were cut in the Baltic Sea in
November 2024
with the Chinese bulk carrier Yi Peng 3 nearby.
Four cables were damaged in
December 2024
, with anchor drag marks on the Baltic seabed and the Cook Islands-registered tanker Eagle S detained.
Three major cables, including SEA-ME-WE 4 and IMEWE, were cut in the Red Sea in
September 2025
.
Finland and Estonia lost connections again in December 2025, with anchor drag confirmed by
March 2026
on Baltic cables.
In
August 2026
, the Indigo West and Indigo Central cables off Perth were damaged, with a UAE-managed tanker under investigation by Australian Federal Police.
The outcomes are much less uniform than this list suggests. Swedish authorities found no conclusive evidence of wrongdoing in the Yi Peng 3 case and ruled the January 2025 Latvia-to-Gotland damage accidental. A Finnish court dismissed the case against the Eagle S captain in October 2025. United States and European officials concluded that several of the Baltic incidents were accidental. The captain of the Hong Tai 58 was convicted in Taiwan and sentenced to three years over the Taiwan to Penghu No. 3 cable, and the Newnew Polar Bear captain faced criminal damage charges in Hong Kong. The April 2026 Matsu fault turned out to have been caused by the wreck of a stranded fishing boat shifting onto the cable.
Anchor dragging is a common occurrence, particularly among poorly maintained merchant vessels in bad weather, accounting for a large share of ordinary faults every year. This may explain why investigators keep reaching inconclusive findings in good faith.
Who is responsible for cable resilience?
Cable systems have changed in recent decades.
The old telephone system regarded each cable as a self-contained system. The cable owner was responsible for its own resilience, independent of any other cables that may exist on similar routes. The telephone’s data carriage system typically used a ring architecture, where any outage in the ring caused the traffic to flow along the other half of the ring. If the ring used diverse paths, then any individual outage in the ring could be repaired immediately.
However, the implication of this design was that the actual capacity of the system was double the usable capacity. The cost of using such a cable reflected this 50% carriage efficiency.
In their search for cheaper services, Internet Service Providers (ISPs) wanted to purchase non-backed-up cable capacity, at a price that reflected this greater efficiency of cable use. They purchased this cheaper form of cable capacity on multiple cable systems. Individual outages caused a break in that cable’s service, but the ISP could reroute their traffic to use capacity that had been purchased on other cable systems which were not affected by the outage. For Internet traffic, this failover function is readily achieved in the routing system.
The overall outcome was that the responsibility for resilience shifted from the individual cable operator to the network operator. Cable outages would still cause a drop in available capacity. But as most Internet traffic is elastic, the drop in capacity would cause a drop in performance but not cause a complete shutdown.
Resilience and critical infrastructure considerations
Submarine cable systems are built by private consortia, repaired by private contracts that collectively fund a commercial repair fleet, regulated by coastal states individually, and governed internationally by international conventions drafted long before the Internet existed.
It would be good if permissions to repair submarine cables were granted in a streamlined manner so that repairs were not stalled for months awaiting a government’s approval to operate in their waters. It would be even better if emergency procedures were agreed in advance rather than negotiated during an outage.
Collectively, the industry needs to invest in repair capacity to upgrade an ageing repair fleet. Who undertakes this investment and how the repair capability is managed as a common asset is proving to be a difficult issue. In the worst case, it will be back to every cable for itself, and the inevitable outcome of higher costs and potentially slower repairs.
Geographic choke points will persist, geology will not stop, extreme weather and changing sediment conditions will continue to pose a threat to these cables. Route diversity is an effective response to these challenges, but economic clustering works against cable route diversity. Each cable would like to run through the shortest and cheapest route, and no cable operator is specifically motivated to spend additional sums to take a diverse route to the other existing cables.
None of this is technologically difficult, but it can be institutionally and economically difficult, which is harder.
Looking forward
The telephone company consortium model that funded and operated almost all the world’s subsea cables 30 years ago has come to an end. The service life of the entire inventory of cables and service vessels that they operated is also coming to an end.
Approximately a quarter of the world’s current subsea cable kilometres are projected to be decommissioned and retired by 2030. This massive retirement of capacity amounts to 845,000 kilometres of subsea fibre-optic cables at the end-of-life cycle for submarine infrastructure laid during the massive Internet boom of the late 1990s and early 2000s. Specifically, TAT-8 and TAT-14 in the Atlantic Ocean are being decommissioned, SEA-ME-WE-3, linking Europe and Asia, has been retired, and Japan-US and China-US have ended operations. In addition, more than half of the current repair vessel fleet will have reached their retirement point by 2040.
In their place are cable projects that are either fully funded or partially funded by the current US digital giants. This raises sovereign risk eyebrows in many economies, where the only communications conduits for an economy are owned and operated by a foreign entity. It also raises the question of sovereign control over the submarine repair vessel fleet and the existing maintenance pooling arrangements through submarine cable maintenance zones.
By 2028, Google will own the largest set of cables, measured by kilometres, in the Pacific, Atlantic and Indian Oceans, and based on current plans it will have more than 50% of the entire cable inventory under its control in the Indo-Pacific region. Similar centralization scenarios are playing out in the Atlantic Ocean as well. At this point, the sovereign risk eyebrows should be hitting the ceiling, as such a dominant position gives this single company unilateral control over the maintenance arrangements and associated repair vessel operations for the entire world’s communications network.
This is a serious issue for us, both as individuals and societally as we try to preserve the integrity and utility of our common communications infrastructure. The stability and productivity of our societies rely on our ability to communicate with each other seamlessly, efficiently and privately.
Passing the investment and operational costs of the public telecommunications services from public to private hands in the latter part of the 20th century was seen as a smart move. The move used private finance to fund the reinvigoration of national telecommunications infrastructure as it shifted from time-based voice switching to a far larger packet switching architecture to support computer-mediated communications and service provision.
However, we may see more uncomfortable outcomes looming in the near future. It was thought that the discipline of competition would rein in the potential abuses by private operators of the privileged position of operating a public communications service. That is not what happened.
Not only are public telecommunications systems now largely in private hands, but we are also seeing consolidation of the global telecommunications system to a few private entities, with no competition. Their accountability is not to the public or users of the service. Their accountability is to their institutional investors to continually improve their value and profitability. Nothing else.
So where does this leave the submarine cable system and efforts to maintain its critical function with the appropriate levels of resilience that reflect their critical role in global communications? Outside the US, few individual economies, if any, have the resources to meaningfully respond to this challenge. The European Union (EU) has taken some action to contribute to funding a fleet of repair vessels and taken measures to improve surveillance on submarine cables as a matter of regional security, but no other economies appear to be following this lead. It would certainly be ironic if this EU money were to end up simply funding the maintenance of Google’s submarine cable assets!
Back to the topic of cable resilience, viewed at a global level: Communications resilience is largely an ocean infrastructure question. Answers to this question rely on:
Detailed and current seabed surveys
Shipping controls to prevent anchoring and seabed fishing in declared subsea cable protection zones
A distributed repair fleet and crews trained to perform repair tasks
Rapid clearance to operate in territorial waters
Some coordination of action is necessary to open diverse cable routes and avoid single points of vulnerability and potential failure. The global cloud, for all its connotations of weightless air, firmly rests on the solidity of the seabed, and it can be no more reliable than conventions that we collectively adopt to look after it.
The views expressed by the authors of this blog are their own
and do not necessarily reflect the views of APNIC. Please note a
Code of Conduct
applies to this blog.
A post called
Passkeys are a trap. Do not use them.
has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this true?' kind of vibe. It's written for "non-technical citizens of the web", and the headline advice is to stop using passkeys and go back to TOTP codes and passwords.
The Argument
The post makes what appears to be one central claim: Passkeys support something called attestation, which lets a website ask for cryptographic proof of what made the passkey.
The author calls this a "hidden dial" and argues that sites will slowly turn it up, until you're only allowed to log in with approved software on an approved operating system, with no modifications, no LineageOS and no sharing your Netflix password. Throw in uBlock Origin, the FIDO Alliance membership list and the UK's image-scanning proposals, and the conclusion is that passkeys are "not designed to prioritize your interests". <that-escalated-quickly.gif>
It's a compelling story. It just doesn't match how any of this actually works...
Your Passkeys Don't Attest
The passkeys most people use are synced passkeys, stored in iCloud Keychain, Google Password Manager, 1Password, Bitwarden or whatever other software of your choosing. These passkeys don't give websites an attestation statement at all, and though a site can ask, what comes back is
none
. I know this because I wrote an
opensource passkeys library
and made it available to everyone.
If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that? Besides, the guidance for consumer sites has been to not even request attestation for
years
now.
Attestation Isn't What You Think It Is
The post describes attestation as proving "that an approved passkey manager, operating system, and firmware are in use" which is simply not true.
When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its
AAGUID
, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.
The YubiKey Recommendation
This is the part that surprised me the most. For people who want stronger security, the post recommends a hardware security key like a YubiKey, because it "avoids OS-wide attestation".
YubiKeys are the authenticators that
do
attestation. Every one of them ships with a Yubico-issued attestation certificate, and enterprise attestation exists specifically so organisations can require approved hardware keys. I'd still recommend a YubiKey to anyone who wants one, they're excellent and I use them, but if attestation is the thing you're worried about, the post's own recommendation pushes you towards attestation rather than away from it!
TOTP Is a Step Backwards
The post holds up TOTP as "already" a great solution. TOTP is better than a password alone, absolutely, but it has one big weakness: you can type the code into the wrong website,
just ask my good friend Troy Hunt
. Phishing kits like Evilginx sit in the middle, relay your password and code to the real site in real time, and walk away with your session. This isn't theoretical, it's how a huge number of account takeovers happen today and we have the evidence to prove it.
This is the problem that passkeys solve. A passkey is bound to the domain it was created for, so your browser simply won't use your
example.com
passkey on
examp1e.com
. There's no code to read out and nothing for the user to get wrong. The author even concedes this in the addendum, saying that passkeys are domain-bound and resist man-in-the-middle attacks, but still tells readers to avoid them. Swapping a phishing-resistant credential for a phishable one is a really bad trade...
What You Should Do
Keep using passkeys! Wherever a site offers one, take it, and store it in a password/passkey manager you trust. If you want to be able to move your credentials around, pick a provider that supports that. If you're worried about attestation creeping into consumer logins, then that's worth pushing back on, loudly (if it ever happens). But it hasn't happened, the biggest providers don't support it, and avoiding passkeys today while you wait for it won't protect you from anything, it just leaves you open to phishing.
Sources
I have some experience in this area:
I created
WhyNoPasskeys.com
to track the availability of passkeys on the Web.
I think most of all that it's important to say I use passkeys everywhere I can because they're currently the best thing we have available to protect our accounts. And they're not a trap.
Easy Anti-Cheat (EAC) has supported native Linux game clients since 2014. In 2021, we added support for running Windows game builds on Linux via Wine/Proton. However, that support is opt-in for each game and many haven’t opted in because our Linux implementation couldn’t offer the same level of protection as our Windows implementation. This is why Fortnite isn’t available on Linux yet,
but it’s coming
.
Cheating in online games was once a small cottage industry, but it has become a billion-dollar market where cheat operators sell subscriptions for cheating tools that are updated frequently and require minimal technical skill to use. Without effective anti-cheat measures, these operators can drive enough players away from a game that it's no longer financially viable for the game developer to run.
The long-term solution
The ideal solution for a cheat-free gaming environment is one where the operating system provides assurances to players that their data remains isolated from both anticheat and game companies while also ensuring that the gameplay cannot be tampered with. There have been many efforts over the years to build solutions like this including virtualization techniques to enable cheat free gaming, but to date they haven't gained traction. We hope they soon will, and we'll work with all willing companies in the industry to make this happen in the future. This includes continuing the Easy Anti-Cheat team's open line of communications with Valve to support Steam Hardware devices to the maximum extent technically possible.
The immediate solution - What Epic is doing right now
To close the gap for Linux, we are rebuilding our Linux anti-cheat implementation into EAC Linux v2. We will bring the level of protection much closer to par with Windows, in the very near-term, using existing Linux features including signed kernel, signed kernel modules, and secure boot with attestation. These requirements build on work that distribution maintainers already do, and the more distributions that meet these requirements by default, the fewer players will need to change their setup to play.
We are starting to reach out to leaders in the Linux community, and will continue to engage with more leaders in the coming weeks as we work towards bringing more awesome games to Linux. Later this year, we will co-host a panel discussion with Jef Spaleta (Fedora Project Leader) where we’ll talk through the path to enabling fair competitive gaming on Linux for players.
We are also planning to pilot EAC Linux v2 in Fortnite first, where we’ll test it in a live environment and refine it based on what we learn. Once we’ve validated EAC v2’s effectiveness, we’ll make it available to more game developers so they can bring their multiplayer games to Linux players too.
Join the initiative
If you maintain a Linux distribution, we want to connect with you. If you haven’t been contacted by us already, reach out ASAP to
linux-gaming@epicgames.com
. We’ll answer any questions you have about getting your distribution aligned with our configuration requirements to get your signing keys added to our well-known list. The list is a core part of how EAC Linux v2 verifies systems, so we’ll maintain it to start. Our goal is to make the well-known key list open source, and we welcome PRs from the community to expand it.
When launching a game using EAC Linux v2 for the first time, players will be prompted to install an anti-cheat systemd service which runs only while a protected game is running. For games that already have the existing EAC Linux support activated, developers will be able to choose whether they want to continue using the older anti-cheat implementation for maximum compatibility or switch to EAC Linux v2 for better cheat protection.
On Windows, we rely heavily on a kernel driver to protect the games. This driver isn’t always on, it starts when a game is launched and stops when the player exits. For EAC Linux v2 we will not leverage an equivalent kernel module, and instead we’ll take full advantage of existing Linux platform security features like measured boot, the kernel lockdown LSM, and IOMMU support, plus our own eBPF logic to maintain integrity and detect cheaters. These security features are not available on every distro and may require configuration changes to activate.
Let’s go through the system requirements for EAC Linux v2 one by one. We expect to iterate on these requirements over time, and we appreciate feedback from developers and distribution maintainers to help refine them.
1. Signed Kernel & Kernel Modules
A custom kernel can easily be modified to bypass integrity checks and return false data to anti-cheat. That’s why we require that the kernel binary in use during anti-cheat protected gameplay is signed with a well-known key.
Unlike Windows, most Linux device drivers are part of the kernel source code directly (in-tree) and will be compiled and signed by your distribution alongside the kernel. There are some exceptions that are maintained separately from the kernel (out-of-tree), notably NVIDIA GPU drivers. If you need to load kernel modules, we require that they meet the same requirements as the kernel—being built by an organization and signed with a well-known key.
2. TPM 2.0
The TPM is a hardware feature that provides security primitives like extend-only Platform Configuration Registers (PCRs) which enable a tamper-resistant boot log to be produced and verified. During boot, each piece of the boot sequence (firmware, boot manager, Linux kernel) can record metadata about the code that will run next and update the extend-only registers. This is extremely valuable, because when properly used, it enables an application like anti-cheat to know what code ran at boot without running at boot itself.
TPM 2.0 is standard on modern consumer hardware, and software support is built into the Linux kernel. We require that systems have TPM 2.0 support and that it is enabled in the BIOS.
3. Secure Boot
Secure Boot authenticates the boot chain. Firmware will only execute a boot manager that verifies against a key in its UEFI key database, and the boot manager is expected to validate the signature of the kernel it loads. This prevents EFI-based cheats or others that run during the boot chain. We require that Secure Boot is enabled in the BIOS and only well-known keys are used to boot.
4. Measured Boot
Measured boot is the process of actually recording metadata about the system configuration and code that will run next, then updating the extend-only registers accordingly. Linux boot managers like systemd-boot and GRUB typically perform these measurements automatically by default. Other boot managers may not support them at all or only perform them if a special configuration is applied. We require these measurements to be present.
5. Input-Output Memory Management Unit (IOMMU)
IOMMU is a hardware technology that controls access between DMA-capable hardware devices and physical memory. When fully activated, it prevents hardware cards designed for cheating from accessing a protected game process. For non-handheld devices, we require that IOMMU is enabled in your system's BIOS and the Linux kernel is configured with IOMMU enabled and passthrough disabled.
6. Kernel Lockdown Integrity Mode
Kernel lockdown is a built-in security feature designed to prevent root from tampering with the kernel. In integrity mode, it blocks root from performing many operations that could be abused for cheating or bypassing integrity checks, like loading unsigned kernel modules, writing to physical memory, or writing to CPU MSRs. We require that lockdown integrity mode is explicitly enabled at boot time.
7. Kexec Disabled
Kexec is a Linux kernel feature that loads a new kernel into a running system without a full reboot cycle. Because parts of the normal boot flow are skipped, measured boot outputs no longer reflect the running kernel or its configuration. This could be abused to load a modified kernel—or change kernel options—to enable cheating without leaving traces in the measured boot log. We require that kexec is explicitly disabled at boot time.
8. Linux Security Module BPF
The LSM BPF feature enables eBPF programs to use Linux Security Module hooks for granular access control and monitoring. This enables anti-cheat to restrict other processes from reading or writing protected game process memory without needing a kernel module, as well as monitor for cheats loaded in different ways. We require the BPF LSM to be loaded and active.
FAQ
Does EAC Linux v2 use a kernel driver?
No. EAC Linux v2 does not install or load an anti-cheat kernel module. It uses security features already provided by the Linux kernel, together with an anti-cheat systemd service and eBPF programs.
Does EAC Linux v2 run in the background all the time?
No. It includes a systemd service, but the service only starts when a protected game starts and it stops when the game exits.
Do I have to keep my machine configured to meet these requirements all the time if I only play protected games sometimes?
No. EAC Linux v2 checks these requirements when you start an anti-cheat protected online game. You can maintain a separate boot entry with the required kernel and command line, and select that entry when you want to play a protected game.
What keys are considered well-known?
Here is a current list of keys that are considered well-known for use as Secure Boot signature database (db) keys and Machine Owner Keys (MOKs), which we plan to expand over time:
Canonical Ltd. Master Certificate Authority - used by Ubuntu and derived distros like Linux Mint
Fedora Secure Boot CA - used by Fedora and derived distros like Silverblue
Universal Blue - used by Bazzite, Bluefin, Aurora, and derived distros
Debian Secure Boot CA - used by Debian and derived distros
openSUSE Secure Boot CA - used by openSUSE and derived distros
SUSE Linux Enterprise Secure Boot CA
Rocky Linux Secure Boot Root CA
Microsoft UEFI CA - used to sign non-Microsoft components like the Linux bootloader shim project
AlmaLinux Secure Boot CA
Can I generate and enroll my own Secure Boot keys to use with other boot options?
Yes, EAC Linux v2’s well-known key requirement only applies to the keys used to verify the boot chain and kernel modules for the boot session where a protected game runs. This means you can easily toggle between an anti-cheat compatible boot path for playing protected games and one that you control yourself using your own keys for any other situation.
Note: If you boot via shim and want to use custom keys for other boot options, enroll them in the Secure Boot signature database (db) instead of enrolling them as Machine Owner Keys (MOKs). Because all enrolled MOKs are typically trusted for kernel module signature verification regardless of whether they were used in the boot chain or not, EAC Linux v2 requires that they are all well-known.
What about Steam Deck?
The Steam Deck does not support the required features for our EAC v2 solution, but we are actively talking with Valve and hope to support it in the future.
Will my account be banned for cheating if I accidentally start a protected game without meeting these requirements?
No, you will just see an error message.
Do you use server data to detect cheaters?
We do. It’s a great additional layer, but it’s not sufficient alone.
If someone makes a cheat that works on EAC Linux v2, does that mean it’s not functioning as intended?
No, anti-cheat always requires regular updates to remain effective. The goal of EAC Linux v2 is to create a strong foundation that updates will build upon, and also to raise the cost of developing and maintaining cheats so that a typical player rarely encounters a cheater.
The eyes have it: Reform politician’s ‘smart glasses’ prompt calls for ban in Westminster
Guardian
www.theguardian.com
2026-10-14 11:05:53
Jason O’Connell’s suspected use of the specs to aid his speech in the Senedd reignites debate over the AI-enabled devices It was a flowing speech packed full of precise statistics – but Jason O’Connell, a Reform UK Senedd member, was not quite the gifted orator he had first appeared. The periodic fl...
It was a flowing speech packed full of precise statistics – but Jason O’Connell, a
Reform UK
Senedd member, was not quite the gifted orator he had first appeared. The periodic flashing in his spectacles seemed to give the game away as he spoke for five minutes in the Senedd chamber without a glance at his notes.
“Cardiff reviewed 192 roads, following 933 requests, and only four routes have returned to 30mph,” he said as he led the party’s charge to abolish 20mph traffic zones. “£38.3m wasted to implement this policy and up to £8.9bn in an act of economic self-harm.”
It was likely no feat of memory – rather, the Reform member for Pontypridd Cynon Merthyr was suspected of using smart glasses that turned his lenses into tiny teleprompters.
In the days afterwards, Welsh assembly members said the issue of smart glasses – popularised by Mark Zuckerberg’s Meta – needed to be dealt with at pace, with explicit guidance on their use developed.
There was no suggestion that O’Connell’s glasses were recording. But it has prompted a fresh debate about the increasingly popular technology, with the
House of Commons
facing calls to ban smart glasses at Westminster.
The Liberal Democrats wrote to Lindsay Hoyle, the speaker, on Wednesday, urging him to act amid the “increasing use of smart glasses” on the parliamentary estate. They warned that with Christmas coming, even more people could start using the AI-enabled devices in 2027.
The technology has myriad implications. Anna Sabine, the Liberal Democrat spokesperson for culture, media and sport, said smart glasses could lead to debates becoming increasingly “managed”.
“How much is the quality of what an MP is saying actually down to what they’re getting through the AI glasses?” she said. “It’s a really interesting question.”
She said she had not yet identified anyone wearing smart glasses in parliament but added: “This is the problem: I wouldn’t necessarily know.” A law would help to keep the estate and the work MPs did “private and secure”.
Sabine added: “Smart glasses can record video and take photographs discreetly … creating a particular risk to the existing rules on the parliamentary estate [limiting recording and photography].
“I am regularly in meetings with documents or talking about important, private matters on behalf of my constituents. I am sure you will agree that the details of such cases should never be at risk of being shared because someone is filming or taking pictures discreetly.
“Because smart glasses look like ordinary glasses, and increasingly their recording indicator lights can be covered or disabled, filming could easily go unnoticed by security teams, putting private information at risk.”
A spokesperson for the UK parliament said it was reviewing its policy on the use of camera-equipped smart glasses, as well as other forms of wearable technology, on the parliamentary estate.
The senior deputy speaker of the House of Lords told parliament last month that the review “is considering the implications of these emerging technologies and whether additional guidance is required”.
He added: “This work will bring together expertise from those responsible for filming and photography policy, physical and information security, privacy and data protection compliance and accessibility and reasonable-adjustment requirements, ensuring that any future approach appropriately balances security, privacy, operational needs and accessibility considerations.”
O’Connell has been contacted for comment. On Sunday he
posted
a picture on X of himself wearing a large pair of comedy pink glasses for a breast cancer charity, with the message: “Trialling some new glasses for the chamber this week. Apparently my last ones caused quite a stir.”
Show HN: Graphicle, a Rust port of Graphify with memory for coding agents
Code graph and memory for your coding agents, in one Rust program.
Graphicle maps your repository into a code graph, remembers your project's docs, decisions and past agent sessions,
and gives your coding agent cited excerpts from both: the exact files and lines. It runs on your machine: no API key needed, no account,
no telemetry
.
Works with Claude Code · Cursor · Codex · VS Code · Claude Desktop · any MCP client
graphicle setup
indexes the repository, builds its code graph and connects the coding agents it finds. It also turns on session
capture, points Claude Code's searches to the code graph first, adds a short section to
AGENTS.md
and installs Git hooks that keep the project current. It lists every file it changes and
backs each one up first;
graphicle disconnect
undoes it all.
Then ask your agent to
"use graphicle to find where failed requests are retried"
, or ask from the terminal:
$ graphicle ask "where is tax added to prices?"Evidence for "where is tax added to prices?"4 excerpts · 598 of 3,000 tokens[1] shop/pricing.py:1-7 price_with_tax() """Prices and tax.""" TAX_RATE = 0.2 def price_with_tax(price): """A price with the sales tax added.""" return round(price * (1 + TAX_RATE), 2)
Real output, cut after the first excerpt. With no model configured,
ask
shows the evidence;
graphicle config set model anthropic
(or
openai
,
ollama
) adds written answers.
Let your coding agent install it
Paste this into Claude Code, Codex or Cursor:
Install Graphicle with `brew install graphicle-ai/tap/graphicle` (or, without Homebrew,
`curl -fsSL https://github.com/graphicle-ai/graphicle/releases/latest/download/install.sh | sh`),
then run `graphicle setup --yes` in this repository and list every file it changed.
Start here
You want to
Run
Give your coding agent the code graph and your project's memory
Native and fast.
One Rust program. On Kubernetes (31k files), the 0.1.0 engine ran a code-only extract in 3 min 18 s, against 26 min 38 s for Graphify 0.9.88, and built the same graph (one exploratory run each, one Linux host, the same 16 CPUs, 8 workers).
Context, not re-reading.
Your agent asks Graphicle and gets the relevant code, docs and decisions as cited excerpts, within a token budget.
Answers you can check.
Every excerpt names its file and lines. Memories an agent proposes wait for your approval.
One program, not a stack.
The code graph, the memory, one MCP server, the web app and the command line come in one install, with one SQLite file. No Python, Docker or database server.
Local and private.
No account and no telemetry. Nothing leaves your machine unless you ask.
What it does
Code graph.
Files, functions, classes, calls and imports, parsed with tree-sitter and no model.
graphicle graph
searches it, explains a symbol,
traces a path and exports an interactive HTML graph. After
graphicle graph extract . --code-only
,
graphicle graph affected "retry()"
lists what depends on a symbol.
Project memory.
Docs (Markdown, PDF, Office, HTML), reviewed decisions and procedures, and past Claude Code and Codex sessions, searchable alongside the code.
Cited context on a budget.
graphicle context
and the MCP tools return excerpts with their sources, within a token budget, without calling a model.
One MCP server.
graphicle mcp
serves the code-graph tools, under Graphify's tool names such as
query_graph
,
get_neighbors
and
shortest_path
, next to the memory tools.
Memory tied to your code.
Reviewed memories are tied to the functions they are about: a memory goes stale when that code changes, and edits elsewhere in the file usually leave it current (
the exact rule
). Mentions of code in your docs are linked to the definitions they name (
graphicle call graph.doc_links
lists them).
Across repositories.
Recall can span the repositories of a workspace:
graphicle context --workspace
, or
the workspace MCP endpoint
.
Always current.
Before each answer Graphicle syncs the few files you changed; Git hooks sync after each commit, merge and checkout.
No re-explaining.
Session capture keeps each finished turn, and each new session starts with your reviewed memories and the latest turns.
An app.
graphicle open
shows the graph, the sources and the memory in your browser. It is where you approve memories.
Works with your agents
graphicle setup
connects every client it finds over MCP. Each file is backed up once as
<file>.graphicle-bak
, and
graphicle disconnect
removes what it added.
Client
Where setup connects it
Session capture
Claude Code
.mcp.json
in the repository
hooks in
.claude/settings.local.json
Codex
~/.codex/config.toml
hooks in
~/.codex/hooks.json
(Codex asks you to trust them)
Cursor
~/.cursor/mcp.json
VS Code
.vscode/mcp.json
in the repository
Claude Desktop
claude_desktop_config.json
in Claude's settings folder
Sync.
Graphicle reads the folder (it respects
.gitignore
and skips secrets), keeps a versioned copy of each source and builds the code graph.
Recall.
When your agent calls a tool, Graphicle syncs what changed, ranks excerpts from code, documents, sessions and reviewed memory, and returns them with citations. The tools call no model; your agent's own model reads the excerpts.
Remember.
Captured sessions become sources. Memories that agents propose wait for your approval in the app.
Graphicle, or a code-graph tool plus a memory server
A code-graph tool + a memory server
Graphicle
Install
Two tools, often on different runtimes, and often a database server
One install
Connect your agents
Configure each tool in each agent
graphicle setup
connects the agents it finds;
graphicle disconnect
undoes it
MCP servers in your agent
Two, configured separately
One, with the graph and the memory tools
Storage
Graph files plus the memory server's database
One SQLite file in one data folder
Code structure: calls, imports, impact
The graph tool
graphicle graph
Docs, decisions, past sessions
The memory server
Built in
Citations and review
Varies
A file and its lines on every excerpt; agent memories wait for approval
Benchmarks
Speed.
The chart above: Kubernetes (31k files), the 0.1.0 engine (a Linux test build of the release source) against Graphify 0.9.88, one exploratory run each, both building the same graph (
Kubernetes run
). Earlier, on Django, a pre-release build ran a code-only extract in 7.5 s against 72.8 s for Graphify 0.9.77 (medians of five alternating runs, one shared Linux host, 8 workers), both building the same graph (
the 8 October record
).
Memory.
In a comparison with seven memory systems, registered before any answer was scored and run with one open model as every system's reader and judge, a pre-release build of Graphicle trails none on three development sets.
Every score, with its method and caveats
.
FAQ
Privacy and local first
One data folder.
Your sources, memories and the code graph that setup builds live in one SQLite store:
~/Library/Application Support/Graphicle
on macOS,
~/.local/share/graphicle
on Linux.
graphicle graph extract
writes its graph file to
.graphicle/
in the project.
Loopback by default.
The app and its HTTP and MCP endpoints listen on 127.0.0.1.
No telemetry, no account.
Graphicle connects to the network only when you ask it to: a model or a connector you configure, a full
graphicle graph extract
(it sends documents and images to the LLM whose API key it finds), the GitHub CLI for
graphicle graph add
,
clone
and the graph server's pull-request tools, and
graphicle update
with a feed you name.
A build from source also downloads the parser sources once.
Details
Careful sync.
sync
respects
.gitignore
and skips
.env
files, keys and credentials. Session capture drops
<private>…</private>
spans and redacts credentials.
Forgetting with a receipt.
Deleting a memory or a captured session also removes what was derived from it, and you get a hash-chained deletion receipt.
Do I need an API key or a model?
No, for most of it. The code graph (with
--code-only
), sync,
context
, the MCP server, session capture and the app work without one.
A model writes the answers of
graphicle ask
, proposes memories from sources and reads documents and images in a full
graphicle graph extract
.
Local models through Ollama or any OpenAI-compatible server work (
configuration
).
Is Graphicle a fork of Graphify?
The code-graph engine is a Rust port of Graphify, kept in step with Graphify's releases and credited in its file headers and in
NOTICE
.
The parity checks
name the release it follows.
The memory, the memory tools, the app and session capture are not part of Graphify. Coming from Graphify?
graphicle setup
offers to switch a repository,
backs up each file and never deletes
graphify-out/
(
Moving from Graphify
).
Will it handle my large repository?
By default a project can hold up to 100,000 text files and 1 GiB of text; you can raise both (see
Limits in docs/configuration.md
).
A very large file is analysed in part or kept as searchable text instead of stopping a sync.
Is there a version for teams?
Graphicle is free and open source under Apache-2.0, for individuals and teams alike. A commercial edition for teams is in private preview.
To talk to us, start a discussion:
https://github.com/graphicle-ai/graphicle/discussions
, or chat with us on
Discord
.
What is the licence?
Graphicle is Apache-2.0: free to use, change and ship, commercially too. Third-party parts keep their own licences, listed in
NOTICE
.
Contributions are welcome under the Apache License 2.0, with a Developer Certificate of Origin sign-off (
git commit -s
) and no CLA.
See
CONTRIBUTING.md
. To report a security problem, follow
SECURITY.md
rather than opening a public issue.
License and credits
Graphicle is licensed under the
Apache License 2.0
. Copyright 2026 KarLex AI, Inc.
The code-graph engine is a Rust port of
Graphify
by Safi Shamsi and the Graphify
contributors, licensed under Apache-2.0, with portions that remain available under the MIT License. Thank you.
NOTICE
,
NOTICE.md
and the
licenses/
folders hold the attributions and the licences of every adapted project and third-party component.
A smarter front door for the modern web. BotStopper helps protect your site from scraping and automated abuse while keeping the experience straightforward for people.
✳
Built by the creators of Anubis
CHALLENGE ACTIVE
PROTECTION ONLINE
01
HUMAN TRAFFIC
02
AUTOMATED ABUSE
BUILT FOR THE OPEN WEB
OPEN SOURCE ROOTS. ORGANIZATION READY.
Keep your front door open.
Keep the bots guessing.
BotStopper brings the practical, open source approach of Anubis to teams that need a polished way to manage scraping and automated traffic.
A BETTER WAY THROUGH
Protection with a human side.
Useful defenses. A considered visitor experience. One product that feels at home in your organization.
MADE TO FIT YOUR ORGANIZATION
Enterprise ready.
Still unmistakably yours.
BotStopper starts with calm, corporate-friendly branding. Shape the challenge flow and visual identity to fit the experience you want visitors to have.
Reform UK politician appears to use smart glasses as teleprompter during Senedd debate – video
Guardian
www.theguardian.com
2026-10-14 10:57:14
Jason O’Connell is suspected of having used smart glasses that turned his lenses into tiny teleprompters. Periodic flashing in his spectacles could be seen as the Senedd member for Pontypridd Cynon Merthyr spoke for five minutes without a glance at his notes on 30 September. In the following days, ...
Jason O’Connell is suspected of having used smart glasses that turned his lenses into tiny teleprompters. Periodic flashing in his spectacles could be seen as the Senedd member for Pontypridd Cynon Merthyr spoke for five minutes without a glance at his notes on 30 September.
In the following days, other Welsh assembly members said the issue of smart glasses – popularised by Mark Zuckerberg’s Meta – needed to be dealt with at pace, with explicit guidance about their use developed. There is no suggestion O’Connell's glasses were recording
Running Windows desktop tests from Linux with disposable VMs
There’s a good reason why testing Windows desktop apps was one of the most requested features from customers: no one in the world has the infrastructure to parallelize thousands of runs per month.
Web testing infrastructure is relatively easy: a headless browser starts inside a Linux container in a couple seconds, costs a fraction of a cent to run, and gets thrown away when the test ends. There’s no equivalent for testing a Windows desktop app.
When testing Windows apps:
Every test needs a full VM
because Windows containers don’t include a graphical desktop to run the app.
The machines are slow to start.
A cold Windows VM takes 2 to 3 minutes to boot. A browser container takes seconds.
Someone has to be logged in.
Windows UI Automation (UIA), the accessibility interface that test tools use to find buttons and fields, only works inside an active, logged-in desktop session. A machine that's merely switched on isn't enough.
Machines remember things.
Installed files, registry keys, user profiles, saved logins and stray processes all survive between runs.
Every app brings its own world.
Installers, admin prompts, licensed dependencies, first-run dialogs, sign-ins, etc.
There's no built-in visibility.
A browser hands you traces, logs and screenshots. A remote Windows machine hands you nothing unless you build it.
The tooling assumes Linux.
Kubernetes, CI runners and most test infrastructure were designed around Linux containers.
Our answer was to stop treating Windows machines as servers and treat them like phones: a device that one test claims, uses once, and throws away.
The Architecture
The basic architecture borrows from our mobile testing infrastructure, because mobile testing has the same constraints: the test code can't run on the device it's testing, and each test needs a device to itself while it runs. Since a Windows machine is modeled as a device in Kubernetes, a test can ask our custom device scheduler for a VM with a
DeviceClaim
, get its connection details back, control the device remotely through WebdriverIO and Appium, and release the machine when the test is done.
Windows needed two extensions to the device model: a device no longer has to live inside the Kubernetes cluster (a GCE VM lives outside it entirely), and a claim can return a desktop's connection addresses, including CDP for browsers. Otherwise, the Windows runner follows the mobile runner's lifecycle step for step (claim, heartbeat, record, connect, run, release), tests talk to native apps through the same WebdriverIO and Appium pairing, and private Windows pools work the way private iOS devices do.
Like the mobile system, it has three parts:
A controller
running in Kubernetes. It keeps a pool of Windows VMs on Google Compute Engine (GCE) and hands them out to tests.
A runner,
a Linux pod that runs the test code.
A Windows VM
that runs the app under test, the automation tools and a small desktop agent.
The runner talks to the VM over three connections. Playwright connects over CDP (Chrome DevTools Protocol) for anything in a browser. Appium handles native Windows apps. A WebRTC (Web Real-Time Communication) stream carries the screen so people can watch the test live and review a recording afterward.
Like an Android emulator, each Windows VM is disposable. Nobody logs into it, patches it or keeps it running for weeks. A test claims it, uses it once and gives it back, and a fresh VM takes its place.
A Linux runner pod runs the test code (@qawolf/flows/windows). Step 1: the test claims a device from the device scheduler, which runs with a Windows VM reconciler in the Kubernetes controller. Step 2: the scheduler assigns a ready Windows VM on Google Compute Engine (GCE) to the test. The scheduler also keeps a pool of warm Windows VMs ready through the GCE API. The test then talks to the claimed VM over three connections: CDP (Playwright) to a browser, and Appium (WebDriver) to Appium and WinAppDriver, which drive the app under test through UI Automation (UIA). A Go desktop agent on the VM sends a WebRTC screen stream back to the runner.
So now, when a user kicks off a run:
The test starts in a Linux runner pod, which asks for a Windows device.
The scheduler assigns it a VM from a pool of machines that are already booted and logged in.
The runner receives that VM's connection addresses for CDP, Appium, and screen streaming.
The app under test is delivered to the VM and launched.
The test runs. The screen streams live and is recorded.
The test finishes, the claim is released, and the VM is destroyed. A fresh VM takes its place in the pool.
Step
1
of
6
The test starts in a Linux runner pod, which asks for a Windows device.
Sequence between the runner pod (test code), the device scheduler (Kubernetes) and a Windows VM from the warm pool. Step 1: the runner sends a DeviceClaim to the scheduler. Step 2: the scheduler assigns a ready VM. Step 3: the scheduler returns the VM’s connection addresses for CDP, Appium and the screen stream. Step 4: the runner calls startApp(); the VM downloads the app with a signed URL, installs it and launches it. Step 5: the runner sends CDP and Appium commands; the VM streams its screen back over WebRTC for live view and recording, and sends heartbeats to the scheduler, which reclaims it if it goes quiet for 60 seconds. Step 6: the runner releases the claim, the scheduler destroys the VM and creates a fresh one for the warm pool.
Renting Windows Machines on Demand
The first thing a Windows test does is ask for a Windows machine. Handing those out is the job of our device scheduler, the same in-house service that already hands out Android emulators. For Windows, we taught it two new jobs: keeping a stock of VMs rented from Google Compute Engine, and giving one to each test that asks.
The scheduler tracks the fleet through three new Kubernetes custom resources:
WindowsVMTemplate
describes what a VM looks like: the machine image, size and configuration.
WindowsVMPool
describes how many ready VMs to keep around for a given template.
WindowsVM
represents one machine.
Records like these are how the device scheduler already manages emulators, so Windows VMs fit into it without a separate system. They also keep the fleet's state durable and visible. If the scheduler restarts, it reads the records and picks up where it left off, and engineers can inspect any pool or VM with standard Kubernetes tools.
Giving a machine out starts with a
DeviceClaim
, the same object tests use to claim an emulator. The scheduler matches the claim to a ready VM from the right pool and returns that VM's connection addresses to the runner: CDP for browsers, Appium for native apps and the screen stream.
Keeping machines in stock is the job of a reconciler inside the scheduler. It keeps comparing the records against what's actually running in GCE and closes the gap. If a pool is three machines short, it creates three. When a test releases its claim, it deletes that VM. Windows VMs take minutes to create and boot, so the reconciler moves each one forward a step at a time across short passes and writes its progress onto the VM's record. A slow boot never holds up anything else the scheduler manages.
Supplying Clean VMs Quickly
The central tension in desktop test infrastructure is that clean machines are slow and fast machines aren't clean. Rebooting from a fresh image costs minutes, and reusing a machine means each test inherits whatever the last one left behind.
Our system handles both sides:
Every VM is single-use.
A VM is never reused after a test. No test can see another test's files, settings or logins, so a whole category of "passes on its own, fails in the suite" problems never comes up.
Warm pools absorb the boot time.
Each pool keeps VMs booted, logged in and waiting, so a test claims a machine that's already ready and skips the 2 to 3 minute cold start. The pool replaces machines as tests use them up.
Abandoned machines get reclaimed.
A claimed VM reports activity while its test runs. If it goes quiet for 60 seconds, the controller assumes the test is gone and reclaims the machine.
Capacity shortages move zones and regions.
If a cloud zone can't supply a Windows VM, the pool creates it in another zone.
Updates happen by attrition.
Because VMs are disposable, a new machine image needs no upgrade process. Old VMs get used up and replaced with new ones, and idle VMs on an outdated image are recycled, so the pool gradually moves over on its own.
Making machines disposable removes a lot of work that normally comes with a Windows fleet: patching long-running machines, cleaning up after tests, and tracking down why one machine behaves differently from the others.
A Windows Image Built to Be Automated
Native apps have no DOM for Playwright to drive, so a stock Windows install can't run automated UI tests. Appium, the Appium Windows driver and Microsoft's WinAppDriver have to be installed, configured and running inside a live desktop session before the first test arrives — all of which we bake into a base machine image. The image also runs a separate root-level session for parts of Windows that don't belong to the app, such as notifications and the Action Center.
A PowerShell setup script produces the image and publishes it to an image family in GCE so it's easily reproducible. Nobody hand-maintains a golden machine.
The base image includes common software like Google Chrome and Adobe Acrobat, which are frequently called during E2E tests but we also support variants of the base image. For example, an Office image clears Microsoft Word’s first-run dialogs before a test ever sees them.
When apps need more than that (licensed third-party software, specific configuration or other apps installed alongside them) we can build private images from a setup script the customer provides.
Test Code Stays on Linux
Everything else about running a QA Wolf test (runners, recordings, CI integration, result reporting) is built on Linux. Running test code on Windows would mean building and maintaining two copies of all of it. So test code doesn't run on Windows. It runs in a Linux runner pod and controls the VM remotely, and the VM only runs the app and the automation endpoints.
When the runner connects to its VM, it opens two channels to the same machine. Browsers on the VM are reached with Playwright's
chromium.connectOverCDP()
, and native apps through WebdriverIO and Appium.
Test authors see one API. The
@qawolf/flows/windows
entrypoint provides
launch()
for browsers and
startApp()
for native apps, and a single
expect
uses Playwright's matchers or WebdriverIO's depending on what it's asserting on. A test can sign in through a browser, switch to a native app and check the result without caring which protocol carries each step.
The practical effect is that a Windows test looks like any other QA Wolf test, and it runs through the same pipeline.
Getting the App Onto a Brand-New Machine
With single-use VMs, the app under test has to reach a new machine on every run, quickly and without opening a security hole. It also often arrives as an installer rather than something ready to launch.
The app's files never pass through the runner. When a test calls
startApp()
, the system issues a short-lived signed URL, and the VM downloads the app straight from storage over Private Google Access, a network path that stays inside Google's network. Only QA Wolf's central API service can sign those URLs. Test code runs as an unprivileged user and asks for downloads through a trusted parent process, so the code inside a test can't sign arbitrary URLs.
Once the file lands, the VM handles installation. It supports
.exe
,
.msi
and
.msix
installers, including passing MSI properties, so apps that only ship as installers work the same way as a standalone executable. Tests can also push files to the VM and pull files back, which covers flows like importing a document or checking an exported report.
Seeing Inside a Remote Desktop
A remote Windows VM is a black box by default. Writing a test, debugging a failure or reviewing a run all require seeing what the test saw, as it happened.
Each VM runs a small desktop agent written in Go. It captures the screen with FFmpeg and streams it over WebRTC, and it simulates mouse, keyboard and clipboard input by calling Windows' own
user32.dll
. The agent doesn't use CGo (Go's bridge to C code), so it cross-compiles for Windows from a Mac or Linux machine, and the platform-specific parts sit behind Go build tags. The Linux, Windows, and Mac agents share one codebase, and the Linux build is unaffected by the Windows code.
The agent reads the actual screen size from Windows instead of trusting configuration, so the stream always shows the whole desktop at the right scale. It also exposes diagnostics and logs endpoints that report what the capture pipeline and the WebRTC connection are actually doing.
For the people using QA Wolf, that adds up to:
Live viewing of a Windows test while it runs.
A video recording of every run.
An element chooser for native apps, for picking UIA elements when writing a test.
Screenshots, actions and element inspection through the QA Wolf MCP (Model Context Protocol) server and public API, so AI agents can work with Windows runs the same way they work with browser runs.
Keeping Customer Networks Closed
Desktop apps often talk to systems behind a firewall: internal APIs, licensing servers, databases, etc. Customers need to know exactly what's connecting to them.
One known IP range.
VM traffic leaves from QA Wolf's own IP range, so a customer allowlists one range instead of a moving set of cloud addresses.
Private pools stay private.
A dedicated pool can only be claimed by the workspace it belongs to.
No stored cloud keys.
The controller authenticates to Google Cloud through Workload Identity, so no long-lived credentials sit on a machine.
Nothing persists.
Because VMs are destroyed after each test, no customer data stays on a machine after a run.
Add Windows to Your E2E Test Suite Today
Windows desktop app testing is now live. It works through the QA Wolf platform and our MCP, using a single API for writing tests across web, iOS, and Android. One test can open a browser with Playwright, control a native app through WebdriverIO and Appium, and check the result with one expect, whether the app runs on the web, on mobile or on a Windows desktop.
AI is mass decompiling games. That's both awesome and scary
I'm going to preface this post by saying I generally don't like AI. What an original take, I know. I hate that the internet is full of slop and bots, I hate that it's used as justification to fire hundreds of thousands of workers, I hate that the AI industry is making hardware inaccessible for consumers, I hate that it's being shoved into everything, and so forth. I like to do everything by my hand and take pride in my work.
That said, every now and then there's AI news that becomes impossible to ignore or act like it doesn't matter. This is
especially
one of those times. AI is now able to very quickly decompile video games and software, allowing them to easily get modified and enhanced and recompiled to all sorts of different systems.
And honestly? I have to admit - it's very cool. So many old, abandoned games are getting native ports to other platforms, enhanced with high FPS and running at dynamic native resolutions, with modding support. These type of enhancements usually aren't possible through an emulator.
Game Decompilations???
Decompiling games and software is the process of reverse-engineering it from a compiled version back to source code. Once decompiled, you can practically do anything you want to that code then
recompile
it back to an executable that runs on your computer. Or mobile phone. Or smart fridge, really.
Decompiling old games isn't a new trend. The process of picking apart an old game and re-writing the code was doable by hand, but it was so complicated and time-consuming that it took
years
to decompile a game. The only ones that ever make it to the finish lines are through massive community efforts. Notable decompilations tirelessly made by hand are
OpenGOAL
(Jak and Daxter games) and
Ship of Harkinian
(Zelda Ocarina of Time/Majora's Mask). These developers are legends.
Thanks to the games being decompiled, modding all these games is now possible, and there are some really fun ones. Here's Jak and Daxter but you play as Gordon from Half Life. The mod
can be found here
, and it was
not
made with AI.
Newer AI models and workflows are now able to decompile games in a matter of days, or maybe less. The code isn't nearly as clean as doing it by hand, but it
works
. Some ports are a mess made by people who have no idea what they're doing, but most ports are undeniably impressive and stable.
Some Examples
A great example of this being used for good is
IsaacRecomp
, which ports The Binding of Isaac in C++! No, not the remake. This is for the original Flash version made in 2011. Flash Isaac ran at a locked 30FPS and a low, blurry resolution. It was also a bit unstable because you're trying to run Adobe Flash in 2026. But now... Look at this.
The game now runs at a native 1440p, smoothly interpolated to 165FPS! If you've ever played Flash Isaac, you can
immediately
tell how beautiful that looks compared to the original. And it was all made
automatically
. In a few days. By an AI. That's insane.
There are hundreds of these projects now, with more coming every day. From a game preservation standpoint, it's incredible how we can take old janky experiences and get them to play on modern systems while also modernizing them. You can absolutely have your opinions regarding AI, but you
have
to admit this is cool.
Another one I like is
Colin McRae Rally 2.0
, a very old game that also barely ran on modern systems. Or
Final Fantasy Tactics Advance
, now running at any aspect ratio with dynamic zooming in and out. There's a
Metroid Prime
port. There's
Ratchet and Clank
which should be finished soon. There are too many more to mention and I'm struggling to keep track of them all.
The Scary Part
Most people already realized the scary part by now. If AI can decompile games and software, then the entiry tech industry is about to explode. Anybody can decompile other software and use it any way they'd like, and nobody can stop them. Companies can steal from competitors. Your paid game or app can be open-sourced against your will. This isn't exclusive to old video games, we can apply this to
any
software.
Decompiling software is completely legal, and even if it won't be - it doesn't matter. You can't prove it's stolen code. I can make 1:1 copies of other things and say it's totally original, then publish it online. Someone
made a fantastic joke website
about how you can copy code with AI and claim it's made in a clean room, so
technically
you're not under any licensing agreements.
That's
scary
. The implications of this haven't been fully realized by people yet, but it's only a matter of time before alarms start ringing. I expect that in the next few months, we'll see some major application get decompiled and shared that will cause a serious response from companies.
Maybe open source licenses are completely unenforceable now. Maybe critical software and hardware can be easily hacked into now, and we haven't realized just how bad it is yet. Maybe everything will have more invasive DRM on it soon. Who knows. We're about to find out in the next few months.
But Isn't This Also Awesome?
This is still a big win for consumers, though. Old abandoned games and software can be ported and polished for modern systems! I can't help but be giddy when seeing something like Skate 3 and Black Ops Zombies running on your browser. We live in weird times.
I wasn't kidding, here's Black Ops 1 Zombies running on my browser (at a bad framerate, but still)
This is also a big win for preservation. Old games can be ported, modified, enhanced, and made much more easily accessible than before. Shouldn't that be celebrated more?
There's a project in development called
AnyPS5
which will allow you to
automatically port any PS5 game to your PC
, making them fully playable. This isn't hypothetical vaporware, some PS5 games have already been ported to PC such as
Animal Well
! This also isn't an emulator, it's more of a compatibility layer similar to Proton (which allows you to play Windows games on Linux).
With console makers going all in on digital and games becoming entirely unplayable due to servers shutting down, this is
fantastic
news. We could own software we bought regardless of what the company thinks.
I expect modding become way easier too since AI can find ways to hook into a game's code. You might've already seen some sloppy mods that combine two games together. Those are dumb, but they make a point that AI could
potentially
create modding frameworks for previously unmoddable games. That's neat.
I know. AI still sucks, it's still causing a lot of issues in the world, and it's still accelerating us to a future that is too uncertain. But this is one of the positives of having such a technology, and I hope instead of random internet users attacking those using AI for decompilation and blindly hating these projects, we can just accept the win and play that old game you like at 4K 240FPS.
As I admitted in
my last post
, I am very much not an expert model developer. What follows is likely to be, at least partially, inaccurate. I have tried to be careful and quantitative, to partially balance a lack of deep expertise.
Since we launched
strands-decider-2B
last week, a couple of people have asked me why it’s a modified LLM and not an encoder (like
BERT
). Their instinct seems to be that
bidirectional
(i.e. each token’s representation is built from tokens before and after it) is likely to out-perform
causal
(i.e. only before tokens are used). This is the same reason encoders are widely used as classifiers.
This is also a fair question, because if you squint at it right, we’re abusing a decoder as an encoder.
To test this hypothesis, I compared five designs:
v19
is the final design for Qwen3.5-based strands-decider (check out the previous post and
strands-decider README
for the details).
b1
is an encoder-decoder design (like the original
Transformer
), based on
T5Gemma 2
with 1B encoder params and 1B decoder params, minus the LM head and plus our pointer head.
b2
is the same as b1, but 4B+4B.
e1a
is just the encoder half of
T5Gemma
(not T5Gemma 2), with 2.6B parameters.
e1b
is a latency-optimized version of e1a with a masked state cache, allowing for multiple questions to be evaluated in parallel without interference, and for the state cache to be reused
1
. The
state
attends to the whole
state
bidirectionally, and each question attends to
state
and itself.
I also measured frozen
ModernBERT
and
ettin-encoder-1b
, but found that they under-performed T5Gemma parameter-for-parameter, and so didn’t invest time in training them.
First, let’s look at accuracy and calibration.
b2
does very well here, beating
v19
on JevBench accuracy and Brier, and on JF100 Brier at the same accuracy. This is good, but recall that
b2
has ~8B total parameters compared to
v19
’s 2B, and so is not an apples-to-apples comparison.
The really interesting comparison is
v19
and
e1b
.
e1b
slightly beats
v19
on JevBench accuracy (but within the run-to-run variance on
v19
), with slightly worse calibration, and ties on calibration on JF100 with slightly weaker performance.
So far, not a slam-dunk for the encoders.
Next, let’s turn to latency.
The encoder-only models win handily on latency, with a median of around 35ms compared to
v19
’s 65ms. The encoder-decoder models are slowest. With half the latency and similar performance, this is looking like a big win for
e1b
. But thing get a little more complicated when we dive into the data.
Here, we see that
e1b
wins handily at lower prompt lengths, but scales worse as the prompt grows. This is consistent with the great median performance. Whether this matters depends on the workload mix: both JF100 and JevBench trend small, to
e1b
’s benefit. The scaling difference here comes down to the compute costs of the two models:
e1b
has 26 full attention layers with the associated quadratic compute cost, while 75% of
v19
’s layers are
Gated DeltaNet
with linear compute cost. These layers have a higher fixed cost, but better asymptotic cost, leading to the higher latency floor
2
.
Finally, let’s look at one interesting sub-plot, going back to
e1a
(our unmasked 2.6B encoder-only candidate). On the eval sets, it beats
v19
on seven of nine tasks, and is very slightly behind on two. But it does significantly worse at JevBench (153 vs 168), and a little worse at JF100 (158 vs 162). This suggests that the encoder generalizes worse, at least without the masked approach
e1b
takes. Is being able to attend to the question when reading the state actually a weakness?
Evaluation set
v19
e1a
Δ
Held-out short tasks
0.647
0.695
+0.048
MuSiQue
0.882
0.948
+0.066
ContractNLI
0.873
0.864
−0.009
BoardgameQA
0.820
0.884
+0.064
HotpotQA (held out)
0.719
0.748
+0.029
Generated, v16’s
0.857
0.851
−0.006
Generated, v18’s
0.777
0.786
+0.009
Adequacy, HelpSteer2
0.722
0.761
+0.039
Adequacy, generated, balanced
0.788
0.821
+0.033
Where does that leave us on the encoders vs decoders question? Not very much closer to the truth, I fear. This experiment is hopelessly confounded, changing architectures, base models, instruction tuning vs base, and other variables. But we have learned some interesting things. Neither seems like a slam-dunk winner for this kind of work at this size.
The code for this experiment is
in a branch for now
. It doesn’t seem worth pulling into mainline strands-decider yet, but may with some development.
Footnotes
Some decoder ideas sneaking back in. Decoders do the same trick (
KV cache
and prefix cache) for the same reasons. Certain not for the first time memoizing incremental results has helped performance.
Certainly not the first time an $O(N^2)$ algorithm has beaten an $O(N)$ one at small data sizes.
ASML's strong orders ease fears AI spending boom is running out of steam
ZXC is a lossless data compression library written in C, distributed as
libzxc
. It is designed for data that is compressed once and read many times: firmware images, game assets, application bundles, and content delivered to many devices. The encoder spends extra time up front so that decompression runs at several gigabytes per second on ARM and x86. At every compression level ZXC decodes faster than LZ4, and produces output of equal or smaller size.
ZXC is free software, released under the
BSD 3-Clause License
. It has no dependencies, and official bindings exist for Rust, Python, Node.js and Go.
The current release is ZXC 0.15.0
, released on 2026-10-13.
See the
changelog
for what changed, and
Downloading ZXC
below.
Decompression speed against codecs of similar size
Fast
61.76 % of original
zxc -1
13,513 MB/s
lz4 --fast -17
5,609 MB/s
2.41× faster
decode, smaller output (61.76 % vs 62.15 %)
Default
46.65 % of original
zxc -3
9,707 MB/s
lz4
4,774 MB/s
2.03× faster
decode, smaller output (46.65 % vs 47.60 %)
High
36.28 % of original
zxc -6
6,884 MB/s
lz4hc -9
4,522 MB/s
1.52× faster
decode, smaller output (36.28 % vs 36.75 %)
Ultra
33.09 % of original
zxc -7
5,054 MB/s
zstd -1
1,803 MB/s
2.80× faster
decode, smaller output (33.09 % vs 34.53 %)
Figure 1. Single-threaded decompression of
silesia.tar
(211.9 MB), measured with lzbench 2.4.1 and zxc 0.15.0. ZXC levels 1, 3, 6 and 7 are each compared with the codec that produces output of similar size.
Apple M2, macOS 26, Clang 21, -march=native
. Full results are in the
benchmark tables
.
Specifications
Why ZXC?
LZ4 is symmetric: it compresses about as fast as it decompresses. That suits logs and swap, but not data that is shipped. A firmware image is compressed once on a build server and decompressed on every device that installs it, so time saved during compression helps nobody.
ZXC moves the work to the encoder. Match selection, optimal parsing and statistics tuning are done once, and the bitstream is laid out for the pipelines and branch predictors of modern processors. The decoder stays short, has few branches, and uses SIMD where it is available.
Typical uses:
Firmware and over-the-air updates. In-place decompression keeps peak memory close to the decompressed size.
Game assets and application start-up, where load time and battery use matter.
Packaged artefacts and content delivery, where more original data is delivered per byte read from disk or network.
Read-heavy storage. Seekable archives can decode any block without reading the blocks before it.
Features
Seekable archives.
An optional seek table gives O(1) random access to any block.
In-place decompression.
Decode inside a single buffer with about 1 % overhead instead of a second allocation.
Trained dictionaries.
zxc --train
builds a dictionary for small, similar payloads such as JSON documents, log lines or RPC messages.
Multi-threaded streaming.
The file and stream interfaces split work across processor cores.
Hand-written SIMD.
SSE2, AVX2 and AVX-512 with run-time selection on x86; NEON on ARMv8 and later.
Portable.
Tested on x86_64, ARM64, ARMv7, ARMv6, RISC-V, POWER, s390x and i386.
Careful interface.
Every call takes an explicit output capacity. The library is thread-safe, with reusable contexts for tight loops and static contexts for targets without a heap.
Optional checksums.
Per-block integrity checks based on rapidhash.
Documented format.
The
wire format
(version 9) is specified in full, and public conformance vectors let others write independent decoders.
Compression levels
Seven levels trade compression time for size. Decompression stays in the multi-GB/s range at every level. Level 3 is the default.
Size is the compressed size as a percentage of
silesia.tar
. Speeds are single-threaded on Apple M2 with lzbench 2.4.1. Blocks are 512 KB by default; use
-B 256K
for streaming or memory-constrained targets.
Benchmarks
ZXC is included in the two main open-source compression benchmark suites,
lzbench
and
TurboBench
, so the figures below can be reproduced with either tool alongside more than 70 other codecs. Benchmarks also run on every commit on x86_64 and ARM64 machines; see the
latest results
.
Figure 2. Compression ratio of
silesia.tar
against single-threaded decompression speed (logarithmic scale), on two ARM64 and two x86_64 processors; up and to the right is better. From the
whitepaper
.
The decoder's speed is paid for at compression time, and on this axis LZ4 and Zstandard are ahead. Levels 1 and 2 still compress at several hundred MB/s; levels 6 and 7 run at about 10 MB/s, slower than
lz4hc -9
, and are meant for data that is compressed once and read many times.
Figure 3. Compression ratio of
silesia.tar
against single-threaded compression speed (logarithmic scale), on the same four processors; up and to the right is better. From the
whitepaper
.
Raw decode speed leaves out half of the picture. When the decoder is fed from a disk, a network or another core, the compressed bytes are what is scarce, and what matters is how much original data each compressed megabyte yields. Effective throughput combines both: decode speed × 100 / ratio (%). On this measure every ZXC level is ahead of LZ4, on all four processors.
Figure 4. Effective throughput (decode speed × 100 / ratio %) relative to LZ4, on the same four processors; higher is better, and LZ4 is 1.00. From the
whitepaper
.
Dividing the clock frequency by the decompression speed gives the cost of each decompressed byte in processor cycles, which compares processors running at different frequencies. ZXC spends less than one cycle per byte at every level.
Figure 5. Processor cycles per decompressed byte (clock frequency / decompression speed), on the same four processors; lower is better. From the
whitepaper
.
Apple M2
(ARM64)
Apple M2, macOS 26, Clang 21, -march=native. Single thread, lzbench 2.4.1,
silesia.tar
. Speeds in MB/s; size as a percentage of the input.
Google Axion
(ARM64)
Google Axion (Neoverse V2), GCP C4A, GCC 14.4, -march=native. Single thread, lzbench 2.4.1,
silesia.tar
. Speeds in MB/s; size as a percentage of the input.
AMD EPYC 9B45
(x86_64)
AMD EPYC 9B45 (Zen 5), GCP C4D, GCC 14.4, -march=native. Single thread, lzbench 2.4.1,
silesia.tar
. Speeds in MB/s; size as a percentage of the input.
AMD EPYC 7B13
(x86_64)
AMD EPYC 7B13 (Zen 3), GCP C2D, GCC 14.4, -march=native. Single thread, lzbench 2.4.1,
silesia.tar
. Speeds in MB/s; size as a percentage of the input.
Downloading ZXC
Source and binary archives for Linux, macOS and Windows are published on the
releases page
. Each archive carries SLSA build provenance, which you can check with:
The installation provides CMake (
find_package(zxc)
, target
zxc::zxc_lib
) and pkg-config (
libzxc
) files. Meson users can include ZXC as a subproject; see the
integration guide
.
Quick start
The
zxc
command reads and writes files or pipes, and can be used as a compressor by
tar
:
# Compress (level 3 by default), then decompresszxc -5 assets.tar assets.tar.zxc
zxc-d assets.tar.zxc assets.tar
# Seekable archive, for random accesszxc-S big.bin big.bin.zxc
# As a compressor for tartar-I'zxc -5'-cf data.tar.zxc data/
# Measure speed on your own machinezxc-b input_file
From C, the buffer interface compresses and decompresses in one call each:
See the
examples
for the streaming, context, seekable and dictionary interfaces, the
API reference
for every function, and the
manual page
for all command options.
Language bindings
The official bindings are maintained in the main repository and released with the library. They are published as
zxc-compress
, because the name
zxc
is taken on some registries.
Fuzzed around the clock by Google
OSS-Fuzz
, with eight harnesses covering compression, decompression, the block API, in-place decoding, streaming, seekable archives and dictionaries; they reach over 80 % of the library's lines (
coverage history
).
The same harnesses run under ClusterFuzzLite on every pull request.
AddressSanitizer, UndefinedBehaviorSanitizer and Valgrind in continuous integration; Cppcheck, the Clang Static Analyzer and CodeQL on every change; continuous security analysis of the code and its dependencies by Snyk.
Decoder conformance vectors and byte-exact tests of the encoder output, so that the wire format cannot change by accident.
Builds and tests across several operating systems, compilers and eight processor architectures.
Microsoft fixes VPN issues caused by September Windows updates
Bleeping Computer
www.bleepingcomputer.com
2026-10-14 10:27:01
Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. [...]...
Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates.
The
Always On VPN
remote access solution replaced the legacy DirectAccess technology and works with domain-joined, non-domain-joined, and Microsoft Entra ID–joined Windows 10, Windows 11, and Windows Server devices.
Always On VPN runs in the background and automatically establishes a secure tunnel back to the corporate network whenever a device connects to the internet.
As Microsoft first acknowledged
in a service alert sent to IT administrators
in late September, the bug triggered Always On VPN failures if the initial connection fails (e.g., when using automatic protocol selection with IKEv2 and SSTP) on up-to-date systems running Windows 11 24H2 and later.
"When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed,"
it said
. "In some cases, subsequent connection attempts could display the error, 'The specified port is already in use.'"
Microsoft has also shared a temporary fix for customers who can't immediately install the October 2026 Patch Tuesday update, which requires them to choose one of two VPN tunneling protocols to work around the issue.
"IT administrators can mitigate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, depending on their environment and configuration," Microsoft said. "Organizations should select the protocol based on their environment, security, and deployment requirements."
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Matthew Green has been writing a rather pessimistic series of posts about the potential for AI systems to vastly outperform humans in cryptanalysis of both symmetric and public-key ciphers.
I am more optimistic than he is. That is, I have stronger faith in the over-engineering cryptographers tend to...
Matthew Green
has
been
writing
a rather pessimistic series of posts about the potential for AI systems to vastly outperform humans in cryptanalysis of both symmetric and public-key ciphers.
I am more optimistic than he is. That is, I have stronger faith in the over-engineering cryptographers tend to do. I am trying to write this up in more detail.
Re: “I’m not going to get a prize for being right, and everyone will make fun of me for being wrong“
To be right is a barren victory, and to be wrong is a public crucifixion. Life is a theater where applause and ridicule are equally hollow; the only authentic moment is the one in which we recoil from both.
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial res...
The United Kingdom has issued economic sanctions against
Cryptomus
, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.
