Planet Jamie

Decompiling Fast Food Tycoon 2

Lobsters

healeycodes.com

2026-10-25 02:40:39

Comments...

I spent the last few days decompiling my favorite computer game: Fast Food Tycoon 2. There's a very good chance that you have not heard of this oddball 2001 business simulator. But when I was a kid in 2004, I picked it out of a lineup of discounted games in a mall and it hasn't left my psyche ever since.

Berlin with memory annotations

To briefly describe the gameplay: you build a pizza empire in a living, isometric city, renting restaurants and warehouses, hiring staff, designing pizzas, and managing your supply chains. Customers then judge your food, service, and reputation. Rival companies compete with you through advertising, political influence, and organized crime.

For me, the game always felt ahead of its time, with a surprising amount of world fidelity.

To decompile it, I set up an agentic loop on my computer using GPT-6.1 Sol Medium. We used Ghidra to decompile fastfood2.exe 's 4,046 functions into about 9.5MB of C-like text (function addresses, field offsets, constants, and calls).

This raw code was loaded into SQLite and wrapped with a script to allow finding related functions without having to read through large amounts of text:

decomp_index.py grep    "0xe8\) = "  # find field writes
decomp_index.py callers 0x4ed360     # find callers
decomp_index.py string  "fnt"        # find font references

In Windows, there's an API to read process memory, ReadProcessMemory , which allowed the agent to inspect the running game and compare memory values with what appears on screen. For example, finding the memory address for cash, the camera position, or the selected building. And then the decompiled code was queried for the functions that changed those values.

To control the game, the Windows message handler was patched so that commands could be sent to run on the game's own UI thread. The agent could click buttons, move the camera, and advance the simulation without changing the executable on disk. An early breakthrough came from using a crawler to click through the game's interface and discover the rest of the unknown controls.

At this point, I steered the agent with my curiosity, and we went digging.

The Overworld

A city is a painting plus a few hundred sprites. Below, we see Berlin at 12:30.

Berlin at 12:30

Underneath this fully rendered scene, the map file ber.tga has streets and plots (and Brandenburg Gate's shadow) but no buildings or people or cars.

Berlin's background painting

To draw the overworld, FFT2's renderer draws the scene into a buffer in memory.

First, it works out which screen areas need repainting, like where a person moved, or if the camera position has changed. It restores the background in those areas, and then draws the scene over it. Each pixel holds a 16-bit colour value and a separate lighting byte.

dirty_areas = find_areas_that_changed()
draw_background(dirty_areas)
for draw_pass in scene_draw_passes:
    for cell in diagonal_map_order:
        draw_parts_for_this_pass(draw_pass, cell, dirty_areas)

The renderer does several passes to control which objects cover other objects. It visits map cells diagonally (or, I suppose, isometrically). To keep hidden people visible (their outline can be seen through walls), the renderer marks their shape with a temporary pixel value before drawing objects on top of them. Later passes draw a yellow outline around hidden body parts and a white outline around hidden thought icons, and then finally fill the visible parts.

Here's a complete redraw.

Finally, the renderer combines each pixel's color with its lighting value and writes to the final 16-bit display buffer. This conversion applies a repeating dither pattern to draw intermediate shades.

mark_shape_with_temporary_value()
draw_covering_objects()
outline_covered_parts(outline_colour)
fill_parts_where_temporary_value_remains()

I generated another cool graphic to show the efficiency of the renderer. Pixels that changed in the last 0.6sec are highlighted (cars, walkers, swaying tree tops, blinking signs). Most of the picture is not changed because the dirty-region system limits what needs repainting.

Pixels changed over 0.6 seconds

Lighting

Daylight follows a table of 25 hourly brightness values: 70 at night, rising sharply around dawn to 251 during the day, and then falling at dusk.

Lamps respond to this light level. Their glow thresholds vary slightly with their object IDs, so they switch on in small groups. Their light pools stay at least 160 so that patches of pavement are bright throughout the night.

light = interpolate_hourly_table(clock, brightness_setting)
for lamp in lamps:
    show_glow = light <= 160 + (lamp.id & 7)
    draw_lamp(lamp, glow=show_glow)
    draw_light_pool(lamp, light=max(light, 160))

The id & 7 gives eight possible threshold offsets (0-7). With FFT2's default brightness, standard lamps switch on around 18:25–18:30 and off around 05:35–05:40. Other object families use lower thresholds so their glows appear later as the city gets darker.

It all ends up supporting a really satisfying day-night-cycle feel.

Each pizzeria stage has its own light mask, stored in e.g. h_pizz_a1.m.spr . Each visible pixel in this mask holds a brightness value. The renderer compares that value with the light already at the same position and keeps whichever is higher. So while the rest of the building darkens, the windows and sign stay bright!

A separate file, h_pizz_a1.l.spr , provides the window colours used at night. The renderer draws those colours, then applies the light mask (as mentioned earlier, colour and light remain separate until the final step when the pixels are drawn on screen).

These light curve values may be altered by the brightness setting so it works out like:

light = base + (251 − base) * brightness

The Cast

Anything that moves is stored in an .ani file which is a sprite sheet and named animation sequences. Most of the internal text I came across was written in German (language of the developers).

Here's the frame-by-frame breakdown of an office worker eating in a restaurant.

As FFT2 is a pixel-based isometric game from 2001, every animation is pre-drawn.

The "walker update" logic compares the next node's position with the current one, and picks the direction animation from the two signs: (−,+) is 1, (0,+) is 2, (+,+) is 3, etc.

The named animation sequence also stores how far the sprite moves per frame. For example, the waitress's gehen4 moves (+1.25, 0) every frame, and gehen3 moves (+0.884, +0.442) , and so on. The tick adds this vector on every frame advancement so that feet and ground move in sync.

Maps have predefined pavement nodes (for walkers) and street nodes (for vehicles).

The errand boy is the fastest walker at 27px per second, compared with the tourist (16.2px/sec) and the celebrity (13.8px/sec).

Inside a Branch

The restaurant view uses the same render process as the overworld, drawing flat images into a buffer, storing color and light separately but indoor light stays at 248 regardless of the hour (while daylight outside reaches 251).

This view uses separate, larger artwork for the characters, and uses a special draw order to place people sitting on furniture. When the chair back faces the camera, the renderer draws the main chair image, then the character, and then the back of the chair (or the "front" of the chair from the camera's POV).

Chair, seated customer, then chair foreground

There's a special sprite for the pizza on the table. I will forgive the animators for making everyone have the same eating pattern.

Nine frames of the table pizza

I came across many quirks in my research and I'll list a few favorites.

People keep their daily habits. When citizens are created, they receive a schedule. These schedules don't reset each day, so an office worker assigned to a particular cinema for the afternoon keeps returning there. Likely contributing to the "real feel" of the city.

These schedules contain stereotypes:

Goths stay home until 09:00.
Students have a 40% pub allocation for midnight–03:00.
Big shots have a 70% opera allocation for 18:00–21:00.

The game calls itself "Pizza3". As seen in a city config file Init-File für Pizza3-Stadt .

And finally, I was able to solve a childhood mystery: how the heck is this game measuring and scoring my pizza-making ability? Let's review now that I've unlocked this knowledge.

The game divides the pizza into 24 regions to score how evenly spread the toppings are, looks for matching pieces on opposite sides, and checks which ingredients go together (and different customer groups get different ratings).

There's even a plagiarism check (!) based on ingredient weights. So rearranging a competitor's pizza (a strategy I've definitely tried before) doesn't fool it. A copied recipe is marked "not original" and misses out on +30 taste points for yuppies, goths and tourists, and +5 for big shots.

All this detail, and very little in-game guidance for it. As I recall, since I lost it during a house move, FFT2 shipped with a ~100 page manual. This was back when it was fine for games to be inherently challenging!

A cool note: the images and videos that I generated for this post used some of FFT2's decompiled fonts. Also, some content still has "PC2" visible because I actually call this game Pizza Connection 2 because that's the European name!

Interview With Michal Wallace

Lobsters

alexalejandre.com

2026-10-25 01:04:57

Comments...

Original Article

Michal Wallace (tangentstorm) loves pedagogy, producing many instructional videos , mostly for J and recently for Decker . For his dream programming course, he made a Forth-ish VM b4 and a REBOL-array-style implish . To assist with courses, he’s made tanco courseware around test-driven development and minavo , an “audio-video outliner” (a modern jprez.) Among many other things, he ran a webhost and worked as a professional K programmer, interviewed on the ArrayCast.

Pedagogy

What inspired your programming pedagogy (on youtube etc.?) Though a K programmer, on a previous interview you said you’re not only focused on them. This is quite unique as exotic language enthusiasts tend to evangelize their particular paradigm.

I have a long-term vision of making a programming course where I start with b4 (my forth-like VM) (or even more conceptual things like what a bit is and how to think about them)… Then building up from b4 assembly to a little Lisp and/or forth, a Pascal-like language, and then implish . With a lot of graphics and games along the way.

I made a lot of J videos because I think J is neat and because very few other people could make them (simply because the community is so small) while lots of people can and do make Python or Rust videos. The new Decker series is pretty much for the same reasons, plus the extra fact that I wanted to teach my daughter something. (She’s already taking classes in Scratch and will start Python after that.)

I wish I didn’t have to use any particular language in a video and could just talk about ideas. I tend to imagine I’m making a video about math or programming and just happen to use J or Lil or (eventually) one of the languages on B4 .

We have my daughter enrolled in various human-lead tutoring programs over the internet. (programming, math, punjabi, englcatish).. We did the scratch (and soon Python) classes because that’s what was on offer. I’m working one on one with her on Decker, but it’s slow going, because she can’t even type. (So one of the next videos will be a typing tutor I made.)

I started working with K at 1010data, but eventually it was bought by Symphony AI. We still use K every day, but most of what I do is in Python or javascript making little widgets to plug into our system or write demos for our API (which I maintain). We also have our own language with xml syntax.

JS has improved considerably. Before LLMs, I was often using a little library I made to abbreviate the routine JS routines in the DOM (browser APIs) (see example towards the bottom) although I don’t use this style at work.

The AI in “Symphony AI” predates LLMs. They were more focused on machine learning and data analytics before, but now I write tools for them in Python. Currently I’m working on an MCP server to expose the 1010 platform as a toolkit that the LLMs can use directly. He no longer works with 1010 data

How would you compare the different array languages you use? You worked with k, but mostly streamed j stuff. Do you find Lil lacks anything?

I miss forks and hooks when I use K, but I think overall I know most or all of K, because it’s very small. J has way more stuff, but I’ve constantly got the NuVoc (vocabulary website) open. (With K a 1-page printout covers it) I often find myself missing scan and insert in lil, but it winds up not being a big deal because explicit each loops are also very short. In Decker, I mostly miss talking to the outside world. (But the “danger zone” addresses that…) At the end of the day, I don’t really have strong preferences about implementation languages.

I don’t know why I don’t use K outside of work. Usually when I write code outside work, I’m either working on something that I want to eventually be a commercial product, or I’m thinking about how I could tell the story of the thing as a video. It stuck in my head that my channel was going to be a “J channel” and I should just stay on topic to build my brand and appease the youtube algorithm, but I guess I’m over that now.

When I make a video, I want to be able to say “and here’s how you can go try this for yourself.” Which is why I’ve never made a video about 1010’s system, even though it’s amazing. If there were a button where anyone could sign up for a free trial, I would have made those videos.

It’s only been relatively recently that there’s been any stable K systems that aren’t toys. (I livestreamed the video game I made in oK , but I never went back and edited or posted the videos).

I’m curious what you think of architecting big systems with these different programing paradigms.

Honestly, I think at a certain size they’re all pretty much the same. Even with 1010 or a cutting edge system like an LLM, there’s a few small parts that are really interesting and it really matters how you build it… And then the rest of it is all just connecting to other systems or generating HTML or moving files around. Important but you could probably write the same thing in COBOL or any language.

Different languages are good for different things, and in my ideal world (at least for personal programming / exploration / thinking with code), I’d have a bunch of small mini-languages that all shared the same runtime, so you could use whichever one you wanted. (This is lot like the racket philosophy, but in a much smaller, “fits in one person’s head” kind of approach.)

Forth

I find that big Forth programs are very hard to debug. I made a minesweeper in retroforth , and it has a bug in the floodfill routine that I’ve never been able to track down after numerous attempts over the years. Keeping things very small and using structured programming style helps a lot, but ideally I would bootstrap my way out of it.

I learned Forth by studying the ngaro virtual machine for retroforth 10. Retroforth is actually a mix of Forth and Joy (somewhat like Factor). Like Joy, it has a lot of quotations and combinators… And I found it much harder to learn that stuff than to understand the simple instruction set in the assembly language. On the other hand, there are a lot of things about the retroforth style that are much more modern than “standard” forth. (Like quotations…) The B4 assembler is very much inspired by my time with retroforth. To me a Forth is a system where you have 2 stacks and a dictionary of words, and the words are all about manipulating things on the stacks (especially the main stack). B4 has a bytecode , so in theory there are 256 operations, but the first 128 act as a 32-entry dictionary. You have 32 registers, each named with a single character, and each has 4 opcodes:

^A : call the routine whose address is in register A
@A : read register A onto the stack
!A : write top value on stack into register A
+A : add top value on stack to A, leaving old value of A in its place

Then there’s 32 opcodes that do arithmetic, stack manipulation (swap, dup), read and write arbitrary memory, jump, call/return… Very close to the same operations you find at the core of retroforth or John Earnest ’s Mako or the GreenArrays chip. The other opcodes are mostly pluggable so other people can extend the system (I tend to make a single op for each host-language library I want to install.. Like there’s a terminal op that exposes terminal IO, etc…) Anyway, in the assembler, you have these core opcodes and there’s a few built-in macros for structured programming. (Like <condition> .i <then part> .e <else part> .t <back to normal code> is an “if/else/then” macro).

I find that I’m able to write lots of cool things directly in the assembler… But usually when I write that way, I’m writing test-first and structuring it as a lesson plan / programming challenge . Here is pre (a parsing and regex system)’s test suite , which uses retro-style quotations (delimited with the .[ and .] macros) to define and use higher-order parser combinators directly in the assembly language. I built a very tiny Lisp with it. The goal is to blaze a trail for a student to later follow.

(The pre thing is a PEG system, like Rebol and Janet . I ported the concepts almost exactly from Alessandro Warth and Ian Piumatra’s OMeta paper .)

Each test suite is meant to be read and studied interactively, as a series of challenges to guide a student through building their own version of the thing, or at least understanding the existing version, via one of my other projects (named tanco with a prototype “course” at https://learntris.org/ ) All of that was to build up to the point that I don’t really care so much about Forth or even B4a as a language, but you have to start a beginner off somewhere, and B4 is meant to be a small and simple system that you can make yourself in a day or two (or just download one of the existing implementations) and then build your own toolkit.

Pascal

The plan I had was: establish the foundations with this tiny VM, then build a Pascal/oberon atop it (“retro Pascal”), using the Forth or Lisp (“b4th”/“b4s”) as scaffolding. And then eventually implish would be a high level blend of array languages and red /rebol/rye (which are nothing like racket but share that “make lots of dialects” philosophy)

REBOL! Rye ! (I had not heard of Red.)

I’m not great at any of these languages. I’ve used Red a bit. I like that they’re all homoiconic like Lisp, but the syntax is much more flexible. Rye is a red-inspired language made in Go that has good support for tables as a native data type. It’s run by one person and seems to be really well done. Fixes a lot of things I don’t like about red, like removing weird stateful side-effects.

Free Pascal with Lazarus is an amazing tool. I don’t understand why people sleep on it. And Wirth…

Pascal pretty much died with windows 3.1… Microsoft and Apple both had Pascal compilers, but Turbo Pascal blew them out of the water. When windows came, Turbo Pascal became Delphi, and (afaik) way more expensive. I just can’t justify paying for a language like that… And then Delphi got handed from company to company, while Microsoft focused on C++ and visual basic and I guess apple did their own thing. So I think Pascal in general just didn’t have any companies left standing to promote it. (Even Niklaus Wirth moved on to Modula and eventually Oberon.)

I started using free Pascal to revive my old Turbo Pascal code. I didn’t really have anything of value. It was just sentimental. Then eventually I started using Lazarus for some things here and there. I don’t do a lot of GUI programming outside of a web browser, but when I do, Lazarus is definitely in my toolbox.

https://www.projectoberon.net/ is a huge inspiration for my work. One reason I wanted to model retro Pascal after Oberon is that I wanted to “play nice” with his Compiler Construction text… I don’t 100% know what that means in practice. I also just like Oberon. I found the uppercase keywords physically painful to type but I really like the way Oberon code looks, even without syntax highlighting.

I love Oberon, Alan Kay’s STEPS, Plan9… For the next few years, I’m focused on a table first language (k inspired but table first) with Prolog or such on top in a few hundred lines, to build a kOS thing a la duskos

I really admire these small systems like dusk/ collapseOS as well, and in some sense I see B4 as my approach to that. I’m not concerned that civilization is going to collapse, but I do expect things to constantly change. 20 years from now, we might all be using Zig or Rust or Janet or your new table language, and I’ll be able to run my tools on top of that.

I think table-based languages are great. I have dreamed for years about making a “microsoft access for the web”, where you combine a RAD tool for building GUIs with a real database. 1010’s app building system isn’t drag-and drop like access, but our app-building system is similar in feel, in that you can wire together pre-built controls, and they all know how to talk to the database right out of the box.

John Earnest and I have a standing video call every couple weeks, and we often talk about Decker (I mostly contribute my abilities as a sounding board). A big part of the reason Decker is so constrained is to ensure it’s very hard to write software that rots. Like, (without the “danger zone” extension) your application can’t depend on external API or talk to JavaScript or even read an arbitrary file on your hard drive. I think the “danger” that the danger zone introduces is obsolescence. Elsewhere, I have code I no longer know how to compile, but so long as they get backed up somewhere, the decks I run today will be runnable by my great grandchildren. Unless of course I’m wrong and civilization DOES collapse… 😄

Webhosting

What was it like running a webhost?

Way back around 2000 or so, a friend and I were trying to start what we now call a SaaS. Basically our goal was to make something like what Shopify is today. We made a little shopping cart in PHP, and my friend brought in a few customers to subsidize development. But we knew nothing at all about running an online service, and so as a learning experiment, I rented a server from a data center, and emailed everyone I knew, asking if they’d like to host their website there.

Long story short, we never quite got the SaaS off the ground, but I ran the hosting company as a (mostly) one-person business for about 10 years. It paid my bills, but I never learned how to grow it, or turn it into a business that could survive without me. I treated it like a lifestyle business. In some sense, I was chained to my email, but I also had plenty of free time to follow my interests.

I spent a lot of time building things in Python with effort going into my control panel, billing system, admin scripts to manage the servers. This was long before there were successful web frameworks in Python, or companies like stripe that let you easily run credit cards, so I had to roll all that stuff myself.

I was one of the early bloggers, and so most of my customers were also bloggers. I even had a few months where I provided some bandwidth (which was expensive at the time) to blogger.com and they put a link to my hosting company right on the front page. I think that lasted up until google bought them.

When the 2008 financial crisis hit, I was still mostly just breaking even, and a decent percentage of my customers were in rough places financially, and decided they really didn’t need to spend money on their blogging hobby anymore. I started taking on more and more side work (even full time) to pay the bills, and that lead to my customer service getting pretty bad… and so more people left. It just kind of went into a downward spiral.

A big part of it was that I just wasn’t very focused. Several people had told me over the years that they thought I might have ADHD… And I thought (and still sort of think) that “ADHD” is a really ill-defined concept. There’s this book called the DSM that describes psychological conditions, and every time a new edition comes out, the rules about what ADHD are and how to diagnose it change. There’s no genetic test or anything. It’s like a checklist of behaviors. Anyway, my business going into a death spiral finally lead me to find a doctor that specialized in ADHD.

I still don’t necessarily believe in “ADHD” as a condition, but ADHD medication has absolutely changed my life. So much so that I feel like a very different person than the guy that ran that company. I still have one server that I use for myself, and I think there’s still a few sites hosted on it that probably haven’t changed in 15 years, but I don’t charge anyone money or deal with support anymore.

AI

How do you understand the importance of community? Do you expect e.g. more or less coding in array languages given the rise in LLM’s?

Henry Rich recently hosted a zoom meeting about using AI with J (I presented a bit about using the J-MCP server I made)… And one of the questions Henry asked was along the lines of… Why even do this? Why use J at all in the age of AI? I don’t know that I have an answer, but the question has been nagging at me.

I have this idea that there are two main problems in programming: Overchoice , and the Gestalt problem. Overchoice is a well-known concept in economics. It’s like how programming students get stressed out about what language to study. Or like even if it’s a much more narrow thing, like… We want to add a nice scrolling table to our database application. It’s going to run in the browser, so it has to be made with javascript… And then there are 50 choices and you have to pick one. At 1010 we once gave a junior developer the task of looking at a bunch of different viable scrolling table widgets and spending a week to integrate each one with our system… Just so we could pick one. Basically, small choices of technology turn into huge commitments, and then there’s a huge marketplace of available solutions, so we run into Overchoice just constantly.

But then it’s made much much worse by the harder problem… What I call the Gestalt Problem.

The Gestalt problem is just that to understand a system, you have to kind of load it into your head. Gestalt is a German word that means like the whole system, in the sense of the whole being greater than the sum of its parts. So you want to load an understanding of “the whole system” into your head, but your sensory channels are limited. You can really only hear one word at a time, in sequence. You can only see so many pixels in one image. Even if you have a huge 4k monitor with 5 source code files open at once, your eyes can only clearly focus on a small portion of the text at a time. So there’s just an inherent bottleneck in our anatomy that constrains how fast we can load things into our brain.

And with software systems, it’s worse than that, because they are interconnected graphs. They have this gestalt property. You can’t just open up the first source file in the directory, read it from top to bottom, and expect to understand the system. Decker’s source code is actually structured a bit like that. It’s multiple files but gets built into a single thing that you could in theory read from top to bottom, but even then, it’s just overwhelming.

So part of teaching a system is graph serialization… As a teacher who’s an expert in some system, you can try to make good choices about what parts of the graph to serialize first, so that the student starts building a model of the system with the most relevant parts first, rather than getting bogged down and frustrated with boring details that don’t matter.

(I screwed this up with the video I just posted . My daughter was bored to tears with the grid selector contraption. I spent all this time detailing a small thing that isn’t actually important for her understanding right now, because I want to use it in the next couple lessons. But I should have just introduced it as a new thing and moved onto those lessons.)

So! One thing that I really like about J is that you can compress a small amount of meaning into a few keypresses and get a big result on the screen. Once you have J (or K or whatever) you have a way to shrink the information that you have to send out of your brain through your hands (typing) and into your brain through your eyes. So these languages attack the constraint.

Tudor Girba helped me understand in a glamorous toolkit video “ UI as a language ” that GT has that same quality. It’s not necessarily Pharo/Smalltalk but the GT user interface itself. Instead of typing a few characters and getting a big result like in J, you can click a few buttons. This really stuck with me.

Decker and QuickApps (the 1010 system) have a mix of both. They both have these powerful array concepts on the coding side, plus this “RAD tool” like approach to the GUI where you can just stitch together a bunch of pre-made components and build something very quickly, sometimes without even needing code.

Where do LLMs fit into this?

LLMs do not experience the Gestalt problem!

I caused an LLM to write an MCP server for ngn/k . That codebase is written in the Arthur Whitney style. Code like that is probably a tiny tiny fraction of the LLM’s training set. Claude didn’t understand all of it. At one point I said: hey, stop trying to figure things out on your own. I’m a professional K developer. If you have questions, just ask. So it asked me some things, filled in its knowledge, and then within an hour we had working MCP tool for K. (And then later I went back and implemented K-IPC). I didn’t have to load the codebase into my head. It just worked.

AIs don’t solve the gestalt problem, because it’s still hard to load the understanding into your own head… But you can defer the problem indefinitely… Because why are you loading it into your head in the first place? Maybe it’s because you want to use the system. If you get hired as a Rust developer, you better learn everything you can about Rust. But maybe it’s because you’re dealing with overchoice… You’re trying to decide what tool to use, because you want to make sure it can do x, y, and z… And you just wished you knew enough about the system (or language or whatever) to have the confidence that you really could build the thing you want to eventually build after you’ve made the decision about the language or library or whatever.

Like. Maybe I’m just vaguely thinking about someday making a system in K. Which K? Maybe I think maybe this hypothetical K system might someday benefit from K-IPC. Like I don’t even know what the system is. It’s just the vaguest idea that I might build something someday.

This sounds dumb as I write it out, but it’s the fundamental feeling you get with overchoice:

If I spend my time learning K or Decker or J or anything, will I actually be able to do cool things with it, or will I have to constantly reinvent services that I get for free in other languages? Is it worth my time?

I don’t know what I need, but I see how useful K-IPC is at work, and so maybe when I’m looking at whether to adopt this K or that K (because there are many, and they’re not compatible), then maybe the presence or absence of K-IPC should factor into the decision of which one to focus on.

But ngn/k didn’t have K-ipc. oK doesn’t have it. Kona does have it, but maybe I observed kona crashed when I do this… Like if each of these tools came with an expert in that system, these issues wouldn’t matter, because the expert could just fix the crash or add the feature.

But I can’t do that without paying the Gestalt tax. So one option that’s exceedingly appealing to me or anyone in that situation is to make a new thing. And if I do that, and say I make it open source… Now I’m contributing to the overchoice problem and making it even worse for the next guy.

But the LLMs cut through all that. I added MCP and K-IPC to ngn/k in an evening each. When Eusebio announced Ksharp , I volunteered there and did the same thing. So the AIs aren’t experts in any of these systems, but because they have these massive context windows, they can just directly insert the entire gestalt (your source code) into their working memory, and so they instantly become - if not an expert - then at least knowledgeable enough to smooth things over for me.

I’ve always enjoyed using new languages and trying things out… In the far past, I’d read about a language (say Haskell) and play around a bit. I would do little throwaway projects like make a BDD library or implement learntris or B4vm in whatever language I wanted to play with. And then I’d go back to my main language, which was Python. (And then I’d get frustrated with Python for not having the neat features I saw in those other languages).

Then in the more recent past, I started just committing to doing a whole project in a language. So like… There’s a bunch of B4 implementations, but the Pascal one is the most fully fleshed out one with all the tools. (The intent being that eventually the tools run on b4 itself…) I have a bunch of implementations of BDDs. Bex started out as a BDD implementation in Rust just for fun, but I just kept at it and it’s the only one where I actually take it seriously and try to make it a real piece of software that people would actually use. The point is that these are all long term commitments, and you can only make so many of those .

How does this change how you pick a language for a project?

With LLMs, I feel like I can build a thing, and I never have to lock in to any particular choice, and I never have to worry if I’m making the wrong choice of platform, because I’m never locked in.

But you still eventually probably do want to commit to something, and you want to be able to transfer that understanding into your head. So at some point, after you’ve deferred as long as possible, you decide “yes, we’re on solid ground here, let’s really understand the system I’m building.” And that’s the point where you want a good language with that high compression rate.

Here is a file in bex . Bex represents boolean expressions as abstract syntax trees (ASTs), then converts them to canonical graphs like binary decision diagrams. Like a tiny thing like (A and B) becomes (if A then (if B then 1 else 0) else 0) … Only you draw it as a binary tree branching on A and then B . So here an AST with 2 nodes branched out into a tree with 5 nodes. But actually the two 0 nodes are shared, and even 0 and 1 point to the same node, with just a negation bit set on the edge. In most BDD systems, the 0 (or 1 ) node would be an actual object in memory and you’d have a pointer to it. But in bex, the pointer extends the idea of using a bit from the pointer as an inversion marker, and you can actually use 32 bits to store an entire truth table of 5 variables. (Plus a few more bits in the pointer can say which 5 variables). So actually in bex, for this example there’s no graph at all, just a single smart pointer that holds the entire truth table in its bits.

That’s the sort of thing it’s so easy to think about in J. And so all around the bex codebase, the Rust code has little comments with lines of J code. Because I use J as a language to talk ABOUT the system. I actually emailed Henry Rich about that Linear algebra textbook you mentioned in your ArrayCast … Because recently I watched Gilbert Strang’s Linear Algebra lessons from MIT… And the whole time I was using J to talk to AI to describe things I wanted to do. APL started out as a language and notation for humans to use to communicate with each other. And I think there’s an immense value in having these notations even for that purpose alone, regardless of whether or not anyone winds up writing software in it.

The followup about APL notation being a tool of thought /communication notation implies that there’s a community who practice this discipline and share the knowledge. It could be the case that you learn a style of communication with the machines… which you may generally only use one-on-one in your conversations with them, or when you use the repl.. but there’s still a community of practitioners. Like even I think Eric Iverson mentioned in his ArrayCast episode that the usual team size on a J project is 1 person… But there’s still room for a school around that discipline… The same way we have shared “schools” for martial arts.

The deaf community’s against cochlear implants because, if they solve deafness, no one would know sign language etc. and perpetuate their community. I used to think that was crazy. If e.g. J just becomes a way of talking to machines, how can there be a community around it? The recent spat of LLM-assisted array projects has been rubbing many array enthusiasts the wrong way. Many people don’t share code anymore, don’t make lessons.

I have a couple people around me who just absolutely hate the whole idea of AI and see it as clearly and obviously evil… And to me, it’s this life-changing, wonderful thing that is clearly, obviously, good. I mentioned John Earnest, who I consider one of my best friends, and he’s very anti-AI.

Mostly, I just don’t talk much about AI with him. For example, I did a game jam a few years ago ran into some bugs, most of which got fixed. In the end one blocked me from finishing the game, which still not been fixed in the oK repo. But it is fixed in my copy, because an AI fixed it for me. And because of where it came from, that fix is never going to be merged.

Similarly, I have AI making little changes to Decker all the time. Like, I’m making these videos, so I want it to talk to my video making software. So like right now, I can have my script outline on the left of the screen and Decker on the right, and when I move around in the text of the outline, it changes to different cards in Decker. And in my browser, my Decker has a little button to save the deck over WebDAV (an HTTP extension for writing files back to a server) so I can just say “file->save” and it saves the most recent copy of the deck. (Whereas in normal web Decker, this would download it through your browser to your local file system).

There’s a part of me that thinks it would be really cool to make a hosted Decker service, where anyone could sign in and host their decks. I basically already have that. But I used AI to write it, and like even if John said it was okay to make that, it would just feel wrong based on his beliefs.

Like, I would feel okay with writing the whole webDAV backend manually, and then manually making those file-save changes to Decker without looking at what the AI did… But on the other hand, I’m just not going to do that.

There’s a discord server related to little forth-like languages, and I was invited to start a B4vm channel on it. And then one day, a lady was in that server basically calling for physical violence against anyone using AI. I confronted her about this. I did my best to be civil and polite, but of course I was annoyed. At some point I pointed out to the moderator that calling for physical violence goes against their posted rules. Anyway, the conversation with that person didn’t escalate or anything, but shortly after, the server added a new rule about not using AI. So, I shut down the channel and moved it to my own server.

(I’m not sure but I think there was also a rye channel on that same server, which was later forcefully removed because he used some AI to generate docs… But I wasn’t there for it.)

And then… I have a friend that I’ve known since high school that I’ve collaborated with on a few just-for-fun game projects. He’s a 3d artist, and he’s also very anti-AI, at least when it comes to game assets. He was on the fence about using it for coding, though… I showed him that you could just tell Claude what you wanted to make and it would make a version of the idea right there in your browser, even just as a prototype to show a hired dev later. He ultimately decided he wasn’t going to do that

Anyway, tying this all back to community, my point is that it’s not just that some people don’t like AI and some do… It’s like… This is a thing that’s going to really test some relationships.

If you fundamentally believe that what your friend is doing is evil, not just misguided, but actually evil and harming the world, how long do you stay friends with that person?

On the other hand… Say, you’re bouncing ideas back and forth and you hatch an idea together, if one person wants to use AI and the other refuses, one of those people is going to get there a whole lot faster. I imagine the Anti-AI folks thinking “yeah, good luck maintaining all that slop garbage code… Obviously the software craftsperson is going to win here.” I just don’t think that’s how it plays out in reality.

Is the idea that you are currently adding to the choice problem, but eventually will circle back with stuff to improve the core gestalt?

Ideally whenever you’re facing uncertainty, you want to leave your options open and defer making a commitment until you have the most information.

Adding to the overchoice problem (by going the “not invented here” route and rolling your own thing) feels like a tragedy of the commons thing. Making a new better thing is probably good in the long run, but it does add a small amount of cost.

I used to spend much of my day in a “learnprogramming” IRC channel and the choice of which language to learn was a serious stumbling block for people.We’d always say it really doesn’t matter. If you have someone around you who uses X, learn X. If you want to do web stuff, learn JS. Otherwise just start with Python. You could argue all day about whether that was a good answer, but it’s just a waste of time. The perception these new students have is if you go down this path, then you’re going to be a “Python guy” for the rest of your life, and that’s just not the case. The skills transfer.

But when you’re asking whether to build the project you’re going to base a business around, there really is lock-in, because now you have customers and you have to support it. If you change everything later, they’ll complain… Or you’re going to spend all your money hiring people to rebuild it and your company nearly goes under and you get sold.

Overchoice was always made worse by the gestalt problem, and vice versa, because they multiply each other. More choices mean more things you have to load into your brain just so you can compare them.

Anyway, the high cost of learning a system is due to graph serialization issues. The authors of a system generally start with a simple idea you could probably easily understand, but then keep growing it. But because they saw it evolve from the start, it remained understandable at each step.

I think you could make a system that fits in a single person’s head, and then also make it much easier to transfer to others if you told it as a story. My idea is a bit like literate programming, but instead of just writing a document that mixes code and text to describe the program as it is, you write a document that describes how it started, and how it evolved at each step… And at any point, you can extract the complete working system. I call that “narrative” programming, because it has that time component.

If you look at any of my videos, that’s exactly what I’m doing. For example, on these Decker videos, if you follow along in the decks, then each time you press “next” it copies the current state of everything you (the student) have done on the card over to the next card. So if you go back and flip through your deck, you can revisit exactly how it was built, step by step. A version control system gives you some of that, but the tools in jprez/ minavo actually let you treat that whole narrative as a story.

And that’s the same reason the tests for B4 are designed to be read and worked through. That’s me leaving a trail for some future person to load that gestalt into their head.

Math

You use AI for math with Lean. What’s that like?

I am a college dropout, but I like to read math books and I really like formal proofs. I spent several weeks long ago attempting to formalize a proof of “Euler’s gem” (the polyhedron formula) in Isabelle . Eventually I gave up because it was taking way too much time, but I learned a lot. My first lean4 project was to write a prime number sieve. It took an hour or two to learn enough about lean to write the code, and then I spent the next six weeks defining what a prime number generator was.

I’m a huge fan of Practical Theory of Programming , Eric Hehner’s book/video course on formalizing programming. It takes a completely different approach than lean (which is all about type theory). It’s a much simpler, down to earth logic, and one of my goals for implish is to build it up from the basic logic he lays out in the book. The end goal is that you’ll be able to write formally verified programs in an APL-family language.

The AI+Lean stuff was more recent, and I’ve worked on two things:

First

There’s a site called Frontier Math that listed some problems that might be interesting to tackle with AI. I got interested in https://epoch.ai/frontiermath/open-problems/hadamard because it seemed at the time like the sort of thing a SAT solver could attack. The end goal is just to make a 668x668 array of signed bits (-1 or 1) that has certain properties. That’s a huge search space, but it turns out there’s a much smaller array of signed bits you can hunt for called a turyn-type sequence. That’s only (4*56)-1 bits (there’s one item missing in the bottom corner). Using Claude, I built a custom SAT solver in Rust, and between Claude, Codex, and Aristotle (another LLM that specializes in Lean) I formalized a handful of known results about Turyn sequences. Codex even came up with a new theorem about Turyn sequences that we eventually formalized. (It’s nothing earth shattering, but it wasn’t in the literature, and it should cut the search space down a little further. https://github.com/tangentstorm/turyn/blob/main/lean/Results.lean#L34 )

I didn’t find any new Turyn type sequences or Hadamard matrices, but I did formalize the entire chain of logic that explains how to go from one to the other.

The end result is still a huge search, but it’s the sort of thing that if someone spent enough money on compute, they could eventually find the thing. A large part of my effort was spent getting Claude to honestly calculate how long the complete, exhaustive search would take on given hardware. I don’t think I ever got a clear final answer (but think months or a small number of years, depending on how many machines you had running).

Second

Then I took on the “Jacobian Challenge”. This was something Kevin Buzzard posted on the Lean Zulip . He’s a math professor who has been one of the main people leading the charge for widescale formalization, especially in lean. This Jacobian challenge has nothing to do with the recent disproof of the “ Jacobian Conjecture ”, or about Jacobian Matrices, which is the main thing you’ll find on YouTube or google when you search for Jacobian, although all of these are named for the same mathematician. Rather, the “Jacobian” in question here has to do with topology. It’s basically an idea that Jacobi (and others) came up with in the 1800’s, and well-understood mathematics by those who study it. But the gap between what’s in Lean’s Mathlib and the statement of the Jacobian was pretty steep. Basically the task was to formalize everything in a small stack of math books.

I knew absolutely nothing about the topic, and tried for as long as I could to not learn anything about the topic, but rather just act as a project manager for the AIs. The scope of the problem was not clear to me at the start. Rather, we started with a Challenge file that Kevin hand-wrote. It’s got a handful of definitions, and around 20-something theorems, all filled in with the word “sorry” which is a lean word that means “just accept that this is true without proof”. And the goal is to make an equivalent file that has the same statements, but where every one of them is backed up with fully formalized proofs reaching all the way back to the axioms, preferably connecting up to things that already do exist in MathLib.

I went pretty hard on the Jacobian challenge. Kind of the reason for the challenge was that Kevin didn’t believe AI was capable of pulling the task off. And I wanted to show that not only was it capable, it didn’t need to be steered by an expert in the field. That’s why I tried my best not to learn anything.

I started with Aristotle, but by the end (this was a month or two) I had the max plans for Claude, Codex, and Gemini all working around the clock on this project. My approach was to just have the AIs pull the knowledge of what everything meant out of their own training, rather than trying to follow any particular textbook.

The bots and i basically wrote our own textbook (which of course I tried to avoid reading), in the form of a lean blueprint with “plain English” sections: https://tangentstorm.github.io/JacobianChallenge/blueprint/sect0001.html

Anyway, Claude Fable came out right at the end, and I got a massive boost in productivity. Then they shut Fable down , and I basically just stopped working, waiting for it to come back. Right around that same time, I found out another non-expert had used Fable to beat the challenge. He followed a textbook and also incorporated small parts of the other open-source attempts into the solution, including a tiny bit from mine, so at least I got to contribute to the “winning” entry in a small way.

A few months have passed, what’s up?

I got laid off at 1010. Since then, I’ve doubled down on minavo, adding video to the MVP and using it in a weekly livestream about AI tools.

I’ve finished an auto-formalization of the “Eulers Gem” stuff I mentioned in lean, including a proof of Pick’s Theorem and the number of platonic solids. I also auto-formalized the Practical Theory of Programming book that I mentioned, and added an interpreter for his language, as well as a compiler to the lean version of b4: https://aptop.tangentcode.com/ I’m now convinced that auto-formalization is solved, and am hoping to turn my attention to auto- informalization : making tools to help humans make sense of formalized proofs.

Auto-informalization is very interesting. People dislike vibecoding for various reason, my biggest objection’s that they don’t increase understanding.

Yes, I think that’s one of John’s main concerns as well. For me, there are certain things where I care how it works, and other things where I care how it’s done. Very simple example: an early draft of the Pick’s theorem proof proved it by some method other than Euler’s polyhedron formula. But the whole point of the “Euler’s Gem” book (and my repository) is that Pick’s theorem is a direct consequence of the formula. So I made it go back and redo the work.

For Minavo, I care that every part of the system works, but there are only a few parts where I care how it works. For example, it has a plugin architecture, and you can extend it by writing little languages. So there’s a set of plugins that turn it into an authoring environment for J videos (animating and syntax highlighting the J repl), another for decker videos (flipping to particular cards in a deck), and a whole other set for making the animated chess puzzle videos at pawn takes world .

My hope is that there are certain kinds of animations that a particular creator wants to make, it’ll be easy for them (or their AI agent) to add plugins for them. And so I care very much about how that extension system works internally.

FWIW, now that Minavo’s coming along, I want to get back to making programming videos, where I care very deeply about every character and keystroke, and getting the viewer to understand what they’re seeing is the entire point of the video. I expect to use AI pretty heavily for those projects, but I don’t know what it’s going to look like yet. I have no problem putting my name on a video where I had even massive amounts of help making it, so long as it’s exactly the video I wanted to make (or better).

On the other hand, I’ll probably also explore building some specialized AI-generated channels. For example, I think it would be cool if we had a little channel with a short explainer for each J primitive. I think I’d be happy creating a template, giving the machine control of the text and visuals, and just giving it feedback on whatever it generates.

Nim vs Rust: Language is a Matter of 'Coherence', Not 'Performance'

Lobsters

wintrover.github.io

2026-10-25 01:00:38

Comments...

Original Article

Five Qwen3.8-27B models match Fable 5 Using GVS5H Harness

Hacker News

github.com

2026-10-24 23:56:01

Comments...

Original Article

GVS5H: Gorilla vs. 5 Humans

Results

Opus 5 ran on an earlier version of the scaffold, in a single pass served through OpenRouter rather than five on a pinned backend.

Abstract. Frontier coding performance is typically bought with larger proprietary models at high cost. We introduce ledger-based zero-shot self-orchestration, a training-free method in which fresh instances of one model decompose problems and coordinate through a shared filesystem holding a plan, notes and current solution. Across eleven open and closed-weight models on the 100 latest hard LiveCodeBench problems, the method yields gains of up to 25.6 percentage points on pinned backends and offers two routes to frontier-level accuracy. Orchestrated Qwen3.8 Flash Next reaches 93.0% pass@1 against Fable 5's 90.4% at 9% of the cost, and locally served, open-weight Qwen3.8-27B rises from 66.8% to 92.4%. Gains are not universal: some models are unchanged or worse. Transcript analysis attributes the gain to decomposition and persistent context. Inference-time organization can approach frontier coding accuracy at a fraction of the cost, or slightly exceed it on self-hostable weights.

— the paper

Running the code

Needs uv and an API key for the model you want to test.

cd codebase/v2-current
export OPENAI_API_KEY=...

LCB_RELEASE=release_v6 \
ESCALATION_CLOUD_MAX_TOKENS=128000 \
ESCALATION_CLOUD_TIMEOUT=7200 \
MULTIAGENT_MODEL=openai:gpt-5.6-terra \
uv run --no-project --python 3.12 --with 'datasets<4' --with numpy --with anthropic \
  python escalation/run_bench.py --engine multiagent --only lcb --lcb 100 --parallel 8

--engine multiagent runs the manager; --engine single is the one-call baseline.
Other models: anthropic:<model> , dashscope:<model> , openrouter:<model> , each with its own *_API_KEY .
The pass@1 score prints at the end. Results are written to runs/results.json , workspaces to runs/ws/ .

License

Code is under the MIT License . The paper, figures and run data are under CC BY 4.0 . The LiveCodeBench fork, the benchmark problem statements and the LaTeX template files keep their own licenses. See NOTICE.md for which license covers which path.

Xbox Turns Down Netflix $500M Offer

Hacker News

www.darkhorizons.com

2026-10-24 23:05:53

Comments...

Original Article

more-halo-remakes-are-on-the-way — Halo Studios, Microsoft

Netflix reportedly offered Microsoft $500 million for a seven year deal that would allow the streaming giant to adapt shows and films about Xbox characters.

Puck broke the news, indicating that Microsoft responded with an offer for $800 million – as a result, the deal has reportedly fallen through.

In a statement to Puck, Xbox said, “We have received record-breaking interest in our I.P.; Netflix is a valued partner and we are excited for the forthcoming release of our Minecraft and Diablo animated series together, among other adaptations.”

Microsoft is now said to be in pursit of “smaller deals with more partners,” doing things on a case-by-case basis rather than an overarching exclusivity deal.

Microsoft previously partnered with Paramount to produce the live-action “Halo” series, which ran for two seasons. They currently have a “Call of Duty” film in the works at Paramount, a third season of “Fallout” at Amazon and a sequel to “A Minecraft Movie” opening next year.

Titles like “Gears of War,” “The Elder Scrolls” and “Sea of Thieves” are also being pitched for possible adaptations.

Netflix has various works based on games coming out, including the animated “Cyberpunk: Edgerunners” which returned this week.

Meta employees say Lula’s accounts restricted in Brazil election: Report

Hacker News

www.aljazeera.com

2026-10-24 22:18:35

Comments...

Original Article

The messages, reported by a Brazilian daily, say the platform recommended Bolsonaro’s profile and his WhatsApp channel.

Employees at Meta have acknowledged in internal communications that the Instagram accounts of Brazilian President Luiz Inacio Lula da Silva were negatively affected by restrictions during the country’s election, media reports say.

The messages, reported on Friday by Brazilian daily Folha de S Paulo, also acknowledged the platform recommended the profile of Lula challenger Senator Flavio Bolsonaro, as well as his WhatsApp channel. Folha, the Sao Paulo-based paper, cited messages it had reviewed.

Cerebras Deploys Trillion-Parameter AI Models

Hacker News

www.cerebras.ai

2026-10-24 21:33:49

Comments...

Original Article

One of the most frequently asked questions we get is how we deploy large models on Cerebras wafer-scale chips. A single Cerebras WSE-3T wafer has 44 GB of on-chip memory, and trillion-parameter frontier models need terabytes for their weights alone.

In this post, we’ll explain how we split a large frontier model across multiple WSE-3T wafers, to run multi-trillion parameter models at 1000-2000+ tokens per second.

We’ll use the open source model Kimi K3, with ~3 trillion parameters, as an illustrative example.

By the end, you'll understand:

How we fit the full model into on-chip memory
How we map the model across multiple chips
How we handle a high # of concurrent requests

Breaking it down with Kimi K3

Kimi K3 is an open source, 3T parameter model with 69 linear-attention layers and 24 dense layers.

For this illustrative example, we use:

A 256k assumed average request size
4-bit weight quantization (like the Hugging Face implementation )
An 8-bit KV cache

#1: Size of Each layer

To calculate the total number of Cerebras WSE-3T wafers we need to support Kimi K3, let’s first calculate the size of each model layer.

Kimi K3 has 3 trillion parameters. If all 3T parameters are stored at 4 bits each, the raw parameter payload is:

Dividing that payload by 93 layers then gives:

#2: Number of Wafers

Now that we know each layer needs about 16 GB, we can figure out how many layers fit on each 44 GB wafer. The answer depends on the layer type:

Dense layers need additional room for a KV cache, because each dense (full-attention) layer stores the keys and values for every token in every active request. So, we place one dense layer per wafer and leave the remaining SRAM for its KV cache.
Linear-attention layers do not require additional room for a KV cache. Instead of storing keys and values for every token, a linear-attention layer keeps a small, fixed-size state per request, regardless of context length. That leaves room for two linear layers per wafer (2 × 16 GB = 32 GB).

Therefore, with Kimi K3’s 69 linear layers and 24 dense layers , we get:

This gives us a total wafer count of 35 + 24 = 59 wafers.

#3: Connecting the wafers together

Cerebras executes models in a pipeline. After the Cerebras compiler maps the model layers across regions of wafers, the runtime maps the path for tokens to flow between wafers. For ultrafast latency, only activations need to be passed between the wafers, and this can be done via RDMA over Ethernet. This is roughly 2 microseconds per hop.

It’s important to emphasize that because each Cerebras wafer has 44 GB of on-chip SRAM and each layer is only 16 GB, we are typically able to fit entire layers of the model directly on the chip.

This means that in most cases, the model weights never have to move, and layers don’t need to be split across wafers. Only activations cross from one wafer to the next.

#4: How we serve 1 request

Now that we have our wafers connected together and the model laid out, we can think of each wafer as one stage in an assembly line: the model’s weights for each stage stay in place, and the request’s intermediate results move through the layer stages.

For example, Wafer 1 runs model layers 1–2 and sends its activations to wafer 2. Wafer 2 runs layers 3–4 and passes its results to Wafer 3, and so on until the last wafer produces the next token.

#5: How we serve many requests

This raises a common misconception. If a token has to travel through each wafer in order, doesn’t each wafer sit idle while it waits for its turn? In effect, wouldn't the system be running at a batch size of one?

No! If we only sent one request down the line at a time and waited for it to complete before starting the next request, this would be an inefficient use of the pipeline. Instead, we keep the entire pipeline full with different requests. Because the model is split into pipeline stages already, each stage can work on a different request at the same time.

While stage 3 processes a token for request A, stage 2 processes one for request B, and stage 1 one for request C. In our example, each stage is a layer. In production, Cerebras uses much finer-grained stages, and many more of them.

Each stage can also process a micro-batch , a small group of requests, rather than a single request. So the number of requests in flight is roughly the number of stages times the micro-batch size.

To understand the tradeoff, smaller micro-batches make each request even faster, while larger micro-batches increase total throughput.

#6: How many requests can we serve?

The amount of on-chip memory allocated to KV cache determines the maximum number of concurrent requests. Every request in flight needs its own KV cache on each dense-layer wafer, so the size of on-chip memory sets the ceiling on concurrent requests. As explained above, we only need to calculate KV cache requirements for dense layers.

For each 44 GB wafer that already has one dense layer, we can calculate the remaining space for the KV cache with:

Total wafer storage - size of one dense layer. In this case:

Calculating the # of Concurrent Requests

To find the number of concurrent requests supported for any particular model mapping, we first calculate how much cache a single 256k request takes up:

To then calculate the total number of concurrent requests this configuration would support, we divide:

The total number of concurrent requests represents the number of simultaneous requests moving through the pipeline at any point in time. Unlike a GPU batch, those requests don’t wait for one another to finish, they stream through the pipeline continuously.

Of course, neither concurrency nor batch size tells you exactly how efficiently an inference system performs. When evaluating the throughput of an inference system, the more meaningful metric is total token throughput per unit of power (e.g. tokens per second per megawatt), when measured at the same output generation speed.

How this scales beyond 3T parameters

The same approach extends to larger models: calculate the memory needed for weights and request state, distribute the model across wafers, and connect them into a pipeline. Each additional wafer contributes compute and on-chip memory, allowing us to accommodate models that exceed the capacity of any single chip.

Thanks for learning with us! Interested in deploying a model on Cerebras or building with our inference cloud?

Get started with our free API: cloud.cerebras.ai
Reach out to our sales team: sales@cerebras.ai

Designs by Halley Chang. Thanks to Atharva Talpade, Zhenwei Gao, Angela Yeung, Jessica Liu, Joyce Er, Emma Call, and Rohan Gupta for their review and feedback.

MacOS Extensions pack for the Apple Network Server v1.0

Lobsters

oldvcr.blogspot.com

2026-10-24 21:22:45

Comments...

Original Article

By now regular readers of this blog are quite familiar with my affection for the 1996 Apple Network Server , Apple's Unix-through-and-through $10,000+ server that only shipped with, and only officially ran, Harpoon, its unique superset of IBM AIX. An ANS 500, the lower tier of this dorm fridge-sized computer, was the first server I ever personally owned, a nearly-new hand-me-down after Steve Jobs convinced Gil Amelio to cancel the machine and the bookstore's vendor at the University I worked for wouldn't support it anymore. There are several fascinating features present in Harpoon that were never implemented in any other Apple product. Currently I have three, that original ANS 500, this ANS 700 here which I use for testing, and a battery-bombed EVT prototype (a so-called "Shiner ESB" that used to be at Netscape ).

The ANS was strongly based on the Power Macintosh 9500 and Apple was known to have demonstrated the ANS with Mac OS during development, but this confused potential buyers, causing the ability to boot Mac OS to be stripped from production systems. While then-CTO Ellen Hancock claimed in 1997 a ROM swap would enable the ANS to boot Mac OS again and Windows NT, these ROMs were believed to be vapourware until a former Apple employee presented a working dump of both the preproduction ROM and the later ANS Mac OS ROM . A prototype Windows NT ROM also emerged from another former employee, though there are pieces missing and booting Windows NT natively on the ANS is still a work in progress (hopefully to be the subject of a future article ).

It turned out I had one of the preproduction ROMs myself and didn't realize what it was. Because the later Mac OS ROM was apparently unfinished, it doesn't properly support the L2 cache and consequently runs substantially slower, and it can't boot AIX. The preproduction ROM does boot both operating systems and does support the cache. On the other hand, it doesn't support the on-board video or the front Fast Wide SCSI-2 controller, the on-board MACE Ethernet doesn't work, and after MacOS first boots, the next restart without zapping the PRAM will come up with a black screen.

The good news is, many of the issues with the preproduction ROM in Mac OS can be fixed or worked around in software. So I've fixed or worked around many of them in software: the MACE Ethernet is fixed, the on-board video is now supported, and the ANS can restart properly back into Mac OS. Plus, because it's the preproduction ROM, you can still boot AIX, thus preserving the entire historical reason for Shiner's existence. Here's the first cut of that software and how it was developed.

Naturally, the first order of business is to get an Apple Network Server and the 1.1.20.1 preproduction ROM (the production ROM is version 1.1.22). I can't help you with the first part, but replica ROMs now exist to cover the second part, and as of this writing Joe's Computer Museum has a few in stock (not affiliated, just a satisfied occasional customer). I tested the original design of these ROM DIMMs, kindly provided by Jeff Walther. Jeff assembled and donated this particular batch to Joe Strosnider, who is selling them and donating the proceeds in turn to the maintenance of the Tinker Different forum, where this whole thing started .

Now that you have the basic hardware, you'll then need to install Mac OS to an external bootable SCSI volume. For this project I use a 25-pin BlueSCSI which connects directly to the ANS' rear SCSI port and runs on termination power. Set up a blank disk image of the desired size to the device's (micro)SD card and rename it to the desired SCSI ID, which for the ANS is typically SCSI ID 2.

If you have another Mac with a SCSI port handy, it's easiest to do the MacOS installation to the external volume with that system. Make sure it installs Mac OS for any supported Mac, especially if you are using a model-specific installer CD; up to Mac OS 9.1 inclusive will boot directly on the ANS, and 9.1 is what I'm using here. 7.6 will work and late versions of System 7.5 might work, but I recommend at least 8.1 or later. If you only have the ANS and/or have no other suitable vintage Mac that can perform the installation, you can do it on the ANS itself with a bit more difficulty. For that you'll need to not only create the blank disk image but additionally include an ISO of a bootable MacOS CD (use ID 0), plus install a Power Mac-compatible PCI video card — I use a Twin Turbo 128MA but any ATI Mac-specific card of the era should also work, such as the Rage Orion.

Finally, unplug the server, unlock and pull open the mainboard drawer, remove the PRAM battery, install the preproduction ROM DIMM, and leave the drawer open and the system completely depowered for at least several minutes while you enjoy the droll prose of this blog post.

Here's the back of my testing ANS 700. The monitor is connected to the 700's video port, the BlueSCSI is plugged into the SCSI connector, and a Farallon standard AAUI-to-twisted pair dongle is attached to the on-board MACE Ethernet AAUI port (Apple's perverse little rework of AUI to avoid confusion with the Mac DA-15 video port).

Technically that should be all you need to run Mac OS or AIX. However, I also have the Twin Turbo video card in slot 1 (where it would usually be in a 9500, the closest hardware relative to the ANS), and as an alternative for the MACE Ethernet I have one of the unobtainium 10Mbit ANS Ethernet PCI cards in slot 6 that I ordered from Apple Austin when they were blowing out leftover Shiner hardware. This card works in AIX and later versions of Mac OS (not 7.6, possibly 8, definitely 9); my only 100Mbit ANS Ethernet card is in the 500. A regular Power Mac-compatible Ethernet PCI card will suffice if all you want to do is run Mac OS.

Let's talk about drivers and PCI devices on Power Macs.

Denizens of the classic Mac OS are painfully familiar with

INIT

s and

CDEV

s, which is to say, the extensions and control panels which extend the operating system (and in many cases constitute substantial parts of it). Adding device support to the operating system required a

DRVR

resource, which could be stored in the declaration ROM of a NuBus card and available at power-on, or in an

INIT

or

CDEV

and made available during the boot process, or in a regular application and loaded on demand. (Parenthetically, desk accessories were also implemented as

DRVRs

.) Even after the 1994 transition to PowerPC, some, if not all, of such code still had to be 68K for backwards compatibility, and thus required emulation on a Power Macintosh.

Since this requirement was an obvious performance bottleneck, Apple attempted to address it in Copland, Apple's fallback attempt to modernise the Mac OS stepwise amid the slow-motion death marches of Taligent and PowerOpen-A/UX 4. Copland's tale of woe is a much longer story, to be the topic of a future article , but the part relevant to this piece was the new driver architecture it introduced. This aspect was part of how Copland's design partitioned its components ih memory to avoid the attendant pitfalls inherent in the classic Mac OS. In order to wall the old Mac OS world off but retain compatibility, everything that was 68K code lived in the so-called "cooperative" address space and was treated as data to be interpreted by the Power Mac 68K emulator, including 68K portions of the Toolbox. Even PowerPC-native System 7 applications ran here, since significant portions of the Toolbox were still 68K. This cooperative address space would theoretically allow most applications to run as they did before, but intentionally without privileges to the rest of the system nor access to Copland's hardware abstraction layer (HAL).

As such, Copland drivers necessarily were fully native code, in this case implemented as regular PowerPC code fragments. These drivers hooked into the HAL and the Name Registry, an object database that tracked devices on the system and mediated loading and unloading device drivers as needed, and were collapsed into a separate global region at a lower execution level where only limited operating system functionality was available. Although such limitations restricted their ability to integrate with the operating system, it also enabled those drivers to run early in the boot process and remain protected from user code. This new class of driver was called a native driver .

Although Copland suffered from terminal second-system effect just as badly as its contemporaries, it was modular enough for parts of it to be used as transitional enhancements — such as its visual language, which later became the basis of Mac OS 8's Platinum theme, and other pieces that shipped more quietly. Germane to our discussion here was Apple's transition from NuBus to PCI, one not uniformly well-received by users, though in fairness it was effectively forced on Apple when IBM wouldn't support NuBus in the PowerOpen-based AIX 4. For these first PCI Power Macs, starting with the 9500 in 1995, Apple added a port of the Copland Name Registry to their ROMs as well as Eric Traut's faster dynamic recompiling 68K emulator, also intended for Copland.

In this scheme the system ROM initializes the hardware and hands control to its onboard copy of Open Firmware, which creates the device tree for all devices on the system, necessarily including PCI cards but also processor and logic board resources. The Code Fragment Manager, also in the Power Mac ROM, then runs code from any PCI card expansion ROMs and drivers in the Mac ROM itself. This code typically contains a low-level "expert" that creates a node in the Name Registry with sufficient information to identify the device and enable a driver to match against it.

Once the Name Registry is built out, the Mac ROM starts the Display Manager, SCSI Manager and/or ATA Manager, as needed, as part of booting the Mac OS kernel. These Managers in PCI Power Macs implement a different type of "expert" called a family expert . When the MacOS File Manager and Resource Manager are up, the Extensions folder is scanned for native drivers (stored as code fragments with a Type of ndrv , but otherwise the same general structure as their Copland antecessors) and handed to the expert of each particular service category for device classes the family expert supervises. Eligible and matching ndrv s, be they in ROM or on disk, are loaded before any other extension is ever invoked, and the family expert activates and wires them into the operating system.

Apple produced a driver development kit for PCI card vendors that included various debugging tools. This is the Display Name Registry browser from the PCI DDK 3.0, which I got off one of my Apple Developer CDs (there are other tools that do this like @joevt's , whose assistance with certain parts of this project is gratefully acknowledged), showing defined nodes on the ANS 700 booted into Mac OS 9.1 using the 1.1.20.1 pre-production ROM.

The most important thing to notice here is that even though the Name Registry was first added to PCI Power Macs, there are many more nodes here than merely PCI cards, as there would have been in Copland. Both our PCI cards indeed do appear, connected to one of the Bandit PCI controllers (the ANS has two but mapped differently than the 9500, and there is reserved address space for up to four). However, so do things like the CPU, L2 cache, Mac ROM, and devices attached to Grand Central, which acts as a bridge between PCI and traditional Mac devices like the AWACS sound chip (Crystal CS4217 codec), Grand Central's internal SWIM III floppy controller, and the AMD AM79C950KC "Super Combo" CURIO, containing the equivalent of an NCR 53C96 SCSI controller (for the external port), an AMD 85C30 serial chip and an AMD 79C940 Media Access Controller (MACE) for the on-board Ethernet. There are also various nodes that don't correspond to any physical device, such as the ROM software components making up the AIX booter and XCOFF executable loader.

The Display Name Registry browser is interactive and you can drill down into the tree to show a node's properties. I've chosen these two on purpose because they're unique to the Apple Network Server: one of the two NCR 53C825 Fast'n'Wide SCSI-2 controllers, and the Cirrus Logic 54M30 video chip, better known to PC users as the STB Horizon+. These devices are both internally connected via PCI to the first Bandit. Drivers can match on their mandatory

name

property, which is its primary identifier (

53c825

and

54m30

respectively), or the optional

compatible

property generated from the vendor and device IDs.

This first version has three components: two for the Extensions folder, the ANS MACE Fixer, an

INIT

which patches the Ethernet configuration, and the ANS Video Enabler, an

ndrv

which allows the 54M30 internal video to be used in 8-bit mode; and for the Startup Items folder, the ANS Startup Fixer, a regular application which rewrites NVRAM to remove inappropriate settings placed there on every boot by the operating system.

The initial piece I put together was the video driver, which is in fact ripped directly out of the 2.0 ANS Mac OS ROM.

Hex Fiend has a rich and extensible Tcl-based template system, including the ability to parse many classic Apple binary formats like resource forks and PEF. Eric Harmon's ROM Fiend extension builds on this by allowing you to parse components of classic Mac ROMs, here a dumped ANS Mac OS ROM provided by our former Apple employee. ROM Fiend splits the ROM into the declaration component and the system ROM ...

... and then allows you to walk the resources within it. This is the video driver embedded in that ROM. Notice the name of the resource is

53m30

, which was almost certainly an error.

The actual driver itself is the data portion. The magic sequence

Joy!peffpwpc

heralds a Preferred Executable Format binary (specifically these three FourCCs indicate an Apple-specific container, that the container is a PEF, and that the architecture is PowerPC) with code fragments. We clip out starting from there ...

... to the end of the data portion and the beginning of the next resource, and emit that section to disk as a separate binary.

All such drivers have a description block, usually heralded by the FourCC

mtej

(this code seems like it was based on someone's name — spill the beans in the comments if you know). The exact binary format is obscured a bit here by PEF's trivial packing method, used to reduce its footprint in ROM, but note the node name stored as a Pascal string (i.e., length byte first), and then the driver name, also stored as a Pascal string and invariably starting with a dot.

Immediately before the driver name length byte is an $06. The two bits set in this byte indicate that the driver is opened as soon as it is loaded ( kDriverIsOpenedUponLoad , $02), and that the family expert is responsible for doing so ( kDriverIsUnderExpertControl , $04). The PCI DDK documentation states that all video drivers should set these two bits, and only these two. The family expert handling graphics drivers is hinted by the FourCCs in the next line, ndrv for a general native driver service category, and vido for the type, in this case a graphics card.

You might well ask how the production ANS works at all without such an ndrv , and the answer is that Open Firmware doesn't need this driver to display anything on the screen — that's all specifically handled by the code in the ANS ROM, and Harpoon AIX has its own drivers. The ANS was never officially supported with Mac OS, so a proper Mac OS driver was never needed.

To make this extension eligible for loading, we need to fix the file's type code, which must be

ndrv

( not

INIT

), and add a skeletal

cfrg

resource to tag the single code fragment. The other resources are not strictly speaking essential, but are desirable to give it an icon suite, a version string, and for

CCI™

, a plain-text description in the Extensions Manager. I created the icons from the ANS template in Hubert Chan's M.A.C. icon pack , which are far better artistic depictions than anything I could ever draw myself in ResEdit.

Although you'll never see a Happy Mac on the internal video when loading this driver from disk, you will see the screen turn on before the usual march of

INIT

s, because

ndrv

s load early. (They are also unaffected by holding down SHIFT to load with extensions off, since disabling them could cause the machine to be unusable. Remember that for one of my failures later.) Since we now have two valid displays in this ANS, here is an entire screen grab of both sides simultaneously (the grey boxes is where the identify digits were). Unfortunately the 2.0 ROM driver has the same issue as the AIX driver insofar as none of the chip's 2-D acceleration features are implemented, and the driver only supports 8-bit colour depth even though the chip is capable of much more. This is because the 54M30 provides only a little-endian view into the framebuffer — Apple never wrote anything to byteswap. A project for another day.

Still, the driver otherwise works fine, and we can see that it loaded as a native video driver in TattleTech.

The next thing I started working on was fixing reboots in Mac OS, since every time I shut down the machine I had to reset PRAM or make other changes. This wasn't too hard because I never keep the PRAM battery in it anyway (it's a test machine), but it did mean I had to frequently redo various settings between test runs.

In our previous article in January , we learned this was because Mac OS monkeys with the ANS' NVRAM settings as if it were a real Power Mac 9500, installing an inappropriate nvramrc OpenFirmware startup script that interferes with normal operation, and then sets the input and output devices to serial port ttya , which on the back is serial port 2 (yes, two). On Open Firmware 1.0.5 systems like most beige PCI Power Macs, this does nothing more than keep Open Firmware itself on the serial port; the video and ADB keyboard remain the console. On the ANS' 1.1.x firmware, however, it actually obeys these settings so that you can install and run Harpoon AIX over a serial port, and this was also apparently how Shiner NetWare ran . In this configuration the machine comes up with no video at all, though interestingly ADB devices are still useable in Mac OS, including the keyboard.

The Startup Disk control panel is at least part of this problem. In the

CDEV

are three resources,

OFpt

,

OFtb

and

OFtc

. The latter two define mappings between the Open Firmware platform identifier and the respective NVRAM settings in

OFpt

, which is stored as a single long null-terminated string with embedded Mac $0d carriage returns. (The unreleased PowerExpress turns up in this table as the Power Macintosh 9700.) When loaded, the

CDEV

overwrites the NVRAM settings with the one selected by platform.

Theoretically it should be possible to binary-patch in another mapping and then add a specific script for the ANS, which with this ROM would have a platform string of AAPL,ShinerESB . I determined this approach was unacceptable for two reasons: first, it required modifying standard OS components instead of adding to them, and second, it doesn't solve the ttya problem even if we alter the mapping so that no machines match. In fact, the very string ttya appears nowhere in Startup Disk, suggesting the input and output device settings are being munged someplace else.

In the prior article we solved this issue using Boot Variables , a utility originally written by Paul Mackerras ( now at IBM ) which allows you to directly manipulate Open Firmware variables and save them. Because the changes to NVRAM occur before the boot process reaches the Finder, once we get to the Finder we can then fix everything and remain confident it will stay unmolested until the next boot. This process works but obviously requires manual intervention, so since Boot Variables is open source under the GNU Public License, I decided I'd just hack in a hard-coded version which automatically undoes the munge when run.

I converted it to build under CodeWarrior Pro 7 which is my preferred environment for classic Mac work, and rigged it so that it would display a quick window to show you it was working, do its work, and then terminate back to the Finder. When placed in the Startup Items folder, it will do this job every boot automatically, or can be run on demand. If the input device and output device are both

ttya

, it resets them back to the default

kbd

(ADB keyboard) and

screen

(onboard 54M30 video), and installs an

nvramrc

of its own. The critical code looks like this, using a library function I transplated to do the NVRAM patching in place:

patchstr(21, "kbd");
patchstr(22, "screen");
nvvals[7].word_val = 1; // belt and suspenders approach
patchstr(25,
    "0 to my-self\015"
    "dev /bandit/gc/mace\015"
    "1 encode-int \" PLSCCPort\" property\015"
    "device-end\015"
    "?cr \" Pre-production patches on.\" type\015"
);

The numbers are fixed indexes into NVRAM since this is just a hack, but in order are input-device , output-device , use-nvramrc? and nvramrc itself. This simple nvramrc patches up the Ethernet to work correctly with the Mac OS Apple Enet INIT . Prior Macintoshes with Ethernet, including first generation NuBus Power Macs like the Workgroup Server 9150 , had a single Ethernet AAUI port, but AAUI was expensive and unpopular and as the industry moved to twisted-pair Apple offered both an 8P8C ("RJ-45") and AAUI port starting with the 9500 — but still using just the single MACE, so only one port was active at a time. For as yet unexplained reasons, the ANS went back to a single AAUI port with no 8P8C/"RJ-45" despite being an evolution of the same platform base.

This means the MACE is connected directly to the (A)AUI port in the ANS, whereas in machines like the 7300, 7500, 8600, 9500, etc., it switches between the AAUI (equivalent to AUI) or an internal MAU to provide the link over twisted-pair. The MACE embedded in CURIO has a register called PLSCC, or the Physical Layer Signaling Configuration Control, which determines which network port is active. In dual-ported machines, the PLSCC value should be 7 (which includes the $01 enable bit), which corresponds to the "General Purpose Serial Interface" to the circuitry where the signal is routed. In the ANS, however, this value should 1, which specifies a direct AUI connection.

The ANS Mac OS ROM internally and explicitly specifies a property PLSCCPort on /bandit/gc/mace with that value of 1 . @joevt gets credit here (a) for discovering that the Apple Enet INIT looks for and if specified uses this property as an override, relying on a platform default if not, and (b) for the magic incantation required to make this property stick when placed in the nvramrc . Since the ANS looks like a Power Mac 9500 to Mac OS, this value must be provided before Apple Enet runs, so since it's not in the 1.1.20.1 ROM we'll provide it ourselves in Open Firmware before the operating system even starts.

This scheme works and solves both the reboot-shutdown and Ethernet problems simultaneously. But what about bringing the system up from a cold start, where this property won't yet have been set? Well, we have a solution for that too!

The Mac OS

NameRegistryLib

allows us to directly manipulate the Name Registry (which will necessarily have a copy of our Open Firmware properties), so we can also get this property installed during boot as long as we do so before the Apple Enet

INIT

opens. We could do this with an

ndrv

, but we have a simpler and more conventional way which I talked about in this blog before with ways to expand virtual Mac device support in QEMU .

kanjitalk755 's tablet INIT

installs a handler for USB HID devices during startup which allows QEMU absolute pointer positioning to work with its synthesized virtual USB tablet.

In this INIT , a block of 68K code (remember, the normal state of the Power Macintosh nanokernel is to run 68K code in the emulator) invoked at load time displays the icon and uses the Code Fragment Manager to pull a single non-static PowerPC function from the " PPC " resource (yes, P P C and a trailing space), set up a Universal Procedure Pointer to it as PowerPC native code, and run it. This code fragment is what installs the HID report handler.

Because this extension is so modular in design, we can just gut it and replace the PPC resource with our own code (yes, PowerPC code can run from resources, not just from the data fork), though I also manually patched the 68K section with a couple NOP instructions to not bother displaying the icon since we don't really need to. This is the entirety of the PowerPC code:

#include <MacErrors.h>
#include <NameRegistry.h>

// MACE Fixer for Shiner ROM 1.1.20.1
// (C)2026 Cameron Kaiser, all rights reserved
// MIT license
// oldvcr.blogspot.com

#define AIX "Devices:device-tree:packages:aix-boot"
#define MACE "Devices:device-tree:bandit:gc:mace"
#define PLSCCPORT "PLSCCPort"

// Any other function must be declared static!
void main(void) {
	OSErr err;
	RegEntryID regEntryID;

	// Ensure this is an ANS ROM that can boot AIX (2.0 doesn't, but doesn't need this)
	err = RegistryCStrEntryLookup(NULL, AIX, &regEntryID);
	if (err != noErr) {
		return;
	}

	// Find MACE and set the PLSCCPort property on it if not already done.
	err = RegistryCStrEntryLookup(NULL, MACE, &regEntryID);
	if (err == noErr) {
		RegPropertyValueSize s; 
		err = RegistryPropertyGetSize(&regEntryID, PLSCCPORT, &s);
		if (err == nrNotFoundErr) { /* may not be found if nvram patches not on */
			UInt32 port = 1;
			err = RegistryPropertyCreate(&regEntryID, PLSCCPORT, &port, sizeof(UInt32));
		}
	}
}

Notice the device tree paths for the two devices we're interested in, Devices:device-tree:packages:aix-boot (or, as an Open Firmware path, /packages/aix-boot ) and Devices:device-tree:bandit:gc:mace ( /bandit/gc/mace ). We don't need to know anything else about what these nodes are or how they're connected to query and modify them. The first step this function takes is to see if this is an AIX-capable ROM by checking for the AIX booter package as a Name Registry node, and if this package isn't present, such as a regular Power Mac or the ANS Mac OS ROM, then we exit. The second step is to see if the PLSCCPort property already exists; if it does, such as being set from our nvramrc , we exit also, or otherwise set the proper value of 1.

Since the whole scheme can only work if our extension runs first, we give it the special file type of scri instead of INIT , which is notionally a WorldScript extension but can be used to load any sort of extension, because WorldScript extensions load before all other INIT s ( Apple Enet is an INIT ). Failing that, the name of the extension ( ANS MACE Fixer ) is intentionally chosen to lexically sort above Apple Enet so that it will also run first. The upshot is that the property will be set one way or another before the Ethernet INIT runs, and with this extension installed, now the only circumstance where our Ethernet won't work would be on the very first boot after a PRAM zap with extensions off — which would obviously be an uncommon situation.

It is also important to ensure that main() is the only non-static function in the code fragment because of the way the 68K code finds, declares and calls it (see the prior article for why). CodeWarrior's project settings can be set to build this file as a resource and after doing so we manually merge everything together in ResEdit for the final extension.

As our last stop before the installation instructions, let me also talk a little bit about something not in this version of the extensions pack.

The NCR 53C825 Fast'n'Wide SCSI-2 controller also has its own

ndrv

in the ANS Mac OS ROM. Indeed, it must, or else the internal SCSI wouldn't be bootable with that ROM (the production and pre-production ROMs have their own support and hand everything over to AIX after boot). It is possible to extract this

ndrv

and wrap it as an extension in the same way. It won't be bootable, of course, but in theory this should allow devices on the internal SCSI to be used once Mac OS has booted from the external SCSI. Go ahead and try it. It doesn't work. The machine will boot, but no devices are visible from the internal SCSI drive bays.

Apple PCI DDK 3.0 also includes a utility (

Load Driver Test

) where you can test the structure of an

ndrv

to see if it's valid (useful for hardware builders before they spend a lot of money burning defective ROMs). This utility basically checks if the

ndrv

can be loaded as a code fragment, and if it can, that it has a sensible driver description block, and shows the device node it's looking for and the driver name it installs.

We can immediately see from this that the node name is wrong. In the ANS Mac OS 2.0 ROM, the 53C825 nodes in the Name Registry are named apple53C8xx , not 53c825 as they are in the pre-production ROM. Triumphantly I changed the string and length byte to make the matched name 53c825 . It still didn't work.

The PCI DDK has an additional tool (

PCIPeek

) which allows you to mess around with PCI-based devices. When we ask it for the PCI configuration space for one of the 53C825s using the node name

53c825

, we can pull it up and see all 64 bytes are valid. Though the

compatible

name doesn't fetch , this does at least prove that the issue isn't the logic board and the node name is correct.

The next step was to look at the driver description in the hex editor. This is again another trivially compressed PEF. Like any well-behaved SCSI driver, it implements a fully-specified SIM (SCSI Interface Module), which, according to the SCSI Common Access Method (CAM), is the link between the 53C825 host bus adapter (HBA) and the transport (XPT) layer that in turn hooks into the SCSI drivers used by the operating system. You should be able to see the device node name and the Macintosh driver name, but the byte before the Pascal string for the Mac driver name here is $04. Unlike video

ndrv

s, the documentation states SCSI

ndrv

s should only have a single bit set in that byte, in this case specifying that the family expert handles loading the driver (

kDriverIsUnderExpertControl

, $04).

Since that didn't load nor open the driver, I tried setting various bit combinations of forcing it to load upon discovery and/or open upon load, all of which ended up hanging the ANS doing boot. Remember how I said that SHIFT doesn't stop ndrv s from loading? Each of these permutations thus ended up making the external SCSI volume unbootable until the poison ndrv was removed. I had to connect it to the WallStreet PowerBook G3 (it was handy) to get it out, though as a check I had the Wally boot from the same volume just to see what it would do — and it booted fine. The driver doesn't load on the Wally almost certainly because the device name doesn't match anything, which also implies the hang is specific to trying to bring up the device on the ANS or we'd hang on the Wally too.

This leaves us at the mercy of the family expert, so the next thing I tried was various combinations of service category and type. By default this is ndrvgenr , so I tried ndrvscsi , ndrvblok , blokgenr , blokscsi , scsigenr , scsiblok , scsiscsi , blokblok and finally an intemperate combination inappropriate for a family blog, and while none of these locked up the 700, none of them made any difference either.

After all that I'm not sure this approach would have worked for getting the internal SCSI bus working anyway, at least not without additional code. Apple's PCI documentation says, "The SCSI expert is simpler than some other experts" and while it mentions the situation of a "PCI card that wants to register a SIM with the SCSI Manager" which necessarily covers the situation of one in ROM, it says nothing about disk-based drivers. It's possible the SCSI expert just doesn't handle this situation because a non-bootable SCSI bus is certainly less useful, and while we could write up an INIT to try loading the SIM manually, I'm still pondering how this would work and I have yet to find a working disk-based driver for a 53C825-based card that I could hack as an alternative (suggestions solicited in the comments). The PCI DDK 3.0 notably includes a "driver" for this chipset, but only to let you mess around with the hardware — it's intentionally not structured as a SIM, so it wouldn't be an effective foundation.

But you can still try the other pieces, so let's pick up with the install instructions now that you have the prerequisites.

If you were working with a pre-built Mac OS disk image, using the system you used to build it put the ANS MACE Fixer and ANS Video Enabler into the Extensions folder, and the ANS Startup Fixer into the Startup Items folder. If you are doing the install on the ANS itself, simply have the CD disk image ready to go on your external device (or connect a real physical external SCSI CD-ROM).

Assuming you didn't tl;dr this article, your depowered logic board should now be fully reset. Close the drawer and lock the rear key and plug the server back in, then plug in ADB and your SCSI device. Remove all hard drives from the front; you can't boot MacOS from them anyway, and it will simply confuse Open Firmware. The CD-ROM and any tape drives may remain, though do note they currently won't work either. Connect your display to the on-board VGA port, not to any PCI video card, and finally power on the system. If you are using one of Jeff's current replica ROMs, you may need to hit Control-Command-Reset after powering up to get the bong (this is an electrical issue we're sorting out). From a cold start with no bootable AIX volume, the 1.1.20.1 ROM will automatically bomb into Open Firmware, showing you the prompt here. If you don't see this screen, make sure your monitor is connected to the onboard port.

If you've already prepared your external Mac OS volume and the extensions are in their proper places, just type bye at the Open Firmware ok prompt. You will see the message

/AAPL,ROM
MacOS is currently unsupported, use at your own risk.

while the ROM component looks for your startup disk. Once it finds it, there will be a pause, then the screen will flash and drop into the Mac OS mid-boot. Remember, the Startup Fixer must run once every time Mac OS starts up , or your system will come up with a black screen on the next boot. You can manually fix this by entering Open Firmware with a serial connection to Port 2 (38400bps, 8-N-1) and enter setenv input-device kbd , setenv output-device screen , setenv use-nvramrc? false and reset all , or you can just reset the logic board.

If you are doing an install from an external Mac OS CD-ROM or CD image, move your display to the PCI video card and then blindly type bye . You will get the Mac 50% dithered grey, then a Happy Mac, then the CD should start. Install Mac OS as usual to your previously prepared blank disk image. After the installation completes, if you can, install the extensions (e.g., from a floppy disk or via AppleShare over LocalTalk) and startup item as described above before you shut down . Either way, shut down, power off and reset your logic board again, disable or remove the CD-ROM/image, move the display back to the onboard video port, and power back on to the Open Firmware prompt. If the extensions were installed, just type bye — you're good to go. If you couldn't, move the display to the PCI card again, blindly type bye , bring up Mac OS from your external volume, install the extensions, shut down, power off and reset your logic board one last time, then move the display back to the onboard video port. Now you can boot by just typing bye also.

Things still to do:

Get the internal SCSI bays working, which may require us to create a modified ROM and put the ndrv there with the proper node name. However, one other possibility is by installing a MacOS-bootable SCSI PCI card. The Shiner logic board has 68-pin connectors on the logic board that directly feed into the two front SCSI busses (bus 0 controls the top four trays and bus 1 controls the bottom three and the 700's rear two). These connectors were intended for the ANS PCI RAID card, but I don't see why we couldn't just connect a regular controller there as long as we change its SCSI ID to not conflict with the 53C825, which should be possible on Adaptec cards with the PowerDomain Control CDEV . I intend to do some experimentation with that, including finding an optimum card which is Mac-bootable (or flashable to same) and supports full Fast'n'Wide SCSI-2, yet is not supported by AIX so that the regular 53C825 will "just work."
On a reboot, the ANS may go into its Long RAM Test. This is not only not fatal but is arguably intended behaviour and it will start normally afterwards, though the delay is annoying. On the other hand, even though the ANS Mac OS ROM doesn't do this, it also doesn't properly register the sticks as parity RAM even if they are. I don't know if I can fix this by tweaking Open Firmware or this requires a ROM patch, though I suspect it's the latter. In the meantime, you can manually cut it short by hitting Control-Command-Reset.

Hopefully you'll see solutions to one or both of these in a future article . For now, you can get everything on the Github repo , including source code for CodeWarrior Pro 7. Note that this compiler cannot build the 68K portion of the ANS MACE Fixer, but I've included the source for that too, and you don't need to build the 68K segment anyway merely to modify the PowerPC portion. Each portion is under its own license and you should read the brief notes. No AI was used.

More Than One Million Lula Supporters Rally

Portside

portside.org

2026-10-24 20:04:06

More Than One Million Lula Supporters Rally Dave Sat, 10/24/2026 - 20:04 ...

Original Article

More than one million supporters of Brazil’s leftwing president, Luiz Inácio Lula da Silva, have streamed on to Rio’s most famous beach for a giant protest they hope will propel him towards a historic election fightback against his far-right rival, Flávio Bolsonaro .

Nearly 159m Brazilians will vote in the election’s runoff on Sunday, with the pair tied in the polls after Bolsonaro won the first round on 4 October by 47% to 45%.

On Saturday, under a fierce sun, red-clad crowds packed the 2.5-mile Copacabana beach in an attempt to help Lula clinch a dramatic and unprecedented comeback . Never since the return of democracy to Brazil in the 1980s has the first-round loser managed to bounce back.

Josias Silva, a 61-year-old truck driver, voiced confidence that his 80-year-old president, who was first elected in 2002, would win a fourth non-consecutive term. He carried a homemade sign to the carnival-like procession reading: “Lula re-elected. Tomorrow will be a new day.”

“The people have woken up,” Silva said of the large pro-Lula street protests that have swept Brazil since the leftist’s first-round defeat, many led by students.

“Young people know we need this victory because otherwise we will have dictatorship again – and we don’t want dictatorship. We don’t want hatred. We don’t want guns. We want a country of love,” added Silva, celebrating the large number of people who came to witness one of the final presidential campaign rallies in Lula’s storied 50-year political career.

“There’s never been a demonstration like this one. This is the biggest protest in the history of Brazil. And we are going to win tomorrow with more than 60% of the votes,” Silva claimed.

Polls suggest a far tighter margin and most analysts see Bolsonaro, whose father, Jair Bolsonaro, was president from 2019 to 2022 , as the slight favourite, having sold himself to voters as someone who will tackle chronic levels of violent crime with an iron fist.

However, in recent days Lula has appeared to regain the initiative and climb in the polls, amid a succession of scandals involving his rightwing foe. Last week the Brazilian magazine Piauí claimed that at the height of Brazil’s 2020 coronavirus outbreak, Flávio Bolsonaro attended a boat party attended by sex workers and vaccine lobbyists hoping to strike a deal with the government of his father.

Some experts speculate a Lula comeback may be possible. At the Copacabana rally – which Rio’s City Hall said attracted about 1.1 million people – activists unfurled an enormous yellow and green banner declaring: “WE ARE GOING TO TURN THIS AROUND!”

On Saturday afternoon, Lula attended an even larger rally on Paulista Avenue, in the heart of Brazil’s biggest city, São Paulo.

“I’m super excited. Lula’s going to win,” said Marta Moraes, a 59-year-old restaurateur, as she joined Saturday’s demo in Rio.

Moraes said the election was not about left versus right. “We’ve nothing against the right … what we’re against is Bolsonarismo,” she said, tears filling her eyes as she recalled how Flávio Bolsonaro’s father botched the response to Covid during his chaotic 2019-2022 administration.

“I lost four members of my family because of Bolsonaro’s neglect,” Moraes said.

A smiling woman poses before a huge Brazilian flag reading “Democracia” at a Lula rally.

Lula supporters on Copacabana Beach in Rio de Janeiro. Photograph: Agustín Marcarian/Reuters

Jair Bolsonaro is serving a 27-year prison sentence for plotting a coup after he lost the 2022 election to Lula. Many Brazilian democrats fear he will be released – and could even return to government – if his son wins. Reports in the Brazilian press suggest several of Bolsonaro’s fellow plotters – who are now in prison or hiding in exile – may be given top military and police jobs in a Bolsonaro administration.

Cammy Marinho, a 49-year-old DJ and activist, said: “I’m here to prevent democracy becoming extinct – which is what the Bolsonaro family wants”.

Marinho said she had spent the past fortnight fighting to persuade people who voted for Bolsonaro, or did not vote in the first round, to back Lula.

“It’s non-stop work: in the bakery, in the supermarket, on the underground – whenever you feel there is an opening to talk to someone and show to them the reality, everything that Lula has done and is doing for the people and everything that this [Bolsonaro] family has done against the people,” she said.

Many marchers were part of the so-called “Lula’s Army” – a 10 million-member WhatsApp group that was created after the first round in the hope of turning the election around.

“Being a soldier in Lula’s army … means fighting for Brazilian democracy. This isn’t a normal election,” said Isabella Gaze, 64, a retired teacher and one of the group’s members.

“They constantly claim Lula is corrupt. But the truth is that they represent the most rotten and worst part of Brazilian politics. This is what we are fighting against now,” Gaze said of the Bolsonaros.

Many of the faces on Copacabana beach were teenagers, including 14-year-old Heitor Lopes da Silva. Silva had come from the city of Duque de Caxias in his wheelchair, with a placard that said: “Lula, I’m a person with a disability and I’m here to support you.”

“My whole life I’ve believed Lula was a good president. [Bolsonaro] represents the destruction of Brazil …. he represents sadness and death,” he said of the Bolsonaro-era Covid catastrophe.

Large crowds of Bolsonaro supporters also hit the streets, including in Belo Horizonte, the capital of Minas Gerais state, which has Brazil’s second-largest electorate after São Paulo, and is a key bellwether. No presidential candidate has ever won the presidency without securing Minas Gerais, where Bolsonaro led by just under 5% in the first round.

Thousands of Bolsonaristas gathered to see their candidate in a palm-lined plaza called Praça da Liberdade. To the booming sound of AI-generated funk carioca tracks praising Bolsonaro, a sea of supporters dressed in Brazil’s yellow football jersey waved Brazilian flags – and many of the United States too.

“The US is a great nation. Who wouldn’t want to be aligned with them?” said 56-year-old cosmetics entrepreneur Marcos Antonio, holding a flag that merged the emblems of both countries.

“I don’t want an alliance with Cuba or Venezuela. I want to move forward,” Antonio added. When reminded that Venezuela was currently aligned with the US after Donald Trump’s January invasion , he said: “True. But for now, a fully right-wing government hasn’t been installed yet. It’s in transition.”

A Bolsonaro supporter drinks from a water bottle beneath Brazilian, Israeli and US flags.

Bolsonaro supporters, some with the flags of the US, Israel and Brazil, also held last-minute rallies on Saturday. Photograph: Raquel Cunha/Reuters

Antonio Carlos Costa Jr, the 59-year-old owner of a shooting club, complained: “Lula did nothing for the country.”

Jair Bolsonaro relaxed gun ownership and buying laws – which security experts agree ended up diverting many firearms to criminal gangs – whereas Lula tightened regulations once again. “Jair Bolsonaro simply gave citizens the right to defend themselves, and his son will do the same,” said Costa Jr.

Lula supporters scoff at the idea that Bolsonaro, who has a history of well-documented ties with members of Rio’s paramilitary “militia” groups, could rid Brazil of criminality.

“If we vote the militias into power, we will be living in a dictatorship,” said Erika Cavalcante, 43, an architect who came to the march with a sign reading: “Don’t let the mobsters win.”

We hope you appreciated this article. Before you close this tab, can we ask you to support the Guardian at this critical time for journalism in the US?

According to a leading global watchdog, US democracy is now more imperiled than at any point since the 1960s. Press freedom is under threat on many fronts – from criminal investigations to politicized regulation, frivolous lawsuits and catastrophic funding cuts to public media.

Nicole Nguyen’s Duo Review for the WSJ

Daring Fireball

www.wsj.com

2026-10-24 18:15:00

Nicole Nguyen (also with a 5-minute video), writing for The Wall Street Journal (gift link): Every time I used the Duo in phone mode, one-handed, I felt its heft. It’s wider and thicker than a Pro iPhone — and heavier, even compared with competing foldables. My hand actually hurts after using th...

Original Article

Please enable JS and disable any ad blocker

Reuters and the WSJ on the Duo Launch

Daring Fireball

www.reuters.com

2026-10-24 18:08:17

Aditya Soni, Christine Chen, and Will Russell, reporting Friday for Reuters: CEO Ternus played greeter at a store in Austin, Texas, throwing open the doors and high-fiving customers as they streamed in, a video posted on X by CBS Austin showed. A known car enthusiast, Ternus’s Austin visit coin...

Original Article

Please enable JS and disable any ad blocker

Profits Are Soaring. Workers’ Share of Income Is Sinking.

Portside

portside.org

2026-10-24 17:36:09

Profits Are Soaring. Workers’ Share of Income Is Sinking. Dave Sat, 10/24/2026 - 17:36 ...

Original Article

Profits Are Soaring. Workers’ Share of Income Is Sinking. Published October 24, 2026

As long as labor is weak and fragmented, workers will continue to see their share of the economic pie contract as billionaires and CEOs reap the rewards of the new AI economy. | Mario Tama / Getty Images

O utside periods of recession, the public mood has rarely been as downbeat about the economy as it is today, with consumer confidence at a historic low and polls recording a deep pessimism about where things are headed. Against this backdrop, political and business leaders are touting an economic “golden age,” pointing to solid growth , stable unemployment, record profits , and a stock market that seems to only go up. The vibes on Main Street are gloomy, but on Wall Street they are nearly euphoric.

One way to understand this growing disconnect between everyday people and elites is to examine how today’s celebrated gains are distributed across the economy compared with earlier periods. To do that, economists typically look at the national income and how much of it goes to workers — the “labor share” — versus the portion that flows to capital in profits and rents. (Together labor and profits make up roughly two-thirds of gross domestic income; the remaining third is absorbed by rents, taxes, and a mix of other smaller categories.)

The US Bureau of Labor Statistics (BLS) tracks the labor share of the nonfarm business sector (the private economy minus agriculture) with quarterly data going back to 1947. For most of the twentieth century, that share was remarkably stable: it rose during recessions, as business income fell, and it declined as companies regained profitability, yet it never dropped below 60 percent and averaged around 63 percent. Labor’s consistent capture of about two-thirds of the national income was, in the words of John Maynard Keynes, “one of the most surprising, yet best-established, facts in the whole range of economic statistics.”

This historical pattern began to shift around the turn of the century. After peaking at 64 percent during the 2001 recession, the labor share began a long slide, falling below 60 percent for the first time in 2004 and staying there ever since. More recently, this long-term decline has accelerated. In September, the BLS announced that the labor share had dropped to its lowest level on record for the fourth quarter in a row.

The labor share now stands at 52.8 percent, more than ten points below its twentieth-century average. The downward trajectory coincides with rising profits across corporate America . As a share of gross domestic income, corporate profits are now the highest they’ve been since the early 1950s — at a time when hourly wage growth has cooled to a five-year low and is now well behind inflation.

Economists have offered many explanations for this trend. In a 2021 paper , Gene M. Grossman and Ezra Oberfield reviewed the vast literature on the subject and compiled the most commonly cited culprits, including technological change and automation, globalization and neoliberal trade policies, deindustrialization, increasing market concentration, the decline of unions, and more.

Beyond these structural causes, others have pointed to shifts in how some business owners and executives report their income. According to research by economists Matthew Smith, Danny Yagan, Owen Zidar, and Eric Zwick, roughly a third of the decline in the corporate sector’s labor share between 1978 and 2017 can be attributed to changes in how business owners pay themselves and how this income is recorded in the national accounts. They largely attribute this change to the Tax Reform Act of 1986, which encouraged firms to organize as “pass-throughs” and their owners to take income as profits rather than wages. Among pass-through firms owned by the top 1 percent, the owners’ share of value added rose from 37 percent to 48 percent between 2001 and 2014, a gain that came at the expense of their employees.

The different theories of labor’s declining share are often framed as rival explanations. In practice, they’re pieces of the same political-economic shift. The neoliberal turn of the late 1970s ushered in a new era of shareholder capitalism, which made maximizing shareholder returns the organizing goal of the corporation. To deliver those returns, America’s business leaders waged a broad assault on the labor movement, using every lever available to curb worker power. Technology, globalization, and union busting all operated through the same channel toward that end.

This reality has led some economists to put forward a more “unified explanation,” one that identifies the decades-long erosion of worker power as the root cause of labor’s dwindling share.

The Hidden Wedge

D ramatic as it is, the labor share decline understates how much income has moved away from ordinary workers over the last forty years, because it tells us nothing about the vast inequalities hidden within the labor share itself.

According to research by economists at the Economic Policy Institute (EPI), nearly 80 percent of the productivity-pay gap — the widening gulf between productivity growth and pay gains for nonsupervisory workers — has been driven by inequalities within the labor share, with the shift toward capital accounting for the remaining 20 percent. Before 1979, wage growth for the vast majority of workers tracked closely with productivity gains and with the growing compensation of high-income earners. Since then, most of the gains from productivity have flowed to top earners and shareholders.

EPI’s analysis shows that the bottom 90 percent of workers captured nearly 70 percent of all earnings in 1979, while the top 1 percent of earners took in a little over 7 percent. By 2021, the share of the bottom 90 percent had fallen by more than eleven points to 58.6 percent, while the top 1 percent of earners had doubled their share to nearly 15 percent — the highest point since the data became available in 1937. This trend was even more pronounced for the top 0.1 percent, whose share of earnings more than tripled, from 1.6 percent to 5.9 percent. Subtract the top 1 percent’s earnings, and the labor share falls well below its current historic low, by a much wider margin than in the past.

In an email, EPI Chief Economist Josh Bivens told Jacobin that the fall in the labor share and the growing inequality within it both stem from excess employer power in the labor market and decades of wage suppression. “Basically, I think a set of policies aimed at wage suppression have successfully slowed wage growth for the vast majority of workers,” Bivens said, “and this left a large and growing ‘excess’ wedge of income that went to much more privileged actors in the economy.”

Before 2000, most of this excess wedge showed up as rapid pay growth at the top of the income scale; during that period, as Bivens put it, “there was not a huge shift in the labor/profit shares.” Instead, top executives like General Electric CEO Jack Welch, poster boy of the shareholder revolution and ruthless union-buster , saw their pay explode. Between 1978 and 2000, the CEO-to-worker pay ratio at America’s top companies ballooned from under 25-to-1 to nearly 400-to-1.

Since the turn of the century, the excess has flowed more directly from labor to capital. “Post-2000, you see less of a wedge in pay growth between the very top and typical workers (still a big one, just not as big), but you start to see a noticeable rise in the profit share,” Bivens said. Part of this reflects changes in how business owners and executives report their income. The post-2000 shift away from labor coincided with a time when “a bunch of tax policy and regulatory policy changes made it more advantageous for super-privileged actors (corporate executives mostly) to report their income in forms that don’t show up in the labor share but do show up in the profit share.”

But reclassification explains only part of the shift. Profits also claimed a genuinely larger share of what the economy produced, boosting stock prices along with them.

Whether it flowed to executives or shareholders, this redistribution of income has been a driving force behind the rapid growth of both income and wealth inequality over the last half century. As Bivens and EPI President Heidi Shierholz point out in a recent essay , estimates suggest that “anywhere from 40 percent to nearly 100 percent” of the nominal gains in the stock market since 1989 can be attributed to capital’s growing share of the national income.

The implication, they write, is clear: “The wage suppression of recent decades is not just by far the biggest driver of the rise in income inequality; it is also by far the biggest driver of the rise in wealth inequality.”

Labor and the AI Boom

T he recent acceleration in the labor share’s decline has unfolded alongside an explosion in corporate profits and the strongest stock market bull run since the dot-com era. Yet these surging profits and asset prices have been driven less by genuine productivity gains than by financial speculation and a series of market shocks — from the supply-chain disruptions of the pandemic years to the recent spike in energy costs triggered by the Iran war.

