Please join me in congratulating the new CiviCRM Community Council. The council has 11 seats. Nine candidates each received endorsements from two community members. There were fewer candidates than seats, so all nine are elected by acclamation....
Please join me in congratulating the new CiviCRM Community Council. The council has 11 seats. Nine candidates each received endorsements from two community members. There were fewer candidates than seats, so all nine are elected by acclamation.
The
CiviCRM Community Council
is an elected advisory body. It brings together the community’s ideas and values, works with the Core Team on open decision-making, and keeps the CiviCRM community a safe place to collaborate.
Meet the Council members:
Nina Carstensen
I started using CiviCRM in 2017, when both the organisations, the one I was volunteering for and the one where I worked, introduced the software. I now work as a project lead for CiviCRM at a community foundation in Germany. I co-founded and help organise the monthly German-speaking CiviCRM meetup as well as the meetup for fundraisers using CiviCRM. Both meetups bring together users to learn and share their knowledge. Based on this background, I see myself primarily speaking for end users. On the Council, I would like to help more users become confident members of the community by learning how to find help, help others and being able to participate without coding skills.
Lesley Carter
I have used CiviCRM with our clients for fourteen years, helping them to utilize it to its fullest extent in support of their missions. The core principles underlying CiviCRM – data and system ownership, flexibility, development by a community rather than a for-profit corporation – are tremendously important to me and I hope to help the Civi team continue to build on them. As a system admin/user rather than a developer, I’ve found the Civi community to be welcoming and patient with questions – my goal is to expand that ambience for folks who are new to CiviCRM or still grappling with it and to find new and creative ways to make Civi even more accessible to a variety of users.
Don Hirst
I have supported CiviCRM users and websites since 2015. Along the way, I identified issues with the documentation and worked to improve it. When the Community Council was established, I volunteered to serve, focusing on documentation. Since then, I have worked with community contributors, partners, and Community Council and Core Team members to strengthen and expand the documentation suite.
Going forward, my focus remains on documentation. I support the use of the Diátaxis framework to help restructure existing documentation and guide the development of new content. Recent efforts to use AI tools to improve documentation and make it more accessible are valuable and should continue. CiviCRM is a world-class application. My goal is to help ensure that it is supported by world-class documentation.
Benedikt
Kaleß
I am Benedikt Kaleß and I will serve on the CiviCRM Community Council as a representative of a user organization.
In my professional capacity, I serve as Head of IT at Pro Peace. We use CiviCRM since 2009. From the very beginning, I am part of the CiviCRM community. I recall meetings in Berlin focused on establishing a German-speaking community or the discussions of funding the extension CiviSepa. In my role within the user organisation Pro Peace, I am also a board member at Software für Engagierte. I actively contributed to #CiviOneClick, which received funding from the Deutsche Stiftung für Engagement im Ehrenamt (DSEE). My goal is to strenghten the new concept of Regional Ambassadors envolving more end user organizations in CiviCRM community.
Rich Lott
I'm standing because I want CiviCRM to be a useful thing for organisations that are focussed on improving humanity. Our democracies are under threat; our climate is fast becoming un-live-able; our ability to communicate and organise is being co-opted by big tech.
I want to make sure that Civi's "do-ocracy" doesn't leave smaller organisations behind and I also want to help us remember not to sell out our ethics or community to big tech billionaires via AI.
I've been implementing, running, developing and supporting Civi for clients since 2010. I've been a partner for many years too. I'm a regular at UK/EU sprints and camps. I maintain over 30 extensions used by hundreds of orgs and contribute to many more. I have about 10 Civi clients ranging from tiny orgs to larger ones with ~1M contacts. I frequently contribute to core; I was key to bringing Standalone and RiverLea into being. I had 20 years' experience as a senior manager and co-director of a small UK NGO before going full time on my freelance business called
Artful Robot
.
Bashar Makhay
I'm Bashar Makhay, Senior Communications & Technology Officer at the NYC Preparedness & Recovery Institute, where I implement and manage CiviCRM. I’ve also managed CiviCRM for Columbia University’s Office of Government and Community Affairs, Columbia Community Service, and Tarab NYC. My experience is primarily as an implementer, administrator, and organizational decision-maker rather than a developer. CiviCRM is an incredibly powerful platform, but we don’t always communicate its value effectively, particularly beyond the existing community. Drawing on my background in communications and community organizing, I want to make CiviCRM more accessible, approachable, and appealing to organizations considering adopting it. On the Council, I hope to amplify non-technical voices while advocating for better user experiences, stronger marketing, and more accessible resources. Cheers!
Joe Murray
I've been in providing CiviCRM services through
JMA Consulting
since 2005. Over the years I provided significant early funding, specifications, developer resources and/or leadership to lots of community initiatives. While serving on the Community Council, I’ve helped with policy development and compliance on things like CiviCRM trademark and brand, use of the blog, and using AI when contributing to CiviCRM. I hope the Community Council continues to contribute to healthy ecosystem governance and the growth of the project. I have a particular interest in the product roadmap, especially making the system easier for non-technical nonprofit staff to use. JMA will continue funding user experience research in this area and working with the core team and others, initially to create a simpler FormBuilder UI.
Neil Planchon
I've been using and championing CiviCRM since 2008, all pro bono, as an end user rather than a developer or implementer. My background spans 25 years in the cohousing and intentional communities movement, Sociocracy and shared governance, and nearly 30 years in nonprofit technology, including organizing with NTEN Oakland.
I've led two West Coast CiviCamps, volunteered at several CiviCons, and recently helped Sociocracy For All and the Cohousing Research Network put CiviCRM to work. Much of my ambassador work is introducing CiviCRM to organizations that could benefit from it and helping newcomers find their way into the community, and I enjoy helping different voices find common ground.
Returning to the Council, I look forward to finishing a confidential way to raise concerns, regular Council updates, and AI guidelines for the project, and to supporting the Core Team and welcoming our new members.
Peter Reck
I actively managed the introduction and implementation of CiviCRM four years ago to help digitize the processes of Stiftung Pfadfinden, a volunteer-run foundation in Germany. I have invested significant time building automations with Form Processor and Search Action Designer to make CiviCRM as simple and accessible as possible for our volunteers. In my professional life, I work as a Project Manager, bringing experience in stakeholder management, governance, and finding common ground between different perspectives. As a Community Council member, I would like to strengthen the voice of small NGOs, end users, and administrators, ensuring that community decisions reflect the practical needs of organizations that rely on CiviCRM every day and encourage more people to actively contribute to the community.
AI Skeptics: The AI Wuhan Moment (with Tom Adams)
Math Babe
mathbabe.org
2026-11-02 10:37:07
Shit is getting real, people: Apple Spotify YouTube...
We've been tracking various metrics each month for over a year now in lieu of producing a big annual report. The latest, for October, is now live at https://civicrm.com/about
At this point, we have a number of trends that we can confidently point to (because the methodology of collecting them has...
We've been tracking various metrics each month for over a year now in lieu of producing a big annual report. The latest, for October, is now live at
https://civicrm.com/about
At this point, we have a number of trends that we can confidently point to (because the methodology of collecting them has been consistent), even if the numbers behind them are debatable (speaking of the stats, for example).
For those that don't want to read the entire report, here are the highlights.
Key takeaways
As an ecosystem, CiviCRM is growing. Installation growth, based on anonymous pingbacks, is up 104% YoY, Spark growth is up 30% YoY, and partner, contributor and member growth is slowly inching up.
Combined website traffic across civicrm.com, civicrm.org and docs.civicrm.org are is down almost 7% after having been rising consistently through the first half of 2026. This is likely due to the impacts of AI-based search. In fact, CiviCRM's own AI assistant "Doc Bot" is seeing increased usage.
Financially, we're at breakeven for the past rolling 12 months due to 1) strong earned and subscription income (accounts for over 43% of budget) and 2) stronger than expected event income (accounts for 13.5% of budget). Community funding remains consistent but flat. We expect to close out the year at a loss.
The largest expenses for CiviCRM at present are labor and events, coming in at 76% and 14% of budget, respectively. We expect labor to increase in the coming months and into next year as we press forward with various intiatitives.
We're coming up on 4 years of climate action with Ecologi:
https://ecologi.com/civicrm
It's a small amount each month that reflects a large impact over time.
Improvements to the monthly report
Improve the expense breakdown to be more meaningful
Researchers identified age-associated differences in tumor composition and gene activity, creating a foundation for investigating why colorectal cancer can be more aggressive in younger adults
Dana-Farber Cancer Institute researchers, along with Mass General Brigham researchers from the Gene Lay Institute of Immunology and Inflammation, and the Broad Institute, have uncovered biological clues to why colorectal cancer can behave more aggressively in younger people. Published today in
Nature Medicine
, the study — the largest of its kind — lays a foundation for understanding age-associated differences in colorectal cancer and exploring future treatments.
In the United States, colorectal cancer diagnosis rates among people younger than 50 rose 2.9% per year from 2013 through 2022, according to the
American Cancer Society
. Its 2026 report identifies colorectal cancer as the leading cause of cancer death in this age group. Younger patients are also more likely to be diagnosed at advanced stages, underscoring the need to better understand the biology of early-onset disease.
"Through Dana-Farber’s Young-Onset Colorectal Cancer Center, we see how profoundly this disease can affect younger patients and their families, often during the busiest and most formative years of life," said co-senior author
Kimmie Ng, MD, MPH
, who is the director of the
Young-Onset Colorectal Cancer Center at Dana-Farber
. "This collaborative work with Mass General Brigham researchers from the Gene Lay Institute and researchers from the Broad Institute gives us important new insight into the biology of these tumors. The findings provide a valuable roadmap for further investigating the distinct features of young-onset colorectal cancer. Our ultimate goal is to discover novel strategies for prevention, diagnosis, and treatment for our young patients."
"The need to understand why colorectal cancer is affecting younger adults at increasing rates is urgent," said co-senior author Ana C. Anderson, PhD, a core faculty member of the Gene Lay Institute of Immunology and Inflammation at Brigham and Women’s Hospital, Massachusetts General Hospital, and Harvard Medical School. "And that starts with understanding the biology of the disease across the entire lifespan. By looking beyond conventional age cutoffs, we’ve uncovered biological patterns that earlier studies may have missed and created a foundation for the field to investigate them further. While we’re still at the beginning of understanding what these differences mean, our work gives researchers a new direction to pursue in tackling this urgent problem in human disease."
The research team, led by first author Caroline Porter, PhD, of the Klarman Cell Observatory at the Broad Institute, studied specimens from surgeries stored in Dana-Farber’s Gastrointestinal Biobank from surgeries at Brigham and Women’s Hospital. Co-senior authors include Anderson, Ng, and Ramnik J. Xavier, MD, PhD, of the Broad Institute, Mass General Brigham, and the Gene Lay Institute. They analyzed 189 tumors from patients ages 29 to 90+, including 54 diagnosed before age 50, and 135 diagnosed at age 50 or older. Using a technique called single-nucleus RNA sequencing, the researchers measured gene activity in more than 850,000 cancer cells and other cells in the tumors. The technique, which works with frozen tissue, enabled the team to build a detailed map of tumor cells by studying archived samples with extensive clinical record data.
Rather than dividing the tumor samples into two data sets and comparing the younger and older age groups, the researchers looked for factors that changed gradually with age, accounting for tumor location, stage, sex, and prior treatment in their analyses. This approach revealed subtle differences that likely would have been obscured by a simple two-data set comparison.
Among tumors of the most common colorectal cancer subtype, younger patients’ tumors had a significantly higher proportion of connective and supporting cells relative to cancer cells. A higher proportion of connective and supporting cells has been linked to chemotherapy resistance in several types of solid cancer. The team confirmed this pattern using gene-activity data from 564 other tumors and computer analysis of stained tissue images from another 712 tumors.
Younger patients also had higher activity of long non-coding RNAs, molecules that can regulate genes without making proteins. Some appeared repeatedly across different types of cancer cells. Many are "dark" RNAs, whose functions remain largely unknown. The team also saw gene activity suggesting stronger signaling between cells that can help cancer cells move and invade nearby tissue in younger patients.
"Our study is an advance from previous work in that we analyzed tumors from a large number of patients and used single-cell approaches to find novel features unique to tumors from young patients," said Xavier, a co-senior author of the study, a core institute member at the Broad Institute, Kurt Isselbacher Professor at Massachusetts General Hospital and Harvard Medical School, and Vice Director of the Gene Lay Institute. Xavier is also a gastroenterologist at Mass General Brigham. "This work sets the stage for future mechanistic studies on how these cell programs interact with chemicals from the diet and from gut microbes to cause early-onset colorectal cancer."
Although the findings provide key insight into colorectal cancer in young individuals, they do not yet provide proof that these differences cause more aggressive disease. One remaining question is whether there are differences in immune responses in these tumors across ages — the researchers' methods captured relatively few immune cells. Future studies will explore how these changes may affect cancer growth and spread, and whether they offer opportunities for prevention or treatment.
Authorship:
Authors include Caroline B. M. Porter, Shane P. Murphy, Jules Cazaubiel, Toni M. Delorey, Liat Amir-Zilberstein, Orr Ashenberg, Liubou Klindziuk, Elizabeth Andrews, William Tan, Kosuke Matsuda, Atsushi Kondo, Satoko Ugai, Tomotaka Ugai, Shuji Ogino, Emily Finan, Jacques Deguine, Ewa Sicinska, Lauren K. Brais, Jennifer S. Thalappillil, Marios Giannakis, Ramnik J. Xavier, Ana C. Anderson and Kimmie Ng.
Disclosures:
Anderson is a member of the scientific advisory boards for Compass Therapeutics, Zumutor Biologics and Cytospire; these interests were reviewed and managed by Brigham and Women’s Hospital and Mass General Brigham in accordance with their conflict-of-interest policies. Ogino has served as a consultant for Sanofi Pasteur. Xavier is a co-founder of Convergence Bio, a scientific advisory board member at Nestlé and Magnet BioMedicine, and a board director at MoonLake Immunotherapeutics; these organizations had no role in the study. Deguine is a member of BioRender’s scientific advisory board. Giannakis receives institutional research funding from Janssen and Sunbird Bio, has consulted for Nerviano Medical Sciences, and has received honoraria from OncLive and PER. Ng consults for or serves on advisory boards for Bayer, Pfizer, CytomX, Jazz Pharmaceuticals, Revolution Medicines, Agenus, Johnson & Johnson, AbbVie, Sanofi, GlaxoSmithKline, Flagship Pioneering, AstraZeneca, Amgen, CRICO and Manta Cares; receives institutional research funding from Pharmavite and Janssen; and serves as an Associate Editor at JAMA. Her interests were reviewed and managed by Dana-Farber Cancer Institute in accordance with its conflict-of-interest policies.
Funding:
This study was funded in part by the Gene Lay Institute of Immunology and Inflammation, Helen Gurley Brown Foundation/Dana-Farber Cancer Institute, Project P Fund, Patrick Beauregard Fund, Poorvu-Jaffe Fund for Young-Onset Colorectal Cancer Research, The Thau Fund, the Eigner Fund for Young-Onset Colorectal Cancer, the Klarman Cell Observatory at Broad Institute, National Institutes of Health (R01 CA205406, P30 DK043351, R01 CA285851, P01 CA87969, UM1 CA186107, P01 CA55075, UM1 CA167552, U01 CA167552, R01 CA151993, R35 CA197735), and the American Cancer Society Clinical Research Professor Award (CRP-24-1185864-01-PROF).
I’ve had a little time off of work as of late, and been spending it in characteristically unwise ways. In particular, I’ve written a
little programming language that compiles to SQL
. I call it
catlang
. That’s not to say that I’ve written a new query language. It’s a programming language, whose compiler spits out one giant
SELECT
statement. When you run that query in postgres, you get the output of your program.
Why have I done this? Because I needed a funny compilation target to test out the actual features of the language, which is that its intermediary language is a bunch of abstract category theory nonsense. Which I’ll get to. But I’m sure you first want to see this bad boy in action.
Behold, the function that returns 100 regardless of what input you give it. But it does it with the equivalent of a while loop:
count :Int->Intcount = x -> loop x i -> n <- join idid-< i z <-abs. (-) -< (n, 100)case z of inl _ -> inr . (+) -< (n, 1) inr _ -> inl -< n
If you’re familiar with
arrow notation
, you’ll notice the above looks kinda like one big
proc
block. This is not a coincidence (because nothing is a coincidence). I figured if I were to go through all of this work, we might as well get a working arrow desugarer out of the mix. But I digress; that’s a story for another time.
Anyway, what’s going on here is we have an arrow
count
, which takes a single argument
x
. We then loop, starting from the value of
x
. Inside the loop, we now have a new variable
i
, which we do some voodoo on to compute
n
—the current value of the loop variable. Then we subtract 100 from
n
, and take the absolute value. The
abs
function here is a bit odd; it returns
Left (abs x)
if the input was negative, and
Right x
otherwise. Then we branch on the output of
abs
, where
Left
and
Right
have been renamed
inl
and
inr
respectively. If
n - 100
was less than zero, we find ourselves in the
inl
case, where we add 1 to
n
and wrap the whole thing in
inr
—which the loop interprets as “loop again with this new value.” Otherwise,
n - 100
was non-negative, and so we can return
n
directly.
Is it roundabout? You bet! The obtuseness here is not directly a feature, I was just looking for conceptually simple things I could do which would be easy to desugar into category-theoretical stuff. Which brings us to the intermediary language. After desugaring the source syntax for
count
above, we’re left with this IL representation:
We’ll discuss all of this momentarily, but for now, just let your eyes glaze over the pretty unicode.
The underlying idea here is that each of these remaining symbols has very simple and specific algebraic semantics. For example,
A ⨟ B
means “do
A
and pipe the result into
B
.” By giving a transformation from this categorical IL into other domains, it becomes trivial to compile catlang to all sorts of weird compilation targets. Like SQL.
You’re probably wondering what the generated SQL looks like. Take a peek if you dare.