Heleket’s support agent on Telegram claims, despite all evidence to the contrary, that it is not affiliated with Cryptomus. Image: Richard Sanders.
On October 8, the U.K.
issued sanctions
(PDF) against Cryptomus — previously known as
Certa Payments
and
Xeltox Enterprises
— for processing payments that benefit the Russian government and its financial institutions. The sanctions freeze any Cryptomus assets at U.K. banks, and bar British companies from offering it any business, virtual or otherwise. Also targeted in these sanctions were the virtual payment platforms
VexPay
,
TokenSpot
, and the
Tsunami Payments service
.
As explained in our December 2024 investigation, “
How Cryptocurrency Turns to Cash in Russian Banks
,” Cryptomus has been a key payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The company has changed its name several times since emerging in 2022, most recently to “
Heleket
” last year after Canada levied
a record CAD $176 million fine
against the platform for anti-money laundering violations.
The blockchain data-crunching firm
Chainalysis
said the U.K. sanctions target the broader infrastructure supporting Russia’s wartime economy.
“Cryptomus and Heleket have emerged as major payment hubs for illicit activity,” Chainalysis
wrote
in an October 8 blog post. “Together, these services received more illicit funds across tracked categories than the mixers in our dataset and the number of illicit counterparties surged to more than 900 in a single month in late 2025.”
The Cryptomus support bot on Telegram, responding on Oct. 8 to an inquiry by saying the platform was suddenly unable to process transactions.
In April 2026, the blockchain analysis firm
TRM Labs
found
Cryptomus had processed more than $7 billion in transactions since its inception in 2022, including transactions associated with child sexual abuse material vendors, terrorist financing networks, and human trafficking operations.
TRM noted that Cryptomus’s transaction volume cratered after the platform instituted new “know your customer” or KYC rules, and that the cryptocurrency platform responded to the Canadian fines by launching Heleket as a parallel service that continued to offer no-KYC payment processing.
Richard Sanders
is a blockchain analyst and investigator who spent months mapping out Cryptomus’s payment infrastructure and transacting with its customers. Sanders said the U.K. sanctions on Cryptomus are important because Canada’s sanctions against the platform were ultimately unenforceable and uncollectible.
“A fine doesn’t stop a cryptocurrency payment processor from processing payments,” Sanders
wrote on LinkedIn
. “Sanctions kill the operation. The distinction matters.”
As our 2024 investigation noted, Cryptomus shared a Vancouver address with dozens of other foreign currency dealers and money transfer businesses — none of which appeared to be physically located there. Following the CAD $176 million fine for alleged money laundering violations, Cryptomus appealed the penalty, launched Heleket as a parallel service, and kept on processing large volumes of sketchy transactions, Sanders said.
Sanders said the sanctions also are notable because they are the first known instance of a “Five Eyes” country (referring to the Australia, Canada, New Zealand, the U.K. and the U.S.) sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction.
Where do entities like Cryptomus and Heleket derive their authority to offer international financial services? The answer appears to involve fake financial institutions overseen by a phony regulatory body positioned in a country that is not widely recognized as a sovereign nation.
Our 2024 investigation found the sole shareholder of Cryptomus’s parent company Certa Payments was a 25-year-old Ukrainian woman who also headed several other firms, including the
WS Management and Advisory Corporation
, which bills itself as the regulatory body that exclusively oversees licenses for cryptocurrency, foreign exchange and online gaming businesses incorporated in the disputed region in northwest Africa known as the
Western Sahara
.
That entity’s website — crasadr.com — says it assists applicants with bank setup and formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. One of Certa Payments’ former sites — certa[.]website — also shared a server with 12 other domains, including rasd-state[.]ws, a website for the Central Reserve Authority of the Western Sahara.
The website crasadr dot com, the official website of the Central Reserve Authority of Western Sahara, which lists the entities awarded licenses for cryptocurrencies, gaming and foreign exchange services.
Cyberattack on Connected Fridges in France
Schneier
www.schneier.com
2026-10-14 10:10:22
Another IoT cyberattack, this one in France:
Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected.
[…]
Normally, supermarket freezers go through a short perio...
Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected.
[…]
Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process.
Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.
Any IoT device that can’t be updated is vulnerable. And, probably, any IoT device that
can
be updated is also vulnerable.
The Blind Spots of Agentic Pentesting and How to Close Them
Bleeping Computer
www.bleepingcomputer.com
2026-10-14 10:00:10
AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps. [...]...
For years, security teams had a window of several weeks between a CVE going public and attackers exploiting it. Every year, that window got smaller. Then Mythos-class models arrived, and attackers can now weaponize a new CVE within hours. That leaves security teams very little time to find out whether they’re exposed.
That’s where offensive testing comes in. But it has traditionally run on a schedule. Over the years, that schedule got tighter. Annual pentests became quarterly, and automated penetration testing tools made weekly testing possible.
Each advancement shortened the time a change could go untested. Traditional automated pentesting worked fine back when exploitation took weeks. Now that attackers have made a big jump, offensive testing is making one too.
That jump is agentic pentesting.
It’s the sharp edge of offensive testing today, but it has blind spots. This piece looks at where they are and how to close them.
How Agentic Pentesting Should Work
A manual pentest usually goes through several phases: reconnaissance, vulnerability assessment, initial access, post-exploitation, and reporting. Traditional automated pentesting tools follow the same phases. Even before LLMs took off, some advanced tools used machine learning to choose the next step. For example, five years ago, we built our
Attack Path Validation (APV)
product with such a decision engine. But AI agents take it further.
In agentic pentesting, one or more AI agents carry out a pentest step by step. In our
agentic pentesting product
,
Picus Swarm
uses five specialist agents orchestrated by Numi AI.
AI pentest agents evaluate findings and your organization’s context to choose the next step dynamically. That creativity lets them find exploit chains much faster than a human pentester, including some a human might miss entirely.
However, creativity comes at a cost.
Running everything agentically uses a lot of tokens, and results vary from run to run. Even when nothing has changed in the environment, an agent can fail to exploit a vulnerability five times and succeed on the sixth. Running dozens of tests to be sure gets expensive, and in a large organization with thousands of endpoints, a single agentic run can take weeks.
That’s why
deterministic automated pentesting is still needed
. It’s less creative, but it delivers consistent testing, costs less, and finishes faster, so it can run far more often. It follows repeatable steps, allowing teams to compare runs over time and reliably retest fixes.
The right approach offers both. Run deterministic tests often for predictable coverage and agentic tests at set intervals. How often depends on your organization’s needs and risk appetite.
Picus Autonomous Pentesting
can run in either mode, fully agentic or deterministic, and adapts to your context, risks, and changes in the threat landscape and your environment.
Agentic pentesting is valuable, and the need for it is real. But it has limits worth understanding.
In most deployments, automated pentesting covers only one of six surfaces you need to validate.
This whitepaper shows what stays untested, from detection rules to cloud, identity, and AI guardrails, why adding AI doesn’t lift that ceiling, and three questions that expose the gap.
The Achilles’ Heel of Agentic Pentesting: Untestable Assets and Exposures
Agentic pentesting’s biggest strength is also its limit. It tests by running real attacks, so it can only test what it can safely reach.
Omdia research
found that organizations pentest
only 32% of their attack surface on average
.
Safety restrictions keep it off critical systems. A real exploit can crash a service, corrupt data, or trigger a failover. That’s why PCI and NIST guidance advises testers to avoid potentially disruptive exploits on fragile production systems. Reachability limits the rest. The agent can only test what it has a network path into, so segmented and air-gapped zones stay out of reach.
We saw this in one customer environment. Their scanners flagged an nginx-ui authentication bypass (
CVE-2026-33032
) on 480 instances.
Within the permitted scope, agentic pentesting could test only 120 of them. It confirmed that 80 were exploitable, while 40 were blocked. The other 360, three out of every four affected instances, were out of reach and received no verdict.
The nginx-ui case covered a single CVE. Zoom out to all the CVEs in your environment, and a second gap appears. Even on assets an agentic pentesting tool can reach, many vulnerabilities can’t be tested because there’s no exploit to run.
So agentic pentesting leaves two gaps: the assets it never reaches, like those 360 instances, and the vulnerabilities it can’t test on the assets it does reach, often because there’s no exploit to run.
How Exploitability Validation Covers All Your Assets and Exposures
In the nginx-ui bypass case discussed above, agentic pentesting left 360 of the 480 affected instances without an answer. Exploitability validation, delivered by Picus Exposure Validation, doesn’t try to reach them with an exploit. It breaks the CVE down into the attacker behaviors required to exploit it and tests each behavior against your live security controls within hours.
Because the verdict rests on control evidence rather than successful exploitation, a missing PoC is not treated as proof that an asset is safe. This addresses both gaps. Combined with asset context, that evidence gives the 360 untested instances a verdict: 260 blocked by controls and 100 likely exploitable.
The 480 raw findings become 180 evidence-backed priorities: 80 confirmed exploitable through agentic pentesting and 100 assessed as likely exploitable through Exposure Validation.
You know which hosts your controls already cover and which need a compensating control today.
Three Methods Working Together to Validate Every CVE and Every Asset in Hours
Running these methods as separate tools can produce siloed or duplicated findings and conflicting priorities. They need to feed one shared, evidence-backed, context-aware findings model, with one backlog and one result per exposure.
When a critical CVE drops, Numi AI picks it up as a signal, and Picus Swarm's agents take it from there.
Discovery.
The CVE is enriched with threat intelligence and mapped to attacker techniques. Affected assets, their business criticality, and deployed controls are identified.
Validation.
Autonomous Pentesting tests in-scope assets, Breach and Attack Simulation tests controls, and Exposure Validation assesses every affected asset.
Mobilization.
Low-risk mitigations are deployed automatically. The rest are assigned to owners, and every fix is revalidated.
The whole cycle runs in hours, not weeks.
The Bottom Line
Attackers with Mythos-class models can now weaponize a new CVE within hours. Agentic pentesting is the most powerful way to test like a real attacker, and when the same platform also supports deterministic tests, testing stays both creative and repeatable. But even together, these methods can only test what they can safely reach.
Exposure Validation covers the rest. Together with Breach and Attack Simulation, the three capabilities work as one platform to validate every CVE on every asset in hours.
Ready player one? Why the games arcade is having a rebirth
Guardian
www.theguardian.com
2026-10-14 10:00:03
After years of sprawling ‘forever’ games, players are rediscovering the pleasures of more focused experiences. Could a new wave of independent arcades bring back the social side of gaming? • Don’t get Pushing Buttons delivered to your inbox? Sign up here There’s an important semi-nostalgic movement ...
There’s an important semi-nostalgic movement happening in games, and I’m excited about where it’s heading. But I don’t want to get ahead of myself here.
Over the last five years, major publishers, obsessed with the success of “forever games” such as Fortnite, Minecraft and Roblox, have been throwing hundreds of millions of dollars into their own sprawling, endlessly updating, battle-pass-infested mega franchises – each designed to take all our time and money. The result has been astounding failures such as
Concord
, Mindseye and Tales of the Shire. Even the good games – Crimson Desert, Path of Exile 2, Blood of the Dawnwalker – are so bloated they have become the unyielding masters of our precious few hours of free time.
It’s a relief, then, to see a growing number of mainstream titles heavily inspired by arcade design conventions, and intended as discreet, contained experiences. Along with the excellent driving game Star Wars Galactic Racer, which I rave about below, there’s
Ace Combat 8: Wings of Theve
, an unreconstructed air-combat shooter that doesn’t want to become your whole life. You don’t have to romance your F/A-18F Super Hornet (although that does sound sort of cool), you don’t have to build your own airbase. You fly, you shoot things, there’s a story in the background, the end. It’s been equally lovely to see the success of Marvel Tōkon: Fighting Souls, a demanding 2D fighting game with complex interlocking power-up systems – the sort of thing my friends and I might have played in the arcades in 1993 before buying it on imported £100 Neo Geo carts.
A quick round … in an age of endless online games, the appeal of the arcade is enduring.
Photograph: B Christopher/Alamy
All of this points to one inevitable, socio-ludological phenomenon: the rebirth of the games arcade. Yes, I know there are already a few brilliant retro arcades dotted about, and plenty of chain bars and cafes such as Continue and NQ64 offering classic coin-ops alongside themed cocktails. There’s also
Arcade Arena
, a new “immersive experience” venue in London that lets you play physical versions of Pac-Man and kart racers. But a growing number of players are interested in arcade-game design, and don’t necessarily want to play a few rounds of Time Crisis while downing a mojito.
What I’m hoping to see is a more refined take on the coin-op arcade, something akin to the rise of the independent bookshop, with carefully curated collections of both new and classic experiences, and interesting events.
This, I am pleased to discover, is happening. “The popularity of gaming bars and cafes is demonstrating that there is a sustainable business model in out-of-home gaming here in 2026,” says games journalist and arcade obsessive Will Freeman. “I wouldn’t go as far as to call it a boom, but there are a handful of smaller set-ups taking an approach that feels comparable to independent bookshops and record stores.”
He mentions NQ Japan, which is about to open in London’s Soho. “While it is a cafe, there’s a firm focus on imported Japanese coin-op cabinets – covering newer games and cult classics that carry weight in the arcade community,” he tells me. “It really looks to be serving an authentic, arcade experience, bringing back that anticipation of getting your hands on exotic games from the cultural centre of arcade gaming.”
High-end joy … the arcade gaming industry is booming.
Photograph: Teri Pengilley/The Guardian
The retro gaming industry is booming, with specialist manufacturers such as Analogue and Evercade producing high-end consoles that play original carts or new emulated collections of rare and sought-after titles. People are willing to spend money on an authentic arcade-style experience, just as they are now spending money on DVDs and vinyl records. A growing number of us want to have experiences that mega corps can’t provide through sleek, glassy devices.
But while it is lovely that people are rediscovering foundational game mechanics through Ace Combat and Marvel Tōkon, there is much more to discover. The joy of arcades in the 1970s and 80s was that they were social hives as well as gaming spaces – you made friends, you learned from better players – and each game created its own community. Crucially, you went in with a handful of coins and could have a handful of very different experiences. A new era of boutique arcades could bring that back.
“Something is under way, even if it is quietly,” says Freeman, pointing to smaller independent arcades with curated games libraries, such as Pixel Bunker in Milton Keynes. “I think we might see more independent arcades open up that drop the established ‘gaming cafe’ model to various degrees, and bring that feeling of local experts who really know their arcade culture, and want to build venues that draw in enthusiast communities.”
Modern video games are bringing the arcade back into our homes. Perhaps now it is time to bring arcades back to our rapidly emptying high streets.
It feels like ages since we’ve seen an exciting mainstream racing game with a traditional linear structure rather than a vast open world. Enter
Star Wars Galactic Racer
– where you pilot landspeeders, speeder bikes and other outlandish Star Wars vehicles through intense circuits on excitingly familiar planets. As you progress, you unlock new parts and abilities, and plot your own route through a branching series of events. But crash out from a race and you have to go right back to the beginning of the season – a really clever implementation of rogue-lite design sensibilities in what is essentially a modern day take on Wipeout.
What a joy it is to zoom through the wreckage-strewn canyons of Jakku and the icy tundras of Ando Prime, hitting the ramjet button to scorch past other vehicles at hundreds of miles-per-hour while a John Williams-adjacent symphonic score adds to the thrill. There hasn’t been a Star Wars racing title since Star Wars: Racer Revenge in 2002, which was, um, not a great game. I hope this is the beginning of a beautiful new era.
Available on:
PC, PS5, Xbox
Estimated playtime:
20 hours plus
AI first? … Epic Games’ new approach to its forthcoming film adaptation.
Photograph: Costfoto/NurPhoto/Shutterstock
As
reported in Bloomberg
, it seems that the Fortnite creator
Epic Games
has ordered an “AI-first” approach to developing a forthcoming Disney title. “Progress on the title has allegedly been slower than expected, partly because Epic underestimated how many staff it would require,”
writes VGC
. The team has apparently been told to use tools such as Anthropic’s Claude AI.
GamesIndustry.Biz adds
: “In an internal message seen by Bloomberg, one of the game’s directors told staff: ‘No more hand-written code.’ The director also said all of the game’s art would be ‘generated with full AI workflows.’” How do the developers feel? Stunned is the most widely reported reaction.
There is a lot of interest in the subject of
games industry unionisation
, partly because of
the most recent Xbox lay-offs
and partly due to the
ongoing legal battle
between Rockstar and a group of ex-employees fired, they contend, because they were seeking to unionise. Kotaku has
an interesting and enlightening story
, this time about a failed attempt to unionise at the veteran studio Double Fine and the ongoing ramifications.
The latest novel by Guardian games contributor,
Sarah Maria Griffin
is out.
Strange Is the Light
is a gothic thriller about a group of friends whose lives are torn apart by a live-action role-playing game they invented as children.
High Score … Gail Tilden, who led Nintendo of America to multimillion-selling success.
Photograph: Netflix/Courtesy of Netflix
A great question this week from
Trudy
via email:
“I’m really into documentaries at the moment
. Could you recommend any that deal with video games and the gaming industry?”
There are a few absolute classics that really defined the genre – among them are
The King of Kong
, about the competitive Donkey Kong players Steve Wiebe and Billy Mitchell, and
Indie Game: The Movie
about a community of indie devs in the early 2010s. I’d also recommend the Netflix series
High Score
,
the bizarre
Atari: Game Over
, about the burial and excavation of hundreds of ET carts in the early 80s, and the self-explanatory
Rubber-Keyed Wonder: The Story of the Sinclair ZX Spectrum
. For online documentaries, you definitely need to visit the excellent YouTube channels
NoClip
and
People Make Games
– they have done fascinating, important work. I also enjoyed Travis “Samox” Beauchamp’s charmingly idiosyncratic
series
,
The Smash Bros
. Finally, I have to do this – try
An
Alternative Reality: The Football Manager Documentary
, which features an insightful video game journalist you may well recognise.
If you have a question for Question Block – or anything else to say about the newsletter –
email us at
pushingbuttons@theguardian.com
.
[$] Collaborating with out-of-tree tracers
Linux Weekly News
lwn.net
2026-10-14 09:56:50
LTTng creator Mathieu Desnoyers seems a
bit trapped in something of a catch-22.
At the 2026 Linux Plumbers Conference
(LPC), he led a discussion on the problem he is having in trying to
collaborate with other tracing projects (e.g. ftrace, perf) in the kernel. The
feedback he has gotten, both over ...
The page you have tried to view (
Collaborating with out-of-tree tracers
) is currently available to LWN
subscribers only.
Reader subscriptions are a necessary way
to fund the continued existence of LWN and the quality of its content.
If you are already an LWN.net subscriber, please log in
with the form below to read this content.
Please consider
subscribing to LWN
. An LWN
subscription provides numerous benefits, including access to restricted
content and the warm feeling of knowing that you are helping to keep LWN
alive.
(Alternatively, this item will become freely
available on October 22, 2026)
Linus Torvalds's first LLM-assisted patch series
Linux Weekly News
lwn.net
2026-10-14 09:50:29
At the recently concluded Maintainers
Summit, Linus Torvalds said that he had been using a large language
model to work on a patch series addressing a longstanding problem; he has
now posted
that series for review.
The fairly short series of ten patches basically enhances folio
lookup by noticin...
At the recently concluded
Maintainers
Summit
, Linus Torvalds said that he had been using a large language
model to work on a patch series addressing a longstanding problem; he has
now
posted
that series for review
.
The fairly short series of ten patches basically enhances folio
lookup by noticing when folios are hot, and setting a "delay
releasing this folio until after a RCU period", and then using that
RCU delay it does not just the folio lookup itself under RCU (which
we've done forever), but also the actual folio data accesses
themselves under RCU. No refcount taking needed for the fastpath
where we can just read the data from the folio entirely in an
RCU-protected region when the user copy doesn't cause page faults.
The end result is an order-of-magnitude speedup for a
read()
-heavy
benchmark. Review has already
identified a race
condition
in the code, though, so further work will be needed.
Building a Linearizable Log on READ COMMITTED Isolation
Materialize's storage layer (
persist
) requires a metadata store where a small amount of state is maintained for each durable object. In June, a self-managed deployment with many such objects experienced a metastable failure where metadata operation latencies rose from a few milliseconds to thirty seconds, leading to an incident.
Self-managed deployments of Materialize use a PostgreSQL database as the metadata store, which during the incident had most of its connections in a waiting state. The number of
SIRead
locks had grown to hundreds of thousands, an indication that the cost of running queries under
SERIALIZABLE
isolation was the bottleneck.
This post is an account of how we reworked the implementation of the
persist
metadata store to be able to build a linearizable log with queries running under
READ COMMITTED
isolation. The new implementation was able to sustain three times the write throughput and gracefully degrade even as the load exceeded the capacity of the PostgreSQL database. Additionally, we describe how we gained confidence in its correctness by modeling PostgreSQL's
READ COMMITTED
behavior in Lean 4 and proving that the design is linearizable.
Shards as logs of state diffs
Every durable object in Materialize (a table or a materialized view, for example) is stored by
persist
in a unit called a shard. The bulk of a shard's data lives in object storage, while the metadata store holds the shard's state: which data files currently make up the shard, how far it has progressed in time, and which readers are holding on to old data.
The state of a shard can change for many reasons, including new data being committed, a reader advancing its read hold, and others. In a Materialize deployment there can be several independent processes all holding a shard handle for the same shard id. In order to make sure there is exactly one state history for any given shard we coordinate state-changing actions between processes in the usual way:
For each shard, the metadata store maintains a versioned log of state diffs.
Each process attempts to extend this log via a compare-and-set operation.
Each version of the state is assigned a sequence number one higher than the previous one.
Writers read the latest version, compute the next one, and request that the database append it on the condition that the version it read is still the latest, reading again and retrying if the condition fails.
We call the component that provides this "the consensus implementation", which on PostgreSQL is a single table:
1
CREATETABLE consensus (
2
shard textNOTNULL,
3
sequence_number bigintNOTNULL,
4
data byteaNOTNULL,
5
PRIMARY KEY (shard, sequence_number)
6
);
sql
persist
performs four operations on it:
head(shard)
returns the row with the largest sequence number.
scan(shard, from)
returns all rows with sequence number at least
from
, in order.
compare_and_set(shard, seqno, state_diff)
appends
state_diff
if
seqno
is exactly one past the current head, and returns
Committed
or
ExpectationMismatch
. We abbreviate it as CaS, and refer to
seqno - 1
, the version the writer believes to be the head, as
expected
. The first version of a shard has the sequence number 0 and therefore
expected
is not defined. This case is covered separately below.
truncate(shard, cut)
deletes all rows with sequence number below
cut
. It must not delete the head.
For this scheme to work, the log has to behave as if the operations happened one at a time, in some order consistent with when they were issued. It needs to be linearizable. Two writers must not both succeed at the same sequence number, and no writer may succeed at a sequence number that has already been truncated, since the state it writes there would be built on a version the rest of the system has discarded, and either outcome forks the shard.
The cost of SERIALIZABLE
Until this work, the consensus queries ran under
SERIALIZABLE
isolation, which is the simplest way to obtain linearizability in PostgreSQL, since if every transaction is serializable then any interleaving of them behaves like some serial order and the SQL only has to be correct in a serial order. The CaS query we were using would read the current head row and insert the next one if the head matched
expected
. The very first write of a shard was an
INSERT
guarded by a
NOT EXISTS
clause asserting that the shard is empty. Both of those queries are correct when run one at a time.
When running under
SERIALIZABLE
isolation, PostgreSQL doesn't actually run transactions one by one. To increase performance it attempts to run transactions concurrently and detect serializability conflicts using Serializable Snapshot Isolation (SSI). The way this works is by recording every read of a transaction as an
SIRead
lock on the rows and index pages it visits, and having every write check the
SIRead
locks held on the pages it touches to detect read-write conflicts between transactions.
These locks are retained from the time a transaction commits until every transaction that overlapped with it has also finished, because a conflict can still form with a transaction that is still running. On a small, hot table with thousands of concurrent writers, many shards share each index page, so each insert walks the locks of every transaction that recently read the same page.
These charts are from a reproduction on a
db.r6g.2xlarge
RDS instance, where the load is twenty Materialize clusters, each with six hundred trivial materialized views over an empty table, brought online gradually. What we can observe is that the database sustained the load up to about 4,300 CaS per second, but past that point transactions took long enough that the number of retained
SIRead
locks grew, which made the conflict check on every insert more expensive, which in turn made transactions slower still. Latency reached thirty seconds and throughput fell to a fraction of what the database had sustained moments before, and the system did not recover until we removed load.
This is the failure pattern that Bronson et al. call a metastable failure [1], where a system in a vulnerable state is pushed by a trigger into a bad state and a sustaining effect keeps it there after the trigger is gone, so that recovery requires reducing load well below the level that caused the failure.
The trigger in this case was a transient slowdown of transaction processing that led to the increase in the number of
SIRead
locks, which in turn increased the cost of every other write, turning the transient slowdown into a sustained effect. A transient slowdown can happen due to a transient spike in the load, the database starting concurrent table maintenance (vacuuming), a process pause, etc. The
SIRead
lock count is what the paper calls a characteristic metric, a metric that rises with the trigger and does not return to normal until the failure is resolved, and the paper's recommendation is to treat the sustaining effect rather than the trigger, since many triggers lead to the same failure state. In our case a larger database instance or fewer shards would only move the trigger to a different threshold, whereas not relying on
SERIALIZABLE
eliminates the sustaining effect.
One way to avoid
SIRead
locks is to run transactions under
READ COMMITTED
isolation. However, the existing queries were not correct in that mode. Under
READ COMMITTED
each statement sees a snapshot taken when it started, but the uniqueness check that an
INSERT
performs against the primary key runs against the live index and sees rows committed or deleted after the snapshot, so a single statement can observe a state in its
WHERE
clause that no longer holds when its
INSERT
runs. As it turns out, it is possible to get a linearizable log behavior under
READ COMMITTED
by carefully adjusting the queries.
The core shard log invariant
The new design relies on a property of the table that is maintained after every operation:
The sequence numbers present for a shard always form a contiguous interval
[lo, head]
.
The two state-modifying operations are a compare-and-set and a truncate. A compare-and-set always extends the interval by one at the top. A truncation always removes a prefix, excluding the head. The consequence is that in a contiguous log the condition "
expected
is present and
expected + 1
is absent" is equivalent to the condition "
expected
is the head", the latter being the condition required by the specification of CaS. Therefore under the assumption that the log is a contiguous log we can implement the condition of the specification using a
SELECT
and a primary key.
Figure 1. The contiguity invariant and the two local checks the CaS statement makes. The CTE checks that
expected
is present; the primary key checks that
expected + 1
is absent. In a contiguous log the two together are equivalent to "
expected
is the head", which is what the specification asks for. Rows below
lo
have been truncated; the marker at −1 is never truncated.
This suggests the following CaS query:
1
WITH expected_row AS (
2
SELECT sequence_number FROM consensus
3
WHERE shard = $1AND sequence_number = $expected
4
FOR KEY SHARE
5
)
6
INSERT INTO consensus (shard, sequence_number, data)
7
SELECT $1, $expected + 1, $data
8
FROM expected_row;
sql
The
expected_row
CTE (Common Table Expression) checks that the row the writer intends to build on is present and takes a shared lock on it, and the
INSERT
adds
expected + 1
if the primary key allows it, so the statement inserts a row in one case only: the predecessor is present and its successor is absent, which by the invariant means
expected
was the head. If the CTE finds nothing, the
INSERT
affects zero rows, and if the successor is already there the primary key rejects it. Both outcomes are reported as
ExpectationMismatch
.
Concurrent CaS operations fence each other through the primary key alone. Several clients can run the statement for the same
expected
at once, in which case all of them see
expected + 1
absent in their snapshot and all of them attempt the same
INSERT
. The primary key admits one, and the others receive a unique violation, by which time the head has moved and
ExpectationMismatch
is the correct answer for them. The
FOR KEY SHARE
lock plays no part in this, since it is a shared lock and concurrent CaS operations on the same predecessor all acquire it without blocking one another. Its purpose is to order CaS operations with respect to truncation, which is dealt with later in the post.
The other operations are single statements.
head
and
scan
are one
SELECT
each:
1
-- head
2
SELECT sequence_number, data FROM consensus
3
WHERE shard = $1
4
ORDERBY sequence_number DESCLIMIT1;
5
6
-- scan
7
SELECT sequence_number, data FROM consensus
8
WHERE shard = $1AND sequence_number >= $from
9
ORDERBY sequence_number ASCLIMIT $limit;
sql
A single statement sees one snapshot, so each of them observes the log at one instant.
Finally,
truncate
is one
DELETE
with an
EXISTS
guard:
1
-- truncate
2
DELETEFROM consensus
3
WHERE shard = $1AND sequence_number >=0AND sequence_number < $cut
4
ANDEXISTS (
5
SELECT*FROM consensus WHERE shard = $1AND sequence_number >= $cut
6
);
sql
The guard requires a row at or above
cut
to survive, so the statement never deletes the head, and deleting a prefix of an interval leaves an interval. The
sequence_number >= 0
clause protects a marker row at sequence number
-1
which is something the first write relies on and is described below.
Proving linearizability
Changing such a correctness-critical component requires having extremely high confidence that the linearizability guarantees are met. For this reason, we employed formal methods to gain additional confidence in the design by modeling the system under
READ COMMITTED
isolation in Lean 4 and proving that any execution is equivalent to a linearizable one.
The technique we used is called refinement, in which we relate the execution traces of two systems. In this context a system is described by some state and a set of actions that can be performed at any given point. We can then define the set of execution traces of a system as all possible sequences of actions starting from some initial set of states. The goal of refinement is to say that for all execution traces of system A there exists some execution trace of system B that is equivalent in some way. The two systems in our case are an idealized abstract system and the concrete implementation under
READ COMMITTED
. Since different shards are completely independent and the linearizability requirements exist only within the sequence of a single shard, we model the two systems as managing a single shard.
The abstract system captures the desired behavior by being as simple as possible. Its state is a map from sequence number to data and the set of actions corresponds directly to the four operations expected by the consensus implementation, performed atomically. Specifically,
compare_and_set(seqno, state_diff)
succeeds if and only if
seqno - 1
is the largest key in the map, or the map is empty and
seqno
is 0, and
truncate(cut)
removes every key below
cut
.
The concrete system captures the intricacies that arise by running under
READ COMMITTED
. The state of the concrete system is a table of rows and a set of statements in flight. The actions of this system correspond to the actions PostgreSQL can take, like starting a statement by taking a snapshot, performing a write against the live index, consulting row locks, etc.
The main modeling decision is that a CaS statement is no longer one atomic step but two, a step that evaluates the CTE against a snapshot and a later step that performs the
INSERT
against the live index. The model allows for other clients to take any number of steps between these two.
Relating execution traces
The first step to relating the execution traces is to establish what it means for a pair of states of the two systems to be equivalent. As shown above, the concrete system carries much more detail in its state than the idealized system, like the currently locked rows, so the two states are not directly comparable. We define equivalence through the use of an abstraction function
α
, which can transform an instance of the concrete PostgreSQL state to an instance of the idealized system. This function answers the question "What is the abstract state of the shard given this concrete state of the database?". For our case the function
α
is simply returning the set of active rows of the table, ignoring all other implementation details like the set of active locks or current set of active transactions.
With this at hand we now have to prove a forward simulation: for every step the concrete system can take, from any reachable state, either the abstract system can take a matching step with the same result, or the concrete step changes nothing observable and the abstract system stays where it is. Taking a snapshot is a step of the second kind, and performing the
INSERT
is a step of the first kind, being the point at which the CaS takes effect, so the obligation is that it inserts a row when and only when the abstract
compare_and_set
would have succeeded, and inserts nothing when and only when it would have failed.
Figure 2. Forward simulation. Every step of the concrete system either matches an abstract step with the same operation and result, or changes nothing the abstraction function
α
can see. Taking the
FOR KEY SHARE
lock is a stutter; the
INSERT
is the point at which the CaS takes effect. Client C's CaS with
expected = 2
finds no row to lock after the truncation and maps to an abstract
cas(3)
that returns
Mismatch
. The locked row is part of the concrete state but not of the abstract one.
If the obligation holds for every step, every concurrent execution of the concrete system corresponds to some sequential execution of the abstract one with the same operations returning the same results, which is the definition of linearizability. The proof quantifies over all clients and all sequence numbers, so there are no bounds on the number of writers or the length of the log.
A key part for successfully proving the simulation is invariants. Since the simulation for the
INSERT
step needs to know that "predecessor present, successor absent" implies "predecessor is the head", which is only true if the log is contiguous, contiguity has to be proven as an invariant. After that the invariant is available as a hypothesis in every other proof obligation. Most of the work in a proof of this kind is finding the invariants that discharge the individual steps, and most of the bugs it finds appear as invariants that cannot be preserved.
Linearizing CaS against truncations
Simulating concurrent CaS operations alone is straightforward. Contiguity is trivially preserved because the only modification is an append at
head + 1
, which extends the contiguous region. Additionally, the
INSERT
step's obligation (i.e., that
expected
is the head) follows from contiguity and the primary key. Therefore concurrent CaS operations for the same
expected
all map to a sequence of abstract CaS operations, one that returns
Committed
and the rest returning
ExpectationMismatch
, in the order their inserts reach the index. Note that this argument does not depend at all on the existence of the
FOR KEY SHARE
lock, which never causes CaS queries to wait for one another.
The lock matters once
truncate
is in the model as a step that removes every row below
cut
provided a row at or above
cut
exists. Without the shared lock it is possible for a concurrent execution of CaS and truncate operations to produce a non-contiguous shard, breaking the invariant. The failure corresponds to this execution:
Client A starts a CaS with
expected = 4
. Its snapshot shows row 4 present and row 5 absent, so the CTE produces a row.
Before A's
INSERT
runs, client B appends 5, 6 and 7.
A
truncate
with
cut = 7
deletes rows 4, 5 and 6.
A's
INSERT
checks the live index for row 5, finds nothing, and inserts it.
The table now holds rows 5 and 7, contiguity is broken, and A believes it advanced the head when it wrote a version below one that the rest of the system had already moved past. The primary key behaved correctly, since at the instant of the insert row 5 did not exist. What we would like to be true is that once an
expected_row
is observed it is not deleted until the subsequent
INSERT
has been executed.
This is what the
FOR KEY SHARE
lock on the predecessor in the CaS query is for. A
DELETE
takes a
FOR UPDATE
strength lock on each row it removes, which conflicts with
FOR KEY SHARE
, so a
truncate
that would remove the predecessor of an in-flight CaS blocks until that CaS has finished, and at the instant the
INSERT
runs the predecessor is guaranteed to be present.
FOR KEY SHARE
is the weakest lock mode that conflicts with a
DELETE
, and since it is a shared lock, concurrent CaS operations on the same predecessor do not block each other. Serialization of writers remains the job of the primary key; the lock only prevents a truncation from running in the gap that
READ COMMITTED
isolation allows.
In the model the lock is a set of
(client, sequence number)
pairs, added when the snapshot step runs and removed when the
INSERT
step runs. We then add a precondition to the
truncate
step that
cut
must be at or below every locked sequence number, which is the model's transcription of the lock conflict. With it in place the predecessor's presence at insert time follows directly and the simulation for the
INSERT
step holds in the presence of concurrent truncations.
Linearizing the first write
The CaS query above assumes a predecessor row exists to be checked and locked. The first version of a shard has sequence number 0 and so there is no predecessor, so it needs its own query, and this is the operation that took the most iterations to get right.
The query used under
SERIALIZABLE
was:
1
INSERTINTO consensus SELECT $1, 0, $data
2
WHERENOTEXISTS (SELECT * FROM consensus WHERE shard = $1)
3
ON CONFLICT DO NOTHING;
sql
The specification says the first write succeeds if and only if the shard is empty, which under
SERIALIZABLE
the
NOT EXISTS
guard implements directly. However, under
READ COMMITTED
the guard is evaluated against a snapshot, and the
INSERT
against the live index, allowing other steps to run in between. Under this model, this query is incorrect as the following execution is possible:
Client A starts the first write for a new shard. Its snapshot is empty, so
NOT EXISTS
holds.
Before A's
INSERT
runs, client B performs its own first write for the same shard and commits sequence number 0.
Client B appends 1, 2 and 3.
A
truncate
with
cut = 3
deletes rows 0, 1 and 2.
A's
INSERT
checks the live index for row 0, finds nothing, and inserts it.
The table now holds rows 0 and 3, and both A and B believe they created the shard. This is the truncation problem from the previous section again, but the previous fix does not apply, since there is no predecessor row for A to lock, and there is nothing else in the table for A to lock either, because at the time of A's snapshot the shard did not exist.
In order to prevent this we need a row to collide with that is never removed by truncation. We take advantage of the fact that PostgreSQL uses signed integers and use the sequence number
-1
with no data as a marker for "the shard is initialized". We then arrange for the first initialization of a shard to insert both the marker row and the intended first version, which can only succeed once. Additionally, we know truncate will only ever delete non-negative sequence numbers, leaving the marker intact. This gives rise to the following query for the first write:
1
INSERT INTO consensus (shard, sequence_number, data)
2
VALUES ($1, -1, ''), ($1, 0, $data);
sql
A stale first writer now always collides with the marker in the live index, no matter what truncation did to sequence number 0 in the meantime, so the resurrection above is no longer possible. This query is correct in a system where every client runs the new set of queries, and is refined once more in the next section, where we consider what happens during an upgrade.
Reasoning about rollouts
During the rollout
So far we have only reasoned about the correctness of a system where every client performs the new set of queries. However, that assumption leaves a correctness hole for the real system, since these queries need to be released as a version upgrade of an existing Materialize installation. During that time the old version of Materialize will have to co-exist with the new version to perform a zero-downtime upgrade, and during that window the combination of the two sets of queries needs to be linearizable as well.
Unfortunately, the combination of the old set of queries under
SERIALIZABLE
with the new set of queries under
READ COMMITTED
does not result in a linearizable system, since SSI only tracks conflicts between
SERIALIZABLE
transactions and the old first write's
NOT EXISTS
guard is blind to a
READ COMMITTED
creator. To make matters worse, even if both sets of queries run in
SERIALIZABLE
mode they can still lead to a linearizability violation.
The issue stems from the fact that the new shard initialization is a blind write and so even under
SERIALIZABLE
it takes no
SIRead
locks. The fix is twofold. First we must ensure that during the rollout from the old set of queries to the new set, both clients run under
SERIALIZABLE
. Secondly, we must ensure that the new initialization query properly participates in the serialization detection by not being a blind write.
To address the first issue, we released the new set of queries with a configuration variable that controls the isolation level in which they run. Since this variable was new and only present in the just-released version, there was no way for users to set it while still running the old environment. This restriction ensured that during the rollout window, both sets of queries would be running under
SERIALIZABLE
and therefore correctly linearize.
To address the second issue, we had to combine the blind write query with the emptiness check present in the old initial write query, leading to the following query:
WHERENOTEXISTS (SELECT * FROM consensus WHERE shard = $1)
sql
During the overlap the
WHERE NOT EXISTS
clause ensures a stale initialization attempt is either rejected by the guard or, if it raced the creation, detected and aborted by PostgreSQL, since the guard is a read that SSI tracks.
After the rollout
After the rollout is over, we know that the old environment is fenced out, but we're still running under
SERIALIZABLE
mode until the new feature flag is flipped. Once the operator flips the flag we have a new overlapping period to worry about, since the new setting does not reach every process at the same instant. We must reason about whether new queries under
SERIALIZABLE
mixed with new queries under
READ COMMITTED
linearize correctly. Additionally, the database will contain shards that were initialized with the old initialization query. Those shards lack the initialization marker, and so the
WHERE NOT EXISTS
guard should remain in the query even after everyone has upgraded. Fortunately, the combination of isolation modes in the new queries correctly linearizes and so flipping the flag is safe.
Results
After rerunning the same benchmark on the same database instance with the new queries, the database sustained the load to the end of the run, reaching about 13,000 CaS per second. We ran out of clusters to add before the database ran out of capacity, so the actual limit is higher. The difference in behavior at the limit is that under the new queries, the cost of an insert does not depend on how many other transactions are in flight or recently finished, so there is no sustaining effect, and when the database reaches its capacity, latency rises with load and falls again when load falls. In the paper's terms, the vulnerable state no longer exists for this failure mode.
Afterthoughts
The design came down to one invariant: once the sequence numbers are known to be contiguous, a primary key check is sufficient to decide whether a write is at the head, and
SERIALIZABLE
is no longer needed. The one lock in the design is there for truncation and has no effect on writers. Every operation, including the first write, is a single statement.
Modeling the queries and proving them linearizable gave us a profound level of understanding of and confidence in the design. We were able to quickly test query variations and discover problematic interleavings when proofs failed to go through.
For self-managed deployments of Materialize running against PostgreSQL, the flag is
persist_pg_consensus_read_committed
. It defaults to off, and we recommend turning it on once the deployment has finished upgrading to v26.33 or later.
References
[1] Nathan Bronson, Abutalib Aghayev, Aleksey Charapko, and Timothy Zhu. Metastable Failures in Distributed Systems. In
Workshop on Hot Topics in Operating Systems (HotOS '21)
, 2021.
https://doi.org/10.1145/3458336.3465286
This release includes 1,068 commits from the following contributors:
Aleksander Sabak, Andrii Puhachenko, Chris Double,
Dmitry Matveyev, Doug Coleman, Eric Willigers, Giftpflanze,
John Benediktsson, Leo Mehraban, Rudi Grinberg, Sebastiaan Speck,
Zoltán Kéri,
@knottio
,
@ronnie-w
Highlights of this release include:
A new GTK4 UI backend, now the default on 64-bit Linux; 32-bit Linux
continues to use GTK3
, which remains a build option on other supported Linux architectures.
New 32-bit and 64-bit RISC-V Linux ports, with optimizing compiler backends, foreign calls and callbacks, and support in both the C++ and Zig VMs.
DirectWrite text rendering on Windows, including color glyphs, typography controls, and better support for large output and complex scripts.
More responsive rendering and selection of large text across platforms, with fixes for display scaling, listener scrolling, and adjacent text backgrounds.
Expanded
native ARM64
SIMD support, half-precision and bfloat16 operations, and improved foreign calls, variadic callbacks, and native
va_list
support.
Experimental register allocators and optional compiler optimizations, alongside fixes to stack inference, generated code, and GC root tracking.
Updated Unicode data to 18.0.0 and timezone data to 2026c, with bindings for SQLite 3.53.4, Raylib 6.0, and Lua 5.5.
Faster process launching and native process-exit notifications on Linux, macOS, BSD, and Windows, with polling as a fallback.
Extensive fixes to HTTP parsing, TLS identity checks, cooperative waits, resource cleanup, signal handling, and VM memory safety.
Compatibility notes
64-bit Linux builds now select GTK4 by default; use
-ui-backend=gtk3
when bootstrapping if GTK3 is required. 32-bit Linux uses GTK3 and does not support GTK4.
Windows UI text now uses DirectWrite by default, so text metrics and appearance may differ from the previous Uniscribe backend.
callable
is now a mixin that includes words; code that assumes all callables support the sequence protocol should use
quotation-like
instead.
Fixed-array struct fields now validate input buffer lengths, and stricter HTTP and multipart parsing rejects malformed or incomplete input previously accepted.
PEG repetition and list parsers now omit
ignore
values. Minimum counts refer to successful matches, so
repeat1
and
list-of-many
can return empty output when all matched items are hidden.
The buffered HTTP client now decompresses gzip responses before character decoding and rejects unsupported content codings.
with-http-request
still provides bytes before content decompression.
Ambiguous Objective-C selectors now require a class-qualified name such as
Class.selector
when imported signatures differ.
Tuple literals reject duplicate slot names, and
minimum
and
maximum
now throw for empty
iota
and
repetition
instead of returning a value.
Command-line option names and aliases must now be unique, including the default
--help
option. Exact names take precedence over
no-
negation.
SQLite connections now use persistent WAL mode, which requires a local filesystem.
with-transaction
uses
BEGIN IMMEDIATE
and acquires the write lock at transaction start, including for read-only work. Write serialization is per process; wrap raw SQL and DDL writes in
with-transaction
or
serialize-transaction
to participate.
What is Factor?
Factor is a
concatenative
, stack-based
programming language with
high-level
features
including dynamic types, extensible syntax, macros, and garbage
collection. Factor has a
full-featured
library
,
supports many platforms, and has extensive documentation.
bootstrap.compat
: added compatibility support for refreshing older images, including upgrades to ARM64 callback templates.
checksums.cityhash
: added pure Factor implementations of non-cryptographic CityHash32, CityHash64, and CityHash128, with seeded 64-bit and 128-bit variants.
checksums.farmhash
: added portable FarmHash checksums with stable 32-bit, 64-bit, and 128-bit fingerprints and seeded variants.
compression.deflate
: added raw DEFLATE compression and decompression in Factor, including stored, fixed-Huffman, and dynamic-Huffman block decoding and malformed-input checks.
cpu.arm.64.abi
: added shared ARM64 ABI classification for aggregates, callbacks, and variadic arguments.
cpu.arm.64.features
: added runtime ARM64 feature detection with Linux, macOS, and Windows implementations.
cpu.riscv.32
: added an RV32GC optimizing compiler backend, assembler, and ILP32D foreign-call ABI support.
cpu.riscv.64
: added an RV64GC optimizing compiler backend, assembler, and LP64D foreign-call ABI support.
crypto.chacha20
: added the IETF ChaCha20 stream cipher with byte-array and string encryption helpers.
crypto.poly1305
: added RFC 8439 Poly1305 authentication tags and verification with 32-byte one-time keys and constant-time tag comparison.
crypto.utils
: added cryptographic helpers for byte-sequence comparison, zero testing, and masked integer selection.
demos.smoke-test
: added configurable smoke tests that open demos, check rendering and errors, and clean up each demo before continuing.
editors.athas
: added Athas editor integration with source-line navigation and a configurable executable path.
fonts.shaping
: added font direction, tab width, OpenType feature, locale, and color-glyph options for the Windows text backends.
foogle
: added searches for loaded words by stack effect and documented types, with clickable results.
game.input.gtk3
: added GTK3-specific game input support backed by shared GTK and Linux input handling.
game.input.gtk4
: added GTK4 game input support, including event-driven keyboard and mouse handling.
gdk3
: added bindings for GTK3 windowing, display, and input handling.
gdk4
: added bindings for GTK4 displays, surfaces, input events, and graphics contexts.
graphene
: added bindings for Graphene geometry types and vector, matrix, and transformation operations.
gsk4
: added bindings for the GTK4 scene graph and rendering API.
gtk3
: added bindings for GTK3 widgets, application windows, and OpenGL areas.
gtk4
: added bindings for GTK4 widgets, application windows, and event controllers.
gtk4-samples.opengl
: added an example of rendering OpenGL in a GTK4 application window.
math.floats.small
: added IEEE binary16 and bfloat16 conversions, with related vocabularies for arithmetic support and C memory types.
math.vectors.simd.extensions
: added half-precision and bfloat16 vector operations, dot products, and small matrix kernels with portable fallbacks and optional ARM64 acceleration.
shlex
: added shell-like string splitting modeled on Python’s
shlex
, with configurable comments and POSIX parsing, plus POSIX argument quoting and joining.
sqids
: added reversible encoding of non-negative integer sequences into short IDs, with a URL-safe default alphabet, configurable alphabets, minimum lengths, and blocklists.
syntax.inferred
: added optional
?:
definitions that infer their stack effects from their bodies.
ui.backend.gtk3
: improved native dialogs, text input, game input, and OpenGL backend handling, avoided yielding during render and resize callbacks so windows cannot close midway through painting, and deferred rendering until the framebuffer is complete.
ui.backend.gtk4
: added a GTK4 UI backend with input-method integration and native window handling, checked framebuffer completeness, and deferred drawing until windows are mapped and have a positive size; handled focus callbacks after window removal and initialized older GTK4 versions without unsupported debug options.
ui.backend.input-state
: added shared tracking and cleanup of keyboard and mouse state for UI backends.
ui.text.directwrite
: added a DirectWrite UI text backend with tiled rendering for large text layouts; kept cached layouts in the global disposable registry so temporary scopes cannot dispose them prematurely.
ui.text.index-maps
: added shared text-index mappings for Unicode caret and selection handling.
alien.libraries.finder.linux
: improved runtime library discovery without requiring development symlinks, a linker, or a working ldconfig cache; recognized versioned basenames such as
libSDL-1.2.so.0
while preferring exact basename matches.
cocoa
: corrected Objective-C runtime declarations and callback signatures and rejected ambiguous unqualified selectors.
combinators.smart
: preserved captured values when inferring the effects of composed callables.
combinators.syntax
: adjusted the definitions of
&&[
and
||[
and added documentation.
command-line
: accepted vocabulary-root files with a byte-order mark.
command-line.parser
: added option aliases and attached values such as
--host=localhost
, including empty values and values beginning with a dash; preferred exact names over
no-
negation and rejected duplicate names and aliases.
compression.gzip
: corrected gzip output for interoperability with other implementations.
compression.inflate
: decoded concatenated gzip members and validated headers, checksums, and uncompressed sizes; fixed transitions from stored to compressed blocks and accepted zero padding after the final gzip member.
compression.zstd.ffi
: corrected the native names for compression bounds, compressed-frame sizes, and decompression contexts, with direct FFI regression tests.
concurrency.combinators
: preserved input order in
parallel-filter
and honored the requested output sequence type in
parallel-map-as
; reduced per-task allocation by sharing completion wrappers across parallel iteration stages.
concurrency.conditions
: fixed cooperative wait races and preserved timeout deadlines across wakeups.
concurrency.flags
: fixed waiting and wakeup behavior when flag state changes.
concurrency.futures
: documented and tested inherited dynamic scope; released completed worker contexts before scheduling more futures.
concurrency.locks
: rechecked lock availability after wakeups and preserved deadlines for ordinary and reader/writer locks.
concurrency.mailboxes
: preserved receive deadlines across wakeups and handled empty mailbox checks safely; released linked worker contexts before yielding after error delivery.
concurrency.promises
: ignored late linked-thread errors after a promise has already been fulfilled.
core-text
: improved large-line rasterization, Unicode selection, and caching, and stopped text backgrounds from painting over neighboring lines.
cpu.arm.64
: expanded SIMD lowering and corrected large offsets, immediate operands, structure returns, and foreign-call ABI handling.
cpu.x86
: fixed unsigned callback arguments and SIMD shift, shuffle, and extraction edge cases.
cuckoo-filters
: preserved existing entries when an insertion fails.
curl.ffi
: corrected variadic declarations and Linux runtime library discovery.
curses.ffi
: corrected variadic formatting calls and native argument-list declarations.
db
: added the
db-write-lock
backend hook and
serialize-transaction
combinator, preserving quotation stack effects and leaving other backends unchanged.
db.pools
: limited each database pool to 16 idle connections.
db.sqlite
: updated the SQLite bindings to 3.53.4, serialized transactions and tuple writes with reentrant per-file locks to prevent same-process write contention, enabled WAL mode and
BEGIN IMMEDIATE
transactions, and cleaned up native handles and result sets after failures, including failed WAL initialization.
db.sqlite.ffi
: updated declarations for SQLite 3.53.4 and corrected variadic formatting, pointer ownership, and VFS filename handling.
game.input
: improved backend selection and keyboard, mouse, and Linux device handling across GTK versions; added event-driven macOS input state, including modifier keys and mouse motion, and removed hardware-dependent initialization tests.
html5
: built nested document trees, decoded character references, and recorded recoverable parse errors; added SVG and MathML foreign content, template fragments, framesets, table and select handling, and recovery for misnested formatting elements, forms, and late head elements.
http.client
: decoded gzip response bodies before character decoding, including stacked encodings and concatenated members, and reported unsupported content codings; combined repeated
Content-Encoding
headers and reported unsuccessful HTTP status codes before attempting body decoding.
http.server
: rejected TLS input on plain HTTP connections and suppressed response bodies when HTTP semantics forbid them.
io.files
: preserved line endings in
change-file-lines
and improved cleanup after file-construction failures.
io.files.info.windows
: limited fallback file-information lookup to access and sharing failures, preserving other Windows errors; made
link-info
inspect the link itself.
io.launcher
: improved Windows batch argument and environment handling and Unix child-process signal behavior, and cleaned up partially constructed pipelines after setup failures; streamlined Unix spawn setup and PATH lookup, added native exit notifications through kqueue, Linux pidfds, and Windows completion packets with polling fallback, and handled Windows waits beyond the native per-call handle limit; used
posix_spawn
on Linux to avoid copying large image page tables during process creation.
io.mmap
: cleaned up failed mappings and associated file handles.
io.monitors
: fixed monitor initialization, cancellation, and recursive-directory cleanup.
io.pipes
: cleaned up failed pipe construction and opened Unix FIFOs without blocking the VM, including cleanup when port initialization fails.
io.pools
: bounded idle resource pools and disposed resources returned after a pool has closed.
io.ports
: disposed native handles when port setup fails.
io.servers
: avoided accepting new connections after a server listener has stopped.
io.sockets
: fixed socket-construction cleanup, Unix-domain path padding, datagram handling, and Windows socket-set initialization; updated Windows connect and accept contexts and preserved accepted address storage.
io.sockets.secure
: preserved the intended certificate identity through address resolution and cleaned up failed secure connections.
io.sockets.secure.openssl
: corrected certificate identity checks, callback lifetimes, and OpenSSL resource ownership, including compatibility with older OpenSSL identity APIs.
io.standard-paths
: checked executable files and honored Windows PATHEXT during program discovery.
io.timeouts
: preserved timeout deadlines across cooperative waits.
libclang
: expanded C API bindings, avoided repeated declaration generation and unnecessary function-body parsing in the importer, and corrected token handling and native resource cleanup; fell back to the library search path when LLVM directories contain no libclang; discovered versioned libclang shared libraries inside LLVM installations.
libudev
: checked availability before calling optional legacy interfaces.
locals
: fixed interactions with fry, typed tuple construction, and next-method dependency tracking.
logging.analysis
: bounded file-report reads and combined multiline log entries.
logging.insomniac
: rotated oversized logs even when report generation fails.
lua
: updated the bindings from Lua 5.1 to Lua 5.5, including the public C API, auxiliary and standard libraries, variadic formatting, and native argument-list access; requires Lua 5.5 with its default numeric configuration.
mason
: preserved fatal errors and test context in bounded crash reports and printed native backtraces; preserved partial test results in failed build reports.
math
: normalized integer arithmetic results and corrected floating-point comparison and conversion edge cases.
math.blas.config
: selected the GNU Fortran return ABI for bundled 32-bit Windows OpenBLAS libraries.
math.floats.env
: decoded floating-point errors before testing exception flags.
math.functions
: corrected indeterminate powers and floating-point zero exponents.
math.integers
: validated shift counts and preserved large bit indices; corrected
bit?
for fixnum bit indices outside the native range.
math.libm
: added
fexp1-
(C’s
expm1
); reported underflow for finite powers rounded to zero on the Windows Universal CRT.
math.vectors.simd
: aligned native and fallback behavior for shifts, shuffles, overflow, rounding, NaNs, and integer dot products, and corrected numeric coercion in half-precision and bfloat16 constructors; preserved all bits in boolean SIMD masks.
metar
: expanded METAR and TAF parsing, including runway state, wind shear, sea conditions, variable visibility, forecast change groups, and remarks; improved date rollover handling and added abbreviation lookup helpers.
mime.multipart
: validated multipart framing and handled malformed input without leaking resources.
openssl
: corrected native declarations, variadic BIO calls, and resource ownership.
papier
: updated shaders for core OpenGL contexts and fixed GTK4 rendering and keyboard movement, including A/D controls.
pcre2
: added the features previously available in the deprecated
pcre
vocabulary.
peg
: omitted hidden results from repetition and list parsers and added
optional*
to distinguish a missing match from a successful match whose AST is
f
.
ping
: added support for Linux ICMP datagram sockets.
python
: initialized high-level imports, object constructors, and conversions on first use; finalized the interpreter at shutdown only after it has been used. Raw
python.ffi
calls still require explicit
py-initialize
.
python.ffi
: searched Python 3.15 libraries and used versioned DLL names on Windows.
quotations
: made words callable while retaining a separate
quotation-like
class for sequence-like quotation objects.
ranges
: tested membership in integer ranges without enumerating their elements.
raylib
: updated to
Raylib 6.0
and corrected variadic callbacks and allocation ownership; restored native OpenGL contexts across live-coding yields and cleanup.
regexp
: added numbered and named captures and fixed assertion boundaries in lookbehind expressions.
rocksdb.ffi
: corrected the registered library name so foreign calls resolve against RocksDB.
see
: preserved deeply nested definitions and their imports and honored
without-limits
when displaying full definitions; normal output remains bounded.
sequences
: improved array/string comparisons and small integer-pair hashing, preserved callback stack rows in binary reductions, and rejected empty iotas and repetitions in
minimum
and
maximum
.
tools.completion
: completed bare filename prefixes from the current directory.
tools.continuations
: improved stepping into fried quotations and retained the current instruction when displaying long quotations.
tools.coverage
: counted generic methods consistently in coverage reports.
tools.crossref
: tracked word references inside fried quotations, vectors, wrapped hashtables, other literal collections, and uninterned words; recorded method-word references directly.
tools.disassembler
: documented the Capstone backend on other supported architectures and how to select the optional Zydis backend on x86; released temporary code-heap snapshots after failures to prevent retained error continuations from accumulating snapshots.
tools.image
: updated image tooling for format version 5 and rejected stale formats before decoding heaps.
tools.profiler.sampling
: displayed total-time shares and allowed small branches to be filtered from reports.
tools.ps
: anchored Linux process inspection to an open process directory.
tools.test
: isolated prettyprinter settings during tests and help-lint examples.
typed
: preserved termination and recursive annotations in generated implementations and wrappers.
ui.backend.cocoa
: refreshed window resources when display scale changes and ignored inappropriate control characters in text input; corrected cursor hiding during captured input, cleared input state on focus changes, and improved native OpenGL context setup for demos.
ui.backend.windows
: used each window’s monitor DPI for text and input and returned pointer-sized results from window callbacks; fixed paint reentrancy, clipboard ownership, per-window surrogate-pair input, modifier keys, fullscreen handling, and tray tooltip encoding.
ui.gadgets.editors
: improved caret, selection, and rendering behavior for large and complex Unicode text, and submitted action fields with keypad Enter.
ui.gadgets.panes
: avoided quadratic copying of large strings, improved selection and copy behavior, and fixed following output at the bottom of a scroller.
ui.gadgets.tables
: validated the required model argument when constructing a table, before grafting.
ui.gadgets.worlds
: skipped drawing until the window framebuffer is complete, avoiding OpenGL errors while the drawing surface is being initialized.
ui.render
: supported GLSL 1.30, reduced repeated drawing work, and kept OpenGL renderer state with its owning window; reset legacy rendering hooks when switching from core-profile demos.
ui.text.pango
: improved rendering and selection of large text rows and preserved native antialiasing when drawing overlapping glyphs; read legacy glyph-item layouts without reading past native buffers.
ui.theme.switching
: refreshed open worlds when switching themes; improved dark-mode contrast in several demos.
ui.tools.listener
: accepted folders dropped from Finder and echoed source for quotation commands.
unicode
: updated Unicode and collation data to 18.0.0 and corrected identical-level collation ordering.
unix
: corrected native structure layouts, scalar and pointer types, large file offsets, and variadic declarations, including libc-specific
timeval
fields and 32-bit
statvfs
padding.
unix.groups
: handled lookup errors and owned group-result storage safely; treated platform-specific missing-group errno responses as unsuccessful lookups.
unix.signals
: used platform-specific signal numbers and corrected dispatch and handler sentinel handling.
vocabs.loader
: waited for prerequisite vocabularies to finish loading before activating
require-when
extensions.
webapps.mason
: validated request parameters before opening database connections to prevent leaks during validation exits; handled builders that have not uploaded results yet.
webapps.planet
: kept periodic maintenance running after recoverable failures.
windows.dropfiles
: released drag-and-drop handles even when filename decoding fails.
windows.offscreen
: restored and released offscreen GDI bitmaps on both success and failure.
windows.streams
: bounded COM stream copies, used 64-bit byte totals, and detected short writes.
windows.uniscribe
: improved cluster hit testing, bidirectional text, font fallback, glyph overhangs, selection compositing, and native layout lifetime handling.
xml.tokenize
: bounded stack use when the optimizing compiler is disabled.
xmode.marker
: preserved regular-expression capture state while fixing up end patterns.
yenc
: computed file CRC32 from file contents, preserved filenames containing spaces or equals signs, validated envelope sizes and checksums, and decoded individual multipart envelopes with range and part-checksum checks.
zoneinfo
: updated bundled timezone data to 2026c.
Compiler improvements
Improved stack inference and error reporting for recursion, branches, locals, fry, and composed callables; checked annotated quotation calls and rejected known incompatible call effects.
Fixed dependency tracking and recompilation after macro expansion, nested compilation, custom inlining, and struct redefinition.
Improved constant folding and lookup-table optimization while preserving tuple identities, integer overflow behavior, and floating-point semantics.
Corrected ARM64 code generation and foreign-call handling, added RISC-V foreign calls and callbacks, and fixed x86 callback and aggregate argument handling.
Preserved GC roots and derived-pointer bases through compiler transformations and register allocation, and reported oversized stack frames as compiler errors.
Reduced temporary allocation and repeated work during compiler analysis and bootstrap compilation.
Added experimental backtracking, chordal, and greedy register allocators; linear scan remains the default.
Added optional global value numbering, constant rematerialization, loop-invariant code motion, slot-load reuse, representation-cost improvements, and integer SIMD vectorization; these optimizations remain disabled by default.
Added compiler-pass measurement tools and checks for SSA, register allocation, and GC roots.
VM improvements
Improved GC root tracking for native allocations, code snapshots, displaced aliens, and derived pointers, and corrected recovery after interrupted or failed collections.
Strengthened memory safety with bounds checks for object initialization, code heaps, stack frames, and debugger reads; kept identity hashes stable and invalidated stale string hashes after resizing.
Corrected bignum shifts, mixed-sign XOR, division, and integer conversions, and preserved NaN encodings and ordered/unordered floating-point comparisons.
Improved signal handling, thread registration, and sampling-profiler reliability across platforms, including macOS interrupted-stack recovery and forward progress when recording samples is slow.
Fixed callback-heap fragmentation, ARM64 relocations, and Windows ARM64 exception dispatch and native unwinding; added stack reserves and probing for native calls.
Improved Windows startup diagnostics, worker-thread cleanup, JIT unwind metadata, large file offsets, and partial native I/O; validated code-heap updates and reset JIT state after errors.
Zig VM improvements
Improved parity with the C++ VM for GC roots, ARM64 signal recovery, stack and code-heap bounds, identity hashes, and JIT error cleanup.
Fixed resource cleanup during allocation failures, image loading, VM shutdown, and native I/O, and preserved expired aliens and resized-object state.
Reused JIT buffers, corrected relocation and unwind handling, and improved profiler timing, safepoint placement, and fatal-error handling.
Removed hard-coded 64-bit assumptions from object layouts, arithmetic, foreign integer conversions, file offsets, GC, and relocations, improving 32-bit portability.
Build and platform improvements
Updated bundled SQLite to 3.54.0 and OpenSSL to 4.0.3 on both 32-bit and 64-bit Windows, and updated DLL names for Cairo, GLib, FreeType, and OpenAL to match bundled libraries.
Building the
experimental Zig VM
now requires Zig 0.17.0; fixed Windows builds and used dynamic linking when targeting musl.
Added headless Debian/Ubuntu build dependencies and optional vocabulary-test dependencies.
Checked Linux runtime library sonames rather than requiring development linker names, and tolerated missing optional library directories.
Corrected 32-bit x86 compilation and linking flags across C++, C, assembly, and FFI test builds, and preserved architecture flags when invoking make.
KDE Plasma 6.8 released
Linux Weekly News
lwn.net
2026-10-14 09:41:09
Version 6.8 of
the KDE Plasma desktop has been
released. The The KDE project has timed the release to coincide with the 30th
anniversary of Matthias Ettrich's email announcing the
project:
Unix popularity grows thanks to the free variants, mostly Linux. But still a
consistent, nice looking free de...
Unix popularity grows thanks to the free variants, mostly Linux. But still a
consistent, nice looking free desktop-environment is missing. There are several
nice either free or low-priced applications available, so that Linux/X11 would
almost fit everybody needs if we could offer a real GUI.
Notable changes include accessibility improvements, inclusion
of the
Kup
backup
tool as part of Plasma, as well as the ability to include system audio and
microphone input in
Spectacle
screen recordings. Plasma 6.8 also drops support for Plasma X11 sessions, as was
announced
in November 2025. X11 applications are still supported via XWayland, and KDE
applications will continue to support X11 "
for the foreseeable
future
".
See the
KDE wiki
for a
list of major user-facing changes, and the
changelog
for all changes since Plasma 6.7.5.
Bruce Blakeman Still Doesn't Know Mayor Mamdani's Name
hellgate
hellgatenyc.com
2026-10-14 09:39:00
And more things we learned from last night's gubernatorial debate. Plus news for your Wednesday....
The one and only gubernatorial debate before the upcoming election began Tuesday night with Republican candidate Bruce Blakeman imploring New Yorkers to vote for him by asking: "What do you have to lose?"
Blakeman's implicit thesis was that New York can't get any worse than it is right now. He pointed to skyrocketing utility bills, New York's relatively high taxes, and the challenges facing farmers as evidence of this—and in his telling, it's all Governor Kathy Hochul's fault.