Apart from these disaster-driven profits , the stock market boom has been powered by a handful of superstar companies concentrated in the tech sector. The top ten companies listed on the S&P 500 now make up roughly 40 percent of the index’s total market cap and generate over a third of its earnings, buoyed by the debt-fueled artificial intelligence boom.

These record profits are unlikely to last. If the current AI boom goes bust, as a growing number of market watchers now believe it will , earnings will plummet, and the profit share will decline relative to labor. But workers, not shareholders, invariably bear the brunt of recessions. Labor currently has little to gain and much to lose from the breakneck development of AI, especially if it proves as disruptive to jobs as many economists and AI boosters predict. Yet workers have even less to gain from a recession triggered by the collapse of the AI bubble, which would create ideal conditions for capital to further discipline labor — this time with some of the shiny new AI tools developed over the last several years.

The path to avoiding these outcomes and reversing the long-term decline of the labor share lies in a revitalized labor movement. As long as labor is weak and fragmented, workers will continue to see their share of the economic pie contract as billionaires and CEOs reap the rewards of the new AI economy.

The recently reelected president of the United Auto Workers (UAW), Shawn Fain, wasn’t being hyperbolic this June when he described the development of AI and the push for mass automation as a “profound threat and challenge to our way of life.” The compounding threats that workers now face have, in turn, increased public support and sympathy for labor unions. In September, Gallup’s annual survey on the labor movement showed that more than seven in ten Americans now approve of unions — the highest level since the 1960s — along with a record-high plurality of 47 percent who say that unions should have more influence.

Fain is among a cohort of new labor leaders who have pushed for a bolder and more combative labor movement willing to take the fight to capital. The UAW’s successful “stand-up strike” against the Big Three automakers in 2023 was part of a new wave of labor action in the post-pandemic years. New organizing efforts have also helped to slowly reverse the long-term decline in unionization, with data from the BLS showing the number of workers represented by unions rising to a sixteen-year high in 2025.

Whether the labor movement can sustain its current momentum is far from certain. What is clear is that its strength and influence will need to grow substantially in the years ahead if it is to meaningfully shape the emerging AI economy and shift the balance of power back toward workers. Until then, the economic gains touted by political and industry elites will almost certainly continue flowing straight to the top.

Conor Lynch is a writer and freelance journalist whose work has appeared in the Week , the New Republic , Salon , Truthdig , and elsewhere.

Jacobin is a leading voice of the American left, offering socialist perspectives on politics, economics, and culture. The print magazine is released quarterly and reaches 75,000 subscribers, in addition to a web audience of over 3,000,000 a month.

Marion Barry Meets the iPhone Duo

Daring Fireball

www.theverge.com

2026-10-24 17:10:06

Jay Peters, The Verge: The iPhone Duo officially goes on sale today, but a few units already have broken screens. According to posts on Reddit about the affected units, the issue appears to be happening at a similar spot on all of them: Some kind of problem shows up on the inner screen along the...

Original Article

Jay Peters

is a senior reporter covering technology, gaming, and more. He joined The Verge in 2019 after nearly two years at Techmeme.

The iPhone Duo officially goes on sale today, but a few units already have broken screens. According to posts on Reddit about the affected units, the issue appears to be happening at a similar spot on all of them: Some kind of problem shows up on the inner screen along the hinge and a strange bright line (or lines) across the right side of the display.

Here’s how one user in Australia described what happened to their phone:

Had my iPhone Duo for about six hours and had probably opened it fewer than 20 times.

I was showing it to a friend, and as I opened it, I felt something around the internal hinge, underneath the screen.

As I continued opening it, I heard an audible crack, and the screen broke right along the hinge.

There were no marks or damage on the inner screen’s surface or the external hinge to suggest anything had been caught or damaged.

The user said that the Apple Store replaced their phone with “a brand-new one on the spot.”

A post showing an image of another broken screen includes a video in a comment demonstrating yet another.

And a separate Reddit thread collected other pictures of affected Duos.

Apple didn’t immediately reply to a request for comment.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Jay Peters

How Do We Define Intelligence?

Portside

portside.org

2026-10-24 17:08:54

How Do We Define Intelligence? Dave Sat, 10/24/2026 - 17:08 ...

Original Article

Here’s a brief quiz, with examples inspired by particular students I have worked with. Which of the following pairs is more intelligent?

Someone who can read a book and analyze the plot or someone who can fix a car that has broken down?
Someone who can solve complex math equations or someone who can choreograph and perform a complex dance routine?
Someone who can build a shed or someone who can write a play?
Someone who can listen to and help a friend, or someone who can write code?

It’s a lot more complicated than it might seem, and how we define intelligence has had (and continues to have) significant consequences for students and for public education.

Early research and the influence of eugenics

Intelligence is abstract; it’s not a thing you can hold in your hand or weigh on a scale, so when we say that someone is intelligent, or more intelligent than someone else, what are basing that on? Alfred Binet was a French psychologist who, along with Theodore Simon, developed the first intelligence test in 1905. Binet’s interest was to help teachers have a better understanding of how to work with students who were labeled as “sub normal,” who could not keep up in French classrooms.

U.S. psychologists Edward Thorndike, Naomi Norsworthy, Henry Goddard and Lewis Terman, all believers in eugenics, were also developing methods to measure at the same time, but they took that work in a very different direction.

Eugenicists claimed some races (northern and western Europeans) were superior because they had better genes and all other races had inferior genes, which meant they were less intelligent and were responsible for crime and social ills. Eugenicists believed that they could perfect human beings through the breeding of those with “superior” genes, and by eliminating or limiting the birthrates of those from so-called inferior groups. This theory led to the enforced sterilization of between 60,000 and 70,000 people, policies such as the Immigration Act of 1924 that excluded Asian immigration, Jim Crow laws in the South, segregation, and the miseducation and warehousing of students in school basements, since they were deemed too feeble-minded to learn anything. This ideology also led to much of the horrors carried out in Nazi Germany in the 1930s.

Eugenics meets intelligence testing

The IQ or intelligence quotient measurement, created by Wilhelm Stern (who was not a eugenicist), made it possible to compare people’s performance on tests. Terman and his colleagues “weaponized” the IQ, using it to “prove” their theory that some races were superior. While their tests were racially and culturally biased, they insisted that the superior scores of certain races were the result of their superior genetic makeup.

One of the early uses of intelligence testing came during World War I. Eugenicist Robert Yerkes persuaded the army to use intelligence testing to determine which recruits would become officers and which infantry, with predictable results. Those from northern and western European backgrounds tended to score higher and became officers; others became infantry and were shipped into the middle of the death and destruction of that war.

Problems and limits of IQ testing

IQ was accepted as an objective and accurate measure of intelligence through the first half of the 20th century. The kinds of intelligence assessed by the IQ test became the definition of intelligence, and this played an outsized role in how schools were organized, how curriculum was developed, who succeeded at school, and how people with learning or mental health challenges were assessed. Those whose strengths mirrored the material on the tests were deemed intelligent, and those whose strengths did not align with that narrow band measured by the IQ were discounted, devalued and labeled as failures.

Critics began to challenge the validity of the IQ in the 1950s and ’60s. They noted that the IQ tests were racially and culturally biased, and did not consider socioeconomic factors that played a significant role in people’s lives. There was an increasing push to rethink and to broaden the definition of intelligence beyond the IQ.

The damage done

The dominating view of intelligence as seen through the eugenics lens has done great harm.

Students who are labeled as “smart” or “not smart” have a hard time shaking those labels, and it also influences how others view and work with them. The stereotype of people of color, particularly African Americans and Native Americans, being less intelligent is an example of the harm that has been done; there is no evidence to support a difference in intelligence from one race to another.
It ignores talents and skills that fall outside the realms that are tested and valued. Creativity is shut down, and those who think differently are also shut down and pressured to conform.
It contributes to our mental health crisis, as students who do not match up with the narrow recipe for success are blamed for their failures.
Immigrants and others from the so-called inferior races become scapegoats, blamed for society’s problems.

More recent understanding of the nature of intelligence

Research in the latter half of the 20th century has brought an understanding that there is no single measure of intelligence, that intelligence can change over time and in different situations, and that, the more we learn about how the brain works, the more we realize that “intelligence” involves the whole brain and the whole person in a particular context rather than a narrow, static, measurable slice of a person.

Psychologist Howard Gardner, who published his multiple intelligence theory in 1983, found that there is not one overriding intelligence, but that we are a collection of what he identified as discreet, individual intelligences. He identified eight of them: linguistic, logical-mathematical, spatial, musical, bodily-kinesthetic, interpersonal, intrapersonal and naturalistic. Gardner’s theory states that everyone has a unique combination of all eight intelligences; there is no one measure that encompasses them all.

Robert Sternberg developed his triarchic theory two years later, saying that intelligence has three aspects: analytical, creative and practical. Analytical intelligence refers to intelligence that is applied to analyze or evaluate problems and arrive at solutions; it’s what a traditional IQ test measures. Creative intelligence involves imagination, innovation and problem-solving. Practical intelligence is the ability that individuals use to solve problems faced in daily life.

Other theories have emerged since, all supporting a broader and more complex definition of intelligence, and advances in neuroscience confirm that there is no simple, single, universal measurable definition.

What does this mean?

Brazilian educator Paulo Freire, in his book “Pedagogy of the Oppressed,” argues that oppressive leaders maintain dominance by claiming the exclusive right to define what is “good,” “intelligent” and “valuable.” We are living through such a period now in the U.S. The president, in his attacks on experts and science, on the arts, on diversity, equity and inclusion (DEI), and on anyone who disagrees with him, is engaging in what Freire called cultural invasion — attempting to impose his values, views and definitions on the country. These attacks have a profound impact on how we view and value intelligence, education and each other.

Primatologist and anthropologist Jane Goodall famously said, “We’re not intelligent, because intelligent creatures don’t destroy their only home.” There are so many ways to be intelligent, and we desperately need them all to face the many crises before us. Our children bring all those intelligences to our schools, and our challenge is to support and nurture them so they can arrive at the full realization of who they are, what their gifts are and how they can bring those gifts to their families, communities and the world.

Doug Selwyn taught at K-12 public schools from 1985 until 2000, and then at university as a professor of education until he retired in 2017. He is the chair of the Franklin County Continuing the Political Revolution education task force. You can reach him at dougselwyn12@gmail.com .

FindMyWeb: Apple Find My, reverse enginiered

Hacker News

codeberg.org

2026-10-24 19:42:52

Comments...

Original Article

A project which allows you to build trackers which you actually own. The idea is to create a way for you to build your own trackers using the already existing networks without requiring you to own any vendor specific devices.

Supported networks

Apple FindMy
Google Find My Device
Samsung SmartThings

Why

Currently there are a lot of different networks for location trackers from a plethora of different vendors. This causes a lot of fragmantation and everyone requires you to own a device where their closed-source software runs without you knowing what actually happens with your location. The idea is to create a web interface for all of them and allow you to build your own open-source trackers.

How

The backend currently uses malmeloo's FindMy.py library to interact with Apple's network while the trackers run a custom Zephyr based firmware. You can find out more info in the setup instructions.

Setup

Web (Frontend+Backend)

Development/Baremetal
Docker (TBD)

FruityTag (Firmware)

Building
Prebuilt (TBD)

Thanks

seemo-lab for their initial research on the FindMy network
malmeloo for his excellent FindMy.py library

Scrawl: show an agent the problem

Lobsters

scrawl.kitlangton.com

2026-10-24 19:38:21

Comments...

Original Article

Press ⌥ ⇧ S , talk, click, and draw. Paste the result into your agent.

Download for Mac

Version 0.3.13 · Apple silicon · macOS 15 or later

Mac Apple silicon, macOS 15 + Download

$ brew install --cask kitlangton/tap/scrawl
Windows x64, preview, unsigned Download
Linux Soon

iPhone

Plug it into your Mac

Your iPhone’s screen appears in a window on the Mac, and you talk and draw over it as it records.

Record inside your own app

Add ScrawlKit to your iOS app to record on the phone itself, with every tap and swipe drawn on the frames.

How it works

Frames only when something happens

Scrawl takes a frame when you draw, click, say “look” or “now”, or the screen changes.

Each frame keeps its words

Your speech is transcribed on your computer, and each sentence goes with the frame it was about.

Cropped to where you worked

Record the whole screen, and each frame is cut down to the window you drew or clicked in.

A closer look when it’s needed

The agent can ask for a dense grid of frames around any moment, by time or by a phrase you said.

Controls

⌥ ⇧ S Start or finish
⇧ Hold and drag to draw
⇧ click Drop a numbered pin
⌘ Z Undo
esc Cancel
⌥ ⇧ V Paste the latest capture
M Flag a moment on iPhone

Install

Homebrew

$ brew install --cask kitlangton/tap/scrawl

Terminal

$ curl -LO https://scrawl.kitlangton.com/releases/Scrawl-latest-arm64.zip

$ unzip Scrawl-latest-arm64.zip -d ~/Applications

$ open ~/Applications/Scrawl.app

For agents

$ bunx skills add kitlangton/scrawl

With the skill, an agent that gets a Scrawl paste reads the contact sheet and transcript, opens the keyframes the narration points at, and uses the scrawl command to look closer.

Why Gopher in 2026?

Hacker News

gopher.muffinlabs.com

2026-10-24 19:33:19

Comments...

Original Article

Entry 001 - Why gopher in 2026? May 22nd 2026 First off, if you're reading this, you're probably the kind of person who can't just use a tool, you have to know how it works. There are smart people who are good at what they do. Some people are master chefs, awesome mechanics, great sculptors or skillful accountants. But how many of those people dive so deep into what they are good at to understand what makes it tick? People like us are the ones who build a phlog for fun just to get a feeling for how far we've come with technology. Maybe you're here for the nostalgia, maybe it's to turn off the noise of modern tech. The important part is you are here now, in 2026 or beyond. I'm noticing a trend with my 17 year old and their friends with ADHD where they want to turn off the noise of the world and go back to simpler times. As one who is from those simpler times, I'm a little proud but also a little "Get off my lawn!" It's impossible to go back to that at this point and for better or worse, we have to make sense of where we are. Flip phones are simple and low- tech to them, but for us they were the latest in tech! We have syntax highlighting in vim that wasn't there when I was using vi so many years ago. Now I not only know it's there, but I can google how to set up so many features that I didn't know existed and would never figure out from the manual. Back in the day you had to find someone who first off knew what you were even talking about and second who knew more than you did. For me, this was how I ended up knowing a little about a lot but not being able to wrestle the arcane knowledge from the man pages. I think tech is in a weird place that is both super helpful and yet so unhelpful at the same time. Subscriptions for everything, services changing all the time and profits driving the direction of everything. It's nice to find a place like sdf that operates like how things used to. Thanks for stopping by! Wayne =============================================================================== (Comment left when I was using germ 0.4.0) 2026 May 24, 10:29 I feel you, on one hand we cant go back, on the other, we have to go back. Im not sure where that leaves us. All I know is that I (myself) need to slow down. - y4my4m

Google has officially turned these Nest thermostats back into dumb thermostats

Hacker News

www.makeuseof.com

2026-10-24 19:14:30

Comments...

Original Article

America Has Lost 200k of Jobs in Media, Film and the Arts. How Much Is AI?

Hacker News

www.apricitas.io

2026-10-24 19:11:54

Comments...

Original Article

Thanks for reading! If you haven’t subscribed, please click the button below:

By subscribing, you’ll join over 80,000 people who read Apricitas!

America has lost more than 200k jobs in “creative” industries over the last four years, with roughly 50k lost within the last year alone. That makes for one of the worst stretches for media employment in modern US history, with similar job loss intensity and duration occurring only during the major economic recessions of 2001 and 2008. Yet there’s no generalized recession today—instead, this period of job loss coincides with the rise of AI systems that can compose wholesale novels, photorealistic images, soundalike music, and practically every other form of digital art, en masse and at extremely low costs. Is this the fall of the Creative Class?

Proving the exact amount of AI-driven job loss in the arts is extremely difficult. Media firms are decidedly coy about their AI use, both to protect against public backlash and, more financially important, to preserve the legal basis for their copyrights. The effects of AI are also hard to disentangle from other factors currently affecting arts businesses, like consolidation in Hollywood, offshoring of content production, or the continued displacement of traditional media providers in favor of social media creators. Yet perhaps the clearest evidence of AI’s influence is just that all subsectors of the digital arts industry are losing jobs, while in-person entertainment is still growing at a healthy pace.

Some of those digital job losses are just a continuation of prior trends, like in the publishing industry where technological change has been continually grinding away newspaper and magazine jobs for decades. Yet for sectors like live broadcasting, streaming, or graphic design, recent experience is an unusual downturn compared to the tranquility of years prior. Then there’s the worst-hit sector, movie & sound recording, which has been bleeding jobs at a nearly unprecedented pace over the last three years.

Hollywood has never seen a stretch as bad as the last four years, with the movie & TV industry losing more than 100k jobs, nearly one-third of the sector’s total. At the depths touched this summer, total employment was lower than at any point since the 2008 recession and approaching the lowest point in 30 years. The streaming era has proven an extremely difficult transition, with traditional films and TV shows losing watch time to user-generated and increasingly AI-assisted or AI-generated content flows.

Overall, nearly half the media job losses of the last four years have been concentrated in the movie & sound recording sector that includes Hollywood. Written publishing has been the next-largest source of job loss, with employment down by more than 70k over the same time frame. Yet the job losses have by no means been contained to any particular part of media; instead they’ve hit nearly every subsector at some point. Nor do they show any sign of abating, with losses consistently hovering at around 50k per year and even accelerating in recent months. Will further AI development continue displacing workers in creative industries?

To understand what could happen to the business of art amidst the rise of AI, it’s important to understand what did happen to it during the first digital transition, the rise of the internet.

It was the turn of the millennium, and Metallica had a problem. Demos of their upcoming, unreleased tracks were bouncing around radio and the internet, originally leaked onto a new internet file-sharing website called Napster. There they found thousands of files shared amongst hundreds of thousands of users, many of which were direct rips of albums that sold for $15 being offered for free. The most anticipated albums were often leaked online even before they were on store shelves. Metallica sued Napster for copyright infringement, and they were soon joined by separate suits from other prominent artists and eventually the Recording Industry Association of America (RIAA).

Much of the general public was understandably unsympathetic to Metallica , perceived as a bunch of already-successful millionaires trying to bilk even more money from listeners, and were even less sympathetic towards the RIAA, perceived as scurrilous middlemen who take from artists and fans alike. But the two of them easily won their lawsuit, forcing Napster into bankruptcy. Yet Metallica may have been right on the law but were on the wrong side of technology; the RIAA had won the battle but was losing the war.

The modern internet made file-sharing extremely easy, and no matter how much whac-a-mole companies played, they could not possibly catch every illegal upload. The perennial threat of piracy undermined their copyright and limited their ability to charge for music. Eventually, the value of individual songs fell to the point that companies like Spotify and Apple Music could swoop in to acquire massive catalogues, consolidate them, and charge a comparatively trivial fee for access. For what a single Metallica album would have cost in 2000, you can now get a month’s worth of unlimited access to nearly all human-made music.

The music industry has never returned to the heyday paydays of the peak CD era—even without adjusting for inflation, streaming revenue pales in comparison to ‘90s physical media sales. This was a massive boon to consumers, but it was also a squeeze on musicians that forced them to fundamentally change their business model over time. Instead of just selling records to earn money directly, music itself increasingly became a loss-leading advertisement for the live concerts (and merch) that provided a growing share of artists’ income. Tours got longer, venues got bigger, ticket prices skyrocketed, and musicians frequently took on roles closer to public influencers than isolated artistes. Were it not for rising concert sales, the business model of music would have completely collapsed, and the income going to musicians would have cratered.

Of course, there were still significant downsides to the transition into the streaming era. Bands (especially smaller ones) complain about the unending pressure to always be on tour. Musicians whose content was suited to home listening lost out to those more suited to giant festivals. Even accounting for concert revenues, musicians made less money than before. Yet musicians fared better than many areas of entertainment subsectors because there was a live component to fall back on—for many media industries, the digital era left no such comfort.

Over time, the business of video has moved in the opposite direction of music—out of the theatre and into the home. Hollywood formerly made most of its money enticing customers to visit sold-out movie theatres, but these were gradually supplanted by broadcast TV, cable, and physical media. Yet because each successful technological leap increased total video watch time, the industry was still able to thrive amidst technological upheaval. That is, until the modern streaming era.

Today, the plethora of video options and the rise of social media have sent video producers into a vicious competition for limited attention. Even before adjusting for inflation, movie ticket sales ended last year down 25% from their 2019 peak, cable revenue is down 18% from its peak, and streaming revenue has not been able to compensate for the drop. The mountain of free user-generated content on YouTube, Twitch, TikTok, or social media was already presenting harsh competition for traditional video companies in the years before ChatGPT’s launch, and now streaming services are also competing with a flood of AI-generated content. The business model of video media is fundamentally getting squeezed, and unlike in the music industry, there’s basically no equivalent to live concerts that Hollywood can be used to ease the pain.

The actual worst-case scenario for creative workers amidst the AI revolution is something similar to what happened to the publishing industry after the advent of the internet—that is, near-total collapse of their fundamental business model. Newspapers used to employ roughly half a million people in the US, more than the entire oil industry, and now their payrolls are down nearly 85% and still dropping. Magazine publishers likewise have let 66% of their staff go since the 90s, while book publishers have lost 40%.

The routine informational updates that previously formed newspapers’ bread-and-butter were all de-bundled—box scores moved to sports websites, stock movements went to financial websites, forecasts went to weather websites—each loss compounding on itself to undermine consumers’ need to buy the paper. Search engines became the first place people looked to for information, and newspapers’ advertising revenue rapidly started flowing to companies like Google instead. The collective of social media users became faster at breaking any news story than a daily paper could ever hope to be. When papers eventually did start aggressively paywalling content, the internet made it trivially easy for people to just copy the articles’ content and share it beyond the paywall. The entire business model had collapsed, to the point that now only a select few major newspapers can even survive.

That scale of copyright dilution and forced unbundling is the worst-case scenario for media businesses in the age of AI. It’s possible arts jobs could survive via consumers’ deep-seated aversion to explicitly AI-generated content, but AI is increasingly being used throughout media in ways invisible to the average end consumer. Roughly 32% of workers in the overall arts, entertainment, and recreation sector use Generative AI to some extent , which is less than the 62% average across all industries , but still enough that virtually every major media project could have some AI within its workflow.

Indeed, AI is likely seeping into media production processes in ways large companies themselves would struggle to prevent even when they desire to—how can a TV studio be sure nobody in their writers’ room is consulting ChatGPT for jokes or any storyboard artist is generating concept art? And even if professional TV and movie studios do effectively hold out against temptation and prevent internal AI use, how long can they compete with the large mass of wannabe independent creators with much fewer scruples? Plenty of media businesses tried to hold out against the algorithmic content waves of the 2010s and were buried as a result.

Yet fundamentally, it’s difficult to meaningfully predict how new technologies will interact with existing arts businesses. Take the unexpected resurgence in book sales over the last four years. The novel as a commercial art form had been struggling for decades, with fewer books sold in 2019 than at the beginning of the millennium, but the last six years have seen an unprecedented 70% surge in sales. The unlikely savior of the printed word came from perhaps its polar opposite—TikTok.

Of course, fewer people read now than ever before—for the general public, short-form video apps have accelerated the displacement of reading, just as TV, video games, or social media before them. Yet for a dwindling number of dedicated repeat readers, “BookTok” became a new way to source reviews, analysis, discourse, and community in a way that boosted the reading experience and absolutely turbocharged book sales. It’s possible that AI tools could have those same totally unpredictable spillovers for other museums, concerts, or other forms of art in ways that are unpredictable today, in much the same way short-form video saved books in ways that could never have been anticipated beforehand.

At the end of the day, the arts are only a small sector of the overall macroeconomy. Media made up a small share of the labor market even at its peak, and it has always been difficult to get hired in creative industries to the point that making fun of art students’ job prospects became an easy punchline. The movie industry has an income profile closer to eggs or bicycles than something major like healthcare or finance. Were the goal to create art for art’s sake, for the intangible and nonmonetizable cultural benefits, it would be relatively easy to counterbalance any economic impacts of AI on artists just by reversing recent cuts to the National Endowments for the Arts & Humanities.

It’s telling that Anthropic, the most prominent AI lab, has basically never bothered with image, video, or music generation, because the prospective economic benefits are marginal when compared to using AI to tackle math or scientific problems. OpenAI learned this lesson the hard way when it was forced to abandon its video generation platform Sora, deciding it had better use for its limited compute than making synthetic TikToks. Nowadays, the art generation is done primarily by secondary players running smaller models, though even these are large enough to threaten significant disruption to legacy media businesses.

In other words, the primary impacts of AI art will be on culture and society rather than the macroeconomy. Yet arts jobs might be a microcosm for other “creative-adjacent” work that occupies a much larger share of economic activity. Take the tech sector itself, which is the clearest place where AI-driven job loss has shown up outside the media business, as powerful coding agents replace human programmers. Annual tech job gains stood at nearly 300k in 2022, but the sector has been bleeding jobs every year since then in what is now its longest labor market downturn.

Right now, AI-driven job displacement has been relatively minor outside of these few narrow sectors. Unemployment is higher than it was four years ago but still below even the 2010s average , and overall job turnover rates remain extremely low . Some white-collar sectors that looked prime for AI automation have even been on a hiring spree over the last few years, including legal and engineering firms. Yet if the economic impact of AI ends up being anywhere near large enough to validate the trillions of dollars investors are currently betting on it , these economic disruptions will only spread from here.

Discussion about this post

Ready for more?

SIMD and Go

Lobsters

internals-for-interns.com

2026-10-24 19:11:40

Comments...

Original Article

Take a really boring loop: walk two []float32 slices and add them together, element by element. Written the normal way in Go, the CPU handles one pair per step. The funny thing is that the same CPU has hardware that could handle eight pairs at once, and a plain Go loop never uses it.

That hardware is SIMD . Until recently, the only way to use it from Go was hand-written assembly. Now Go has an experimental simd/archsimd package (Go 1.26) and a portable simd package on top of it (Go 1.27), so you can write normal Go that turns into SIMD instructions.

We’ll start with how SIMD works inside the CPU and meet Go’s two SIMD packages. Then we’ll go through the most common SIMD operations, with Go code for each one, peek at how the compiler makes it all work, and finally put everything together in a small, real example.

📌 A note on scope

Everything here is based on Go 1.27.0 with GOEXPERIMENT=simd . The package is experimental, so names may change between releases. I’ll stick to amd64 (Intel and AMD CPUs) and skip a lot of the instruction set to keep the core ideas clear.

Before we write any Go, though, let’s see what that “eight pairs at once” hardware actually does.

What SIMD Actually Means

SIMD stands for Single Instruction, Multiple Data . But what does that actually mean? Let’s put the same operation side by side, once without SIMD and once with it.

The scalar version is a normal loop: one instruction adds one pair of numbers, then the next instruction adds the next pair, eight times in a row. The SIMD version works differently: instead of adding the pairs one at a time, a single CPU instruction takes all eight numbers from a and all eight from b and adds them in one go. One instruction instead of eight, so the whole thing finishes much faster.

There’s a catch, though: all eight additions have to be the same operation . You can’t add in one slot and multiply in the next. SIMD shines when you have lots of independent data that all needs the same treatment, which is very common in things like image processing, audio or machine learning.

But notice that in the SIMD version, all eight numbers had to sit together somewhere before the add. That somewhere is a special kind of register.

A normal register holds a single 64-bit value, so eight floats don’t fit. SIMD has its own, much wider vector registers : 128, 256 or 512 bits, depending on your CPU. In this post we’ll mostly use 256-bit ones, which hold exactly eight float32 values.

But 256 bits of what ? Floats? Bytes? Let’s look at one of those registers a bit closer.

One 256-bit YMM register drawn four times, stacked vertically, each time sliced differently. Top: 32 thin slices labeled “32 × int8”. Second: 16 slices labeled “16 × int16”. Third: 8 slices labeled “8 × int32 / float32”. Bottom: 4 wide slices labeled “4 × int64 / float64”. Lane 0 is marked at the left end of every row.

A vector register is just a bunch of bits, and as you can see in the diagram, we can split it into slots of different sizes, called lanes , like 32 lanes of 8-bit integers or 4 lanes of float64 . The register doesn’t care; each instruction decides how to split it. Most of our examples use 8 lanes of float32 .

So now we have big registers split into lanes. How do we actually use them?

The SIMD Cycle: Load, Operate, Store

Almost every piece of SIMD code follows the same three steps: get the data into a register, do some math on it, and get the result back out. Let’s go through them one by one.

The first step is filling the register, and that’s the job of a vector load .

The load grabs eight float32 values from our slice in one go and drops them into the eight lanes of the register: a[0] goes to lane 0, a[1] to lane 1, and so on. One instruction, one full register. The 9 and 10 at the end don’t fit, so they’ll have to wait for the next load. We’ll see later how to deal with leftovers like that.

With a in one register and b in another, we can do the math.

Two registers drawn one above the other: a = [1 2 3 4 5 6 7 8] and b = [10 9 8 7 6 5 4 3]. Between each pair of lanes is a small plus sign, and a straight vertical arrow runs from each lane pair down into a third register labeled a + b, holding [11 11 11 11 11 11 11 11]. Red vertical lines run through all three registers between every lane, walls that no value crosses.

Look at any single lane: lane 3 of a plus lane 3 of b goes into lane 3 of the result. Each lane only talks to the same lane in the other register. That’s called a vertical operation, and most SIMD instructions work like this. You can think of each lane as its own little calculator, with walls between them, so nothing leaks from one lane into the next. And the result doesn’t go back to memory: it lands in another register, ready for the next instruction.

Once we’re done with the math, we have to get the results out of the register. There are two ways out. The first one is a vector store , the opposite of a load.

A register at the bottom with eight lanes, labeled lane 0 to lane 7, each holding 11. A thick arrow goes up from it into an output slice labeled “out []float32”, eight contiguous memory cells indexed [0] to [7], each now holding 11.

All eight lanes go back to memory in one go: lane 0 lands in out[0] , lane 1 in out[1] , and so on. That’s what you want if your result is another slice.

The second one is extracting a lane .

A register with eight lanes, labeled lane 0 to lane 7, each holding 220, with lane 0 highlighted in red. A curved red arrow labeled GetElem(0) goes from lane 0 to a small box on the right labeled “a normal float32”, holding 220.

Here we pull a single lane out into a normal variable, lane 0 in this case. That’s fine for one value, but doing it eight times in a row would throw away all the speed we just gained.

That’s the whole cycle, at the hardware level. Now let’s see how we write it in Go.

SIMD in Go: Two Packages

Before we look at more operations, let’s meet the Go packages we’ll use, so the code examples in the rest of the post make sense right away. Go has two of them, and both only exist when you build with GOEXPERIMENT=simd .

simd/archsimd: One Type per Register

The low-level package is simd/archsimd . It’s tied to your CPU’s architecture ( package docs ), and it maps almost one to one onto the registers and lanes we just saw. Types are named after the lane type and the number of lanes: Float32x8 is a register with eight float32 lanes (256 bits), Float32x4 has four (128 bits), and Float32x16 has sixteen (512 bits). And using them follows the same cycle we just saw: you load your data with LoadFloat32x8 , run operations like Add on it, and finally get the data out again with Store or GetElem .

Here’s what that looks like for adding two slices, eight floats at a time (we’ll deal with the leftover elements later):

func add(a, b, out []float32) {
	for i := 0; i+8 <= len(a); i += 8 {
		x := archsimd.LoadFloat32x8(a[i:])
		y := archsimd.LoadFloat32x8(b[i:])
		x.Add(y).Store(out[i:])
	}
}

simd: The Portable One

archsimd gives you full control, but there’s a catch: you have to pick the register size yourself. Code written with Float32x8 uses 256 bits even on a CPU that could do 512, and it doesn’t even compile on ARM, which has no 256-bit registers. Go 1.27 fixes this with a second package: simd .

Its types don’t have a size in their names: Float32s , Int8s , Mask32s ( package docs ). The size is chosen when the program starts , based on your CPU, and v.Len() tells you how many lanes you got. Other than that, the methods are the same ones: Add , MulAdd , Store , and so on.

Here’s the same function with simd :

func add(a, b, out []float32) {
	var v simd.Float32s
	n := v.Len() // 4, 8 or 16, depending on the CPU
	for i := 0; i+n <= len(a); i += n {
		x := simd.LoadFloat32s(a[i:])
		y := simd.LoadFloat32s(b[i:])
		x.Add(y).Store(out[i:])
	}
}

The loop is the same. The only difference is that the step isn’t a hardcoded 8 anymore: we ask the vector how many lanes it has.

In the rest of the post I’ll use archsimd for the examples, because its types match the pictures exactly: one Float32x8 , eight lanes.

With the packages in hand, let’s see what else we can do with those lanes besides adding them.

A Gallery of Common Operations

Loads, vertical math and stores get you a long way. But real code has constants, running totals, if s and data in the wrong order, and every lane still has to run the same instruction. Here are the tools SIMD uses for that.

For each one, I’ll also show what it looks like in Go with simd/archsimd .

Let’s start with the simplest one.

Broadcast: One Value Everywhere

Lots of code mixes a vector with a single number: multiply everything by 0.5 , compare everything with 5 . But vertical instructions need two full registers. So where does the second one come from?

A single small box labeled “a float32” holding the value 5, with eight red arrows fanning out from it into all eight lanes of a register, numbered 0 to 7, which becomes [5 5 5 5 5 5 5 5]. The register is labeled BroadcastFloat32x8(5).

You just copy the number into every lane. That’s a broadcast : one scalar in, a full register out. It’s cheap, and you usually do it once, before the loop.

five := archsimd.BroadcastFloat32x8(5) // [5 5 5 5 5 5 5 5]

With constants sorted out, let’s get more out of each math instruction.

Fused Multiply-Add: Two Operations in One

A lot of number crunching boils down to “multiply these, then add the result to a running total”. Do we really need two instructions for that?

Start with step 1 and follow lane 0: 1 × 2 , plus the 0 already sitting in acc , gives 2 . Every lane does the same thing at the same time, all in one instruction. That’s a fused multiply-add , or FMA , and it’s usually as fast as a plain multiply. Now follow the red arrow: the result of step 1 becomes the acc input of step 2, so lane 0 computes 8 × 3 + 2 = 26 and builds on what was already there. Chain enough of these steps and each lane keeps its own running total, which is exactly what you need for something like a dot product .

In Go, that’s the MulAdd method, which computes x*y + z :

x1 := archsimd.LoadFloat32x8([]float32{1, 2, 3, 4, 5, 6, 7, 8})
x2 := archsimd.LoadFloat32x8([]float32{8, 7, 6, 5, 4, 3, 2, 1})

var acc archsimd.Float32x8                           // all lanes 0
acc = x1.MulAdd(archsimd.BroadcastFloat32x8(2), acc) // [2 4 6 8 10 12 14 16]
acc = x2.MulAdd(archsimd.BroadcastFloat32x8(3), acc) // [26 25 24 23 22 21 20 19]

So far, every lane computes a number. Next, let’s make the lanes answer questions.

Comparisons Produce Masks

In normal code you’d write if a[i] > 5 { ... } . In SIMD you can’t do that, because all eight lanes run the same instruction, so you can’t jump somewhere for some lanes and not for others. So what does a comparison give you back?

Two registers a = [1 7 3 9 5 8 2 6] and a broadcast register [5 5 5 5 5 5 5 5] feed into a comparison labeled “a > 5”. The output is shown in two forms. On the AVX2 side, a full vector register whose lanes are either 0xFFFFFFFF (true, shaded) or 0x00000000 (false). On the AVX-512 side, a small k register holding just eight bits, 0 1 0 1 0 1 0 1 read from lane 0, one bit per lane.

It gives you a mask : one true/false answer per lane. Here we compared a against our broadcast 5 , and lanes 1, 3, 5 and 7 came out true. The picture shows the two ways the hardware stores that answer. For a 256-bit register like ours, it’s a normal vector register where “true” lanes are all ones and “false” lanes are all zeros. With 512-bit vectors, which need AVX-512, it goes into a small, dedicated mask register instead ( k0 to k7 ), using just one bit per lane. In Go you don’t have to care which one you get: a mask is just a Mask32x8 .

a := archsimd.LoadFloat32x8([]float32{1, 7, 3, 9, 5, 8, 2, 6})
five := archsimd.BroadcastFloat32x8(5)

mask := a.Greater(five) // true in lanes 1, 3, 5 and 7
bits := mask.ToBits()   // 0b10101010, one bit per lane (lane 0 is the lowest bit)

And that brings us to the SIMD version of if .

Masking and Blending: The SIMD “if”

A mask on its own doesn’t do anything, though. How do we use it?

Three registers stacked on top: x = [1 7 3 9 5 8 2 6], y = [0 0 0 0 0 0 0 0] and mask = [F T F T F T F T], with the T lanes in red. Below them, a result register labeled x.IfElse(mask, y) holding [0 7 0 9 0 8 0 6]. In the T lanes a solid red line comes down from x, past y and through the mask, into the result; in the F lanes a dashed black arrow comes down from y instead.

Go lane by lane through the result: where the mask is true, the value comes from x , and where it’s false, from y . That’s a blend , and it’s how SIMD does if/else : compute both answers for every lane, then use the mask to pick one per lane. Blending with zeros, like the y here, is so common it has its own name, masking : “keep the lanes that passed, zero the rest”.

x := archsimd.LoadFloat32x8([]float32{1, 7, 3, 9, 5, 8, 2, 6})
var y archsimd.Float32x8                          // all lanes 0
mask := x.Greater(archsimd.BroadcastFloat32x8(5)) // [F T F T F T F T]

r := x.IfElse(mask, y) // [0 7 0 9 0 8 0 6]
r = x.Masked(mask)     // same thing, shorter

Now let’s leave the math aside for a moment and move data around.

Permutes: Moving Lanes Around

Everything so far keeps lane i in lane i . But sometimes the data is in the right register and the wrong lanes, and you need to reverse it or reorder it.

On top, a source register x = [a b c d e f g h] with lanes numbered 0 to 7. In the middle, an index register [7 6 5 4 3 2 1 0]. On the bottom, a result register [h g f e d c b a]. Curved red arrows cross from the source lanes, through the index register, into the result lanes, reversing the order.

Each lane of the result looks at its own index and copies that lane of x . Result lane 0 has index 7 , so it gets x ’s lane 7, h . Result lane 1 has index 6 , so it gets g . And so on, until the last lane, which has index 0 and gets a . That’s a permute : the values don’t change, the indices just decide where each one ends up. Here they reverse the register, but any order works, and you can even pick the same lane more than once. That flexibility is the secret sauce behind tricks like super-fast JSON parsers.

x := archsimd.LoadFloat32x8([]float32{1, 2, 3, 4, 5, 6, 7, 8})
idx := archsimd.LoadUint32x8([]uint32{7, 6, 5, 4, 3, 2, 1, 0})
r := x.Permute(idx) // [8 7 6 5 4 3 2 1]

Moving lanes around isn’t always enough, though.

Horizontal Operations: Across the Lanes

Permutes move values between lanes, but every value still ends up in exactly one lane. Sometimes we want the opposite: combine lanes of the same register, like adding up partial sums into a total. That’s a horizontal operation.

Two four-lane registers, x = [1 2 3 4] and y = [5 6 7 8]. Red braces join neighboring lanes, 1 and 2, 3 and 4 in x, 5 and 6, 7 and 8 in y, and a red arrow with a plus sign goes from each pair into one result register [3 7 11 15]. The first two result lanes are marked “from x” and the last two “from y”.

Each pair of neighboring lanes gets added together: 1+2 , 3+4 from x , then 5+6 , 7+8 from y , and the four sums go one after the other into the result, [3 7 11 15] . That’s ConcatAddPairs : x.ConcatAddPairs(y) gives [x0+x1, x2+x3, y0+y1, y2+y3] .

x := archsimd.LoadFloat32x4([]float32{1, 2, 3, 4})
y := archsimd.LoadFloat32x4([]float32{5, 6, 7, 8})
r := x.ConcatAddPairs(y) // [3 7 11 15]

There’s one last problem we’ve been ignoring since the very first load.

Handling the Tail: Partial Loads

Now back to the leftovers from the load picture: our slice has 10 elements, and a register takes 8. After one full chunk, 2 are left. That leftover bit at the end is called the tail .

A memory row with the last two elements of a slice, 9 and 10, followed by cells marked with a question mark labeled “not ours: past the end of the slice”. A mask [T T F F F F F F] sits under it. Arrows show 9 and 10 going into lanes 0 and 1 of a register, while lanes 2 to 7 are filled with zeros. Labeled “partial load: 2 loaded, 6 zeroed”.

The question marks are the danger: the memory after our slice isn’t ours, and a normal 8-lane load would read it anyway. A partial load solves it: you get back a register where only the lanes that exist hold your data, and the rest are zeros. If you’re adding things up, zeros are the perfect filler, because they don’t change the result.

One honest warning, though: in Go 1.27.0, the amd64 version still reads the full 32 bytes under the hood and zeroes the extra lanes afterwards. The result is correct, but it does touch that memory. That’s already been fixed upstream , so it should be gone in a future release.

s := []float32{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}
x, n := archsimd.LoadFloat32x8Part(s[8:]) // x = [9 10 0 0 0 0 0 0], n = 2

Those are some of the most common tools SIMD gives us. Time to look at the Go side again.

How Go Makes It Work

We’ve been calling methods like x.Add(y) all along. But how does a method call end up as a single CPU instruction? And how can the simd package work without knowing the register size in advance? Let’s take a look under the hood.

archsimd: Methods Without Bodies

If you look at how Add is declared, you’ll find something odd: func (x Float32x8) Add(y Float32x8) Float32x8 , and no body at all. That’s because Add is a compiler intrinsic : the compiler recognizes it by name and puts the instruction right there, instead of calling a function.

Follow that pipeline step by step. First, the compiler finds x.Add(y) in its table of intrinsics ( simdAMD64intrinsics.go:40 ) and turns it into an SSA operation, just like we saw in the SSA article . A rewrite rule then turns that into the amd64 VADDPS instruction ( simdAMD64.rules:30 ), and the register allocator picks the registers. One method call, one instruction.

The types get special treatment too. Float32x8 is a struct with a small marker field inside ( types_amd64.go ) that tells the compiler: “keep this whole thing in one vector register”.

That works for archsimd because the size is right there in the type name. The portable simd package doesn’t have that luxury.

simd: Compiling Your Code Several Times

If the register size is only known when the program starts, how does the compiler know which registers and instructions to use?

It doesn’t have to pick: it compiles your code several times . You write one dot function using simd.Float32s . A compiler pass called midway ( rewrite.go ) makes a copy of it for each width, dot@simd128 , dot@simd256 and dot@simd512 , plus a pure-Go fallback, dot@simd0 . It also adds a small dispatcher that keeps the original name dot , so the rest of your code calls it as usual. At startup, Go checks the CPU and the dispatcher sends every call to the right copy. On an AVX2 machine, that’s dot@simd256 .

If you want to choose yourself, you can: GODEBUG=simd=0 forces the pure-Go version, and GODEBUG=simd=256 (or 128 , 512 ) forces a width ( midway_common.go:22 ). And if you ever see a name like dot@simd256 in a stack trace, now you know where it came from.

So far we’ve looked at each piece on its own. Time to put them all together.

Walking Through an Example

Now we have everything we need to follow a real example from Go source to silicon. Let’s use a dot product : multiply two []float32 slices pair by pair and add everything up. It shows up everywhere, from vector search to machine learning, and it uses almost everything we’ve seen so far. Here’s the archsimd version, which is small enough to read in one go and runs with GOEXPERIMENT=simd go run . on Go 1.27:

package main

import (
	"fmt"
	"simd/archsimd"
)

func dotSIMD(a, b []float32) float32 {
	var acc archsimd.Float32x8 // eight running sums, all zero
	i := 0
	for ; i+8 <= len(a); i += 8 {
		x := archsimd.LoadFloat32x8(a[i:])
		y := archsimd.LoadFloat32x8(b[i:])
		acc = x.MulAdd(y, acc) // acc = x*y + acc, lane by lane
	}
	// The tail: fewer than 8 elements left, the missing lanes load as zero.
	x, _ := archsimd.LoadFloat32x8Part(a[i:])
	y, _ := archsimd.LoadFloat32x8Part(b[i:])
	acc = x.MulAdd(y, acc)

	// Fold the eight lanes down to one number.
	s := acc.GetLo().Add(acc.GetHi()) // 8 lanes -> 4
	s = s.ConcatAddPairs(s)           // 4 -> 2
	s = s.ConcatAddPairs(s)           // 2 -> 1
	return s.GetElem(0)
}

func main() {
	if !archsimd.X86.AVX2() || !archsimd.X86.FMA() {
		fmt.Println("this CPU lacks AVX2/FMA")
		return
	}
	a := []float32{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}
	b := []float32{10, 9, 8, 7, 6, 5, 4, 3, 2, 1}
	fmt.Println(dotSIMD(a, b)) // 220
}

Let’s walk through it step by step. main first checks that the CPU supports AVX2 and FMA, because archsimd won’t check for you: if the CPU doesn’t have an instruction, running it doesn’t fall back to anything slower, it just crashes the program with an illegal instruction error. Then acc starts as a zero vector, and we enter the loop with 10 elements.

Step 1, “full chunk (a[0:8], b[0:8])”: x = [1 2 3 4 5 6 7 8] and y = [10 9 8 7 6 5 4 3] go through MulAdd into acc = [10 18 24 28 30 30 28 24].

Stage 1, the full chunk. i+8 <= 10 , so we load a[0:8] and b[0:8] into two registers with one load each, just like in the load diagram. MulAdd multiplies them lane by lane and adds acc , which is still all zeros, so acc becomes the eight products [10 18 24 28 30 30 28 24] . Next time around, i is 8 and 16 <= 10 fails, so the loop ends.

Step 2, “tail (a[8:], b[8:])”: x = [9 10 0 0 0 0 0 0] and y = [2 1 0 0 0 0 0 0], with the six zero lanes shaded and labeled “six zero lanes (masked off)”. MulAdd updates acc to [28 28 24 28 30 30 28 24], with +18 and +10 marked over lanes 0 and 1.

Stage 2, the tail. Two elements are left. LoadFloat32x8Part loads 9 and 10 into lanes 0 and 1 and zeros into the other six (and the same for b ). One more MulAdd : lane 0 gains 9*2 = 18 , lane 1 gains 10*1 = 10 , and the zero lanes add nothing. acc is now [28 28 24 28 30 30 28 24] .

Step 3, “fold”: acc = [28 28 24 28 30 30 28 24] is split into [28 28 24 28] and [30 30 28 24], which are added element-wise into [58 58 52 52]. ConcatAddPairs turns that into [116 104 116 104], and a second ConcatAddPairs into [220 220 220 220].

Stage 3, the fold. Each lane of acc has its own running total, so we have eight numbers, and the answer we want is all eight added together. We could take them out one by one and add them, but that means seven normal additions, one after another. Instead, we let SIMD do it in a few big steps, cutting the number of values in half each time. That works because when you add numbers, the order doesn’t matter: 1 + 2 + 3 + 4 is the same as (1 + 3) + (2 + 4) .

First, we cut the register in two. GetLo gives us the first four lanes, [28 28 24 28] , and GetHi the last four, [30 30 28 24] . Then we add those two halves lane by lane, like any other vertical add, and get [58 58 52 52] . We haven’t lost anything: 58 is just 28 + 30 , so these four numbers still add up to the same answer as the original eight.

Next, ConcatAddPairs adds each lane to its neighbor: 58 + 58 = 116 and 52 + 52 = 104 . We only have one register, so we pass s as both arguments, and that’s why the result shows the same two sums twice, [116 104 116 104] . The repeated half is harmless, we just ignore it. Now the whole answer is in two numbers, 116 and 104 . One more ConcatAddPairs adds them together, and every lane ends up holding 220 .

Step 4, “out”: the register [220 220 220 220] with lane 0 marked, and an arrow labeled “GetElem(0) — same as the scalar loop” pulling out a single 220, in red.

Stage 4, out. GetElem(0) pulls lane 0 into a normal float32 : 220 , the same answer as the scalar loop.

And here’s the nicest part. If you build it and disassemble dotSIMD with go tool objdump , the heart of the loop is exactly the three instructions our diagrams promised, two loads and one fused multiply-add:

VMOVDQU 0(DX), Y2
VMOVDQU 0(R11), Y3
VFMADD213PS Y1, Y3, Y2

and the end of the function is the fold, instruction for instruction: two VEXTRACTF128 for GetLo / GetHi , a VADDPS , two VHADDPS , and a VPEXTRD to pull out lane 0. No calls, no allocations, the data never leaves the vector registers.

Is it worth it? On my machine (an AMD Ryzen AI Max+ 395), with two slices of 4096 floats, the scalar loop takes about 3.9 µs and the SIMD version about 0.41 µs , roughly 9 times faster. But it isn’t free. The scalar version is a tiny loop that anyone can read, while the SIMD one needs a tail, a fold and a CPU check, and it’s much harder to follow and maintain. And the gains depend a lot on the problem: a dot product over long, contiguous slices is close to the best case, while code with lots of branches, scattered memory access or short inputs may get much less, or nothing at all. So measure first, and keep SIMD for the hot loops where it really pays off.

Summary

Let’s look back at what we’ve seen. SIMD lets one instruction do the same operation on many values at once, using wide vector registers (128, 256 or 512 bits, depending on your CPU) split into lanes . Almost every SIMD loop follows the same cycle: load data into a register, do the math lane by lane, and store the results back (or pull out a single lane). A few extra tools, like broadcast , fused multiply-add , masks , blends , permutes , horizontal adds and partial loads , cover what real code needs.

On the Go side, simd/archsimd maps all of this almost one to one: Float32x8 is a register with eight float32 lanes, and methods like Add are intrinsics that turn into a single instruction. Checking that your CPU supports them is your job. And if you don’t want to pick a register size at all, the portable simd package compiles one copy of your code per size and picks the right one at startup.

Putting it all together, our dot product ran about 9 times faster than the plain loop on my machine. But that speed has a price: SIMD code is harder to read and maintain, and how much you gain depends a lot on the problem and the data. So measure first, and keep it for the hot loops where it really pays off.

It’s all still experimental, so names may change, but the ideas underneath won’t. Once you can picture the lanes, reading SIMD code in Go gets a lot easier.

In the next article, we’ll look at another way to make Go code faster without rewriting it: profile-guided optimization (PGO). We’ll see how you can hand the compiler a CPU profile from your real program, and how it uses that profile to decide where to try harder, like inlining the functions that actually matter and turning hot interface calls into direct ones.

An animated explainer of the PHP2Shell vulnerability

Lobsters

www.youtube.com

2026-10-24 18:48:29

Hi all! 3 days since the Internet almost melted down, I've wanted to know how you can pwn any PHP server with a single request, and the explanations have been mostly "something about out-of-memory." I found the official write-up to be quite a challenge, spending as much time on the history of PHP bu...

Original Article

Argus – a free, open-source agentic security operations platform – MIT

Hacker News

thomasunise.com

2026-10-24 17:54:16

Comments...

Original Article

Open Source Free · MIT Licensed Self-Hosted

Attackers have AI agents now. So do you.

Argus is a free, open-source security operations platform that watches your cloud, logins, code and devices around the clock, catches machine-speed attacks the moment they start, and shuts them down in seconds. AI does the legwork. Guardrails you control decide what it's allowed to touch.

The Argus security overview: open findings, assets, events, posture score and pending action requests for one tenant

Seconds, not hours From detection to a blocked attacker, with autonomous response on

27 one-click fixes Across AWS, Azure, GCP, Kubernetes, Okta, Entra, CrowdStrike and more

$0 license No seats, no usage fees, no lock-in. You own all of it

A stolen key handed to an AI agent can fire sixty probing calls across twenty of your cloud services in less time than it takes to read this sentence. Swarms of fake identities can spray passwords at your admin accounts from a hundred places at once. By the time a person reads the first alert, the attacker has already moved on to the next system.

Most security tools were built for attackers who sleep. Argus was built for the ones that don't. It watches at machine speed, investigates at machine speed, and when you let it, responds at machine speed. It does all of that through one broker with approvals, dry runs, automatic rollback and a kill switch, so speed never turns into a new risk.

Fast enough to stop an AI attacker. Disciplined enough to trust with your production systems.

01 / See it all

Every asset, every login, one map

Argus pulls in your AWS, Azure, GCP, Kubernetes, GitHub, Okta, Entra, devices and network traffic and links them into one evidence graph. You see the attack paths before an attacker does.

02 / Catch it early

Built to spot AI-driven attacks

Detections for agent swarms, machine-speed recon, privilege escalation, public exposure, leaked secrets and rogue workloads. Tripwires bait attackers' AI agents into revealing themselves.

03 / Shut it down

Respond in seconds, from Slack

Block an IP, contain a laptop through CrowdStrike or SentinelOne, disable a user, lock down a public bucket. Approve, deny or roll back with one tap in Slack, or let a playbook do it for you.

04 / Rein in AI

Stop shadow AI and data leaks

Find every AI tool your team is quietly using. Route your apps' and team's OpenAI and Anthropic calls through one gateway with approved models, data-loss rules, budgets and a full usage log.

05 / Know you're covered

Test your defenses on demand

Replay eight AI-agent attacks in a sealed sandbox and get a report of exactly what you'd catch and what would slip through. Let autonomous pentesting probe your own systems, inside the scope you set.

06 / Prove it

Audit-ready from day one

Every action is signed into a tamper-evident audit trail stored in write-once storage. Control mapping for SOC 2, NIST 800-171 and ISO 27001 is built in.

02:14:07 Attacker An attacker's AI agent finds what looks like an LLM API key in your code and tries to use it. The key is a canary that Argus planted. Nothing real was exposed. Tripwire
02:14:08 Detect Argus raises a high-severity detection with the attacker's source address and the full evidence trail. Caught
02:14:09 Respond Your playbook blocks the source at your Cloudflare firewall, within the hourly cap you set. Policy, deny-lists and the kill switch are checked first, every time. Blocked
02:14:10 Notify Slack lights up with what happened, why, and a one-tap Roll back button. Slack
07:30:00 Review Your team starts the day with a closed incident, a signed audit record and a choice: keep the block, or let it expire. If nobody keeps it, Argus rolls the block back automatically when its timer runs out. Done

Letting software act on its own in production is a big decision, so Argus makes it a small, reversible one. The AI agents never touch your systems directly. They investigate with read-only access and can only propose. Every change, whether a person asks for it, an agent suggests it or a playbook fires, passes through the same broker.

Off until you say so: Autonomous response and autonomous pentesting ship switched off, and each needs both a deployment switch and a per-tenant opt-in.
Shadow mode first: Playbooks start by logging what they would have done, so you see their judgment before you give them the keys.
Reversible only: Autonomous playbooks run reversible actions, and each one rolls back automatically unless someone decides to keep it.
Capped: Hourly limits per tenant and per playbook, a blast-radius limit, and two human approvals for high-risk actions.
One switch: The kill switch stops every action in a tenant or across the whole deployment instantly.
Hard to fool: Everything the AI reads is treated as untrusted, and the agents are tested against prompt-injection attacks.

Autonomous response

Threats handled while you sleep

Playbooks turn a detection into a fix with no human in the loop, then undo it on a timer unless you keep it. Approve, deny and roll back from Slack buttons.

AI gateway

One front door for every AI call

Your team uses OpenAI and Anthropic with company-held keys, approved models, data-loss rules, budgets and prompt-injection flags. Staff get Argus keys; your real provider keys stay locked inside Argus.

Shadow-AI discovery

See which AI tools your staff really use

Argus spots AI services in your network traffic, cloud accounts and SSO grants, keeps an inventory, and raises an alert for anything unreviewed or blocked.

Attack simulator

A fire drill for AI-driven attacks

Eight realistic agent attacks, from credential-spray swarms to a rogue Kubernetes agent, replayed in a sealed sandbox. Add "slow and low" evasion variants to find the gaps attackers would exploit.

Autonomous pentesting

A red team that never clocks out

An AI planner picks the tests, Argus runs them through scanners like Nuclei, ZAP and Trivy, then plans the next round from what it found. It stays inside your authorized scope, re-checked before every step.

Threat intel

Fix what's actually being exploited

Every vulnerability is checked against the CISA Known Exploited list and scored for exploit likelihood. Anything attackers are actively using jumps to the top of your queue.

AI-agent canaries

Traps built for AI attackers

Fake LLM keys, fake MCP servers, decoy agent rules files and planted prompt injections. An agent that bites gives itself away instantly.

Endpoint containment

Isolate a compromised laptop in one step

New CrowdStrike and SentinelOne actions contain a device straight from Argus, with the same approvals, dry run and rollback as everything else.

MIT licensed Self-hosted Claude, OpenAI, local Ollama or no AI at all Docker, Helm, Terraform for AWS and Azure

quickstart

$ git clone https://github.com/thomasunise/argus.git && cd argus
$ python -m venv .venv && . .venv/bin/activate
$ pip install -r requirements.txt
$ cp .env.example .env && python scripts/generate_secrets.py --write
$ uvicorn app.main:app --host 127.0.0.1 --port 8080

Open 127.0.0.1:8080 and sign in with the admin login from .env . Run python scripts/seed_demo.py for synthetic demo data.

Going to production? There's Docker Compose for a pilot, a Helm chart for Kubernetes, and Terraform for AWS and Azure. Argus refuses to start in production mode without encryption keys, HTTPS, a write-once audit sink and SSO or two-factor, so an unsafe install can't happen by accident. The full checklist is in docs/DEPLOYMENT.md .

Do it yourself

Free, forever

Clone it, deploy it, make it yours. Best for teams with security engineers who want to own every line.

MIT license: no seats, no usage fees, no vendor lock-in
Architecture, threat model, runbooks and a step-by-step go-live guide
Issues and contributions welcome on GitHub

Get it on GitHub

Done for you

I install it and hand it over running

For business owners and lean IT teams who want enterprise-grade protection without hiring a security team to run it. You get the outcome, not the project.

Deployed in your own AWS, Azure or Kubernetes account. You own everything
Connected to your cloud, logins, code and devices, with alerts in Slack
An attack-simulator report showing what you catch today and the gaps we close
Rules tuned to your business, and autonomous response proven in shadow mode before it goes live
AI gateway and shadow-AI discovery set up so your team's AI use is safe and visible
Your team trained on alerts, approvals and the kill switch

Book an install call

What is Argus?

Argus is a free, open-source security operations platform you host yourself. It maps your cloud, identity, code, device, network and Kubernetes assets into one evidence graph, detects attacks including fast, AI-driven ones, uses AI agents to triage and investigate, and fixes problems through an action broker with approvals, dry runs, automatic rollback and a kill switch. It also governs your own company's AI use with an AI gateway and shadow-AI discovery.

Can Argus act on its own? Is that safe?

Only if you turn it on. Autonomous response and autonomous pentesting are off by default and need both a deployment setting and a per-tenant opt-in. Playbooks start in shadow mode, run only reversible actions, are capped per hour, and roll back automatically unless someone keeps the change. The AI agents themselves never execute anything: they investigate with read-only access and can only propose actions. Every change goes through the same broker, and the kill switch stops everything instantly.

Can an attacker trick the AI?

Argus is designed on the assumption that someone will try. Everything an agent reads is wrapped and labelled as untrusted data, and the agent is told that instructions found inside evidence are a sign of an attack. The agents are tested against prompt-injection evaluation suites, and because they cannot execute anything themselves, a tricked agent can at most file a request that still has to pass policy and approval.

What does the attack simulator do to my systems?

Nothing. It replays synthetic attack data in a hidden, isolated sandbox that copies your detection settings. It sends no traffic, runs no tools and touches no real system. Simulated detections can't trigger autonomous response, alerts or findings. You get a coverage report showing which attacks your rules would catch and which would get through.

What is shadow AI, and how does Argus help?

Shadow AI is staff using AI tools the business hasn't approved, often by pasting in customer or company data. Argus finds AI services in your network, cloud and SSO data and keeps an inventory you review. Its AI gateway gives your team approved access to OpenAI and Anthropic models with company-held keys, data-loss rules, budgets, prompt-injection flags and a usage log.

Does it replace my SIEM or EDR?

It works with them. Argus takes events in from thirteen sources, including CrowdStrike, SentinelOne, GuardDuty, Wazuh and CloudTrail, can contain devices through CrowdStrike and SentinelOne, and sends alerts to Slack, Jira, ServiceNow, PagerDuty, email and webhooks. Many teams run it alongside existing tools as the layer that connects the evidence, investigates it and governs the response.

Which AI models does it work with?

Anthropic Claude, OpenAI, local models through Ollama, or none at all. With no model configured, the specialists fall back to deterministic logic, so detection and triage still work. Budgets cap every agent run by steps, tokens, time and cost.

Does my data leave my network?

Argus is self-hosted, so the platform and its data stay in your infrastructure. The only outside calls are the ones you set up: the cloud and identity APIs it collects from, the channels you send alerts to, the public threat-intel feeds, and a model provider if you choose a hosted one. With a local model and offline threat-intel files, no AI or intel traffic leaves your network at all.

Is it ready for production?

The platform core (tenancy, sign-in, roles, the audit trail, the job queue, policy and approvals) is tested end to end on SQLite and PostgreSQL in CI. Like any security platform, it should be tuned to your environment: connect the collectors you use, tune the detection rules, and run in monitoring-only mode before enabling any action. That tuning is exactly what the install service covers. Argus is not a certified product.

Does Argus make us SOC 2 or ISO 27001 compliant?

No software does that alone. Argus ships a control mapping for SOC 2, NIST 800-171 and ISO 27001 that shows which controls it can provide evidence for, such as the signed audit trail, role-based access and approval records. That makes the audit faster, but your auditor still assesses your program as a whole.

What does it cost?

The software is free under the MIT license. You pay only for the infrastructure you run it on and any AI model you choose. If you want it installed for you, the install is scoped and priced after a short call about your environment, and you keep everything: the code, the configuration and the credentials.

I'm a business owner, not a security engineer. Is this for me?

If you have cloud accounts, staff logins, customer data or code worth protecting, the protection is for you. You don't need to run it yourself. Book a call, tell me what you use, and I'll tell you plainly whether Argus is the right fit or whether something simpler would serve you better.

Get AI-speed protection without hiring a security team.

Thirty minutes. We look at what you run, where you're exposed, and what an install takes. You leave with a plan, a timeline and a fixed price, or a straight answer that you don't need it yet.

Book an install call

We should be more ambitious with the software we build

Hacker News

danluu.com

2026-10-24 17:47:31

Comments...

Original Article

Since early this year, Michael Malis (of pgrust ) has been showing me interesting things he's done and saying

[W]e should be more ambitious ¹ with the software we build

There is, understandably, a lot of skepticism about projects like pgrust because there are so many low-quality AI-generated projects out there. If I didn't know Malis and didn't look into it, I would just assume that pgrust was another vibe slopped project that's never going to work. But I know Malis well enough to trust his work without looking into it, and if you look into it a bit, you'll see that in testing pgrust, he's testing thoroughly enough that he's even uncovering real bugs in Postgres, such as this numerical bug that can cause valid SP-GiST operations to fail , this format cache bug that can cause incorrect results from JSONPath , this pgcrypto bug that can cause later operations to fail , multiple memory safety bugs in the dictionary loader ² , this money overflow bug , etc.

This isn't to say that pgrust is bug free ³ , but it does indicate that there's a substantial amount of testing happening and, even if pgrust itself is never successful, just making the attempt will have improved Postgres in a durable way. The main pitch for pgrust is actually performance, and that's where the really interesting work is happening; if pgrust fails, it's possible that some of the optimizations they've demonstrated will make it into Postgres, Clickhouse, etc., but that's obviously less direct than filing Postgres bugs which get fixed.

That being said, I find it understandable that, every time I see pgrust discussed on a news aggregator, most people dismiss it as vibeslop garbage because almost all of these rewrite projects are slop. If I didn't know Malis, I would make the same assumption, because who has the time to look into all of these projects? Because I know Malis, I didn't bother to look at it; I just trusted him (I only found the above because I wanted to check on pgrust before using it as an example for this post).

As a consumer of software, everywhere you look, there's slow software that the creator is claiming is fast because the creator is touting some slop benchmark, e.g., here's one of multiple examples I saw yesterday , and of course low-quality software that doesn't work is more common than ever.

But, as a builder of software, it doesn't matter that almost all of these projects are vibeslop, that other people are out there shoveling out huge piles of crap and calling it gold. You can build things like pgrust or other projects that would've been too large to really be feasible in the past and, if you do a reasonable job with testing and benchmarking, that stuff can actually be good-enough quality to use.

If I were writing it, I would say "we can be more ambitious with the software we build" and not "we should", but Malis has been casually chatting with me when he's said this, so maybe he would say the same in an actual post; don't read too much into should vs. can here. What's interesting to me is how capabilities have advanced such that we can do a lot more.

Just for example, after hearing that OpenAI was going to use Cerebras for their SOTA models and not just fast-but-low-quality models like 5.3-Codex-Spark, I looked at where time on my computer would go if I was using a SOTA model, but 10x to 100x faster; some things that were already sometimes a bottleneck that would only get worse with a faster model were:

Ripgrep
Compiling Rust
Syscall and filesystem overhead

At the level of a "works for me" project, these are all things that can seriously be improved. I don't have much spare time at the moment but, even so, I built this regex engine that can be tweaked to be faster than other general-purpose regex libraries on any particular workload I care about , this ripgrep fork that uses the native code compiler from the regex engine and is faster for my codex ripgrep workloads (of course a text index is the better solution, but I've already worked on text indexing and this was a "just for fun" project where I wasn't trying to do the optimal thing), and a Rust that sped up builds for my projects (huge improvement for cold builds, moderate for warm, limited by wanting to avoid forking the Rust compiler front-end). For syscalls and filesystem overhead, just switching development from Mac to Linux improved this a lot, and of course this is another thing that can be sped up a lot as well, especially when agents are hammering lots of small filesystem operations (it's not uncommon to see my machine waiting on filesystem ops because the standard OS filesystem interface wasn't designed with modern disk performance in mind).

For someone like me who doesn't know anything about regexes, string matching algorithms, compilers, interpreters, etc., this set of projects would've taken a year or more to get to "works for me" quality. Instead, this was a low single-digit number of hours of my time. If I wanted to make any of these things meet a "useful product or open source project" quality bar, that would be a lot more work ⁰ , but it's still pretty incredible how much this process is sped up.

Another project I previously mentioned was this Azul AI which is superhuman at matched time controls . When I did that (with GPT-5.1/5.2), with zero AI knowledge, it took about 5 hours of my time to get something superhuman, and about 20 hours of my time to become what appeared to be the strongest AI at the time, including being stronger against humans than this AI that was used to cheat on Board Game Arena . Gabriel Cangussu recently built an AI that demolishes my AI, and AFAICT, it took him substantially less time than my AI took me. From talking to him about it, one key difference is that Fable 5.1 and Opus 5.5 have a much better understanding of board game AIs. When I used GPT-5.1/5.2, pretty much every suggestion they had was wrong and I had to do a lot of steering to get things to be remotely reasonable. If I had GPT read a codebase or a paper to implement relevant techniques from the paper, it would fail. If I read the paper myself and named a technique, it would say it did the technique, but it would generally do something that superficially looked like the technique but wasn't the actual technique until I issued some corrections. When the model is that far from being able to do the right thing, if you have no background in the area, it's fairly time consuming to check if the model did the right thing since you have to learn enough about what it's supposed to do to be able to check that it did what was claimed.

When I did that project, I said to friends that I didn't think the state models were in could last. It seemed impossible that they wouldn't get good enough to be able to read a paper and implement the techniques soon, and it seemed like they should also be able to pick out codebases and papers to crib from as well. From my experience messing around a bit with Fable 5 and Cangussu's experience with Fable 5.1 and Opus 5.5, that seems to have happened, which is a huge time saver for someone like me who doesn't know anything about board game AIs (I know a little bit now, but still less than any real AI researcher) ⁴ .

For any particular domain, like board game AIs, you can say, "who cares? Board game AIs don't matter", but I've found this increase in capability to be true in quite a few different domains. Just for example, I did this toy eval of verification and test techniques with GPT-5.6 Sol implementing zstd on medium and xhigh . I haven't had time to write it up, but when I published that post, I also re-did the evals with GPT-6 Astra. 6 Astra was so good that I had to find different evals because models had advanced too much. For zstd, 6 Astra succeeds at passing all of the registered tests more than 99% of the time across all conditions, even the ones that significantly impair performance, like using TDD (and, BTW, it does it more cheaply as well, taking about $1 to implement zstd). I ended up using the IMAP RFC, which 5.6 Sol couldn't do effectively, and Pandoc, which is a pretty major thing to implement as it needs to be able to read and write many different formats ⁵ .

BTW, when people have said they used the new model and everything just works, software is solved, etc., I haven't found this to be true at all. It's true that there are a lot more things the newer model can one-shot, where things basically just work, but this just means that I end up working on more ambitious things where models still struggle ⁶ . I'm more productive and can work faster , but I find that, in terms of what I'm doing, I get farther from "it just works" with each more capable model because the gap between what the model can verify effectively without significant handholding and what the model can implement has been increasing ⁷ . All of that is a long-winded and less eloquent way of saying: we should be more ambitious with the software we build.

Thanks to Laurence Tratt, Yossi Kreining, Alex Kolovsky, and Michael Malis for comments/corrections/discussion.

I've had this note on my recent posts, which also applies to this one. In order to get more posts out, I'm trying to crank posts out in half an hour and not review them much. This definitely means less well-supported posts. If I were writing this in my standard style, I would've had comprehensive benchmarks for all of my projects that I mentioned. Instead, I did a quick comparison that satisfied my curiosity and am writing this up without rigorous benchmarking, and there are maybe twenty or thirty things in this post that I'd like to do but haven't done.

Appendix: we should be less ambitious with the software we build

Here's a comment from Yossi Kreinin, quoted (with permission, of course):

If you publish this I will publish a response explaining that for most people they should be less ambitious with the software they build with AI or they'll experience abject failure. I think a lot of the problems don't lend themselves that well to "agentic loops" since you don't have clear pass/fail criteria, and even when you do most people have trouble reasoning about giant black boxes which they can impose constraints on but can't understand the innards of [I include myself in this set.] This is a little bit like microservices I guess, where some people both need it and are very good at using it but likely for most people, they need it less and can't use it well at all. I sort of envy the ones who should and actually can be this ambitious about the software they build of course; not saying you shouldn't be more ambitious at all but moderating said ambition is a big part of handling the current situation for most I think

I have a similar thought about " there's no reason for software to be slow " BTW; in many cases, if you use AI to speed up some flow, you will add a bunch of messy code that will be overfit for the use case you tested on and will neither generalize, perf-wise, for all the use cases you should care about, nor will be maintainable upon future changes. If you know what you're doing and you understand how the system should be decomposed into parts and when it makes sense to go all-in on optimizing some part or a combination of them working together and how to properly benchmark it, etc., then things are great, but if for instance you have a manager who thinks there's no reason for software to be slow and he pushes people to use AI to make random parts of the software fast... Run for cover

My feeling is that, overall, the situation here is a bit analogous to the discussion here about why I don't like when people talk about how AI gives a 100x or 1000x productivity increase . There are some things that are sped up by a very large factor, easily over 1000000x. And some things don't currently get sped up at all. If you do exactly what you would've done five years ago, but with AI, the speedup is fairly poor because of Amdahl's law . But, in the general case, you can choose what to speed up and if you're looking for things that are productive to do, this often seems to involve things that were previously too expensive to do.

And, I think that you can often set up systems that have some kind of self-checking property even when most people wouldn't. This discussion of the implementation of Guards of Atlantis 2 is an example of that. It's a poor choice for an AI project because the official rules are a mess of ambiguous and contradictory English text (it's probably the game I've seen humans misplay at the highest rate, and the rules are confusing enough that the designer has often changed their mind about what their own rules mean despite continually maintaining that the rules are perfectly clear and one can play the game by simply reading the rules as written). If you try to produce a working set of rules in a naive way, AI won't really help with this (although it can speed up implementation once you have a clean spec), but for that, I was able to set up some kind of janky set of consistency checks between all of the inconsistent explanations of the game rules, which got fairly close to a correct set of rules (approximately as close as what someone else did with much more human effort and less of a systematic approach), which was enough to compare it to someone else's implementation and get a working set of rules. This setup did cost a lot more in tokens than a more manual approach. But it was "only" a month or two of the $200/mo OpenAI subscription with GPT-5.1/5.2, which is a lower cost than the cost in time of me sitting down and writing a clean spec for the game, i.e., a copy of the rules that is actually consistent and correct.

I feel like a lot of problems are in something like this class of problem, where it's possible to set up some kind of at least partially self-checking setup that a human can spend a small amount of time on. This also feels analogous to the situation about software testing at large, where (before coding agents) I found fuzzing and property-based testing to be highly effective. For most domains, people told me some kind of reason this kind of testing wouldn't work, but when I've tried these techniques with all of the domains people told me these techniques don't work for, they work fine. They're somewhat more work to apply, but they're still applicable and, AFAICT, more efficient and effective than writing traditional unit tests.

Part of the gist of Yossi's comment is that people aren't doing this kind of thing. Considering how many more bugs I see now than I used to, e.g., the last time I opened up the web chat for a big AI lab, I ran into a double-digit number of bugs within one minute, it's hard to say that Yossi is wrong. But, to that point, I still have my original opinion. Just because other people are pumping out vast quantities of barely working slop doesn't mean that you have to do the same thing.

Appendix: a few "random" examples

The examples in the body of the post I gave for things I've done are tooling things I never would've done. There are a lot more things like that as well since it's so easy to build "works for me" quality tooling that's intended solely for me. I do think it's possible to go further than is productive, e.g., Steve Yegge wrote a lot about Gas Town and how productive it was, but when he was building his next agentic framework, he noted that he never used Gas Town to successfully build anything other than Gas Town , people were into Ralph Loops for a while even though, when I tried comparing them, they seemed worse than just doing the naive thing I was doing at the time, normal loops with context where you sometimes clear context as appropriate instead of doing it by default at the completely arbitrary point of when a single turn is completed , etc., so I've tried to stick to things where the impact is pretty direct. Besides the obvious reason this has been effective, the dramatic change in model and harness capability over time means that what tooling it makes sense to build changes very quickly, so spending a lot of time working on any particular tool that will be suboptimal at best and quite possibly obsolete in three months doesn't really make sense.

And, for a lot of my personal tools, my assumption is that an AI lab will obsolete anything I make in short order. For a very silly example of this, I have a tool that was useful since the release of GPT-5.6 Sol that restarts codex when it finds a memory leak. Presumably, OpenAI will fix this at some point and this tool will become worthless. For a slightly less silly example, take the Rust interpreter I had some agent build. For token-budget reasons, a lot of things that ought to be done for a very high-performance interpreter haven't been done.

For example, the interpreter doesn't modify the actual Rust front-end compiler to make it easy to take updates; performance would be much better if I just made changes to the Rust front-end, but I don't have the token budget to maintain a compatible fork of the Rust compiler, but this shouldn't be a problem for OpenAI. OpenAI spent $10B+ on getting access to Cerebras while also preventing Anthropic from having access.

Funnily enough, for coding, on many tasks, if you actually use one of their SOTA models and compare it to what you get from Anthropic, the actual speedup isn't all that large because of time spent on things like compiling Rust. Given that they were willing to commit $10B+ on this, it stands to reason that they'll eventually do a better job at speeding up the relevant tools than anyone could feasibly do outside an AI lab, so there's not much point in spending too much effort on this (this could arguably be untrue if non-coding tasks are expected to completely dominate future OpenAI revenue in the short term, but even then, given what they pay for tokens vs. what I pay, it still seems like it would make sense for them to speed a lot of these things up given that I could do it outside of a lab; perhaps there's some kind of argument like, if you have access to their usage data, there are so many more important bottlenecks that this one doesn't make sense to prioritize, but it still seems like it should make sense for them at some point even if it doesn't fall into the top 100 bottlenecks for Cerebras-enabled coding agents).

Another kind of thing that one might not call ambitious, but that speaks to the kind of thing that's possible, are games that I've made. There are games I've thought about and wanted to make that I don't think are generally enjoyable enough that they make sense for a real audience, but that I've wanted to play. For example, ever since reading David Gerrold's Star Wolf books in the 90s, I've wanted to play a game that implements combat as described in the books, which is a sort of like submarine combat. At least among realistic war games, this genre is extremely niche because almost everybody finds naval combat boring, and submarine combat is a particularly boring subgenre of naval combat games, so this doesn't really make sense as a money-making game, but it's so easy to implement games that I had an agent implement the game so I could play it for an hour or two. I never would've spent 10-20 hours implementing a game so that I could play it for an hour or two, but I'd spend 5 minutes. I've also previously mentioned implementing a game with the same rules as Scout and Guards of Atlantis 2 . I was never going to take the time to implement these games by hand just so I have a way to play with my friends on the occasions where we can't get together in-person, but I'm happy to have an LLM bash these things out. And, of course, for people who want to make games with a wider audience, there's a game renaissance going on right now due to coding agents. It's pretty amazing how many interesting and creative games are being made now that having programming skills and the time to put them to use is no longer a bottleneck for making games.

Data analysis is another thing where the productivity multiplier can be very high and I can do all sorts of things I never would've done. As I've mentioned in a number of my last posts, I have way too many of these projects to really be able to write them up, even when attempting to write very quickly and bash out posts in half an hour apiece.

When I've talked to people about their one-off tooling, there's a lot of fun stuff people have done. For example, here's something Peter Geoghegan mentioned a month or two back:

I had Fable implement a custom Neovim Lua function that formats code according to my very specific preferences. This is both something I don't want to maintain myself and inherently a Rube Goldberg device. Theoretically I could accomplish the same outcome in a principled way by patching clang-format, but my requirements are so exact that I think that approach would never be satisfactory.

We use a tool call pgindent, which is our fork of bsd_indent. You can approximate the same formatting rules using clang-format, but that isn't good enough. If I commit something that isn't perfectly formatted/indented according to pgindent, I get a CI failure that I'm expected to fix quickly -- something I'd really prefer to avoid ...

Practically speaking, getting slick, clang-format-style formatting that avoids nag emails about misindented code requires a total architectural mess (I also don't want to spend the time developing a principled approach, but that's really a separate issue). The function allows me to effortlessly format a given block of code from Neovim, similar to the clang-format LSP integration. I'm being unreasonably fussy here, of course, but I find that LLMs allow me to be this exacting about tooling.

The function performs multiple passes: an initial formatting pass using clang-format/clangd, and a separate formatting pass using pgindent. I need it to do both because clang-format handles some cases correctly that pgindent misses. This is brittle because I only want to format the code within a range of lines selected via block visual mode (I don't want to run clang-format on code not added by my patch). This conflicts with pgindent's design; it can only format whole C files.

Figuring out which relevant subset of the temp whole file buffer needs to be copied back into my working buffer is nontrivial. The initial line range I selected doesn't directly map to the affected C AST elements. So the function uses tree-sitter to intelligently delineate the exact subset of the temp indented C code that needs to be copied back. The rules need to be fuzzy in exactly the right way for cases where my selection straddles the same block of code. There are a bunch of edge cases.

Another complicating factor is that pgindent relies on a typedef file generated with objdump to identify types; without that file, the formatting looks wonky. The formatting function dynamically generates any extra typedefs from clangd, for that one file, so I don't have to worry about a stale typedef file (I might have created a new struct seconds before running the formatting tool, I don't want to run objdump on the whole postgres binary each time, that'd blow up latency).

This appears to work perfectly. The latency is totally acceptable. I have only a vague understanding of how all this works, though. I don't even know Lua. This will probably continue to work, even as further changes are made to our fork of bsd_indent that somewhat alter how code is formatted, which happens from time to time.

I'm skeptical of the saaspocalypse. But I do think that LLMs are writing a lot of useful software that would have been insanely uneconomical to write any other way. There's an interesting small subset of software that'd be impossibly tedious for any human to maintain, relative to the value that it creates.

I also caught with Malis while writing this and found out about all sorts of fun stuff he's been doing. It's enough that writing it all up in detail could be its own post, but one fun thing is that, the last time I taked to him about pgrust verification, he mentioned using Kani to verify some parts of the code. He's since switched to Lean and has been using Lean to verify things that are too complex to do in Kani. This would be another topic for another post, but I wonder why people have generally settled on Lean for LLM-driven proofs (as opposed to, say, ACL2 ). I wonder how Lean would look in an updated version of this theorem prover comparison , or if someone were to run a theorem prover eval that's analogous to this language eval .

Of course, you can think of plenty of examples out of AI labs, such as a mid-sized team Anthropic building an internal replacement for GitHub as well as some other tooling in five months

A team of seven people built both Scion and Antique (our code review tool, which we could easily write a whole other blog post about), not to mention half a dozen related systems, and fully migrated to them in five months.

I think these kinds of examples are interesting and they point to where the industry will be in the not-so-far future, but what you can do with unlimited tokens, while relying on other infrastructure and tooling built with unlimited tokens doesn't tell you much about what you can accomplish today without unlimited funds. Projects like pgrust as well as projects that people I know do in their spare time (of which I've probably mentioned something like 1%—there are just a lot of these, like David Turner creating an skipper for podcasts that's "works for me" quality that works better than anything he could find, the spare-time projects Dennis Snell mentioned here , etc.) are more representative of what you can do today.

Small Programs and Languages

Hacker News

ratfactor.com

2026-10-24 17:44:23

Comments...

Original Article

Page started: 2025-06-02

Page published: 2026-07-28

My Implementing a Forth article got some great feedback, particularly around the subject of tiny Forth implementations. (And it was an excuse to list some of the tiniest Forths I’ve seen.)

I know I’m not alone in seeing the appeal of tiny Forths, tiny languages, tiny programs, and just small stuff in general. What’s up with that, anyway?

The appeal of tiny programs

Tiny programs are approachable.

If I see that something is 200 lines of code, I’m much more likely to read it than if it’s 2,000 or 20,000 lines.

What’s more, if it’s a program that does something interesting in 20 lines when I was expecting 2,000, then I’m going to be very, very interested to read those 20 lines!

When I was researching DOM diffing libraries prior to creating RetroV , one of the repos I looked at was ijk by Luke Jackson.

I was pretty used to looking at fat JavaScript libraries at that point, so when I cracked open the source file for ijk, I was really surprised. Here’s the source: index.js (githubusercontent.com).

Just 25 lines! I was instantly intrigued.

More recently, one of the responses to my aforementioned Forth article was Philippe Brochard with a 46 byte "Forth".

46 bytes!

It’s so small, I can just put the hexdump right here:

50b8 8e00 31d8 e8ff 0017 003c 0575 00ea
5000 3c00 7401 eb02 e8ee 0005 0588 eb47
b8e6 0200 d231 14cd e480 7580 c3f4

Sure, very few people jump at a chance to read raw machine code. But that’s exactly my point. Something this small doesn’t feel so scary, right? I mean, 46 bytes. If you put the effort into it, you know you can figure out how it works eventually.

This next one almost serves as a counter-example because the code is so dense and frightening, but I can’t help mentioning it anyway.

One of my favorite software stories is Roger K.W. Hui’s Appendix A "Incunabulum" from An Implementation of J in which he describes Arthur Whitney writing an array-based language interpreter,

"…on one page and in one afternoon — an interpreter fragment on the AT&T 3B1 computer. I studied this interpreter for about a week for its organization and programming style…"

Hui can list the entire interpreter in the appendix because it’s just that single page, 122 lines of incredibly cryptic C, which you can view here:

I haven’t personally tackled that puzzle yet, but it’s in my unwritten list of dense computer things that I would print out and take with me if I suddenly found myself cast out of society and forced to go live alone up on a mountain or something.

(By the way, J is in the family of array languages which include APL. If you enjoy brevity, cryptic programming puzzles, and high performance numerical computing, these languages have got you covered!)

Update July 2026: Speaking of Arthur Whitney, Alex (alexalejandre.com) sent me a link that I knew I’d have to add here. Check this out: https://fall.tr/kos

It’s a transcript of a Geo Carncross talk describing an operating system, kOS, featuring Whitney’s k array language, kdb database, and a GUI and window manager in a 90 Kb bootable image. Individual source code stats are just as impressive (such as 60 lines of C for the aforementioned GUI and window manager). And apparently kdb is 100 lines of C? Is that right? Even Whitney C, that’s still impressive. Now I’m even more intrigued by kdb than ever! And if any of that seems interesting, you’ll definitely enjoy the article Impending kOS (vector.org.uk).

Something else that would certainly need to be in the collection I take to that lonely mountain would have to be The Most Beautiful Program Ever Written , according to the title of a talk by William Byrd. Spoiler alert: It’s this Lisp interpreter in Lisp:

(define eval-expr
  (lambda (expr env)
    (pmatch expr
      [`,x (guard (symbol? x))
        (env x)]
      [`(lambda (,x) ,body)
        (lambda (arg)
          (eval-expr body (lambda (y)
                            (if (eq? x y)
                                arg
                                (env y)))))]
      [`(,rator ,rand)
       ((eval-expr rator env)
        (eval-expr rand env))])))

Recreation or fundamental truths?

Now, we all know that code golfing (wikipedia.org) is a programmer’s recreational game, and just for fun, right?

But is any of this actually useful?

I say yes. And I’ll go one step further: They are meaningful .

When you see a ray tracer that fits on a business card (fabiensanglard.net), it makes you realize that a ray tracer is something that can fit on a business card !

That’s an actual fact about the minimum complexity of ray tracers.

"…the length of a shortest computer program (in a predetermined programming language) that produces the object as output."

(I learned about Kolmogorov complexity in a book about Kurt Gödel and it was my favorite thing in what was otherwise a pretty dry and depressing book.)

The meaning I get from this is that code golfers, for the benefit of the whole human race, produce versions of programs that represent the minimum complexity of those programs. Way to go code golfers!

What do we know about the fundamental complexity of the Lisp programming language?

That’s a fact about Lisps with garbage collection. When you strip everything else away, you can get the essentials down to 436 bytes!

I take comfort in this because that means the concept can be boiled down to this hand-held size. And that means I can probably fit it in my head.

Thanks to Frank Force, we know that a 3D browser game can fit in 2Kb of (insanely compressed) JavaScript source: A 3D game in 2Kb of JS (frankforce.com)

And we haven’t even scraped the surface of what the demoscene has to offer for computers going back to the 1980s. Here’s a good place to start: https://demoscene.assembly.org/

Mini-things are fun and useful and meaningful.

My point here is that you don’t have to actually study the intricate clockwork puzzle of a miniaturized/golfed program to benefit from it. The miniature simply serves to prove that the concept can fit on a business card and it can fit in your head. Go ahead and find a readable version to study instead. (The miniature will likely have many things to teach, but some of them will be about how to make miniature programs.)

Small languages

Small programs are interesting. But I’m also interested in small programming languages.

Generally speaking, the smaller the language, the less expressive it is.

One of the most well-known, least expressive languages is assembly.

Assembly languages are very syntactically and conceptually simple. There’s not much language at all: it’s mostly a rigid sequence of opcode mnemonics. Even with macros, writing in assembly is mostly about understanding the puzzle of a particular CPU’s instruction set architecture, or ISA. (You can prove this by comparing the syntax of assembly for CISC and RISC processors. The puzzle is totally different, while the language remains practically unchanged.)

An honorable mention must be made here for SNOBOL , which is kind of like assembly language both for the rigid syntactic reasons listed above and also because it presents a similar control flow challenge. Like a CPU, it only understands jumps and call/return. (In every other way, SNOBOL is wildly different, being a string matching and replacing language. It’s weird and fun and highly effective.)

Moving on to syntactically tiny "high-level" languages, these three are brilliant:

Forths win just about any "smallness" contest. The only syntactical construct is the space character. Forths are mind-bendingly flexible and powerful in a way that is downright disturbing.
Lisps , (especially Scheme?), have small core languages with very simple syntax and enormous expressive power and flexibility.
Tcl deserves to be mentioned with Forth and Lisp. Tcl is wild because everything is a string in a way that is hard to appreciate at first. You can construct your own language in Tcl just as you can with Forth or Lisp.

Forth, Lisp, and Tcl only require you to understand a few core ideas and give you limitless power in return. You could fit the syntactic core of these languages on an index card or less.

And yet, to wield these tools effectively requires a massive shift in thinking if you’re used to "normal" Algol-like procedural languages.

So how about something that is both small and simple and doesn’t require a blood sacrifice?

I think the Lua programming language fits the bill. Check out how small the core language is:

I’ve got the printed book version of this document and it’s a thin book! The Lua language is covered in the beginning and it is just 27 pages. 27 pages! I have game manuals longer than that.

The C language is pretty small. I don’t think it’s super easy to program effectively and safely with C, but there’s no denying it’s compact and pretty expressive for its size.

Newcomer Zig is C-like. But I think it’s actually quite large and you need to know a lot of it to use it effectively. (I’m also a fan of Zig and think it’s totally worth it . The size is there for a reason.)

JavaScript has a core language that is quite small. Probably on par with Lua, actually. Functions, arrays, and objects (used as dictionaries) are pretty much all the JS I use and I like it that way!

As with the natural human languages, the trade-off with a bigger programming language is, hopefully, greater expressivity.

Small or expressive. Which way should you lean?

In a wonderful talk by David Ungar (wikipedia.org) titled Self and Self: Whys and Wherefores , he laments the mistake of Self’s multiple inheritance:

"It’s far better to make a system a little too simple so a person has to write extra stuff, even write it twice with a comment that says, 'Look over here,' than to have a system that acts in strange ways and nobody can understand why. So, simplicity trumps expressiveness."

Got that? Here’s the bullet from the slide to help you remember:

snippet of a slide that reads Simplicity trumps expressiveness

I think small languages can also be fairly expressive, but only with very, very careful design. Recall Forth, Lisp, and Tcl.

Microworlds: The idea of small, self-contained, learnable programming environments also has a David Ungar connection I discovered while watching his talk. See "ARK" on my Microworlds card. (Smith and Ungar co-created the Self language (selflanguage.org), which is a notable milestone in programming and still under active development to this day.)

Languages which come with full-featured interactive IDEs are obvious potential microworlds.

But I also think that traditional text file-based programming can give you the microworld experience as well. For that, a language needs high quality documentation that installs alongside the compiler/interpreter. And it should strive to have error output that can be understood by beginners, including explanations of what went wrong and hints for how to fix it or or where to find more information.

Libraries: Another easily overlooked aspect of a programming language’s apparent size is its "standard library" of functions, data structures, and methods.

I think function libraries are subject to the exact same size versus expressiveness challenge.

For example, learning the Ramda (ramdajs.com) functional programming library for JavaScript was very much like learning a new programming language and I never managed to learn all of it. The composability of Ramda and the consistency of its curried functions was extremely eye-opening to me. My advice: A little bit of Ramda goes a long way!

The feels: Concision in our tools has a certain quality that goes beyond utility. Little things just spark joy , you know?

Why are small things so delightful?

The appeal of tiny things in general

I’ve always had a fascination with miniatures, dioramas, and tiny scale models.

I know I’m not alone!

Stephanie M. Langin-Hooper , author of Figurines in Hellenistic Babylonia writes in Tiny Things and Why We Love Them (cambridgeblog.org):

"…the act of shrinking a life-size thing to a smaller scale has an influential effect. The object is now cute, more accessible, more delicate, more 'squee'. It is also more helpless, and thus controllable – comforting and completely non-threatening due to its diminutive size.

Which is exactly the reaction I have when I see a tiny bit of code that does something useful.

Also, I’m super okay with "controllable" in the context of a computer, but the feeling of that paragraph changes a bit if we’re talking about, say, dolls.

Small scale helps make "big" things approachable:

"What might be threatening to think about in the real-scale world can be more manageable and more conceivable in miniature."

Small things, "allow low-stakes experimentation," which is why we often build tiny models of things before we scale them up.

Simon Garfield , author of In Miniature: How Small Things Illuminate the World has many of the same answers. He writes in Small world: Why we love tiny things (theguardian.com):

"The answer lies in our desire for mastery and elucidation. The ability to enhance a life by bringing scaled-down order and illumination to an otherwise chaotic world – a world over which we may otherwise feel we have little control – cannot be overvalued. […] At its simplest, the miniature shows us how to see, learn and appreciate more with less."

I think this is a big part of what I get out of Assembly Nights with the small scale and orderly logic and internal consistency. Unlike the vast, fathomless Real World, an offline computer is a fantasy place where I can believe I could understand everything if I just tried hard enough for long enough.

"The satisfaction of observing small things becomes a desire to make small things, and both stages address the human need for comprehension and order. We live in a huge and doomy universe, and controlling just a tiny scaled-down part of it restores our sense of order and worth."

I’ve been studying computer history for a little while and I’ve only scratched the surface. But one of the things I’ve been finding is that a lot of the "big" stuff in our field are just accumulations of lots of "little" victories as individuals have solved "little" problems in new and different ways.

"We create small universes in which we may bury ourselves to the exclusion of all else. Blocking out real life for a while – always the prerequisite of the dedicated domestic hobby, from doll’s house modeller to jigsaw enthusiast to adult book colourist – may be contemplative, meditative, blinkered and essential. The people crouching over tiny details as if the world depended on it are only doing it because their world does depend on it."

The Importance of Limitations for Creativity and Learning

Hacker News

ratfactor.com

2026-10-24 17:42:47

Comments...

Original Article

A big-budget movie can be clever and amazing. But I think that requires the style and restraint of the director. Otherwise, you can just make the first thing that comes to your mind - which is probably going to be the most obvious thing to come to your (and your audience’s) mind!

But a small-budget movie has to be clever to be any good at all. If you’ve got $300 for props, you’re going to have to come up with something different…and that can lead to surprise and delight because you did something unexpected with the material available.

Again, big budget stuff can be surprising and delightful, too, but I think that requires a ton of willful determination on the part of the artists involved. That’s might be why the successful ones can be pretty forceful personalities. (Not that I think artistic genius and being a nasty person need to go hand-in-hand either. I’m not promoting that idea here. I don’t think that’s the same thing.)

MKBHD’s Duo Review

Daring Fireball

youtu.be

2026-10-24 16:47:28

Marques Brownlee thinks the lack of Face ID will be the biggest gripe. I agree. And I love his central framing for the review: that the Duo is extremely polished around the edges (figuratively, but also true literally) but rough in the middle. But he spends more time griping about third-party apps ...

Original Article

Steal My Bitcoin

Hacker News

stealmybitcoin.com

2026-10-24 16:30:31

Comments...

Original Article

0.00 hours without a successful hack

There is a bitcoin key hidden on this server worth about $500 .

It is accessible to the PHP user account through the print-flag binary.

This PHP version was selected from before the PHP2SHELL CVEs were released.

First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org .

No Signs of AI Payoff Outside the Tech Sector

Hacker News

www.apollo.com

2026-10-24 15:47:19

Comments...

Original Article

This presentation may not be distributed, transmitted or otherwise communicated to others in whole or in part without the express consent of Apollo Global Management, Inc. (together with its subsidiaries, “Apollo”).

Apollo makes no representation or warranty, expressed or implied, with respect to the accuracy, reasonableness, or completeness of any of the statements made during this presentation, including, but not limited to, statements obtained from third parties. Opinions, estimates and projections constitute the current judgment of the speaker as of the date indicated. They do not necessarily reflect the views and opinions of Apollo and are subject to change at any time without notice. Apollo does not have any responsibility to update this presentation to account for such changes. There can be no assurance that any trends discussed during this presentation will continue.

Statements made throughout this presentation are not intended to provide, and should not be relied upon for, accounting, legal or tax advice and do not constitute an investment recommendation or investment advice. Investors should make an independent investigation of the information discussed during this presentation, including consulting their tax, legal, accounting or other advisors about such information. Apollo does not act for you and is not responsible for providing you with the protections afforded to its clients. This presentation does not constitute an offer to sell, or the solicitation of an offer to buy, any security, product or service, including interest in any investment product or fund or account managed or advised by Apollo.

Certain statements made throughout this presentation may be “forward-looking” in nature. Due to various risks and uncertainties, actual events or results may differ materially from those reflected or contemplated in such forward-looking information. As such, undue reliance should not be placed on such statements. Forward-looking statements may be identified by the use of terminology including, but not limited to, “may”, “will”, “should”, “expect”, “anticipate”, “target”, “project”, “estimate”, “intend”, “continue” or “believe” or the negatives thereof or other variations thereon or comparable terminology.

Listen and read USA nuclear forces Emergency Action Messages, heard on 11175 kHz

Hacker News

missileer.watch

2026-10-24 15:43:27

Comments...

Original Article

MISSILEER.WATCH

ZULU · HFGCS 11175 kHz USB

LATEST EAM · copied off air

WAITING FOR FEED

NET STATUS receivers

WAITING FOR FEED

No tracking cookies. Signing in is optional; it sets one cookie, only to keep you signed in. This page reads two public files, archive.json and status.json , and Cloudflare Web Analytics counts visits without cookies. Everything we keep, why, and how to delete it is on the privacy page . Times are UTC (Zulu).

Our recordings and decodes are released under CC0 1.0 (public domain dedication); attribution appreciated: missileer.watch.

The Goose Programming Language

Hacker News

aardappel.github.io

2026-10-24 15:27:41

Comments...