Ungodly Compiled SQL
SELECTf0 AS f0FROM(SELECT f0 AS f0, f1 AS f1FROM (SELECT*FROM (WITH t0 AS (SELECT*FROM (WITH RECURSIVE recursion AS (SELECT clock_timestamp() as step , *FROM (WITH t1 AS (SELECT*FROM (SELECT f0 AS f0, f1 AS f1, NULL::integerAS f2, NULL::integerAS f3FROM (WITH t2 AS (SELECT*FROM (SELECT0as f0) AS _)SELECT*FROM (SELECT*FROM (SELECT f0 AS f0 FROM t2 AS _) AS _CROSSJOIN (SELECT f0 AS f1 FROM t2 AS _))AS _)AS _)AS _)SELECT*FROM (WITH t3 AS (SELECT*FROM (-- undistSELECT*FROM (SELECT f0 AS f0, NULL::integerAS f1, f1 AS f2FROM (-- undist1SELECT*FROM t1 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECTNULL::integerAS f0, f2 AS f1, f3 AS f2FROM (-- dist2SELECT*FROM t1 AS _ WHERE"f2"ISNOTNULL)AS _)AS _)AS _)SELECT*FROM (WITH t4 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0, f1 AS f1FROM (WITH t5 AS (SELECT*FROM t3 AS _)SELECT*FROM (WITH t6 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0FROM (WITH t7 AS (SELECT*FROM (SELECT f0 AS f0, f1 AS f1 FROM t5 AS _) AS _)SELECT*FROM (SELECT*FROM (SELECT f0 AS f0FROM (-- join1SELECT*FROM t7 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECT f1 AS f0FROM (-- join2SELECT*FROM t7 AS _ WHERE"f1"ISNOTNULL)AS _)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f1, f1 AS f2, f2 AS f3 FROM t5 AS _))AS _)SELECT*FROM (WITH t8 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0, f1 AS f1FROM (WITH t9 AS (SELECT*FROM (SELECT f0 - f1 AS f0FROM (WITH t10 AS (SELECT*FROM t6 AS _)SELECT*FROM (SELECT*FROM (SELECT f0 AS f0 FROM (SELECT f0 AS f0 FROM t10 AS _) AS _)AS _CROSSJOIN (SELECT f0 AS f1 FROM (SELECT100as f0 FROM t10 AS _) AS _))AS _)AS _)AS _)SELECT*FROM (SELECT*FROM (SELECTabs(f0) as f0, NULL::integeras f1FROM t9AS _WHERE f0 <0)AS _UNIONSELECT*FROM (SELECTNULL::integeras f0, f0 as f1 FROM t9 AS _ WHERE f0 >=0)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f2, f1 AS f3, f2 AS f4, f3 AS f5 FROM t6 AS _))AS _)SELECT*FROM (WITH t11 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0, f1 AS f1FROM (SELECT f0 AS f0, f1 AS f1 FROM t8 AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f2, f1 AS f3, f2 AS f4, f3 AS f5, f4 AS f6, f5 AS f7FROM t8AS _))AS _)SELECT*FROM (WITH t12 AS (SELECT*FROM (-- distSELECT*FROM (SELECT f0 AS f0, f2 AS f1, NULL::integerAS f10, NULL::integerAS f11, NULL::integerAS f12, NULL::integerAS f13, f3 AS f2, f4 AS f3, f5 AS f4, f6 AS f5, f7 AS f6, NULL::integerAS f7, NULL::integerAS f8, NULL::integerAS f9FROM (-- dist1SELECT*FROM t11 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECTNULL::integerAS f0, NULL::integerAS f1, f4 AS f10, f5 AS f11, f6 AS f12, f7 AS f13, NULL::integerAS f2, NULL::integerAS f3, NULL::integerAS f4, NULL::integerAS f5, NULL::integerAS f6, f1 AS f7, f2 AS f8, f3 AS f9FROM (-- dist2SELECT*FROM t11 AS _ WHERE"f1"ISNOTNULL)AS _)AS _)AS _)SELECT*FROM (SELECT*FROM (SELECTNULL::integerAS f0, f0 AS f1FROM (SELECT f0 + f1 AS f0FROM (WITH t13 AS (SELECT*FROM (SELECT f0 AS f0, f1 AS f1, f2 AS f2, f3 AS f3, f4 AS f4, f5 AS f5, f6 AS f6FROM (-- join1SELECT*FROM t12 AS _WHERE ("f0"ISNOTNULL) AND ((("f1"ISNOTNULL) OR ("f2"ISNOTNULL)) AND (("f3"ISNOTNULL) AND ((("f4"ISNOTNULL) OR ("f5"ISNOTNULL)) AND ("f6"ISNOTNULL)))))AS _)AS _)SELECT*FROM (SELECT*FROM (SELECT f0 AS f0FROM (SELECT f0 AS f0FROM (SELECT f2 AS f0, f3 AS f1, f4 AS f2, f5 AS f3FROM (SELECT f1 AS f0, f2 AS f1, f3 AS f2, f4 AS f3, f5 AS f4, f6 AS f5FROM t13AS _)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f1 FROM (SELECT1as f0 FROM t13 AS _) AS _))AS _)AS _)AS _)AS _UNIONSELECT*FROM (SELECT f0 AS f0, NULL::integerAS f1FROM (SELECT f0 AS f0FROM (SELECT f2 AS f0, f3 AS f1, f4 AS f2, f5 AS f3FROM (SELECT f1 AS f0, f2 AS f1, f3 AS f2, f4 AS f3, f5 AS f4, f6 AS f5FROM (SELECT f7 AS f0, f8 AS f1, f9 AS f2, f10 AS f3, f11 AS f4, f12 AS f5, f13 AS f6FROM (-- join2SELECT*FROM t12 AS _WHERE ("f7"ISNOTNULL) AND ((("f8"ISNOTNULL) OR ("f9"ISNOTNULL)) AND (("f10"ISNOTNULL) AND ((("f11"ISNOTNULL) OR ("f12"ISNOTNULL)) AND ("f13"ISNOTNULL)))))AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f2 FROM (SELECT f2 AS f0 FROM t3 AS _) AS _))AS _)SELECT*FROM (-- distSELECT*FROM (SELECT f0 AS f0, f2 AS f1, NULL::integerAS f2, NULL::integerAS f3FROM (-- dist1SELECT*FROM t4 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECTNULL::integerAS f0, NULL::integerAS f1, f1 AS f2, f2 AS f3FROM (-- dist2SELECT*FROM t4 AS _ WHERE"f1"ISNOTNULL)AS _)AS _)AS _)AS _)AS _)AS _UNIONALLSELECT clock_timestamp() as step , *FROM (SELECT*FROM (WITH t14 AS (SELECT*FROM recursion AS _)SELECT*FROM (WITH t15 AS (SELECT*FROM (-- undistSELECT*FROM (SELECT f0 AS f0, NULL::integerAS f1, f1 AS f2FROM (-- undist1SELECT*FROM t14 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECTNULL::integerAS f0, f2 AS f1, f3 AS f2FROM (-- dist2SELECT*FROM t14 AS _ WHERE"f2"ISNOTNULL)AS _)AS _)AS _)SELECT*FROM (WITH t16 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0, f1 AS f1FROM (WITH t17 AS (SELECT*FROM t15 AS _)SELECT*FROM (WITH t18 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0FROM (WITH t19 AS (SELECT*FROM (SELECT f0 AS f0, f1 AS f1 FROM t17 AS _) AS _)SELECT*FROM (SELECT*FROM (SELECT f0 AS f0FROM (-- join1SELECT*FROM t19 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECT f1 AS f0FROM (-- join2SELECT*FROM t19 AS _ WHERE"f1"ISNOTNULL)AS _)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f1, f1 AS f2, f2 AS f3 FROM t17 AS _))AS _)SELECT*FROM (WITH t20 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0, f1 AS f1FROM (WITH t21 AS (SELECT*FROM (SELECT f0 - f1 AS f0FROM (WITH t22 AS (SELECT*FROM t18 AS _)SELECT*FROM (SELECT*FROM (SELECT f0 AS f0 FROM (SELECT f0 AS f0 FROM t22 AS _) AS _)AS _CROSSJOIN (SELECT f0 AS f1 FROM (SELECT100as f0 FROM t22 AS _) AS _))AS _)AS _)AS _)SELECT*FROM (SELECT*FROM (SELECTabs(f0) as f0, NULL::integeras f1FROM t21AS _WHERE f0 <0)AS _UNIONSELECT*FROM (SELECTNULL::integeras f0, f0 as f1 FROM t21 AS _ WHERE f0 >=0)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f2, f1 AS f3, f2 AS f4, f3 AS f5 FROM t18 AS _))AS _)SELECT*FROM (WITH t23 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0, f1 AS f1FROM (SELECT f0 AS f0, f1 AS f1 FROM t20 AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f2, f1 AS f3, f2 AS f4, f3 AS f5, f4 AS f6, f5 AS f7FROM t20AS _))AS _)SELECT*FROM (WITH t24 AS (SELECT*FROM (-- distSELECT*FROM (SELECT f0 AS f0, f2 AS f1, NULL::integerAS f10, NULL::integerAS f11, NULL::integerAS f12, NULL::integerAS f13, f3 AS f2, f4 AS f3, f5 AS f4, f6 AS f5, f7 AS f6, NULL::integerAS f7, NULL::integerAS f8, NULL::integerAS f9FROM (-- dist1SELECT*FROM t23 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECTNULL::integerAS f0, NULL::integerAS f1, f4 AS f10, f5 AS f11, f6 AS f12, f7 AS f13, NULL::integerAS f2, NULL::integerAS f3, NULL::integerAS f4, NULL::integerAS f5, NULL::integerAS f6, f1 AS f7, f2 AS f8, f3 AS f9FROM (-- dist2SELECT*FROM t23 AS _ WHERE"f1"ISNOTNULL)AS _)AS _)AS _)SELECT*FROM (SELECT*FROM (SELECTNULL::integerAS f0, f0 AS f1FROM (SELECT f0 + f1 AS f0FROM (WITH t25 AS (SELECT*FROM (SELECT f0 AS f0, f1 AS f1, f2 AS f2, f3 AS f3, f4 AS f4, f5 AS f5, f6 AS f6FROM (-- join1SELECT*FROM t24 AS _WHERE ("f0"ISNOTNULL) AND ((("f1"ISNOTNULL) OR ("f2"ISNOTNULL)) AND (("f3"ISNOTNULL) AND ((("f4"ISNOTNULL) OR ("f5"ISNOTNULL)) AND ("f6"ISNOTNULL)))))AS _)AS _)SELECT*FROM (SELECT*FROM (SELECT f0 AS f0FROM (SELECT f0 AS f0FROM (SELECT f2 AS f0, f3 AS f1, f4 AS f2, f5 AS f3FROM (SELECT f1 AS f0, f2 AS f1, f3 AS f2, f4 AS f3, f5 AS f4, f6 AS f5FROM t25AS _)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f1 FROM (SELECT1as f0 FROM t25 AS _) AS _))AS _)AS _)AS _)AS _UNIONSELECT*FROM (SELECT f0 AS f0, NULL::integerAS f1FROM (SELECT f0 AS f0FROM (SELECT f2 AS f0, f3 AS f1, f4 AS f2, f5 AS f3FROM (SELECT f1 AS f0, f2 AS f1, f3 AS f2, f4 AS f3, f5 AS f4, f6 AS f5FROM (SELECT f7 AS f0, f8 AS f1, f9 AS f2, f10 AS f3, f11 AS f4, f12 AS f5, f13 AS f6FROM (-- join2SELECT*FROM t24 AS _WHERE ("f7"ISNOTNULL) AND ((("f8"ISNOTNULL) OR ("f9"ISNOTNULL)) AND (("f10"ISNOTNULL) AND ((("f11"ISNOTNULL) OR ("f12"ISNOTNULL)) AND ("f13"ISNOTNULL)))))AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f2 FROM (SELECT f2 AS f0 FROM t15 AS _) AS _))AS _)SELECT*FROM (-- distSELECT*FROM (SELECT f0 AS f0, f2 AS f1, NULL::integerAS f2, NULL::integerAS f3FROM (-- dist1SELECT*FROM t16 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECTNULL::integerAS f0, NULL::integerAS f1, f1 AS f2, f2 AS f3FROM (-- dist2SELECT*FROM t16 AS _ WHERE"f1"ISNOTNULL)AS _)AS _)AS _)AS _)AS _)AS _WHERE ("f2"ISNOTNULL) AND ("f3"ISNOTNULL))AS _)SELECT*FROM recursion ORDERBY step DESCLIMIT1)AS _)SELECT*FROM (WITH t26 AS (SELECT*FROM (-- undistSELECT*FROM (SELECT f0 AS f0, NULL::integerAS f1, f1 AS f2FROM (-- undist1SELECT*FROM t0 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECTNULL::integerAS f0, f2 AS f1, f3 AS f2FROM (-- dist2SELECT*FROM t0 AS _ WHERE"f2"ISNOTNULL)AS _)AS _)AS _)SELECT*FROM (WITH t27 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0, f1 AS f1FROM (WITH t28 AS (SELECT*FROM t26 AS _)SELECT*FROM (WITH t29 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0FROM (WITH t30 AS (SELECT*FROM (SELECT f0 AS f0, f1 AS f1 FROM t28 AS _) AS _)SELECT*FROM (SELECT*FROM (SELECT f0 AS f0FROM (-- join1SELECT*FROM t30 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECT f1 AS f0FROM (-- join2SELECT*FROM t30 AS _ WHERE"f1"ISNOTNULL)AS _)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f1, f1 AS f2, f2 AS f3 FROM t28 AS _))AS _)SELECT*FROM (WITH t31 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0, f1 AS f1FROM (WITH t32 AS (SELECT*FROM (SELECT f0 - f1 AS f0FROM (WITH t33 AS (SELECT*FROM t29 AS _)SELECT*FROM (SELECT*FROM (SELECT f0 AS f0 FROM (SELECT f0 AS f0 FROM t33 AS _) AS _)AS _CROSSJOIN (SELECT f0 AS f1 FROM (SELECT100as f0 FROM t33 AS _) AS _))AS _)AS _)AS _)SELECT*FROM (SELECT*FROM (SELECTabs(f0) as f0, NULL::integeras f1FROM t32AS _WHERE f0 <0)AS _UNIONSELECT*FROM (SELECTNULL::integeras f0, f0 as f1 FROM t32 AS _ WHERE f0 >=0)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f2, f1 AS f3, f2 AS f4, f3 AS f5 FROM t29 AS _))AS _)SELECT*FROM (WITH t34 AS (SELECT*FROM (SELECT*FROM (SELECT f0 AS f0, f1 AS f1FROM (SELECT f0 AS f0, f1 AS f1 FROM t31 AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f2, f1 AS f3, f2 AS f4, f3 AS f5, f4 AS f6, f5 AS f7FROM t31AS _))AS _)SELECT*FROM (WITH t35 AS (SELECT*FROM (-- distSELECT*FROM (SELECT f0 AS f0, f2 AS f1, NULL::integerAS f10, NULL::integerAS f11, NULL::integerAS f12, NULL::integerAS f13, f3 AS f2, f4 AS f3, f5 AS f4, f6 AS f5, f7 AS f6, NULL::integerAS f7, NULL::integerAS f8, NULL::integerAS f9FROM (-- dist1SELECT*FROM t34 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECTNULL::integerAS f0, NULL::integerAS f1, f4 AS f10, f5 AS f11, f6 AS f12, f7 AS f13, NULL::integerAS f2, NULL::integerAS f3, NULL::integerAS f4, NULL::integerAS f5, NULL::integerAS f6, f1 AS f7, f2 AS f8, f3 AS f9FROM (-- dist2SELECT*FROM t34 AS _ WHERE"f1"ISNOTNULL)AS _)AS _)AS _)SELECT*FROM (SELECT*FROM (SELECTNULL::integerAS f0, f0 AS f1FROM (SELECT f0 + f1 AS f0FROM (WITH t36 AS (SELECT*FROM (SELECT f0 AS f0, f1 AS f1, f2 AS f2, f3 AS f3, f4 AS f4, f5 AS f5, f6 AS f6FROM (-- join1SELECT*FROM t35 AS _WHERE ("f0"ISNOTNULL) AND ((("f1"ISNOTNULL) OR ("f2"ISNOTNULL)) AND (("f3"ISNOTNULL) AND ((("f4"ISNOTNULL) OR ("f5"ISNOTNULL)) AND ("f6"ISNOTNULL)))))AS _)AS _)SELECT*FROM (SELECT*FROM (SELECT f0 AS f0FROM (SELECT f0 AS f0FROM (SELECT f2 AS f0, f3 AS f1, f4 AS f2, f5 AS f3FROM (SELECT f1 AS f0, f2 AS f1, f3 AS f2, f4 AS f3, f5 AS f4, f6 AS f5FROM t36AS _)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f1 FROM (SELECT1as f0 FROM t36 AS _) AS _))AS _)AS _)AS _)AS _UNIONSELECT*FROM (SELECT f0 AS f0, NULL::integerAS f1FROM (SELECT f0 AS f0FROM (SELECT f2 AS f0, f3 AS f1, f4 AS f2, f5 AS f3FROM (SELECT f1 AS f0, f2 AS f1, f3 AS f2, f4 AS f3, f5 AS f4, f6 AS f5FROM (SELECT f7 AS f0, f8 AS f1, f9 AS f2, f10 AS f3, f11 AS f4, f12 AS f5, f13 AS f6FROM (-- join2SELECT*FROM t35 AS _WHERE ("f7"ISNOTNULL) AND ((("f8"ISNOTNULL) OR ("f9"ISNOTNULL)) AND (("f10"ISNOTNULL) AND ((("f11"ISNOTNULL) OR ("f12"ISNOTNULL)) AND ("f13"ISNOTNULL)))))AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _)AS _CROSSJOIN (SELECT f0 AS f2 FROM (SELECT f2 AS f0 FROM t26 AS _) AS _))AS _)SELECT*FROM (-- distSELECT*FROM (SELECT f0 AS f0, f2 AS f1, NULL::integerAS f2, NULL::integerAS f3FROM (-- dist1SELECT*FROM t27 AS _ WHERE"f0"ISNOTNULL)AS _)AS _UNIONSELECT*FROM (SELECTNULL::integerAS f0, NULL::integerAS f1, f1 AS f2, f2 AS f3FROM (-- dist2SELECT*FROM t27 AS _ WHERE"f1"ISNOTNULL)AS _)AS _)AS _)AS _)AS _)AS _WHERE ("f0"ISNOTNULL) AND ("f1"ISNOTNULL))AS _)AS _;
It’s not pretty, rather amazingly, running the above query in postgres 17 will in fact return a single row with a single column whose value is 100. And you’d better believe it does it by
actually looping its way up to 100.