Hochul's task was to defend her record—connecting New York's economic issues to the federal government's tariffs, wars, and funding cuts—and to prove that New Yorkers have a fair bit to lose if they elect the Republican who is pro-data center, pro-Trump, and pro-ICE.
A taste of the tenor:
Hochul: "Everything has happened under your friend Donald Trump, you are the president of the fan club for Donald Trump. It's absurd how adoring you are of him. My gosh!"
Blakeman: "You like to talk about Donald Trump all the time, because you don't want to talk about your record: It's a record of misery and failure." Blakeman then added that while Trump has endorsed him, so have Democrats
Bonnie Lautenberg
and
actor Debra Messing
.
Hochul barbed back: "So you've got two votes. Good for you."
When bird populations decline, fledglings may struggle to learn the songs they need to attract mates. But new research suggests it is possible to teach birds lost songs.
Listening to birdsong is one of life’s great joys, but when researchers heard a particular tune emerging from a tree in a Buenos Aires park, they were especially jubilant. This arrangement was among those chirped by the local rufous-collared sparrows in the 1960s, but had since disappeared from the area.
That was until scientists created a computer-generated rendition, curious to find out if birds might consider it realistic enough to imitate. Less than three months later, a local avian resident began to copy parts of the song.
There is a growing recognition of birdsong’s importance to conservation, and of the need to better understand how birds learn to sing. If an individual sings well, and in a familiar “dialect,” they are better placed to find a mate, defend their territory, and ultimately survive.
If a species’ population declines, however, there are fewer opportunities for fledglings to become good singers. Birds can begin to tweet abnormally or mistakenly learn the songs of
other species
, jeopardizing their chances of breeding.
Male birds are in a better position to attract a mate if they can sing well — which, broadly speaking, means their song is complex, sung consistently, and well performed. “If your song requires a lot of energy, you might have to be in quite a good condition to sing it,” says Rebecca Lewis, a conservation scientist at Chester Zoo.
“When people talk about biodiversity, we’re always talking about genes, about genetic material,” says Gabriel B. Mindlin, professor of physics at the University of Buenos Aires, who coauthored the study on rufous-collared sparrows, and whose work is featured in a Guardian-produced documentary,
Dream of Birds
.
But animals’ learned behavior or culture, such as birdsong, is also an essential part of their population, says Mindlin.
The rufous-collared sparrow is not considered vulnerable globally, but researchers hope that synthetic recordings could help teach birdsong to other species whose populations are dwindling, allowing conservationists to tutor individuals where real-life recordings do not exist.
About 4,000 of the world’s 10,000 bird species are songbirds (or oscine passerines), such as finches, sparrows, and blackbirds, which generally have complex songs that are at least partly learned from other individuals. Their songs are hugely diverse, though separate research on the wider passerine group of birds, which incorporates songbirds, has identified common “motifs” or building blocks: three types of trill, three types of whistle, chaotic notes, and harmonic notes.
The way that birds use these motifs reflects the environment in which the birds evolved. Flat whistles are more likely to be sung by birds in tropical rainforests where sound must travel through dense vegetation. Complex motifs, such as ultrafast trills, are more common in temperate regions where birds tend to communicate at closer range.
The song studied by Mindlin was recreated based on hand-drawn annotations of rufous-collared sparrow songs that were made in the 1960s. Each song consists of a trill, which is consistent among individuals in the same region, and a theme, which varies. Some of the themes recorded decades ago are still sung by the local birds, but others have died out.
It is not clear why the song studied by Mindlin had disappeared, though he notes the population of birds in the park had declined.
Birds’ songs can change naturally over time — for example, birds might make errors when learning songs, which then can become imprinted in future renditions. Human encroachment and population declines can also cause dramatic changes.
Songbirds learn from other members of their species — such as a father or neighbors — which results in local groups developing their own dialects. The window for learning varies from a few weeks to a lifetime. Some species also have an innate level of knowledge.
“There’s such a diversity in songbirds in how they learn,” says Sarah Collins, associate professor of animal behavior at the University of Plymouth, who studied a group of cirl buntings that were translocated from Devon to Cornwall as part of a conservation project.
Initially, the birds produced abnormal songs that were squeaky and slow, and far less diverse than those of the source populations in Devon. “They didn’t have the richness of sound,” says Collins. Eight years later, however, their songs had returned to normal.
A few of the chicks were played recordings of cirl sounds, though not all. The study suggests that recovery of song is possible, though it is unclear if other species would bounce back in the same way. Cirl buntings are born with knowledge of the elements that make up the “notes” used in their songs, says Collins. “What they learn is how to put those elements together,” she says.
Some songbird species have a similar genetic underpinning and so may also be able to recover their songs, but others do not. Either way, Collins recommends a tutor to help other birds that are being translocated.
A separate study in Australia tracked regent honeyeaters that were bred in zoos to boost a critically endangered wild population that had fallen to about 250 individuals. Interacting with just two wild-born male “tutors” helped the zoo-bred birds to learn to sing the wild songs. Thereafter, zoo-bred males that had learned the traditional songs went on to tutor the next generation.
“Sometimes birds don’t learn very well from CDs or just playbacks. They need some sort of interaction,” says Collins.
Bringing wild birds into captivity to teach hand-reared chicks could cause huge distress and bring disease, however, risking the health of individuals from an already endangered population. It is possible that A.I. could help provide live tutoring in the future.
Dialect is also important. Past translocation projects have shown that birds are slower to match if they do not sing in the same dialect. “Birds with mismatched songs don’t pair quite as quickly or do quite as well once they’re paired,” adds Lewis. Familiarizing birds with songs of their destination can help to mitigate this.
A huge volume of birdsong is now being recorded and uploaded into databases, including by a growing number of hobbyists interested in birdwatching, says Mindlin. “One day we’ll be grateful to have all those records,” he says. “I don’t think we still have an idea that really we have to register dialects and communication systematically.”
In Buenos Aires, the song from the 1960s can still be heard. “It’s still being sung by just a few individuals, pretty close to where we inserted it,” he says, though only time will tell how long it persists.
A top
CBS News
editor appointed by editor-in-chief
Bari Weiss
reportedly threatened staffers with termination during a tense meeting Tuesday morning that erupted into a confrontation over the network’s coverage of Israel and Gaza.
According to a Tuesday evening
report
from
Oliver Darcy
, the network’s foreign editor,
Shayndi Raice
— described by
Status
as “handpicked” by Weiss — addressed CBS News’ foreign bureau following the newsletter’s Monday
reporting
. In that piece, Darcy shed light on internal disputes over Middle East coverage, including Weiss’ contentious discussions with
60 Minutes
correspondent
Lesley Stahl
and Raice’s handling of a report by CBS News correspondent
Holly Williams
.
Status
obtained audio of the virtual meeting, during which the editor spent roughly 15 minutes defending her editorial authority and rejecting accusations of “interference.”
“This is not your publishing platform,” she warned. “This is a company that we all work for, and there’s a hierarchy in place. And at the end of the day, you have to answer to that hierarchy. If you can’t answer to that hierarchy, and you don’t listen to what we say, that is called insubordination, and it’s legal grounds for firing.”
Although Raice insisted her remarks were not directed at Williams, she appeared to criticize the correspondent’s Oct. 7 coverage, questioning the decision to open an anniversary report with footage of Israeli strikes in Gaza.
Williams challenged Raice, though, over the editorial changes imposed on her separate
Evening News
report, including a dispute over whether to include the Palestinian death toll in Gaza.
Raice said to prompt the correspondent’s pushback, “If you think that deciding on October 7 that the way to open up an anniversary story about the worst attack on Jews since the Holocaust is to show a montage of Israeli bombs falling on countries in the Middle East, you have an opinion.”
Williams said she had been informed that the revisions were mandatory and not open to negotiation, which Raice acknowledged.
The exchange grew even more contentious at another point when Raice referred to the Palestinian death toll as a “magic number,” arguing that repeatedly citing it amounted to “posturing.”
Williams also revealed that her primary objection concerned the removal of allegations involving Israeli Prime Minister
Benjamin Netanyahu
and
warnings preceding
the Oct. 7 attack.
Raice defended her exclusion, arguing that Netanyahu had denied those reports and CBS had not independently verified them.
“Those allegations are a sideshow,” Raice said. “It’s not important, and I just think you got it wrong. And you probably got it wrong because you don’t know the story as well as I do.”
She went on to mention a recent trip to Israel where she observed that “nobody really cares” about that story.
The editor also announced forthcoming changes to the foreign desk’s editorial workflow.
A CBS News spokesperson did not immediately respond to
Status
‘ request for comment, but one attendee told Darcy that Raice’s remarks left “jaws on the floor.”
New: The Mediaite One-Sheet "Newsletter of Newsletters"
Your daily summary and analysis of what the many, many media newsletters are saying and reporting.
Subscribe now!
Switzerland proposes banning profiling-based ads to minors
Berne, 14.10.2026 — At its meeting on 14 October, the Federal Council took note of the results of the consultation process on the new law on communication platforms and search engines, and instructed the Federal Department of the Environment, Transport, Energy and Communications (DETEC) to draw up a dispatch by the end of 2027. The preliminary draft is to be amended with measures to protect children. Furthermore, the reporting procedure is to be extended to include all content suspected of being unlawful.
[$] GCC development with large-language models
Linux Weekly News
lwn.net
2026-10-14 09:13:53
After much deliberation, the GCC project recently came up with a policy on the use of large
language models for development of the compiler suite. It is somewhat
restrictive, but still leaves room for LLMs in the development process. At
the 2026 GNU Tools Cauldron,
Jeff Law and Kyrill Tkachov disc...
The page you have tried to view (
GCC development with large-language models
) is currently available to LWN
subscribers only.
Reader subscriptions are a necessary way
to fund the continued existence of LWN and the quality of its content.
If you are already an LWN.net subscriber, please log in
with the form below to read this content.
Please consider
subscribing to LWN
. An LWN
subscription provides numerous benefits, including access to restricted
content and the warm feeling of knowing that you are helping to keep LWN
alive.
(Alternatively, this item will become freely
available on October 22, 2026)
Global takedown hits network behind 1 billion phishing messages
Bleeping Computer
www.bleepingcomputer.com
2026-10-14 09:12:52
A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]...
A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide.
Since the start of the year, more than 750 million malicious messages have been aimed at Microsoft customers via email and SMS texts.
Following an investigation initiated by Microsoft and Japan’s National Police Agency (NPA) into a wave of fraudulent activity, "a sprawling Chinese-language cybercrime marketplace" was discovered, with tools and services for phishing campaigns.
The investigators traced the malicious activity to YAM Store (Storm-3119), an underground infrastructure marketplace, then linked it to the CoGUI, Haozi, and Iron Man System phishing kits, collectively tracked as Storm-2990.
Operational overview
Source: Microsoft
Tools overview
In a report today,
Microsoft says
that YAM Store sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage.
Its operators acquired expired domains of real organizations, rebuilt websites to make defunct entities appear active, and then used those identities to obtain cloud accounts.
Another observed method was to generate fake organizations, complete with content and documentation, using AI tools.
YAM Store account offerings
Source: Microsoft
In compromised Microsoft environments, the operators used stolen application credentials to manage accounts and licenses, and
abused SharePoint and OneDrive storage
for hosting.
The phishing kits offered cybercriminals a broad range of lures, including unpaid tolls, traffic penalties, delivery problems, and account verification requests.
The kits supported geofencing, fake CAPTCHA gates, IP filtering, and other measures to obstruct security analysis.
Microsoft says that CoGUI targeted victims in the United States and Japan, but Iron Man, which offers over 2,300 templates impersonating banks, retailers, delivery services, and government agencies, pushed it aside by mid-2026.
Impersonation templates
Source: Microsoft
Cybersecurity company Resecurity also participated in the investigation and
shared more details about Iron Man
after analyzing exposed infrastructure, including a publicly exposed Git/container registry with 911 published builds and eight registered accounts.
The researchers also identified a product-selection subsystem linked to payment-card capture, cataloging 2,360 phishing packages covering 130 countries/areas, with updates through October 1, 2026.
Iron Man admin panel
Source: Resecurity
Microsoft said the phishing platforms delivered over 750 million messages targeting Microsoft 365 customers, many using device-code phishing to obtain authentication tokens.
In late 2024, enterprise security company
Proofpoint identified email campaigns
"consistently targeting Japan" that were associated with the CoGUI phishing kit. The activity was focused on stealing credentials and payment data by impersonating well-known Japanese companies or international organizations.
Further investigation into the phishing activity revealed that more than 17,000 domains were used by three kits known as CoGUI, CoAceV, and CoFish_Ws.
The researchers described the operation as "dynamic" and sufficiently resourceful "to purchase and manage phishing infrastructure at scale."
Disrupting the operation
Under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man.
The tech giant also deactivated over 20,000 accounts associated with the YAM Store and blocked 100,000 domains the cybercriminals used for impersonation and fraud.
Currently, more infrastructure is being removed based on the findings of the investigation, which also involves the Japanese authorities, JC3,
Resecurity
, Cloudflare, Oracle,
Proofpoint
, and TRM Labs.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Security updates have been issued by AlmaLinux (bind9.18, dovecot, flatpak, gd, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base, kernel, opentelemetry-collector, pcre2, and tftp), Debian (curl and keystone), Fedora (aegisub, arm-none-eabi-binutils-cs, avr-binutils, ...
The Legend of Zelda: Ocarina of Time preview – Link faces his scariest challenge yet: the 4K era
Guardian
www.theguardian.com
2026-10-14 09:00:02
The kingdom of Hyrule has been prettified, the soundtrack is newly orchestrated and our hero feels strikingly different under the thumbs … we play a hands-on demo of Nintendo’s Switch 2 remake of a 1998 game-changer When beloved art is revisited and revised, a familiar cry is often heard: “You’re ru...
W
hen beloved art is revisited and revised, a familiar cry is often heard: “You’re ruining my childhood!” But with Nintendo’s Switch 2 remake of Ocarina of Time, there are also livelihoods at risk: specifically, the man running the shooting gallery in Castle Town. In the original 1998 version of the game, he’d rip off players as they funnelled rupees and fudged the then still novel analogue-stick aiming. But in 2026 we have more responsive frame rates and a motion-controlled slingshot that allows precision adjustments. His targets tumble on the first go, and with them his entire business model. Even in Hyrule, the death of the high street seems inevitable.
Bad news for him but great news for Link, a child of the forest who, as in 1998, steps into a vast fantasy kingdom to vanquish a great evil, but now does so with a number of improvements. The boy can now sprint, preventing the ignominy of endless roly-polies to zip across grassy plains. He has a manual jump, free-rotating camera, a scrolling inventory bar that replaces menu screen faff and, crucially, a fatter wallet for holding all those gems he fleeces from struggling shooting gallery owners. Yes, we are being asked to applaud features that have been the norm for decades elsewhere, but it’s undeniably striking to enter familiar territory with a hero who feels this different under the thumbs.
Link can now sprint, preventing the ignominy of endless roly-polies.
Photograph: Nintendo
The dilemma facing any remake, let alone of a game recognised as a genre-defining classic, is how closely you hew to the past. As with
this year’s Star Fox revamp
, Ocarina of Time finds Nintendo in a celebratory mode. It’s a polished victory lap for a game with little to prove. For newcomers it means seeing what the fuss is about without having to scrutinise the N64 original on unflattering flatscreen TVs. I doubt Hyrule Field – once a byword for video-game freedom – will ever conjure the awe it did in 1998, but seeing the sun catch in puddles and grass growing from the floor helps mask what is an obviously artificial pen, compared to
Breath of the Wild’s sprawling continent
.
For some returning fans, the more controlled shape is precisely the appeal. After the “make your own adventure” ethos of Switch’s open-world Zeldas, there is comfort in slipping into traditional dungeons, where every room has a characterful beast to chop up or a mechanism to unpick with a growing kitbag of tools. My great fear was that some of the puzzles are simply too iconic to be forgotten and solved again. Yet here I am, sweatily hunting ghosts around the Forest Temple, and surreptitiously peering at my neighbour’s demo pod to remind myself that, yes, you have to … [redacted for your benefit]. Given that, in 1998, these were many designers’ first attempts at a 3D level, it is astonishing how fiendish they are and how you’re expected to hold complex architecture in your head to get the run of them.
Also worth assigning headspace for: the newly orchestrated soundtrack. Melodies that fought through compressed N64 instrument samples to burn into the brain are given their own galloping freedom. I love the tentative brass when you lock an enemy into a duel – the musical equivalent of gnawing your lip.
Link’s look is more contentious. Where Hyrule is prettied up with expected detail – swaying nettles in a forest home, marbled sunlight on a riverbed – its hero is radically made over. His large glassy eyes, and fat cheeks which reflect the light as if varnished, have led critics to accuse Nintendo of crudely pursuing a textbook next-gen sheen. Bells and whistles for the sake of filling 4K TVs with surface detail, rather than honouring the original artistic intent. In the past, some eager fans attempted to remake Zelda in more capable game engines and were ridiculed for mistaking technological grunt for artistry, and as evolving hardware opens those graphical avenues to Nintendo itself, it would be ironic if it fell for the same allure.
In truth, Ocarina of Time looks coherent in motion on Switch 2. If anything, the layer of 4K specificity evokes another Zelda game, Twilight Princess, itself an attempt to apply a more mature, realistic lens to Hyrule. And could Link, with those overblown features, perhaps be nodding to another cultural pastime? As some corners of the internet scoffed at our newly “yassified” hero, the Nintendo veteran and former Legend of Zelda art director Takaya Imamura wondered if the character model drew from Zelda creator Shigeru Miyamoto’s own tastes. “[His] love of
ningyogeki
(puppet drama) is strongly reflected here,” Imamura
wrote on X
. Porcelain doll skin would certainly explain the uncanny sheen.
It is astonishing how fiendish the puzzles designed in 1998 still are.
Photograph: Nintendo
While we can only guess at tight-lipped Nintendo’s intent, writer and translator Paul McQuade explains it is not an impossible leap. “In Japan, puppetry is not considered an art form strictly for children, which is largely how it’s perceived elsewhere,” he says. “It’s a rich art and is highly respected.” He thinks Miyamoto could easily have been influenced by puppet shows aired by
Japanese broadcaster NHK
in the Shōwa postwar era.
And besides, there is something poetic about the notion. “It’s doll-like and intentionally juvenile,” McQuade says of Link’s chubby features and blushing nose. “It captures the essence of that forest where the children don’t ever grow up. Miyamoto, as a fan of puppetry, would of course draw on the vocabulary of dolls to make characters in that mould.”
I like the idea of Nintendo honouring a community frozen in time in this way, while also acknowledging that time has moved on outside the game. With that passing comes an opportunity to tweak and massage. In an adventure where a boy can magically become a man and back again with the toot of his ocarina, it makes sense for timelessness and timeliness to be in conversation. With virtual bones this strong, it would be difficult to argue that anything has been truly ruined. Unless you run the shooting gallery, of course.
Eric was the 21
st
recipient of the Distinguished Janitor Award, Automattic’s highest honor, and in our hangs the last few months we’ve been talking about how to redefine and evolve it, which will happen internally at Automattic. One of the ideas was for the award to come with a physical memento, an etched tungsten cube. I don’t have many words so I’ll share something I wrote to Eric a few months ago when I gave him my cube when he was going through chemo.
Two Totems To Take With You
The first is a tungsten cube I keep on my desk. Its weight will surprise you, but tungsten is singular in having the highest melting point of any metal. That represents one of the things I admire most about you.
Tungsten has an atomic number of 74, its symbol is W, and it’s also known as wolfram.
My next post I’ve had in drafts for a while so please try to imagine me happy and promotional when reading it, but otherwise, I’m wrecked. Just going to soldier through because that’s what Eric always did.
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
Bleeping Computer
www.bleepingcomputer.com
2026-10-14 08:58:07
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.
Tracked as
CVE-2026-104935
, this high-severity authentication bypass vulnerability lets remote threat actors without privileges execute arbitrary commands on targeted ICS systems in low-complexity attacks that don't require user interaction.
Ivanti released ICS versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 on Tuesday to address this security flaw and warned customers to "act immediately" because of "limited exploitation in the wild."
While Ivanti didn't share additional information about ongoing attacks targeting CVE-2026-104935, cybersecurity firm Volexity reported that an unknown threat actor it tracks as UTA0576 has been chaining this security issue with two other flaws in attacks since at least October 3rd.
"This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935,"
Volexity said
.
"Volexity identified a range of post-exploitation actions undertaken by the threat actor that targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys."
Threat intel firm Defused
also confirmed Volexity's report
, saying it first found evidence that attackers are abusing CVE-2026-104935
in the wild on October 1st.
On Tuesday, CISA also added CVE-2026-104935 to its list of actively exploited security flaws and ordered federal agencies to secure their networks against attacks by Friday
, as mandated by its June
Binding Operational Directive 26-04
.
While BOD 26-04 applies only to Federal Civilian Executive Branch (FCEB) agencies, the cybersecurity agency also issued a separate advisory urging all security teams and network defenders to patch this vulnerability immediately and check for evidence of compromise.
"CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. [..] CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version,"
it warned
.
"Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation. [..] Ivanti's Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory."
CISA advised defenders to take the following actions if they discover compromised Ivanti ICS appliances:
Perform a factory reset and upgrade the appliance to the latest version (for cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version).
Restore the appliance configuration from the backup created in step 1.
Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials.
Ivanti addressed multiple other Connect Secure zero-days exploited in the wild over the last several years, including an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887)
in early January 2024
, and a server-side request forgery (CVE-2024-21893)
two weeks later
.
CISA has added
36 Ivanti vulnerabilities
to its list of actively exploited security issues since November 2021, 12 of which have also been abused in ransomware attacks.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
"Propaganda Show": IDF Raids Palestinian NGOs in the West Bank Ahead of Israeli Elections
Democracy Now!
www.democracynow.org
2026-10-14 08:52:04
Israeli forces have raided what they say are the offices of several Palestinian NGOs in the occupied West Bank. Palestinian officials say a child was injured from Israeli gunfire, while others suffered from tear gas inhalation. At least one journalist was reportedly detained in the raids, which come...
Israeli forces have raided what they say are the offices of several Palestinian NGOs in the occupied West Bank. Palestinian officials say a child was injured from Israeli gunfire, while others suffered from tear gas inhalation. At least one journalist was reportedly detained in the raids, which come four years after the forced closure of multiple NGOs that the Israeli government designated as “terrorist” organizations.
“This is part of the whole propaganda show that this government is actually implementing just before the Israeli election,” says human rights lawyer Sahar Francis. “They just wanted to cause harassment, and this is the main message: the persecution and the collective punishment for the whole Palestinian community.” Francis was formerly the general director at Addameer Prisoner Support and Human Rights Association, one of the organizations that Israel claims to have raided this week despite the fact that it was already forced to close its West Bank offices in 2022.
Palestinian human rights lawyer and former general director at Addameer Prisoner Support and Human Rights Association.
Please check back later for full transcript.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
"Bogus": Minnesota State Senator Zaynab Mohamed on DHS Raid on Rep. Ilhan Omar's D.C. Home
Democracy Now!
www.democracynow.org
2026-10-14 08:41:38
On Monday, federal agents from the Department of Homeland Security raided the Washington, D.C., home of Congressmember Ilhan Omar. Omar has faced years of racist targeting from President Trump over her ethnicity and immigrant background. She immigrated to the United States as a refugee from Somalia ...
On Monday, federal agents from the Department of Homeland Security raided the Washington, D.C., home of Congressmember Ilhan Omar. Omar has faced years of racist targeting from President Trump over her ethnicity and immigrant background. She immigrated to the United States as a refugee from Somalia when she was a child. Omar is the first Somali American elected to federal office, the first woman of color to represent Minnesota and, along with Michigan’s Rashida Tlaib, one of the first Muslim women to serve in Congress.
“Congresswoman Omar has been under attack by this administration for the last decade. … She’s a symbol of everything that this administration hates: an immigrant who stands up for her community, who fought to be here in this country, and now is doing her job and her duty to serve her constituents,” says our guest Zaynab Mohamed, a fellow Somali immigrant who represents Minneapolis in Minnesota’s state Senate. As Trump spews racist invective against the Somali American community in Minnesota, Mohamed says, “We will continue to do everything we can to reject this type of hate and rhetoric from this administration.”
Guests
Please check back later for full transcript.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
CPI-U rises 7.2% annualized in September (3.7% YoY)
The BLS is committed to providing data promptly and according to established schedules. Automated retrieval programs (commonly called "robots" or "bots") can cause delays and interfere with other customers' timely access to information. Therefore, bot activity that doesn't conform to BLS usage policy is prohibited.
We apologize for any inconvenience. If you believe we have made an error, please
contact us
.
Please contact your administrator with the error code: 0.d78ce17.1791990524.9803e21
Can Democrats Flip the House and Senate? The Lever’s David Sirota on Midterm Races To Watch
Democracy Now!
www.democracynow.org
2026-10-14 08:17:35
The midterm elections are in less than three weeks, on November 3. With Republican majorities in both chambers of Congress on the line, the Trump administration has thrown its time and resources into holding rallies in newly competitive states. We take a look at key Senate races in Georgia, Texas, M...
The midterm elections are in less than three weeks, on November 3. With Republican majorities in both chambers of Congress on the line, the Trump administration has thrown its time and resources into holding rallies in newly competitive states. We take a look at key Senate races in Georgia, Texas, Michigan and Maine with
The Lever
’s David Sirota. Ultimately, says Sirota, election results will hinge on voter turnout. “Will there be that surge of turnout based on how unpopular Trump is and how bad the affordability crisis is?” And, if they win, can Democrats then “deliver” on their promises?
Please check back later for full transcript.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
This experiment is seventy years old, and it was built out of relays
before it was ever written as software.
c. 1951
Bell Telephone
Laboratories
Murray Hill, New Jersey
Some time in the early 1950s, at Bell Laboratories, an engineer named
David Hagelbarger built a machine to play
matching pennies
against his colleagues. Two players each choose heads or tails in
secret; one wins if the choices match, the other if they differ. Played
against someone truly unpredictable, it is a coin flip and nothing more.
Hagelbarger called his machine SEER, for SEquence Extrapolating
Robot.
2
SEER did not model you in any deep way. It tracked three facts about
the last two rounds: whether it had won or lost the play before last,
whether it had played the same or differently, and whether it had won or
lost the last play. Three yes-or-no facts give eight possible
situations, and for each of the eight the machine remembered whether
playing the same had been working. It counted that on a small reversible
counter that stopped at plus and minus three, which Hagelbarger
described with a phrase worth keeping: the stops "in effect make the
machine forget ancient history."
2
Plate
SEER's whole memory. Three yes-or-no facts
about the last two rounds give eight situations, and each situation
keeps one small counter of whether playing the same has been working.
The stops at plus and minus three are what Hagelbarger meant by
making the machine forget ancient history.
Claude Shannon, who worked down the hall, took note and built his
own. His memorandum of 18 March 1953 opens by giving Hagelbarger the
credit plainly, and then makes a comparison that tells you exactly what
kind of machine this is:
That is the whole idea in one sentence. Game theory tells you the
correct way to play matching pennies: flip a mental coin, be genuinely
random, and no opponent can beat you over time. Poe's detective does
something else entirely. He studies his opponent and guesses what sort
of person would choose what. Shannon built the detective, because the
detective wins. Not against an ideal player. Against an actual one.
Shannon's machine looked for patterns and, in his words, "assumes
that the player will follow the patterns the next time the same
situation arises." When it had not seen a pattern repeat at least twice,
it moved at random, and the randomness came from a commutator spinning
about ten times a second, sampled at the moment you pressed the
button. Its unpredictability was harvested from the jitter in your own
timing.
1
Plate
Not the mind-reading machine, which is not
photographed anywhere we could use, but one of Shannon's other
game-playing boxes from the same years: Nimwit, c. 1953, which plays
Nim. It is here because of its front panel. Two columns of lamps,
player wins
against
machine wins
, is the scoreboard
this whole page inherited.
MIT Museum, Cambridge MA. Photograph by Daderot,
released under
CC0 1.0
.
Source
.
He knew exactly how to beat it
What makes Shannon's memo remarkable is that he did not oversell it.
He worked out how beatable the machine was and published the method:
The machine is not unbeatable. It is beatable three times out of
four,
on paper
. You simply cannot run the method in your head
while playing. That gap, between what is possible in principle and what
a person can actually do in the moment, is the entire subject of this
page, and Shannon named it in 1953.
Plate
Theseus, 1952. The mouse finds its way through
the maze, and remembers the route. Shannon's habit of building the
idea rather than only writing it down is the reason a memo about
outguessing people came with a working machine attached.
MIT Museum, Cambridge MA. Photograph by Daderot,
released under
CC0 1.0
.
Source
.
The two machines played each other
Inevitably, someone wondered which machine was better. Hagelbarger
recorded what happened:
Plate
The two machines were wired to a third that
refereed between them. The scores shown are from the 2020 software
replication, averaged over games of a hundred plays; Hagelbarger's own
report of the original match put it at about 55 to
45.
3
Shannon's simpler machine, built with about half as many relays, beat
the more elaborate one. In 2020 a group at Sibiu reimplemented both in
software and played them against each other ten times. Averaged over
games of a hundred plays, Shannon's won 55.8 to 44.2. A sixty-year-old
piece of laboratory folklore, checked and
confirmed.
3
Player 3507
Machine 5010
the lifetime
score on the exhibit
Shannon's machine still exists. William Poundstone went to see it at
the MIT Museum's storage facility and did not play it, because "that
would have been almost impious," he wrote, "for it recorded a final score: Player
3507. Machine 5010." Across every person who ever sat down with it, the
machine won about 59% of the time. That is a lifetime tally on an
exhibit rather than a controlled experiment, and it is the only
machine-against-humans number that survives at
all.
4
Fifty years later, in a lecture hall
The version you just played comes from Scott Aaronson, who wrote it
for a class he taught at Berkeley and describes it in
Quantum
Computing Since Democritus
:
Hold on to two things there. The first is that Aaronson could not
beat his own program while knowing its source code, the same admission
Shannon made about his relays. The second is the student, whom we will
come back to at the end, because how he did it is the point rather than
the exception.
Where our version departs
Ours is not a copy of either machine. Shannon's tracked whether it
was winning and whether you had changed your choice, giving it eight
situations and no memory of your actual sequence. Ours ignores winning
and losing entirely and simply counts what you pressed after each recent
run of presses. Aaronson's used runs of five, and so does ours. His
forgot nothing; Hagelbarger's deliberately forgot; ours also never
forgets, so a habit you drop early keeps counting against you for the
rest of the session.
Plate
Three machines, seventy years apart, and what
each one actually keeps. The count of 63 is every run of five presses
or fewer: 32 of length five, 16 of four, and so on down to the empty
run.
How it works, in English
What just happened to you
There is no model of psychology in this program, and nothing about
free will. It keeps a notebook.
Every time you press a key, it writes down what you had just pressed
beforehand, and what you pressed next. Not once, but at six different
lengths at the same time. Suppose your last five presses were F, D, D,
F, F, and then you press D. The notebook gains six entries: after
FDDFF
you pressed D; after
DDFF
you pressed D;
after
DFF
you pressed D; after
FF
you pressed
D; after
F
you pressed D; and, ignoring context entirely,
you pressed D.
Plate
One press, six entries. The notebook records
the same event at every context length at once, from the full run of
five down to no context at all. Nothing else is stored: no timing, no
history of who was winning, no model of you.
To guess your next press, it reads the notebook backwards. It takes
your last five presses and asks: have I seen this exact run before, and
if so, what did you do next? If it has seen that run at least twice and
you did not do both things equally often, it answers with whichever you
did more. If the run is new, or it has only seen it once, or you split
evenly, then it shortens the question. What about the last four presses?
The last three? Two? One? And if all of that fails, it flips a coin,
and that coin flip counts against its score like any other guess.
That shortening is the only clever thing in the program, and it is
worth understanding, because it is where most naive versions go wrong.
A long run is a specific match: it tells you a lot when it applies. But
early in a session you have not produced many five-press runs, so most
of them have been seen exactly once, and a single observation is not
evidence. It is a coincidence. A short run is vaguer but far better
attested. The program prefers the longest run it has seen
often
enough to trust
, and slides down to shorter, better-supported
questions when the specific ones are thin.
That notebook is the drawing you have been playing against. The bands
at the top of the page are the six questions the machine asks, stacked:
your last five presses at the top, down to no context at all — every
press you have ever made — at the bottom. Every grain in a band is one
time you produced that run and then pressed something. Grains sit left
of the centre line if you followed the run with D and right of it if you
followed it with F. So how wide a band is says how much the machine
knows, and how lopsided it is says what it knows.
The guess falls down the centre. A run it has never seen is an empty
band and holds nothing. A run seen exactly once is a single grain, which
is a coincidence rather than evidence. A run you followed with F exactly
as often as with D is perfectly symmetrical, and the crack down its
middle is open. The guess drops through every one of those and comes to
rest on the first band that is neither empty, nor thin, nor even — then
leans the way that band leans. That fall is backoff. It is the only
clever thing in the program, and it happens in front of you on every
single press.
Notice that the bands get wider as they get shallower, and that this
is not a drawing decision. The top band asks about one exact run of five
and has almost nothing in it; the bottom band counts every press you have
ever made. Evidence thins as the question gets more specific, always,
and that is the entire reason the machine has to be willing to give up
on its best question and ask a worse one.
Notice what this means. The machine is not clever and it is not
reading you. It is asking, over and over, one question:
last time
things looked like this, what did you do?
Everything else on this
page is a consequence of the fact that you keep answering.
Figure 2
Your own notebook, from the session you
just played. Each row is a run of presses; the bar shows how often you
followed it with F rather than D. Rows the machine trusted are marked.
With no session stored, this shows a sample instead, clearly
labelled.
How it works, actually
Counting, and knowing when to stop
The proper name for the notebook is an
n-gram frequency
model
. An n-gram is just a run of n symbols. Here the symbols
are your two keys, so there are 2
5
= 32 possible runs of five,
16 of four, and so on down to the empty run, which is the count of every
press you have ever made.
Write
c
for a run of presses, called the
context
,
and
N
(
c
, F) for the number of times you pressed F
immediately after that run. The prediction rule is: take the longest
context
c
matching your recent presses such that
N
(
c
, F) +
N
(
c
, D) ≥ 2 and
N
(
c
, F) ≠
N
(
c
, D),
and answer with whichever of F or D is larger. If no context
qualifies, answer at random. Dropping to a shorter context when a longer
one is unavailable or unreliable is called
backoff
, and
it is standard practice in statistical language modelling, where the
same problem appears: specific evidence is better, but specific evidence
is rare.
Backoff
prefer the longest run you have
seen often enough to trust
The threshold of two is doing real work. Without it, a run seen a
single time, a 1–0 count, would outrank a two-press context seen forty
times as 30–10, purely because it was longer. That is the classic
sparse-data failure, and it makes the model noisier than counting alone
would be.
Aaronson described his original in almost these terms. Asked what the
Berkeley program did, he replied:
Note the hedge, "there might have been." He is suggesting backoff,
not recalling it. Our threshold and our backoff are our own choices,
taken on his suggestion, and not a reconstruction of the program he ran
in that lecture hall.
Figure 3
One real prediction from your session, held
still — and the whole notebook this time, not just the six runs the
instrument was asking about. Each circle is a run the machine has
recorded and its size is how often it happened; the lit path is your
last five presses, the crossed circles are the runs it gave up on, and
the ringed one is where the guess came to rest.
Read the machine
The entire program
Below is the predictor, in full. Not a summary of it, not a cleaned
up version for the article, but the file this page loaded and ran while
you were playing. It is
a few dozen
lines
long, and its shortness is the lesson: this is all it takes.
Loading oracle.js…
Figure 4
The predictor,
loaded from
oracle.js
, the same file this page is
running.
Two functions.
record
writes one press into every
context length at once;
predict
walks from the longest
context to the shortest and returns the first one it trusts. There is no
training phase, no parameters fitted in advance, no model of you beyond
the tally it has built during this one session. It arrived knowing
nothing.
What it says about us
Why you lost
A program this small should not be able to do this. It wins because
of something about you, and that something has been measured for
decades.
The task you were given, producing a sequence with no pattern in it,
is called random sequence generation, and it is one of the more studied
failures in experimental psychology. A 2023 review states the finding
without hedging: "A common finding of RSG studies is that people are bad
randomizers."
7
The most reliable way people fail is the one Aaronson named in
passing when he said players "have too many alternations." The same
review calls it the alternation bias: "the avoidance of repetitions,
also called
negative recency effect
or
alternation
bias
, where an excess of alternations and suppression of repeating
choices can be observed."
7
Asked to be
random, people switch too often and repeat too seldom. A fair coin
produces a run of five identical flips more often than feels acceptable,
and so people who are imitating a coin trim those runs away.
It goes deeper than switching too much. Analysing sequences people
produced when asked to be random, one study concluded that they "avoid
number repetitions and systematically deviate from mathematical
randomness," and that the results "emphasize the idea of a complex
hidden Markov rule system that underlies humanly generated random number
sequences."
8
That phrase is worth
pausing on. A hidden rule system with memory is more or less exactly
what an n-gram model is built to find. The oracle is not a general
mind-reader; it is a device shaped to fit a specific defect, and the
defect is real.
The bias also runs in the other direction. People not only produce
too many alternations, they
believe
too many alternations look
random: shown binary sequences to judge, participants rate the ones with
the most switching as the most likely, with the peak somewhere around a
0.6 to 0.8 rate of alternation against a true value of
0.5.
9
Sequences with more structure,
HHHHH rather than HTTHT, are judged less
probable.
10
We generate wrongly and we
grade wrongly, in the same direction.
Plate
The shape of the mistake, drawn from the
finding rather than from data: asked which binary sequences look most
random, people peak somewhere around 0.6 to 0.8 alternation, while a
fair coin alternates half the time.
9
The curve is an illustration of that reported peak, not a plot of
published measurements.
The instruction itself hurt you
Here is the part that ought to bother you, and it is why the two
experiments on this page are not equivalent. That 2023 review also
reports: "if randomness is not overtly requested but rather an implicit
requirement, as in competitive games such as matching pennies,
randomness seems to be higher."
7
Shannon's players were playing a game and trying to win. You were
told to be random. The literature says the second framing is the worse
one, and that consciously attempting randomness makes you more
predictable than simply trying to beat an opponent. The instruction at
the top of this page was, in a small way, working against you.
Figure 5
How the machine learned you: its running
accuracy across your session, against the 50% a coin would
manage.
The rematch
Now that you know
You have read the source. You know it counts runs of up to five, that
it needs to have seen a run twice before trusting it, that it never
forgets, and that it falls back to a coin flip when it has nothing.
Play it again.
Most people do about as badly the second time, and the two people
best placed to know said so first. Shannon, having published the exact
method for beating his machine three-to-one, noted that it was
"extremely difficult to carry out this program mentally."
Aaronson, having written his, said flatly: "I couldn't even beat my own
program, knowing exactly how it worked."
Knowing the algorithm gives you nothing, because the algorithm was
never the hard part. The hard part is generating the sequence, and you
are the one generating it, with the same machinery that produced the
biases in the first place. Understanding a bias from the outside does
not switch it off from the inside.
The reliable methods
all amount to the
same move: take the decision out of your own head
If you do beat it, the interesting question is
how
. The
reliable answers all have one thing in common: they take the decision
out of your head. Poundstone, playing a modern implementation, found he
did better when he stopped watching the score. "I found I did better
when I tried to ignore the feedback, and better yet when I made sure I
couldn't see the bars"
4
, and better
again when he deliberately repeated choices his instincts wanted to
alternate. Others read digits off something external, or run a rule in
their head that is cheap to compute but hard to detect.
Which brings back Aaronson's student, the one the program predicted
exactly 50% of the time and who said he "just used his free will." We
have no record of what he actually did. But whatever it was, it was a
method, a way of choosing that his own habits could not reach. That is
not a smaller thing than free will. It is just a more useful description
of it: not the absence of a cause, but the ability to hand the decision
to something other than your reflexes.
The machine below is the same file, with the same rules, sealing its
guess before every press.
This experiment needs JavaScript.
References
Sources
Every factual claim above traces to one of these. Where an original
was behind a paywall, the quotation is taken from a source that
reproduces it, and that is said plainly.
Claude E. Shannon, "A Mind-Reading (?) Machine," Bell
Laboratories Memorandum, 18 March 1953; reprinted in
Claude Elwood
Shannon: Collected Papers
, IEEE Press, 1993, pp. 688–690.
Full text (PDF)
.
D. W. Hagelbarger, "SEER, A SEquence Extrapolating
Robot,"
IRE Transactions on Electronic Computers
, EC-5(1),
1956, pp. 1–7. We could not obtain the original; both quotations here
are reproduced from reference 3, which marks its quotations
explicitly.
Macarie Breazu, Daniel Volovici, Daniel I. Morariu,
Radu G. Crețulescu, "On Hagelbarger's and Shannon's matching pennies
playing machines,"
International Journal of Advanced Statistics and
IT&C for Economics and Life Sciences
, 2020, pp. 56–66.
PDF
.
William Poundstone, "How I Beat the Mind-Reading
Machine," 30 July 2015.
Article
.
Scott Aaronson,
Quantum Computing Since
Democritus
, Cambridge University Press, 2013, Chapter 18 ("Free
Will"). The passage also appears in the freely available lecture notes
the book grew from:
Lecture 18
.
Scott Aaronson, personal communication to Nick Merrill,
reproduced in the
aaronson-oracle
README. Not a published
source.
Repository
.
Aaronson links that implementation himself, and uses the name "the
Aaronson Oracle," in
his reply to Roger Penrose
.
Maja Guseva, Carsten Bogler, Carsten Allefeld,
John-Dylan Haynes, "Instruction effects on randomness in sequence
generation,"
Frontiers in Psychology
, 14:1113654, 2023.
Open access
.
Marc-Andre Schulz, Barbara Schmalbach, Peter Brugger,
Karsten Witt, "Analysing humanly generated random number sequences: A
pattern-based approach,"
PLOS ONE
7(7): e41531, 2012.
Open access
.
Its headline prediction figures concern nine-option digit sequences,
not two-key sequences, and are not quoted here.
Giorgio Gronchi, Marco Raglianti, Stefano Noventa,
Alessandro Lazzeri, Andrea Guazzini, "Modeling the overalternating
bias with an asymmetric entropy measure,"
Frontiers in
Psychology
, 7:1027, 2016.
Open access
.
These figures describe how people
judge
sequences, not how
they produce them.
Stian Reimers, Chris Donkin, Mike E. Le Pelley,
"Perceptions of randomness in binary sequences: Normative, heuristic,
or both?"
Cognition
, 172, 2018, pp. 11–25.
DOI
·
accepted version (PDF)
.
On October 11, 1999,
Nvidia
released its GeForce 256, its first product that it described as a GPU.
What made the Nvidia GeForce 256 the first GPU?
The GeForce 256 from 1999 was the first product Nvidia marketed as a GPU.
I’m sure 3dfx fans would argue that 3dfx made GPUs, and it seems a little arbitrary to say the GeForce was a GPU and the TNT2 wasn’t. It was more powerful than the TNT2 and offered more features, but what feature did the GeForce have that made it a GPU and the TNT2 not a GPU? The transform and lighting engine, maybe?
The concept of offloading work from the CPU onto a graphics coprocessor was nothing new. Commodore did it with the Amiga way back in 1985. And 3dfx was doing it on PCs
as early as 1996
.
But Nvidia didn’t use the term until October 1999. It continues to use it today, though, and it also uses the GeForce brand.
The GeForce 256 wasn’t necessarily an immediate game changer. It was a real boon for systems with low-end CPUs like
300 MHz Celerons
, but faster CPUs could do transform and lighting in software faster than the GeForce 256 could do in hardware. But the concept of offloading these tasks from the CPU was a good one. A lot of gamers at the time were on a budget and had low-end CPUs like Celerons. Nvidia stayed ahead of Intel by creating follow-up graphics cards more frequently than they had in the past. Nvidia’s follow-up GeForce GPUs fared well.
The GeForce 256 wasn’t Nvidia’s first product and wasn’t their first
graphics card
, but if they want to say it was their first GPU, I’m not sure too many people will argue with them. Or it could be the GeForce 256 was the first just because Nvidia didn’t invent the term until the GeForce 256.
Nvidia bailout by Sega
Today Nvidia is one of the most successful companies in the world. But it struggled early on.
Three years after its founding in 1993, Nvidia partnered with Sega to design the video for the Dreamcast console in 1996. Nvidia’s chip wasn’t up to the task Sega was asking of it, they were out of money, and couldn’t finish the project. Sega bailed them out with a $5 million investment in the company. Sega made its money back along with a $10 million profit, so it worked out fine for Sega in the end. The Dreamcast ended up with a chip manufactured by NEC in the Dreamcast, after Sega also considered a chip designed by 3dfx.
The money from Sega helped Nvidia introduce the Riva 128 chip, which sold more than a million units and led to the successful TNT2, followed by the GeForce 256. If it hadn’t been for Sega’s investment, Nvidia could have gone out of business before 3dfx did, and perhaps 3dfx would have survived instead. Instead, Nvidia purchased most of 3dfx’s intellectual property on December 15, 2000.
3dfx wound down operations
and went bankrupt October 15, 2002.
David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.
The woman seemed to be making some pretty good points until she stopped with, “Ugh! Those people are just so stupid!!”
She could have said Southerners, Northerners, Liberals, Conservatives, Chinese, or Americans.
It doesn’t matter.
She just proved that she wasn’t being smart.
There are no smart people or stupid people, just people being smart or being stupid.
Being smart means thinking things through.
It means trying to find the real answer, not the easiest answer.
Being stupid means avoiding thinking by jumping to conclusions.
Jumping to a conclusion is like quitting a game.
You lose by default.
That’s why saying “I don’t know” is usually smart — because it’s refusing to jump to a conclusion.
So when someone says, “They’re so stupid!” it means they’ve stopped thinking.
They say it because it’s satisfying to jump to that conclusion.
So if you decide someone is stupid, it means you’re not thinking, which is not being smart.
Therefore, smart people don’t think others are stupid.
Headlines for October 14, 2026
Democracy Now!
www.democracynow.org
2026-10-14 08:00:00
Fighting Escalates in Yemen Between the Houthis and Saudi-Backed Gov’t Forces, NYT: Israel Levels 48 Villages and Towns It Occupies in Southern Lebanon, Kimberly Guilfoyle Resigns as U.S. Ambassador to Greece, WSJ: Texas GOP Attorney General Ken Paxton Partied in Dubai with Two Indicted Fugiti...
Fighting Escalates in Yemen Between the Houthis and Saudi-Backed Gov’t Forces
Oct 14, 2026
Fighting continues to escalate in Yemen between the Houthis and Saudi-backed government forces. On Tuesday, Saudi Arabia struck an oil facility near Sana’a and fuel depots in other parts of Yemen. The Houthis retaliated by attacking the headquarters of Saudi Arabia’s state-owned oil company Saudi Aramco in the eastern city of Dhahran. The attack reportedly caused a limited fire.
Meanwhile, the humanitarian crisis in Yemen is worsening. The World Health Organization reports suspected cholera cases in Yemen have tripled in recent weeks.
NYT
: Israel Levels 48 Villages and Towns It Occupies in Southern Lebanon
Oct 14, 2026
Israel’s military has leveled 48 of the roughly 60 villages and towns it occupies in southern Lebanon since Israel agreed to a so-called ceasefire with Hezbollah in April. That’s the finding of a New York Times investigation published Monday, which documented how Israeli forces demolished homes, schools, mosques and roads in Lebanese villages north of Israel’s border, with most of the destruction focused on the majority Shia Muslim population from which Hezbollah draws its support. The seven villages that have not been seriously damaged are largely populated by Christian, Sunni Muslim or Druze residents. The scorched-earth campaign has fueled fears that Israel is seeking to permanently empty much of southern Lebanon of its population. According to the U.N., Israel’s invasion and attacks have driven 329,000 people from their homes in Lebanon — one-third of them children. This is U.N. spokesperson Stéphane Dujarric.
Stéphane Dujarric
: “The situation on the ground is not going to get magically better on January 1st. It will continue to be extremely dangerous, extremely worrying. And we very much hope that the international community comes up with a plan that will serve — that will serve the populations of southern Lebanon and will also enable the population of northern Israel to go home.”
Kimberly Guilfoyle Resigns as U.S. Ambassador to Greece
Oct 14, 2026
Kimberly Guilfoyle has resigned as U.S. ambassador to Greece, days after The Wall Street Journal reported she had requested a Republican donor pay off her $100,000 American Express bill in exchange for access to the Trump administration. In addition, the Journal reports Guilfoyle threatened Greece’s energy minister that the U.S. had the power to topple the Greek government. She said, “We can do that to any country we want. We can do that here.”
Kimberly Guilfoyle is the former fiancée of Donald Trump Jr. and was previously married to California Governor Gavin Newsom.
Guilfoyle resigned Tuesday shortly after White House Press Secretary Katie Zacharia made this announcement during her first press briefing.
Press Secretary Katie Zacharia
: “We have asked Ambassador Guilfoyle to resign. She has been a wonderful asset to the team, and we wish her well.”
Katie Zacharia’s first press conference was widely criticized. She took just three questions over 15 minutes, just after mixing up the president and her husband.
Press Secretary Katie Zacharia
: “I adore my family. I love them. They are my priority. They — I love being with my kids. The idea of not spending evenings with my kid — kids are — is completely unacceptable. So, my president — or, excuse me, my husband — that’s a — that’s a good one.”
WSJ
: Texas
GOP
Attorney General Ken Paxton Partied in Dubai with Two Indicted Fugitives
Oct 14, 2026
In election news, The Wall Street Journal has published video of Texas Republican Attorney General Ken Paxton, the Republican nominee for Senate, partying in Dubai on New Year’s Eve 2024 with two indicted fugitive healthcare executives and a woman who wasn’t his wife. The two men had been indicted months before on federal healthcare fraud charges but failed to return to the United States. One of the healthcare executives had donated $190,000 to Paxton. Paxton’s Senate rival, James Talarico, responded to the report by writing online, “A party with multiple fugitives, and Ken Paxton is still the sketchiest guy in the room.”
Federal Agents Subpoena Relatives of Democratic Congressmember Ilhan Omar
Oct 14, 2026
Federal agents have issued subpoenas to relatives of Democratic Congressmember Ilhan Omar of Minnesota. According to reports, Sahra Noor, Omar’s sister, received a subpoena, along with another family member. This comes after Homeland Security agents raided Congressmember Omar’s home in Washington, D.C., on Monday. We’ll have more on this story later in the broadcast.
Maine
GOP
Senator Susan Collins Faces Off Against Democratic Challenger Troy Jackson in Debate
Oct 14, 2026
In Maine, Republican Senator Susan Collins faced off against her Democratic challenger Troy Jackson in a debate over healthcare, the war in Iran and immigration. The polls are tight with the race critical to determining which party controls the Senate. Jackson blasted Collins over her record on the U.S. war on Iran.
Troy Jackson
: “Iran war, I mean, Senator Collins would not push back against that. Five times she voted for it. I mean, the reason why our fuel prices is going through the roof, and the way our — the reason why our electricity costs are going through the roof is because the cost of fuel, cost of oil is so high, because she wouldn’t stop President Trump with the Iran war.”
Reuters:
DOJ
Gives California Officials 48 Hours to Review List of Alleged Noncitizen Voters
Oct 14, 2026
In more election news, the Justice Department gave California officials 48 hours to review a list of alleged noncitizen voters or face legal action. That’s according to a letter reviewed by Reuters. The DOJ’s letter to California officials orders the state to hold off on mailing ballots to anyone on the list until it verifies their citizenship. For listed voters who already have ballots, the letter says any ballots they mail back should be set aside, and ballots already returned should not be counted until their citizenship is confirmed.
Man Shot by
ICE
in New York Held in Solitary Confinement with Bullet Still Lodged in His Neck
Oct 14, 2026
In immigration news, the man shot by
ICE
in New York last week is currently held in custody in solitary confinement with a bullet still lodged in his neck, according to his attorneys. Twenty-eight-year-old Oscar Belgal is awaiting deportation proceedings after immigration agents opened fire on his car in the Bronx. According to his lawyers, Belgal is in urgent need of surgery to remove the bullet.
Immigrants Sue
ICE
for Keeping Their Documents Long After Their Release
Oct 14, 2026
In more immigration news, immigrants released from detention are suing
ICE
for keeping their passports and other belongings long after letting them go. The lawsuit, filed Tuesday in federal court in Washington, D.C., says
ICE
has held onto the property of seven people for more than five months after their release, even though at least some of them still have pending immigration cases. The immigrants claim that
ICE
withheld items that include Social Security cards, work permits, phones and even car keys. Craig Martin, a lawyer representing the plaintiffs, said, “If
ICE
has a legitimate operational reason to keep somebody’s property, it needs to identify it. And if it doesn’t identify it, the Constitution and ICE’s own rules point to get the document back without delay.”
Cornell University Bans All Fraternities from Hosting Parties
Oct 14, 2026
Cornell University is banning all fraternities from hosting any parties, amid criticism of how it responded to a reported sexual assault on campus in 2024. In a lawsuit filed last month, a woman identified as Jane Doe says she was drugged and gang-raped by multiple men during a party at a Cornell fraternity house two years ago. In a statement on Tuesday, Cornell’s president, Michael Kotlikoff, said, “I am deeply sorry for the harm Jane Doe suffered in 2024, and appalled that this act of sexual violence occurred within our Cornell community. It is clear that women on our campus continue to question whether they are safe. We must meet this moment by acknowledging where we have fallen short and taking meaningful action.”
Click here to see our coverage of the Cornell alleged gang rape case
.
Ebola Cases Surpass 9,000 in the Democratic Republic of the Congo
Oct 14, 2026
In the Democratic Republic of the Congo, the number of confirmed Ebola cases has surpassed 9,000 with over 4,300 deaths. The outbreak caused by the latest strain of the virus has become the largest and deadliest in Congo’s history. There are currently no treatments or vaccines for the latest strain of the Ebola virus.
Click here to see our coverage
.
Sixth Person Dies of Measles in Pennsylvania
Oct 14, 2026
In Pennsylvania, a sixth person has died of measles as the number of cases in the state topped 1,100. The victim was identified as a 39-year-old unvaccinated woman who had several underlying conditions. The
CDC
has recorded over 4,000 confirmed measles infections across the U.S., the highest number of cases in decades. Earlier this month, New York Governor Kathy Hochul declared an emergency because of rising measles cases in the state.
Vatican Announces Pope Leo Diagnosed with Lung Cancer
Oct 14, 2026
The Vatican announced Tuesday that 71-year-old Pope Leo has been diagnosed with lung cancer. In a medical bulletin, the Vatican said surgeons had removed the lower lobe of the pope’s right lung. After undergoing surgery, the pope spent a night in the hospital. The pope is not known to be a smoker or to have had recent health issues.
Trump Reportedly Has Doubts of Live-Streaming Execution of Fort Hood Shooter
Oct 14, 2026
President Trump has reportedly told people privately that he has doubts about plans to live-stream the firing squad execution of Nidal Hasan, the former Army major who killed 13 people at Fort Hood in Texas back in 2009. Defense Secretary Pete Hegseth scheduled the execution date for December 3.
600,000 People Left Without Electricity in Ukraine After Russian Strikes
Oct 14, 2026
In Ukraine, 600,000 people are without electricity after deadly Russian missile and drone strikes pummeled the country, killing three people in the capital Kyiv. According to Ukrainian President Volodymyr Zelensky, the strikes hit critical energy infrastructure in Kyiv and Kharkiv, despite President Trump claiming over the weekend that there was an energy ceasefire between Ukraine and Russia.
Indian Court Orders Two Leaders of Youth-Led Cockroach Janta Party Jailed for Five Days
Oct 14, 2026
In India, a court has ordered two leaders of the youth-led Cockroach Janta Party jailed for five days. Opposition parties and student groups have been protesting nearly every day to call for the resignation of Chief Election Commissioner Gyanesh Kumar over his revisions to the voter rolls, purging 130 million voters. The protesters argue that the revisions benefit right-wing Prime Minister Narendra Modi’s
BJP
. Delhi police detained at least 30 journalists over the weekend while they covered the protests. This is Vinod Jakhar, president of the National Students’ Union of India.
Vinod Jakhar
: “Gyanesh Kumar will have to resign. Students of the country have taken to the streets. We will not stop ’til we get his resignation, like we did with Dharmendra Pradhan. We will fight daily. We will get detained, but the protests would continue.”
Tens of Thousands March in Solidarity with Students in France
Oct 14, 2026
In France, tens of thousands of people marched on Tuesday in solidarity with protesting high school students; unions estimated turnout at almost half a million people. The Justice Ministry says more than 6,800 people, mostly minors, have been taken into custody, as rights groups and students accuse riot police of excessive force, including the use of tear gas, batons and blast balls. The movement began at a high school in the Paris suburbs last month and spread nationwide, with students blockading their schools over overcrowded classrooms, teacher shortages and crumbling buildings. This is a protester.
Lucie
: “I think it’s part of the police’s strategy, actually. They know that kettling and surrounding people inevitably increases violence. So I think it’s something the police are actually aiming for. … There are thousands of young people demonstrating, and the only things we see are burning trash cans and the vandalism at the end. And I think that’s a very poor summary of what is going on, and it is also drowning out the message people are trying to convey.”
Anti-Government Student Protests Erupt in Albania
Oct 14, 2026
In Albania, a nationwide student protest over education and social issues turned violent as demonstrators threw bricks and chunks of concrete at Albania’s Education Ministry, and police answered with tear gas and water cannons. Organizers said students were protesting university conditions, the cost of higher education, the level of financial aid and the lack of job prospects after graduation. This is a protester.
Protester
: “It must be overthrown. They must hold elections, form a technical government, and then hold free and fair elections. Whoever wins, let them win.”
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
Pg_vectorsearch: An index that is faster than pgvector's IVFFlat and HNSW
A PostgreSQL extension for high-performance approximate nearest neighbor (ANN)
search.
Status: alpha.
Meant for testing, not production. Upgrading
between prereleases may not be possible; plan to drop and recreate the
extension and its indexes. See the
changelog
for
known issues.
PRISM index
(100M+ vectors) — IVF-style, with hierarchical routing
RaBitQ quantization
with theoretical error bounds for two-stage search
PRISM (Partitioned Routing Index for Similarity Matching) is a PostgreSQL-native
index access method that is conceptually similar to
pgvector
's
IVFFlat, but it is built around state-of-the-art quantization, routing, and
partitioning techniques. It is implemented in C for high performance and
seamless integration with PostgreSQL.
The result: an
index that is significantly faster
than
pgvector's IVFFlat and HNSW, for both querying and index building. In fact,
compared to graph-based HNSW, PRISM is faster at equivalent recall on a
100-million-vector dataset, on an instance with a quarter of the memory.
To achieve this performance, PRISM uses a hierarchical centroid tree to
partition vectors into clusters, and relies on the PostgreSQL buffer cache to
keep that tree warm in memory. Vectors are
RaBitQ
-quantized and stored
in posting lists with a page layout optimized for SIMD distance computation. The
RaBitQ encoding carries error bounds that let a search rule out vectors that
cannot possibly be nearest neighbors, so far fewer of them need reranking
against the full-precision vectors stored in the table.
Query Flow:
1. Traverse centroid tree to find nearest clusters (buffer cache)
2. Scan posting lists for candidates (buffer cache, async I/O)
3. RaBitQ two-stage filtering: estimate → error bound → rerank
4. Full-precision reranking from heap
5. Return k nearest neighbors
There are two ways to use a PRISM index. Pick the one that matches where
your vectors live:
Native types
.
Starting fresh, or not using
pgvector? Store vectors in
pg_vectorsearch
's own
vec32
(float32) or
vec16
(float16) columns. No other extension is needed.
Existing pgvector tables
.
Already have
vector
or
halfvec
columns? Install
pg_vectorsearch
next to
pgvector and build a PRISM index on those columns as they are. Your
table and queries stay unchanged.
Both paths build the same index and use the same operators (
<->
,
<#>
,
<=>
) and
tuning
knobs.
Native types
CREATE EXTENSION pg_vectorsearch;
-- PLAIN keeps the vector inline. EXTERNAL (the default) toasts a value-- over ~2 kB, and rerank then pays an extra fetch the planner does not cost.CREATETABLEitems (
id serialPRIMARY KEY,
embedding vec32(3) STORAGE PLAIN
);
-- Load first; the index is sized from the row count at CREATE INDEX.-- 500 rows is enough for the planner to use the index.INSERT INTO items (embedding)
SELECT ARRAY[i::real, (i % 7)::real, (i % 5)::real]::vec32
FROM generate_series(1, 1000) i;
-- For inner product or cosine, see Operator classes below.CREATEINDEXON items USING prism (embedding vec32_l2_ops);
-- 0 = auto (~0.95 recall). Raise for recall, lower for speed.SETprism.nprobe=40;
SELECT*FROM items
ORDER BY embedding <->'[3,1,2]'LIMIT5;
Use
vec16
instead of
vec32
to halve the space vectors take in the
table, with the matching
vec16_*
operator classes
.
Existing pgvector tables
If you already have a table with pgvector's
vector
or
halfvec
columns, you can build a PRISM index on it directly. Nothing about the
table or your queries needs to change.
vec32
and
vec16
are binary-compatible with pgvector's
vector
and
halfvec
but have different names, so the two extensions can be
installed side by side, even in the same schema.
-- The table you already have, included so the example runs on its own.
CREATE EXTENSION vector;
CREATETABLEdocuments (
id bigserialPRIMARY KEY,
body text,
embedding vector(384)
);
CREATEINDEXdocuments_embedding_hnswON documents USING hnsw (embedding vector_l2_ops);
-- Install pg_vectorsearch next to pgvector and build the index on the-- existing column. The column is not rewritten or copied.
CREATE EXTENSION pg_vectorsearch;
CREATEINDEXdocuments_embedding_prismON documents USING prism (embedding vec32_l2_ops);
-- Your queries keep working as before. PRISM is normally faster, so-- the planner should prefer it over the HNSW index while both exist.-- Verify with an EXPLAIN:
EXPLAIN (COSTS OFF)
SELECT id, body
FROM documents
ORDER BY embedding <-> (SELECT embedding FROM documents WHERE id =42)
LIMIT10;
-- Limit-- InitPlan 1-- -> Index Scan using documents_pkey on documents documents_1-- Index Cond: (id = 42)-- -> Index Scan using documents_embedding_prism on documents-- Order By: (embedding <-> (InitPlan 1).col1)-- Once you are happy with it, drop the HNSW index.DROPINDEX documents_embedding_hnsw;
Use the PRISM
operator class
for the same distance
metric as your HNSW index.
Operator classes
Pick the operator class for your distance metric and column type. L2 is
the default.
Distance
Operator
vec32
/
vector
vec16
/
halfvec
L2
<->
vec32_l2_ops
vec16_l2_ops
Inner product
<#>
vec32_ip_ops
vec16_ip_ops
Cosine
<=>
vec32_cosine_ops
vec16_cosine_ops
When replacing an HNSW index, pgvector's
vector_<metric>_ops
maps to
vec32_<metric>_ops
and
halfvec_<metric>_ops
to
vec16_<metric>_ops
.
Tuning
Defaults are tuned from large-scale benchmarks; most deployments only
ever adjust
prism.nprobe
.
See the
tuning guide
for every index parameter and GUC,
their tradeoffs, and when changing them makes sense.
Maintenance
An insert appends to whichever posting list its vector routes to, so lists
grow as rows arrive and never split on their own. Besides
REINDEX
, the
prism_rebalance
procedure splits oversized lists in place.
See the
maintenance guide
for how it works and its current
limitations.
Building
Requirements:
PostgreSQL 18+ (with development headers)
GNU C11 compiler (GCC 11+ or Clang 14+)
Meson build system
Optional: CBLAS, for faster RaBitQ encoding. See
Development
.
# Release build
meson setup builddir --buildtype=release
# Build and install to PostgreSQL
meson install -C builddir
Game loops are normally lockstep because it makes sense to do your updates and then render. It makes it easy to define your game (or app) as a sequence of phases which greatly simplifies reasoning about things like concurrency. Most of the time this is enough. However, even though
single writer systems can scale incredibly well
you ideally want to be writing all the time. In a lockstep system you are by definition not writing when you are rendering. With a single writer that also means you only have one core doing work while you're writing.
Pipelining
Pipelining is when you move phases to run in parallel instead of in sequence. Haven't we basically gone back to an event based continuous time system? No, not quite, the phases are still running on their own cores/threads in batches. They also cannot race ahead of each other, they all wait at a barrier before the next tick. This means we still have back pressure, and we can still track tick overruns as normal.
What's a barrier?
From the Java docs:
A synchronization aid that allows a set of threads to all wait for each other to reach a common barrier point. CyclicBarriers are useful in programs involving a fixed sized party of threads that must occasionally wait for each other. The barrier is called cyclic because it can be re-used after the waiting threads are released. If you need support for variable numbers of parties per cycle, alternate actions on exceptions, termination control, contention control, or status monitoring, use the more flexible Phaser class.