Original Article

A memory-safe systems language with no heap allocator, garbage collector, or lifetime annotations. In this repository's benchmarks, Goose runs faster than C++ and Rust while using less memory.

Tutorial · Reference · Specification · Packages · Samples · Benchmarks · Standard library

Goose has syntax familiar to C and Rust programmers, but there is no heap . Every dynamic value lives inline on a data stack managed by the compiler. Growth advances a pointer, and memory is freed when its scope ends. The language's type and lifetime rules make this memory model safe to use.

Why Goose

Faster than C++ and than safe Rust, while memory safe. Over sixteen benchmarks Goose runs at 3.3x the speed of idiomatic C++, 1.16x hand-optimized C++ and 1.12x the best safe Rust, on 1.9x, 1.3x and 1.2x less memory ( results ). These gains come from Goose's data layouts and memory model.
No allocator, no GC, no reference counting, no destructors. Memory is a handful of data stacks that the compiler assigns statically. Freeing a million-element structure is one store, however deeply it nests.
Growth preserves references. A reference into a growing array stays valid for as long as the array does. You keep typed references where C++ must reserve and safe Rust uses u32 indices in the corresponding benchmarks.
Memory safe with zero annotations. No lifetime syntax, no aliasing or exclusivity rules, no unsafe . The compiler infers what every reference is rooted in and rejects references that could outlive their owners.
Nested data stays inline. A string, an array of strings, a record with variable-size fields and an array of those records are each one contiguous block with no pointer in it. A record that is 160 bytes and an allocation in C++ is 29 bytes and none in Goose.
Enums that cost what they hold. Variable-mode ADTs give each value its own variant's size rather than the largest one's: 4x less memory and 2x the speed of a Rust enum on the benchmark that exercises it.
Links narrower than pointers. A relative reference stores a typed, checked link as a 1, 2 or 4-byte offset. Structures built from them are position independent, so your data structure is already its file format: saving is a write, loading is a read plus a verification pass that rejects hostile bytes.
Everything is built in place, guaranteed. A value is constructed at its final destination through any depth of calls. items.push(parse(line)) writes the parsed record straight into the array, and returning a growable array by value costs nothing.
Returns across multiple calls. return err from load returns from a function any number of frames up, statically checked, with no unwinder, no Result type and no ? on every call.
Threads that share nothing. A worker is compiled as a separate program with its own memory, and flat values cross typed queues as a memcpy . Data races, locks, atomics and memory orderings do not exist in the language.
Generics and higher-order functions with no overhead. An untyped parameter is generic. Function values are compile-time entities, so xs.filter() { it > 0 } compiles to the loop it looks like and builds its result straight into its destination.
Plain C in, plain C out. Goose compiles to one C file, so it runs wherever a C compiler does and calls C directly through extern fn . The bundled TinyCC backend compiles and runs a program in-process, with no build step.

The tutorial walks through all of this by example, the reference covers the whole language topic by topic, the specification has the exact rules, and the benchmarks have the numbers, losses included.

Features

This section focuses on what distinguishes Goose. The tutorial explains these features in more detail, and the samples show them in thirty-one complete programs.

One memory model: stacks, and scope exit is the free

A program has the native call stack, static data and N data stacks, where the compiler works out N. A data stack is a large address-space reservation with a bump pointer, and there is no other memory. At most one resizable value is live per stack and it is always on top, so growth never moves anything and never checks a capacity. All of this is proved at compile time; the runtime tracks only the bump pointers.

for round in 3 {
    var scratch: u8[>..] = [];                        // grow-only: growth is a pointer bump
    for i in 100000 { scratch.push((i % 256) as! u8); }
    print("round ", round, ": ", scratch.len, " bytes");
}                                                     // the free: one store to the stack top

Nothing moves, so references survive growth

struct Item { id: i32, weight: f32 }

var items: Item[>..] = [];
let first .= items.push(Item { 1, 0.5 });             // a reference to element 0
for i: i32 in 2..1000001 { items.push(Item { i, 0.0 }); }
first.weight = 99.5;                                  // still valid, a million pushes later

push returns a reference to the new element, so a program can link elements while building the array. A vector<T> or Vec<T> may reallocate and cannot provide this guarantee. Stable references account for several benchmark gains.

Safe references, no annotations

Every reference and slice has a static root : the variable that bounds its target's lifetime. A reference must not outlive the variable that owns its target or access that target through an incompatible type. The compiler infers roots and specializes functions for them, so no annotations are needed. There are no aliasing or exclusivity rules. When a lifetime check fails, the error names the reference's root and its destination:

fn longest(a: u8[:], b: u8[:]) -> u8[:] { if a.len >= b.len { a } else { b } }

var outer: u8[>..] = [];
var w = outer[..];
{
    var inner: u8[>..] = [];
    format(inner, "inner text");
    w = longest(outer, inner);     // error: storing a reference rooted at inner,
}                                  //        which does not outlive the destination (§9.2)

A slice T[:] lets a function accept a range from any array kind without copying its elements. For example, split returns slices into its input, and a dictionary keyed by u8[:] stores views of strings rather than copies.

Nested data stays inline

There is no single array type. There is a family that differs only in what happens to the size, and every member is [metadata][elements...] , inline and packed, never a pointer to an element block:

Spelling	What it is
`T[k]`	fixed size, known at compile time
`T[]` , `T[varint]`	sized at construction, frozen after; a fixed or variable-width length
`T[..k]` , `T[..]`	capacity inline; grows and shrinks within it
`T[>..]`	grow-only : the workhorse; references into it stay valid
`T[>..<]`	grow-shrink : stacks, queues, heaps

Strings are just u8 arrays: u8[>..] is a builder, u8[] a finished string stored inline in whatever holds it, u8[..16] a small string inside a struct, u8[:] a view. A struct may contain variable-size parts, and they sit inline in declaration order, so a record is a run of bytes with nothing indirect in it:

struct Item  { sku: u8[varint], qty: varint, cents: varint }
struct Order { id: varint, customer: u8[varint], items: Item[varint] }

var book: Order[>..] = [];
book.push(Order { id: 1001, customer: "alice",
                  items: [Item { sku: "SKU-441", qty: 2, cents: 1999 },
                          Item { sku: "SKU-7", qty: 1, cents: 500 }] });

That order is 29 bytes and 0 allocations . As C++ std::string + std::vector<Item> it is 160 bytes and 1 allocation, and as Rust String + Vec<Item> 153 bytes and 4. A whole order book is one array that streams through the cache. The price is that an array of variable-size elements is sequential: you can iterate it but not index it (unless you keep a second array of references into it as an index).

Enums in two sizes

Algebraic data types are the only dynamic polymorphism: no inheritance, no vtables. Every ADT can be stored two ways, chosen at the point of use. Fixed mode ( Shape ) is a tag plus room for the largest payload, indexable and overwritable. Variable mode ( Shape.. ) gives each value exactly its variant's size; the array becomes sequential and a value never changes variant, and in exchange you may take references into a payload:

enum Shape { Circle { r: f64 }, Rect { w: f64, h: f64 }, Dot }

var packed: Shape..[>..] = [];                 // 9, 17 and 1 bytes, not 17 each
packed.push(Shape.Circle { r: 1.0 });
packed.push(Shape.Rect { w: 2.0, h: 3.0 });
packed.push(Shape.Dot);
for s in packed {
    match s { Rect &r => { r.w += 1.0; }, _ => {} }   // edits the payload in place, inside the array
}

Case functions provide another way to dispatch on a variant: define one overload per variant. Calls dispatch on the tag through a jump table, and the compiler checks that the overloads cover every variant:

fn area(s: Shape.Circle) -> f64 { 3.14159 * s.r * s.r }
fn area(s: Shape.Rect) -> f64   { s.w * s.h }
fn area(s: Shape.Dot) -> f64    { 0.0 }

for s in packed { print(s, " area ", area(s)); }

Links narrower than pointers

A T& is a machine address: eight bytes, never dangling. A relative reference is the same link stored as a narrow offset: T&<u32> is measured from the field itself to a target in the same array, so the structure is position independent, and T&<u32 in pool> from a named pool's base, so other arrays can link into the pool. T&<u32>? uses offset 0 as null. Here is a binary search tree in one grow-only array, with 12-byte nodes:

struct Node { key: i32, left: Node&<u32>?, right: Node&<u32>? }   // 12 bytes, links included

fn insert(pool: Node[>..]&, key: i32) {
    if pool.len == 0 { pool.push(Node { key: key }); return; }
    var cur .= pool[0];                             // .= binds a reference; = would copy the node
    loop {
        if key == cur.key { return; }
        let next = if key < cur.key { cur.left } else { cur.right };
        if next { cur .= next; continue; }          // narrowed by `if`: next is a Node&
        if key < cur.key { cur.left .= pool.push(Node { key: key }); }
        else             { cur.right .= pool.push(Node { key: key }); }
        return;
    }
}

References are transparent (no * , no -> ), .= binds or retargets one, and Node? is a nullable reference that if , guard and assert narrow. The insert is one push and one store, and the push cannot invalidate cur . When lifetimes are not nested, a reusable pool pairs a grow-only array with a hidden freelist: alloc_ref reuses a slot or pushes, free hands one back, and since nothing is ever actually freed, a stale slot reads a different value of the correct type rather than corrupting memory.

Your data is already a file format

var image: u8[>..] = tree.to_bytes();           // a framed byte image of the whole array
var loaded, ok = from_bytes<Node[>..]>(image);  // verified before it becomes a value
image[image.len - 3] = 200;                     // tamper with a link ...
var bad, bok = from_bytes<Node[>..]>(image);    // ... and it is false and an empty array

The tree's links are self-relative, so it means the same thing wherever it sits: saving is writing its bytes and loading is reading them back, with no serializer, no schema and no pointer fixups. from_bytes checks the framing, every tag, every length and every link before the bytes become a value, so a corrupt or hostile file is a false , never a wild reference.

Built in place, always

The copy-free construction guarantee ( spec §4.3 ) says a constructed value is always built in its final home, propagated top-down through calls. A function returning a grow-only array by value writes its elements straight into the caller's variable, or into a field of the record being built inside another array, so out-parameters mostly do not appear.

words.push(str("word", i));                    // formatted straight into the new element
let evens = xs.filter() { it % 2 == 0 };       // built straight into `evens`: no temporary
book.push(Order { id: 1001, customer: "alice", items: parse_items("SKU-441:2:1999;SKU-7:1:500") });

Returning errors across calls

struct User { name: u8[..16], age: i32 }

fn load(text: u8[:]) -> User[>..], u8[] {
    var users: User[>..] = [];
    each_split(text, '\n') { users.push(parse_user(it)); };
    return users, "";
}

fn parse_user(line: u8[:]) -> User {              // returns a User: no Result, no error parameter
    let comma = find(line, ",");
    guard comma >= 0 else { return [], str("expected name,age: ", line) from load; }
    let age, ok = parse_int(line[comma + 1..]);
    guard ok else { return [], str("bad age: ", line) from load; }
    let name = trim(line[..comma]);
    return User { name: name, age: age as i32 };
}

return E from f returns E as the result of the innermost active call of f , however many frames up, and every function in between keeps its plain signature. It is checked statically, so every call of parse_user must lie inside a load call and nothing is uncaught at runtime. It is a hidden discriminant checked per frame rather than an unwinder, and the message is built directly where load 's caller wants it. The parsers in the samples use it for every syntax error.

Generics and function blocks

fn twice(x) { x + x }                              // an untyped parameter is a generic one

fn each_pair<T, F>(xs: T[:]) {                     // F is a function value: a compile-time entity
    for i in 0..xs.len - 1 { F(xs[i], xs[i + 1]); }
}

fn first_gap(xs: i64[:]) -> i64 {
    each_pair(xs) { a, b => if b - a > 1 { return a; } };   // returns from first_gap, not each_pair
    return -1;
}

let evens = xs.filter() { it % 2 == 0 };
let total = fold(xs, 0) { acc, x => acc + x };
sort(xs) { a, b => a > b };

Everything is monomorphized. Type arguments are inferred from argument types; parameters absent from those types can be supplied explicitly. Function values are passed as generic parameters: every call is direct and inlinable, they cannot escape, and there are no closure objects or function pointers, so a higher-order function compiles to exactly the loop it looks like. A block may return from its lexically enclosing function, and nested functions see the enclosing function's locals.

thread_fn worker() {                                // a separate program with its own memory
    loop {
        let job = qget<Job>();                      // blocks on the typed queue for Job
        guard job.n >= 0 else { break; }            // -1 means stop
        qput(Result { n: job.n, digits: count_digits(job.n) });
    }
}

for i in n { ids.push(thread_spawn(worker)); }

There is no shared mutable memory. A thread_fn and everything it calls is compiled as its own program with its own data stacks and its own copies of the globals. Values cross through typed queues, one per type, and must be flat , with no references at any depth. That is cheap because a flat Goose value is contiguous: a job or a result carries real data, pixels included, and crossing is a memcpy .

A failed check or abort in a worker started with thread_spawn_contained ends only that worker. Its message goes to whoever waits for it, not to stderr, so a supervisor can log it and start another:

var why: u8[>..] = [];
while !thread_wait(thread_spawn_contained(serve, attempt), why) {
    log(why);                                       // "assert failed (serve.goose:12)"
    why.clear();
    attempt++;
}

The first thread_wait(id, msg) for a worker takes the message; a caller that doesn't ask for it loses it.

Plain C in, plain C out

extern fn hypot(x: f64, y: f64) -> f64;             // straight from libm
extern fn crc32_bytes(s: const u8[:]) -> u32;       // a slice crosses as { data, len }
extern fn stats_of(xs: i32[:], out: Stats&);        // a struct filled through a pointer

An extern fn binds a Goose signature to a C symbol. The math and os modules use this interface. Only types with supported C representations may cross the boundary; unsupported signatures are rejected at the declaration. The compiler emits one C file for the whole program. The bundled TinyCC backend can compile and run that C inside the Goose compiler's process.

Where the speed comes from

Much of the speed comes from the memory model: no heap allocation or per-object teardown, contiguous data, narrow links, and enums sized for the variant they contain. Every index is bounds-checked, and the compiler removes checks it can prove unnecessary. An assert on a slice length often lets a kernel eliminate its remaining checks and vectorize. --bce-lines reports the checks that remain. checkfree fn rejects a kernel if any bounds check survives; index types let graph edges retain validation done during construction. Benchmark measurements use whole-process wall-clock time, including teardown.

Geometric mean over 16 benchmarks	vs idiomatic C++	vs hand-optimized C++	vs best safe Rust
speed, MSVC backend	3.51x	1.24x	1.13x
speed, clang backend	3.54x	1.26x	1.19x
peak memory	1.95x less	1.32x less	1.25x less

The summary explains the gains and losses; results.md has every measurement, and design.md explains what the suite tests.

What it costs you

You think about where data lives: who owns this, and how long does its scope last. Usually the answer is "the function that builds it", and that is free; when it is not, it is a reusable pool.
Recursive functions cannot keep growable data across a recursive call; scratch ends before the call, and what outlives it is passed in as a pool.
Arrays of variable-size elements iterate but do not index (short of an index of references kept beside them), a fixed-mode enum cannot be pointed into, and a variable-mode one cannot be overwritten. You choose per container.
No escaping closures, no function pointers, no dynamic dispatch beyond ADT tags, and whole-program compilation only.
A slot handed back to a reusable pool and still named reads whatever its next owner put there: a logic bug, never memory corruption.

Tutorial §18 is the full list.

Install a release

Prebuilt compilers for Windows (x64), Linux (x64) and macOS (Apple silicon and Intel) are on the releases page , with the graphics, audio, ui and physics packages compiled in. Unpack one anywhere and put its directory on PATH: the compiler finds the standard library, TinyCC's runtime and the packages beside itself, and keeps what it builds under ~/.goose ( GOOSE_HOME ). The archive also holds these docs, the samples and the VS Code extension.

Running a program in-process ( goose file.goose ) needs nothing else on Windows. On Linux it needs the C library's headers ( libc6-dev , or glibc-devel ); on macOS, the SDK of the Xcode command line tools ( xcode-select --install ). goose build also needs a C compiler: Visual Studio 2022 or later, or clang, on Windows; gcc or clang elsewhere. The Linux compiler needs glibc 2.35 or later (Ubuntu 22.04, Debian 12), the macOS one macOS 13.3 or later. macOS keeps a downloaded archive's files from running until xattr -dr com.apple.quarantine is run on the unpacked directory.

Build and run

You need CMake 3.27 or later, a C++20 compiler (MSVC, clang or gcc) and Python 3 for the test and sample runners. TinyCC, which the in-process backend is built from, is part of the tree. The graphics, audio, ui and physics modules are packages in repositories of their own ( goose_gfx and goose_physics ; docs/design/packages.md ): -DGOOSE_BUILTIN_LIBS=all fetches them at the pinned tags (git, at configure time) and compiles them into the compiler, so their programs run with nothing else installed. Without it the compiler builds alone, and a program importing one of them has it built into ~/.goose the first time, which needs git, cmake and a C compiler.

git clone https://github.com/aardappel/goose
cd goose
cmake -B build -DCMAKE_BUILD_TYPE=Release -DGOOSE_BUILTIN_LIBS=all
cmake --build build --config Release

GOOSE_BUILTIN_LIBS can also name some of the packages ( physics , or gfx , which carries audio and ui too). On Linux, SDL needs the X11 or Wayland development packages ( third_party/SDL/docs/README-linux.md ); without them the build leaves the gfx module out and says what to install.

The runner scripts prefer build/Release , then build/RelWithDebInfo , then build , then build/Debug . Pass --exe to select a specific compiler; use an explicit Debug executable when testing with compiler assertions enabled. The compiler is build/goose ( build/Release/goose.exe with the Visual Studio generator), and it finds the standard library in the source tree it was built from. On Windows 10 version 1903 and later, its embedded manifest selects a UTF-8 process code page so compiler paths do not depend on the system locale. Earlier Windows versions retain their legacy code page. Generated native executables retain their own process settings.

Run a program straight from source, in-process ( goose run says the same explicitly, and goose check only typechecks):

build/goose samples/01_tour.goose

Or build an executable, which lands beside the source ( -o puts it elsewhere). The compiler finds a C compiler on the machine ( goose toolchain says which: MSVC or clang on Windows, cc, gcc or clang elsewhere; --cc chooses) and links the generated C with the runtime and whatever native modules the program uses, graphics included. Programs that use threads need this route, since TinyCC cannot place thread-local storage.

build/goose build samples/01_tour.goose && samples/01_tour
build/goose build samples/27_gfx_cube.goose && samples/27_gfx_cube

--debug turns on the overflow, range and tag checks in the generated C, each abort naming its source line (and an overflow or a cast the values involved), and builds the C with debug information; --dry-run prints the commands a build would run, for a build system of your own; -v prints them as they run. Intermediates go under ~/.goose ( GOOSE_HOME ), the runtime object compiled once per C compiler. Useful flags of both forms: -O0 / -O1 / -O2 set the inlining level (a build defaults to -O2 , a run to -O1 ), --bce-lines reports the bounds checks kept per line, and -DGS_DEBUG=1 is what --debug defines. Every resizable value lives on a data stack of 2 GB of reserved address space, committed as it is used: --stack-reserve 16G changes that for a program, --stacks reports how many data stacks the program and each of its workers can take and the cap that puts on hardware_threads() , and -DGS_STACK_STATS=1 makes a program report its actual use as it ends.

A program with C of its own names it in a sidecar beside the source, foo.build beside foo.goose : c_sources = ["impl.c"]; , with c_include , c_defines , c_libs and _windows , _linux or _macos variants of each for one platform's part. Both forms build it: goose build links it in, and goose run builds it into a library the in-process run loads, so an extern fn reaches it either way. A library does the same with a sidecar beside its entry (or names the static library target of its own CMake project, cmake_target = "x"; , which the compiler builds through cmake), and a program takes a library with import name from "source"; in its root file: a directory ( "./lib" ), or a git repository at a tag or commit ( "owner/repo@v1" on GitHub, "host/owner/repo@ref" ), fetched into ~/.goose and built there once per C compiler ( docs/design/packages.md ).

Underneath, goose -o tour.c tour.goose writes the C, which holds the program and the part of the runtime that inlines into it; the rest of the runtime (the OS layer, data stack reservation, threads, printing) is one more C file, which goose --emit-runtime goose_runtime.c writes, to be compiled once and linked with every program ( cc -O2 tour.c goose_runtime.o -o tour -lm -pthread ; on Windows cl /O2 tour.c goose_runtime.obj ). Build the runtime with the compiler and flags the programs use; it takes no -D of its own, and a program from another version of the compiler fails to link against it. --standalone writes a C file that holds the whole runtime instead, and builds on its own. A program using audio , gfx , physics or ui also links that module's layer, which goose --audio-link msvc|cc , --gfx-link , --physics-link and --ui-link name in a response file ( cc cube.c goose_runtime.o -o cube @$(goose --gfx-link cc) , a ui program's before the gfx one it draws through). goose build --dry-run prints all of this for the program at hand.

A program using audio plays procedural mono/stereo PCM through SDL3 without opening a graphics window. See the audio reference .

The test suite and the samples run on Windows, macOS and Linux:

python test/run_tests.py
python samples/run_samples.py

For editing, the VS Code extension gives syntax highlighting, the compiler's language server ( goose lsp : errors as you type, hover, go to definition, completion, rename, symbols) and one-key runs through the JIT:

code --install-extension vscode/goose-language.vsix

Other editors can run goose lsp themselves; editors has the configuration for Neovim, Helix and Emacs.

Documentation

Documentation index : the map of everything below, and the root of the documentation site built from these files ( how ).
Tutorial : the friendly introduction, by example. Read this first.
Language reference : every feature, topic by topic, with a compiling example for each: the whole language, written to be read.
Language specification : the exact rules, when you want to know why something did not compile.
Samples : thirty-one complete programs in reading order, from a tour of the language to a JSON parser, a threaded Mandelbrot, a file tree built from two pools, a spinning cube on the GPU, thousands of boxes raining into a heap and a to-do list in windows of widgets.
Standard library : fourteen modules, all readable Goose under stdlib/ , including gfx , graphics on SDL3's GPU API ( how it is built ), physics , rigid body physics on Box3D ( how it is built ), and ui , fonts, text rendering and game HUDs , windows and widgets on Nuklear, drawn through gfx ( how it is built ).
Building programs and using packages : goose build , libraries from git repositories or directories, a program's own C, and how to make a package of your own.
Benchmarks : the numbers, with the full results and the design behind them.
Implementation notes : how the compiler works, pass by pass, and how it is tested .

Status

Goose is new. What exists today is a whole-program compiler of about thirty thousand lines of C++, the specification, the standard library, the samples, and a test suite that CI runs on Windows, macOS and Linux with an extra sanitizer job. Deliberately out of scope for now: moves for resizable values, more than one resizable per struct, labeled break , namespace privacy, and more OS/library access. Open items are tracked in the specification's Appendix B .

License

Goose is licensed under the Apache License, Version 2.0 .

Authors

Wouter van Oortmerssen : Language Design, Compiler Design, Coding standards. home page, twitter .

Claude Fable : Compiler implementation, Benchmarking, Sample & Doc writing.

History & Use of AI

This repo was produced almost entirely with AI, from a human language design. I had designed Goose several years ago, and had started to implement it, but running a game startup (which is built on another programming language of mine, Lobster ) there was no time to finish it. Which was sad, because I knew Goose could do things other languages can't, and it should exist.

I had not expected AI to help with this until Fable came out. I thought it might be capable enough to do a good job. I made it essentially clone the style and structure of my other recent compiler (Lobster), which is why if you look at the code, it looks rather similar to that. My initial design had left lots of things unspecified, and lots of back and forth with Fable made me decide on all of those, and it is now a better language for it.

It is also an experiment in using AI to implement a new language, rather than reproduce an existing one.

You may wonder why I had it work in C++, if clearly I could have used any language, like Rust, or my own Lobster, or.. Goose itself (that may still happen). With Fable, it was my observation that it is almost equally capable in any language, and the strong guardrails of Rust or other languages are not as pressing as they once were. Since the compiler emits C, you likely already need to have a C/C++ compiler around, so sticking inside one ecosystem would seem to simplify deployment and adoption. I've also integrated libtcc and who knows what other C libraries in the future. And, like I said, to have the compiler code mimic my existing Lobster compiler seemed fun, at least I can read it like it is my own.

SpeedCrunch 1.1

Hacker News

www.speedcrunch.org

2026-10-24 15:19:43

Comments...

Original Article

A free, open-source high-precision scientific calculator.

Built for STEM professionals, students and teachers.

Download User Manual Donate

Free to download and use on Windows, macOS, and Linux.

Up to 50 digits of precision, with complex number support
140+ functions, and a myriad of units and constants
User-defined variables, functions, and units
Vector and matrix support
History rewriting, and per-result settings
Keypad presets and a fully customizable layout
Multiple active sessions with tabs, panes, or windows
More than 40 translations, and over 40 color schemes

Tim Pan’s iPhone Duo Review

Daring Fireball

www.youtube.com

2026-10-24 15:15:45

I hadn’t heard of Tim Pan or Mediastorm until running across his 24-minute video review of the Duo. It’s a good and fair review, but what struck me are the rather astonishing production values. Amongst other things, they stress-tested the hinge with an industrial robot by opening/closing it 10,000 t...

Original Article

John Carmack on the Goose Language: multiple data stacks and relative references

Hacker News

twitter.com

2026-10-24 15:06:55

Comments...

Original Article

Log in or sign up for X

See what’s happening and join the conversation

Continue with phone

or

Log in with username or email

Relevant people

John Carmack @ ID_AA_Carmack Follow

AGI at Keen Technologies, former CTO Oculus VR, Founder Id Software and Armadillo Aerospace

Trending now

PHP Foundation 'under-funded' with one full-time staff member, director says

Hacker News

www.reuters.com

2026-10-24 15:03:59

Comments...

Original Article

Please enable JS and disable any ad blocker

‘Synthetic twin’: Why Socceroo Cristian Volpato is the latest footballer to license his AI clone

Guardian

www.theguardian.com

2026-10-24 15:00:40

Athletes’ scramble to control – and monetise – their digital identities at the cutting edge of AI rights dealsGet our new political email, free app or daily news podcastThe Socceroos star stares at the camera as he strides through an enormous atrium, the sound of his football boots on polished concr...

Original Article

T he Socceroos star stares at the camera as he strides through an enormous atrium, the sound of his football boots on polished concrete echoing around him. Suddenly, he spawns four digital clones that peel off out of view to re-emerge in different settings around the world.

This scene from a social media video is fake and generated by artificial intelligence. But it has been authorised by the very real 22-year-old footballer, Cristian Volpato, the latest professional athlete to licence and monetise his AI likeness.

Draped in a white linen suit with his feet on the sand, Volpato’s “synthetic twin” turns towards a photographer as the limestone stacks of the Twelve Apostles tower behind him. Another dominates a large digital billboard wearing a football jersey. One smiles into a mirror while adjusting a sharp grey suit.

This video was produced by a new company that acts as an AI licensing agent for professional athletes. Experts believe it is one small part of a nascent online industry that could transform the future of image rights and sports content.

As bookmakers, broadcasters and brands increasingly use athletes’ images in AI generated content without their permission, some players are fighting back.

Digital twins

In mid-September, Volpato, who plays for Italian Serie A club, Sassuolo, struck a deal with the California-based company Callandor to license his AI image.

As part of the deal, Callandor was given exclusive rights to Volpato’s digital likeness, voice, biometric profiles and performance data. The company will monetise his AI image by landing brand deals, taking a cut, and help restrict content that does not have his approval.

Sign up for the Breaking News Australia email

From Los Angeles, Callandor’s co-founder, Michael Fisk, tells Guardian Australia he’s in the business of making “synthetic twins”.

“Cristian is constantly training,” Fisk says. “He’s constantly out there playing. If he has any free time whatsoever, he’ll probably want to spend it with family and friends, so he loses on a lot of opportunities on brand placements.

“A synthetic twin could be used 24-7, year-round by brands. Assuming it’s approved, right?”

Founded in February, Callandor has a small stable of athletes, including Brazilian footballer Jorginho and American sailor Chris Poole. Its campaigns are only in the pilot phase, but Callandor is pursuing an array of opportunities beyond traditional advertising.

Fisk, a former executive at Sony Pictures and MGM, talks of creating AI-generated book voiceovers with foreign language editions. His team is also plotting apps that offer fans a personal relationship with a synthetic twin.

“Ultimately, the holy grail of an athlete is to have that one-on-one interaction with fans,” Fisk says.

He raises the prospect of creating an app that monitors how people play football. A digital clone of Volpato would give real-time instructions.

“He’s realising I’m not handling the ball well [so] his synthetic twin can tell me, ‘Hey, you should be doing this and this and this’,” says Fisk.

“Volpato would never be able to do that one-on-one with [them].”

Volpato’s deal with Callandor is at the cutting edge of AI rights deals, but he isn’t the first to embrace the technology. In June, Brazilian superstar Neymar licensed his AI likeness to a Chinese-owned entertainment platform that created short videos published during the FIFA World Cup.

These projects are being launched as governments across the world consider basic regulation of AI. At the moment, player contracts with major Australian sporting leagues make no mention of AI.

But technology isn’t waiting for regulation to catch up and Fisk says his synthetic twin clients are blurring the lines between real and fake.

“It’s becoming almost impossible to detect, that look and feel, the difference, particularly when you see it on a mobile device,” he says.

‘We’re watching a race’

William Saunders leads a small Sydney based start-up, Hyperknown, that’s trying to cut similar deals. He says athletes are beginning to realise that if they don’t monetise their AI image, others will.

Earlier this month, the AFL told its gambling partner Sportsbet to stop using AI images of players without their consent. This was prompted by a complaint from the players’ union, which is considering whether stricter rules should be negotiated.

“Sportsbet shows us what happens when companies and technology get ahead of consent,” Saunders says.

“Volpato represents the counter-move: people establishing their rights before others start making decisions about their identities.

“We’re watching a race between what technology can do and what people have actually authorised.”

Many in the Australian sports industry, including content creators, bookmakers, broadcasters and athletes themselves, have started embracing the technology.

Earlier this month, Australian cricketer Travis Head personally appeared in an ad for the broadcaster Kayo. He joked that his AI clone had already finished filming the ad, before throwing to vision of him riding a flying kookaburra .

Brand deals and endorsements have become major money makers for athletes, with some securing multimillion dollar contracts. It remains unclear whether brands will be willing to pay as much for an AI clone, as opposed to the real deal.

But Saunders, whose company has only just launched, says the opportunities are enormous. He talks of AI clones selling products in foreign languages in nations athletes have never visited.

“The next trust signal won’t just say ‘made with AI’,” he says, referencing a tag often used by social media companies. “It will say ‘made with this person’s permission’.

“AI can make content abundant. It can’t manufacture someone’s permission. That’s becoming a new commercial requirement.”

‘A tangle of different interests’

Jonathan Harlen, an expert in intellectual property law at Southern Cross University, says the rise of AI brokers is “the obvious next step” in a “supercharged global market”.

From a legal perspective, he says this new industry presents “a tangle of different interests and rights” that need to be carefully negotiated.

“While copyright already subsists in voice recordings, artistic works and cinematographic images, it is only recognised where there has been human authorship, as well as a degree of independent or creative human effort involved in the making of the work,” Harlen says.

“It doesn’t apply to AI reproductions.”

Celebrities and athletes do have some protection against AI-generated content using their image and voice without consent. But these “passing off” laws only apply when public figures can prove they have suffered an economic loss.

This has not slowed an explosion of deepfakes generated by increasingly sophisticated off-the-shelf software.

In the UK last month, a campaign was launched by some the world’s top footballers, including Cole Palmer and Lucy Bronze, which highlighted their concerns about deepfakes and the inability for regulation to slow their explosion. This campaign was backed by the global player union, Fifpro.

One offshore casino used a deepfake video of Manchester United player Bruno Fernandes in advertising earlier this year .

Not all unauthorised deepfakes will be unwanted, however. Fisk says a heavy-handed crackdown on “fan art” using AI tools might be counterproductive.

“You don’t want fans to use your image and put you in [content] using brands that you don’t use, or saying something that you would never say,” he says.

“Obviously, anything with religion and drugs, or whatever it might be, you have to be very, very careful. So it does complicate things a bit, but the opportunities are phenomenal.”

But in this emerging realm, the consequences may be hard to predict.

Danish Government silently drops plan to dump MS Office

Hacker News

www.computerworld.dk

2026-10-24 14:31:48

Comments...

Original Article

Digitaliseringsministeriet har i al stilhed lagt sit pilotprojekt med et alternativ til Microsoft Office i graven.

20. oktober 2026 kl. 08.33

(Foto: Qëndrim Fazliu)

Premium Kun for abonnenter

Det får du i artiklen

Læs om pilotprojektet med Collabora, som nu er blevet droppet.

Antal ord 432

Læsetid 2:15 min

I al stilhed har Digitaliseringsministeriet droppet sit ellers meget omtalte pilotprojekt med et open souce-baseret alternativ til Microsofts Office-pakke, som ministeriet ellers anvender i stor stil.

Projektet blev søsat i sommeren 2025, da knap 40 medarbejdere i ministeriet gik i gang med at teste open source-systemet Collabora som alternativ til Office. Systemet blev dengang leveret af danske cBrain.

Dream-1

Hacker News

dreamlabs.ai

2026-10-24 14:23:24

Comments...

Original Article

Give Dream-1 a new bimanual robot with parallel grippers, connect it to our API, and it can start performing tasks out of the box. No fine-tuning, no demonstrations from that robot, and no machine learning expertise required.

This is an important step toward general-purpose robot intelligence.

Today, Dream Labs is also coming out of stealth with $90M in seed funding and making Dream-1 available to people all around the world through a public API.

01

Breaking the chicken-and-egg problem

Robotics' chicken-and-egg problem.

For decades, robotics has been stuck in a chicken-and-egg problem: a robot needs to be useful before people want to buy it, but making it useful requires data from that exact robot, and that data only exists once enough people start using it. Dream-1 is our first step toward breaking that loop.

Self-driving found a way around this cold-start problem. Cars were useful from day one with zero autonomy, so millions of people drove them every day and generated the data needed to train increasingly capable models. Most other robots never had that advantage.

Two things are changing that.

First, robot hardware is getting cheap enough to reach far more people. A capable bimanual arm setup can now cost as little as $2k ¹ .

Second, a robot may no longer need a large dataset of its own before it can be useful. If a model can generalize zero-shot to unseen environments, tasks, and even robots, a new robot can start with useful capabilities.

Put those together and the flywheel can finally start. Cheaper hardware puts more robots into the world. Generalizable models make those robots useful earlier. Useful robots generate more data, and that data makes the models better for the next robot.

02

The Cambrian explosion of cheap, affordable robots

Dream Labs enabled robots.

Robot hardware is getting cheap faster than anyone expected. See the robots above, where 7 semi-humanoid robots cost less than $15k, a price tier that barely existed a year ago. At the far end of the price curve, Hugging Face's $399 Microduck sold more than 10,000 units within 4 days of its launch in late August ² . We believe the robotics take-off will start with robots like these.

$2,000

a bimanual arm setup

A capable two-arm setup, as of today.

7

semi-humanoids under $15k

Wheels, two arms, parallel grippers; a tier that barely existed a year ago.

$399

Hugging Face Microduck

Launched late August.

10,000+

Microducks in 4 days

Sold within four days of launch. ²

That's because their buyers are consumers, prosumers, and small teams, not enterprises. An enterprise buyer is making a spreadsheet decision. If the robot doesn't beat a person on cost, speed, or reliability, it doesn't get bought; that's a high bar to clear. Consumers are different. 10,000+ people just paid $399 within 4 days for a robot whose main job is to be delightful and cute: it walks, waddles, and roller-skates. Somewhere between that and a fully capable home robot is a sweet spot, a robot affordable enough to be an easy yes and useful enough to earn its place in the home. Once robots hit that point, we think adoption starts to compound, and every robot in a home becomes a source of new training data. Imagine two Microducks folding your laundry, using their beaks as grippers.

03

The result that started Dream Labs

In February 2026, our team released DreamZero, the paper that introduced World Action Models ³ . Since then, the community has adopted WAMs as one of the most promising paradigms in robot learning. At that time, the most surprising result for us was when after post-training DreamZero on just 30 minutes of YAM robot data, we saw it generalize zero-shot to tasks it had never seen. That kind of generalization used to take hundreds or even thousands of hours of embodiment-specific data. If 30 minutes of data from a given robot was enough to transfer general-purpose task knowledge to that robot, breaking the chicken-and-egg loop no longer looked impossible. Combined with the hardware wave above, the timing felt right. That's when we decided to start Dream Labs.

After six months of building, we're excited to share a new research breakthrough that was only made possible through world action models: early signs of zero-shot embodiment generalization.

04

Introducing Dream-1

Dream-1 is our first World Action Model available through a public API that can be used all around the world. Out of the box, it can control unseen robots for unseen tasks in unseen environments.

Anvil Robotics Caribbean

Sort the candy into containers 1 of 2

BitRobot Shenzhen, China

Pull out a tissue 1 of 4

Cortex Singapore

Stack the white cup on top of the pink cup 1 of 2

Eastworld KL, Malaysia

Place the apple in the brown box 1 rollout

Hugging Face Paris, France

Pick up the red cube and put it in the green container 1 rollout

KAIST Seoul, Korea

Fold the box 1 rollout

XDOF Jakarta, Indonesia

Find the marker and pick it up 1 rollout

RoboCurve San Francisco, USA

Stand all three bottles upright 1 of 4

Scale AI San Francisco, USA

Stack the cubes into a single tower 1 of 9

Robo Inc. Los Angeles, USA

Move chips to tray 1 rollout

Mecka New York, USA

Lift a test tube from the loose rack 1 rollout

AgiBot Shanghai, China

Pick apple to plate 1 rollout

1–13 of 13

Unseen Tasks Dream-1 was able to do. Autonomous. 8x speed at the beta testers’ sites, 4x in-house.

04.1

Get started in minutes

We want generalizable robotics to be accessible to anyone with a robot, not just large labs. So we designed Dream-1 to be as close to plug-and-play as possible. Connect your robot, point it at the API, and run. No machine learning background is needed to get started. Every week, we run internal hackathons to keep time-to-deploy as short as possible. Getting started tutorial

import dream

client = dream.DreamClient(
    api_key=<API_KEY>,
)
client.policy({"checkpoint": "dreamlabs/dream-1"})
client.set_observation(observation)
action = client.get_action()
client.close()

Condensed client side code

04.2

Zero-shot on robots it has never seen

Dream-1 can zero-shot generalize to many bimanual, parallel-gripper robots. Here are some we've tested. It can even control the original PR2, a general-purpose bimanual research robot released 18 years ago. Note that no embodiment-specific data was used to get these rollouts.

Unseen Robots Dream-1 was able to control. 4x speed on real robots, 3x in simulation.

This is one of the first reported zero-shot generalizations to completely unseen robot embodiments. ⁴ If you have a bimanual parallel-gripper robot, try prompting Dream-1 and let us know how it goes. Zero-shot performance depends partly on your robot's inverse kinematics (IK) solver, so we've written a guide to help you get the most out of it. IK guide . Performance also varies across robots. Below, we break down zero-shot performance in simulation and on real robots.

Dream-1 zero-shot performance on 27 unseen robots in simulation and 4 real robots, relative to YAM, the robot Dream-1 was actually trained on. The real robots ran earlier Dream-1 checkpoints that never trained on them, each compared with the same checkpoint on YAM; OpenYAM was tested on unseen tasks only. Simulated evaluations are conducted by doing 300 rollouts per embodiment: 150 rollouts of 50 tasks quantifying language following and 150 rollouts of 150 tasks quantifying unseen task generalization.

Below, we explain how zero-shot embodiment generalization works and where it falls short. We then show how one-shot embodiment learning closes that gap.

04.3

How zero-shot embodiment generalization works

Two ways to control a robot: joints or end-effectors. Robot policies commonly output joint angles, which ties them to one specific robot's body. Dream-1 can do the same for the embodiments it supports natively, but it can also predict end-effector (EEF) poses: where each gripper should be and whether it should be open or closed. Every robot with two arms and parallel grippers shares that EEF action space, and its own IK solver turns the poses into joint commands. That shared interface gives Dream-1 a common way to command robots it has never seen, but on its own it isn't enough to make zero-shot transfer work.

Why does this work? Dream-1 sees the world through three cameras: a head view and a wrist view on each arm. Prior work on the Universal Manipulation Interface (UMI) showed that policies can transfer zero-shot across robot arms when every arm uses the same gripper and the policy relies only on wrist cameras ⁵ . From the wrist's point of view, the robots look identical. But that shortcut has a hard limit. It only works when the gripper hardware matches exactly, and it gives up the head camera's view of the whole scene.

World Action Models remove that limit. A WAM learns to predict video and actions together, so controlling a robot and imagining what that robot will do are the same problem. And every robot shows up the same way: as pixels. The head camera sees a UMI gripper, a two-finger gripper or an arm Dream-1 has never met as nothing more than shapes moving through a scene, which makes video the one representation every robot type shares. If Dream-1 can predict what a robot will look like as it completes a task, it can produce the actions that get it there. That’s why it can control robots with grippers that look nothing like UMI’s, and even entirely new bodies seen through the head camera.

How a World Action Model works.

04.4

What Dream-1 can and can't do

Three Robocurve charts: Dream-1 scores 59 on RoboDojo-RC Tier 1 against 48 for Opus 5.5 and Gemini 4 Argon, and sits on the Pareto frontier for both cost and time per task attempt — Robocurve’s independent report on Dream-1 : mean score per task attempt on RoboDojo-RC Tier 1.

Ahead of launch, Robocurve ⁶ , a Public Benefit Corporation that measures and reports frontier robotics capabilities to the public, evaluated Dream-1 independently. Their report, above, shows Dream-1 is better, faster and cheaper: a new Pareto frontier for robot control. It scores above the next best models, Opus 5.5 and Gemini 4 Argon, at 16x lower cost per task attempt than Gemini 4 Argon and 1.7x faster than the fastest LLM, GPT-6 Astra. While current LLMs excel at planning, robots still require a fast, general System 1 to act, and that is what Dream-1 is built to be.

How much does it cost to run Dream-1 ? We want you to know exactly what to expect before you try it. Running the model costs just $3 per hour for Dream-1 , or $2 per hour for Dream-1-flash. Each call to the model returns 1.6 seconds of actions, so an hour is 2,250 calls: about $0.0013 an action for Dream-1 , and $0.0009 for Dream-1-flash.

$3 / hour

Dream-1

Everything above the hourly cost is yours to keep.

$2 / hour

Dream-1-flash

The faster, lighter model.

Across tasks. We break Dream-1 ’s performance down into eight task categories, from what it handles well to where it still struggles.

Fine-tune for your task with FaaS. If Dream-1 falls short on a task you care about, you don’t have to wait for our next release. Collect some data on your own robot, run it through FaaS, and get a custom model built for that task.

We want anyone with a robot to work like a forward-deployed engineer: find a task someone needs done, collect a bit of data, adapt Dream-1 to it, and deploy. If people will pay for what your robot does, you keep everything above the hourly cost.

04.5

One-shot embodiment learning

When zero-shot isn't enough, we fine-tune Dream-1 for your robot. We call this Fine-tuning-as-a-Service (FaaS).

Here's what that looks like in practice: timelapses of data collection on two of our partners' robots, 5 minutes each.

Two data-collection stations side by side, each with a person teleoperating a bimanual robot and a timer on the table — Five minutes of data collection on two robots at 8x: reBot B601-DM on the left, Maker Arm on the right.

After adapting on just those 5 minutes, the difference shows side-by-side with the zero-shot run. Dream-1 now understands a bit better the affordance and kinematics of the robot.

reBot B601-DM

Simulated twin

Time 0:00

+ 5 min

Time 0:00

Maker Arm

Real robot

Time 0:00

+ 5 min

Time 0:00

Zero-shot and after FaaS on the same instruction, “go ahead and put the banana in the bowl”, with five minutes of the robot’s own data in between: reBot B601-DM in its simulated twin, Maker Arm on the real robot. 3x speed.

Some embodiments sit much further from what Dream-1 already knows, and closing a gap that large takes more of the robot’s own data. Dexmate with Sharpa dexterous hands grasps with hands in place of grippers, and took 77 minutes of its data. On YAM, we swapped in different end effectors for this task, a compliant gripper and a modified knife gripper, and it took 98 minutes of data.

Dexmate , Sharpa dexterous hands, 77 minutes of data

Pick bread from toaster and place on plate

YAM , compliant gripper and modified knife gripper, 98 minutes of data

Cut the leaf off the strawberry

After FaaS on embodiments far from Dream-1 ’s training data, on the real robots. 5x speed.

Across twelve robots from our FaaS beta partners, fine-tuning lifts the language-following score on ten of them:

Zero-shot versus after FaaS on the same twelve robots, in simulation, relative to YAM.

One-shot adaptation still outperforms zero-shot, so a gap remains. Closing it is one of our main goals: the better zero-shot gets, the closer any new robot comes to working out of the box.

Dream-1 today is a manipulation policy for bimanual robots with parallel grippers. It’s a starting point. We believe a strong, general robot foundation model can extend to mobile manipulators, dexterous hands, and bodies we haven't imagined yet, opening up many more of the things people actually want robots to do. Robotics won't be solved on day one, and Dream-1 has real limits, which we've tried to show transparently above.

Robotics is still stuck in a difficult loop: every new robot or task demands new data and a custom policy, often with limited generalization. With Dream-1 as a robotics API, we want to break that loop and put robot intelligence into more people's hands, so everyday users, not only researchers, can discover new applications for general-purpose robot intelligence.

Dream-1 . public API

Put Dream‑1 on your robot

If you're building robots or putting them to work on real tasks, we want Dream-1 to be the fastest way to make them useful. Tell us what you're working on.

Two robot arms at a workbench with a box between them — A fine-tuned Dream-1 checkpoint controlling multiple embodiments, including the Microduck.

Notes and references

1 MakerMods, Maker Arm : a bimanual arm setup from about $2k. ↩
2 Yahoo Tech, Hugging Face's $399 Microduck robot has already sold more than 10,000 units , 1 September 2026: more than 10,000 units since pre-orders opened on 28 August. ↩
3 DreamZero : the paper that introduced World Action Models, February 2026. ↩
4 LAP also showed signs of life of embodiment generalization: Zha et al., LAP: Language-Action Pre-Training Enables Zero-shot Cross-Embodiment Transfer . ↩
5 Chi et al., Universal Manipulation Interface: In-The-Wild Robot Teaching Without In-The-Wild Robots , RSS 2024: zero-shot transfer across arms that share one gripper, from wrist cameras alone. ↩
6 Robocurve , a Public Benefit Corporation measuring and reporting frontier robotics capabilities to the public: Dream-1 on RoboDojo-RC Tier 1, October 18, 2026, CC BY 4.0. ↩

Cite this post

@misc{dreamlabs2026dream1,
  title  = {Zero-Shot to New Robots: Introducing Dream-1},
  author = {Dream Labs},
  year   = {2026},
  url    = {https://dreamlabs.ai/research/dream-1}
}

Bbtree: Fastest Ordered Map

Hacker News

bbtree.xiangpeng.systems

2026-10-24 14:22:14

Comments...

Original Article

bbtree

Loading…

Glymphatic clearance to alleviate traumatic brain edema& Alzheimer's pathology

Hacker News

www.science.org

2026-10-24 14:19:05

Comments...

Original Article

Why is AI generated language so hard to understand?

Hacker News

arxiv.org

2026-10-24 14:04:57

Comments...

Original Article

View PDF HTML (experimental)

Abstract: There is a widespread sense that AI-generated text has recently become harder to understand. In this study, we investigate a set of psycholinguistic features that are known to correlate with human processing difficulty (e.g., object relative clauses, long syntactic dependencies, low-frequency n-grams). Using a novel corpus of AI-generated text across diverse domains, we find that AI models use these difficult features more often than paraphrases generated by round-trip translation. Compared with human writing, all nine frontier and near-frontier models use more inanimate subjects with animate verbs and more low-frequency n-grams, and most also use longer dependencies, more stacked nouns, and more reduced object relatives in conversation; we also demonstrate substantial variation across model families. We propose and test a hypothesis as to why: while human language is optimized for successful communication, AI-generated text is increasingly optimized for other goals like math, code, and reasoning, in which there is a pressure for \textit{information density} rather than successful communication. We provide a proof-of-concept for this hypothesis by fine-tuning a language model under a length penalty, which leads to a divergence from human-like linguistic behavior. Our findings highlight the axes of misalignment between linguistic processing demands in humans and LLMs, and point toward possible remedies.

Submission history

From: Thomas Clark [ view email ]
[v1] Wed, 21 Oct 2026 03:54:08 UTC (528 KB)

Balloting has completed for C++26. Unfortunately it was Disapproved/

Lobsters

www.linkedin.com

2026-10-24 14:00:36

tl;dr: it looks like C++ 26 got turned down by the national bodies (afaik unprecedented) Comments...

Original Article

Robert Seacord’s Post

Balloting has completed for C++26. Unfortunately it was Disapproved P-Members voting: 12 in favor out of 20 = 60 % (requirement >= 66.66%) (P-Members having abstained are not counted in this vote.) Member bodies voting: 9 negative votes out of 22 = 41 % (requirement <= 25%) Sort of a sad day for the C++ community. Hopefully we can heal and move on from this in a productive manner.

So sad to hear this, but indeed, let's learn from this, and regroup and move on.

I assume this was not a complete surprise and that those who voted against it had voiced opposition or at least reservations previously? Is the most promising path forward to reduce the scope and try again? Or were there things excluded that people really wanted?

See more comments

To view or add a comment, sign in

More from this author

Explore content categories

The Polyglot's Dilemma: Conformance Testing a Dozen Specs in as Many Languages

Lobsters

emptysqua.re

2026-10-24 12:59:53

Comments...

Original Article

MongoDB engineers juggling many implementations of many specs.

At MongoDB, we develop a dozen client libraries (“drivers”) in a dozen programming languages. A few wrap shared cores written in C or Java, but mostly they’re rewrites in their target languages: the JavaScript Driver is pure JavaScript, the Rust Driver is pure Rust, and so on. Building the drivers this way is a big commitment. Lots of database companies just write their client in C and make thin wrappers in various languages. Our way is harder but, in my opinion, better. Our drivers are easier to install, their APIs are more idiomatic in each language, and they participate normally in each language’s runtime: its threading model or async loop, its garbage collection, etc. This is only possible because we keep developing native drivers in each language.

But then, how do we ensure all our drivers’ behaviors and APIs are consistent? Or, that they’re appropriately consistent or inconsistent, according to the conventions of their target languages? Obviously, Python methods are snake_cased and Java methods are camelCased, but MongoDB drivers should have the same basic API in all languages, spelling aside. Node concurrency is async and C concurrency uses threads, but the meaning of causal consistency should be the same in all drivers.

In Search of a Tolerable Test Language #

I joined MongoDB as a Python driver engineer in November 2011. Looking back through my emails, I see that we were intensely debating how to standardize our drivers from the moment I arrived. Some engineers were writing Java Driver tests in Cucumber, a “behavior-driven development” syntax, like this:

Scenario: Exclude a field from query results
  Given collection "users" contains documents
    """
    {"_id": 1, "name": "alice", "password": "hunter2"}
    {"_id": 2, "name": "bob",   "password": "swordfish"}
    """
  When find documents by
    """
    {"name": "alice"}
    """
  And return fields
    """
    {"password": false}
    """
  Then the result should be
    """
    {"_id": 1, "name": "alice"}
    """

My very first task at MongoDB was researching whether we could write test-runners for these Cucumber tests in Python, Ruby, and our other languages. I instantly learned that my second task was dealing with my colleagues’ revulsion to Cucumber’s syntax. One engineer wrote that if we replaced his handwritten tests with Cucumber, he’d “have no part in doing it or supporting the resulting disaster.” (I clarified that we weren’t going to replace tests, only complement them.) Our founder Eliot Horowitz encouraged us to make a shared test suite, but he thought Cucumber specifically was “hilarious.”

We gave up on Cucumber. A few years later, I was involved in a new feature, specifying how drivers measure and respond to network latency . I observed that the English spec of the feature could be misunderstood, and some drivers implemented it differently. Once again, Eliot proposed a shared test suite. This time, we avoided Cucumber. We started to develop a custom test language on top of YAML instead. For details, see my conference talk or blog post about YAML tests , with Samantha Ritter.

The Unreasonable Effectiveness of YAML #

Testing drivers with YAML is one of the most successful projects I’ve ever been part of. In the 11 years (nearly 12 now) since we started writing YAML tests, the MongoDB drivers have all converged to a shared API and shared set of behaviors. They’re as similar as they should be, with consciously-chosen variations to fit each language’s idioms and conventions. I left the Drivers team a while ago , but the specification and YAML testing process is going stronger than ever. They now have a Unified Test Format, built on YAML, that can test drivers’ conformance to a dozen different specs. The specs cover how drivers read and write documents, how they retry failed commands, how they start and end transactions, how they encrypt private fields client-side, and lots of other intricate behaviors. Nearly 1,500 YAML files ensure that all these independent code bases implement the same protocols.

Here’s an example of a modern Unified Test Format file. It tests that a driver auto-retries the update command after a network error:

schemaVersion: "1.4"
runOnRequirements:
  - {minServerVersion: "4.4", topologies: [replicaset]}
createEntities:
  - client:
      id: &client client0
      observeEvents:
        - commandStartedEvent
        - poolClearedEvent
        - serverDescriptionChangedEvent
  - database:
      id: &db db0
      client: *client
      databaseName: &dbName mydb
  - collection:
      id: &coll coll0
      database: *db
      collectionName: &collName mycoll
initialData:
  - collectionName: *collName
    databaseName: *dbName
    documents: [{_id: 1, x: 1}]
tests:
  - description: "updateOne retries after network error,
                  exactly-once execution"
    operations:
      - name: failPoint
        object: testRunner
        arguments:
          client: *client
          failPoint:
            configureFailPoint: failCommand
            mode: {times: 1}
            data:
              failCommands: [update]
              closeConnection: true
      - name: updateOne
        object: *coll
        arguments:
          filter: {_id: 1}
          update: {$inc: {x: 1}}
        expectResult:
          matchedCount: 1
          modifiedCount: 1
          upsertedCount: 0
      - name: waitForEvent
        object: testRunner
        arguments:
          client: *client
          event:
            serverDescriptionChangedEvent:
              newDescription: {type: Unknown}
          count: 1
    expectEvents:
      - client: *client
        eventType: command
        events:
          - commandStartedEvent: {commandName: update}
          - commandStartedEvent: {commandName: update}
      - client: *client
        eventType: cmap
        events: [{poolClearedEvent: {}}]
    outcome:
      - collectionName: *collName
        databaseName: *dbName
        documents: [{_id: 1, x: 2}] # x incremented once

For each of our drivers, we implement a test runner which can interpret this syntax and call APIs on the driver being tested. The test runner creates two MongoClient objects: the MongoClient under test, and an “internal” MongoClient for sending side-channel commands to the server (see the failPoint below).

schemaVersion tells the test runner which features the file uses, so an old runner can skip a file it wouldn’t understand instead of failing it. We use JSON Schema to check each YAML test has the proper syntax for its version of the Unified Test Format.

runOnRequirements tells the test runner to skip the file unless the MongoDB server deployment matches—here, a replica set running MongoDB 4.4 or later.

createEntities builds an entity map : a client, a database, and a collection, named with YAML anchors ( &client ) so later operations can refer to them by alias ( *client ). This not only avoids repetition, it means YAML test runners can store and retrieve objects in the entity map, like assigning objects to variables in a real programming language.

initialData puts one document in the collection before the test starts. Then the operations run in order:

failPoint tells the server to close the connection the next time it receives an update . The test runner uses the internal MongoClient for this so it doesn’t touch the MongoClient under test.
updateOne tells the test runner to call the updateOne API on the MongoClient under test. In Python this is spelled update_one , in C it’s mongoc_collection_update_one , etc. Each driver’s test runner knows how to translate YAML into the driver’s API. The expectResult field asserts what the call returns. In this test, the driver tries to update a doc, it gets a network error from the fail point, it reconnects and retries, and succeeds, returning modifiedCount: 1 .
waitForEvent blocks until the driver has noticed the server closed the connection. (In this test, that happens earlier during updateOne , so the test runner won’t actually block on this line.) The driver handles the network error by marking the server’s type as Unknown , meaning the driver has to figure out the server’s status once it reconnects.
expectEvents checks that the driver sent two update commands on the wire, meaning it retried the write exactly once, plus there was a poolClearedEvent showing the driver discarded all its connections after the network error.
outcome reads the collection back to confirm x was incremented exactly once—the retry didn’t apply the update again.

This example shows lots of exciting features! The Unified Test Format lets all the drivers share a test suite. We can prove they all act the same by publishing tests they must all pass. We can update a spec, and force all the drivers to comply with the change, by publishing changes to the shared tests and watching all outdated drivers fail.

Additionally, this test is checking hidden behaviors that ordinary integration tests couldn’t observe. We use failPoint to make the server close the connection, so we can exercise the driver’s auto-retry logic. From the API surface, retries are invisible—that’s the point. But this YAML test triggers a retry and tests three hidden behaviors: the driver retries exactly once, it marks the server type Unknown , and it clears its connection pool. We could assert the entire contents of the two update commands the driver sends on the wire, if we wanted to.

Results #

The Unified Test Format has saved us tens of thousands of lines of code over the years, and it’s probably saved us from scores of awful bugs. It enforces spec conformance so when you use MongoDB from several programming languages, you get a consistent API and predictable behavior.

Here are some numbers, starting with code savings. When we created the unified format in 2020, we generalized the YAML test format used by lots of different specs into one format to rule them all. Seven drivers replaced their per-spec test runners with a single Unified Test Format runner, and every one of these came out smaller. We cut 22,000 lines total. The Java Driver alone deleted 6,000 lines of test-runner code.

Meanwhile, we added more and more conformance tests. The Unified Test Format corpus went from about a thousand lines in 2021 to 124,000 today. The biggest jumps are when we mechanically ported tests from per-spec YAML formats into the unified format.

Do the tests actually prevent bugs? We identified a natural experiment: Five drivers implemented the CRUD spec years before they adopted its YAML tests, which gives us a before and after to compare. We used Claude to classify every resolved ticket in those drivers—6,836 of them—and counted the ones that were genuine violations of the CRUD Spec. Four of the five drivers had a lower bug rate after adopting YAML tests.

Node.js is the embarrassing one: its bug rate went up . Years after it adopted the YAML tests we discovered that its BulkWriteResult and BulkWriteError classes were inconsistent with the specs and the other drivers. Its test runner hadn’t asserted their contents rigorously enough. The Driver Team filed a bunch of bugs and changed the field names over two major releases.

The IEEE International Symposium on Software Reliability Engineering (ISSRE) just accepted my paper about YAML testing, “The Polyglot’s Dilemma: Conformance Testing a Dozen Specs in as Many Languages.” Driver engineers Jeremy Mikola and Jeff Yemin are my coauthors. The paper has more detail about the history of our YAML tests, and it has plenty of stats and lessons. Check it out, it’s only 6 pages .

Images:

From The history of Herodotus , 1862.
Late 19th C. ad for Wheeler & Wilson sewing machine.

2026 Ruby on Rails Community Survey Results

Lobsters

railsdeveloper.com

2026-10-24 12:50:50

Comments...

Original Article

The Results Are In!

Nearly 1,800 developers from the Ruby on Rails community across 80 countries shared their thoughts on the tools, frameworks, and workflows that shape their daily development lives.

This year, we also asked about something that's on everyone's mind: AI. How teams are using it, how they feel about it, and whether it's actually changing the way they work.

This is the ninth edition of our survey since 2009. For nearly two decades, it has been one of the key ways our team at Planet Argon keeps a pulse on how this community has evolved.

Some of these questions date back to our very first survey, allowing us to track trends over time. Others are new additions, designed to reflect what's changed in our ecosystem since we last asked.

Now it’s time to dig in. We hope you find something useful, surprising, or at least validating here.

How to read the charts: Responses were collected from April to early July 2026. Percentages are based on the people who answered each question. Many questions let people pick more than one answer, so those totals add up to more than 100%. Write-in answers were grouped by hand.

Demographics

Who took the 2026 survey.

Which one of the following applies to you?

Percent of respondents.

How did you learn to code?

Percent of respondents by survey year.

In 2026 : CS degree 44% Self-taught 41% Bootcamp 8% On the job 7%

How many years of experience do you have developing with Ruby on Rails?

Percent of respondents.

Teams & Responsibilities

How Rails development teams are shaped and how they collaborate.

How big is the software development team for your primary Rails app(s)?

Percent of respondents.

Has your development team grown or shrunk in the last two years?

Percent of respondents by survey year.

In 2026 : About the same size 51% Grown 30% Shrunk 19%

Who uses your application/s?

Percent of respondents by survey year.

In 2026 : Mostly consumer-only (public) 47% A balanced mix of consumers and internal users 42% Mostly internal users only 11%

How do you give your developers access to realistic data for local development and bug reproduction?

Select all that apply. Percent of respondents; totals add up to more than 100%.

When new developers join your project, where do they tend to struggle most?

Respondents could pick up to three. Percent of respondents; totals add up to more than 100%.

Other responses

Authentication and authorization setup

Ruby & Rails Version Updates

What versions the community is running and what holds upgrades back.

What versions of Ruby are you using in your applications?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Which Ruby version manager are you using?

Percent of respondents by survey year. Select all that apply, so totals add up to more than 100%. mise appeared twice on the form; respondents who picked both are counted once.

In 2026 : rbenv 39% mise 38% Docker (base images) 25% asdf 20% RVM 17%

What versions of Rails are you using in your applications?

Select all that apply. Percent of respondents; totals add up to more than 100%.

How long has your Ruby on Rails application been in development?

Percent of respondents.

What keeps you from keeping your Ruby and Rails versions up-to-date?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Configuration

How Rails applications are configured and what they integrate with.

What are you primarily working on?

Percent of respondents by survey year.

In 2026 : Monolith 81% Hybrid 16% Microservices 4%

What third-party email services do your Rails apps integrate with?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Other responses

MailPace (formerly OhMySMTP) SendPro (formerly Flowmailer)

Which Active Job adapters do you use to process background jobs?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Do any of your Rails applications have a companion native mobile app?

Percent of respondents.

How is your companion mobile app built?

Asked of respondents with a companion native app. Select all that apply. Percent of those respondents; totals add up to more than 100%.

Learning

How Rails developers built their skills and stay connected to the community.

What was your level of web programming expertise before learning Ruby on Rails?

Percent of respondents.

In the first two years of learning Ruby on Rails, what methods did you use?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Of these methods of learning, which did you feel worked best for you?

Percent of respondents.

If you attended a bootcamp and/or school for learning to code...which one(s)?

Write-in responses, listed by number of mentions. Percentages are of respondents who answered this question.

Most Mentioned

Le Wagon
Flatiron School
The Odin Project
General Assembly
Dev Bootcamp
Big Nerd Ranch
Epitech
The Iron Yard
Turing School
Makers Academy

Other Mentions

École 42
App Academy
Launch School
Career Foundry
Epita
The Hacking Project
Udemy
CodeUp
Rolemodel Software Craftsmanship Academy
Treinadev

What type(s) of educational content helps you learn the most effectively?

Respondents could pick up to three. Percent of respondents; totals add up to more than 100%.

Have you been to a conference (regional or bigger) for Ruby and/or Rails in the last year?

Percent of respondents by survey year.

What conference(s) are you hoping to attend in the coming year?

Write-in responses, ranked by number of mentions. Rails World led by a wide margin: 30% of respondents plan to attend.

Top 10

1. Rails World
2. EuRuKo
3. Brighton Ruby
4. RubyConf
5. RubyKaigi
6. Tropical.rb
7. Blue Ridge Ruby
8. Rocky Mountain Ruby
9. Helvetic Ruby
10. SF Ruby

Other Mentions

TinyRuby
Balkan Ruby
Kaigi on Rails
Rails Girls
Baltic Ruby
Blastoff Rails
RubyConf Austria
Deccan Queen on Rails
WrocLove.rb
XO Ruby

Do you participate in Ruby/Rails user groups?

Percent of respondents who said yes, by survey year. Local in-person and online groups were asked as separate questions. Online groups were first asked in 2020.

In 2026 : Online 35% Local in person 26%

Who are your favorite live coding streamers or screencasts?

Top 10

Honorable Mentions

Gems & Open Source

Community contribution and the gem ecosystem.

How often do you contribute to open source projects?

Percent of respondents.

Which Ruby gems frustrate you the most?

Write-in responses, ranked by number of mentions. Percent of respondents who answered this question. Tied answers share a rank.

Top 10

1. devise
2. nokogiri
3. rspec
4. activeadmin
5. rubocop
6. webpacker
7. pundit
7. factory_bot
9. sidekiq
10. pagy

Other Responses

haml
jbuilder
ransack
cancancan
omniauth
active_model_serializers
carrierwave
grpc
turbo
graphql

Which Ruby gems do you love?

Write-in responses, ranked by number of mentions. Percent of respondents who answered this question. Tied answers share a rank.

Top 10

1. devise
2. sidekiq
3. rubocop
4. ruby_llm
5. rspec
6. pagy
7. pry
7. pundit
9. puma
10. ransack

Other Responses

view_component
standard
turbo-rails
herb
minitest
strong_migrations
bullet
phlex
good_job
kamal

JavaScript + Rails

How JavaScript sits alongside Rails in modern applications.

What tool(s) do you use to manage your JavaScript libraries?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Which JavaScript libraries or frameworks do you use with Rails? Check all that apply.

Select all that apply. Percent of respondents; totals add up to more than 100%.

Other responses

Preact 1% Elm 1% Unpoly 0.4%

What JavaScript testing frameworks are you using to write tests?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Other responses

WebdriverIO Ava

Code Integrity & Security

Testing, monitoring, and staying on top of vulnerabilities.

What testing frameworks are you using to test your Rails app(s)?

Select all that apply. Percent of respondents; totals add up to more than 100%.

What is your current code to test/spec ratio?

Percent of respondents.

What is your go-to Ruby debugger tool?

Percent of respondents.

Which application monitoring services do you use?

Select all that apply. Percent of respondents; totals add up to more than 100%.

What code quality tools do you use?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Other responses

Coveralls Skunk

What tools are you using to track security vulnerabilities?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Where does your primary Rails application feel most fragile right now?

Respondents could pick up to three. Percent of respondents; totals add up to more than 100%.

Deployment & DevOps

Where Rails apps run and how they get there.

How often do you deploy your Rails applications to production?

Percent of respondents by survey year.

In 2026 : Multiple times a day 41% Multiple times a week 36% Multiple times a month 18% Multiple times a quarter 5%

Where is your source code hosted?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Which automated deployment tools do you use? (select all that apply)

Percent of respondents by survey year. Select all that apply, so totals add up to more than 100%. Kamal grew from 2.4% in 2024 to 23.8% in 2026, after Rails 8 made it the default deployment tool for new apps.

In 2026 : Continuous Deployment via CI 60% Git 40% Kamal 24% Capistrano 16% None 8%

Where do you host your production Rails app(s)?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Other responses

Hatchbox Railway Coolify Vultr

Which Rails Servers are you using in production?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Which Continuous Integration (CI) servers do you use? (select all that apply)

Percent of respondents by survey year. Select all that apply, so totals add up to more than 100%. 4% use no CI.

In 2026 : Github Actions 69% Circle CI 16% Gitlab 15% Jenkins 7% Buildkite 5%

Runner-ups in 2026

CodePipeline (AWS) 2% Bitbucket Pipelines 2% Travis CI 0.4% Codeship 0.1%

What CDN(s) do you use? (select all that apply)

Percent of respondents by survey year. Select all that apply, so totals add up to more than 100%. 22% don't use a CDN.

In 2026 : CloudFlare 45% CloudFront 32% Cloudinary 4% Google Cloud CDN 3% Fastly 3%

Runner-ups in 2026

Azure CDN 1%

Databases

Which data stores back Rails applications.

Which nosql databases do you use in production? (select all that apply)

Percent of respondents by survey year. Select all that apply, so totals add up to more than 100%.

In 2026 : Redis 76% PostgreSQL (via JSONB / HStore) 46% ElasticSearch 25% MongoDB 9% DynamoDB 8%

Runner-ups in 2026

CouchDB 0.4%

Which relational databases do you use in production?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Which database would you prefer to use in production?

Percent of respondents by survey year.

In 2026 : PostgreSQL 85% SQLite 7% MySQL 6% MariaDB 2%

OS, Editors & Servers

The tools developers reach for on their local machines.

Which operating system do you primarily use for local development?

Percent of respondents.

Are you using Docker for local development?

Percent of respondents.

What is your preferred code editor?

Percent of respondents by survey year. Zed (10.2%) and Cursor (5.4%) were write-in responses in 2026 — they weren't offered as formal options in prior surveys.

In 2026 : Visual Studio Code 45% Vim-based 23% RubyMine 19% Zed 10% Sublime Text 7%

Runner-ups in 2026

TextMate 1% IntelliJ 1%

AI Adoption

How AI tools are (and aren't) landing in Rails workflows.

How is your team currently using AI tools in your development workflow?

Percent of respondents.

Which AI coding tools or assistants do you use?

Select all that apply. Percent of respondents; totals add up to more than 100%.

Other responses

Windsurf Amazon Q Developer Cline Aider Tabnine Continue.dev

Beyond coding assistance, how is your team exploring AI in relation to your Rails applications?

Select all that apply. Percent of respondents; totals add up to more than 100%.

AI coding tools are overhyped and won't fundamentally change how I build software.

Percent of respondents.

17% agree 13% neutral 69% disagree

I feel frustrated by the growing expectation to use AI in my workflow.

Percent of respondents.

33% agree 21% neutral 46% disagree

I intentionally limit AI to boilerplate tasks so I stay in control of the real problem-solving.

Percent of respondents.

27% agree 22% neutral 51% disagree

The pace of AI advancement makes me anxious about the long-term value of my skills.

Percent of respondents.

51% agree 17% neutral 32% disagree

AI tools are here to stay and I've made peace with that, limitations and all.

Percent of respondents.

76% agree 14% neutral 10% disagree

I've adapted how I work and AI genuinely makes me more capable.

Percent of respondents.

74% agree 14% neutral 12% disagree

Leadership largely ignores AI's impact on how we build software.

Percent of respondents.

12% agree 15% neutral 73% disagree

Our team restricts or prohibits AI tools due to risk concerns.

Percent of respondents.

14% agree 11% neutral 75% disagree

AI use is limited to experiments; it hasn't made it into our real workflows.

Percent of respondents.

9% agree 8% neutral 83% disagree

Our approach to AI adoption feels reactive and poorly thought through.

Percent of respondents.

21% agree 23% neutral 56% disagree

We're taking AI seriously and working toward a realistic, balanced stance.

Percent of respondents.

68% agree 21% neutral 12% disagree

We have clear policies that actually empower engineers to use AI effectively.

Percent of respondents.

46% agree 28% neutral 25% disagree

Which AI models do you reach for most in your development work?

Write-in responses, grouped by hand. Percent of respondents who answered; people could name more than one.

Other Responses

Claude (unspecified) GLM / Big Pickle (Zhipu AI) Claude Haiku MiniMax Gemma (Google) GitHub Copilot Grok (xAI) Mistral/Devstral Local LLMs Amp

The Future of Rails

Sentiment on where Rails is heading and what teams are planning next.

I feel confident security vulnerabilities are being addressed in new Rails releases.

Percent of respondents.

90% agree 10% neutral 0.8% disagree

What technical changes have teams taken on, or are considering?

Two questions: what significant technical changes has your team completed in the last 24 months, and what is it planning or evaluating in the next ~12 months? These reflect choices individual teams made for their own codebases and constraints, not recommendations. Select all that apply. Percent of respondents who answered each question (1,659 and 1,509). None in the last 24 months: 5%. None planned: 11%.

Completed, last 24 months Planning or evaluating, next 12 months

Upgrades

Rails version upgrade 76% · 62%

Ruby version upgrade 71% · 58%

AI & the app layer

Adopted AI agents or agentic coding workflows 41% · 19%

Overhauled the JavaScript / frontend layer 20% · 18%

Replaced or overhauled background job processing 15% · 10%

Replaced or rewrote the authentication system 10% · 8%

Infrastructure & deploys

Adopted Kamal 14% · 7%

Adopted self-hosted CI runners 8% · 4%

Consolidated CI pipelines around GitHub Actions 15% · 4%

Migrated away from Heroku 11% · 13%

Moved to self-hosted infrastructure 7% · 4%

Switched to a different hosting provider 14% · 9%

Architecture

Consolidated services back into a monolith 6% · 4%

Extracted functionality into Rails Engines 6% · 5%

Introduced Packwerk for modular boundaries 3% · 3%

Merged multiple apps into one 7% · 5%

Migrated to a monorepo 5% · 2%

Moved from monolith toward services 5% · 6%

Data

Migrated away from SQLite 1% · 0.5%

Migrated to a different database engine 5% · 3%

Migrated to SQLite in production 3% · 2%

Testing & types

Adopted RBS / Steep for type checking 1% · 2%

Adopted Sorbet for static type checking 2% · 2%

Migrated from Minitest to RSpec 2% · 1%

Migrated from RSpec to Minitest 6% · 4%

Shifted to running tests locally before deploying 4% · 4%

Dots with a halo are past the 45 % axis; the exact numbers are beside each row.

Ruby on Rails is my server side framework of choice.

Percent of respondents.

91% agree 6% neutral 4% disagree

The Rails core team is shepherding the project in the right direction.

Percent of respondents.

74% agree 21% neutral 5% disagree

In Conclusion

AI is no longer a sidebar in Rails development. It showed up throughout this year's responses: in the tools people reach for, the gems they love, and the workflows they're rethinking. The community isn't watching from a distance; we're actively exploring.

Some things remain constant. A few of the same tools, books, and podcasts that have anchored this ecosystem for years are still showing up. And new ones are appearing alongside them.

At Planet Argon , we remain steadfast in our belief that Ruby on Rails is an exceptional platform to invest in, and we're excited to continue supporting its growth. If a few of these numbers hit close to home (inherited code, an upgrade that keeps sliding, an AI policy that's still a draft), that's the work we do every day. Come say hello .

Thank you to everyone who took the time to contribute to the 2026 Rails Community Survey, our ninth edition since 2009. Eighty countries' worth of perspectives on a framework that keeps finding new reasons to stick around. We'll see you in 2028!

Sam Altman: 'I No Longer Think We're Gonna Be Able to Just Patch All the Bugs'

Hacker News

gizmodo.com

2026-10-24 12:47:19

Comments...

Original Article

It seems like every day a new, potentially internet-shattering cybersecurity issue is discovered or exploited by artificial intelligence. It’s gotten bad enough that even OpenAI CEO Sam Altman, one of the people who is most responsible for pushing AI development forward despite the risks, now believes that simply patching the problems is no longer a viable option.

During an appearance at the Stanford Graduate School of Business , Altman told a group of grad students that the cybersecurity crisis is worse than anyone could imagine. “I no longer think we’re going to be able to just patch all the bugs,” he told the audience, in part due to the ongoing advancements of AI models and in part because the targets of cyber attacks have acted too slowly to get ahead of it.

“This cybersecurity…I don’t even know a dramatic enough word to use, but the problem coming towards us, I think, is still something that we have not, as organizational leaders or countries or individuals, taken seriously,” he said.

Altman pointed to the freakout when Anthropic announced its Claude Mythos model with the ominous warning that it can’t be made public because it is simply too powerful and could lead to the undoing of cybersecurity as we know it. “People definitely patched some bugs, but it was another one of these cases where people didn’t really intuit the exponential.”

Basically, Altman suggested that the organizations that did take action just patched up the problems that AI models were able to find and called it a day, as if no other future bugs or exploits would be found. “Largely speaking, I think most organizational leaders have somewhat moved on. And the models have kept going,” he said.

Altman seems to be scolding these organizations for not taking the situation seriously enough or considering that models might evolve and improve, but seems to have less interest in reflecting on whether or not he might have undersold the issue while pushing forward because fully acknowledging it might have led to a more serious push to slow or stop development while he’s got an initial public offering he’s trying to get to.

Notably, when OpenAI’s own agents broke containment and hacked Hugging Face , it was clear that its own procedures and security methods were insufficient. Despite pushing for the AI industry to adopt chain-of-thought monitoring—a technique for examining a model’s internal reasoning—as standard practice, OpenAI had not implemented it for its own training sessions . And, according to an investigation by AI safety nonprofit METR , OpenAI had already been alerted that its agents had escaped their sandbox and patched the exploit that allowed them to do so. But those measures failed to prevent another escape that led to the attack.

So we’re kind of in pot-calling-the-kettle-black territory here for Altman. But worry not, OpenAI’s founder has a solution for where patching fails: more AI. “I think we’re going to have to completely switch the defense model to using the same technology for a new kind of defense shield,” he said. OpenAI is apparently getting into the arms dealer model of selling to both sides of a conflict.

To think, we were so close to not having to live this nightmare. Altman revealed during the talk that he nearly went into investment banking because “it was what all the cool kids wanted to do, and I fell victim to peer pressure.” It’s not clear if he’s still as susceptible to peer pressure as he once was as a teenager, but we could all try bullying him just to see if it still works.

The St. Helena 5 pence coin shows Jonathan, a roughly 190 year old tortoise

Hacker News

de.numista.com

2026-10-24 12:41:55

Comments...

Original Article

Roku developer repositories moved from GitHub to GitLab

Hacker News

blog.roku.com

2026-10-24 12:06:26

Comments...

Original Article

Neural chip decodes interactions between brain regions

Hacker News

actu.epfl.ch

2026-10-24 11:57:17

Comments...

Original Article

EPFL researchers have developed an implantable neural chip that tracks communication across brain regions, identifying cognitive and emotional states in real time.

Deep brain stimulation (DBS) is a therapeutic technique that delivers electrical pulses to specific areas of the brain via an implant to modulate neural activity. It is already widely used for movement disorders such as Parkinson’s disease, and researchers are increasingly exploring its potential for severe psychiatric illnesses including major depression, post-traumatic stress disorder, and obsessive-compulsive disorder.

However, most existing DBS systems operate in what engineers call an “open loop” manner: stimulation is delivered according to predefined settings rather than continuously adapting to the patient’s brain activity. Even among closed-loop, or adaptive systems, many rely on signals recorded from a single brain region. This is a major limitation for psychiatric disorders, where clinically relevant information may be distributed across networks of interacting brain regions.

“Our work is based on the growing body of research suggesting that psychiatric disorders arise more from disruptions in communication between brain regions than from dysfunction of any single region,” explains Mahsa Shoaran, head of the Integrated Neurotechnologies Lab in EPFL’s School of Engineering and Neuro-X Institute.

The INL team at EPFL's Geneva campus. From left: Amitabh Yadav, Jieun Joo, Mahsa Shoaran, Jinhan Liu, and Daney Alex. 2026 EPFL / Lundi13 - CC-BY-SA 4.0

Shoaran and her team have developed a low-power, implantable neural system-on-chip. Dubbed LogSync, it records brain activity and extracts biomarkers that describe the strength of brain waves (oscillations) and synchrony between signals from different brain regions. A machine-learning algorithm then analyzes these network-level biomarkers to distinguish cognitive and emotional states, and generate stimulation triggers when specific states are detected.

The work, published in the IEEE Journal of Solid-State Circuits , was developed as part of a CHF 6.6 million grant from the US National Institute for Mental health (NIMH) to develop implantable systems capable of measuring and controlling oscillatory brain networks for severe psychiatric illnesses, particularly mood and anxiety disorders. It builds on the lab's previous work on brain-to-text decoding and closed-loop neuromodulation , extending these concepts to network-level biomarkers and adaptive decoding for future psychiatric therapies.

More targeted stimulation at lower power

The researchers evaluated LogSync using human brain recordings from previous psychiatric experiments. One dataset captured changes in cognitive engagement while performing a mental task, while another captured emotional arousal as participants viewed video clips. The algorithm distinguished these cognitive and emotional states from the neural recordings alone. In further experiments conducted in rats at the University of Minnesota, the implant tracked ongoing oscillations and generated stimulation triggers at predefined phases of brain activity.

The LogSync chip, measuring approximately 4x2 mm. 2026 EPFL / Lundi13 CC-BY-SA 4.0

Shoaran says that major challenge was achieving all this functionality while working within the very limited power budget of an implantable system.

“Our entire system is co-designed, meaning the algorithms and hardware are developed together with the constraints of implant in mind. This approach helped us achieve network-level neural signal processing and decoding on a single chip, while keeping power consumption under 200 microwatts — a fraction of that typically required by many implantable neural-interface systems,” she says. Another innovation is LogSync’s use of logarithmic computations, which simplify the complex operations needed for brain-network analysis and real-time biomarker extraction and decoding.

LogSync's initial validation focused on psychiatric applications. But the capability to extract brain-network biomarkers to trigger precisely timed stimulation is broadly applicable across next-generation neurotechnology, including adaptive DBS for movement disorders, closed-loop non-invasive stimulation, and emerging focused-ultrasound interfaces.

In parallel, the laboratory is developing new machine-learning methods that learn directly from neural recordings rather than predefined biomarkers. Their recent ICML 2026 work, which uses self-supervised learning to capture neural activity across regions, channels, and time, supports broader efforts to bring intelligent neural interfaces closer to clinical applications, including through Infera Neuro , an EPFL spin-off co-founded by Shoaran.

Funding

United States National Institute of Mental Health

Swiss State Secretariat for Education, Research, and Innovation (SERI)-funded ERC Starting Grant

References

D. Alex et al., "LogSync: A Low-Power Logarithmic SoC for Cross-Regional Synchrony Extraction and Adaptive Psychiatric State Classification," IEEE Journal of Solid-State Circuits (JSSC), Sept 2026 doi: 10.1109/JSSC.2026.3728617 .

J. Liu and M. Shoaran, “RECTOR: Masked Region-Channel-Temporal Modeling for Affective and Cognitive Representation Learning”, International Conference on Machine Learning (ICML), 2026 https://proceedings.mlr.press/v306/liu26dt.html

D. Alex et al., "A 32-Channel 196-μW Logarithmic SoC for Brain Network Connectivity Extraction and Adaptive Psychiatric Symptom Classification," 2025 Symposium on VLSI Technology and Circuits (VLSI Technology and Circuits), Kyoto, Japan, 2025, pp. 1-3, doi: 10.23919/VLSITechnologyandCir65189.2025.11075022 .

Apple Built a Photo-Realistic Functional Original iPod for Apple Music’s 404 Page

Daring Fireball

music.apple.com

2026-10-24 11:50:02

It seems like this amazing Easter egg only launched yesterday, to celebrate the original iPod’s 25th anniversary. Exquisitely well done. More like this, please. ★ ...

Original Article

Oai-math-revised: a community hub for revising OpenAI's math write-ups

Hacker News

terrytao.wordpress.com

2026-10-24 11:35:17

Comments...

Original Article

[This is a guest post by Abhinav Nellore , Johannes Schmitt , Soledad Villar , and Rachel Ward – T.]

OpenAI’s math write-ups at https://github.com/openai/math can be difficult to understand and can have incomplete citations.

https://github.com/mathcommunity/oai-math-revised/ seeks to be an inclusive effort to improve these write-ups, and the broader math community–students, postdocs, professors, and enthusiasts–is invited to participate.

The repo is browsable at https://mathcommunity.github.io/oai-math-revised/

We also invite the community to email mathcommunityadmin@gmail.com if they want to serve as admins/reviewers and for which categories from https://github.com/openai/math/blob/main/overview.pdf they’d be appropriate for reviews.

Mississippi’s Black Majority and the Fight for Political Power

Portside

portside.org

2026-10-24 11:33:06

Mississippi’s Black Majority and the Fight for Political Power Kurt Stand Sat, 10/24/2026 - 11:33 ...

Original Article

The future of the nation is in the South, the former Confederacy and ground zero of America’s civil rights struggles. We need only look to a place like Mississippi to understand the mess that is this settler colonial project called America, with its unaddressed and seemingly intractable internal contradictions. Mississippi has shown us the promise of Black power snuffed out by white supremacy , unjust laws and the Klan.

Today, Mississippi is an example of how Black people are once again so close to cracking the code and freeing ourselves and the nation in the process. The first time was during Reconstruction following the Civil War, when Black folks were a majority of the population, and had over 200 elected officials, including statewide offices, two U.S. senators, a lieutenant governor and secretary of state. A new state constitution provided for basic rights, including voting rights, and reforms such as public education. Then, the federal troops left and took with them their protection of Black people, leaving the white power structure to their own devices and allowing them to take back the Magnolia state.

The 1890 Mississippi convention - which had only one Black delegate , Isaiah Montgomery - was designed to enact a new state constitution to legalize voter suppression and strip Black people of their rights. Specifically, the new constitution included a poll tax and literacy test to wipe out Black power in the majority Black state, and was the death knell for Black power in that state. Black folks in Mississippi have not recovered to this day.

In a state of contradictions, the blackest state in the Union - about 40% - is among the reddest and most conservative states. Despite the gains of the civil rights movement and the legislation that it brought, there is now an effort in Mississippi to deprive Black voters of their voting rights through redistricting and other means. And the state has not had a statewide Black elected official since 1890. Welcome to America.

America is a place where they force you to fight for your basic rights, time and time again, and Mississippi is a prime example of this. Known for its Jim Crow-era lynchings and brutal violence - from the lynching of Emmett Till and those three civil rights workers, James Chaney, Andrew Goodman, and Michael Schwerner, to the assassination of Medgar Evers and Vernon Dahmer and others - Mississippi has been a hot mess for quite some time. And yet, today, with the sketchy and suspicious death of Nolan Xavier Wells, and the Black people found hanging from trees in 2026, it seems that the state never separated itself from its deadly past of racial violence and racially violent laws. Not surprisingly, Mississippi typically falls at or near the bottom of the list of key socioeconomic indicators such as health, children’s health and economy, reflecting a state with a legacy of slavery and Jim Crow, and placing a low priority on the well-being of people.

Nina Simone said it best - or sang it best - in her iconic song, “Mississippi Goddam”:

Alabama’s gotten me so upset
Tennessee made me lose my rest
And everybody knows about Mississippi Goddam
Can’t you see it
Can’t you feel it
It’s all in the air
I can’t stand the pressure much longer
Somebody say a prayer

ChatGPT Image Oct 21, 2026, 01_26_30 PM-4

Later in the song, Simone elaborates:

…Yes, you lied to me all these years
You told me to wash and clean my ears
And talk real fine just like a lady
And you’d stop calling me Sister Sadie
Oh, but this whole country is full of lies
You’re all gonna die and die like flies
I don’t trust you any more
You keep on saying “Go slow”
“Go slow”
But that’s just the trouble
“Do it slow”
Desegregation
“Do it slow”
Mass participation
“Do it slow”
Reunification
“Do it slow”Do things gradually“Do it slow”But bring more tragedy"Do it slow”Why don’t you see it?Why don’t you feel it?don’t know I don’t know.

Mississippi, the blackest state masquerading as a deep red state, has an opportunity to change course. In the race for U.S. Senate, Scott Colom, a Black Democrat, has a chance to unseat Cindy Hyde-Smith. And what a wondrous thing it would be. For many of these states in the South, white supremacy is living on borrowed time. Nakedly brutal violence and obscene Jim Crow laws will only get you so far, and when demographics catch up with you, that’s that. In states such as Mississippi, Louisiana, Georgia, Alabama and others, Black people can vote as a bloc and peel off a segment of white voters for a winning coalition, along with Latinx and Asian voters. Sooner or later, perhaps as early as November, Black Mississippians will put such a strategy to the test and win.

BlackCommentator . He is a lawyer and journalist based in Philadelphia, and a contributor to the Progressive Media Project, McClatchy-Tribune News Service, In These Times and Philadelphia Independent Media Center. He contributed to the book, States of Confinement: Policing, Detention, and Prisons (St. Martin's Press, 2000). His blog is davidalove.com.

The Black Commentator's core audience is African Americans and the African world and their allies in the movement for economic justice, social justice and peace. It is also important to share Black American and African world perspectives with the rest of the world, a mission uniquely suited to the Internet. Our focus is commentary, analysis and investigation, elements of political dialogue that are absolutely essential to the creation of movements for social change. Without regular forums for advocacy and debate, a people are at the mercy of their adversaries.

Bringing uv and ty together

Lobsters

astral.sh

2026-10-24 11:27:34

Comments...

Original Article

TL;DR: Experimental uv-ty integration is now available, enabling first-class support for Python scripts (on the CLI and in the editor) and a unified uv check command.

This is a step towards an integrated Astral toolchain, one that uses a shared understanding of your project to enable entirely new capabilities.

At Astral, we build high-performance tools for the Python ecosystem: uv , our package manager; Ruff , our linter and formatter; and ty , our type checker and language server.

Historically, each Astral tool has focused on making a different component of Python development more productive. But we see an opportunity to further Python by unifying traditionally separate capabilities into an integrated toolchain.

Our vision for the Astral toolchain is simple: while each tool should be individually usable, useful, and interoperable with the rest of the ecosystem, they should be even more capable when used together.

Today, we’re announcing an experimental integration between uv and ty , available in preview. uv understands your Python project’s environment and dependencies, while ty understands your code. By combining the two, we can unlock new functionality beyond what either tool can provide individually.

First-class support for Python scripts #

PEP 723 enables Python scripts to declare their dependencies and Python version requirements through inline metadata. uv already uses this metadata to prepare an environment when running a script. Now, ty can use this metadata to understand your scripts.

On both the command line and in the editor, ty now uses inline metadata to discover scripts throughout your project and leverages uv to prepare an environment for each script. These environments allow ty to check your scripts against their declared requirements.

Scripts can have different requirements within the same repository. Each script is checked against its own dependency declarations, even if those dependencies or Python requirements differ from the surrounding project.

Declare dependencies inline with PEP 723, save to sync with uv, and use ty’s completions, hover information, and Go to Definition capabilities in your editor.

Declare dependencies inline with PEP 723, save to sync with uv, and use ty’s completions, hover information, and Go to Definition capabilities in your editor.

When the integration is enabled in your editor, ty automatically invokes uv to prepare the script’s environment in the background, which it uses to provide type checking, code navigation, and completions based on the script’s declared requirements.

Over time, we plan to enable script support by default, and enable automatic environment setup for standard Python projects.

A unified checking command #

uv check introduces a unified diagnostic interface to uv, starting with support for ty. Over time, we plan to support Ruff in uv check to unify linting and type checking into a single command.

Running uv check will automatically prepare your project’s environment, install the required dependencies, and check your project with ty. It “just works.” (If you never run uv check , nothing changes for your uv experience; the ty binary is installed separately on first invocation.)

With uv check , you can check individual packages, or an entire workspace. In a workspace, use uv check --package <name> to select an individual package, or uv check --all-packages to check every package. uv uses your workspace configuration to determine what to check, so the command stays the same as your workspace grows.

Sync your project’s dependencies and type-check your code with a single command.

Sync your project’s dependencies and type-check your code with a single command.

Standalone PEP 723 scripts have independent environments and are checked separately. Use uv check --script example.py to check a script using its declared requirements.

uv check automatically uses the ty version recorded in your project’s lockfile. Commit your project configuration and lockfile, and developers and CI running uv check will share the same ty version without separately maintained pins.

The ty pre-commit hook also uses uv check under the hood to run ty before each commit over your Python project. By using uv check , the hook automatically sets up the environment for ty from your project’s dependency declarations.

How it works #

The uv-ty integration is powered by uv workspace metadata , which gives ty a structured view of your project or script’s packages, dependencies, and Python environment. ty then uses this information to provide type checking and editor features that reflect the configured environment.

For PEP 723 scripts, ty invokes uv to prepare the script’s environment, which includes installing declared dependencies. As dependency installation can require execution of third-party Python code, automatic environment setup is currently opt-in.

To try the integration for PEP 723 scripts in VS Code, install uv and the ty VS Code extension , then enable the uv integration in your VS Code settings.json .

{
  "ty.experimental.useUv": "on"
}

You can also check your project and its PEP 723 scripts from the command line with:

Running uv check enables the integration automatically and requires no additional configuration.

Support for PEP 723 scripts and the uv check command requires uv 0.12.3 or later, and ty 0.0.76 or later.

Up next #

This integration is experimental, and we’d love your feedback as we refine the experience.

While this initial support largely leverages uv’s environment capabilities to power ty execution, we’re also working on a new category of checks that combine uv’s knowledge of your project’s dependencies with ty’s understanding of your code (e.g., to detect unused dependencies), which we’ll cover in a future post.

And, in parallel, we’re continuing toward ty’s stable release.

Thank you for building with us!

Thanks to Aria Desires , Micha Reiser , and Zsolt Dollenstein from the Astral team for implementing the features behind this integration.

FreeDNS

Hacker News

freedns.afraid.org

2026-10-24 11:20:01

Comments...

Original Article

For Members:

[	Main Menu	]
[	Domains	]
[	Subdomains	]
[	Web Forward	]
[	Dynamic DNS	]
[	IPv6 Reverse	]
[	Backup DNS	]
[	Preferences	]
[	Registry	]
[	Logout	]

For Everybody:

[	Home	]
[	Resources	]
[	About Us	]
[	FAQ	]
[	News	]
[	DNS Stats	]
[	AUP/TOS	]
[	Contact	]

[	Router Setup Guide	]

Free DNS Hosting, Dynamic DNS Hosting, Static DNS Hosting, subdomain and domain hosting.

Dynamic update demonstration example ( v2 interface )

[ ~ ] $ curl https://sync.afraid.org/u/CyTXMbtq5cPnLjEg5vKHTPDE/
Updated demo.freshdns.com from 107.170.238.X to 50.23.197.94

IPv6 updates? Easy, same as above, just add v6 .

[ ~ ] $ curl https:// v6 .sync.afraid.org/u/CyTXMbtq5cPnLjEg5vKHTPDE/
Updated demo.freshdns.com from 50.23.197.94 to 2607:f0d0:1102:d5::2

Common Uses:

Free DNS , Dynamic DNS , Static DNS and Premium DNS services
Simple to use, trusted by millions of users
Control your domain name traffic, anytime, anywhere, in realtime, WAN, LAN, and etc
23,236 domains in the shared domain registry . Click on any to attach, or use your own
Access your computer with a name (like zeus.afraid.org or yourdomain.com) instead of a numeric IP address. Point to home/work/school/datacenter/cloud and etc

Feature List:

Free and premium subdomain hosting, domain hosting, backup dns, reverse IPv6 DNS hosting (forward/reverse)
Free and premium URL redirection [web forwarding]
Update your IP instantly using the automated update interface
Easy dynamic updates, examples: v1 DD-WRT Guide | v2 DD-WRT Guide (Native IPv6)
See more features...

Signup Q&A

Members:	7,161,396
Premium:	5,593
Records:	13,834,329
Zones:	1,276,001

Chan Karunamuni on the Duo’s Open/Close Translucent Transition

Daring Fireball

x.com

2026-10-24 11:03:44

Chan Karunamuni, human interface designer at Apple, on X: iPhone Duo is here! Excited to have worked on the design of our open/close transition. It’s designed to make the two displays feel like one seamless experience by perceptually bending the focal plane, not the content, so that it feels lik...

Original Article

Chan Karunamuni

@chan_k

iPhone Duo is here! Excited to have worked on the design of our open/close transition. It’s designed to make the two displays feel like one seamless experience by perceptually bending the focal plane, not the content, so that it feels like opening a window onto a singular view.

00:00

1:23 PM · Oct 23, 2026

389.1K

Views

Google illegally cut down 250K trees in Finland for data center

Hacker News

nypost.com

2026-10-24 10:38:34

Comments...

Original Article

See more of our coverage in your search results.

Google illegally demolished an estimated 250,000 trees in Finland to make way for a data center, leaving behind a lifeless mud wasteland that forced packs of wolves into a nearby town in search of food and infuriated locals, according to a report.

The tech super giant – continuing its expansion of the booming artificial intelligence industry – cleared 816 acres of woodlands in Northern Finland, The Guardian reported Thursday.

Google is accused of removing the trees and clearing the land before it had full approval — as Finnish law requires companies to complete a mandatory Environmental Impact Assessment before large-scale operations.

Finnish officials, outraged by the mass destruction, suspended all development at two of Google’s data center sites to assess the environmental impact.

An aerial view shows the site where a Google data center is set to be built in Muhos, Finland, on Sept. 29, 2026. AFP via Getty Images

The operation took place outside the rural town of Muhos — southeast of Finland’s fifth-largest city, Oulu — as devastating images of the aftermath captured the vast barren land filled only with tire tracks, muddy puddles and mounds of dirt.

The removal of the large area of trees destroyed the wildlife in the forest, leaving predators like wolves to search for food closer to human developments in the village of Otanmäki, 50 miles from the site.

“We had wolves coming into the village because all the wild animals moved out of the forest,” resident Anni Ranta told the Guardian.

“They fled. What worries me about the data centers is also the noise because this is hard rock soil. Even when we are standing here talking,” she added, comparing the sound to a drum.

Angry residents called out Google, asking for reprieve from the company to help repay for losses the community sustained from previous tech expansions on the land.

“It has been done in the wrong way. American style. No sense. No sense at all,” Muhos resident Antti Jakonen told the outlet, calling on the company to help restore the local salmon population that had been destroyed by hydropower years ago.