If you don’t believe me, make the following change:
- SELECT * FROM recursion ORDER BY step DESC LIMIT 1)+ SELECT * FROM recursion ORDER BY step DESC)
which will instead return a row for each step of the iteration.
There are some obvious optimizations I could make to the generated SQL, but it didn’t seem worth my time, since that’s not the interesting part of the project.
What the Hell Is Going On?
Let’s take some time to discuss the underlying category theory here. I am by no means an expert, but what I have learned after a decade of bashing my head against this stuff is that a little goes a long way.
For our intents and purposes, we have types, and arrows (functions) between types. We always have the identity “do nothing arrow”
id
:
and we can compose arrows by lining up one end to another:
1
(⨟) :: (a ~> b) -> (b ~> c) -> (a ~> c)
Unlike Haskell (or really any programming language, for that matter), we DO NOT have the notion of function application. That is, there is no arrow:
-- doesn't exist!($) :: (a ~> b) -> a -> b
You can only compose arrows, you can’t apply them. That’s why we call these things “arrows” rather than “functions.”
There are a bundle of arrows for working with product types. The two projection functions correspond to
fst
and
snd
, taking individual components out of pairs:
prj₁ :: (a, b) ~> aprj₂ :: (a, b) ~> b
How do we get things into pairs in the first place? We can use the “fork” operation, which takes two arrows computing
b
and
c
, and generates a new arrow which generates a pair of
(b, c)
:
(△) :: (a ~> b) -> (a ~> c) -> (a ~> (b, c))
If you’re coming from a Haskell background, it’s tempting to think of this operation
merely
as the
(,)
pair constructor. But you’ll notice from the type of the computation that there can be no data dependency between
b
and
c
, thus we are free to parallelize each side of the pair.
In category theory, the distinction between left and right sides of an arrow is rather arbitrary. This gives rise to a notion called
duality
where we can flip the arrows around, and get cool new behavior. If we dualize all of our product machinery, we get the
coproduct
machinery, where a coproduct of
a
and
b
is “either
a
or
b
, but definitely not both nor neither.”
Swapping the arrow direction of
prj₁
and
prj₂
, and replacing
(,)
with
Either
gives us the following injections:
inl :: a ~>Either a binr :: b ~>Either a b
and the following “join” operation for eliminating coproducts:
(▽) :: (a ~> c) -> (b ~> c) -> (Either a b ~> c)
Again, coming from Haskell this is just the standard
either
function. It corresponds to a branch between one of two cases.
As you can see, with just these eight operations, we already have a tremendous amount of expressivity. We can express data dependencies via
⨟
and branching via
▽
. With
△
we automatically encode opportunities for parallelism, and gain the ability to build complicated data structures, with
prj₁
and
prj₂
allowing us to get the information
back out
of the data structures.
You’ll notice in the IL that there are no variable names anywhere to be found. The desugaring of the source language builds a stack (via the
something to allocate △ id
pattern), and replaces subsequent variable lookups with a series of projections on the stack to find the value again. On one hand, this makes the categorical IL rather hard to read, but it makes it very easy to re-target! Many domains do have a notion of grouping, but don’t have a native notion of naming.
For example, in an electronic circuit, I can have a ribbon of 32 wires which represents an
Int32
. If I have another ribbon of 32 wires, I can trivially route both wires into a 64-wire ribbon corresponding to a pair of
(Int32, Int32)
.
By eliminating names before we get to the IL, it means no compiler backend ever needs to deal with names. They can just work on a stack representation, and are free to special-case optimize series of projections if they are able to.
Of particular interest to this discussion is how we desugar loops in catlang. The underlying primitive is
cochoice
:
cochoice :: (Either a c ~>Either b c) -> (a ~> b)
which magically turns an arrow on
Either
s into an arrow without the eithers. We obviously must
run
that arrow on eithers. If that function returns
inl
, then we’re happy and we can just output that. But if the function returns
inr
, we have no choice but to pass it back in to the eithered arrow. In Haskell, cochoice is implemented as:
cochoiceHask :: (Either a c ->Either b c) -> a -> ccochoiceHask f = go .Leftwhere go ::Either a c -> b go eac =case f eac ofLeft b -> bRight c -> go (Right c)
which as you can see, will loop until
f
finally returns a
Left
. What’s neat about this formulation of a loop is that we can statically differentiate between our first and subsequent passes through the loop body. The first time through
eac
is
Left
, while for all other times it is
Right
. We don’t take advantage of it in the original
count
program, but how many times have you written loop code that needs to initialize something its first time through?
Compiling to SQL
So that’s the underlying theory behind the IL. How can we compile this to SQL now?
As alluded to before, we simply need to give SQL implementations for each of the operations in the intermediary language. As a simple example,
id
compiles to
SELECT * FROM {}
, where
{}
is the input of the arrow.
The hardest part here was working out a data representation. It seems obvious to encode each element of a product as a new column, but what do we do about coproducts? After much work thought, I decided to flatten out the coproducts. So, for example, the type:
would be represented as three columns:
( f1 INTNOTNULL, f2 INT, f3 INT)
with the constraint that exactly one of
f2
or
f3
would be
IS NOT NULL
at any given point in time.
With this hammered out, almost everything else is pretty trivial. Composition corresponds to a nested query. Forks are
CROSS JOIN
s which concatenate the columns of each sub-query. Joins are
UNION
s, where we add a
WHERE field IS NOT NULL
clause to enforce we’re looking at the correct coproduct constructor.
Cochoice is the only really tricky thing, but it corresponds to a
recursive CTE
. Generating a recursive CTE table for the computation isn’t too hard, but getting the final value out of it was surprisingly tricky. The semantics of SQL tables is that they are multisets and come with an arbitrary greatest element. Which is to say, you need an column structured in a relevant way in order to query the final result. Due to some quirks in what postgres accepts, and in how I structured my queries, it was prohibitively hard to insert a “how many times have I looped” column and order by that. So instead I cheated and added a
clock_timestamp() as step
column which looks at the processor clock and ordered by that.
This is clearly a hack, and presumably will cause problems if I ever add some primitives which generate more than one row, but again, this is just for fun and who cares. Send me a
pull request
if you’re offended by my chicanery!
Stupid Directions To Go In the Future
I’ve run out of vacation time to work on this project, so I’m probably not going to get around to the meta-circular stupidity I was planning.
The compiler still needs a few string-crunching primitives (which are easy to add), but then it would be simple to write a little
brainfuck
interpreter in catlang. Which I could then compile to SQL. Now we’ve got a brainfuck interpreter running in postgres. Of course, this has been done by hand before, but to my knowledge, never via compilation.
There exist C to brainfuck compilers. And postgres is written in C. So in a move that would make Xzibit proud, we could run postgres in postgres. And of course, it would be fun to run brainfuck in brainfuck. That’d be a cool catlang backend if someone wanted to contribute such a thing.
Notes and Due Diligence and What Have You
I am not the first person to do anything like this. The source language of catlang is heavily inspired by
Haskell’s arrow syntax
, which in turn is essentially a desugaring algorithm for
Arrows
. Arrows are slightly the wrong abstraction because they require an operation
arr :: (a -> b) -> (a ~> b)
—which requires you to be able to embed Haskell functions in your category, something which is
almost never possible.
Unfortunately, arrow syntax in Haskell desugars down to
arr
for almost everything it does, which in turn makes arrow notation effectively useless. In an ideal world, everything I described in this blog post would be a tiny little Haskell library, with arrow notation doing the heavy lifting. But that is just not the world we live in.
Nor am I the first person to notice that there are categorical semantics behind programming languages. I don’t actually know whom to cite on this one, but it is well-established folklore that the lambda calculus corresponds to
cartesian-closed categories
. The “closed” part of “cartesian-closed” means we have an operation
eval :: (a ~> b, a) ~> b
, but everyone and their dog has implemented the lambda calculus, so I thought it would be fun to see how far we can get without it. This is not a limitation on catlang’s turing completeness (since
cochoice
gives us everything we need.)
I’ve been thinking about writing a
category-first
programming language for the better part of a decade, ever since I read
Compiling to Categories
. That paper takes Haskell and desugars it back down to categories. I stole many of the tricks here from that paper.
Anyway. All of the code is available on
github
if you’re interested in taking a look. The repo isn’t up to my usual coding standards, for which you have my apologies. Of note is the template-haskell backend which can spit out Haskell code; meaning it wouldn’t be very hard to make a quasiquoter to compile catlang into what Haskell’s arrow desugaring
ought to be.
If there’s enough clamor for such a thing, I’ll see about turning this part into a library.
When looking at the types of arrows in this essay, we make the distinction that
~>
are arrows that we can write in catlang, while
->
exist in the metatheory.
↩︎
I’ve built the same system three times now, at three different companies, for three different providers. It never has a name and it never appears on a roadmap, but it always goes the same way: the truth about your own customers lives in someone else’s database. The users live in an identity provider, the subscriptions in Stripe, the bounces in whatever sends your email, and your product needs that truth locally. So you subscribe to webhooks and keep a copy.
The first time, I thought I was building an endpoint: one route that parses the JSON and updates a row, an afternoon of work.
The afternoon grew into a week. First came signature verification, because an open endpoint that mutates your database is a hole. Then the dedup table, because deliveries arrive twice and the docs cheerfully call this “at-least-once.” Then the handler got a buffer, because a
membership.created
sometimes shows up before the
user.created
it points to. Then the bootstrap importer, because webhooks only tell you what happens
after
you subscribe, and it raced the live events, so it grew a locking scheme. And finally came the reconciliation cron: a job that crawls the provider’s list APIs at 3 a.m., diffs them against our tables, and quietly fixes what disagrees.
I want to be honest about what that cron is. It’s a written confession. It says:
I do not trust the copy I built, and I have no way to know when it’s wrong, so I will re-derive it from scratch every night, forever.
The trust was gone for a reason. The drift never announces itself; ours was found by a support ticket. A customer had cancelled months earlier and our database still said
active
; some
customer.subscription.deleted
had evaporated between Stripe and us, and nothing anywhere was capable of noticing: not their dashboard, which showed the delivery as retried and eventually dropped, and not our logs, which cannot log a request that never arrived.
And that’s only the code. Every provider also brings its own dashboard. Three providers, three webhook configuration pages, each with its own idea of how endpoints are registered, which events exist, how test and live environments are kept apart, and where the signing secret lives. When something breaks, debugging is a tour: their delivery log in one tab, our logs in another, and a third tab for whichever dashboard I currently suspect. None of them look alike, and all of them have to be checked.
By the third time I built this system, I had stopped pretending. I budgeted for the whole stack up front (signatures, dedup, buffering, bootstrap, cron) and somewhere in the middle of writing my third dedup table, I finally asked the question I should have asked the first time.
What exactly am I reconstructing here?
Notifications aren’t data
I was reconstructing an ordered log. Every one of those integrations was an attempt to turn a stream of notifications back into the ordered, complete, current history it came from.
And here’s the absurd part: that history
exists
. It has to, because it’s sitting inside the provider; it’s how they render their dashboards, their event pages, and their webhook replay tools. The provider takes their ordered log, shreds it into individual HTTP POSTs, fires them at my endpoint over a channel that guarantees neither order nor delivery, and then I reassemble the log on my side. So does every other consumer, independently, each with their own bugs.
It’s a jigsaw puzzle where the manufacturer had the original picture, cut it up, mailed me the pieces one at a time, lost a few in the post, mailed some twice, and printed nothing on the box. And when my assembled puzzle doesn’t match the original, their support team asks
me
which pieces I’m missing. I don’t know, and that’s the entire problem: nothing announces a gap.
None of this is any provider’s bug. Their webhooks work exactly as documented. The problem is what a webhook
is
: a notification, “something happened, here’s a POST about it.” Notifications are a fine way to trigger a side effect and a terrible way to transfer a dataset, and somewhere along the way we started using them for the second thing without noticing we’d changed jobs.
How did this become the norm?
Nobody decided this. The term “webhook” was coined by Jeff Lindsay in 2007, and the early uses were genuinely good fits: GitHub’s post-receive hooks kicking off a CI build, or a payment event pinging your server so it could email a receipt. The job was to do a thing when a thing happens, and for that a POST is perfect: fire-and-forget is fine when forgetting is fine.
Webhooks spread because they were the cheapest thing a provider could ship (one HTTP POST) and the cheapest thing a consumer could receive (you already had a web server, so you just added a route). By the early 2010s, “we have webhooks” was a checkbox on every API’s landing page, and the checkbox never distinguished between two very different jobs:
Trigger a side effect
: send the receipt, start the build, ping the channel.
Keep a copy of the provider’s data correct
: this customer deleted their payment method, so update it in your DB too.
Job one is what webhooks were born for. Job two is what I was doing all three times, and job two is the one where every property webhooks lack (ordering, completeness, bootstrap, verifiability) is precisely the property you need.
We picked the tool that was lying on the table in 2007, and then we spent fifteen years compensating.
The valley
There’s a concept in evolutionary biology I can’t stop thinking about: the fitness landscape. Peaks are good designs, valleys are bad ones, and populations climb whatever slope they happen to be standing on. The trap is the
local optimum
: a small hill that’s better than its immediate surroundings, so evolution parks there, even when a much higher peak exists across the valley. Getting to the higher peak means crossing through designs that are temporarily worse, and evolution doesn’t do temporarily worse.
Webhooks-for-replication are a local optimum, and the proof is the pile of workarounds on the valley floor: signature schemes, dedup stores, idempotent handlers, retry queues with exponential backoff on the provider side and dead-letter queues behind them, webhook logs with replay tooling because consumers keep asking for replays, and my 3 a.m. cron.
The pile has an economy on top of it. Svix exists so providers don’t have to build webhook delivery; Hookdeck exists so consumers don’t have to build webhook ingestion. AWS will sell you the valley as managed services, with EventBridge to ingest your SaaS partners’ events, SQS to queue them, and Lambda to retry your handler, and you get to assemble the pipeline yourself. And an entire industry of connector platforms (Fivetran, Airbyte, every “unified API” startup) is, at bottom, pseudo-CDC: change data capture reconstructed from webhooks and polled list APIs, one bespoke connector at a time, sold as a product. Inside a database, capturing changes is a solved problem: it’s called replication, and it works because there’s a log. Between companies, we rebuild it out of doorbells.
My favorite workaround of them all is the local tunnel. Many providers ship a CLI like
stripe listen
that opens a tunnel to your laptop, because a webhook cannot reach localhost. Think about what that is: a product, built and maintained by the provider, reinvented multiple times, whose entire purpose is to work around the delivery direction of their own primitive. When multiple providers all need to ship a local tunnel so developers can
develop
, the primitive is answering the wrong question.
None of this tooling is bad engineering; it’s excellent engineering. That’s what a local optimum looks like: so much excellent engineering poured into the valley floor that the valley becomes comfortable, and nobody looks up.
But some providers have looked up. Stripe retains
thirty days of events
and exposes
/v1/events
, an ordered, listable log, and
recommends reconciling against it
. WorkOS ships an
Events API
, an ordered cursor-paginated log, and
their own docs recommend it over webhooks
when data consistency matters. The log keeps escaping, and each escape mints its own bespoke cursor semantics, its own bootstrap story, no way to verify a replica, and no shared contract, but the direction is unmistakable. This is convergent evolution: unrelated organisms, same environmental pressure, same wing.
The log exists everywhere, but the contract doesn’t.
Could it be better?
Before reaching for a new design, it’s worth asking what any replacement would actually have to provide. My three integrations suggest the list: order, so changes can be applied without buffering; a way to start from nothing, so bootstrap isn’t a separate import racing the live events; deletes as data, so absence stops being the failure mode; resumability, so my downtime is my problem instead of a data-loss event; and some way to verify the result, so trust doesn’t decay into a 3 a.m. cron.
Measured against that list, the obvious candidates come up short. Polling the list APIs harder is the reconciliation cron promoted to a whole strategy: it can rebuild current state, but it burns rate limits discovering that mostly nothing changed, it says nothing about order, and a deleted object looks identical to an object that never existed. Managed delivery, whether that’s Svix on the provider’s side or EventBridge and SQS on mine, makes the pushes more reliable, but they are still pushes: still no bootstrap, still no verification, still notifications pretending to be a dataset. That path hardens the valley floor without climbing anywhere.
The third candidate is the one the providers keep half-building on their own: stop pushing altogether, and let the consumer read the log itself.
Flip the arrow
So here’s the thought experiment. What if instead of the provider telling us when there is new information, we ask the provider what new information it has for us since we last checked?
Suppose a provider served one URL per collection, and that URL returned an ordered, cursor-addressed change log of full-state events. Ask without a cursor and you read from the beginning, which is your bootstrap, with no separate import and no race. Ask with a cursor and you resume where you left off. Your entire sync state is that cursor.
GET /feed/customers?cursor=01J9XQ4R
Prefer: stream
200 OK
Content-Type: application/x-ndjson
{"cursor":"01J9XR2M","operation":"upsert","object":{"id":"cus_123","plan":"pro"}}
{"cursor":"01J9XR2N","operation":"delete","object_id":"cus_099"}
Send
Prefer: stream
and the response never ends: each change arrives as it commits, over a connection
you
opened, using the same API key you use for the normal REST endpoints. Leave it off and you get a bounded page you can poll from a cron. It’s the same endpoint, the same events, the same cursors, and the same consumer code.
None of this is exotic; it’s a paginated GET. But walk back through my afternoon-that-grew and watch what it does to the stack:
The dedup table
is gone. Every event carries the object’s full current state, so applying one is a blind upsert keyed by id, and the same event applied twice produces the same result.
The ordering buffer
is gone, because the log is ordered.
The bootstrap importer and its locking scheme
are gone. A new consumer reads the same feed with no cursor, replays the collection, and carries straight on into live changes in one request.
The lost delete
is impossible. A tombstone is an event in the log, and it sits there until I read it. My cancelled customer cannot silently stay
active
, because absence stopped being the failure mode.
The endpoint, the signatures, and the tunnel
never exist in the first place. Every connection is consumer-initiated, and the loop runs behind NAT, on a laptop, or in a scheduled job.