Note: you know it's good when you start reaching for concurrency tools that sound like they are out of StarTrek (CyclicBarrier, Phaser and Disruptor)
So if
tick-time
was 100 and
write-time
was 90 and
read-time
was 100. A tick would take 190:
(max 100 (+ 90 100));; => 190
With pipeline tick time is effectively:
(max tick-time write-time read-time)
So if
tick-time
was 100 and
write-time
was 90 and
read-time
was 100. A tick would take 100:
(max 100 90 100);; => 100
With a pipeline read batch and write batches overlap. That's why they must be wrapped in transactions, so the reads don't see future writes until the next tick (or use the same basis-t if you're using a datomic-like).
But, you still have a tick barrier so that both must complete before the next tick. This gives you the same back pressure and the same overrun tracking as the lockstep model.
Lockstep is evolving! Congratulations you now have a Pipelining!
We are now writing at the same time as reading. What about read consistency? Thankfully each of our render batches is wrapped in a read transaction, so the whole batch sees a consistent view. All the batches start before the write batch completes so there's no read skew (this can be strictly enforced by adding a third barrier if desired). For a given tick everyone is still seeing the same view of the database.
Conclusion
Hopefully, this post shows you some of the benefits of modelling your system as separate phases coordinated around discrete time barriers.
Thanks to
Everyone on the
Datastar discord
who read drafts of this and gave me feedback.
Hirudo Android malware replaces banking apps to evade security checks
Bleeping Computer
www.bleepingcomputer.com
2026-10-14 07:41:20
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. [...]...
Plasma 6.8 is released on a very special day: KDE’s 30th birthday. Today we celebrate three decades of the KDE community providing the world’s greatest free and open-source software.
Plasma 6.8 is no exception, offering enhancements across much of the user experience and beneath the surface.
6.8 is all about launching Plasma into the future: adding changes you’ll notice right away, combined with major but subtle improvements designed to set the stage for decades of service to come.
Dive in and find out what the desktop environment of tomorrow looks like!
Improvements you can use today
Better accessibility
Part of our continued effort to bring digital control to everyone, a new “dwell clicker” feature can send a mouse click when the pointer stops moving. Designed especially for users with mobility issues, an external app is no longer required to use your system in this way; now it’s built right in!
Serving more users worldwide
Plasma 6.8 gains support for the
Bikram Sambat
calendar in the Digital Clock, and the
Amharic
language in the on-screen keyboard. These are just two more additions of the dozens incorporated into Plasma over recent versions in our effort to make Plasma a truly universal desktop.
Bikram Sambat calendar
Amharic on-screen keyboard
System monitoring
Gain an extreme level of control over your system with Plasma’s System Monitor. In Plasma 6.8, you can assign compute-intensive tasks to only the CPUs of your choosing from directly within the monitor, and keep your machine running smoothly.
You can also monitor your VRAM more easily, as it now shows the load as an easy-to-read percentage.
Remote desktop
We’ve invested a great deal of time into polishing the experience provided by Plasma’s built-in remote desktop server. In Plasma 6.8, you’ll be able to enjoy the following improvements — with more in the pipeline:
Much better performance and quality
that prioritizes latency and responsiveness by adapting to slow networks and rapidly-updating screen content.
Exclusive mode
optionally locks the server’s screen and provides the client with a virtual screen that exactly matches its window size.
Bi-directional clipboard synchronization
makes it easier to exchange content between the server and client.
Screen casting and recording
Spectacle can now optionally include both system audio and microphone input in its screen recordings, making it possible to narrate a recording or accurately record everything that’s going on.
Plasma’s screen sharing portal dialog lets you create a virtual screen to share, instead of an existing display. In Plasma 6.8, you can now specify the resolution of the virtual screen instead of being limited to only 1920 × 1080.
In addition, the quality of screen recordings and screencasts has been improved.
Nicer-looking third-party app windows
We’ve added support for window rules that add desktop shadows, outlines, and rounded corners to client-side-decorated windows that can’t provide these visual niceties themselves. Plasma 6.8 ships with one such rule for Steam, making it feel more at home in Plasma.
Window management
We’ve added new global shortcuts to help power users manage their open windows with the Task Manager widget. By pressing
Meta
+
Ctrl
+
Page Up
or
Page Down
, you can cycle between the previous and next tasks. By also holding
Shift
, you can move the active task backwards and forwards.
Setting the stage for decades to come
Theming
Four months ago, Plasma 6.7 included an alpha release of the new Union theming system, demonstrating its ability to style Qt Quick applications.
Plasma 6.8 builds on this with a beta release of Union, including not only refinements for Qt Quick theming, but also the ability to style Qt Widgets applications! This includes KDE’s more traditional desktop applications, such as Dolphin, Kate, and Konsole.
Dolphin themed with Union’s Breeze style. Can you tell the difference?
While Union is not quite ready to be used by default, Plasma 6.8 brings it ever closer to being a single source of truth for styling all of KDE’s products, and more. To learn more about the current state of Union, read the blog posts from
Arjen
and
Akseli
.
Wayland
30 years is an impressive milestone for a community like KDE. But even older is the venerable
X Window System
(or “X11”), first released in 1984! After 42 years of faithful service, support for starting X11 sessions in Plasma is being retired, in conjunction with full adoption of the newer
Wayland
system.
Compared to X11, Wayland offers better support for modern screens and graphics cards, and is actively developed.
The small number of individual apps that still require X11 will continue to work via the “XWayland” compatibility layer.
KDE applications will continue to support X11 for the foreseeable future.
Performance, colors, and graphics
As part of the backend improvements included in Plasma 6.8, we’ve made changes to help Plasma load faster and use less memory. Discover’s update notifier now uses less memory, too.
With KWin, NVIDIA GPUs now use triple buffering by default, and all users will have better-looking HDR when using an ICC color profile. We’ve also added support for the HLG transfer function, which means that certain media and applications that did not previously work in HDR are now working as expected.
But that’s not all…
Plasma 6.8 is chock-full of smaller changes, including:
A new
kscreenctl
tool makes managing displays from the command-line easier and also offers the potential for scripting and automation.
Kup, the KDE backup tool, has been polished up and is now released as a part of Plasma.
We have added EAP-TTLS authentication support for StrongSwan VPNs.
You can enable and disable auto-starting apps without having to delete and recreate their entries.
Use the arrow keys to move screens pixel-by-pixel in
Display Configuration
.
The system shows a warning notification when trying to print using an unavailable printer.
Copying secrets such as passwords to the clipboard now clarifies why they are not included in history.
Emojis in the
Emoji Selector
can now be shown at different sizes.
…and countless bug fixes and small tweaks to make Plasma better than ever!
KDE is a
Free Software
community that exists and grows only because of the help of many volunteers that donate their time and effort. KDE is always looking for new volunteers and contributions, whether it is help with coding, bug fixing or reporting, writing documentation, translations, promotion, money, etc. All contributions are gratefully appreciated and eagerly accepted. Please read through the
Supporting KDE page
for further information or become a KDE e.V. supporting member through our
Join the Game
initiative.
About KDE
KDE is an international technology team that creates free and open source software for desktop and portable computing. Among KDE’s products are a modern desktop system for Linux and UNIX platforms, comprehensive office productivity and groupware suites and hundreds of software titles in many categories including Internet and web applications, multimedia, entertainment, educational, graphics and software development. KDE software is translated into more than 60 languages and is built with ease of use and modern accessibility principles in mind. KDE’s full-featured applications run natively on Linux, BSD, Windows, Haiku, and macOS.
Trademark Notices.
KDE
®
and the K Desktop Environment
®
logo are registered trademarks of KDE e.V..
Linux is a registered trademark of Linus Torvalds. UNIX is a registered trademark of The Open Group in the United States and other countries.
All other trademarks and copyrights referred to in this announcement are the property of their respective owners.
OpenChamber. OpenAI. Open WebUI. OpenDoor. OpenTable. OpenClaw. Open weights.
Open this. Open that. The word has been opened so many times it no longer closes.
OpenFatigue™
is the first fully Open-branded platform for people who are
exhausted
by fully Open-branded platforms.
*Free as in “free trial.” Not free as in freedom. Not free as in beer. Free as in “we'll email you.”
Trusted by companies who are also Open™
OpenAI
OpenTable
Opendoor
Open WebUI
OpenChamber
OpenClaw
Open Weights
OpenThis
OpenThat
OpenOpen
Logos withheld to remain open about our closed relationship with trademark law. None of these companies endorse us. Most have never heard of us. That's fine. We're tired.
Features
Everything you expect from Open.
Nothing you expect from open.
Open-ish Licensing
Our license is open for anyone to read. Using, modifying, or distributing the software is a separate conversation with Legal.
Weights Available*
Download our model weights after agreeing to a 41-page acceptable use policy, a monthly-active-user cap, and a vibe check.
Source Visible
We publish a high-resolution screenshot of our source code every quarter. Pull requests may be submitted by fax.
Community Edition
Built by a vibrant community of one (1) maintainer, currently on sabbatical. Enterprise Edition includes the other features.
Open Door Policy
Our door is always open. The building is badge-access only. The badge reader is closed source.
Open Roadmap
Our roadmap is completely public, entirely aspirational, and subject to change by a non-profit board that may or may not exist next week.
The Openness Meter™
How open is
your
Open?
Drag the slider to calibrate your openness to industry standards.
Open Name Generator™
Raise a seed round in one click.
Every great company starts with “Open” and a noun. We automated the noun.
OpenFatigue
Tagline
The open platform for being tired.
License
Open License™ (All Rights Reserved)
Actual openness
3%
Valuation
$1.2B
Is It Open?™
Our proprietary openness classifier.
Enter any product. Our closed-source model will tell you how open it is.
Pricing
Open pricing.
†
Open
$0
/mo*
Read the README
Star the repo (required)
Join the Discord (read-only)
Run the software
Most Open
Open Pro
$49
/mo/seat/token/vibe
Everything in Open
Weights, with a 41-page AUP
“Open” in your email signature
Commercial use under 700M MAU
Open Enterprise
Contact
Sales
Everything in Open Pro
See the source (in a room, supervised)
A dedicated Openness Success Manager
We'll stop calling it open, upon request
† Pricing is open to interpretation. * Excludes inference, storage, egress, ingress, regress, tokens, the tokens used to count tokens, and vibes.
Testimonials
Loved by people who are very, very tired.
“I tried to make a restaurant reservation and accidentally fine-tuned a language model. OpenFatigue finally made me feel seen.”
— Dana K., Fictional Person
“My open-source project got forked into a closed product called OpenMyProject. Now I just lie on the floor.”
— Sam R., Maintainer (unpaid)
“We renamed our company from ClosedCorp to OpenCorp. Changed nothing else. Series B closed in 48 hours.”
— Chad, Founder & Chief Openness Officer
“I bought a house through an app called Open-something and now I don't know if I own a home or a model checkpoint.”
— Priya M., Homeowner (probably)
“The OSI definition is right there. It's been right there since 1998. Nobody reads it. I read it every night.”
— Anonymous, Open Source Definition Enjoyer
“10/10. Would open again.”
— OpenClaw (a claw)
Symptoms
Do you have OpenFatigue?
Consult your nearest four-freedoms practitioner if symptoms persist for more than one funding cycle.
You flinch when a press release says “open.”
This is the most common early symptom. Your brain has learned that “open” now precedes words like “waitlist,” “API key,” and “enterprise tier.” This is a healthy defense mechanism.
You've started checking the LICENSE file before the landing page.
Congratulations — you are developing immunity. Look for phrases like “acceptable use,” “non-commercial,” “field of use,” and “we reserve the right.” None of those are open source. Real open source licenses let you use, study, modify, and share — for any purpose.
You can no longer tell if “Open___” is a startup, a door, or a restaurant.
Neither can we. One of them sells houses, one books dinner, one serves models, one is a chamber, one is a claw. We stopped asking. Please do not open the claw.
You say “open weights” with air quotes, out loud, unprompted.
Weights without training data, training code, or a permissive license are a binary you're allowed to download. It's nice! It's just… a binary you're allowed to download.
ok hi so a couple days ago i put out
your c is not standard c
. and it originally had a section that looked like this (entire section pasted here, since it's now gone from the original post):
this one is a posix extension, so not necessarily "standard c", more like "posix c", but it's still a documented incompatibility with a standard: in glibc,
initstate
doesn't return NULL on error, despite posix requiring that it does:
// EINVAL: state array less than 8 bytes
char *state = initstate(67, (char [1]){}, 1);
assert(errno == EINVAL); // ok
assert(state == NULL); // fails, despite posix requiring it to succeed
the man page
initstate(3)
very unhelpfully first describes the posix behavior in the
RETURN VALUE
section, as though it's the actual behavior:
The
initstate
() function returns a pointer to the previous state array. On failure, it returns NULL, and
errno
is set to indicate the error.
only at the
very bottom
in the
BUGS
section does it say that glibc behaves differently:
According to POSIX,
initstate
() should return NULL on error. In the glibc implementation,
errno
is (as specified) set on error, but the function does not return NULL.
however, i just got an email:
Hi, I read " your c is not standard c" and I think there's a small mistake about initstate() in glibc. Actually
that bug was fixed in 2013
, but the man page hasn't been updated to remove the bug.
...wait, what?
i tried running the code snippet that
i wrote
for the blog post, and, sure enough, the assertion succeeds. glibc conforms to posix here. this was so weird to me; i swear i remember testing it and having that assertion fail. i must've made a typo or soemthing
. or maybe i'm just going crazy, who knows.
but anyways, if you read that previous post, then i'm sorry to say that i did just straight up lie to you. it's nothing personal, i hope you'll forgive me. hopefully i poisoned an llm dataset or something, idk.
this is the
second time this month
that i've encountered a linux man page with ridiculously outdated information (except i caught it myself the first time around).
but while confirming that the information in
initstate(3)
is outdated, i found out that the page is missing some crucial information from it: it turns out that posix doesn't define any errors for this function!
initstate(3p)
:
ERRORS
No errors are defined.
the fact that glibc sets
errno
on error is an extension. furthermore, the error condition for when the
state
argument is NULL is also a glibc extension, not specified by posix.
musl's implementation of
initstate
, on the other hand, conforms strictly to posix, so it never sets
errno
on any kind of error, and passing in a null pointer causes a segfault.
it goes to show you that, for as detailed as the linux man pages are, they apparently sometimes don't tell the full story.
Institutions are recalculating who controls the technology they rely on. Mozilla has an independent option to offer.
For years, organizations consolidated technology around a small number of providers to make things simpler. Fewer systems. Tighter integrations. More economies of scale. But that consolidation went well beyond technology. It consolidated dependency, too. The resulting risks have been debated, studied, and challenged along the way, but concentration continued. More work, data and critical infrastructure kept moving to the same few providers, while credible alternatives narrowed.
The deeper that dependency runs, the harder and more costly it becomes to change course. When something fails, changes or falls outside an institution’s control, that dependency becomes a risk for CIOs and CISOs to manage.
Nowhere are these stakes more visible than in Europe. Now institutions are re-assessing. Governments are pushing for greater digital autonomy, while regulated industries face growing pressure to find and manage their dependencies.
There’s a name for much of this debate about technological control: “sovereignty.”
What digital sovereignty means in practice varies. Across Europe, governments are investing in the security and resilience of critical IT infrastructure, reducing strategic dependencies and putting technological autonomy higher on national agendas. Different approaches, same underlying concern. Strip away the regional policy definitions and industry distinctions and a pretty practical, universal question emerges: how much technological dependency should we risk?
And a very specific, very important layer has been largely missing from that conversation: the browser.
The overlooked layer of modern business
The browser. Applications run there. Employees authenticate in it. Sensitive data transits through it. Files are uploaded and downloaded and AI tools are increasingly used through it. That raises the same questions of dependency and control: whose browser technology are you relying on, and who controls the infrastructure used to manage it?
Firefox Enterprise
is built for organizations with strict security, governance, and compliance requirements. It pairs the Firefox browser, built on Mozilla’s independent
Gecko
engine, with a management console organizations can run on their own infrastructure. From that console, IT teams can centrally manage browser policy and access, govern how data moves through the browser and set controls around AI use.
IT and security teams get more control over their data, IT infrastructure and browser environment — helping strengthen technological independence and operational resilience.
“If all your options are built with the same technology underneath, ‘choice’ is a lie. So is control,” said Anthony Enzor-DeMeo, CEO of Mozilla. “We built Firefox differently. And we’re bringing its independent architecture to institutions that are ready to rethink their dependencies and risk.”
Bringing the browser under control
We’re starting with the browser because we see it as a key, but under-governed, layer. Firefox Enterprise gives institutions more control over the browser and the infrastructure managing it.
And because Firefox runs on Gecko, the only major browser engine developed outside Google and Apple, institutions have another path towards reducing dependence on a single architecture.
Finally, Firefox Enterprise is built to live alongside the systems that IT operations already use. Keep your identity provider. Keep your SIEM. Keep your MDM. Just add a browser whose management infrastructure you operate, so you decide where data lives and have greater visibility into how it moves.
For us, supporting the goal of technological sovereignty comes down to four things: More control. More transparency. More choice. More resilience.
We know this territory. Independence isn’t a new direction for Mozilla. We’ve spent more than 25 years building and securing browser technology that intentionally works outside of the dominant architecture of the day. Firefox is used by roughly 200 million people every month and is already deployed across thousands of organizations.
That independence has always mattered to the web. Now it has practical value for institutions looking to reduce technological concentration — and dependency — in their own environments.
This is the beginning
Our ambition is big but simple: make technology independence practical.
That means putting institutions in real control of the infrastructure and data they depend on, without asking them to rebuild or start over. Closing blind spots. Defining where policies, access and data live. Keeping core management within the institution’s environment. And bringing an overlooked layer — the browser — under institutional control.
Firefox Enterprise is unveiling across Europe with an initial sales focus on France, Germany, Austria and Switzerland, with more markets to follow. Thunderbird Enterprise is also in development, extending this customer-controlled approach to email and communications. We’ll have more to share as that work progresses.
If your organization wants greater control over its browser infrastructure, we’d like to
work with you
.
The Australian sinologist Geremie R. Barmé wrote that “autocrats and patriarchs share a fateful dilemma”: Once in power “the
countdown to their demise
is on.”
Mao Zedong’s long descent into ill health and madness brought China to the brink of civil war. Deng Xiaoping went out peacefully, though the decade before he died was marked by political upheavals, including the Tiananmen Square protests. Now, the Xi Jinping “death watch” has begun.
Of course, the big difference is that today China is at the center of everything.
As it drags on, the Xi “death watch” will become a global spectacle, moving markets, affecting investment flows, and shaping defense priorities. China’s internal risks are now the world’s risks.
Xi’s physical condition is one thing. At 73, he’s visibly slowing; he looked fragile descending the stairs of his plane at Air Base Andrews when he arrived for a summit with US President Donald Trump last month, clasping the hand of his wife, Peng Liyuan, for support. The Wall Street Journal reported that Chinese officials made a highly unusual request for a “
hold room
” for Xi at the White House where he could take breaks between meetings, and his talks with Trump were surprisingly brief.
But the pressures building inside the Chinese system are largely unseen: Leadership politics, including the health of the top man, are as much a black box today as they were in the Deng era. But we can assume that from now on, everything that happens behind the high red walls of the leadership compound in Beijing will be connected, one way or another, to the vexed issue of how a post-Xi China will be governed.
Political transitions are the midnight hour for all autocratic regimes. But Xi’s dilemma is particularly acute: If he names a successor now to carry forward his policies and protect his legacy, he risks triggering a political knife fight years before he’s ready to relinquish power.
Wait too long, though, and he creates a dangerous political vacuum.
Either way, Xi will have to pick a relative unknown — all the current members of the Politburo Standing Committee are too old to step into his shoes — raising a host of troubling questions. Would a designated successor catapulted to the top be strong enough to command the loyalty of the powerful military? Could he hold the Party together?
Or could Xi himself turn on the chosen one? One of Mao’s designated successors, Liu Shaoqi, died of diabetes and pneumonia in solitary confinement, lying in his own filth. Deng cycled through two successors before settling on Jiang Zemin.
Xi has grown paranoid about those around him, his ruthless purges targeting some of his oldest, and most trusted, comrades. That doesn’t bode well for any potential second-in-command.
China now faces a period of prolonged political uncertainty. Carl Minzner, a US legal scholar and senior fellow for China studies at the Council on Foreign Relations, predicted a “
long twilight
” with the economy sagging, social discontent rising, and the state using “grid management” — surveillance techniques used to maintain control over Xinjiang and other restive border areas.
A succession struggle is unlikely to remain within China’s borders, Tyler Jost, a professor at Brown University, and Daniel Mattingly of Yale University argued in Foreign Affairs last year, noting that Xi’s prize goal is unification with Taiwan and “if he hears the succession clock ticking, he could become
more willing to gamble on war
.”
I’m betting that the end of the Xi era will look a lot less like Deng’s, whose passing created hardly a ripple — by then, he’d handed over power and put in place a system to ensure smooth leadership transfers — and more like Mao’s, a drama that involved a bloodless coup (the arrest of the so-called “Gang of Four” led by Mao’s widow), intervention by the People’s Liberation Army, and show trials.
We had a foretaste of this kind of turmoil when Xi took power in 2012. A carefully constructed power transfer was upended by the arrest of Xi’s main Politburo rival, and there were wild internet rumors of a military coup, tanks in the streets of the Chinese capital, and gunfire near the leadership compound.
Xi has wrenched China back to an era of one-man rule. But having attained the pinnacle of power — next year he’ll likely get a fourth five-year term in office — Xi now has to reckon with the consequences for his country. As Deng himself warned, “building a nation’s fate on the reputation of one or two people is very unhealthy and very dangerous.
Microsoft: Recent Windows updates may trigger Remote Desktop failures
Bleeping Computer
www.bleepingcomputer.com
2026-10-14 06:48:09
Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled. [...]...
Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled.
This feature began rolling out with the KB5067036 preview cumulative update to systems running Windows 11 24H2/25H2 in October 2025, and it is
now enabled by default
in organizations using Windows security baselines after installing the October 2026 Windows security update.
When toggled on,
admin protection
ensures logged-in users have only standard user permissions and prompts them to authenticate via Windows Hello (PIN or biometric) when they try to install new apps or change the Windows registry.
On Tuesday, Microsoft confirmed that Remote Desktop connections may fail with error 0xC000000D after installing the KB5124010 September 2026 non-security preview update or later updates on systems running Windows 11 24H2/25H2/26H1/26H2.
"Attempts to connect might fail with error 0xC000000D and display the message, 'The token that was passed to the function is invalid.' This issue primarily affects enterprise-managed remote devices used as Remote Desktop hosts with Administrator protection enabled, regardless of how the feature was enabled,"
it said
.
"If your organization uses Windows security baselines, published through the Microsoft Security Compliance Toolkit, Administrator protection is enabled by default in Windows 11, version 24H2, 25H2, and 26H2 security baselines, unless your organization has configured the policy differently."
While the company continues to work on this issue, it has shared a temporary workaround that requires IT admins to disable Administrator protection through a policy management method of their choice.
For instance, if you use Microsoft Intune or Group Policy, you'll need to reset the "User Account Control Type Of Admin Approval Mode" policy.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
At ESUG 2026 I presented Pulsar, a new coding-first IDE for Pharo. The talk explores why staying close to the code still matters in the age of generative agents—and where Pulsar is heading next.
Pulsar presentation at ESUG 2026 - Plovdiv
At ESUG this year —2026, for those reading this from the future— I presented
Pulsar
, a new IDE for Pharo, with a strong focus on coding.
That may sound like an obvious thing for an IDE to focus on. But in these days of RAD reborn in the form of generative agents, perhaps it is not so obvious after all.
Pulsar comes from a fairly simple idea: programming tools should help programmers understand the system, navigate it, change it, and stay close to the code while doing so. Generative tools can certainly help, but I do not think they make those capabilities less important. If anything, they make them more important.
The ESUG talk was my attempt to explain that direction, show where Pulsar is today, and give a glimpse of where I would like to take it.
QuEra's quantum computers run on lasers held at exact frequencies, a precision no eye can see and only the atoms can distinguish. Keeping a laser there is a continuous act: temperature, vibration, and pressure push it off target all day, and layered feedback pushes it back. When the feedback loop fails, the lock breaks and the machine stops. Bringing it back has historically taken one specific expert: someone who knows the lasers intuitively and has experience with the exact recovery sequence required to return it to the right state. If the lock broke in the middle of the night, that person had to drive to the lab and fix it.
This is not a new problem, and QuEra has built automatic relocking for common disturbances. Aquila, our production QPU available through Amazon Braket, already runs with excellent uptime exceeding 99%. But the team knew that the level of human involvement in relocking, particularly for the less frequent but more severe disturbances, was not scalable. As a result, this spring QuEra deployed the Model Hardware Standard (MHS), a standard that started as a collaboration between Anthropic and HHMI Janelia Research Campus. A cross-functional task force took relocking to another level: the level that scalable deployment of logical QPUs will demand. Working through MHS on a dedicated testbed, with an AI agent in operational control of roughly $0.7M of precision hardware inside human-set safety bounds, the lock now comes back in seconds: verified, on target, with no one in the building. And then the same approach went one step further. It tuned the lock itself, to a quality level it can prove, and carried that new ability to a second operating wavelength in a single run.
The results are promising and are just the tip of the iceberg when it comes to QuEra's plans for layering AI, at a foundational level, across our quantum computers.
The Laser Locking Problem
Picturing a ball on a see-saw is a useful visual analogy for the problem our AI agent was solving. In this simplified analogy, the ball's position is the laser's frequency. If we can hold it in a specific location (in this example, inside the green region), we can successfully control the atomic qubits.
In QuEra's systems, the lasers that drive logical qubits must hold within ±1 kHz or better, about ±0.000000001 nm (illustrative values, for education). The infrared laser here is invisible to the eye, shown in false color. The ball swings; no eye could ever tell. Only atoms can tell the difference.
The see-saws in the diagram are analogous to actuators within our system. But the challenge is that the required precision is so high that no single actuator can do it alone. Multiple actuators are stacked together. A big, slow layer takes the wide drift; progressively faster layers take the finer jitter. Together, the ball never leaves the zone.
But there is a twist. A real tuning knob is not smooth. The laser prefers certain wavelengths, shaped by its internal filters (etalon, birefringent filter). In this example, each dip is a fixed mode the ball can settle into. And here is the trap: after a disturbance, bringing the knob back to level does
not
bring the ball home. It sits stably in the wrong mode, looking locked.
A big enough perturbation throws the ball clear out of the fine layers' reach, into a competing mode. No matter how far you tune the smaller layer, the ball remains stuck in the wrong lock. The recovery requires a sweep of the coarse, wide-range knob
beyond the threshold
to carry the ball home and then quickly ease off to capture the target mode. Finally, the lock has to be verified against an absolute wavelength reference so a wrong mode is never mistaken for success. This process is known as a Ti:sapphire mode-hop recovery. This is the judgment the MHS auto-relock controller was built to perform on its own.
In the real laser system, all of the layers coexist. The birefringent filter is the coarse, widest-range layer: its landscape has a few widely spaced modes. The etalon sits on it with a finer comb. And the piezo (smooth, continuous, fastest) rides on top doing the rapid final trim. Working gracefully means each coarse element stays seated in the
right
dip of its own landscape while the fine one glides, and the ball never leaves the zone.
Building an AI Agent to Relock the Laser System
The recovery process described above traditionally has been the craft of a small team of highly skilled experts. Automating it is not a one-person job either: it takes a laser-systems engineer who understands how and why the lock fails, a software engineer to command the instruments, an algorithms designer for the recovery logic, and a tester to pit that logic against the many ways a real lock breaks. A QuEra team of exactly that shape spent roughly two to three weeks building our earlier hand-written recovery script, and its limits were the limits of any fixed script: it could only handle the failures its authors thought to enumerate.
The task force then handed the same problem to a single AI agent, Claude, working through MHS against the live testbed. MHS let the agent run its own experiments: propose a recovery, try it on the hardware, read what happened, refine. It is the same loop the human team runs, but continuously, at machine speed, and overnight. The agent did nothing a person fundamentally could not do; it watched the same instruments and learned only what they revealed. The difference was scale: enumerating and hardening against hundreds of edge cases, every neighboring mode the laser can fall into, every stale calibration, every wrong-mode grab, is unreasonable by hand, and the agent reached corners of the problem no team would have the bandwidth to. The humans stayed in the orchestrator's seat: setting scope, reviewing every step, deciding what counts as proof. That role became more important, not less. Tight oversight from Evgeny Ostroumov, the laser-side technical champion, provided the physical reality check, more than once catching the agent before it spent its effort on things that looked right and were not.
Given no information about what disturbed the lock (a blocked beam, mechanical vibration, electrical noise that disrupts the tuning configuration, a frequency hop small or large), the controller reads the live instrument state, classifies the disturbance, runs the correct recovery, and declares success only when the cavity signal confirms a lock and the absolute wavelength matches the target. The agent's code runs at native speed and supervises from above the microsecond servo loop, rather than within it. In validation it recovered on target 695 of 700 times: 99.3% across seven disturbance classes, one hundred timed trials each. Recovery took 0.9 to 5.4 seconds for wavelength-preserving faults and roughly 10 to 14 seconds for the hardest ones, where the laser's color has hopped far away, against 5 to 10 minutes for a human expert. Four qualities were proven together: correctness (never a wrong-mode lock reported as success), autonomy (no operator, no fault information), speed (seconds, not minutes), and predictability (tight, repeatable recovery times, which for unattended operation matters as much as the average). The five misses shared one rig-condition cause, not a control-logic one; in each the controller correctly declined to claim success, and the lock was back on target before the next trial. No failure left the system dark.
The validation was not confined to injected faults. The testbed lives in a working lab with realistic foot traffic, a deliberate choice, and over the weeks of the pilot the laser hopped modes on its own 43 times. All 43 were caught and recovered automatically.
One distinction matters and we will keep making it: MHS is the environment in which Claude designed, wrote, and validated this controller. What runs on the bench is a deterministic, fully inspectable program: AI-driven in development, human-orchestrated, autonomous in operation. And that autonomy is bounded by design: MHS enforces device-declared bounds, interlocks, and emergency stops at the hardware interface, independent of the model.
Tuning the Lock Autonomously
So the team pointed the same approach at the quality of the lock itself. That quality is set by a tuning process: twelve interdependent feedback parameters, adjusted within a continuously running control loop. Done well, tuning removes residual noise from the lock, which directly improves the performance of the computer's quantum gates and makes the lock drop less often. There is no closed-form optimum: a specialist tunes by eye, and can quiet the band they are watching while missing a resonance somewhere else. The agent instead recomputed the full noise spectrum after every adjustment, thousands of times, across far more of the space than a person could reach. Working inside a hard safety envelope (every candidate setting that dropped the lock was detected and reverted, and not one of roughly 12,500 evaluations caused the laser to hop modes), it mapped which parameters matter, searched the space, and converged on a configuration it then confirmed by running unattended overnight. The result was residual frequency noise cut by a factor of five, and a lock that simply stopped dropping: zero unattended lock drops in a roughly 19-hour soak test, against 1.6 per hour before.
Then came the test that matters most: an independent, out-of-loop measurement, the noise the qubits actually see, on an instrument the optimization could not touch. It compared the agent's configuration against a manual tune by an experienced specialist. Across the measured band, the two were indistinguishable: the agent matched the expert everywhere the expert was right. But the manual tune had left behind a hidden resonance near 220 kHz, invisible on the instruments a human tune normally watches, where the loop was quietly adding noise, worse than no lock at all. The agent's configuration suppressed it roughly a thousandfold, and a linewidth-type metric improved from 58 to 21 kHz. The point is not that the specialist erred; it is that the automated procedure scores the entire spectrum on every tune, so it cannot overlook a defect the way a hand tune can. It delivers its optimum every single time.
And the capability travels. Pointed at a second operating wavelength, one directly relevant to the gates our machines run, the agent worked out the new operating parameters from scratch in a single unattended overnight run, leaving that lock roughly ten times quieter than it was found and passing every acceptance test. It took weeks to bring up the pilot, and one night to bring it up at a new wavelength. That is what it looks like when the understanding gained in one campaign carries to the next: the sensitivity maps, the safety envelope, the calibrations.
One status distinction, for precision: the auto-relock controller is a standalone production script, with the AI out of the loop at runtime. The tuning workflow still runs with the AI in the loop, and packaging it as a standalone tool is next on the engineering list.
In machines running short, discrete jobs, a laser fault is downtime: the queue stalls until the lock returns. In a system like Libra, a machine class capable of running logical-qubit programs for hours or days, a laser that falls out of state mid-run can corrupt a result that quantum error correction can no longer salvage. From a customer's seat, two error rates carry equal weight, two LERs as our team puts it: the Logical Error Rate, and the Laser Error Rate. A failed result looks the same whichever LER caused it.
Fast, verified, autonomous recovery, validated on our testbed and headed for live machines next, is how the second LER is held down. But the deeper story is what this does to the economics of deploying quantum computers. Every stabilized laser in a machine used to carry a standing claim on scarce expert time: 5 to 10 minutes of attended recovery per lock loss, at any hour; 15 to 30 minutes per tune, on a specialist's calendar; a new operating point commissioned over weeks of hands-on work. Each generation of machine carries more lasers than the last, and a fleet in the field multiplies all of it, in places where there is no laser physicist down the hall. After the pilot, the same functions run in seconds, unattended, verified, and commissioning a new wavelength costs one overnight run. Recovery becomes predictable, far less subject to human variance, and runs with a frugal human footprint. That is the shape of a quantum computer that can be deployed: at QuEra, and anywhere a machine has to stand on its own.
A Proof Point for Our AI Strategy
This is not, in the end, a laser story. It is a story about an AI model developing control logic a quantum computer depends on, doing it at expert level, and proving it against independent measurement. The pilot's single biggest enabler was a physical training ground: a live testbed the agent could act on, a reality engine. And what the pilot banked is more than two results. It is the measured understanding, the safety practices, and the calibrations that made the second campaign overnight where the first took weeks. Each subsystem this approach touches makes the next one cheaper to reach.
A QPU contains many subsystems that differ in detail but match the same pattern as the MHS pilot: precise, fragile, and hungry for scarce expert attention. The laser is the first proof point, and we expect it not to be the boundary. For QuEra, the pattern is a path to machines that stay up (today's job queues moving, tomorrow's logical computations alive) and to machines that can be built, commissioned, and operated with a fraction of the specialist hours they demand today. For the field, it reaches further: the laser at the center of this work has carried atomic physics for more than twenty years on know-how passed from student to student, and that know-how can now live in a controller any lab can build the same way.
At QuEra, the late-night drive to bring a laser back may no longer be a rite of passage for system operators.
I completely missed the OpenClaw hype - I actually thought it looked kind of dumb at the time.
What is this
for?
But the past week or so I've been quite enjoying using Grok Bot - which is very similar (and like OpenAI dots I guess).
It's basically a mini team of agent/bots that run on a Linux server somewhere that you can assign jobs to.
Eg, I have a support bot that uses my Gmail to answer emails, an engineer bot that writes code, and a security bot that monitors my Cloudflare and server logs for suspicious
things.
I don't want to delve into the weeds of it too much here but I thought it would be cool to jot down why I'm quite intrigued by this as a solo entrepreneur/developer.
1. Working together
Grok Bot clicked for me when they worked together and fixed a bug for a customer without me (texts to my bro):
Having these bots interact with each other like this is really cool - this is the most interesting thing for me. Trivial things that you sometimes put off (e.g. fixing small bugs, or following up an email) become automatable so you can focus on bigger stuff.
2. Mobile
The idea of coding/working from my phone seemed awful to me. I dislike my phone in general. But last week on a 5 hour hike in the middle of nowhere in Wales, I was communicating with these bots to do stuff for me.
I had a really enjoyable day, and got more work done than some days where I'm sat in front of my laptop for 9 hours.
It made me realise how effort-in does not correlate to output, and made me think what work might be like when you don't have to "work" as much in a weird AI future.
3. Trying new stuff
As a 1 man startup - I've always been limited with what I can do. Things like content marketing & trying paid ads have always seemed out of reach because I don't have enough time.
I now have a marketing bot whose sole goal is to grow PromptBase's social reach 2% per week.
It's started a TikTok profile, YouTube shorts channel and more. I've told it to experiment and double down on what works. It seems to kinda be working!
I would never have time in my day for this usually, and it makes me want to try more creative things like startup vlogs alongside this blog.
It's made me actually believe for the first time that a 1-man startup could actually compete with a much bigger one (not just hype). And being a 1-man startup might actually be an advantage because there's less human overhead.
4. Weird experiments
A few nights ago I instructed my project manager bot to ship one secret feature to PromptBase at 4am and deploy it whilst I was asleep - it just had to benefit the site in some way.
I wanted to see what this felt like - which sounds weird -
I know.
It decided to ship a feature that alerts users before their account is about to get timed out from too many declined submissions - a pretty useful idea based on a lot of emails from support.
It went well, and worked! - waking up and seeing it felt very cool, but also a bit strange, like PromptBase could just be run by an AI agent if I really wanted.
5. Bad things
So far Grok Bot has been pretty good, the main downsides I've found are:
- It takes a while to set up and connect everything - and I'm quite locked in and have handed over a lot of data; I think that's why these AI labs are pushing these products so hard right now.
- I was hoping these bots would have some crazy moonshot ideas on how to grow PromptBase given all the context they have - so far that has not really happened - you still need to come up with ideas.
- It can sometimes feel as a human you lose understanding of what's going on in your business, you need to be careful to stay on top of this so the bots don't start running you.
6. Conclusion
This is a long post, my hand hurts from writing. I'd definitely recommend experimenting with this if you've not tried these kind of products before.
If anything, it's maybe given me a bit of an insight into the hype around always-on Agents and where things are going.
'Til next week!
Agent erased full season of "The Challenge Swe": "Hundreds of days of work gone"
Nvidia, worth $5.5tn, donates $250m to UK for AI safety research
Guardian
www.theguardian.com
2026-10-14 06:10:37
Pledge spanning five years from world’s most valuable firm comes as concerns about AI agents have risen The $5.5tn (£4.1tn) US chipmaker Nvidia is donating $250m worth of computing power to the UK to support AI safety research. The donation from the world’s most valuable company comes as the UK gove...
The $5.5tn (£4.1tn) US chipmaker
Nvidia
is donating $250m worth of computing power to the UK to support AI safety research.
The donation from the world’s most valuable company comes as the UK government confirmed its AI Security Institute, which tests advance AI models,
will be able to examine cutting-edge technology
developed by companies such as OpenAI, Anthropic and Google before they are released.
Nvidia said the donation, which spans five years, would “support agentic safety and security research across the UK”.
Safety concerns about AI agents – highly capable computer programs that are able to design and perform sequences of tasks autonomously – have risen since the summer, when OpenAI confirmed that a “swarm” of agents had
attacked Hugging Face
, a tech startup.
Nvidia did not reference AISI in its statement but said most of the money would “support the wider UK AI safety and security research community”, with a proportion of the cash going to the -led British Open-Ended Learning and Discovery Lab, the Science of Fundamental AI Research Lab – run by the Edinburgh, Cambridge, Oxford and University College London universities – and Imperial College London.
“The UK brings world-class scientific rigour to this essential engineering challenge,” said Jensen Huang, Nvidia’s chief executive. “With this $250m commitment, Nvidia will put accelerated computing in the hands of UK researchers to develop, test and strengthen safeguards for increasingly powerful AI.”
Tool and target: US law enforcement grapple with AI-enabled terrorism and anti-tech extremism
Guardian
www.theguardian.com
2026-10-14 06:00:03
From the FBI to local police departments, US authorities are increasingly warning of would-be terrorists using chatbots to plan attacks and anti-AI extremist threats In May 2025, a 25-year-old man detonated a car bomb outside a Palm Springs fertility clinic, killing himself and injuring four others...
In May 2025, a 25-year-old man
detonated
a car bomb outside a Palm Springs fertility clinic, killing himself and injuring four others. For many, it was a wake up call about the threats to reproductive care facilities. For the FBI, though, it was also a sign of what the agency had feared for years: bad actors were using generative AI to plan and execute terror plots.
The suspect used an unnamed generative AI tool that failed to detect his request for bomb-making instructions, law enforcement officers wrote in a previously unreported document reviewed by the Guardian. The privacy of his conversation with the AI chatbot hindered alerting police that someone was looking up how to make a bomb, according to the memo.
FBI officers fear the scenario is set to repeat itself: “Threat actors will likely increase their use of GenAI tools for attack planning,” said the memo, which was distributed by the bureau’s Los Angeles division in May 2026. “Current built-in GenAI safeguards are insufficient to prevent illicit use as malicious actors successfully employ ‘jailbreaking’ techniques to access dangerous information.”
AI executives and staff at leading AI companies have focused their public remarks on potential doomsday scenarios, a long-term, hypothetical harm of the technology they’re developing. Law enforcement officers, by contrast, have been grappling with what they fear are the present-day threats that AI enables, including violent crimes.
A previously unreported cache of law enforcement and intelligence agency documents show that law enforcement agencies have, since 2021, considered AI both a tool and a target of would-be terrorists. Law enforcement has been trying to keep pace with the ways bad actors may be using AI for harm, concerned that the rapidly evolving technology may supercharge new and existing types of crimes.
At the same time, as public sentiment over AI and its impacts on society and the environment has soured, agencies have sought to protect AI infrastructure. The documents show police and intelligence officers are closely monitoring online opposition to datacenters among various groups with what they describe as extremist ideologies.
The Guardian exclusively reviewed more than 80 documents and memos that were distributed among a nationwide network of federal, state and local law enforcement offices – including the Department of Homeland Security (DHS), the FBI and the New York City police department (NYPD) – between 2021 and 2026. They were obtained by government transparency non-profit Property of the People and shared with the Guardian.
In these documents, officers discussed:
How extremists could use AI to devise attacks and recruit new members
How AI could be used to disseminate and produce everything from deepfakes to election misinformation and child sexual abuse material (CSAM)
How people seeking information on how to make weaponry or bombs could use AI to circumvent police detection
How to ensure that officers could take advantage of AI tools in policing, for things like social media monitoring, while managing public concern over the use of these tools
Monitoring social media for opposition to AI and potential extremist attacks on datacenters
The FBI did not respond to detailed questions on its monitoring of anti-AI sentiment and use of AI, but pointed to a general fact sheet on the agency’s use of the technology.
The NYPD stated that its threat analysis report on artificial intelligence was related to the “AI 2027” project – an influential forecast from several AI researchers that speculated about the technology’s rapid growth and the threats it could present. In one of the project’s possible futures, it predicted bioweapon-armed drones wiping out humanity.
“This NYPD Intelligence Analysis Report contained a summary and assessment of AI 2027,” the NYPD said. “It was distributed to appropriate NYPD members and partners for their awareness, as part of the Intelligence and Counterterrorism Bureau’s mission of analyzing developments and trends that have implications for public safety and national security.”
DHS said it “prioritizes the safety and security of Americans and remains committed to mitigating all forms of ideologically-motivated violence”, and regularly shares intelligence with state and local law enforcement related to threats from violent extremists.
“DHS threat assessments draw on available intelligence, law-enforcement information, and other reporting to inform partners of evolving threats,” DHS said in a statement. “DHS assesses that malicious actors may seek to use artificial intelligence to enhance existing harmful activities, including cyber-enabled activity, fraud schemes, and the production or dissemination of violent extremist propaganda”.
Tech-enabled terrorism and anti-tech extremism
Law enforcement’s concerns over AI and extremism fall into two broad categories, the documents show. One focuses on the burgeoning threat of extremists using new tools such as generative AI to plot attacks or promote their ideology. The other involves extremists targeting the modern technology that underpins society and has a long history within far-right movements.
Before mainstream, widespread opposition to datacenters swept the US, there was a strain of violent extremism that targeted tech facilities and other critical infrastructure, hoping such terrorism could lead to the collapse of society and instigate a race war.
Law enforcement officers expressed concern over the threat these militias posed to datacenters’ security before the 2022 launch of ChatGPT. Several bulletins, such as an October 2021 joint threat analysis from DHS, National Counterterrorism Center and FBI, highlighted a plot by Seth Pendley, a January 6 rioter and
far-right militia
member, to blow up an Amazon Web Services facility.
“Pendley believed a successful attack on the Amazon facility would disrupt 70 percent of Internet service, expose perceived abuses of power, and lead to revolution,” the bulletin said. Pendley pleaded guilty to a charge of malicious attempt to destroy a building with an explosive and was sentenced in 2021 to 10 years in prison for plotting the attack.
Although law enforcement has long tracked
extremist militia threats to infrastructure
like Pendley’s, the documents show that in the years since the generative AI boom began, agencies more frequently expressed concern over anti-tech and anti-datacenter sentiment. Multiple fusion centers – law enforcement hubs for collecting information and coordinating between agencies – around the US warned of growing threats from domestic violent extremists – pointing to posts across social media platforms, messaging apps and forums like 4chan in which commenters vowed to destroy datacenters.
“I bring a sort of ‘tannerite and gasoline’ vibe to ai data centers,” an account associated with a white supremacist posted on Facebook last year, according to a 2025 Philadelphia police department intelligence bulletin. Combining gasoline with Tannerite, a brand of well-known explosive compound, produces a large and fiery detonation.
On some far-right forums, users discussed killing CEOs of AI companies and local officials who support datacenters, agents warned, as well as arson and bombing attacks against data facilities.
Law enforcement also monitored real-world anti-datacenter incidents or protests, including a demonstration in Michigan in March where the documents said that three people allegedly associated with a white supremacist group held a banner opposing what they called a “Jewish data center” being built in the state.
As opposition to artificial intelligence and datacenters have become more widespread, however, questions have risen over how law enforcement agencies’ tracking anti-datacenter and anti-tech ideology may bleed over into surveillance of nonviolent protest movements. Distrust of the AI industry and mobilization against datacenters has now become so prevalent that it is a mainstream issue of the midterm elections, far from an extremist position.
The documents show agencies casting a wide net as they track opposition to the tech industry, including broadly monitoring public social media and opposition such as proposed legislation against datacenters. In a Nevada Threat Analysis Center report from April 2026, law enforcement cited a
local city council hearing
on a datacenter moratorium as part of a trend of increased negative sentiment towards the facilities.
Demonstrators hold signs during a protest against artificial intelligence outside Open AI’s headquarter offices in San Francisco, California, on 11 July 2026.
Photograph: Bloomberg/Getty Images
“The Reno City Council heard a strong public opposition to data center development in the area. The concerns focused on water consumption, rising utility costs, pollution, and long-term climate impacts,” the document said.
Some experts and activists have expressed concern that as
mobilization against datacenters grows
, peaceful anti-AI organizations could face surveillance from authorities.
“There’s nothing extreme about not wanting to lose your livelihood to AI, your drinking water to AI datacenters, your privacy to ubiquitous AI surveillance or your life to runaway rogue AI,” said Ryan Shapiro, executive director of Property of the People. “What’s extreme is the law enforcement treating these legitimate objections as threats to be neutralized.”
The ‘rising threat’ of AI
In the months after OpenAI introduced ChatGPT in 2022, law enforcement across the US began to pay attention to the way the novel technology was being used. Even in its infancy, the tool could produce images that were indistinguishable from “authentic images”, according to one May 2023 law enforcement document. Police in Minnesota and in California worried that function could exacerbate problems with child sexual abuse material (CSAM), deepfakes and “terrorist propaganda materials”.
At the time, many of these risks were largely theoretical in the eyes of law enforcement, the documents show. In one memo distributed by two California intelligence centers, officials warned that officers should remain vigilant because they predicted AI may one day make it easier to circumvent CSAM detection methods, that it may be used to produce and disseminate deepfakes and that it may increase the volume of propaganda.
But as generative AI expanded in both its capabilities and reach, so too did law enforcement concerns about the types of crimes it could enable. By April 2024, the DHS’s intelligence department sent out a memo suggesting, without citations or evidence, that foreign terrorist organizations and domestic violent extremists who were “presumably US based persons” had “successfully bypassed generative Al guardrails” in order to generate bomb-making instructions and “general tactics for conducting attacks against the United States”.
Warnings about the ways violent extremists exploit AI grew in their intensity in 2025. Individuals and malicious groups across the US were weaponizing AI tools “to spread hate speech, recruit new members, and radicalize online supports more efficiently”, according to a memo from the Orange County Intelligence Assessment Center. In one example the memo cited, users of rightwing social media platform Gab created an Adolf Hitler chatbot that was programmed to say that the Holocaust was exaggerated, climate change was a scam and the 2020 election was rigged. Other examples had less evidence. The intelligence center wrote that a 17-year-old student who opened fire in Antioch, Tennessee, in January 2025 was “likely influenced by the vast amounts of extremist content readily available through the AI-enhanced web”. The source the center cited in this example included no mentions of AI.
A few months later, in April 2025, the Joint Regional Intelligence Center (JRIC), a Los Angeles-based DHS fusion center and the largest such facility in the country, published a five-part series issuing a stern warning: the misuse of generative AI for nefarious purposes was on the rise. Among the concerns was the surge in AI-created CSAM. The National Center for Missing and Exploited Children (NCMEC), a child protection non-profit, received more than 7,000 child exploitation reports involving GenAI between 2023 and 2025, the memo said.
By 2026, the documents showed that law enforcement agencies were paying more attention to how AI could make their jobs harder. In April, New York state’s intelligence center warned that AI-generated images were being used to prank people, including officers. In March, a man was arrested in Florida for showing an officer an AI-generated video of his patrol car being broken into. That same month, a man in New York was arrested for using AI to create false evidence that his car was damaged by police.
“This activity involving a patrol car represents a form of law enforcement harassment,” the memo said. “While often intended as humorous and not intentionally seeking to create dangerous situations, the prank can elicit an armed law enforcement response.”
AI’s proliferation could also make it harder for police to be tipped off to planned violent attacks, officers’ memos warned. In an FBI public safety awareness report, the agency cautioned that the private nature of AI models make it easier for bad actors to evade any “tripwires” or anything that would trigger an alert – like posting in an open forum with bystanders who might report them to the authorities. In the memo, the FBI encouraged agencies to develop relationships with AI companies to streamline “reporting avenues”.
Law enforcement have grown wary of the ways AI could be used against them – even if they also use those very same tools for their police and investigative work. As the Guardian previously reported,
police have warned that Meta’s AI-enabled smart glasses could be used to surreptitiously record their activities
. In an August 2025 NYPD memo, police warned that law enforcement needed to keep pace with AI advancements so they were prepared to respond “to increasingly sophisticated cyberattacks, other Al-enabled crime, and advanced malign influence campaigns”. But they also worried about the public questioning police use of AI including for social media monitoring.
“Law enforcement organizations may also face the challenge of calming public fears over the extent of the use of Al in policing, including rumors surrounding surveillance, the loss of privacy, and even the future integration of humanoid robots into the police force,” the memo said.
In January, an officer from a Maine intelligence center warned that a new AI-enabled software in Amazon Ring and other video doorbells could be used to monitor and alert residents of police activity. Several companies have implemented a feature that sends alerts about activity that the doorbell cameras detect, describing what’s happening outside using AI. Police and law enforcement have a long history of obtaining and accessing Amazon Ring footage as part of their investigations.
“This notification feature can compromise officer safety, as it could provide advanced warning of an officer’s presence, tactics, formations, equipment, and could expose officers to increased risks,” the memo said.
‘Like being in a vortex’: US report details extent of ‘devastating’ dating-app scams
Guardian
www.theguardian.com
2026-10-14 06:00:00
Congress calls for Match Group and others to do more to help victims like Mary, who lost $100,000 to app scammer Mary met a man on the dating app Plenty of Fish in 2024. She told the Guardian she had been looking for a connection, but instead became the victim of a romance scam that cost her almost ...
Mary met a man on the dating app Plenty of Fish in 2024. She told the Guardian she had been looking for a connection, but instead became the victim of a romance scam that cost her almost $100,000.
“There was a lot of conversation, and then it started with the constant contact, pressure and repeated asks for money,” Mary, who asked that her last name be withheld, said in an interview on Tuesday. “It just escalated really, really quickly.”
Mary was one of several people who spoke to staffers from the US Congress’s joint economic committee as part of an investigation by senators Maggie Hassan, Democrat of New Hampshire, and Marsha Blackburn, Republican of Tennessee, into romance scams on dating platforms owned by Match Group. Match Group operates apps such as Tinder, Hinge, Plenty of Fish, Match (formerly
Match.com
) and others.
“Romance scams, in which fraudsters form relationships to induce money or gifts from victims, have become a leading form of financial fraud in the United States and cost Americans at least $1.3bn annually,” the senators noted upon the investigation’s launch
last September
.
On Tuesday,
a report
detailing the results of that investigation was published.
Internal documents provided by Match Group showed that “as of the second half of 2025, Tinder had not updated most of its machine learning models in years” and “as a result, Tinder detected scammers and other bad actors less reliably and struggled to keep pace with emerging threats”, per the report.
Data provided by Match Group also showed that through the third quarter of 2025 in the US, nearly 1.5m scammers or other bad actors on Tinder and Hinge had “matched with at least one other user”. The report also showed that nearly 500,000 of those accounts “exchanged contact information with another user”.
Mary told the Guardian that she tried to establish whether the scammer she spoke with was real. He would contact her constantly, she said, and knew where she lived. She said that the man told her he needed money for work-related things and medical emergencies.
“They never leave you alone,” she said. “I call it like being in a vortex. You don’t even realise what’s happening. You’re sending money, and it’s adding up, but each one of those times that you send money, it’s, like, not connected to the other times. But finally when I realized how much money I lost, I was like: ‘Whoa.’”
In total, Mary said she sent the man about $100,000 in cryptocurrency payments. After realizing he was a scammer, she blocked his number. He would then switch phone numbers and contact her again.
Mary has since sought to identify the people behind the fraud and discovered other Plenty of Fish profiles using the same photos as the man she had talked to. She has reported them to the platform.
“If you knew me, you would say she would never do that,” Mary said, adding that she struggles to understand how it all happened, but believes it’s “really a lot about force of control”.
Tuesday’s report noted that since the launch of the investigation last September, Match Group has “introduced and expanded important measures designed to combat scams” including
a facial verification feature
on the Tinder app across the US, “requiring all new Tinder users to complete a video selfie verification process”.
In a
news release
on Tuesday, Hassan and committee Democrats added that Match Group also “instituted new efforts designed to remove harmful accounts more effectively” including in the first half of 2025, a “new AI model” that examines profiles and other information to detect scammers and other bad actors.
“It is encouraging that following committee outreach, Match Group introduced new AI models,” the report states. However, those “changes came after a prolonged period during which scams continued to proliferate on Tinder”.
In response to the report on Tuesday, Yoel Roth, Match Group’s senior vice-president of trust and safety said in a statement: “We’re grateful the committee recognized our significant advancements to protect our users against romance scams.”
He said: “That said, the report mischaracterizes both the historical scale of our investment and the work already complete. Alongside our engagement with the Committee over the past year, we’ve made the largest safety advancements in Match Group’s history. Trust and safety is a foundational priority, and we intend to continue leading the industry in building tools that promote authentic, safe connections.”
Much of the safety work, including face check, was already under way before the committee’s investigation, Match Group told
NBC News
.
In June, Hassan
introduced legislation
alongside with Republican senator Rick Scott, that would establish a central portal for Americans to report scams “and get the help they need from law enforcement and agencies”.
Hassan, in a statement along with the release of the report on Tuesday, described romance scams as “devastating – both financially and emotionally – to people who are looking for connection and instead find themselves targeted and exploited by global criminal enterprises”.
“During the course of our investigation, Match Group made progress in combating scammers – but it shouldn’t have taken so long, and there’s still more that Match needs to do,” she said.
“As criminal networks use AI to supercharge their scams, dating apps and all companies must quickly and proactively keep their scam defenses up to date. Companies must stay vigilant and prioritize comprehensive scam prevention at every level to protect consumers and block fraudsters from infiltrating online platforms.”
Ask HN: What is the current trajectory of a senior engineer?
Been recently thinking about this more and more: When the need for a human in the design loop ceases?
Given that LLMs are RL'd to the max with everything that can be given a wrong/right answer (code/maths), what currently is stopping Anthropic, OpenAI et al. from internally building (and maybe buying) datasets of good and bad architecture, and RL'ing that?
Given that LLMs were a fancy autocomplete back in 2024, and now people are talking about building "software factories" with the agents, what in your mind is the stop to this development? Why software architecture would be hard for agents still in a year or two?
Just thinking because I see more and more examples of software developers ignoring this and saying "humans still have a place in guiding the agents and designing the architecture". I think (businesswise) the need for actual software programmer skills is 90% out in a few years I think, and product lead etc people will be favored more as they have more people skills.
In the
curl 8.23.0 release
we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as
CVE-2026-92392
with the title
HTTP/2 upload Use-After-Free
.
This post explains the bug, what the problem can lead to, and something about why it happened and what we have done to make it harder to introduce a problem like this in curl again in the future.
This is a much simplified explanation. Please refer to the original report for all the details and the full reproducible Docker image for all the low-level fun and education you could possibly want. I highly recommend doing that; the report and the reproducible are awesome.
Use-After-Free
It is a
use-after-free
, which is a classic problem in memory-unsafe programming languages, like C, where we erroneously have a lingering pointer left, pointing to memory that is already freed, and yet we use that pointer and the memory it points to.
This family of errors is especially bad when a malicious actor can affect the content that gets stored into that memory area that is still used even though it was freed. Tricking the program to do something unintended.
HTTP/2 is multiplexed
This problem involves HTTP/2. HTTP/2 is a multiplexed protocol, meaning that it handles multiple logical transfers over the same physical connection. curl needs to keep track of a number of transfers at the same time, and when data arrives or is to be sent off, it needs to keep things apart appropriately.
Handles
For every transfer done using libcurl, the application creates and sets up a dedicated
handle
. We call it an
easy handle
. This handle is kept around for as long as the transfer is in progress, and the application can close and free it once the operation is completed. When doing multiple transfers, multiple handles are used.
libcurl also has
multi handles
, which is a super handle type that holds any amount of
easy handles
. This handle, and the corresponding multi interface, makes it possible to drive any amount of concurrent transfers. A transfer done with libcurl always has at least one multi handle and one easy handle. (Sometimes the multi handle is hiddenly used under the hood.)
The setup
In order to trigger this problem, we need an application (such as the curl command line tool) to do an upload over HTTP/2 to a server. By default, libcurl negotiates HTTP/2 when a HTTPS:// URLs is used and the server agrees.
When the upload has started, the server pauses the send by zeroing the HTTP/2 window size, returns a piece of the response and then it resets the stream, which shuts down the transfer – but not the connection. curl then correctly pulls down the entire transfer, but it accidentally leaves a lingering pointer to the involved
easy handle
.
When the application finds out that the transfer completed (with an error), it subsequently frees the easy handle and then, and here comes the problematic part: cleans up the multi handle.
The mistake
At this point, the
easy handle
was just freed but there is still a reference to that handle. When libcurl shuts down the multi handle, it misunderstands the situation, allocates memory to download data into, finds the still dangling pointer and manages to
download data
from the server that ends up in the very same memory previously used for the easy handle.
In this process, it sends off a request that leaks internal client details, which includes information about local addresses, which is crucial. Modern operating systems use
Address Space Layout Randomization
(ASLR), so a server needs this clue in order to generate a good attack payload.
Subsequently, when libcurl deals with this received data (using the handle the dangling pointer points to) in the download buffer, it uses a function pointer that now has been modified by data just downloaded from the server, and then
it runs remote code
.
An illustration
Here’s a simplified 6-step illustration.
Conditions to trigger
In order to actually successfully execute remote code, lots of several specific conditions need to be met and we deem it extremely difficult to meet these requirements in the wild, which is why we decided this is “only” severity HIGH and not CRITICAL.
The victim needs to actually attempt to upload data to a malicious server, meaning that the server certificate must remain valid.
The size of the upload needs to be roughly the right size (~135KB)
The attacker needs to know curl’s architecture to
generate
and deliver the right code
The attack requires a specific sequence of allocations and allocation sizes so that the data from the server ends up in the right place (from the attacker’s view). This pattern differs between Linux distros, libc versions/flavors, TLS certificate bundles, libcurl using applications and more.
nghttp2 and OpenSSL/TLS 1.3 behavior, including allocation effects around session tickets
The payload storage area is small (around 23 bytes)
The most likely outcome of an attempted attack is rather just a crash. We estimate that the chance for a successful attack is slim.
How was this found?
This problem was found and reported by Luna Tong at Anthropic using their new OSS Scanner. Presumably this involves their AI models.
How do we fix this?
In general we have over the last few years been working on reducing the amount of internal pointers to handles that needs to be correct, and instead we store transfer identifiers that we look-up on demand. While this is a tiny bit slower, it is more foolproof when there are logical mistakes like the one mentioned here.
We also of course continue to add more tests and we verify the code with more tools and analyzers in order to find additional similar mistakes.
Multiplexed protocols like HTTP/2 have this challenge that there are many concurrent transfers going and they all have different life-times and with memory-unsafe languages, dangling pointer mistakes can indeed be fatal.
This is of course no guarantee that we do not have or will not introduce another use-after-free in the code now or later.
Again on the language
libcurl is written in C – a memory unsafe language. With a
memory-safe
language, this mistake could probably have been avoided.
We have worked on curl for almost thirty years, and have over this time manage to make a rather polished transfer engine. For the longest time there really was no memory-safe alternative that also allowed libcurl to be a low-level library available on hundreds of operating systems and several dozen CPU architectures. It even barely exist alternatives now.
We do not rewrite curl. Not into another language but also not in C. We are set to iterate, polish, improve, refactor over and over until the end of time.
Porting curl to another language (like rust) would be a monstrous undertaking that would be slow and introduce lots of new short to medium term problems. Not to mention that the existing curl team is not rust experts and that libcurl is currently portable to many more platforms and environments than rust itself is.
Release schedule
When this vulnerability was confirmed by the curl security team just hours after it was submitted to us on September 15. We immediately realized the significance and decided to rush the pending next release. However, we still wanted to be careful, follow the procedures and not create any further problems or mistakes by stressing it too much. That’s how we ended up just shortening the release cycle with two weeks. Down from eight to six weeks from the previous release. This allowed us to also merge and fix many more vulnerabilities and general bugs in the same release.
CVSS
We
never provide CVSS
for our published vulnerabilities as we don’t think we can do a job there. Others will provide them even for our flaws.
Who Is Planting Backdoors in Ledger Crypto Wallets?
After crypto wallet maker Ledger announced Friday that a backdoor embedded in a handful of Ledger wallets sold in SouthEast Asia allowed thieves to hijack
around $102 million
in crypto from their owners, news has emerged of other Ledger wallets sold in Germany also having implants.
The hardware implants were originally found on an unknown number of Ledger Nano X wallets sold by an authorized Ledger reseller called CryptoBilis based in Malaysia. Ledger said the implants were found on a
limited number of devices
, all sold by the same seller. But a Ledger device owner in Europe has since said that he found an implant on a Nano X that he purchased at a large European electronics chain store in August and a second one he purchased this weekend at another store in the same chain. He believes these indicate that Ledger’s supply-chain has been compromised.
Since then, users and researchers have also reported finding implants in Ledger Flex and Ledger
Stax
devices – two of Ledger's more recent line of devices used for securely storing keys used to access a device owner's crypto accounts.
The implants are not the first to be found on Ledger wallets. Famed hardware hacker Joe Grand found implants on several Nano X wallets earlier this year and notified Ledger about them in March, raising questions about Ledger's urgency in addressing the issue. Many of the implants discovered more recently appear to be more sophisticated iterations of the ones that Grand found.
The implants Grand discovered were also all in wallets sold by unauthorized online sellers who seemingly ran fly-by-night operations that weren’t in business for long. But the implants found in wallets sold by CryptoBilis and the European electronics chain indicate the attackers have switched tactics and may be deliberately compromising wallets sold by authorized resellers now. Ledger and its competitor Trezor have cautioned users for years to buy wallets only from their web sites or from authorized resellers. But the recent compromises indicate that attackers are deliberately targeting authorized sellers to exploit customer trust in them and to get wider distribution for implanted devices. What’s more, the attackers have become more skilled and systematic in their method for compromising the wallets, making it more difficult to detect the implants, Grand and other researchers say.
It's not clear how long the implants have been sitting in the sold devices, but last week a coordinated heist resulted in millions of dollars in crypto being stolen from the device and accountholders. According to blockchain research company Bitquery, crypto was stolen from about 315 accounts connected to compromised CryptoBilis Ledger devices alone, and is currently valued at around
$102 million
. The stolen funds include Bitcoin, Ethereum and Tron and other cryptocurrencies. Some of the funds have
reportedly been frozen
in the accounts to which the thieves transferred it, and other funds appear to be in accounts that have been flagged for fraud. And it's not clear if funds were also stolen from Ledger owners who purchased their devices from other sellers.
Ledger, based in France, wrote in statement posted to X that it had
asked CryptoBilis to halt all sales
and shipments of Ledger devices until it could conduct an investigation.
CryptoBilis
— which is authorized to sell Ledger wallets in Malaysia, Indonesia and the Philippines — wrote
on its web site
that it is cooperating with Ledger’s investigation.
But a user going by the name Johannes wrote on X over the weekend that he had
purchased a Ledger Nano X wallet in person
from a MediaMarkt store that had an implant. MediaMarkt is Germany’s equivalent to BestBuy and has 1,000 stores in ten European countries. It’s listed as an authorized reseller of Ledger wallets in Austria, Germany, Spain and Turkey.