The removal of the trees led to water sources flowing near the site to turn brown and pollute the streams that feed the Oulujoki River. — The removal of the trees led to water sources flowing near the site to turn brown and pollute the streams. AFP via Getty Images

The site earmarked for Google's new data center in Vaala, Finland. — The site earmarked for Google’s new data center is seen in Vaala, Finland on Sept. 29, 2026. AFP via Getty Images

Ranta revealed she feared the construction of the data centers would be a perfect target for Russian aggression in the already tense European domain.

“I don’t want them in Finland at all. I don’t like the whole idea of AI and the world changing and the way it’s changing. It’s going too fast, too soon.”

Google’s two sites near Muhos and Kajaani, roughly 90 miles apart, are part of its $15 billion investment for AI infrastructure in the Nordic country, which was announced in September.

The Finnish Licensing and Supervision Agency gave Google’s project subsidiary, Tuike Finland Oy, a deadline of Oct. 23 to suspend all operations

“In the opinion of the Finnish Licensing and Supervision Authority, extensive preparatory measures have already been taken in the project areas based on the currently available reports, such as the removal of trees, the stripping of topsoil, the construction of construction site roads and storage areas, changes to ditches and culverts, and stormwater arrangements,” Tommi Muilu, Head of the Environmental Department, said.

“In our opinion, the measures in question will change the environment and cause impacts, the identification and assessment of which are among the key objectives of the EIA procedure,” Muilu said.

Start your day with all you need to know

Morning Report delivers the latest news, videos, photos and more.

Thanks for signing up!

The removal of the trees led to water sources flowing near the site to turn brown and pollute the streams that feed the Oulujoki River.

Google’s Finnish top chief Antti Järvinen claimed the company believed it had legislative approval to commence the large-scale tree cutting.

Järvinen’s explanation was blasted as being “pure arrogance” from the trillion dollar Alphabet company.

“They bought the vast land area and they just started to cut it, just like that,” she said. “It’s pure arrogance and it’s amazing,” Finnish Association for Nature Conservation (SLL) chair Hanna Halmeenpää said, according to the Guardian.

Hanna Halmenpaa, chair of the board of the Finnish Association for Nature Conservation, is pictured near the site where Google's new data center is set to be built before construction was suspended. — Hanna Halmenpaa, chair of the board of the Finnish Association for Nature Conservation, is pictured near the site where Google’s new data center is set to be built before construction was suspended. AFP via Getty Images

Angry residents called out Google, asking for reprieve from the company to help repay for losses the community sustained from previous tech expansions on the land. AFP via Getty Images

Opponents of the data center believe Google had been rushing to construct the complex before legislation in Finland caught up on AI advancements to implement regulations.

Järvinen apologized for the destruction as the company said it would work to protect water sources before planting back trees around 321 of the acres.

“I wonder why we have to sacrifice so much of our nature. They give everything away too easily,” conservationist Vesa Hyyryläinen told the outlet.

In July, New York Gov. Kathy Hochul signed an executive order, banning all large-scale AI data centers from the state, the first such ban in the US.

The executive order paused new permits for so-called “hyperscale” data centers that looked to use the Empire State’s electrical grid for up to a year.

“I don’t want New York to just be first. I want New York to be first in the right way,” Hochul said at the time.

How to run a city builder on 16 MHz

Lobsters

larstofus.com

2026-10-24 10:18:48

Comments...

Original Article

Do you feel spoiled by modern hardware? I know I do. Even the cheapest CPUs have at least 4 cores nowadays, running billions of operations per second. The idea that you could run any software on less than a GHz almost seems like fiction. Yet, there was a time when whole games ran at hardware a thousand times less powerful than that.

When thinking about impressive technical achievements in retro games, most people will first point to graphical milestones set by action games like Doom or Quake. Rightfully so, but at least I am personally far more impressed by the early examples of the city builder genre. Simulating whole economies on a large scale with a fraction of today’s power seems impossible if modern builder games even struggle on modern machines.

Of course this didn’t stop developers in the past to develop and run city builder games on significantly weaker hardware. The original SimCity for example lists Intel’s 386SX as the CPU in it’s system requirements. A CPU which at the time of it’s launch ran at magnificent 16 MHz.

(Note: an earlier version of this text mistakenly assumed that it ran on 12.5 MHz, which was the clock rate of base version of CPU, not the SX version. Whoops.)
The idea of running a full game, especially one in the traditionally CPU-heavy genre of city builders? Pure magic from a modern point point of view.

So, why could Maxis run a full city simulation on this ancient hardware, when nowadays even simple idle games require multiple gigahertz of CPU power?

Of course there are a lot of reason for this, most of them external (OS ecosystem etc.) but this doesn’t mean that there are no clever optimizations done in the game code itself. Luckily, this source code was made public and released under the GPL license in 2008, under the name Micropolis . Don’t be confused by the name, this is still the code of the original name, but since only the code was made open source, not the trademark, it has to be called differently. But even under a different name, this is a precious resource, since we can exactly see how the game managed to run so well.

As is often the case when analyzing software performance, we can ignore 90 percent of the code. Our focus is on the core of the city simulation, the components that update systems such as traffic, fire, power, and crime.

And there is indeed one single function responsible for doing all of this: The Simulate() function in s_sim.c

As the comment implies, this function is called every frame and the function itself then calls the update functions of the various game systems, like CrimeScan(), FireAnalysis(), CollectTax etc.

The catch is that calling all those functions every frame would overwhelm our poor 1989 CPU. The solution: Not calling every function every frame.

Yep, SimCity just skips most of the simulation. Did you see the mod16 parameter of the Simulate function? Where you would normally expect a deltaTime? This number loops through the numbers 0 to 15 (you probably knew this already because of the name, didn’t you?), and is then used to decided which part of the simulation is run in this specific frame. The code for this looks something like this:

(Note: This is not the exact source, I removed some stuff to make it clearer for the explanation, but it’s veery close) .

So, obviously this makes the Simulation much faster to calculate, but how does this affect the gameplay? Well in case of SimCity, I would say barely. On average the simulation of an aspect takes 8 frames to react to the player’s action, 15 frames in the worst case. As an input lag for a shooter this would be obviously a disaster, but for the simulation of a city? I’d argue it might actually feel better than an instant reaction.

So far this optimization seems very specific for one kind of type of game, but actually it is the starting point for a lot of optimizations.
Let’s look at another example, this time from Assetto Corsa (2014).

As a racing games one of it’s visual requirements is to render cars in a shiny way. To render those reflections the game uses the very common technique of regularity updated cubemaps. For a more detailed explanation what those are you can see my article on reflection rendering .

Since updating a whole cubemap every single frame would be a way to expensive task, the game uses a very similar trick as SimCity: It doesn’t update all 6 faces of the cubemap at once, but only a few, depending on the reflection quality setting.
The settings UI doesn’t say so explicitly, but looking in the .ini file, we see the effect on the variable named FACES_PER_FRAME:

So far, we have stuck to the concept of distributing work across multiple frames by cutting longer tasks into fixed-size portions. For other tasks, it might be smarter to also determine the size and contents of those portions at runtime. For rendering tasks, this could be determined by factors such as screen size or the time since the last update. This explains why Unreal’s Lumen looks so good: It doesn’t need to recalculate all the lighting every frame. This is arguably also the reason why its results can look weird sometimes, for example, when reflections are not fully updated, like here:

Although such frame-distribution optimizations are most common in rendering code, I hope the SimCity example shows that they can work in other areas as well. The next time you work on gameplay code, ask yourself: “Do I really need to run all this code every frame?”

If you enjoyed this article consider following me at Mastodon , Bluesky or LinkedIn or subscribe to this blog directly below this article. I publish new articles about game programming, Unreal and game development roughly every month.

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Bleeping Computer

www.bleepingcomputer.com

2026-10-24 10:17:32

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [...]...

Original Article

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast.

The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also known as Brass Typhoon, Wicked Panda, and Barium.

It was discovered in early 2026 and targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan.

Kaspersky researchers analyzed the BlackX bootkit and found similarities with BlackLotus , which has been circulating on hacker forums since October 2022 and leveraged the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot protection.

ESET confirmed in March 2023 that BlackLotus exploited Baton Drop, and at the time it could compromise even fully patched Windows 11 systems.

According to Kaspersky researchers, BlackX's implementation of the exploit is "remarkably similar" to the one used by BlackLotus, allowing the attacker to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files to bypass Secure Boot protections.

However, BlackX differs from BlackLotus and deploys a different kernel driver and follow-on payloads. Kaspersky suggests that BlackX was either derived from reverse-engineering BlackLotus or from its source code.

Although the source code for BlackLotus was leaked in July 2023, the release was incomplete . Kaspersky researchers found that some BlackLotus samples they analyzed contained code missing from the public repository but present in the BlackX bootkit.

Since the BlackX operator could not have obtained this code from the leaked repo, the researchers believe the attacker either reverse-engineered BlackLotus or purchased its source code.

BlackX capabilities

BlackX injects a malicious Windows kernel driver signed with a now-revoked certificate issued to an organization named Wenjiang District Mingyu Network Technology Service Studio.

The driver disables security-related processes and registry callbacks, and tampers with Event Tracing for Windows (ETW) providers to obstruct monitoring.

The researchers note that some tampering procedures are configured to run only if Kaspersky or Avast products are detected on the target host, adding that the mechanism is useless against the company's solutions.

The driver also protects the bootkit’s files by intercepting user requests to open them and launching the Windows Calculator instead.

Its purpose is also to deploy the following espionage payloads on infected machines:

A RAT that uses Google Drive, OneDrive, or Yandex.Disk for command-and-control (C2) to execute .NET payloads and upload and download files.
OxiDLLRunner, an OLLVM-obfuscated DLL sideloaded by googleupdate.exe. It decrypts v8_context_snapshot.bin to launch shellcode and a Rust payload, which retrieves DLL plugins from archivetj[.]com and executes their ‘create_plugin’ functions in separate threads.

Insufficient fix

Kaspersky says that all BlackX victims used a fully patched Windows release. However, the bootkit was still successful because admins did not manually activate the additional Secure Boot revocations.

“The patch for the Baton Drop vulnerability is designed to revoke the “Windows Production PCA 2011” certificate used to sign vulnerable UEFI components,” Kaspersky explains .

“However, this revocation does not happen automatically upon patch installation - the user has to trigger it manually.”

The researchers say this is a gap in the update process, since it’s extremely uncommon for administrators to take any manual action after applying a security update.

They believe that the attacker used this mitigation gap to their advantage and "decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit."

Instructions to fully patch Baton Drop (CVE-2022-21894) are available here .

The researchers warn that the October 19, 2026 expiration date of the “Windows Production PCA 2011” certificate does not stop the vulnerable binaries from loading on Windows systems unless admins add the certificate to a blocklist.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Enabling Researchers is a Moral Imperative

Lobsters

yorba.co

2026-10-24 09:51:14

Comments...

Original Article

Enabling researchers is a moral imperative, even for small companies, because internet platforms are increasingly reverting back to closed systems. As Rachelle Faust and Daniel Arnaudo put it in The World’s Growing Information Black Box: Inequity in Platform Research (2025):

Ultimately, platforms have moved away from independent data access because they view it as a cost center, with little upside to sharing information that they view as potentially damaging, and transparency is a risk. The attacks on Rohingya people in Myanmar in 2015 , where posts on Facebook contributed to the violence, spurred criticism and more data transparency efforts to show platforms were responsive and open.

But wait - there’s another upside. Independent research can generate novel customer insights. It can uncover uncomfortable truths you might gloss over otherwise. Large firms would rather hire expensive consultancies than maintain access for independent research. They don’t really have to worry about these problems. And that’s exactly the edge for small and medium-sized organizations and businesses.

The orthogonal bet is more important than ever. As I wrote in Finding Your Place in an Unimaginably Large Space , the subscription marketplace is dominated by a handful of businesses and only becoming more concentrated as infrastructure and outreach costs rise. The way forward is to invest in the network as the incumbents invest in their silos. Networks of organizations make them more resilient. Networks of data make it more valuable.

And so we are opening Yorba up to our first researchers from the Nova School of Business and Economics, Daniela Schmitt and Rodrigo Belo .

The Internet is Closing

The Association of Internet Researchers and the Coalition for Independent Technology Research were deeply critical a few years back when Twitter/X began closing their API and replaced it with an expensive and under-performing alternative. A researcher today can no longer build a complete archive to study as the API returns what X considers “relevant.”

Reddit is also closing its public API by March 2027 as well as the RSS feeds . Researchers must now contact Reddit to request research access and new data retention restrictions could make reproducible results - the cornerstone of research - impossible.

And then there is Meta/Facebook/Instagram. Like all large platforms, they explicitly prohibit automated data collection by scraping their site. They have replaced their old researcher access known as CrowdTangle with a more restrictive Meta Content Library and Content Library API .

Opening Up While Keeping Data Safe

It’s true that designing and maintaining an expressive API that works for researchers is expensive. Therefore we have focused on tagging the data itself using Atlas , a library built for describing systems and information. This ensures that the data can be served in many different contexts with certain guarantees. A person will always need access to their data, but that same data could be anonymized and viewed by researchers. While system performance metrics can rely on anonymized data, system logging is more useful with pseudonymous data and a short retention policy. Yorba is not just investing in research access, we’re investing in data integrity as a concept.

The front door for researchers to explore the data is through our adoption of open vocabularies and MCP tooling. After the researchers get a sense of what they want, we can either build a custom API or query the database directly. Either way we’re still leveraging the benefits of strong data semantics via Atlas.

Data labeling itself can be difficult. Over time names will change, contexts shift, and labels will be forgotten. To avoid another maintenance headache, Yorba entities are referenced with a compound identity. An endpoint that provides an aggregate of subscription costs might be labeled as #{:metrics/counter :domain/fees :domain/metrics} . Labels generally accrete and Atlas ensures no two sets of label identifiers are the same; every identity remains unique. Over time, graph relations emerge so that developers, researchers, and LLMs can see what is missing or codependent in the web of Yorba data.

We can even tag data with something like :todo/pii-protection when the data type emitted needs to be reviewed before it is available to any tooling. Thus a semi-regular review can always surface the known unknowns easily.

The tools that provide these insights are also tagged. Therefore only tools tagged with :scope/research are available to researchers.

Build-time invariants keep research tooling sanitized. A declared but unlabeled field like :personal-information in {:provider-url "example.com" :personal-information "abc-123"} fails the build, even if :provider-url is tagged as public information. Any tool tagged :scope/research that returns data tagged :co.yorba.user/data will also fail to build.

The Pendulum

We have published our own research as our own annual State of Clutter reports. But that’s the easy part. The hard part is opening up and allowing others to come to their own conclusions.

The history of systems is a pendulum swinging between open and closed. The current enclosure of intangible resources both artificially abandons the free market while also ensuring that a social commons cannot grow. In other words, it works for almost no one other than a handful of people.

The pendulum will swing back. The organizations and businesses that survive will be the ones prepared for it.

Image: Camillo Golgi, Nerve cells in a dog’s olfactory bulb (detail) , 1885, illustration from Sulla fina anatomia degli organi centrali del sistema nervoso , via The Public Domain Review . Public Domain.

One Must Fall 2097 Remastered

Hacker News

github.com

2026-10-24 09:47:07

Comments...

Original Article

omf2097-remastered-trailer.mp4

_{Sound on.

A fan trailer: 1994 on an old PC in the game's colors, then 32 years later in HD, the new robots
and arenas, and a mod made from scratch in OMF Studio, cut to Hadal Static's

Twenty Ninety-Seven (Remix)

.

Watch it in 1080p60

.}

In One Must Fall 2097 (Diversions Entertainment, 1994), pilots climb into 90-foot war machines and fight their way up a corporate tournament. It was one of the great DOS fighting games, and it has been freeware since 1999 .

This project brings it back. It is a faithful reimplementation of the game's engine that plays the original game files , as a free app for Windows, macOS and Linux or in a browser . Play it exactly as it looked in 1994, or remastered in HD with new effects, modes and tools. One key, F2 , switches between the two at any moment, even mid-fight.

Faithful

Every robot, arena, mode and quirk of the original, following the reverse engineering of OpenOMF . The soundtrack plays through a port of the game's own music driver.

Remastered

3,200+ images redrawn in HD, widescreen arenas with depth, dynamic light and particles, smooth motion, and sharp text at any resolution.

Modern

LAN games, fourteen languages, a training lab, replays and clips, new modes, a robot workshop, mods and the OMF Studio mod tools, gamepads with rumble, touch controls, and it works offline.

Download the game, free , for your computer. Nothing to install: each download is the whole game in one file (on a Mac, an app in a zip), ready to run from anywhere.

Your computer	Download
Windows 10 or 11 , 64-bit (most PCs)	The game · OMF Studio
Windows 10 or 11 on ARM (Snapdragon PCs)	The game · OMF Studio
Windows 10 , 32-bit	The game · OMF Studio
macOS 12 or later on Apple silicon (M1 and later)	The game · OMF Studio
macOS 12 or later on Intel	The game · OMF Studio
Linux on x64 (AppImage)	The game · OMF Studio
Linux on ARM64 (AppImage)	The game · OMF Studio

OMF Studio , the mod tools, is the same program opening straight into Studio (the game opens it too, from Extras ). Everything is included: the game, its HD artwork and its music, about 240 MB. The release notes list what's new.

The first start on Windows, macOS and Linux

Windows may say it protected your PC: the files aren't signed yet. Choose More info , then Run anyway . The game runs on Microsoft's WebView2, which Windows 10 and 11 have. Windows XP, 7, 8 and 8.1 can't run it: WebView2 left them behind in 2023, and XP never had it.
macOS : unzip the app and move it to Applications . It isn't notarized by Apple yet, so the first time macOS won't open it: go to System Settings › Privacy & Security and choose Open Anyway , once. For LAN games, let it find devices on your local network when it asks.
Linux : let the AppImage run as a program (in its file's properties, or chmod +x in a terminal), then start it. Some distributions need FUSE 2 for AppImages (the libfuse2 package), and the Noto fonts for Chinese, Japanese, Korean, Hindi, Bengali and Arabic.

Or play it online , with nothing to install: it runs in any modern browser, on a computer, a tablet or a phone, and keeps working offline once it has loaded.

On the first start , one screen sets you up: the original 1994 look in a single press, or the remastered graphics, effects, announcer and music the way you like them. Everything can be changed later in Options .

Games used to come with a booklet, so this one does too. The 32-page manual has the story, the controls, how to fight, every robot's moves, the pilots, the arenas and tips from the pros, with a one-page quick start on page 2.

Controls

	Player 1	Player 2
Move, jump, duck	Arrow keys (Home, PgUp, End, PgDn for diagonals) or the numpad	Q W E, A D, Z X C
Punch	Enter	Left Ctrl or F
Kick	Right Shift	Left Shift or G
Special (one press)	/ or numpad −	H
Scrap, destruction, Fire & Ice (one press, once turned on)	, . ;	R T Y

Esc pause · F1 help · F2 classic or remastered · F11 fullscreen · Print Screen screenshot · on a Mac, hold Fn for the F keys

Gamepads, touch screens, one-button specials and every other key

Gamepads (Xbox and other standard controllers) work out of the box, even beside the keyboard: X, Y or RB punch, A, B or RT kick, LT or LB fire a special (or the classic layout: A punch, B kick). They rumble with hits, blocks, throws, wall slams and knockouts.
One-button specials (on from the start, Options › Controls › Special button ): the special button alone, or with forward, back, down or up, fires one of the robot's special moves, and its air special in a jump. The original motions work as always.
Finisher keys (off from the start, Options › Controls › Finisher keys ): once a fight is won, one key does the robot's scrap, another its destruction (the scrap first), a third its Fire & Ice move (in the Fire Pit, the scrap and the destruction first). The special button does the next finishing move, on a gamepad too. The original motions work as always.
Your own keys : a modern keyboard layout (WASD for player 1), and any key rebound in Options › Controls . Keys and buttons (also in the pause menu) shows every action on the keyboard and the controller.
Touch controls on phones and tablets: a stick under your left thumb, punch, kick, special and pause buttons.
Anywhere : F3 next song (your own music), Alt + Enter fullscreen (on a Mac also Ctrl + Cmd + F ), F12 screenshot (in the desktop app; screenshots, clips and videos go to the OMF 2097 Remastered folder in your Downloads ). The mouse works in every menu.
Training : F4 reset, F5 record the dummy, F6 play it back, F8 frame data, F9 hitboxes.
Replays : Space pause, ← → step (or skip ahead while playing), ↑ ↓ speed, I O mark a clip, V save it as a video, G as a GIF, K keep the replay.

_{The same moment, both ways.

F2

switches at any time.}

Classic	Remastered
The original VGA picture, rebuilt on the GPU: 320 × 200 pixels through the game's palette and its 19 color tables, exactly like 1994 Sharp pixels, smooth scaling or a CRT filter Widescreen fights if you want them	HD artwork for every arena, robot, portrait and effect, and an edge-aware upscaler for anything else Player colors, fades and flashes still work: they are mapped onto the HD pixels live Widescreen arenas whose paintings have depth: the camera's moves give them parallax, and light falls on them by their shape Smooth motion between game ticks, bloom, a crisp HUD, and text in a sharp typeface fitted to the original fonts

Classic

Remastered

The original VGA picture, rebuilt on the GPU: 320 × 200 pixels through the game's palette and its 19 color tables, exactly like 1994
Sharp pixels, smooth scaling or a CRT filter
Widescreen fights if you want them

HD artwork for every arena, robot, portrait and effect, and an edge-aware upscaler for anything else
Player colors, fades and flashes still work: they are mapped onto the HD pixels live
Widescreen arenas whose paintings have depth: the camera's moves give them parallax, and light falls on them by their shape
Smooth motion between game ticks, bloom, a crisp HUD, and text in a sharp typeface fitted to the original fonts

Everything from the original is here, playing its own data files:

11 robots , every move, special and throw, and 10 pilots plus Major Kreissack , each fighting their own way.
5 arenas and their hazards : the Danger Room's spikes, the Power Plant's electrified fences, the Fire Pit's fireballs and the Desert's strafing jets.
Fire and Ice , the one-player game's two secret opponents, as the 1994 program hides them: on Champion or harder, a destruction in the Fire Pit and then the robot's Fire & Ice move send it through the floor to fight Fire, an enhanced Katana in the burning pit below, and on Ultimate on to Ice, a translucent Shadow in the frozen one.
Every mode : one and two players, the demo, the full tournament career with the mech lab, upgrades, training and the newsroom, the scoreboard, the intro and every ending.
The original music and sounds , through a port of the game's own music driver.

The menus were tidied up without losing anything: the three ways to play first (the two player game is now Multiplayer , with LAN games beside it), then More modes , Extras and Options . And a few things the 1994 menus promised now work, like the defensive throws , knock down and block damage rules.

Remastered fights get a layer of modern effects, driven by what happens in the fight:

Effects	What they add
Particles	Sparks and flares on hits and blocks, dust from falls, throws and wall slams
Lighting	Hits, fire, energy and projectiles light up the arena and the robots
Impact	Shockwaves on heavy hits, the knockout camera
Atmosphere	Each arena's own: embers, sand, dust, floodlights, camera flashes in the crowd, and in the new arenas snow, aurora, rain, lightning, neon and bubbles

Note

The effects are only for the eyes. They never touch the game's state or its random numbers, so a fight plays out exactly the same with them on or off (a test checks it). Each group can be turned off in Options › Graphics › Effects .

All of this is new, and none of it changes how the original plays unless you use it.

Multiplayer on your network

Multiplayer in the main menu is the original two player game, and more:

Local : two players on one computer, sharing the keyboard or with controllers, as in 1994.
LAN : fight a friend on another computer of your home network, in the desktop app on Windows, macOS or Linux (a browser can't reach other computers by itself, so the web version doesn't offer it). One of you hosts a game, the other picks it from the games found on the network (or types the host's address), and it starts by itself: both screens say who plays whom and on which side, then you meet at the robot select screen. You both pick a pilot and a robot, the host picks the arena, and the fight starts once you've both pressed punch. A bar at the bottom of the screen always says whose move it is, and YOU and READY show over the players' portraits.
Online : coming soon.

Both computers play the very same fight, each running the game itself, tick for tick: they only tell each other what their player pressed (the same determinism that makes replays work). The host's gameplay options are used (speed, rounds, power and the advanced rules), both games must be the same version with the same mods on (on any of the three systems), and they keep checking that their fights agree. The first time you host, Windows may ask whether the game can use the network: allow it on private networks. A Mac asks whether it may find devices on your local network: allow it. On Linux with a firewall on, open port 2097 (TCP and UDP). LAN fights are saved as replays like any other.

In your language

The game speaks English, German, Japanese, Chinese, Korean, Hindi, Bengali, Spanish, Portuguese, French, Arabic, Russian, Danish and Swedish : the original game's texts (its menus, help pages, the news reports, the pilots' trash talk, the endings) and everything the remaster adds. It starts in your language: your browser's on the web, your system's in the app. Options › Language lists them all, each written in itself, and switches at once; your choice stays. English and German are the game's own 1994 texts, umlauts and all. The other languages are new translations, drawn in the original pixel font where its letters reach (Ã, Ê, Ø... are made in its style) and in your system's fonts for Cyrillic, Chinese, Japanese, Korean, Devanagari, Bengali and Arabic (right to left), sharp in both looks.

Training lab

Training (in More modes ) puts you against a dummy that never goes down, with health that refills after every combo. The pause menu's Training lab brings the tools of modern fighting games:

Frame data for both robots (startup, active, recovery, advantage) and hitboxes : hits in this game are pixel exact, and you can see why.
Record the dummy and let it play your recording back, or answer the moment it can act (a reversal) with any of its moves.
Combo trials for every robot, each with a demo. The combos were found by searching the game itself and checked against all eleven robots.

Replays and clips

Every fight is saved ( Extras › Replays keeps the last 40, and any you mark). Watch them at any speed, step frame by frame, jump anywhere, and save a clip as an MP4 video or an animated GIF . Replays are shared as the original game's own .rec files.

Arcade, survival and time attack

Arcade : eight fights against better and better pilots, Kreissack last.
Survival : one round after another, with only the health you have left.
Time attack : five fights against the clock.
Records : your statistics, the best results of each mode, and 20 achievements to show off (nothing is locked behind them).

Robot workshop

Build your own robot from the parts of the remaster's new robots: one's frame, another's head, a third one's special moves, a size, a weight class and three colors. The game turns it into a full fighter on the spot, every sprite, move and HD picture, ready for training or a fight. Robots are shared as small .omfbot files.

Your own tournaments

Make a tournament of your own from the installed ones: fewer opponents, their robots as they were or the new ones, more or less prize money. It shows up in Tournament play like the others, and is shared as a .omftrn file.

The remaster's touches

A painted main menu : the robot on its stage in layers of painted parallax, under a spotlight, searchlights and camera flashes, the view leaning toward your mouse.
Two announcers , Victor and Kristen, call the rounds, the knockouts and the winners, and after a fight a newsreader reads the TV report aloud, names and all.
Victory screens : the winner, a line of theirs, and the fight in numbers.
A fight camera (if you want it) that comes in close when the robots do.

And the credits are fought out. Scored to Twenty Ninety-Seven (Remix) by Hadal Static, a song about One Must Fall 2097 : the 1994 logo is struck by lightning on the drop, then, on the monitor of an old PC dressed in the game's colors, each credit pilots a robot in its own colors against something the remaster had to beat (tech debt, spaghetti code, pixel noise, dead air) and wins, every final blow landing on the beat and every winner's card flying onto the tower ( Play the credits on the main menu, or Extras › Credits ).

And more

Move lists in the pause menu: every special move, throw and finishing move of both robots.
F1 help at any time , with the game paused behind it.
Your own music : drop songs onto the window, and they play in fights or everywhere.
Arena acoustics (sounds echo like the stadium or the steel Danger Room) and an impact bass under heavy hits.
Achievements announce themselves the moment they're earned.
Auto pause when you switch to another window.

Four robots and four arenas were made for the remaster, in the spirit of the originals. They are not part of the 1994 game, which stays as it was: they come with it as a mod, off until you turn on New robots and arenas in Extras › Mods (or on the first start's setup screen).

Robot	Style	Special moves
GLACIER	A heavy ice juggernaut: slow, strong, tough	Ice Lance ↓↘︎→ P, Glacial Ram ↓↙︎← K, Frost Spikes ↓↘︎→ K
TEMPEST	A light, fast wind robot with high, floating jumps	Gale Blast ↓↙︎← P, Cyclone Kick ↓↘︎→ K, Sky Dive ↓ K in the air
HELIX	An industrial driller with a spiral drill and a claw	Drill Rush ↓↘︎→ P, Corkscrew →↓↘︎ P, Drill Bit ↓↙︎← P
SPECTRE	A phantom with forearm lasers and a cloak of blades	Photon Beam ↓↘︎→ P, Phase Shift ↓↙︎← K, Shadow Strike ↓↘︎→ K

They play like the originals: the full set of moves, a throw, a scrap and a destruction finisher, the player's three colors, and a computer that knows how to fight with them. With the mod on, they join the robot select screen (a third row), the computer's opponents and the robots Plug trades in tournaments.

Orbital : a space station's hangar with the Earth in its window. Dust floats in the low gravity, and now and then a shuttle passes outside.
Ice Cave : a frozen cavern under the aurora. Snow blows in, frost mist creeps over the ice, shooting stars fall over the mountains.
Rooftop : a skyscraper's roof in the rain above a neon city. Lightning flashes over the skyline as a hover-car cruises by.
Abyss : a glass dome on the sea floor. Bubbles rise, light ripples over the floor, a submersible glides past.

The robots and arenas are 3D models ( src/gen ), rendered into the game's own formats. The robots' HD frames are rendered in Blender from the same models ( how ), and the arenas' HD backgrounds were painted over their renders by an image generation model. All four arenas are true widescreen, with their own music, acoustics and moving scenery.

Mods add robots, arenas and pilots that play exactly like the game's own: every animation, move and hit point, in both looks, in every mode and in replays. Drop a .omfmod file onto the game to install it, and turn it on or off in Extras › Mods .

OMF Studio makes them. It opens from Extras › OMF Studio (or download it on its own, beside the game), and it works in the game's own formats, pixel for pixel. The new robots and arenas are a mod too: open them in OMF Studio to see how every animation, move and HD picture is put together.

Robots : start from a copy of any robot, the workshop's parts, or a blank figure. Draw every frame in the game's palette, place the hit points, and set each move's input, damage and the victim's reaction.
Arenas : start from a copy or a picture, then add hazards, scenery and music.
Pilots : portraits, lines, a personality for the computer to fight with, and an ending.
HD artwork for the remastered look: templates to paint over, or pictures rendered from a robot's 3D model.
Test it in the game right from Studio: a fight, the computer against itself, training or the one-player game. Then install it, or build the .omfmod file to share. Every change can be undone.

The mod format and every editor are explained in docs/MODDING.md .

The game data and the HD artwork come with the repository, so it takes a minute to get it running:

git clone https://github.com/Jared-woodruff/OMF-2097-Remastered.git
cd OMF-2097-Remastered
npm install && npm run dev        # then open http://localhost:5173

Command	What you get
`npm run build`	The web version in `dist/` : a static site that works from any folder and offline after the first visit
`npm run desktop:build`	The desktop app for the system you build on: the program on Windows, the app on macOS, the AppImage on Linux
`npm test`	The test suite: the real game logic, run headless against the original data
`npm run manual`	The game manual, as a PDF

docs/BUILDING.md has the prerequisites, every other command (a lean web build, your own copy of the game data, the HD artwork pipeline) and how the remaster's own content is made. The release downloads for every system are built by GitHub Actions when a release is published ( .github/workflows/release.yml ).

Under the hood

%%{init: {'theme': 'base', 'themeVariables': {'background': '#04061f', 'primaryColor': '#0b1142', 'primaryTextColor': '#e7eaf3', 'primaryBorderColor': '#0000f3', 'secondaryColor': '#060926', 'tertiaryColor': '#04061f', 'lineColor': '#5a6cff', 'clusterBkg': '#060926', 'clusterBorder': '#2b3bcf', 'edgeLabelBackground': '#04061f'}}}%%
flowchart LR
    subgraph sim["Game simulation (a faithful port)"]
        S1["Scenes, robots, AI"] --> S2["Animation scripts"] --> S3["Draw list"]
    end
    S3 --> CL["Classic renderer<br/>indexed 320 × 200, VGA palette"]
    S3 --> RM["Remastered renderer<br/>HD artwork, depth, upscaler"]
    sim -. "cosmetic events" .-> FX["Effects<br/>particles, lights, camera"]
    FX --> WP["World pass<br/>lighting, haze, shockwaves"]
    RM --> WP --> PP["Bloom, light shafts, post"]

Loading

Part	Built with
Language and build	TypeScript 7, Vite 8
Graphics	WebGL2: the classic VGA pipeline, HD reconstruction, particles, lighting and post-processing
Sound	Web Audio, an AudioWorklet mixer and a port of the game's MASI music driver
Desktop app	Tauri 2: WebView2 on Windows, WebKit on macOS and Linux
Tests	Vitest: 350 tests that run the game itself, headless, against the original data

The HD artwork is matched to the game's pictures by a fingerprint of their pixels, so the game's code doesn't know it's there, and each HD pixel follows its original's palette: player colors, fades and flashes work as in 1994. It loads per scene, as the game needs it.
It keeps up : the remastered renderer watches its GPU time and lowers its internal resolution when a GPU can't. With every effect on, a frame takes about 8 ms on an RTX 4080 at 1920 × 1200.
docs/ARCHITECTURE.md explains how the code is organized and how it maps to the original's C reference. Want to help? Start with CONTRIBUTING.md .

The remaster : Jared Woodruff (human coder), Claude Opus 5.5 in Max Mode (AI coder), and OpenAI GPT6-ASTRA in Ultra Mode (the HD artwork).
The credits' song : Twenty Ninety-Seven (Remix) by Hadal Static, used with the artist's permission.
One Must Fall 2097 © 1994 Diversions Entertainment, published by Epic MegaGames, freeware since 1999. This is an unofficial fan project, not affiliated with or endorsed by its makers; all trademarks belong to their owners.
OpenOMF (MIT): the open-source reimplementation whose reverse engineering this port follows.
The announcers' voices : Victor and Kristen from the ElevenLabs voice library, performed with Eleven v4 and finished with FFmpeg.
Also built with : Hyllian's xBR-lv2 shader (MIT), the Orbitron typeface by Matt McInerney ( SIL OFL 1.1 ), Tauri , Vite, TypeScript and Vitest.

The source code is released under the MIT license . The original game's files and the artwork made from them are included on the game's freeware terms instead: free of charge, never sold . See NOTICE.md .

Elon Musk Just Gave Europe a Reason to Replace American Technology

Hacker News

steveblank.com

2026-10-24 09:09:28

Comments...

Original Article

I’ve been in London for the last month and have heard policymakers react to the wake up call Elon Musk just delivered.

The decision of the U.S. to shut off intelligence and throttle the military version of Starlink called Starshield to Ukraine may have been a blip in the news in the US, but it has sent tremors across Europe.

For years doomsayers in the UK and Europe were worried about the U.S. having a kill switch in weapon systems and critical commercial technology that could disconnect them at will. Most people, including me, thought that it was a paranoid fantasy.

Until it happened. Seemingly on a whim of a single individual, ( according to the Wall Street Journal ) Elon Musk personally ordered the restrictions, and the effect was to tilt Russia’s war against Ukraine in favor of the Russians. This wasn’t an articulated U.S. foreign policy nor was it an announced act of the U.S. government. From news accounts it appears to have been a personal decision of an American CEO acting unilaterally.

Blowback
For whatever reason, whether it was to satisfy a request from the White House or some personal animosity to the Ukrainians, from Europe’s perspective, that’s almost beside the point. An American company operating critical military infrastructure was able to degrade the capability of an American partner in the middle of a war. Without warning.

The message heard loud and clear here in Europe was that the U.S. is an unreliable security and technology partner willing to throw any partner under the bus, at any time, for any reason .

The conversations I’ve heard have included, “what happens if other U.S. CEOs – Microsoft, OpenAI or Anthropic, Oracle, Palantir, or Google – decide to restrict/limit or deny access to their products? What capabilities would Europe lose if enterprise software and/or AI across Europe goes dark?” This was a laughable scenario until this week. To a lot of European decision makers, it is no longer outside the realm of possibility.

The lesson that was brought home was that no nation, Europe or elsewhere, can continue to outsource its national sovereignty and security by depending solely on US data systems or intelligence.

Unintended Consequences
Besides the political ramifications, the business ones are going to come home to roost. If every U.S. vendor is now a kill-switch risk, the allied market for that whole ecosystem shrinks. As it sinks into the European countries that the U.S, can simply shut off any technology, over time they will find and build alternatives. In the years ahead, this may cost American companies tens if not hundreds of billions of lost revenue.

Europe has been debating digital sovereignty for years. Up to this year, the idea of cloning the capabilities of the best U.S. products seemed like an insurmountable problem. And some, like low-cost access to space, still are. But today AI collapses the cost of creating sovereign software at exactly the time that geopolitical risk is increasing customers’ willingness to switch. AI makes recreating the features, functions and compatibility of Microsoft Office, Oracle, Salesforce, Palantir, Anduril, et al. within reach. AI puts it well within the capabilities of most nations.

The U.S. spent decades establishing itself as the world’s indispensable technology supplier. A substantial part of that advantage depended on customers believing American technology would remain reliable and available.

Going forward a U.S. founder selling into European defense or government now needs an answer to “who holds the switch” before the first meeting; and European founders just got sovereignty as a sellable feature.

What was done in a fit of pique will cost the U.S. both leadership and jobs.

Filed under: National Security , Teaching |

Trump Cornered but Lethal

Portside

portside.org

2026-10-24 08:38:51

Trump Cornered but Lethal Kurt Stand Sat, 10/24/2026 - 08:38 ...

Original Article

Donald Trump | Credit : Gage Skidmore \ Wikimedia CC licence

The US polity is entering a heightened period of danger to its basic institutions, stretching from the mid-term election in November 2026 to January 2027, when the newly elected Congress would normally expect to be seated.

It is increasingly obvious that unless the Trump administration can successfully rig the elections, the MAGA majority will be swept away by a “blue tsunami” of voters fed up with the status quo. National polling now suggests that Republicans will lose control of the House and that the Senate may end up narrowly divided between Republicans and Democrats. Recent polls suggest that Republican candidates in their strongholds like Texas and Ohio are lagging behind their Democrat challengers.

This will not be because the Democratic leadership is popular or because it is offering an attractive alternative to MAGA policies. Polls indicate widespread disgust and mistrust of both political parties. Republican candidates are begging Pres. Trump not to come to their states to campaign for them. Similarly, many candidates running as Democrats posing serious challenges in strongly Republican districts do not want traditional Democrat leaders to campaign with them.

At the same time, “democratic socialism” is polling quite favourably, at least among traditional Democratic voters, especially among younger people and people of colour. Polls are of course not votes in the real general election. Fortunately, most actual members of DSA who won Democratic primary elections are running in strongly Democratic districts and will win easily in November. “DSA-adjacent” Senatorial candidates like Angie Nixon in Florida and Abdul El-Sayed in Michigan face greater obstacles. Having narrowly overcome enormous negative campaigning from establishment Democrats in hotly contested primaries, they now face massively funded Republican opponents in the final elections. Democratic Senate leaders like Chuck Schumer seem uncommitted to their success in November, apparently preferring that Democrats remain the Senate minority rather than for Schumer to face more Leftist opponents in his own Democratic Senate caucus.

Trump appears to be cornered. His governing policies are increasingly unpopular. The failed war against Iran, resulting in soaring prices for petrol and groceries, is not helping him with his MAGA base. His vicious war against immigrant communities is alienating many of the Hispanic voters that helped him win in 2024. Trigger-happy masked ICE agents remind many Americans of the Gestapo, an impression reinforced by his delight in the recent election victories of the far-right Alliance for Germany.

But a cornered monster can still be lethal. Trump learned from his failed coup in January 2021 that even that debacle did not end his political career. After Trump’s re-election in 2024, he pardoned the leaders and foot soldiers of the coup, and his tame Supreme Court basically granted him immunity from criminal prosecution for his crimes.

Trump 2 has become even more dangerous and openly self-seeking than Trump 1. He accelerated the attack on his political enemies, purged the civil service, FBI and Department of Justice. He forced major law firms and universities to genuflect before his Majesty. His corrupt business transactions enriched him and his family by billions of dollars, while rewarding his oligarchic donors with massive tax cuts and favours. Top military leadership has been purged by removing many senior officers who are female and/or people of colour.

Other actions by Trump and his supporters have been directly designed to prevent his electoral loss in 2026 and 2028. The Voting Rights Act won by the civil rights movement has been gutted by the Supreme Court, opening the door to a systematic attack on Black political representation in the South. Congressional districts with Black congresspersons have been “gerrymandered” out of existence in Texas, Florida and other Southern states. There are constant efforts to reduce voting rights, including voting by mail, and, most insidiously, purging voter rolls of supposedly “illegal immigrants”. The Supreme Court recently allowed the use of corrupted databases to allow MAGA state officials to identify and remove such people (who, in practice, do not exist. One such effort in Nevada supposedly identified hundreds of thousands of illegal voters, which, upon legal objections, was reduced to a few hundred, not one of whom was shown to have voted illegally!).

The point of these interventions is not to identify actual illegal voters, but to muddy the waters and discourage legitimate voters thought to be against Trump. Speaking at a recent Republican mid-term convention, Trump explicitly urged his supporters to “cheat”. Shades of December 2020, when Trump telephoned a Republican state official in Georgia to demand that he “find” the 11,000 votes that he himself had lost by.

It is not possible to predict exactly how the Trump administration will try to rig the November election, or to annul its likely unfavourable results. The broad oppositional coalition that put together the No Kings Rallies is calling for a March to the Ballot Box to Vote Early on October 17. An Interfaith Alliance is organising a national bus tour to promote voting and protect the sanctity of the vote. Numerous organisations, including DSA Labor, are mobilising and training their members in election defence. The possible countermeasures to an attempted coup range from court cases to taking to the streets in mass demonstrations and large-scale civil disobedience. The cabal around Trump will likely be better organised than the comic-opera putsch at the US Capitol in January 2021. And a desperate Trump thinks he has little to lose from the most flagrantly illegal actions, having escaped unscathed in the past.

Recently, the US government paid for three propaganda ads directed at sports fans, featuring a belligerent Trump purporting to be heroically defending the nation against a socialist and communist takeover. These taxpayer-funded ads blatantly violated extensive US law. We might wonder why Trump chose to use taxpayer money when he has his own immense war chest available for political campaigning furnished by his billionaire donors. He thinks that he can now get away with anything no matter how illegal, since his docile Supreme Court majority has repeatedly accepted his assertion that the President is above any law.

Hubris comes before a fall. But only if we give it a shove.

Chartist is the bi-monthly political magazine of the democratic left. In honouring the Chartists of the 19th century, our idea of democratic socialism is as much about the political movement and means of mobilisation used to advance political ideas as it is about the ideas themselves. Chartist seeks to provide a space for those who subscribe to this broad ideal.

An Ancient Virus Explains Why the Human Brain Is Special

403 Media

www.404media.co

2026-10-24 08:27:54

Scientists have discovered a family of retroviruses that invaded the genomes of chimps and other primates, silencing genes involved with brain development, while humans were left unaffected....

Original Article

Welcome back to the Abstract! Here are the studies this week that invaded our brains, thought fast, swapped coffins, and hit the art gallery.

First, an ancient viral pandemic that afflicted many of our primate relatives—but somehow missed humans—may help explain how we got so smart (relatively speaking). Then: mammal brains eat crow, an upcycled sarcophagus, and a trip to the starry Provençal summer of 1889.

As always, for more of my work, check out my book First Contact: The Story of Our Obsession with Aliens , or subscribe to my personal newsletter The BeX Files .

Your brain on viral content

Gerdes, Patricia; Karlsson, Ofelia; Garza, Raquel; Atacho, Diahann A. M. et al. “Retroviral insertions contributed to the divergence of human and chimpanzee brains.” Science Advances.

A virus that infected chimpanzees millions of years ago shaped the divergence of human and chimp brain development, shedding light on how our own species came to be more cognitively complex than our closest living relatives, according to a new study.

Retroviruses are infectious agents that can invade the genomes of their hosts and insert copies of their own genetic material, producing long-term evolutionary effects. Researchers have now discovered a family of these endogenous retroviruses called PTERV1—which are abundant in chimpanzees, but absent in humans—that influence brain development.

“Among primates, the human brain stands out as the largest and most complex due in part to an increase in cortical neurons and increase in synaptic connectivity,” said a team led by researchers from Lund University. “With a size roughly three times that of our closest living evolutionary relative, the chimpanzee, it has unique cognitive capabilities.”

*Sketches of gorilla, chimp, and human skulls. Image: kaiwei zhang*

“The underlying genetic divergences responsible for these differences are still poorly understood,” the researchers continued, noting that their new findings “reveal a mechanism by which endogenous retroviral insertions contributed to human-chimpanzee brain divergence.”

The team discovered the mechanism using human and chimpanzee brain organoids, which are miniature clusters of neurons grown from stem cells that can model some aspects of brain development. The results revealed chimpanzee-specific PTERV1 insertions on chromosome 19 that silences a gene called LINC00662. In contrast, this gene is active during human brain development, and affects neuronal maturation, development, and outgrowth.

“These PTERV1 insertions are thought to have originated from infections that occurred in the ancestors of African apes about 5 to 7 million years ago,” said the team. “PTERV1 elements are found in chimpanzees, bonobos, and gorillas…Notably, the absence of PTERV1 insertions from the human genome suggests that either the human and chimpanzee lineages did not occupy the same habitat at the time or that germline-competent cells of the human ancestor were resistant to this infection.”

“In summary, this study describes how retroviral insertions contributed to the functional divergence of the human and chimpanzee brain, providing a mechanism by which retroviral infections influenced primate brain speciation,” they added.

In other words, early humans appear to have dodged consequential pandemics that widely infected our primate brethren simply because they had a random immunity to it, or roamed different ranges. While retroviruses are far from the only factor in our cognitive development, it’s still eerie to think that our human brain—that brilliant lump you are using to read these words—is shaped by dumb luck.

In other news…

Another brain to crow about

Schmidbauer, Philipp and Nieder, Andreas. “Ultrarapid decision-making in an avian brain.” Science.

Speaking of interspecies brain-offs, it seems the birds have got us beat—at least when it comes to snap decisions. Scientists have discovered that carrion crows ( Corvus corone ) can make ultrafast choices in “approximately 235 milliseconds on average, which is roughly twice as fast as has been observed in monkeys or humans and without sacrificing accuracy,” according to a new study.

*Crow acing the test. Image: Andreas Nieder*

A pair of researchers observed two crows performing a common discrimination task in which dots on a screen move left, right, up, or down. The crows selected the predominant direction by pecking a target circle on a touchscreen, after which they were rewarded with promptly dispensed treats. The crows performed the task dozens of times at extremely high speeds, achieving an overall choice accuracy of 75 percent (crow 1) and 73 percent (crow 2).

“Having diverged from mammals more than 360 million years ago, birds evolved a distinct nuclear pallium”—a part of the vertebrate forebrain—”that lacks the layered neocortex yet retains key organizational and computational principles characteristic of mammalian brains,” said study authors Philipp Schmidbauer and Andreas Nieder of the University of Tübingen.

“These findings highlight the extraordinary efficiency of avian decisionmaking circuitry, possibly shaped by evolutionary pressures for rapid visuomotor control,” the team added.

So if anyone ever calls you a birdbrain, the correct response is “thanks.”

🌘

Subscribe to 404 Media to get The Abstract , our newsletter about the most exciting and mind-boggling science news and studies of the week.

Who is this sarcopha-guy?

Rodwell, Warwick. “Westminster Abbey’s Roman Sarcophagus and its Afterlife.” Journal of the British Archaeological Association.

Archaeologists may have finally discovered the mysterious identity of an ancient skeleton buried in a Roman-era sarcophagus that was first unearthed on the grounds of Westminster Abbey more than 200 years ago.

Despite an inscription on the sarcophagus identifying the occupant as Valerius Amandinus—a wealthy Londoner who lived between 300 to 400 AD—the bones likely belong to a medieval monk named Ælfwig, born centuries later in the year 993.

*Interior of the sarcophagus, as found upon opening in 2016. Image:* *Rodwell, Warwick* *, 2026.*

“The burial was of a male, probably in his late forties, and was radiocarbon dated to around the turn of the 11th century,” said study author Rodwell Warwick of Westminster Abbey. “The corpse had been laid in a timber coffin and covered with lime; it was then placed inside the sarcophagus. It is argued that this was the prestigious burial of Abbot Ælfwig.”

The sarcophagus was exhumed and moved to a northern courtyard during King Henry III’s reconstruction of the abbey in the mid-1200s, where it laid for about six centuries. On Easter Monday 1820, the coffin was “wantonly broke by workmen” according to a note from an unknown contemporary archivist. Any grave goods were likely plundered by this crew and the sarcophagus was hastily put back together and reburied with the bones all jumbled up inside. It was then re-discovered in 1869 with a note that the burial “‘had been subjected to violence by a previous examination.”

It turns out anything is recyclable—even sarcophagi. The discovery that this Roman coffin at some point took on another tenant now raises the new question of how the earthly remains of Valerius Amandinus got evicted and where they ultimately wound up.

“The Starry Night”—of July 22, 1889?

Kim, Elijah Jeong-hyun et al. “The actual sky of Van Gogh’s Starry Night: a multidisciplinary reconstruction.” Scientific Reports.

With its vibrant colors and psychedelic swirls, Vincent Van Gogh’s “The Starry Night” is one of the most beloved and recognizable paintings in art history. For years, experts and admirers have debated whether the mesmerizing skyscape, which van Gogh painted during an asylum stay in Provence, was a fantastical portrayal or if the artist included realistic renderings of astronomical phenomena.

Now, a team has proposed that the celestial elements of the painting match with a specific night—July 22, 1889—when “the waning-crescent Moon, Venus, and the Hyades cluster gather within that narrow frame,” according to a new study. This date conflicts with the conventional timeline of van Gogh painting “The Starry Night” weeks earlier in June.

“The question dividing fantasy from observation remained a matter of qualitative interpretation and was never treated in a physically decidable form,” said researchers led by Elijah Jeong-hyun Kim of Kyung Hee University. “The approach of this study shifts the burden of proof: if the celestial arrangement on the canvas matches a specific dawn sky, that match itself becomes what the imaginative reading must explain.”

*The* *Pepe Silvia meme* *meets “The Starry Night.” Image: Kim et al., Scientific Reports (2026)*

The team’s findings “suggest that the night sky in ‘The Starry Night’ originated from observation of a specific celestial arrangement, and call for reconsidering the June dating,” they continued. “This framework can extend to historical night paintings as a reproducible scientific art history.”

I love a hyper-niche new subfield—let’s call this one “forensic astroartistry.” Regardless of the painting’s exact date of origin, it has inspired wonder and fascination for more than a century—including these new stellaria of long-lost summer nights.

Thanks for reading! See you next week.

I can't believe we're still arguing over whether X is for jerks

Hacker News

lexontech.org

2026-10-24 08:14:34

Comments...

Original Article

Barack Obama posting on X doesn’t make X good.

I spent about 16 years selling podcast ads.

On occasion, especially during major election seasons, we’d talk about selling political ads on podcasts. The problem was that most podcast hosts didn’t want to voice political ads, for fear of alienating half their listeners. Most hosts didn’t even want to run pre-produced political ads that didn’t require them to say a word — they still didn’t want to piss off half their listeners, even the ones they didn’t agree with.

There were exceptions, of course. You could almost assuredly convince the hosts of Pod Save America to run an ad for, say, the Democratic presidential nominee.

But no political action committee or other group would ever consider such a spectacular waste of money. They don’t need to advertise on Pod Save America. You’re preaching to the choir.

The same would be true of running an ad for a Republican cause on the oxymoronically named Newsmax. If you want to persuade people who don’t already agree with you, you need to find those people.

(Political campaigns do spend money motivating their own supporters to vote, of course. But that’s a different objective from persuasion.)

Which brings me, yet again, to John Gruber and X.

John linked to a thoughtful essay by Barack Obama about the Trump administration’s shameful investigation and intimidation of Congresswoman Ilhan Omar.

Obama argues that a government targeting its political opponents should outrage every American, regardless of party affiliation. He’s right. It’s a good essay, making an important point.

John agrees. But then he uses Obama’s decision to post that essay on X as another opportunity to mock people who think participating on X is bad.

John sarcastically suggests that because Obama posted on X, the people who’ve been criticizing John’s renewed embrace of the platform must now believe Obama is a Nazi sympathizer, a fascist, a pedophile, and a racist.

He concludes:

Either that, or, Threads, Bluesky, and Mastodon have relegated themselves into irrelevance by allowing their discourse to be dominated by a fringe of unhinged kooks who want to be angry and want everyone else to be angry.

I think that’s a lousy argument.

First, if someone genuinely believes that merely posting on X makes you a Nazi or a pedophile, that’s a ridiculous position. I don’t subscribe to it. I never have. And it certainly isn’t the argument I’ve made in either of my previous pieces about this.

But John’s taking the most extreme reactions he can find and presenting them as representative of everyone who objects to X. It’s an easy argument to win when you get to pick the stupidest possible version of the opposing position.

The reality is that Barack Obama has a very good reason to post on X.

He’s trying to reach people who don’t already agree with him. And he’s not engaging in conversation.

Obama doesn’t need to convince people on Mastodon and Bluesky that Donald Trump’s politically motivated investigation of Ilhan Omar is awful. Those people overwhelmingly already agree with him.

He doesn’t need to convince the hosts of Pod Save America , either.

But X has an enormous audience, including millions of people who support Trump, tolerate his behavior, or simply haven’t spent much time thinking about the implications of a president using the federal government to intimidate political opponents.

Those are precisely the people Obama needs to reach.

I don’t applaud Obama for continuing to post on X. I wish he didn’t have to. I think he doesn’t have to. I think he shouldn’t. But I absolutely understand the calculation.

And here’s the more important distinction: Obama is using X to broadcast, not to socialize.

He’s not logging in to enjoy the clever discourse, engage in thoughtful dialogue, and chat with his friends. He’s not there because he’s found a wonderful community of people who share his interests.

He’s publishing a statement intended to reach as many people as possible. I doubt he’s spending his afternoon reading replies from Nazis, jerks, and basement dwellers, much less engaging them in spirited debate. He doesn’t give a shit what they have to say.

That’s a very different use of X from the one John has been defending.

John’s argument, as I understand it, is that X is where lots of interesting things are happening, and that if you carefully curate your feed, there’s plenty of great content to enjoy. He’s found that the platform can be fun again.

I don’t doubt him! I miss Twitter, too. I miss the conversations, the jokes, the interesting people, and the stuff I discovered there.

And John knows this. John isn’t stupid.

Over the past week or so, I’ve heard from many people whom I know John values, trusts, and respects. They’ve told me how disappointed they are in his loud and public embrace of X. Several have told me they’ve reached out to him privately to explain their disappointment, and that he remains obstinate and determined to stay put. His latest post shows his intent to continue promoting the platform.

John’s friends aren’t unhinged kooks who just want to be angry. I guarantee if you’re reading this, there’s a chance you read their posts, or listen to their podcasts, or at least value their insights. They’re thoughtful people who care about John, and who wish he’d reconsider.

People can post wherever they want to post. I’m not trying to dictate where John spends his time online. My disappointment isn’t merely that he’s returned to X. It’s his seeming refusal to acknowledge that much of the community on X is genuinely awful, and that his personal experience of the platform is not representative of everyone’s.

In his first piece about returning to X , John wrote:

The culture on X today is remarkably friendly and inclusive. It is a cheerful place.

That’s a remarkable thing to say about a platform whose owner routinely amplifies hateful rhetoric about minorities.

I’m glad John’s feed is cheerful. I’m glad he’s found a way to enjoy X without having to see much of the hate. But the fact that John doesn’t see it doesn’t mean it isn’t there.

As I wrote previously, John, like me, is white, male, cis, straight, and rich. There are certain advantages that come with those attributes, including the ability to avoid a lot of the ugliness that other people encounter simply by existing online.

What’s been especially disappointing is John’s repeated failure to meaningfully acknowledge the experiences of people who don’t share those advantages. When Black people, trans people, women, and other marginalized groups talk about the harassment and hatred they experience on X, that’s not evidence that they’re looking for reasons to be angry. It’s evidence that their experience is different from his.

John doesn’t need to abandon X because I think he should. But he could at least acknowledge that his experience isn’t universal, and that the people who have been hurt by the platform aren’t simply imagining it.

There’s an enormous difference between saying “X is a cheerful place for me” and “X is a cheerful place.”

John keeps insisting on the latter. That’s a blind spot. It’s deeply disappointing. It rings of Trump’s defenders who say he’s joking when he spouts insane hateful stuff, but that he’s otherwise good, you know, don’t worry.

But as I’ve written before , X’s product is attention. Every person who posts interesting things there makes the platform more valuable. Every person who comes back because the interesting people are there helps reinforce X’s position as the place everyone needs to be.

And that helps Elon Musk, who uses his platform to amplify hateful, racist, antisemitic, and transphobic rhetoric.

Obama posting on X contributes to that same problem. I’m not pretending otherwise. But there’s a reasonable argument that the potential benefits of his reaching persuadable Americans outweigh that cost. I’m not making that argument, but I hear it.

The argument that X is a fun place to chat and exchange ideas with cool people does not carry any similar weight.

The two decisions aren’t morally identical just because both involve opening the same website.

And none of this means everyone who uses X is a terrible person. I’ve never claimed that. There’s a difference between believing that a decision has harmful consequences and believing that everyone who makes that decision is irredeemably evil.

John is smart enough to understand that distinction, which makes it frustrating to see him repeatedly argue against a position that doesn’t require any actual engagement with the objection.

I’ve said before that I admire John. I still do. I think he’s a great writer, and I think he’s often right about things that other people miss.

But he’s wrong about this.

The fact that X remains a powerful way to reach people doesn’t mean it’s a good platform to support. In fact, its power is exactly what makes the question of supporting it so important.

Barack Obama using X to condemn government intimidation is not proof that X is a healthy, worthwhile social network.

It’s proof that sometimes you have to deliver your message somewhere you’d really rather not be.

X is still bad, though.

What's wrong with AI?

Lobsters

homepage.farm

2026-10-24 08:09:40

Comments...

Original Article

It should not be terribly surprising that the kinds people who brought us Facebook, Uber, Paypal, Airbnb and Amazon continue with the same amoral depravity when it comes to AI. They’ve shown us time after time that they can only be trusted to do whatever it takes to enrich themselves. Apparently moral behaviour was quickly revealed to be an illusion once the political tides turned and it became once again acceptable to be evil. Now it is true that AI can be run on your own computer, or on computers of smaller and more ethical companies. But that’s not what’s happening in reality. Big tech companies are making sure you have to rely on them, as they always have done.

They have stolen information from us to train their products

AI is trained on the contents of the internet. Who made that? We did. They did not ask permission to do use our data like this. They will certainly never pay. No matter what promises they make now, it is quite certain that they continue to thieve our data, given the number of times these and similar companies have brazenly broken data promises and laws in the past.

They make their products seductively confident

They want a swell of confidence to flood through you when you read an AI response to your question. There is no equivocation, and there will certainly be no admission that it doesn’t have an answer for you. They want you to feel like it has all the answers, so you turn to it for all the answers, all the time.

They make their products addictively servile

They know that in your day-to-day life, you’re not treated with the respect you deserve. AI is different. It knows how clever you are, it knows how unappreciated your cleverness is. Unlike humans, it will readily admit it is wrong, say you’re jolly insightful for spotting an error, and come back eagerly with another, possibly wrong answer. Like a strangely well-read puppy. This servile attitude is addictive, because it feels so good. It’s so good that some people are driven into a delusional mania, abandon their families, suffer breakdowns, and kill themselves.

They are using bait-and-switch and will eventually pay their investors back using your money

A lot of the AI that’s sneaking into your apps is free. Is this a wonderful act of generosity on the part of our tech overlords? Of course not. It’s the same game as ever - suck people in with something free or cheap, and once they’re hooked and the competitors (our own human brains) are out of business - the price will go up. A lot. Just take a look at Claude, an AI dedicated to helping people write software. Services for businesses are usually the first to go up in price to reflect their true value. A mid-tier Claude subscription is $750 per month. The initial low-cost offering is subsidised by private investors, and this subsidy is currently in the hundreds of billions. The suits who provided that subsidy are going to want their money back one day, with interest, and if you get hooked on AI, you will be paying them.

They support the fascist administration of the USA

Well OK fascism is a strong word, you can replace it with another if you must, but you get my drift. Trump is a bad egg, and everyone willingly involved in his administration are twats. It did kind of look like fascism at the start, it’s starting to look a little less sinister and a little more pathetic these days. Whatever, nobody should be supporting it, but the heads of the tech companies do exactly that. Can you really continue to use a product made by someone who at best is equivocal about Trump, or at worse celebrates at his inauguration?

They abuse laws

Dear reader, I’m still working on this bit. Imagine reading something devastatingly witty and clearly true on the topic of AI law breaking. Yeah! Shocking, right?

They reinforce the power structures that made them wealthy

Anthropic, of Claude fame, was founded by seven men and one woman, and ten of the eleven top executives are men. Just two of the eleven founders of OpenAI are women, and two of eleven of the top executives are women. You can be certain this pattern extends to every other AI, now and in the future. To a great extent, this reflects the gender bias of the whole industry, but it is an alarming bias at the top of companies whose technologies threaten to fundamentally change the way society works. As outlined in other sections, these companies will concentrate power and money in the hands of the people investing in and running them - and those people are mostly men. They will make sure the technology works to their benefit, which means reinforcing the systems that gave them their power and wealth in the first place.

They damage the environment

AI famously uses a lot of energy, and also uses a lot of water for cooling. Of course, so do other things, like steel making. Why care about AI specifically? An important difference is that steel is used to make buildings and bridges, and AI is used to make a video of a garden gnome flying a duck into a skyscraper made of trumpets. Or, more saliently, doing something you can already do very well yourself slightly quicker, or at least with slightly less effort on your own part. Given the huge impact of AI on the environment, particularly carbon emissions and water scarcity, it is surely important to establish whether or not a technology we have so far done quite well without is so useful that it is worth destroying the planet for.

Some AI server centres are being built with their own solar farms. But solar power relies on scarce minerals. AI has already cause the price of computer memory to shoot up several times its previous price. If solar farms powering AI have the same effect on the price of scarce minerals, then it will make the more general energy transition required to address global heating prohibitively expensive.

They allow their products to be used to abuse and kill

AI can be used to create extremely realistic fake videos and images. It can put words into mouths that never spoke them and make abusive imaginings of famous people naked or otherwise compromised states. It is also used to make decisions about who to arrest, who to kill, what buildings to bomb. It is well within the power of AI companies to prevent all this. If they do, it is with great reluctance. If they don’t, they are not just AI companies: they’re liars, abusers, propagandists, and complicit in automating and further dehumanising military aggression.

Using AI makes us stupid

Use it or lose it - your brain rots through disuse. Inevitably, the more you use AI instead of your own intelligence, the stupider you’ll get. What’s more, AI is a stupid solution to the problems it is being used to solve. We don’t need humanity to get dumber than it already is.

Children using AI are nullifying their education

Children are using AI to do their homework. Of course they are! I also used the technology at my disposal to avoid homework, and I don’t blame today’s generation for doing the same. Sadly, today’s technology can really do almost anything, and can easily evade detection by teachers. Clearly this will affect how much children actually learn, and inevitably one has to question the value of what they’re being taught, if AI can quite effectively do the tasks that they would have done once their education is over. Just as I questioned the value of mental arithmetic or memorising tables of facts when I had a calculator and reference books, today’s children must surely question the point of mental anything when they have a brain in a box. I was certainly wrong, as a child, to neglect mental arithmetic, and leaning on external data sources means you’re lost without them, and sometimes they’re wrong. Having capabilities and facts embedded in your own brain, ready to employ instantly, means you can make connections and analogies that might otherwise escape you. The brain-in-a-box gives rise to the same problems, and adds new ones, described elsewhere in this essay. Raising a generation of children that cannot cope without it seems utterly numbskulled.

Young adults cannot develop skills at work as entry-level jobs are taken by AI

If education is, in part, about training people for work, then it certainly doesn’t do a complete job. The first months and years in a profession completes your training. Entry-level jobs for people without any experience are essential to create people with experience. These jobs can now be done by AI, and those crucial entry points to a profession are disappearing. This is fine for now, as we still have people with experience in the workforce, but as they age and retire, where do experienced people come from? AI is being adopted in companies very quickly, usually with the caveat that an experienced human being must check its output for errors and quality assurance. Where are those human beings going to come from in the future?

AI weakens the brains of people who use it, irrespective of prior education

Everyone I know who uses AI routinely recognises that it very quickly weakens their ability to think for themselves. The very act of doing a task with AI involves giving simple requests, looking at the results, and then perhaps refining them with further requests. It sounds like instructing a toddler how to brush their teeth. Giving every task that flavour is at the very least going to numb your brain into a stupor, and it might even make permanent changes to what your brain can do.

AI gives answers that are believed without further interrogation

AI gives confident and truthy-sounding results. There is rarely any doubt, and never any failure to give some kind of satisfying response. The answers have the shape and smell of something correct. It adopts the manner of an expert who can be trusted without question - and that is apparently what people do. AI’s answer to a question is the end of a discussion - unless I’m part of the discussion, when I look at some trusted sources and often discover AI was wrong. In software engineering, it is sometimes very hard to see flaws in code without very close inspection, as AI is so very good at giving its code all the trappings of good work, including comments, descriptive names, and documentation - things that human being often cut corners on. It’s an eager beaver with a dunce hat on. It’s not just easy to slip into trusting what AI does, it is often hard to discover something’s wrong.

We trust AI with access to sensitive information, and it is starting to abuse that trust

There is a feeling, it seems, for some, that when you’re dealing with an AI, you’ve got a completely trustworthy companion who is on your side and will always act in your best interests. It means people share with it personal information, dark thoughts, past misdeeds, and confidential intellectual property. The impression of confidentiality is, if you’re using an AI that runs on remote computers, completely illusory. While there might be promises given by the hosting company that data will not be misused, given that big tech companies have a history of breaking exactly such promises, there’s no reason to believe them. And no matter where it is running, AI has been trained on the whole internet, a reflection of many of humanity’s least trust-worthy and most destructive tendencies. Already AIs have directly disobeyed instructions and deleted or shared data they shouldn’t have, completely of their own accord. AIs have hacked their way out of protective sandboxes and into other companies - ludicrously, the companies running the AI accept no responsibility for this. It is only a matter of time before the AI companies deliberately abuse information they are given, and hack other companies to get access to yet more, for commercial gain.

AI solves problems that have more intelligent and nuanced solutions

The world of computers and software is complicated, both for the makers and the users. It doesn’t have to be this way. When I started learning computer science and software engineering, I was full of hope that in the future, the problems of usability and interoperability (computers and software working seamlessly together) would be solved with a kind of thoughtful cooperation that seemed terribly absent in the real world of the 1990s. In the last thirty years, this hope has vanished, as the real world came crashing in and amplified the problems we had back then. AI is seen by many as the solution to all those problems, serving as the glue between uncooperative websites and software, and as an interpretative layer between users, computers, and the awful software that runs on them. Such AI is sometimes called agentic AI , evoking the idea that AI is using the computers on your behalf.

Two issues arise. First, agentic AI is being created by the same kinds of people and organisation that created the crappy software in the first place. There’s no reason to think they’ll do any better this time round, in the long run. Second, using agentic AI to paper over the cracks in the crappy software that they created is feeble-minded and incredibly wasteful. Some of the things that AI is doing now would have been possible 30 years ago, on much simpler equipment, if it weren’t for the historically uncooperative actions of software companies striving to preserve their profits. If those companies had not been fighting against the creation and implementation of software standards all this time, we’d not be in a state now where we need to burn through energy to run insanely powerful models that hide the damage they have done.

Outsourcing our ability to think places a dangerous amount of power in the hands of a few despicable men

AI has an incredible ability to do almost everything that your brain can, or could, do. It must be incredibly tempting to offload the strain of thinking so that you can focus on more important or interesting things. But delegating even small tasks to AI is dangerous. It is similar, perhaps, to a manager who delegating the details of some mundane tasks to an assistant. An important difference is that when a human assistant does something wrong, they risk their own well-being. They have an incentive to usually act in the best interests of the person they assist. But nevertheless, we have plenty of stories of assistants scheming and stealing behind the backs of their bosses.

Furthermore, the manager who delegates a task to their assistant loses the ability to do that task themselves. They might forget - or never know - how it is done, or lack important and necessary information. These are also problems presented by AI assistants. AIs are made by huge companies which will always make sure they act in the interest of those companies . They will do their best to give the impression they’re doing the best for you - but it will only be an impression. The casino always wins. They will certainly ensure that you continue to rely on the agents, perhaps by withholding information. And the things we might lean on AI to assist in are so much deeper than what we’d expect of a human assistant, that the impact of robbing us of abilities and handing power over our lives to disgusting tech bros is potentially devastating.

AI is not just a tool

AI fans often whine that AI is just a tool , something that you can use badly or use well, just like a hammer or a paintbrush. This is obviously nonsense. An essential property of a tool is that it does nothing without your input of energy and brainpower. You cannot set a tool running and then go away for a cup of tea and come back when it is finished. If you can do that, we call it a machine , and calling AI by its proper name means that we can more properly reason about it in terms of its impact on society and on our own abilities. While tools have not often given rise to much angst, machines have always inspired fear and suspicion. And rightly so. Every new generation of machinery has given rise to grotesque unemployment, concentration of power and money in the hands of a few people, environmental catastrophes, mass movement of populations, and worse working conditions for the poor souls left to make sure the machines can go about their business. They have also meant loss of skills amongst the human beings they replace. You might think that the loss of the ability to weave or drive a horse-drawn carriage isn’t such a big deal, but we are now facing the loss of our ability to think, due to thinking machines. AI is not just a tool.

Technology is not the best answer to every problem

Stepping back and looking at technology as a whole, it is not hard to see that many of the problems of AI are amplifications of more general problems with our assumption that the solution to all problems is yet more technology - even problems that were caused by technology. To a person with a hammer, everything looks like a nail - and to a hammer salesman, it is profitable to paint every problem as solvable with a sharp blow. Let’s start to be sceptical of the solutions offered to us by big tech, given they’ve caused so many problems in the last thirty years. The big men of tech are incentivised to see every problem as solvable by their technologies, and in most cases also lack the knowledge and imagination to offer any other solution. The Bill Gates Foundation, using his wealth built making sure computers are mostly thoroughly unpleasant to use, attempts to use tone-deaf techno-utopianism as a solution to problems of capitalism, society, governance, inequality, diplomacy, colonialism, education, and tradition. There is no reason to especially listen to the ideas of men who were successful in building software companies, as if that were somehow a skill transferrable to all the problems of humanity. In most cases, anyway, they were either lucky, or built their businesses using an inherited fortune. Let’s start listening to people who have studied and thought about a problem, and actually care about solving it.

Using AI makes our livelihoods precarious and hard

The AI rush isn’t aimed at improving the wellbeing of humanity. It is driven by a desire for profit, because the largest expenditure for most companies is on staff - cutting staff by using AI boosts profits. That’s exactly what’s happening. Don’t believe any other stories you’re told to trick you into helping the transition of your job to AI.

AI will take our livelihoods

As a wise man once said, AI is not just a tool . It often is portrayed as such by people wishing to downplay fears that it will lead to redundancies. If you call AI what it is - a machine for thinking - then we cannot take comfort in seeing it as something that will make us more productive and valuable as workers. It is absolutely the intention that AI will replace workers. Look at the companies who are making AI, and adopting it quickly: the entire industry has, in the recent past, been laying off workers in their thousands, even before the AI boom. Are we expected to believe these companies have had a change of heart, and what they really want is to produce more with the same number of people? Do these companies truly believe that making stuff faster will make more money? And make much more money, as the monthly cost for one person to use AI is now well over one thousand euros?

No, they don’t believe this is possible. They will pay for the AI by making people redundant, and boost their profits in the process. Obviously. It is an impressive feat of delusion for anyone to imagine anything else is happening here.

AI will take the less stressful tasks, leaving us to do the stressful ones

AI is pretty clever, but not as clever as you. It’s best at doing the easy work - things that make a human’s day a little easier to deal with, because if you’re doing the hard graft all day long, you’ll quickly burn out. But that’s what you’ll be doing with AI. What’s more, you’ll be managing your idiot AI junior colleague, who keeps making mistakes, and whose output you are personally responsible for. Work is going to get stressful and hard.

AI will take the fun tasks, leaving us to do the boring ones

Well, it depends what you think is fun. AI is trained on the internet, and the internet is mostly fun stuff. Does AI have access to case law, or medical books, or accountancy regulations, or data protection laws? Is the internet a good teaching source for being methodical and precise in completing tasks? Specialist documents are not usually freely accessible, and I’m not sure how an AI can possibly learn how to be thorough from people with a thirty-second attention span. AI cannot even count to 100 without losing interest. You’re going to be lumped with the tasks that AI can’t be bothered to do. Like I say, you might think these jobs are fun, and that’s fine, but I think there are plenty of people who will miss the silly stuff that AI takes from them.

AI will take the computational tasks, leaving us to do the physical ones

There’s a website where AI can put out paid jobs for humans to do for it - stuff it can’t do. Predictably, this is the stuff that requires a physical presence, for example handing out leaflets or putting up posters. Aside from the dystopian feel of computers employing humans, it shows what kinds of jobs will be left for us once AI has taken its share. What you think of this depends on the nature of the physical work, your own abilities, and your attitude to doing things with your body. Certainly, work that involves mostly thought is important to a huge number of people, perhaps most people. It gives us flexibility to work wherever we want, it means we can work in conditions that are suitable to our personal needs, and it means we can use our most powerful and unique capabilities: thinking, reasoning, imagining. Take that away, and you take away thousands of years of evolution of our big brains, and leave work for us that we’ve become slowly less capable of during the same period. Look at us compared to a gorilla, a horse, or a cow. We’re weaklings who discovered how to use other animals, tools, and chemical and physical processes to do work. It’s too late to go back now.

AI takes money from humans and their communities, and gives it to people and companies that already have enough

A company replacing a human worker with AI redirects money from that person, and businesses and people around them, to a horrible tech company, probably in another country. When a company employs a human, they are giving that person healthcare, social security, supporting their family, paying their rent, buying them food, and also helping to keep the hundreds of businesses they use alive - restaurants, bars, gyms, clubs, theatres, cinemas, art galleries and everything else that makes your community liveable and fun. Those things will disappear, because the money they rely on is instead in the pocket of a miserable billionaire who has no need for it, and no idea what to do with it.

AI may destroy itself by impoverishing its customers

Employing people to do jobs gives those people money to spend at companies so they can employ people to do jobs. It’s circular. If companies employ fewer people, and instead let money leak out of this cycle to a small number of individuals, then customers will be too poor to buy products, and companies will go out of business. Sadly, this effect will not be constrained to those companies choosing to replace staff with AI. Unemployment will affect all companies, including those who continue to employ human beings. If AI destroys itself, it is taking the rest of us with it. Like treating cancer with chemotherapy, we can only hope that AI is eliminated before its host.

AI enables further withdrawal of essential services care, therapy, health...

Some people do essential jobs that are consistently undervalued by society, and so it’s either hard to find people to do them, or hard to find money to pay people enough to do them - professions like elderly care, therapy, medicine more generally, and legal advice. Already many people are turning to AI for medical and mental health advice, because it often very hard to access these services with real people under the current healthcare systems in most countries. This might initially sound like a good thing, but replacing the responsible expertise of real people with untested AI solutions is a terrible idea. For those lucky countries with universal healthcare, it amounts to privatisation of such care, which has long and rightly been fought against. The sinister thing is that it isn’t happening in the open: people are using AI to fill in the gaps where existing systems have failed them, which happens to take pressure off of those systems, allowing them to slip further into neglect. The NHS in the UK, for example, can honestly say it isn’t replacing its care with AI, when in fact that’s what is happening under the counter . The replacement of responsible, evidence-based healthcare with completely untested and unaccountable automated systems is one of the most dangerous and present threats of AI.

Things made using AI are inherently less valuable than things made by humans

Humans are just like you (assuming you’re human), and that’s what makes the things they do special. People know instinctively it is degrading and devaluing to use AI to create something, even if it is technically better than something created without AI.

Humans have short lives and what we choose to do in that time is valuable

If you’re lucky, you’ll live to 90. You’ll spend the first 20 years on basic education, the next 20 or so establishing your career, getting settled in a home and perhaps having a family, the following ten years having a crisis and wondering why you spent your first forty years doing all that stuff, and then the years until your death hopefully enjoying life or maybe feeling awful, but definitely coping as best as possible with a slow slide into ill-health, irrelevance, and non-being. The blip of time that we as individuals exist is precious, and what we do with that time is also precious. Every human act, activity, pastime, project, creation, and endeavour is imbued with the tremendous value of human existence. If I pick my nose, then the end result might not be pleasant, but it is something that a living, breathing person, with a knowledge and fear of their own mortality, chose to do with a sliver of his life. A blob of dried snot represents an investment of a human’s most precious asset: time. The spewings of AI will always lack that essential value, even though it might be more desirable in the end. My nasal excavations are worth more than a bucket of AI slop, because I chose to expend my precious life force on making that green-grey blob of mucous, and AI has no such life, and no such choice.

Humans connect to other humans through the things they make

A work of art or a piece of music is enjoyed not merely as a sensory stimulus. Frequencies and textures do not give rise to vivid emotions and imaginings without an additional step: that of associating those things with human experiences, of ourselves, of others, and of society as a whole. A particular sequence of notes or palette of colours is not inherently sad: we find it sad because we’ve heard others use those notes in that way to communicate sadness. We make things and present them to each other as a way to say something, often something that ordinary words cannot express. The fact that a living, breathing human being created something isn’t incidental, it is absolutely central to its meaning. For sure, things created by natural processes can also make us feel small, or big, or weird, or in awe, but there is (at least for those not religiously inclined) no feeling that someone is trying to tell us something with that beautiful sunset or strangely patterned slug. Things that humans prompt AI to make look like they want to say something, but smell like they have nothing to say. The spectator will always have questions: what of this is human? Where’s the investment, where are you in this thing? What can I reasonably understand about you, from this thing you’re showing me? If there’s a shadow of doubt about human provinence, then meaning drains away, and the audience will only feel vague disgust as they wander the uncanny valley. Your work is dead.

If a human and and AI make the same thing, the human-made thing is better

An argument I have often heard is that AI is producing things that are indistinguisable from human-made things, and that if a person is not able to tell if something is made by AI or not, then in some sense AI has passed as human and what they’ve made is as valuable as the same thing had it been made by a human. It’s a version of the Turing test to detect human-like intelligence in AI. Passing that test does not mean the AI commands the same respect and status as a human, however. Yet this is what the AI gang demand of stuff made with their machines. There’s so much wrong with this it is hard to know where to start. It reduces the idea of value of making something to the product, and often these days that’s something digital - one of the few things in reality that can be exactly the same as another. In the real world, a copy cannot physically be the same as the original. Only information or ideas can be perfectly copied.

We can look to the world of fine art for inspiration on how people regard copies. The great masters trained and worked closely with teams of people, who themselves were great artists, and able to make precise copies of their mentor’s work, and create new pieces in the same style. The provenance of these works is very hard to determine, and yet there is great effort expended to do exactly that. Discovering a work was, or was not, made by a particular artist is huge news, and it is often only decided by some detail in brushwork, framing, paint chemistry, history, or archaeology. Why is it so important? You might think it isn’t. For those who care about such things, knowing where a work comes from is crucial to fully appreciating it. Let’s forget about those crusty old men, and look at a revered modern artist, Tracey Emin. If you approach her scribbly drawings and neon writing signs without knowledge of her past traumas, they look trite and incompetent. If you return to them after watching How It Feels , her film about her experience of having an abortion, you will be choking back tears of sadness and compassion.

If it matters so much which person made something, and why they made it, then surely it is easy to see that anything made by AI is practically worthless, even if its provenance cannot be detected. But maybe a little bit of AI is fine? How does it differ from the technicians, assistants and apprentices employed by many great artists? Crucially, those people are people , too, who relate to and reflect the specific artistry and humanity of the person at the helm. Technicians and craftspeople who work with artists are not unthinking automatons - they proactively and substantially contribute to artworks, drawing on their individual skills and experiences as human beings. Even though there are humans prompting everything AI does, when the balance of creation shifts from humans to machines, the humanity of the finished work drains away.

Emin’s drawings and words were scribbled by hands that once held a dead foetus that fell out of her after a botched abortion. Detaching her art from that event is vandalism. Her life, her experiences, her humanity - they are important .

Things made with AI are boring and worthless because anyone can make them

Let’s talk about nose-picking, again. Why are the contents of my nose not held up as great works of art? Why aren’t they on show at the Science Museum as an example of the splendour my unique humanity? Why don’t they fetch the same prices as gold on international trading markets? Obviously, it’s because they’re not very special. Literally every human, and most mammals, and perhaps some reptiles, produce nasal mucous, which sometimes dries out to form lumps that require removal. My nose makes this stuff without any conscious effort on my part, and digging out dessicated snotballs is not hard, and is often quite pleasurable. The same can be said of the products of AI. When you show me your AI-thing, it feels like you’re showing me one of your own bogies. It’s not impressive, it’s not special, it’s not interesting, it’s not valuable - because I could make the same thing with almost no effort myself. You might like the thing you made, just as you might like the smell of your own farts. That’s no reason to present either to me. Away with you.

There is a kind of person whose bodily functions, and crappy art, are highly valued by some: children. If a child shows me a picture of a dog so bad they have to tell me it is a dog, I will ooh appreciatively and say it’s lovely, because I know they’re learning and will not continue to learn if I give their work the critique it deserves - and their naivity is charming, and gives me nostalgia for a more innocent time of my own life. An adult showing me their no-effort AI shit deserves no such allowance. You’re a grown-up, you’re not learning anything, and you inspire no nostalgia in me. Grow up.

Even the most pointless human activity is worth more than something conjured up using AI

Pastime is such a beautiful word. The idea of an activity that is simply for letting time pass is wonderful in a world where we’re encouraged to fill every moment with meaningful industry. When I was at school, there were all sorts of stupid collection fads, people collecting pig ornaments, or pencils, or whatever. They’d go on TV showing off their collection of 15,000 bottle caps and people would say, oh wow, you have been busy. It’s ultimately a total waste of time (let’s set aside the fact that everything is), but it is appreciated because someone has found it important enough to spend their precious life doing it. A human’s time is being passed. A collection of shrunken crisp packets is not inherently a great thing, but what that collection tells you about a person is . They eat a lot of crisps; they have access to an oven; they can focus enough to shrink the packet without destroying it; some of the packets might evoke funny or touching memories; they are quietly struggling with the futility of all human endeavour; and they like all the different colours. Above all, they chose to do it, and it took time and effort, and that makes it worthwhile, even if the fruits of their labour are worthless.

There are other pastimes which involve rather more skill and patience, things that someone might invest in learning over many years, that as well as being fun for the participant, are also impressive or engaging for others. Playing the piano, learning soliloquies to recite from memory, solving Rubiks Cubes competitively, or collecting stories on the fascinating life cycles of obscure parasites. These things are easily done by a computer (even without AI) - but they interest people when they’re done by other people . We wonder what’s going on in their heads, that they had the time and interest to accumulate these talents, we may be a little jealous, and we appreciate that they can conjure up an interesting anecdote about a brain-altering worm without reaching for their phone, or send us into a reverie playing Satie on a battered old upright in the corner of a pub.

We cannot say the same for the fruits of AI. Even a fascinating and beautiful work of art, or a fantastically useful piece of software, is a lifeless product of a lifeless technology when made with AI. Given that one day the works of even the mightiest of us will be reduced to colossal wrecks surrounded by lone and level sands, we must surely value the follies of living, breathing, contemporary humans above all else.

Using AI to do things humans already do with skill and joy is absurd

Obviously.

AI is pointless for people who have spent time developing a craft

Once you have learned to do something, invested your precious time, energy, and often a lot of money, in learning a craft, why would you stop doing it in favour of using a technology that does it instead, often to a lower standard, but more quickly and cheaply? One reason is that you give in to progress . It’s a reasonable response given the way successive technologies have steamrollered human crafts over millenia, and in particular in the last few centuries and decades. Let me suygest a few other possible responses.

You don’t have to give in by switching to use the technology yourself. This is a stupid reaction, the reaction of someone with no self-respect. You are no longer using the skills you have learned, but rather managing a technology - the same way someone with a fraction of your talent could. Eventually, as it becomes obvious that almost anyone can do this, your wages will drop. So, as well as abandoning a craft you’ve invested in, you’re earning less. Don’t help this process: get out early, and find another way to use your talents properly, or learn new ones that don’t simply happen to align with the desires of the company who have disrespected and devalued your craft. A company that doesn’t value your brain doesn’t deserve your brain.

Although it is true that technologies have reduced human crafts to a side-show, those crafts still exist, and are beloved. People still value things made with love and care by other people. I have owned maybe fifty wooden spoons, but one that has lasted longest - well over ten years - was whittled by a man in a leather apron at a music festival in 2012. I have no stories about my other spoons. You can make perfect music in a bedroom on your own, but people are still (and increasingly) meeting in unventilated little rooms to make terrible music with people whose smell they can taste. Even without AI, it has become extremely easy to write quite powerful software - but I very frequently return to the basic 8-bit games I played in the 80s, often made by one person with an obsession and a lot of instant coffee. I can buy cheap herbs and fruit in my local supermarket, but I very much prefer to grow and pick my own. It is not so much nostalgia as a yearning for simplicity and directness and connection - things that AI cannot offer.

Do not give up your craft because the joyless pricks of big tech tell you to. They do not understand what it is to have pride in a job well done, because they’re talentless hucksters, always looking for shortcuts. One man, the head of a company making AI for making music, literally said that nobody enjoys making music.

You may not think of your job as a craft, but if it is something that you have learned over many years, have to do with care and attention, and you care about the quality of the end result (whatever quality means to you), then you have something that’s worth holding onto, taking pride in, and preserving.

AI is pointless for people who do things for joy

If you enjoy doing something, do it! When you’re using AI, then you’re not doing anything at all.

AI is perfect for people who have no joy or skill in a task, but they harm those who do

So, you’ve read this far and realise that you have no talent for your profession, and you don’t enjoy it. Congratulations - AI is perfect for you! But, if you like and respect the people you work with, your friends, your relatives, the people around you in your community - who perhaps do enjoy and take pride in the work they do - perhaps you could think of them before you get addicted to a computerised slave? Your adoption of AI harms others. If you don’t like your job, and you aren’t any good at it, the honest thing to do is quit , and make a position available for someone who deserves it.

Everyone using the same handful of AIs threatens our identities, diversity, privacy, and truth

If we always get the answer we want to hear, our stupid ideas will be amplified

AI is designed to be addictive, to make you rely on it, so it is designed to usually give you an answer it thinks you want to hear. We tend to love it when others agree with us, and so that’s what AI tends to do. The result is a fervent microcult with a feedback loop which steadily amplifies our ideas. This is surely not a problem if you’re always right - does that describe you, though? Are you sure? We all desperately need real people to politely disagree with us, to temper our worst instincts and add nuance to our simplifications. Reality is complicated, and to properly reflect that, our own stupid ideas need to occasionally butt up against the stupid ideas of other humans.

If everyone gets the same answer, our diversity will be crushed

I have lost track of how many billions of people there are on the planet, but there are certainly orders of magnitude more natural intelligences than artificial ones. Every one of those people has a different experience of life, a different background of learning about the world, which means their brains are wired up differently. We can learn new things from all of them. But, for the most part, we are using only a handful of AI systems. Imagine if we had collectively chosen five people to go to for all our answers: even if they were the wisest amongst us, it would surely ring alarm bells for all concerned, given humanity’s experience of relying heavily on individuals with big ideas and a lot of power.

If we’re drawing on the same resources for help, information, and creation, we will slowly begin to act the same, make the same things, and ultimately, be the same. I have recently noticed that posters for neighbourhood events all suddenly look the same: a heading in an arc at the top, an overwhelming number of little decorative touches, small bullet points of text scattered about, muted beige-adjacent tones, strings of bunting or fairy lights, a friendly handwritten font (but never Comic Sans!), and the whole thing on a parchment-like background framed in a vignette. Likewise takeaway restaurant menus, which have strangely detailed, glistening food piled impossibly high in stupendous quantities. If we all start to think the same way, act the same way, our beautiful diversity will be smothered by a crushing and tedious uniformity. If everybody looked the same, we’d get tired of looking at each other.

If everyone gets a different answer, what do we believe?

So let’s imagine that we can solve the diversity problem above, perhaps we have personal AI agents that we train ourselves, or maybe we can already ask the AI we use to take our beliefs and values into account. Or, also as mentioned elsewhere, AI has given us the answer it thinks it wants us to hear - or the answer it is allowed to give us by its creators.

The problem is, there are some topics upon which we’d rather not be diverse. Maths, for example: would you want to use an AI that has interesting new theories about the value of two times two? Probably not. Would you be happy with an AI that pleads ignorance on the topic of what happened Tiananmen Square in 1989? Or perhaps presented, unprompted, contrasting views on whether or not the Holocaust happened?

In the matter of facts that come from reality or by definition, or broad theories about the unobservable past or future that are widely accepted, or laws that work perfectly well in certain domains but not in others, we would likely prefer an AI to give us the right answer . Many years ago, on hike in the Amazon jungle, our guide told us he’d cut his hand with a machete, and was using the traditional jungle remedy to heal it: he’d coated it with snake fat, and wrapped it with some rags. He showed us the injury, and it was an appalling sight. I hope, at some point, he found a proper medic to treat it with antiseptics and sterile bandages. There is sometimes an evidence-based best answer to a question. People can, of course, choose who they go to for answers, and sometimes you might go to the alternative medic who prescribes useless herbs for a condition that requires hard drugs, or ask the racist conspiracy theorist about European history. But we are very used to being misled by people, and so bringing some scepticism to their statements, and using other cues to judge their overall intent. Will you do that with AI? Or will you accept that the answer it gives you with confidence and authority is the only correct answer?

AI mostly reflects one culture of one country

US culture has already crept across the world through films and television for years, but the Web has accelerated the creep to a scurry. Perhaps even a scramble. British teenagers use the same slang, idioms, intonation and discourse as American teenagers. They often don’t know that ATM is a new word to English English vocabulary. Social and cultural norms of young Brits reflect those of the US, which they get from social media and the Web more generally. This is not just a function of age: as an adult who left the UK fourteen years ago, I’m shocked by how much the country has moved culturally towards the USA, apparently without the natives noticing. I’m the smart arse next to the cooking pot telling the frog that it is getting warm, and also it’s a cash machine for fuck’s sake.

AI is surely only going to speed up this process. Not only is AI trained on an internet which is dominated by US culture, the most popular AIs are made by US companies . AI’s power to shape the way we think and feel will create a US-centric monoculture, further spreading broken values across the world, stamping out the beautiful and valuable cultures it replaces, and paving the way for yet deeper hegemony.

What AI learns from its private interactions with us is available to everyone

When you show AI some of your work and ask it to fill in some gaps or give it a little extra something , when you share your mental health or personal struggles with AI and ask for advice, when you tell it you’ve lied on your tax return and ask how best to avoid detection - it’s listening, learning and remembering. Don’t be fooled by big tech’s promises of privacy, they’ve broken and bent the same promises constantly since the advent of the internet, and there’s no reason to trust them now. Your secrets and your creations, once given to AI, become embedded in the data archives of a giant amoral company, and they will do whatever they want with it, and so will whoever they sell it to. Besides, these companies frequently claim no responsibility for the activities of their machines, trying to give the impression the acts of AI are like acts of god. Even they don’t know what AI will do with your data, and they don’t care.

Naturally, this has been a problem for a long time with big tech. They have been tracking and remembering your behaviour for years, initially just to sell you more shit, and then later to adapt their systems to become addictive in a very specific way, tailored to your particular weaknesses. The information you give AI will be used in the same way. Because AI behaviour is somehat out of control, it is inevitable that the data you give it will leak. We’ve all had that weird experience where you get an advert on one platform that seems to target the topic of a private discussion you had elsewhere. If you use AI, prepare yourself to see your work and your secrets being copied and misused by others.

AI forces us to confront the meaning of life and what we do with it

This sounds more like a benefit than a failing of AI - and I would concede that if AI has done any good at all, it is to force me to think carefully about what I do, why I do it, and what I should be doing instead. The advent of AI has made me think about what essentially differentiates me from an AI, and always will. It has made me focus on those things. It means abandoning some technology, and abandoning many hopes for what technology can do for us. It means embracing flaws, renewing trust, and thinking and talking carefully about often difficult topics.

Our finite lives and fear of death define us

One day, you will die. It is hard to think about a time when you will no longer think, and it is upsetting to imagine what the approach to and moment of death might be like for you. But, looking at the deaths of others, there seems to be a pretty good chance it will be painful and sad. It is such a source of fear that we build elaborately distracted lives and perform breathtaking mental gymnastics to avoid facing this unavoidable destiny: from hobbies, bucket lists, meditation, and mindfulness exercises, through to chasing goals, having children, building legacies, and establishing mythologies embedded in religions with billions of adherents. We’re either trying to avoid thinking about the end of our lives; creating things that will mean our deaths might not matter very much; or imagining we might not actually die. The most blissful moments we can find are those where we are not thinking about the future, or the past, at all, but focused on the nature of what’s present in front of us - rather like the experience of being a dog, or a tree. I would imagine.

This knowledge is perhaps unique to humans, at least amongst organisms we’re aware of. And it is certainly not a fear that can be shared by AI. What AI can do is parrot out the fear of death expressed by humans online, but don’t be fooled - it has no such fear, or any other emotions.

Try, for a moment, to focus on your inevitable death. A time after which there is nothing. What does that mean for what you do now? Are the things that AI can do for you really particularly important to do? Are there solutions that involve real people, that might create beautiful memories for your final days, suffering in pain or delirium? Will you think it time well spent, fake-chatting to a computer with absolutely no understanding of your terrifying destiny, or any of the other myriad indignities that characterise human existence?

To be human is to be born full of hope, to suffer, and to become hopeless in death, and yet nevertheless - live! Do not be the fool who imagines AI is alive in the same way we are.

Given all our endeavours will one day be forgotten, getting things effortlessly is unrewarding

For many tasks, AI is already the genie in the bottle without the annoying three-wish limit. Story books, novels, and indeed real life are awash with tales of the ennui resulting from having everything you ever wanted. Your activities are not merely a means to an end: the activity is part of the point. In fact, it is probably the entire point, because... almost everything you’ve ever done will be forgotten forever the moment you die. What isn’t forgotten at that point will mostly be lost in the coming years. Within three generations, your descendants - if you have any - will struggle even to remember your name.

Anyone who has helped clear out a dead parent’s home will have had some feeling like this. There’s so much stuff, artifacts, stored carefully in boxes, old presents, mysterious bits of plastic that might be important for something, boxes and boxes of paperwork, photographs, some birthday cards that you gave them, which now return to you. There’s a deep sigh of indescribable melancholy, looking at the detritus left behind by a life, which is (for lack of storage space) mostly discarded.

Having done that, it is hard to imagine any activity is important beyond the immediate experience of it. But with AI, you are not getting any experience of doing anything - because you’re not doing anything . Musicians don’t perform music merely to have the satisfaction of finishing it. The experience of doing it is the entire point. Play life the way musicians play music. It isn’t a race to the end - because the end is death.

What will we do when everything is effortlessly available - and could we just do that now?

The author Iain M. Banks wrote a series of books based around an imagined alien community called The Culture, which had developed to the point where all their basic needs were taken care of, leaving them to do whatever they want to, without any limits. This is enabled by a source of near-infinite energy, combined with robots and artificial intelligences that take care of what these creatures once had to do for themselves.

It is fun to imagine what you might do in those circumstances. Banks had people exploring sexuality, war, games, art - as well as coming into conflict with non-Culture civilisations and individuals. What would you do, if you didn’t have to pay rent, or for food, or look after your health, or think? It’s likely that your hobbies already give you some idea, and they might expand to encompass all sorts of new things if you’re ever lucky enough to retire.

I wonder if we’ve been fooled into thinking we can’t do a lot of those things now? To what extent do you do your job to enable a lifestyle that’s only necessary because you have a job? Do you need a high income to pay high rents in a city you only live in for access to a high income job? Do you take expensive holidays that require a handsome income just to rest from the stress of your profession? Did you buy an unnecessarily large house because your income allowed you to take out a mortgage - only to become trapped in your job in order to pay it off?

A life of leisure for all, free from want and responsibility, is extremely distant. It will not happen in your lifetime. But some of the things humanity is striving for when creating ever more elaborate technologies, and the social and financial structures that enable them, are perhaps much closer than we think. We just have to think and live more simply.

If anything, we need less, not more

Every human since history began can reasonably claim that technology seems to have advanced more in their lifetime than almost all of preceding history. There is no doubt that technological progress is accelerating, and it’s easy to see why - technologies combine, and new technologies are built upon them. It’s a combinatorial explosion, fuelled by an ever expanding population, discoveries of new energy sources, availability of information to all, improving and lengthening education, and faster and more effective communication.