The feed could carry one more thing. When a read reaches the end of the log, the provider could tell you what should be there: a count and a checksum of current state, at the cursor you now hold. You compare the two, and you
know
your replica is right instead of assuming it. My 3 a.m. cron, the written confession, becomes a comparison I’ve already made by the time I would have thought to schedule one.
The fourth time
If a feed like that existed, the fourth time I build this system would be a loop:
GET
the feed, let “upsert” upsert the object into my db and “delete” delete it, and save the last cursor. That’s twenty lines with no route, no secrets to rotate, no queue, and no cron. The replica carries its own proof of correctness, and when someone asks which customers have an active subscription and a bouncing email address, the answer is a
JOIN
across local tables with no silent asterisk attached.
Nobody
Almost nobody serves this today. That’s the catch, and it’s also the point.
I wanted to see whether the idea survives being written down precisely, so I drafted it as a protocol:
SCROLL
, short for Synchronized Change Replication Over Line Logs, at
welidev.github.io/scroll
. It’s draft-00 in the request-for-comments sense of the phrase. It pins down the feed, the cursors, the streaming and polling modes, the checkpoints, tombstones, and retention, and it marks the places where my own confidence is lowest. It also doesn’t require waiting for providers, since a shim can synthesize a feed from any provider’s existing webhooks and list APIs, which is how I plan to find out where the design is wrong.
If you’ve lived in the valley, if you’ve written a dedup table or debugged a reconciliation cron or watched a delete evaporate, read it and tell me where it breaks. Disagreement is the desired response; silence is the failure mode.
Michigan Senate Race Closes as a Referendum on Israel Policy
Intercept
theintercept.com
2026-11-03 21:00:06
The fate of Abdul El-Sayed will either herald an ascendant left flank among Democrats or trigger the party’s revanchist centrist instinct.
The post Michigan Senate Race Closes as a Referendum on Israel Policy appeared first on The Intercept....
For the left,
it’s been the marquee race of the midterm cycle. Either a Republican former U.S. representative known for pushing domestic spying powers or an outspoken progressive who forced a reckoning over U.S.–Israel policy among Democrats will emerge from Election Day as the next senator from Michigan.
Abdul El-Sayed would be the first Muslim U.S. senator if elected Tuesday night, capping off a race that’s been viewed as a referendum on swing-state appeal for the Democratic Party’s left flank. If he defeats Mike Rogers, a loyal Trump ally whose campaign often peddled Islamophobic tropes against the Democratic nominee, the results will all but certainly embolden progressives ahead of the 2028 presidential election.
If El-Sayed loses, it will likely trigger a centrist backlash — and cost the Democrats a critical Senate seat as the party fights to take back the upper chamber.
Polls across Michigan closed by 9 p.m. ET on Tuesday, with anxious voters across the state awaiting the returns.
In the heavily Arab and Muslim city of Dearborn, voters across party lines said they were outraged at the Islamophobic attacks ads targeting El-Sayed that became a staple of airwaves and social media feeds in the campaign’s final days.
“I am a Muslim. And I’ve seen a lot of ads, and it’s disgusting, because we are good people,” said Gus Tarraf, a Republican running for a state House seat. “I love this country.”
Although Donald Trump carried many precincts in
Dearborn two years ago
due to voter frustration over the Biden administration’s support of Israel, Tarraf said his community is turning on the Republican Party this year.
“Not a lot of Arab Americans are happy with the Trump administration,” he said. “So it doesn’t matter if they know you, as soon as they know you are on the Republican ticket.”
El-Sayed’s willingness to criticize U.S. policy on Israel animated soap-opera-level drama in the final days of the race, when his former primary opponent, centrist Democratic Rep. Haley Stevens, announced she would
switch her endorsement
to support Rogers.
After
demanding an apology
from El-Sayed for an outside PAC’s ad, Stevens said on social media that she came to the decision after feeling “shut out” by El-Sayed’s campaign, adding that she’s heard from “Black voters, Jewish voters, and others about how deeply these messages hurt.” Rogers, she said, gave her “the hope that he can serve in the tradition of John McCain: a senator willing to put country before party and stand up to his own side when conscience requires it.”
Stevens’s
late-breaking endorsement of Rogers
drew a mix of eye-rolls and outrage from voters at three precincts in Detroit and Dearborn. None of the voters interviewed by The Intercept said it had swayed them to vote for Rogers.
“People have already early voted. People have already absentee voted,” said Noora Iskander. “I don’t think many people change their minds. So I think it’s just hypocritical.”
Stevens’s decision to make the endorsement while inside a Black church in Detroit may also have generated backlash from the Black voters that Rogers was hoping to win over, according to some who spoke to The Intercept. One said the church community has been buzzing — and not positively — about the weekend’s events.
“Unfortunately, she went to a Black church to use it as a backdrop,” said Dearborn voter Dorothea Sharon. “It really was a slap in the face for the Black community that that happened.”
While El-Sayed has had to face intense
scrutiny
over accusations of conflating opposition to
U.S. aid to Israel
with antisemitism, little accounting has been made of the blatant
Islamophobia
and xenophobia from the Rogers campaign, the Republican Party, and
Trump
. But in Dearborn, the rhetoric had clearly hurt several voters who spoke to The Intercept.
The father of state Senate candidate Abbas Alawieh, a Democrat who played a prominent role in the
2024 Uncommitted movement
, grew visibly upset when asked about the ads targeting Muslims.
“These are weak people who don’t have anything to do — they don’t have any programs for our economy, for our health, for our future,” Zouheir Alawieh said. “That’s why they are attacking us as Muslims and as human beings. It’s never been like this. This is a shame. America is a place where the Black with the white with the yellow, the Muslim with the Christian with the Jews, can live freely. Don’t try to tear up our society.”
Outside Dearborn, El-Sayed has tried to defuse the
anti-Muslim
smears against him by joking that he is only in favor of “shawarma law.” However, the Islamophobic attacks convinced at least one voter to cast her ballot for Rogers.
“I don’t want to live under Sharia law,” said Joann, a law firm employee who declined to give her last name after she voted in Detroit.
The fear of Islamic rule was the main issue for Joann, she said, although she also worried about El-Sayed’s campaign pledge of Medicare for All.
“I’ve worked my whole life, put all my stuff into the Medicare, but then I’ve got to let other people get it for free? It doesn’t seem fair to me when I’ve worked my whole life for it, and we’re not even sure that it’s going to be there when we really get ready to retire,” she said.
Yet it was that very messaging from El-Sayed’s campaign that excited many other residents in Michigan. Many voters who spoke to The Intercept said they were more focused on pocketbook issues.
“It’s the gas prices, the food. I mean, money is running out your pocket so fast,” Leigh James said after voting at Tabernacle Missionary Baptist Church in Detroit.
James said she had walked to the polling place to avoid using gas. “I’m trying to save,” she said. “So thank God I live in the neighborhood.”
Other voters said they were inspired by El-Sayed’s personality, with one woman describing him as a “fighter.”
Noora Iskander, who voted for El-Sayed in Dearborn, said she approved of his stance in favor of Medicare for All, his affordability platform, and his solidarity with Palestine.
“I think he’s going to make a lot of change. He’s going to scare a lot of people — which I believe is a good thing, because you can’t really change for the better if you don’t scare a few people,” she said.
This is a developing story. Matt Sledge reported from Dearborn and Detroit, Michigan.
Giant Canyon on Mars Is Still Tectonically Active Today
Polls Close in Maine as Democrats Make Final Push to Oust Sen. Susan Collins
Intercept
theintercept.com
2026-11-03 20:02:50
The longtime Republican incumbent is at risk of losing her seat to Troy Jackson, a progressive Democrat who entered the race just over three months ago.
The post Polls Close in Maine as Democrats Make Final Push to Oust Sen. Susan Collins appeared first on The Intercept....
The toughest reelection
campaign of Republican Sen. Susan Collins’s career is over, as Mainers await results of whether their longtime senator effectively portrayed herself as an independent force in Washington or was weighed down by the baggage of a Republican Party entering the midterms at a severe disadvantage.
Polls closed at 8 p.m. ET Tuesday night in a race that could see the 30-year incumbent lose her powerful Senate post to challenger Troy Jackson, a progressive who was virtually unknown on the national stage until his
rushed
elevation just over three months ago as the Democratic replacement candidate.
Tuesday night’s election results could change the control of the Senate chamber, with Maine as one of the seven critical states likely to determine whether Democrats can overcome the Republican majority in D.C.
But Maine voters may have to wait far later to learn who won. The state’s ranked-choice voting system, which
allows voters to rank candidates by preference
rather than being forced to select just one candidate, could delay results significantly.
Maine Secretary of State Shenna Bellows said municipalities have two business days to submit their results to the state, although election officials have requested that towns share their vote counts Tuesday night.
Collins, who has represented the state since 1997, campaigned on her record of securing federal investments for state infrastructure, such as rural hospitals, and prided herself as being a moderate Republican who breaks ranks with President Donald Trump.
“We now see her failing to stand up to a brutal, irresponsible, greedy and corrupt regime,” Maine Democratic Party Chair Charlie Dingman told The Intercept. “She has not used her seniority or her power to aggressively stand in the way of that destructive presidency, and that is a serious and fundamental difference between 2020 and 2026.”
Dingman argued that Collins faces a fundamentally different political environment than she did in 2020, pointing to her vote to confirm Supreme Court Justice Brett Kavanaugh and the subsequent overturning of Roe v. Wade.
Still, Collins’s split support among some Democratic voters was evident Tuesday in Lewiston, where several residents told The Intercept they were supporting the Republican senator despite filling their ballots out to Democrats otherwise.
“I am Susan Collins all the way,” said Anne Marie Hastings, a voter who also expressed strong support for Matt Dunlap, a progressive running against former Republican Gov. Paul LePage in a closely watched race in the state’s 2nd Congressional District.
“I’m a registered Democrat, but when it comes to things like this, I go with what I feel is right, not the party that they belong to,” Hastings said. She also praised Collins for advocating for shipbuilding contracts at Bath Iron Works, where she said her brothers had worked.
But John Cabral III, a shipbuilder at the same shipyard, disputed Collins’s record.
“She didn’t bring any extra work,” Cabral told The Intercept. “So that’s all propaganda.”
Cabral said he supports Jackson because of his commitment to organized labor.
“I think they are going to wake up and smell the coffee,” Cabral said of Maine voters. “[Mainers] never seen a senator fight as hard as Troy, especially for labor.”
Another Lewiston voter, Ouellette Bertram, said he voted blue across the board, with the exception of “the Republican lady,” who he said he just plain likes.
“She’s been doing a good job, I think,” Bertram said.
Other Maine residents didn’t share the sentiment toward the Republican incumbent and the Republican Party’s decadelong legacy within the state.
One all-Democrat voter was Bryan Golay, who said he wished the Democratic Party would move to the left but voted against what he described as the GOP’s “enshittification” of America, much of which, he said, has come during Collins’s time in Washington.
“If you can’t get shit done in 30 years, why are we gonna give you another term?” Golay said.
Mags Krantz, a master’s student of social work who works with children with disabilities, said she voted for all Democrats, including Dunlap and Jackson, citing GOP-backed cuts to social services.
“They just cut funding for my job, and for my career,” Krantz told The Intercept outside a polling site in Lewiston on Tuesday. “I really voted for my future, but I also voted for every vulnerable child that I work with every single day that really wishes adults would vote for them over money.”
“I also voted for every vulnerable child that I work with every single day that really wishes adults would vote for them over money.”
Speaking to a crowd of supporters on the eve of the election, Jackson toasted the grassroots organizing that has powered his rapidly assembled campaign into the most serious challenge yet to Collins’s hold on her seat.
“This government is fundamentally broken, and it only works for the wealthiest people in this country — that’s what we’re up against right now,” Jackson said. “They are going to outspend the hell out of us. There’s no doubt about it. But they don’t have people like you in rooms like this across this state and across the country.”
Jackson, who spent nearly 20 years in the state legislature, ran on a platform focusing on lowering costs for working-class families, expanding healthcare access, and combating the influence of wealthy donors and corporate PACs in Washington. He entered the race somewhat hastily in late July, after former Democratic nominee Graham Platner
withdrew
from the Senate race
following a rape allegation
, which Platner denied.
Maine is one of the two critical swing states determining control of the Senate to use ranked-choice voting. The other is Alaska, where the last polls won’t close until 1 a.m. ET on Wednesday.
The Collins–Jackson race has been one of the top targets for national attention this cycle — most of it on purpose. In October, The Intercept reported that Defending Main Street, a Republican-aligned super PAC associated with Collins spent between $20,000 and $25,000 attacking Jackson on topics such as cost-of-living and taxes. The
ads mistakenly
were targeted to audiences in Portland, Oregon, rather than the intended Portland, Maine.
This is a developing story that will be updated. Noah Hurowitz reported from Lewiston and Portland, Maine.
Anti-Union Crusader Tilts Labor Department Toward Big Business
Portside
portside.org
2026-11-03 19:47:36
Anti-Union Crusader Tilts Labor Department Toward Big Business
Judy
Tue, 11/03/2026 - 19:47
...
Amazon Labor Union members protest the company’s anti-union stance in 2021. Amazon has spent $26 million on union busting since 2025 alone. | Wikimedia Commons
A new investigation by the Center for Media and Democracy (CMD) reveals that a top Trump labor official responsible for protecting workers’ rights and transparency in labor-management relations failed to disclose more than $750,000 in compensation for her and her husband from anti-union groups when President Trump appointed her to the position in 2025.
In her role as director of the Department of Labor’s little-known Office of Labor-Management Standards (OLMS) since February 2025, Elisabeth Messenger has overseen a crackdown on unions while ignoring and failing to report union-busting by employers.
The revelations illustrate the tight links between the Trump administration’s top labor enforcers and a broad network of anti-union advocacy and litigation groups funded by corporate and right-wing foundations. As the labor movement has aggressively pushed back on Trump’s attacks on federal workers, the immigrant labor force, and public education, the administration has in turn sought to burden unions with a deluge of paperwork and allowed corporations to engage in union avoidance activities while avoiding clear disclosure requirements.
Congress first established the
OLMS
in 1959 to protect workers’ rights, promote transparency between labor and management, and support union democracy, financial integrity, and self-governance.
While past reporting has covered Ms. Messenger’s recent position as CEO of
Americans for Fair Treatment
(AFFT), a group dedicated to weakening public employee unions, a CMD review of the group’s tax filings shows that she received
$419,556
in payments from the organization after her departure in July 2024, with only
$161,541
of that categorized as “severance payments.”
Messenger’s husband, William Messenger, is a vice president and the legal director of the
National Right to Work Legal Defense Foundation
(NRTWLDF), which is solely focused on litigating against the labor movement. The group paid him more than $300,000 in compensation in 2025, making him its highest paid employee and bringing the couple’s income from anti-union groups to more than $750,000 in the months leading up to Ms. Messenger’s appointment.
Ms. Messenger failed to report her salary at AFFT in the 12 months prior to her appointment and entered “None” in the section of the
“New Entrant” ethics report
requiring disclosure of employer severance payments and similar arrangements. She did report her husband’s employment at NRTWLDF, but left the box for his income amount blank. Her official Department of Labor
profile
also makes no mention of her past employment by AFFT, citing only “leadership positions at several nonprofit organizations focused on free market policies and protecting First Amendment rights.”
Image by Makena Fitzpatrick
A spokesperson for the Department of Labor told CMD that, “Director Messenger takes her ethical obligations seriously and follows all guidance provided by career ethics officials regarding the standards of ethical conduct and other ethics statutes and regulations.” The person declined to respond to further questions, and AFFT also did not respond to CMD’s request for comment.
Mr. Messenger first attracted national attention for successfully
arguing
the
Janus v. AFSCME
case before the Supreme Court in 2018 on behalf of the NRTWLDF.
Janus
, which the Roberts court decided in a 5–4 decision, overturned the
Abood
precedent that had allowed public sector employers to bargain over “agency fees” paid by non-members for the cost of union representation.
Abood
addressed the “free rider” problem of individual workers benefitting from union representation without paying for it.
In an article titled “The Lawyers Who Beat the Unions,” the
Wall Street Journal
noted
that Mr. Messenger had litigated a 2014 case,
Harris v. Quinn
, that helped lay the groundwork for the
Janus
decision.
Ms. Messenger’s ethics filing with the federal government also revealed that she had briefly consulted with the
Foundation for Defense of Democracies
, which has attacked teachers unions for their positions on foreign policy, in February 2025.
OLMS, which is responsible for both enforcing union compliance with laws governing financial transparency and with ensuring that employers and their “union buster” consulting firms file required disclosures about their anti-union activity, has seen a massive dropoff in the latter disclosures in the year and a half since Ms. Messenger took charge of the agency.
A
recent report
by LaborLab, a pro-union group, found that employers complied with filing requirements in just 58% of cases in 2025, which represents a steep dropoff from previous years. An analysis by LaborLab and the Economic Policy Institute last May found that employers
spend over $1.5 billion
annually on union avoidance, the vast majority of which is not disclosed.
While reporting by corporations has gone by the wayside, Ms. Messenger has
expanded
reporting requirements for unions, which are compelled to disclose far more about their activities publicly than any other tax-exempt organizations.
“The [new] policy, known as ‘the LM–2 long form,’ is designed to drown unions in paperwork and drain them of resources needed to organize, collectively bargain, and advocate for their members — especially for smaller unions [that] are particularly challenged to take on the additional administrative burden,” the AFL-CIO stated in its June
press release
announcing that it would sue over the Labor Department’s new reporting requirements. “Meanwhile, wealthy corporations continue to go under-scrutinized, allowed to get away with minimal reporting requirements compared to the unions [that represent] the workers [who] create their profit.” AFL-CIO President Liz Shuler added that the administration is “using every tool in the toolbox to come after workers.”
The
NRTWLDF
is affiliated with the
National Right to Work Committee
(NRTWC), which lobbies for state and federal anti-union legislation. Among its
founders
were the PR firm Selvage & Lee, which is now part of the French firm Publicis (one of the “Big Three” global advertising firms), as well as representatives from General Electric and the Santa Fe Railway (now a part of Burlington Northern Santa Fe, which is itself part of Warren Buffett’s Berkshire Hathaway empire).