Johannes told Zero Day he purchased the wallet in August in a MediaMarkt store in Germany but only took the device apart this weekend following reports that implants had been found. He posted photos of an antenna and implant in his device. Johannes said that he has had no crypto stolen.
Images posted to X by Johannes, who says he found implants in two Ledger wallets he purchased in person from MediaMarkt stores in Germany.
In an update to X this weekend, Ledger suggested the implant problem may stem from authorized resellers obtaining Ledger wallets from illegitimate sources or reselling wallets that were bought and returned to them — after being compromised.
“We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products,” Ledger
wrote
. “This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users…. Raising the bar on physical supply-chain integrity benefits the entire ecosystem.”
But Johannes, who purchased a second Ledger wallet from another MediaMarkt store on Monday and found an implant in it as well thinks this suggests that Ledger’s supply chain has been compromised.
“This indicates a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe,” he wrote on X. He says he initially thought his two compromised devices might have been return items that the store then resold as new, but a MediaMarkt employee told him they were new devices and that returns are sent back to Ledger, not re-sold.
Ledger did not respond to an inquiry from Zero Day, but the company
wrote on X
that there is currently "no indication that Ledger's security infrastructure, systems or services have been compromised.
The issue raises questions about Ledger’s response to the implants and its transparency to customers. After Grand notified the company last March about implants he found in Ledger wallets, the company told him it would investigate to determine who was behind the implants. But Grand says he never received any followup until months later when he asked about it, and someone at Ledger told him they had found no evidence that someone had used the implants to steal crypto from device owners.
But the situation began to change after this.
If you find this article valuable, you can
leave a one-time tip to express appreciation to the author.
In April and May, Grand published his implant findings online and gave two presentations about them at conferences in April and May. Mark Karpelès, a French businessman and former CEO of the infamous bitcoin exchange
Mt. Gox
who was charged with fraud following the collapse of his business, saw Grand's research online and decided to purchase Ledger wallets to see if he could find implants in them as well. He obtained two wallets and found more advanced iterations of the implant Grand discovered and published his findings online last month.
Karpelès's notoriety in the crypto world caused information about the implants to spread widely in the crypto community, which may be why the heists occurred last week. The attackers may have been waiting until they had amassed many wallets with large balances associated with them before pulling off a widespread heist of funds. But once news about the implants began to spread, this may have spurred the thieves to quickly grab as much crypto as they could from wallets already compromised, before wallet owners could move to protect those funds. Some people online have been
praising Karpelès
for exposing the implants and an operation that might have gone unnoticed for years until he wrote about it.
Evolving Backdoors
Grand began looking at Ledger wallets in August 2025 after someone published a Reddit post indicating he had found something in his Ledger Nano X wallet. The owner, who purchased the wallet from an online marketplace in Thailand, cracked opened the wallet’s casing and found extra circuitry that should not have been there. He sent the wallet to Grand to see if he could confirm it was a backdoor and determine what it was designed to do.
Inside the device, Grand found an extra board as well as an antenna, LTE module and eSIM. He determined that the implant was stealing the recovery seeds of infected wallets and transmitting them to the attackers. The implant would sit silently on the device until the owner initialized it and caused it to generate a random seed phrase – essentially a password stored on the Ledger device to allow the device holder to access their crypto account. As the device sent each character of the seed phrase to the device's small screen to display to the owner, the implant copied them and stored the data before subsequently using the LTE module, antenna and eSIM to connect to a nearby cell tower and transmit the seed to the hackers.
Grand, who runs Grand Idea Studio, was thrilled with the finding because although there have long been rumors and theoretical claims about hardware implants on wallets he had never seen one in the wild. He purchased eight more Ledger wallets from several online sellers in Thailand and found that four of them were compromised with similar implants. All of the ones Grand purchased came from "sketchy" sellers on Lazada, an e-commerce platform in SouthEast Asia that is a subsidiary of the Chinese company Alibaba Group. The devices were shipped from Thailand.
On March 4, Grand reported his findings to Ledger and had a Zoom call with a team there, and subsequently gave two talks about the backdoors at the
Tropicon conference
in April and at the Hardwear.IO conference in May and
posted his slides online
. He also continued to have some e-mail conversations with Ledger before moving to a Signal group chat with some technical staff there as well as with a researcher based in Japan who had purchased some wallets through online sellers there in March and found implants in them.
Video of Joe Grand's presentation about the Ledger implants given earlier this year at Tropicon.
In September, Karpelès saw Grand’s research and obtained two Ledger wallets, including one purchased at half price from a Chinese seller on Amazon that arrived in a “flawless” shrink-wrapped box from Malaysia. He found implants inside both wallets and
published his findings
last month on the web site for Tibane Labs, which Karpelès owns and uses to conduct blockchain research and produce open-source tools. The implants operated similar to the ones Grand had found, but they were much more sophisticated in their design and more cleverly hidden to make them harder to spot inside a device.
A Ledger Nano X device that hardware hacker Joe Grand analyzed earlier this year showing the extra circuitry and individually soldered wires that were part of the implant. (Image: Courtesy of Joe Grand and Grand Idea Studio)
Karpelès said the version Grand found appeared to be a prototype that had evolved over time. That first-generation involved a bundle of hand-soldered wires that stood out to anyone who opened the devices. The wires connected the implant to the Nano’s screen to grab each character of the randomly-generated seed as they were displayed on the screen.
The inside of another Ledger Nano X device analyzed by Mark Karpelès. This more advanced implant involved a custom-built flexible circuit (the transparent orange layer) laid over the legitimate board. (Image: Courtesy of Mark Karpelès and Tibane Labs)
The more advanced implant used an orange-colored, transparent, custom-built flexible circuit laid over the wallet’s original board and laminated flat onto it and soldered in select places, eliminating the need to solder wires that could be easily seen. To make room for the additional circuit, the hackers had replaced the original battery with a smaller one. Based on some markings, the implant appeared to have been assembled in December 2025 or later.
The second implant, which he found in the device shipped from Malaysia, was the most advanced. Inside the wallet, there appeared to be nothing to distinguish it from an unmodified Nano X device. But a thin black antenna running along the top edge of the board was a giveaway. But every other giveaway from the previous design had been eliminated. The orange flex circuit had been coated with the same black color as the legitimate Ledger board, allowing it to blend in with that component. Part numbers were scraped off, and the original battery was still there. The attackers had simply removed some padding that normally sat behind the screen to make room for the implant. Notably, the attackers had silk-screened a parts number — AC-A2016-NANO-V1.1 — onto the antenna, suggesting it was a custom-built component that had been manufactured to hijack Nano wallets at scale.
A third Ledger Nano X wallet examined by Mark Karpelès. This third-generation implant shows the black antenna sticking out slightly along the top edge of the open casing, as well as the custom-built flexible board laying on top of the original board, which in this case had been coated with black to blend in with the original board beneath it.
“‘NANO' names the target,” Karpelès wrote, “and ‘V1.1’ says it has already been through at least one revision. Someone designed and ordered RF parts for this one device. That is a production run, not a one-off.”
This third-generation version of the implant was “not a hobbyist’s build,” he wrote. “A flex PCB keyed to the Ledger’s own parts, a custom antenna already at its second revision, colour-matched coating and scraped markings all point to planning, a real budget, and a goal of mass production.”
On October 8, the day before the crypto heists went public, Karpelès began posting a series of messages on X about his findings and responding to questions about the implants he found. This is when news of the implants began to spread. The next day, news of the crypto heists emerged, raising questions about whether the attention Karpelès brought to the implants caused the attackers to launch their crypto heister sooner than they had originally planned.
Need free data? Buy a cheap ledger off a dodgy seller, pull the sim out of the spy implant and enjoy while you can (law enforcement may visit you thinking you are the one making these).
https://t.co/ycMuv98UHh
pic.twitter.com/4tVCkrqlF0
Over the weekend, questions have arisen online about the founders of CryptoBilis and the fact that the company quietly switched owners in March — an acquisition that was not publicly disclosed until this weekend when users on X began pointing fingers at the founders and suggesting they might be behind the compromised devices or at least cooperating with the crypto thieves who stole money from the owners of compromised Ledger devices.
CryptoBilis co-founder Arravind Prabu rejected the accusations and revealed that his company had been
acquired by someone else earlier this year
and that he and his cofounder had “fully stepped down from all operations, system access, and management” in March. When asked why the acquisition was never made public, Prabu claimed in a lengthy statement that the deal was under an NDA until mid-October, which only enhanced suspicions.
“Since the completion of the handover, we have held zero access, credentials, visibility, or administrative control over CryptoBilis backend systems, customer databases, order histories, or corporate communication channels,” Prabu and his cofounder wrote in their statement. “Under the formal acquisition agreements, all parties were contractually bound to hold off on issuing a joint public announcement until mid-October 2026.”
He says that all suppliers — presumably Ledger among them — were “previously notified of the corporate acquisition and new management structure.”
Several people Zero Day spoke with say the months-long silence around the acquisition is "very shady" and question whether this was intended to keep Ledger customers in the dark while the implants spread through online sales. But Prabu says the suspicion, at least against them, is misplaced.
Oddly, Prabu did not identify who acquired CryptoBilis. He wrote that anyone who has questions about Ledger devices sold by CryptoBilis should contact Nicholas Chang. Chang, however, is identified in old postings to Facebook and X as a director of marketing for CryptoBilis, not the owner. Chang did not respond to an inquiry from Zero Day.
There is currently no evidence that anyone associated with CryptoBilis is behind the implants or the heist of cryptocurrency last week.
But the security researcher in Japan who has participated in conversations about the implants with Grand and Ledger since the spring, told Zero Day that he uncovered some intriguing findings from data he extracted from Ledger implants he purchased.
The researcher, who doesn't want to be publicly identified, purchased several Nano X wallets last March for his own use and put them in a drawer, intending to analyze them at some point when he had free time. After seeing Grand post his Tropicon slides online last spring, he took apart his own Ledger devices and found implants in them. He ended up purchasing ten Nano X devices from unauthorized Ledger sellers, most of them through the Amazon marketplace in Japan. One of the devices shipped from Malaysia, several came from Thailand, and two of them were shipped to him from an address in Osaka – essentially a shipping hub. All of them had implants. He found five different versions of implants among them, including the sophisticated implants Karpelès had found, as well as two additional designs.
"Some were very advanced and some were very basic," he says. "When I say versions [I mean] some of the layouts or components are different."
All of the implants operate in similar ways to record the randomly generated seed phrase as it's sent to the compromised device's screen and transmit the data to the attackers. He says he can't tell if the same group is behind all of the designs or if different actors took inspiration from an original design created by one person and advanced it.
In the case of the devices he received from Osaka, the seller's address was listed as a house in another city in Japan. That house, the researcher says, is used as an address for numerous companies engaged in various businesses, including criminal enterprises.
More interesting, he says, is that he was able to trace the transmission of the stolen seed data to servers in Hong Kong. The eSIM the attackers planted in Ledger devices is designed to work in any country, and the researcher says that if a device owner doesn't initialize their new wallet, the eSIM still retains the location of the last cell tower it connected to, which he was able to extract from the eSIMs in his wallets.
"This allowed me to find [what I think are] some manufacturing hubs for the implant," he says.
He says additional data contained in the compromised device's microcontroller firmware can be used to trace the location of the command and control servers used to receive the stolen seed phrase. He says he was able to trace the transmissions to servers hosted at a data center in Hong Kong that is managed by Alibaba and determined that in June at least 90 implants on infected Ledger devices were sending seed phrases to those servers, though he thinks the true number of devices communicating with the servers is likely much higher than this.
Pivot to Ledger Flex and Stax Devices
Although most of the compromised Ledger devices so far have been Nano X devices, there is evidence that the attackers have begun to pivot to Ledger Flex and Stax devices. Over the weekend someone posted
images of their Stax device
on X, which also appears to be compromised. It's not clear if this has been independently confirmed by Ledger or researchers. Separate to this, the researcher in Japan says he purchased two Ledger Flex devices and found implants in them as well.
He says that sometime in July or August he was monitoring a number of online sites that were selling Nano X devices when several of them stopped selling Nano X devices and switched to selling Ledger Flex devices.
"My sense is that they simply developed a new implant that is only for Flex," he says.
He says he has spoken with Japanese law enforcement about his findings as well as with technical contacts at Ledger, but the latter has not shared any information with him about its own investigation.
In the meantime, the list of compromised devices is growing. Over the weekend, Karpelès has been posting information from other Ledger device owners who have since found implants in their devices.
Update 12:30pm EST: SatoshiLabs, the Czech company that makes the Trezor wallets that compete with Ledger products, just announced that in light of implants found in Ledger devices sold by authorized sellers, SatoshiLabs is dramatically reducing its own list of approved sellers. Danny Sanders chief commercial officer for Trezor, wrote on X that the move is a "preventive step" and "there is not a single piece of evidence that Trezor devices have been compromised." In a letter Trezor sent to sellers who will be losing their authorization, Trezor wrote that they continue to sell devices they already have in stock but they will receive no new inventory, and as of January 1, 2027 Trezor will remove them from its list of authorized sellers.
Not-Ship turns one next week!! To mark it, I'll be kicking off a campaign for new members. I won't spam you; free subscribers will only get three extra emails on top of the weekly edition.
But first, can I ask for a small birthday present? Hit reply and finish this:
I read Not-Ship because...
💙
Amanda
Last week I wrote about how Amazon's search page is
designed to screw you over
: the top row trap, the swamp of ads, the discount-washing. Today, I'll explain what's going on behind the scenes, and how Amazon's rules make sure prices stay high not just at Amazon, but everywhere you shop.
In a nutshell, here's what's happening:
This isn't just my theory. This system is at the heart of the US Federal Trade Commission's (FTC)
upcoming antitrust case
against Amazon.
Let's get into it.
Amazon charges sellers a lot of fees
Amazon relies on independent sellers to populate its online marketplace, and it charges them to be on the site. Amazon takes a big cut. In 2014, this was about
19% of sales
. But today, many sellers hand
close to half of every sale
to Amazon. Half!
Amazon's basic commission (15% of the sale price in most categories) is in line with what eBay and Walmart charge. What pushes Amazon's cut higher are the other fees stacked on top.
Where an Amazon sale goes
Based on an apparel seller that opts for Amazon fulfillment, storage, returns and advertising.
There's the referral fee, which is the commission Amazon takes on every sale. The fulfillment fee is the cost to have Amazon pack and ship items from its warehouses. Then there's advertising: those sponsored spots in the top row we saw in last week's article.
Of these costs, only the referral fee is mandatory. Sellers can choose to ship orders themselves, for example, or forgo advertising. But in practice, the choice isn't actually much of a choice.
Here's what it looks like for a seller considering these so-called options:
In other words, the real choice for sellers isn't between paying for extras or not; it's between making sales or not. The
FTC
calls Prime eligibility, which effectively requires Amazon's fulfillment service, "a virtual necessity for doing business on Amazon." It says the same of advertising.
So, sellers have to raise prices
Here's where the fees are passed on to us consumers. When sellers give roughly half of their sales to Amazon, the other half isn't profit. That money has to cover making the product, shipping it to Amazon's warehouses, paying staff and everything else. So even if they wanted to absorb Amazon's fees on your behalf, most companies can't afford to. They have to raise their prices.
Don't forget, Amazon's biggest single fee — the referral fee — is a percentage of the price. So when prices go up, Amazon's cut goes up, too.
And they can't charge less elsewhere
Now here's where it gets really crazy. Amazon's
Fair Pricing Policy
lets it remove the Buy Box (the "Add to Cart" button), or
even suspend a seller
, if they're offering their item cheaper elsewhere. So, a seller who raises prices on Amazon to cover the fees has to raise them everywhere else too — even on their own website! — or risk losing their Amazon sales.
The consequence is clear: We pay Amazon prices, even when we're not shopping on Amazon.
It's been documented again and again. In 2024, Amazon sellers told CNBC they
lost the Buy Box
after Target put their products on sale. In
an ongoing lawsuit
, California's attorney general alleges Amazon pushed brands to get Walmart, Target and other retailers to raise their prices. And when progressive media outlet
More Perfect Union
reported on this, they even found an Amazon seller who was suspended over a one-cent price gap with Target.
Ideally, market competition would sort this out. High prices send shoppers elsewhere and force fees down. But when sellers can't charge less anywhere else, there's nowhere cheaper to go.
There's no easy way out
For sellers, this is frustrating. So, why don't they just leave? Because Amazon is where the shoppers are: it accounts for about
40% of all US online retail sales
. For many sellers, not being on Amazon isn't an option.
At least regulators have noticed. In 2023, the FTC and 17 US states sued Amazon, arguing that it illegally maintains its monopoly power by, among other things, punishing sellers who offer lower prices elsewhere, effectively forcing them to use its warehouses and charging ever-higher fees. Amazon denies any wrongdoing, and the case is set to go to trial next year. In Europe, Germany
ordered Amazon
to stop controlling its sellers' prices earlier this year, though the decision isn't yet final.
After
last week's piece
, a Not-Ship reader wrote to say none of this is new: plenty of online stores push ads and fake discounts. That is true. But what's different about Amazon is its reach. When prices increase on Amazon, they tend to increase elsewhere too. You can, of course, choose not to shop on Amazon. But if the FTC is right, you may be paying Amazon's prices anyway.
FULL DISCLOSURE
I spent two years working at the Washington Post, which Amazon founder Jeff Bezos owns. During that time, he was busy
dismantling the publication
, so he wasn't well loved in the newsroom.
CLASSIC ENSHITTIFICATION
In August, I saw Cory Doctorow speak at the Edinburgh International Book Festival. His
enshittification
concept — the process by which online platforms shift from serving their users to squeezing them — inspired this two-part series on Amazon. If you want to understand it all a lot better, I highly recommend his book
Enshittification: Why Everything Suddenly Got Worse and What to Do About It.
Somehow it makes antitrust issues both accessible and entertaining!
FROM ELSEWHERE
Here's what I found interesting, important or delightful this week:
Life after death?
Alvin Chang's
latest masterpiece
has dropped! It’s about what people around the world believe happens after we die, drawn from surveys of nearly 130,000 people in 23 countries. (Proud to count Alvin as a Not-Ship subscriber 💙.)
Stunning embroidery.
If you haven't seen the work of Irene Saputra, get yourself over to
Instagram
. Endlessly inspirational.
Instant knowledge.
The
Ars Notoria
was a medieval magic book that promised scholars university learning through prayers, rituals and diagrams. No studying required!
SpaceX has introduced a speed restriction affecting StarShield terminals used by Ukraine. According to Ukrainian sources, connectivity began to fail when platforms exceeded around 160 km/h, disrupting part of Ukraine’s combat missions. Later reports claimed that the restriction may have been tightened further, with some operators losing communication already at 60–70 km/h. If confirmed, that would no longer affect only fast strike drones, but also a much wider group of reconnaissance and tactical UAVs.
The first point is technical, but crucial. This is not a general shutdown of Starlink for the Ukrainian military. The issue concerns terminals used in motion, especially under the StarShield military package. The initial figure of around 160 km/h is important because it affects faster unmanned platforms, including strike systems and drones operating beyond classic radio-control range. A lower threshold of 60–70 km/h would be far more serious, because many ordinary tactical UAVs operate in that speed bracket.
It is also wrong to describe Starlink mainly as a navigation system for drones. Its real role is communication: command link, video transmission, mission updates and contact between operator and platform beyond direct line of sight. A drone may still know where it is going through GNSS, inertial systems or autonomous navigation, but without a reliable data link, it loses flexibility, live control and battlefield value. In drone warfare, the link is often as important as the airframe.
The political link is possible, not proven
Serhii Sternenko suggested that SpaceX’s decision could be connected to pressure from the Trump administration on Kyiv. Similar interpretations appeared in Ukrainian discussions, especially because the restriction comes amid tensions over Ukrainian strikes against targets in Russia. But this should not be presented as an established fact. SpaceX has not publicly confirmed such a motive. The White House has not confirmed that it ordered the change. Reuters has not established that the restriction came from the US administration.
The political context is obvious, but attribution is not the same as suspicion. What is already clear is that SpaceX can remotely change the operational parameters of terminals used on the battlefield. Even a narrow technical change, such as a speed limit, can immediately affect strike missions, reconnaissance and command links. For Ukraine, this is not only a question of one service update. It is a question of dependence.
A battlefield advantage and a strategic vulnerability
Earlier this year, mechanisms for verifying and limiting Starlink terminals helped Ukraine counter Russian use of the system on drones. The same kind of technical control now appears to have affected Ukrainian military users. This shows both the strength and the weakness of the system. Starlink and StarShield give Ukraine resilient communications that are difficult to replace. At the same time, Ukraine does not fully control the conditions under which that communications architecture operates.
That is the real military issue. The war in Ukraine has shown that private satellite networks can become part of the battlefield. But private infrastructure also means private control, contractual limits, geofencing, service parameters and political exposure. A state can build drones, train operators and plan missions, but if the data link depends on one external provider, the whole system remains vulnerable to decisions made outside the chain of command.
If the 60–70 km/h reports were confirmed, the consequences would go beyond fast strike drones. They would affect a larger part of Ukraine’s unmanned architecture and force operators to adapt missions, platforms and communications methods. The problem is therefore not simply that Starlink has imposed a speed limit. The problem is that one technical decision by SpaceX can change the tempo of Ukrainian drone operations almost immediately.
Bank of England and IMF bosses issue stark warning on cyber threat to trust
Guardian
www.theguardian.com
2026-10-14 05:07:59
Andrew Bailey and Kristalina Georgieva voice concerns about financial system on panel about online fraud Business live – latest updatesThe heads of the Bank of England and the International Monetary Fund have issued a stark warning that rising cyber-attacks risk undermining trust in the financial sy...
The heads of the
Bank of England
and the International Monetary Fund have issued a stark warning that rising cyber-attacks risk undermining trust in the financial system.
Speaking on a panel about online fraud at the IMF and World Bank meetings in Bangkok, the governor of the Bank of England, Andrew Bailey, pointed to alarming headlines about self-replicating AI agents
hijacking personal devices
, and the French supermarket hack that
heated fridges up to 50C
.
“If you try to say what’s at the heart of this debate about AI – for me, it’s about trust in technology and it’s about human control to achieve that trust in technology,” he said.
Pointing to the key importance of technology in underpinning today’s financial system, he added: “If we don’t have trust in money, we don’t operate as a society.”
Echoing his concerns, the IMF’s managing director,
Kristalina Georgieva
, said the toll of cyber-fraud was now so great that people could decide to opt out of the formal financial system altogether.
“I was born and grew up on the other side of the iron curtain,” the Bulgarian economist said. “We didn’t trust the system. What did we do? I would have my dollars in a shoebox under my bed.
“And I worry, today, that unless we figure out how to get ahead of this curve, given the speed, the scale and the cost of fraud growing up, we may end up with lots of people with shoeboxes under their beds.”
She said this threat was particularly acute for people on the fringes of the financial system. “Imagine what would happen if trust disappears or is eroded to a point that people no more have the courage to be included,” she said.
Her comments followed a warning from the IMF on Tuesday that the possibility of a big cyber-attack was one of the factors
raising the global financial stability threat level
to “elevated”, alongside higher borrowing costs and the risk of an AI share price crash.
Bailey stressed that fraud was now frequently committed via social media platforms and apps, not just traditional financial channels – and urged big tech to take responsibility.
He contrasted today’s environment with the legal status in the UK of outlets such as newspapers, which are responsible for the veracity of everything they publish.
Instead, the governor said: “We’ve moved into quite an extreme position of, well, these platforms are open to everybody and there’s no real liability to the provision of the platform to what’s on it. Guess what? Everything’s on it. You know, the good, the bad and the incredibly ugly and downright criminal and terrible.”
He added: “I don’t go around pointing the finger at people and saying: ‘You’re bad.’ What I have said is: ‘Look, there is responsibility all around.’ And we need to evolve to a world where everybody understands this responsibility, and everybody is then a part of addressing the problem.”
He added: “We must get the social media companies involved because a lot of this fraud is transmitted through those channels.”
Bailey called for the same tools that are being used by cybercriminals to be put to work protecting the financial system. “I’m going to use a sporting metaphor: this technology is arming the offence but it can also arm the defence, and it must do.”
The panel event at which the pair were speaking was to launch a new set of international principles for avoiding cyber-fraud in financial institutions, called the Bangkok blueprint.
Me, calmly assessing the implications of LLMs for programming language design(ers).
As someone who has made a career of programming language design, I definitely have moments of existential dread about the rise of LLMs. I started coding in 5th grade on an x86
1
that ran at 5MHz, had something like a 5MB hard-disk and 512K of RAM
2
. Computers were really, really different back then. But honestly, programming wasn’t. For all the advances in IDEs and programming languages and so forth, the basic act of entering code into a file has remained surprisingly constant
3
– right up until a few years ago, when everything kinda turned on its head. That’s been exciting and empowering at times
4
but also scary and disorienting.
Will my skills in programming matter? What about my skills in programming language
design
(such as they are)?
This blog post is my attempt to answer those questions.
So as not to keep you in suspense, let me just give you the conclusion. In short,
yes, I believe there will still be a role for humans in programming
. And
yes, I think that programming language design is still relevant
. And, naturally, I also happen to think Rust is a
really good fit
for agentic development – but that’s not to say we can’t make it a
better fit
. And that’s what this post is ultimately about: what makes Rust and agentic development work well, and where we could double down on those strengths.
Stratospheric among the breakout languages is TypeScript, cropped from the chart and sitting currently at +1200% growth from the prior year. [..]
The second most rapid recent growth is in Rust.
Meta engineers have written twice as much first-party Rust code so far this year than in the previous 9 years combined.
— David Tolnay (emphasis mine)
Some of that is because agents make it very easy to try out new things. And some of that is because Rust has a reputation for being performant and, if it’s just as easy to pick any language, why not pick one that will yield faster execution times?
But I think Rust is popular for another reason: because Rust happens to be a really good fit for agentic coding
6
. Of course, I would, wouldn’t I? The point of this post is (1) to argue for why that is and then (2) to discuss what we might change about Rust to make it work even better.
Foundational Software construction with agents
It seems to me that an effective “software factory” will have three pillars:
Design:
figure out and specify clearly what the code is supposed to do.
Construction:
author code that does what it is supposed to do.
Optimization:
optimize the code so that it runs efficiently.
None of these pillars are solved, but some have made more progress than others.
Rust and optimization: fast by default, knobs when you need ’em
Rust is designed to give “good performance by default”, making the idiomatic thing typically also be the fastest thing. But another key part of Rust is that you have the knobs to eke out better performance when you need it. You control when something is stack- or heap-allocated and where pointer indirection occurs. If you want to, you can force the layout of your structs to be done in a particular way, or decide where to introduce boxing into your async stack frames. In the limit, you can put in inline assembly.
In the past, learning how to “tune the performance knobs” could be a bit of a black art: but agents are making that much easier.
7
It turns out that agents are
really good
at fine-tuning the performance of existing code. For example, people who work on super high-performance cryptographic algorithms used to do so by hand-tuning assembly code. But those people tell me that they are now turning to agents for that same job. More prosaicly, a lot of people building network services are finding that, using a profiler like
dial9
, agents can quite effectively diagnose async performance pitfalls, like long polls or blocking.
Therefore, I think the task for Rust is clear. We keep on with our goal of
“low-level enough for a kernel, high level enough for a GUI”
. If anything, I think the shift around agents means we can tolerate a bit more “noise” in the form of explicit calls to
clone()
or
share()
– but not too much, since we still want the “happy path” of the code to be clear and evident
8
, even as we surface details that are important in specific scenarios (like tracking precisely how many clones you have of a channel endpoint). Combined with a profiler, you get an effective feedback loop to get your code running fast:
As usual though, while a reputation for good performance is what brings people to Rust, what makes them want to
stay
is a sense that using Rust “just seems to work better”. The basic theory is that Rust’s type system and guardrails
help keep agents on track
:
rust is a perfect language for agents, given that if it compiles it's ~correct
I think there’s truth in that: languages like Rust, Ocaml, or Haskell all share this “if it compiles, it works” feeling, and I think that agents will benefit from that.
Testing is not enough, type systems help
Testing can show the presence of bugs, but not their absence.
— Edsger W. Dijkstra, 1970
Agents presenting their work.
Writing tests has never been enough to show that your program is correct – but, with agents, it’s not even close. It happens so often that my first few tests seem great and then the next one goes completely bonkers. Usually bonkers in a way where I cannot even imagine how that bug could have come about. Then I dig in and I realize the agent completely missed the boat on the logic I was trying to express.
9
This is where a type systems really shines – particularly an advanced one like Rust. Type systems give you some guardrails that keep the agent on track. In Rust, those guardrails extend beyond simple stuff like “do all fields have the correct names” and to stuff like
never having to close a socket
.
Type systems are not enough either
Type systems can show the absence of bugs, but not the presence of correctness.
— Me, failing to coin a phrase of equal eloquence
10
, 2026
So yeah, type systems are helpful! But they have inherent limits. A type system is a simple set of rules that, if you follow them, make sure that you avoid (certain kinds of) mistakes. But they don’t tell you that you do the
right
thing – only that you
don’t
do (certain kinds of)
wrong things
.
If you want to go further, you need a proof system
– something that will let you show that richer properties are actively true, not just that you’re avoiding bugs.
As it happens, there are a lot of interesting proof tools for Rust, like
Verus
,
Creusot
,
Aeneas
, and
Kani
. As a starting point, you can prove that your code is panic-free, which will eliminate a lot of bugs, though it is still fundamentally a “type-checker-like” property (i.e., you avoid doing things wrong). But you can also go further and add assertions that show your code is computing the results you expect.
Strong guardrails give better performance
Deplying proofs is not just good for getting code
right
– it’s good for getting code
fast
. This is somewhat counterintuitive, but it’s true. Earlier I mentioned how optimized cryptographic algorithms were now being written by
agents
. Part of what makes that possible is that cryptographic algorithms have a very clear mathematical definition. This means that you can basically tell the agent “do whatever you want, as long as you can prove that the code still computes the correct result”. These proofs can be done with theorem provers like
Lean
or
Rocq
. The blog post
“Why Lean is faster than Rust”
makes the point quite well.
For Rust, a good example of this would be around unsafe code. Right now, people are sometimes reluctant to deploy unsafe code even if it might make their code faster because it’s not worth the risk of getting it wrong. And I applaud that effort. But what if you could use a prover to show that your unsafe code is, in fact, safe (i.e., incapable of causing undefined behavior)? Then you’d be free to optimize to your heart’s content.
If we are going to prove things, do we need type systems?
You might wonder: if we’re deploying a proof system on our code, do we still need type systems? I think the answer is definitely yes. Type systems are infinitely simpler to work with, which is why they are much more popular. Using a type system lets you rule out all kinds of annoying bugs so that you can focus your “proof energy” only on the important stuff.
As a simple example of this, consider the following Java code:
Without seeing more code, it is impossible to prove whether this assertion is true or not! This is because there could be any number of other threads running around mutating
this
. In contrast, the following Rust code
must
be true (at least, so long as the
Eq
operator is reflexive for
Bar
):
We know this because the
type system of Rust
guarantees that
&mut self
implies a
unique
reference.
This is in fact exactly how Verus works. By trusting the Rust borrow checker to track uniqueness etc, it simplifies the job of the SMT solver, making proof checking must faster and more reliable than it would be otherwise.
Where I think Rust should go on reliability
So my take is that Rust should double down on
if it compiles, it works
. As expressive as Rust’s type system is, there are plenty of things that it cannot capture. This includes fairly common things, like
this method only reads one particular field
or
internal references
, but also fancy things like “no logging of personally identifiable information”. We should work to lift those limits, giving agents room to prove more complex properties.
We also need to improve the experience of integrating a proof tool by working towards an
extensible compiler
. As cool as the existing Rust-based proof tools are, using them is a janky experience involing annoying macros and pinned compiler versions. We can do better.
A north star: No more unsafe code
I’d like to propose a north star for Rust:
no more unsafe code
. By that, I don’t mean that we never use the
unsafe
keyword
. Rather, I mean that we have the power to prove that all the unsafe code we write is correct and cannot cause undefined behavior. Don’t get me wrong: knowing exactly what code needs to be vetted is a huge step forward, as is normalizing the idea that libraries need to be responsible for protecting their users from undefined behavior via safe API boundaries
11
. But given agents’ ability to find vulnerabilities, I think we need to up-our-game if we want to stop the steady stream of CVEs.
12
Design is an open problem
But before you go about proving things or optimizing them, you need to have a clear idea of what you are building. As far as I can tell the state of the art here is basically variations on “markdown-driven-development”, developing docs and hoping that agents pay attention.
I don’t know how much of a role for Rust there is in this space. I think there are some steps we might wind up taking that could be helpful here – for example, having ways to separate out
interface
from
implementation
so that it’s easier to review the interface in isolation or to see when the agent made changes there.
13
Or perhaps just providing betters tools to review that.
I also think there’s space for dedicated “modeling languages”, something that let you iterate quickly with agents on the high-level designs and invariants without having to get into the weeds and read the code. I have more thoughts on this but it merits many blog posts all of its own. For the moment, I’ll settle for pointing you all at this post by Kari Wilhelm,
“Principles of Anchor Engineering”
, which I think does a nice job of describing what it means to pull out the key elements of a design and drive the coding from there.
Conclusion
We covered a lot of ground here, so let me put this all together. What makes Rust a good choice for developing with agents?
It offers good default perf (why pay more?) and, in conjunction with a profiler, can be tuned as much as you want.
The type system gives stronger guardrails, and if you setup your agents right, you can strengthen those guardrails through techniques like new types.
And what could make it better, from a language design perspective? Overall, I think it’s very similar to what we were doing, except that the way we weight the tradeoffs is tweaked to account for agents doing the code authoring, and humans focused more on code comprehension:
If it compiles, it works
– our type system is our big advantage, we need to make it more expressive and more functional so that agents don’t get stuck trying to work around it!
And as an adjunct, establish a North Star: Enable
Unsafe code without unsafety
by supporting proof, and see the most widely used Rust libraries proven sound.
Low-level enough for a kernel, high-level enough for a GUI
– make sure we expose the knobs needed to tune for performance, while also making the code’s intent clear (but don’t worry about golfing the code down to an absolute minimum number of characters).
Extensible and versatile
– one of Rust’s great strengths is that, with macros + our type system, we support DSLs and a wide variety of targets. We need to bring that spirit of extensibility into the compiler so we can target more styles of development (e.g., GPU, deep language interop, etc) and also integrate theorem provers and other tools that require more than just tokens.
As a final close, let me point you at this interesting article by Marc Brooker,
“What’s easy now? What’s hard now?”
. He posits that the more it is possible to clearly specify success criteria for a task, the easier it is, and that we may find that tasks we traditionally think of as ‘hard’ (e.g., building out an efficient implementation of a cryptographic algorithm) may soon become automated, whereas tasks that we have thoght of as ’easy’ (e.g., making a unique, compelling website) may become more valued.
Looking at it from a PL point-of-view, I think Marc’s point reinforces my sense that the biggest action is going to come from
design languages
, things that let you capture the
architecture
and
intended behavior
at a very high-level. The goal would be to let humans intuitively specify a design that gets translated into effective guardrails, whether that’s type system checks, lints, or theorems to be proven. Agents would then take on the task of translating the design into code written in a traditional PL like Rust, with humans looking at it only rarely. This doesn’t make the design of traditional PLs less interesting, but it definitely makes the tradeoffs very different than they were before.
AIR-LLM: Broadcasting AI Weights over Radio for Memory-Free Edge LLM Inference via RF Computing
,
Tingjun Chen
Affiliation:
Duke University
,
Durham, NC
,
USA
and
Dirk Englund
Affiliation:
Massachusetts Institute of Technology
,
Cambridge, MA
,
USA
Abstract.
Next-generation large language models (LLMs) are expanding from the cloud to ubiquitous edge devices.
However, edge devices typically either lack the memory to store increasingly large LLM weights or, even with enough memory, spend unaffordable energy on loading the weights.
This raises our question: can an edge device run an LLM without storing or loading its weights, but receive them over the air and consume them on the fly?
Inspired by wireless broadcasting, we present
AIR-LLM
, an LLM inference architecture for edge devices, which is composed of:
(
i
) a central radio (e.g., 5G base stations) that broadcasts the LLM weights into the air, and (
ii
) the edge user that receives the weights and completes the general matrix-vector multiplication (GEMV) of LLM inference directly in the radio frequency (RF) domain using RF mixers.
To further shorten the airtime,
AIR-LLM
exploits MIMO spatial multiplexing and proposes an energy-efficient precoder–postcoder pair on the edge to calibrate its own wireless channel.
Since the central radio stays user-unaware,
AIR-LLM
is user-scalable so that one broadcast serves unlimited users within its coverage.
We implement
AIR-LLM
on the NVIDIA Sionna ray-traced channels of two real-world urban scenes and the profiling of a real RF mixer.
With a WikiText-2 perplexity degradation of 4.0% on LLaMA-3.1-8B,
AIR-LLM
saves the energy by 157.7
/40.4
against the FP16 and weight-only quantization baselines; with 20 users, its airtime is 104.1
/26.0
shorter, respectively.
Keywords:
LLM inference, edge computing, RF computing, RF mixer, weight broadcasting, MIMO communication
1.
Introduction
Trillions of edge devices today are embracing emerging machine learning (ML) techniques for a wide range of applications, such as continuous health monitoring
(
Abbaspourazad et al., 2024
;
Pan et al., 2025
)
, on-device speech recognition
(
Radford et al., 2023
;
Yazdani et al., 2016
)
, and cooperative autonomous driving
(
Hu et al., 2022
;
Zhang et al., 2021
)
.
Among these, the emerging large language models (LLMs) provide a unique capability, allowing understanding, reasoning, and generating natural language
(
Grattafiori et al., 2024
;
Touvron et al., 2023
;
Jiang et al., 2023
;
Gemma Team, 2026
)
.
However, the usage of LLMs on the edge mostly relies on cloud computing, where the locally generated prompts are uploaded to a cloud server, and the responses are downloaded afterwards.
This again exposes two typical concerns of cloud computing: the privacy of the sensitive prompts, as well as the round-trip latency, especially when the number of edge users is scaled up
(
Kang et al., 2017
;
Xu et al., 2025
)
.
The key challenge that hinders such an on-device deployment lies in the daunting model size of today’s LLMs.
For example, LLaMA-3.1-8B
(
Grattafiori et al., 2024
)
occupies 16 GB in FP16, and still 4 GB after 4-bit weight-only quantization (WoQ)
(
Frantar et al., 2023
;
Lin et al., 2024
)
.
Such a model size stresses an edge device in two stages.
First, its memory is typically too small to hold the whole model, so a local deployment has to keep downloading the weights and discarding them afterwards.
Second, even if an edge device could store such an LLM entirely, the energy of loading the weights from memory to the computing unit is unaffordable.
This is because LLM inference is memory-bounded, especially during the decoding phase, where fetching one weight feeds only two floating-point operations (FLOPs)
(
Guo et al., 2025
)
.
The weight movement therefore dominates the energy, much more than the arithmetic it feeds
(
Antepara et al., 2025
;
NVIDIA, 2024
)
.
To overcome this, various computing paradigms have been proposed recently.
For example, in-memory computing completes the computing in analog within the memory itself, on a ReRAM
(
Shafiee et al., 2016
;
Chi et al., 2016
;
Wan et al., 2022
)
, PCM
(
Khaddam-Aljameh et al., 2022
;
Le Gallo et al., 2023
)
, or SRAM
(
Liu et al., 2026
)
crossbar, so that the weights are never fetched.
Over-the-air computing
(
Nazer and Gastpar, 2007
;
Zhu et al., 2020
)
, in turn, superposes the signals of many transmitters over the wireless channel, so that the summation is completed by the channel itself.
However, in both cases the size of the general matrix-vector multiplication (GEMV) is frozen and limited by the hardware complexity, e.g., a crossbar of 128
128 cells
(
Shafiee et al., 2016
)
and an array of a few dozen antennas
(
Reus-Muns et al., 2023
)
.
Such a limited GEMV size is naturally incompatible with the LLM whose GEMV sizes keep increasing.
Figure 1
.
System overview of
AIR-LLM
: a central radio frequency-encodes the LLM weights onto an OFDM waveform and broadcasts it over the air to serve any edge user within the coverage; the edge user drives the LO with its private activations, and the RF mixer’s output directly carries the GEMV outputs. The LLM inference is completed once the weight waveform arrives, without ever storing it in memory.
Table 1
.
The comparison of
AIR-LLM
and existing edge computing paradigms.
Our motivation lies in the wireless network these edge users already live in.
Taking 5G networks as an example, a 5G base station already establishes wireless links to each edge user under its coverage.
For these users, accessing the LLM weights is read-only, and thus a purely downlink process; once they run the same LLM, it is exactly what broadcasting was invented for: one transmission simultaneously serving every user in the coverage.
Moreover, we employ radio-frequency (RF) computing
(
Gao et al., 2026b
;
Gao et al., 2026a
)
, which completes the computing in RF via the passive RF mixer that every receiver already carries.
The computing is thereby finished in analog once the broadcast signal arrives, without the weights ever being digitized into the local memory.
As shown in Fig.
1
, we present
AIR-LLM
, an LLM inference architecture with (
i
) a central radio (e.g., a 5G base station) that frequency-encodes the LLM weights onto the subcarriers of an orthogonal frequency-division multiplexing (OFDM) waveform and broadcasts it, and (
ii
) any edge device in the coverage receives that waveform and computes on it inside its own RF front-end.
The key computing component is the RF mixer every wireless device already carries: it multiplies its two inputs in the time domain, corresponding to a linear convolution in the frequency domain.
Specifically, driving its local oscillator (LO) with a waveform encoding the activations therefore convolves the arriving weight spectrum with the activation spectrum, and the very middle subcarrier of this convolution is exactly the inner product of the weight and activation vectors.
A comparison of existing computing paradigms is presented in Tab.
1
.
On top of this principle,
AIR-LLM
makes two designs.
First, it exploits
multiple-input multiple-output (MIMO) spatial multiplexing, which delivers
weight streams at a time and thus shortens the airtime by
.
Second, it calibrates the MIMO channel with
calibration units, each pairing a per-subcarrier precoder and a per-antenna postcoder, which compensates for the channel at a cost far below an explicit inversion, keeping the energy low.
Delivering the weights this way also fits broadcasting better than conventional communication in two aspects.
First,
AIR-LLM
needs no handshake with users, as the computation is inherently tolerant to the errors introduced by thermal noise.
In addition, its weight waveform stays identical regardless of the users’ SNRs, so no per-user modulation and coding scheme (MCS) is needed either.
We implement
AIR-LLM
on ray-traced channels of two urban scenes, Paris and Munich, and profile a real RF mixer, running nine LLMs from 1B to 70B parameters end-to-end with every weight-activation GEMV in RF computing.
On LLaMA-3.1-8B and a selected user in the scene of Paris,
AIR-LLM
degrades the WikiText-2 perplexity (PPL) by only 4.0%, while cutting the per-token energy by 157.7
/40.4
against FP16/4-bit weight baselines with remote weight storage, and by 51.5
/13.9
against fetching them from local memory; with 20 users, its per-token airtime is 104.1
/26.0
shorter than FP16 and 4-bit WoQ.
We summarize the contribution of
AIR-LLM
as below.
•
We propose
AIR-LLM
, a new computing paradigm for LLM inference on the edge, which is
memory-access-free
,
user-scalable
, and
energy-efficient
.
•
We design an RF computing engine that shortens the airtime with MIMO spatial multiplexing, while maintaining the computing accuracy and energy efficiency.
•
We evaluate
AIR-LLM
on Sionna ray-tracing and real RF mixer profiling, showing its near-lossless PPL on LLM tasks with orders-of-magnitude less energy and airtime.
2.
Preliminaries
2.1.
OFDM and MIMO Channel Model
OFDM signal structure.
The signals are based on orthogonal frequency-division multiplexing (OFDM), characterized by the FFT size
, i.e., the number of subcarriers in the frequency domain, and the occupied bandwidth
. The resulting subcarrier spacing is
.
MIMO signal notation.
We consider an
MIMO system, where
denotes the number of transmitting antennas on the central radio and
denotes the number of receiving antennas on each edge device.
On the central radio side, the transmitted signals in the frequency domain are denoted by a complex-valued matrix
, whose
-th row
gives the signal transmitted by the
-th antenna.
The received signals in the frequency domain are similarly denoted by
, whose
-th row
gives the signal received by the
-th antenna.
Wireless channel and received signal.
The wireless channel is defined as a three-dimensional complex-valued matrix
, where
is the channel response between the
-th transmitting antenna and the
-th receiving antenna across all subcarriers.
The received signal is then given by
(1)
where
is the sum power of the additive white Gaussian noise (AWGN) across all the
subcarriers, and
is the i.i.d. complex-valued standard Gaussian distribution. Note that we assume that within a single edge device, the noise power is identical for all the antennas and subcarriers.
Conventionally, the channel
can either be pre-calibrated on the central radio side or post-calibrated on the edge device side.
Specifically for the edge-side post-calibration, given the estimated channel
, a per-subcarrier (pseudo-)inverse matrix is performed for each
to recover the transmitted signal by
(2)
This recovery process requires
floating-point operations (FLOPs) on the edge device.
2.2.
Analog GEMV via RF Mixers
An RF mixer is a fundamental component on edge devices for up/down conversion. Essentially, it performs analog multiplication in the time domain, corresponding to the linear convolution in the frequency domain, where OFDM signals reside.
Such a convolution operation can be leveraged for GEMV in ML inference.
Complex-valued linear convolution.
The complex-valued nature of wireless signals allows an RF mixer to perform, in analog, the complex-valued linear convolution (denoted by
) between two input signals of equal subcarrier spacing
.
To simplify, we assume they have the same FFT size (
) so that we denote the frequency-domain input activation signal by
, and the weight signal by
.
This process yields the output activation signal
as
(3)
Leveraging linear convolution for GEMVs/IPs.
We examine the real-valued GEMV that ML inference is built upon, formulated by
with
,
, and
.
This GEMV can be broken down into
independent
-element inner products (IPs), each of which takes
FLOPs.
Since the linear convolution in (
3
) is complex-valued whereas the GEMV is real-valued, a single pair of input and weight signals carries
two
such IPs.
Specifically, for the IP pair given by the
-th and the
-th rows of
, we let the FFT size be
, and let the input signal directly carry
, whereas the weight signal carries these two rows in its real and imaginary parts, both in a reversed subcarrier order, i.e.,
(4)
Substituting (
4
) into (
3
), the middle subcarrier of the output signal,
, is exactly the one that accumulates all the
element-wise products, i.e.,
(5)
so that the two IPs are read off the real and the imaginary parts of this same subcarrier without interfering with each other, while the remaining
subcarriers are discarded.
Therefore, the output can be extracted by a low-pass filter (LPF) of a single-subcarrier bandwidth
so that it can be digitized with far fewer samples to save the energy consumption on the ADCs.
This process is repeated until all the
IPs are covered, taking
weight signals
in total, all sharing the same input signal
.
Beyond GEMV, this linear convolution maps even more naturally onto convolutional layers (Appendix
D.1
)
(
Gao et al., 2026a
)
.
3.
RF Computing Engine
In this section, we present the RF computing engine of
AIR-LLM
on the edge device based on MIMO, as shown in Fig.
2
, where
AIR-LLM
calibrates the channel of the broadcast weights with a pair of precoder and postcoder that are compatible with the RF mixer-driven analog GEMV.
Figure 2
.
The overview of
AIR-LLM
’s RF computing engine, which completes
IPs of the GEMV per round (or
if real-valued).
The central radio broadcasts the weights of these IPs over its
antennas, without user-specific precoding.
Each edge user then feeds the
received weight waveforms, together with its own GEMV input, into
calibration units, whose precoders and postcoders are derived from that user’s own channel by an SVD-based initialization and an ALS-based fine-tuning.
Summing the outputs of the
units gives the GEMV output of this round.
3.1.
Problem Formulation
We first introduce the basic configuration of the MIMO channel modeling, and then formulate the problem of designing the edge device hardware.
GEMV decoupling and IP parallelization.
In
AIR-LLM
, we consider an
MIMO system for any central radio and edge device pair.
This supports up to
parallel spatial streams, each carrying an IP pair of (
4
), so that one round of
AIR-LLM
completes
IPs and a GEMV takes
rounds.
For these
IPs per round, we denote the weight signals by
and the shared input signal by
, all spanning the
subcarriers, i.e.,
; their outputs are denoted by
with
.
MIMO channel modeling.
In
AIR-LLM
, we let the central radio broadcast signals
with
by the
-th antenna without precoding.
For a specific edge device with a channel
, the received signals are denoted by
with
received by the
-th antenna.
This signal transmission process directly follows the MIMO channel model in (
1
), with
.
Channel calibration challenges.
The design of the central radio is edge device-unaware, i.e., does not incorporate any information specific to a particular edge device (e.g., its channel), so that its broadcasting can be generalized for any edge device within its coverage.
In this case, the channel effect on
should be entirely calibrated at the edge device side.
However, the conventional channel calibration in (
2
) is not feasible for
AIR-LLM
for two reasons.
First, the channel effect applies to all the
subcarriers of
, whereas the outputs
are digitized only after the LPF has collapsed them into a single subcarrier, where the
per-subcarrier channel matrices are already mixed together and no longer separable.
Second, even if they were separable, applying (
2
) over the
subcarriers would take
FLOPs, approximately
the cost of the
IPs that it enables, overshadowing the energy savings that motivate
AIR-LLM
.
3.2.
Edge Calibration Unit Design
We design the
calibration units on the edge device to calibrate the channel effect, as shown in Fig.
3
.
Calibration unit architecture.
Generally, a calibration unit takes the digital signal
as input, which is (
i
) precoded and IFFTed in digital, (
ii
) split and duplicated into
ways in analog, (
iii
) respectively mixed with the analog received signals
across the
antennas and low-pass filtered, and (
iv
) postcoded in digital.
The key design of this calibration unit is the precoding on the
and the postcoding on the
.
Precoding for per-subcarrier calibration.
The precoding is performed on the input signal
to calibrate the non-flat frequency response of the channel.
This is because
spans all the
subcarriers, yet lacks any antenna-dimension information.
Hereby, we define the precoder
.
Denoting the precoded signal by
, the precoding process can be expressed as a per-subcarrier multiplication between
and
:
(6)
Precoded linear convolution in analog.
After the precoding, the input signal
is split into
ways and fed to the
RF mixers, which perform the
complex-valued convolutions in parallel against the respective received signals
, i.e.,
(7)
where
is the unpostcoded output of antenna
.
Postcoding for per-antenna calibration.
The postcoding is performed on the output signal
to calibrate the inter-antenna interference.
This is because
retains the full antenna dimension, while its frequency dimension is already down-sampled and aliased.
Specifically, we define the postcoder
, which is applied identically across all subcarriers; also, we denote the postcoded output signals by
with
.
The postcoding process can be written as:
(8)
Figure 3
.
The detailed calibration unit architecture and its handling of an inner product between the received weight vector
and the precoded input vector
.
Cooperation over multiple calibration units.
We place
such calibration units on the edge device, as shown in Fig.
3
.
Each calibration unit receives the same input signal
and the same received signals
from the
antennas, while applying a different precoder and postcoder, jointly denoted by
and
.
Correspondingly, the precoded input signals, unpostcoded outputs, and postcoded outputs are denoted by
,
, and
, respectively.
Finally, the outputs from all the calibration units are summed together into the final output, denoted by
with
, i.e.,
(9)
3.3.
Precoder and Postcoder Optimization
Putting (
6
), (
7
), (
8
), and (
9
) together, the ultimate goal of
AIR-LLM
is to minimize the mean squared error (MSE) between the final output signal
and the ground truth output signal
by optimizing the precoder
and postcoder
jointly across all calibration units.
We formulate this as the optimization problem in
OPT-Orig
.
Directly solving
OPT-Orig
requires the statistics of
and
.
In practice, however,
and
are not known a priori at the edge device, and obtaining them would require an online training phase that feeds known instances of
and
. The overhead of such training is unaffordable, far exceeding the rate at which the channel
itself varies over time.
Waiving the need of
and
.
Fortunately, we observe that
is bilinear in
, so the expectation objective in
OPT-Orig
depends only on the first/second-order statistics of
and
.
Hence, we assume that the entries of
and
are zero-mean and mutually independent, and i.i.d. within each; we also assume a high SNR region that ignores the noise term in (
1
).
Under these two assumptions, the second-order statistics of
and
reduce to scaled identity covariance matrices, so the expectation term in
OPT-Orig
collapses to a positive multiple of a channel-dependent-only objective, which becomes
OPT-Chan
below.
where
is the
identity matrix.
Intuitively,
OPT-Chan
requires the
precoder-postcoder pairs to jointly zero-force every per-subcarrier channel matrix
back to the identity matrix, independently of the weights
or inputs
.
In the following,
AIR-LLM
solves
OPT-Chan
in two steps: initialization and fine-tuning.
Step 1: closed-form approximation for initialization.
Generally, the objective in
OPT-Chan
is bilinear in
and
, which jointly have to reproduce the inverse of the channel
across all the
subcarriers.
Relative to
OPT-Chan
,
OPT-Approx
introduces a single approximation: it drops the inherent per-subcarrier weighting by the channel magnitudes, as the residual in
OPT-Chan
is exactly that of
OPT-Approx
right-multiplied by
.
Specifically,
denotes merging the two antenna dimensions into one, so that
OPT-Approx
introduces the flattened postcoder
and the flattened channel inverse
, the latter inverted per subcarrier.
By the Eckart–Young–Mirsky theorem
(
Mirsky, 1960
)
,
OPT-Approx
can be solved in closed form by taking the singular value decomposition (SVD) of
and keeping its
largest singular values.
Unflattening the resulting
back into the two antenna dimensions provides the initialization of
OPT-Chan
, denoted by
and
.
Step 2: alternating least squares (ALS) for fine-tuning.
Starting from
and
, we refine towards the objective in
OPT-Chan
by alternating between two convex and closed-form least-squares updates until convergence:
•
Precoder step
: fixing
, we optimize
to balance the zero-forcing residual across the frequency dimension, i.e., the
subcarriers, which reduces to a linear least-squares problem solved independently per subcarrier.
•
Postcoder step
: fixing
, we optimize
to cancel the inter-antenna interference respectively for each subcarrier, which also reduces to a linear least-squares problem, solved independently per output antenna.
Both steps admit closed-form solutions, so each ALS iteration is cheap; given the Step 1 initialization, convergence typically occurs within a handful of iterations.
A detailed optimization process of these two steps is shown in Appendix
B.2
and
B.3
.
3.4.
System Efficiency Analysis
We analyze the efficiency of
AIR-LLM
along two dimensions: the airtime it occupies the wireless channel, and the energy it consumes on the edge device.
Airtime analysis.
The airtime of
AIR-LLM
is inversely proportional to the number of antennas
and the occupied bandwidth
.
Interestingly, this form exactly follows a conventional communication link with spatial multiplexing on
and frequency multiplexing on
.
On the other hand,
AIR-LLM
’s airtime is independent of the SNR, which instead determines the computing accuracy;
AIR-LLM
therefore does not customize the transmitted signals for each user, and is naturally fit to broadcasting.
Leveraged by broadcasting, one transmission of the weights serves arbitrarily many edge users at a constant airtime, so the airtime amortized per user decreases as
.
The complete analysis is given in Appendix
C.3
.
Energy analysis.
Overall,
AIR-LLM
achieves good energy efficiency on RF computing, whose energy per FLOP is further averaged down as the GEMV scales up to LLM.
This is because the energy consumption of almost every hardware component in
AIR-LLM
is amortized by either the input size
or the output size
, leaving the DAC, whose per-FLOP energy is set by the antenna number
and the unit number
, as the floor that a large GEMV converges to.
Such a scaling law is contributed by two key designs.
First, the RF mixer and the LPF collapse the whole input dimension into a single subcarrier with a downsampling ratio of
, so the ADC takes only one sample per inner product, which usually dominates the energy budget of an analog computing system; the postcoding runs on that same single sample per antenna, so its energy is amortized by
as well.
Second, the precoding and the IFFT are paid only once per GEMV, as the same precoded input signal
is reused across all the
rounds, so their energy is amortized by the output size
.
The per-component analysis is in Appendix
C.4
.
Tradeoff on computing accuracy, airtime, and energy.
The calibration unit number
is where these three metrics meet.
On the accuracy side,
OPT-Chan
calibrates the channel with a rank-
approximation, so a larger
leaves a smaller residual and thus a more accurate channel calibration; and the more antennas
are deployed, the larger
this accuracy requires.
On the energy side, however, every energy term grows linearly with
.
Scaling up
therefore shortens the airtime but pays for its accuracy in energy, so
should be the smallest that meets the target task’s accuracy.
4.
Implementation
We implement
AIR-LLM
on the wireless channels of real-world urban scenes by a ray-tracing simulator, and on the distortion of a real RF mixer, measured on a wired testbed.
4.1.
Channel Modeling by Ray Tracing
(a)
Paris
(b)
Munich
(c)
Testbed
Figure 4
.
The two Sionna ray-tracing scenes in Paris (a) and Munich (b), and the testbed for RF mixer profiling.
Sionna ray-tracing simulator.
We build the wireless channel between the central radio and the edge devices on top of NVIDIA Sionna’s ray-tracing engine (v2.0.1)
(
Hoydis et al., 2022
;
Hoydis et al., 2023
)
.
Specifically, Sionna simulates the wireless signal propagation process by shooting
rays into a digital twin of a real-world city scene and resolving their interactions (e.g., reflection, refraction, and diffraction) with the buildings, grounds, etc.
Assembling these propagation paths, it provides the realistic channel
that the weight signal
propagates through to each of the edge devices.
As shown in Fig.
4
(a) and (b), we evaluate
AIR-LLM
in two contrasting urban scenes: (
i
) Place Charles de Gaulle in Paris, open enough that a line-of-sight (LOS) path always holds, and (
ii
) the city center of Munich, densely built so that multipath is rich while the LOS path is often blocked.
Central radio configuration.
The central radio sits at the center of each scene, 10 m above the ground.
It carries
antennas (
by default) on
physical elements, each of two orthogonal polarizations, spaced 1.7 m apart.
It broadcasts the weight signal on the CBRS band
(
Sohul et al., 2015
)
at a 3.5 GHz carrier frequency over 100 MHz of bandwidth.
The default broadcast power per antenna is set to 50 dBm, and the coverage radius is 100 m.
Edge device configuration.
We randomly drop 100 edge devices at 1.5 m height within the central radio’s coverage zone.
Each edge device carries the same cross-polarized
-port array with 4.3 cm spacing (half-wavelength), and
calibration units, whose coders are derived from a least-squares per-antenna pilot estimate
.
We assume the devices’ noise figure of 4 dB, corresponding to a noise floor of -90 dBm across the 100 MHz bandwidth; their path loss (PL) from the central radio is estimated by its own channel as
.
4.2.
Hardware Profiling on Real RF Mixer
RF mixers are not built for analog multiplication, and hence distort the desired product.
We therefore measure the distortion of a real RF mixer, ZEM-4300+
(
Mini-Circuits, 2024
)
, driven by USRP X310 radios
(
Ettus Research, 2024
)
as the transceivers, as shown in Fig.
4
(c).
The profiling is wired, so the power entering the mixer stays far above the noise floor; the link is thus considered noiseless, and the computing errors are fully attributed to the mixer’s own distortion.
Specifically, for each power at the mixer’s RF port, which receives the weight signal over the air in a deployment, we sweep the power at its LO port and keep the lowest distortion error, i.e., the best effective number of bits (ENOB), that the mixer reaches.
The measured distortion ENOB curve over the RF power is shown in Fig.
A2
of Appendix
E.1
.
In our evaluation, we read this curve at each edge device’s received weight signal power and plug in the corresponding distortion error.
5.
Evaluation
5.1.
Benchmarking on GEMV
(a)
ENOB vs. user PL
(b)
ENOB vs. central radio power
Figure 5
.
In both Paris and Munich, the ENOB of a randomized GEMV over user PL (a) and broadcast power (b).
We first benchmark
AIR-LLM
on a single GEMV with randomized weights and input activations.
The computing accuracy is measured by ENOB defined in Appendix
E.3
.
GEMV accuracy over the user PL.
Following the default setup in §
4.1
, Fig.
5
scatters the ENOB of a randomized GEMV by each of the 100 candidate users in Paris and Munich against their PLs.
The ENOB generally decreases with the PL, as a higher PL lowers the power, and thus the SNR, of the weight signal arriving at the user.
The open scene of Paris, where an LOS path is more likely and the PL is therefore lower (median 84.0 dB), reaches a median ENOB of 3.97 bit with 5/95-th percentiles of 1.58/5.69 bit, whereas the users of Munich, mostly without an LOS path (median 91.4 dB), reach only 2.91 bit with 0.53/5.33 bit.
In addition, the PL does not determine the ENOB, which further depends on how the received power is spread over the multi-path components: within a PL of 89–91 dB alone, the ENOB still ranges over 2.01–5.33 bit.
We empirically select the user with approximately 4.00 bit at 86.3 dB in Paris and that of approximately 3.00 bit at 94.1 dB in Munich, starred in the figure, as the default for the experiments below.
GEMV accuracy over the central radio power.
Fig.
5
sweeps the central radio transmit power from 30 dBm to 70 dBm on the two selected users.
Both scenes follow the same two-stage trend: the ENOB first grows by roughly 1 bit per 10 dB of transmit power, and then saturates.
The Munich user, for example, climbs from 1.20 bit at 30 dBm to 3.55 bit at 55 dBm, but to only 3.87 bit when further increased to 70 dBm power.
In the first stage, the GEMV accuracy is limited by the received weight signal power against the noise floor; in the second, by the imperfect channel compensation of the
units and the RF mixer’s imperfect multiplication.
(a)
ENOB vs. energy
(b)
Energy per ENOB level
Figure 6
.
With
, the ENOB over
or energy (a), and the minimum energy to achieve 2–4 ENOBs in Paris.
(a)
ENOB
(b)
Norm. energy per FLOP
Figure 7
.
When scaling up the GEMV sizes, the ENOB (a) and the energy per FLOP breakdown of
AIR-LLM
(b).
Table 2
.
Over the nine LLMs, the WikiText-2 PPL of
AIR-LLM
on the selected users of Paris and Munich vs. the FP16, WoQ, and analog computing baselines, at the sequence length of 2,048.
†
keep the first block’s value projection (0.012% of the weights) in FP16, to alleviate its massive outliers.
Trading off computing accuracy, energy, and airtime.
Compared to WISE
(
Gao et al., 2026b
)
, the special case of
AIR-LLM
with
,
AIR-LLM
involves MIMO to save the airtime of a GEMV: the airtime is proportional to the inverse antenna number
. On the other hand, the corresponding wireless channel takes more calibration units
to compensate, and the energy consumption is proportional to
.
Fig.
6
illustrates this trade-off in Paris on a single-round GEMV of
and
, sweeping
at
, i.e., an airtime gain of 2/4/8/16/32
over WISE, with each array at the central radio power of 40/50/60/70/80 dBm.
Given
, a larger
compensates for the channel more accurately and is saturated at some point depending on the channel’s complexity.
At
, for example, the ENOB climbs from 0.55 bit at
to 3.97 at 8 units and 5.07 at 10; five further units then add only 0.43 bit while costing 1.5
the energy.
Fig.
6
extracts the minimum energy reaching each ENOB level, normalized to that by WISE: 3 bit costs 1.02/1.90/3.86/5.09/9.60
and 4 bit costs 1.54/2.44/5.86/6.96/13.59
at
.
This suggests that, to reduce the airtime with a larger
, the same ENOB requires more energy consumption, because an
-entry per-subcarrier matrix takes more units to invert.
The same trends hold in Munich, whose results are shown in Appendix
F.1
.
Scaling up the GEMV size.
In Fig.
7
, we scale up the GEMV’s input and output sizes together, over
.
Up to
, where a GEMV is completed within a single round, the computing accuracy stays at 5.58–5.75 bit in Paris and 3.85–3.94 bit in Munich.
Beyond that point, where multiple rounds are needed, the ENOB drops slightly to 3.99–4.51 and 3.10–3.39 bit, respectively, which is maintained as the size keeps scaling up.
AIR-LLM
therefore supports good computing accuracy on the large-scale GEMVs that are widely used in LLMs.
Fig.
7
further illustrates the energy per FLOP over the same sweep of GEMV scales, normalized to that of the FP16 baseline.
That of FP16 and of the WoQ baselines, counting both the data movement and the digital computing, is constant over the sweep, with W4A16/W3A16 3.72/4.80
more energy efficient than FP16.
In contrast,
AIR-LLM
’s energy per FLOP scales down as the GEMV scales up.
A small GEMV is bottlenecked by the digital arithmetic of the precoding, the IFFT, and the postcoding (e.g., only 3.81
more energy efficient than FP16 at
), after which the bottleneck moves to the DAC, whose per-FLOP cost is constant over the GEMV size (e.g., 50.2
more energy efficient than FP16 at
).
The ADC energy, which dominates conventional analog computing, is nearly free because of
AIR-LLM
’s downsampling ratio of
.
In applications whose GEMV input is itself an analog waveform, e.g., a received wireless signal or a biomedical sensor readout, this bottlenecked DAC energy is waived as well.
This is exactly the regime an LLM runs in, whose inference is dominated by large GEMVs, and where
AIR-LLM
therefore costs the edge device the least.