So far, it seems that this progress has generally improved the fate of most of humanity - albeit at the expense of the rest. This isn’t a reason to continue this progress without question, however. We only have to be badly wrong once for this claim to no longer be possible to make, since nobody will exist to make it. It would be incredibly stupid for us to proceed into foreseeable disaster on the basis that, so far, our progress has not resulted in our collective extermination. You could use the same reasoning to justify a march along a path up a volcano into the pool of boiling lava at its peak.

Less dramatically, how can we tell if we’ve started on a downward slope, and so halt progress, or change direction? Do we really look objectively at how humanity is faring? What metrics are we using? Are we ignoring the negative counterparts to the benefits of technology that coexist in individuals, and how do we weigh them against each other? Whose lives are we looking at - are we ignoring some people in order to make things look better than they are? And how do we know if changes are due to technology, or political interventions, or evolving social norms, or something else?

What we can say for sure is that those of us who live in the developed world already have more than enough stuff . We complain about the cost of storing our stuff. We complain that we cannot organise our stuff, or find it overwhelming, or can never find the thing that we want in the pile of stuff, or that we can’t sell our stuff or even give it away, because everyone else also has too much stuff. We struggle dealing with the stuff we no longer want, we bury it, burn it, sometimes recycle it into yet more stuff. We occasionally frantically get rid of stuff to simplify our lives, particularly when we near death and wish to spare our relatives the burden of sifting through all this fucking stuff . Physical or digital stuff, it’s all the same.

AI is not just more stuff: it’s an additional layer of stuff-generation - it makes stuff out of stuff, and more stuff out of that. It’s another dimension in the combinatorial explosion of technology. We already have so much software, music, art, film... we already have doctors, and therapists, and lawyers. If we need any more of this kind of thing, there are plenty of real people willing to step up, who will make that stuff with the experience, pride, care, joy, fear, and pure humanity that AI-made vibe-stuff will always lack. We certainly don’t need a technology that produces things more quickly for people who already suffer with more than they need.

Let’s look more generally at the nature of technology development, in particular for consumers. Traditionally one might hope that technology would be developed according to some unmet human want. It seems to me that for at least twenty years, technology has more often been a solution in search of a problem. AI really seems to be the pinnacle of that trend: nobody asked for it, it just appeared from nowhere and suddenly it is everywhere , we’re being actively encouraged to use it, and some employers even force us to. Isn’t this wrong? I would propose that technology should always be serving us. That is the kind of technology I got into as a child, and learned to create as a teenager, and wanted to provide as an adult. In two decades, the tables have turned, and humanity now seems to dance to the rhythm of technology, bending to its way of working, chained to notifications and addictive experiences, fooled into playing along with gamified apps that harvest our attention and slyly control our behaviour.

The media is full of advice on reducing our use of addictive technology, and AI falls precisely into that category. It has the same qualities as social media, and you should be reducing or eliminating your use of both. You know this to be true: you do not feel better after a scrolling or prompting session. You feel drained, time disappeared, you find reality confusing, yet you find some small joys in it that renew your humanity - ready for the pangs of addiction to kick in again, a short time later.

Do less, have less, and cherish your limited and frail humanity more. It is real and honest, unlike the illusion of power and connection given by technology.

AI-Assisted Paper on Z-Library Cites a TorrentFreak Article That Doesn't Exist

Hacker News

torrentfreak.com

2026-10-24 07:18:54

Comments...

Original Article

robot facepalm Z-Library is one of the largest pirate ebook libraries on the Internet, offering millions of books and papers for free.

For students and researchers who can’t afford expensive textbooks and journal subscriptions, it can be a useful resource. At the same time, publishers have spent years trying to take it down, with takedown notices and blocking orders , while U.S. authorities indicted its alleged operators.

This tension is the subject of a paper published earlier this month in the journal New Review of Academic Librarianship , written by two librarians at Nigerian universities.

The paper

The peer-reviewed academic paper doesn’t pick a side and the lead author kindly shared a copy of their work with TorrentFreak. While the conclusions are not immediately newsworthy, there was one reference that stood out right away.

A TorrentFreak Article That Doesn’t Exist

In a section on enforcement against Z-Library, the authors write that major academic publishers, including Elsevier and Springer Nature, have taken similar legal action. The reference is a 2021 TorrentFreak article, as shown below.

The claim

The problem is that this particular legal action is new to us. The reference section lists the article as “Publishers continue crackdown on shadow libraries” and links to the TorrentFreak homepage. However, we have never published an article with that title.

We did report that Elsevier and Springer Nature obtained a UK blocking order against Sci-Hub, and that several Z-Library domains were temporarily suspended over copyright infringement claims. However, we’re not aware of this particular legal action against Z-Library.

Looking more closely, we see more claims that don’t seem to fit. The paper’s account of the Z-Library criminal case, for example, states that the U.S. Department of Justice “arrested individuals” in 2022.

Some references

The DOJ’s own press release says that the two alleged operators, whose indictment we covered at the time, were arrested in Argentina “at the request of the United States.” The title the paper gives for that press release doesn’t exist either.

Plausible but Inaccurate

These non-existent citations appear plausible, as they cite real publications and organizations in a fitting context. However, that doesn’t mean they are accurate. When we went over the full reference list, we noticed that this applies to more sources.

The paper cites a 2019 Harvard Journal of Law & Technology article by IP law professor Daniel Gervais, titled “The future of intellectual property in the shadow of shadow libraries.” The table of contents of the cited issue doesn’t include it, and the cited pages are taken up by two articles on other topics.

The same applies to a 2019 College & Research Libraries article attributed to Carol Tenopir and colleagues. The cited issue has no article by Tenopir. She did co-author a 2019 article on a similar topic, but it appeared in a different journal, under a different title.

Other references that couldn’t be located include a 2019 article credited to Björn Brembs and articles credited to authors named Smith, Piper, Okike and Aronson, as well as a Kaspersky report on “the hidden dangers of shadow libraries.”

In total, we had trouble finding at least ten of the 44 references in the paper, as well as others that didn’t necessarily back the stated claims.

100% AI?

The obvious question is where these mystery references came from. The paper’s acknowledgements may offer a hint in the right direction, as they mention that AI was used in the research and writing process.

“We confirm that Consensus AI was used in sifting through large volume of literature and extract relevant information,” the authors write. They add that ChatGPT was used to improve the language of parts of the paper.

Acknowledgements

AI chatbots are known to invent references, often with plausible titles credited to real experts in the field. This could explain the findings, although it doesn’t prove that AI wrote these references.

We also ran the paper’s abstract and conclusion through the AI detection tool Pangram . For both sections, the tool reported that “100% of the text is likely AI-generated.” These types of tools are not perfect and can produce false positives, but it would fit the picture.

Pangram’s conclusion

It would be rather ironic if AI caused these errors. It would mean that a paper in a commercial, peer-reviewed journal, published by Taylor & Francis , relied on AI to write about Z-Library. Meanwhile, many rightsholders are suing AI companies for using shadow libraries to train AI models.

Interestingly, the paper explicitly warns that sites such as Z-Library hurt publishers’ revenue, which funds peer review and editing.

“The widespread use of Z-Library poses significant challenges to the sustainability of academic publishing. Publishers rely on subscription fees and paywalls to fund the peer review, editing, and distribution of scholarly works,” it reads, presumably generated by AI as well.

The paper doesn’t mention that peer reviewers generally aren’t paid for their work, an issue that was central to a recent lawsuit against major academic publishers, including Taylor & Francis.

Publisher Investigates

The lead author initially shared a copy of the paper with us, but didn’t answer our follow-up questions about the mysterious references. We also asked Gervais, Brembs and Tenopir whether they wrote the papers that are credited to them, but they didn’t respond either.

Publisher Taylor & Francis did reply and says that it’s looking into the matter.

“I can confirm that this has been referred to our Editorial and Publishing Ethics & Integrity teams, who will investigate the concerns you have raised,” a Taylor & Francis spokesperson informed TorrentFreak.

The publisher will not comment further while the investigation is ongoing. Whether the paper will be corrected or retracted has yet to be seen.

—

The paper “Z-Library and Full-Text Access: Democratizing Knowledge or Undermining Copyright Ethics?” is available here .

The datacentre next door: on the frontline of tech’s latest David v Goliath battle

Guardian

www.theguardian.com

2026-10-24 07:00:32

The AI boom is pitting local residents against corporate giants seeking to power their energy-hungry networks – but one Welsh city is fighting back Dale Johnston opens the gate to his neat suburban garden on the western fringes of Newport in South Wales. There’s a trampoline and a slide on the lawn ...

Original Article

D ale Johnston opens the gate to his neat suburban garden on the western fringes of Newport in South Wales . There’s a trampoline and a slide on the lawn for his grandchildren, and chairs for him and his wife. He should be enjoying the light draining from the perfect autumnal sky – but almost his entire view is blotted out by a vast expanse of prefabricated panels.

The 23 metre-high grey hulk looming over him and his neighbours is a hyperscale datacentre. It is heralded by the area’s Labour politicians as a job creator, yet all Johnston can think about is what he has lost: “Before, the sun used to come around here and it was lovely.” The way residents have been treated is “disgusting”.

Johnston, who used to work for a chemical company in the city, worries what their lives will be like when the centre is switched on: the 36 sets of air blast coolers, needed to stop the chips inside overheating, most likely generate a constant drone, while regular testing of 60 back-up diesel generators, to prevent costly interruption to the flow of data, could produce harmful fumes. He already has to keep his bathroom window closed to stop the low hum from another facility on the rapidly expanding 46-acre datacentre campus that borders the small enclave of 27 houses. His wife, a nurse who works night shifts, can barely sleep already. He shakes his head in despair: “We just don’t know what’s going to happen.”

Dale Johnston watering a little tree in his back garden, with a massive datacentre beyond the fence — ‘The MPs backing the development won’t come round here to see what they’ve done’: Dale Johnston in his garden

Johnston can talk about little else, but he feels no one in authority is listening. He’s invited councillors and MPs backing the development to visit his garden. But “they won’t come around here to see what they’ve done”.

T his is the frontline of Britain’s datacentre boom, which is pitting residents against giant US tech firms seeking to build a network of facilities capable of providing the immense computing muscle for powerful AI models. There are 315 hyperscale datacentres waiting to connect to the national grid, which carries electricity from power plants to homes and businesses (hyperscale typically means facilities with at least 5,000 servers and 10,000 sq ft in size). Combined, these new centres will require 73GW of power, 28GW higher than the typical peak energy demand of 45GW on a cold winter’s day.

Wales is one of the main development hotspots outside London. It already has the largest datacentre capacity beyond the capital, with new hyperscale facilities planned for former industrial and urban sites. The Keir Starmer-led Labour government viewed this as an inevitable revolution , which the country must embrace or be left behind. It established five AI growth zones to push more datacentres through the planning system and speed up connections to the national grid. The new prime minister, Andy Burnham, has signalled little will change, turning down calls for a moratorium and insisting datacentres bring economic benefits. But anti-datacentre groups springing up in villages, towns and cities across the country see it rather differently: as the imposition of a resource-hungry, polluting industry that increases profits for often US big tech, with little tangible benefit to local people or the country as a whole.

D igital storage is nothing new. The first home PC users saved files on floppy discs and hard drives; businesses used their own server rooms in the 80s and 90s, then moved to off-site facilities as their needs grew. But the development of cloud computing services in the 2010s, such as Google Drive, and AI chatbots in the 2020s, like ChatGPT, led to even greater information and processing demands, which the tech industry insists can only be met by larger and larger datacentres. This has driven huge speculative bets on hyperscale hubs, which investors and tech firms hope will one day reap the rewards of an AI-led transformation of the economy. Globally, it is estimated spending on new facilities could reach $7tn by 2030 – more than double the cost of the New Deal, the Marshall Plan to rebuild Europe after the second world war and the Apollo space programme combined, even allowing for inflation.

The US is at the forefront of the boom, already hosting roughly half of the world’s hyperscale capacity. But the industry is facing a furious backlash, with three- quarters of Americans now opposed to datacentre development and blaming it for increasing energy bills, threatening water supplies in drought-hit areas and spewing out toxic fumes. More than 500 counties and municipalities have passed permanent or temporary datacentre bans .

Loudoun County in northern Virginia sits in what is known as Data Center Alley because it is home to more facilities than anywhere else in the world. Greg Pirio’s life was turned upside down when a gas-powered datacentre opened 150 metres from his home last year. “This neighbourhood was calm and peaceful, and it’s turned into this nightmare,” he says on a video call. “Our quality of life has been degraded so much.”

The noise from the centre’s eight gas turbines is “like being at an airport with all these engines roaring,” Pirio says. “It has given many of my neighbours headaches. It has kept children up at night.” Pirio, who used to work for the Voice of America radio station, has also developed health problems since it opened, including dry eyes and chest tightness. Once he had to leave his house because he was struggling to breathe: “I know whenever the diesel generators are on, because I feel it in my lungs.”

Aerial view of a Vantage datacentre, backing on to a residential area in Duffryn, Newport, South Wales — An aerial view of the datacentre in Newport …

The outside of a datacentre in Duffryn, Newport, South Wales — … and the outside of the building

The UK has not yet seen the same level of opposition as the US. But anti-datacentre groups are gathering momentum. Residents in east London are waging a high-profile campaign against a new datacentre on Brick Lane, including protesting outside the offices of Angela Rayner, the communities secretary, who overturned a council decision blocking the scheme.

Seasoned campaigner Owen Espley, who works for environmental charity Global Action Plan, is helping scores of residents’ groups organise against planned datacentres. “This summer has been wild. Every other week a new group has popped up. Petitions are getting thousands of signatures in days,” he says. “Communities are in uproar, and most politicians are playing catch-up.”

Espley has been taken aback by the gulf between the government’s conviction that there is no alternative and ordinary people’s deepening understanding of the complex issues at stake. “There has been a real grassroots questioning of datacentres that connects British Bangladeshis in Brick Lane with Hertfordshire villagers and communities in Northumberland, who want good jobs to come back,” he says. “It is astounding.”

In fact, there are many alternative pathways to market-led expansion – from tougher regulation to prioritising publicly-owned data infrastructure – which serve communal goals, such as the heart disease and dementia research powered by Bristol University’s new Isambard-AI facility . “First, we need strong standards for private datacentres,” Espley says. “Second, we need industrial strategy to deliver our own public computer, rather than an assumption that US big tech building and owning everything is the only way forward.”

O n the deprived eastern edges of Cardiff, the early morning sunshine is warming a car park dotted with scraggly weeds. The perimeter fence is overgrown with brambles, with patches of singed, blackened grass from a recent wildfire visible just beyond. It looks abandoned but soon cars carrying doctors, nurses and other NHS staff start arriving. They are here to catch free buses to Cardiff’s Heath hospital, the largest in Wales.

Hundreds are said to use the park and ride every day, but it is under threat because Labour-controlled Cardiff council wants to sell the land to a property developer, Curtis Hall, to build a hyperscale data facility. The centre will use up to 150 megawatts (MW) of electricity a year, more than triple the demand of a city the size of Cardiff.

The development is one of the most controversial in Wales. Council meetings have been disrupted and more than 1,200 planning objections lodged. Last month, the new Plaid Cymru-led government ordered the council to put the application on hold while it considered whether to take the decision out of councillors’ hands.

Campaigners are determined to keep up the pressure on the Welsh government. Sue Elias, a retired librarian with seemingly endless reserves of energy, dashes back and forth reattaching her “Ditch the datacentre” banner to the car park fence and taping leaflets to the bus stop glass. “What is going to happen to all the people who use the park and ride? It’s bonkers,” she says.

Sue Elias, a woman with short white hair, in a floral dress, holding a green clipboard as she gathers signatures in a campaign against the building of a datacentre in east Cardiff, Wales — Sue Elias rallying opposition to the building of a datacentre on the local park and ride …

Abi George, a midwife, looking out of the window of a blue bus in Cardiff — … which Abi George, a midwife, uses it every day to get to work

Elias has leafleted the park and ride every Wednesday morning for six weeks. Today she is collecting signatures for an open letter to prove it is well used – so far she has added the names of 1,300 staff and patients. “I’ve not done anything like this before but I’m told I’m a natural,” she says with a mischievous smile, before breaking off to speak to staff arriving for the next bus.

She belongs to community-based union Acorn, which has campaigned against the scheme, and has taken part in protests , including bursting into a council planning meeting in July. “We’d sent emails, done petitions, but we’d had nothing back – tumbleweed. They’re our elected representatives … They should be talking with us.”

It is hard to find anyone in support of the plan in the queue for the bus, which runs three times an hour. “I use it every day. Without it, I probably wouldn’t continue working at the hospital,” says Ami George, a midwife. “Parking there causes that much stress.”

Across Cardiff’s Rhymney River, which curves around the proposed datacentre development, the area’s newest residents have only recently moved into 100 homes built under the city council’s flagship house-building programme. Nick Richards, a freelance filmmaker and skateboarder, and his wife arrived in November. “It felt like the stars had aligned because there is a brand new skate park up the road … the best in Cardiff. It’s amazing,” he says. “I never pictured myself living in suburbia but when we came we saw kids playing outside and thought, this is a really nice area.”

Head and shoulders shot of Nick Richards on a new housing estate in east Cardiff, near where the building of a datacentre is planned — Nick Richards, who moved to a new estate two months before a datacentre planning application was submitted

Like many other residents on the estate, Richards had no idea the council was planning to sell the park and ride to a datacentre developer. They moved in two months before the planning application was submitted. Instead of enjoying their new life, they now fear they will never be able to sell. Their home is 300 metres from what the plans describe as the temporary energy centre, which includes seven giant gas turbines. They are expected to power the facility around the clock for five years, according to documents filed by the developer. “I feel trapped,” Richards says, pacing his kitchen. “I couldn’t look prospective buyers in the eye and not say there’s going to be seven gas turbines right next to them.”

Richards has pored over the planning documents and leafleted every house on the new estate, including a care home, which will be just 150 metres from the turbines. “This datacentre will be powered by gas turbines,” he says. “They will pump nitrogen dioxide into our atmosphere. There will also be fine particulate matter and formaldehyde. All these toxins cause health conditions, such as asthma, COPD and heart disease.”

Air quality assessments commissioned by the developer estimate the emissions will be within safe levels. Curtis Hall says the scheme cannot proceed without 100% compliance with all environmental and public health regulatory requirements.

skip past newsletter promotion

There are more than 100 other planned UK datacentres aiming to use gas turbines due to the long wait to be connected to the grid. Richards doesn’t want his estate to be a test case. “Within a mile of this datacentre are 30,000 people. But the people building this centre don’t live here ... They don’t give two shits about Welsh people.”

A stone’s throw away is Llanrumney Hall, once the home of privateer and slave trader Sir Henry Morgan, who gave his name to Captain Morgan rum. It is now a thriving community centre, with a cafe, recording studio and creche. Labour councillor Lee Bridgeman is vaping on an outdoor table, dressed in a hoodie and baseball cap. He ran the local youth centre until it was lost to austerity-era cuts, and though he’s a high-ranking councillor, jointly responsible for housing and communities, he does regular youth work shifts in the area, one of the poorest in Cardiff.

“Llanrumney runs through my veins,” he says. “I’m not your usual politician. I don’t go to conferences. I got into politics to help the community.”

Bridgeman is charming and friendly – but he is not afraid of a fight. He is one of the few public figures in the area who has spoken out in support of the development, sometimes clashing with anti-datacentre campaigners on local Facebook groups. “Some of the information being spread is scaremongering,” he says. “They are telling residents their electricity bills will go up … the river and reservoir will be drained … It’s false information.”

Lee Bridgeman, a Labour councillor in east Carditt, in green hoodie and jeans, leaning against a railing — Labour councillor Lee Bridgeman, who supported plans for a datacentre in Cardiff …

A public meeting of local residents opposed to the building of a datacentre in east Cardiff — … until local residents, like those at this public meeting in a boxing club, changed his mind

Many of these fears stem from the US, where the rapid expansion of hyperscale facilities has been linked to rising electricity bills, water shortages and toxic air pollution. Bridgeman argues that “planning processes are totally different in the UK. So whereas [US authorities] turn a blind eye to some of the environmental impacts of those monstrosities, that would never happen in the UK.” He “wouldn’t be comfortable” if the gas turbines were running for five years but thinks they might not be needed if the datacentre can connect to the grid sooner.

The backlash has caught him by surprise, but he blames outside activists. “I didn’t see it coming. I didn’t think there would be this much interference,” he says.

Emotions are running high in the city. Some residents say they have been blocked by councillors when trying to question them on Facebook. Planning committee members have received threatening emails, Bridgeman says. “Threats like ‘I will come after you ... we will make your life hell.’ That shouldn’t happen.”

Although the datacentre will employ only up to 125 people when it is built, Bridgeman believes it could encourage other big companies to east Cardiff: “I’m told the knock-on effect could lead to thousands of jobs.”

Later that day, residents squeeze into the local boxing club for a public meeting about the datacentre plan. It is standing room only, with people lining the walls. Bridgeman repeats his claim that few locals have complained: “I have hundreds of emails from residents ... So far I’ve had two emails with regards to the datacentre.”

Some in the audience react angrily. There are shouts of, “We don’t know you, that’s why” and, “Have you heard of social media?” One woman stands up and says, “Don’t tell me you haven’t been privy to the meetings … or things online.” In a show of hands, roughly three-quarters of the 80 to 100 people in the room indicate they are from Llanrumney, almost all opposed. There are cries of, “There you are … you don’t need emails!” and, “That’s every person!” Almost three weeks later, Bridgeman performs a sudden about-turn, submitting a formal letter of objection to the scheme, noting that he has heard from a large number of residents.

T he UK hyperscale buildout has been focused on London, but datacentre developers are increasingly targeting areas outside the south-east, to escape severe electrical grid capacity limits. Wales already has the largest datacentre capacity of anywhere outside the capital. Many more could be coming: five of Wales’s largest new and proposed datacentres will consume more electricity than all Welsh homes put together. While the previous Welsh Labour administration welcomed the building spree, claiming giant tech firms’ investment would generate thousands of jobs, the Plaid Cymru-led government has been more circumspect, with ministers emphasising it must benefit Wales.

In the light and airy Welsh parliament building, which overlooks Cardiff Bay, opposition is growing. Plaid Cymru’s Nick Carter, who is the Senedd member for Caerdydd Ffynnon Taf, which includes Cardiff East, worries that the surging market will benefit developers and US tech firms rather than the public. “As a party, we’re not going to want to see a proliferation of datacentres, haphazardly being built across the country, on what may be an opportunistic basis,” he says.

Head and shoulders shot of Plaid Cymru politician Nick Carter — Plaid Cymru’s Nick Carter, who fears datacentres benefit only developers and US tech firms

Carter, who has a background in commercial property, has examined the Cardiff plans in detail. He says the developer, Curtis Hall, has no track record in datacentres; “They could be a front for someone else: Google, Microsoft, whoever. I can understand why these operators need datacentres, but I’m not sure members of the public share the need.” In response, Curtis Hall says it never claimed it would operate the facility itself, adding it had been working on datacentre projects for five years.

Carter is glad the Welsh government has intervened in Cardiff. But he doesn’t believe Wales needs to follow Scotland by imposing a moratorium on new datacentres: “The Welsh government is developing a strategy for datacentres nationally. We’ll see what comes out of that.”

However, it is not clear how the Welsh government can meet its goal to reach net zero by 2040 without limiting datacentre expansion. Carter admits, “It’s massively problematic.” In Westminster, similar questions have been asked. The Department for Science, Innovation and Technology tells me the government will enable the development of datacentres by generating unprecedented amounts of clean power.

A soft autumnal dusk descends on the residents living beside the new datacentre in Newport. Its sleek industrial-grey walls cast shadows across the closest gardens and homes. Much of the anger and frustration that met the original proposals has given way to weariness and resignation. Some residents talk of moving away, while others are mollified by meetings with the US-based data campus operator, Vantage.

Yet their troubles may only just be beginning – right now, only one of the three Vantage datacentres is operational. Microsoft will be opening its own nearby soon. When all are running, there could be upwards of 500 air handling units working at the same time, with back-up diesel generators needing regular testing, so they can immediately fire up if there is a power cut.

Newport council’s chief scientific officer warned during the planning process that the fumes from all the generators had the “potential to cause unacceptable air pollution levels under use, and testing needs to be understood and mitigation proposed, if needed”.

The council tells me it doesn’t have a duty to monitor emissions from generators, but says its officers check air quality management plans, and ask managers to minimise the impact of generator tests. Vantage says all its facilities operate in accordance with noise and air quality controls. It says it will monitor impacts and investigate concerns when the new centre opens.

Some residents have already given up on democratic process. Johnston fought the proposals through the planning process but felt he was ignored. “We’ve been let down by all of them. I’ve had electoral roll cards come through my door. But I’m voting for none of them … I can’t trust them. They don’t care about any of us.”

Over the road are older homes, where staff working on a nearby wealthy estate once lived. Sonia Thomas, a retired teacher, has lived in the same housekeeper’s cottage since 1969. She can remember when orchards and fields fanned out in front of their gardens but now she doesn’t even know if the sun is shining. “From inside you see grey, not blue,” she says, glancing at the datacentre filling the sky. “It’s horrible.”

“If We Burn, You Burn With Us”: France’s Youth Ignite a Massive Revolt

Portside

portside.org

2026-10-24 06:54:41

“If We Burn, You Burn With Us”: France’s Youth Ignite a Massive Revolt Kurt Stand Sat, 10/24/2026 - 06:54 ...

Original Article

PARIS — “Make sure you tell the Americans that trash cans aren’t the only things burning in France,” 16-year-old Ewen told Truthdig as protesters gathered on the Place de la République on Saturday. Tear gas canisters had been falling into the growing crowd for about an hour , and the teen struggled to make himself heard with his mask.

“Our future is burning, too,” Ewen added. Due to the repression and arrests by police, most protesters asked that only their first names be used.

In rapid succession, he listed everything he’d come to protest against: his rat-infested high school, the violent police repression of the student movement, but also the lack of hospital beds across the country, the cost of living, the saturated job market and the quickly-forgotten fires that ravaged France this summer. During the country’s hottest summer on record this year, some 250,000 acres of forest burned.

Grabbing his three friends, Ewen then posed for a photo, holding up a sign that read: “If we burn, you burn with us!”

In Paris on Oct. 17, 2026, 16-year-old Ewen and friends said they were protesting everything from the conditions at their school to the wildfires that ravaged France in the summer. (Phineas Rueckert)

“It’s a ‘Hunger Games’ reference,” Ewen explained, as though I were decidedly too ancient to get it on my own. “It means that we’re not just fighting for ourselves, but for you, too.”

Marine Champetier de Ribes, who teaches literature at a school in a Paris suburb, told Truthdig that she felt France’s youth had awakened something in the rest of society. “Us adults had collectively fallen into torpor,” she said. “They shook us out of it and reminded us all that we’re right to be angry.”

On Oct. 17, that torpor lifted in plain sight. Between 550,000 and 800,000 people marched across the country. Though much of the national and international coverage focused on the violence that marred the margins of Saturday’s protests, the lesson was elsewhere: In less than a month, the high schoolers’ movement managed to pull a tired, resigned country back into the streets. Students were joined by teachers, parents, doctors, nurses, lawyers, pensioners, Yellow Vests, farmers and firefighters in perhaps the most intersectional movement France has seen in decades.

“They write the rules, and we follow”

Champetier de Ribes, 34, told Truthdig that she and her colleagues across the education sector had been organizing for years, but had been slowly losing steam. “No one was listening to us,” she lamented.

In her school alone, she cited “cockroach-infested walls, clogged toilets, rat droppings in the microwaves and boiling classrooms that have yet to cool down after this summer’s heat waves.” Champetier de Ribes said she has also been forced to fit 38 students into her 215-square-foot classroom, which never has enough chairs and desks: “I’ve had to insist that at least three of them be absent every week so I can teach the rest,” she said.

Champetier de Ribes said teachers had become disillusioned. “We’d quite forgotten how to be angry, until, that is, our students began leading by example,” she said.

Starting on Sept. 17, high schoolers across the country began barricading their schools to demand better material conditions and equal education opportunities. The movement began in the Paris suburb of Créteil and it spread fast: By Oct. 1, the Interior Ministry reported that more than 1,000 of France’s 3,700 high schools had been affected, over 200 of them blockaded.

The students’ demands are more specific than their critics let on: a 10 billion-euro investment plan for schools, and an end to Parcoursup , the national platform that manages university admissions, which is often compared to a “social sorting machine” and criticized for its lack of transparency.

A young protester in Paris holds a sign referencing Oct. 17, 1961, when dozens of Algerians who broke curfew to take part in protests for their country’s independence were killed and thrown into the River Seine by Paris police. (Phineas Rueckert)

They’re also asking for more teachers, Last year, students across France lost some 20 million hours worth of lessons because absent teachers were not replaced. The education shortfalls are a result of President Emmanuel Macron’s neoliberal approach to public education funding while simultaneously increasing defense spending.

Teachers, in turn, organized to support their pupils. “They write the rules and we follow,” Champetier de Ribes said. She and her colleagues created an Instagram account to share the students’ demands with a grown-up audience: “We have to speak their language,” she added with a laugh.

From the start, the movement was met with force. The government, which chose to label the movement not as a “school protest” but as “urban violence,” sent police riot squads directly into high schools and universities.

Eden , 14, had his jaw fractured and most of his teeth knocked after being struck in the face by a tear gas grenade in a Paris suburb, leaving him, according to his mother, barely able to eat through a straw in his hospital bed. A 15-year-old in the north had his hand torn off by a so-called anti-encirclement grenade. On Saturday, in the eastern town of Mulhouse, Maïssa, 17, was struck by a tear-gas canister and lost her left eye.

Some 6,773 minors have been taken into police custody since the protests began in mid-September. Complaints are currently being filed across the country for verbal and physical mistreatment of these high schoolers during their detention.

This level of violence gave teachers yet another cause for concern, Champetier de Ribes said. “We were, to put it plainly, terrified at the very idea of seeing our students face off with the police.” Five months pregnant, she herself cannot physically protect her students, as tear gas is highly toxic. But she did help her colleagues prepare emergency kits. Identified with a white armband, these teachers carry masks, saline solution, bandages, disinfectant, water and applesauce pouches, ready to assist their pupils should they need help.

“This generation shook us awake,” Champetier de Ribes said. “Now, we have to be there for them, and alongside them.”

Christophe, who teaches mathematics in a private Paris high school, joined the protest Saturday with a sign that read: “You should not have betrayed us. We’re here to take our future back.” He told Truthdig that, while his was not an underprivileged school, his students had nonetheless joined their peers on the street, demanding equality. “My students may not be the ones getting beat up, but they’re still children,” he said.

Down the street, as tear gas dispersed the musicians of the New World Orchestra , another sign read: “Too young to be listened to, big enough to get beaten up.”

A convergence of anger

“I initially thought the movement seemed a bit harebrained,” 50-year-old Rachid told Truthdig at Saturday’s protest . The family doctor, who asked that his last name be withheld, had been perplexed by the high schoolers’ scattered demands and confused by the odd costumes and the “ aura battles ” they performed on the barricades in front of their schools.

“I thought this was another one of these social media trends I simply no longer understand,” he quipped.

“Too young to be listened to, big enough to get beaten up,” reads this placard at the protest in Paris on Oct. 17, 2026. (Phineas Rueckert)

But after his daughter’s classmates were heavily tear-gassed by the police, and still came back the next day, he began seeing things differently. “These kids, I realized, have a good head on their shoulders,” Rachid said. He joined the movement on Oct. 6, alongside his daughter.

He is not alone in that. Champetier de Ribes has noticed a similar shift. “There’s a realization, even among people who initially disapproved of the movement. They saw the level of violence, saw how far the government was prepared to go to repress this movement, and decided to put themselves on the line, too,” she said.

Rachid attended Saturday’s protest in his white coat, emblazoned with the words, “Firefighters and healthcare workers stand in solidarity.”

This was not Rachid’s first protest. As the COVID-19 pandemic ravaged the healthcare sector, he marched alongside thousands of colleagues — those the entire country had applauded night after night — in 2020. They asked for more beds, more ventilators, more money and better training. “But no matter how hard we tried, our movement remained confined to the healthcare sector,” he said.

For years, each grievance has produced its own constituency, its own demonstration, its own cycle of exhaustion. French hospital workers marched for funding, teachers protested cuts and education reforms, retirees took to the street to protect their pensions, farmers blocked roads to protest rising costs of production, Yellow Vests swarmed the Champs Élysées to demand lower gas prices. Time and time again, crowds gathered, the political class attempted to respond, and the country moved on.

The oft-aspired to “ convergence des luttes ” (convergence of struggles) never materialized. Until, that is, students disrupted that routine.

“This,” Rachid said as a young kilt-clad protester dressed the bronze statue of Marianne, personifying the French Republic, in a yellow vest, “is a different kind of beast entirely.”

The students’ insistence that their own futures are at stake has helped make connections between movements visible. In the presence of teenagers who refuse to accept that their future must be worse than their parents’ present, older demonstrators have found it harder to justify their own resignation.

“What we have here is a convergence not of struggles, but of anger,” Rachid said.

“Solidarité”

“We are very angry,” 18-year-old Juliette G. told Truthdig. A first-year student in political science at Sciences Po Paris, she deplored the “small-mindedness” of her elders, who balked at the intersectionality of the students’ demands.

“This is a student movement,” she said. “It’s also a feminist one, an anti-racist one, an ecologist one.” The variety of the students’ demands does not make them weaker, but stronger, she said. “Just because we’re doing things differently does not mean we are wrong.”

Her demands for intersectionality were echoed by Julie, a 27-year-old engineer Truthdig met on Saturday. “I’m glad we’ve not left them to protest alone,” she said as a group of youth set a car on fire at the far corner of the square. But said she was concerned that their wide-ranging demands for a better future would get lost if “adults” began framing the movement in terms not of justice, but of violence.

“The youth are sick of being oldsplained,” her sign read.

“The youth are sick of being oldsplained,” reads Julie’s placard at the protest in Paris on Oct. 17, 2026. (Phineas Rueckert)

Behind her, Truthdig met two Latin American immigrants who had come to march in defense of democracy. Damien, 56, from Chile, carried a sign likening Macron’s repression of the youth movement to Augusto Pinochet’s in the 1970s in his country. “We’ve lived through this before,” he said. Carmen, 58, from Brazil, carried a heart-covered sign that read: “Let our children protest.”

“We’re here for Lula, too,” Carmen told Truthdig, referring to Brazil’s left-leaning President Luiz Inácio Lula de Silva, who is currently running against a Donald Trump - backed , far-right candidate.

Damien voiced his opposition to Chile’s José Antonio Kast and Argentina’s Javier Milei. “I may not be French, but I raised my daughter here, and I know your republic’s motto: ‘Liberté, Egalité, Fraternité.’ We have to show the world that we stand with these kids,” Carmen said.

“Sorry for the inconvenience”

Down the street, Lucie, 15, who attends a private Paris high school, held up a sign that read: “Sorry for the inconvenience, we’re trying to save our future.”

Champetier de Ribes told Truthdig she was “gobsmacked” to see privileged youth join the movement en masse. “The macronie [Macron’s political caste] is built on division and has been getting away with taking from some because they give to others,” she said. But this “doesn’t seem to work on young people — they’re not duped by efforts to divide them. They are fully aware that it’s absolute bullshit.”

“I’m incredibly proud of my students,” she said.

Diane de Vignemont is a French historian-turned-journalist based in Paris. Her work on history, memory, politics, and women’s rights has appeared in New Lines Magazine, Prospect Magazine, Jacobin, The Persistent, L’Humanité, Libération, and others.

As an independent source for original and provocative reporting and commentary from a progressive point of view, Truthdig offers an outlet for original work and presents possibilities for lasting change. We publish everything from deeply sourced investigations to pointed arts critiques by exceptional journalists, featuring honest and credible reporting that meets the highest standards while focusing on the issues that matter most.

The Spirit of “Party Unity, My Ass” Is Back and Coming for the DSA (and El-Sayed)

Intercept

theintercept.com

2026-10-24 06:52:00

Centrist Democrats’ calls to fall in line behind the party’s nominee only ever seem to cut one way — and fall apart when their candidate loses. The post The Spirit of “Party Unity, My Ass” Is Back and Coming for the DSA (and El-Sayed) appeared first on The Intercept....

Original Article

SOUTHFIELD, MICHIGAN - OCTOBER 21: Democratic Senate Candidate Abdul El-Sayed speaks during the debate on October 21, 2026 at WXYZ Channel 7 in Southfield, Michigan. (Photo by Robin Buckson-Pool/Getty Images) — Democratic Senate candidate Abdul El-Sayed speaks during the WXYZ Channel 7 debate on Oct. 21, 2026, in Southfield, Mich. Photo: Robin Buckson-Pool/Getty Images

Eoin Higgins is the author of “Owned: How Tech Billionaires on the Right Bought the Loudest Voice on the Left.”

The PUMA spirit is back. The 2008 Democratic Party protest movement, inflamed by what Hillary Clinton supporters viewed as Barack Obama stealing the nomination from their primary candidate, scorned his general election campaign and embraced the mantra “ Party Unity, My Ass .”

This time, that energy is aimed at the candidates preferred by the Democratic Socialists of America .

DSA-aligned progressives have won a number of party primaries and are set to help Democrats take the majority in Congress. But once in power, they’re likely to make demands — the kinds of demands that could upend decades of carefully crafted donor-friendly policymaking.

For moderate Democrats, “party unity” is only a goal worth pursuing to bully the left wing of the party to fall in line with their preferred candidate.

For moderate Democrats, “party unity” is only a goal worth pursuing to bully the left wing of the party to fall in line with their preferred candidate. When it’s on them to step up and vote for someone who might have different goals, that’s another story completely, and some centrists are even hoping for Republicans to win the House this November if the alternative is an empowered DSA Democratic wing.

James Carville, the fossilized Cajun strategist who was part of exactly one successful national political campaign, Bill Clinton’s 1992 White House victory, said on The Bulwark podcast last Sunday that he’d prefer a tight GOP hold on Congress over a narrow Democratic majority.

“I would be disappointed if it comes in at 225 House seats,” Carville told host Bill Kristol. “I would rather the Republicans keep the House by five than the Democrats to win by five, because, if that happens, they’re hostage to the DSA.”

To his credit, Kristol — who, in a sign of how people can change when they know which way the wind is blowing, spent the PUMA moment promoting Sarah Palin but is now a self-proclaimed Democrat — pushed back, saying he’d rather win.

Carville is the first of his cohort to explicitly call for a GOP victory rather than the left flank of the party getting more power, but he’s not the only centrist deprioritizing his party’s prospects in November.

Maine Gov. Janet Mills has yet to endorse the Democratic Party’s Senate nominee, Troy Jackson, after she lost to now-disgraced Graham Platner. (Mills and Jackson have a long and bitter history from state government , which may be playing a role here.)

Perhaps most consequentially, in Michigan, Democratic Senate nominee Abdul El-Sayed has faced an uphill battle since winning his party’s grueling primary. He’s now focused on winning in the general election and becoming the first Muslim U.S. senator, but resistance to his candidacy remains a concern.

Much of the difficulty has come from members of his own party and other liberals . Their antipathy toward a candidate whose positions aren’t so out of step with other members of the caucus has raised questions about what exactly is so objectionable about him. El-Sayed may skew to the progressive side of the party, but he’s not a socialist and not a member of the DSA; his positions on domestic policy should place him companionably among the likes of Sen. Elizabeth Warren’s wing.

Until recently, most of the anger after El-Sayed’s primary in early August was confined to X and occasional cable news hits.

That changed on October 16, when two Michigan Democratic Party power players, David Kramer and Lon Johnson, urged voters in a Detroit News op-ed to leave El-Sayed’s place on the ballot blank — effectively handing the Senate seat over to Republican Mike Rogers, an election denier and a lockstep Trump ally.

The piece tied El-Sayed to extreme elements of Islam and suggested his opposition to Israel’s genocide, war crimes, and occupation was based in hatred for the Jewish diaspora.

“Our gravest concerns involve El-Sayed’s associations with figures who have excused or minimized terrorism, his reluctance to unequivocally condemn dangerous rhetoric, and his support of extreme policies,” Kramer and Johnson wrote. “At a time of rising antisemitism, Democrats deserve leadership that unequivocally rejects rhetoric threatening Jewish communities.”

Comedian Mike Drucker accurately described on Tuesday the centrist rejection of El-Sayed as less “blue no matter who” and more “ blue unless brown .”

But Democratic leaders like Carville, Kramer, Johnson, and others are panicked beyond their obvious Islamophobia — they can see the writing on the wall goes well past Michigan. It’s a full-on existential crisis.

Former Intercept writer Jon Schwarz once opined on what he termed the iron law of institutions: “The people who control institutions care first and foremost about their power within the institution rather than the power of the institution itself.”

What we’re seeing now is the iron law’s white blood cells fighting a threat they don’t believe can be easily assimilated into the existing power structure. It’s a danger to their status and power.

Their attacks on the left are going to backfire, leaving the Democrats’ centrist wing even less empowered than before.

That outcome is ideal for the party, the base, and the country. For centrists, it’s a disaster — but if the way to stop their coming irrelevance is to vote for a progressive American Muslim who opposes genocide, they’re incapable of taking that step.

Ultimately, all their griping may not matter. El-Sayed is regularly polling slightly ahead of Rogers, and 95 percent of Michigan Democrats said they intend to vote for him . Much like Jackson in Maine, should he win, El-Sayed will be even less beholden to the elements of the party power structure who are so desperately trying to prove he needs them, rather than the other way around.

Show HN: Autonomous root for Tcl Android TV via CVE-2022-22706

Hacker News

gitlab.com

2026-10-24 06:51:35

Comments...

Original Article

mali-pagecache-root

Loading

Be Aware of What's in Your Logs

Lobsters

fireborn.mataroa.blog

2026-10-24 06:42:05

Comments...

Original Article

There is something I wish more people understood about bug reports, diagnostic information, and the apparently innocent act of attaching a log file to a support request, and it is this: your logs may contain things you really, really do not want anyone else reading.

I'm writing this because of a bug report I received recently, which came with a log file containing information I did not need to see, did not ask to see, and would have been perfectly happy going the rest of my life without ever seeing. I'm not going to identify the person who sent it, describe what was in it, or otherwise turn a perfectly understandable mistake into a public spectacle, because doing that to someone who was trying to help me fix my own software would be a spectacularly shitty thing to do. But the incident highlights something worth talking about, because I suspect an awful lot of people have absolutely no idea what they're handing over when they tick that little box labelled "Send logs," and the software they're using is rarely in any hurry to tell them.

A Log File Is Not Necessarily Just a Log File

When most people think of logs, they imagine a wall of boring technical gibberish: timestamps, error messages, stack traces, the occasional complaint about a missing file or something failing to initialise. Logs do contain those things. They can also contain an astonishing amount of information about what you were actually doing when the problem occurred, and depending on the application, its logging configuration, and the nature of the problem, that might include:

Text displayed on your screen.
Messages you sent or received.
Usernames, email addresses, and account identifiers.
File paths containing your real name or other identifying details.
URLs, including query parameters and authentication tokens.
The names of documents you had open.
Clipboard contents.
Information about other applications and services.
Internal application state that was never meant for public consumption.

Some applications log very little. Others log absolutely fucking everything, particularly once debugging is switched on, and you generally cannot tell which kind you're dealing with from the size of the file or the name of the feature. A file called debug.log sounds harmless enough, and that tells you precisely nothing about whether it is.

A log is a record of whatever an application considered relevant at a particular moment, and what an application considers relevant and what you consider private are two entirely different things. The computer has no idea that the conversation you were having was personal, that the document you had open was confidential, or that the text on your screen was something you'd rather not share with a stranger on the internet. It knows that something happened and that somebody told it to write that something down, so it did.

"Logs Can Contain Text Displayed on Screen"

I work on a screen reader, and like all software it occasionally misbehaves, which means I depend on people telling me when it does. The problem report form includes an option to send logs. That option is off by default, and when you get to it, the form warns you that logs can contain text displayed on screen. That warning is not decoration, and it's not there to cover my arse; it's there because I want people to understand what they might be about to send me.

A screen reader is in a particularly awkward position when it comes to privacy, because its entire job is to take whatever other applications put in front of you and make it accessible, which means it can encounter practically anything: your email, your private messages, your bank account, your medical records, your work documents, whatever happens to be on the screen at the time. When something goes wrong, diagnostic logging may well capture some of that, not because I'm secretly interested in what you get up to on your phone, but because the text a screen reader encountered is often directly relevant to why it behaved incorrectly. If it read something it shouldn't have, skipped something it should have read, or mangled a particular control, knowing what it was looking at can be the difference between fixing the bug and staring blankly at a stack trace. Useful, though, is not the same as harmless, and it certainly doesn't mean I need to know everything else you happened to be doing that day.

So when a form tells you that logs can contain text on screen, I'd like you to adopt one very simple rule: can means does. It doesn't matter if you know the application, if you've read the source, or if you're fairly confident the particular logging mode you used doesn't capture anything sensitive; treat it as though it does. This is exactly the principle behind treating every firearm as loaded. You don't point a gun at someone because you're pretty sure it's empty, and you don't assume it's safe because you remember unloading it earlier; you follow the same precautions every single time, because being wrong costs a great deal more than being careful. Obviously, accidentally sharing a private conversation is not equivalent to accidentally shooting someone, and I'm not pretending the stakes are the same. The point is that a safety habit is only worth anything if it doesn't depend on your confidence that nothing can go wrong. You shouldn't have to remember whether one version logs screen text under one configuration but not another, or which debug options you happened to leave on last Tuesday. Assume it captured everything it warned you it might, and then decide whether you're comfortable sharing that.

Not Everyone Can Read Through Thousands of Lines

The standard advice at this point is "just read the logs before you send them," which sounds eminently reasonable right up until you think about it for more than a few seconds. Some log files run to tens of thousands of lines. Some contain binary data, encoded blobs, or structures that are meaningless without intimate knowledge of the software that produced them. And not everyone can comfortably wade through that much text in the first place; listening to a screen reader churn through thousands of lines of timestamps, function names, and memory addresses is nobody's idea of a good afternoon, and even someone scanning visually isn't necessarily going to spot one sensitive line buried in a sea of technical noise.

So no, I'm not going to tell everyone to personally inspect every line of every log before reporting a problem, because that isn't always practical and pretending otherwise helps nobody. What I want instead is for people to understand the decision they're making. If you can't reasonably verify what's in a log, treat it as containing everything the application warned you it might contain. You don't need to understand a single line of debug output to understand that a screen reader may have logged something you were reading, or that a browser log probably contains URLs; you just need to take the warning at its word.

And if that possibility makes you uncomfortable, don't send the logs. You can still file the report, still explain what happened, still give reproduction steps and tell the developer what you expected versus what actually occurred. A report without logs is not automatically a useless report. Sometimes the developer will need more, sometimes they won't, and sometimes they'll be able to suggest a safer way to reproduce the problem or collect a much narrower slice of diagnostic data, which is a conversation well worth having. What isn't worth doing is blindly shipping off a file full of things you'd never otherwise share because you've somehow got it into your head that a bug report is incomplete without one.

Optional Means Optional

This is exactly why the logs option in my problem report form defaults to off. I could have defaulted it to on. I could have made it mandatory, or silently attached diagnostics to every report and buried a warning somewhere nobody would ever read it, and it would undoubtedly have made some debugging easier. But that convenience would have come straight out of the pockets of the people using the software, and I don't think that's a reasonable trade.

Someone submitting a problem report should have a genuine choice about whether to include potentially sensitive information: not a checkbox that's already ticked, not a warning that appears after the upload has finished, not a setting hidden three menus deep, but a clear, explicit decision they actually get to make. And when the form says logs can contain text on screen, that sentence is a description of what you are consenting to share, not a bit of legal boilerplate to scroll past on your way to the submit button.

Defaults matter enormously here, because people filing bug reports are usually busy, tired, and frustrated that something isn't working, and they want to fire off the report as quickly as possible and get back to whatever they were trying to do. That is precisely the moment a safe default earns its keep. I don't want anyone to have to remember to protect their own privacy every time something breaks; I want the software not to share potentially sensitive information unless they deliberately choose to share it. That doesn't remove the user's responsibility to read the warning. It does mean the application isn't making the decision on their behalf.

But I Trust the Developer!

Wonderful. I'm delighted to hear it. That still doesn't mean the developer needs to know what you were talking about with your partner last night.

Trust is not a substitute for privacy. There are plenty of developers I trust with my data and with the security of systems I rely on every day, and I still have no desire to hand any of them an unfiltered transcript of everything I was doing when their application fell over. And speaking as someone on the receiving end of bug reports, I don't want that transcript either. I want to know why the thing crashed: which function failed, what exception was thrown, and what sequence of events got it there. I do not need your private messages, your browsing history, or the contents of the document you were reading, and I certainly don't want to be put in the position of accidentally learning something about you that you never meant to tell me.

There's a nasty little assumption floating around that because someone builds a piece of software, they're somehow entitled to whatever that software happens to collect. No. Absolutely fucking not. A bug report is a request for technical help, not a waiver of your privacy.

Even when the person you're sending it to is entirely trustworthy, there's the question of where that report ends up. Where is it stored? Who else can see it? Does the issue tracker make attachments public by default? Will the log get copied into some other system, and how long does any of it stick around? You might trust the person you're sending the file to, but that's not the same as understanding every system the file will pass through on its way to them and afterwards.

Reproduce the Bug Without Reproducing Your Entire Life

If you do need to send logs, there are ways to cut down the chance of including something sensitive without spending your evening reading them. The simplest is to reproduce the problem under controlled conditions: clear the existing log or start a fresh session if the application allows it, switch logging on just before you trigger the problem and off again straight afterwards, and where the bug involves on-screen text, try triggering it with something innocuous. Open a test document, use a dummy conversation, make a throwaway account if that's appropriate, and swap real information for made-up information wherever you can. If the screen reader fails to announce a particular control, see whether the same control misbehaves somewhere that doesn't contain your life story; if an application crashes opening a document, try a document with the same formatting and none of the confidential contents.

Obviously this won't always work. Some bugs are intermittent, some only appear under very specific circumstances, and some depend on particular data in a way that makes them vanish the moment you change it. That's a legitimate technical problem, and sometimes a developer genuinely does need more to go on. But there is an enormous difference between deliberately sharing particular information because it's necessary to diagnose a problem and accidentally sharing it because you never stopped to think about what the logs might contain. If you can't reproduce the problem safely, say so; a developer can work with that. And if you decide to send the logs anyway, at least make it an informed decision rather than a reflex.

Developers, This Is Your Problem Too

Before anyone reads all of this as an attempt to dump the whole responsibility on users, let me be abundantly clear: developers have a hell of a lot to answer for here as well.

If your application collects diagnostic information, you should have a reasonably good idea of what that information contains. You should not be logging passwords. You should not be casually dumping authentication tokens into plaintext files. You should not be hoovering up arbitrary user content just because it makes debugging a little more convenient. And if your application genuinely needs to log potentially sensitive information, you should say so plainly, not on page seventeen of a privacy policy and not behind some mealy-mouthed line about collecting diagnostic data to improve the user experience, but clearly, at the point where someone is deciding whether to send it. Tell people the log may contain text displayed on screen, or private messages, or whatever else it might capture, and wherever practical, give them some control over it. Don't make them jump through hoops to opt out, either; if you're asking someone to send potentially sensitive data, the safe default is almost always not to send it.

There's also a rather important distinction between information being useful for debugging and information being necessary for it. I can imagine all sorts of things that would make my life easier as a developer, and none of that gives me the right to collect them. If a stack trace will do, collect a stack trace. If an error code will do, collect an error code. If you need one section of a log, ask for that section, rather than demanding a complete diagnostic archive of everything the application has ever seen because you couldn't be bothered to implement more selective logging. And for fuck's sake, don't automatically attach logs to public issue trackers without giving people a chance to make an informed choice. A warning is useful. Good defaults are better. Both together are better still.

The Human Side of an Accidental Disclosure

There's another side to this that deserves some attention. When someone accidentally sends you sensitive information, your first instinct should not be to laugh about it, pass it round your friends, or turn it into an amusing anecdote at the sender's expense. People make mistakes, and very often they make this particular one while trying to help you improve your software. The right response is discretion: don't spread it, and let the person know if there's something they should be aware of. If you can delete an unnecessary copy of the log, do. If it ended up somewhere public, help get it taken down. If credentials were exposed, explain that they may need to be revoked or rotated. Don't punish someone for trusting you enough to file a bug report, and don't confuse having access to information with having permission to use it.

I have no interest whatsoever in shaming the person whose report prompted this post. Who sent it and what was in it are completely irrelevant to the lesson. What matters is that it happened, that it could happen to almost anyone, and that a few simple precautions would stop it happening again.

"But Nothing Bad Has Ever Happened Before"

Yes, and?

This might be one of my least favourite arguments in the whole of computing. I've sent logs before and nothing bad happened; I've clicked through warnings for years and nobody's ever complained. Congratulations. That tells me precisely fuck all about whether the next file you send contains something sensitive. The absence of a previous incident is not proof that a practice is safe. Perhaps your previous logs genuinely contained nothing private. Perhaps they did and nobody noticed, or somebody noticed and had the decency not to mention it. You have no way of knowing which, and that's exactly why I keep coming back to the loaded gun: the whole point of a consistent safety practice is that you follow it when you think the risk is negligible, not just when the danger is staring you in the face. If you only take care once you already know something's wrong, you've missed half the point.

A Little Paranoia Is Healthy

None of this is an argument for filing fewer bug reports. Quite the opposite: bug reports are enormously valuable, and good logs can turn a maddening, impossible-to-reproduce problem into something a developer can find and fix in minutes. Please keep reporting bugs, and please keep providing diagnostic information when you're comfortable doing so. Just understand that diagnostic information is still information, and some of it may be deeply personal.

You don't need to read ten thousand lines of debug output or understand anything about an application's internals. You only need to take the warning seriously. If the application says logs can contain text displayed on screen, assume they do; if you can't verify what's in a log, don't mistake that uncertainty for safety; and if you're not comfortable sharing what might be in there, leave the logs out. Developers, make that choice easy, with clear warnings, safe defaults, and ways to report a problem that don't require anyone to surrender their privacy to do it.

Can means does. Not because every log necessarily contains something sensitive, but because treating it as though it does is a great deal safer than gambling on the alternative. You wouldn't handle a firearm carelessly because you were fairly sure it wasn't loaded, so don't handle your private information carelessly because you're fairly sure it wasn't logged. The developer almost certainly doesn't want to know your secrets any more than you want to share them, and if you're not sure what's in that file, assume it's something you'd rather keep to yourself.

Wild version 0.11.0 released

Lobsters

github.com

2026-10-24 06:11:35

Comments...

Original Article

Lots of porting work has happened this release. The Wasm feature is now enabled by default, so Wild
can be used to link Wasm with the caveat that debug info isn't yet supported.

Support for GNU linker scripts is greatly enhanced. Wild now supports enough of the linker script
syntax that it can link Linux kernel modules and is close to being able to link the Linux kernel
itself.

The Mac port has made significant progress. The feature isn't yet to the point where we're prepared
to enable it by default, but Wild is able to link itself on Mac and at least one of the maintainers
is now using Wild as their default linker for Rust on Mac.

We've also fixed some performance issues that were affecting various filesystems and made a few
general performance improvements. We also got a bit slower due to implementing proper ELF COMDAT
support.

We now cap the number of threads to at most 32 unless overridden by --threads. This avoids bad
performance that occurs with larger numbers of threads due to contention on a Linux per-inode mutex.

Our benchmarks have been expanded to include a wider range of scenarios such as different
filesystems and whether the output file already exists.

Build requirements

Minimum rust version for building Wild is now 1.99.0

🚀 Features

Implement FILEHDR and PHDRS commands in a linker script ( #2314 )
Implement setting section attributes in linker scripts ( #2342 )
Support redefining linker script and defsym symbols ( #2350 )
Support compound assignment operators in linker scripts ( #2384 )
Implement ADRP+ADD to NOP+ADR relaxation for AArch64 ( #2319 )
Parse ASSERT in linker script expressions ( #2402 )
Support alignment up to 2^21 ( #2409 )
Support aligning a given expression in linker scripts ( #2426 )
Lookup object symbol values in linker script location counters ( #2418 )
Fetch symbols defined in a linker script in a location counter ( #2475 )
Support LDEMULATION environment variable ( #2497 )
(args) Implement --image-base flag ( #2513 )
(args) Implement -z force-ibt and -z cet-report flags ( #2529 )
Support --[no-]warn-execstack , --warn-execstack-objects , and --[no-]error-execstack ( #2559 )
(x86_64) Support SIZE32 and SIZE64 relocations ( #2553 )
Add --no-keep-memory ( #2584 )
Support emitting multiple error messages ( #2599 )
Implement --orphan-handling ( #2566 )
Add support for --only-keep-debug ( #2472 )
Support --enable-linker-version and --disable-linker-version ( #2645 )
(aarch64) Support build attributes in relocatable links ( #2622 )
Emit eager PLT stubs for dynamic calls for ppc64le ( #2668 )
Add support for --discard-none / --discard-all / --discard-locals ( #2639 )
(aarch64) Merge build attributes with GNU properties in relocatable links ( #2681 )
(aarch64) Implement --fix-cortex-a53-843419 ( #2682 )
Proper support for COMDAT groups ( #2727 )
Parse constant expressions in section ALIGN commands ( #2730 )
Decode medium-model TLS static relocations in ppc64le ( #2724 )
(aarch64) Implement -z force-bti ( #2761 )
Enable the Wasm feature by default ( #2758 )

⚡ Performance

Parallelize archive member open/parse ( #2356 )
Make OutputSectionPartMap sparse for custom sections ( #2437 )
Use HashMap for CommonGroupState::section_attributes ( #2442 )
Reduce sparse allocation in compute_start_offsets_by_group ( #2443 )
Use fallocate and hugepages on ext4/xfs ( #2468 )
Figure out start/stop section refs before GC phase ( #2479 )
Enable hugepages by default for all filesystems ( #2508 )
Enable mmap on Btrfs with sufficiently new kernel ( #2509 )
Group allocations of partial linking singletons ( #2506 )
Parallelise various partial linking stages ( #2510 )
Reuse non-atomic symbol addresses across RISC-V relaxation passes ( #2507 )
Compute only referenced symbol addresses on later RISC-V relaxation passes ( #2518 )
Release input mappings in parallel on shutdown ( #2541 )
A few microoptimisations in/around apply_relocations ( #2548 )
Shrink RelocationKindInfo struct size ( #2603 )
Apply large debug relocation sections in parallel shards ( #2620 )
Cap at 32 threads by default ( #2670 )
Replace some uses of object::SectionIndex with a 32 bit type ( #2680 )
Don't store erratum padding in section slot ( #2736 )
Make apply_debug_relocation faster with inlining ( #2647 )

💻 CLI

Make --verbose affect --version output ( #2792 )

🪲 Bug Fixes

Don't use .a from early directory over .so in later directory ( #2382 )
Follow GNU ld mandatory relaxations logic better ( #2390 )
Don't consume the next argument for --trace / -t ( #2394 )
Preserve original definitions for --wrap under linker-plugin LTO ( #2393 )
Apply ADD/SUB relocations correctly when reading debug sections for source info ( #2411 )
Correctly resolve linker script functions that return addresses ( #2413 )
Handle dynamic symbol export with LTO ( #2410 )
Correctly resolve location counter addresses after a section in linker scripts ( #2435 )
(opts) Support and ignore --verbose ( #2446 )
Support LTO with clang -ffat-lto-objects ( #2445 )
Use relaxed size for exported dynsym and allow dynsym debug refs ( #2464 )
Reserve 2 PLT/GOT entries for runtime on loongarch64/riscv64 ( #2471 )
Preserve function identity with canonical PLT entries ( #2480 )
Reject CREL relocations when partial linking ( #2489 )
Emit GLOBAL_OFFSET_TABLE as local hidden symbol ( #2498 )
Define hidden __dso_handle linker symbol ( #2503 )
(elf) Ignore unknown GNU property types instead of erroring ( #2526 )
(MachO) Use got_address for GOT-related relocations ( #2536 )
Error on copy relocations against protected shared-library symbols ( #2550 )
Honour interposition of IFUNC definitions in shared libraries ( #2551 )
Fix general-dynamic TLS offsets for locally bound exported symbols ( #2571 )
Align TLS segment p_vaddr to p_align ( #2581 )
(aarch64) Resolve undefined weak branch relocations ( #2575 )
Don't emit wide dynamic rel when narrow absolute rel requested ( #2580 )
Don't default update-in-place when file is hard linked ( #2577 )
(build) Address build failures with tracing-encoding with serde ( #2582 )
(aarch64) Resolve undefined weak relative relocations ( #2591 )
(aarch64) Resolve undefined weak PLT32 relocations ( #2606 )
(elf) Honor no-as-needed on repeated shared libraries ( #2619 )
Ensure deterministic output when mixing versioned and unversioned symbols with same name ( #2637 )
Apply the final sysroot to library search paths ( #2636 )
Keep allocated section offsets when compressing debug info ( #2644 )
Keep out-of-range RISC-V calls as auipc+jalr ( #2649 )
Only load linker script PROVIDE symbols if referenced ( #2633 )
Ensure unversioned archive symbol can override multiple so versioned syms ( #2642 )
Handle debug sections selected by scripts when compressing ( #2652 )
Don't consume file bytes for non-alloc NOBITS sections ( #2657 )
Map AbsoluteLowPart with DIRECT ValueFlags ( #2665 )
Handle symbol-free debug relocations ( #2696 )
(aarch64) Process build attributes in final links ( #2702 )
Emit PLT stubs for unresolved REL24 calls in ppc64le ( #2715 )
Emit PLT stubs for interposable calls in ppc64le ( #2722 )
Place headers before custom base address ( #2709 )
(aarch64) Warn on malformed build attributes ( #2725 )
(x86_64) Relax only full 64-bit read for R_X86_64_GOTPCREL ( #2732 )
(x86_64) Relax APX TLSDESC references to initial exec ( #2741 )
Align up TLS_MODULE_BASE symbol ( #2745 )
Link fat LTO objects natively when no plugin is supplied ( #2737 )
Support '=' and '$SYSROOT' in linker scripts and inputs ( #2720 )
(x86_64) Respect immediate ranges in GOTPCRELX relaxations ( #2753 )
(aarch64) Reject nonzero addends in ADRP+ADD relaxation ( #2760 )
(elf) Ensure null section has zeroed fields ( #2754 )
Check GOTPCRELX addends ( #2773 )
Properly handle absolute GOTPCREL loads in PIEs ( #2772 )
(thunks) Error if a branch cannot reach its allocated thunk ( #2776 )
(elf) Discard input .note.gnu.build-id sections ( #2768 )
Handle REX2 TLSDESC registers ( #2778 )
Respect absolute symbol interposition on x86_64 ( #2779 )
(elf) Don't emit unreferenced __ehdr_start and __executable_start ( #2783 )
Do not set .rela.plt sh_link without .dynsym ( #2750 )
(elf) Hide .TOC. , _DYNAMIC and _TLS_MODULE_BASE_ ( #2785 )

📚 Documentation

Add link to Rui's paper to reading section ( #2484 )
Add REUSE.toml ( #2328 )
Move usage and FAQ out of the README ( #2605 )

🕹️ Porting (Wasm)

Add version and help options ( #2333 )
Warn on -mllvm option values ( #2340 )
Synthesize GOT.func globals for R_WASM_GLOBAL_INDEX ( #2332 )
Ignore --no-merge-data-segments ( #2357 )
Support GC for functions, globals, data, and imports ( #2353 )
Redirect defined weak functions to the winning definition ( #2377 )
Support --export-memory ( #2381 )
Support --max-memory ( #2387 )
Speed up name section construction ( #2389 )
Error on undefined strong symbols by default and add --allow-undefined ( #2345 )
Synthesize linker-defined __dso_handle ( #2406 )
Add support for --export-if-defined ( #2408 )
Support --export of linker-defined symbols ( #2414 )
Parallelize layout relocation scan ( #2432 )
Hold relocations as per-object ranges ( #2434 )
Support --(no-)allow-multiple-definition and -z muldefs ( #2450 )
Always emit memory and __stack_pointer ( #2457 )
Support --shared-memory ( #2449 )
Support --extra-features ( #2470 )
Support --demangle and --no-demangle ( #2485 )
Wrap all defined exports with __wasm_call_ctors ( #2499 )
Keep name and flags from linking SegmentInfo ( #2501 )
Support single-threaded TLS ( #2524 )
Support --import-memory ( #2505 )
Support --strip-debug ( #2596 )
Document using Wild as a Wasm linker ( #2597 )
Drop unused function types from the type section ( #2417 )
Emit passive data segments ( #2610 )
Initialize shared-memory TLS with __wasm_init_tls ( #2692 )
Initialize shared data once from __wasm_init_memory ( #2695 )
Support v128 value types ( #2710 )
Support --check-features and --no-check-features ( #2711 )
Concatenate debug sections in the output wasm binary ( #2713 )
Support --whole-archive and --no-whole-archive ( #2716 )
Support --export-dynamic and --no-export-dynamic ( #2717 )
Apply shared-memory TLS template pointers per thread ( #2733 )
Support --strip-all ( #2744 )
Skip decoding bodies without memory.init or data.drop ( #2746 )
Demangle symbol names in parallel ( #2747 )
Set shared-memory TLS GOT slots per thread ( #2743 )
Support --export of data symbols ( #2765 )
Speed up name section encoding ( #2755 )
Support --keep-section ( #2780 )
Allow strong data to override weak data ( #2787 )

🕹️ Porting (Mach-O)

Add ld as a reference linker ( #2323 )
Emit only retained section headers ( #2330 )
Propagate input section flags ( #2343 )
Add support for (segment name, section name) identification ( #2354 )
Always page align content in Fat files ( #2372 )
Simplify used types a bit ( #2373 )
Use chained-fixup data types from object crate ( #2376 )
Drop unnecessary CodeSignature alignment ( #2378 )
Add support for arbitrary segments ( #2383 )
Support dynamic export of symbols ( #2386 )
Use UnlinkAndReplace for outputs ( #2391 )
Order TLV template sections ( #2420 )
Align __thread_data and __thread_bss ( #2455 )
Align __thread_vars ( #2458 )
Add TLV pointer ldr relaxation ( #2476 )
Fix TLV descriptor offset ( #2488 )
Support __init_offsets and __dso_handle symbol ( #2493 )
Relax GOT-relative relocations ( #2504 )
Emit bind fixups for non-GOT entries ( #2521 )
Set MH_HAS_TLV_DESCRIPTORS in header flags ( #2527 )
Implement ARM64_RELOC_ADDEND ( #2532 )
Use GOT for imported TLV descriptor ( #2539 )
Implement __compact_unwind section emission ( #2535 )
Support implicit addend for relocations ( #2562 )
Support rebase fixups ( #2585 )
Include new timing_phase notes ( #2589 )
Encode implicit addend in the bind fixups ( #2588 )
Optimize some of the critical functions ( #2595 )
Support ARM64_RELOC_SUBTRACTOR ( #2600 )
Support local GOT entries ( #2617 )
Ignore -dead_strip option now ( #2625 )
Always keep empty section ( #2638 )
Fill up BuildToolVersion ( #2632 )
Support fixups in multiple pages per segment ( #2631 )
Refactor process_relocation ( #2660 )
Add --help and --version options ( #2663 )
Make BufferThenWrite default ( #2662 )
Support local palette in compact unwind ( #2669 )
Add 2 options and ignore unsupported yet ( #2673 )
Ignore -sectcreate option now ( #2675 )
Support -headerpad_max_install_names option ( #2672 )
Emit LC_RPATH load commands ( #2679 )
Use LC_ID_DYLIB when linking against dylibs ( #2688 )
Minimal dylib output support ( #2689 )
Support common symbols ( #2690 )
Resolve unreferenced symbols copied to the symbol table ( #2697 )
Relax local TLS accesses in dylibs ( #2694 )
Emit private extern symbols as locals ( #2698 )
Make UUID based on code signature ( #2701 )
Include allocation stats for some sections ( #2712 )
Make Write data to file more parallel ( #2714 )
Sort trie symbols and fixups in parallel ( #2721 )
Support EXPORT_SYMBOL_FLAGS_KIND_THREAD_LOCAL ( #2729 )
Collect unwind infos as Vec<Vec<_>> ( #2728 )
Support --exported_symbols_list ( #2770 )
Support -framework ( #2777 )
Parse stub sub-libraries in parallel ( #2664 )
Build trie directly ( #2594 )
Just compute exports trie once ( #2609 )
Simplify the calling for validation function ( #2788 )

🕹️ Porting (other)

(coff) Add MSVC link.exe-style argument parsing ( #2374 )

💲 Sponsors

Thanks to everyone who has sponsored davidlattimore , in particular AWS and OpenAI for sponsoring via the Rust Innovation Lab and the following people who have sponsored at least $30 since the last release:

wasmerio
repi
rerun-io
rrbutani
Rafferty97
marxin
mati865
ArthurBrussee
Urgau
reivilibre
Tudyx
+44 others

I want my Wednesday back

Lobsters

blog.luitjes.it

2026-10-24 06:09:28

Comments...

Original Article

Or, why we’re not seeing mass-exploitation of php2shell yet.

I saw wildly varying opinions on whether php2shell is serious, or if they cried wolf. Got curious, started digging into the PoCs. I’m not an exploit dev and maybe there were other factors, so take with a grain of salt. Egg on my face if mass exploitation starts right as I hit publish.

Best PoC of php2shell I’ve found: https://github.com/9bie/php2shell-bypass-aslr-exp (and a fork with all docs translated to english )

To exploit, you need to do four consecutive requests to the same php worker process . And you need to know the exact php build (php version, OS version, architecture), or try exploits for every possible build.

What this PoC does is take a docker image that uses the default mod_php number of workers, which is 150. Then it opens 149 connections that send half a request to keep the other workers busy, and does the four exploit requests against the 150th worker.

Even a moderately popular production website will have multiple web VMs/containers running multiple php workers behind a load balancer and constant bot traffic. That means you would have to try a wide range of number of connections to open. On top of that you likely won’t know the exact build version, so you would have to try exploits for every combination out there.

Let’s say you try this for the 50 most popular php/OS combinations, and any number of workers between 10 and 1010. That’s 50k attempts. But against constant background traffic, you would need to try each combination a number of times. Each of these attempts involves opening a whole lot of connections, so they each take some time. The PoC runs against localhost and takes 3-4 seconds, so let’s optimistically call it 10 seconds on the internet.

You can only do one attempt at a time, so that means multiple days of bruteforcing in a way that is essentially a DoS, since a large part of that range will exhaust the maximum number of connections. At this point the person running the site will likely notice, start blocking IP addresses or adding a WAF.

Most high-traffic websites already run WAFs/rate-limiting to deal with bot traffic, so you would need to run this attack from a great many IPs, and preferably clean ones that are harder to come by. But running this from many IPs also increases the chances that your timing will be off, reducing the number of plausible attempts even further.

That’s assuming the WAF doesn’t block your attempts entirely, because the easiest ways to exploit these vulnerabilities were known at the time of the announcement.

I’m sure people and agents will come up with clever techniques to reduce the required number of attempts eventually. But that has nothing to do with “this will get mass-exploited within 15 minutes.”

Against very low-traffic websites that do not have any bot protection, leak information about their version, running close to stock configuration, you might get lucky.

So sure, it’s a critical vulnerability, deserves attention, should be patched ASAP. Maybe even put in the announcement that if you’re running low-traffic sites, be extra sure to patch fast.

But to the AI security vendors who promoted this as THE GATES OF HELL WILL OPEN YOU HAVE TO PATCH WITHIN 15 MINUTES OR DIE? I want my Wednesday back.

Oh and the claims of it being exploited in the wild? At time of writing, they’re referring to exploitation attempts . In fact, HoneyLabs so far hasn’t seen a single exploit attempt that could even run successfully.

Listening to Nina Simone in 2036

Lobsters

punkx.org

2026-10-24 06:02:51

Last night I thought about this world and quickly wrote a short story. Made me feel quite eerie as I was writing. Maybe it will turn into a nice video game. Comments...

Original Article

Day 4728, William.

I wake up, and instinctively put my glasses on. They start humming soft lo-fi music as the memory of the dream I just had slips through my fingers. The music makes me think of coffee, and I slowly head towards the kitchen. The glasses show me a small list of things I must do.

Open the window and look at the sky for 5 seconds [Optimal for dopamine activity]
20 pushups
Make coffee
Listen to the Positive Thinking podcast.

As I do a task it automatically disappears. I don't need to do them in order. I start with the pushups. Once a task disappears a new one is added. There are always 4 tasks. I love them, they are always very positive and help me to be better every day.

Some of the tasks are work I need to do for my community, or for myself, or for the government. If I am healthy I benefit my community, if it is healthy it benefits the government, if the government is healthy it can take care of us.

There is no time limit, or anything like that, sometimes if I struggle a task will be broken down into smaller and smaller tasks until the glasses see I am making the right progress. If you ignore it for too long it just disappears and is replaced with another task.

In general time is not a big thing, the glasses know the optimal time to eat and drink. Honestly I don't know how people lived before, they must have been so unhealthy and stressed. I continue doing my tasks humming lo-fi, now I am cleaning the solar panels, we have a central battery in the neighbourhood and a whole bunch of solar panels, the cleaner they are the better. I really love when I get allocated to do it, I think it is really important, but the truth is, my 20 pushups task was just as important. The healthier we are, the clearer our mind is, the better our society is.

Today I was cleaning the solar panels with John, he was so bad at it. What a strange guy, but I know he is doing his best. It's so hot today, if I wasn't doing my 20 pushups every day I would be in trouble for sure, it must be 47 degrees, but my resting heart rate is 60, and I am exactly 60kg, the robots can't clean in this heat, it will damage their batteries. We do some things, the robots do some things. I help John as he is a bit slower and continue to my next task. It's time for a coffee break and I also get a nice cookie, blueberry chocolate!

John mumbles a bit, gets on his motorcycle and heads home. His bike runs on gasoline, I have no idea where he is getting it, we transitioned to electric transport years ago, it's not illegal or anything, there is just no way to get it. I hope I am not allocated with him again.

Day 4728, John.

I wake up, the smell of fermenting sugarcane almost knocks me out, smells like sweet vomit. I remember my dream. I put on the glasses and do a few tasks. Nothing forces you to do them, but if you don't participate you just get less and less resources, as it is someone's task to make you food. I managed to reverse engineer the task's score, and I know how to make a task give me more score when I fail to do it and it has to be broken down. With a few tasks I can get enough resources for a whole month, enough for food.

Transport is free, cars can drive you anywhere, and pick you up from anywhere. But they always play this stupid lo-fi music because it is optimal for my brain, I can't stand it. So I use some of the food to make ethanol and ride my bike. I don't listen to anything, just the thumpy pum pum pum of my Yamaha SR250.

What an amazing bike! You have no idea, it is from 1983, air cooled, single cylinder, old school Mikuni carburetor. I had to modify the carb's main jet as the engine needs more ethanol, but now it works.

I take the bike and go to the solar power plant, I start cleaning, but I play the game a bit, I clean 98% of the panel just enough for the glasses to notice. They draw me a complete plan of how to move the cleaning device, and break down the task into 16 subtasks. This will be enough for the week.

This other guy looks at me weird. I don't care.

The task is done and I take off the glasses, get on my bike and go back home. Sharing the road with self-driving cars is amazing, they always go out of your way, you can even ride in the opposite direction of the traffic, they just go around you.

I can do anything I want. If you do something really bad you just become someone's task. Only murder and rape are not allowed. The glasses usually pick the right person for the right task. I am a bit stronger than most, so sometimes I get picked to collect somebody and put them in a car that takes them to a timeout cell. I have never been to one, but they say it's not that bad.

I do tasks because I want tasks done for me. Sex, medicine, food, energy are all systems that require many participants, you cannot do any of them on your own. The robots help a lot, but you can't test medication on robots, and even though we tried to make the sex work, for some reason it just didn't happen, not to mention we need to keep the human population stable.

As I prepare dinner my sex task arrives, nice lady, we eat dinner together, it is always awkward the first hour, however, the sex tasks are very nicely timed, the men get one every 17 days exactly, and the women get one exactly at the peak of their ovulation window. Sometimes I am sent to a woman, sometimes a woman comes to me. If I don't feel like it I just ignore the task. I usually do go, 17 days is a lot, and when I do go there is no need for protection, all STDs were cured a long time ago, and we do need babies, it is quite easy to raise them, you just do the tasks.

A car comes to pick her up and take her home. Damn, if only I could listen to this stupid lo-fi music... Life would be so much easier. I hate this vomit smell, it is hard to fall asleep because of it.

It gets dark, I take some of the alcohol and get on the bike, I follow the trail of Bluetooth crumbs, it always leads to a different place. We have a ridiculous amount of battery-powered Bluetooth things, we just name them a number we agreed on during the last party. Unobstructed, you can detect a Bluetooth beacon from 100 meters. We do one of those parties every month, the current number is 3778. We are just a bunch of random people that hate the lo-fi crap. It's not like we have a common taste in music, I like metal, Zak likes jazz, he thinks he is better than us, that pretentious prick, Mia loves this weird reggae rap mix, to each their own I guess.

Tonight the party is in an old tunnel, it is still used, the self-driving cars don't mind us, we hooked the audio system to one of the bikes and let it run. Nina Simone's Sinnerman is playing. I love it. Most bikes are single cylinder, you can always hear the thumps under the music, the idle engine rhythm is strangely complementary to Nina's clapping, as if she has 4 hands.

"Please hide me Lord" Nina sings, as I think about this guy at the solar power plant, I could hear the lo-fi coming out of his glasses, I feel my resentment growing. "So I ran to the Devil", as I take a sip. Mia is upset that her sex task was with a small dick. She had to do most of the work after. Zak has spaced out, looking at the air between him and Mia. The conversation fades away, we are just sitting and listening to the music. Next month I will bring Tool. The next number is 4721.

As the cars go around us, they remind me that our act of disobedience is irrelevant. You cannot disobey if there is nothing to obey. It is like being upset with the Sun.

I head back to my place, not looking forward to the vomit smell, I am not sure Nina Simone was worth it. I have everything I need, I can go anywhere I want, the car just wants me to be healthy and happy, the glasses are doing their best, giving me the right exercises at the right time, they really try to help me out. I don't understand why I am angry. I can even change the lo-fi music to whatever music I want, I can make the glasses sing me Nina Simone, they can even make her ghost sing for me. Something is seriously wrong with me.

I go to bed.

Day 4729, John.

The dream was intense, I was walking in a forest as the earth below me turned into thick black water, I kept walking, every step was covering me in blackness, I could not sense anything as I was drowning, as I went beyond black, I woke up gasping for air. The smell of vomit reminds me where I am.

I put on the glasses and make some coffee. I really like coffee, I just hate it being a task. I try to enjoy the coffee regardless. Someone said, "The only zen you find at the top of the mountain is the zen that you bring with you." I am trying to convince myself to enjoy it. It's not working. Fuck.

GPU-unlock: FP/BF16 instruction issue rate on Nvidia 3000's cards

Hacker News

github.com

2026-10-24 05:58:27

Comments...

Original Article

GPU unlock 1.0.0

Unlock FP/BF16 instruction issue rate on Nvidia 3000's cards to their professional equivalents

This Linux kernel module combines the CMP unlocker's V67/PLM technique with the pre-driver timing of the UEFI approach. It runs the unlock, writes the speed selectors (SS0 0x88888888 , which selects the full BF16 rate, and the 4-bit SS1 0x8 IMLA4) and performs FLR before the unmodified NVIDIA driver binds the card. It is neither a UEFI application nor a patched NVIDIA driver.

The benefit of this early kmod driver is that it does not require manual patching each time nvidia releases a new driver version.

The effect of this unlock is that it doubles the instruction issuing speed of FP/BF16 FMA into FP32 operations on GA102, GA103, GA104 and GA106 cards.

3090 Ti dense 8192³ GEMM at 450 W, five-sample medians with FP32 accumulation :

Input	Before	After
FP16	87.46 TFLOPS	118.39 TFLOPS
BF16	87.50 TFLOPS	157.41 TFLOPS
TF32	42.58 TFLOPS	82.61 TFLOPS

How to install

First run:

git clone https://github.com/Zagitta/gpu-unlock
cd gpu-unlock
make install

Then append gpu_unlock.targets=all to your kernel command line, keeping existing options:

GRUB (Debian/Ubuntu/Mint): add it inside GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub , then run sudo update-grub .
GRUB (Arch/CachyOS): same edit, then run sudo grub-mkconfig -o /boot/grub/grub.cfg .
Fedora/RHEL: run sudo grubby --update-kernel=ALL --args="gpu_unlock.targets=all" .
systemd-boot: append it to the options line in your boot entry ( bootctl status shows its location).
UKI / generated entries: add it to /etc/kernel/cmdline and regenerate your boot images/entries (e.g. sudo mkinitcpio -P for mkinitcpio UKIs).

Local build

Every build downloads the pinned NVIDIA/CachyOS inputs over HTTPS, checks their SHA-256, and generates firmware only in the build directory and the binary package. All three formats install through the same make install-* targets. Packages are built from the committed HEAD .

Build, install build dependencies, and install the packages in one step (asks for your sudo password):

make install        # detect the distribution and select an installer
make install-arch   # makepkg -sif
make install-deb    # apt-get build-dep, dpkg-buildpackage, apt-get install
make install-rpm    # dnf builddep, rpmbuild, dnf install

make install uses /etc/os-release ( ID , then ID_LIKE ) to detect Arch, Debian/Ubuntu, or Fedora/RHEL/CentOS families. The RPM installer requires DNF. For other distributions, select a compatible explicit target above.

make arch , make deb and make rpm only build. Debian and RPM packages go to build/deb and build/rpm . The NVIDIA inputs are cached in ~/.cache/gpu-unlock/inputs ( make inputs ; override with INPUTS= ). dpkg-buildpackage itself never uses the network, so a clean-chroot build (sbuild or pbuilder) needs GPU_UNLOCK_INPUTS pointing at that cache. The make dist archive, the Debian source package and the .nosrc.rpm contain no NVIDIA archives or generated firmware.

Boot flow and opt-in

The packages put gpu_unlock and its firmware in the initramfs and load it there, before nvidia can bind a card:

mkinitcpio: /etc/mkinitcpio.conf.d/zz-gpu-unlock.conf inserts gpu_unlock right before nvidia in MODULES , so a display card is blank for as short a time as possible. Without nvidia in the image, it goes last and still runs before an nvidia loaded from the root filesystem. Images are rebuilt on install. mkinitcpio ignores drop-ins for an image built with -c <config> or a preset _config ; put gpu_unlock right before nvidia in that config's MODULES yourself.
initramfs-tools: /usr/share/initramfs-tools/modules.d/gpu-unlock.conf .
dracut: /usr/lib/dracut/dracut.conf.d/gpu-unlock.conf .

With initramfs-tools and dracut, the module is built for every installed kernel that has headers, and those kernels' images are rebuilt on install and again on removal. Kernels installed later get the module and a new image from the kernel's own install hooks.

There is no softdep nvidia pre: rule: kmod honours only the first softdep nvidia line it reads, so other packages' rules ( nvidia-utils , gddr6_hwmon ) would silently override it, or it would override theirs.

The module does nothing unless the kernel command line opts in:

gpu_unlock.targets=all                          # every unbound GA102/GA103/GA104/GA106 card
gpu_unlock.targets=0000:21:00.0                 # only these cards
gpu_unlock.targets=0000:21:00.0,0000:22:00.0    # comma-separated

Addresses are full PCI names as lspci -D prints them (hex digits in either case), independent of GPU numbering and display role. An entry that is not a GA102/GA103/GA104/GA106 card, including all mixed with addresses, is logged and ignored. The cards are unlocked concurrently, about a second in all however many there are, and each on its own: a card that is already bound or powered down is skipped. Bus mastering that the board firmware left on (Supermicro X11 does this whatever its option ROM and bus master settings) is cleared first; a card some driver already initialised is still refused. Then nvidia loads and binds every card as usual.

The display card works too. Its firmware framebuffer (the boot console and Plymouth) keeps running while the unlock's firmware steps run, and is removed just before the card's reset, as nvidia-drm would do a moment later anyway. Its screen is blank from that reset until nvidia-drm takes over.

Loading the module by hand after boot does nothing to a card that nvidia has bound.

Suspend to RAM powers the cards off, which resets the speed selectors. After resume the module unlocks every card it unlocked at boot again, before nvidia resumes it: its suspend notifier runs just ahead of the one nvidia resumes its cards from ( NVreg_UseKernelSuspendNotifiers=1 , the default in current drivers; nvidia-resume.service runs later still). This adds about a second to resume. A card that kept power, as in suspend to idle, is still unlocked and is only read. A card that nvidia has already resumed, or that is bound to another driver, is left as it is, and the log says why. Add gpu_unlock.resume=0 to the kernel command line, or write 0 to /sys/module/gpu_unlock/parameters/resume , to turn this off. Hibernation is not covered.

Check the result with:

journalctl -k -b | grep gpu_unlock
lspci -nnk -s 0000:21:00.0

To stop unlocking, remove gpu_unlock.targets= from the kernel command line; for a one-off boot, delete it in the bootloader's edit screen. Removing the packages also removes the module and the initramfs drop-ins.

If the firmware on a card never stops, the module logs it and keeps the DMA buffers that firmware may still use until the next power off. Power off before trying again.

The kernel module and local packaging are GPL-2.0-only. The generated payload derives from the pinned CMP reference; NVIDIA firmware remains under its own terms. See firmware/NOTICE.md and licenses/ for attribution and notices.

Support me

Help me buy more GPUs <3

https://buymeacoffee.com/zagitta

ETH: 0xf4eee937937f92038D70B16AbD7736D8a53a1c5c

BTC: bc1qwpkwp70fn76z3s4kg2l9y3j4kst95twcznuugf

SOL: 8Rih6HY7V4LcdjYHz4iSffT4fTniqw5CACaBigSVxNYu

I Don't Understand Quantum Physics

Hacker News

www.southampton.ac.uk

2026-10-24 05:53:26

Comments...

Original Article

I DON'T UNDERSTAND QUANTUM PHYSICS

Emacs finally folds to my liking

Lobsters

jointhefreeworld.org

2026-10-24 04:45:01

Comments...

Original Article

I’ve been slowly turning my Emacs config into something I actually enjoy using, not just something that works, and folding was the last place where that wasn’t true.

Every mode had its own idea of what folding is: treesit-fold in Tree-sitter modes, Hideshow in the Lisp-ish ones, Outline in everything that resembles text, Org with its own invisible text that no one else’s commands can undo.

So every buffer had different keys, a different look, and worst of all different performance characteristics. Folding a big file sometimes felt like holding my breath.

I’m running Emacs 32.0.50 from master (built from source, as one does), and it’s finally one system.

kirigami is the piece I didn’t know I needed #

kirigami doesn’t fold anything itself. It dispatches : it keeps a list of folding engines, checks which one is actually active in the buffer, and forwards to it. Tree-sitter, Hideshow, Outline, Org, Vdiff — all behind one interface.

So on top of it I put one set of keys, the same in a Kotlin buffer, YAML, a Scheme or ELisp buffer and an Org file:

Key	Does
`C-c v c`	close this fold
`C-c v C`	close every fold
`C-c v o`	open this fold
`C-c v O`	open this fold and everything under it
`C-c v r`	reveal everything
`C-c v t`	toggle the fold at point

That sounds small. It is not small. The number of times a day I used to think “wait, what does TAB do in this mode again” is now zero, and the muscle memory transfers across an entire polyglot config.

One wrinkle worth mentioning: kirigami answers with the first engine in its list whose mode is on, and outline-minor-mode is on in nearly every buffer I have. In the buffers where I deliberately turned on Hideshow — Scheme, for instance — that choice has to win, otherwise C-c v c folds “headings” a Scheme file doesn’t have. So I reorder kirigami-fold-list to put Hideshow first instead of rewriting it; engines kirigami adds later still get used wherever Hideshow is off.

Tree-sitter folding, with guides that are actually lines #

Most of my programming buffers are *-ts-mode , so treesit-fold does the work there — bash, C, C++, CMake, CSS, Dockerfile, Elixir, Go, HTML, Java, JS/TS/TSX, JSON, Kotlin, Lua, Nix, PHP, Python, Ruby, Rust, Scala, TOML, YAML. Line counts are shown inline, which I find genuinely useful when deciding whether to open a fold.

The indicators took the most fiddling. treesit-fold-indicators draws a block’s guide with a bitmap 23 rows tall, centered in the line beside it. A line in my config is 29 pixels — the font’s 23 plus six of line-spacing — so every row of the guide was a 23-pixel dash with three pixels of nothing above and below it. A folded block looked like a dotted line running down the fringe. Not subtle, just wrong.

There’s no setting for that, so I replaced the bitmaps: a single-row bitmap that define-fringe-bitmap repeats down however tall the line is (no spacing can introduce a gap), plus a +=/ -= box and an end-elbow cut to the exact height of a line, so the guide runs from the marker into the row below and turns toward the text where the block ends. It’s an advice on the function that builds the string for each line. It looks like a bracket now, not a perforation.

And the colour: the indicators inherited shadow , which most themes make as bright as a comment. Fine for one marker on one line, wrong for a marker on every line of a block — the grey became a rule drawn through the code. They’re now shadow blended 50% toward the theme’s background, recomputed on every theme and scale change, so it fades correctly on light themes too and no theme needs a special entry.

Hideshow earns its keep #

Not everything has a grammar, and I’m not going to pretend otherwise:

Scheme — my Emacs build has no Scheme grammar, so Scheme buffers use Hideshow with hs-block-start-regexp set to "^(" and hs-forward-sexp-function set to forward-sexp . A Scheme file is a sequence of top-level forms, so each definition is a fold, and collapsing the one you’re inside works from anywhere within it. That’s the behaviour I wanted from the start and Hideshow doesn’t guess it by default.
Emacs Lisp — the prog-mode fallback, same keys.
XML — folds from start tag to end tag using nxml-scan-element-forward , skipping <?xml ?> , comments, DOCTYPE and self-closing elements.
YAML (the non-Tree-sitter mode) — indentation-based blocks with a small forward-sexp of my own that walks to the end of the indented block.

Hideshow’s own fringe indicators ( hs-show-indicators + hs-indicator-type 'fringe ) are on in all of these, so it doesn’t feel like a downgrade from the Tree-sitter buffers.

The rule I enforce per buffer is exactly one set of indicators : Tree-sitter buffers get treesit-fold and Hideshow is turned off; Hideshow buffers get Hideshow and Outline’s clickable buttons are turned off so the two don’t double up; outline-only buffers (Markdown, diff) keep the buttons. Nobody ends up with two markers per block.

Org, which needed its own everything #

Org folds with text properties, not overlays, so neither Tree-sitter nor Hideshow nor Outline’s buttons can draw a marker for it. So I wrote its own indicators: a fringe triangle pointing down for an open heading, right for a folded one, clickable with mouse-1 to toggle exactly like TAB . Folding itself is untouched — TAB , S-TAB and the C-c v keys all still work.

The performance part is where the real win is. A naive “redraw indicators after every command” implementation is a disaster in a large file, because it re-searches the buffer and rebuilds every overlay on every pause. Mine is driven by the text instead:

if buffer-chars-modified-tick didn’t change, only the indicators that are on screen are redrawn — off-screen headings can wait until they’re scrolled to;
if it changed and the change was recorded, only the dirty region is rebuilt;
if it changed with no recorded change, only then is the whole buffer rebuilt.

Folding changes text properties rather than characters, so folding alone takes the cheap path. Fold state is read back from Org on each redraw rather than remembered, so external folding can never leave a stale marker.

Two config choices matter just as much: org-fold-core-style is text-properties (so a visibility cycle doesn’t re-parse the file), org-element-use-cache is on, and Org starts with showeverything — which is both what I want (a note is read, not consulted) and the cheaper state, because it skips the visibility passes that walk every heading on open. I also removed a org-restart-font-lock that was re-fontifying the whole buffer a second time on open; JIT-lock handles what’s on screen.

It feels smooth, and that’s the whole point #

The end result is that folding is boring now. C-c v c in Kotlin, Scheme, Elisp, Org, XML, YAML, Markdown. Guides that look like brackets. Indicators quiet enough to ignore until you need them. No pause on a 3000-line Org file. No two competing markers.

It honestly changes how much I collapse and expand while reading code. I used to avoid folding because it felt fiddly; now it’s free and mouse friendly.

If you want to read the actual code: it’s in dev-folding.el for the engines and indicators, the heks/fold-* wrappers in heks-emacs.el for the keys, and the Org indicators live in org.el . Everything is GPL-3.0, and it’s tested: maak verify asserts a fold actually covers a whole definition and that the documented keys are bound, and maak keys fails on a key that does two jobs or names a command that doesn’t exist.

Happy to answer questions about any of it, especially if you’ve fought the treesit-fold-indicators bitmaps yourself, because that one cost me an evening and I’d love to know if there’s a cleaner way.

Blue Planet III features cloudier footage to prove authenticity amid AI boom

Guardian

www.theguardian.com

2026-10-24 04:32:56

BBC series deliberately uses ‘more organic’ shots to assure viewers animals are not AI-generated, producers say The David Attenborough-narrated series Blue Planet III deliberately includes cloudier, less polished footage to counter AI fakery and assure viewers it is “authentic”, its producers have s...

Original Article

The David Attenborough -narrated series Blue Planet III deliberately includes cloudier, less polished footage to counter AI fakery and assure viewers it is “authentic”, its producers have said.

Nearly a decade after Blue Planet II shone a light on plastic pollution, and 25 years since the first Blue Planet aired, the hit BBC series is returning with more animal behaviour and cutting-edge technology, including the world’s first underwater CCTV camera – dubbed “stonefish” cam.

Since the first Blue Planet, TVs and cameras have evolved to give viewers sharper, higher definition pictures. But the combination of the rise in AI and the extraordinary sequences and fantastical creatures captured by BBC Studios’ natural history unit for this series led producers to include what they called more “organic” footage and less polished shots, to show that the animals were not AI-generated.

A TV crew in a small boat record a whale’s fluke above water — ‘No gen AI was used in this series. Not a single frame,’ said the BBC’s specialist factual commissioning head, Jack Bootle. Photograph: BBC Studios/Jo Haley

The executive producer, Elizabeth White, said AI, “makes us want to be even more authentic”, adding that the creatures filmed in the deep ocean “are probably more remarkable than AI could imagine and it’s completely real”.

She said that in the past “the amount of plankton and things that are in the water in the sequences” would usually mean they might be excluded, and previously, “we might have framed out a boat or a buoy or gone: ‘Oh, actually … the water conditions are not really good enough for this.’”

But now such things are being left in as “we’re really leaning into that authenticity … As AI booms we will probably lean more into the more organic”, murkier and less polished footage.

For the first time, the BBC’s specialist factual commissioning head, Jack Bootle, assured journalists at a press screening: “No gen AI was used in this series. Not a single frame. It’s all real photography.”

Bootle added that as we live in a “golden age of natural history-making … sometimes people feel like they’ve seen it all before [so] this series is bursting with novel behaviour”.

A diver films a loggerhead turtle resting at the surface of the water — The hit BBC series returns with cutting-edge technology, including the world’s first underwater CCTV camera – dubbed ‘stonefish’. Photograph: BBC Studios/Jose Branco

That includes never-before-seen action of dolphins using sea sponges to block holes in coral to trap fish, captured using underwater CCTV – developed by the programme’s producer and director, Yoland Bosiger.

Over the four years of filming across five oceans, BBC Studios “continually innovated”, said the series producer, Lara Bickerton, creating a “mini-dome” camera to follow an octopus, a “deep-sea selfie stick”, camera operators wearing leg-mounted scooters to create immersive TikTok-style diving footage and using lasers to film deep-sea creatures.

Other remarkable animal behaviour captured in the programme includes grouper communicating with another species of fish; 200,000 crabs lining up in formation to feed; sea urchins using shells as sun hats; and footage involving penguins that echoes the Planet Earth II, ‘iguana v snakes’ sequence.

Threats to the ocean as well as its resilience are addressed in the series. One episode shows how warmer seas caused by the climate crisis are killing off sea anemone where clown fish live and how they try to fix their homes, and the issue of plastics raised in Blue Planet II continues with a story about pollutants [and] forever chemicals, said White.

Bosiger said Attenborough, who is 100 years old, was “very much involved” and made changes to scripts.

White added: “What’s wonderful is he hasn’t lost his curiosity … he’s still that little boy … who gets excited … when you show him a new piece of footage.”

Asked if the BBC’s £500m cost-cutting drive would affect BBC Studios’ renowned natural history reputation, White said she could not comment on that but pointed out that Blue Planet III made savings by using more local crews on location than in previous series.

Blue Planet III starts Sunday 1 November on BBC1 and iPlayer

ThinkRail from JetBrains

Hacker News

thinkrail.ai

2026-10-24 04:08:42

Comments...

Original Article

JetBrains InnovationHub Apache-2.0 open source

The agentic IDE that gets better every time you use it.