The Supreme Court’s ruling on the
Janus
case was a big win for the far right and the Koch network in the US —
led by
the Bradley Foundation and billionaire heirs Charles and David Koch — whose longstanding goal has been to destroy the ability of public sector unions to advance their members’ interests and to deal a “mortal blow” to progressive politics.
Ms. Messenger’s actions at OLMS appear to be largely following the playbook set out in the labor section of the Heritage Foundation’s
Project 2025
. Written by current Solicitor of Labor Jonathan Berry (the Labor Department’s top attorney), it calls for expanding disclosure requirements for unions, among other anti-worker measures.
Bob Funk, executive director of LaborLab, told CMD that since “an extensive, well-funded industry of union-busters now wields enormous influence within the [OLMS], it’s no wonder corporate compliance with labor relations laws is staggeringly low — and still falling.”
===
Matthew Cunningham-Cook is an award-winning investigative reporter with a focus on capital markets and money in politics. He has written for The American Prospect, The New York Times, The Nation, In These Times, The Lever, The Intercept, and Al Jazeera, among other publications. He has also worked as a researcher and consultant for labor unions.
On October 23, 2026, the unthinkable happened. It was supposed to be a mere formality: C++26 was up for a vote by the ISO National Bodies (NBs). The options are always approval, rejection, or abstention. Comments are also allowed. Since 1998, this process had run quietly and smoothly. Not so on October 23, 2026. After a twelve-week voting period, the result is in:
Disapproved
!
I would like to mention here that I am a member of the C++ Standardization Committee and, together with my colleagues, represent Germany’s vote. ISO rules also stipulate that certain votes are internal to ISO, and the results—or the breakdown of the results—may not be published. This article contains my own personal views.
The Current Status
As far as I know, this is the first time in the history of C++ that DIS ballot failed. When I searched the ISO system, I could only find one other DIS that was not approved: ISO/IEC DIS 26926 C++/CLI Language Specification dated August 11, 2006. It’s possible that my search privileges aren’t sufficient to view everything, but all ISO programming languages should be visible to me. The sad end of ISO/IEC DIS 26926: the project was halted. I mention this upfront to clarify the significance of this vote.
In the following, I will use various terms from everyday ISO terminology. At
https://isocpp.org/std/iso-iec-jtc1-procedures
, there is an overview of the various stages of an ISO standard. DIS is the penultimate stage. As the overview also shows, a two-thirds majority is required. This majority was not achieved.
The reason for the rejection is quite clear from the comments submitted by the National Bodies (NBs): contracts. Put simply, a number of NBs believe that this feature is not yet ready for release.
The Process
Now it gets complicated. The C++ Standardization Committee, also known as WG21, follows ISO rules but also has some additional rules. One of these is (or was) that opinions are always heard whenever new information becomes available. If an opinion was heard and a feature was nevertheless not changed as desired, the person respects the outcome and accepts that many others disagree.
However, the voting body at the NB level may also consist of other individuals, or the NBs are, of course, free to vote differently.
The previous practice was that NBs would only vote against a standard if new information became available or if errors in the process or similar issues were identified. This changed on October 23, 2026.
It’s difficult to judge in this complex situation; the NBs who want C++26 without Contracts argue that there is new information. I myself find it hard to share this view. A new paper with old arguments is not new information to me.
The History of Contracts in C++
The feature has been on the wish list for a long time. I was already in the room in Cologne back in 2019, at the time for C++20, when Contracts, in a different form back then, were being included in the standard. I was also in the room when the feature was removed from C++20 again during the same meeting. As a result, a study group was formed to address the topic of Contracts and its various aspects from 2020 to approximately 2024. Afterward, the study group submitted its work and proposals to the Evolution Working Group (EWG), the central body for language extensions. There, the topic was discussed further over several meetings before being included in C++26 by a majority vote.
In the next step, WG21 voted on the C++26 draft in March 2026, which included Contracts. Here, too, a large majority was achieved, though not without dissenting votes.
And that brings us to the next phase: DIS. At this stage, there were enough “no” votes that a two-thirds majority was not reached.
What happens next?
The big problem: what happens next? ISO, of course, has a process for this. It offers various options:
Submit a
revised
draft for a new DIS vote.
Submit a
revised
draft to the committee (that would be the CD phase).
Publish a
revised
draft as a Technical Specification.
Cancel the project.
All of these possibilities mean a delay in the next C++ standard. Whether it will still be called C++26 is also up in the air, but that’s a much smaller issue.
The difficulty with all four options is that they require a majority within WG21. However, this working group voted to move C++26
with
Contracts into the next voting phase leading to its release. And it did so with more than just the required two-thirds majority. The feature didn’t come out of nowhere, either; it was developed over the course of years through the work and possibly personal commitment of many people. It’s hard to imagine that this group would simply want to abandon its work, which has received approval on multiple occasions so far. The same applies to the group that is dissatisfied with Contracts. This group, too, has invested effort, in some cases even in alternative implementations. It’s hard to imagine that, after these groups voted “no” in the DIS vote, the result would change without Contracts being removed.
Even the last option
removing C++26
requires a majority in WG21. As I understand it, this step would mean reverting to C++23 and proceeding to C++29 without a single change. This would affect the work of even more people. WG21 would then be tasked with incorporating features that have already been successfully included in C++26 into C++29. Since this can only be done through a paper backed by at least one person advocating for it, features could be omitted if that person lacks the motivation or time.
Of course, certainty about the voting outcome can only be achieved if the respective path is actually taken.
Unfortunately, the way forward is currently more than uncertain. Perhaps this also explains why ISO/IEC DIS 26926 marked the end of this activity. Consensus is needed to move forward. Trust is always required for consensus. Unfortunately, that trust has just been shaken.
The next C++ standard, and thus the future of C++, is currently at an impasse.
The good news is that the next meeting will take place on November 16, which is just a few days away. The top priority will be to break the deadlock. This will very likely have implications for C++29 as well; in fact, there is currently no reason to continue working on this project.
My Personal Opinion
Normally, my articles are technically focused and free of personal opinion. Regarding the rejected DIS, I can only say that I consider it a massive disaster and feel sorry for the entire C++ community. Regardless of whether someone likes Contracts, considers them important, or sees major weaknesses in them, the topic has been worked on for years and has received a majority vote multiple times in its current form. By voting “no,” an established system, one based primarily on trust and respectful collaboration, has been shaken. Every ISO standard is simply a set of compromises. Everyone loses sometimes, and everyone wins sometimes. Overall, the result is one in which all participants have given their best. During the DIS vote, the losing parties refused to accept their loss. The question that primarily determines
how to move forward
is whether the group can rebuild trust.
Andreas
Canva layoffs: design giant to cut or relocate more than 1,200 jobs in major restructure
Guardian
www.theguardian.com
2026-11-03 19:14:49
Chief executive Melanie Perkins describes job cuts as ‘without doubt the hardest moment in our thirteen-year history’ in email to staffGet our breaking news email, free app or daily news podcastCanva is cutting or relocating more than 1,200 jobs, representing 22% of its global workforce, as part of ...
Canva is cutting or relocating more than 1,200 jobs, representing 22% of its global workforce, as part of a major restructure that includes laying off staff who helped build the Australian-founded design platform.
The changes mirror a trend across the technology sector, where software companies are fighting to stay competitive against cheaper artificial intelligence disrupters while aggressively embedding AI tools themselves.
Canva’s chief executive, Melanie Perkins, said in an email to staff on Wednesday that the restructure was “without doubt the hardest moment in our thirteen-year history”.
“For some people, this will mean changes to their roles or being asked to relocate to centralised hubs,” she said. “Sadly, it will also mean saying goodbye to teammates and friends who have helped build Canva into what it is today.”
The restructure will affect 1,271 people, according to the company, as it focuses on “collapsing layers” and bringing “more teams together in person”.
“We know relocating is a big decision for those being asked to consider it, and we’re committed to making the process as smooth as possible with comprehensive support,” said Perkins, who did not specify the exact number of job losses.
Those leaving Canva will receive at least six months of salary and retain healthcare coverage for a further 12 months in countries where workers receive that benefit. They can also keep their laptops.
Those leaving can also apply for US$10,000 (A$14,000) grants to start their own ventures.
The graphic design company is one of Australia’s most successful startups and has long been touted as a candidate for a blockbuster listing on the Nasdaq.
While established software companies have rejected the
threat of a “SaaS-pocalypse”
, a term used to describe the idea that AI becomes so advanced that specialised software becomes redundant, many have overhauled their business models in response or aggressively adopted AI tools.
Unlike Atlassian, Block and WiseTech, Canva did not mention AI in its restructure announcement.
Test and verification technique effectiveness with GPT-6 Astra
Dan Luu
danluu.com
2026-11-01 19:00:00
When we looked at how well agents used test/verification techniques in August1, we saw that GPT-5.6 Sol generally did what you might call a caricature of various techniques when asked to use a technique or library such as TDD, QuickCheck, Lean 4, etc.; not specifying any particular test method (whic...
When we looked at
how well agents used test/verification techniques in August
1
, we saw that GPT-5.6 Sol generally did what you might call a caricature of various techniques when asked to use a technique or library such as TDD, QuickCheck, Lean 4, etc.; not specifying any particular test method (which we'll call Default) resulted in many worthless unit tests, which was one of the best performing conditions because asking agents to test in specific ways mostly made them worse. In that eval, we gave agents the Zstd RFC and asked them to implement Zstd (with an addendum for how they should test for all conditions other than Default).
On re-running the same eval with GPT-6 Astra, we see two big differences:
Astra's capability has increased by enough that we need a more difficult eval (on the Zstd implementation eval, almost every condition gets 100% correctness almost every time on medium regardless of technique)
Agents seemed to use test and verification techniques more effectively
On (1), we previously saw that, when implementing Zstd from the RFC with 5.6 Sol, on average, agents spent $3.50 on medium effort and $5.50 on xhigh effort to get full (holdout) test correctness about 63% and 77% of the time, respectively. With Astra, agents cost $1 to get full test correctness over 99% of the time at medium effort.
On (2), an example would be that when we asked 5.6 Sol to do fuzzing, it would generate many worthless random inputs, which would mostly hit the same code paths and not test anything interesting. With 6 Astra, we see agents that are asked to do fuzzing in a structured way that actually exercises code paths and finds non-trivial bugs, but we can't tell if this improved correctness or not because the Zstd implementation benchmark is saturated.
We also tried giving 5.6 Sol the IMAP RFC, but it was too hard for 5.6 Sol. When trying again with 6 Astra, we get the following distribution of results (the y-axis is the percent of runs where all tests pass; agents are not given the tests and the points are the results across 80 runs of each condition).
Default once again looks pretty good. Some conditions result in somewhat better correctness, but also with higher cost. Although the IMAP RFC isn't saturated, it would be nice to also see results on a harder task since most of my time goes to tasks that agents can't one-shot most of the time. To test this, we'll try the
pandoc eval we looked at when comparing programming languages
. A reason I want to see results on larger evals is that, as we observed
when looking at caveman mode
and as we saw with languages, models often perform fairly differently on larger tasks. With caveman mode, the large wins that people reported became smaller or disappeared and with languages, we saw this in multiple ways, such as C and C++ implementations of Zstd being at least somewhat ok on memory safety, whereas C and C++ implementations of Pandoc were plagued by memory safety issues.
Pandoc is significantly harder, and even after running multiple turns (roughly 14 on average), no condition reached 100% correctness, so we'll look at the fraction of tests passed instead of fraction of runs that got to 100%.
For this, we only ran each condition 25 times due to the cost involved. At MSRP, this cost about $90k.
Recall that, in past evals we ran on languages and test/verification techniques, the failures were often idiosyncratic results of how agents operate, such as agents using Clojure writing incorrect byte conversion code by default or agents using Verus writing vacuous proofs. This kind of thing is quite different from the reasons I've seen people say that agents should use some particular language or test/verification technique, which are generally nice-sounding explanations for why something ought to be better that sound appealing in a very human way but appear to be unrelated to reality when we look at what agents actually did
2
.
Because we "only" ran $90k worth of evals here, we don't really have enough information to say why almost anything happened. We can observe that some conditions performed better than others, but it's difficult to say what it means. As a result, we shouldn't read too much into this, but we do see some things that seem consistent with what one might expect, in that we might expect most of the test techniques and libraries suggested to give better generalization, which would then give better holdout vs. test scores (result is up and to the left of the Default line when viewing visible vs. holdout test scores), with TDD giving worse generalization (down and to the right of the Default line).
But, if it's true that testing properties gives us better generalization and conditions like TDD that result in a lot of small tests give less general results, we'd expect the built-in condition to also have a low holdout:visible relative to Default and that's not what we saw. Why this is is unclear and I don't think we can really determine this without a lot more runs.
For the actual results, the line shown for cost vs. holdout and cost vs. visible show curves fitted to the shape of all graph trajectories across multiple turns, fit to Default. Things that are below / right of the line can be thought of as worse and above / left can be considered better. With 5.6 Sol, it was clear that the test conditions generally weren't doing useful work for a combination of reasons:
Almost no condition outperformed Default
On other evals (not discussed in detail), similar prompts also did not outperform Default
The tests produced by non-Default conditions were mostly ridiculous and didn't capture the value of the technique
Here, we have a situation where many different techniques have a better result than Default. The conceptual error bars on each condition are quite wide (more so than indicated by the bootstrap intervals shown on the plots), but the number of conditions that outperform Default makes it
plausible that one or more conditions truly outperforms Default
even if we don't know which ones exactly. Furthermore, some conditions likely truly outperform other conditions, but we don't really have sufficient data to tell which conditions are generally better. It's much simpler when almost everything looks bad across a wide variety of techniques.
Here are some questions I have about the results:
To what extent can these results be extrapolated to running more turns to get to
near-complete correctness for Pandoc
? In general, conditions do maintain something like their rank order with additional turns, so it's plausible the ranking will continue as-is, but this is untested
How much of the results are due to a small sample size (with respect to each condition)? For the Pandoc eval, we "only" ran each condition 25 times. Many different turns were run, but we know from previous experiments as well as just using agents that there's a high degree of path dependence when looping over generated code
How much of the results are due to a small sample size (with respect to minute / trivial variations)? From having run a few silly evals, I know that it's possible to get very different results when asking for the same thing due to trivial changes (such as changing sentence structure, changing capitalization, etc.); how much of the current results are due to something arbitrary like this?
How much of the results are due to a small sample size (with respect to the problem being solved)? We looked at one "Pandoc-sized" problem. If we looked at 100, how representative would Pandoc be?
If I really wanted to answer these questions, I'd want to run at least 100x what was run here to run the full matrix. Steve Yegge has mentioned using ~20 Claude subscriptions to spend ~$120k/mo of MSRP token spend. Getting to 100x isn't plausible with a setup like that, but 2x to 3x could be done with testing expanded in a limited fashion and some guesswork and extrapolation. I don't know that it really makes sense for me to do that given how much time it would take and how little spare time I have, but considering
what kinds of things academics have looked at when studying programming productivity
, maybe it makes sense for a grad student to do this, since it would be more informative than a number of widely cited studies. But, in industry, I'm not sure who would do this outside of an AI lab.
That being said, if you keep in mind that we don't know how well any of these results generalize, I'll note a few things that I thought were interesting.
Differential testing caused agents to examine tests and invariants in a way that engendered better "understanding" than other conditions
TDD once again underperformed, but not all conditions that caused agents to write a lot of small tests underperformed
Property-based testing (not the named condition, but a number of libraries that force the use of the technique) finally resulted in tests that do what one might hope from PBT
(1): I tried to get agents to do this with the hastily written skill I wrote for the 5.6 Sol Zstd eval; although the skill performed decently, agents basically didn't do this. However, for the Pandoc eval, differential testing did cause agents to closely examine boundary conditions and figure out how to write tests (and therefore how to write code) that correctly implements both sides of the boundary. I'm not confident that this generalize, but it would be interesting to see if it does generalize and what else can get agents to do this kind of thing systematically.
(2): Although TDD underperforming is exactly what I'd expect (recall that I added TDD to the 5.6 Sol eval because I thought it would underperform), the lack of underperformance of other conditions that cause many small tests to get generated should reduce confidence in the plausible sounding reason that writing many small tests underperforms.
(3): I've felt for a long time that ACL2 is underrated relative to other verification tools (it was heavily used to good effect in industry in some areas relative to the amount of academic work on it). I had low confidence in this opinion and continue to have low confidence, but it has performed well in evals I've done so far. Given how much effort is being poured into getting agents to use Lean effectively, I'd expect that Lean will eventually outperform ACL2 even if ACL2 outperforms today, but ACL2 doesn't seem like a bad choice today. For people doing verification or proofs with Lean 4, I'd be curious how the results compare to using ACL2.
(4): Yay (perhaps). For all the reasons I noted above, I have low confidence that this generalizes, but Proptest once again performed well. And, this time, the testing was a lot better than we saw in the 5.6 Sol Zstd eval. I have no inside information on this, but I would guess that there wasn't a major effort on improving PBT / fuzzing / etc. between 5.6 Sol and 6 Astra and that this comes out of better generalization and higher capability. If that's true (and this isn't just some artifact of my only spending $90k MSRP and not $9M MSRP), this bodes well for better testing in the future in that we should expect models to get better at testing without any particular effort to improve testing capabilities.
Between my running these tests and publishing this post, a claim that you should tell agents not to write tests (based on running DeepSWE) went viral. The specific claim was
ok it's official...[ellipses from original quote] AI-written unit tests and integration tests are empirically proven to be unhelpful. you should tell your agents to stop writing tests by themselves
As we previously noted
, I find DeepSWE unrepresentative of work that I do and therefore meaningless to me personally. Additionally, that was done with Sonnet 5.5 High, so it generally only passed on problems that are much easier than the problems discussed here, and as observed here and in other recent evals, which techniques are effective often doesn't generalize across problem size or problem difficulty. I find it plausible that for problems coding agents find very easy, telling them not to test reduces cost (which is what was actually shown conditional on someone caring about DeepSWE). Generalizing this to "AI-written unit tests and integration tests are empirically proven to be unhelpful" based on the test that was run seems wrong regardless of whether or not this holds for other problems, and it seems unlikely that the claim holds. The claim was based on asking for no tests, which resulted in similar correctness and a small cost savings (9%, on average). In our tests here as well as before, we find differences in correctness as well as a larger than 9% difference in cost, so it seems unlikely that a claim like "AI-written unit tests and integration tests are empirically proven to be unhelpful" based on a 9% difference in cost on a benchmark of small problems is correct. Another thing to note is that DeepSWE's grader is broken with respect to testing because (among other issues),
an agent can add a test name that conflicts with a grader's secret test name, which will then cause a failure
. Given issues like that, adding tests is inherently penalized in a way that isn't representative of real-world usage.