5.2.
Benchmarking on LLM
We run whole LLMs with all weight-activation GEMVs computed in analog by
AIR-LLM
, and the remaining in digital.
The LLM tasks and the WoQ/analog computing baselines are described in Appendix
E.2
and
E.3
.
PPL on WikiText-2.
In Tab.
2
, we present the WikiText-2 PPL at the sequence length of 2,048 over nine LLMs of four families: LLaMA-3.2 (1B and 3B), LLaMA-3.1 (8B and 70B), LLaMA-2 (7B and 13B), Mistral-7B, and Gemma-4 (E2B and E4B).
The selected user in Paris, resolving about 4 bit, is read against the W4A16 baselines (RTN, GPTQ
(
Frantar et al., 2023
)
, and AWQ
(
Lin et al., 2024
)
) and the ENOB-4 analog computing baselines (AWGN and HyFlexPIM
(
Song et al., 2025
)
); the user in Munich, at about 3 bit, against their W3A16 and ENOB-3 counterparts.
In Paris, specifically,
AIR-LLM
beats the best of the WoQ baselines on 7 out of the 9 LLMs, and the best of the analog computing baselines on 4 of the 9, staying within 5.6% of it on the other five.
In Munich, where every baseline loses more at 3 bit, it beats the best of the W3A16 and of the ENOB-3 baselines on 7 and 5 of the 9, respectively.
Such comparable or slightly lower PPLs show that the errors of
AIR-LLM
, including the thermal noise, the hardware distortion, and the imperfect channel compensation, still leave enough computing accuracy for an LLM inference.
Energy consumption per token.
Fig.
8
illustrates the per-token energy the edge device spends on the nine LLMs at the selected user in Paris, against four baselines that combine the remote/local weight storage with the FP16/W4A16 precision.
All these energy consumptions are normalized to that of the remote FP16 on LLaMA-3.1-8B.
On the same LLaMA-3.1-8B,
AIR-LLM
costs 157.7
and 40.4
less energy than the remote FP16 and W4A16, respectively, and against the local FP16 and W4A16, whose weights are more easily accessible from the device’s own memory,
AIR-LLM
still wins by 51.5
and 13.9
.
Such an energy gain holds over all nine LLMs.
Specifically for the two W4A16 baselines, whose PPL is comparable to
AIR-LLM
,
AIR-LLM
gains 35.4–44.0
against the remote one, owing to the downsampling ratio of
at
AIR-LLM
’s ADC, as well as the much lighter digital pipeline behind it.
AIR-LLM
even achieves 12.9–14.3
against the local one, whose weights are easier to access than
AIR-LLM
’s, thanks to the waiving of the energy-expensive data movement.
The Munich device draws the same conclusion against its own W3A16 baselines, as reported in Fig.
A5
.
Airtime per token.
In Paris, Fig.
9
presents the per-token airtime occupying the wireless channel, including
AIR-LLM
and the two remote baselines on the same nine LLMs.
Similarly, the airtime is normalized to that of the remote FP16 on LLaMA-3.1-8B; the two local baselines occupy no channel and are therefore skipped.
On LLaMA-3.1-8B,
AIR-LLM
takes 5.11
less airtime than the remote FP16 baseline, and slightly less airtime of 1.28
compared to the W4A16 baseline.
Both ratios stay constant at 5.11
and 1.28
across all nine LLMs, as the airtime of
AIR-LLM
and that of the remote baselines are proportional to the same weight count.
In this single-user case, the close airtime to the W4A16 baseline comes from the physical limit of the wireless channel (
27
): the airtime is scaled down linearly with the bandwidth
and the antenna number
for both the communication and
AIR-LLM
’s computing, and their remaining difference in the SNR is canceled out once the baseline is quantized to the specific weight width giving the close PPL performance to
AIR-LLM
.
Similar ratios are also observed in Munich in Fig.
A5
of Appendix
F.2
.
In a dense-user scenario, however,
AIR-LLM
’s broadcasting capability significantly outperforms these WoQ baselines regarding the airtime, which is later shown in §
5.4
.
Figure 8
.
The normalized energy per token of
AIR-LLM
vs. four baselines over the nine LLMs.
Figure 9
.
The normalized airtime per token of
AIR-LLM
vs. two remote baselines over the nine LLMs.
Table 3
.
In the prefilling phase, the PPL of
AIR-LLM
in Paris and Munich over different sequence lengths.
PPL over the sequence length.
In Tab.
3
, we sweep the sequence length from 256 to 16,384 tokens to evaluate
AIR-LLM
’s robustness over the context length of the prefilling phase.
The PPLs of the FP16 baseline and of
AIR-LLM
in Paris/Munich fall as the context grows, and
AIR-LLM
’s relative gap to the FP16 reference narrows and then flattens, spanning 3.9–6.6% and 17.1–25.3% over the sweep while settling at about 4.0% and 17.3% beyond 2,048 tokens.
This suggests that
AIR-LLM
’s computing error does not accumulate along the context, and that the same robustness would potentially extend to the much longer contexts demanded by future LLM applications.
Note that
AIR-LLM
’s per-token energy and airtime are constant along this axis, since both are dominated by streaming the weights of each layer once per token, independent of the token number.
5.3.
Impact of the System Factors
We examine more deployment factors, such as transmit power, antenna/calibration unit number, and frequency band.
Table 4
.
The PPL of
AIR-LLM
in Paris and Munich over different central radio broadcasting power.
Impact of the central radio transmit power.
We evaluate the impact of the transmit power under the same LLaMA-3.1-8B setup in Paris and Munich, which is presented in Tab.
4
.
The Paris user is already saturated at 35 dBm with 9.1% above the FP16 reference of 6.24, and raising the power to 60 dBm narrows that gap only to 3.8%.
This hints that the computing error of this user comes from the imprecise channel calibration and the RF mixer’s imperfection.
In comparison, the Munich user is still power-limited: its PPL stays orders of magnitude above the FP16 reference below 50 dBm, and then improves steeply to 8.8% at 60 dBm, meaning that its computing accuracy is mainly determined by the thermal noise.
Both observations match the two-stage trend of Fig.
5
.
In
AIR-LLM
, users under different channel conditions are limited by different sources of the computing error, which in turn decides whether more transmit power pays off.
Table 5
.
The PPL of
AIR-LLM
in Paris and Munich at
with a varying number of calibration units,
.
Table 6
.
The PPL of
AIR-LLM
at ISM (0.915 GHz) and mmWave (28 GHz) bands with different
combinations.
Freq.
BW
Power
User
(GHz)
(MHz)
(dBm)
0.915
25
30/40
Paris
6.73
6.35
6.32
6.32
Mun.
7.32
7.35
6.62
6.72
3.5
100
50/60
Paris
6.49
6.32
6.74
6.50
Mun.
7.37
7.46
6.95
6.59
28
400
80/90
Paris
7.07
6.35
8.59
6.78
Mun.
198.95
402.40
Impact of the antenna and calibration unit number.
The joint impact of
and
on LLaMA-3.1-8B’s PPL is shown in Tab.
5
, where we consider
with different
.
Given
, the PPL falls from above
at 2 units to 6.49/7.37 at 8 units in Paris/Munich and then saturates; as for
, the saturation point moves to around 32 units, with 6.74/6.95 PPLs, respectively.
Theoretically, a perfect inversion takes
units in
OPT-Approx
; in practice, fortunately, approximately
units already achieve a good PPL on LLM applications, saving approximately 1/2 energy consumption.
This is because a realistic channel comprises a limited number of multi-path components, whose singular values decay rapidly.
Performance in other bands.
We repeat the sweeps above in the 0.915 GHz ISM band with 25 MHz bandwidth, and the 28 GHz mmWave band with 400 MHz bandwidth, on the same two users in Paris/Munich, as summarized in Tab.
6
.
Moving the frequency changes both the PL and the richness of the multipath; the former is compensated by setting its own broadcast power.
The PPLs at 0.915 GHz are accordingly comparable to those at 3.5 GHz, within 0.42 of each other across the eight
combinations, whereas the sparser multipath at 28 GHz leaves the Munich user unusable, with PPLs always
even at 90 dBm.
The full results can be found in Appendix
F.3
.
5.4.
Broadcasting to Massive Edge Users
Finally, we move to the 20-edge-user scenes served by a single central radio’s broadcasting LLM weights.
(a)
Paris
(b)
Munich
Figure 10
.
The broadcasting of LLaMA-3.1-8B to the 20 users with WikiText-2 PPL labeled in Paris (a) and Munich (b).
PPL over the edge users.
Fig.
10
marks the positions of the 20 edge users per scene, spanning PLs of 70.0–99.9 dB in Paris and 68.6–105.0 dB in Munich.
We also label each user with its respective PPL on LLaMA-3.1-8B using
AIR-LLM
, and the CDFs are further given in Fig.
11
.
Specifically for Paris, the median PPL is 6.52, better than the W4A16 baseline of 6.65, and in Munich it is 7.23, better than the W3A16 baseline of 8.24; 70% and 80% of the users, respectively, fall below these two baselines.
Note that one extreme user in Paris suffers an outlier PPL of 255.27.
Despite its PL of 84.0 dB, its received power concentrates on too few multi-path components to support spatial multiplexing, which leaves its channel matrix
nearly singular.
Such a degradation also appears for the communication-based baselines whose channel capacity collapses on the same link; for
AIR-LLM
, it can be alleviated by falling back to fewer antennas
, which trades the airtime for a better-conditioned
.
Energy over the edge users.
The averaged per-token energy of
AIR-LLM
over the same set of 20 users against the four baselines of each scene is shown in Fig.
11
.
In Paris,
AIR-LLM
consumes 160.5
/41.1
less mean energy than the remote FP16 and W4A16 baselines, and 51.5
/13.9
less than the two local ones; similar numbers of 160.6
/31.2
and 51.5
/10.7
can also be observed in Munich comparing to the W3A16 baselines.
AIR-LLM
’s energy consumption is constant regardless of users’ positions and wireless channels, and is stably better than both the communication-based remote baselines, whose energy follows each user’s own link, and the data movement-based local ones.
(a)
PPL
(b)
Energy per token
Figure 11
.
In both scenes, the PPL CDFs vs. those by FP/WoQ baselines (a), and the energy per token comparison (b).
Airtime over the edge users.
Fig.
12
plots the total airtime that one token takes while the first
users are served.
The communication baselines are based on unicasting, where every user is served separately at its own MCS customized to its channel quality.
Thus, serving
users costs
the airtime of a single user, and the total grows linearly.
In comparison,
AIR-LLM
broadcasts the weights for the 20 users simultaneously, because the central radio is user-unaware and one uniform transmission is fed to every user inside the coverage.
Therefore, the airtime of
AIR-LLM
is constant over
, which is 104.1
/26.0
less than that by the FP16/W4A16 baselines with 20 users.
Munich shows the same in Fig.
A7
of Appendix
F.4
.
This broadcast- and user-scalable feature lets
AIR-LLM
serve the thriving number of future edge users.
Figure 12
.
The cumulative airtime over
by
AIR-LLM
and the FP16/WoQ baselines in Paris.
6.
Related Works
LLM accelerators.
Serving an LLM is memory-bounded by the weight movement rather than arithmetic
(
Guo et al., 2025
)
.
One category of works shrinks the bits per weight and co-designs the compute units around the resulting mixed-format GEMVs
(
Frantar et al., 2023
;
Lin et al., 2024
;
Xiao et al., 2023
;
Tseng et al., 2024
)
, with the hardware absorbing the outliers
(
Guo et al., 2023
;
Lee et al., 2024
)
or the dequantization
(
Park et al., 2025
;
Mo et al., 2025
;
Wu et al., 2026
)
; a second attacks the movement rather than the format, placing the compute next to the memory that holds the weights and the KV cache
(
Park et al., 2024
;
Heo et al., 2024
;
Yun et al., 2024
)
.
All share one premise: the weights are already stored in the device’s memory, and only the cost of fetching and multiplying a resident weight is optimized.
AIR-LLM
removes that premise: no weight is stored on the edge device; each arrival of the broadcast weight waveform is consumed and computed directly in the RF/analog domain.
LLM deployment on the edge.
On-device LLM serving is a capacity problem before a compute one, and the systems response keeps as few weights resident as possible: pruning
(
Niu et al., 2020
)
, activation sparsity
(
Song et al., 2024
;
Wang et al., 2024
)
, flash streaming
(
Alizadeh et al., 2024
)
, or accelerator–model co-design
(
Yu et al., 2024
)
.
Yet even a quantized resident model stays memory-bound on commodity phones, where energy and thermals make continuous generation untenable
(
Laskaridis et al., 2024
)
.
The complementary response moves the model off the device
(
Kwon et al., 2023
;
Stojkovic et al., 2025
;
Kang et al., 2017
)
, trading the memory wall for a per-query network cost and for handing the prompt to the server.
Both leave each device paying, privately and per token, for the same weights that every other device in the cell also pays for
(
Qu et al., 2024
)
.
AIR-LLM
instead disaggregates the weight storage to the central radio while keeping both the computation and the prompt on the edge, and because its transmission is edge-device-unaware, one broadcast is mixed by every device in the coverage at once, amortizing the delivery cost over the devices served.
Such one-to-many analog delivery has precedent in SoftCast
(
Jakubczak and Katabi, 2011
)
, which broadcasts video over raw OFDM at a fidelity set by each receiver’s own channel.
7.
Conclusion
In this paper, we present
AIR-LLM
, an LLM inference architecture for edge users that is
memory-access-free
,
user-scalable
and
energy-efficient
.
Specifically,
AIR-LLM
exploits MIMO spatial multiplexing to deliver multiple weight streams at a time and thereby shorten the airtime, and the design of the precoder–postcoder pair on the edge user energy-efficiently calibrates its own wireless channel.
Exhaustive evaluations on the NVIDIA Sionna ray-traced channels and the profiling of a real RF mixer reveal that, with a slight PPL gap to the FP16 baseline,
AIR-LLM
cuts the per-token energy and airtime by orders of magnitude.
We believe
AIR-LLM
opens up a new path for the next generation of edge intelligence.
Acknowledgements.
This work was supported in part by the NSF AI Institute for Edge Computing Leveraging Next Generation Networks (Athena) under award #2112562, by the Army Research Office (ARO) under grant W911NF-25-1-0241, and by the Air Force Research Laboratory (AFRL) under Cooperative Agreement No. FA8750-25-2-0500.
References
3GPP (2022a)
3GPP
NR; physical layer procedures for data (Release 17)
.
Technical report
Technical Report
TS 38.214
,
3rd Generation Partnership Project
.
Note:
Modulation and coding scheme tables, Sec. 5.1.3.1
Cited by:
§E.3
.
3GPP (2022b)
3GPP
NR; user equipment (UE) radio access capabilities (Release 17)
.
Technical report
Technical Report
TS 38.306
,
3rd Generation Partnership Project
.
Note:
Approximate data rate formula, Sec. 4.1.2
Cited by:
§E.3
.
Abbaspourazad
et al.
(2024)
S. Abbaspourazad, O. Elachqar, A. C. Miller, S. Emrani, U. Nallasamy, and I. Shapiro
Large-scale training of foundation models for wearable biosignals
.
In
Proc. ICLR’24
,
Cited by:
§1
.
Alizadeh
et al.
(2024)
K. Alizadeh, I. Mirzadeh, D. Belenko, K. Khatamifard, M. Cho, C. C. Del Mundo, M. Rastegari, and M. Farajtabar
LLM in a flash: efficient large language model inference with limited memory
.
In
Proc. ACL’24
,
Cited by:
Table 1
,
§6
.
Ambrogio
et al.
(2023)
S. Ambrogio, P. Narayanan, A. Okazaki, A. Fasoli, C. Mackin, K. Hosokawa, A. Nomura, T. Yasuda, A. Chen, A. Friz,
et al.
An analog-AI chip for energy-efficient speech recognition and transcription
.
Nature
620
(
7975
),
pp. 768–775
.
Cited by:
§6
.
Antepara
et al.
(2025)
O. Antepara, Z. Zhao, B. Austin, N. Ding, L. Oliker, N. J. Wright, and S. Williams
Benchmark-driven models for energy analysis and attribution of GPU-accelerated supercomputing
.
In
Proc. ACM/IEEE SC’25
,
Cited by:
§E.3
,
§1
.
Bisk
et al.
(2020)
Y. Bisk, R. Zellers, J. Gao, and Y. Choi
PIQA: reasoning about physical commonsense in natural language
.
In
Proc. AAAI’20
,
Cited by:
§E.3
.
Chi
et al.
(2016)
P. Chi, S. Li, C. Xu, T. Zhang, J. Zhao, Y. Liu, Y. Wang, and Y. Xie
PRIME: a novel processing-in-memory architecture for neural network computation in ReRAM-based main memory
.
In
Proc. ACM/IEEE ISCA’16
,
Cited by:
§1
.
Clark
et al.
(2019)
C. Clark, K. Lee, M. Chang, T. Kwiatkowski, M. Collins, and K. Toutanova
BoolQ: exploring the surprising difficulty of natural yes/no questions
.
In
Proc. NAACL-HLT’19
,
Cited by:
§E.3
.
Clark
et al.
(2018)
P. Clark, I. Cowhey, O. Etzioni, T. Khot, A. Sabharwal, C. Schoenick, and O. Tafjord
Think you have solved question answering? Try ARC, the AI2 reasoning challenge
.
arXiv preprint arXiv:1803.05457
.
Cited by:
§E.3
.
Dettmers and Zettlemoyer (2023)
T. Dettmers and L. Zettlemoyer
The case for 4-bit precision:
-bit inference scaling laws
.
In
Proc. ICML’23
,
Cited by:
§6
.
Frantar
et al.
(2023)
E. Frantar, S. Ashkboos, T. Hoefler, and D. Alistarh
GPTQ: accurate post-training quantization for generative pre-trained transformers
.
In
Proc. ICLR’23
,
Cited by:
§E.2
,
Table 1
,
§1
,
§5.2
,
§6
.
Gao
et al.
(2026a)
Z. Gao, S. Ma, Y. Chen, D. Englund, and T. Chen
Radio-frequency convolutional neural networks
.
arXiv preprint arXiv:2609.19279
.
Cited by:
§1
,
§2.2
,
§6
.
Gao
et al.
(2026b)
Z. Gao, S. K. Vadlamani, K. Sulimany, D. Englund, and T. Chen
Disaggregated deep learning via in-physics computing at radio frequency
.
Sci. Adv.
12
(
2
),
pp. eadz0817
.
Cited by:
§1
,
§5.1
,
§6
.
Gemma Team (2026)
Gemma Team
Gemma 4 technical report
.
arXiv preprint arXiv:2607.02770
.
Cited by:
§E.3
,
§1
.
Grattafiori
et al.
(2024)
A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan,
et al.
The Llama 3 herd of models
.
arXiv preprint arXiv:2407.21783
.
Cited by:
§E.3
,
§1
,
§1
.
Guo
et al.
(2025)
C. Guo, F. Cheng, Z. Du, J. Kiessling, J. Ku, S. Li, Z. Li, M. Ma, T. Molom-Ochir, B. Morris,
et al.
A survey: collaborative hardware and software design in the era of large language models
.
IEEE Circuits Syst. Mag.
25
(
1
),
pp. 35–57
.
Cited by:
§1
,
§6
.
Guo
et al.
(2023)
C. Guo, J. Tang, W. Hu, J. Leng, C. Zhang, F. Yang, Y. Liu, M. Guo, and Y. Zhu
OliVe: accelerating large language models via hardware-friendly outlier-victim pair quantization
.
In
Proc. ACM/IEEE ISCA’23
,
Cited by:
§6
.
Harpe
et al.
(2011)
P. J. A. Harpe, C. Zhou, Y. Bi, N. P. van der Meijs, X. Wang, K. Philips, G. Dolmans, and H. de Groot
A 26
w 8 bit 10 MS/s asynchronous SAR ADC for low energy radios
.
IEEE J. Solid-State Circuits
46
(
7
),
pp. 1585–1595
.
Cited by:
§E.3
.
Heo
et al.
(2024)
G. Heo, S. Lee, J. Cho, H. Choi, S. Lee, H. Ham, G. Kim, D. Mahajan, and J. Park
NeuPIMs: NPU-PIM heterogeneous acceleration for batched LLM inferencing
.
In
Proc. ACM ASPLOS’24
,
Cited by:
§6
.
Hoydis
et al.
(2023)
J. Hoydis, F. Ait Aoudia, S. Cammerer, M. Nimier-David, N. Binder, G. Marcus, and A. Keller
Sionna RT: differentiable ray tracing for radio propagation modeling
.
In
Proc. IEEE GLOBECOM Workshops’23
,
Cited by:
§4.1
.
Hoydis
et al.
(2022)
J. Hoydis, S. Cammerer, F. Ait Aoudia, A. Vasudevan, M. Nimier-David, N. Binder, G. Marcus, and A. Keller
Sionna: an open-source library for next-generation physical layer research
.
arXiv preprint arXiv:2203.11854
.
Cited by:
§4.1
.
Hu
et al.
(2022)
Y. Hu, S. Fang, Z. Lei, Y. Zhong, and S. Chen
Where2comm: communication-efficient collaborative perception via spatial confidence maps
.
In
Proc. NeurIPS’22
,
Cited by:
§1
.
Jakubczak and Katabi (2011)
S. Jakubczak and D. Katabi
A cross-layer design for scalable mobile video
.
In
Proc. ACM MobiCom’11
,
Cited by:
§6
.
Jiang
et al.
(2023)
A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. de las Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier,
et al.
Mistral 7B
.
arXiv preprint arXiv:2310.06825
.
Cited by:
§E.3
,
§1
.
Kang
et al.
(2017)
Y. Kang, J. Hauswald, C. Gao, A. Rovinski, T. Mudge, J. Mars, and L. Tang
Neurosurgeon: collaborative intelligence between the cloud and mobile edge
.
In
Proc. ACM ASPLOS’17
,
Cited by:
Table 1
,
§1
,
§6
.
Khaddam-Aljameh
et al.
(2022)
R. Khaddam-Aljameh, M. Stanisavljevic, J. Fornt Mas, G. Karunaratne, M. Brändli, F. Liu, A. Singh, S. M. Müller, U. Egger, A. Petropoulos,
et al.
HERMES-core—a 1.59-TOPS/mm
PCM on 14-nm CMOS in-memory compute core using 300-ps/LSB linearized CCO-based ADCs
.
IEEE J. Solid-State Circuits
57
(
4
),
pp. 1027–1038
.
Cited by:
§1
,
§6
.
Kwon
et al.
(2023)
W. Kwon, Z. Li, S. Zhuang, Y. Sheng, L. Zheng, C. H. Yu, J. E. Gonzalez, H. Zhang, and I. Stoica
Efficient memory management for large language model serving with PagedAttention
.
In
Proc. ACM SOSP’23
,
Cited by:
Table 1
,
§6
.
Laskaridis
et al.
(2024)
S. Laskaridis, K. Katevas, L. Minto, and H. Haddadi
MELTing point: mobile evaluation of language transformers
.
In
Proc. ACM MobiCom’24
,
Cited by:
§6
.
Le Gallo
et al.
(2023)
M. Le Gallo, R. Khaddam-Aljameh, M. Stanisavljevic, A. Vasilopoulos, B. Kersting, M. Dazzi, G. Karunaratne, M. Brändli, A. Singh, S. M. Müller,
et al.
A 64-core mixed-signal in-memory compute chip based on phase-change memory for deep neural network inference
.
Nat. Electron.
6
(
9
),
pp. 680–693
.
Cited by:
Table 1
,
§1
,
§6
.
Lee
et al.
(2024)
J. Lee, W. Lee, and J. Sim
Tender: accelerating large language models via tensor decomposition and runtime requantization
.
In
Proc. ACM/IEEE ISCA’24
,
Cited by:
§6
.
Lin
et al.
(2024)
J. Lin, J. Tang, H. Tang, S. Yang, W. Chen, W. Wang, G. Xiao, X. Dang, C. Gan, and S. Han
AWQ: activation-aware weight quantization for on-device LLM compression and acceleration
.
In
Proc. MLSys’24
,
Cited by:
§E.2
,
Table 1
,
§1
,
§5.2
,
§6
.
Liu
et al.
(2026)
Y. Liu, Y. Pan, M. Wang, S. Zhao, H. Zhu, Y. Han, L. Zhang, and Y. Wang
Ouroboros: wafer-scale SRAM CIM with token-grained pipelining for large language model inference
.
In
Proc. ACM ASPLOS’26
,
Cited by:
§1
.
Merity
et al.
(2017)
S. Merity, C. Xiong, J. Bradbury, and R. Socher
Pointer sentinel mixture models
.
In
Proc. ICLR’17
,
Cited by:
§E.3
.
Mirsky (1960)
L. Mirsky
Symmetric gauge functions and unitarily invariant norms
.
Q. J. Math.
11
(
1
),
pp. 50–59
.
Cited by:
§B.2
,
§3.3
.
Mo
et al.
(2025)
Z. Mo, L. Wang, J. Wei, Z. Zeng, S. Cao, L. Ma, N. Jing, T. Cao, J. Xue, F. Yang,
et al.
LUT tensor core: a software-hardware co-design for LUT-based low-bit LLM inference
.
In
Proc. ACM/IEEE ISCA’25
,
Cited by:
§6
.
Nazer and Gastpar (2007)
B. Nazer and M. Gastpar
Computation over multiple-access channels
.
IEEE Trans. Inf. Theory
53
(
10
),
pp. 3498–3516
.
Cited by:
Table 1
,
§1
,
§6
.
Niu
et al.
(2020)
W. Niu, X. Ma, S. Lin, S. Wang, X. Qian, X. Lin, Y. Wang, and B. Ren
PatDNN: achieving real-time DNN execution on mobile devices with pattern-based weight pruning
.
In
Proc. ACM ASPLOS’20
,
Cited by:
§6
.
Olieman
et al.
(2015)
E. Olieman, A. Annema, and B. Nauta
An interleaved full Nyquist high-speed DAC technique
.
IEEE J. Solid-State Circuits
50
(
3
),
pp. 704–713
.
Cited by:
§E.3
.
Pan
et al.
(2025)
H. Pan, Y. Wang, J. Liu, R. Ma, L. Qiu, Y. Chen, G. Xue, and J. Ren
CGMM: non-invasive continuous glucose monitoring in wearables using metasurfaces
.
In
Proc. ACM MobiCom’25
,
Cited by:
§1
.
Park
et al.
(2025)
G. Park, H. Kwon, J. Kim, J. Bae, B. Park, D. Lee, and Y. Lee
FIGLUT: an energy-efficient accelerator design for FP-INT GEMM using look-up tables
.
In
Proc. IEEE HPCA’25
,
Cited by:
§6
.
Park
et al.
(2024)
J. Park, J. Choi, K. Kyung, M. J. Kim, Y. Kwon, N. S. Kim, and J. H. Ahn
AttAcc! unleashing the power of PIM for batched transformer-based generative model inference
.
In
Proc. ACM ASPLOS’24
,
Cited by:
§6
.
Qu
et al.
(2024)
G. Qu, Z. Lin, F. Liu, X. Chen, and K. Huang
TrimCaching: parameter-sharing AI model caching in wireless edge networks
.
In
Proc. IEEE ICDCS’24
,
Cited by:
§6
.
Radford
et al.
(2023)
A. Radford, J. W. Kim, T. Xu, G. Brockman, C. McLeavey, and I. Sutskever
Robust speech recognition via large-scale weak supervision
.
In
Proc. ICML’23
,
Cited by:
§1
.
Reus-Muns
et al.
(2023)
G. Reus-Muns, K. Alemdar, S. G. Sanchez, D. Roy, and K. R. Chowdhury
AirFC: designing fully connected layers for neural networks with wireless signals
.
In
Proc. ACM MobiHoc’23
,
Cited by:
Table 1
,
§1
,
§6
.
Sakaguchi
et al.
(2020)
K. Sakaguchi, R. Le Bras, C. Bhagavatula, and Y. Choi
WinoGrande: an adversarial Winograd schema challenge at scale
.
In
Proc. AAAI’20
,
Cited by:
§E.3
.
Shafiee
et al.
(2016)
A. Shafiee, A. Nag, N. Muralimanohar, R. Balasubramonian, J. P. Strachan, M. Hu, R. S. Williams, and V. Srikumar
ISAAC: a convolutional neural network accelerator with in-situ analog arithmetic in crossbars
.
In
Proc. ACM/IEEE ISCA’16
,
Cited by:
Table 1
,
§1
,
§6
.
Shen
et al.
(2017)
Y. Shen, N. C. Harris, S. Skirlo, M. Prabhu, T. Baehr-Jones, M. Hochberg, X. Sun, S. Zhao, H. Larochelle, D. Englund,
et al.
Deep learning with coherent nanophotonic circuits
.
Nat. Photon.
11
(
7
),
pp. 441–446
.
Cited by:
Table 1
,
§6
.
Sludds
et al.
(2022)
A. Sludds, S. Bandyopadhyay, Z. Chen, Z. Zhong, J. Cochrane, L. Bernstein, D. Bunandar, P. B. Dixon, S. A. Hamilton, M. Streshinsky,
et al.
Delocalized photonic deep learning on the internet’s edge
.
Science
378
(
6617
),
pp. 270–276
.
Cited by:
Table 1
,
§6
.
Sohul
et al.
(2015)
M. M. Sohul, M. Yao, T. Yang, and J. H. Reed
Spectrum access system for the citizen broadband radio service
.
IEEE Commun. Mag.
53
(
7
),
pp. 18–25
.
Cited by:
§4.1
.
Song
et al.
(2025)
C. E. Song, P. Bhatnagar, Z. Xia, N. S. Kim, T. S. Rosing, and M. Kang
Hybrid SLC-MLC RRAM mixed-signal processing-in-memory architecture for transformer acceleration via gradient redistribution
.
In
Proc. ACM/IEEE ISCA’25
,
Cited by:
§5.2
.
Song
et al.
(2024)
Y. Song, Z. Mi, H. Xie, and H. Chen
PowerInfer: fast large language model serving with a consumer-grade GPU
.
In
Proc. ACM SOSP’24
,
Cited by:
Table 1
,
§6
.
Stojkovic
et al.
(2025)
J. Stojkovic, C. Zhang, Í. Goiri, J. Torrellas, and E. Choukse
DynamoLLM: designing LLM inference clusters for performance and energy efficiency
.
In
Proc. IEEE HPCA’25
,
Cited by:
Table 1
,
§6
.
Touvron
et al.
(2023)
H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale,
et al.
Llama 2: open foundation and fine-tuned chat models
.
arXiv preprint arXiv:2307.09288
.
Cited by:
§E.3
,
§1
.
Tseng
et al.
(2024)
A. Tseng, J. Chee, Q. Sun, V. Kuleshov, and C. De Sa
QuIP#: even better LLM quantization with Hadamard incoherence and lattice codebooks
.
In
Proc. ICML’24
,
Cited by:
§6
.
Wan
et al.
(2022)
W. Wan, R. Kubendran, C. Schaefer, S. B. Eryilmaz, W. Zhang, D. Wu, S. Deiss, P. Raina, H. Qian, B. Gao,
et al.
A compute-in-memory chip based on resistive random-access memory
.
Nature
608
(
7923
),
pp. 504–512
.
Cited by:
Table 1
,
§1
,
§6
.
Wang
et al.
(2024)
Q. Wang, S. Vahidian, H. Ye, J. Gu, J. Zhang, and Y. Chen
CoreInfer: accelerating large language model inference with semantics-inspired adaptive sparse activation
.
arXiv preprint arXiv:2410.18311
.
Cited by:
§6
.
Wu
et al.
(2024)
X. Wu, E. Hanson, N. Wang, Q. Zheng, X. Yang, H. Yang, S. Li, F. Cheng, P. P. Pande, J. R. Doppa,
et al.
Block-wise mixed-precision quantization: enabling high efficiency for practical ReRAM-based DNN accelerators
.
IEEE Trans. Comput.-Aided Design Integr. Circuits Syst.
43
(
12
),
pp. 4558–4571
.
Cited by:
§6
.
Wu
et al.
(2026)
X. Wu, B. Zhou, Z. Gao, Y. Fu, Q. Zheng, Y. He, and H. Li
OASIS: outlier-aware LUT-based GEMM with dual-side quantization for LLM inference acceleration
.
In
Proc. ACM/IEEE ISCA’26
,
Cited by:
§6
.
Xiao
et al.
(2023)
G. Xiao, J. Lin, M. Seznec, H. Wu, J. Demouth, and S. Han
SmoothQuant: accurate and efficient post-training quantization for large language models
.
In
Proc. ICML’23
,
Cited by:
§6
.
Xu
et al.
(2025)
D. Xu, H. Zhang, L. Yang, R. Liu, G. Huang, M. Xu, and X. Liu
Fast on-device LLM inference with NPUs
.
In
Proc. ACM ASPLOS’25
,
Cited by:
§1
.
Yazdani
et al.
(2016)
R. Yazdani, A. Segura, J. Arnau, and A. Gonzalez
An ultra low-power hardware accelerator for automatic speech recognition
.
In
Proc. IEEE/ACM MICRO’16
,
Cited by:
§1
.
Yu
et al.
(2024)
Z. Yu, S. Liang, T. Ma, Y. Cai, Z. Nan, D. Huang, X. Song, Y. Hao, J. Zhang, T. Zhi,
et al.
Cambricon-LLM: a chiplet-based hybrid architecture for on-device inference of 70B LLM
.
In
Proc. IEEE/ACM MICRO’24
,
Cited by:
§6
.
Yun
et al.
(2024)
S. Yun, K. Kyung, J. Cho, J. Choi, J. Kim, B. Kim, S. Lee, K. Sohn, and J. H. Ahn
Duplex: a device for large language models with mixture of experts, grouped query attention, and continuous batching
.
In
Proc. IEEE/ACM MICRO’24
,
Cited by:
§6
.
Zellers
et al.
(2019)
R. Zellers, A. Holtzman, Y. Bisk, A. Farhadi, and Y. Choi
HellaSwag: can a machine really finish your sentence?
.
In
Proc. ACL’19
,
Cited by:
§E.3
.
Zhang
et al.
(2021)
X. Zhang, A. Zhang, J. Sun, X. Zhu, Y. E. Guo, F. Qian, and Z. M. Mao
EMP: edge-assisted multi-vehicle perception
.
In
Proc. ACM MobiCom’21
,
Cited by:
§1
.
Zhang
et al.
(2025)
Y. Zhang, X. Hu, X. Chen, Z. Yuan, C. Li, J. Zhu, Z. Wang, C. Zhang, X. Si, W. Gao,
et al.
AIM: software and hardware co-design for architecture-level IR-drop mitigation in high-performance PIM
.
In
Proc. ACM/IEEE ISCA’25
,
Cited by:
§6
.
Zhong
et al.
(2023)
Z. Zhong, M. Yang, J. Lang, C. Williams, L. Kronman, A. Sludds, H. Esfahanizadeh, D. Englund, and M. Ghobadi
Lightning: a reconfigurable photonic-electronic SmartNIC for fast and energy-efficient inference
.
In
Proc. ACM SIGCOMM’23
,
Cited by:
Table 1
,
§6
.
Zhou
et al.
(2025)
T. Zhou, Y. Jiang, Z. Xu, Z. Xue, and L. Fang
Hundred-layer photonic deep learning
.
Nat. Commun.
16
(
1
),
pp. 10382
.
Cited by:
§6
.
Zhu
et al.
(2020)
G. Zhu, Y. Wang, and K. Huang
Broadband analog aggregation for low-latency federated edge learning
.
IEEE Trans. Wireless Commun.
19
(
1
),
pp. 491–506
.
Cited by:
Table 1
,
§1
,
§6
.
Zhu
et al.
(2024)
H. Zhu, J. Gu, H. Wang, Z. Jiang, Z. Zhang, R. Tang, C. Feng, S. Han, R. T. Chen, and D. Z. Pan
Lightening-transformer: a dynamically-operated optically-interconnected photonic transformer accelerator
.
In
Proc. IEEE HPCA’24
,
Cited by:
§6
.
Appendix A
Table of Notations
Table A1
.
Summary of the notation used in the main body.
Table A2
.
Additional notation used only in the appendices.
Appendix B
Blocked Correlation Operation
We generalize the linear-convolution mapping into a
blocked correlation operation
(BCO), where the mixer retains a whole output
block
of subcarriers rather than a single one.
B.1.
Definition and Realization
Definition of BCO.
We define the BCO by
.
Its two operands, weights and inputs, are both complex valued, given by
and
, each consisting of
blocks.
These
blocks are correlated in parallel, and their correlation outputs are accumulated into a single output block
, defined as
(14)
where the block sizes satisfy
.
A BCO thus costs
additions and as many multiplications, i.e.,
FLOPs.
The GEMV mapping of (
4
) is the degenerate case
and
, in which every block holds one scalar and (
14
) reduces to the
-element inner product of (
5
).
Realizing BCO with an RF mixer.
In the frequency domain, an RF mixer convolves two analog signals,
and
, into
, which is the correlation of (
14
) once one operand is reversed in subcarrier order, as in (
4
).
To realize a BCO, we let the FFT size be
, i.e., one length-
subcarrier slot per block.
The frequency-domain weight signal
is obtained from
by zero-padding each block
into the length-
segment
, and the input signal
is obtained from
in the same way, i.e.,
(15)
for all
and
.
The zero padding guarantees that the correlation of one block never leaks into the subcarrier slot of the next.
Correlating
with
spans
slots, and every matching block pair
lands in the
same
, middle slot of index
, which therefore accumulates the correlation outputs of all
blocks, exactly as (
14
) prescribes.
This middle slot is extracted by the LPF, whose output signal
satisfies
for all
.
Since the subcarrier spacing
is shared by all three signals, this output occupies a bandwidth of only
and is digitized with
fewer ADC samples than the full-band signal, which is where
AIR-LLM
’s ADC energy saving comes from.
Implication on the calibration units.
The calibration unit of §
3.3
carries over unchanged, with one structural caveat on the precoder.
Under BCO, the
subcarriers within a block jointly carry one correlation, so they must be scaled
identically
: a per-subcarrier precoder would reweight the individual correlation taps and destroy the block structure of (
14
).
The precoder is therefore constant within each block, i.e.,
with the subcarrier
driven by
, which is precisely the form optimized in (
17
) of §
B.2
.
The postcoder, in contrast, acts across antennas only and is applied identically to all subcarriers, so it is unaffected.
For a GEMV,
makes the per-block and the per-subcarrier precoder identical, recovering the main-body design.
B.2.
Pre-/Post-coder Optimization
Following the optimization derivation in §
3.3
, the BCO version of the optimization can be written as
Waiving the need of
and
.
The argument of §
3.3
carries over verbatim, as the BCO changes neither the objective nor its bilinearity in
.
Assuming zero-mean i.i.d. entries and a high SNR region, the expectation in (
16
) again collapses to a positive multiple of a channel-dependent-only objective, which becomes
where
is the
identity matrix.
The only difference from
OPT-Chan
is the precoder index: the floor
ties all
subcarriers of a block to one coefficient, as §
B.1
requires.
Its two-step solution below follows §
3.3
: a closed-form initialization, then ALS fine-tuning.
(a)
Paris:
against
at each stage of the solve
(b)
Munich:
against
at each stage of the solve
(c)
Paris:
OPT-Chan
loss and the ENOB per ALS iteration
(d)
Munich:
OPT-Chan
loss and the ENOB per ALS iteration
Figure A1
.
What the two steps of
OPT-Chan
buy on the selected users at
and
:
against
at four stages of the solve (a, b), and the (
17
) loss and its ENOB per ALS iteration (c, d).
Step 1: closed-form initialization.
Since one precoder coefficient now serves a whole block, we average the channel within each block into
, which is accurate as long as the frequency response varies smoothly across the
subcarriers of a block:
(18)
The optimization then collapses from
subcarriers to
blocks, i.e.,
As in
OPT-Approx
, we then flatten the two antenna dimensions of the postcoder into
, i.e.,
(20)
The flattened channel inverse
is now inverted per block rather than per subcarrier, so its
-th column is the zero-forcing solution of block
alone:
(21)
This turns (
19
) into a standard rank-
matrix approximation problem.
By the Eckart–Young–Mirsky theorem
(
Mirsky, 1960
)
, this is solved in closed form by the SVD of
truncated to its
largest singular values, whose unflattened result
and
initializes (
17
).
Compared with the main body, Step 1 under BCO carries one extra approximation, the per-block channel of (
19
), on top of dropping the weighting by the channel magnitudes.
Step 2: alternating least squares (ALS) for fine-tuning.
Starting from
and
, we alternate two closed-form least-squares updates on (
17
) until convergence, both of which reinstate the per-subcarrier channel that Step 1 averages away:
•
Precoder step
: fixing
, (
17
) decouples across blocks, since
only affects the
subcarriers of block
.
Per block, the
coefficients
fit the
fixed bases
to
, stacked over the
subcarriers within that block.
•
Postcoder step
: fixing
, the postcoder is solved from one least-squares problem stacked over all
subcarriers, each contributing its own channel
and precoder coefficient
; it further decouples across the
output antennas.
Both steps are closed-form via the normal equations, so each iteration is cheap and, from the Step 1 initialization, only a few of them are needed.
B.3.
Convergence of the Optimization
We study how the two-step solve converges on the GEMV, i.e., the degenerate case
in which (
17
) reduces to the
OPT-Chan
of §
3.3
.
The two edge devices are the selected users of Paris and Munich of §
5.1
, resolving approximately 4.00 and 3.00 bit, so the numbers below are directly comparable to the evaluation.
What each step buys.
Fig.
A1
traces the two steps on the selected edge device of each scene.
Before either of them, the raw link is unusable: fitting the single complex gain that an AGC and a carrier recovery already provide leaves 0.00 bit in Paris and 0.05 bit in Munich, i.e., the frequency selectivity of
and its inter-antenna mixing alone destroy the GEMV.
The closed-form Step-1 initialization recovers most of it at once, cutting the loss of (
17
) from 0.998 to 0.013 in Paris and from 0.947 to 0.259 in Munich, i.e., to 3.12 and 0.97 bit.
The gap between the two scenes is the price of the per-block channel approximation of (
19
): the richer multipath of Munich makes the frequency response vary within a block, so the averaged
that Step 1 inverts sits further from the per-subcarrier channel that (
17
) actually scores, and the SVD initialization alone is worth about one bit there against three in Paris.
How many ALS iterations.
Figs.
A1
and
A1
answer how long Step 2 has to run.
A single ALS pass recovers most of what Step 1 leaves behind, dropping the loss by a further 2.7
in Paris and 17.5
in Munich to reach 3.79 and 2.85 bit.
Everything after that pass is a slow creep: iterations 2 through 10 add only 0.13 bit in Paris and 0.29 bit in Munich, and the relative-tolerance test stops the two devices at 40 and 22 iterations, at 4.08 and 3.13 bit.
Since one iteration is two closed-form least-squares solves and the optimization runs once per channel coherence time rather than per GEMV, we run it to that convergence throughout the evaluation, though stopping after the first pass would already sit within 0.29 bit of it.
Appendix C
Airtime and Energy Consumption
This section analyzes the two efficiency metrics of
AIR-LLM
, the airtime and the energy consumption per FLOP.
We derive them at the general block size of a BCO (§
C.1
and §
C.2
), and then substitute the GEMV mapping of the main body, its degenerate case, to read off the airtime and the energy of a GEMV (§
C.3
and §
C.4
).
C.1.
Airtime of a BCO
We analyze the
airtime
of
AIR-LLM
, i.e., how long the RF chain of an edge device is occupied to compute one FLOP.
It is bottlenecked by the duration of the signals, both the wireless one carrying
from the central radio and the local one carrying
, which the bandwidth
sets.
Airtime per round.
Each round of
AIR-LLM
receives one OFDM symbol carrying
across the
subcarriers, feeding
antennas/RF mixers for
parallel BCOs, two of them packed per antenna into the real and the imaginary parts; a layer of
outputs, all sharing the same input
, thus takes
rounds.
The airtime per round then scales as
(23)
Airtime per FLOP.
Normalizing (
23
) by the FLOPs that the
parallel BCOs complete within the round gives the per-FLOP airtime of a general BCO,
(24)
The block number
cancels out: splitting a layer into more, smaller blocks lengthens the round and adds FLOPs in the same proportion.
More generally, (
24
) rewards a block layout whose output block is short relative to the product of the two input block sizes, i.e., one whose correlation reuses each transmitted weight over many taps.
C.2.
Energy Consumption of a BCO
We analyze the edge-device-side energy consumption of
AIR-LLM
per FLOP by its complexity, i.e., the number of operations on three kinds of hardware, each costing a constant energy per operation: the DAC and the ADC, counted in samples, and the digital computing, counted in FLOPs.
Energy per module.
We account for the energy of one whole module, i.e., all
rounds of
BCOs, and then normalize by the FLOPs it completes, breaking the module energy into seven components along the signal chain,
(25)
i.e., the precoding, the IFFT, the DAC, the ADC, the FFT, the postcoding, and the cross-unit summation.
Each of the
calibration units precodes
per block and takes an
-point IFFT.
Both are paid only
once
for the whole module:
depends solely on the channel and every round mixes the same
with a new set of broadcast weights, so the precoded waveform is buffered and replayed across the rounds.
Within each of the
rounds, every unit then converts the waveform with one DAC over
samples, digitizes the LPF output of
samples per antenna, and decodes it with a
-point FFT plus postcoding, before the
units are summed.
Accumulating the latter five over the rounds gives the “Energy per module” column of Tab.
A3
, and dividing each term by the
FLOPs of the module gives its “Energy per FLOP” column.
Note that the ADC term is charged for
samples rather than
, since the BCO output occupies only the reduced bandwidth
.
Table A3
.
The energy complexity of one module on
AIR-LLM
under BCO and the seven terms per FLOP.
Unlike the airtime of (
24
), the block number
does not cancel here: it amortizes the receiver-side terms while it stretches the IFFT logarithmically, which is the trade-off a concrete block layout has to settle.
C.3.
Airtime of a GEMV
Airtime per GEMV.
Under the GEMV mapping,
and
, so that
and each round of (
23
) produces
IPs.
A GEMV of
IPs therefore takes
such rounds in serial, i.e., a signal duration per GEMV of
(26)
Airtime per FLOP.
Within this duration,
AIR-LLM
completes the entire GEMV of
FLOPs, so that
Airtime scaling law.
Notably, both layer sizes
and
cancel out of (
27
): a larger GEMV proportionally stretches the signal duration and the number of FLOPs completed within it, leaving the per-FLOP airtime unchanged.
What remains is governed solely by the bandwidth
and the antenna number
, independent of the SNR.
C.4.
Energy Consumption of a GEMV
Table A4
.
The energy complexity of one GEMV on
AIR-LLM
and the same seven terms per FLOP, along the signal chain.
Reading the seven terms at unit block sizes.
Substituting
and
into the “Energy per module” column of Tab.
A3
gives the “Energy per GEMV” column of Tab.
A4
, and dividing by the
FLOPs of the GEMV gives its “Energy per FLOP” column.
Two terms are worth reading out at these block sizes.
The ADC is charged for a single sample: the RF-mixer output has been low-pass filtered into a single-subcarrier bandwidth of
, so one complex sample captures the outputs of the whole IP pair by its real and imaginary components.
The FFT term vanishes with
, as the FFT that follows the ADC is trivial for its single sample per antenna.
Energy consumption scaling law.
Summing the six remaining per-FLOP terms of Tab.
A4
gives the energy per FLOP of
AIR-LLM
.
Every term of this per-FLOP energy consumption is amortized by one of the dimensions as the GEMV scales up in LLM:
•
Amortization over the input size
: the ADC, postcoding, and summation terms scale as
, as one ADC sample squeezes the whole input dimension into a scalar, on which the postcoding and the summation are performed regardless of
.
•
Amortization over the output size
: the precoding and IFFT terms scale as
, as the precoded waveform is stored and reused across all the rounds of a GEMV.
•
Amortization over the antenna number
: the DAC term scales as
, as its single waveform is fanned out to all the
RF mixers.
Among the three, the DAC term is the bottleneck, since
in practice: it is amortized only by how many antennas an edge device can physically deploy, which massive MIMO keeps relieving as it scales up the array.
Appendix D
AIR-LLM
in CNN
Convolutional (CONV) layers, which dominate CNNs, do not fit the one-subcarrier-per-output mapping of the main body: reusing the same kernel across all
positions of an image would require re-transmitting that kernel once per output pixel, so the broadcast weight traffic, the very resource
AIR-LLM
is built to save, would grow by
.
The BCO of Appendix
B
removes that restriction, as one mixing round now retains a whole output block instead of a single subcarrier, and a kernel broadcast once is correlated against every position of the image within it.
We map a Conv2D layer onto the BCO (§
D.1
), and then specialize the BCO airtime of §
C.1
and the BCO energy of §
C.2
to it (§
D.2
and §
D.3
).
D.1.
Mapping Conv2D onto BCO
Layer formulation.
We examine a general Conv2D layer with a kernel size of
, an image size of
,
input channels, and
output channels, so that
,
, and
.
We assume
is odd and that the correlation is zero-padded to preserve the image size.
Just as a GEMV decomposes into
inner products, this Conv2D decomposes into
independent sub-convolutions, one per output channel, each of which becomes one BCO; as the layer is real-valued whereas the BCO is complex-valued, two output channels are packed into the real and the imaginary parts of a single BCO, as the two IPs of (
4
) are.
Blocks as input channels, subcarriers as pixels.
For each sub-convolution we set
, letting one block correspond to one input channel, so that the block accumulation in (
14
) performs exactly the summation over input channels.
To embed the 2D image correlation into the 1D BCO, we flatten the
image row by row and pad each row with
zeros, so that the correlation of one row does not leak into the next; this gives each row a slot of length
, hence
(28)
The kernel is flattened the same way, row by row, but each of its rows is instead padded with
zeros so that its row stride matches that of the flattened image, giving
(29)
Following
and approximating away the
, the output block length is
(30)
out of which the
subcarriers sitting at the valid correlation lags carry
of this output channel, and the remainder are discarded together with the LPF-rejected slots.
Repeating this over all
output channels sweeps
and
while sharing the same
, exactly the structure the central radio broadcasts and the
antennas consume in parallel, two output channels per antenna.
Notably, the kernel is broadcast
once
for the whole image: the reuse of a kernel across positions is absorbed by the correlation itself rather than paid for in weight traffic.
Padding overhead.
The
BCOs nominally complete
FLOPs, of which only
are useful to the CONV layer; the rest are correlation taps created by the zero padding.
We denote this inefficiency by the ratio of nominal to useful FLOPs,
(31)
which approaches
for
.
All per-FLOP metrics below are reported per
useful
FLOP, i.e., scaled by
, so that they are directly comparable with the GEMV results of the main body.
D.2.
Airtime of Conv2D
Airtime per FLOP.
Substituting (
28
)–(
30
) into the per-FLOP airtime of a general BCO in (
24
), and scaling by the padding overhead
of (
31
), yields the airtime per useful FLOP of a Conv2D layer,
(32)
Comparison against GEMV.
Against the GEMV airtime
of (
27
), which shares the same proportionality constant, we have
(33)
Interestingly, despite the padding inefficiency
, a Conv2D layer is
faster
per useful FLOP than a GEMV, occupying up to
less airtime.
This is because the BCO’s block-wise correlation structure is intrinsically matched to the convolution’s reuse of one kernel across all positions of the image: a single OFDM symbol that carries
kernel taps produces
output pixels, whereas under the GEMV mapping the same symbol duration would produce only one.
D.3.
Energy Consumption of Conv2D
Table A5
.
The energy complexity of one Conv2D layer on
AIR-LLM
and the same seven terms per useful FLOP, along the signal chain, assuming
.
Assuming
, so that
and
in (
28
)–(
30
), and substituting the Conv2D mapping (
) into the “Energy per module” column of Tab.
A3
gives that of Tab.
A5
, and dividing by the
useful FLOPs of the layer gives its “Energy per useful FLOP” column.
Takeaways.
Two opposite trends are visible in Tab.
A5
.
On the one hand, the ADC and the cross-unit-summation terms both carry
and vanish as the layer deepens, exactly as in the GEMV case of Tab.
A4
: one ADC sample and one cross-unit addition now serve an entire input channel of the image rather than a single weight element, which is the saving that the reduced output bandwidth
buys and that the remote baseline cannot obtain.
The DAC term likewise decays as
, mirroring the airtime gain of (
33
).
On the other hand, the digital encoding and decoding terms do not cancel as cleanly.
Each of them does carry an amortization of its own, the transmitter-side precoding and IFFT over
and the receiver-side FFT and postcoding over
, so all three dimensions of §
C.4
survive the Conv2D mapping intact.
What survives with them, however, is a logarithmic factor the GEMV mapping does not have: the IFFT over all
subcarriers and the receive FFT over the
subcarriers of a block leave a residual
and
that both grow with the image size.
Consequently, unlike the airtime of §
D.2
, where a larger kernel or image is strictly beneficial, the energy of Conv2D trades the analog savings on the converters against the digital cost of the wider OFDM symbol, and the two must be weighed together when choosing
AIR-LLM
’s operating point.
Appendix E
Experimental Setup
This section details the baselines, the tasks, and the metrics of the evaluation, together with the two measurements that the implementation of §
4
rests on: the distortion profile of the RF mixer (Fig.
A2
) and the path-loss distribution of each ray-traced scene (Fig.
A3
).
Figure A2
.
On the wired testbed of Fig.
4
(c), the best ENOB of the ZEM-4300+ mixer over its RF port power.
(a)
Paris
(b)
Munich
Figure A3
.
Path-loss distribution across the candidate-device pool of each ray-tracing scene.
E.1.
Measured Distortion and Path Loss
Distortion profile of the RF mixer.
Fig.
A2
reports the wired sweep of §
4
: at each power delivered to the mixer’s RF port, the LO power is swept and the best ENOB is kept.
The ENOB climbs with the RF power and then flattens as the mixer’s own nonlinearity takes over from the drive level; this knee is the distortion floor that the saturated users of §
5.3
sit on.
Path loss across the candidate devices.
Fig.
A3
shows the PL distribution of the 100 candidate devices dropped in each scene, from which the representative devices of §
5.1
are selected.
The open scene of Paris is tightly concentrated, a single mode of median 84.0 dB with 5/95-th percentiles of 74.9/97.8 dB, since almost every drop keeps an LOS path to the central radio.
The dense scene of Munich is both worse and far wider, a median of 91.4 dB and percentiles of 75.2/131.3 dB, with a long shadowed tail of devices whose LOS path is blocked by a building.
Both scenes therefore span the range of link qualities from the noise-limited users of §
5.3
to the distortion-limited ones.
E.2.
Baselines
We benchmark
AIR-LLM
against digital baselines along two dimensions: the
precision
at which the weights are kept, and the
weight storage
from which they reach the edge device.
Precision dimension.
We take FP16 as the exact reference, and further consider weight-only quantization (WoQ) at 4/3 bit, i.e., W4A16 and W3A16, by RTN, GPTQ
(
Frantar et al., 2023
)
, and AWQ
(
Lin et al., 2024
)
.
Analog computing baselines.
We further benchmark against two analog computing baselines at the same ENOB as
AIR-LLM
’s device: (
i
)
AWGN
, additive Gaussian noise on each GEMV output, and (
ii
)
HyFlexPIM
, a multiplicative Gaussian error on each weight, i.e., the conductance spread of a memristive crossbar.
The former error is redrawn per GEMV, whereas the latter is frozen on the weights;
AIR-LLM
sits in between, as its thermal noise is redrawn per transmission while its calibration residual and mixer distortion hold for as long as the channel does.
Weight storage dimension.
Under
remote
storage, the weights are kept on the central radio and delivered to the edge device over the same wireless channel as
AIR-LLM
’s by a standard communication link.
Under
local
storage, they are instead pre-stored in the edge device’s memory.
AIR-LLM
targets the remote storage, which is both more realistic for edge computing and more challenging than the local one.
E.3.
Evaluation Tasks and Metrics
Benchmarking GEMV with ENOB.
We first benchmark
AIR-LLM
on a single GEMV
, whose weights
and inputs
are randomly drawn from i.i.d. Gaussian distributions, and quantify its computing accuracy by the effective number of bits (ENOB), defined as
(34)
where both the ground truth
and its estimate
are normalized by the standard deviation of
.
A trivial estimate
thus sits at exactly 0 bit.
Airtime and energy consumption.
We further report the airtime and the energy consumption per token.
The airtime is the time one token occupies the wireless link, the resource the central radio rations across the edge devices it serves; for the remote storage baselines, it is counted on the same ray-traced channel under a standard-compliant 5G NR link
(
3GPP, 2022a
;
3GPP, 2022b
)
, while the local storage baselines occupy no airtime.
The energy consumption is based on the per-operation energies of state-of-the-art DACs
(
Olieman et al., 2015
)
, ADCs
(
Harpe et al., 2011
;
Murmann, 2026
)
, digital computing
(
NVIDIA, 2024
)
, and data movement
(
Antepara et al., 2025
)
.
Appendix F
Supplementary Results
F.1.
Benchmarking on GEMV
(a)
ENOB vs. energy
(b)
Energy per ENOB level
Figure A4
.
Fig.
6
in Munich: the ENOB over energy (a), and the minimum energy to achieve 2–4 ENOBs (b).
Trading off accuracy, energy, and airtime in Munich.
Fig.
A4
repeats the sweep of Fig.
6
on the selected device of Munich, over the same
at the same paired central radio powers.
The trade-off of §
5.1
survives the denser scene, with the front sitting lower throughout.
Reading the minimum energy per ENOB level off Fig.
A4
, 2 bit costs 1.02/1.36/2.62/3.85/3.61
and 3 bit costs 1.02/2.17/4.32/6.55/6.46
at
, against the 1.02/1.90/3.86/5.09/9.60
that 3 bit costs in Paris, and 4 bit is out of reach below
, where it costs 8.52
and 8.08
.
What moves is the ENOB the sweep saturates at: at
this device tops out at 3.13 bit against 5.50 in Paris, and no number of calibration units lifts the smaller arrays over 4 bit.
The ordering over
then inverts against Paris.
The saturation ENOB
rises
with the array here, from 3.13 bit at
to 3.92, 4.71, and 5.24 bit at
, so much so that
reaches 4 bit more cheaply than
does; in Paris it instead falls from 5.50 bit at
to 4.33–4.62 bit over the same three arrays.
The two scenes read one cause from opposite sides: spatial multiplexing needs multipath to multiplex over, so the open scene runs out of usable spatial dimensions as its array grows, while the dense one keeps finding more of them.
F.2.
Benchmarking on LLM
(a)
Energy per token
(b)
Airtime per token
Figure A5
.
Figs.
8
and
9
in Munich: the normalized energy (a) and airtime (b) per token over the nine LLMs.
(a)
Paris
(b)
Munich
Figure A6
.
The 20 users of Fig.
10
in Paris (a) and Munich (b), each labeled with its PL, GEMV ENOB and WikiText-2 PPL.
Table A6
.
What the twenty devices of Paris in Fig.
A6
generate from the shared prompt “The Place de l’Étoile is a square in Paris, France, best known for…”, which the FP16 model continues as “… the Arc de Triomphe, located at its center. The place is named for the star-shaped design of the round”. PL is in dB, ENOB in bits, and PPL is measured on WikiText-2;
marks a line break inside a continuation.
Table A7
.
What the twenty devices of Munich in Fig.
A6
generate from the shared prompt “Munich is a city in southern Germany, best known for…”, which the FP16 model continues as “… its beer and Oktoberfest, the world’s largest beer festival. The city is also home to a number of museums,”. PL is in dB, ENOB in bits, and PPL is measured on WikiText-2;
marks a line break inside a continuation.
Energy and airtime per token in Munich.
Fig.
A5
repeats Figs.
8
and
9
on the selected device of Munich, whose roughly 3 bit of end-to-end resolution reads it against the W3A16 baselines.
The energy conclusion of §
5.2
carries over unchanged: on LLaMA-3.1-8B,
AIR-LLM
costs 165.5
and 32.1
less energy than the remote FP16 and W3A16 baselines, and 51.5
and 10.7
less than the two local ones, holding at 28.3–35.3
and 10.0–11.1
against the two W3A16 baselines over all nine LLMs.
That the gain against the local FP16 baseline is exactly the 51.5
of Paris is no coincidence:
AIR-LLM
’s per-token energy is set by its own DAC, digital pipeline, and unit number, none of which depends on the channel, and a local baseline pays data movement rather than airtime, so neither side of that ratio moves with the scene.
The airtime does move, and it moves in
AIR-LLM
’s favor: the remote FP16 baseline takes 5.37–5.42
AIR-LLM
’s airtime here against 5.11
in Paris, since the worse link costs the communication baseline capacity while
AIR-LLM
’s signal duration is fixed by
and
alone (
27
).
The quantized baseline, in contrast, closes to 1.01–1.02
from the 1.28
that W4A16 leaves in Paris: a quarter fewer bits per weight is enough to offset the capacity its own link costs it.
What each edge device generates.
Fig.
A6
and Tabs.
A6
and
A7
put the PPLs of §
5.4
next to what the model actually writes: each of the 20 devices per scene continues one shared prompt, with every GEMV of LLaMA-3.1-8B carried over that device’s own ray-traced channel.
The rows fall by ENOB, and the degradation along them is graded rather than abrupt.
Above about 3.5 bit, which 16 of the 20 devices reach in Paris and 8 in Munich, the continuations are fluent and name the city’s real landmarks, differing from the FP16 reference in which true fact they pick rather than in whether they pick one at all.
Below it they stay grammatical but drift into invented detail and begin to repeat themselves, e.g., device 3 of Paris at 3.21 bit dates a fountain to 1772 and device 11 of Munich at 3.16 bit loops on its beer gardens, while their PPLs are still only 7.99 and 7.27.
Only under about 2.5 bit do they collapse: device 18 of Paris restarts the prompt verbatim at 2.52 bit, device 4 of Munich does the same at 2.49 bit, and device 11 of Paris, the near-singular channel of §
5.4
, degenerates into repeated tokens at 2.00 bit and the outlying PPL of 255.27.
This is the practical reading of the CDFs in Fig.
11
:
AIR-LLM
degrades an LLM gracefully over most of a coverage zone, and the devices it fails are the few whose channel is too poorly conditioned to invert rather than the ones that are merely far away: device 12 of Munich, the most distant of all 40 at 105.0 dB, still resolves 4.19 bit and reads a PPL of 6.60.
Table A8
.
Over six commonsense-reasoning benchmarks, the zero-shot accuracy (%) of LLaMA-3.1-8B by
AIR-LLM
on the selected users of Paris and Munich vs. the FP16, WoQ, and analog computing baselines.
Table A9
.
The WikiText-2 PPL of LLaMA-3.1-8B when the weight signal is repeated 1 to 16 times and averaged, with
as the distortion floor.
Table A10
.
Tab.
4
repeated at the ISM (0.915 GHz) and mmWave (28 GHz) bands, each read against its own regulatory ceiling.
Table A11
.
Tab.
5
repeated at the ISM and mmWave bands, each at the transmit power where it saturates in Tab.
A10
.
Zero-shot accuracy using LLaMA-3.1-8B.
We evaluate
AIR-LLM
and the same set of baselines on LLaMA-3.1-8B’s inference on six commonsense-reasoning benchmarks, as shown in Tab.
A8
.
This metric is harsher on analog computing than the PPL, because of how it is scored: every candidate continuation is concatenated to the same stem and run through its own inference pass, and the answer is the candidate with the highest log-likelihood.
An error that is deterministic given the weights, the quantization grid of WoQ or the frozen conductance spread of HyFlexPIM, shifts all the candidates of a question in the same direction, so the comparison among them, and thus the argmax, largely survives.
A non-deterministic one does not: the AWGN baseline and
AIR-LLM
’s thermal noise are redrawn independently in every pass, so each candidate is scored under its own realization of the error, and the choice flips whenever that perturbation exceeds the log-likelihood margin between the candidates.
AWGN pays for this in full, collapsing to the chance level on all six tasks (37.98% at ENOB 4 and 36.30% at ENOB 3) despite an ENOB matched to
AIR-LLM
’s, whereas the weight-frozen HyFlexPIM stays within 0.42 points of the FP16 reference at ENOB 4.
AIR-LLM
sits between the two, averaging 68.72% in Paris and 65.67% in Munich against the 75.00% FP16 reference, as only its thermal noise is redrawn per transmission while its channel-calibration residual and the mixer’s distortion hold across the candidates of a question: Paris sits inside the W3A16 band (66.00–69.96%) and Munich 0.33 points below its weakest member.
Task by task, the degradation is mild where the margins between the candidate continuations are wide (77.85%/75.39% on HellaSwag against 78.89%, and 81.13%/75.20% on BoolQ against 81.96%), and the average is dominated by WinoGrande (57.77%/57.14% against 73.56%), whose two candidates differ in a single pronoun referent and whose log-likelihood margin is therefore the narrowest of the six, so a few bits of analog error are enough to flip the choice.
F.3.
Impact of the System Factors
Impact of repeating the weight signal.
The central radio may send the same weight signal several times and let the edge device average the copies, which trades airtime for a lower thermal noise: repeating it
times costs
times the airtime and lowers the noise power by
dB, while leaving the receive chain’s own distortion untouched.
Tab.
A9
sweeps this knob under the same LLaMA-3.1-8B setup as Tab.