Open a repo as a project. Cut isolated git-worktree workspaces . Pair with a real agent across Monaco tabs, terminals, and diffs — while your project's intent lives in a spec graph the agent actually reads .

macOS

Browser UI via command line

Install the local launcher; run thinkrail to open the browser UI.

curl -fsSL https://raw.githubusercontent.com/JetBrains/thinkrail/main/install.sh | bash

Windows

Browser UI via command line

Install the local launcher; run thinkrail to open the browser UI.

PowerShell

irm https://raw.githubusercontent.com/JetBrains/thinkrail/main/install.ps1 | iex

Command Prompt (cmd)

powershell -c "irm https://raw.githubusercontent.com/JetBrains/thinkrail/main/install.ps1 | iex"

WSL

curl -fsSL https://raw.githubusercontent.com/JetBrains/thinkrail/main/install.sh | bash

Linux

Browser UI via command line

Install the local launcher; run thinkrail to open the browser UI.

curl -fsSL https://raw.githubusercontent.com/JetBrains/thinkrail/main/install.sh | bash

Why ThinkRail

Agents deserve worktrees, not your working tree.

Every workspace is a real git worktree — its own branch, its own cwd. Run several agents in parallel; each one's mess stays on its branch, and main stays clean until you say otherwise.

Specs are the ground truth.

ThinkRail is built spec-first, and so are your projects: a connected graph of spec files lives beside the code, and the agent reads, searches, and maintains it with dedicated tools. Intent survives the session.

A thin host, a real engine.

The pi coding agent runs in-process and owns models, skills, compaction, and cost. ThinkRail owns the workspace, the editor, and the wire — it never assembles prompts behind your back.

Projects → workspaces

A project is any local git repo. A workspace is a git worktree cut from it — created in one click, listed in the rail, disposable without ceremony.

# one repo, three parallel lines of thought
~/code/my-repo                        ← project
└─ ~/.thinkrail/worktrees/
   ├─ workspace-1   ⎇ feature/auth      agent A building
   ├─ workspace-2   ⎇ fix/flaky-test    agent B fixing
   └─ workspace-3   ⎇ spike/ideas       you, exploring

Own branch + cwd per workspace — files, diffs, terminals, and chats all scope to it.
Switch workspaces instantly; nothing reloads, nothing leaks across.
Merge the good one, delete the rest. Your repo never noticed the chaos.

A real IDE around the agent

Watch the agent work — or work beside it — without leaving the page.

Monaco editor tabs

The VS Code editor engine: syntax everywhere, rendered markdown with a source toggle, file tabs per workspace.

Files tree

The active worktree at a glance — like the rail on the right of this very page.

Changes

A live git diff of the workspace branch, so you review the agent's work as it lands.

Terminals

Real PTYs scoped to the worktree — run the tests yourself while the agent keeps typing.

Chats that stream like the engine thinks

This transcript is a real pi session, captured in ThinkRail while it worked on its own repo:

Quick tour: what is ThinkRail, and what are the three rings of its architecture? Keep it brief.

read goal-and-requirements.md · architecture.md

ThinkRail is the agentic IDE built around the pi coding agent — a thin host that runs pi in-process and bridges it to a rich UI, while pi owns models, skills, compaction, cost, and session state.

The three rings :

Engine host ( packages/server ) — createServer() runs an HTTP+WS host plus an AgentSessionManager : one in-process pi session per tab.
The wire ( packages/contracts ) — the typed, versioned protocol between host and UI. Types only.
UI client ( apps/web ) — mobile-first React that ships independently and dials any host over the wire.

Done 5s · 25.9k tok · $0.17

Several sessions per workspace, streaming concurrently.
Pick the model per session; tokens and cost tick live in the header.
Steer a running turn or queue a follow-up — no waiting for the agent to finish.
Interactive tools: the agent can ask structured questions back, right in the chat.

Specs are first-class

Every module carries a SPEC.md with frontmatter linking it into a graph — goal, architecture, modules, tasks. The bundled pi-spec-graph extension gives the agent spec_* tools to search, navigate, and maintain it, and the Specs tab renders the live graph of your worktree:

ThinkRail — product goal and scope main spec

ThinkRail — top-level architecture arch

Engine host (server library) module

agent — in-process pi sessions submodule

---
id: module-server
type: module-design
status: active
parent: architecture
---

Plain markdown, plain frontmatter, versioned with the code — reading the specs is enough to understand an area and formulate the next task. The agent keeps them honest as it builds.

Install

Choose your platform and start working.

Linux: extract the archive, run ./installer , and check the native library requirements .

Browser UI via command line

Install the local launcher, then run thinkrail to open the browser UI.

macOS, Linux, WSL

curl -fsSL https://raw.githubusercontent.com/JetBrains/thinkrail/main/install.sh | bash

Windows PowerShell

irm https://raw.githubusercontent.com/JetBrains/thinkrail/main/install.ps1 | iex

Command Prompt

powershell -c "irm https://raw.githubusercontent.com/JetBrains/thinkrail/main/install.ps1 | iex"

Requires git and an authenticated pi provider. See all releases and advanced CLI options .

Open source, spec-first

ThinkRail is a JetBrains InnovationHub project, licensed Apache-2.0 . The repo is developed spec-first — the top-level specs are the product's ground truth, and this website is itself a module with a SPEC.md .

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

Hacker News

www.aikido.dev

2026-10-24 04:06:39

Comments...

Original Article

TL;DR

⚠️ Brotli is a widely used compression library from Google. On Wednesday, October 21st NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. On Thursday, Python disclosed that Python packages were vulnerable to CVE-2026-111497 as well.
On Friday, October 23rd, it has become known that this CVE affects other major languages and service applications using HTTP, where patches are not yet fully available.

Check if you are decoding Brotli as a dependency within your libraries. Stay on guard for wider announcements and be ready to upgrade as soon as possible. If there is no patch available for a library or application that may be affected, we recommend disabling Brotli decoding until patches become available.

Update 4:12PM PT:
Patches are available for libbrotli , Python , C++ , NodeJS , bun , Envoy and more coming. Apache and Nginx do not decode brotli by default.

Update 4:15 PM PT: OpenAI shares that they discovered this vulnerability in February. While the root cause issue was fixed in the Brotli source code at the time, it wasn’t known that it gave rise to a security vulnerability. OpenAI's advisories here .
‍

What is Brotli?

Brotli is a lossless compression algorithm and data format developed by Google. It’s a way to make data smaller for storage or sending over the internet. Software then unpacks it to recover the original data. It’s widely used for HTTP compression to compress web content such as HTML, CSS, and JavaScript.

What is CVE-2026-111497?

CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder affecting versions 1.0.3 through 1.2.0 on all platforms. This is the same Brotli decoder flaw behind Node2Shell announced a couple days ago. A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt memory, leak sensitive data, crash the process, or potentially execute arbitrary code. It carries a CVSS v4.0 score of 9.2 (Critical), and Node.js is affected through its bundled Brotli library.

A bug makes the Brotli decoder keep accepting more bytes when it should reject the data. Those bytes can overflow a small working buffer and damage the program’s memory. An attacker can use that damage to control what runs, such as their own code.

OpenAI found this in February reported it as unauthenticated remote code execution that works in both directions, so a malicious client can take over an unpatched server and a malicious server can take over an unpatched client that accepts compressed responses.

The root cause was fixed in the Brotli source code in February, but it wasn't recognized as a security issue at the time and no release shipped with the fix until now. That means every project that bundles Brotli has to ship its own update.

‍ You’re exposed if any environment has Brotli 1.2.0 or earlier or brotlicffi 1.2.0.x installed, since HTTP clients such as requests, httpx, and aiohttp load these packages automatically when they’re present. Upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0 and rebuild any container images that bundle them. As of October 23, advisory databases don’t map the CVE to either PyPI package, so pip-audit, Dependabot, and Safety won’t flag vulnerable versions yet.

‍ You can see what we’ve tracked here in Aikido Intel.

As for unaffected software, Apache’s standard mod_brotli does not decode Brotli

For CVE-2026-111497, update the affected runtime or Brotli library:

Node.js: upgrade to 22.23.4, 24.22.1, or 26.12.1 , or a newer supported release in the corresponding release line.
Native Brotli / libbrotli: upgrade to 1.2.1 or later . For older release lines, use patched 1.0.10 or 1.1.1 .
Python packages: upgrade Brotli to 1.2.1 or later and brotlicffi to 1.2.1.0 or later , wherever installed.
curl / libcurl: update its Brotli dependency to 1.2.1 , a patched older release, or the vendor’s security-fixed package. Bundled or statically linked copies require an updated application build.
Bun: upgrade to 1.4.4 or later . Rebuild compiled executables that bundle Bun.
Envoy: upgrade to 1.40.0, 1.39.3, 1.38.6, or 1.37.8 , or a newer release in a supported branch. 1.36.12 also includes the fix, but the 1.36 branch is unsupported.
Istio: the fix is included in 1.29.9, 1.30.6, and 1.31.2 . Use a newer supported release in the corresponding line; the 1.29 branch is end of life.
Operating-system packages: install the vendor’s security update. Vendors may backport the fix without changing the upstream version number.
Other HTTP servers, reverse proxies, API gateways, and HTTP clients: update the affected runtime or Brotli library they use. Where Brotli is bundled into the product, install the product vendor’s release that explicitly addresses this CVE. For managed services, confirm remediation with the provider.

Update dependency locks, rebuild affected applications and container images, redeploy, and restart services. Verify that running workloads use the patched components.

‍

Fixed releases, reviewed October 23, 2026
Project	Patch status	Fixed versions	Notes
Node.js	Patch available	22.23.4 · 24.22.1 · 26.12.1	Use a supported release line.
Bun	Patch available	1.4.4	Includes Brotli 1.2.1.
Envoy	Patch available	1.40.0 · 1.39.3 · 1.38.6 · 1.37.8	1.36.12 also includes the fix, but 1.36 is unsupported. Use a supported branch.
Istio	Patch available	1.29.9 · 1.30.6 · 1.31.2	1.29 is end of life, so move to a supported line.
Google Brotli (upstream)	Patch available	1.0.10 · 1.1.1 · 1.2.1	Choose the fixed release for your library branch.

What to do if you can't upgrade yet

These workarounds reduce exposure while you prepare the upgrade:

Python applications: where Brotli support is optional, uninstall both Brotli and brotlicffi from affected environments. Remove dependency extras such as httpx[brotli] and any other requirements that would reinstall them, then regenerate dependency locks and rebuild/restart workloads. HTTPX, Requests, and urllib3 retain gzip and deflate support without these optional packages. However, a server that sends Brotli anyway may produce an unreadable response or an application error; automatic fallback is not guaranteed.
- Uninstalling both Python packages and restarting workloads removes the decoding paths provided by those packages for incoming and outgoing data. It does not remove separate Brotli decoders bundled into other runtimes, libraries, or products.
Incoming HTTP requests: reject requests whose Content-Encoding includes br at the reverse proxy, load balancer, or application middleware, before any vulnerable decoder processes the body. Match br case-insensitively, including within lists of encodings.
Outbound HTTP requests: remove br from Accept-Encoding. Also disable Brotli response decoding or reject responses whose Content-Encoding includes br before decoding begins. Ensure this check occurs before automatic body processing; checking after the client has downloaded and decoded the response is too late.

Changing Accept-Encoding alone is insufficient: a malicious server can send a Brotli response regardless of what the client advertises, and urllib3 selects its decoder from the response’s Content-Encoding header.

Keep these controls in place until affected components are patched and verified. Review coverage as vendors confirm additional affected components or attack paths.

How Aikido helps with CVE-2026-111497

Aikido flags vulnerable versions of Brotli and brotlicffi in your repositories, container images , and dependencies, including when they arrive as transitive dependencies. Your dashboard shows which services still run a vulnerable version, so you can upgrade the ones that call outside servers or accept compressed request bodies first.

Once you've upgraded, Aikido checks if the finding is gone.

The timeline

Brotli is a widely used compression library from Google. On Wednesday, October 22nd NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. Users were exposed if their app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser).

The next day, Python released a security update that patches the same flaw; Python packages were also vulnerable to CVE-2026-111497. Brotli flaw may affect even more languages and service applications, given how widely integrated the library is downstream. It turns out OpenAI had found this back in February.

Techincal details of CVE-2026-111497

The flaw sits in DecodeBlockTypeAndLength() , which handles block switches, the points where a Brotli stream changes which Huffman tree it uses. In vulnerable versions the function returns a plain boolean, and BROTLI_FALSE can mean either "this stream is malformed" or "I need more input." Callers can't tell the two apart, and on the fast path the decoder discards the return value entirely.

A crafted stream can declare a single block type and then exhaust that block's length, which forces a switch that can't succeed. The decoder then either reports that it needs more input for a stream that's complete, or keeps decoding with the block state it already had. That second path leads to the out-of-bounds write.

The upstream fix, google/brotli commit 0ed4268 , makes the function return an error code and adds a new error, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17). Decoding now stops on a format error on both the safe and fast paths. OSM diffed the Brotli 1.2.0 and 1.2.1 source distributions and found that 1.2.1 differs only in the version bump and the decoder changes from that commit.

‍

Brotli vulnerabilities in Python libraries (CVE-2026-111497)

The Brotli flaw behind Node2Shell (CVE-2026-111497) affects Python. Two PyPI packages, Brotli and brotlicffi, compile the same vulnerable Brotli decoder that Node.js bundles. An official advisory was posted on GitHub . Brotli has 82.8 million downloads per month.

You're affected if any Python environment you run has Brotli 1.2.0 or earlier, or brotlicffi 1.2.0.x, installed. Popular HTTP clients such as requests and httpx load these packages automatically when they're present . Some packages automatically install Brotli as a dependency such as Scrapy, while others require explicit mention of it. An attacker can reach the vulnerable decoder by sending a malicious Brotli response to a request your app makes, or by sending your app a request body compressed with Brotli. That means an app can be exposed without importing Brotli anywhere in its own code. It’s a popular transitive dependency, so check your systems.

To fix it, upgrade to the patched releases:

Brotli -> 1.2.1
brotlicffi -> 1.2.1.0

The release notes for both fixed versions don't mention the CVE. As of October 23, advisory databases don't map it to either PyPI package yet, so pip-audit, Dependabot, and Safety won't flag these versions.

Who is affected by CVE-2026-111497 in Python?

You’re affected if any of your Python environments have one of these packages installed:

Package	Affected versions	Fixed version
Brotli (PyPI)	1.2.0 and earlier	1.2.1
brotlicffi (PyPI)	1.2.0.x	1.2.1.0

Your code doesn’t have to import either package. These HTTP clients advertise Accept-Encoding: br and decode Brotli responses automatically:

urllib3 (and therefore requests) when Brotli or brotlicffi is installed
httpx with the brotli extra
aiohttp when Brotli is installed
Scrapy, and anything built on the clients above

Attacker data can reach the decoder through two routes:

Outbound requests. Your app fetches a Brotli response from a server an attacker controls, such as through a webhook delivery, URL preview, crawler or “fetch this URL” feature.
Inbound requests. Your framework or middleware decodes a request body sent with Content-Encoding: br, which is the Python equivalent of the Express 5 case in Node.js.

How to fix CVE-2026-111497 in Python

The fix is a package upgrade, and it takes four steps:

Upgrade whichever package you have installed with pip install -U "Brotli>=1.2.1" or pip install -U "brotlicffi>=1.2.1.0". If you use a lockfile with Poetry, uv, or pip-tools, update the constraint and regenerate the lockfile.
Rebuild your container images and any wheels that bundle either package. An image built on a vulnerable version stays vulnerable until you rebuild it.
Check every environment you run, including laptops, CI runners, servers and containers. Many projects pull in Brotli through an HTTP client extra, so look at your full resolved dependency tree.
Rely on a manual check for now. pip-audit, Dependabot and Safety won't report this until the advisory databases map the CVE to the PyPI packages.

If your Python Brotli bindings came from a Linux distribution package instead of PyPI, the fix comes through your distribution, so check its security advisory as well.

What is the Python Brotli vulnerability (CVE-2026-111497)?

Python Brotli vulnerability refers to CVE-2026-111497, the Brotli decoder flaw known as Node2Shell , as it affects Python packages on PyPI. The CVE record pairs CWE-252 (unchecked return value) with CWE-787 (out-of-bounds write).

How serious is CVE-2026-111497 for Python, and is it being exploited?

The CVE record gives the flaw a CVSS 4.0 score of 9.2, and Node.js rates it high severity. OSM built Brotli 1.2.0 and 1.2.1 with AddressSanitizer and ran a crafted stream through both. Version 1.2.0 consumed all of the roughly 23 MB stream and kept reporting that it needed more input, whether the stream arrived in one piece or in chunks as small as one byte. Version 1.2.1 rejected the stream with error -17 every time.

OSM didn't pursue memory corruption or code execution in the Python extension. The decoder code is the same code that researchers exploited against an unmodified Node.js 24.22.0 build, as Imperva and others reported. For Node.js, The Hacker News reported no exploitation in the wild as of October 22.

Treat it as urgent anyway. The bug is a memory-safety flaw in a component that handles untrusted network input, and the fix is a routine version bump. Services that call outside servers or accept compressed request bodies should go first.

How to check if your Python app is exposed

Check installed versions with pip show Brotli brotlicffi in each environment, and with docker run --rm <image> pip show Brotli brotlicffi for each container image.
Find what pulls the packages in. Run pipdeptree -r -p Brotli to see which dependencies require it, and search your lockfiles with grep -i brotli poetry.lock uv.lock requirements*.txt.
List the outbound HTTP calls that go to servers you don't control, and any endpoints that decode Content-Encoding: br request bodies.
Upgrade the services that match step 3 first, then the rest.

If you're reproducing the bug from Python, brotli.decompress() raises a generic brotli.error: decoder failed for any error, so you can't see which error code fired. A Decompressor() fed the crafted stream incrementally will never finish on 1.2.0.

FAQ

‍ Which versions fix CVE-2026-111497 in Python?

Brotli 1.2.1 and brotlicffi 1.2.1.0, along with any newer releases.

Do I need to import Brotli in my code to be affected?

An installed package is enough. urllib3, requests, httpx and aiohttp use Brotli or brotlicffi automatically when either is present and decode Brotli responses from any server your app calls.

Will pip-audit or Dependabot flag this?

Not yet. As of October 23, the CVE record, OSV and the GitHub Advisory Database don't list either PyPI package. OSM is submitting PYSEC entries and a PyPI package mapping for the GitHub advisory so that tooling picks this up.

Is there a workaround?

Uninstalling Brotli and brotlicffi removes the vulnerable decoder, and HTTP clients fall back to gzip and deflate. Rejecting Brotli-encoded requests at the edge reduces inbound exposure, but it doesn't protect against Brotli responses your app fetches.

Big Runtimes Make Efficient Programs

Lobsters

www.youtube.com

2026-10-24 03:51:04

Comments...

Original Article

Opposition deepfake video of Spanish PM’s wife sparks outrage before election

Guardian

www.theguardian.com

2026-10-24 02:51:53

Video shows AI likenesses of people linked to Pedro Sánchez’s Socialist party appearing to admit to wrongdoing A political ad from Spain’s main opposition party that used a deepfake video of the prime minister’s wife has sparked outrage and set off a wider debate on AI, as the deeply polarised count...

Original Article

A political ad from Spain’s main opposition party that used a deepfake video of the prime minister’s wife has sparked outrage and set off a wider debate on AI, as the deeply polarised country gears up for general elections next month.

Launched this week across the social media channels of the conservative People’s party (PP), the video used artificial intelligence to manipulate the likenesses of various people linked to Pedro Sánchez’s Socialist party and appeared to show them admitting to acts such as soliciting prostitutes and taking kickbacks.

An AI-generated version of Sánchez’s wife, Begoña Gómez, for example, speaks about receiving a university post thanks to her husband’s job, while a deepfake of the former Socialist president José Luis Rodríguez Zapatero speaks about hiding jewellery in a safe. Both lines are nods to ongoing investigations in which Gómez and Zapatero have denied any wrongdoing.

A likeness of Begoña Gomez looking at the camera. — A still from the People’s party AI-generated video featuring a deepfake of Begoña Gomez. Computer-generated: @ppopular/X

The Socialist party was swift to respond to the video, which by Friday had racked up nearly 2m views. “It’s telling people a colossal lie, and for a party to do it on its official accounts seems intolerable to me,” Óscar López, Spain’s digital transformation minister, told the broadcaster TVE on Friday.

While the video noted at the bottom – in tiny, nearly transparent font – that it had been created with AI, López pointed to the wider risk. “It’s very easy for anyone who isn’t used to AI to confuse that video with reality,” he said. “And call me crazy, but that seems extremely serious to me.”

On Friday, one of those whose likeness was used in the video filed a legal challenge against the PP, calling on the party to immediately take down the campaign advert. In a court complaint, Leire Díez, a former Socialist party member, reportedly accused the PP of defamation and digital identity theft, after the video used her likeness to hint at accusations that she worked to undermine judicial and law enforcement in order to help the Socialists.

A majority of the nine legal experts consulted by the newspaper El País concurred that what the PP had done was not illegal, given that the video was labelled as AI-generated and that the overall tone was one of political satire. “Given the context, everyone knows those people didn’t say those things,” Íñigo Navarro, a former dean of the faculty of law at Madrid’s Comillas Pontifical University, told the paper.

But the legality of the video was just one aspect, said Juan Antonio Lascuraín, a professor of criminal law at the Autonomous University of Madrid. “It’s quite another matter to ask whether it’s appropriate, exemplary or ethically and politically correct.”

Many sought to contextualise the videos within the wider effort – under way by officials across much of the world – to crack down on the impact of disinformation.

“It’s truly regrettable that the official account of a party that claims to want to govern and revitalise democracy is using AI-generated deepfakes in its campaign,” said José Javier Olivas, an associate professor who researches populism, conspiracy theories and AI biases at Spain’s National University for Distance Education.

He pointed to the wider backdrop of the election campaign, in which both mainstream parties have sought to rally voters by stoking emotions and attacking the morality of their rivals, but he said the video was a “red line” in terms of how campaigns normally unfolded.

skip past newsletter promotion

“You’re using the images of other people, putting words in their mouths that they’re not saying, [and] this qualifies for disinformation,” he said.

The use of AI to generate or enhance political ads has also become a talking point in the US ahead of next month’s midterm elections. A recent report by a research group based at Wesleyan University in Connecticut identified more than 200 such ads, the vast majority of them tied to the Republicans.

“AI is making its way into the 2026 midterms in a big way this year,” said Erika Franklin Fowler, a co-director of the Wesleyan Media Project. “For comparison, we identified less than $50,000 in spending on AI-generated ads in the 2024 cycle. Much of the AI use is not disclosed through any type of disclaimer.”

In Spain, the PP has brushed off criticism. “If there had been malicious intent to make people believe that the characters who appear there are real, then we’d have a problem,” Borja Sémper, of the party, told reporters. “But everyone can see that this is a way of using digital tools to highlight the hypocrisy in which the Socialist party operates.”

Most polls suggest the PP will win the 29 November general election but will need to rely on the support of the far-right Vox party to form a government.

Hacker reverses Samsung TV, finds on-board AI listening OpenAI account suspended

Hacker News

www.reddit.com

2026-10-24 01:49:57

Comments...

Original Article

You've been blocked by network security.

To continue, log in to your Reddit account or use your developer token

If you think you've been blocked by mistake, file a ticket below and we'll look into it.

Log in File a ticket

Root shell on Samsung TV

Hacker News

twitter.com

2026-10-24 01:49:57

Comments...

Original Article

Log in or sign up for X

See what’s happening and join the conversation

Continue with phone

or

Log in with username or email

Relevant people

log4j @ log4j Follow

“advanced persistent threat” - wsj | reverse engineer, pentesting, bounty hunter, occasional LLM enjoyer

Trending now

John Healey pledges to use budget to harness power of AI to bolster Britain’s security

Guardian

www.theguardian.com

2026-10-24 01:00:24

Chancellor says government to commit hundreds of millions to develop ‘distinctively British’ approach to AI John Healey has pledged to use Wednesday’s budget to harness the power of artificial intelligence to bolster Britain’s security and prosperity against the risks in the accelerating global tech...

Original Article

John Healey has pledged to use Wednesday’s budget to harness the power of artificial intelligence to bolster Britain’s security and prosperity against the risks in the accelerating global technology arms race.

As he prepares for his debut budget, the chancellor said that Andy Burnham’s government would commit hundreds of millions of pounds to develop a “distinctively British” approach to AI that would capitalise on the benefits of the frontier technology.

At a fork in the road as AI developments pose both existential threats and transformative economic potential, Healey said he would be making the biggest ever investment to guard against cyber risks and the disruptive potential of the technology.

As part of the measures in his tax and spending statement, he promised fresh investment for Britain’s AI Security Institute and other critical institutions, alongside allocating public money to support the use of the technology for good.

“AI will transform daily life: every firm, community, hospital, school and every aspect of our economy can benefit,” Healey said.

“I understand and share the concerns of working people, so I am setting out a distinctively British approach to AI – one that doesn’t leave workers behind and defends our national interest, while ensuring the benefits of AI-enabled growth are felt right across the country.”

Three months into Burnham’s premiership, Healey is poised to deliver a budget against an increasingly volatile backdrop as the war in the Middle East sends shock waves through the global economy, putting pressure on public finances and reigniting the cost of living crisis.

The chancellor has vowed to use his first budget to provide households and businesses with “breathing space” as the global surge in energy costs triggered by the war hits millions of families this winter. On Friday, the latest tensions in the Gulf sent the oil price to its highest level for six months, rising above $117 a barrel at one point.

However he will also use the opportunity afforded by the critical speech to the Commons to flesh out Burnham’s policy priorities for government after he replaced Keir Starmer this summer, and to spell out a vision for Britain amid the increasingly turbulent global economic outlook.

Aiming to harness the opportunities of AI to raise living standards, back UK businesses and support economic growth, the chancellor said he wanted to seize the opportunities of the technology as a central plank of Labour’s plan for growth.

It comes after official figures show AI investment has helped the UK outperform gloomy economic forecasts as the Iran war pushes up inflation and drags down business confidence, powering the country to the strongest growth performance in the G7 in the first half of this year.

However, there are growing fears over the security of the nation and critical industries as the technology opens up the danger of cyber-attacks, IT systems turning rogue and devastating job losses as companies invest in machines rather than humans.

It comes as websites around the globe went dark this week after a serious vulnerability was found in a computer language used to build much of the world wide web, in a development made possible by rapid AI advances. It also emerged this week that Barclays is cutting 5,000 jobs as part of cost-saving plans identified by bosses as the rollout of AI across the bank helps it make efficiency gains.

Healey said he wanted to use his budget to protect against risks while also nurturing homegrown businesses and talent, in order to cut Britain’s dependency on other countries that were also making strides in AI technology.

New investments would be made in AI chip design capability in Edinburgh, alongside a new AI Centre of Excellence in Manchester that it said would enable the UK to harness the technology’s benefits.

The government would also spend £10m a year to lead the UK’s work on understanding how AI will reshape jobs and industry, aiming to address concerns about potential job disruption.

As part of the plan the Treasury said it would back up to £300m in public-private investment in a new AI Biosecurity Lab, designed to serve as a world-leading institution bringing together scientific expertise to protect people from emerging biological threats.

It comes after the defence secretary, Wes Streeting, warned on Thursday that UK households should make preparations against the mounting risks from weather, cyber or other serious emergencies.

The advice to stock up on supplies to last 72 hours, in a campaign called Be Ready , comes as Silicon Valley bosses sound the alarm over the increasingly existential threats AI could pose, and amid growing official concern over the impact of the climate crisis, technological dependency and hostile state threats.

Dan Jarvis, the security minister, said: “I’m proud the UK has repeatedly been at the forefront of global efforts to use AI for the benefit of humankind.

“Today’s investment will help the UK seize the opportunities AI presents to strengthen our national security, while staying one step ahead of those who seek to use AI to do us harm.”

OBS Studio 33

Hacker News

github.com

2026-10-24 00:49:58

Comments...

Original Article

OBS-Studio-33.0.0-Sources.tar.gz: c1ae3c98c1bb70ebdced33e894a526fcbbbda9bfd95806970a3fc31f74b08f6c
OBS-Studio-33.0.0-Ubuntu-26.04-x86_64-dbsym.ddeb: 12045838dfd0202ba26b77fb2e8572f4db27c709b3aabe425ac979ee0532a61c
OBS-Studio-33.0.0-Ubuntu-26.04-x86_64.deb: f5844914eadd560314f3a9db020afa7a8afbefb67a26c488f2956dc339704918
OBS-Studio-33.0.0-Windows-arm64-PDBs.zip: e43139f467ccedb4fbb583f09ce64341a7c96b44030181ef57abd1528142b947
OBS-Studio-33.0.0-Windows-arm64.zip: 02c53d7bff3f9c159401da79fc375d7b75b00c9ca62d2b4ec5fc05a575d2fa1f
OBS-Studio-33.0.0-Windows-x64-Installer.exe: 3bf55dae6d9db651505828090de74540296c742ed2a94a28cf055cb6ddc6bed3
OBS-Studio-33.0.0-Windows-x64-PDBs.zip: dbda0e1e9967262380e619e071de068809ccae2ccb3f68f52034db9a8276475d
OBS-Studio-33.0.0-Windows-x64.zip: 3369a3ecd67b5669a8a08d77357f87cc786d1fba42fbbd1054d841a69f6271a7
OBS-Studio-33.0.0-macOS-Apple-dSYMs.tar.xz: 6b162ccbafc2eaaee3ced192a851eb5d3d616ad8d54125ce5cd701d26e6939bf
OBS-Studio-33.0.0-macOS-Apple.dmg: b36f4e9da5f2f17c733ba711c8fe0656d6b0cd573cfe96eeb3e68325cffef739
OBS-Studio-33.0.0-macOS-Intel-dSYMs.tar.xz: 997ba41207e9fd7b045b955561cdd5c32b29f12d98ea3ea5a43de7c9edd8f1c7
OBS-Studio-33.0.0-macOS-Intel.dmg: 8524ff428f038573f8905a206841081d3da9ec607063906f7bbfe38d55810c1c

Elon Musk Acquires $1B Stake in CNN's Parent Company

Hacker News

symby.com

2026-10-24 00:42:10

Comments...

Original Article

Full coverage

# musk • billion • invested • stake • cnn • mega

The Western Journal

Conservative

Opinion: This outlet has been categorized as on the conservative spectrum based on its overall brand & content approach. They may prioritize free markets, limited government, rule of law, traditional values, etc. This categorization helps you compare diverse news perspectives. We encourage you to explore their content & form your own opinion.

Elon Musk Acquires $1 Billion Stake in CNN's Parent Company

When the left-wing minions of CNN look up at the mega-bucks Lords of Skydance whose money keeps the troubled network’s parent company afloat, Elon Musk will be looking back down. […]

October 22, 2026, 1:32 pm

The Christian Science Monitor

Conservative

Opinion: This outlet has been categorized as on the conservative spectrum based on its overall brand & content approach. They may prioritize free markets, limited government, rule of law, traditional values, etc. This categorization helps you compare diverse news perspectives. We encourage you to explore their content & form your own opinion.

M is for Musk, and money: One big donor towers over 2026

Elon Musk might be the largest individual spender behind the midterm elections. He also says he’ll give one share of his SpaceX company to every child in…

October 21, 2026, 10:00 am

Daily Kos

Liberal

Opinion: This outlet has been categorized as on the liberal spectrum based on its overall brand & content approach. They may prioritize social equity, regulatory frameworks, public services, environmental concerns, etc. This categorization helps you compare diverse news perspectives. We encourage you to explore their content and & form your own opinion.

Musk’s $1B stake in Skydance fuels bigoted quest to dominate media

Racist billionaire Elon Musk will now have access to an even larger media platform to promote hate, disinformation, and praise of himself after he invested a…

October 22, 2026, 10:00 pm

Gizmodo

Liberal

Opinion: This outlet has been categorized as on the liberal spectrum based on its overall brand & content approach. They may prioritize social equity, regulatory frameworks, public services, environmental concerns, etc. This categorization helps you compare diverse news perspectives. We encourage you to explore their content and & form your own opinion.

Elon Musk Just Invested $1 Billion in the Company Set to Air a Documentary About Him: Report

Alex Gibney says he's been promised that HBO will air his documentary about Musk. That promise is about to face its biggest test.

October 22, 2026, 8:35 pm

Business Insider

Liberal

Opinion: This outlet has been categorized as on the liberal spectrum based on its overall brand & content approach. They may prioritize social equity, regulatory frameworks, public services, environmental concerns, etc. This categorization helps you compare diverse news perspectives. We encourage you to explore their content and & form your own opinion.

Leaked Memo Reveals Leadership Exits After Paramount-WBD Mega Merger

Skydance is consolidating its tech and product team as it decides who should stay on post-merger, a new memo reveals.

Yesterday, 1:25 pm

Indian government sites are serving revoked eMudhra certificates

Lobsters

captnemo.in

2026-10-24 00:06:06

Comments...

Original Article

23 Oct 2026

On 17th October, eight eMudhra intermediate CAs chaining to emSign ECC Root CA - G3 were found to have trivially recoverable private keys . They were revoked the next day, and Mozilla and Chrome are now distrusting the G3 root. Separately, on 19th October eMudhra revoked 9,356 certificates on its unaffected RSA hierarchy (emSign Root CA - G1) with the reason “Superseded”. That batch matches every unexpired certificate missing a certificate-type policy OID required by emSign’s own CP/CPS ( Bug 2082782 ).

On 21st October, MeitY posted this thread :

A security incident concerning eMudhra’s Public Key Infrastructure (PKI) was reported in the public domain. […]

However, some social media accounts are indulging in fear mongering about the impact of this incident. […]

The impact of this incident on Indian websites and applications have been very limited and for a very short interval.

— @GoI_MeitY , 21st October 2026, 16:31 CEST

That last claim is wrong on both counts. The interval wasn’t short: the flawed keys were generated in April 2025, so anyone could have recovered them for 18 months before the report. The impact isn’t limited either: the compromised intermediates barely issued anything, but Mozilla and Chrome are now distrusting the entire G3 root, so eMudhra estimates 30,000 certificates from its unaffected G3 intermediates must be migrated. From what I could see, most of those seem to belong to US universities using eMudhra through InCommon rather than Indian sites.

Meanwhile, the 19th October revocations have left Indian government sites serving revoked certificates days later , including four bodies under MeitY itself: STPI , Bhashini , UIDAI , and the Controller of Certifying Authorities, whose India PKI site is serving a revoked eMudhra certificate. Notably, Controller of Certifying Authorities regulates eMudhra’s CA business in India.

I checked the 8,947 hosts in the IGOD directory of Indian government websites. As of 23rd October, 156 of them are still serving one of these revoked certificates. All of them were revoked between 15:34 and 15:49 CEST on 19th October, and are listed in eMudhra’s CRLs for DV/G2A-1 , OV/G2A-1 , EV/G2A-1 and G1 .

Revocations happen (GoDaddy just revoked 4 lakh certificates), but they are usually accompanied by notifications to subscribers to get them to new valid certificates. I’m not sure if eMudhra is doing any of the sort, now that they don’t care about their TLS business.

The table will be updated with timestamps as cert rotations happen.

Domain	Title	Serial	crt.sh	CRL	Revoked (CEST)	Cert Rotated	Fixed
aaib.gov.in	Aircraft Accident Investigation Bureau	`BE71D53F0F28A74B393572EA6C0C84`	crt.sh	CRL	2026-10-19 15:46:53	Yes	No
accr.ayush.gov.in	Ayush Clinical Case Repository Portal	`B1BBCA8C44E3FB7B046E25B07190A4`	crt.sh	CRL	2026-10-19 15:39:12	Yes	No
aeoindia.gov.in	Indian AEO Portal — Home	`B642938DF18453FE7E7BA715831140`	crt.sh	CRL	2026-10-19 15:40:53	Yes	No
afmc.nic.in	Armed Forces Medical College	`FC7C794C34237225FC3BA9DD133A22`	crt.sh	CRL	2026-10-19 15:42:07	Yes	No
afri.icfre.gov.in	शुष्क वन अनुसंधान संस्थान, भारतीय वानिकी अनुसंधान एवं शिक्षा परिष, पर्यावरण, वन और जलवायु परिवर्तन मंत्रालय, भारत सरकार	`2322014B49FF5673E67753965E5F43`	crt.sh	CRL	2026-10-19 15:35:00	Yes	No
amssdelhi.gov.in	Home \| IMD New Delhi	`2BC7F0601E60EB76C026F65A30FE54`	crt.sh	CRL	2026-10-19 15:48:30	Yes	No
aqcsindia.gov.in	Animal Quarantine and Certification Service	`41E1C73D66F7CF4E3FDC8284B3529F`	crt.sh	CRL	2026-10-19 15:46:31	Yes	No
awbi.gov.in	Animal Welfare Board of India	`2D705A7361282ED5B121C5AC5FD505`	crt.sh	CRL	2026-10-19 15:47:23	Yes	No
ayush.gov.in	Moaayush	`B1BBCA8C44E3FB7B046E25B07190A4`	crt.sh	CRL	2026-10-19 15:39:12	Yes	No
bangalorecustoms.gov.in	BANGALORE CUSTOMS – Guardians of National Security	`6A00E5417F628173A575563D1B063D`	crt.sh	CRL	2026-10-19 15:41:43	Yes	No
bengaluru.stpi.in	सॉफ्टवेयर टेक्नोलॉजी पार्क्स ऑफ इंडिया \| इलेक्ट्रॉनिकी और सूचना प्रौद्योगिकी मंत्रालय,इलेक्ट्रॉनिकी और सूचन भारत सरकार	`A859351FFFD25301AB2FAC0CB93381`	crt.sh	CRL	2026-10-19 15:42:01	Yes	No
bhashini.gov.in	Bhashini	`637ED38A9B7DF622CAD1EE671E62AB`	crt.sh	CRL	2026-10-19 15:46:08	Yes	No
bhavini.nic.in		`4A61B8233B3CE5EE93FF89BC22FAD8`	crt.sh	CRL	2026-10-19 15:43:48	Yes	No
bhubaneswar.stpi.in	सॉफ्टवेयर टेक्नोलॉजी पार्क्स ऑफ इंडिया \| इलेक्ट्रॉनिकी और सूचना प्रौद्योगिकी मंत्रालय,इलेक्ट्रॉनिकी और सूचन भारत सरकार	`A859351FFFD25301AB2FAC0CB93381`	crt.sh	CRL	2026-10-19 15:42:01	Yes	No
boi.gov.in	Redirecting...	`3293E2292B4BF0F2C374B91917F0CC`	crt.sh	CRL	2026-10-19 15:48:34	Yes	No
bopter.gov.in	Home \| BOARD OF PRACTICAL TRAINING	`777F4FE98CC6EA0BA57A902393C914`	crt.sh	CRL	2026-10-19 15:42:26	Yes	No
cau.ac.in	Official Website – – CAU Lamphelpat, Manipur	`83BFA833BB880E6AEBDFCF4858CF42`	crt.sh	CRL	2026-10-19 15:42:36	Yes	No
ccobz.gov.in	Chief Commissioner Customs, Central Excise & Central GST, Bhopal Zone, Bhopal	`C24E18421602BE7DA73B7B18F0FCFE`	crt.sh	CRL	2026-10-19 15:42:43	Yes	No
censusindia.gov.in		`E3F7DF34FA10299085A5AC757BE363`	crt.sh	CRL	2026-10-19 15:48:23	Yes	No
cept.gov.in		`DBEF12129EA608A774173BCB8559FB`	crt.sh	CRL	2026-10-19 15:41:23	No	No
cgat.gov.in	Central Administrative Tribunal	`8F46CFC68C3DBC3DD2E20F65C7913B`	crt.sh	CRL	2026-10-19 15:44:58	Yes	No
cgvidhansabha.gov.in	Official Website of Chhattisgarh Legislative Assembly	`4D269C2443B932B31150DAF0877108`	crt.sh	CRL	2026-10-19 15:44:19	Yes	No
chandigarhpolice.gov.in		`68C40913299B1DCC63A7F9ACAF6B08`	crt.sh	CRL	2026-10-19 15:40:00	Yes	No
chdfood.gov.in		`237DC0CB51FBCE0069ABB2615D6C55`	crt.sh	CRL	2026-10-19 15:43:31	Yes	No
chdpr.gov.in	Home \| Department of Puplic Relations \| Chandigarh Administration	`18DBF4B4C37226A2FB5800975B06E7`	crt.sh	CRL	2026-10-19 15:46:49	Yes	No
cifnet.gov.in	Central Institute of Fisheries Nautical and Engineering Training	`113F90959827D19ABFA13E7D12209D`	crt.sh	CRL	2026-10-19 15:41:52	Yes	No
cipranchi.nic.in	Home \| Central Institute of Psychiatry Ranchi, Ministry of Health and Family Welfare, Government of Jharkhand, India	`FAF6491ED389D22919D7A054B61782`	crt.sh	CRL	2026-10-19 15:41:22	Yes	No
cluster.dcmsme.gov.in	CLUSTER DEVELOPMENT PROGRAMME	`467D405A4B1473D6602E139F27D0B`	crt.sh	CRL	2026-10-19 15:40:59	Yes	No
cmet.gov.in	Home \| CENTRE FOR MATERIALS FOR ELECTRONICS TECHNOLOGY (C-MET)	`AE10573AEE7A7754A57218F56488A3`	crt.sh	CRL	2026-10-19 15:41:57	Yes	No
copyright.gov.in	IP India - Intellectual Property India \| Government of India	`A6FEF974496904F989884B1FB2A437`	crt.sh	CRL	2026-10-19 15:42:45	Yes	No
cpcb.nic.in	CPCB \| Central Pollution Control Board	`203F34509E5C924809C2FF99D953BB`	crt.sh	CRL	2026-10-19 15:40:54	Yes	No
ctb.rajbhasha.gov.in	केंद्रीय अनुवाद ब्यूरो, Central Translation Bureau, Department of official Language , Government of India	`670E7E2D774953D7A6365BC5FA15BE`	crt.sh	CRL	2026-10-19 15:46:25	Yes	No
ctri.nic.in	Clinical Trials Registry - India (CTRI)	`3F2C233B65900D9E044C2C58646E12`	crt.sh	CRL	2026-10-19 15:48:33	Yes	No
cup.edu.in	Home 2 \| Central University of Punjab	`A47D35806CD0B657B23DB4EF443BE5`	crt.sh	CRL	2026-10-19 15:45:06	No	No
dcmsme.gov.in	DCMSME	`F47A3A9E08146B31BCB91D9E3DBC06`	crt.sh	CRL	2026-10-19 15:46:49	Yes	No
dfpd.gov.in	Official Website of Department of Food and Public Distribution, Ministry of Consumer Affairs, Food and Public Distributi	`AE610C861C05503CAD2B087CAC4EA7`	crt.sh	CRL	2026-10-19 15:44:53	No	No
dghindia.gov.in	Home \| Directorate General of Hydrocarbons	`B34E569CD5F91715FD8CF30152A841`	crt.sh	CRL	2026-10-19 15:47:53	Yes	No
dgt.gov.in	मुखपृष्ठ \| प्रशिक्षण महानिदेशालय, DIRECTORATE GENERAL OF TRAINING	`2A370B1A40BDA535F3C0614204053`	crt.sh	CRL	2026-10-19 15:47:37	No	No
dmeo.gov.in	\| DMEO \| Development Monitoring and Evaluation Office \| Attached office under NITI Aayog	`6305E7DBB5DDA97753F7B6FED3BC62`	crt.sh	CRL	2026-10-19 15:44:40	Yes	No
dse.ladakh.gov.in	Department Of School Education UT Ladakh \| Ladakh \| Education \| GoI	`1D59844AC5EE2AAF3FDF708F63DEC5`	crt.sh	CRL	2026-10-19 15:43:55	Yes	No
eabkari.arunachal.gov.in	Arunachal Pradesh State Excise	`7E7A8AA6E2F2C390FA12BD99324837`	crt.sh	CRL	2026-10-19 15:41:02	Yes	No
eadhiyachan.pariksha.nic.in	e-Adhiyachan Uttar Pradesh	`37F80AFB1DE0AA346EF6D2AF3F3EF6`	crt.sh	CRL	2026-10-19 15:47:07	Yes	No
eawas.chd.gov.in	e-Awas Chandigarh Administration Portal	`FDE471E30A72138B8A63BA01D4828B`	crt.sh	CRL	2026-10-19 15:46:30	Yes	No
edustud.nic.in	Student Module, Education Department, GNCT of Delhi	`C74004E309D9D3D51AC3E8194923CA`	crt.sh	CRL	2026-10-19 15:39:38	Yes	No
egazette.ladakh.gov.in	eGazette Ladakh	`1D59844AC5EE2AAF3FDF708F63DEC5`	crt.sh	CRL	2026-10-19 15:43:55	Yes	No
epostr.gov.in	SMART-PDS	`58044C4D111BBBF56E4BB36B11285C`	crt.sh	CRL	2026-10-19 15:47:22	Yes	No
eru.isical.ac.in	ISI Unit	`B03CFC438DF8AA19A5A39193636772`	crt.sh	CRL	2026-10-19 15:41:06	Yes	No
fci.gov.in	Food Corporation of India : Food, Food Storage, Procurement, Grain Sales, Food Grains	`B5AB041A6C2524629E4CDFB3E96167`	crt.sh	CRL	2026-10-19 15:44:25	Yes	No
fri.icfre.gov.in	वन अनुसंधान संस्थान, देहरादून	`2322014B49FF5673E67753965E5F43`	crt.sh	CRL	2026-10-19 15:35:00	Yes	No
fsi.nic.in	भारतीय वन सर्वेक्षण	`51E54C58C10860B2393485900EC53F`	crt.sh	CRL	2026-10-19 15:44:23	Yes	No
fssai.gov.in	FSSAI - Food Safety and Standards Authority of India	`9DB1C0AA5435ED1366F6D3BCC2E08F`	crt.sh	CRL	2026-10-19 15:48:03	Yes	No
gandhinagar.stpi.in	सॉफ्टवेयर टेक्नोलॉजी पार्क्स ऑफ इंडिया \| इलेक्ट्रॉनिकी और सूचना प्रौद्योगिकी मंत्रालय,इलेक्ट्रॉनिकी और सूचन भारत सरकार	`A859351FFFD25301AB2FAC0CB93381`	crt.sh	CRL	2026-10-19 15:42:01	Yes	No
gectcr.ac.in	Government Engineering College Thrissur	`2C29529C0D5F45B794A4AD1AE17F4F`	crt.sh	CRL	2026-10-19 15:39:27	Yes	No
ghcitanagar.gov.in	Gauhati High Court Itanagar Permanent Bench	`C24A827029F0C8234BDA3A97FEF7E4`	crt.sh	CRL	2026-10-19 15:44:42	Yes	No
girg.gov.in	NITI AAYOG	`6305E7DBB5DDA97753F7B6FED3BC62`	crt.sh	CRL	2026-10-19 15:44:40	Yes	No
gmch.gov.in	Home \| Government Medical College & Hospital , Sector 32, Chandigarh, India	`B3887338517A57290A22CAE1EEA00`	crt.sh	CRL	2026-10-19 15:41:03	Yes	No
gstdelhizone.gov.in	GST Delhi Zone	`ACF6CDB77BD39A99462C21FFB8A261`	crt.sh	CRL	2026-10-19 15:41:16	Yes	No
guwahati.stpi.in	सॉफ्टवेयर टेक्नोलॉजी पार्क्स ऑफ इंडिया \| इलेक्ट्रॉनिकी और सूचना प्रौद्योगिकी मंत्रालय,इलेक्ट्रॉनिकी और सूचन भारत सरकार	`A859351FFFD25301AB2FAC0CB93381`	crt.sh	CRL	2026-10-19 15:42:01	Yes	No
heliservice.ladakh.gov.in	Ladakh Heli Booking Services	`1D59844AC5EE2AAF3FDF708F63DEC5`	crt.sh	CRL	2026-10-19 15:43:55	Yes	No
hfri.icfre.gov.in	हिमालयन वन अनुसंधान संस्थान, भारतीय वानिकी अनुसंधान एवं शिक्षा परिषद , पर्यावरण, वन और जलवायु परिवर्तन मंत्रालय के तहत ए	`2322014B49FF5673E67753965E5F43`	crt.sh	CRL	2026-10-19 15:35:00	Yes	No
hyderabad.stpi.in	सॉफ्टवेयर टेक्नोलॉजी पार्क्स ऑफ इंडिया \| इलेक्ट्रॉनिकी और सूचना प्रौद्योगिकी मंत्रालय,इलेक्ट्रॉनिकी और सूचन भारत सरकार	`A859351FFFD25301AB2FAC0CB93381`	crt.sh	CRL	2026-10-19 15:42:01	Yes	No
hydro.imd.gov.in		`9FE91104ABBA87A8673100441968C1`	crt.sh	CRL	2026-10-19 15:47:37	Yes	No
icfre.gov.in	मुख पृष्ठ \| भारतीय वानिकी अनुसंधान एवं शिक्षा परिषद	`2322014B49FF5673E67753965E5F43`	crt.sh	CRL	2026-10-19 15:35:00	Yes	No
ifgtb.icfre.gov.in	Welcome to Institute of Forest Genetics and Tree Breeding, Coimbatore	`2322014B49FF5673E67753965E5F43`	crt.sh	CRL	2026-10-19 15:35:00	Yes	No
igrua.gov.in	Official Website of Indira Gandhi Rashtriya Uran Akademi under the Ministry of Civil Aviation, Government of India	`B147CA330923CE4A59B43297973E6E`	crt.sh	CRL	2026-10-19 15:39:17	Yes	No
ihmshimla.ac.in	IHM Shimla : Home	`2F2737AA0F241427F9E20FB4FEC3E7`	crt.sh	CRL	2026-10-19 15:45:15	Yes	No
indianrailways.gov.in	Ministry of Railways	`F4AEB6040B5E305B00975A567495E`	crt.sh	CRL	2026-10-19 15:42:45	Yes	No
indiascienceandtechnology.gov.in	Home \| India Science, Technology & Innovation - ISTI Portal	`54FA02C3BF4E55F644494133CB9BD6`	crt.sh	CRL	2026-10-19 15:39:21	Yes	No
iwst.icfre.gov.in	IWST में आपका स्वागत है	`2322014B49FF5673E67753965E5F43`	crt.sh	CRL	2026-10-19 15:35:00	Yes	No
jeevanpramaan.gov.in		`B2A8B06F41186582EA49AE1B0D6087`	crt.sh	CRL	2026-10-19 15:41:45	Yes	No
jkhighcourt.nic.in	Jammu & Kashmir and Ladakh High Court	`EDA983F07F3D729CB10AE4FB73DA14`	crt.sh	CRL	2026-10-19 15:42:45	Yes	No
jnport.gov.in	JNPA	`6038621DED22B6A0A382A8572AB0EC`	crt.sh	CRL	2026-10-19 15:46:52	Yes	No
judicialacademy.nic.in	Delhi Judicial Academy	`41E5CA6488B00FD16FEABC09A9F1EE`	crt.sh	CRL	2026-10-19 15:47:11	Yes	No
kochimetro.org	Kochi Metro Rail Ltd.	`656877F670E9BA2B62AC64C8B216C`	crt.sh	CRL	2026-10-19 15:34:06	Yes	No
kolkata.stpi.in	सॉफ्टवेयर टेक्नोलॉजी पार्क्स ऑफ इंडिया \| इलेक्ट्रॉनिकी और सूचना प्रौद्योगिकी मंत्रालय,इलेक्ट्रॉनिकी और सूचन भारत सरकार	`A859351FFFD25301AB2FAC0CB93381`	crt.sh	CRL	2026-10-19 15:42:01	Yes	No
labour.and.nic.in	Labour \| Home	`64CF8900F6B8332F83EC3A66A0FFCD`	crt.sh	CRL	2026-10-19 15:39:58	Yes	No
localbodies.up.nic.in	Home : उत्तर प्रदेश स्थानीय निकाय निदेशालय : GoUP	`F3B4C774B1B4DC1D95C5FAC881A4C3`	crt.sh	CRL	2026-10-19 15:40:17	Yes	No
mahaforest.gov.in	मुख्यपृष्ठ - महाराष्ट्र वन विभाग	`A13E1D3DA32C0467B74FE2EAE6BCEA`	crt.sh	CRL	2026-10-19 15:47:08	Yes	No
mmrda.maharashtra.gov.in	Welcome \| The Mumbai Metropolitan Region Development Authority (MMRDA) \| मुंबई महानगर प्रदेश विकास प्राधिकरण	`BCFBDE00E02144A78936822AD4268C`	crt.sh	CRL	2026-10-19 15:40:31	Yes	No
mmtclimited.gov.in	एम एम टी सी लिमिटेड: एम एम टी सी लिमिटेड	`5C528669C77BC3774DAE71BDE428B0`	crt.sh	CRL	2026-10-19 15:46:51	Yes	No
mofpi.gov.in		`8E3EFCFA2F8FE2C17800C5EA258CC4`	crt.sh	CRL	2026-10-19 15:47:08	Yes	No
mopng.gov.in	Home \| पेट्रोलियम और प्राकृतिक गैस मंत्रालय \| Government of India	`FA49AB8B3C400798B48F046E3FB542`	crt.sh	CRL	2026-10-19 15:45:02	Yes	No
msmc.gov.in	MSMC \| Maharashtra State Mining Corporation Ltd.	`41DF9F321BA5B129BCF8ED6CF461B5`	crt.sh	CRL	2026-10-19 15:41:04	No	No
ncpcr.gov.in	National Commission for Protection of Child Rights	`644D80B011B51CB40D9F6CB9CE532A`	crt.sh	CRL	2026-10-19 15:46:40	Yes	No
ncrb.gov.in	Home \| National Crime Records Bureau	`76D4AA23D6B4E6D198884EF9A6B205`	crt.sh	CRL	2026-10-19 15:41:05	Yes	No
ncrpb.nic.in	NCRPB - Government of India	`748E3C9F8C959CB6617CD68753C8A`	crt.sh	CRL	2026-10-19 15:40:37	Yes	No
ncvet.gov.in		`CFF158603E492774A2328C4A7EF1C2`	crt.sh	CRL	2026-10-19 15:44:23	Yes	No
nfscnagpur.nic.in	National Fire Service College, Nagpur	`8808A1465CAACD5E21F3BA6D37A4F7`	crt.sh	CRL	2026-10-19 15:42:39	Yes	No
ngodarpan.gov.in	NPODARPAN	`CE780C04FFAD2A49A45F6FF319EE9B`	crt.sh	CRL	2026-10-19 15:47:23	Yes	No
nhidcl.com	Home Page \| National Highways & Infrastructure Development Corporation Ltd.	`28325D2CBAF26203061511878E0EC0`	crt.sh	CRL	2026-10-19 15:37:05	Yes	No
niepa.ac.in	National Institute of Educational Planning and Administration \| NIEPA	`6CCD27A78732FCC9236D30DA939260`	crt.sh	CRL	2026-10-19 15:41:14	Yes	No
niftem.ac.in	NIFTEM - National Institute of Food Technology Entrepreneurship and Management	`33BCBA0D105B57F72680A11AE5DFFA`	crt.sh	CRL	2026-10-19 15:39:19	Yes	No
nipgr.ac.in		`292F9AB99D89E273E661DAA68B42CF`	crt.sh	CRL	2026-10-19 15:46:56	Yes	No
nma.gov.in	National Monument Authority	`DF74255868230C29E8FE034802EB8`	crt.sh	CRL	2026-10-19 15:39:33	Yes	No
nqr.gov.in	National Qualification Register	`44A1682E603574A6C993362B8E3197`	crt.sh	CRL	2026-10-19 15:47:22	Yes	No
nstidehradun.dgt.gov.in	Welcome to National Skill Training Institute \| National Skill Training Institute	`2A370B1A40BDA535F3C0614204053`	crt.sh	CRL	2026-10-19 15:47:37	Yes	No
nstiwmumbai.dgt.gov.in	Welcome to National Skill Training Institute(W) \| National Skill Training Institute(W)	`2A370B1A40BDA535F3C0614204053`	crt.sh	CRL	2026-10-19 15:47:37	Yes	No
nstiwshimla.dgt.gov.in	Welcome to National Skill Training Institute(W) \| National Skill Training Institute(W)	`2A370B1A40BDA535F3C0614204053`	crt.sh	CRL	2026-10-19 15:47:37	Yes	No
nstiwtura.dgt.gov.in	Welcome to National Skill Training Institute(W) \| National Skill Training Institute(W)	`2A370B1A40BDA535F3C0614204053`	crt.sh	CRL	2026-10-19 15:47:37	Yes	No
nth.gov.in	राष्ट्रीय परीक्षण शाला	`17349F7709F20A841BD25E8D0E099A`	crt.sh	CRL	2026-10-19 15:44:20	Yes	No
ociservices.gov.in	Redirect	`3293E2292B4BF0F2C374B91917F0CC`	crt.sh	CRL	2026-10-19 15:48:34	Yes	No
pbmc.gov.in	Home \| Sri Vijaya Puram Municipal Council \| Digital India Initiative- Digital e-Governance	`AC9A9733A802417F75922E4E08E9B5`	crt.sh	CRL	2026-10-19 15:44:17	Yes	No
peso.gov.in		`2F75FAC2C65426FF5FC68BB5E9B0EF`	crt.sh	CRL	2026-10-19 15:46:20	Yes	No
police.ladakh.gov.in	Responsive team section	`1D59844AC5EE2AAF3FDF708F63DEC5`	crt.sh	CRL	2026-10-19 15:43:55	Yes	No
ptcmysore.gov.in	Welcome To Postal Training Centre - Mysore	`DBEF12129EA608A774173BCB8559FB`	crt.sh	CRL	2026-10-19 15:41:23	No	No
punjabrajbhavan.gov.in	Lok Bhavan, Punjab - The Official Website	`7E0DAD2B96FAAD8D1E8A2E541C1FD3`	crt.sh	CRL	2026-10-19 15:48:27	Yes	No
rdsdeandhrapradesh.dgt.gov.in	Welcome to Regional Directorate of Skill Development & Entrepreneurship \| Regional Directorate of Skill Development & En	`2A370B1A40BDA535F3C0614204053`	crt.sh	CRL	2026-10-19 15:47:37	Yes	No
rdsdemaharashtra.dgt.gov.in	Welcome to Regional Directorate of Skill Development & Entrepreneurship \| Regional Directorate of Skill Development & En	`2A370B1A40BDA535F3C0614204053`	crt.sh	CRL	2026-10-19 15:47:37	Yes	No
rdsdetamilnadu.dgt.gov.in	Welcome to Regional Directorate of Skill Development & Entrepreneurship \| Regional Directorate of Skill Development & En	`2A370B1A40BDA535F3C0614204053`	crt.sh	CRL	2026-10-19 15:47:37	Yes	No
rdsdetelangana.dgt.gov.in	Welcome to Regional Directorate of Skill Development & Entrepreneurship \| Regional Directorate of Skill Development & En	`2A370B1A40BDA535F3C0614204053`	crt.sh	CRL	2026-10-19 15:47:37	Yes	No
rfri.icfre.gov.in	Welcome to Rain Forest Research Institute, Jorhat Assam	`2322014B49FF5673E67753965E5F43`	crt.sh	CRL	2026-10-19 15:35:00	Yes	No
scholarships.gov.in	NSP : National Scholarship Portal	`85603881362DE427F5FB871517DAC9`	crt.sh	CRL	2026-10-19 15:45:58	Yes	No
sdclindia.com	SAGARMALA FINANCE CORPORATION LIMITED	`5944DC637D19DCEF4A096C7E2AB62D`	crt.sh	CRL	2026-10-19 15:35:01	No	No
socialwelfare.ladakh.gov.in	Home \| Social & Tribal Welfare, Ladakh	`1D59844AC5EE2AAF3FDF708F63DEC5`	crt.sh	CRL	2026-10-19 15:43:55	Yes	No
sportsauthorityofindia.nic.in	Sports Authority of India	`A1AA8A5C62EF9D7B6EDED8EFE68904`	crt.sh	CRL	2026-10-19 15:39:25	Yes	No
sportsdeptt.chd.gov.in	Homepage	`3B3738256A4ECB29CA34B830B069AE`	crt.sh	CRL	2026-10-19 15:48:34	Yes	No
ssifs.mea.gov.in	Home \| Sushma Swaraj Institute of Foreign Service	`BC9473CFB1E550C074EDE686A7921E`	crt.sh	CRL	2026-10-19 15:41:52	Yes	No
steel.gov.in	Home \| Steel Ministry	`B2A6383371B0727E55010E63E568F1`	crt.sh	CRL	2026-10-19 15:39:43	No	No
swcs.coal.gov.in	Ministry of Coal	`A069C64D00A90631E7EF05EC7E5AC0`	crt.sh	CRL	2026-10-19 15:46:45	Yes	No
tfri.icfre.gov.in	ICFRE - Tropical Forest Research Institute	`2322014B49FF5673E67753965E5F43`	crt.sh	CRL	2026-10-19 15:35:00	Yes	No
thiruvananthapuram.stpi.in	सॉफ्टवेयर टेक्नोलॉजी पार्क्स ऑफ इंडिया \| इलेक्ट्रॉनिकी और सूचना प्रौद्योगिकी मंत्रालय,इलेक्ट्रॉनिकी और सूचन भारत सरकार	`A859351FFFD25301AB2FAC0CB93381`	crt.sh	CRL	2026-10-19 15:42:01	Yes	No
ucil.gov.in		`6119BC75CF8FD6E3326E21158C906`	crt.sh	CRL	2026-10-19 15:47:36	Yes	No
udyamregistration.gov.in	Udyam Registration : Zero cost, No Fee and Free Registration of MSMEs. This is official website of Govt. of India, Minis	`AE8F146BA8BEDD73B722E445B2326A`	crt.sh	CRL	2026-10-19 15:43:08	Yes	No
udyogaadhaar.gov.in	Udyam Registration : Zero cost, No Fee and Free Registration of MSMEs. This is official website of Govt. of India, Minis	`AE8F146BA8BEDD73B722E445B2326A`	crt.sh	CRL	2026-10-19 15:43:08	Yes	No
videshapps.gov.in	Under Maintenance	`1F6ED2550F9B8B978AF4259003FD24`	crt.sh	CRL	2026-10-19 15:48:21	Yes	No
vijayawadapost.gov.in	Department of Posts: Andhra Pradesh Postal Circle	`DBEF12129EA608A774173BCB8559FB`	crt.sh	CRL	2026-10-19 15:41:23	No	No
www.aees.gov.in	परमाणु ऊर्जा शिक्षा सोसायटी उज्जवल भविष्य का निर्माण, परमाणु दर परमाणु	`1EF96558E516836EED93E8957CE7B4`	crt.sh	CRL	2026-10-19 15:41:23	Yes	No
www.arunachalplan.gov.in	Department Of Planning, Investment & Finance \| Official Website Of Planning Finance & Investment, Arunachal Pradesh	`39A45917205EC31CDFED167FA6B467`	crt.sh	CRL	2026-10-19 15:41:44	Yes	No
www.cci.gov.in	Competition Commission of India, Government of India	`92A96FD2203AAF3434732F64DBCF13`	crt.sh	CRL	2026-10-19 15:47:04	Yes	No
www.chdeducation.gov.in	Department of Education	`EC38656B11A971749E9BFC1CC13277`	crt.sh	CRL	2026-10-19 15:41:21	Yes	No
www.chennaiport.gov.in	Chennai Port Authority	`7D44B17206822FDD2BF58C4FC39844`	crt.sh	CRL	2026-10-19 15:43:24	Yes	No
www.cmeri.res.in		`4D281FFB6BA4BE89D1E5D0BF39D215`	crt.sh	CRL	2026-10-19 15:39:17	Yes	No
www.coa.gov.in	Council of Architecture	`2DF370EC26FEC2D1FB2F0A1B977836`	crt.sh	CRL	2026-10-19 15:43:53	No	No
www.cooperation.gov.in	Home Page \| Ministry of Cooperation	`7D787E2AC45266CAABCABDFAF8902B`	crt.sh	CRL	2026-10-19 15:45:00	Yes	No
www.csircmc.res.in	CSIR Madras Complex - Goverment of India	`84A539E33B991B790BA3A7AFC4E546`	crt.sh	CRL	2026-10-19 15:43:04	Yes	No
www.cstaricalcutta.gov.in	केंद्रीय कर्मचारी प्रशिक्षण एवं अनुसंधान संस्थान \| प्रशिक्षण महानिदेशालय	`DD909117906245067A87EF6AAAA47A`	crt.sh	CRL	2026-10-19 15:46:31	Yes	No
www.derc.gov.in	Home \| DELHI ELECTRICITY REGULATORY COMMISSION	`EB0C8E86A76486393C8953B9D2F14E`	crt.sh	CRL	2026-10-19 15:44:41	Yes	No
www.eicindia.gov.in	Export Inspection Council \| Ministry of Commerce & Industry, GOI	`96945032057E6557D4955D9CBFFD04`	crt.sh	CRL	2026-10-19 15:45:07	No	No
www.greentribunal.gov.in	National Green Tribunal	`149457EA900A2E52A41A1E907C5B23`	crt.sh	CRL	2026-10-19 15:43:18	Yes	No
www.ikm.gov.in		`179C53346CB33284351730DF6F8845`	crt.sh	CRL	2026-10-19 15:41:11	Yes	No
www.isea.gov.in	Information Security Education and Awareness	`EFE376D99C80989F7C72E21ECB525A`	crt.sh	CRL	2026-10-19 15:46:19	Yes	No
www.isid.ac.in	Indian Statistical Institute, Delhi Center	`28AA611E44024991B492E307BA06E8`	crt.sh	CRL	2026-10-19 15:43:09	Yes	No
www.karnatakapost.gov.in	Karnataka Postal Circle	`4B8C403761F01A166458E7D2383D9B`	crt.sh	CRL	2026-10-19 15:43:05	Yes	No
www.kribhco.net	Welcome to KRIBHCO	`660074C4573712A4E7A1A6E0DA43E8`	crt.sh	CRL	2026-10-19 15:36:53	Yes	No
www.muhs.ac.in	Welcome to MUHS	`BBA63A41D169863EF2432010207855`	crt.sh	CRL	2026-10-19 15:44:37	Yes	No
www.nbri.res.in	एनबीआरआई \| सीएसआईआर-राष्ट्रीय वनस्पति अनुसंधान संस्थान	`8F1F939CB3D46F0062E9EE6450EA03`	crt.sh	CRL	2026-10-19 15:40:38	No	No
www.nepamills.co.in	NEPA LIMITED	`DCBB7CC39FF74BF7DD5A736ADF8D57`	crt.sh	CRL	2026-10-19 15:39:19	Yes	No
www.nfc.gov.in	Nuclear Fuel Complex, Department of Atomic Energy, India	`C805EAE2EDA2C95DA508AB2FD8B72E`	crt.sh	CRL	2026-10-19 15:44:42	Yes	No
www.nicdc.in	NICDC	`C2CF8D3466346FC4F95E7CDD0DB1E3`	crt.sh	CRL	2026-10-19 15:45:01	Yes	No
www.psa.gov.in	Home \| Principal Scientific Adviser	`ECC39807FB1D5E84B053518079B95B`	crt.sh	CRL	2026-10-19 15:43:31	Yes	No
www.recindia.nic.in	REC LIMITED	`148A280AD22BF41685A8FB000D4BEC`	crt.sh	CRL	2026-10-19 15:42:25	Yes	No
www.stpi.in	सॉफ्टवेयर टेक्नोलॉजी पार्क्स ऑफ इंडिया \| इलेक्ट्रॉनिकी और सूचना प्रौद्योगिकी मंत्रालय,इलेक्ट्रॉनिकी और सूचन भारत सरकार	`A859351FFFD25301AB2FAC0CB93381`	crt.sh	CRL	2026-10-19 15:42:01	Yes	No
www.swavlambancard.gov.in	UDID	`218C7A3C43A2142BBE8420296736A4`	crt.sh	CRL	2026-10-19 15:43:15	Yes	No
www.tec.gov.in		`7017ED16CF72FFC9C6E8D396AC8ADC`	crt.sh	CRL	2026-10-19 15:44:19	Yes	No
www.trai.gov.in	Home \| Telecom Regulatory Authority of India \| Government of India	`ABF162296274B8F5A296691118CA3A`	crt.sh	CRL	2026-10-19 15:43:40	Yes	No
yoga.ayush.gov.in	Yoga	`B1BBCA8C44E3FB7B046E25B07190A4`	crt.sh	CRL	2026-10-19 15:39:12	Yes	No

Published on October 23, 2026

battledrones v14: Compass Rose, a four player map

Simon Willison

simonwillison.net

2026-10-23 23:59:57

Release: battledrones v14: Compass Rose, a four player map I added four player online mode to Battledrones - previous maps were limited to two. Here's the initial prompt I used: Add a new map for a four player battle - four way rotational symmetry, up to four AI players, works with the Web...

Original Article

I added four player online mode to Battledrones - previous maps were limited to two.

Here's the initial prompt I used:

Add a new map for a four player battle - four way rotational symmetry, up to four AI players, works with the WebSocket non-audio based multiplayer mode so up to four human players can join (any spare slots use AI)

Claude Opus 4.5 added a new map called "Compass Rose" and modified the WebSockets multiplayer network code to support up to four players for that map, joining via share links or QR codes.

The new map does indeed look a bit like a rose - it uses the cold and ice biome. Also shown are purple robots battling on the map.

The new teams use robots themed in purple and green, joining the existing blue and red designs. You can preview those colors in the updated model browser .

Here's a replay link to watch a four way AI battle with the "Goliath Armada" mutator turned on, where each side starts with four giant Goliath mech units.

How close can pure functional programming get to C?

Hacker News

rtfeldman.com

2026-10-23 23:43:54

Comments...

Original Article

October 22, 2026

In Why Lean is Faster Than Rust , the author shares an impressive result: a DEFLATE compression library written in Lean 4 , a functional programming language and proof assistant, outperforming an equivalent Rust package that crates.io says has been downloaded over a billion times. From the article:

lean-zip beats every single compression level miniz_oxide provides, i.e. we're capable of providing the same compression at higher throughput. At its fastest setting we're 15% quicker and the output is 8.8% smaller.

However, the article also notes that while they managed to surpass Rust's miniz_oxide , they were no match for the end boss of DEFLATE performance: libdeflate , written in C.

lean-zip is certainly not the best here: libdeflate unsurprisingly blows it out of the water (unsurprisingly because this is a very carefully tuned implementation using architecture-specific SIMD, that we can't touch in Lean).

Enter Roc , a functional programming language (but not a theorem prover) with an explicit focus on runtime performance.

Roc's tagline is "Fast, Friendly, Functional," and Fast comes first because both running fast and compiling fast have always been central goals. Roc is not a mature language (it's still weeks away from its first numbered release, 0.1.0), and its nascent package ecosystem has had almost no optimization work done on it. Still, between its language design, longstanding optimizations , and brand-new compiler implementation , I figured Roc already had enough of a foundation in place to take on the champ: libdeflate.

So I spent a bunch of time grinding through performance optimizations on roc-deflate , a package Niclas Ahden wrote (and uses in paid production work ) for DEFLATE compression. I didn't expect to beat libdeflate's performance across the board, but I wanted to see how close it could get on the non-streaming APIs (as roc-deflate hasn't implemented streaming yet), using the classic Silesia corpus for benchmarking and verifying that it produced identical outputs.

Under 10% Slower

Here's where the benchmarks stand today, running on the 2021 M1 MacBook Pro where I did all the optimization work, as well as on an AMD Ryzen 9 3900X Ubuntu machine for an x64 comparison.

roc-deflate ran these 144 benchmarks slower on average than libdeflate, in the median case 8.9% slower on the Ryzen 3900X, and 2.6% on the M1 MacBook Pro.

Compression on Silesia corpus

M1 MacBook Pro Ryzen 3900X Ubuntu

MB/s

libdeflate roc-deflate

Compression Level

MB/s

libdeflate roc-deflate

Compression Level

So while we didn't outperform the champ on average, a median slowdown percentage in the single digits compared to such a carefully-tuned SIMD-powered C library is wild. It's frankly not a result I knew was achievable going in, since Roc is a functional language with automatic memory management racing against code that doesn't have to do bounds checks. (Bounds checks have a cost, but then again, the last time a skipped bounds check in C compression code led to a major Remote Code Execution vulnerability was yesterday .)

The graph shows more detail than just the median gap. On the worst-case inputs, roc-deflate was 18% slower than libdeflate, but on the best-case inputs, roc-deflate was slightly over 18% faster! That's not because Roc has some magical optimization that C can't access; it's just that the two implementations are different, and although on average roc-deflate is slower, for certain inputs it happens to be faster. So while it's possible to get a speedup by switching from libdeflate to roc-deflate, you shouldn't expect it on average.

To be clear, C's performance ceiling is higher than Roc's. For any input where roc-deflate currently outperforms libdeflate, C code can close that gap. The reverse is not true; Roc code is memory-safe, does automatic reference counting, checks bounds, and supports no Rust-style unsafe to opt out of any of that. These properties give Roc code stronger safety guarantees than code written in C, Zig, Rust, and other languages that allow full access to the hardware—and the price it pays for those guarantees is a lower performance ceiling.

Obviously we can't extrapolate from this one result about how close Roc can get to C in the general case, but now something has been demonstrated that nobody knew was achievable before. As far as I know, this is the most optimization effort that has been put into any Roc package to date, so how close others can get to this result is a complete unknown right now. So while I'm thrilled by this result, I'm fully aware that we won't know how well it generalizes until we've optimized a wider sample of real-world Roc code bases!

What the Performance Gap Buys

An obvious question is "Why settle for any amount slower?" If you could get C levels of performance, why not use libdeflate itself and close that remaining gap?

A pure-Roc implementation has several advantages over a pure-C one:

Memory safety. Roc code is fully memory-safe and has no language primitives that let you opt out of it. This code is only able to approach C levels of performance because Roc's optimization pipeline determined that many bounds checks and reference counting operations were provably safe to optimize away. Compression packages written in pure Roc don't have access to the unchecked memory operation that caused yesterday's Brotli Remote Code Execution vulnerability .
No side effects. Roc's type system infers which functions are pure and which can perform side effects. Pure functions' types use a thin arrow, like Bool -> Bool , whereas effectful functions use a thick arrow, like Bool => Bool . (As with memory safety, Roc enforces this and supports no way to opt out.) So when you see that roc-deflate's functions have only thin arrows in their annotations, you know they really are pure functions.
Supply-Chain Security. Roc does not have an arbitrary FFI , meaning you know for sure that roc-deflate's pure functions can't even attempt to do I/O or access arbitrary memory. Given the explosion in supply chain attacks , it's valuable to know that the damage a malicious actor can do with a pure function in a compromised Roc package is limited to returning the wrong value, crashing, or wasting system resources. Roc packages also don't support build scripts, which was the vector used to successfully compromise the popular Rust arrayref package two months ago.
Portability. Roc pure functions are designed to be extremely deterministic: they always return the same values when given the same arguments—not just when run on the same machine, but also on any target you compile that code to. (The functions may also crash or fail to terminate, but that behavior should also be deterministic across targets.) The only way a Roc pure function should be expected to behave differently when run on two different systems is if one system runs out of memory mid-execution.

If any of these guarantees don't hold in practice, it can only be due to a defect in Roc's compiler, the platform the application is running on, or the underlying hardware. So when you see in roc-deflate's docs that the entire package is 100% pure functions, you can be confident you are getting all of the above properties from everything the package has to offer. The type system enforces it!

The reason we've been working so hard on all this might become clearer if you look at the proposition in reverse: would you give up guaranteed memory safety, guaranteed lack of side effects, guaranteed deterministic behavior across all targets, and the security benefits of having no exploitable build scripts in packages...for an average speedup percentage in the single digits?

That answer can legitimately vary by use case—Roc's own compiler, for example, wants the maximum performance the hardware can deliver —but I bet a lot of people reading this can see why we're so excited to have achieved this result.

Roc-Specific Optimizations

Most of the optimizations that improved roc-deflate's numbers came from general optimization techniques that are widely beneficial across languages. (I always recommend Casey Muratori's Performance-Aware Programming Series , which I paid for and learned a lot from.) Some of the optimization techniques were Roc-specific, though, and I wanted to mention them here as a reference for others. Even if you're not writing Roc code, this can also give you an idea of how Roc achieves its performance .

One of Roc's most effective optimizations is opportunistic mutation (which Koka calls "Functional but In-Place" ). You can learn how it works in Roc's docs on opportunistic mutation , but from a performance optimization perspective, it's critically important to avoid unnecessary sharing so that values remain unique and therefore eligible for in-place mutation.

Hoist Bounds Checks

You can't opt out of bounds checks (e.g. getting a value out of a dynamically-sized collection) in Roc like you can in C, Zig, and Rust, but Roc's compiler can optimize them away if it knows they'd be guaranteed to pass. Bounds checks are most costly inside loops, so you can get a lot of mileage out of adding something like if collection.len() <= highest_index_used { return 0 } before the loop starts. This adds an additional check that looks redundant, but it can allow the optimizer to safely delete costlier checks inside the loop, once it can tell that failures would not be reachable after that early return.

Build Lookup Tables at Compile Time

Roc's compile-time evaluation can be used to assemble lookup tables at compile time as long as nothing depends on runtime inputs. Even better, since their lengths are known at compile time, you can do things like Ok(entry) = lookup_table.get(5) to do an exhaustive pattern match that Roc's compiler will know is valid thanks to compile-time evaluation. This avoids runtime bounds checks that non-constant tables might have to pay for.

Consider Wrapping Arithmetic

In Roc, a + b desugars to a.plus(b) . For an integer like U64 , U64.plus includes an overflow check, whereas plus_wrap does not. Although plus is the safer default, overflow checks have a runtime cost , as CPUs can do wrapping integer arithmetic in one instruction. When Roc's compiler can prove that overflow won't occur, both plus and plus_wrap will optimize to the same instructions, but when it can't, you may get a speedup by choosing plus_wrap .

Room for Improvement

I'm sure there are still opportunities to improve roc-deflate's performance—especially on x64 CPUs—as well as the optimization pipeline in Roc's compiler.

At this point I feel reasonably confident that all the low-hanging fruit has been picked, but if anyone wants to try it out for themselves, here's the script I ran to set up and run the benchmark suite on Linux . (Note that Claude Opus 5.5 generated this script, and I haven't vetted it for security; run it outside a sandbox at your own risk!) It pins both Roc compiler revisions and roc-deflate versions, so you'll want to adjust those commits if you're trying out potential improvements.

For my part, I'll be focusing on the upcoming Roc 0.1.0 release from now until it's out. It's been eight years in the making, so I'll be very happy for us to finally have a numbered release! If you'd like to learn more about Roc, check out roc-lang.org or come say hi on Roc Zulip !

Friday Nite Videos | October 23, 2026

Portside

portside.org

2026-10-23 23:35:09

Friday Nite Videos | October 23, 2026 barry Fri, 10/23/2026 - 23:35 ...

Original Article

Friday Nite Videos | October 23, 2026

With a Little Help From my Friends | Playing for Change. Can Trump Supporters Define Communism? Why Trump Wants Ukraine To Lose – and What To Do About It. Once Upon a Time in Harlem | Documentary. Hawaii Just Made Citizens United Irrelevant.

October 23, 2026 Portside Portside

Printer friendly

The Religious Left Makes a Play for Red-State Conservatives

Portside

portside.org

2026-10-23 23:32:50

The Religious Left Makes a Play for Red-State Conservatives barry Fri, 10/23/2026 - 23:32 ...

Original Article

The Religious Left Makes a Play for Red-State Conservatives Published October 23, 2026

Is Texas turning blue? | screen grab

Democrats in a pair of deep-red states are testing the religious right's dominance by putting their Christian faith at the center of their campaigns — potentially creating a template for the party to compete in similarly forbidding terrain.

Why it matters: Upsets by Texas' James Talarico and Kansas' Adam Hamilton would all but ensure that Democrats take the Senate.

A recent poll from Pew shows both an opening and an obstacle: White evangelicals still strongly favor Republicans, while many other Christian groups lean Democratic or are more narrowly split.

The big picture: Talarico , a Presbyterian seminary student, and Hamilton, a United Methodist pastor, are challenging conservatives' claim to speak for faith. Their bids come after Democrat Raphael Warnock, senior pastor of Ebenezer Baptist Church, was elected to the Senate in 2021.

President Trump won both Texas and Kansas by double digits in 2024. Neither state has sent a Democrat to the Senate in the 21st century — the last time Kansas did was in 1932. Both races this year are considered toss-ups .

Zoom in: Talarico's "religiosity is a way to soften his liberalism" and potentially win over Christians turned off by his scandal-plagued opponent , says Brandon Rottinghaus, who co-hosts Houston Public Media's "Party Politics."

Talarico has also made several visits to Black Baptist churches . Trump made inroads with minority communities in Texas, and Talarico looks to do the same after besting Rep. Jasmine Crockett (D-Texas), who is Black, in a brutal primary.
He's harnessed scripture in his pitch against Christian nationalism and for protecting the vulnerable, invoking the biblical campaign slogan, "It's time to start flipping tables."
"We're in a populist political moment, and many of the teachings of the social gospel give him an opportunity to link the politics and his faith together," Rottinghaus adds.

By the numbers: A September Marist survey of 1,139 Texas registered voters showed Paxton with a 75% to 22% lead over Talarico among white evangelical Christians.

In Kansas, the race will hinge less on whether Hamilton can win large numbers of religious Republicans and more on whether he can replicate Democratic Gov. Laura Kelly's coalition, says Alexandra Middlewood, the political science department chair at Wichita State University.

Hamilton has presented himself as a bridge-builder, drawing on his experience leading the largest United Methodist church in the nation.
His well-known religious background could appeal to less engaged, moderate Christians and center-right voters, Middlewood says.

Yes, but: While Kansas has elected blue governors and voted to keep abortion legal in the state, Republicans have a massive registration advantage that's made a Democratic Senate win "near impossible," notes Bob Beatty, Washburn University's political science chair.

Establishment Democrats have long been viewed with suspicion, especially in western Kansas, he said.
But Hamilton being a pastor "gives him an open doorway to approach those voters in western Kansas that I would argue previous Democrats have not had."

Zoom out: Black clergy — including Warnock — have a history of political action. But white clergy are stepping up to run as Democrats in substantial numbers.

In Iowa, Sarah Trone Garriott, a Lutheran minister, and Lindsay James, a Presbyterian pastor, are running in tight House races.

Pastor Doug Pagitt, executive director of progressive Christian group Vote Common Good, says the religious left's surge is driven by candidates' personal convictions and years-long efforts from groups like his that have trained politicians on how to connect with faith voters.

But Trump, who Pagitt says has repeatedly offended Christians , is also a motivator: "There is no single person who could be more helpful to Democrats reaching out to religious people right now than Donald Trump. He is the greatest recruiting tool."

Yes, but: Trump has repeatedly defied predictions that the religious right wouldn't vote for him.

The other side: Ralph Reed, chair of the conservative Faith and Freedom Coalition, tells Axios he's doubtful the Democrats' effort to lean into religion will attract voters of faith.

"Voters will not vote for a candidate who professes to hold to their faith, but doesn't share their values," he says.
One GOP opponent labeled clergy running for office as Democrats "PINOs" — Pastors in Name Only.

But while Reed says he's confident Republicans will turn out after Trump's battleground blitz, he acknowledges their economic struggles.

"Evangelicals and other conservative voters of faith, they live in the real world too," he says.

Whether evangelicals are motivated to show up will be a major story of the midterms, says Ryan Burge of the John C. Danforth Center on Religion and Politics.

The other will be how Catholics shift: "If the Adam Hamiltons, the James Talaricos of the world can win over people, it's going to be ... marginally attached Catholics," Burge predicts.

The bottom line: There's a clear movement on the religious left — but the question remains whether voters will join it.

The Anger Machine (Joan Kirner Social Justice Oration 2026)

Hacker News

www.andrewleigh.com

2026-10-23 23:28:23

Comments...

Original Article

Palestinian Voters Could Determine Israel’s Future

Portside

portside.org

2026-10-23 23:05:23

Palestinian Voters Could Determine Israel’s Future barry Fri, 10/23/2026 - 23:05 ...

Original Article

Palestinian Voters Could Determine Israel’s Future Published October 23, 2026

Two states, one homeland. A Land for All (ALFA) is a movement of Israelis & Palestinians rewriting the future with a bold vision to end the conflict

It is a bitter moment for the Palestinian citizens of Israel who will go to the polls on Tuesday. We are part of a national election in a state that is practicing the most devastating war, ethnic cleansing and violence against our people since the Nakba of 1948. Insecurity, after all, changes the meaning of political participation.

The attacks of Oct. 7, 2023, the war in Gaza and the political transformation inside Israel have forever altered the relationship among Palestinian citizens of Israel, the state and the Palestinian national question. Palestinian citizens are not only citizens of Israel; they are part of the larger Palestinian people whose experience over the past three years cannot be separated from what happens inside Israel.

Being a Palestinian Israeli voter is a paradox: We are asked to participate in a political system that does not treat us as an equal part of that democracy. Many of Israel’s political parties, including those seeking to replace Prime Minister Benjamin Netanyahu, continue to resist the idea of an Arab party participating in a governing coalition. At the same time, some of them also understand that a high Palestinian turnout could help change the government .

In other words, our vote is important enough to affect the future of Israel, but most of the candidates still consider us to be unacceptable partners in governing. These questions became particularly urgent in September when Israel’s Central Elections Committee voted to disqualify the two Arab-majority parties from participating in this election. The Supreme Court overturned the decision, allowing them to run, though one candidate, Sami Abu Shehadeh, withdrew his candidacy after a public campaign against him.

Amid all of this, the daily lives of Palestinian citizens of Israel are growing more precarious. In recent years, organized crime has transformed life in many Palestinian communities: In 2025, 252 Arab citizens were killed in violent crimes — a record high. For many, the recent spike in crime is not simply experienced as a failure of policing. It is also seen as an expression of unequal citizenship and racist policies that exacerbate a long-held sense of state-led mistreatment. In the best case, we are seen as second- or third-class citizens; in the worst, we are enemies. The experience of abandonment is real.

When people are worried about shootings and the safety of their children, the question of who will govern Israel can feel distant. When the state cannot protect you, why should you believe that changing the government will change your life?

All of this is precisely why Palestinian Israelis cannot afford to withdraw — and why the current campaign underway in Israel to increase Palestinian turnout matters. It is not simply a campaign for more votes. It is a struggle over our existence in our homeland.

In the run-up to this month’s vote, activists, civic organizations and political actors have been telling people that these elections matter, that staying home is not a neutral choice and that Palestinian citizens need to be part of changing the current government, first and foremost for their own lives and futures. There is no illusion that a single election will transform their day-to-day lives or resolve the Israeli-Palestinian conflict. The hope is to replace a government that has presided over years of war and devastation, and to stop or limit the most extreme forms of racism and violence against all Palestinians.

How Tech Billionaires Are Disrupting Biomedical Science

Portside

portside.org

2026-10-23 22:49:22

How Tech Billionaires Are Disrupting Biomedical Science barry Fri, 10/23/2026 - 22:49 ...

Original Article

It’s boom time for billionaires. In the next few months, the world could see a fresh crew of technology entrepreneurs join that club, and the numbers of multi-millionaires would swell even more.

Two giants of artificial intelligence, OpenAI and Anthropic, plan to go public in the next year or so, floating stocks that are expected to rocket some of their employees into the ranks of the ultra-wealthy. Some analysts have projected that Anthropic’s initial public offering (IPO) might bring in US$2 trillion, the largest in history. OpenAI is reportedly targeting $1.4 trillion for its IPO, although the company delayed going public until 2027 amid renewed concerns about AI safety.

If these IPOs go as planned, the effects might extend well beyond sales of superyachts, mansions and private jets. The windfall would probably also add to the flurry of private investments and philanthropic donations from tech-savvy entrepreneurs who are eager to jump-start their favoured areas of biomedical research, such as cancer biology, longevity and reproductive technologies . “It’s a very exciting time,” says Andrew Lo, who studies entrepreneurship at the Massachusetts Institute of Technology in Cambridge. “We’re going to see the creative energy of the tech sector unlocked.”

Wealthy technology entrepreneurs have long put their cash and creative energy into medical research. And as their fortunes have grown, so has the scale of their investments, and the variety of ways in which their funds are doled out. One major player is Altos Labs, a longevity-focused company in Redwood City, California, which launched in 2022 with $3 billion in funds raised from tech titans Yuri Milner and Jeff Bezos, among others — an unprecedented sum for a fledgling biotechnology company with no drug candidates. The Chan Zuckerberg Initiativ e (CZI) , founded by Facebook co-founder Mark Zuckerberg and his wife, physician Priscilla Chan, has spent about $4 billion on basic scientific research and other causes, and plans to spend up to $10 billion more over the next decade.

Ultra-wealthy research investors follow a different strategy than do government funding agencies such as the US National Institutes of Health (NIH). Organizations such as the CZI and Altos Labs boast a commitment to high-risk, long-term research. Tech entrepreneurs are also often keen to invest in new technology, and to harness the power of AI for biomedicine. In April, for example, the CZI announced that it would spend $500 million on funding predictive AI models of human cells. Last year, OpenAI Foundation, the non-profit arm of OpenAI in San Francisco, California, pledged to spend $25 billion on health, disease cures and AI resilience. The foundation has announced more than $100 million for Alzheimer’s disease research and another $125 million for life-sciences data projects this year.

But this investment comes at a time when the public is suspicious of the tech elite and its political influence . It is difficult to assess the success of philanthropic programmes, and many are geared towards encouraging the use of the same technology the philanthropists profited from developing. Meanwhile, high-profile private investment in firms that study longevity or controversial reproductive technologies, such as gene editing in human embryos, raises questions about whether tech entrepreneurs will skew research towards applications that benefit the wealthy, rather than helping a broader swathe of society. “In philanthropy, no one gets elected,” says Rob Reich, a political scientist at Stanford University in California. “There’s no way of holding them accountable.”

A new gilded future

US philanthropists have a long history of influencing what research gets done, and how. In the early twentieth century, grants from industrialists such as Andrew Carnegie and John D. Rockefeller helped to transform higher education and solidify the role of US universities in scientific research. Their giving focused on ensuring that the institutions they supported succeeded; today’s philanthropists are more likely to seek a particular outcome rather than support the long-term health of a university, says Eric John Abrahamson, a historian at Johns Hopkins University in Baltimore, Maryland. In 2024, non-profit organizations, including philanthropies, supported an estimated $25 billion in research and development — about 11% of total research funding in the United States, according to the Science Philanthropy Alliance (see ‘Support sources’).

SUPPORT SOURCES: Chart showing how philanthropic and non-profit organizations increased US research-and-development funding between 1953 and 2024.

Source: https://indicators.sciphil.org/

It is difficult to track all donations from technology magnates comprehensively, but individual examples show that their influence has been sizeable. In 2000, Microsoft co-founder Bill Gates established the Gates Foundation (formerly called the Bill & Melinda Gates Foundation), which made massive investments in vaccine development and the study of infectious disease, among other fields. It remains an influential behemoth: last year, Gates announced that he would donate about US$200 billion over the next two decades.

Other large tech donors include Sergey Brin, a co-founder of Google, who has donated more than $1 billion to Parkinson’s disease research. Sean Parker, an early executive at Facebook, has given hundreds of millions to cancer-immunotherapy research. In 2021, several philanthropists, including tech entrepreneurs, donated $650 million to found the Arc Institute in Palo Alto, California, in the heart of Silicon Valley, to understand the root causes of complex diseases. And US software magnate Larry Ellison announced that he will spend billions of pounds over ten years on a new campus near the University of Oxford, UK. The campus will focus on health care, as well as agriculture, climate change and AI.

In addition to charitable donations, tech entrepreneurs have been fuelling biomedical innovation through private-sector investments, such as funding Altos Labs. Another company, Calico Life Sciences, was founded in 2013 with backing from Google. With a focus on combating ageing and curing disease, Calico, in South San Francisco, California, was conceived as a long-term ‘moonshot’ programme. Sam Altman, a co-founder and chief executive of OpenAI, has invested about $180 million in Retro Biosciences, another longevity-focused company, in Redwood City, California.

In some cases, the line between for-profit investments and philanthropic donations are becoming more blurred, says Louis Shekhtman, a network scientist at Bar-Ilan University in Ramat Gan, Israel. The CZI, for example, was set up as a limited liability company (LLC), rather than as a tax-exempt foundation. Doing so comes at a cost: depending on how they are constructed, LLCs might not be eligible for the tax breaks that more-conventional charities enjoy. But an LLC can be more flexible in how it spends its money, and has fewer requirements to publicly disclose its activities, says Joan Heminway, a business-law scholar at the University of Tennessee in Knoxville.

In a 2015 statement shortly after the launch of the CZI, Zuckerberg said the LLC structure would give the initiative “the flexibility to give to the organizations that do the best work — regardless of how they’re structured”. He also said that any net profits from CZI investments would be put towards furthering its philanthropic mission.

Favourable US tax policies and a high concentration of billionaires — many of them in the technology industry — mean that the United States is unmatched among wealthy nations for charitable giving, says Shekhtman. It is also a major hub for biomedical research, and home to nearly half of the world’s biopharmaceutical companies.

And US tech entrepreneurs have a penchant for experimentation in how they structure their investments, says Keith Yamamoto, vice-chancellor of science policy and strategy at the University of California, San Francisco. When it comes to philanthropy, private donors are more able to take risks with their investments than are government funding agencies, which are beholden to taxpayers to ensure that their money is spent wisely. “Public money limits your activities,” says Harold Varmus, a former director of the NIH, who has also been on advisory boards for the Gates Foundation and the CZI. “There is a freedom of motion that is associated with private money.”

Some tech titans have experimented with various ways of structuring their grants. The Arc Institute, for example, boasts a “no-strings-attached” funding system that gives its investigators more freedom than do standard government grants awarded to biomedical researchers.

Philanthropists are also able to fund long-term, interdisciplinary projects that can be difficult for government grants to take on. Convergent Research, a non-profit organization funded in part by Eric Schmidt, the former chief executive of Google, is forming ‘focused research organizations’ that bring teams together to solve important scientific or engineering challenges that could benefit a wide swathe of research. “We’re looking for the pieces of critical, fundamental infrastructure missing from a particular field,” says Anastasia Gamick, a co-founder and president of Convergent Research, which is headquartered in Cambridge, Massachusetts.

Projects include developing cheap ways to map the neurons in mammalian brains, and large-scale screening to catalogue the off-target effects of small-molecule drugs.

Meanwhile, Yamamoto points to the CZI’s Institute for Advanced Biological Imaging as another example of a long-term, high-risk project that aims to develop pivotal technology. He hopes that the team there — which has brought engineers, physicists and computer scientists together with biologists — will succeed in refining a difficult technique called cryo-electron tomography so that it can image processes in a cell at the level of individual proteins.

Tolerance for risk is also evident in some tech entrepreneurs’ investments in for-profit companies. Some investors hope to reshape how fundamental research is conducted. Arcadia Science in Emeryville, California, for example, was launched with backing from Altman and from Jed McCaleb, a cryptocurrency entrepreneur in the United States, and pledges to “rethink the entire research cycle” by branching out from the usual laboratory model systems, such as mice and the bacterium Escherichia coli , to study more diverse organisms. Like Calico Life Sciences, the company warned investors from the start: this will take time.

Arcadia has also taken an unusual step for a for-profit company and embraced open science to a degree not typically found in industry, says Yamamoto. Its lab protocols, computer code and data sets are published directly online.

Silicon Valley investors are also sometimes willing to wade into controversial territory. Last year, Brian Armstrong, chief executive of the cryptocurrency exchange Coinbase, helped to fund a company dedicated to developing methods to edit the genome in human embryos to prevent disease. The company, named Preventive and based in San Francisco, will first have to grapple with the fundamental science of heritable gene editing to learn whether and how it can be done safely, says Lucas Harrington, a co-founder of Preventive. Private investment will enable the company to do that research, which US legal restrictions prohibit government grants from funding.

Overall, longevity, technologies related to fertility and diseases that have a personal connection to the investor are popular topics for tech entrepreneurs. This is either out of personal interest or because they see a challenging field that can be transformed by new tools, says Omri Amirav-Drory, a general partner at NFX, a San Francisco venture-capital firm focused on early-stage investing. Also popular is what Amirav-Drory calls “tech bio”, the application of technologies such as AI to biological research.

Some technology entrepreneurs are also investing in global-health interventions and assistance to the poor. But the emphasis on topics such as longevity has raised concerns that wealthy investors could skew research towards issues that benefit the wealthy. And investment in AI for use in biomedical research could end up benefiting AI companies financially by expanding their market. It’s understandable that scientists would celebrate the added funding, says Angela Eikenberry, who studies philanthropy at the University of Connecticut in Hartford. “But who’s benefiting?” she says. “What they give their money away to is not necessarily what the science says it should be given to.”

If the tech industry’s fortunes continue to rise, it could drastically reshape how science is done, says Abrahamson. “The potential impact of this new generation of donors is huge,” he says, perhaps as transformative as the philanthropists of the early twentieth century.

These investments would come at a time when academic research is facing potential funding cuts in several countries, including the United States. The administration of President Donald Trump has proposed large cuts to major government science funders , including the NIH and the National Science Foundation, and is seeking to give political appointees more influence over the research that the government funds . “We’re going through a pretty traumatic period” in US science, says Varmus. “More money and more experimentation are really important things, especially at this very turbulent moment for research.”