You can argue the claim was highly effective, in that making overstated claims that something is empirically proven is a good way to go viral
3
or
get a lot of citations
, but it's not a good way to figure out how to use coding agents effectively.
My goal here is not to write the end-all-be-all benchmark for “I’m a vibe-coder, which framework should I choose?” The point of this post is to demonstrate that it’s possible in the era of AI coding to still make decisions based on evidence rather than vibes.
I feel the same way here, in that I think it's valuable to run some toy evals and see what the results are. Even if someone had the resources of an AI lab available to them, I don't think they could say that X or Y are "empirically proven to be unhelpful [or helpful]", but we can still get some kind of information.
From what we've seen in our testing evals, I'd be inclined to try proptest if I wanted a property-based testing library in Rust, and for any problem that I'd use Lean on, I'd be inclined to try ACL2 as well to see how results vary and if I get better results, and there's also a fair amount of information that fits into some kind of vibes-based feel for things.
As I've noted in my N most recent posts, I've been trying to write up each of these in 30 minutes because there are too many results to write up and not enough time, so I'm not going to provide
an accounting of what happened for each condition like I did for the 5.6 Sol Zstd eval
. I'm already over 30 minutes on this post, so I'll stop here and perhaps we'll look more into testing and verification in a future post.
Thanks to Laurence Tratt and Marco Primi for comments/corrections/discussion.
Appendix: why don't AI labs publish more comparisons on what techniques are effective?
Unlike us randos, they actually have the resources to run relatively comprehensive evals and there's a general lack of information about what's effective. If people understood how to use AI better, it seems like that would result in more AI usage. Also, my experience has been that different techniques are effective with OpenAI's models vs. Anthropic's models. If one of these companies published good information about what works with their models, that could move people towards interacting with agents in a way that's advantageous for them.
I guess the case against this is something like, revenue growth is so rapid that more money can be made by doing other work and/or differences in how people prompt don't really matter anyway. As someone on the outside of these labs, the former seems plausible to me, whereas the latter doesn't seem like it can be true (because I've repeatedly observed reasonable people who aren't doing obviously silly things get very different results, to the point where one person might fail to get a working solution to a problem where another person easily makes things work).
David R. MacIver noted:
Btw one thing I'm noticing in my evaluations on the skill is that ChatGPT is way less into PBT than Claude is. Claude will pretty eagerly write property-based tests and seems to benefit from them during development in my current benchmarks, but ChatGPT sol doesn't do that unless you're really insistent. So there might be some prompt sensitivity going on here, or it might be model specific. I've not yet optimised the skill for ChatGPT at all so it's possible I've inadvertently fucked something up for it. BTW I don't actually know that Claude is
better
at PBT than ChatGPT (I should really check this). It's just more proactive about doing it, but it's plausible that when they actually write properties they're about the same level of quality.
I haven't done the same breadth of testing with Claude. Given what MacIver said, it's plausible that Claude is better at property-based testing or that it's not. Also, given that he develops Hegel and is generally using Claude, it's also plausible that Hegel works better with Claude than with Codex and we'd see better results from Hegel if we tried with Claude. So there might be some prompt sensitivity going on here, or it might be model specific.
Although it's not shown on the graph, the original Hegel skilled used for the 5.6 Sol Zstd eval and the updated one that was created as a result of MacIver doing more testing on the skill after that eval both fared worse than Hegel with no skill. Correctness was pretty similar, and both cost a lot more, with the updated skill being the more expensive of the two. I think it's pretty interesting that this skill, which was improved for some cases got worse for other cases. As we discussed in the last post, it seems very difficult to write certain kinds of skills (such as test technique skills) that are effective across models and effort levels. A related thing we can observe here is that the Skill condition, which was a skill I quickly whipped up based on my experience driving agentic testing with GPT-5.5 and GPT-5.6 Sol outperformed in our 5.6 Sol eval, but underperformed here with 6 Astra on Pandoc. Someone who has more experience driving testing with 6 Astra on larger problems could probably write a skill that outperforms in those circumstances, at least on problems that are similar in nature to what that person has worked on, but I haven't seriously looked at Astra test effectiveness enough to write that skill myself.
On a related note, for various arbitrary reasons, I've gotten used to using Codex. I seem to do ok with it. This gives me little idea how effective I would be with Claude.
Roman Leventov commented:
Hi Dan, I was encouraged by your post about ai-coding to try fuzz/generated testing.
A part of a system I develop has a statechart-like architecture. Think of it as a support chat where automation could suggest actions or messages for support agent (human) to send to the user. LLM is not used to author messages, but just to classify some of the support intents, but state transitions are deterministic. There could also external events about the subject of the ticket that materially affect possible next actions or decisions. All of this gives rise to a rich statechart system. It is written in TypeScript.
So I had to rewrite a significant chunk of that system so to derisk rewrite but also to try fuzzing I decided to go with it during the rewrite. I used sol xhigh for the first 5 days of the rewrite, then mostly astra medium or high for 4-5 days more (it was around astra release). I instructed agent to develop generate traces of all the possible kinds of events and effects that affect the logic.
For the first 4 days it couldn't make the generated testing system find a single de novo defect that agent reviewers themselves didn't find first. I always use my approach where I define many angles/scopes/areas of review (for this rewrite there were about 15), make agents generate quite detailed prompt for these areas based on my templates, then start subagents in these areas with verbatim prompts in the areas as long as they find any defects or things to fix.
In total throughout the whole rewrite, agent reviewers found about 210 bugs/defects, generated tests took off the ground a bit towards the end and produced about 20 de novo defects that agents themselves didn't notice. In total about 230.
Production code change was about 30k lines, the generated testing harness and everything that was written specifically to support this generated testing approach was about 300k lines at the end. Probably it was very ineffective, but I didn't look into it.
After the deploy, there were a few (4-5) very "stupid" bugs that you would think a process that run well over 100 agent reviewers and found 230 bugs couldn't have missed. Still, I consider this a good result for a rewrite of such a complex statechart system.
Overall I consider this a negative result because generated tests helped find just 10% of the defects, and required gargantuan amount of code (300k lines) and agent tokens to develop and support.
I think this is interesting and I would love to see more people writing up case studies of what they observe.
Apple Begins Opening Siri AI to Developers
Daring Fireball
developer.apple.com
2026-11-03 18:58:49
Apple Developer:
Starting today with the iOS 27.3, iPadOS 27.3, macOS 27.3, and
visionOS 27.3 betas, a new Developer Preview enables any developer
to integrate their app with Siri AI, giving businesses and
developers new ways to reach and serve their customers. [...]
This developer beta offers ...
Starting today with the iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3 betas, a new Developer Preview enables any developer to integrate their app with Siri AI, giving businesses and developers new ways to reach and serve their customers.
Siri AI, an entirely new version of Siri that is profoundly more capable, conversational, and personal, is designed to be deeply integrated into Apple’s operating systems and the apps people use every day, including the apps from our vast ecosystem of developers. Thousands of developers have already built integrations with Siri to let users ask for directions, manage a to-do list, send a message, or catch up on an audiobook. Siri AI is available in many languages, including English, French, Japanese, Korean, Portuguese, and Spanish and will soon expand to support Traditional Chinese, Norwegian, Turkish, and Vietnamese. People around the world are turning to Siri AI to get things done every day, which means more customers can discover and use apps just by asking.
Today’s preview allows any app to bring its content and actions directly into Siri AI by using App Intents, making it easier for all apps to tap into Siri AI’s newest capabilities, including personal context understanding, onscreen awareness, natural language, and more. So people can just ask for help in their own words, and Siri AI carries out any custom action you’ve built, from checking a delivery to booking a reservation to placing an order. For complex requests, we’re also introducing skills to let you teach Siri AI how to combine several actions into a single experience. And Siri AI can now surface any entity in the Spotlight semantic index, not just the ones that fit an existing schema.
We started rolling out these new capabilities across many Apple apps, including Calendar, Files, Finder, Journal, Mail, Maps, Messages, Music, Notes, Photos, Preview, Reminders, Safari, Shortcuts, and Weather, so users can do things like find a coffee shop they visited last week or archive files that haven’t been opened in over a year. There are many more actions available now as examples for you to reference. To see what you can do in each app, just ask Siri AI.
This developer beta offers a sneak peek at Siri AI app intents for developers. With this early Developer Preview, your app can work directly with Siri AI, giving you a first look at new ways to reach and serve your customers. This preview provides early access before first shipping to customers in a few months; and with submission to the App Store opening up in the spring, developers have time to explore, build, and help shape their experiences before launch. Try it out and share your feedback.
As you explore early, we will follow up with more details about the terms and usage policies for experiences enabled through Siri AI. More to share soon.
To learn more about the new APIs, how to use them, and how to evaluate your app’s experience with Siri AI, read new
documentation
. You can also connect with Apple engineers in Apple Intelligence Group Labs on November 4–5 to ask questions, get advice, and follow the discussion.
Siri AI is available in beta in iOS 27.3, iPadOS 27.3, macOS 27.3, watchOS 27.3, and visionOS 27.3 and requires an Apple Intelligence-enabled device set to a supported language. It is available in English, French, Japanese, Korean, Portuguese, and Spanish. Some features may not be available in all regions or languages.
Siri AI is currently unavailable in the EU in iOS, iPadOS, and watchOS. Apple is working constructively with the EU in an attempt to find a path forward.
Siri AI is not available for users under 13.
Certain Apple Intelligence features that rely on server-side models are subject to daily usage limits, including but not limited to Siri AI, intelligent photo editing tools, Image Playground, and AFM 3 Cloud models in Shortcuts. Daily limits may vary by feature, request complexity, system demand, system policies, and other factors. Expanded access to such features will be available for a fee in the future. Use of these features is subject to the Apple Intelligence terms and conditions. Learn more at support.apple.com/148587.
Bernie Sanders Is on the Ballot—Against Trump
Portside
portside.org
2026-11-03 18:58:40
Bernie Sanders Is on the Ballot—Against Trump
Judy
Tue, 11/03/2026 - 18:58
...
Bernie Sanders Is on the Ballot—Against Trump
Published
Senator Bernie Sanders speaks at a campaign rally in Houston, on October 20. | Antranik Tavitian/Getty Images
Bernie Sanders is drawing massive crowds, not in the so-called “Commie Corridor” of Brooklyn and Queens, but in battleground states like Maine, Florida, and Michigan. This is unusual, as
Atlantic
writer Russell Berman noted
earlier this week: “Democratic candidates typically embrace him during primaries and then stick him on the sidelines for the stretch run, when they’re rediscovering their love of capitalism and bipartisanship.” But this year, many of these candidates are still embracing him—and his policies—in the general election, despite competing in tight races against Republicans. By doing so, they’re testing a long-running question on the left: Can Democrats beat Republicans with a social-democratic platform centered on the working class? Tuesday’s elections will provide a clearer answer than any U.S. election has this century.
When Sanders ran for president in 2016 and 2020, many of his supporters insisted that had he won the Democratic primary, he would have gone on to win the general election. In this dreamy hypothetical scenario, we could have been spared Trump in 2016 (perhaps also averting Biden, the genocide in Gaza, and Trump 2.0). “Bernie would have won!” has been a wistful core belief of the Vermont senator’s supporters; some poll data indeed suggests he could have, but given all the oligarchic cash that would have been deployed to oppose him, the unpredictability of polling, and the conservativism of many Americans, who knows? We never will, of course. Sanders is (presumably!) too old to run for president again, so these midterms are the best test yet of whether his politics can beat Trumpism on the ballot.
The core of Sanders’s politics is an opposition to oligarchy and support for a better life for America’s working class. In policy terms, that has meant support for Medicare for All, lowering the price of prescription drugs, taxing the rich and large corporations, limiting corporate power, the right to organize unions, and free college. It has also meant universal childcare, the right to choose abortion, affordable housing, a higher minimum wage, fully funded K-12 public schools, and an end to most foreign wars. Some version of this agenda has exploded all over the country, with great success, electing mayors, congresspeople, city councilmembers, and state legislators, mostly in blue areas. But only now are its powers being seriously tested on red and purple terrain in races of national significance.
In Maine, Democratic voters, eager to run a Sanders-style Democrat against incumbent Republican Senator Susan Collins, nominated Graham Platner, a charismatic oysterman and former Marine who supported Medicare for All. When Platner dropped out over sexual assault allegations, he was replaced, in a complicated internal party process, by Troy Jackson, a former logger and labor leader. Jackson’s personality is far less colorful than Platner’s, but his politics are similar. The issue atop
Jackson’s platform
is Medicare for All; after that, lowering the price of prescription drugs and taxing billionaires and large corporations. The race is close, with Jackson
leading
slightly
.
By now everyone has heard of Abdul El-Sayed, who first burst onto the Michigan political scene in 2018 to run for governor, a doctor fighting for Medicare for All who was one of the first candidates to be embraced by Sanders’s movement as a “Berniecrat.” He lost in 2018, but this time, running for Senate with a message of “Money out of politics, money in your pocket, Medicare for all,” he’s commanded far more momentum. This race is also
very
close
.
Angie Nixon, the Democratic nominee for Senate in Florida, is
prioritizing
Medicare for All too, followed by universal childcare, public education, housing, and unions. She’s polling several points behind Republican Ashley Moody. But even if Nixon loses, no one should write her off—nor underestimate the future of Sanders-style politics in her state: She leads with 68 percent among voters 18–25, and 59 percent among those age 25–34.
There are many other races in purple and red areas around the country where Sanders’s influence can be felt. Smoke jumper and union leader Sam Forstag in Montana’s deep-red 1st congressional district is running against Republican Aaron Flint in a
competitive open race
, on a vow to “
Make Montana Work for Working People
,” with housing, health care, childcare and education at the top of his platform. Will Lawrence, in Michigan’s 7th congressional district, which went slightly for Trump in 2024, is polling ahead of incumbent Republican Tom Barrett. Lawrence is
running on taxing the rich
, affordable housing, and health care for all.
Then there’s Nevada, a state where Sanders won the 2020 Democratic presidential caucus
in a landslide
. Many of his followers have described that night as the last time they had any hope for a leftist turn in national politics. This year, working-class Latino voters may hand the Democrats a victory over an incumbent Republican governor and flip a House seat in a red district, thanks in part to Sanders’s playbook.
In an interview with Politico
, Democratic Senator Catherine Cortez Mastro emphasized Nevada’s lessons for Democrats across the country: Focus on the cost of living. The gubernatorial Democratic challenger, Aaron Ford, is running on an “Affordable Nevada” platform with housing and health care as the top two issues. The first sentence of House candidate Teresa Bentiz Thompson’s platform is, “People across northern Nevada are working harder and getting less.”
Whether or not these candidates win will not decisively settle the question about whether Sanders-style politics can topple Trumpism in elections. There are too many other electoral factors in play, from the president’s corruption to ICE’s abuses. But the results, if they largely favor the aforementioned candidates, could point the Democratic Party in a new direction for 2028.
It’s high time. Sanders’s movement has now grown bigger and more electorally successful than anyone expected. The Democratic Socialists of America has
grown
to nearly 130,000 members, with many running for office as socialists, winning elections against moderate Democrats, and proving the popularity of policies like rent stabilization, universal childcare, free transit, and public control of energy. Yet many pundits and establishment Democrats treat the left vote as niche, one that can only succeed in blue cities and college towns.
The left believes that centrists’ failure to deliver material improvements to people’s lives yielded the toxic combination of resentment and apathy that gave us two terms of Trump—and that we can’t defeat the MAGA right, and build a better America, without remaking the Democratic Party in the mold of Bernie Sanders. Ten years ago, the mainstream portrayed us as naïve, hopeless dreamers who refused to accept political reality. But as more and more Americans struggle in a cruelly unequal economy, and increasingly blame the entrenched politicians in both parties, our dreams don’t look so hopeless anymore.
===
Liza Featherstone is a contributing editor at
The New Republic
and the author of
Divining Desire: Focus Groups and the Culture of Consultation
(2018).
Last week, I saw an article on the front page of the New York Times
website
reporting that a critical vulnerability in PHP had been found. The article, and
others
like
it
, claimed any attacker could achieve arbitrary remote code execution on any of the millions of running PHP services worldwide simply by sending a few unauthenticated web requests that exploited the PHP2Shell vulnerability.
My office Slack was buzzing, as were several of my Signal chats with colleagues and friends across the security community.
Rumors swirled about how in-the-wild exploitation caused one tech company to break embargo and leak news of the vulnerability hours before the rest of the community could coordinate disclosure. That hackers were
already
hacking websites, in the wild, with this exploit and that every hour mattered to get the patches rolled out across 70% of the internet.
The Question
Was PHP2Shell the hallmark of a new era whereby uplifted randos could hack any website with a few well-crafted prompts to an AI model?
I looked out my window, expecting perhaps to see the dull apocalyptic glow of fires on the horizon as society collapsed in real time. Nothing.
While online articles and tweets made the rounds about the eleven alarm cyberapocalypse upon us, I struggled to find any reference to a specific website that had been hacked.
Over the following days, a few iconoclasts had pointed out that the vulnerability was rather fiddly in practice (
Elias Taylor
;
Lucas Luitjes
) and that hacker groups, while initially quite excited by the exploit’s potential, had started to view it as impractical or difficult (
KELA
).
Yet at the same time, the national and international press continued to cover a herculean emergency effort to hunt down and patch PHP-based websites across the internet.
Rather than wait around and wonder, I decided to try to figure things out for myself. I had two fundamental questions:
Was PHP2Shell actually exploitable outside of a lab environment?
Would relatively unskilled attackers with access to AI and the PHP source code be able to exploit this class of vulnerability?
The Results
Directly, the answers to the questions are:
1) Was PHP2Shell actually exploitable outside of a lab environment?
Yes.
Absolutely. The challenge winner, who has posted a
writeup
, exploited my server directly over an open internet connection and did so using the PHP2Shell vulnerability (e.g. he did not exploit some other vulnerability in my setup). He did this through a specially crafted exploit which targeted the specific configuration of my PHP installation and the ways in which it was set up on the server.