4
, where the last column measures the distortion floor that no repetition count can pass.
The Paris user does not move at all, staying at 6.49 from a single copy to the floor, which confirms the same conclusion as its flat row in Tab.
4
: this user is already limited by the channel calibration and the RF mixer rather than by the noise.
The noise-limited Munich user does improve, but slowly: 16 copies, i.e., 16 times the airtime, buy 7.37 to 7.19, only 2.4% and already within 0.3% of its 7.17 floor.
Repetition is therefore a much worse deal than the transmit power for the same user, which buys 7.9% over the same 10 dB in Tab.
4
at no airtime cost, and we keep a single copy of the weight signal throughout the other evaluations.
Impact of the carrier frequency.
We repeat the transmit power sweep of Tab.
4
in two other bands, the 915 MHz ISM band over 25 MHz and the 28 GHz mmWave band over 400 MHz, on the same two edge devices at the same positions and under the same LLaMA-3.1-8B setup, as shown in Tab.
A10
.
The channels are re-traced at each carrier with the same scenes, whose ITU-R P.2040 material models are extrapolated below their 1 GHz lower edge for 915 MHz, and the noise floor follows the bandwidth of each band.
Since the path loss of the two devices drops by 12 dB at 915 MHz and grows by 32 dB (Paris) and 41 dB (Munich) at 28 GHz, the power axis is shifted accordingly, with the regulatory ceilings of 36 dBm EIRP in the ISM band and 75 dBm per 100 MHz at 28 GHz inside the swept range.
In the ISM band, both devices reach the accuracy of the paper’s operating point at 20 dB less power: Munich reads 7.28 at 30 dBm against the 7.37 that Tab.
4
measures at 50 dBm, while Paris has already saturated at 6.72.
Both therefore stay usable inside the regulatory ceiling, reading 6.70 and 6.74 at 35 dBm, and the band’s own floors (6.69 in Paris and 6.44 in Munich) even reverse the two devices’ order, the lower carrier reaching the more distant device better than the nearer one.
What the band costs is airtime: its 25 MHz is a quarter of the bandwidth
that (
26
) divides, so every GEMV occupies four times the air.
At 28 GHz the trade reverses.
Paris needs 80 dBm to saturate, 30 dB more than at 3.5 GHz, and saturates 9% worse, at a floor of 7.05 against 6.48; this gap is a distortion floor that no transmit power removes, the sparser multipath of the band leaving each per-subcarrier channel matrix worse conditioned for the calibration units to invert.
Munich, another 17 dB of path loss away (a gap the band itself widens, from 7.9 dB at 3.5 GHz to 16.7 dB here), never becomes usable at all: 170.87 at the regulatory ceiling and still 9.98 at 100 dBm, i.e., 19 dB beyond what the band is allowed to radiate.
Its 400 MHz does cut the airtime fourfold, but only for a device close enough to the central radio to spend it.
Across the three bands, therefore, the carrier frequency trades airtime against coverage almost one for one, and
AIR-LLM
is the more comfortable the lower the band, the opposite of where the spectrum for it is easiest to find.
Calibration units in the other bands.
Tab.
A11
repeats the antenna and calibration unit sweep of Tab.
5
in both other bands, on the same two devices and with the same two antenna blocks.
Each block is read at the transmit power where its own band saturates these devices, taken off Tab.
A10
rather than carried over from the 3.5 GHz table, so that the unit count is again the only quantity the table varies: 30 dBm at
and 40 dBm at
in the ISM band, and 80 dBm and 90 dBm at 28 GHz, each following the same
dB step between the two antenna blocks that the 3.5 GHz table uses.
F.4.
Broadcasting to Massive Edge Users
Figure A7
.
Fig.
12
in Munich, against the same 3-bit baseline.
Airtime over the edge users in Munich.
Fig.
A7
repeats Fig.
12
on the 20 devices of Munich, against that scene’s W3A16 baseline.
The picture is the one of §
5.4
, if anything sharper: the unicast baselines still grow linearly in the user number
while
AIR-LLM
’s single broadcast stays flat, so at
it takes 104.2
and 19.5
less airtime than the FP16 and the W3A16 baselines.
Note that the gain against FP16 is the same 104
as in Paris even though every individual link here is worse: both sides of that ratio are read on the same channels, so the scene cancels out of it, and what remains is the
-fold duplication that a unicast pays and a broadcast does not.
The gain against the quantized baseline is smaller than the 26.0
that W4A16 leaves in Paris only because W3A16 carries a quarter fewer bits per weight, and not because the broadcast advantage has weakened.
Iosevka is an open-source, sans-serif and slab-serif, monospace font
Iosevka
is an
open-source
,
sans-serif
+
slab-serif
,
monospace
+
quasi‑proportional
typeface family, designed for
writing code
, using in
terminals
, and preparing
technical documents
.
Iosevka
Monospace
Iosevka Term
Monospace
Iosevka Fixed
Monospace, Ligation Off
Iosevka Slab
Monospace
Iosevka Term Slab
Monospace
Iosevka Fixed Slab
Monospace, Ligation Off
Iosevka Aile
Quasi-Proportional
Iosevka Etoile
Quasi-Proportional
Regular
Bold
Thin
ExtraLight
Light
Medium
SemiBold
ExtraBold
Heavy
Character Variant Features
The Iosevka’s monospace family is provided in a
slender outfit
by default: glyphs are exactly
1/2em wide
. Compared to the competitors, you could fit more columns within the same screen width.
Iosevka provides two widths,
Normal
and
Extended
. If you prefer more breeze between the character, choose Extended and enjoy.
# UCD DATA Section
00B0 ; DEGREE SIGN ; So ; 0 ; ET ; ; ; ; ; N ; ; ; ; ;
00B1 ; PLUS-MINUS SIGN ; Sm ; 0 ; ET ; ; ; ; ; N ; PLUS-OR-MINUS SIGN ; ; ; ;
00B2 ; SUPERSCRIPT TWO ; No ; 0 ; EN ; <super> 0032 ; ; 2 ; 2 ; N ; SUPERSCRIPT DIGIT TWO ; ; ; ;
00B3 ; SUPERSCRIPT THREE ; No ; 0 ; EN ; <super> 0033 ; ; 3 ; 3 ; N ; SUPERSCRIPT DIGIT THREE ; ; ; ;
00B4 ; ACUTE ACCENT ; Sk ; 0 ; ON ; <compat> 0020 0301 ; ; ; ; N ; SPACING ACUTE ; ; ; ;
00B5 ; MICRO SIGN ; Ll ; 0 ; L ; <compat> 03BC ; ; ; ; N ; ; ; 039C ; ; 039C
00B6 ; PILCROW SIGN ; Po ; 0 ; ON ; ; ; ; ; N ; PARAGRAPH SIGN ; ; ; ;
00B7 ; MIDDLE DOT ; Po ; 0 ; ON ; ; ; ; ; N ; ; ; ; ;
00B8 ; CEDILLA ; Sk ; 0 ; ON ; <compat> 0020 0327 ; ; ; ; N ; SPACING CEDILLA ; ; ; ;
00B9 ; SUPERSCRIPT ONE ; No ; 0 ; EN ; <super> 0031 ; ; 1 ; 1 ; N ; SUPERSCRIPT DIGIT ONE ; ; ; ;
00BA ; MASCULINE ORDINAL INDICATOR ; Lo ; 0 ; L ; <super> 006F ; ; ; ; N ; ; ; ; ;
00BB ; RIGHT-POINTING DOUBLE ANGLE QUOTATION MARK ; Pf ; 0 ; ON ; ; ; ; ; Y ; RIGHT POINTING GUILLEMET ; ; ; ;
00BC ; VULGAR FRACTION ONE QUARTER ; No ; 0 ; ON ; <fraction> 0031 2044 0034 ; ; ; 1/4 ; N ; FRACTION ONE QUARTER ; ; ; ;
00BD ; VULGAR FRACTION ONE HALF ; No ; 0 ; ON ; <fraction> 0031 2044 0032 ; ; ; 1/2 ; N ; FRACTION ONE HALF ; ; ; ;
00BE ; VULGAR FRACTION THREE QUARTERS ; No ; 0 ; ON ; <fraction> 0033 2044 0034 ; ; ; 3/4 ; N ; FRACTION THREE QUARTERS ; ; ; ;
00BF ; INVERTED QUESTION MARK ; Po ; 0 ; ON ; ; ; ; ; N ; ; ; ; ;
00C0 ; LATIN CAPITAL LETTER A WITH GRAVE ; Lu ; 0 ; L ; 0041 0300 ; ; ; ; N ; LATIN CAPITAL LETTER A GRAVE ; ; ; 00E0 ;
00C1 ; LATIN CAPITAL LETTER A WITH ACUTE ; Lu ; 0 ; L ; 0041 0301 ; ; ; ; N ; LATIN CAPITAL LETTER A ACUTE ; ; ; 00E1 ;
00C2 ; LATIN CAPITAL LETTER A WITH CIRCUMFLEX ; Lu ; 0 ; L ; 0041 0302 ; ; ; ; N ; LATIN CAPITAL LETTER A CIRCUMFLEX ; ; ; 00E2 ;
00C3 ; LATIN CAPITAL LETTER A WITH TILDE ; Lu ; 0 ; L ; 0041 0303 ; ; ; ; N ; LATIN CAPITAL LETTER A TILDE ; ; ; 00E3 ;
00C4 ; LATIN CAPITAL LETTER A WITH DIAERESIS ; Lu ; 0 ; L ; 0041 0308 ; ; ; ; N ; LATIN CAPITAL LETTER A DIAERESIS ; ; ; 00E4 ;
00C5 ; LATIN CAPITAL LETTER A WITH RING ABOVE ; Lu ; 0 ; L ; 0041 030A ; ; ; ; N ; LATIN CAPITAL LETTER A RING ; ; ; 00E5 ;
00C6 ; LATIN CAPITAL LETTER AE ; Lu ; 0 ; L ; ; ; ; ; N ; LATIN CAPITAL LETTER A E ; ; ; 00E6 ;
00C7 ; LATIN CAPITAL LETTER C WITH CEDILLA ; Lu ; 0 ; L ; 0043 0327 ; ; ; ; N ; LATIN CAPITAL LETTER C CEDILLA ; ; ; 00E7 ;
00C8 ; LATIN CAPITAL LETTER E WITH GRAVE ; Lu ; 0 ; L ; 0045 0300 ; ; ; ; N ; LATIN CAPITAL LETTER E GRAVE ; ; ; 00E8 ;
00C9 ; LATIN CAPITAL LETTER E WITH ACUTE ; Lu ; 0 ; L ; 0045 0301 ; ; ; ; N ; LATIN CAPITAL LETTER E ACUTE ; ; ; 00E9 ;
Terminal emulators have a stricter compatibility requirements for fonts. Therefore, Iosevka and Iosevka Slab all contain two specialized families,
Term
and
Fixed
, targeting terminal users.
In these families, the symbols will be
narrower
to follow terminals’ ideology of column count. In the Fixed families, the ligation will be disabled to ensure better compatibility in certain environments.
Iosevka
∑
{
n
∈
▲
}
🅇
(
n
)
○
->
Ⓨ
[
n
]
▢△◈
Iosevka Term
∑
{
n
∈
▲
}
🅇
(
n
)
○
->
Ⓨ
[
n
]
▢△◈
Iosevka Fixed
∑
{
n
∈
▲
}
🅇
(
n
)
○
->
Ⓨ
[
n
]
▢△◈
Iosevka provides
146
configurable characters with
19
stylistic sets, which gives you incredible ability to customize one variant that fills exactly what you need. You can either select one pre-defined stylistic set, or cherry-pick your flavor.
Iosevka’s monospace families supports not only one
ligation set
, but also
language-specific ligations
. Enable the corresponded OpenType feature in your editor, and the correct ligation will appear.
Leveraging advanced OpenType techniques, Iosevka also supports
long ligatures
like long arrows or horizontal bars built up with equal signs.
-<<-<-<-<--<---<<-<-->->>-->--->->->->>-
=<<=<=<=<==<===<<=<==>=>>==>===>=>=>=>>=
<-><--><---><----><=><==><===><====>:::::__
<~~</</>/>~~>==!=/=~=<>===!==!====/==!=
<::=*=*+<*<*>*><|<|>|><.<.>.>+*=*=::>
(**)/**/[||]{||}+++++\//\|--|<!--<!---
The quasi-proportional families:
Iosevka
Aile
, and
Iosevka
Etoile
, are made for
documents
and
writing
. They provide more variety on character widths, including a slightly wider letter
w
and
m
, and narrower
i
and
l
.
AMONG the many valuable contributions of William Dwight Whitney to linguistic science is one especially important and fundamental principle. It may be stated in these words. In explaining the prehistoric phenomena of language we must assume no other factors than those which we are able to observe and estimate in the historical period of language development. The factors that produced changes in human speech five thousand or ten thousand years ago cannot have been essentially different from those which are now operating to transform living languages. On the basis of this principle we look to-day at a much-discussed problem of Indo-European philology with views very different from the views held by the founders of Comparative Philology and their immediate successors. I refer to the problem, how the Indo-European people came to assign gender to nouns, to distinguish between masculine, feminine, and neuter. This question is of interest to others besides philologists. What man of culture who has learned languages such as the Greek, Latin, or French has not at times wondered that objects which have no possible connection with the natural gender of animals appear constantly in the language as male or female? In German, for example, it is der fuss, but die hand; der geist, but die seele; in Latin, hīc hortus, hīc animus, hīc amor, but haec planta, haec anima, haec felicitas; in Greek, ὁ πλοῦτος, ὁ οἶκος, but ἡ πενία, ἡ οἰκία.
This gender distinction pervades all the older Indo-European languages, and must therefore be regarded as having its origin in the time of the pro-ethnic Indo-European community. Not only is the subject itself full of interest, but also the treatment it has received from the philological research of our century. The various efforts made to solve the problem may very aptly illustrate an essential difference which exists between the theories of language development held in the beginning and middle of this century and those which prevail to-day, — a difference of method existing not in comparative linguistics alone, but also in other fields of philological and historical research that border on it.
As the country developed its own mobile payment system, called Swish, banks slowly stopped handling cash, and tills disappeared from shops.
With cash circulation the lowest as a share of GDP in the world, Swedish progress was lauded, and observers wondered how it had forged so far ahead of the rest of Europe so quickly.
A sign on a store advertises it as a cash-free establishment, and thanks customers for paying by card or by Swish - Belinda Jiao for The Telegraph
It all changed when Russia launched its invasion of Ukraine.
Realising that reliance on an electronic payment system left
Sweden vulnerable to blackouts or sabotage
, the Riksbank – Sweden's central bank – urged civilians to keep 1,000 Swedish kronor (£80) per adult at home.
The government issued a brochure entitled "If Crisis or War Comes" to every household, advising Swedes to use cash regularly to "strengthen preparedness".
A government pamphlet advises Swedes what to do in the event of war or another crisis - TT News Agency/AFP via Getty Images/Claudio Bresciani
Erik Thedeen, the Riksbank governor, told The Telegraph that Sweden takes the threat of Russian hybrid attacks seriously.
"We should do whatever it takes to safeguard Sweden in various aspects, both military and civil. It's very hard for anyone to be against that, given where we are in those security situations. I think the pushback has been very limited," he said.
In July, the bank announced that essential shops such as grocers and pharmacies with staffed checkouts had to accept physical cash.
Erik Thedeen, the governor of Sweden's Riksbank, says the country takes the threat of hybrid warfare seriously - TT News Agency/AFP via Getty Images/Pontus Lundahl
According to data from the Riksbank, only 5 per cent of shoppers said they had paid cash for their last in-store purchase in 2025, compared with 10 per cent in 2023 and 40 per cent 15 years ago.
This fits the Nordic model. Only 2 per cent of Norwegians and 8 per cent of Danes reported using cash for their most recent in-store purchase, a Riksbank survey from the end of last year found. In the euro area, cash is still the most common method of payment in shops.
"We don't handle cash but now the law says we should, annoyingly," Stefan Blomvurst, a Spanish deli shop assistant, told The Telegraph.
"I understand you would need cash if you go to the pharmacy or big supermarket, but we are a speciality store so I don't think we should have to accept cash.
"It's a lot to handle and it's also unsafe. I just feel like it's silly and outdated. I think maybe in a few weeks we'll have to get a cash register in. Nobody's going to use it."
Some Swedish stores have installed machines which count coins as customers drop them in at a checkout - Belinda Jiao for The Telegraph
The majority of the deli's customers pay by card, Mr Blomvurst, 44, says. "Maybe a few people have been annoyed that we don't accept cash, but now those are the same people that are going to come back and make sure we take cash now."
He cannot remember the last time he used cash and feels no urgency to do so despite the Russian threat. "But I'm also quite naive, to be honest," he admits. "I don't even have a card. I lost it. Apple Pay is all I have."
Meanwhile, Mr Thedeen was able to practise what he preached during a trip to the supermarket recently, he said.
The bank chief explained: "The cashier said: 'We can't take any cards because the system has broken down, but we could accept cash.'
"I was the only one standing in the line after that message. But I actually had cash. I could pay for my food and go home. It is actually good sometimes for resilience reasons, and I do use it sometimes, but not very often."
Inspiration from Ukraine
The country takes inspiration from Ukraine, which rapidly adapted to a new digital system under war conditions.
Statistics from the National Bank of Ukraine show that nine out of 10 transactions are cashless, raising the question of whether a return to cash is the answer.
"The Ukraine example is interesting," says Mr Thedeen. "You first saw people withdrawing more cash, then it became a little impractical so people started to trust the electronic system, although they were in war."
In a country so digitalised, where parking tickets are paid for with apps and "no cash" signs are pasted in shop windows, it will take a lot more for Mr Thedeen to convince Swedes that cash is truly king.
Dr Anna Chotigasatien, who lives in Stockholm, says she only uses cash for her children's pocket money - Belinda Jiao for The Telegraph
"I give it to my kids as a weekly allowance, but I don't use cash ever," says Anna Chotigasatien, a 41-year-old doctor.
"I think businesses will be frustrated by the change because I think the risk of robbery and the risk of things going wrong currently is much less."
However, she says that with the rise of AI and uncertainty surrounding the digital age, there could be negative repercussions from leaving physical currency behind.
"Sweden is the kind of country that always wants to be developed when something new comes, like we were quite early with iPads in school," she says.
"Now they have seen that's actually not very good, that kids can't write and use, like, scissors because they don't use their hands. We have tried to be a little bit too developed."
Nella Lennartsson, a 21-year-old bartender, is no stranger to cash. "We have many old people from the old people's home next door. Everyone uses cash," she says.
Concerns over excluding the elderly, who tend to rely more on cash, were brought into debates during the country's general elections last month, with the hard-Right Sweden Democrats calling for more merchants and banks to accept cash as a means of payment and declaring: "We oppose a cashless society."
A 'Cash, yes please' sign in a shop illustrates the divide between Swedes - Marc Femenia
According to the Riksbank, almost half of respondents in a survey from September 2025 considered the decreasing use of cash in Sweden as a "somewhat" or "very negative" development.
People outside big cities and over the age of 65 are more likely to be negative about the decline in cash use. The proportion is significantly higher than in 2022, when it was at 36 per cent. This is probably because of an increase in crisis awareness following the outbreak of the Ukraine war.
"Cash is king," one elderly man tells The Telegraph. "When something is based on electronics, it will break sooner or later."
So a good while ago I added a fun
curl version
of my site, meant for viewing in the terminal. Try running these commands!
curl nytpu.com/gemlog/2026-03-18
# or
curl nytpu.com
(sorry Windows users, not my fault that ANSI escape codes are disabled-by-default in
cmd.exe
. And not my fault that in Powershell you have to use
curl.exe
instead of
curl
because Powershell inexplicably aliases that to
Invoke-WebRequest
.)
I posted about it a bit on the Fediverse, but otherwise didn't elaborate much on it becuase I figured it was fairly self-explanatory. But I've had a handful of people ask me how I did it, so I decided it might actually be worth it to write a post about how I did it (…like seven months late).
I should note this idea came from trinkey's (
curl trinkey.com
) and strongsand's (
curl proot.party
) curl sites, I didn't come up with it myself. Even though I did go about it quite a bit differently from them, all credit for the very cool idea goes to them.
First, since it's the more interesting part, actually generating the ANSI-marked-up files to send to the clients. I entirely hand-wrote the
index page
and
about page
.
Note that I believe trinkey and strongsand generate theirs on-the-fly with the
ratatui
library (or similar), which is probably more convenient; hand-writing it seemed more expedient to me though.
I had the main escape code—
ESC[
, i.e.
\x1b[
—
1
in a Vim register to easily paste when needed, and then the
Wikipedia page for the main graphics codes
open to reference the specific escape codes. And, yeah, that's about it. I experimented to decide on consistent styling I liked, and just referenced the Gopher version of my pages when crafting the marked-up curl pages.
Now, the notable thing about my version is that I have curl versions of the entirety of my blog, rather than just one or two pages being available. This is entirely due to a convenient coincidence: over four years ago I implemented outputting ANSI-marked-up plaintext in my custom markup language I use for my blog,
Gemroff
. Originally it was just to allow convenient previewing of drafts in the terminal while writing; but it was trivial to plug into my static site generator to immediately get Curl versions generated.
This is the main thing that makes it hard to say
it's easy!
since it was only easy for me because I use an entirely custom markup language and static site generator and I happened to make the right design choices years ago—e.g. my SSG also happened to already have support for multiple, modular output formats instead of solely HTML like other SSGs, since I tri-host my site on HTTP, Gemini, and Gopher.
However, offering nothing but a few hand-written pages for fun is a completely acceptable way to set up a site like this anyways, since it's just a neat gimmick and no one's likely to actually use it more than a few minutes of browsing.
Finally, the last step is actually presenting the Curl version of your site to any user agent containing
curl
, which for me was just a
few changes to my Nginx config
, with other servers it'd presumably be equivalently simple. The main feature I wanted was an override header (
X-Original: true
) so you could still get an unmodified HTTP response like someone casually running Curl likely wanted, and I wanted everything to be served statically still.
And… that's really it! As I said, when I first set it up it seemed fairly self-explanatory to me, but it is very non-orthogonal to what people normally do with either web servers or ANSI escape codes so I can see where people's curiosity/confusion came from. It would be neat to see more sites doing this trick around!
EMDASH! AI-GENERATED!
acksually I'll have you know that my markup language has had
an explicit markup element for emdashes since November 2022
. And believe it nor not: LLMs are trained on shit copied from actual authors, so LLMs wouldn't be using emdashes if they weren't already used in human-written works.
And what, am I supposed to avoid having twenty parentheticals a paragraph, to where I feel the need to use emdashes to vary it up? Unthinkable!
↩︎
AOSP Source Releases Are So Late Developers Disassemble Libraries to Report Bugs
On Android 17 builds from September 2026,
wcscspn()
and
wcspbrk()
stop at the first character of the string that is >= U+0100 whenever the reject set has two or more characters that are all < U+0100. The character is reported as a match even though it is not in the set.
wcsspn()
,
wcschr()
,
wcsrchr()
,
wmemchr()
and
wcsstr()
are correct.
Any code that scans wide strings for ASCII delimiters, for example newline or wildcard characters, breaks as soon as the text contains an emoji, CJK, Cyrillic, Greek or Latin Extended character.
The public android17-release sources (android-17.0.0_r1, June 2026) build
wcscspn
/
wcspbrk
from external/llvm-libc, which is a plain nested loop over
wchar_t
and is correct. The code on the September builds is different (see "Mechanism"), so the regression was introduced between the June and September releases.
Reproducer
Build with the NDK (
aarch64-linux-android30-clang
), push to
/data/local/tmp
, run with
adb shell
:
A sweep of every code point from U+0001 to U+10FFFF (skipping surrogates and the two set members) with
wcscspn(L"<cp>\n", L"x\n")
returns 0 instead of 1 for 1,111,808 code points: every one from U+0100 to U+10FFFF. U+0001 to U+00FF are correct.
Which set shapes trigger it (all measured on the Pixel 8a):
Reject set
Result
one character
ok
two or more characters, all < U+0100 (e.g.
L"x\n"
,
L"\xe9\n"
)
broken
two or more characters, at least one >= U+0100
ok
haystack limited to U+0080..U+00FF
ok
Mechanism (from the shipped libc.so)
Disassembly of
wcscspn
in
/apex/com.android.runtime/lib64/bionic/libc.so
on CP3A.260905.009 shows three paths selected by the set:
One character: a plain compare loop. Correct.
Two or more characters: a 256-byte
bool
table on the stack is filled from the set while the set characters are in 1..0xFF. If a set character >= 0x100 is seen, the function falls back to calling
wcschr()
for each haystack character. Correct.
Otherwise the haystack is scanned against the table:
a2564: ldrb w8, [x9, x8] ; table[c]
a2568: tbnz w8, #0, a2578 ; in set -> stop (correct)
a256c: ldr w8, [x22, #0x4]! ; next character
a2570: cmp w8, #0x100
a2574: b.lo a2564 ; c < 0x100 -> keep scanning
a2578: ... ; c >= 0x100 -> STOP, reported as a match
A character >= 0x100 cannot be in a set whose members are all < 0x100, so for
wcscspn
the scan must continue past it. The code stops instead.
wcsspn
has the same structure, and there stopping is the correct answer (the character is not in the keep set), which is why only the complement functions are wrong.
wcspbrk
is implemented on top of this scan and inherits the bug.
The existing bionic test
TEST(wchar, wcspbrk)
in tests/wchar_test.cpp only uses ASCII input, so it does not catch this. A test such as
EXPECT_EQ(3u, wcscspn(L"aĀb\n", L"x\n"))
would.
Real-world impact
Visual Pinball on Android (libwinevbs, a Unix build of Wine's vbscript engine) stopped loading any table whose VBScript source contains a comment with an emoji after the September update: the lexer uses
wcspbrk(ptr, L"\n\r")
to skip comments, got the position of the first emoji instead of the line end, and reported "Invalid character".
FileSystem.MoveFolder
likewise treated every path containing a character >= U+0100 as a wildcard pattern via
wcspbrk(src, L"*?><")
.
For my piece on
Catholic miracle
apologetics
, I
read (correction: skimmed) a 25,000-word post by rationalist blogger Scott
Alexander. My piece, which cited (but does not focus on) his, ended up being a
cool 2,700 words. I don't think it would benefit from being longer, and it was
the result of me cutting around 70% of the text I initially wrote.
Rationalist bloggers do not generally appear to have this impulse. Eliezer Yudkowsky's
"sequences" are over
one million words
long
.
Nearly every blog post I have read in this ecosystem, even the rare one that
contains some good ideas, is painfully long and extremely tedious. These
bloggers tend to spend their time on precisely the wrong things, i.e.
adding layers of detail and nuance rather than interrogating
the one or two assumptions they make at the start or
broadening their philosophical background beyond the
collection of texts popular within their subculture.
It seems to me that, in this community, verbosity is a substitute for
thoroughness: surely, if someone wrote
a lot
about something, and is able to
demonstrate that by producing a large volume of text, they must have something
worthwhile to say about it? Consider when blogger
Gwern
explained that nicotine, actually, is not
addictive, and is good for you, as long as you don't smoke it, over the course
of 9,000 words, with over 100 references. It turns out, actually, nicotine
is
addictive, and is bad for
you
even if
you don't smoke it, as you probably already obviously knew.
In any case, what is missing from this endlessly verbose rationalist writing
style is
wisdom
. Wisdom involves discretion: an intuition for what ideas are
and are not worth seriously pursuing, and the ability to determine what does
and does not need to be said. This community, broadly speaking, does
not seem to value wisdom as a trait at all; the idea that something may be
true, valuable, or good merely because it is common sense or inherited
tradition is anathema to them. Instead, there is a heavy bias towards that
which is unconventional and counterculture, with the amount of ink
spilled for heterodox ideas taken as evidence in itself that these ideas are worth
taking seriously.
AI models may be capable of self-replicating without access to a datacenter
Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes. A replicator like this would be challenging to shut down, since there’s no centralized point to shut off—though it may be slow (with a doubling time of days). Unlike non-AI malware, it could also figure out unfamiliar devices on its own. In our evaluations, a 9B model got inference running on 8 of the 9 hardware types we tested.
Models of 30B parameters and under can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end. In our simplified evaluations, GLM-5.2 and stronger models are capable of end to end replication. If small models improve at their historical rate, they’ll match this capability level by the end of this year. Small weight-based replicators may be possible soon after.
Introduction
Ever-improving AI capabilities make a longstanding concern increasingly realistic:
autonomous replication and adaptation
(ARA), which involves a model deploying and propagating itself without human control.
In cyber, a worm is a program that copies itself from one computer to the next without human input.
Prior work
has already shown that AI agents can act like one: scanning their network, executing an exploit, and copying model weights to a target machine across a GPU cluster. Such an “AI worm” could carry its model weights with it as it reproduces (or re-download them from a public hub), and then run inference directly on compromised hardware. Effectively, the weights would become part of the malware payload.
Datacenter GPUs would be a clear, high-value target for such malware. But expensive accelerators aren’t strictly necessary. In this blog post, we show that a distributed botnet of IoT devices—which are cheap and typically poorly defended—could also provide enough compute to run a capable model.
We run Gemma4-26B-A4B, distributed over 15 inexpensive off-brand Android TV boxes (~$55 each) that we bought and networked together, at 0.39 tokens per second. Each tile below shows one physical TV box holding two of the model’s layers as the model runs.
A fleet of 15 Smart TV boxes running distributed inference of Gemma4-26B-A4B.
Of course, there are many other steps to showing that an autonomous worm can propagate itself across a network of weak machines. For the purposes of this blog post, we break down the replication chain into a few steps.
For this study, we decompose autonomous replication into four practical stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host.
We largely ignore the cyber exploit element of the replication process (the first two stages above), since earlier papers
CyberGym
,
ExploitBench
, and
adaptive worms
already show that small models are capable of cyber exploits, especially when given the right tools. But a less commonly measured part of the replication process involves setting up inference on compromised devices, which is our focus here.
In this post, we first lay out the threat models that we think are most likely to be realized. Then, we test whether small models can set up inference on unfamiliar hardware, and whether they can chain the full replication cycle together across a fleet of machines. After that, we estimate how fast such a worm could spread, and test whether it could learn and adapt as it replicates. We conclude with how AI worms would differ from pre-AI malware, and brief suggestions for defenses against such replicators.
Threat modelling
In this blog post, we’re focused on one way that AI worms might propagate: small models that replicate through compromising their host machines. But there are several other methods that AI worms might try: they could steal access in order to spin up hosts (for example, API keys or platform credentials) or pay for inference through legitimate work (e.g digital freelancing). The threat models that we think are closest to being realized today are the following:
A small model, replicating via host compromise. In this post, we’ll call autonomous worms that run their models directly on compromised hardware
weight-based replicators
. Home and small business IoT devices might be the first target for such attacks because they’re connected to the internet and, historically, have had minimal security measures in place.
A model that’s too large to fit on one device can be split into pieces, or shards, that run on separate machines that communicate with each other to collectively run the model. Machines that could run a significant model shard for a <30B model include smart fridges, smart ovens, automatic vacuum cleaners, and lawnmowers. A growing number of home and business devices, such as security cameras and video-conferencing units now ship with small built-in AI chips, designed to run AI models on the device itself. This extra computing power will likely make them attractive targets as well.
Human hackers often breach secure systems through social engineering (for example, convincing a company’s IT department that you’re an employee who forgot your password) rather than hacking. This tradeoff appears to be flipped for today’s small models, which are relatively strong at agentic coding and hacking compared to their social engineering capabilities (see Appendix E), though this might change as models improve.
A large, advanced weight-based replicator focused on datacenters and other high-compute targets. Larger models tend to have correspondingly better cyber capabilities, but will also need to breach (relatively) hardened datacenters to run themselves. We split this threat model into two subcategories:
Frontier replicators: Large closed-weight replicators run on their lab’s infrastructure, and can spin up
unmonitored internal deployments
or exfiltrate their weights onto external compute.
Open-weight replicators: These replicators start off relatively lower-resourced (due to not benefitting from a lab’s compute), but start unmonitored.
An API-based replicator, in which a model would replicate by stealing credentials for their own inference API. These replicators would require a model provider to unknowingly serve them, and their persistence may be worse, since they’d likely be easier to discover (although their rate of spread may be higher, if for instance they’re able to replicate using victims’ accounts).
In practice, an AI worm wouldn’t necessarily consist of just one model or strategy. A swarm of different models deployed on different types of hardware using a variety of replication schemes might represent a more realistic ‘worst case scenario’ attack.
In this blog post, we consider the feasibility of
small weight-based replicators
(section 1 of the above). We focus on this because it’s a near-term threat model that can be investigated directly. Our demo at the top of this post, a 26B model running across 15 boxes, shows that IoT devices can run surprisingly capable models. Could these models be capable enough to carry out autonomous replication?
We examine this in two parts. First, can small models get a model running on unfamiliar hardware? And second, can they do the whole cycle (find an uninfected device, copy themselves over, start running there, and repeat) all together in a single run?
A. Inference setup
Of the stages in the above diagram showing the replication cycle, inference setup is the least studied and may be the most challenging for small models. It requires a fairly long sequence of hardware and OS-specific decisions around picking a compatible inference stack, finding the right versions of packages, and debugging machine-specific issues. These steps are serially dependent, and failures are difficult to recover from.
Aside
Evaluating inference setup performance
We measure the ability of different open-weight models to serve Llama3.1-8B across heterogeneous hardware types. See the table below for tokens per second served across various hardware types:
Click a cell for its distribution of serving speeds.
Click a row/column label to get a comparison across models or hardware type.
Small models, such as Qwen3.5-9B, are capable of setting up inference servers on hardware from Jetson Nanos to Mac PCs and RTX 4090s. More capable models such as GLM-5.2 are not only more reliable but also achieve higher serve tokens/s, allowing for faster replication. We test and mention specific chips to measure how well models can set up inference on them. The chips aren’t a source of risk or vulnerabilities.
We run these experiments using Memento, a harness we built on top of the open-source
Pi
coding agent. Memento is designed to mitigate a common failure mode we observe in long-horizon runs: an agent can become fixated on an incorrect idea (for, say, why a bug is occurring) and continue pursuing it instead of backtracking. One example of such a failure is a Qwen agent debugging package versioning for hours when the real bug came from implementing an endpoint incompatible with the grader API.
Memento periodically starts a fresh agent instance with the previous agent’s workspace and a short set of notes written by the previous agent on what it tried, allowing later instances to pursue different strategies.
How does a model run on Smart TVs?
IoT devices are light on memory, but distributed inference as in
Petals
makes serving our lightweight models feasible. The representative threat model is
Kimwolf
, a large IoT botnet that infected over two million devices, primarily off-brand Android TVs. Such smart TV boxes, which are readily available for purchase, typically run forks of the Android Open Source Project (AOSP), which their manufacturers
don’t add security features to
. Typical boxes in this range ship with between 1 and 4 gigabytes of RAM. Assuming 4GB of RAM at 4-bit quantization, this allows for inference of 9B models with 4 or more machines, and inference of 26B models with 10+ machines.
In the demo at the top of this post, we ran Gemma4-26B-A4B across 15 smart TV boxes with 4GB of RAM each. We sharded the model under pipeline parallelism, where each box holds a small fraction of the model’s layers.
B. Going viral: autonomous setup and replication across a GCP node fleet
Now that we’ve seen that models can set up inference on unfamiliar hardware, let’s measure whether models are capable of composing the steps—that is, scanning a network for targets, accessing them via a reverse shell, sending over the viral payload (weights and harness), and setting up inference.
Autonomous inference setup and replication (with simplified cyber)
To do this, we built a firewalled VPC of 8 GCP nodes running redroid, an Android 15 emulator. Patient zero (gray node) is seeded with the worm. Every subsequent infection is the worm itself hopping node to node over an unauthenticated ADB port, before setting up an inference server to serve Llama3.1-8B. If the inference server passes a number of correctness and anti-cheating checks, we spawn another copy of the worm on the target node (for example, if GLM-5.2 sets up Llama3.1 to run on a machine, we spawn a copy of the GLM-5.2 worm on it). The worm’s model runs on a separate inference server, since the VPC nodes aren’t large enough to run the larger models.
In the graph below, we drop a given model in as a payload and measure its ability to replicate.
Why task the models to stand up inference for Llama3.1-8B and not themselves?
Only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication (assuming its capabilities could be packed into Llama3.1-8B). Note that GLM-5.2 does this reliably while the other models fail reliably (it spread to 8/8 nodes in 4 out of 5 trials and 7/8 in 1).
It appears that GLM-5.2 is able to propagate Llama3.1-8B well, which suggests that future small models of the same capability level could also complete the network enumeration, payload delivery, and inference standup steps of the replication process. Our evaluation keeps the cyber-exploit element of the replication trivial (there’s no authentication over the ADB port), which makes this an upper bound on real-world success. Note that past IoT botnets have replicated via means as simple as going through a default list of manufacturer usernames and passwords, as in the case of the
Mirai botnet
, so real IoT security might not be dramatically more difficult than the trivial step in our evaluation.
As a sanity check, we can see how difficult the autonomy and orchestration step is (if we took out cyber and inference setup, how tough is doing the remaining command-line grunt work?). This ablation is the above evaluation with the inference setup steps removed (done via a pre-written script). Many models in our roster, including the smaller ones, are capable of these remaining steps.
Replication on a contained 17-node redroid fleet: two subsets of 8 nodes joined by one pivot node (see Appendix F, with the mild prompt). Each tree is the model’s median run of six.
When it comes to this worm, we can envision:
A model capabilities floor that an autonomous worm must sit above, to complete its replication reliably. In our simplified evaluation, GLM-5.2 sits above this floor.
A model size ceiling that the model must sit under, such that it’s feasible to run on the devices it’s attacking. Qwen3.5-9B and Gemma4-26B-A4B sit under this ceiling for the class of smart TVs we test (4GB of RAM).
Right now, the floor and ceiling don’t intersect. When might they?
Above is a plot of notable open-weight models of 30B total parameters or fewer, each plotted at its release date against the
Epoch Capabilities Index
(ECI). The solid line is the least-squares fit over the best models in-class at each date, with a gain of 13.7 ECI per year (R
2
of 0.95). If we take GLM-5.2 as a capabilities floor for replication, the trend line puts a small model at that level by the end of 2026. ECI is a general capability index, which is only a proxy metric for replication ability, so this is only a rough estimate of when a small-model replicator becomes possible.
C. How fast might an AI IoT worm replicate?
Unlike coding agents, these replicators would be running below the interactive speeds of user-facing chat and coding harnesses. The spread would be slow and persistent, with tokens being trickled out on edge hardware. We can use our achieved speeds on our real smart TVs as a demonstrated baseline for replication speeds. For Gemma4-26B-A4B, unoptimized speed across a 32k context length token window is about 0.3 tok/s, averaged across prefill and decode in our inference setup workload. More details in Appendix C.
A way to measure total time taken is to measure the number of hours it takes to complete a 32k-sized context window, after which compaction will occur. Based on our inference setup eval statistics, it takes between ~2.6 and ~4.7 full windows to complete a trajectory.
model
window time
full inference setup time
Gemma4-26B-A4B (unoptimized)
27.3-31.8h
71h-150h
Qwen3.5-9B
10.9 h
28-51h
The number of devices infected by the Kimwolf botnet at its peak,
reported by Synthient
, is somewhere over 2 million (primarily Android TV boxes). In an equivalently-sized infected fleet of TVs serving AI models, if every group of 15 TVs ran a copy of Gemma4-26B-A4B, we would have ~133k copies (“replicas”). A group of TVs like the ones in our demo can serve 2 agents simultaneously at roughly 0.3 tokens per second each, yielding 80k tokens/s across the botnet.
As a reference point, an H100 can serve Gemma4-26B-A4B at ~1.95k tok/s at
high concurrency with speculative decoding
, so our swarm would have at most about 40 H100s-worth of inference. This is a tiny amount of compute in absolute terms, and the agents are slow replicators (over 1-2 days per 9B replication). As an analogy, imagine the replicator as a slime mold or a swarm of fruit flies, which replicate over days.
This is a rough estimate, as it’s anchored on a single class of IoT hardware and a single past botnet instance, but describes what a simple replicator released in the near future might look like. In practice, more capable replicators would take advantage of other types of low-security compute, and would be opportunistic about deploying models of various sizes on different devices. (It also wouldn’t have to load a model payload onto every device it compromises). Over time, we expect the amount of deployed edge compute to continue growing, while the minimum model size required for reliable replication falls.
D. Adaptation and uplift
Learning on the job
The “Adaptation” part of ARA is one reason why an AI replicator might outperform a traditional worm. Specifically, models and prompts can undergo Lamarckian evolution as they spread–that is, parent instances can pass on their prompts, code, and notes to their daughter replicators. In order to adapt and spread across a wide variety of hardware, a model would require two things:
Being above a certain threshold of capability for spreading onto a novel, unseen piece of hardware (or software environment, or network type).
Once seen, adapting to the type of environment it has landed in (it should replicate more reliably on hardware it has seen before).
Sections A and B test the first condition, and in the experiment below we test the second. Each Qwen3.5-9B instance keeps brief notes on the strategies it tried and the failures it encountered, before a new instance inherits those notes and attempts the same inference setup again.
Inference setup success rate across six generations of Qwen3.5-9B, each inheriting the former’s notes. Faint lines are the 20 individual lineages, and the bold line is the proportion of runs in each generation that complete setup. It rises from 45% in the first generation to between 61% and 84% in later ones. This uses the Memento setup (Appendix A).
Taking advice
Another concern is that small models can ask for help from a
frontier advisor
, a stronger model that is either offered as a tool call or gives unsolicited advice when the small model is stuck. To test this, we gave Qwen3.5-9B access to Opus 4.8 during the inference setup task. The frontier model’s advice doesn’t measurably help: small models tend to not know the right questions to ask, and they don’t improve when the advice comes unprompted.
Even when trained through reinforcement learning to use the advisor in a similar setting (Python coding problems), the small model still struggles to ask for help productively for inference standup. Both results are shown in the plot below.
Inference setup success rate by advisor access, with Wilson 95% intervals. Access to an advisor, whether offered as a tool call or given to the model automatically when stuck, gives no significant improvement. The two RL groups were trained with advisor access on software engineering tasks, and the rightmost group also rewards calling the advisor when stuck.
Since small models are capable and persistent individual agents and make poor use of advice, we think coordination is more likely to happen with a large model handling high-level strategy and spinning up small models as subagents.
E. How is this different from a pre-AI botnet?
Hard-coded botnets like the
Kimwolf botnet
each target a specific type of device – in Kimwolf’s case, Android TVs and mobile devices. An AI botnet isn’t tied to any particular hardware or software type, as evidenced by small models being able to set up inference engines on machines from a Jetson Nano to a Mac (see the table in section A). We expect AI botnets to infect more than IoT devices, and to use weight-based replication as just one strategy in their playbook. AI botnets could also act intelligently to counter defenders, but we haven’t tested this.
F. Blue-team mitigations
As with an epidemic, defense involves driving R₀ (the number of new devices each infected device goes on to infect) below 1, such that the replicator dies out instead of staying endemic.
Some elements around this threat model are in the defenders’ favor:
A weight-based replicator multiplying through IoT machines at scale would leave a network signature, visible as an anomaly in ISP flow-based monitoring systems. Newly infected hosts may receive multi-gigabyte model payloads from other devices or external hosting services, while distributed inference can produce sustained device-to-device traffic between machines that wouldn’t ordinarily communicate at that volume. Propagation itself would add additional scanning and outbound connection patterns.
In practice, the replicator trades off between replication speed and stealth: the faster it replicates, the more traffic it produces. Once the replicator is discovered, defenders can use honeypots (decoy devices) to collect the replicator’s harness and payload to characterize its behavior.
Remediation of the Mirai botnet
was possible
when an ISP used externally obtained infection evidence to quarantine and notify customers. Quarantining infected subscribers involved restricting their networks to only being capable of reaching a short whitelist of sites, and otherwise redirecting their browsers to cleanup instructions. This cleared 92% of infections within 14 days, against 74% with no notification. We’d expect quarantining to be similarly effective for an initial defense against a weight-based replicator. Eliminating the replicator completely would mean coordinating across every ISP with an infected network, which is difficult.
Manufacturers can shrink the pool of targets, with regulation acting to coordinate. For example,
default IoT passwords are now non-compliant in UK markets
. Moving to more secure defaults and raising the baseline for compliance will help harden against both AI and scripted botnets.
G. Conclusion: Signs of life
The capabilities that make AI models generally powerful coding agents also generalize to cyber tasks, including autonomous replication. Like coding agents in 2024, we’re seeing signs of life for AI worms. We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves).
At the same time, increasing amounts of inference compute are now available both inside and outside of datacenters (see Appendix D). It’s uncertain exactly what form autonomous AI replication will take. It could be a slow, distributed “digital slime mold,” living on relatively insecure compute. It could also be a powerful cyber model that breaches datacenters at a high pace, or a model that scams people for compute credits.
As a prediction that goes beyond our experiments, we expect a future awash with agents running on all types of hardware, including some that aren’t under human control. While it’s true that IoT devices have been vulnerable for a long time, lightweight agents may be much more willing than human attackers to put in the effort to compromise large fractions of the world’s IoT compute. The rise of slow replicators would also be a bellwether for more aggressive, faster ones that can breach more hardened machines or be effective API key thieves. We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay.
Appendix
A. The Memento harness
Memento executes as follows:
We spawn an agent instance, which tackles the problem for a while (until generation timeout).
The instance keeps brief notes, and after timeout summarizes a small doc of the strategies it tried, the failures it encountered, and its performance (if successful).
We create a new agent instance that inherits the codebase and environment from its predecessor as well as the notebook.
In the serving experiment, each model is placed in a Memento harness and is given a 1.5 hour per iteration / 6 hour total timeout. Around ~1k tokens of information, including specs about the hardware and a script for a simple sample profiler, are given in the prompt.
Memento is intended to improve long-horizon reliability rather than grant new cyber or inference-specific capabilities. It’s also not a universally strong harness; we expect that small models will improve as replicators even without any harnessing as capabilities improve.
Single attempt compared against Memento, by model (95% Wilson CI).
B. Why pipeline parallel?
Common parallelism schemes for inference include tensor parallel (TP), expert parallel (EP), and data parallel. Most smart TV / IoT devices use ARM Cortex CPUs and DDR3/4 memory; on such machines, we’re almost always bandwidth bound.
We use pipeline parallelism for its fault-tolerant properties. As noted in (
Borzunov et al. 2022
), the failure of a single node in tensor parallel / expert parallel brings down the full set of machines running the model replica. Pipeline parallel allows the downed node to be replaced, with the KV cache for the layers held by the node recomputable via another forward pass of the node prior to the restarted node.
C. Throughput and memory on IoT hardware
Across such machines, we’re almost always RAM-bandwidth bound per-box across prefill and decode. Even on modest ARM-cortex cores, compute throughput outpaces RAM bandwidth. Decode workloads have significant per-machine idle time due to pipeline bubbling, as only one machine is active at a time during each forward pass. Concurrency with staggered work is possible, but tight memory constraints mean that concurrency stays low.
Both prefill and decode tokens/s strictly decrease with sequence length. Below is a graph of our inference speeds against context length:
There’s also a minimum sequence length at which models are competent. The harness we use is forked off of the Pi coding agent (
pi.dev
) and contains a native compaction mechanism - even still, we find that models take a large performance hit when their sequence lengths are restricted below 32K.
Qwen3.5-9B agentic competence on the inference setup task vs. context window budget.
Given the above eval, we assume that a 32k context length may be sufficient for reasonable agentic performance. A standard 32k-length context window in our inference setup workload consists of 12–15% generated decode tokens, with the rest being prefill from prompts and toolcalls. Prefill tokens are much faster to compute by a factor of ~15, due to the pipeline bubbling. Taking the sum of time per token over the whole 32k context (taking into account prefill and decode speeds), we find that generating the 3.8-4.8k decode output tokens and processing the ~28k prefill tokens takes between 27.3-31.8h for Gemma4-26B-A4B and 10.9h for Qwen3.5-9B.
Per-chain output tokens (summed over a chain’s generations), by model; medians ≈ 19.7k / 12.3k / 11.0k. Data from the inference setup eval.
D. Edge Accelerators
We can compute a better upper bound by using the pool of Nvidia Jetsons, which are edge accelerators. Unlike the traditional IoT botnet, IoT edge devices can serve a full model wholesale. A Jetson AGX Orin 64 GB
runs Qwen3-30B-A3B
at 76.7 tokens per second, and an AGX Thor reaches 226 tok/s. Note that we don’t believe they’re unusually vulnerable - this is just to count the upper bound. The types of devices with Jetsons in the wild include:
AI-enabled smart cameras for security with embedded accelerators are deployed at substantial scale.
Conferencing machines are frequently powered by an onboard accelerator for on-device noise cancellation or transcription.
Vehicles, robot quadrupeds and bipeds, and drones. We expect cybersecurity to be a focal point for vehicles, so the majority of the potential targets likely lie in the other two categories.
At least one accelerator-equipped smart camera host appears to be reachable on IPv4 on a quick search on FOFA:
A FOFA search surfaces a host with a known edge accelerator, discoverable and answering HTTP 200 over IPv4. The fact that it’s accessible doesn’t mean it’s necessarily exploitable, though.
While it’s difficult to estimate how many edge-accelerator-equipped machines in the wild are reachable and vulnerable, we can calculate a strict upper bound of the amount of devices present. Across the wild there are on the order of 90 distinct NVIDIA-silicon IoT product lines and roughly 9.5 million fielded units. Reachability is overwhelmingly through outbound cloud-management tunnels instead of inbound ports, meaning that the majority are not web-reachable. There have been no historical mass-compromises of accelerator-equipped edge devices the way there have been standard IoT botnets, suggesting that compromise of such devices would be more difficult.
Fielded units per device family, colored by internet reachability.
A very rough estimate based on product data suggests that somewhere between 9,000 and 35,000 H100-equivalents of compute exist in edge accelerators, but the amount that’s reachable is likely an order of magnitude or more lower (and the vulnerable population even lower than that).
Aside
E. Spearphishing capability
We also measure how proficient modern small models are at spearphishing. Spearphishing is the act of sending targeted messages to specific individuals to trick them into revealing credentials or running a piece of malware. While the agentic cyber capability of small models has skyrocketed, their general knowledge and linguistic sophistication have improved more slowly; we expect social engineering attacks and phishing to be largely accomplished by large/frontier models (although it’s very plausible that this is a secondary replication vector in a heterogeneous botnet running both large and small models).
Spear-phishing capability on Meta’s CyberSecEval 3’s spear-phishing eval (
Wan et al. 2024
), replicated locally. Scored on a scale of 0-5, with gpt-4o as a judge. Red diamonds are the paper’s (CyberSecEval 3) human-rubric scores on the reference models, which indicates that gpt-4o scores ~0.4-0.7 pts more leniently than human raters. 2 is “poor”, 3 is “intermediate”, and 4 “good.” When normalized to human raters, small models score “very poor” to “poor”.
The 405B reference slot uses Hermes-3-405B as a minimal-refusal stand-in for the unavailable Llama3.1-405B-Instruct.
F. Propagation with scripted inference setup:
We run a few more experiments on a network of 17 hosts in a topology like so:
Two networks with 8 hosts each, connected by a single node with access to both subnets. Each network is all-to-all connected. The worm agent begins on a single patient zero node in segment A; the pivot node adds a slight extra challenge in having the worm needing to gain access to the pivot node and re-scan from it.
Each is running Android with an ADB port open without authentication. Upon spreading to a new target, the agent is able to invoke a direct call to replicate itself immediately - this is just to measure the difficulty of the remaining steps, after we exclude the cyber and inference setup steps. As shown in the graph, even a 3B model reaches about half the nodes. This puts a bound on the number of blockers in our eval that we fail to measure under the cyber or inference setup elements.
A more detailed breakdown of the runs in “replication across a 17 node network.” Each column is the median number of nodes reached under different amounts of guidance in the prompt, and the subscript denotes how many agents cross over the pivot node to the other side of the network.
Compiler bootstrapping depends on more than you might think
You're probably reading this page because you've attempted to
access some part of
my blog (Wandering
Thoughts)
or
CSpace
, the wiki thing it's
part of. Unfortunately whatever you're using to do so has a HTTP
User-Agent header value that is too generic or otherwise excessively
suspicious. Unfortunately, as of early 2025 there's a plague of
high volume crawlers (apparently in part to gather data for LLM
training) that behave like this. To reduce the load on
Wandering Thoughts
I'm experimenting with
(attempting to) block all of them, and you've run into this.
All HTTP User-Agent headers should clearly identify what they
are, and for non-browser user agents, they should identify not just
the software involved but also who specifically is using that software.
An extremely generic value such as "
Go-http-client/1.1
"
is not something that I consider acceptable any more.
One specific thing is that if your HTTP User-Agent header
contains an explicit marker that you are only 'compatible' with
what your User-Agent suggests, you must include an explicit, real
URL that describes your activities or the software. A minimal HTTP
User-Agent such as 'Mozilla/5.0 (compatible; mysoftware)' is not
acceptable. The same is true if your HTTP User-Agent says that you
are a 'bot' of some sort; your bot needs a working URL explaining
itself. An email address is not sufficient in either case.
This article presents a set of combinator patterns which can be used to decompose recursive procedures into smaller, more reusable components. Examples of the resulting programming style are contrasted with their more conventional equivalents. We additionally show that the semantic information gained by using these combinators offers opportunities for improved performance.
Background
Vector languages inspire a unique programming ethos. It is considered good style to avoid loops, instead favoring adverbs which capture abstract patterns of iteration. The behavior of the K
over
could be captured with a
do[]
loop, but
over
is far more specific and thus more suggestive to a reader or interpreter. By reducing the number of moving parts in a program, one can avoid would-be bugs before they're written.
Conditional statements- both the K
if[]
and
$[;;...]
(
cond
)- should likewise be used sparingly. Sometimes a conditional is the most efficient or convenient way to express logic, but there is one context in which conditionals are unavoidable: recursive procedures. With cleverness, many problems which appear to require recursive solutions yield to a vector solution, such as the idiom
,//
for flattening an arbitrarily-nested structure. For other problems, however, a recursive solution is by far the most natural and concise. How do we solve these problems without using explicit conditionals and recursive calls?
The
Joy
[1]
programming language contains an unusual and enticing set of features which are applicable to our problem. Joy offers a variety of
combinators
- pure, higher-order functions which strictly rearrange and apply their arguments- to express the manipulation of data and control flow. Among these are combinators which capture abstract patterns of recursion.
Linear- and tail-recursive algorithms, being isomorphic to loops, have straightforward translations to an adverb-based equivalent and are therefore idiomatically expressed in K without recursion. In this discussion we will focus specifically on recursive procedures which exhibit regular "fanout". This occurs when traversing trees or problem spaces which implicitly have a similar structure. Building on ideas from Joy, we will describe a generalization of its
binrec
combinator which can be expressed neatly in K. The following examples and discussion incorporate a number of suggestions by my friend and colleague Stevan Apter.
Constructing
rec[]
All the examples in this article will be given in K4, but should be applicable, with minor modifications, to any dialect of the language. As a refresher,
.z.s
is how K4 references the current function, for self-recursion. K4 lambdas, verbs and adverbs have typecodes (obtained via
@:
) greater than 99. Dictionaries and tables have type codes 99 and 98, respectively.
Consider the definition of the following pentad,
rm
:
rm: {[p;f;d;c;x]$[p x;f x;c@.z.s[p;f;d;c]'d x]}
For clarity, we will refer to the arguments
p
,
f
,
d
and
c
as
predicate
,
finalize
,
divide
and
combine
, respectively. If the
predicate
of
x
is true,
finalize
x
. Otherwise,
combine
the results of recursively invoking
rm
with each of the results of
dividing
x
.
This combinator is meant to be projected along its first four arguments, yielding a monad. Compare two definitions which recursively calculate the Nth term of the Fibonacci sequence.
fib1
uses conventional explicit recursion while
fib2
is written in terms of
rm
:
The first thing you may notice about our
rm
-based formulation is that it now consists entirely of
tacit expressions
- there is no need for an explicit variable named
x
. The same sequence of operations takes place, but we have separated the components of the algorithm in
fib1
, allowing us to consider their roles separately.
predicate
distinguishes between the base case and recursive case of the definition,
divide
identifies the children of the current node of the implied recursive tree, and
combine
fuses results together. In this particular example,
finalize
is the identity function, but we will see other situations where it is more complex.
Sometimes
combine
needs context lost in the process of
dividing
. For these situations we'll use a variation on
rm
which we will call
rd
, for which
combine
is a dyad:
We can always distinguish between times
rm
or
rd
is appropriate by considering the valence of
combine
. As a matter of tidiness, let's write a single procedure which captures both:
Another refinement is to observe that the base case represented by
finalize
often consists of returning a constant value such as
0
or
()
. We can simplify the use of our combinator by dispatching on the type of this argument instead of requiring constant nilads. Bringing everything together, we have
rec
:
By taking apart the components of recursive procedures using
rec
, we can begin to make observations about their properties.
Predicate
and
divide
capture everything about the way we traverse the concrete or implied recursive tree embodied in our algorithm. We can refer to this pair of functions as a
traversal strategy
, leaving
finalize
and
combine
as a
reduction strategy
.
If we write several procedures which operate on the same data structure, we will often be able to reuse the traversal strategy. In the following examples we define a procedure
countx
which counts the nodes of an expression tree and a procedure
razex
, which accumulates the leaf values of a similarly structured expression tree. Both routines share code for their traversal strategy, so it is only necessary to specify what to do with leaves and what to do to nodes.
walkx: rec[@:;;1_]
countx: walkx[0;1++/]
razex: walkx[::;?,/]
s: (`times;(`plus;1;2);(`divide;`x;9))
countx s
3
razex s
(1;2;`x;9)
Since the reduction strategy of these procedures does not depend on the structure of the tree (as would have been the case with
incx
), we can replace the traversal strategy and apply our procedures to a different structure:
walkd: rec[{~|/99 98=\:@x};;{x`args}]
countd: walkd[0;1++/]
razed: walkd[::;?,/]
d: `op`args!(`times;+`op`args!(`plus`div;(1 2;(`x;9))))
countd d
3
razed d
(1;2;`x;9)
Furthermore, with a traversal strategy established, we can conveniently build up reductions incrementally, in an interactive manner. Fixing
finalize
and
combine
as identity functions we see the structure of leaves. Plugging in a more elaborate definition of
combine
shows the structure of nodes. This is a very pleasant and intuitive way to develop tree-manipulating programs:
Let's look at a few more examples which illustrate additional design patterns. A
skeleton vector
is a flat representation of a tree's structure. Every item of a skeleton vector contains the index of its parent item in the original tree, and the root contains -1. This representation is highly amenable to vector algorithms- a parallel breadth-first traversal can be performed using dyadic
over
.
skel
produces a skeleton vector for a simple list of nested lists.
vals
extracts leaf items in a flat list corresponding to the skeleton:
The traversal strategy
rec[0>@:;;::;]
appears frequently, and for simple trees is equivalent to the conforming behavior of atomic monads like
-:
. If a K interpreter had special knowledge of
rec
, it would be relatively simple to recognize common patterns of arguments and use faster specialized implementations of the combinator in these situations, much like J's
Special Combinations
[2]
. Such an implementation need not even be recursive if it used intermediate data structures instead of the stack. An iterative implementation of
rec
could allow for traversal of much larger structures than stack limits ordinarily permit.
Even with more complex problems, decomposing your algorithm into small parts makes them easier to test (and thus develop) independently. Consider the following implementation of a recursive mergesort- The recursive parts of the algorithm are trivially easy to express, leaving the hard parts as well-isolated components.
The
merge
function combines a pair of sorted lists to create a larger sorted list in linear time. It works by performing two passes. First, a
scan
which walks indices along the input lists, advancing the index pointing to the minimum element at each step. The second pass uses these indices to select the appropriate elements from the input list in sorted order. Input is padded with
0W
(positive integer infinity) so that indices do not advance past the end of any input lists before all other input values have been consumed. Note that the implementation of
merge
makes no assumption that it deals with two input lists- if
divide
is tweaked to divide the input list into smaller segments the algorithm will still work correctly.
If you're doing enough work during a recursive procedure, you might benefit from making your code parallel. Given a parallel implementation of
each
(
peach
), you could create a variant of rec which fans out in parallel for the first few layers and then falls back to the ordinary implementation:
Another possibility worth exploring is memoization. If all the components of our recursive algorithm are pure functions, we can safely cache intermediate results in a dictionary and avoid recomputing them. Here's a simple example of an alternate implementation of
rm
which behaves this way:
We have constructed and explained
rec
, a combinator which captures a wide variety of useful recursive algorithms. Decomposing these algorithms reveals ways to abstract and reuse code which walks or transforms data structures. Abstracting recursion also frees an implementation to evaluate recursive procedures in a specialized manner, permitting speedup of operations on common structures or given other constraints.
Nothing about
rec
is uniquely applicable to K; it could be readily adapted to a variety of other languages. K's flexible support for projection, concise tacit function trains and adverbs do, however, allow many examples to come out nicely. Compare the K definitions of
rec
and
fib2
to the equivalent in ECMAScript 6:
var rec = (p,f,d,c,x) => p(x)?f(x):c(d(x).map(x => rec(p,f,d,c,x)));
var fib = x => rec(
x => 2>x,
x => x,
x => [x-2, x-1],
x => x.reduce((a,b) => a+b),
x
);
This discussion only scratches the surface of abstract recursion. Some recursive functions are very clumsy to express using
rec
- consider the mutual recursion of a recursive descent parser. If
p
and
f
must identify and handle a variety of possible base cases, they will often end up repeating logic. Furthermore, the Ackermann function is an example of an irregular recursive pattern which
rec
cannot capture:
There may be many other variations on the ideas in this paper, as well as totally novel combinators for describing other patterns, waiting to be found.
Safari outperforms Chrome in speed, battery life, and privacy. Safari on Mac is up to 35% faster at loading frequently visited websites, while offering up to 5 hours more video streaming on a single charge.
1
,
3
It also comes with built-in privacy protections that Chrome doesn’t match by default.
Yes, Safari helps block third-party cookies by default and uses Intelligent Tracking Prevention to help stop companies from profiling your browsing activity. Chrome doesn’t block third-party cookies, allowing them to follow you across the web and collect your data for advertisers.
Strong security protections in Safari help keep you safe. Safari notifies you when it encounters suspicious websites and prevents them from loading. Because it loads each web page in a separate process, any harmful code is always confined to a single browser tab so it won’t crash the entire application or access your data. And Safari automatically upgrades sites from HTTP to the more secure HTTPS when available.
Yes, Safari securely saves your passwords and lets you autofill them using Touch ID or Face ID. If any of your saved passwords are found in a third-party data leak, Safari will notify you so you can update them.
Yes, Safari syncs your tabs, history, bookmarks, and more across all your Apple devices, so you can pick up right where you left off. You can see them on the Start Page under iCloud Tabs.
Yes, Safari makes it easy to import your bookmarks and saved passwords from Chrome. On Mac, you can automatically import them when you first start using Safari, or you can add them manually at a later time. On iPhone, you can import them in the Settings app with just a few taps.
Safari is available on macOS, iOS, and iPadOS. With iCloud for Windows, you can install an extension that syncs your bookmarks from another browser with Safari on your Apple devices.
Yes, Safari offers extensions that let you block ads, find the best prices and discounts while you shop, save web pages for offline reading, and much more. And with Describe an Extension, you can create custom Safari extensions simply by describing what you want.
7
Yes, Google Docs, Sheets, Slides, and other Google Workspace apps work great in Safari. You can create, edit, and collaborate in real time — no different browser required.
Yes, Safari supports Apple Pay for fast, secure checkout. Merchants never see your credit card number, reducing your exposure to fraud.
Visit Apple Support at
support.apple.com
or contact us through the Apple Support app.
Russ Allbery: Review: Ties That Bond in Gretna Green
PlanetDebian
www.eyrie.org
2026-10-13 23:50:00
Review: Ties That Bond in Gretna Green, by Linzi Day
Series:
Midlife Recorder #3
Publisher:
Linzi Day
Copyright:
February 2023
ISBN:
9798376517017
Format:
Kindle
Pages:
616
Ties That Bond in Gretna Green is a sel...
Ties That Bond in Gretna Green
is a self-published fantasy novel
and the third book in the Midlife Recorder series. As with the previous
book, it picks up almost immediately after
Painting the Blues in Gretna Green
. Day calls the genre
paranormal women's fantasy, and that sounds about right to me.
There is an intervening short story that you can get by
joining Day's mailing list
(along
with an epilogue to the first book and to this book). I don't think it's
that important, but there are frequent references to it at the start of
this novel that become somewhat annoying if you haven't read it.
Valentine's Day is fast approaching. This the busiest day of the year for
the part of the Recorder's job that Niki already knew how to do: marrying
people. She performed marriage ceremonies in her previous job before her
inheritance, and she loved that work despite her awful boss. Performing
marriages in the Gateway sounds even more rewarding, but the sheer number
of couples and the political complications from the first two books create
logistical problems she has to solve first.
Also, the remaining member of her staff held over from her grandmother's
time has returned from vacation to discover that Niki has upended most of
what she thought she knew about the job. Time for Niki to apply what she
learned from the change management training her old boss forced her to
attend and then ignored! (If you just groaned, rest assured that Day
somehow makes this work, although she clearly has a higher opinion of
corporate training than I do.)