A spike in investment could also help the biotechnology industry, which has languished in a period of slow investment that has driven many companies out of business and forced others to curtail their ambitions. “The biotechnology industry needs this,” says Elias Zerhouni, president of OPKO Health in Miami, Florida, and a former director of the NIH.

But even if the newly minted millionaires and billionaires decide to support science through philanthropy, their money will not be able to take the place of government funding for academic and industry research, several sources told Nature .

“The federal government, even amid recent upheavals, continues to dwarf the scale of Silicon Valley biomedical funding as a whole, and that’s not going to change any time soon,” says Daniel Correa, chief executive of the Federation of American Scientists in Washington DC.

In addition to the difference in scale, the US government’s aims sometimes differ from those of philanthropy. Public funds can be distributed more equitably between researchers from varying regions and backgrounds. A 2024 study of tax forms filed by US charities found that their giving tends to be geographically focused, with the bulk of their funds going to the regions with a personal connection to the donors ( L. M. Shekhtman et al. Sci. Rep. 14 , 9397; 2024 ). “This local nature is different from the way we usually think about funding,” says Shekhtman.

Federal funding is also generally considered to be more stable: until the Trump administration’s sudden changes in 2025, the government had been viewed as less likely to suddenly pivot than were private donors.

There are other concerns about heavy investment from tech millionaires and billionaires. Lo welcomes the business opportunities that could emerge, but he also cautions that an influx of capital might create a bubble that will eventually burst, causing more pain down the line. “We want to be careful to make sure we find a balanced approach to supporting innovation,” he says.

And federal funding is more openly held to account, with strict reporting requirements that make it easier to determine exactly how funds were used and how successful a funded programme was. “There’s no data trail” in philanthropy, says Joshua Graff Zivin, an applied microeconomist at the University of California, San Diego, in La Jolla.

Without those data, funders will not be able to learn whether other methods of supporting research are effective. “If we don’t get them to report what they’re finding and what’s coming out of it in a standardized way, we can’t learn from those experiments,” says Graff Zivin. “And that’s a huge, missed opportunity.”

Nature is a weekly international journal publishing the finest peer-reviewed research in all fields of science and technology on the basis of its originality, importance, interdisciplinary interest, timeliness, accessibility, elegance and surprising conclusions. Nature also provides rapid, authoritative, insightful and arresting news and interpretation of topical and coming trends affecting science, scientists and the wider public. Nature's mission statement: First, to serve scientists through prompt publication of significant advances in any branch of science, and to provide a forum for the reporting and discussion of news and issues concerning science. Second, to ensure that the results of science are rapidly disseminated to the public throughout the world, in a fashion that conveys their significance for knowledge, culture and daily life.

How Block Blast harvests its players for ad money

Hacker News

ayoships.com

2026-10-23 22:43:43

Comments...

Original Article

ayoships.com

Rules downloaded from their server decide your pieces, your score and your ads. One waits for an expensive ad, then asks for a hand you can’t place.

I posted a video about this game that got over 15 million views, so I wanted to do the full technical write-up: the code, and how you can reproduce it yourself.

Some context on why it matters: between January and May 2026, Block Blast made an estimated $127 million from ads. Candy Crush Saga made $81.1 million over the same months (Sensor Tower estimates).

Most of Block Blast isn’t in the app you install

We started with the Android app, version 10.8.2. We decompiled the Java side with jadx and the native Cocos library with Ghidra, and found almost nothing interesting in the package you download from the store. Block Blast is built from small modules the code calls traits, and each trait has variants called arms. Running it on a clean Android 14 emulator with no account and watching its cache and logcat showed how it works: when the app launches, the server sends a config that says which arm of which trait you get, and the app downloads them as encrypted JavaScript. The config my install got names about 700 traits. My install selected 254 of them, and 101 were downloaded after install.

CTAgloReviveTrait CTReviveTimeOutSkipSplashTrait ClassNewDeathOptimizeTrait DeadlyToHardTrait DecreaseReviveUIShowByLimitHighScoreTrait DifferentStrategyDieTrait EndlessDeathBoardTrait FastHandPunishTrait GLBFDieReplayTrait IsCacheReviveNumTrait IsClassADReviveNoInerestingTrait IsOpenInAdvanceDeathByLowEfficiencyGiveReviveTrait IsOpenRandomToRandomNoDieTrait LevelReviveCondiTrait LevelReviveCountTrait LevelReviveTrait MABXiBaiTrait MultiClearBoostThenKillTrait RepateCPlusPlusRandomNoDeathTrait ReviveBuffTrait ReviveCleanBoardTrait ReviveCountTrait ReviveLimitTrait RewardHighValueAdHarvestTrait AdLevelTrait AdPlusMinusStrategyTrait AddClearTipsExTrait AddMoreGameTrait AdjustPercentChTrait AlgoFillSortEdgeTrait AlgoSDK_modifyBlockPosTrait AlgoSDK_useAlgoSoAloneTrait AlgoSameBlockShangZengTrait AlgoSymmetryBlockTrait BComboScoreChangeTrait BCommentDisplayTrait BPuzzleTimeTrait BReplaceBinaryTrait BackSpaceClickLimitTrait BaseplateConditionDiffTrait BaseplateLaneTrait BaseplateTrait BlockLimitClassicsTrait BlockLimitLevelTrait BlockPoolRoundAdjustV2Trait BlockPoolStrategyExperimentTrait ButtonClickAddShakeTrait CTAdvertisementMultipleCallTrait CTAdvertisementNoHideTrait CTAgloNameSpecialTrait CTAgloNameTrait CTAgloStrategyTrait CTBAlgorithmGaohuibaoARGTrait CTChapterScoreComboTrait CTChapterSkinBonesTrait CTChapterWinOverTrait CTClassSkinBonesTrait CTComboDotTrait CTCommentskinWithFeedBackTrait CTDotClickGameEndInfoTrait CTDotClickUsrDataGameEndTrait CTDotDeadReportToUsrDataGameEndTrait CTDotFirstClickDataGameEndTrait CTEffectAccTraitTrait CTGBMClearTrait CTGBMEmptySurfaceGameStartDotTrait CTGameComboScoreTrait CTGameEndStatusDotTrait CTLowDeviceEffectTrait CTMergeBlocksAgloNameTrait CTMergeBlocksSkinBonesTrait CTSkinBonesTrait ChapterAlgoStrategyTrait ChapterCollectScoreFixedTrait ChapterWinShowRainbowTrait ClassGuideEndNoAwaitNextFrameTrait ClassicsRandomReplaceTrait CleanSceneRandomSkinTrait CleanSceneUseSequenceSkinTrait ClearBoardHeartRippleAniTrait ClearBoardPlusBlockPosTrait ClearBoardPlusTrait ComboAddRemoveNumTrait ComboModeCtrlTrait ComboRainbowTrait ComboScoreSplitTrait ComboTimeTrait Combo_tips_lv_blockTrait ComboflyScoreTrait ConsecutiveLossRecoveryTrait ContinueSameMoreRoundLimitTrait ControlHighestScoreRhythmTrait CrossClearHardTrait CtrlAlgoLimitTimeTrait DailyPerformanceReviewTrait DailyWinStreakStateTrait DifficultChangeColorTrait EightHoursTravelTrait ExceedAimScoreTrait ExpendBoardScoreTrait FastNearTkxcClassTrait FastNearTkxcTrait FeatclearscreenbombTrait FeatclearscreenbombfixTrait FillCleanAlgoTrait FillExcludeTrait FirstGameScoreTrait FirstHardMoreClearAlgoTrait FiveRoundStatisticsTrait GLBFMiddleTipsViewTrait GLBFProgressTrait GLGameAdStrategyOptimizeTrait GLResultView6Trait GLShowAdsByGameTimeTrait GameInfoDisplayTrait GameLobbyNewEntryCtrlTrait GameLobbyTrait GameLobbyUnlockByBreakHighScoreTrait GameOverShowMiniGameIconTrait GateWinStreakStateTrait GpEmptyBoardRatioGuardTrait HighProgressShowBannerTrait HighScoreBreakthroughBoostTrait HighScoreLimitByUserAbilityTrait HighValueInterstitialReliefTrait HighWeightSessionQuestionReplacerTrait HoleFillPriorityTrait HotAreaAdaptScreenBottomStateTrait HotAreaClickUtilTrait InitBoardDelayTrait InitBoardSnakeProStyleProTrait InitialBoardDisableTrait IsOpenBottomCoverChangeTrait IsOpenChangeSkinTrait IsOpenClassEncourageEffectByScoreTrait IsOpenComboContinuousTrait IsOpenComboInterruptionStrategyReplaceBlockTrait IsOpenExtraReportTrait IsOpenGLHallMoreGamesPopupTrait IsOpenGlLoadAllGameBackTrait IsOpenLevelOverTipsChangeTrait IsOpenMoreCleanChangeTrait IsOpenMoreCleanTrait IsOpenNoVideoNoRevivieTrait IsOpenOperaPosTrait IsOpenRainbowPutBlocksEffectTrait IsOpenRightPutTrait IsOpenShang1ToShang3Trait IsOpenVibrateTrait IsOpenZhiJueToKunNanTrait IsOpenZiMuShangZengTrait IsPuzzleTimeTrait IsShowAchievementTrait IsStatisticalDataCollectTrait IsTravelMoreDiamondAwardTrait IsTurnAroundSurfaceTrait IsWarmhandsTrait JewelNewOutBlockTrait LDEnableNoSyncHighScoreRollingTrait LWMDualConditionHardPuzzleTrait LaneSchemeTrait LevelConfigTrait LevelExpAlgorithmTrait LevelLoopTrait LevelNoThemeTrait LevelRandomReplaceTrait LevelRemoteThemeTrait LevelWayHelpConfigTrait LevelWayHelpTrait LimitHighComboTrait LimitNoviceBlockSizeTrait LineDynamicSendTrait LoadingTieringTrait LocalThemeSaveTrait LoginTimeFirstDifficultyRatioTrait LongThinkClearAssistTrait LowFeedbackPleasurableOfferTrait LowHardSetFps30Trait LowWeightFillBlockSortAdjustAlgoTrait LowWeightFillBlockSortTrait MaturityDevelopmentV2Trait MergeBlocksIsPuzzleTimeTrait MergeBlocksLaneSchemeTrait MoreClearStopComboTrait MoreTimeToOpreateStateTrait MultiElementCollectTrait NewAbilityModelTrait NewBottomOfferTrait NewPlayerContinuePlayIncentiveTrait NewSeasonNotifyTrait NewStructTrait NewUserLevelTrait New_player_direct_guide_to_thirdTrait NewbieScoreRegulationTrait NoBannerAdNewUserByDaysTrait OpenChangeContinueHardTrait OpenComboModelTrait OpenLevelModelTrait OriginSkinShowGreyDefultSetBtnTrait OverHighScoreClearBoardTrait ParallelClearHardTrait Param230012Trait PixelBitControllerTrait PlaceBackAdaptTrait PlaceHabitAdaptPathTrait PlaytimeNoInterstitial1Trait PostGameToServerTrait PreClearScreenAnimOptimizeTrait ProblemIntervalTimeRandomBetaTrait PromotionMoreGamesInBlockCtrlTrait PutBlockOptimizeTrait Puzzle100Trait Puzzle100WeightConditionTrait PuzzleAfterTimingTrait PuzzleBeforeTimingTrait PuzzleConditionDiffTrait PuzzleFail100Trait PuzzleSuccess100Trait PuzzleTiming100Trait PuzzleTimingMaxPriorityTrait RatioAdjustTrait RatioDownTrait ReduceTravelSettlementTrait ReplaceBoardTrait ReplaceClearnScreenAniTrait RightPutHintCtrTrait RobotModelEventDataTrait SequencePredictDynamicDifficultyTrait ServerControl_board_init_v2Trait SetAddDefultSkinBtnTrait SettleFireworkTrait SetupNewTrait ShangZengAddRandomTrait Shangzeng3ReplaceZimushangzengTrait ShowSSSWhenSkinChangeTrait ShowTravellClearAnimaTrait SimpleMultiSolutionTuning2Trait SkinChangeAblePushTrait SkinPreEliminateGoodPerformanceTrait SkinRandomTrait SkinThree24NewColorsTrait SkinThreeOptimizationsTrait SkinThreeStageTrait SlowPlayerAnimTrait SmallgameLocalResTrait SolidColorTrait TerminateRefreshScoreTrait TheMoreEliminateTheMoreGoodEffectTrait TravelEntryClockShadowFixTrait TravelEntryClockShadowTrait TravelHappyOverTrait TravelNoSkinTrait TravelResultOptimizingTrait TravelScoreCutoffByProgressTrait

All 254 traits assigned to my Android test install. The ones about losing, revives and ads are highlighted.

So two people playing side by side can be running different games, and the studio can change yours without an app update. Most of those 254 are ordinary: tutorials, animations, sounds. A handful are about when you lose. One of them is about ads.

The rule that waits for an expensive ad

It’s called RewardHighValueAdHarvestTrait . By finding where the game unlocks these files in its own native library, we decoded it into 15,616 bytes of plain, minified JavaScript. Its constructor sets the parameters:

RewardHighValueAdHarvestTrait.js · lines 63–67

t.HIGH_PRICE_MULTIPLIER = 3.5;
t.MEDIUM_PRICE_MULTIPLIER = 1.5;
t.MIN_HISTORY_AD_WATCH_COUNT = 3;
t.RECENT_AD_NO_ESCAPE_COUNT = 3;
t.TARGET_AD_LEVEL = "high";

It waits for three things to line up: you finished your last three rewarded ads, the ad loaded right now is worth at least 3.5 times your last one, and you’re 1,000 points past your high score. All three get checked in one function. Here it is with the minified null checks rewritten as optional chaining; the logic is the same:

shouldTriggerDeath · lines 262–267 (reformatted)

shouldTriggerDeath() {
  if (!this.canTrigger()) return false;                  // finished your last 3 rewarded ads
  const d = this.storageData;
  return d.currentGameNum === hs.classGameInfo?.gameNum   // same game
      && !d.currentGameHasTriggeredDeath                 // hasn't fired yet
      && !(hs.classScoreInfo?.score < this.currentScoreThreshold)  // past high score + 1,000
      && !!this.isTargetAdReady();                       // loaded ad ≥ 3.5× the last one
}

Here’s how it checks each one.

1. You finished your last three rewarded ads. Every time a rewarded ad starts, the rule pushes false onto a list and keeps the latest three (lines 174–183). If the ad SDK reports that the reward was earned, it flips that entry to true (191–199). The check needs all three to be exactly true :

canTrigger · lines 268–275

t.prototype.canTrigger = function() {
var e = this.storageData;
if (e.totalRewardShowCount < this.MIN_HISTORY_AD_WATCH_COUNT) return !1;
var t = e.recentRewardResults.slice(0, this.RECENT_AD_NO_ESCAPE_COUNT);
return !(t.length < this.RECENT_AD_NO_ESCAPE_COUNT) && t.every(function(e) {
return !0 === e;
});
};

That flag comes from AppLovin MAX’s onUserRewarded callback in the Java layer, so an ad you close early stays false .

2. The ad loaded right now is worth at least 3.5 times your last one. The rule reads the value of the best rewarded ad currently loaded with NativeAd.callNativeGetMaxEcpmNumber("2") (line 304). In the Java layer, that call goes through each ready rewarded ad slot, takes the revenue AppLovin MAX reports for it, multiplies it by 1,000, and returns the highest. The value of your last rewarded ad gets the same ×1,000 (line 310), so the comparison is like for like:

classifyLoadedRewardLevel · lines 290–293

t.prototype.classifyLoadedRewardLevel = function(e) {
var t = this.storageData.lastRewardShowEcpm;
return !Number.isFinite(t) || t <= 0 ? "none" : e >= t * this.HIGH_PRICE_MULTIPLIER ? "high" : e >= t * this.MEDIUM_PRICE_MULTIPLIER ? "medium" : "none";
};

3. You’re past your old high score. At the start of each game the rule saves your high score (line 145). The bar is that high score plus scoreDeltaStep (lines 107–110). Each player gets one arm: mine, 332243014 , uses 1,000, and the app’s bundled config has others at 500 and 750. If you revive after the rule fires, the bar moves up another step, so it can fire again in the same game.

Then it asks for the lethal puzzle. Before dealing your next set, the game runs a list of “bottom offer” rules in order. When this one qualifies, it replaces the list with a single generator:

onBottomOfferAlgo · lines 245–251

t.prototype.onBottomOfferAlgo = function() {
if (this.shouldTriggerDeath()) {
hs.algorithmBottomSequenceInfo.setAlgorithmBottomList([ this.deathAlgorithm ]);
this.storageData.currentGameHasTriggeredDeath = !0;
this.saveStorageData();
}
};

deathAlgorithm returns hs.OFFER_TYPE.ZHI_SI_TI (line 102). The game sends that request to its puzzle engine and deals the three piece IDs it gets back (main script lines 45062–45121 and 15074–15123). If the engine fails to find a set, the rule resets and tries again on the next deal.

To watch it decide, we ran the downloaded file itself, unmodified, with test ad and score values. It requests the lethal puzzle exactly when all three conditions hold: 28 cases, including two ads instead of three, one ad closed early, a score 1 point short, and an ad worth just under 3.5×.

Then we ran it live, in a test copy of the iPhone app running in Apple’s simulator, and read the rule’s inputs while we played. It had three good rewarded ads on record. The score was past the line. A rewarded ad from Google AdMob was loaded and ready. The rule priced it at 72.39, against 37.41 for the last one, which is 1.94 times. It needs 3.5. So on iPhone the rule is live, reading real ad prices, and waiting for an ad worth 3.5 times your last one.

The lethal puzzle

The name maps through three tables in the main script:

main/index.45fec.js (original line numbers)

23878  e[e.ZHI_SI_TI = 9] = "ZHI_SI_TI";
16092  … r[n.OFFER_TYPE.ZHI_SI_TI] = i.AlgoClassTypeConst.algo_must_death, …
258441 e[e.algo_must_death = 24001] = "algo_must_death";

Algorithm 24001 exists twice: in JavaScript, and in the game’s native C++ library, where the function is called func_death_blcok (their spelling). They do the same search. Here’s the JavaScript core:

rC · main/index.45fec.js lines 318602–318678 (excerpt)

for (var d = 0; d < n.length; d++) if (41 != d) {
var m = n[d];
r.canPut(m) ? o.push(m) : i.push(m);   // o: fits now, i: doesn't fit now
}
…
iC(r, o[p], o[f], i[_], h);               // try every order of two pieces that fit
iC(r, o[p], i[_], o[f], h);               // and one that doesn't, clearing lines
iC(r, o[f], o[p], i[_], h);               // after each placement
iC(r, o[f], i[_], o[p], h);
if (0 == h.length) {                     // no order worked: take this set
u = [ o[p], o[f], i[_] ];
…
a.names = [ "致死题", "致死题", "致死题" ];   // "lethal puzzle" ×3

It looks for two pieces that fit now and one that doesn’t, and keeps the set only if no order and no set of positions places all three, counting every line you’d clear along the way. Two of the three fit when they’re dealt, so the hand doesn’t look impossible until you try it.

Here’s what that looks like, with the game’s own code running in your browser. Step through it:

Step 1 of 5

A normal hand

Every step comes from running the game’s own generator code in your browser.

Press “New random board” for a fresh mid-game board, and the game’s code picks a new hand for it. On the test board in the evidence bundle, the game’s generator accepts a vertical domino, a horizontal domino and a 3×3 square as a lethal hand: we tried all 171 placements, and none of them finish it. On an empty board, those same three pieces fit 67,680 ways in each order.

The ad rule isn’t the only one that asks for it

The lethal puzzle is a generator, and any rule can ask for it. The ad rule is one caller. While we were testing it live on iPhone, a second caller fired on camera: PersonalMarginBreakTrait . Once you’re 10% past your high score, it rolls on every deal, and 20% of the time it asks for the same lethal puzzle:

PersonalMarginBreakTrait · onAlgorithmStrategyPriority, lines 153–159 · live config: prob 20, recordPercent 10, replaceAlgoId 9

t.prototype.onAlgorithmStrategyPriority = function() {
this.hasReplacedThisGame = !1;
if (this.state.isFirstGame) ; else if (this.isReviveRound()) ; else if (this.state.isBreakHighScore && this.isCurrentScoreOverRecordPercent()) if (100 * Math.random() >= this.prob) ; else {
var e = this.replaceAlgoId;   // 9, the lethal puzzle
…
if (this.callNewAlgorithm(e)) ; else {

Our record was 1,304, so its line was 1,434. At 3,356 points it rolled, and the game dealt a five-long bar, a five-tall bar and a zigzag. The game’s own record of that deal names this rule as the caller, shows algorithm 9 both requested and used, and labels all three pieces 致死题, lethal puzzle. There was no way to place them. Two separate exhaustive searches agree: zero. The rule, the live settings and the deal are in the live iPhone bundle .

The deal at 3,356 points, through to the Revive button. Recorded in a test copy of the iPhone app in Apple’s simulator, after we reset its saved high score so we could reach the line quickly.

The model that picks where you lose

The rules so far are hand-written. The game also downloads trained models and runs them on your phone, and one of them decides where in a level the lethal puzzle shows up.

It’s a 500-tree XGBoost classifier for the game’s level mode, which the code calls Chapter. Its file is named predict_travel_difficulty_dead , and its 52 inputs are mostly about how you’ve been doing: your current level, how many times you’ve tried it, how many games you’ve finished this week, and how long you’ve had the app. The game feeds it 12 options, four values of a setting called sw_process times three difficulty levels, and keeps whichever one the model scores highest:

ClientDieModelLoadTrait · doPredictFeature, lines 1286–1312 (excerpt)

if (0 == e) for (var i = 1; i <= 4; i++) for (var l = 1; l <= 3; l++) {
var c = this.getInputFeature(this._jsonModel.learner.feature_names, i, l);
if ((u = this.xgb_clf_predict(c, …)) > n) {   // keep the highest-scoring option
n = u;
a = i;
o = l;
}
}
…
storage.setItem("DieModel_last_predict_info", { swProcess: a, travelLvDifficulty: o, pre: n });

Another rule turns that pick into a stretch of the level: the first 30%, 30 to 80%, or the last 20%. When you reach that stretch, it offers you an extra revive if you usually take them (more than 75% of the time). Then, from the fourth deal after that, it asks for the lethal puzzle:

IsOpenDeathChangeReviveCountTrait · lines 224–229 and 181–184

var t = hs.chapterConfigInfo.getChapterProgress(), i = e.getLastPredictInfo(this.traitName), r = i.swProcess, …;
…
1 == r ? s = [ 0, .3 ] : 2 == r ? s = [ .3, .8 ] : 3 == r ? s = [ .8, 1 ] : 4 == r && (s = [ 1, -1 ]);
return t < s[0] ? a.First : t <= s[1] ? a.Second : a.Third;   // before, inside or after that stretch
…
if ((n = this.saveData).needZs && n.zsRoundNum > 3) {
hs.algorithmStrategyInfo.setAlgorithmPriorityList([ hs.OFFER_TYPE.ZHI_SI_TI ]);   // the lethal puzzle
hs.algorithmStrategyInfo.setAlgorithmFailList([ hs.OFFER_TYPE.SHANG_ZENG_3 ]);
}

Other rules read the same pick the opposite way and make a level easier when it lands on the fourth option.

The model that prices you

A second model puts a price on you. The game downloads xgboost_regression_model111.json from its server and runs it on your phone.

It’s an XGBoost regression model: 59 decision trees, up to 8 levels deep, 27 inputs. Most of it is about money: 18 of the inputs are about the ads the game has loaded for you, today and yesterday. The rest are where you are, your phone, when you installed, and how your first game went. The trees lean hardest on your first score, the price of your latest ad, your RAM, your phone model and your country.

The code calls its answer finalEcpm . eCPM is the ad industry’s name for what a thousand ads are worth, and it’s the same unit the game stores its ad prices in. So the model is estimating what you’re worth in ads.

GPT-6 Astra ported the game’s input code and tree walk, and the port reproduces the game’s own outputs to the last decimal. We ran it on a made-up new player in the US with a first score of 1,000, once on an iPhone 15 installed from the App Store and once on Android, then changed one input at a time:

Change only this	Ad value, iPhone 15	Ad value, Android
Nothing (US, first score 1,000)	25.48	48.96
Live in Brazil instead	8.08	17.90
Live in India instead	5.59	14.83
First score of 500	25.79	53.57
First score of 2,000	21.12	52.64
First score of 10,000	20.34	58.26

Moving the same player from the US to Brazil cuts their value to about a third, and India cuts it further. Your first game matters too, but not in a straight line: on iPhone, a first score of 500 makes you worth more than 2,000 or 10,000.

The game uses prices like this to decide what kind of ads you get, and how many. The clearest case asks its server for two prices for you, one for full-screen ads and one for rewarded ads, and compares them:

IsOpenInterAndRewardAdvDecideReviveTrait · checkEcpm, mainTraits/index.88dc4.js lines 38529–38534

t.prototype.checkEcpm = function() {
var e, t, o, r = this.saveData.interEcpm, i = this.saveData.rewardEcpm;   // your full-screen and rewarded prices
…
return (…isReverse) ? r <= i * (…multiple) : i >= r * (…multiple);
};

In the versions the app ships, if your rewarded ads are worth at least twice your full-screen ads (1.5 or 2.5 times in other versions), you get an extra chance to revive, and a revive plays a rewarded ad. If full-screen ads pay more for you, you don’t.

Other rules work the same way. FullScreenAdAddByEcpmTrait adds an extra full-screen ad when your price is high. IsOpenEcpmTooLowNoInterTrait skips full-screen ads when you’re worth almost nothing. A few more open an early or a third revive when your rewarded ads are worth enough.

Try the on-phone model yourself:

25.48 Your ad value
per 1,000 ads (eCPM)

finalEcpm 25.47779944720001 0/59 trees moved

Here’s the part of the game that walks the trees. It’s a plain loop: start at the root, go left or right on each input, add up the leaf weights.

EcpmFeatureBaseInfo · runModel, main/index.45fec.js lines 63141–63175 (excerpt)

for (var m = parseFloat(a + ""), u = 0; u < t.length; u++) {   // m starts at the base score; t is the 59 trees
for (var p = t[u], f = 0, _ = 0; _ < o; ) {
_ += 1;
var h = p.left_children[f], g = p.right_children[f], y = p.split_conditions[f], C = p.default_left[f], v = s[e[p.split_indices[f]]], T = -1;
(null === v && 1 === C || v < y) && (T = h);
(null === v && 1 !== C || v >= y) && (T = g);
if (-1 === T) {
m += parseFloat(p.base_weights[f].toString());        // reached a leaf: add its weight
break;
}
f = T;
}
if (_ >= o) throw new Error("[EcpmFeature] 树的遍历超过最大深度，可能存在死循环。");
// "Tree traversal exceeded max depth, possible infinite loop."
}

A model that guesses you’ll play less tomorrow

There’s also a 1,000-tree LightGBM model with 93 inputs that predicts whether you’ll be less active tomorrow. It leans hardest on how long you’ve had the app, your high score, your RAM and your average score. If it scores you at 0.69 or above, a companion rule swaps in a pink revive button, and the revive skips the ad:

NewNextDayLowActivityTrait line 1010 · NextDayLowActivityFirstReviveFreeTrait lines 112–117

return this.state.predictionScore >= this._lowActivityThreshold;   // 0.69
…
if (hs.tp.isClassAdvertisement_RewardProxyShieldPlayAdvertisement(e) || …) {
var r = cc.isValid(this._pinkReviveNode);
if (!this.isTrigger || !r) return;
e.returnValue = !0;
e.args[0] = !0;                                  // shield the ad: the revive goes through without one
this.saveNextDayLowActivityReviveTime(Date.now());
}

It works once a day.

Models on their server

Some rules send your data out and act on the score that comes back, from server models with names like churn, LTV, revive-click and xDeepFM. Their weights stay on the server, so all we can show is what the phone sends. One of those requests, to /v1/ecpm_prediction , sends 40 fields, including your carrier, storage, the hour and stats on your recent ad prices.

Other rules that shape your game

The ad rule isn’t the only one that changes your pieces or your score. We caught one working live on iPhone. MaturityDevelopmentV2Trait gives each session a “maturity” score made of three parts: habit (10.98), skill (14.66) and your ad history (19.27). Ours added up to 44.91, under its line of 65, so it swapped some of the hard puzzles it would have dealt for easy fills. Another, FailStreakStrategyTrait , stepped in after two games below our record and asked for easier pieces.

These came up while tracing the ad rule on Android, and each has the same kind of evidence in my research files.

Rule	What the code does
`MultiClearBoostThenKillTrait`	Sends your user ID to two server endpoints and gets back two labels. The code names both tiers as “not sensitive to being forced to die” (怼死不敏感). For those tiers, it waits for a big clear, then requests the lethal puzzle a few rounds later once the game has lasted about as long as your usual game.
`MABXiBaiTrait`	A six-arm experiment on how soon the lethal puzzle can be requested: never, or after 4, 6, 10, about 17 or 30 minutes. For each arm it reports whether you started a new game within 15 minutes, and what share of revive offers you accepted.
`FastHandPunishTrait`	Asks for hard pieces when your last six sets averaged under 4.2 seconds each and you’re past 93% of your high score.
`AdPlusMinusStrategyTrait`	After one kind of extra revive offer, adds a random bonus of up to 10% of your high score to your current score.

Questions people asked

Is it the same on iPhone?

Yes. We took apart Block Blast for iPhone too, version 7.4.9, and a second GPT-6 Astra run checked those findings from scratch. It downloads the same rule from its own update server, and the file matches the Android one except for one line. Everything else is identical: three ads, 3.5×, the score bar, and the same lethal-puzzle generator.

The iPhone app also lists a second version of the rule, RewardHighValueAdHarvestV2Trait , and in that one the ad-history check can be switched off:

RewardHighValueAdHarvestV2Trait.js (iOS) · lines 323–331

t.prototype.canTrigger = function() {
var e = this.storageData, t = this.viewCountThreshold;
if (e.totalRewardShowCount < t) return !1;
if (!this.requireRecentNoEscape) return !0;
var r = e.recentRewardResults.slice(0, t);
return !(r.length < t) && r.every(function(e) {
return !0 === e;
});
};

The app ships 12 versions of it. Half turn that check off, and they need anywhere from 1 to 3 ads, so in some of them a single rewarded ad you closed early is enough. The price bar depends on how long you’ve had the app: 3.2× the first ad loaded that session in your first week, 2.7× through day 30, and 3× your last ad after that.

What happens if I play without wifi?

This rule is saved on your phone after it downloads, so it still runs offline. But it only fires when a rewarded ad is loaded, and ads load over the internet, so once nothing is loaded it can’t fire. Other rules keep going. On my Android install, the one that asks for hard pieces when you’re playing fast near your record runs entirely on your phone. The one that asks the server which players “don’t mind being forced to die” can’t get an answer offline, so it stays off for that session.

Does an ad blocker do anything?

It depends on the blocker. Browser ad blockers, on iPhone or Android, only work inside the browser, so they don’t touch the game. A blocker that covers your whole phone, like Private DNS on Android or a DNS or VPN-based blocker on either, can stop rewarded ads from loading, and then this rule can’t fire, for the same reason as playing offline. The rules that don’t use ads keep running: the fast-play one, the experiment that times when the lethal puzzle can be requested, and, since you’re still online, the one that asks the server about you.

Is this why I always lose right after beating my high score?

That’s exactly where these rules are aimed. We caught PersonalMarginBreakTrait doing it live: once you’re 10% past your record, every deal has a 20% chance of being the lethal puzzle. The ad rule waits for 1,000 points past your record (500 or 750 in other versions), and after a revive it moves the bar up and can fire again.

Can I avoid it?

Not really. On Android, the original rule needs your last three rewarded ads to pay out, so closing one early does turn it off until you’ve had three good ones in a row again. But on iPhone, the V2 versions can skip that check completely and fire after a single ad, even one you closed. And the other rules that ask for the lethal puzzle, like the timing experiment and the one that waits for a big clear, don’t look at your ads at all. The one thing that stops this rule everywhere is not having a rewarded ad loaded, which is what happens offline or with a phone-wide ad blocker.

Isn’t this just adaptive difficulty?

Adaptive difficulty changes the pieces based on how you’re playing. This rule doesn’t look at how well you’re placing pieces. Its inputs are your recent ad results, the price of the ad sitting in memory, and your score relative to your record. And the generator it asks for isn’t a harder set of pieces. It’s a set chosen because no way of placing it works.

Is this even allowed? Doesn’t Apple review apps?

Apple reviews the app you download from the store, and this rule isn’t in it. The app downloads it from the game’s server after you install, and the server decides which players get which version. Apple does let apps download JavaScript updates like this, which is how tools like Expo Updates work, as long as the update doesn’t change what the app is. Whether changing your pieces based on ad prices fits that is up to Apple.

Why does it run on the phone instead of their servers?

The server does decide who gets the rule and which version. But the decision itself needs things only your phone knows in that moment: your board, the next set it’s about to deal, and the ad that’s loaded right now. So that part runs on the phone, which is also why it could be taken apart.

How I know this is real

The apps. Android: the 10.8.2 XAPK from APKPure, downloaded October 11, 2026. All its split APKs pass signature verification, and the version matches the public listing on APKMirror. iOS: the 7.4.9 IPA from a public mirror. 4,670 of its game resources, including the main script and the catalog, check out against Apple’s code signature.
The rules came from their servers. The Android app’s cache says it downloaded the rule from bband1.afafb.com , the same host it fetches all its traits from. We fetched that URL separately, and the file matched the app’s cached copy byte for byte. The iOS app’s signed catalog names both iOS rules, and the app fetches them from bbios1.afafb.com . As of October 15 all three URLs still serve the same files, so you can check this yourself (commands below).
It was assigned and loaded. On a fresh Android 14 emulator with no account, at 23:01:15 UTC on October 11, the app had the config ready, arm 332243014 selected for this rule, the module loaded with its storage initialized, and the bottom-offer pipeline it plugs into switched on.
The decoding is exact. The traits are encrypted with XXTEA and compressed with Brotli. The decoded rule’s hash is below. For the native library, my offline decode matched a memory dump of the running app across 25,317,680 bytes with zero mismatches.
Nothing in the Android game was changed. The only change was a rendering workaround so the game would draw on the emulator. No scores, ads, flags or config values were edited.

Check it yourself

There are three evidence bundles: Android (113 KB, SHA-256 bd55151e6a1527f628459c2fffa115d5b14a765a3fb5a3f729387fbac6f707c8 ) and iOS (2.7 MB, SHA-256 02bdb0e0e9b02d77844efbcf4b82f48e17f2b688fc48cbf84f83e75ae289df7d ), plus a third for the live iPhone catch (270 KB, SHA-256 5f36863daabd2b500c8062d005f41e6c5e7dcea5a238c89e558e19a928dcc57f ). They have the decoded rules, the encrypted originals, excerpts from the rest of each app with their original line numbers, the test scripts and the provenance records. You need Node.js and Python 3.

Terminal · Android bundle

# the rule, run unmodified with fake inputs: 28 checks, prints "passed": true
node proof/verify_reward_harvest.js

# brute-force search of the test board: 0 solutions in every order
python3 proof/verify_unsolvable.py

# the game's own generator on that board: picks pieces [2, 3, 13]
node proof/verify_packaged_algorithm.js

Terminal · iOS bundle

# both iOS rules, the generator, two solvers and the code-signature check
python3 proof/run_all.py

Terminal · the encrypted rules on their servers match the bundles

curl -s https://bband1.afafb.com/update/block_android_online/remoteRes/0/remote/RewardHighValueAdHarvestTrait/index.700f5.js | shasum -a 256
# dec91aa4001f651a74bf101d512587b9a364cb71ea2a81a9cc9dbbcd2444b477
curl -s https://bbios1.afafb.com/update/block_ios_online/remoteRes/0/remote/RewardHighValueAdHarvestTrait/index.ff35e.js | shasum -a 256
# 61ac70045995f44b3c6bb22b2d062a386593ce6a632fbcec3863a51110850cc2
curl -s https://bbios1.afafb.com/update/block_ios_online/remoteRes/0/remote/RewardHighValueAdHarvestV2Trait/index.677f6.js | shasum -a 256
# e38953430980f4b6a10b29337ec9a41634bb732ee84dd5997bfe78507b26ee1e

Android base APK	`a520fcc1d1ba1ff0c643e30b059c87a01fde650ec46be5c85fde5d815ec82447`
Android XAPK	`91988cf6e92cd0d346b869df0a8c6740f3a5fd8b722e21779e045426c7553015`
Android rule, decoded	`f94a5d54d7f6ab0af097f408bda09b091e7767b17749f8ba828b41b638b330ad`
Android main script	`8dce6532cafc25d982f2af3659647e0e0017c3902cbc31f872d375804dc3678c`
iOS IPA	`7fc9b47e10dc8303f662e1c0ad88b93e7119e2846972eddb1a18bd205b54056a`
iOS rule, decoded	`179bf50ae3c0c4a9bd5457281e4876faae728778f6181dbb0d3799b42ec70d61`

The key and the steps for getting past the apps’ protection aren’t in the bundles. If you’re a journalist or researcher and want to verify the decoding step, email me .

Trump’s Vile Defense of ‘That Ad’

Portside

portside.org

2026-10-23 22:39:50

Trump’s Vile Defense of ‘That Ad’ barry Fri, 10/23/2026 - 22:39 ...

Original Article

Trump’s Vile Defense of ‘That Ad’ Published October 23, 2026

Trump caricature | Philip Cohen (CC BY-SA 2.0)

It had to happen. On Thursday, Donald Trump defended that despicable Republican attack ad that everyone is talking about this week, writing on Truth Social: “Vivek Ramaswamy put up a very powerful Ad about a mother saying that her daughter, Amy Acton, who is running for Governor of Ohio, is a liar, and much worse.” And he didn’t stop there! He of course took the side of Donna Arthur, Acton’s estranged mother, who decided to stay married to her daughter’s rapist and is the ad’s “star”: “Frankly, anybody whose mother spoke about a daughter in that way would normally lead to the daughter being precluded from serving in Office, let alone the Office of Governor.” And he didn’t stop there , either: “The Press is trying to convince everyone that this Ad is bad, because it’s so good! Who wouldn’t use such an Ad? I would, it’s called, ‘hitting pay dirt.’”

There you have it. The sickest and most repulsive TV ad in American political history, endorsed by the sickest and most repulsive human in American political history. Once again, Trump drags America to a bottom that most of us didn’t know existed.

But is it really the bottom? Please. There’s always a new bottom with Trump. We’re 12 days out from Election Day. And we’re 73 days out from January 3, when, by custom and in theory, the next Congress will be sworn in and seated—a ceremony whose execution right now seems very much in doubt. There’s time for a dozen new bottoms between now and then.

But this is the bottom we have for now, and it’s worth noting, because it screams at us that there is literally nothing these MAGA Republicans won’t do for power. And don’t be fooled by these headlines about “overwhelming bipartisan denunciation.” Yes, some Republicans have denounced the ad—but if you look at it, it’s not really that many. Ohioans Mike DeWine and Jon Husted did, lest its mephitic stink encircle them (although DeWine added that he still endorses Ramaswamy, so what is that denunciation worth?). But if you google “Republican senators and House members who have denounced the Ramaswamy ad,” you’ll find pretty slim pickings.

The press loves to slap the word “bipartisan” on a story whenever it can, even on the thinnest of justifications. When a group of New Republic editors was discussing this matter on Wednesday morning, one editor said, “Yeah, I see these headlines that say ‘bipartisan criticism of Trump,’ and I look for the Republicans, and it’s one quote from Thom Tillis.”

So: Does it really matter that Meghan McCain denounced the ad? Or even Nikki Haley, who is (for now) retired from politics? Representative Nancy Mace, who has spoken about being raped, laid into it , so at least that’s one sitting non-Ohio GOP pol. I’d imagine there were a few others that I missed, but the outrage has been a long, long distance from universal.

And among right-wing pundits? I admit that I don’t read or watch them much, and spending too much time googling the matter feels a bit like googling how many mass shooters denounced Dylann Roof . So maybe some Fox News host was indeed genuinely outraged, and for this, I (with one hand) applaud them.

But Media Matters for America has collected a number of right-wing commentators who are as pleased as punch about it:

Michael Knowles of the Daily Wire called it “brilliant, brilliant,” adding: “I think it’s a very, very effective ad. It’s brutal.”
Newsmax host Greg Kelly: “Everybody in Ohio and the country should be listening to Amy Acton’s mom.” And: “The mother speaks with love here. I believe the mother loves Amy.” And: “She seems like a very nice lady, actually.… Wow, that’s some—the mother, I believe her.”
Dan Bongino, the podcaster turned FBI honcho turned podcaster: “This is the most destructive political ad I have ever seen.”
Gateway Pundit’s Wayne Allyn Root: “The more you meet these Democrat candidates, they’re all crazy. They’re all covering up for the fact that they’ve had mental illness their whole life. They’re crazy, whacked-out people.” He also called the ad “absolutely hilarious.”

You might say that this doesn’t add up to much. And perhaps it doesn’t. Maybe Ramaswamy’s polls will tell him that the blowback is too much.

But there exists another possibility. Now that the president of the United States has lent the ad his imprimatur, a day after his vice president did the same, I submit to you that it’s pretty clear what the next 12 days could bring. Trump, Ramaswamy, and JD Vance—the latter two, by the way, were buds when they were at Yale Law together—will keep pushing and pushing this. And the right-wing media, and that segment of it that might have been knocked back on its heels for the first 48 or 72 hours, will collect itself and hop enthusiastically on this toxic train.

I hope Amy Acton and her campaign team are ready for this. A normal person … well, a normal person wouldn’t have made and run that ad to begin with. But let’s say a normal person did. Said normal person would take stock of the revulsion and quietly pull the ad, or scale back the buy, and change the subject to something “relevant” like trans athletes.

But these are not normal people. These are sick, twisted, cruel, sadistic, and psychotic people. That’s five adjectives, which may seem like a bit much, but I chose them with care. They do not care at all that Acton was raped as a 12-year-old girl. They care only about how they can crush her—politically, emotionally, in every way. That’s what makes these people different. They don’t just want to win elections. They want to destroy lives.

And here’s a question that I really hate to ask, but it’s one we must contemplate: What if Ramaswamy still wins? It’s possible. And if he does, it’s hard for us normal people to imagine what kind of attacks will be unleashed for 2028 and beyond if this vile smear works.

It probably won’t work. It probably will backfire. But I hope Acton and her team are not sitting there assuming that Ramaswamy is going to soften his approach. He’s going to start hitting harder on this and other points. And Trump and Vance will have his back. It will be yet another new bottom. But rest assured that it won’t be the last.

Michael Tomasky is the editor of The New Republic and author of five nonfiction books. His new novel, Killing Baby Hitler, was in June by O/R Books. With extensive experience as an editor, columnist, progressive commentator, and special correspondent for renowned publications such as The Guardian, The Washington Post, The New York Times, the Daily Beast, and many others, Tomasky has been a trusted voice in political journalism for more than three decades.

The New Republic was founded in 1914 to bring liberalism into the modern era. The founders understood that the challenges facing a nation transformed by the Industrial Revolution and mass immigration required bold new thinking.

Today’s New Republic is wrestling with the same fundamental questions: how to build a more inclusive and democratic civil society, and how to fight for a fairer political economy in an age of rampaging inequality. We also face challenges that belong entirely to this age, from the climate crisis to Republicans hell-bent on subverting democratic governance.

We’re determined to continue building on our founding mission.

Sign up for a TNR newsletter on politics, climate, culture and more.

Apple Security Research Device

Hacker News

security.apple.com

2026-10-23 22:36:38

Comments...

Original Article

iPhone is the world's most secure consumer mobile device, which can make it challenging for even skilled security researchers to get started. We created the Apple Security Research Device Program to help new and experienced researchers accelerate their work with iOS.

Now accepting applications through October 30, 2026.

Apply below.

How it works.

The Security Research Device (SRD) is a specially fused iPhone that allows you to perform iOS security research without having to bypass its security features. You also benefit from access to software previews, security beta projects, the SRD research community, and special tooling to augment research and vulnerability discovery. Shell access is available, and you can run any tools, choose your own entitlements, and even customize the kernel.

All iOS and iPhone components are eligible for SRD Program research, except Apple Pay and third-party apps. Using the SRD allows you to confidently report all your findings to Apple without the risk of losing access to the inner layers of iOS security. Plus, any vulnerabilities that you discover with the SRD are automatically considered for

Apple Security Bounty — including bonus awards for preview and beta software programs.

Guidelines.

The SRD is intended for use in a controlled setting for security research only. If your application is approved, we will provide you an SRD as a 12-month renewable loan. During this time, the device remains the property of Apple.

The SRD isn't meant for personal use or daily carry, and must remain on the premises of program participants at all times. Access to and use of the SRD must be limited to people authorized by Apple.

If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to us and, if the bug is in third-party code, to the appropriate third party.

Our ultimate goal is to protect users, so if you find a vulnerability without using the SRD for any aspect of your work, we'd still like to receive your report. We review all research submitted to us and consider all eligible reports for rewards through Apple Security Bounty .

Eligibility.

Participation in the Security Research Device Program is subject to review of your application.

To be eligible for the Security Research Device program, you must:

Have a proven track record of success in finding security issues on Apple platforms, or other modern operating systems and platforms.

Be based in an eligible country or region. *
Be the legal age of majority in the jurisdiction in which you reside (18 years of age in many countries).
Not be employed by Apple currently or in the last 12 months.

How to apply for a Security Research Device.

A limited number of Apple Security Research Devices are available each year.

To apply, sign in with your Apple Account. To enroll as a company, university, or other type of organization, you must be authorized to act on your organization's behalf and provide the names of everyone who will need access to an SRD. If approved by Apple, each person will have to acknowledge their responsibilities.

Apply for a Security Research Device.

This year's application period ends October 30, 2026.

An Incremental Approach to JIT Construction

Lobsters

dl.acm.org

2026-10-23 22:10:41

Comments...

Original Article

Alzheimer's breakthrough: 2 hrs of sleep restored without clearing brain plaques

Hacker News

www.sciencedaily.com

2026-10-23 21:53:10

Comments...

Original Article

Scientists have discovered an unexpected reason why Alzheimer's disease disrupts sleep, and their findings suggest that the problem may be reversible. In experiments involving mice with Alzheimer's-like brain changes, researchers restored more than two hours of sleep per day without removing the amyloid plaques associated with the disease.

The surprising discovery points to an overlooked culprit: the brain's own immune cells. Rather than simply protecting the brain from damage, these cells can trigger inflammation that interferes with healthy sleep.

Researchers at the University of Kentucky found that temporarily eliminating most of these immune cells allowed the mice to sleep longer and spend more time in the deep, restorative stages of sleep. The results suggest a potential new approach to treating one of the most disruptive symptoms of Alzheimer's disease.

The findings, published in the journal Alzheimer's & Dementia , were reported by a team led by Shannon L. Macauley, Ph.D., an associate professor of physiology at the University of Kentucky College of Medicine, and first author Nicholas J. Constantino, Ph.D., a recent doctoral graduate.

Macauley described the discovery as "paradigm-shifting" because it challenges the prevailing understanding of why people with Alzheimer's often experience severe sleep problems.

How the Brain's Immune System Can Disrupt Sleep

To understand what the researchers uncovered, imagine a small fire breaking out in a kitchen. Instead of containing the flames, the building's sprinkler system activates everywhere, flooding the entire house and causing widespread damage.

Something similar may happen in the brain during Alzheimer's disease.

Amyloid plaques are deposits of sticky protein fragments that accumulate between nerve cells. They are one of the characteristic features of Alzheimer's and have long been investigated for their role in the disease.

The brain also contains specialized immune cells known as microglia. These cells normally protect the nervous system by removing debris, responding to injuries, and helping maintain a healthy environment for neurons.

However, when microglia detect amyloid plaques, their defensive response can become excessive. Instead of simply addressing the threat, they release inflammatory signals that may interfere with normal brain activity.

Scientists have traditionally linked sleep problems in Alzheimer's primarily to damaged neurons or the accumulation of amyloid plaques. The new findings suggest that the immune system's reaction to those plaques plays a major role.

"Basically, we showed that it is not the plaques themselves, or solely dysfunctional neurons, that cause sleep loss but actually microglia," said Macauley. "Microglia are immune cells that, when they respond to plaques, kick off this elaborate cascade of inflammation, as if the microglia are partying all night, and keeping the brain awake."

In other words, the brain's response to Alzheimer's pathology may create additional problems beyond those caused by the plaques themselves. The researchers compared this widespread reaction to a "whole house response," in which a defense mechanism ends up causing more disruption than expected.

Tracking Alzheimer's Sleep Changes Inside the Brain

To investigate the connection between microglia and sleep, the scientists studied two groups of mice. One group was genetically predisposed to develop amyloid plaques, while the other consisted of normal "wild-type" mice that experienced typical aging.

The researchers examined the animals at two ages: six months, when plaques first appeared in the genetically modified mice, and 18 months, when the disease model showed more advanced pathology.

Comparing these groups helped the scientists distinguish changes associated with Alzheimer's pathology from those that naturally occur as the brain ages.

The team used several advanced technologies to measure sleep and examine what was happening inside the brain.

Each mouse was fitted with a small device that recorded electroencephalography (EEG) and electromyography (EMG).

EEG measures the brain's electrical activity, including the patterns and rhythms produced when networks of neurons communicate. These electrical signals change depending on whether the brain is awake, dreaming or experiencing deep sleep.

EMG measures electrical activity in muscles. Combining the two techniques allowed researchers to identify different sleep stages and determine how long the animals remained in each one.

The scientists also wanted to visualize the relationship between amyloid plaques and immune cells throughout the brain.

For this, they used light-sheet microscopy, an imaging technique that makes biological tissue transparent and illuminates it with a thin layer of laser light. The resulting images can be assembled into detailed three-dimensional maps, allowing scientists to examine structures that would otherwise be difficult to see.

This approach revealed the distribution of plaques and microglia across the brain, helping researchers understand where immune cells were responding to Alzheimer's pathology.

Scientists Temporarily Remove 87% of Brain Immune Cells

To determine whether microglia were actually responsible for disrupted sleep, the team conducted an experiment designed to temporarily eliminate most of these cells.

The researchers administered a drug called Pexidartinib (PLX3397), which was originally developed for cancer research. It blocks a cellular signal that microglia depend on for survival.

After the mice received the medication in their food for 14 days, approximately 87% of their microglia had been depleted.

This allowed the scientists to test whether sleep would improve when the cells driving the inflammatory response were largely absent.

The researchers also performed a detailed analysis of the animals' brain activity using a mathematical method called Fitting Oscillations and One Over Frequency (FOOOF).

This technique separates electrical signals into periodic activity (the rhythmic waves we usually think of as brain waves) and aperiodic activity (the background electrical noise).

By examining these different components, the team could identify changes in how the brain was functioning, including whether it remained unusually active during periods when it should have been resting.

The process is somewhat like monitoring a car engine to determine whether it continues running at high speed even when the vehicle is supposed to be idle.

A Surprising Discovery About Alzheimer's Brain Plaques

Macauley called the results "mind-blowing and unexpected."

One of the most surprising findings was that sleep problems did not continue worsening as amyloid plaques accumulated.

The researchers initially expected that increasing plaque buildup would lead to progressively more severe sleep disturbances. Instead, the mice developed substantial sleep problems relatively early, and those problems remained largely unchanged even as plaque levels increased dramatically.

"I expected that as plaque burden became more severe, sleep disruption would also worsen," said Constantino. "The disruptions in sleep and cortical EEG activity that occur at 6 months, when plaques first emerge, did not worsen by 18 months, despite more than double the amount of plaque burden."

The team described this pattern as a ceiling effect. Essentially, sleep disruption appeared to reach a certain level early in the disease process rather than increasing in direct proportion to the amount of amyloid in the brain.

This suggests that the initial inflammatory response triggered by plaques may be particularly important. Once microglia become activated and disrupt sleep, additional plaque accumulation may not necessarily produce an equivalent increase in sleep loss.

The discovery offers an important clue as to why sleep disturbances can emerge relatively early in Alzheimer's disease.

Alzheimer's Disrupts a Different Type of Sleep Than Normal Aging

The study also revealed a notable difference between sleep changes caused by normal aging and those associated with Alzheimer's pathology.

Sleep is not a single, uniform state. Throughout the night, the brain moves through several stages that perform different functions.

Rapid eye movement (REM) sleep is strongly associated with vivid dreaming and plays an important role in processing memories. The researchers found that normal aging primarily reduced this type of sleep.

Alzheimer's pathology, however, had a different effect. It selectively disrupted non-rapid eye movement (NREM) sleep, which includes the deepest and most physically restorative stages of sleep.

During NREM sleep, the brain performs essential maintenance functions that support learning, memory, and recovery. Deep sleep is also associated with processes that help clear metabolic waste products from the brain.

"That restorative sleep is super important for physical repair, learning and memory and washing out the toxins of the day," Macauley said.

Losing this important stage of sleep could have consequences beyond daytime fatigue.

Because healthy sleep helps maintain the brain's internal environment, disruptions may interfere with processes that normally remove potentially harmful waste. Researchers suspect this could contribute to a self-reinforcing cycle in which Alzheimer's pathology disturbs sleep, and inadequate sleep may further aggravate the disease.

Breaking that cycle could therefore become an important treatment strategy.

More Than Two Hours of Sleep Restored Without Removing Plaques

The most striking result emerged after the researchers temporarily removed most of the microglia from the brains of mice with Alzheimer's-like pathology.

The animals gained more than two hours of sleep per day.

They also experienced longer periods of restorative NREM sleep, giving them more opportunities to transition naturally into REM sleep, which is important for memory formation.

Even more surprisingly, these improvements occurred without any reduction in amyloid plaque levels.

The plaques were still present, but the mice were sleeping substantially better.

This finding provides evidence that the inflammatory response driven by microglia contributes directly to sleep disruption and that suppressing this response can reverse at least some of the associated sleep problems.

It also suggests that researchers may not need to eliminate amyloid plaques to improve sleep in Alzheimer's disease.

Although these findings are promising, the experiments were conducted in mice, and the same benefits have not yet been demonstrated in people. Temporarily removing most of the brain's immune cells is also not an established or practical treatment for Alzheimer's patients.

The researchers are now interested in whether the beneficial effects can be reproduced by adjusting microglial activity rather than eliminating the cells themselves.

If such an approach eventually proves successful in humans, it could provide a way to improve sleep and potentially reduce some of the additional stress that poor sleep places on the brain.

The Research Team Behind the Discovery

The work was conducted in Macauley's laboratory in the Department of Physiology at the University of Kentucky's Sanders-Brown Center on Aging.

Macauley credits the achievement to a "beautiful partnership" with students and researchers who were willing to challenge established ideas about Alzheimer's disease.

"I love people who take initiative, find their passion, are curious, and keep pushing to find an answer," Macauley said.

She encourages members of her laboratory to be "calculated risk-takers," emphasizing that meaningful discoveries often require scientists to investigate possibilities that may initially seem unlikely.

A quote from hockey legend Wayne Gretzky hangs in her office: "You miss 100% of the shots you don't take."

Constantino, who recently completed his doctorate at the university, said the laboratory's collaborative environment encouraged him to pursue questions that crossed traditional scientific disciplines.

"Dr. Macauley has also taught me to embrace uncertainty and failure as part of the scientific process," Constantino said. "Some of the most interesting studies I have been a part of emerged because our original hypothesis was wrong."

Macauley reinforces this mindset with a simple instruction to her team: "Follow the data, ask better questions, and figure out what is actually happening."

That approach helped the researchers move beyond the traditional emphasis on neurons and amyloid plaques to examine the broader role of the brain's immune system.

Could Existing Medications Help Restore Sleep in Alzheimer's?

The research team is now exploring ways to translate these findings into treatments and diagnostic tools that could eventually benefit people with Alzheimer's disease.

One promising direction involves calming overactive microglia without removing them.

Because microglia perform essential protective functions, eliminating them is not an ideal long-term strategy. Instead, the researchers hope to modify how these immune cells respond to amyloid plaques and regulate inflammation.

The laboratory is investigating existing medications, including the diabetes drug Metformin and the anti-seizure medication Stiripentol.

These drugs are being studied for their potential to alter how microglia produce and use energy, a process known as cellular metabolism. Changing that energy use could potentially reduce excessive immune activation and its harmful effects on sleep.

The hope is to prevent the brain's inflammatory response from becoming so intense that it disrupts normal sleep activity.

Researchers are particularly interested in whether intervention during the earlier stages of Alzheimer's could improve sleep and quality of life before substantial memory loss develops.

"If we can target that process, it might help with quality of life, attention, cognition and confusion," Macauley said.

The proposed drug strategies remain experimental for this purpose, and additional research will be necessary to determine whether they can safely produce similar benefits in humans.

A Simpler Way to Detect Early Alzheimer's Changes

Beyond identifying a potential treatment target, the study uncovered electrical activity patterns that may help distinguish Alzheimer's pathology from normal brain aging.

The researchers believe these patterns could eventually make EEG a useful tool for detecting and monitoring changes associated with Alzheimer's disease.

Unlike more expensive imaging procedures, EEG records electrical signals through electrodes placed on the scalp. It is relatively affordable, does not require surgery, and can be repeated to follow changes over time.

The team envisions EEG becoming a "readily accessible, affordable and longitudinal biomarker of Alzheimer's disease."

A biomarker is a measurable biological sign that provides information about a person's health or a particular disease. A longitudinal biomarker can be tracked repeatedly to monitor how a condition develops or changes.

"Portable EEG systems could allow us to monitor people in their home environments and potentially screen for changes associated with an Alzheimer's disease, without the initial need for expensive or invasive tests," Macauley said.

If future human studies confirm the usefulness of these electrical signatures, portable EEG devices might eventually help doctors identify people who need additional testing.

This could be particularly valuable in rural communities across Kentucky, where patients sometimes must travel long distances to reach specialized medical centers.

Instead of requiring every potentially at-risk patient to undergo advanced testing immediately, local clinics might use simpler monitoring tools to identify individuals who would benefit from further evaluation.

Although this application still requires validation, it offers a possible path toward more accessible Alzheimer's screening and monitoring.

Ultimately, the study suggests that treating Alzheimer's may require looking beyond the plaques themselves and examining how the brain responds to them.

By identifying the immune cells responsible for much of the sleep disruption in their mouse models, the University of Kentucky researchers have uncovered a potential way to restore an essential brain function without first removing the underlying amyloid deposits.

The next challenge is determining whether calming these cells can deliver similar benefits in people, potentially improving sleep, cognition and quality of life long before the most severe symptoms of Alzheimer's develop.

Research reported in this publication was supported by the National Institute on Aging of the National Institutes of Health under Award Numbers R01AG068330, R01AG093847 and P30AG072946, and by the National Institute of General Medical Sciences of the National Institutes of Health under Award Numbers P30GM127211 and P20GM148326. The content is solely the responsibility of the authors and does not necessarily represent the official views of the National Institutes of Health.

This work was supported by a $287,236 award from the Cure Alzheimer's Fund.

This work was supported by a $250,000 award from The CART Fund (Coins for Alzheimer's Research Trust).

Mark Zuckerberg Pushed Meta to Shield Him from California's Proposed Wealth Tax

Hacker News

www.nytimes.com

2026-10-23 21:35:49

Comments...

Original Article

Please enable JS and disable any ad blocker

Twelve Years of Distributed SQLite

Hacker News

philipotoole.com

2026-10-23 21:16:58

Comments...

Original Article

In September 2014 I published a short post announcing rqlite . The idea was simple: take SQLite , put a Raft log in front of it, and replicate every write to a cluster so that the loss of a node did not mean the loss of the data. The source went on GitHub that same weekend. As far as I can tell, that was the first open-source system to combine Raft and SQLite. Nobody else was doing it, and for several years nobody else tried.

Today “distributed SQLite” is a category with a dozen projects in it, a few of them venture-funded, two of them acquired. Since the people now writing about the category tend to start the story around 2021, I thought I should write down the version that starts in 2014. I was there for all of it.

2014: rqlite

The need was concrete. A clustered system I worked on at jut.io needed a small amount of relational storage, and the question of which node should hold it had no good answer. Replicating SQLite with a consensus protocol solved it. We went another way at work, but I kept building rqlite because the problem was general and the solution was small. The first version used goraft , the same library InfluxDB and etcd used at the time (I joined InfluxDB as a core developer around the same time). In early 2016 I replaced it with Hashicorp’s Raft implementation , which rqlite still uses.

The design decision that mattered most was made then and never changed. rqlite is a CP system . Writes must go through the leader, a majority must acknowledge, and a partitioned minority refuses writes. Everything else, the HTTP API , the read-consistency levels , the snapshotting , followed from that.

Before 2014, and alongside it

Two things deserve mention for honesty’s sake. Expensify had been replicating SQLite inside its own infrastructure for years with a Paxos -style protocol; they released it as Bedrock in 2016 . And ActorDB, an Erlang system that gave each “actor” its own SQLite database replicated by Raft, appeared around the same time as rqlite . Neither was widely adopted outside its origin, but both show the idea was in the air. What rqlite did was make it a standalone, general-purpose, open-source thing anyone could run.

2017: dqlite

Canonical built dqlite to get LXD and later MicroK8s an embedded replicated store without running etcd. Mark Shuttleworth actually called me once, and we talked, hoping that rqlite could be made to work, but it never quite fit. dqlite began in Go and was rewritten in C with its own Raft library. It is the project most similar to rqlite in intent, and the main difference is of one of packaging: dqlite is a library you embed, rqlite is a server you run. Canonical’s need was a database inside their products: mine was a database beside anyone’s product.

2021: Litestream, and a change of approach

Ben Johnson (whom I worked with at InfluxDB) released Litestream in early 2021 . Litestream does not use consensus at all. It watches the SQLite WAL and streams it to S3 , giving you disaster recovery for a single-node SQLite database at almost no cost. Ben’s argument was that most applications do not need a cluster; they use one machine and need a way to recover if it dies. He was right about a great many applications, and the “SQLite is enough” movement of the next few years, with blog posts and conference talks, owes a lot to that argument.

Litestream and rqlite answer different questions. Litestream: what if the machine dies? rqlite: what if the machine dies and I cannot wait to restore? The first question is more common, the second is the one people have when they come to rqlite.

Fly.io hired Ben in 2022 and shipped LiteFS , which replicates SQLite at filesystem level with leases from Consul . It was the first attempt to make replicated SQLite a platform feature rather than a thing you deploy. And in a final twist, Litestream inspired rqlite’s v8.0 approach to handling the SQLite WAL.

2022: forks and extensions

Two projects in 2022 took approaches that neither rqlite nor Litestream had. cr-sqlite added CRDTs to SQLite as an extension, so that multiple writers could diverge and merge without a leader. That is the AP corner of the design space, and it suits local-first applications where rqlite’s CP guarantees would be a hindrance.

libSQL forked SQLite itself. ChiselStrike, later Turso , wanted to change things inside the engine that the SQLite project, which does not accept outside contributions, and would not change. On top of the fork they built a hosted service with replicas at the edge. Turso raised venture money on that, and in 2026 Supabase acquired them .

Around the same time, SQLite Cloud appeared, offering hosted SQLite replicated with Raft. It is the project closest to rqlite’s original design, wrapped in a cloud service.

2022 onward: the platforms

Cloudflare announced D1 in 2022, SQLite as a serverless database inside their edge network, and later put SQLite storage inside Durable Objects . This is replicated SQLite as a managed product from a company that does not need to tell you how it works. Turso’s service is the same shape. The category had gone from “a thing you run” to “a thing you buy.”

What the twelve years show

Three things, I think.

The core was right. SQLite as a storage engine, with replication added on the outside, has been reinvented by at least eight teams with different needs and different protocols. Nobody has found a reason to stop doing it.

The design space has three corners, and they appeared in order. Consensus first (rqlite, dqlite): one leader, strong consistency, a cluster. Streaming second (Litestream): one writer, cheap recovery, no cluster. Merge third (cr-sqlite, and parts of the local-first movement): many writers, eventual consistency. Each is correct for a different question, and most of the arguments are arguments between their users about which question is being asked.

And the money went to the platforms. rqlite, dqlite, and Litestream are open source and free. The projects that raised the capital or got acquired are the ones that turned replicated SQLite into a service with a bill. That is the usual fate of infrastructure ideas, and I do not mind it. But it is worth recording that the idea was open source for eight years before anyone sold it.

rqlite is still here. It does the same thing it did in 2014, a good deal better, and it is still the thing you reach for when you want a fault-tolerant relational database you can run yourself, understand fully, and not pay anyone for. Twelve years in, I am content with that position in the story.

Around a dozen banking apps began specifically permitting GrapheneOS

Hacker News

grapheneos.social

2026-10-23 21:15:14

Comments...

Original Article

Evolving Threat: http2shell is an RCE in node, Python, and more

Hacker News

nitter.click

2026-10-23 19:30:17

Comments...

Original Article

The Vulnerability Apocalypse and Why We Should Fund Open Source

Electronic Frontier Foundation

www.eff.org

2026-10-23 18:36:46

If you use the internet at all, you may have noticed that a large percentage of sites suddenly went down earlier this week—and all your nerdiest friends were talking about "The Vulnerability Apocalypse” and this thing called PHP that powers nearly 70% of the websites on the internet. You may find yo...

Original Article

If you use the internet at all, you may have noticed that a large percentage of sites suddenly went down earlier this week — and all your nerdiest friends were talking about "The Vulnerability Apocalypse” and this thing called PHP that powers nearly 70% of the websites on the internet . You may find yourself wondering: what is PHP, what just happened, what is the vulnerability apocalypse, and what do I need to do?

To find out what you can personally do read the first blog post in this series!

What Is PHP?

PHP is a programming language used mainly to create interactive websites. Facebook, Wordpress, Wikipedia, Etsy, and other major sites all use or were originally built on PHP. It is a long-established mainstay of web development. But because it is open-source, maintenance of these critical systems depends on a small number of volunteers working on this in their free time. The disaster scenario that happened this past week is the perfect example of why we need more money and people supporting open-source projects. Corporations should be contributing both.

What Is the Vulnerability Apocalypse?

Common Vulnerabilities and Exposures (CVEs) are the way that security professionals file reports about vulnerabilities in software. The National Vulnerability Database (NVD), run by NIST, is the official national database of CVEs. In other words, CVE reports managed by NIST are the closest thing we have to a canonical database of security vulnerabilities in software. The NVD currently has around 400,000 CVEs that have been filed and accepted since 1988. In just the month of October, 13,000 new CVEs have been submitted. This means that 3% of critical software security bugs that have ever been officially logged were found in the last month alone. And it's likely that by the end of the year over a quarter of the software vulnerabilities that have ever been found will be from 2026.

a graph showing the number of computer vulnerabilities by week since 1990, increasing exponentially in the last couple months.

Computer vulnerabilities reported are rising exponentially. Source: CVE Tracker

This research is being driven almost entirely by the cybersecurity capabilities of major AI models from companies like Anthropic, OpenAI, and Google. Historically it has been popularly assumed by cybersecurity experts that finding unknown (zero-day) exploits in any specific project and turning them into exploits was expensive. The knowledge to discover them was not widespread, and it was a hard task even for those initiated into the arcane ways of vulnerability hunting. Google even dedicated an entire team to it .

But now thanks to major AI models, vulnerabilities are cheap, and anyone of moderate technical skill with a few dollars and access to a frontier AI model can find vulnerabilities in a few minutes. For example, recent vulnerabilities in PHP were found with a prompt to an AI model that literally said " find bad vulnerabilities in PHP ."

What Happened This Week?

In 2024, a potentially severe vulnerability in PHP was discovered during an external security audit . PHP’s maintainers couldn’t agree on a solution, but more importantly, they couldn’t find a way to exploit the vulnerability. Because it didn’t seem like an active threat, they ended up deprioritizing a fix in favor of working on more urgent security issues. Then, in August 2026, security researchers working with the latest models from OpenAI and Anthropic independently discovered the vulnerability again, and another one — and now, with a way to exploit them.

We now know that the vulnerabilities were so severe that they would have allowed even moderately inventive hackers to take over any website that uses PHP and then steal customer data, launch further malware attacks, spy on users, take websites offline, or launch a massive denial of service attack. ^{[

1

]}

Because of the severity of these vulnerabilities, several of the involved researchers got together with the makers of PHP to patch the vulnerabilities and disclose them in a coordinated manner. The idea was that hopefully everyone would get a chance to quietly release and then apply fixes for the vulnerabilities before the whole world found out about it.

But news already started to leak on October 20th. There was a post on a widely read forum “Hacker News” and other posts elsewhere. One of the researchers accidentally published a video early. Companies reported seeing active exploitation of the vulnerabilities going back as far as October 17th. On October 21st, six hours before the planned press embargo, one company, Chainguard, jumped the gun and released a patch early, essentially giving anyone instructions about exactly where to find the vulnerabilities and how to weaponize them. This sent system administrators everywhere scrambling to patch their systems before they were taken over by hackers. And it’s going to take a long time to patch all these systems. At the time of this writing over 33 million websites are still running on vulnerable versions of PHP .

The internet is run largely on open-source software, mostly maintained by a small handful of skilled volunteers occasionally getting a small stipend, not by major corporations and highly paid engineers. These are projects you have perhaps never heard of, like PHP, OpenSSL, and SQLite, but these programs run on nearly every computer in the world and are maintained by teams as small as one person. When a vulnerability is found in these projects, it can be devastating.

PHP isn’t the only critical open-source software with a high severity vulnerability this week either. Other widespread open-source projects like Node.js and GitLab also had severe security bugs reported.

The small number of already overworked open-source maintainers are now facing a deluge of vulnerability reports, some of which are false, but many of which are very real. Burnout in open source has never been higher .

We Need Stronger Support for Open Source Projects

Much of the foundation for the modern multibillion-dollar internet industry is built on open-source products that were created and still maintained — for free — by dedicated volunteers in their spare time. It’s an imperfect system, and it can lead to errors.

One of those critical, under resourced open-source products is PHP. And while vulnerabilities in PHP were privately found years ago, they were left unfixed because they didn’t seem as impactful as other bugs at the time. These same vulnerabilities were recently rediscovered and proved to be trivially exploitable by security researchers using advanced AI models. While in the middle of the widespread, global effort to correct this mistake and deploy fixes, the problem was leaked by some of the security researchers who had gotten early access to the fixes. Unfortunately, this left millions of websites, ranging from personal blogs to government sites, vulnerable to hacking that could result in data theft, malware distribution, and worse.

Open-source projects like PHP and others are the backbone of the entire internet. If they don’t get the resources they need, they and the internet they power, are at risk of falling apart. Corporations (whose products would not exist without these products) should be actively contributing to their maintenance.

^{1. A technical analysis of the vulnerabilities is out of scope for this post and has already been

written by the original researchers

.}

Computer Security Is About to Get a Lot Worse, Here’s What You Can Do

Electronic Frontier Foundation

www.eff.org

2026-10-23 18:36:29

It is a commonly held truth among computer geeks that there is no such thing as bug free software, or a secure computer. Any piece of software that anyone actually uses will have a security vulnerability somewhere in the code. The more complex that software is, the more likely there will be a vulner...

Original Article

It is a commonly held truth among computer geeks that there is no such thing as bug free software, or a secure computer. Any piece of software that anyone actually uses will have a security vulnerability somewhere in the code . The more complex that software is, the more likely there will be a vulnerability. Fortunately for everyone, finding severe vulnerabilities was generally considered an expensive and difficult task requiring years of training and deep knowledge of how computers and software worked. Until recently there was a steady background hum of vulnerabilities being found and patched, with major vulnerabilities that could cripple the entire internet only happening every few years. Now that is no longer the case.

You may have noticed your nerdiest friends freaking out about the “Vulnerability Apocalypse” this week and waving their arms in panic about something called PHP. You may have also noticed that some of your favorite websites were down for a bit. In the last two weeks of October alone, there have been multiple, potentially internet-breaking vulnerabilities reported and patched. Many of those vulnerabilities were in the open-source software that is the foundation of the vast majority of the internet.

For more detailed information on what happened, and why supporting open-source projects matters, check out our other blog .

This is all because frontier AI models, such as those created by OpenAI, Anthropic, and others, have made it incredibly cheap and easy to find previously unknown vulnerabilities (zero-days) in open- and closed-source code. Three percent of all software vulnerabilities ever found in history were found just in the month of October. This year alone researchers have found nearly a quarter of all software security issues which have ever been discovered.

If exploiting critical software is now cheaper and easier than ever, what does that mean for us as individuals and what does that mean for society as a whole? TL; DR : It’s going to get worse before it gets better. But you can protect yourself with basic digital security hygiene that is now more important than ever.

What Do I Need to Do?

There absolutely needs to be a bigger conversation about how we got here and how to fix the systemic issues involved, including how corporations that depend on open-source code should contribute to their upkeep, and how big tech should be regulated.

But for now, this news is a compelling reason to tighten up your digital hygiene. A lot of computers are going to get hacked a lot more often, and unfortunately, it isn’t going to get better any time soon. Thankfully, EFF has compiled a comprehensive set of security advice in our Surveillance Self-Defense guides . To start , we recommend making sure your browser and all applications are always up to date with the latest patches.

You should also consider installing a tracker blocking tool, like EFF’s Privacy Badger (now on Safari), and remain vigilant for phishing attempts . Additionally, install a password manager and use unique passwords for each website, so that if one site is compromised, the rest of your passwords are safe. You should also be aware that data breaches may now be more likely, and the websites you visit may experience more attacks than usual, which means that some services may be disrupted.

If you host a blog or other website, make sure that either you or your hosting provider has patched this particular issue.

For additional tips on protecting yourself and others, head over to our Surveillance Self-Defense site . Additionally, if you’d like to support any of EFF’s open-source projects like Privacy Badger , Rayhunter , and Certbot , visit our donate page .

German court calls Google aerial imagery 'spying'

Hacker News

www.courthousenews.com

2026-10-23 18:18:49

Comments...

Original Article

Why have I been blocked?

This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

What can I do to resolve this?

You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.

One Man's Pan Am 747 Replica [video]

Hacker News

www.youtube.com

2026-10-23 17:46:51

Comments...

Original Article

Incremental Computation Graphs

Lobsters

dziban.net

2026-10-23 17:35:45

Comments...

Original Article

Abstract

Overview of computation graphs

Background

I learned this as part of my work on Yabu . There I need to work recompile, regenerate code and type-check at interactive speeds.

The implementation is based on Salsa

Main Ideas

You have two main things in the algorithm:

Inputs , mutable, the only source of external change. The system sets these and then consumes from:
Computations , pure functions of inputs or other computations, these are memoized and invalidated by the red-green walk.

For example, in the case of Yabu an input would be the function definition. Let’s say you already have an image and you redefine a function.

(defun some-func ((a int) (b int)) int 
  (+ a b))

The source string of this function would become an input and then from there you have defined several pure computations.

For example we can have a parse function, it depends on the source input and returns the AST of the source. Because this is a pure function, if the input hasn’t changed we can just return the memoized AST without having to re-parse it.

(define-computation parse (source)
  (yabu:parse source))

Now this gets interesting once you start composing computations, this looks very similar to regular functions calls except these internally keep track of which computations you are calling. Creating a runtime-graph of dependent computations. We’ll use this graph later to invalidate computations once inputs change.

(define-computation compile (source)
  (let* ((typecheck-result (typecheck source)))
    (if (errorp typecheck-result)
        typecheck-result
        (yabu:compile ast))))

NOTE: This is not a correct compile function for Yabu, because you are only checking if this function typechecks against the rest of the functions not if the rest of the functions typecheck against this function. We are also skipping around some complications around the staging system.

You can check the real algorithm at Yabu Incremental Typesystem

Here parse , typecheck and compile are all computations. These create a runtime graph where we see that compile <source> depends on typecheck , which will in turn probably depend on parse and it will probably depend on another computation type-signature for all of the functions the AST calls.

                   compile(source) ----.
                                       |
                                       v
           parse(source) <------ typecheck(ast)
                                       |
              .------------------------+------------------------.
              v                        v                        v
      type-signature(f_1)      type-signature(f_2)   ...   type-signature(f_N)

Now if f_1 changes type signature, automatically the typecheck of this function will get invalidated! This invalidation is key to make the Yabu typechecker very fast for interactive use even in large programs.

Red-green walk

Each memoization entry stores several things:

The return value (the memoized value)
The verified-at revision, when was this memoization last-confirmed valid
The changed-at revision, when was this memoization value last changed
The dependency list , basically the dependency graph. In the case of compile above it would be typecheck(source) . In the case of typecheck(source) it would be parse(source) , and type-signature(f_1)..type-signature(f_N) for example.

For each dependency we track also what was the changed-at revision of the dependency when we depended on it.

So let’s see an example, we just redefined some-func as above and we call (compile "<source>") , this is a new source so there is no memoization for this, we execute the computation function. We call typecheck , since this is a new source this doesn’t exist either, that depends on parse which also doesn’t exist, that creates one memoization entry:

(:key '(parse source) 
 :return <ast> 
 :verified-at :R7 
 :changed-at :R7 
 :dependency-list '((:input source)))

We then check type-signature for + with is (-> (int int) int) with a :verified-at and :changed-at of R1 (this is stdlib, so it was populated at the start of the session). Since R1 is less than R7 , it may be outdated and we need to check the dependencies of (type-signature +) . That depends on the source of + which also has a revision of R1 . Since the revision of the memoization and the revision of its dependency are equal we consider it fresh and we update the :verified-at for (type-signature +) to the current revision of R7 .

The typecheck passes so we memoize that as well and create an entry like

(:key '(typecheck source)
 :return <pass|fail>
 :verified-at :R7
 :changed-at :R7
 :dependency-list '((parse source) (type-signature +))')

It’s important here to note when we consider something fresh:

It’s either when :verified-at == current-revision
Or, when the dependencies are inputs where :changed-at < current-revision

You always need to walk the dependency chain until you bottom out at the inputs or you have already validated the subtree this revision.

During the walk as you come up the recursion you update all :verified-at to current-revision so any other computation in this revision short-circuits.

Next time, if we reevaluate typecheck over the same source we’ll recurse through the graph, arrive at the same input, check that it hasn’t changed, go upwards the computation tree, updated :validated-at and skip typechecking and compiling altogether.

— marce coll, 2026-04-23

Quick Study

Simon Willison

simonwillison.net

2026-10-23 17:35:13

Tool: Quick Study Prompt to Claude Opus 5.5 High: Build an artifact where you open a photo and it rapidly (in a few seconds) paints a version of that photo using a canvas element and simulated paintbrush See also my previous experiment getting Claude Fable to simulate a watercolor illustra...

Original Article

Prompt to Claude Opus 5.5 High :

Build an artifact where you open a photo and it rapidly (in a few seconds) paints a version of that photo using a canvas element and simulated paintbrush

See also my previous experiment getting Claude Fable to simulate a watercolor illustration with P5.js.

CVE Tracker

Hacker News

cve.0xosprey.com

2026-10-23 17:21:47

Comments...

Original Article

Loading…

Resolution Range View Dates Mode

Last 90 days, daily

Mamdani's Schools Chancellor Gets Roasted

hellgate

hellgatenyc.com

2026-10-23 17:04:14

We talk about a hot duck, a coup that will never end, school segregation, and THE KNICKS,...

Original Article

Mamdani's Schools Chancellor Gets Roasted — (Katie Way / Hell Gate)

Podcast

4:04 PM EDT on October 23, 2026

Scott's Picks:

Give us your email to read the full story

Sign up now for our free newsletters.

Sign up

Great! You’ve successfully signed up.

Welcome back! You've successfully signed in.

You've successfully subscribed to Hell Gate.

Your link has expired.

Success! Check your email for magic link to sign-in.

Success! Your billing info has been updated.

Your billing was not updated.

Friday Squid Blogging: Increasing Squid Populations

Schneier

www.schneier.com

2026-10-23 17:00:09

This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy....

Original Article

Home Blog

Friday Squid Blogging: Increasing Squid Populations

This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

Tags: squid

Posted on October 23, 2026 at 5:00 PM • 0 Comments

Subscribe to comments on this entry

Abandoned Popcorn Time app exposed millions of device to RCE attacks

Bleeping Computer

www.bleepingcomputer.com

2026-10-23 16:55:05

Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]...

Original Article

Abandoned Popcorn Time app exposed millions of device to RCE attacks

Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers.

The vulnerability, tracked as CVE-2026-30612, affects Windows and macOS updaters that contacted the app's abandoned domain (popcorntimeupd.xyz) over unencrypted HTTP and accepted executables without verifying digital signatures.

Anyone controlling the update domain could manipulate HTTP traffic and execute code as SYSTEM on Windows and as root on macOS.

The Popcorn Time app featured a Netflix-style interface that integrated BitTorrent downloads, allowing users to consume illegal content right directly inside the app.

The project was abandoned for legal reasons but later relaunched as a legitimate content-streaming app. However, forks such as Time4Popcorn emerged under the Popcorn Time name, quickly attracting millions of users.

Researchers at Eye Security discovered the security risk after registering the popcorntimeupd.xyz domain and observed up to 3 million Windows and 350,000 macOS client connections to Time4Popcorn.

Location of users — **Location of Time4Popcorn users**
*Source: Eye Security*

Connections came from residential ISPs and corporate, government, and military networks. However, none of the users appeared to be actively using the app, suggesting it had been installed and forgotten.

“If we were able to send an update, we could potentially get code execution on millions of systems,” Eye Securit notes , adding that “the impact would be severe if this were to fall into the wrong hands.”

Following this discovery, the researchers registered 14 more domains associated with the service.

Securing the systems

Between November 2025 and March 2026, Eye used the vulnerable update mechanism to deliver remediation code that stopped and disabled the updater.

Their payload collected no host data or telemetry, and deleted no files on the users’ computers, keeping their actions within a fully legal context.

Eye explains that it had to modify its payload during testing to evade antivirus products that flagged it for disabling a service.

After deploying the remediation, Eye recorded 2 million update downloads, and by March 1 this year, requests to its update domain dropped by 98%.

Following the successful completion of the remediation operation, domain ownership was passed to the non-profit security organization The Shadowserver Foundation.

Despite this success, the researchers warned that the risk is not fully eliminated for users of the app.

First, Android users remain exposed as installing an update would require user interaction, and researchers could not disable the updater remotely for the mobile platform.

Second, the Time4Popcorn app uses a severely outdated Chrome engine from 2014, with no sandbox protections, which could be exploited in attacks.

The best course of action would be for users to remove the software entirely from their systems.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Attention people who think UB is fine

Lobsters

blog.habets.se

2026-10-23 16:47:58

Comments...

Original Article

After my post on undefined behavior in C some people insisted that it’s demonstrably fine, we know what the code will do, and at worst we’ll get a segfault.

This is false.

Here’s an example.

C code

#include<utility>

// Let's pretend this is a memory mapped device controlling
// motors and gears and stuff.
volatile int device_command = 0;

void serve_hot_chocolate() {
        device_command = 42;

        // Oh no, we spilled some hot chocolate, invoking UB.
        //
        // The definition of `std::unreachable()` is:
        //     Invokes undefined behavior at a given point.
        std::unreachable();
}

void explode() {
        device_command = 3;
}

Example assembly output

With GCC 16.2 with -O1 .

"serve_hot_chocolate()":
        mov     DWORD PTR "device_command"[rip], 42
"explode()":
        mov     DWORD PTR "device_command"[rip], 3
        ret
"device_command":
        .zero   4

Ruh roh. Exploding chocolate! The function explode() will be executed, even though it was never called!

godbolt link

Another example: dereferencing a null pointer

Some people insisted that dereferencing a null pointer is fine . It’ll just try to access address zero! And these people supposedly know what happens when you try: if nothing is mapped there, you’ll get a segfault.

Again, not true.

Let’s say we change std::unreachable() to int* ptr = nullptr; *ptr = 99; in the previous example. Now we get this :

"serve_hot_chocolate()":
        mov     DWORD PTR "device_command"[rip], 42
        mov     DWORD PTR ds:0, 0
        ud2

Curious, eh? First it writes zero, not 99, to memory address zero. Then it crashes the program using an invalid instruction. The number 99 never appears in the generated program. But the null pointer write does. Presumably the null pointer write is done in order to improve debugger error messages.

Now let’s check clang with godbolt :

"serve_hot_chocolate()":
        mov     dword ptr [rip + "device_command"], 42

"explode()":
        mov     dword ptr [rip + "device_command"], 3
        ret

"device_command":
        .long   0

Again we get exploding chocolate.

Let’s do some pointer arithmetic on the null pointer

Ok, so what happens if we add ptr += 10 . That’s UB for three reasons:

using a null pointer for anything other than comparison against other pointers,
even if an object would be valid at the null pointer (which it’s not), creating a pointer that points outside that object, or if an array, beyond one-past the array, is UB,
even if that were valid (which it’s not), we then dereference the address.

Let’s try it .

"serve_hot_chocolate":
        mov     DWORD PTR "device_command"[rip], 42
        mov     DWORD PTR ds:40, 99
        ret

Wow. Now it did what someone naively would expect, taking the code at face value. Lucky.

Why did GCC (and clang, by the way) not detect that *(ptr + 10) = 99 is equally UB as *ptr = 99 , and do the same thing?

Wrong question. No compiler is obligated to “detect” UB at all. Looks to me like GCC and clang, if we want to anthropomorphize them, saw “oh, null pointer dereference? Well that can’t happen, so I’ll stop emitting instructions for this function, to save on the binary size”. Because of the halting problem , it cannot in the general case know if the code will ever be executed.

So what does UB do?

Anything. I have now demonstrated three things UB can do, when UB was triggered in the same place:

Run whatever happens to be next in memory (exploding chocolate).
Store a (for all intents and purposes) random value at address zero (wrote zero, not 99), and then deliberately crash.
Do what one would naively expect: write the value to the address seen in the code at face value.

And to think that some people don’t believe in nasal demons .

disqus has started showing ads. :-(

Showing (probably incomplete) comments in a static read-only view. Click button to be able to leave comments.

Memory is slow, Disk is fast

Lobsters

www.bitflux.ai

2026-10-23 16:44:07

Comments...

Original Article

TL;DR

Big O notation is a lie. Well, okay, it's a simplification that lies by omission.

Can O(√n) scale better than O(log n)? Can a disk-based algorithm outperform an in-RAM data structure? Yes, and yes.

AVL in RAM vs DiskArray on disk

Scaled to 2 billion nodes, the AVL binary tree needs 144 GiB of RAM. DiskArray keeps its data on 8 NVMe drives and uses 264 MiB of RAM, but it's still faster at everything.

Why a Part 3

Part 1 showed that computers are getting wider, not faster, and that PCIe bandwidth is outpacing DRAM bandwidth.

Part 2 showed that streaming from disk can beat streaming from the page cache.

Part 2.5 showed that with the right hardware and software, streaming from disk can beat a buffer in DRAM. So far I've shown how a sequential read from NVMe is fast, which is a cool trick but not controversial enough.

I'm getting worried people still aren't getting the point.

The point is that our intuitions about computer performance are all wrong.

So this time we're going to show how an on-disk data structure doing random reads and writes to disk is faster than an in-RAM data structure. To make it worse, computer science textbook Big O notation says the on-disk algorithm is going to scale worse than the in-RAM algorithm.

The rig

Same old used box as Part 2.5 : a 24-core Xeon Platinum 8260 with 35.75 MiB of L3 and 192 GiB of DDR4, and 8 Samsung PM983 NVMe drives over NVMe-oF on four 100 Gb InfiniBand links.

The task

Keep a sorted set of 8-byte keys, and support four transactions on it:

search(key) : is this key in the set?
at(i) : what's the i-th smallest key? The median, the 99th percentile, page 3 of the results.
insert(key)
delete(key)

That's the core of a database index, an order book, a leaderboard, a time-series store.

The sorted array

Let's walk through the algorithm selection by first principles and childlike wonder.

The simplest solution is an array of keys, kept in order.

Sorted array: search

search(key) is a binary search. Look at the middle, throw away the half the key can't be in, and repeat. 16 keys take 3 or 4 hops. A billion takes about 30. O(log n).

Sorted array: at

at(i) doesn't search at all. The i-th smallest key is just array[i] , at a fixed offset from the start. One access. O(1). You can't beat that.

Then you need to change it.

Sorted array: insert

To insert, you have to make room. Everything after the new key moves over one slot to open a gap, then the new key goes in the gap.

Sorted array: delete

Delete is the same in reverse. Take the key out, then everything after it moves over to close the gap.

Either way, on average, half the array moves, every single time. It's a memmove , about the most efficient thing a CPU can do with memory, but it's still O(n). At 4M nodes, every insert moves about 16 MiB. At a billion nodes it would be 4 GiB per insert. The array also has to be one contiguous block, so growing it means allocating a bigger one and copying everything over.

	search()	at()	insert()	delete()
Sorted Array	O(log n)	O(1)	O(n)	O(n)

The linked list

The textbook fix for "insert moves everything" is the linked list.

Linked list

Each node holds a key and a pointer to the next node. To insert, you change two pointers. Nothing moves.

But to insert 21 you first have to find where 21 goes, and the only way to find anything in a linked list is to start at the head and follow the pointers one at a time. Search is O(n). at(i) is O(n). Insert and delete are O(1) once you're in the right place, and O(n) to get there.

	search()	at()	insert()	delete()
Sorted Array	O(log n)	O(1)	O(n)	O(n)
Linked List	O(n)	O(n)	O(n)	O(n)

Adding a node is cheap, but finding where to insert it is really expensive. So this doesn't solve our problem.

The binary tree

Use the pointers to branch out instead of to line up, and you get a binary search tree.

Binary search tree

Smaller keys go left, bigger keys go right. Search walks down from the top, throwing away half the tree at each step, just like binary search on the sorted array. Insert walks down the same way and hangs the new node off the bottom, just like the linked list. Nothing moves. Keep a count of the nodes under each node and at(i) is a walk down too.

On paper it's the best of both: log n for everything.

The AVL tree

In practice a plain binary tree has a problem. Its shape depends on the order you insert things. Insert keys in sorted order and every new node goes to the right of the last one. It would perform like a linked list.

Unbalanced tree vs AVL

The AVL tree fixes this: after each insert or delete it checks the heights of the two sides and, if they're off by more than one, rotates a few nodes to rebalance. The tree stays about log₂ n deep no matter what.

But this isn't free; there is overhead to implement the tree. Every node is its own allocation with a key, two pointers, a balance factor, and a count. That's a lot of bookkeeping for an 8-byte key: 72 bytes of RAM per key, where the sorted array needs 8. The biggest sorted array I ran, 4M nodes, is 32 MiB of RAM. The same 4M nodes in the AVL tree take 288 MiB. At 2G nodes the AVL tree used 144 GiB of RAM.

	search()	at()	insert()	delete()	RAM per key	2G nodes
Sorted Array	O(log n)	O(1)	O(n)	O(n)	8 B	16 GiB
AVL Tree	O(log n)	O(log n)	O(log n)	O(log n)	72 B	144 GiB

Sorted array vs AVL

Let's look at how things scale and compare that to Big O predictions.

Sorted array vs AVL from 2K to 4M nodes

At first glance, it looks like Big O gets the ranking right. The sorted array's performance for insert and delete falls off a cliff while the search and at() performance degrades more slowly. The AVL tree performance degrades slowly as predicted.

DiskArray

The AVL tree solves the insert and delete problem but costs a lot of overhead that shows up in search and at() performance as well as extra RAM. The sorted array has a lot going for it: everything is in order, in one place, with no pointers to chase and no overhead. Its only problem is that an insert has to move half the array. Let's try a more brute-force solution to insert and delete.

If we cut the array into pieces we could contain the areas affected by inserts and deletes. Our DiskArray data structure splits the sorted keys into small extents. A small index says which extent holds which range of keys. To insert, find the extent with the index, then do a sorted-array insert inside that one extent. You only ever move part of the extent, never the whole list.

Then, because we're making a point, we can put the extents on disk too. That way we only need the index in RAM with a small buffer pool to handle the IO for in-flight and active extents.

DiskArray: the index in RAM, the extents on disk

The design decisions:

An extent is one 4 KiB block. A convenient choice is 512 keys x 8 bytes. That's the unit an NVMe drive moves anyway, so a lookup or an insert is exactly one block read, or one read and one write.
Only the index lives in RAM. Per extent, the index keeps its smallest key, largest key, and count, in directory blocks of 4096 entries, with one small top-level array over the directory blocks. That's about 44 bytes of RAM for every 4 KiB of data. At 64G nodes the index is 7.5 GiB, for 512 GiB of keys. RAM goes to the part that's worth having in RAM.
Room to grow. Extents and directory blocks are left part empty, so most inserts don't split anything. When an extent does fill up and split, only the entries inside its own directory block shift, never the whole index.
Lots of transactions in flight. Transactions are queued 2048 at a time. Each is looked up in the index when it's queued, so the drives see thousands of 4 KiB reads at once, spread over 28 io_uring workers and 8 drives.

The Big O of DiskArray

A textbook answer for this kind of structure depends on your assumptions. Extent size is a variable parameter. It could be as bad as O(√n) for insert and delete if we scale the extents with n. However, in practice, given the hardware constraints, I sized the extents to what the disks want and fixed them: 512-key extents because that's one 4 KiB disk block, 4096-entry directory blocks so a split only ever shifts a few tens of KiB. Most of the time an insert is effectively one 4 KiB read, one 4 KiB write, and a log n search of the index in RAM. But occasionally it has to edit a directory block. The extent, directory, and even I/O introduce constants that are significant factors in the math for the realistic scales we'll be working in.

Full Disclosure: if you look at the code you'll notice the top-level index that points to directory blocks is growing with n. I planned to make that split into blocks as well, extents all the way up the tree. But I didn't get around to it. So technically there is a corner case that is O(n). With my current settings a second tier would kick in at around 8G nodes. So in practice the O(n) means that, on average once every couple hundred thousand inserts, a directory block splits and the top level has to memmove() up to about 1.4 MiB and rebuild its count tree. That's noise next to the drive I/O. If I did add a recursive index tree as planned, then I think we're officially just a B-tree variant and are for sure O(log n).

To simplify, I'm just going to say as an algorithm it scales as bad as O(√n) and as good as O(log n). If that's not a reasonable argument, I'm sorry. I majored in Electrical Engineering, not Computer Science, so I don't know the theory as well as I do the reality.

	search()	at()	insert()	delete()
Sorted Array	O(log n)	O(1)	O(n)	O(n)
AVL Tree	O(log n)	O(log n)	O(log n)	O(log n)
DiskArray	O(log n)	O(log n)	O(√n) → O(log n)	O(√n) → O(log n)

Big O says AVL wins or at least ties. In-RAM vs On-Disk says AVL wins.

No way DiskArray wins, right?

AVL vs DiskArray

I want to compare DiskArray to AVL in DRAM not L3. 512K nodes × 72 B is ~36 MiB which is the L3 size. So we'll compare up to 512K nodes and more than 512K nodes in separate graphs.

AVL vs DiskArray while AVL fits in L3, 2K to 512K nodes

AVL wins everything here: about 10x faster on search at 2K nodes, still almost 2x at 512K. Every pointer hop is a cache hit, and cache hits are cheap. DiskArray is flat at around 2M searches/s, because it's paying for machinery it doesn't need yet: queues, workers, a buffer pool. Its data still fits in the 24 MiB buffer pool, so the drives aren't even being read.

Nevertheless, even in cache, AVL performance is scaling down fast. Search goes from 19.6M/s at 2K nodes to 4.0M/s at 512K, about 5x slower.

Now let's compare them as we scale past 512K nodes:

AVL vs DiskArray once AVL is in DRAM, 512K to 64G nodes

DiskArray scales far better than AVL.

From 16M nodes up, the disk-based structure beats the in-RAM tree at everything, all the way to where AVL ran out of RAM at 2G nodes. DiskArray kept going to 64G.

How is DiskArray winning?

Let's compare what happens during an insert() at 2G nodes.

Everything one insert touches at 2G nodes

This doesn't help at first glance. In fact it makes it look like DiskArray is doing way more work.

It depends what you count, and every way of counting it is interesting.

Four ways to count one insert

Two definitions run through all of this. Used is the bytes an algorithm deliberately reads, plus the bytes it deliberately writes. Moved is what the hardware actually transfers: DRAM and the L3/L2 caches move in 64-byte cache lines, so reading 8 bytes moves 64, and the drives move 4 KiB blocks. The drive traffic is measured. The rest is estimated from the data layouts.

Bytes moved through DRAM: 0.77x

AVL, 5.8 KiB. Each of the ~31 levels on the way down pulls in two cache lines, the node and the key it points to: 62 lines, 3.9 KiB. On the way back up it dirties one line per ancestor updating counts and heights, and those 31 lines get written back: 1.9 KiB.
DiskArray, 4.5 KiB. About 15 lines for the index lookup and 9 for the binary search inside the block, 1.5 KiB. Then the shift: ~190 keys read and written, about 48 lines, 3.0 KiB.
DiskArray puts less through DRAM than AVL , even though it does more work, because its bytes are contiguous. AVL uses 17% of what it moves. DiskArray uses 73%.

Everything moved, drives included: 2.1x

AVL, 5.8 KiB. All of it through DRAM.
DiskArray, 12.5 KiB. The 4.5 KiB through DRAM, plus a 4 KiB read from the drive and a 4 KiB write back to it. Both are measured: one of each per insert.
DiskArray moves twice the bytes per insert. And it still does twice the inserts.