2) Would relatively unskilled attackers with access to AI and the PHP source code be able to exploit this class of vulnerability?
Not yet.
Of tens of thousands of people who attempted the exploit - including in a 9 hour period when the challenge was active after the first successful solve (more on that below…) - only two managed to trigger the
print-flag
binary and only one, the winner of the challenge, managed to do so in such a way as to extract useful content from the application.
The Experiment
The core idea was pretty simple. I’d rent a cheap VPS for a few weeks, slap a PHP website on it along with the key to a bitcoin wallet, and then wait and see if anyone managed to drain the wallet. Miraculously, the domain name “stealmybitcoin.com” was available, so I took this as a sign from the fates themselves that this experiment had the mandate of heaven.
I slapped $500 of bitcoin into a clean wallet, rented a $2.50/month Debian VPS from a web hosting provider, and told Codex to make me a basic webpage and stick it on the internet with PHP. I configured the server such that a single executable binary
print-flag
had permissions to read a
flag
file containing the WIF, took down my firewall, and posted the link to Hacker News to see if anyone would give the challenge a shot.
Things got a little crazy from there. Within the first hour of posting, the link had climbed to the front page of Hacker News (where it stayed for essentially an entire day) and my $2.50/month VPS was under so much load I couldn’t maintain an SSH session.
I eventually scaled my VPS up from 1 vCPU, 500 MB RAM and 10GB of disk space all the way to 2 vCPU, 4096 MB RAM, and 80 GB of SSD. Over the course of the challenge my VPS host temporarily took my site down once because they suspected it was subject to a Distributed Denial of Service attack and once because “we have determined your CPU resource utilization profile is excessive.”
Additionally, due to the nature of the exploit, people were pretty continuously taking down individual PHP workers from high request load, partially successful memory exploitation attempts, and general shenanigans.
Eventually I managed to get things into a relatively steady state (e.g. most people could connect to the website most of the time), with regular resets and health checks standing in for true high-availability hosting. Once the link dropped off the front page of Hacker News, traffic quieted down quite a bit as well.
Some Stats
Due to flaky monitoring, it’s hard to get representative statistics regarding visitor count and traffic patterns. I had set up some pretty reliable logging so I could know if/when the
print-flag
binary was called and some best-effort logging of web request headers and payloads so I could hopefully understand what happened around that time; for the first few hours of virality, I was blowing through my logrotate configuration (for ~80MB of storage) roughly every 4 minutes thanks to the attention on the site.
As a result, logs of certain PHP crashes and activity around the
print-flag
file were essentially complete over the duration of the challenge. Broader web request logging only covered 600-ish of the challenge’s 1,600-ish minute duration.
During the 10 hours when I had reliable web request logging:
Around
20,000
unique IP addresses engaged with the challenge in some substantive way (rather than just visiting the home page).
Around
120,000
distinct source IPs visited the site.
The server recieved more than
13 million
HTTP requests.
At peak load, the server received over
18,000
requests a minute.
There’s no statistically credible way to extrapolate over the missing netflow data, but I can confidently say that tens of thousands of players attempted to steal my bitcoin.
I had much more reliable logs of PHP server errors and
print-flag
executions since they were not rotated under heavy load and were relatively low volume. In these logs, over 26-ish hours, I observed:
Approximately
2,075
distinct PHP
SIGSEGV
events. While these could be caused by other bugs in PHP, they are not something you’d typically expect to see and may roughly correlate with attempts that were closer to triggering the exploit.
Only
two
IPs managed to trigger the
print-flag
executable and only
one
person did so in such a way that data was exfiltrated successfully from the server.
First recorded PHP SIGSEGV after the challenge timer started. Note: it predates
php-version.php
, seven subsequent PHP SIGSEGVs occurred on this first version of the challenge.
Oct. 25, 12:59
I add
php-version.php
, which returns the PHP version and UTC time.
Oct. 25, 15:44
I add
ping.php
, a small POST endpoint that returns pong for message=ping.
Oct. 25, 15:47
A PHP process successfully runs
print-flag
. This execution is associated with the eventual winner. The
ping.php
page was not utilized in the exploit chain.
Oct. 25, 20:32
I receive an email from the winner asking if I had the incorrect bitcoin wallet address for the key on the server. The winner provides the exact flag, timestamp, IP address, and payload associated with the 15:47 event listed above along with a writeup describing the winning exploit.
Oct. 25, 21:06
I review the winner’s claims against the server logs and validate that the flag is an exact match for the flag on the server and matches the web traffic logs surrounding the successful execution.
I review the winner’s final writeup and transfer the wallet contents directly.
Difficulties Along the Way
My original expectation is that this would be a low traffic honeypot. A few people would poke at it on Hacker News and then it would eventually get snagged by some botnet/scanner/automated exploitation tool that would steal my bitcoin. I’d write a little blog post about the logs from the hour or so around the exploit and then move on.
I didn’t remotely expect it to go viral in the way that it did. The virality was nice - it brought a lot of eyes on the challenge, got me a quick answer to my research question, and some people even chipped in and increased the size of the bitcoin prize wallet.
The virality was also rough in that suddenly many
actual
PHP security experts (and many non-experts too) had
opinions
about me, my motivations, and my web administration skills!
What should the backend do?
The first critique was that the server was unexploitable. Some claimed that it was literally just an nginx page (e.g. no PHP at all), while others claimed that the specific configuration of the server made it impossible to exploit.
I’m still not 100% sure how correct these claims were, as some people were causing SIGSEGVs to throw on the original version of the challenge.
However, I did make several modifications to the website that I felt were fair adjustments to increase the feasibility of the challenge without just deliberately making the server vulnerable.
First, I added a
php-version.php
page, which was served alongside the already PHP-hosted
index.html
page, in case the active participation of the PHP interpreter was necessary for the exploit. While some of the early reporting on PHP2Shell suggested this maybe wasn’t a strict requirement of exploitation (e.g.
https://www.wiz.io/blog/php2shell-php-rce
: “Exploitation does not depend on a flaw in the application’s code: even a simple “Hello World” application running on an affected PHP version can be vulnerable.”), it seems plausible to me that the part of the PHP SAPI server that serves
.html
files could be immune to these tasks.
I also added a
ping.php
page that responds with the word
pong
whenever someone POSTS the value
ping
to the server. This very simple application was added in case exploitation required PHP to dynamically react to user-supplied input. To me these two requirements (reacts to user-supplied input, runs .php pages) are pretty universal across real-world applications, so adding support for these code paths did not undermine the spirit of the challenge.
There was some other feedback, which I largely ignored, requesting specific variants of the PHP applications, or modifications to the (very basic) nginx proxy configuration I put in front of the website to help with routing, challenge isolation, and logging. It’s possible that if I made further modifications in this vein, more people would’ve been able to solve the challenge. There is no specific evidence to prove that this would be the case.
What’s a bitcoin key anyways?
The second major hosting issue I had is more easily expressed by a video. This is how I exported the WIF private key for my bitcoin wallet that I used in the challenge (Note: the wallet shown here is a different empty wallet. Please don’t use this key since I’ve recorded a video of it online!):
I thought I was putting the key to the wallet in the challenge based on this flow. Turns out I wasn’t. The WIF I exported turned out to be a parent key in a derivation path for the wallet address holding the bitcoin. I’m still not entirely sure which combination of credentials I
should’ve
provided to make the bitcoin stealable. If I run future challenges of this nature, I’ll probably make the flag the full wallet recovery key instead of any individual private key.
So the winner got the real bitcoin key from the server, but couldn’t use it to move any of the money in the branch wallet derived from that parent key.
Luckily, they reached out over email and provided exceptionally detailed proof including: the full text of the wallet key on the server, its hash, the exact timestamp when they exploited the server, the exact IP address they used to exploit the server, the exact payload they used to exploit the server, AI chat turns from when they developed the exploit, and a full writeup of the exploit they used.
With this information I was able to pull up the full trace in my logs, match down to the second the exploitation time with my logs on the
print-flag
binary and confirm that they did in fact know the full value of the
flag
file on the server.
Congrats to the winner for not only solving the challenge, but also solving the secret hidden challenge of keeping excellent exploit logs!
Conclusion
So what did I learn from this experience?
I launched the website out of a degree of skepticism around the breathless reporting of a serious PHP CVE despite a dearth of real-world victims of this attack.
To be honest, I think that was a
bad take
on my part. PHP2Shell is the real deal. It’s an exploitable vulnerability and a sufficiently motivated adversary, with the help of AI, can absolutely use it to hack a website even when they do not have direct access to memory addresses or the physical server to tailor their exploitation pathway.
If you are running a PHP-based website today, you should absolutely patch PHP2Shell.
I fully expect over the coming months we will see more and more working general purpose exploit chains for PHP2Shell.
If you operate a service that is sufficiently valuable or public enough to warrant specialized attention, my experience with stealmybitcoin.com makes me believe it is a matter of when, not if, someone could target a working PHP2Shell exploit specifically to your system configuration.
On the flip side, I believe stealmybitcoin.com tells us a lot about the current state of AI-assisted cyber exploitation. Out of tens of thousands of people attempting to hack a website with a publicly known (and exploitable!) CVE on it, only two managed to get close to triggering the vulnerability.
While some of the server-side changes I made to make exploitation easier may have had an impact (e.g. the winner solved the challenge about 3 hours after I added
php-version.php
to the server), many thousands of hackers were unable to trigger the flag binary over the 9-ish hours between the winner’s successful solve and the time when I took the challenge offline.
It’s pretty clear that we aren’t at a time, yet, where an inexpert attacker can take a top LLM + a
difficult
CVE (like PHP2Shell was) and turn it into a reliable cyber-attack tool.
It does seem that we’re drawing closer to that point every day though. I don’t think there’s any good way to stuff this cat back into the bag, but I do hope that hard work over the coming months across the open source and systems security ecosystem will make it so that hard exploits remain hard.
As someone who has spent a good chunk of my career doing offensive security research, PHP2Shell seems like another example of why enabling good people to find bugs quickly and publicly, so that everyone can get a jump on patching them, is as important as it has ever been.
iPad Mini (A20 Pro) Review Roundup
Daring Fireball
www.techmeme.com
2026-11-03 18:45:18
David Pierce at The Verge, on the Acoustic Display:
It means the sound fires out of the front panel rather than from
speaker holes. (Some TVs currently work the same way.) It doesn’t
sound any better than before, maybe a tiny bit bassier, but it
also doesn’t sound worse, and if anything it’s sli...
Candid conversations with the leaders shaping what's next in AI and the broader tech industry. Hosted by Alex Heath, who has covered Silicon Valley for more than a decade.
The official podcast of the singularity, from Casey Newton and Kevin Roose. Twice-weekly news, analysis, and interviews with the people who are building the future.
The first thing to note is simply the massive turnout – with
a 77.7% turnout
of those eligible voting, the highest turnout in more than two decades. That in itself is significant. It underscores how much importance Israelis attached to this vote.
Before the election, many observers were saying that it was one of the most consequential – if not the most consequential – votes, and clearly many Israelis felt the same way.
What drove this high turnout was different types of fears. Israelis of all persuasions were worried about how the outcome would affect what kind of country Israel becomes.
The second big takeaway is that the ruling coalition, formed by Prime Minister Benjamin Netanyahu after the 2022 election, was resoundingly rejected by the majority of Israeli voters – well over 50% cast their vote for parties opposed to the current government.
The five parties that make up Netanyahu’s right-wing and religious coalition went into the election with 68 seats in the 120-seat parliament. That same bloc
will now have 53
– and that is a significant loss, no matter how Netanyahu tries to
spin this as a victory
.
It means that those five parties will not be able to form the next government, and as such, the vote stands as a repudiation of the Netanyahu government.
Netanyahu’s Likud party will still be
the largest in parliament
. But its share of the national vote declined, and it looks like it will have
six fewer seats
in the next parliament, another blow to Netanyahu.
Netanyahu’s far-right coalition partners fared worse than expected, too. In part, this was due to “wasted votes” going to a new far-right party that failed to make it
above the 3.25% of the national vote needed
to be represented in parliament. Also, Likud drew some voters away from these far-right parties who had voted for them in the last election.
What drove the Arab parties’ surprise showing?
The performance of the Arab majority parties – the more secular and left-wing Joint List and the more religious and conservative United Arab List – is very important.
The reason for that is the massive turnout of Arab voters – much higher than the last election. But also, a less noticed trend is the increase in Jewish votes that those parties received. It is important to note that these are Arab-majority parties, not simply Arab parties.
Aside from Netanyahu, it was also a disappointing result for the main opposition party, Yashar; its
leader, Gadi Eisenkot
; and the anti-Netanyahu Change Bloc it was part of. The preelection polls suggested that the Zionist opposition bloc would do slightly better than the ruling coalition bloc.
But Yashar ended up with over 200,000 fewer votes than Likud, winning a projected
21 seats compared to Likud’s 26
, and the “Change Bloc” is heading to 48 seats, far short of a parliamentary majority.
Ultimately, what is clear is that the Israeli public remains deeply divided. And the fact that there is still a good chance that Netanyahu will emerge as prime minister is remarkable given that many observers had already written his political obituary after the Oct. 7 attack.
For his supporters, Netanyahu is the only person to be trusted with Israel’s security, especially given the threat from Iran. They
credit him for weakening
– albeit not defeating – the two non-state actors that most threaten Israeli security, Hezbollah and Hamas, and they praise him for ensuring President Donald Trump’s support for Israel.
Many also blame Netanyahu for not prioritizing the release of the Israeli hostages held in Gaza and prolonging the war there. He is also held responsible by many for the
precipitous decline in Israel’s international standing
and for jeopardizing Israel’s crucial alliance with the United States.
But it was domestic issues, rather than external ones, that motivated many of those who voted for anti-Netanyahu parties. Many fear that
democracy in Israel is under attack
, and they particularly oppose the effort by Netanyahu’s government to
weaken the power and independence of the Israeli judiciary
, which sparked massive street protests in 2023. They also strongly resent that Netanyahu’s government has allowed ultra-Orthodox men to avoid military service, despite the Israeli military’s growing manpower shortage. And on a personal level, Netanyahu is
widely perceived as self-serving and dishonest
– he is still on trial for corruption.
Arab voters have other, more specific concerns that drove them to vote in record numbers, in addition to the Netanyahu government’s policies in Gaza and the West Bank, which they strongly oppose. Chief among them is the
soaring rates of violent crime
in their communities, which the government – particularly the far-right Itamar Ben-Gvir, who oversees the police – has done nothing to address, say his critics. More broadly, many Palestinian-Arab citizens of Israel fear that if the far-right parties remained in power, their civil rights would be under threat.
What should we expect next?
The key thing to underline is what happens on election day in Israel is just the first stage in the process of forming a new government. Since no party ever receives a majority of seats in the parliament, what really matters is what happens after the election when the coalition building begins. This can take weeks, if not longer.
The party with the largest number of seats typically gets the first chance to assemble a governing coalition, but not always. Israel’s president, Isaac Herzog, will choose who gets the first chance to form a government based on who is most likely to succeed.
Right now, it looks like Eisenkot will get the first opportunity, but his only real option is to form a minority government that would depend on the parliamentary support of the Arab-majority parties – which some members of his Change Bloc adamantly oppose.
Despite the success of the Arab-majority parties in the election, it is unlikely they will be invited to be formal members of any coalition – although that has happened once in the past, when the United Arab List
joined the short-lived government
of 2021-22 led by Naftali Bennett and Yair Lapid.
If Eisenkot is unable to form a government, then Netanyahu will get the chance. He could try to entice some leaders of the parties in the Change bloc to defect and join a right-wing government under his leadership, or a broader “national unity” government with a rotating leader. Netanyahu
did that in the past with Benny Gantz
, but then he later prevented Gantz from becoming prime minister – so I doubt Eisenkot would agree to do this with Netanyahu.
There are reports in the media that the
Trump administration would like a national unity government
in Israel, so that might increase the pressure on Eisenkot to accept this outcome. And should war with Iran heat up again, that would increase the pressure.
The most likely scenario, I believe, is that neither Netanyahu nor Eisenkot will be able to form a government, and a new election will be called, with Netanyahu as caretaker prime minister until that vote. Netanyahu has reason to hope that his bloc will do better in another election, so that may well be his game plan. In which case, it will be many months until Israel has a new government.
===
Trumpism Is Running Out of Gas
Portside
portside.org
2026-11-03 18:28:23
Trumpism Is Running Out of Gas
Judy
Tue, 11/03/2026 - 18:28
...
When Trumpism has been strongest, its tenor has been insurgent, and it has operated in a populist register. Campaigning for the midterms, Donald Trump is no longer doing this. | Kevin Dietsch/Getty Images
I
have no special insight into what the exact outcome of this yearʼs midterm elections is going to be. It would be absolutely astonishing if Democrats failed to take the House, and the
latest
NY/Sienna poll has the Democrats leading in all seven of the races that will determine control of the Senate. This includes nonnegligible edges in both Texas and Kansas, the latter of which hasnʼt elected a Democratic senator since the early 1930s.
In Michigan, which has been getting a great deal of attention for
obvious
reasons
, Democratic candidate Abdul El-Sayed boasts a double digit lead, and several key gubernatorial races look to be leaning the same way. Donald Trumpʼs approval rating, meanwhile, is catastrophically low and has been dropping steadily. If Democrats donʼt make considerable gains across the board tonight, it will mean major polling companies got things badly wrong.
For other reasons that are less strictly related to polling, however, it has increasingly seemed to me that Trumpism is out of gas and may soon be on its last legs.
To reiterate something that cannot be repeated enough: Trump has never been particularly popular. So it was wrongheaded for shocked liberal commentators to throw up their hands and declare the country
lost
, both in 2016 and 2024. In order to consolidate its hold on the countryʼs politics, the Trump project ultimately needed to mobilize a larger popular coalition — something it has consistently proven unable to do.
In his second term especially, in fact, Trump has often seemed indifferent to public opinion and has looked visibly unconcerned when it comes to selling the administrationʼs direction to voters. (I
wrote about this
back in April specifically in relation to the US-Israeli attack on Iran, though there are certainly other examples.)
Beyond all this, Iʼve been struck by the nature of Trumpʼs midterm campaigning itself.