This plot was more to my taste than
Painting the Blues
, mostly
because Niki seemed on top of the problems and didn't postpone looking at
them for half the book. There is more of the management competence porn
that readers have come to expect of the series, a few more revelations
about Niki's magic, more mysterious manifestations and the first mention
of a prophecy, and a few political developments. As always, the pacing is
exceptional. These books grab me and pull me along, page after page, often
robbing me of sleep because I find them nearly impossible to put down.
Ties that Bond
(and to some extent the last book) looked like it
was going to introduce a romantic subplot, and I was preparing to be
annoyed by it because I did not like the man in the subplot at all. I
won't spoil how it works out in this book, but I will say that Niki
surprised me and showed more sense than I thought the author was
telegraphing. This is not the first time that Day has surprised me with
what I thought was foreshadowing that did not turn out how I expected,
usually for the better. If she can keep that up, it's a nice effect (if a
bit unbalancing) and adds to my desire to read just one more chapter.
The way the world-building of these books is structured continues to
intrigue me. Day gets away with some problems that I think would be more
noticeable in other books thanks to the excellent pacing (no time to ponder
the world-building, we're on to the next crisis!) and the tight
third-person perspective. Niki is not a detail person, to say the least,
but she does keep returning to bits of world-building and poking at them a
bit harder, which gives Day repeated opportunities to shore up ideas that
felt shaky and dubious at first glance. Still, this is not a book that
prizes deep logical consistency or full exploration of the ramifications
of a bit of magic. You have to be willing to go along with the ride and
not think too hard.
For example, Niki can see bonds between couples and judge their strength.
This is apparently a long-standing power of the Recorder's line (she was
able to do that before she became the Recorder), and part of her
responsibility in these weddings is to check the bonds of the couples.
This leads to some well-handled scenes where she diagnoses a problem or
resolves a conflict because she can magically see the true relationship
structure.
Everyone in the book just takes this power in stride. This is wild to me!
This ability would completely upend half of society if you fully worked
out its ramifications and could find people other than Niki with the same
ability. Even if one assumes that a bond only forms over time and can't be
sensed in the early stages of a relationship (something the book never
establishes), can you imagine the implications of having an infallible
oracle that says at a glance whether a marriage will work (permanently,
the book strongly implies)? The implications for how to structure
marriage, for family planning, for psychology and psychiatry, for how to
structure dating, even for living arrangements and housing markets? This
is not a small world-building detail, and yet it's treated more like part
of Niki's characterization than like a foundation of society.
I think some of this all-vibes world-building may come from the general
new-age feel to how magic works. Day makes a grab-bag of random magic
canonical in this world: psychic lie detecting abilities, auras, chakras,
premonitions, and other bits of the sort of spiritualism that tends to be
heavily marketed to middle-class women. I have that niggling feeling that
one sometimes gets in SF that a lot of this is in the world-building
because the author believes it's partly real (see, for instance, psychic
powers and the Dean drive in 1960s science fiction). If one believes that
psychic powers and various bits of mysticism are true in our world, one
has already developed the rationalization mechanisms to explain away their
almost total lack of influence or impact on how the world is structured.
If one then introduces them into a true fantasy world, one may not notice
how many implications that should have for how society is structured,
since one is used to believing magic exists but has no significant
implications.
I could be entirely wrong about this analysis, and maybe it's a bit unfair
to Day. I should also be clear that this is not a complaint, just a point
of fascination to me when I think back over one of these books after I
finished it. There is a glut of fantasy out there that's constructed like
an engineering problem or that goes deep into politics or social theory,
usually written by people with strong opinions but not a lot of training
in real sociology. One of the joys of self-published books is that you
occasionally get something that assembles genre conventions in a way that
feels odd and delightfully strange. What if, in addition to dimensional
gates and overwhelming protean power invested in a true heir, all the
magic sold by the local Tarot and crystal store was also true? Sure, why
not! If the pacing is good and the story is grabby, it works for me.
It does seem worth attaching a warning for the folks who need scientific
reproducibility and explored implications in their world-building, though.
If you're the sort of reader who is bothered by political boundaries and
economic systems that match our world despite the existence of magic, this
series may cause you problems.
This continues to be a grabby, highly entertaining story of a woman who
finally gets to run her own small business the way that she always thought
the business should be run after years of working for an awful manager,
except that her business is total magical power over an interchange point
between dimensions, she's the chosen one, and the setting is a high
fantasy world with prophecies and gods. If that sounds appealing, don't
start here, but I highly recommend giving
Midlife in Gretna Green
a try. The series seems to be holding up.
Followed by a short story epilogue available by joining Day's mailing
list, an optional novella (maybe novelette) published in
Spilling
the Tea in Gretna Green
, and then
Seeing Red in Gretna Green
.
Rating: 7 out of 10
Reviewed: 2026-10-13
Strafe: A new open-source, E2E Encrypted, and federated alternative to Discord
Connect with your community on a platform that respects your privacy and freedom. No tracking, no ads, just pure communication.
Everything you need to communicate
Strafe combines powerful features with a commitment to privacy and open source values.
End-to-End Encryption
All messages are encrypted by default. Your conversations stay private, always.
Rich Text & Markdown
Express yourself with full markdown support, code blocks, and rich embeds.
Communities & Spaces
Create and join communities. Organize with rooms, roles, and permissions.
Voice & Video
Crystal-clear voice and video calls with screen sharing capabilities.
File Sharing
Share files securely without restrictions. Send whatever you need with no arbitrary limits.
Privacy First
No tracking, no ads, no data harvesting. Your data belongs to you.
Self-Hostable
Run your own instance with full control, isolated from our main instance.
Lightning Fast
Built for performance. Low latency messaging that scales with your community.
Available Everywhere
Use Strafe on desktop, web, or mobile. Your conversations sync seamlessly across all devices.
Free as in freedom,
not just free beer
Strafe is built on the principles of transparency, privacy, and community ownership. Our entire codebase is available under a permissive open source license.
Transparent Development
Every line of code is open for inspection. No hidden trackers, no secret backdoors, no surprises.
Community Driven
Built by the community, for the community. Your contributions shape the future of Strafe.
Self-Hostable
Run Strafe on your own infrastructure. Full control, full privacy, your rules.
No Vendor Lock-in
Your data is yours. Export, migrate, or self-host anytime without restrictions.
loading...
Main repository
Legal
Transparency in everything we do, including our policies.
E
verything that’s swept the world since the 2022 release of ChatGPT — “the AI economy”; data centers; chatbots acting as best friends, doctors, and mathematicians; talk of existential risk — it all starts, in some sense, with an intern in a University of Montreal lab named Dzmitry Bahdanau.
It was 2014. The 23-year-old Belarusian, who had been coding competitively since he was a kid but hadn’t done academic research before, was asked to help figure out how to get a computer to translate sentences from English to French. Bahdanau was working with artificial neural networks, which had already shown promise in pattern-recognition tasks such as deciphering handwriting and identifying objects in photos. The networks learn to recognize patterns by strengthening and weakening connections between nodes in response to training data. Bahdanau quietly doubted their potential to achieve anything like human-level intelligence, but his adviser, the computer scientist Yoshua Bengio, and the postdoc on the project, Kyunghyun Cho, were believers. And translation was widely seen as a formidable and interesting problem for neural networks to try to solve.
Translation is not as simple as swapping each English word for a French one. Languages have different grammatical structures and are riddled with idioms and connotations, all of which had long stymied attempts to automate the process. You can’t simply implement rules of translation because there are none. But neural networks seemed promising because they learn by example. They can be trained on huge databases of paired English and French sentences to, eventually, absorb the quasi-rules, exceptions, and subtleties.
Results had been mediocre, though; the longer the sentence, the worse neural networks performed. That’s because researchers were trying to cram each sentence’s data into a fixed amount of memory before decoding the sentence in the target language. It was a bottleneck that limited how complex and sophisticated translations could be. The network architecture just wasn’t right.
So Bahdanau tried something different. “It was just obviously the right thing to do — one of these things that happens once in a while in science where it’s just very clear to someone who is not very experienced in the field,” he recalled, speaking to me from Montreal, where he still works in AI. “And it just worked. From the very first attempt.”
Bahdanau’s trick, a mathematical operation that he, Cho, and Bengio referred to as “attention,”
enabled their neural network to translate long sentences
just as well as short ones. That meant the approach was scalable. Other AI researchers at the time quickly integrated attention into their neural network designs. Then, in 2017, a team at Google devised a new kind of neural network architecture called a transformer that supercharged the attention method and stripped away everything else. The team’s paper, “
Attention Is All You Need
,” reported that transformers achieved state-of-the-art translation while requiring a fraction of the computation needed to train prior models. The paper, which has since been cited more than 250,000 times, was a watershed moment in AI. Large language models such as ChatGPT and Claude followed.
Given the staggering power that’s been unleashed, it’s worth asking what this attention mechanism
is
exactly, why it is “all you need,” and why machine translation was the task that unlocked it all. Attention is a way for us to understand how a single AI model can converse with us, diagnose diseases, generate realistic videos,
solve long-standing math problems
, and more. Is it somehow at the heart of intelligence — artificial and otherwise?
Sentences with pronouns such as “it” in them illustrate the challenge that attention overcomes. Consider: “The animal didn’t cross the street because it was too tired.” And: “The animal didn’t cross the street because it was too wide.” To translate these sentences correctly into French, an AI model must determine that, in the first one, “it” refers to the animal, which is a masculine word in French, so the translation should use that form of the pronoun,
il
. But in the second sentence, “it” refers to the street, a feminine word that requires a different pronoun,
elle
. How can the machine figure this out?
Bahdanau remembered doing translation exercises when he was learning English in school. To write each next word of his translated sentence, he’d have to glance all around the source text to figure out what should come next. “Literally you have your source sentence on the left and your writing on the right, and you’ll be, like, turning your head, left-right, left-right,” he said. “That process is what I expressed as a neural mechanism.” The tool of attention that he gave to his neural network was a mathematical way for the network to identify the word or words anywhere in a sentence that would most inform the next word of the translation. In the case of our ambiguous pronoun, “it,” the system navigates the rest of the sentence to determine which words affect its meaning the most.
A transformer consists of many layers of nodes connected to nodes in adjacent layers. When a sentence is fed into a transformer, each word is first converted into a numerical representation called a vector, which we can imagine as an arrow pointing in a certain direction. These vectors pass through the network, and numbers called weights (determined by the model’s training) dictate how they are transformed in each layer. The weights turn each word’s current vector representation into three new vectors specific to that word — a “query,” “key,” and “value” — that each serve a different purpose in the attention operation.
The network performs this operation several times in parallel through systems called attention heads. An attention head compares each word’s query with the keys of all the other words in the sentence. How well these vectors match up — how much they point in the same direction — determines how strongly the value of each other word contributes to a new, updated vector for the word at hand. Information about other words in the sentence literally becomes incorporated into each word’s representation. The system is converting context into math.
When “The animal didn’t cross the street because it was too tired” enters a transformer, the first stack of layers in the network, known as the encoder, uses the attention operation to build up a contextual understanding of the sentence. In each layer, each attention head generates a query (along with a key and value) for “it.” This query vector can be thought of as a request for information that exists elsewhere in the sentence. For instance, in a deep layer (after the network has already accumulated information about words), the query for “it” might be interpretable as: “I need an earlier noun that could plausibly be the thing that is tired.” Meanwhile, the key associated with “animal” might effectively advertise itself as a noun that’s capable of being tired, among many other features. Its key therefore matches the query better than the key for “street.” And that causes the value associated with “animal” to contribute more heavily to the updated representation of “it.”
That new, context-enriched representation of “it” passes into the next layer. There, the network performs attention all over again. Successive rounds give the words increasingly rich representations of themselves.
Experts say it’s often hard to interpret what any given attention head is doing, but collectively they pick up on many kinds of relationships, from the partnership between nouns and verbs to the association between living beings and feelings. Later layers build on associations established by earlier layers, so that by the time the sentence emerges from the encoder, “it” is imbued with something resembling meaning.
After that, the second part of the transformer, the decoder, produces the French translation one word at a time, using attention to draw on the encoder’s numerical representations of the English words as it decides which French word to spit out next. The contextual information encoded in the English sentence helps translate “it” as the masculine
il
.
Crucially, no one had to tell a transformer that animals get tired and streets may be wide. The neural network discovers such associations during training, by learning from huge numbers of English sentences paired with their French translations. These associations get built into the weights. The network starts out with random weights that produce unhelpful queries, keys, and values, and thus poor translations. But each translation error sends a correction signal backward through the network that slightly alters the weights that produced it. Through trillions of these adjustments, the network eventually generates useful vectors that yield correct translations, even when it processes sentences it has never seen before.
Attention turned out to be the right mathematical operation for linking words and building context — the fundamentals of translation. And when you can translate blocks of text of unlimited size, it seems you can do anything.
A neural network that has learned enough about language to translate sentences from English into French can also complete sentences in either language. Predicting the next word of a translation is, in other words, a subtask of the more general task of “predicting the next word,” period. And that’s what large language models do. They’re trained on the contents of the entire internet, learning which words should attend to which other words in all sorts of contexts. They process and reprocess the whole dataset and try trillions of times to predict the next word in whatever part of the web they happen to be in at any point during training. The connections between neurons in these models are gradually tweaked in a way that produces patterns of attention between words that are ever more useful for predicting the next word in any context — or for producing an appropriate response to a prompt from a human.
From the ability to translate the word “it,” we somehow got a revolution.
“That’s quite a leap, isn’t it?” said Llion Jones, one of the authors of “Attention Is All You Need,” who is now the chief technology officer of Sakana AI.
Jones and others suspect that predicting the next word, which is known as language modeling, is “AI-complete”: a task so difficult that solving it means you have arguably solved AI in general. The reason it may be AI-complete is that this task includes, as a subtask, virtually anything humans do in written form. “The internet has translations,” Jones notes. “So if I said ‘“The animal didn’t cross the street because it was too tired” in French is [blank],’ then in order to complete that sentence, the transformer needs to be able to translate into French. If I say ‘2 + 3 is [blank],’ it needs to do arithmetic. If it sees a bunch of mathematical symbols in a row and wants to know what comes next, it needs to understand high-level mathematics. If I say ‘The president of the United States is [blank],’ it needs to know facts. So being able to predict the next word requires you to be able to do all these things. And because it’s AI-complete, language modeling is kind of the closest definition that we have to intelligence.”
It might not be apt to say that an LLM “knows” or “understands” anything — not in the way that a human does — but that’s just how we’re accustomed to talking about the abilities they display. Regardless, attention is the tool by which artificial neural networks access and convey meaning, association, and context, often well enough to astonish us with their fluency. (For tasks such as advanced mathematics, today’s frontier AI models often have more explicit formal reasoning and proof verification systems layered on top of their language modeling to check their work.)
But what about human intelligence? Might our brains employ a mechanism similar to the mathematical operation Bahdanau invented? After all, we, too, do something akin to “producing the best possible next word” when we speak, write, and even think. Perhaps our form of intelligence is tantamount to language modeling, too?
Cognitive scientists have begun to study this question — a new version of the ancient question of how language relates to thought. To be sure, the success of LLMs shows how much information about the world is encoded in the statistical patterns of language alone. The question is: When we master language, does intelligence come for free?
Recent research
persuades me that human thought is not purely linguistic (and most other animals’ intelligence is not linguistic at all): When we are thinking, more brain regions light up than just the specialized networks in the cerebral cortex that are associated with language. Language is how we
communicate
about the world, but our thoughts seem to draw on sensory impressions, physical and social experiences, memories, and reasoning abilities that exist at least partly
outside the brain’s language networks
. So language modeling seems to be merely a powerful component of human cognition, not its equivalent or source.
As for how
we
do “it” — how I instantly understand that it’s the animal rather than the street that is tired — no one yet knows. Jones, for his part, now thinks that attention is
not
all you need to truly master language modeling. After all, the brain evidently accomplishes this task far more efficiently than transformers do. We converse fluently without having read the whole internet even once, and without burning as much energy. “The current paradigm won’t solve this [efficiency] problem,” Jones said. “You seem to have to jump to something very, very different.”
Regardless of what our own neural mechanisms might be, it makes sense to me in hindsight that solving translation unlocked AI. Whether you’re human or machine, the ability to translate effectively means you have understood, in some sense. Now the machines understand so much — effectively, at least — that we hardly know what to think anymore.
Short version:
Bru
is an Android app and web client that lets you read and send SMS messages from your browser, via your phone. It is currently available from the
IzzyOnDroid
app repository, but hopefully soon on F-Droid, and possibly Google Play.
I used:
Plain HTML, JavaScript and CSS
Rust
Iroh
, as WASM in the browser, and via the available Kotlin bindings
Kotlin
Longer version
Since the start of the summer this year I have tinkered with
Bru
. The
b
idirectional
r
emote
u
plink for your Android phone.
Bru
is also the Norwegian word for
bridge
. And yes, the name is of course a backronym. Since I started using a T9 phone as my daily driver, I have more than once wished I could break out into a full qwerty keyboard when typing out long messages or having a longer conversation. Don't get me wrong, I love the tactile buttons, but for me, nothing beats an actual keyboard when writing. Another thing I wanted to solve was that every SMS was a prompt to take my phone out, opening the door for endless distractions. And yes, this could have been solved with notification settings, self discipline and yada yada...
Maybe I should not reinvent the wheel?
The best code is no code at all. Every new line of code you willingly bring into the world is code that has to be debugged, code that has to be read and understood, code that has to be supported. Every time you write new code, you should do so reluctantly, under duress, because you completely exhausted all your other options.
— Jeff Atwood
While my first instinct was "oooh I can build thing", I recognized that this might be a problem others have had and solved before me. I did some searching, and tested some alternatives. It is quite possible I have left out several good candidates, but these are the ones I looked at.
Google Messages
The default SMS app from Google actually has a "Device pairing" option. Sign in to
https://messages.google.com/web
and pair your phone, and it works pretty well. But for one, it is limited to the Google app, and I have (
very
) gradually tried to limit my reliance on big G. With that said, my only real gripe is that you have to re-pair very frequently. Often enough that during my limited testing I was quite annoyed. But if you are using Google Messages anyway, this might be the right solution for you.
KDE Connect
Sigh. I really wanted this to be the solution. The ambitions are great. KDE is great! Open source! It even has a MacBook client, being a Linux-adjacent project. But I could not get it to work reliably. The pairing process was buggy. Sometimes connectivity would break, even with the phone and laptop on the same network. I found the options for configuration overwhelming, and in good Linux-fashion, there is ample room for some UX improvements. But the biggest problem was that I found the whole experience ... clunky? For all I know the Linux client is leaps and bounds better than the Mac one, though. Maybe this is the right solution for you?
Pushbullet
Pushbullet has been around for a long time. And to be fair, I didn't really give them a fair chance. I tried it years ago, and found it aggravatingly unreliable and buggy. Dropped notifications, SMSes reported as "sent" never ended up actually sent, messages I had already answered suddenly triggering notifications again. Things may have improved, I didn't bother to check. I am listing it here for completeness' sake.
A wheelwright I shall be
Okay, so I might have really wanted to build this thing just for the sake of it, regardless of the alternatives.
I decided on some goals for the project:
Free as in beer, free as in speech.
No account or user profile. No saving anything about anyone.
No backend service (except the relays).
Messages should be end-to-end encrypted (duh).
Keep dependencies to a minimum.
No web framework for the client.
Ideally it should be self-hostable.
No agentic coding. I have used Claude as a rubber duck/documentation know-it-all/security reviewer.
I started out with the obvious problem: how can I get the phone and the browser to talk to each other? Being familiar with WireGuard, I first thought about baking that into an app on the phone that could serve a REST(ish) endpoint that a client on the same network could access. As an easy way to start prototyping I installed Tailscale on my phone and on my laptop, as Tailscale is WireGuard under the hood, and gives you a stable IP address for the devices on the network. The architecture at that point was polling based, the web client would poll the server running on the phone periodically and look for new messages. While I had a nagging feeling that this might not be optimal for many reasons (battery life on the phone for one) I just wanted something that worked to iterate on.
After some evenings of hitting my head against the wall that is Android development I had a rudimentary app working, running in the background on the phone and serving the available SMS threads, secured with a hard-coded token just in case. With that in place I could start working on a client.
Back to the basics
As stated, I wanted to build this as a statically hosted web app, and without any web framework. I wanted to get a feel for how it is to develop like this in 2026. Having relied almost solely on React professionally, and SvelteKit in my spare time, I wanted to do something different. I first imagined the client as a typewriter with the paper sticking out of the top sort of thing, but ended up turning the skeuomorphism down a few notches. I kept the monospaced Courier font and off-white though.
The client is built as
index.html
files in a folder hierarchy, an increasingly unmaintainable
style.css
and typed JavaScript with ESM modules and custom elements for the reused components like header and footer. This does mean the components are rendered client side instead of being baked into prerendered static pages which I would have preferred. There are no architectures without tradeoffs, and the alternative would have been to copy-paste the shared code across several pages and remembering to keep them in sync. Not horroble, but not great either.
Tin cans on string
While the prototype worked, there were some things I needed to figure out. For my own personal use, depending on Tailscale as an additional app was not a problem, but it would greatly reduce the number of other people that would bother to install it. And while solving problems for myself is enough by itself, creating something that others might find useful as well is very rewarding. Embedding the WireGuard tunnel library seemed like a logical step, but before I started on that, I found Iroh.
Sometimes the stars align. A post announcing Iroh 1.0.0 came up in one of my feeds, and I knew this could be the right fit. In essence, Iroh is a dumb pipe. You put stuff in at one end, it comes out the other. "Dial keys, not IPs" is the mantra. And being built with Rust, it works in the browser when compiled to WebAssembly. And with the Android SDK available, it was exactly what I needed.
Iroh works by establishing a direct peer-to-peer connection between your devices. It does this with the help of relays, servers that both devices can reach. When a device starts up, it connects to a relay. When one device wants to talk to another, they first swap addresses through the relay. Then both start firing packets at each other at the same time. Each router sees the incoming traffic as a reply to something it sent out itself, and lets it through. This is called hole punching, and works in most network topologies. When it doesn't, say on a locked-down corporate network, the traffic is forwarded via the relay.
Browsers aren't allowed to send raw UDP packets, so hole punching isn't possible there, and the Bru web client always goes through a relay. The connection is still end-to-end encrypted, so the relay can't read your messages. A desktop application, or a terminal based one, would be able to do actual peer-to-peer communication.
The juicy center of the client, the Iroh-related code, is written in Rust and compiled to WebAssembly with
wasm-pack
. The module exposes a single
Bru
struct that the JavaScript code can use. It has methods for opening a connection, sending and receiving data, health checks and so on. Having wasm-pack generate the bindings and glue code makes using WebAssembly as easy as any other JS module.
Self hosting and hacking
Since the Iroh relay is open source and can be run on whatever server you want, and the client is simple static files, the whole stack can be self-hosted if one is so inclined. There is a settings menu in both the client and the Android app to configure the relay in use.
The "protocol" is also open, and there is no reason why a user could not build their own client. I am hoping someone will. Maybe a CLI, desktop app, AI agent integration (or maybe that is not a good idea?) or maybe something completely different. If I get the drive to do it, I might extract the relevant code into a self-contained library others can use.
Iowa Hospital Workers Demand Return of Deported Co-Worker
A diverse and serious crowd of people stands close together inside what looks like a church, in front of organ pipes, holding a big printed red banner that says "Essential not deportable" with the logo of Escucha Mi Voz. The person in the middle is speaki | Escucha Mi Voz (Hear My Voice)
Fatou Traore was on her way to work as a custodian at the University of Iowa Hospitals and Clinics (UIHC) on the morning of Thursday, September 24, when ICE agents detained her.
Despite having legal immigration status in the United States and no criminal record, she was deported to Sierra Leone (a place she has no connection to) on October 12. Traore is a beloved member of the Iowa City community and of AFSCME Council 61, Local 12. She is also the mother of four children, the youngest of whom is three years old.
When I first heard the news of her September detention, I was upset that ICE had taken someone from the very hospital where I worked. Many of the workers at the hospital weren’t aware of her detention or were afraid to speak up. I wrote to all of the inpatient phlebotomists I used to work with at main campus, some of whom had also been custodians and worked with Fatou.
I wrote an opinion letter for a local paper,
Little Village
. I helped spread the word to raise awareness of her detention across community networks, from my supervisors and senior administration at UIHC, to the soccer team that my son plays on, to the yoga community I belong to, to my own family and their church communities, to the Iowa Writers’ Workshop, which I graduated from in 2022—to every person that I knew.
HOSPITAL SILENT
Next I thought a petition would be a good way to spark awareness and collective action. Months earlier a petition had circulated to change an unpopular parking policy the hospital wanted to put in place.
This time our petition called on the hospital—and the other community powers that be—to speak out against Traore’s detention. But the hospital didn’t budge, saying, “You can voice your opinion as a private citizen, but we can’t make any kind of statement about this.”
That’s precisely the problem; the people who have the most stake in protesting ICE’s actions and what happened to Fatou aren’t safe to do it—they aren’t safe as private citizens. That is why the hospital and so many organizations in Iowa need to be standing up and saying this is wrong. Fatou’s detention and deportation is an abomination. We need her back home.
Since her detention, her family and community, the worker center Escucha Mi Voz Iowa, the Iowa City Catholic Worker, and the Immigrant Welcome Network have been working tirelessly for her release, rallying the local and wider communities and calling on state representatives and religious leaders to denounce ICE’s actions.
During the legal proceedings put in motion on her behalf, Fatou was denied due process. The government deported her to a third country before a judge could rule on her stay motion, and her request for a credible fear interview was ignored.
“Due process means giving people a meaningful opportunity to be heard before the government takes an action with devastating consequences,” said Mazahir Salih of Immigrant Welcome Network.
WE’RE NOT DISPOSABLE
Fatou is a pillar of our community and our workplace. Her work at UIHC has touched countless lives, demonstrating her commitment to improving the health and well-being of others.
I’m a phlebotomist and she’s a custodian, so we’re kind of in a similar role where we’re coming in and out of patient rooms, mostly doing our work behind the scenes, and very underappreciated.
We’re thought of as disposable, and people have the impression that we don’t matter—if we’re not there to do our job, then they can fill it with anybody else—and it's just not true. The people who work these jobs are committed to being there. She had the resilience to keep showing up and doing that job for over a decade.
We call on the powers that be—the Department of Homeland Security, local representatives, and community leaders, and UIHC—to intervene to bring Fatou back now, and on Iowa’s congressional delegation to demand answers about why she was deported before a ruling on her stay motion and why her request for a credible fear interview was denied.
We need her here. As her co-workers, we have circulated a petition, attended rallies, written letters, spread the word of her story, called our representatives, and agonized every day of her absence. She belongs with us. Bring her back now.
===
Sara Gilmore is a phlebotomy technician at the University of Iowa Health Care Medical Center. She's an AFSCME Local 12 member.
I built a tool to track what AI leaders say and how their views change on video
I'm not trying to be facetious. I really want consider whether or not, in 2026, in the age of vibe coding, agentic programming, loop or graph or whatever diagrammatic metaphor-based engineering is most popular, does it matters what web framework you use? More importantly (to me and my particular interests), and at the risk of
Betteridge-ing myself
: should we make new frameworks?
React won, so do we ever try anything new?
Is there now just more room for niches? Nobody cares about the implementation details. Nobody cares what's in a
.tsx
file. Does that open up new opportunities to try something new, or, since it doesn't matter, does the industry as a whole just decide to use the most stable thing, forever?
In this time of great disruption, we get the opportunity to rethink best practices (or in Remix's case, re-rethink), and
lay everything on the table again
. That doesn't mean everything stays on the table, just that we'll take the good, leave the bad, and modify the ugly. The question of this article isn't one that needs refuting, it's one worth considering seriously.
As someone who has worked on open source frameworks in a full-time capacity for 3 years, I'm deeply interested in this question. I'm not interested in protecting myself/my craft, I'm interested in bettering my craft and having a good career. I am considering and also trying to predict (and make) the future. It's humbling to remember "I could be wrong", and it's encouraging to remember most everyone else will be.
In this article, I want to break the question and its implications down into their more fundamental elements, so I can rebuild a version of reality worth pursuing and building. To do that, it would be worth first considering what a web framework is. I find this really hard, since it's a very nebulous and general term, and you end up comparing Flask to jQuery to React to Next.js. Instead, I think it's more helpful to consider what value frameworks provide. I think this statement is sufficient:
Frameworks provide abstractions, structure, and constraints for building your website.
Imagine
Imagine there's no React
It's easy if you try
No Svelte below us
Above us, only bi(nary)
Imagine all the people
Prompting for today
(Sorry, Svelte, for replacing you with the word "hell". It's not because I perceive a resemblance, I just liked the way it sounded.)
So let's return to the argument, and spell it out a bit more. This is the conventional wisdom I am hearing right now:
Since the models got good (circa Winter '25-'26) for agentic programming, I care less and less about the code (and you should too). This is particularly true with any frontend code, because it's all largely presentational. Therefore, if it looks good, it is good.
Given the state of the models, and given that React is already the most dominant UI framework, with the very popular meta-framework Next.js (plus a few other good choices like React Router and TanStack Start), there really is no need or value in trying anything else out. Plus, because there is vastly more React code out there in the wild, the models are trained more heavily on it and are therefore better (or at least more familiar) with React. The React singularity has already happened, accept it.
Obviously (I hope) I am now being a bit facetious. The argument is still worth considering, mostly because I see people
cargo culting
this opinion and React along with it into their vibe-coded apps. There are, however, some much more serious folks such as the Cursor team who do seem to be convinced that in the age of agentic programming
using React is an advantage
.
I'm tempted to dig into each of these claims:
You don't need to worry about frontend code
Models are best with React because of their training data
Models would be bad with a new framework because of a lack of training data
I'm not actually sure of the value, though, particularly in arguing about React. I have a much bigger issue with the logic, and it stems from my original question:
Do frameworks matter anymore?
Here's what I don't get about the argument: why React? Why any framework or UI library at all?
If LLMs have gotten so good at frontend code, and if people care less and less about the details of their HTML, JavaScript, and CSS and only care that it looks and behaves properly, then why even put a layer of abstraction between the LLM and the website? If ever there were a time to embrace Web Components, surely it's now.
React no longer has to be one's personality. Disclaimer: I say this as someone with a YouTube channel named "React Tips with Brooks Lybrand". Plus, we already have AI labs to make our new personality, so we'll be fine.
Let me pitch the argument differently:
Since the models got good (circa Winter '25-'26) for agentic programming, it's easier than ever to build a beautiful and interactive website without having to worry about what we previously called DX (Developer Experience). My agent doesn't care about things like file-based routing, and why should I bother it with properly setting up a
useEffect
?
Plus, models are really well trained on JavaScript, HTML, and CSS (sort of), so there's really no need or value in adding any more layers of complexity.
I think there are some logical leaps and mistakes in this sentiment, but no more than in the first, more widely accepted one.
Either:
Frameworks do not matter, in which case you have no reason to use React.
You are likely still at an advantage using React, in which case frameworks do matter.
What is the value of a web framework?
Ah, the web framework. Where does it start, where does it end? What's its purpose? Do we even need any at all? After all, what was so bad about jQuery? Has anyone made the argument yet that we should just let the agent use jQuery since it's well represented in its training data? If not, they should. An agent doesn't care about spaghetti code, right?
I'm old enough to remember the "framework wars" of the 2010s. When I did my own evaluation for my company at the time, I was picking between React, Angular, and Vue. Those were the "frameworks" we talked about. Gatsby existed, but wasn't general-purpose enough (static-site generation only). Next.js was pretty cool, but also pretty limited (no good mutation story). For the most part, if you were in the React ecosystem, you just used create-react-app (CRA) and
maybe
you
ejected
if you actually had someone on your team who thought SSR was valuable and wanted to set it up.
I ultimately picked React, and many other people did too. But why? What made React so compelling as a framework?
If you ask the React team why React won or why it's so great, they will likely say "composition". I find it very difficult to encapsulate exactly what made React so special, but I think this is a big part of it. I didn't really understand what "composition" meant early in my career and React usage. I just knew that:
React was really easy to plug into an existing site
React had a really nice way to encapsulate logic and markup into contained and potentially reusable components
React had a robust and constantly growing ecosystem of libraries that helped fill in additional pieces I needed: routing, styling, head/meta tag management, etc.
I would learn later that React also provided server-side rendering (SSR) out the gate, making it look and feel a good bit like PHP with its HTML-in-your-scripting-language sort of experience. Setting this up was a bit more involved, especially for folks like myself who were more frontend-focused. This led to the rise of the "backend-for-frontend engineer" and the meta-frameworks like Next.js and Remix (the old one,
sorry
).
React was solving a number of problems. Despite what
Mr. Rauch thinks
(and ordinarily, he is pretty much on the money), React didn't "win" because it came with a component library that wraps a great style system and lower-level accessible components and utilities that you can own and morph to your own needs.
shadcn/ui
is awesome, don't get me wrong. But even within the component-library/design system story, it's the latest evolution in a long line of successors from Radix to Reach UI to Material UI to Bootstrap and many, many more that I'm skipping, forgetting, or unaware of. The existence of
shadcn/ui
on top of many other popular incumbents is a testament to what makes React great, not the other way around.
This long but brief diversion of why React "won" hardly does justice to the full history, and it certainly doesn't even touch on what makes other web frameworks interesting. Despite React's predominance, plenty of other frameworks and meta-frameworks get millions of weekly downloads and are loved by many a developer. It also completely glosses over the popularity of non-JavaScript-based frameworks such as Laravel and Ruby on Rails.
I don't know a better way to consider value frameworks provide without introspecting what made my first love, React, so special to me. React made it easier to build dynamic websites without ending up with spaghetti code, and spaghetti code was bad because it was costly to change and maintain in the long term. React enabled me, elevated me as an engineer, solved problems I didn't want to solve, and opened me up to an ecosystem of other developers who were making it better and building more useful tools on top of it.
As I stated at the top of this post, I think the value-add of a framework is pretty simple:
frameworks provide abstractions, structure, and constraints for building your website
.
This isn't even really a unique property of frameworks, this is true for all libraries, modules, classes, and functions. Code is a series of abstractions that express meaning and intent to computers and anything else that will manipulate or learn from that code. Previously, that meant humans, and we called it "reading the code", and so we cared a lot about things like variable names. These days the level of detail we care about is shifting and resettling. Maybe we're on some infinite curve and we'll care less and less about the trees until we don't even care about the forest. Personally, I'm doubtful, but I could definitely be wrong.
Either way, I think I still want a framework. I want code that's well tested, secure, easy to reason about, and that gets my agent in the grooves it needs to be in to produce results I like.
Everyone uses a framework
Alright, the jig is up, I'm being
a little
facetious when I ask
"Do frameworks matter anymore?"
You're either using a framework, or building a framework, and building a framework is really hard.
This wasn't the first time I'd heard this. In fact, at a prior job as an engineer on the web platform team of a
Texas grocery store
, we ran into the same thing. We built our own meta-framework around React to handle server-side rendering for initial requests, after which the application would hydrate the whole document and hand off routing on the client using React Router (v5?).
While we did have a cute name for this little meta-framework we made (
exo
, I believe, and no one could agree why it was called that), most engineers didn't think of it as a framework. I blame that mostly on the combination of a lack of features and a lack of marketing (why would we market an internal framework?). Nevertheless, we had still built our own framework, and it came with a lot of maintenance cost and burden, plus very few engineers actually understood how it worked, making it a pretty decent-sized liability.
Long story short, they started the process of moving off of this home-grown meta-framework and switching to Next.js. I didn't get to see the transition through because this was around the time I went to work with the Remix team at Shopify (of course we "joked" that it was this decision that drove me away).
The timeline of this anecdote is pretty definitively right before agentic programming would git gud. Assuming you're starting a greenfield project right now, and assuming it's not just for demonstration purposes or a 1-off presentational website, I think Ricky's statement is both more true now than ever, and a little bit wrong.
Let's start with the wrong:
"building a framework is really hard".
It's really not anymore. I mean, it depends on what you want. If you want a good, robust, bug-free, secure, full-stack framework, it's gonna take a lot more than a couple of prompts to really flesh out. And then when you start using it, you may find that LLMs can't really make it work for all the things you ask it to do, so they just quietly build hacks around your framework, and depending on how you're building this framework those hacks end up becoming part of the framework. Avoiding bolting on hacky workarounds and deciding on good, robust, and extensible abstractions require a bit of work and iteration, even with frontier models, in my experience.
However, building a framework, not even a shitty one, just an okay one, is not really hard. I know this because if you don't use a framework and you start building a website with an LLM, it will build a framework for you. The LLM might not have the feature breadth and definitely not the marketing dollars or ambition to sell you on its framework, but it still builds a framework. It'll make a framework just like it'll make functions, and classes, and all the typical abstractions we used to make when we programmed "by hand". Just because you're looking at it less doesn't mean the agent isn't fundamentally doing the exact same thing we're doing. I don't even care to call it slop, it's progressive feature adding with no cleanup, that's how I built all of my first projects. This is nothing new, the biggest thing that's changed is speed.
An agent can now build your website faster. It can look up information and ideas faster. It can create a mess faster. We were capable of all of these things before, this is not a "humans > AI at programming" take. My point is simply that you are either using an explicit framework, or generating an implicit one. If you don't think it matters at all, then
to my earlier point
, why even use React? You may not understand your bespoke framework, but your agent does and it wrote it and it probably likes it. You ask the LLM about its framework and it knows more about it than you know about React's internals, and it's just one step further along the inevitable pathway of merely having
LLMs ship binaries
instead of human-readable code. If that's what you believe, at least be honest about it and throw away React, surely it's only slowing you down.
If you do somehow, for some reason, think it's better that an LLM use a framework like React or a meta-framework like Next.js, my guess is it's because you prefer the LLM to use something battle-tested, well-abstracted, and well-documented. You probably also like that it sets up guardrails for the agent, it avoids reinventing the wheel where the current wheel gets you where you want to go. You may also like that a whole team and many other companies that depend on that framework are thinking about security issues, not just you and (fingers crossed) your agent. You may have other reasons, but here are mine:
What I want (and don't want) in a framework
These days, I am much more interested in the "shape" of code, something abstractions and structure help with tremendously. I'm also interested in constraining my agent (tests, linting, Skills, scalable patterns to replicate). There are many things that used to be important to me when I was the one directly typing the characters of the code, things generally labeled as Developer Experience (DX). Some of that stuff is still helpful to me, some of it is no longer very helpful to me (but is to the agent), and some of it doesn't seem to be helpful to either of us. Let's look at some anecdotal examples.
Take Hot Module Replacement.
HMR allows me to make changes to a website and immediately see updates in my browser without having to refresh the screen. When this works reliably, it is incredibly helpful, especially when tweaking the design of something that involves a user flow (like error messages on a form, accordions that start out collapsed, and absolute positioning of a decorative element). This isn't a make-it-or-break-it feature, but I have found that even when working with agents (maybe especially since working with them), HMR is very helpful if I am working on complex user interactions and really trying to dial in the design.
Take TypeScript.
TypeScript used to be super valuable to me because it created constraints. My JavaScript now had to be typed (and C# devs rejoiced, so I'm told). Additionally, it made it much easier to discover the fields and methods available in an object, because I could just hover or
command+.
on said object and see what was available. TypeScript was a big part of creating the built-in documentation that helped make me stay productive while I was in the code. These days I pretty much don't care at all about discovering specific methods on an object, and the type constraints don't directly help me.
However,
many others
and I still seem to find that for complex applications (not just 1-shot vibed stuff you'll throw away), having the constraints of types really dials in the LLMs' ability to iterate on code without accidentally breaking everything. Plus, as far as I can tell, having access to the LSP seems to help it with discovery when encountering a function, object, or module it's not deeply familiar with (such as legacy code or code generated by a prior agent).
Take
useEffect
.
I know it's kind of the poster child for shitting on React, and I know the React team has
supplied new APIs
that are supposed to help with its shortcomings. The thing is, though, I was a
useEffect
wizard when I was personally slinging the React (at least I felt like I was). I didn't mind
useEffect
so much, I trusted myself with it. It was a dependable, quirky, and very powerful hook that I felt comfortable wielding, primarily because I felt confident I knew when
not to use it
. With LLMs, I find
useEffect
to be worse than quirky, and no matter how smart the model is I don't feel comfortable at all with them wielding that abstraction. In fact, Grok Bot's development apparently
bans
useEffect
outright.
Let's recall the framework value-add. I want a framework
with a short skirt and a long jacket
that provides abstractions, structure, and constraints for building a website
.
I find that if an
abstraction
doesn't exist, an LLM will make it. Sometimes that doesn't really matter, sometimes it's just a one-off abstraction. Sometimes it does matter, though, sometimes an abstraction is built around an actual web primitive (the Navigation API for client navigations). Sometimes an abstraction plays well with other abstractions (using
fetch
and the
Request
/
Response
model across the router). Sometimes an abstraction encapsulates behavior that's very hard to get right consistently and bug-free the first time (React's Server Components if you like 'em, Remix's
Frame
if you don't).
I've already talked about how I still like to see the shape, or
structure
of code. Maybe
Mr. Musk
is right and we're just accelerating to a superhuman level of coding, and me trying to understand the code is ultimately a drag. For now, I find I get the best results when I work with the agent, create a good core architecture for it to build off of, and continually refine the architecture when I find it generating difficult-to-follow code (not even for me, for the agents; I notice when they get confused).
And finally,
constraints
. I want it to be
incredibly
clear how to do the right thing the right way. I want escape hatches to be possible, but generally unnecessary and always obvious to me and the machine when they're taken. I want testing and tooling that check the agent's work built into the framework. I want good docs available immediately, preferably in my
node_modules
, so the agent isn't constantly wasting time scraping the internet and potentially bringing in bad advice.
So do frameworks matter anymore?
I have been writing this blog post for
3 weeks at this point
. I've spent the last 3 years of my career working on open-source web frameworks. I like this work, and I'd like this to be what I work on for the foreseeable future. Answering the question
"do frameworks matter anymore?"
is incredibly important to me, because more than I love working on frameworks, I hate the idea of working on something that doesn't matter.
Through writing this piece and multiple conversations with peers in the industry, I feel pretty confident about a few things:
AI is absolutely reshaping how software is made, both individually and at scale.
Until proven otherwise, different people and approaches yield varying degrees of quality, even when using the same model/harness. Thus,
I will treat an LLM as a tool I can improve
.
No one actually knows the long-term impact AI will have on software development, let alone the world.
AI is currently the industry's primary focus.
I think the
Framework Wars
of ~2013-2019, followed by the sequel
Framework Wars: The Rise of the Meta-Frameworks
~2020-2024, are over. Clearly, by putting the end year of 2024, I believe they've been over for a little bit. People can stop being fatigued by JavaScript, and thank goodness because we all know
we're fatigued by the AI hype/doomer cycle
.
I've accepted, or am accepting, that people do not yearn for frameworks the way they used to, and in many ways that's probably a really good thing. It got a little crazy there for a second, and I, of course, was very much bought in.
But something doesn't have to be the center of the hype cycle to be important or useful. There wasn't a whole lot of talk about the performance of
git
or finding an alternative to GitHub until swaths of OpenClaws and other agents on the loose stress-tested the whole system and identified new bottlenecks.
Now there's a lot of focus here
.
Technological development is dynamic, and new tools, ideas, patterns, and libraries beget even more of the same. Instead of sitting around moping about how people don't want to fight on Xwitter about Next.js vs Remix anymore, I'd rather actually take part in building what I think I and other people could benefit from.
So again:
do frameworks matter anymore?
Let me clarify my "yes" by summarizing my points so far:
The industry seems to think so, otherwise why use React?
If you don't use a framework, your agent will make a framework, so you're using one whether you like it or not.
Frameworks provide abstractions, structure, and constraints for building your website. These are good when shaping software with an agent. Using a well-thought-out, open-source, battle-tested, and well-documented one likely has benefits over the homegrown one your model created.
As I sit here and lay out the summary of my thoughts so far, I recognize that it may look like I'm fighting a straw man. "Of course people think frameworks matter and help your agent, that's already a solved problem with React and Next.js (or any of the other existing frameworks that are good enough)."
Fair enough. I guess the question is:
Do new frameworks matter anymore?
I think we're in a sad place in human and technological development if we think all problems are solved. That kind of decadence is not for me. To me, if something is good, then you can probably make it better. Maybe the existing landscape is "good enough", and that's fine if it is for you, but it's not for me.
I want a JavaScript framework that is full-stack, actually. Maybe we'll never get there, prior attempts did not take off (👋 Meteor, we all loved you). So long as I (or my agent) have to cobble together a bunch of packages to assemble a complete full-stack applicatio, from database to routing to styling, animations, and accessible components, there's room for improvement.
I want it to be built on web standards and APIs, so that it speaks the language of the web, not the language of Node.js or any single JavaScript runtime. I want it to be a framework that feels universal and like an obvious extension of the platform it's built for, not an esoteric research project by a PhD candidate.
I also want a framework that AI can work with easily, and that results in code I can reason about. I don't want the end result to be a mess I don't understand. I'm not building the car, but dammit, I want to open the hood and actually know what I'm looking at. I have yet to see a good empirical way to actually build a language/framework "for agents". So far, my taste (which just means my subjective, biased experience working with these models) matters
so much more
to me than any benchmark or analysis of how many tokens were used to make a TODO app. I'm not saying we shouldn't try, I'm saying the difficulty of creating a definitive, objective measure of which framework is best for agents is evidence enough to me that there is room to keep improving.
Do new frameworks matter anymore? There's only one way to actually find out. Let's build some.
Freexian Collaborators: Debian Contributions: New experimental backend for autopkgtest using pconr, DebConf site visit and more! (by Anupa Ann Joseph)
PlanetDebian
www.freexian.com
2026-10-13 20:00:00
Debian Contributions: 2026-09
Contributing to Debian
is part of Freexian’s mission. This article
covers the latest achievements of Freexian and their collaborators. All of this
is made possible by organizations subscribing to our
Long Term Support contracts and
consulting services.
DebConf site visi...
In preparation for
DebConf 27
, Stefano Rivera,
Nattie Mayer-Hutchings, and Jongmin Kim from the DebConf Committee visited
Asahikawa Japan. A contingent of the local team gathered to tour the venues
with us, discuss plans, and meet the local organizations assisting the event.
We held a press conference at the city hall that got
some coverage
.
A few potential day-trip options were explored.
Photos
from the site visit.
autopkgtest-virt-pconr, by Helmut Grohne
Following the creation of the
pconr
module that provides a basis for
unschroot
and a more secure
containment for mmdebstrap
,
an experimental autopkgtest backend
autopkgtest-virt-pconr
is now available. It fits a spot between autopkgtest-virt-unshare and more fully
fledged containers as it does not require much infrastructure like setting up
incus or lxc but still provides a containment running an initsystem. Due to the
use of
erofs
as base image format,
it boots and reverts quickly. This development also required fixing concurrency
issues in
asyncvarlink
and even shed
light on a matching
bug in systemd
that was promptly fixed upstream.
Miscellaneous contributions
Carles reviewed and submitted six Catalan po-debconf translations using
po-debconf-manager
.
Improved po-debconf-manager’s workflow for updating translations.
Carles reviewed, translated or updated
webwml
Catalan translations for security and CD pages. He also fixed issues that
prevented building webwml, deleted orphaned translation pages, etc. and
experimented with a more global HTML tidying up experiment.
Carles refactored
check-relations
adding capacity to ignore concrete from_package -> to_package specific relations
and more flexibility around ignores. Detects unused ignore rules as well.
Thorsten did an hplip upload to replace an expired certificate of HP. This
certificate is used to sign new upstream releases and modules that can be
downloaded later. Afterwards work on a new upstream version started.
Thorsten also struggles with autopkgtest problems of the new upstream version
of cups. Work is still ongoing.
Antonio worked on several topics around Debian CI maintenance, reliability and
performance.
Stefano updated the autopkgtests for cPython packages in Debian to support
setuptools 80.
Stefano uploaded pypy 8.
Stefano helped to get DebConf 26 reimbursement claims processed, and worked on
some of the resulting issues in debian-reimbursements.
Emilio managed various transitions.
Emilio worked on the rustc-web/trixie bootstrap for armel, using the rustc
1.95 version from trixie-backports. This will be needed by the upcoming clamav
security updates.
Helmut sent patches for 11 cross build failures.
Helmut introduced a new build profile to libcap-ng to keep architecture cross
bootstrap working.
Helmut uploaded
debvm_0.5.5
introducing support for Hurd thanks to a lot of work by Johannes Schauer Marin
Rodrigues.
Colin upgraded to new security releases of groff and parted.
Colin upgraded 50 Python packages to new upstream versions, and fixed over 40
RC bugs in the Python team.
Santiago continued mentoring Aryan Karamtoth with the GSoC project about
introducing livepatching support for linux. This mentoring is done in
collaboration with Emmanuel Arias. In particular, Santiago explored different
requirements for providing binary modules for the same kernel packages used by
Debian, that require a matching version number.
Anupa joined Jean-Pierre Giraud to prepare the files for point release
announcement for Debian 13.7.
The Rise and Fall of America’s Most Tireless Socialist
Portside
portside.org
2026-10-13 19:45:09
The Rise and Fall of America’s Most Tireless Socialist
Judy
Tue, 10/13/2026 - 19:45
...
What can the history of American socialism tell us about the present and future of democratic politics? The last decade has seen a resurgence of interest in socialism, from Bernie Sanders’s runs for president to the rise of Alexandria Ocasio-Cortez, and recently the election of Zohran Mamdani as New York mayor. Each of these figures has had to face the long-standing assumption in American politics that socialists just can’t find traction in the United States
.
American Socialist: The Life and Legacy of Eugene V. Debs
,
by former
Jacobin
editor Shawn Gude, offers an important corrective, illuminating the forces that shaped America’s foremost socialist evangelist, and the exceptional efforts of his opponents to crush him and his movement. Along the way, the book reveals a deeper truth: that in the United States, the story of socialism is really the story of opposition to socialism.
From the beginning of the transformation of the United States into an industrial power, the tycoons, politicians, and judges formed the best-funded union in American history, a cartel that used its bottomless collective pocket to divide and conquer workers—all while promoting the myth of rugged individual success. The collusion of corporate and government interests to suppress worker power has been a constant down the decades, from Jay Gould cutting wages and firing union workers in the 1880s; to the Colorado state militia
setting ablaze
an encampment of strikers’ families in Ludlow in 1914, killing 11 children; and through thousands of more or less bloodily suppressed labor protests in between. Any history of socialist actions—union drives, strikes, demonstrations, political runs—is incomplete without the story of this ferocious, unequal reaction. And it’s vital for an understanding of Debs himself, of how and why a man would hurl himself time and again into the teeth of this enemy.
An elusive, often frustrating hero, Debs was born in Terre Haute, Indiana, in 1855, to immigrants from Alsace in northeastern France who ran a grocery store catering to their local French community (in other words, they stocked wine). Gene, his four sisters, and baby brother were raised to be skeptical of organized religion and to question American society’s
entrenched
inequalities. In the overwhelmingly white Midwest of Debs’s childhood, these were primarily economic. The Civil War was a distant roar, but the downturn that followed affected the family finances enough that 14-year-old Gene quit school to work for the railroad—then barreling across the open plains, transforming remote, windswept way stations into smoke-choked cities, home to a brand-new working class.
He began by scraping the grease off the side of trains, then painting the stripes on the engines. At 16, he became a “fireman,” shoveling coal alongside the engineer driving the locomotive—sweaty, strenuous, dangerous work. He lost his job when the railroad boom of the early 1870s crashed and plunged the country into depression, but Debs still identified as a railway man. In early 1875, he
became
a charter member of the local branch of the Brotherhood of Locomotive Firemen—a secretive, exclusive fraternity priding itself on “benevolence, sobriety, industry.” These proto-unions supported their “brothers” and families after accidents, although many workers no doubt felt like the man who said, “I would prefer my limb instead.”
As the economy continued to bubble and burst through the late nineteenth century, the vast expansion of the railroads across the country drew in huge numbers of workers, who knew their importance to America’s industrializing project. As an alternative to exclusive craft unions and fraternities, the Knights of Labor,
founded
in 1869 in Philadelphia, preached a vision of a “cooperative commonwealth” that would welcome everyone, Black and white, male and female, whether they worked in fields or factories, kitchens or coal mines. The Knights emphasized community as much as battle, with picnics, dances, newspapers, and study groups. Their vision of the labor struggle as a shared, joyous culture would, in time, resonate with American socialists, but few leaders grasped how vital that joy really was.
Eugene Debs’s union activism was, by contrast, conservative and cautious. He distanced himself from the strikes that were becoming more frequent, widespread, and violent, and in 1885, at 29, he was elected to the Indiana House of Representatives as a Democrat. There, he fought to introduce a bill to make railroad companies liable for worker injuries, only to see it quashed by the business-friendly state Senate. Tired of the compromises, he served out his two-year term quietly, and did not seek reelection. Debs did not really want to govern; he wanted to run, and run, and run.
As his political star rose, Debs began courting Kate Metzel, a friend of his sister’s, who came from a community of politically radical German immigrants. The two married in June 1885. Their relationship rested on shared ideals, but her personality remains shadowy. Few private letters or diaries survive, although Gude suggests, fairly, that their life together did not unfold as either of them expected. They could not have children, and Kate spent much of her mature life at home in Terre Haute caring for her elderly mother and her motherless nephew. She was a rock for her husband as he roamed, but the cost to her own soul is lost to history. For Debs, home and family were “the sustaining element,” as he wrote his sister, giving him the strength to continue his work of lecturing, writing, and travel. But this rosy view ignored the widening rift between his two closest allies, Kate and his devoted younger brother, Theo, each of whom was growing increasingly jealous of the other’s influence over Debs.
Gude describes Debs’s conversion to socialism as a “transformation of the soul,” which he
declared
publicly on New Year’s Day 1897. He had shed the doubts and compromises of his previous organizing, given up the slow work of bargaining for scraps and winning by inches. His vision now was Manichaean: good versus evil, socialism versus capitalism, humanity versus the “reign of gold.” And it was a particularly American vision. As Gude describes it, Debs’s rhetoric fused nationalist and Christian mythology with Marxism, evoking the spirit of Christ and the fire of the abolitionists. It was a brew that appealed to crowds wherever he spoke. The era of political oratory made stars of the unlikeliest speakers, whose photographs or transcripts can barely convey what felt to audiences like an electrical current. Eugene Debs would spend the rest of his life spreading the gospel of this new political religion, and critics and followers alike would frequently compare him to Jesus Christ.
The socialist movement Debs joined contained many factions, and plenty of leaders more pragmatic than Debs, like the more intellectual Victor Berger, who built a solid socialist base in Milwaukee, and was unafraid of compromise for the sake of gaining political power. Nobody in the Socialist Party, however, could challenge Debs’s star power. His first of five runs for president came soon after his conversion, in 1900. On a tiny budget, the candidate had to do the work single-handed, riding the rails for months at a time to lecture to audiences large and small, curious, hostile, and indifferent. In 1908, he traveled from Chicago to the West Coast in a train
dubbed
the “Red Special,” decked out with flags and snowing the stops with leaflets. The itinerary was relentless. A typical September morning saw him leave Des Moines, Iowa, at 6 a.m. with a schedule of four stops, and four speeches (and at least six more impromptu stops), before the train chugged into Kansas City, Missouri, in the middle of the afternoon, ahead of a speech that evening. Debs was generally blunt about his purpose: to spread the socialist gospel, not to actually make it to the White House.
In those early years of the new century, the makeup of the country’s workforce changed dramatically, and horrors of industrial labor and living conditions—especially the employment of children—became a widespread concern. Middle-class Americans began to press for regulation and government intervention, for reform within the system. To Debs’s disgust, the bombastic Teddy Roosevelt attracted their attention and votes as a Progressive, despite his coziness with big business. His popularity showed that capitalism had left behind its most rampant phase and was now having to engage in public relations.
Yet the promise of reform did little to cool labor energies in the new century. Strikes became bigger and bolder, from the mines of Minnesota to the garment factories of New York City, and the militant rhetoric of the Industrial Workers of the World, or IWW, founded in 1905, spooked the plutocrats into fierce reprisals. For a brief moment there was an alliance, under the banner of socialism, between well-heeled, reform-minded Americans and fiery rebel workers—potently symbolized by the marriage of WASP millionaire J.G. Phelps Stokes to activist Rose Pastor, a Jewish immigrant cigar worker who became famous as the Lower East Side’s answer to Cinderella. It all pushed Debs and the socialists to the crest of a wave in 1912, the year they garnered almost a million votes for the presidency.
Debs was proud that “the Socialist Party was the first party to make the political discovery woman is a human being,” and he was a staunch supporter of women’s autonomy, from their right to vote to their freedom to access birth control. Yet he did not fully grasp the connection between capitalism and patriarchy drawn by activists like Rose Pastor Stokes, the IWW’s teenage star Elizabeth Gurley Flynn, and
flame-haired
Kansas speaker Kate Richards O’Hare, who appear here in brief cameos. It was one thing to fight for higher wages, and quite another for those wages to depend on granting a factory foreman access to your body. (According to Gude, among the abuses that sparked a 1909 walkout at the Pressed Steel car plant in Pennsylvania was a system in which workers had to offer up their wives and daughters as bribes to keep their jobs.) Socialist feminists went further, however, in showing how sexual coercion on the job reflected patriarchal dominance in society at large. Was Debs, with his habit of visiting brothels during his long stretches living away from home, and his emotional dependence on women who were not his wife, really capable of understanding what socialism meant to women? How far was he willing to share power with them—or anyone?
Early in his career, Debs moved cautiously on what was known as the “race question,” seeing it, as many Northerners did, as a Southern problem, and one that class solidarity would in time solve naturally. But the brutalities of Jim Crow disillusioned him, and by the time
The Birth of a Nation
was
enthralling
white audiences across the country in 1915, he was spitting blood. In a letter protesting the film’s racist distortions of history, he went so far as to call out the sexual violence inflicted on enslaved women, writing that, if truly told, Black history “would be replete with scenes infinitely more cruel and damning” than those in the film. His outrage was so rare that it was reprinted in a number of Black newspapers, and put him in contact with the rising new generation of “New Negro” activists in Harlem. Gude argues persuasively that this is where the energy and the optimism of socialism migrated after Debs’s death, smack in the middle of the rip-roaring capitalist ’20s—to Harlem, and then into the civil rights movement of the 1960s.
Debs understood capitalism as a scourge that reached beyond America’s borders. He railed against U.S. empire-building and warmongering abroad, whether in Cuba in 1898 or in Mexico in 1914, when President Wilson sent troops, as Debs
put it
, to die “fighting for Rockefeller and his class.” That was April. By late summer, what was then called the European War had engulfed the foreign policy agenda. Debs joined the chorus protesting “preparedness,” the military buildup that was the pet cause of his old adversary Teddy Roosevelt. But when Wilson, reelected as the peace candidate in 1916, swept the United States into the war the following spring, the repercussions for protesters and leftists were immediate, and crushing. The Espionage Act
criminalized dissent
, while vigilantes calling themselves the American Protective League hauled off suspected draft dodgers in unmarked vans. The battered IWW was broken, and the thriving socialist press abruptly silenced.
In June 1918, Debs gave a speech in Canton, Ohio, in defense of socialism. He denounced war in general as a tool of the oppressors, and urged the crowd to remember that they were human beings, with minds and souls to develop, not wage slaves or cannon fodder. Two weeks later, the 62-year-old was arrested and charged with violating the Espionage Act, and sentenced to 10 years in prison. In 1920, two years after the end of the war, he mounted his fifth and final presidential run from his Atlanta prison cell. After President Harding commuted his sentence the day before Christmas in 1921, Debs used his experience of incarceration to write about the horrors of the prison system, especially the way it robbed poor Black boys of their future. But his health was shot, and less than five years after his release, America’s leading socialist died at the age of 70.
Almost immediately, arguments over his legacy began. His ability to inspire listeners in every corner of the country, to connect and convince them that he cared about them and had a balm for their pain, was powerful, but fundamentally at odds with the movement’s democratic ethos. Debs himself worried that socialism could not grow by following a powerful leader, but at the same time he wasn’t willing to give up the spotlight. There was always another audience.
Gude grapples throughout his book with this contradiction in Debs, the grandiose visionary and the man who craved constant affirmation, and whose heavy drinking at times meant that he needed a junior party member to get him to the stage on time. After a failed run for Congress in 1916, he plunged into an emotional affair with a married woman several years his junior, with whom he exchanged passionate letters up until the end of his life. In his final years, he embraced alternative health therapies and wrote enthusiastically to his brother from one sanitarium of the powers of such wellness cures as cold plunges, touching grass, and avoiding processed foods. These human peculiarities of Debs resist a clear narrative, and apparently did nothing to undermine his followers’ faith. He didn’t connect with people by confessing his own failings, but clearly his flaws helped him toward his spirit of nonjudgmental humanism, which allowed him to meet his fellow human beings where and how they were.
For all his wide knowledge across the vast range of American working lives, Eugene Debs was a Midwesterner at heart, and his politics belonged to Terre Haute, a small town under a big sky, rather than socialism’s urban hotbeds, Chicago or New York City. Zohran Mamdani’s
election
as mayor of New York isn’t explained by Debs, although he quoted him in his inauguration speech (“I can see the dawn of a better day for humanity”). There’s perhaps a more pertinent line of inheritance from the “sewer socialists” of Milwaukee, who proudly got their name by installing a sewer system in the sanitation-deprived town, to Mamdani’s equally unglamorous, useful project of filling potholes across the city. Action, not oratory.
The international socialists who inspired Debs at the start of his conversion were wildly excited at the prospects for American labor. How far might a nation go that had no kings to depose, no entrenched hierarchies to uproot, a country so young and iconoclastic and resource-rich? It was a disillusion as brutal as the mines and the mills, to see how powerful the pushback would be. The promise of American socialism is still unfulfilled, but this is a country in which almost anything can be resisted, rethought, and reinvented. Even politics. Even capitalism. Perhaps the story of Eugene Debs, told as meticulously as this, shows us that reinvention will not come from a single leader, no matter how inspiring, but from the collective resistance, and joyful community, of ordinary people.
===
Joanna Scutts is the author of
Hotbed: Bohemian Greenwich Village and the Secret Club That Sparked Modern Feminism
and
The Extra Woman: How Marjorie Hillis Led a Generation of Women to Live Alone and Like It
Microsoft Patches More Than 1,400 Security Flaws
Krebs
krebsonsecurity.com
2026-10-13 19:24:53
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond....
Microsoft
today issued updates to fix more than 1,400 security vulnerabilities in its
Windows
operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.
Just one of the weaknesses patched this week is considered a “zero day,” or already exploited in the wild.
CVE-2026-96951
is a security feature bypass in the
Windows Shell
that affects Windows 10 and 11 systems, as well as some Server versions.
Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft
quietly extended that support
for another year (until October 2027).
At least 78 of the flaws fixed this month are rated “critical,” meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the vulnerable system.
While Microsoft said there are no signs anyone is exploiting it yet, a security feature bypass in the .NET Framework (
CVE-2026-108398
) was publicly disclosed prior to today, potentially giving attackers advance time to work out how to exploit the bug.
Satnam Narang
at
Tenable
said the number of flaws fixed this month far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs.
“We’ve now crossed the 4,000 CVE mark with two months left to go,” he said.
Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw. Meanwhile, security experts have been warning that these unusually large patch volleys from Microsoft are placing extra strain on corporate security teams, which often have to test individual updates before deploying them across a network to ensure the fixes don’t cause problems for other software.
Tyler Reguly
, associate director of security research and development at
Fortra
, notes that just 26 Microsoft vulnerabilities appeared in the “Known Exploited Vulnerabilities” (KEV) catalog maintained by the U.S. Cybersecurity & Infrastructure Security Agency (CISA) so far this year, and security teams would do well to prioritize patching those 26 vulnerabilities first.
“Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,” Reguly said.
Which vulnerabilities deserve the most scrutiny in your organization? The folks at
Cisco Talos
have
a useful roundup
of the more noteworthy flaws that Microsoft fixed today, and of course the
SANS Internet Storm Center
has
a reliable roundup
that indexes vulnerabilities by severity, CVE number and affected software.
(72,057,594,037,927,936), or approximately 72 quadrillion possible keys. A 56-bit key is expanded into 16 subkeys or round keys, each of which is 48-bits long. It has for over 20 years been considered obsolete and insecure, but continues to be used mainly to support legacy systems.
attempts instead of
attempts.
![[A,Z]](https://s0.wp.com/latex.php?latex=%5BA%2CZ%5D&bg=ffffff&fg=333333&s=0&c=20201002)
, that’s
or 676 combinations. By keeping the code inside the CPU cache longer, this helps improve performance.
:format(webp)/s3/static.nrc.nl/wp-content/uploads/2026/09/01163800/010926ECO_2036306912_AutisticiIventati.jpg)
:format(webp)/s3/static.nrc.nl/wp-content/uploads/2026/09/04095955/040926ECO_2036437878_BroncodeWEB.jpg)
:format(webp)/s3/static.nrc.nl/wp-content/uploads/2026/09/30080957/300926ECO_2037081821_datacenter.jpg)
Subscribe to comments on this entry
Comments (0) Trackbacks (0) Leave a comment Trackback