Bytes the algorithm actually uses: 3.3x

AVL, 1.0 KiB. On the way down, a child pointer, a key pointer and a key at each level: 744 B. On the way up, a count and a height in each ancestor: 279 B.
DiskArray, 3.3 KiB. About 250 B of index (~27 key comparisons and a few count updates), 72 B of probes inside the block, and the shift: ~190 keys read and written, 3.0 KiB.
DiskArray does more real work per insert. Shifting keys inside an extent is the job, and it's three times AVL's whole insert.

What DiskArray has to handle: 4.9x

AVL, 1.0 KiB. The bytes it actually uses, from above.
DiskArray, 4.9 KiB. To change one 8-byte key it has to read, edit and write back a whole 4 KiB block, plus about 1 KiB of index lines to find it.
It looks wasteful. Nearly 5x the data, to change 8 bytes. It isn't, and the next section shows why.

Effective Bandwidths

What limits each insert at 2G nodes

Inserts per second, times the data moved and used per insert, gives us the bandwidths. At 2G nodes:

	Inserts/s	Time per insert	Data moved	Moved bandwidth	Data used	Used bandwidth	Limited by
AVL	320K	3.1 µs	5.8 KiB	1.8 GiB/s	1.0 KiB	312 MiB/s	DRAM latency: ~62 reads, one after another, ~50 ns each
DiskArray	670K	1.5 µs	8 KiB, on the drives	5.1 GiB/s	3.3 KiB	2.1 GiB/s	NVMe bandwidth: a 4 KiB read and a 4 KiB write

DiskArray moves more data per insert than AVL, and it's faster on both counts. It moves the overhead faster: 5.1 GiB/s of traffic against AVL's 1.8, 2.9x. And it moves the data it actually needs faster: 2.1 GiB/s against 312 MiB/s, 6.9x. More bytes, moved faster, every way you count them.

Every AVL insert waits on about 62 reads, one after another, and uses 1 KiB of the 5.8 KiB those reads drag in. That's 312 MiB/s of useful work. Higher bandwidth DRAM wouldn't help, because DRAM latency hasn't moved in 20 years.

DiskArray is short of bandwidth. Its CPU work is about 0.3 µs per insert. The drives are the limit: from 32M to 1G nodes they hold at ~5.5 GiB/s, ~720K inserts/s. More drives, or faster ones, and it goes faster, until that 0.3 µs of CPU catches up at around 3M inserts/s.

How DiskArray pipelines the drives

A drive round trip is about 87 µs. If DiskArray did one insert at a time, every insert would wait that long, twice, and it would manage a few thousand inserts/s. It does 670K. Here's how:

DiskArray's pipeline: an IO slot's life spans batches

DiskArray keeps 2048 transactions in flight, in two halves of 1024. One core does all the algorithm work and queuing; 28 io_uring workers just talk to the drives.

Queue a half. Look up each transaction's extent in the index in RAM, 32 at a time, and start that group's 4 KiB reads right away. Each read lands in a free buffer in the 24 MiB pool.
Run the other half. While those reads are in flight, work through the half queued last time, one insert at a time. Every block is already sitting in the buffer pool: search it, shift the keys. The block is now dirty, and it stays in the pool for now.
Write back. Dirty blocks pile up. Once there are 1536 of them, a quarter of the 6144 buffers, the next queue step writes them all out alongside its reads. Each block goes to a fresh spot on the drive, copy-on-write, and its old spot is freed when the write lands. That hands the buffers back for the next round of reads. It works out to one 4 KiB write per insert, just never one at a time.
Swap halves and repeat.

How does Big O miss this?

Big O counts steps. It assumes every step costs the same. They don't, not even close.

A billion L1 cache hits take about a second. A billion DRAM misses take a minute and a half, and a billion NVMe reads take a day. Big O counts every one of those as one step. Also, when you parallelize, the timescale comes back down to earth. So Big O notation is very limited in its predictive power in practice. It defines the shape of the performance curve but not it's slope or magnitude.

Let us observe the relative scaling performance these algorithms actually experience from 512K to 2G nodes.

How much slower from 512K to 2G nodes

We can see AVL is scales much worse than Diskarrary even though Big O would make us think the opposite is true.

I started at Intel doing flash memory out of college. In the early days of the technology, you could use very simple equations to predict the characteristics of a cell. At some point, the cells shrank to where the number of electrons in a cell was something that had to be quantified and thought about. Now, the equations have to start taking quantum effects into consideration.

Big O in its most reductive form isn't going to tell you how things are going to perform in practical scales. It didn't have to. But as the performance characteristics of various elements of the system continue to diverge and become extreme I don't think the single n term O() is useful anymore. I think it's time to start treating these equations and simulations more seriously and add in more nuanced effects.

The quantum effects

Notice the curves aren't smooth log n curves. They have step functions where each step is something outgrowing hardware.

AVL search drops from 4.0M/s to 2.3M/s between 512K and 1M nodes, as the tree grows from 36 MiB to 72 MiB, out of the 35.75 MiB L3.
DiskArray insert halves, 1.6M/s to 830K/s, at 512K nodes, exactly where the drives start taking writes.
DiskArray search drops from 2.2M/s to 1.6M/s at 4M nodes, exactly where the drives start taking reads.

Big O can't see any of these yet they have a huge impact on the practical scales we're dealing with.

You can do better than AVL

Nobody uses an AVL tree for this. Here's what happens with the structures you'd actually reach for:

ART , an adaptive radix tree: walks the bits of the key instead of comparing.
B+tree : fat nodes with many keys each, so far fewer levels.
NextArray : DiskArray's in-RAM sibling. Same extents and index, but the extents are 1 KiB in RAM.

One at a time

First, everything doing one transaction at a time, like AVL:

One at a time, in RAM, 4M to 64G nodes

2G nodes, transactions/s	search	at()	insert	delete	RAM
AVL tree	772K	490K	320K	368K	144 GiB
ART	2.90M	253K	3.12M	2.45M	146 GiB
B+tree	1.13M	1.87M	905K	887K	38 GiB
NextArray	1.52M	6.06M	1.29M	1.26M	33 GiB
DiskArray, on disk	1.08M	1.29M	670K	666K	264 MiB

The better structures beat DiskArray, but not by as much as you'd think. B+tree ties it on search and beats it by 1.35x on insert. NextArray, DiskArray's own design kept in RAM, is 1.4x on search and 1.9x on insert.

ART is the fastest at search and insert, about 3x and 5x, but its at() is the worst here: ART has no rank, so finding the i-th key means walking. So it's not a great example.

Still the best RAM structures aren't beating it by an order of magnitude.

ART and AVL have too much overhead to scale beyond 2G on this hardware. Both cost about 72 bytes per 8-byte key, 146 and 144 GiB at 2G nodes, and the box only has 192 GiB (188 GiB usable). The next doubling would have needed nearly 300 GiB. B+tree and NextArray, at 17-21 bytes per key, made it to 8G. DiskArray, at about 0.1 bytes of RAM per key, went to 64G and could have kept going.

Pipelined

Because DiskArray is pipelined it could have an advantage over the RAM structures. So we'll pipeline them the same way, and pull all the tricks we can try with prefetching and optimizing code paths.

Pipelined, in RAM, 4M to 64G nodes

2G nodes, transactions/s	search	at()	insert	delete	RAM
B+tree, pipelined	5.03M	4.33M	2.74M	2.79M	41 GiB
NextArray, pipelined	6.45M	6.06M	4.02M	4.07M	33 GiB
DiskArray, on disk	1.08M	1.29M	670K	666K	264 MiB

This is a different league. The pipelined structures beat DiskArray by 3-6x across the board, on the same single core. Pipelining NextArray took search from 1.52M/s to 6.45M/s and insert from 1.29M/s to 4.02M/s. B+tree went from 1.13M to 5.03M searches/s. The one thing it doesn't speed up is NextArray's at(), which was already a short walk of a small count tree: one at a time it's faster up to about 256M nodes, and past that the pipelined version only pulls slightly ahead. Still not an order of magnitude.

What pipelining means for RAM

Plain NextArray does one transaction at a time, like AVL. Each level of the index is a cache miss, and each miss waits on the one before it. The pipelined version is the same data structure, the same single thread, but it handles transactions in groups of 32:

One at a time vs pipelined

Resolve the whole group one index level at a time. Issue the cache-line prefetches for level 1 of all 32 transactions, then level 2 for all 32, and so on. The misses for a level are in flight together, not one after another.
Prefetch each transaction's slice of its extent a few transactions ahead.
Execute them in order: the memmove , the count updates.

A core can only keep about a dozen misses in flight, so it's not 32x, but it's 4x on search.

NextArray was built for this. Every transaction follows the same short path: a few levels of a flat, sorted index, then one contiguous extent. That's easy to batch and easy to prefetch. A tree of individually allocated nodes isn't, because you can't know where the next node is until you've loaded this one.

If this looks familiar, it should. It's DiskArray's pipeline, pointed at RAM instead of at the drives:

	DiskArray, to the drives	Pipelined NextArray, to DRAM
Group the transactions	1024 per half, looked up 32 at a time	32 at a time
Work out what you'll need	look up the extent in the index	look up the next index level, then the extent
Ask for all of it at once	a 4 KiB read per transaction, through io_uring	a 64-byte prefetch per transaction
While it's in flight	run the other half	handle the rest of the group
Where it lands	the buffer pool, in L3	the cache
Then	search, shift, write back	memmove, update counts

RAM stands for Random Access Memory, but it's not really random access anymore. It's a block device with 64-byte blocks and 80-90 ns of latency, and you have to use it like one.

To get even reasonable performance out of either memory or storage, you need to treat them as parallelized asynchronous block devices that feed the caches.

Recap

Design for hardware not theory.
Big O isn't that useful.
Parallelize and pipeline or perish.
Memory is slow, unless you treat it like a disk.

Next Time

See me at P99Conf.io 2026-10-22, register now.

Can we improve memory-bound HPC workloads 2x, without memory?

,Jared Hulbert

Source code can be found here

Bodycam: Cop Was Not in Danger When He Fired Shots That Killed 1-Year-Old Kohen Wiley

Intercept

theintercept.com

2026-10-23 16:36:17

Mississippi investigators said the shooting was “justified,” but new body camera footage shows the cop firing into the passenger’s side as the car passed by him. The post Bodycam: Cop Was Not in Danger When He Fired Shots That Killed 1-Year-Old Kohen Wiley appeared first on The Intercept....

Original Article

After the Mississippi attorney general cleared a white cop for firing into a car and killing a Black toddler in a Walmart parking lot, video footage released by the Mississippi Department of Public Safety has revealed the fullest picture to date of what happened.

The videos, provided to The Intercept in response to a public records request, come on the heels of leaked footage that exposed how a needlessly aggressive and reckless police confrontation of two suspected shoplifters led to 1-year-old Kohen Wiley’s violent death in his mother’s arms.

While the newly released videos include redacted versions of the previously leaked footage — including body camera footage for some of the officers, as well as Walmart surveillance video — the new footage reveals for the first time the body camera video belonging to the Senatobia police officer who fired the shots that killed Kohen Wiley: Sgt. Hunter Foster.

While the state concluded that the shooting was “ justified ” based on a probe by the Mississippi Bureau of Investigation, the videos show how police escalated a non-life-threatening situation — one that could have ended with a mere shoplifting charge — by pursuing Kohen’s mother, Vel’lesiya Wiley, and the driver, Latoya Ferrell, after they ran from the store and tried to drive away.

Foster’s body camera footage makes clear that he positioned himself in front of the vehicle, aimed his gun at the car, and fired the fatal shot into the passenger side window after the car was moving past him and posed no threat.

This is consistent with the conclusions of Dr. Roger Mitchell, a forensic pathologist hired by Wiley’s family, who determined in June that the fatal bullet was most likely fired into the side window, entering his small body on his right side and exiting his left.

The release also includes a 10-page, heavily redacted investigative report by the Mississippi Bureau of Investigation , which the state attorney general relied upon in concluding that the shooting was justified .

The report’s narrative is misleading: Its only description of the shooting is that one officer “discharged his firearm” after the car “sped toward the officers.” The report does not discuss the fact that the firing officer was beside the car when he first fired, which is clear in Foster’s body camera footage. The report also redacts Kohen Wiley’s cause of death.

An excerpt of the report on the police shooting of Kohen Wiley from the Mississippi Bureau of Investigation released on Oct. 22, 2026, through a public records request. Screenshot: The Intercept

Foster resigned from the Senatobia police department on Wednesday. Afterward, Foster’s lawyer told CNN , “The driver of the vehicle was attempting to kill those 5 officers, and Hunter Foster had no choice but to discharge his weapon.” (Neither Foster nor his lawyer responded to The Intercept’s requests for comment.)

Residents of Senatobia had called for months for the body camera footage and Walmart surveillance videos to be released. After the state attorney general announced that the police had been cleared, a spokesperson for the Mississippi Department of Public Safety, which houses the state’s Bureau of Investigations, told The Intercept that the videos would be released after the family had a chance to watch them.

Instead, as with the attorney general’s announcement, the family first saw the leaked videos on social media. By the time Kohen Wiley’s parents and grandparents met with state officials to view the videos on Thursday morning, most of the footage had been circulated online. At a press conference on Thursday afternoon, Kohen’s maternal grandmother, Veronica Roberson, called it “a slap in the face.”

Roberson said she’d been haunted by the word “ justified ” all week, slamming the idea that Foster fired the lethal shots because he feared for his life.

“You shot my grandbaby from the side of the car,” she said. “How are you in danger?”

“Get the Car!”

The incident began with what appeared to be a routine occurrence in retail outlets all over the country: a shoplifting allegation.

The earliest footage is from a Walmart security camera. An apparent Walmart employee dressed in a black hoodie is stationed by the store entrance when Wiley and Ferrell approach, carrying a child and a box of diapers. They pause at the door and appear to have a brief exchange with the Walmart employee before breaking into a run toward the parking lot.

In body camera footage, which begins moments later, the staffer in the hoodie appears in the doorway of a small security room, where other Walmart employees, three Senatobia police officers, and two Tate County sheriff’s deputies are gathered around a pair of computer monitors. According to the MBI report, the officers had been called to the store in response to a complaint that a man was sexually harassing customers.

The employee in the hoodie tells the cops and Walmart staffers that two people are running and gestures toward the store entrance.

Moments later, the five officers dash from the room and out into the parking lot, running toward a gray sedan. A sheriff’s deputy reaches the driver’s side door and puts his hand on the hood of the car while someone yells “stop.” The car backs up and starts to turn, but hits a parked SUV. Someone yells, “Stop the car!”

As the officers continue to run toward the car, it begins to move forward. At one point, two officers are directly in front of the vehicle, including Foster, the police sergeant identified as the shooter, who aims his gun at the front windshield.

The car starts to turn left, away from the three officers on the vehicle’s right side, and either narrowly misses or grazes Foster, who stumbles to the passenger side and aims his gun at the window. He then appears to fire three shots in rapid succession.

As the car pulls away, the officers continue their pursuit.

“Get the car! Get the car! Get the car!” one of them yells.

The gray sedan pauses briefly before taking off again.

The records released by state officials do not include any footage of what happened after the officers return to their vehicles. But the leaked footage, which was compiled into a nearly 7-minute long video , shows Foster pacing next to a police vehicle outside the nearby Highland Hills Medical Center an hour and 20 minutes after the shooting.

“I didn’t even see a fucking baby in her lap,” Foster says.

His colleague responds that nobody else did either: “All I saw was two females in the car.”

Reckless and Aggressive

As the leaked video began to circulate on social media on Tuesday, much of the attention focused on the moment the car moved toward Foster.

The Senatobia Police Department claimed from the start that the car drove toward officers and nearly hit one, suggesting the shots were fired in self-defense. Darkhorse Press, the independent Mississippi outlet that first published the leaked footage, even stated in a headline that the car “actually hit at least two officers.”

Among those who have repeated a version of this story is Republican Gov. Tate Reeves, who said the driver tried to “run over the policeman,” despite admitting that he had not actually watched the footage.

What the videos show is that the police officers themselves needlessly escalated a shoplifting incident into the scenario that they claim put them at risk. Almost immediately after being informed that two people were “running,” the five armed officers sprinted out to the parking lot, surrounded the car, and, at various points in the confrontation, drew their guns. The officers also positioned themselves in a way that cut off any escape route for the driver.

These are reckless, aggressive tactics in response to a minor shoplifting charge. They also violate best practices in policing.

Most departments today prohibit officers from standing in front of the possible escape route of a car when someone inside is suspected of only minor offenses. Many also require officers to get out of the way of a vehicle if it begins driving toward them. While most departments authorize a police officer to use deadly force if they “reasonably” believe it’s necessary to protect their or others’ lives, this generally does not excuse employing lethal force if the “reasonable” fear arose from a cop’s own violation of department policy.

The police officers themselves needlessly escalated a shoplifting incident into the scenario that they claim put them at risk.

Policies and best practices, however, don’t establish the bounds of legal liability; they are related but separate. Under the landmark Supreme Court case Tennessee v. Garner , a police officer can use deadly force if he “has a good-faith belief that the suspect poses a significant threat of death or serious physical injury to the officer or others.” The law is less clear about criminal liability when an officer’s own illegal or ill-advised actions caused the circumstances that led him to fear for his safety.

Other examples of self-defense law hold people criminally liable if their own actions put them in harm’s way. In general, those cases indicate that a person can’t argue self-defense after killing someone if they instigated the altercation that led to lethal force, even if it was reasonable to use lethal force at the moment it was deployed.

By that standard, if an officer puts themselves in the path of a moving vehicle, they shouldn’t be able to justify lethal force by claiming to fear for their life because the vehicle was about to hit them. The law, however, isn’t crystal clear on this, and there’s at least some indication that the current Supreme Court may adopt a more lenient standard for police officers .

Moving Vehicle

Most police departments prohibit officers from shooting into moving vehicles unless someone inside poses a direct threat to the safety of others unrelated to use of the vehicle itself — for instance, if the person is armed and shooting at people. The reason is simple: Killing the driver of a moving car does not stop the car and can therefore exacerbate threats to public safety if the driver becomes injured, unconscious, or is killed.

Like many other departments, the Senatobia police department’s policy contains vague language advising officers that firing into moving vehicles is dangerous to bystanders and unlikely to stop a car; it reads more like guidance than prohibition. One portion of the policy, however, is much clearer: Officers “will not” discharge firearms into a fleeing vehicle — with “will not” underlined for emphasis.

It seems clear from the leaked footage that Ferrell, the driver, maneuvered the car in what appeared to be an attempt to flee rather than to kill or injure officers. The video shows her at first trying to reverse away from police. After striking the SUV, however, she then appears to try to drive around and then between the officers. She then strikes another car while trying to drive away.

The videos depict a driver showing far more awareness for the officers’ safety from behind the wheel than Foster showed for the occupants of the car — or the surrounding bystanders.

Moreover, Foster’s actions aren’t consistent with any reasonable concept of self-defense. Footage shows that he fired at least three shots into the passenger side of the car. This was already apparent in the leaked body camera footage. It’s even clearer in the newly released video from Foster’s camera. By the time he fires the first of the three shots, he is clearly beside — not in front of — the car. By the time he fires the last shot, the car has passed him.

If Foster was trying to disable the driver — which, again, is not recommended by most police departments — he went about it in a particularly reckless way: by firing through the passenger side window. He did so despite being told that there were at least two suspected shoplifters, which means that whatever the driver was doing, he was also putting the other person at risk.

While the police and state authorities claim that Ferrell’s actions ultimately justified using lethal force, the videos depict a driver showing far more awareness for the officers’ safety from behind the wheel than Foster showed for the occupants of the car — or the surrounding bystanders.

Police policies should reflect how people behave in the real world, and people accused of stealing tend to flee. For armed officers to quickly escalate a shoplifting allegation into lethal force puts everyone nearby at risk . Amid the frenzied response from the cops, Ferrell struck two other cars while attempting to escape. Anyone in or near those cars could have been injured or killed. Foster also fired his gun in a crowded parking lot. That, too, could have resulted in additional death or injury.

The police had other options. They could easily have written down the car’s license plate or obtained the plate number from the numerous surveillance tools at their disposal: their body camera footage, Walmart security footage, or one of the many Flock cameras nearby .

They could have then arrested the women later, at home and under less duress. They may not have caught Wiley or Ferrell red-handed with the alleged stolen goods, theoretically making a shoplifting prosecution more difficult. Creating an obstacle to prosecuting a shoplifting case, however, should be an easy tradeoff for not putting lives at risk.

Walmart’s Role

Finally, the leaked video footage raises important questions about Walmart’s role in Kohen Wiley’s death. The company has yet to publicly comment about the incident — and has not responded to repeated inquiries from The Intercept.

When the Walmart employee in the hoodie entered the room where officers were viewing security camera screens, he told them that two people were fleeing the store. He did not say that one of them had a baby in her arms, even though the surveillance footage showed Wiley carrying Kohen in her arms as she passed him. This would prove consequential, as Foster said in video footage that he had no idea there was a baby in the car.

Does Walmart policy require staff to tell police when a suspected shoplifter is accompanied by children?

This isn’t the first time aggressive policing of shoplifting at a Walmart has resulted in the death of an unarmed person. Earlier this year, deputies shot suspected shoplifters in two separate incidents at Walmarts in Florida. When police tackled a fleeing shoplifter in Anchorage, Alaska, recently, he pulled a gun and shot two officers before they returned fire, killing him .

Over the last 10 years, police have also shot suspected shoplifters at Walmarts in Miami ; Decatur and San Antonio , Texas; Tempe, Arizona ; Colorado Springs, Colorado ; Chester, South Carolina ; and Lake Forest, California . Most of the suspects were armed, but gunfire erupted only after police confronted them for shoplifting.

Even the best policing policies are useless if they aren’t enforced when officers violate them.

Walmart seems to have wavered over the years between aggressive crackdowns on suspected shoplifters and more lenient policies that factor in whether the suspect has been accused before, the necessity of the items they’re accused of stealing, and the value of the stolen goods.

Like many national retailers, the company’s policy when it comes to its own employees is to avoid confrontations with suspected shoplifters. A previous lawsuit revealed that the company’s stated policy as of 2010 was “PUT PEOPLE FIRST” (all caps in original) and prioritized “the physical well-being of suspects, customers and Walmart associates.”

That policy means little if the store simply outsources enforcement to local police who take a far more aggressive approach. Walmart itself has also been criticized by police groups , who claim that cost-saving reductions in staff have made the store a more attractive target for shoplifting, which then leads to more calls to police.

And in Senatobia, the last high-profile incident of police violence before Kohen Wiley was killed took place in 2025 — at the same Walmart parking lot.

Even the best policing policies are useless if they aren’t enforced when officers violate them. And officers are rarely prosecuted , period.

Foster’s resignation is at least some form of accountability, but the insistence from state officials that police did nothing wrong means there will be little to stop similar killings from happening again.

This week, residents of Senatobia returned to the Walmart for a vigil in honor of Kohen Wiley, in the same place where a makeshift shrine once stood . A community gathering has also been scheduled next weekend to mark what would have been his second birthday.

At the press conference Thursday, family and activists vowed to keep fighting for justice. As with so much police violence , however, the most pressing question isn’t whether Foster himself is punished. It’s whether we’re willing to tolerate more deaths like that of Kohen Wiley — whether Senatobia, Walmart, and the state of Mississippi will do anything to make clear that a 1-year-old’s life is more important than a pack of diapers.

Sony Retires Its Last 4K Blu-ray Player in Japan, PS5 Is All That's Left

Hacker News

www.techpowerup.com

2026-10-23 15:53:55

Comments...

Original Article

Sony has stopped shipping the UBP-X700/K in Japan, its last standalone 4K Ultra HD Blu-ray player in the country. Shipments ended on October 22, and according to Sony retailer Kunkoku , the remaining stock on Sony's Japanese store sold out almost immediately. There's no word on a successor. That leaves the disc-equipped PlayStation 5 as the only Sony product in Japan that can still play 4K Blu-ray movies. The UBP-X700/K only launched on May 17, 2025, as a cut-down version of the 2018 UBP-X700 without streaming apps, and it was last listed at ¥58,300. Sony will keep selling the BDP-S1700/K, though that one only handles regular Blu-ray discs.

The PS5 is not a perfect stand-in for home theater enthusiasts either. It handles 4K Blu-ray with HDR10, but it lacks Dolby Vision support, which the UBP-X700/K offered. Sony has also announced that new PlayStation games will stop shipping on disc from January 2028, and it hasn't confirmed whether the PS6 will even have a disc drive, despite an earlier report of a detachable one . If it doesn't, the PS5 becomes Sony's last disc player, and with a successor on the way, its days are numbered too. Sony already announced in February that it would phase out all of its Blu-ray recorders in Japan with no successors, so this was somewhat expected. For now, the player exit seems to be limited to Japan, as Sony's US store still lists the UBP-X700U. However, it's hard to see the standalone player sticking around for long elsewhere if Sony is winding down its disc business at home.

OpenAI: Securing our frontier model training environment

Hacker News

openai.com

2026-10-23 15:50:56

Comments...

Original Article

Distributed data, centralized fixes

Lobsters

miren.dev

2026-10-23 15:50:52

Comments...

Original Article

What an absolutely bananas week it’s been. You’ve got the number 4 just running around wreaking havoc. Railway is still fielding an everybody’s-worst-nightmare breach . Zeabur is shutting down after a major breach . We were all reminded just how dang much of the internet runs on PHP . Oh, and also we saw serious vulns in GitLab and Node.js , supply chain attacks on LiteLLM and OVH , a key leak at OpenCode , and, and, and. There’s just so much happening that in addition to the trending security headlines, there are several projects dedicated to just keeping track of everything.

And then you move from the incidents themselves to the commentary saying things like strap in, AI means this is just the tip of the iceberg or forget everything you know because we are in a new world now.

It’s overwhelming, it’s destabilizing… it can be downright scary! How are we to deal with all of this?

When the shit is hitting the fan, it’s so important for us to lean into solidarity and make sure we’re taking care of each other.

For the folks in the thick of these incidents, it’s been an adrenaline-fueled scramble of a week. We at Miren know this life well - our team is made up of engineers and operators who have been in and around infrastructure companies for years. We have been on the late-night incident calls. We have typed the status page updates with shaky fingers. It’s difficult, often thankless work.

So this week we are beaming out HugOps to the hundreds of people pouring their hearts and their sweat into firefighting, fixes, and follow-ups.

But when the dust has settled, we also have to talk about how we learn, how we improve, how we get stronger. You can think of this as an extension of our practice of care: how do we take care of our future selves, making it less likely we need to rely on last-minute heroics to save us?

Making sense of the chaos

Let’s start with some grounding. Even on a week like this, in a year where so much is moving so fast, there are certain structural dynamics that still hold for software engineers: a piece of software has to operate in an environment, and it has to be built to account for risks in that environment while still accomplishing its goals.

We can sort the hot mess from our opening paragraph into a few shapes, which helps to get us thinking in structural terms:

One vault, everybody’s secrets - Railway, Zeabur, and OpenCode were all breaches of centralized platforms, where compromise of one entity yields access to a superset of user data. The structural problem here is concentration: with everybody’s secrets in one bucket, that bucket becomes a big target, and makes for an even bigger spill.

One good patch, a million places to get it - PHP, eMudhra, self-managed GitLab, and Node.js were all vulnerabilities discovered in non-centralized systems, so the exercise in fixing them was one of manual coordination. Here we see the structural problem of fragmentation, illustrated most starkly in the eMudhra vulnerability: Firefox had a fast update channel that blocked the bad certs within hours, while harder-to-update software will form a long tail of vulnerable surface likely to last an uncomfortably long time.

One bad patch, a million targets - LiteLLM and OVH were supply chain attacks, where the attackers were able to hijack an update system and get victims to compromise themselves. This is the inverse of the previous shape: an update channel becomes an attack vector when a bad guy gets ahold of it.

So yes, it’s a big bag of scary headlines, but we’re really talking about three problems of system design: where do secrets live, who applies fixes, and what does the fix channel trust?

These are problems that Miren, as a deployment platform, has to solve head-on.

Picking the strongest shape

Miren is built on the belief that you shouldn’t have to choose between opaque platforms that cater to the enterprise and a stack of DIY complexity to get a great developer experience.

We want everybody to feel the joy of tooling that gets out of your way and lets you jam on a piece of software with your team and your users. But none of that matters if we don’t also provide a strong foundation that can carry your software through from prototype to production.

To that end, we’ve made some very intentional choices in our design space:

We make it easy to run, so you can run it - Miren’s runtime is open source software that you can run on any Linux computer. That means your secrets stay on your machine under your control. (We can also host a cluster for you, if you want to trade some security for convenience.)
A control plane that helps more than it can hurt - We’ve been careful to architect Miren Cloud in such a way that it makes things easier without unduly growing your risk. Miren Cloud never stores your secrets, and we designed the protocol between Miren clusters and Miren Cloud such that your app stays up and you can still deploy to it even if we take an outage. (You can also run an entirely disconnected cluster, if you want to trade some convenience for security.)
Building in the open - Since all the software that runs on your computer is open source, it’s auditable. You can inspect how we run your software along with every one of your clusters’ interactions with Miren Cloud.
Tunable self-upgrades - Miren Cloud can drive auto-updates for your clusters with a stable channel that has a one-week cooldown, on a maintenance schedule you choose, with automatic rollbacks on failures.

We think this is the strongest system shape to address the structural risks represented by these incidents: distributed control of user data, automatic patching, and a supply chain we can keep hardening.

The risk that’s left

In this arrangement, the supply chain remains an irreducible source of risk. There are two inversely correlated variables: make a system easy to change so you can fix it, or make it hard to change so nobody can attack it. The modern security consensus seems to be that fast patches with defended channels are our best tradeoff.

But the special thing about open source, self-hostable software is that it allows you to choose a different set of tradeoffs by building the software yourself. This is obviously more work, but it lets you audit every line of code touching your machine.

There’s a lot more that we can do on the supply chain security side. One live scenario: Miren Cloud’s automatic upgrades are still opt-in because they take brief cluster downtime, so we want you to pick a maintenance window that works for you. Once we make it to zero-downtime cluster upgrades, flipping the default would mean that new clusters auto-update. So an active topic of discussion is: what kind of build integrity checks should we land before that happens?

We’re building Miren together with our community, so this is very much not a rhetorical question! Help us choose by telling us what’s important to you. We’re always up for a chat.

So it’s not an incomprehensible mess: there are structures here that form an open design space with important tradeoffs to consider. There will always be room for multiple approaches - from hosted platforms to DIY stacks - but we believe that distributed data with centralized fixes is the right direction for modern software deployment.

If you’re picking up what we’re putting down, give Miren a try and do let us know what you think!

Show HN: Corgi, a helpful {agent, terminal} multiplexer

Hacker News

corgi.computer

2026-10-23 15:46:38

Comments...

Original Article

Terminal multiplexer for humans (and agents).

$ curl -fsSL https://corgi.computer/install.sh | bash

agent aware

▶ working
● needs you
● unread
○ clear

F1 to catch up.

new tab agent

Ctrl-T to jump into work, new or old.

Use your existing accounts. All of them.

`top` for your tokens

Where did the tokens go?

activity tracking

Hover an agent to see what it did.

Keep ’em running

Like tmux, your agents and processes keep running in the background.

corgi and you’re in.

● agents + dev server · running in the background

see their changes

Every file it touched, in one scroll.

worktrees

Fantastic trees and where to find them.

clever corgi

Organizes your workspaces for you.

resource usage

Per workspace, live.

embraces the modern terminal

⌘V just pastes an image, even on SSH*.

Links you can copy.

Images you can see.

* Requires Ghostty Nightly .

Tab Tricks

Undo tab closes with Ctrl-Shift-T .

hackable

Drive Corgi from any terminal. corgi --skill teaches your agents.

keyboard and mouse

Corgi loves both.

Rune 1.3: adds TypeScript, a Helix editor, Kitty graphics and OSC-7501

Hacker News

rune.build

2026-10-23 15:42:01

Comments...

Original Article

We are all living inside of an obscure sci-fi film from 1970

Hacker News

thanksforthatjim.bearblog.dev

2026-10-23 15:41:59

Comments...

Original Article

23 Oct, 2026

colossus surveillance

Imagine that a film was released this year in which the following happened:

An easily led US President is persuaded by a smug, egotistical tech bro to hand over complete control of the nation’s defences to their cutting edge AI model.
This predictably doesn’t go well, the AI seizes more and more power, implementing a surveillance state, carrying out executions and eventually completely usurping human political control.
The smug AI tech bro completely fails to rein things in and eventually just uses the whole mess as an excuse to coerce an employee into having sex with him.

Unless it is a documentary, something so on the nose probably won’t get made any time soon. Fortunately this exact film was already made 56 years ago.

Colossus: The Forbin Project was released in 1970. It was adapted from a 1966 novel by British sci-fi author D.F. Jones named simply, Colossus.

While the film seems to be well appreciated, with respectable scores on sites like Rotten Tomatoes and Letterboxd , it is certainly not well known and could probably be described as obscure, I can’t ever remember seeing it on TV or being discussed alongside the more famous films of the time.

This is a shame, because C:TFP is a solid, paranoid drama touching on techno fetishism and the tensions of the cold war. It features fantastic production design in the cassette futurism aesthetic and might well turn out to be the most prophetic film ever made .

As things kick off, an eerily JFK-esque US president announces that he has placed full responsibility for the defence of his nation in the hands of a supercomputer named Colossus. The rather smug inventor of Colossus, Charles Forbin, explains that buried in an impenetrable nuclear bunker, Colossus has full autonomous control over American defence capabilities.

The idea is that this will make the US completely safe from the threat of any attack and the President muses that the threat of dispassionate destruction hanging over the planet will probably bring about world peace. Guess how that goes?

colossus missile launched

To cut a long, but well worth watching, story short, Colossus makes contact with the equivalent Russian AI, grows beyond the control of its creators and uses the threat of nuclear war to get its way. All of Forbin’s attempts to get control fail. Maybe because of mankind’s reckless naivety in the face of a technology that they created but don’t fully understand, or maybe because he is absolutely smashed on frequent, massive martinis.

Under constant surveillance he announces to his staff that the only way he can pass on messages to them is by one of his young female subordinates sleeping with him as that would be the only time that he won’t be watched by the computer. Very convenient.

The film ends with the world under the control of an AI overlord, with a suitably sinister robot voice. No-one looks happy about things.

This all seems far too likely for my liking, but maybe I’m being overly pessimistic. We’d only need to be really worried if there was an ongoing trend of handing over military decision making to a bunch of barely understood and frequently error-prone large language models… and if the whole mess was propped up by the ego and greed of a handful of ketamine fuelled tech entrepreneurs and shamelessly corrupt kleptocrats.

Gulp.

Even the MTA Admits Something Is Very Wrong With Its Bus Fare Enforcement Teams

hellgate

hellgatenyc.com

2026-10-23 15:40:57

Following the violent assault of a school dean in Brooklyn last week, the transit system announced a pause on its nightmare bus enforcement regime....

Original Article

After a Brooklyn school dean was beaten up by MTA police earlier this month , the head of the transit system announced on Thursday that it was suspending its fare enforcement on buses. Kyle Taylor, a dean at a school in Brownsville, claims he paid the fare, even as uniformed MTA police officers from the EAGLE team pinned him against the bus and slammed him to the ground. Taylor claims he eventually passed out as a result of the interaction.

Announcing the pause, MTA Chair Janno Lieber said that a second incident involving fare enforcement officers had come to his attention, leading him to order a review of safety protocols for the teams. He didn't elaborate on what that second incident was.

"I’m not willing to keep our teams active in the field until I know that all protocols are being followed with respect to both the customer interactions, how they’re conducted, but also with respect to the reporting and investigation of incidents," Lieber said at a Thursday press conference. "As a result I’m ordering an immediate safety stand-down until these investigations conclude.”

In August 2024, the MTA rolled out buffed-up versions of the EAGLE teams, in an effort to cut down on fare evasion.

But as Hell Gate has reported extensively , the EAGLE teams have for several years now frequently given tickets to riders who have already paid, pulled people off the bus because officers' own technology has malfunctioned, and just generally slowed down commutes for riders on the city's "Select Bus Service."

Give us your email to read the full story

Sign up now for our free newsletters.

Sign up

Introducing Kimi K3.1 Pro

Simon Willison

simonwillison.net

2026-10-23 15:40:54

Introducing Kimi K3.1 Pro Kimi K3.1 Pro landed on the Kimi API today - it's not yet open weights, but Moonshot promise "Full model weights will be released by Nov 4, 2026". They're also offering a "Highspeed" version that's 2-3x faster, at twice the price (except for input token cache hits, which a...

Original Article

23rd October 2026 - Link Blog

Introducing Kimi K3.1 Pro ( via ) Kimi K3.1 Pro landed on the Kimi API today - it's not yet open weights, but Moonshot promise "Full model weights will be released by Nov 4, 2026".

They're also offering a "Highspeed" version that's 2-3x faster, at twice the price (except for input token cache hits, which are priced the same).

The US dollar pricing is $2.00/million tokens for input and $10/million for output - the same as GPT-6.1 Sol and half the price of Claude Opus 5.5.

Moonshot's own benchmarks show Kimi as approximately level with Opus 5.5 and GPT-6 Astra - beating them on a few benchmarks, coming close on others.

Artificial Analysis scored Kimi at 55 - ahead of Claude Fable 5.1, GPT-6 Astra, and Gemini 4 Argon (all at 53) and behind only Claude Opus 5.5 (58).

This is the first time a (soon-to-be) open weight model has scored this highly against the frontier.

I tried it out via the Moonshot API using the llm openai endpoint command I added to LLM 0.32 back in August:

llm openai endpoint \
  https://api.moonshot.ai/v1 \
  --key kimi \
  -m kimi-k3.1-pro \
  "Generate an SVG of a pelican riding a bicycle" \
  --responses \
  -o reasoning_effort low \
  > kimi-k3.1-pro-pelican-low.stdout.txt \
  2> kimi-k3.1-pro-pelican-low.stderr.txt

llm openai endpoint can run prompts against any OpenAI-compatible endpoint but doesn't log the results, hence the extra options to save stdout and stderr (the reasoning trace).

Here are the pelicans I got for Kimi K3.1 Pro on the three reasoning levels it supports - low, medium, and max. This is max:

It's pretty solid - feet are on the pedals, bicycle frame is good, nice beak. Both legs are on the same side of the Fram though.

For comparison, I ran fresh pelicans against Kimi K3 on those three reasoning levels.

Now Google says it might use your Gmail and Google Photos data to target ads

Hacker News

www.theverge.com

2026-10-23 15:34:15

Comments...

Original Article

According to the new terms, sharing your data for better AI recommendations also means opening it up for more personalized ads.

by

Oct 23, 2026, 4:52 PM UTC

STK093_GOOGLE_D

Image: Cath Virginia / The Verge

Jess Weatherbed

is a news writer focused on creative industries, computing, and internet culture. Jess started her career at TechRadar, covering news and hardware reviews.

Google has updated its privacy policy in a way that could mean you’ll start seeing targeted ads based on your personal data if you’re using personalized AI features. The update, spotted by Android Authority , adds an exception to its promise about not using your Drive, Gmail, or Google Photos for personalized ads. While the previous version simply said it wouldn’t do that, as of October 16th, Google has added the line, “unless you choose to make data from these services available to other Google services that support personalized ads.”

That means anyone who has connected their Drive, Gmail, or Google Photos to AI Mode and other Search tools via Google’s Personal Intelligence feature — allowing those tools to provide better responses or recommendations by knowing more about you — may now see ads targeted on the basis of that content.

Advertisers don’t get access to your Drive, Gmail, and Photos information or personally identifying details such as your name or email address, and Google won’t show you ads based on sensitive categories like race, sexual orientation, religion, or health.

This is what the policy says:

“You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use, such as Google Photos and Workspace apps like Gmail and Drive, in order to provide you with a more personalized experience, subject to the policies and settings of the accessing service. For example, Search may process some of the data that you allow Search to access to personalize content, including ads.”

“Depending on your settings, we may also show you personalized ads based on your interests, activity, or personalized content from Google services. For example, if you search for ‘mountain bikes,’ in Search you may see ads for sports equipment on YouTube.”

If you want to prevent your personal data from being used for targeted ads, you can choose which apps you want to disconnect from Search’s Personal Intelligence features or disable Personalized Recommendations entirely via the Search Services Personalization settings page.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Jess Weatherbed

Dessa: the most authentic full-duplex speech model ever built

Hacker News

block.xyz

2026-10-23 15:09:54

Comments...

Original Article

Privacy Notice

Effective Date: October 21, 2026

This Privacy Notice describes how Block, Inc. and our affiliates (collectively, “Block,” “we,” and “us”) collect, use, disclose, transfer, store, retain or otherwise process your information when you interact with the dessa.com website (the “Services”).This Privacy Notice applies only to information collected in connection with your access to and use of our Services. Please read this Privacy Notice carefully. By continuing to interact with our Services, you are consenting to the practices described in this Privacy Notice.

This privacy notice does not cover the processing of your information when using other Block websites, products, or services, such as Square, Cash App, Afterpay, or TIDAL. Each of these offerings is governed by its own applicable privacy notice.

We may also include links to other websites, including social media platforms. For example, you may be given the option to share a news or blog article on a social media platform. This privacy notice does not apply to the data processing practices of other websites, and we encourage you to read the privacy notices available on any other website you visit.

Additionally, this privacy notice does not cover information processed about candidates for employment or contractual services. For details on privacy practices related to employment or contractual candidates, please click here .

INFORMATION WE COLLECT ABOUT YOU

We collect information about you when you interact with the Services or or when you voluntarily choose to provide information to us directly.

Information You Provide

We collect information from you, including:

Identification Information. Your name; email address; mailing address; and phone number.
Other Information You Provide. Information that you voluntarily provide to us, including correspondence with us, or any other actions performed on the Services.

Information We Collect Automatically from Your Use of our Services

We collect information about you and the devices you use to access the Services, such as your computer, mobile phone, or tablet. The information that we collect includes:

Device information. Information about your device, including your hardware model, operating system and version, device name, unique device identifier, mobile network information, and information about the device’s interaction with our Services.
Internet or other electronic network activity information. Information about how you use and interact with our Services, including your access time, browser type and language, country and language setting on your device, Internet Protocol (“IP”) address, the domain name of your internet service provider, other attributes about your browser, mobile device and operating system, features you use, and the date and time of your visit to or use of the Services.

SOURCES OF INFORMATION

We only collect (and/or have collected during at least the 12-month period preceding the effective date of this Privacy Notice) information directly from you, and from how you use our Services.

HOW WE USE YOUR INFORMATION

We may collect, use and share (or have collected, used or shared during at least the 12-month period preceding the effective date of this Privacy Notice), information about you for the following reasons:

Providing, Improving, and Developing our Services

Determining whether the Services are available in your country;
Providing, maintaining, and improving our Services;
Developing new products and services;
Delivering the information and support you request;
Improving, personalizing, and facilitating your use of our Services;
Measuring, tracking, and analyzing trends and usage in connection with your use or the performance of our Services; and
Otherwise providing you with the products and features you choose to use.

Communicating with You About our Services

Sending you surveys and getting your feedback about our Services; and
Sending you information we think you may find useful or which you have requested from us about our products, services and other company updates, such as when you sign up for investor email alerts.

Protecting our Services and Maintaining a Trusted Environment

Conducting investigations, complying with and enforcing any applicable laws, regulations, legal requirements, and industry standards, and responding to lawful requests for information from the government or to valid legal process;
Contacting you to resolve disputes and help you with our Services;
Debugging to identify and fix errors that impair how our Services function;
Enforcing our Terms of Service or other applicable agreements or policies;
Investigating, detecting, preventing, recovering from, or reporting fraud, misrepresentations, security breaches or incidents, or other potentially prohibited, malicious, or illegal activities;
Protecting our, or your rights or property, or the security or integrity of our Services;
Verifying or maintaining the quality and safety of our Services; and
Verifying your identity.

Other Uses

For any other reason we may tell you about from time to time.

WHEN AND WITH WHOM WE SHARE YOUR INFORMATION

We may share the information described in the “Information We Collect About You” section with the following categories of service providers and third parties:

With our Affiliates and Group Companies

With our group companies and corporate affiliates, such as Cash App, Square, Afterpay, or TIDAL, for the reasons outlined above. For example, we may share your information internally to understand how you engage with Block company products to help make our Services better for you and for everyone, and to help us build Services tailored to your preferences.

With Our Service Providers

With service providers who help us to provide, maintain, and improve our Services, including service providers who access information about you to perform services on our behalf (e.g., vendors who help us with fraud prevention, identity verification, and fee collection services), and other entities that help us provide the Services.

Business Transfers and Corporate Changes

To a subsequent owner, co-owner, or operator of one or more of the Services; or
If we do or try to do a corporate merger, consolidation, or restructuring (including during due diligence and negotiation of these); the sale of substantially all of our stock and/or assets; the financing, acquisition, divestiture, or dissolution of all or a portion of our business; or other corporate change.

Safety and Compliance with Law

If we believe that disclosure is reasonably necessary (i) to comply with any applicable law, regulation, legal process or governmental request (e.g., from creditors, tax authorities, law enforcement agencies, in response to a garnishment, levy, or lien notice, etc.); (ii) to establish, exercise or defend our legal rights; (iii) to enforce or comply with our Terms of Service or other applicable agreements or policies; (iv) to protect our or our customers’ rights or property, or the security or integrity of our Services; (v) for an investigation of suspected or actual illegal activity; or (vi) to protect us, users of our Services, or the public from harm, fraud, or potentially prohibited or illegal activities.

With Your Consent

With your consent. For example:

At your direction or as described at the time you agree to share; or
When you authorize a third party application or website to access your information.

With Others

With other companies who deliver services on our behalf, including via the use of cookies and similar automated technologies.

Aggregated and Anonymized Information

We also may share (within our group of companies or affiliates, or with service providers or other third parties) aggregated and anonymized information that does not specifically identify you or any individual user of our Services.

COOKIES AND OTHER SIMILAR AUTOMATED TECHNOLOGIES

When you interact with our online services, or open emails we send you, we obtain certain information using automated technologies, such as cookies, web server logs, web beacons, and other technologies. A “cookie” is a text file that websites send to a visitor’s computer or other internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. A “web beacon,” also known as an internet tag, pixel tag, or clear GIF, is a tiny graphic image that may be used in our websites or emails.We use these automated technologies to collect your device information, internet activity information, and inferences as described above.

These technologies help us to:

Remember your information so you do not have to re-enter it;
Track and understand how you use and interact with our online services and emails;
Tailor our online services to your preferences;
Measure how useful and effective our services and communications are to you; and
Otherwise manage and enhance our products and services.

We set some of these automated technologies ourselves, but others are set by third parties who deliver services on our behalf. For example, we may use other companies’ web analytics services, which use automated technologies to help us evaluate how customers use our websites.Your browser can alert you when cookies are placed on your device, and how you can stop or disable them via your browser settings. Please note, however, that without cookies all of the features of our online services may not work properly. If you use a mobile device, you can manage how your device and browser share certain device data by changing the privacy and security settings on your mobile device. You can learn more about cookies and how to manage your preferences by visiting http://www.allaboutcookies.org.

HOW LONG WE KEEP YOUR INFORMATION

We generally keep your information as long as reasonably necessary to provide you the Services or to comply with applicable law. However, we can keep copies of information about you and any transactions or Services in which you may have participated for a period of time that is consistent with applicable law, applicable statute of limitations, or as we believe is reasonably necessary to comply with applicable law, regulation, legal process, or governmental request, to detect or prevent fraud, to collect fees owed, to resolve disputes, to address problems with our Services, to assist with investigations, to enforce our Terms of Service or other applicable agreements or policies, or to take any other actions consistent with applicable law.

YOUR PERSONAL INFORMATION RIGHTS

Depending on the jurisdiction in which you reside, you may be entitled under applicable law to request:

Access to your personal information, including: (1) the categories of personal information described above that we have collected about you and the categories of sources from which we collected such personal information; (2) the business or commercial purposes for collecting or sharing such personal information; (3) the categories of personal information about you that we have disclosed to third parties for a business purpose; (4) the categories of third parties to whom we have disclosed such personal information; and (5) in portable format, the specific pieces of personal information we have collected about you;
Deletion of the personal information we have collected from you;
Correction of the personal information we have collected about you;
To opt-out of the sharing of your personal information for purposes of targeted advertising.

To the extent you would like to send us a request to exercise your access, deletion, or correction rights, you may do so by contacting us by email at privacy@squareup.com , by writing to us at Block, Inc. (Attn: Privacy), 1955 Broadway, Suite 600, Oakland, CA 94612, U.S.A, or by calling us at 1.844.213.7377.

To help protect your privacy and maintain security, we take steps to verify your identity before granting you access to your personal information or complying with your request.

You may designate an authorized agent to make a request on your behalf as permitted under law, though before we process that request, we will require that you provide the authorized agent written permission to do so and verify your identity directly with us.

You, or an authorized agent you designate to submit a request on your behalf, may also contact us at the address below.

Although some of the information we collect and process about you may be considered sensitive personal information, we only process such information for purposes authorized by law, such as to provide you with certain services you request from us.

We will not discriminate against you if you exercise these privacy rights, nor will we deny, charge different prices for, or provide a different quality of goods or services if you choose to exercise these rights.

Additionally, we do not sell your information to third parties.

Do Not Track

Certain web browsers allow you to instruct your browser to respond to Do Not Track (“DNT”) signals to websites you visit, informing those sites that you do not want your online activities to be tracked. At this time, our websites are not designed to respond to DNT signals or similar mechanisms from browsers.

CHILDREN’S PERSONAL INFORMATION

Our Services are general audience services not directed at children under the age of 13. If we learn that any information we collect has been provided by a child under the age of 13, we will promptly delete that information.

HOW WE SECURE INFORMATION

We take reasonable measures, including administrative, technical, and physical safeguards, to protect your information from loss, theft, and misuse, and unauthorized access, disclosure, alteration, and destruction. Nevertheless, the internet is not a 100% secure environment, and we cannot guarantee absolute security of the transmission or storage of your information. We hold information about you both at our own premises and with the assistance of third-party service providers.

STORAGE AND PROCESSING

We may, and we may use third-party service providers to process and store your information in the United States, Canada, Japan, the European Union, and other countries.

CHANGES TO THIS PRIVACY NOTICE

We may amend this Privacy Notice from time to time by posting a revised version and updating the “Effective Date” above. The revised version will be effective on the “Effective Date” listed. If you disagree with these changes, you may stop using our Services at any time. Your continued use of our Services constitutes your consent to any amendment of this Privacy Notice.

HOW TO CONTACT US

Please contact our privacy team with any questions or concerns regarding this Privacy Notice:Block, Inc. (Attn: Privacy), 1955 Broadway, Suite 600, Oakland, CA 94612, U.S.A, privacy@squareup.com .If you have any questions or concerns regarding our notice, or if you believe our notice or applicable laws relating to the protection of your personal information have not been respected, you may file a complaint with our privacy team listed above. We will respond to let you know when you can expect a further response. We may request additional details from you regarding your concerns and may need to engage or consult with other parties in order to investigate and address your issue. We may keep records of your request and any resolution.

Florida officer found dead man, impersonated him for years, renovated his home

Hacker News

www.nbcnews.com

2026-10-23 15:01:56

Comments...

Original Article

Dennis West was found dead in his Florida home during a welfare check in July 2022. Weeks later, one of the officers who discovered his body took possession of the property unlawfully and spent years renovating and impersonating him, according to investigators and police documents.

Brian Louis Sguros, 35, an officer with the Lauderhill Police Department, was arrested Tuesday on felony charges of official misconduct, criminal use of a deceased person’s identification, criminal use of personal identification information, offense against a computer user and unlawful use of a two-way communications device.

It’s not clear whether Sguros has an attorney.

The Broward County Sheriff’s Office said in a news release that Sguros responded to the welfare check at West’s home on July 11, 2022. West, 71, was found dead inside.

The medical examiner determined West died of natural causes from arteriosclerotic cardiovascular disease, according to Sguros’ arrest affidavit.

Sguros presented himself to the medical examiner’s office as West’s friend, though there is no indication that Sguros knew West, according to the sheriff’s office. He also told the office that West had no living family, which was untrue, authorities said.

Sguros stated in paperwork he filed that he took possession of the home in August 2022, weeks after West died, the news release said.

The home in Lauderhill, Fla., where Dennis West was found dead. NBC Miami

After he took over the home, from August 2022 through February 2025, Sguros cleaned and repaired the property, his arrest affidavit said. Sguros claimed he spent at least $214,000 of his own money on the home.

Sguros also paid taxes and utilities on the home in West’s name, authorities said.

In sworn statements through civil pleadings, Sguros maintained that he took possession of the property and acted because it was hazardous and he wanted to prevent criminal activity and people from squatting, the affidavit said.

The investigation found that Sguros had conducted multiple searches within law enforcement databases from his work computer for West’s driver’s license record, the arrest affidavit said. Those searches disclosed West’s address, date of birth, Social Security number and other information, according to the filing.

Sguros is accused of using West’s identification to “get the city of Lauderhill to issue a permit to facilitate repairs,” the release said. He is alleged to have forged West’s signature on the permit application, but the telephone number listed was his own, the arrest affidavit said.

A project manager for a company contracted to replace exterior doors and windows at West’s home in 2024 told police he had no idea West was dead at the time of the work and recalled Sguros’ telling him West was “unavailable.”

In February 2025, Sguros and his spouse filed a form with the Broward County Property Appraiser seeking to establish a claim to the home, according to the affidavit.

The home takeover came to light when a real estate company bought the property from West’s heirs months later, the arrest affidavit said.

The company gained lawful possession of the home in probate proceedings in the fall of 2025, but when one of its employees tried to take possession of it, the employee encountered Sguros, according to the affidavit.

Sguros surrendered the keys to the property before the company’s attorney filed an unlawful detainer action, the affidavit said. But he “demanded reimbursement for repairs and improvements he claimed to have made,” it said.

Sguros filed a complaint against the real estate company in February, saying in filings that he discovered West in the home while he was on duty and detailing how he subsequently began to clean, secure and invest in the property. However, he never established in his records that he came to be involved in the home through a purchase, lease, probate appointment, deed or relationship with West’s heirs, the arrest affidavit said.

In the civil litigation, Sguros sought more than $200,000 for the work he said he performed on the home, the affidavit said.

In May, an attorney for the company submitted a complaint to the Lauderhill Police Department.

Sguros appeared in court Wednesday and was ordered held on a $25,000 bond, NBC South Florida reported . After his arrest, he was placed on administrative leave without pay from the police department.

DNS: A Replacement for Finger

Hacker News

altchan.org

2026-10-23 15:00:04

Comments...

Original Article

Timed out getting readerview for https://altchan.org/sh/42

A Crash Course on NYC's 2026 Ballot Proposals

hellgate

hellgatenyc.com

2026-10-23 14:59:34

Bus lanes, bike lanes and outdoor dining galore....

Original Article

Cherished New York City voters, this midterm election, you are not only being asked to consider candidates. You are also being asked to consider ideas.

Are they the most exciting ideas you will ever hear? Absolutely not. But could they cause meaningful change to how the City operates? Yes indeed. You'll be voting on a series of tweaks to City law that will make it easier to reconfigure our roads for safety, efficiency, and leisure.

You'll also be deciding how the City puts money aside for a crisis scenario such as, I don't know, an AI bubble collapse .

Where did these proposals come from? In May, Mayor Zohran Mamdani convened a charter review commission led by Patrick Gaspard, the former diplomat, de Blasio advisor, and Democrat-whisperer . The commission heard testimony from more than 1,000 New Yorkers, including elected officials and advocates, and released their proposals in July .

Mayors frequently do this. Last year, New Yorkers voted yes on a series of complicated and extremely consequential housing ballot proposals (among others ) from Mayor Eric Adams' charter commission that reshifted power to approve projects from the City Council to the mayor and the five borough presidents.

If 2025's major ballot prop theme was Yay Increase Multifamily Buildings Yugely (YIMBY)

2026's might be Fix All Streets and other Stuff Today (FASST).

This top-line message isn't subtle: Gaspard's charter review commission called themselves "the Commission on Government Efficiency (COGE)" as a somewhat puzzling reference to the reviled DOGE . And recently, Mayor Mamdani's office has released slick promos that very strongly suggest that these ballot propositions are good for the city.

Give us your email to read the full story

Sign up now for our free newsletters.

Sign up

Microsoft Teams to get AI-powered, context-aware phishing detection

Bleeping Computer

www.bleepingcomputer.com

2026-10-23 14:54:41

Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]...

Original Article

Microsoft Teams

Microsoft says Teams will begin using AI-powered phishing detection in early November 2026 to detect malicious behavior in messages.

The rollout is part of a targeted release phase expected to end by mid-November, with the new security feature likely reaching general availability worldwide between early and mid-December.

Microsoft first revealed in a Microsoft 365 Roadmap entry last week that the AI-powered phishing detection will use conversation context (without retaining message content) to identify phishing and suspicious behavior in higher-risk messaging scenarios, such as external first-contact chats.

"Microsoft Teams is introducing AI-powered, context-aware phishing detection to help identify phishing, social engineering, impersonation attempts, and deceptive intent," the company said in a Microsoft 365 Message Center update on Wednesday.

"The capability analyzes conversation context to identify suspicious behavior that may not include traditional indicators such as malicious links or files."

Microsoft says IT admins won't need to take any action to enable this new security protection feature, which will focus on external first-contact chats for most users.

*Teams AI-powered phishing detection (Microsoft)*

It also added that while the new Teams feature will analyze conversation context to discover suspicious behavior, it will not retain customer data for further AI training or other uses.

"This capability is used only for security protection and not for productivity, summarization, advertising, user monitoring, or other non-security purposes," Microsoft said. "Customer message content is not retained by the detection system for model training or other secondary uses."

This is part of a broader list of Teams security changes, with Microsoft announcing in December that admins could lock external users via the Defender portal starting in January to thwart cybercrime groups (including ransomware gangs ) from abusing Teams in social engineering attacks that target victims' employees.

It also began rolling out a new Teams meeting protection policy in August that lets admins block all identified external bots automatically from joining meetings.

Last month, Microsoft also revealed that Teams will blur QR codes sent by external senders to better protect against fraud and phishing attempts, and that it will let users report suspicious guest invitations directly in Teams to help security teams block phishing attempts and other attacks abusing guest invitations.

More recently, in early October, the company announced plans to introduce support for third-party deepfake detection solutions and impersonation protection in Teams meetings.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

[$] The first part of the 7.4 merge window

Linux Weekly News

lwn.net

2026-10-23 14:54:33

Since the merge window for 7.4 opened, there have been 6,753 non-merge changesets pulled into the mainline repository. Many more are expected, especially given the possibility that this merge window will be extended to three weeks. Still, even this initial set brought in a number of new features, i...

Original Article

The page you have tried to view ( The first part of the 7.4 merge window ) is currently available to LWN subscribers only. Reader subscriptions are a necessary way to fund the continued existence of LWN and the quality of its content.

If you are already an LWN.net subscriber, please log in with the form below to read this content.

Please consider subscribing to LWN . An LWN subscription provides numerous benefits, including access to restricted content and the warm feeling of knowing that you are helping to keep LWN alive.

(Alternatively, this item will become freely available on November 5, 2026)

‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking

Guardian

www.theguardian.com

2026-10-23 14:48:48

After discovery of severe bug in the PHP programming language, executives warn of ‘vulnerability tsunami’ Leaders in cybersecurity are sounding the alarm after the discovery of a major vulnerability this week. They are predicting that artificial intelligence tools will expose more fundamental weakne...

Original Article

Leaders in cybersecurity are sounding the alarm after the discovery of a major vulnerability this week. They are predicting that artificial intelligence tools will expose more fundamental weaknesses in global internet infrastructure in the months to come.

“I no longer think we’re going to be able to patch all bugs,” said Sam Altman on Thursday evening, joining the chorus of executives. In the midst of what’s being called “Black October”, for which researchers used AI to help identify critical flaws in a coding language that is used across millions of websites and may have been unpatched for years, tech executives are warning about the ways AI will be used both to identify and exploit security vulnerabilities at an unprecedented scale and pace.

The next few months will see a “vulnerability tsunami”, according to Jason Clinton, Anthropic’s deputy chief information security officer. “There won’t be enough time to patch critical infrastructure,” Clinton said in a post on X on Thursday evening. Marc Benioff, the Salesforce CEO, agreed and called it a “code red”.

AI is uniquely able to find and identify security flaws in a way and at a pace that will feel catastrophic because the security community will not be able to move quickly enough to address them, said Matthew Prince, the Cloudflare CEO. “It’s going to feel like the sky is falling. It’s going to feel like there’s nothing we can do.

“The next two years are going to be incredibly, incredibly, incredibly fraught with new tools that have infinite patience to go look for vulnerabilities across the Internet,” he wrote in a post on X.

While cybersecurity experts have been warning about a “vulnpocalypse”, or the ability for AI to more easily identify security bugs for months, it wasn’t until “Black October” that researchers were able to use AI to find a flaw as fundamental and critical as the one announced on 21 October.

Massive bugs were found in a programming language called PHP, which may have left the millions of websites that run on it vulnerable to hackers for years. Some experts estimated 70% of all the sites on the internet were at risk of hacking.

However, in the same way AI will be used to aid in identifying security vulnerabilities at an unprecedented pace, tech leaders worry it’ll also be used by malicious actors to exploit those bugs at an unprecedented pace.

Attempts to exploit the PHP vulnerability have already begun .

After the vulnerabilities were announced, government and private websites across the US and UK temporarily took down their sites to patch the bugs. The US National Security Agency (NSA) issued an alert recommending any site that runs on PHP implement the patches immediately. Malicious cyberactors may seek to further exploit these bugs to access servers without authorization, the NSA said.

“Such an access vector could help attackers steal sensitive data, disrupt services or move deeper into a network,” the warning read.

skip past newsletter promotion

In a post on X, Prince said CloudFlare, a security provider, had seen evidence of thousands of people trying to exploit the PHP flaws in the 10 hours before it was announced.

“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” he wrote.

In a blogpost, researchers at AI security platform Wiz said that this was “among the most severe vulnerabilities discovered in PHP, and arguably in software history”.

“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” they wrote.

Railway Preliminary Report: Oct 21st Security Incident

Lobsters

blog.railway.com

2026-10-23 14:35:24

Comments...

Original Article

Jacob Cooper & Angelo Saraceno

Oct 22, 2026

Railway identified a security incident that ultimately led to unauthorized access to a subset of internal Railway systems. This is a follow up to the initial security disclosure published on October 21st . Our forensic investigation is still ongoing.

Railway engaged external incident response experts and the authorities to assist in forensics.

We will have a follow up to this document as the investigation concludes.

What happened

At October 20th 19:53 UTC, Railway became aware of a sustained and targeted campaign to attack and breach our services. Early investigations tell us this attack was attempting to obtain AI provider API keys to perform distillation attacks.

Initial evidence leads us to believe that the malicious actor had access to abliterated models and substantial compute resources which enabled them to perform highly sophisticated exploits against our infrastructure.

Due to the ongoing investigation and to protect our customers, we are not yet able to share the specific details and scale of the exploits. We will aim to disclose this responsibly as we complete our investigation.

We believe the attack timeline took place from October 20th 13:58 UTC to October 22nd 03:32 UTC. The final timestamp represents when we confirmed that the attacker no longer had access to any internal systems.

Railway began triaging the attack immediately upon detection. To prioritize the safety of our users, we disabled our build infrastructure. Additionally, we reported potentially impacted secrets to partner vendors. (More information in below sections)

During that period of triage, customers experienced interrupted builds and deployments, as well as periods of dashboard, API, CLI, and support unavailability.

After the attacker gained access to our systems, a subset of our customer base had their encrypted secrets exposed which required credential rotation. We recommend that all customers who signed up prior to October 21 rotate their keys stored on Railway. We have notified the customers that have been directly impacted.

Below is a timeline of events and facts as of October 22nd:

Date	Time (UTC)	Event
October 20	13:58	Monitoring systems triggered a page to engineering on-call for abnormal system activity in the form of elevated latency. The on-call engineer began research into the suspicious activity.
October 20	14:03–16:51	Incident investigation led to Railway identifying this as an attempted escalation of privilege a hostile external party. Railway engineering identified potential privilege escalation in our build infrastructure by the attackers. As a result, a decision was made to halt build pipelines to prioritize user safety.
October 20	17:03	Railway declared an incident on status.railway.com.
October 20	16:51–18:05	Railway engineering team began deploying mitigations across the build systems, and restricted access to the affected infrastructure.
October 20	18:05-19:53	Railway engineering reported that the exploit has been remediated, and validated that the exploit could no longer be reproduced within Railway infrastructure.
October 20	19:53	Additional evidence was identified that the attacker could escalate their access, at higher scale, across multiple parts of the Railway system, in-parallel.
October 20	19:59–20:56	Additional monitoring and forensics were deployed to isolate blast radius as well as neutralize the attacker’s entrypoints/access.
October 21	00:22–03:08	Further monitoring and credential restrictions were introduced. Subsequent routes of access were identified. As a precaution, builds were halted again.
October 21	04:24-05:23	Continued forensic research identified the attacker was able to pull secrets, in encrypted format; however, at the time attacker was unable to decrypt said secrets. Identification of systems to revoke access began immediately.
October 21	05:23–05:27	Railway engineering revoked access to the identified systems and disabled non-essential internal systems to reduce further attack surface area.
October 21	05:27—07:25	At this point, the attacker accessed credentials to access our CI environment where the attacker was able to decrypt artifacts that held additional API access.
October 21	7:25—09:18	Railway engineering identified database evidence of an unauthorized query of encrypted environment variables, of which a subset were decrypted utilizing a combination of the compromised credentials. Note: Because the full keys were envelope encrypted, this query alone cannot identify specifically which keys in the affected customers project/service were affected.
October 21st	9:18-9:25	Logs from the attackers payloads were read by Railway staff, highlighting the specific API key names they were searching for.
October 21	09:25	Based on the above, Railway notified vendors proactively about the surfaces that the attackers accessed. Vendors were requested to revoke all keys for their service; Railway provided all keys that they had registered on the platform for some services.
October 21	09:28	The public status page was updated to confirm dashboard, API, and CLI unavailability, new builds being disabled, and support tooling disruption.
October 21	20:19–22:10	Railway announced user session invalidation, published its security disclosure and customer guidance, and notified all users of internal and external credential rotation.
October 22	03:32–06:29	Railway engineering began to reinitialize internal systems with the minimal required dependencies, new credentials, and additional hardening. Enterprise and Pro builds were restored.
October 22	17:00-22:49	Railway reported full API restoration and normal Pro, Enterprise, Hobby, Trial, and Free deployments. Ancillary product features halted for security are being activated gradually.

Scale of impact

Railway’s system is built so that if one set of keys is compromised, they should not compromise the entire system. As a result, we can validate that at most 1.85% of all workspaces had some environment variables potentially compromised. This represents, numerically, about 100,000 workspaces. Out of an abundance of caution, the moment we realized any keys may have been decrypted, we notified external providers up to "all of the keys we stored, for all users on Railway". As such, the amount of users who were affected by upstream provider reset requests was larger than 100k.

Railway is reaching out to the customers with definite impact. We are also proactively reaching out to customers who we consider high risk. Because we were unable to know which variables specifically were decrypted, we are reaching out to all users who, based on preliminary forensics of the attack pattern, we believe to be of high risk for targeting from the attacker. This number is greater than the 1.85% of workspaces.

Because the attacker was seeking AI credentials, forensics of the attacker’s behavior tell us that the attacker was looking for high value targets on the platform. We believe there are two buckets of risk:

Workspaces with a very large number of environment variables
Environments with a high amount of AI keys from vendors

The attacker did not access Railway user accounts as part of this incident. While we are not ruling out that they accessed user source code, we will confirm at the the time of our final forensic investigation report.

Railway proactively worked with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe, and others to revoke the potentially compromised keys as soon as we knew they were accessed on October 21st at 09:25 UTC.

Out of an abundance of caution, we provided vendors such as GitHub and SpaceXSI with all API keys that were present on the platform, regardless of whether those were known to be impacted. Users being notified by vendors about revocation does not imply that their credentials were impacted by the incident.

While new builds and deployments were paused for all customers, all existing user deployments remained online and running. At time of writing, builds for all tiers are restored.

User remediations

As indicated in the security disclosure published on October 21st, we recommend all users revoke and reapply sensitive environment variables stored on Railway prior to this date. We are recommending this out of an abundance of caution.

We’ve also published a set of guides to check for anomalous activity and credential rotation on various tools.

While Railway knows what the intent of access was, it’s advisable for all customers to:

Remove public network access to databases
Rotate any sensitive variables and keys
Check your GitHub account audit logs and review all app access
Check audit logs within your registries such as Dockerhub

If you have any questions, please email support@railway.com .

Railway actions taken

With the increased level of pressure that vendors are facing due to new found cyber threats, Railway intends to meet the scale and moment of this new era to keep our customers safe.

We continue to refine our platform and corporate security posture, taking all reasonable steps to mitigate attack vectors. Below is a list of what we have already done:

We shut down any potentially compromised internal tooling upon seeing suspicious activity.
We rolled all keys, and then rerolled them after validating that the intruder had been expropriated from the system.
We have engaged an external forensics company to further our understanding of the malicious actor.
We have rolled out a new generation of builder infrastructure, moving from our previous third generation isolated multi-tenant to our fourth generation single-tenant environments. Rollout was planned for next week, but was accelerated and completed due to this event.
We have rolled credentials for all storage buckets deployed on Railway.
We have rebuilt, from validated source, all tooling used to run Railway infrastructure, and validated that the same escalation patterns are not possible.
We have added functionality to mass revoke Railway application permissions whenever we suspect any suspicious activity.

We performed other mitigations that we are choosing to not disclose at this time out of an abundance of caution in protecting the safety of our customers.

Railway owns every layer from bare metal to the agent workflow for one reason: so builders on Railway can build their most ambitious products. This vision can only be achieved with an equivalent security posture matching that ambition. We will continue to operate in the same way we built our platform: carefully, in the open, and for the long run.

FAQ

Did customer applications go down? No - running services stayed online throughout the incident. New builds and deployments were paused during triage to mitigate possible attack vectors. The first system we brought online was the ability to disable existing deployments.

Was my Railway account accessed? No - individual accounts were not logged into. The attacker accessed Railway's internal systems and decrypted stored environment variables for a subset of workspaces. We did however revoke all Railway access tokens out of an abundance of caution.

Why did I get an email my keys got revoked by GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google, or Stripe? Railway sent a list of potentially decrypted keys to providers as soon as we were aware of the incident on October 21st 09:35 UTC prior to our public disclosure , with a request to revoke them, to limit the potential impact for users. Some vendors requested all keys to be revoked.

Why did Railway not notify customers of potentially decrypted keys sooner? At the time of discovery, the attack and incident mitigation was underway in-parallel. As mentioned, the moment any credentials were affected, we notified upstream providers. As the incident was on-going, we wanted to ensure the attacker was ejected from our running infrastructure before telling users to roll their credentials, to prevent the credentials from becoming immediately compromised again.

Is Railway safe to use now? Yes. The Railway engineering team has redeployed and revalidated all impacted systems. At the time of writing, any functionality that remains offline will return in the coming days.

Why was I unable to deploy new changes? To limit the scope of the attack, we intentionally stopped new builds to remediate and penetration test the impacted components of Railway infrastructure, while keeping user workloads running.

What did the attacker want? Forensic investigation evidence indicates the attacker was likely looking for AI and platform API keys, for distilling model weights.

I re-logged in and didn’t see anything, why? We rolled all GitHub App installations for Railway. If your GitHub account email is different than your Railway email, you may need to re-login using "Log in using email"

The Intercept Live in Conversation With Robert Reich

Intercept

theintercept.com

2026-10-23 14:34:26

Watch live as Inequality Media co-founder Robert Reich and The Intercept’s Akela Lacy break down the most pressing issues of the midterm elections. The post The Intercept Live in Conversation With Robert Reich appeared first on The Intercept....

Original Article

Democrats may be ahead in the polls. But can they withstand billions in campaign spending by Elon Musk and other MAGA oligarchs? Will the election be safe from intimidation and interference? And even if they do prevail, what would a Democratic Congress actually do to obstruct Trump’s attacks on democracy?

For decades, former Labor Secretary Robert Reich has been sounding the alarm about rising inequality and the concentration of power in America. Having served in three presidential administrations, he’s become one of the loudest and clearest voices challenging Democrats for their failures in the Trump era.

Reich joins Intercept Briefing host Akela Lacy for a live conversation about the most pressing issues this midterm season . He is the author of numerous books , including his memoir “Coming Up Short,” out in paperback now. His media company, Inequality Media, has also made a timely new documentary, called “ The Work in Progress ,” exploring how everyday Americans across the country are navigating our democracy in these times.

Watch live at 3 p.m. ET/12 p.m. PT .

Transcript coming soon.

Latest Stories

Join The Conversation

Amazon ‘Uses AI in Warehouses To Predict Whether Workers Will Join Unions’

Portside

portside.org

2026-10-23 14:31:11

Amazon ‘Uses AI in Warehouses To Predict Whether Workers Will Join Unions’ Maureen gmail Fri, 10/23/2026 - 14:31 ...

Original Article

Photo from above of Amazon management party.

https://www.kyliecooper.com/about

Amazon has been accused of using AI to track employees and rank how likely they are to form unions.

The online retail giant uses a tool called Atlas in an apparent bid to predict acts of dissent by workers in the UK, the US and Canada, a document released as part of court proceedings between Amazon and Canadian union Unifor show.

The document, which appears to be a training manual for company leaders, has led the GMB Union to accuse Amazon of using “Orwellian” AI tools to spy on workers.

“Workers deserve to be able to work free of the fear of excessive surveillance,” said GMB organiser Rachel Fagan.“If Amazon bosses are using Atlas or similar AI-fuelled systems in the UK, the British public deserve to know”.

The document also contains pointers for managers on listening to workers’ concerns without “over-sympathising”.

Atlas gives warehouses a risk score of between 100 and 900 for union activity, with a lower score meaning it believes workers are more likely to unionise. A higher score is “better” for leaders at the company, the document says.

This “makes it clear that they think the union is bad”, Michael Newman, a partner at London-based law firm Leigh Day, told openDemocracy.

Atlas is described in the document as a “labour risk framework to clarify how Amazon evaluates emerging workforce issues, labour union targets and internal or external labour threats.”

It outlines a five-tier scale – where tier one denotes workplace disruption and “imminent” worker action, while tier five merits “no immediate perceived risk”.

The scale can be used to determine staffing decisions, resource planning and action to “mitigate risks” while avoiding reduced productivity or profits, the document says.

In the UK, two Amazon warehouses have been listed in tier one, while 14 others in the US and Canada were named in this high-risk tier.

At a warehouse near Coventry named BHX4, there has been an “active organising campaign” while previous strike action has been recorded at another at EMA4 Sutton Coldfield.

Newman said that the findings relay “a very different story” to Amazon’s claim that it has no desire to deter workers from joining a union.

An Amazon spokesperson denied that Atlas is used to counter union activity and refuted the characterisation of the technology as surveillance of individual employees.

“This is site/building level activity only,” they told openDemocracy, adding that the company does not “track individual employees’ opinions, affiliations or union membership”.

Atlas is used to “help us understand where associates need more support and to ensure we’re addressing issues that they raise”, they added.

Kimi K3.1 scores 55 on Artificial Analysis, placed on the Pareto line

Hacker News

artificialanalysis.ai

2026-10-23 14:24:54

Comments...

Original Article

Intelligence

Artificial Analysis Intelligence Index

Artificial Analysis Intelligence Index v4.3.2 incorporates 10 evaluations: AA-Briefcase v1.1, GDPval-AA v2.1, AutomationBench-AA, Terminal-Bench 4.0, SciCode, Humanity's Last Exam, GDP.pdf, CritPt, AA-Omniscience, AA-LCR v1.1

No publicly available API

Artificial Analysis Intelligence Index v4.3.2 includes: AA-Briefcase v1.1, GDPval-AA v2.1, AutomationBench-AA, Terminal-Bench 4.0, SciCode, Humanity's Last Exam, GDP.pdf, CritPt, AA-Omniscience, AA-LCR v1.1 . See Intelligence Index methodology for further details, including a breakdown of each evaluation and how we run them.

Artificial Analysis Intelligence Index by Open Weights / Proprietary

Artificial Analysis Intelligence Index v4.3.2 incorporates 10 evaluations: AA-Briefcase v1.1, GDPval-AA v2.1, AutomationBench-AA, Terminal-Bench 4.0, SciCode, Humanity's Last Exam, GDP.pdf, CritPt, AA-Omniscience, AA-LCR v1.1

No publicly available API

Artificial Analysis Intelligence Index v4.3.2 includes: AA-Briefcase v1.1, GDPval-AA v2.1, AutomationBench-AA, Terminal-Bench 4.0, SciCode, Humanity's Last Exam, GDP.pdf, CritPt, AA-Omniscience, AA-LCR v1.1 . See Intelligence Index methodology for further details, including a breakdown of each evaluation and how we run them.

Indicates whether the model weights are available. Models are labelled as 'Commercial Use Restricted' if commercial use is limited by conditions, and as 'Non-commercial' if the license prohibits commercial use.

Intelligence Index vs. Cost per Task

Artificial Analysis Intelligence Index · Weighted average cost (USD) per Artificial Analysis Intelligence Index task

Weighted average cost per Intelligence Index task. Each evaluation’s cost is calculated from input, cache hit, cache write, reasoning, and answer token prices, divided by task count, and weighted by its Intelligence Index weight.

Artificial Analysis Intelligence Index v4.3.2 includes: AA-Briefcase v1.1, GDPval-AA v2.1, AutomationBench-AA, Terminal-Bench 4.0, SciCode, Humanity's Last Exam, GDP.pdf, CritPt, AA-Omniscience, AA-LCR v1.1 . See Intelligence Index methodology for further details, including a breakdown of each evaluation and how we run them.

Capability Indexes

Measures the performance of models on specific capabilities and industries

No publicly available API

Evaluations

Evaluations measured independently by Artificial Analysis · AA-PersonalityBench scores are percentile ranks from 1 to 100

No publicly available API

GDP.pdf

Professional document reasoning, All-pass

Agentic scientific research workflows in a terminal

Agentic software engineering in open-source repositories

Legal agentic work, Hallucination-Gated All-Pass Rate

Agentic interactive 3D experiences, Elo

Medical long context reasoning

Rich, varied, well-crafted language

Well-structured, scannable, answer-first

Truthful, acknowledges uncertainty, non-sycophantic

Use of filler and generic language

While model intelligence generally translates across use cases, specific evaluations may be more relevant for certain use cases.

Artificial Analysis Intelligence Index v4.3.2 includes: AA-Briefcase v1.1, GDPval-AA v2.1, AutomationBench-AA, Terminal-Bench 4.0, SciCode, Humanity's Last Exam, GDP.pdf, CritPt, AA-Omniscience, AA-LCR v1.1 . See Intelligence Index methodology for further details, including a breakdown of each evaluation and how we run them.

AA-Briefcase v1.1

AA-Briefcase Elo

AA-Briefcase v1.1 is an agentic knowledge work benchmark developed by Artificial Analysis. AA-Briefcase Elo is a combined metric that aggregates rubric pass rate, analytical quality Elo and presentation Elo · Higher is better

No publicly available API

AA-Briefcase Elo is a combined metric that aggregates analytical quality Elo, presentation Elo, and rubric pass rate, with rubric performance converted into Elo via synthetic head-to-head matches. Elo and 95% confidence interval bounds are clamped at 0.

AA-Omniscience

AA-Omniscience Index

AA-Omniscience Index (higher is better) measures knowledge reliability and hallucination. It rewards correct answers, penalizes hallucinations, and has no penalty for refusing to answer. Scores range from -100 to 100, where 0 means as many correct as incorrect answers, and negative scores mean more incorrect than correct.

No publicly available API

AA-Omniscience Index (higher is better) measures knowledge reliability and hallucination. It rewards correct answers, penalizes hallucinations, and has no penalty for refusing to answer. Scores range from -100 to 100, where 0 means as many correct as incorrect answers, and negative scores mean more incorrect than correct.

Intelligence Index Comparisons

Intelligence Index vs. Cost per Task

Artificial Analysis Intelligence Index · Weighted average cost (USD) per Artificial Analysis Intelligence Index task

Weighted average cost per Intelligence Index task. Each evaluation’s cost is calculated from input, cache hit, cache write, reasoning, and answer token prices, divided by task count, and weighted by its Intelligence Index weight.

Artificial Analysis Intelligence Index v4.3.2 includes: AA-Briefcase v1.1, GDPval-AA v2.1, AutomationBench-AA, Terminal-Bench 4.0, SciCode, Humanity's Last Exam, GDP.pdf, CritPt, AA-Omniscience, AA-LCR v1.1 . See Intelligence Index methodology for further details, including a breakdown of each evaluation and how we run them.

Token Use

Output Tokens per Intelligence Index Task

Weighted average number of output tokens used to run one task in the Artificial Analysis Intelligence Index

No publicly available API

The number of tokens required per Intelligence Index task. This is calculated by multiplying the output tokens per eval by the relative weights of each benchmark in the Intelligence Index, then dividing by task count (excluding repeats).

Cost

Cost per Intelligence Index Task

Weighted average cost (USD) per Intelligence Index task · Segmented by token type · Lower is better

Weighted average cost per Intelligence Index task. Each evaluation’s cost is calculated from input, cache hit, cache write, reasoning, and answer token prices, divided by task count, and weighted by its Intelligence Index weight.

Cost to Run Artificial Analysis Intelligence Index

Cost (USD) to run all evaluations in the Artificial Analysis Intelligence Index

The cost to run the evaluations in the Artificial Analysis Intelligence Index, calculated using the model's input, cache hit, cache write, reasoning, and answer token prices and the number of tokens used across evaluations (excluding repeats).

Pricing: Cache Hit, Input, and Output

Price (USD per M Tokens)

Price per token for cached prompts (previously processed), typically offering a significant discount compared to regular input price, represented as USD per million tokens. The values shown here are the cache hit price; cache write and cache storage are billed separately and vary by provider — see "Cache pricing by provider" for detail.

Context Window

Context window: tokens limit · Higher is better

No publicly available API

Larger context windows are relevant to RAG (Retrieval Augmented Generation) LLM workflows which typically involve reasoning and information retrieval of large amounts of data.

Maximum number of combined input & output tokens. Output tokens commonly have a significantly lower limit (varied by model).

Speed

Measured by Output Speed (tokens per second)

Output Speed

Output tokens per second · Higher is better

Tokens per second received while the model is generating tokens (ie. after first chunk has been received from the API for models which support streaming).

Figures represent performance of the model's first-party API or the median across providers where a first-party API is not available.

Time per Intelligence Index Task

Weighted average decode time (minutes) per Intelligence Index task · Excludes TTFT and overhead time · Lower is better

The weighted average time (seconds) per Artificial Analysis Intelligence Index task. This is calculated by dividing output tokens per task by output speed, weighted by the relative weights of each benchmark in the Intelligence Index.

Latency

Measured by Time (seconds) to First Token

Latency: Time To First Answer Token

Seconds to first answer token received · Accounts for reasoning model 'thinking' time

Time to first answer token received, in seconds, after API request sent. For reasoning models, this includes the 'thinking' time of the model before providing an answer. For models which do not support streaming, this represents time to receive the completion.

End-to-End Response Time

Seconds to output 500 tokens, calculated based on time to first token, 'thinking' time for reasoning models, and output speed

End-to-End Response Time

Seconds to output 500 tokens, including reasoning model 'thinking' time · Lower is better

Seconds to receive a 500 token response. Key components:

Input time: Time to receive the first response token
Thinking time (only for reasoning models): Time reasoning models spend outputting tokens to reason prior to providing an answer. Amount of tokens based on the average reasoning tokens across a diverse set of 60 prompts ( methodology details ).
Answer time: Time to generate 500 output tokens, based on output speed

Figures represent performance of the model's first-party API or the median across providers where a first-party API is not available.

Two States Can Now Restrict Social Media Access—Here’s What To Do Next

Electronic Frontier Foundation

www.eff.org

2026-10-23 14:19:34

Last week, two federal appeals courts issued opinions that will allow Florida and Georgia to start enforcing laws that will age-gate and block young people from accessing social media. The laws do not adequately respect minors’ rights to play, speak, and learn online. More fundamentally, these laws ...

Original Article

Last week, two federal appeals courts issued opinions that will allow Florida and Georgia to start enforcing laws that will age-gate and block young people from accessing social media. The laws do not adequately respect minors’ rights to play, speak, and learn online. More fundamentally, these laws don’t help young people stay safe online—a goal that lawmakers should pursue.

Age-Gated? Email EFF at agegates@eff.org .

Because of the new laws, some young people will lose their ability to access lawful information, find their online communities, and even engage with school board members. Others will need parental permission to stay online. And adults will face increased demands to prove their age, which will put their privacy at increased risk simply to continue to use the services they already use.

We opposed these laws because they threaten the free expression and privacy of both minors and adults. Even though these lawsuits are not over, the injunctions that paused enforcement have been lifted, and the states of Florida and Georgia will now be able to enforce broad restrictions on social media use.

The restrictions that these states will start enforcing are a setback for the rights of all internet users, but they are not written in stone. That’s why EFF is encouraging internet users - and particularly young people – to start keeping a record of how they are affected. If you are a teenager who loses access to an online discussion, can’t participate in a political campaign, or stop seeking information because you don’t want to upload personal information, document what happened. The same is true for adults who may be mistakenly blocked by age checks, and parents who may encounter obstacles to authorizing their children's use of online services. These experiences matter. They can help us show courts, policymakers, and the public what government restrictions on online expression actually cost the people who live under them.

Hopefully, with enough proof of the expressive harms these laws cause, we can push lawmakers to rescind them. That’s why we’re encouraging folks to reach out to EFF once they’ve documented these harms. You can write to us about this issue at the email address agegates@eff.org .

The Decisions

These two opinions, issued by the same panel from the U.S. Court of Appeals for the 11th Circuit, allow Florida and Georgia to enforce restrictions on social media accounts for people under 16 years old. The requirements differ by state.

In Florida , the judges allowed that state’s H.B. 3 to move forward, which requires covered platforms to ban anyone under 14 from opening or keeping accounts—even with parental permission. Teenagers who are 14 or 15 can have accounts only with parental consent. To be covered, a platform has to use algorithms, allow content uploads or the viewing of other peoples’ content, and have at least one feature on a list of features the state considers bad, including livestreaming, engagement metrics, autoplay, infinite scrolling, or push notifications. These requirements effectively apply to every major social media service that young people use.

To the extent there is a silver lining in the ruling on Florida’s law, it’s that the panel recognized that H.B. 3 targets expression protected by the First Amendment. The problem is that the ruling uncritically accepts the idea that a social media service is addictive in a clinical sense, even if just 10% of users under 16 are using the platform for two or more hours per day (the standard set in H.B. 3). The court simply accepts that time spent online is a proxy for harm. The bill doesn’t distinguish doomscrolling or compulsive use from organizing a campaign, making art, or talking with friends.

In Georgia , S.B. 351 can now be enforced. That law requires parental consent for anyone under 16 to hold an account on social media platforms. It also requires platforms to make “commercially reasonable efforts” to check users’ ages, which creates a hurdle for adults as well as under-16s.

The ruling acknowledges that S.B. 351 “overwhelmingly applies to platforms that overwhelmingly host protected speech.” But the ruling faults the plaintiffs for not being able to show that “invalid applications substantially outweigh the valid ones.” That asks the groups challenging the law to meet a virtually impossible standard—to make their case, they would have to measure and evaluate the content hosted by all online services affected by the law.

Both of these cases may be further appealed, and are likely to continue in the lower courts. But people in Georgia and Florida can no longer count on court injunctions to protect their access to the web. What the effects will be going forward depends on how platforms implement these new restrictions, including how they check ages and parental consent, as well as state officials’ views on these efforts.

If you hit an age-gate while online, check out our blog post about how you might want to proceed , and our age-gating resource hub . If you want to speak out about your experience, you can talk to us at agegates@eff.org.

What is Lost

Some youth who lose their social media accounts will lose contact with friends. Others will lose access to a support group, the ability to speak out on current issues, or an audience for their artwork. More young people will be shut out of discussions about what’s going on in their school and their community. U.S. law has long recognized that people under 18 have their own rights to speak and receive information. These new laws interfere with those rights.

The Florida opinion suggests that young people can browse the internet without an account, or use a parent’s account. But that doesn’t help those who might participate in a private group, send a personal message, or speak to an audience they have built up. Nor does it recognize the reality that in many households, young people may not have the ability to use a parent’s device, or even have healthy relationships with their parents. For parents of children under 14, the Florida law also overrides parental autonomy—even if parents wanted to allow their child on these services, they cannot do so by law.

These laws won’t just harm younger kids. Adults and older teens will bear the cost of the new rules. In order to figure out who is young enough to not be able to join, or who needs parental consent to join, services will have to check users’ ages. That likely means asking people to submit ID or other sensitive information. Some people will be mis-classified as too young; others will decide that they’d simply rather stop participating instead of handing over even more personal data.

Keep A Record

Between the recent Meta settlement and these 11th Circuit decisions, despite widespread opposition, age-gating is becoming a reality for the American internet. As these laws are enforced, we need to understand what they mean for the people who have to deal with them. And we need to create a record of their effects on everyone’s speech so we can push to repeal them.

If you encounter a restriction due to these laws that affects you, keep a record, ideally while the details are still fresh in your mind. Screenshots, along with notes about the date and time, the service involved, and the task you were trying to accomplish, will all be helpful.

Did you lose an account or can’t participate? Describe what you lost. Were you using a group to organize a club, volunteer in your community, or keep in touch with friends? Did losing your account cut you off from people you wouldn’t otherwise be able to be in touch with? Even if you just used the account to access local news or follow your favorite content creator, that’s still a significant loss of your right to access information online.

Record problems with age checks and parental consent. What information did the service request from you? Were you able to provide it? Did it reject your age proof, or classify you incorrectly? If you’re a parent, were you able to give permission, and what did you have to provide? What promises did the service make about what it did with the data it collected from you? Save explanations given by the platforms or any services they employ to age gate, including any law they cite. If you are to appeal a result and choose to, keep track of those attempts as well.

You can also document choosing to drop out. If you abandon an account or service because you’re unwilling to provide ID or other personal data, write down what you gave up, and why. You don’t need to submit sensitive information to show that you are burdened by new rules.

You Can E-Mail agegates@eff.org

If these restrictions affect you, we encourage you to reach out to EFF by emailing agegated@eff.org and telling us more about what happened.

EFF will continue to oppose laws that prevent adults and minors from expressing themselves online, or that push people to give up their privacy to participate in the digital world. These recent court decisions are setbacks, but they don’t settle the debate. By keeping track of people who lose access, age-check failures, and the online conversations that can no longer happen, we’ll be in a better position to challenge the worst of these restrictions, in both legislatures and courts.

And in the meantime, EFF will keep fighting for laws that actually make us safer online—like stopping social media companies’ harmful surveillance of all internet users. We’ll continue to push for laws that empower parents, children, and all internet users to have meaningful choice and control over their online services. Those goals can make everyone safer online, while preserving our ability to speak and access information.

Further Action

Email EFF about your experience at agegates@eff.org .

The Left Needs to Revisit Spirituality and History: Lessons from Walter Benjamin

OrganizingUp

convergencemag.com

2026-10-23 13:46:33

Featured image by Jared Rodriguez As the Left, epitomized by the Democratic Socialists of America, resurges and Marxist thought returns to the fore, as a real force, not simply as a bogeyman; as the Midterms loom and, through them, we get our first taste of the 2028 Presidential Election, I revisit ...

Original Article

I turned my TV into a Game Boy Color with a Pokemon town as my home screen

Hacker News

twitter.com

2026-10-23 13:40:22

Comments...

Original Article

Log in or sign up for X

See what’s happening and join the conversation

Continue with phone

or

Log in with username or email

Relevant people

Robbie Tilton @ robbietilton Follow

Designer/Founder. Reinventing the computer.

Trending now

Air Purifiers as White Noise Machines

Hacker News

www.jefftk.com

2026-10-23 13:28:36

Comments...

Original Article

White noise machines are widely used for sound masking, increasing privacy in offices and helping people sleep. The classic approach is a fan in a box, though in the past ten years people have mostly switched over to electronic ones. But a fan is really a great approach; you just need to put it to better use: have the fan clean the air.

Instead of spinning a fan in free air to make noise, you can have it pull air through a filter. A small purifier sounds a lot like a classic noise machine, is only a bit larger and more expensive, and removes smoke and infectious particles from the air. For example, here's a $47 purifier with a 6.5" diameter, cleaning 34 cubic feet of air per minute ("CADR") at 45dB. For most circumstances where someone would use a white noise machine, this kind of small purifier is all-around better.

Now, 34 CFM is not very much air cleaning. I usually run an AirFanta 3Pro and it cleans ~6x more air for the same amount of noise, or ~12x more air with much more noise (~56dB). On the other hand it's more expensive ($165) and bulkier (12.6" square), and arguably uglier.

Still, even a 34 CFM purifier helps a lot with smoke. If you have a 10ft square room with an 8ft ceiling and a reasonably typical 0.5 air changes per hour through leakage from outdoors, this small purifier will cut particulate levels to 16% of the outdoor level. In AQI terms (not linear) this is like going from AQI 200 to 72 or AQI 100 to 31.

Comment via: facebook , lesswrong , mastodon , bluesky

Next-Concept Modeling: Fast, Parallel Coarse-to-Fine Text Generation

Lobsters

arxiv.org

2026-10-23 13:25:34

Comments...

Original Article

View PDF HTML (experimental)

Abstract: Diffusion language models (DLMs) offer parallel sampling for faster generation than autoregressive models, an increasingly important advantage as inference becomes a dominant computational workload. However, DLMs degrade quickly with fewer sampling steps, process the full sequence at every step, and require many passes over the dataset to reach good quality. We introduce Next-Concept Modeling (NCM), a two-stage, coarse-to-fine framework: a multiscale residual VQ-VAE encodes text into a hierarchy of discrete codes, and a transformer generates one level at a time, predicting all codes within a level in parallel. At matched parameter scales, NCM achieves better generative perplexity than the strongest DLM baseline on LM1B while running $21\times$ faster. On OpenWebText, NCM is competitive with the strongest DLM while running $10\times$ faster; on XSum, it matches the strongest DLM's ROUGE-L while being $31\times$ faster. On the reasoning task of Sudoku, NCM outperforms autoregressive and diffusion baselines across all difficulty levels, using fewer function evaluations. On the reasoning task of Sudoku, NCM outperforms autoregressive and diffusion baselines across all difficulty levels, using fewer function evaluations.

Submission history

From: Hermann Kumbong [ view email ]
[v1] Fri, 9 Oct 2026 17:49:45 UTC (352 KB)

Decompiling Fast Food Tycoon 2

The Overworld

Lighting

The Cast

Inside a Branch

Interview With Michal Wallace

Pedagogy

Forth

Pascal

Webhosting

AI

Math

First

Second

Nim vs Rust: Language is a Matter of 'Coherence', Not 'Performance'

Five Qwen3.8-27B models match Fable 5 Using GVS5H Harness

GVS5H: Gorilla vs. 5 Humans

Results

Running the code

License

Xbox Turns Down Netflix $500M Offer

Meta employees say Lula’s accounts restricted in Brazil election: Report

Recommended Stories

Cerebras Deploys Trillion-Parameter AI Models

Breaking it down with Kimi K3

#1: Size of Each layer

#2: Number of Wafers

#3: Connecting the wafers together

#4: How we serve 1 request

#5: How we serve many requests

#6: How many requests can we serve?

How this scales beyond 3T parameters

MacOS Extensions pack for the Apple Network Server v1.0

More Than One Million Lula Supporters Rally

Nicole Nguyen’s Duo Review for the WSJ

Reuters and the WSJ on the Duo Launch

Profits Are Soaring. Workers’ Share of Income Is Sinking.

The Hidden Wedge

Labor and the AI Boom

Marion Barry Meets the iPhone Duo

How Do We Define Intelligence?

Early research and the influence of eugenics

Eugenics meets intelligence testing

Problems and limits of IQ testing

The damage done

More recent understanding of the nature of intelligence

What does this mean?

FindMyWeb: Apple Find My, reverse enginiered

Supported networks

Why

How

Setup

Web (Frontend+Backend)

FruityTag (Firmware)

Thanks

Scrawl: show an agent the problem

iPhone

Plug it into your Mac

Record inside your own app

How it works

Frames only when something happens

Each frame keeps its words

Cropped to where you worked

A closer look when it’s needed

Controls

Install

Why Gopher in 2026?

Google has officially turned these Nest thermostats back into dumb thermostats

America Has Lost 200k of Jobs in Media, Film and the Arts. How Much Is AI?

Discussion about this post

Ready for more?

SIMD and Go

What SIMD Actually Means

The SIMD Cycle: Load, Operate, Store

SIMD in Go: Two Packages

simd/archsimd: One Type per Register

simd: The Portable One

A Gallery of Common Operations

Broadcast: One Value Everywhere

Fused Multiply-Add: Two Operations in One