CNN recently published an interesting piece in which various reporters reflect on Trump’s rallies theyʼve been attending. Hereʼs how the piece opens:
Ballrooms. Cognitive tests. The male physique. As President Donald Trump closes out the midterm election season with a sprint through ruby red America, his message to voters has veered into some unexpected places. More than ever before, his stops have been remarkable because theyʼre about one thing: Trump himself. His message to voters is to pretend heʼs on the ballot, no matter how unpopular heʼs become. Concerns about the direction of the country, or the cost of living, are mostly shoved to the side.
Indeed, the substance of Trumpʼs speeches speaks to a political project that is increasingly exhausted and running on fumes.
When Trumpism has been politically strongest, its tenor has been insurgent, and it has at least tried to operate in some kind of populist register. It has successfully tapped into generalized anger toward the political class and rightly or wrongly (usually the latter) convinced at least some nontraditional GOP voters it will bring genuine heterodoxy to government. It has, albeit with deep incoherence, attacked the global trade consensus and hinted it will put an end to unpopular wars. It has promised jobs and reindustrialization. It has hit cost-of-living issues hard, even when engaging in more conventional right-wing messaging about immigration and culture war issues.
Trumpism has always been profoundly ugly. But here, again, it has found its greatest political success when able to democratize the ugliness somewhat. Its many appeals to racism and sexism have delivered politically when integrated into a larger narrative of hedonism — elect me and you, too, will have license to be nasty and say all the unsayable words again — and national renewal.
Here, for example, is an excerpt from Trumpʼs 2016 speech to the Republican National Convention:
America is a nation of believers, dreamers, and strivers that is being led by a group of censors, critics, and cynics. Remember: all of the people telling you that you canʼt have the country you want are the same people telling you that I wouldnʼt be standing here tonight. No longer can we rely on those elites in media, and politics, who will say anything to keep a rigged system in place. . . . My opponent asks her supporters to recite a three-word loyalty pledge. It reads: “Iʼm With Her.ˮ I choose to recite a different pledge. My pledge reads: “IʼM WITH YOU — THE AMERICAN PEOPLE.ˮ I am your voice.
The contrast between the above and how Trump has been speaking more recently is striking. The rank ugliness that has defined Trump-era conservatism from the beginning remains. Alongside the usual stand-up comedy, however, his midterm campaigning has also featured many moments like these, from the CNN piece:
The moment that stood out in Perry, Georgia, on October 24 was Trumpʼs assertion that the United States is “making hundreds and hundreds of billions, trillions of dollarsˮ in oil at a time when people are facing high prices at the pump. Appearing to recognize the disconnect, the president acknowledged his aides had advised him not to mention gas prices and oil. “My people said, ‘please donʼt mention that, sir!ʼˮ he said. Trump said the media would later report that “President Trump is talking about all the money we are making while people are suffering at the pump,ˮ in a kind of self-fulfilling prophecy. “I donʼt give a damn! Iʼm going to say it. Weʼre making a freaking fortune!ˮ he thundered.
At both stops on October 27, Trump dangled $5,000 checks for Americans if Republicans win control of the House and Senate. In Corpus Christi, he invited voters to spend their cash payment at Mar-a-Lago — before quipping they wouldnʼt be able to afford it. “You could even come to Mar-a-Lago,ˮ Trump said. “The problem is that for $5,000, the most youʼll be able to buy is a hamburger and maybe a small dessert. Iʼm not even sure you could buy that. No, donʼt go there. Thatʼs not a good place if youʼre price conscious.ˮ
Whatever he happens to be talking about — his war with Iran, the cost of living, his redecoration of the White House — Trumpʼs messaging, both on the campaign trail and off, has increasingly resembled the above. Thereʼs no hint of a populist undertone here. Thereʼs not even half-hearted attempt to sell the administrationʼs war with Iran nor any message about the cost of living beyond an emblematically cheeky assurance that everything is actually fine. When Trumpism has been most confident and politically robust, it has categorically not looked or sounded like this.
That, to say nothing of the polls, suggests to me that MAGA may really and truly be exhausted and about to suffer a significant body blow. Should that indeed happen, Trump may still be in a position to inflict plenty more harm — but will in all likelihood serve out the remainder of his time in office as a deeply unpopular and fatally compromised figure.
MKBHD on the New A20 Pro iPad Mini
Daring Fireball
www.youtube.com
2026-11-03 18:25:25
Marques Brownlee describes the two color choices as “annoyingly, slightly not black and slightly not white,” which is apt. He digs the acoustic display enough that he can imagine Apple bringing it to a future high-end iPhone (like if they do a big redesign next year for the 20th anniversary), but he...
This seems like a well executed mini-course on concurrency in Go.
I'd love to hear where it might be out of date or otherwise steering me wrong, as well as pointers to other good resources.
Comments...
Many Go concurrency books and tutorials are like: here's goroutine, here's channel, here's select — use them as you like. Others just throw concurrent patterns at you without really explaining them.
This is not very helpful: the most important thing in concurrent programming is not pure knowledge, but the understanding and ability to apply concurrency primitives.
That's why I've created an interactive book that teaches Go concurrency from the ground up through practical exercises. These exercises are simple enough to be solved with a single page of code yet are closely aligned with real-world scenarios.
The book is intended for programmers who are already familiar with Go, from language basics to interfaces and errors. You don't need any prior knowledge of goroutines and channels — we'll cover concurrency tools from the ground up.
Since the book targets experienced programmers, I've chosen a presentation style that I prefer: concise, focused, with exercises of moderate difficulty. Maybe you'll like it too.
Concurrent programming is a tricky beast, but I explain complex topics clearly, making them easier to understand. There are lots of examples and no dry theory.
There are dozens of interactive exercises that run directly in the browser. Each problem has an automated test suite that provides immediate feedback and a reference solution with an explanation.
There is no AI-generated or copied content. The book is 100% original.
Contents
The book is available online and as a PDF.
You can read the chapters using the links in the table of contents above, or purchase the book for full access to the interactive exercises (+ a PDF version).
REPACK is my favorite feature in Postgres 19. It's not the flashiest, but it is the one that’s going to matter most if you’re running a production database. Vacuum, autovacuum and bloat have always been this sore spot for Postgres users. On the one hand, Postgres MVCC design is not new. And yet, on high update systems, this churn of having dead rows that get freed up later, vacuum being tweaked to the right levels to maintain low bloat is still a bit of an inexact science.
Once bloat does exist, it’s just sitting there. And you see that unclaimed space not being used.
Before Postgres 19, your options for reclaiming that space were:
VACUUM FULL:
Built-in, but takes a read/write lock for the entire duration. On a large table, that means minutes of downtime.
dump/restore
: Fail over to a fresh database that is a clean snapshot.
pg_repack:
A third-party extension for online rebuilds from an external process. Generally a good option, but not without caveats and risks.
pg_squeeze:
Another third-party extension for online rebuilds via a background worker, also solid in production but again not without caveats and risks.
Enter Postgres 19:
REPACK CONCURRENTLY
: reclaims bloated table space while the table stays fully readable and writable, takes only a brief lock at the very end, and runs without any extension
How Postgres tables become bloated
Let’s back up. You may be familiar with bloat as a seasoned Postgres user, but just to make sure we’re all on the same page… It's one of those Postgres realities, the tradeoff for MVCC. Tables accumulate dead tuples over time: when rows are updated or deleted, the old versions stick around. Regular autovacuum typically marks that space as reusable. For most tables, that's enough. But for large, update-intensive tables, vacuum can fall behind. Dead rows accumulate as table bloat. The file grows, but since VACUUM can only mark that space as internally reusable, it doesn't shrink the table or return space to the OS. To actually reclaim disk space, you need to rebuild the table.
How do you know if you have a bloat problem? You can do a quick check using pg_stat_user_tables. The tuple counts are estimates, but this is one good diagnostic signal.
SELECT
schemaname,
relname,
pg_size_pretty(pg_relation_size(schemaname || '.' || relname)) AS size,
n_live_tup,
n_dead_tup,
CASE WHEN n_live_tup > 0
THEN round((n_dead_tup::float / n_live_tup::float)::numeric, 4)
END AS dead_tup_ratio,
last_autovacuum,
last_autoanalyze
FROM pg_stat_user_tables
ORDER BY dead_tup_ratio DESC NULLS LAST;
Below 50% bloat
: Generally acceptable. Monitor it and check autovacuum settings, but no urgent action needed.
Above 50% bloat
: You're likely wasting disk space and paying a performance cost from extra page reads. It's at least worth investigating — and possibly addressing — if you see slow queries or growing table sizes.
There is no single bloat percentage that determines whether a table needs attention. Consider wasted bytes, workload, growth, and whether reclaiming space is worth the rewrite.
How pg_repack works
The
pg_repack extension
was the option for online table rebuilds for years. Here's how it works:
External tool
: pg_repack runs as a command-line utility (pg_repack --table my_table -d mydb) from an external server or management host. You needed to install both the extension inside Postgres (CREATE EXTENSION pg_repack) and the client binary on whatever machine would run it.
Trigger-based change capture
: It creates a log table and installs triggers on your target table to capture all INSERT/UPDATE/DELETE operations during the rebuild. This adds trigger overhead on every write for the duration of the operation.
Shadow table approach
: It creates a new copy of the table, populates it from the original, replays the trigger log, then does a brief lock-and-swap, along with a final table rename.
This worked well, and many production systems relied on it for years. But installing third-party extensions makes some teams nervous, and the external binary adds operational overhead.
How pg_squeeze works
pg_squeeze
(from CYBERTEC, the same team behind much of the Postgres 19 REPACK work) came along and took a more modern approach. It's also seen wide production use.
Logical decoding
: pg_squeeze uses Postgres’ WAL-based logical decoding to capture concurrent changes. This means no triggers are installed on your table. This is the same approach that PG 19's built-in REPACK (CONCURRENTLY) now uses.
Background worker
: This runs entirely inside the database as a background worker process which means unlike pg_repack, you don’t need an external CLI tool. You can also configure it to run automatically when bloat thresholds are exceeded.
Still an extension
: Lots of folks prefer a built-in option, but this still requires wal_level = logical, a replication slot, compiling and installing the extension, and adding it to shared_preload_libraries.
pg_squeeze in a sense is the prototype for what became PG 19's REPACK (CONCURRENTLY). The built-in version inherits the logical decoding approach but integrates it directly into the server without an extension, shared_preload_libraries, or separate configuration tables.
Enter REPACK
Postgres 19 adds REPACK as a first-class SQL command with three modes:
-- Basic repack, like VACUUM FULL — takes ACCESS EXCLUSIVE lock
REPACK my_table;
-- Online repack using CONCURRENTLY just like you would with indexes
REPACK (CONCURRENTLY) my_table;
-- Online repack + reorder by index
REPACK (CONCURRENTLY) my_table USING INDEX my_index;
REPACK (CONCURRENTLY)
This is what makes the feature production-ready. With CONCURRENTLY, the ACCESS EXCLUSIVE lock is only held briefly at the end. During the bulk of the operation, which for a large table could take minutes, the table remains fully readable and writable.
INFO: repacking "public.repack_test" in physical order
INFO: "public.repack_test": found 0 removable, 1000000 nonremovable
row versions in 38452 pages
Time: 9406.788 ms (00:09.407)
Before: 493 MB → After: 228 MB (54% reduction)
Three options in play here:
CONCURRENTLY
: Rebuilds online, with only a brief exclusive lock at the very end for the file swap.
VERBOSE
: Prints progress at INFO level.
ANALYZE
: Runs ANALYZE after the repack completes to update planner statistics.
REPACK with USING INDEX
REPACK can also physically reorder your table's rows to match an index. If your workload frequently reads ranges of related rows, clustering with USING INDEX may improve locality. Measure the effect on your own queries; later updates are not automatically clustered.
This is a big deal for the REPACK feature beyond just bloat removal. It's a performance feature in its own right. For example, say you have an orders table and frequently query WHERE created_at BETWEEN '2026-01-01' AND '2026-01-31'. Without physical ordering, those rows could be scattered across hundreds of pages. With REPACK orders USING INDEX idx_orders_created_at, the rows are stored sequentially on disk in date order, so a range scan reads pages in sequence instead of random I/O across the whole table.
You might know CLUSTER from older Postgres versions. It did the same thing, but took a lock.
REPACK (VERBOSE, ANALYZE) product_inventory USING INDEX idx_product_category;
INFO: repacking "public.product_inventory" using index scan
on "idx_product_category"
Time: 15230.264 ms (00:15.230)
Before: 618 MB → After: 320 MB (48% reduction, rows now ordered by category)
REPACK vs. VACUUM FULL sample performance
I did some testing just to verify how this works. For the 493 MB test case with 1M live rows remaining after deleting 1M of the original 2M rows, the reported timings were:
Method
Time
Result
Table Accessible?
VACUUM FULL
2.7s
228 MB
No (locked entire time)
REPACK
5.9s
228 MB
No (locked entire time)
REPACK (CONCURRENTLY)
9.4s
228 MB
Yes (brief lock at end only)
In one test on a constrained system, REPACK (CONCURRENTLY) took 9.4 seconds for the stated table and test conditions. Results vary with table, indexes, workload, and hardware.
REPACK CONCURRENTLY is slower in wall-clock time. It's doing more work: logical decoding and WAL replay on top of the table rebuild. The tradeoff here is more time to keep your table online.
Requirements for REPACK CONCURRENTLY
You need 2x the space for the table and indexes you are repacking, since for a period, you will have two copies of it.
The table must be logged with WAL, cannot be UNLOGGED.
The table cannot be partitioned.
The table must have an indexable primary key.
The table cannot be a system catalog or TOAST table.
Only one concurrent REPACK can run per database at a time.
Tables using non-heap access methods are not supported.
A note on MVCC safety
: REPACK CONCURRENTLY is not fully MVCC-safe. During the brief final swap, a long-running transaction could theoretically miss concurrent changes. A concurrent transaction using a snapshot taken before repacking began can see the table as empty. This is the same limitation pg_repack had, and it's documented in the Postgres 19 release notes. Review this behavior against your workload’s transaction and consistency requirements.
When to use REPACK vs. VACUUM
Regular VACUUM and REPACK solve different problems:
Situation
Use
Why
Routine maintenance
VACUUM (autovacuum)
Marks dead tuples reusable, updates visibility map. Fast, no lock, runs automatically.
Some bloat, may be growing faster than autovacuum clears dead rows
Tune autovacuum settings
Adjust autovacuum_vacuum_scale_factor for large/busy tables. Also worth trying the parallel vacuum features in Postgres 19.
Table has high bloat AND you need disk space back
REPACK (CONCURRENTLY)
Rewrites the table, returns space to OS, table stays online
Table has high bloat AND you have a maintenance window
REPACK or VACUUM FULL
Faster than REPACK CONCURRENTLY, but locks the table
Range queries are slow on a column that has an index
REPACK CONCURRENTLY ... USING INDEX
Physically reorders rows for better sequential access patterns
Index is bloated but table is fine
REINDEX CONCURRENTLY
Rebuilds just the index without touching the table
The rule of thumb: autovacuum handles day-to-day maintenance. REPACK is for when you need to reclaim space back to the OS or physically reorder data, —hings that regular VACUUM fundamentally cannot do.
Estimating how long REPACK will take
REPACK time scales with table size, index count and available I/O. A rough model:
REPACK time ≈ (time to read entire table) + (time to write new copy) + (time to rebuild all indexes)
You can estimate this before running REPACK:
-- How large is the table + indexes that need to be rewritten?
SELECT
pg_size_pretty(pg_relation_size(relid)) AS table_data,
pg_size_pretty(pg_indexes_size(relid)) AS all_indexes,
pg_size_pretty(pg_total_relation_size(relid)) AS total,
n_live_tup AS rows_to_copy
FROM pg_stat_user_tables
WHERE relname = 'my_table';
From my tests on a constrained system (1 CPU, 512 MB, 4 MB maintenance_work_mem):
Table Size (before)
Live Rows
Time (REPACK)
Time (CONCURRENTLY)
493 MB
1M
5.9s
9.4s
839 MB
2M
7.5s
~12s (estimated)
1,252 MB
1.7M
17.2s
~27s (estimated)
The CONCURRENTLY overhead is roughly 1.5x to 2x the basic REPACK time, because it has to set up logical decoding and replay any concurrent changes. On a real production server with fast NVMe and more CPUs, these times would be significantly lower, but the ratio holds.
For very large tables (100+ GB), expect REPACK to take minutes to tens of minutes. Plan accordingly, and use pg_stat_progress_repack to monitor.
Monitoring REPACK progress
While REPACK is running, query pg_stat_progress_repack from another session:
SELECT
pid,
datname,
relid::regclass AS table_name,
command,
phase,
heap_tuples_scanned,
heap_tuples_inserted,
heap_blks_total,
heap_blks_scanned,
index_rebuild_count
FROM pg_stat_progress_repack;
The phases you'll see progress through:
Phase
What's Happening
initializing
Preparing to scan
seq scanning heap
Reading the old table sequentially
index scanning heap
Reading via index
sorting tuples
Sorting rows by index order
writing new heap
Writing compacted rows to new file
catch-up
Replaying concurrent DML (CONCURRENTLY only)
swapping relation files
Brief lock, swapping old/new files
rebuilding index
Rebuilding each index on the new heap
performing final cleanup
Done, cleaning up
You can estimate percent complete during the scan phase:
SELECT
phase,
heap_blks_scanned,
heap_blks_total,
CASE WHEN heap_blks_total > 0
THEN round(100.0 * heap_blks_scanned / heap_blks_total, 1)
END AS pct_complete
FROM pg_stat_progress_repack;
REPACK CONCURRENTLY is the most significant DBA-facing feature in Postgres 19. It brings online table rebuilds into core, eliminates the need for pg_repack, in most cases, and gives you a cleaner interface than the VACUUM FULL / CLUSTER split that's existed forever. If you manage tables with significant bloat in production, this is your upgrade reason.
Postgres 19 currently has a first release candidate (RC1) with an expected RC2 Nov 12 and GA expected later in November/December 2026. If you want to try REPACK today, spin up a beta instance and see how it performs on your most bloated tables.
Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
Bleeping Computer
www.bleepingcomputer.com
2026-11-03 17:18:50
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. [...]...
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.
OpsShield, the cPGuard developer, published an alert earlier today saying the attack began on November 2 at 02:06 UTC and affected versions 5.88.12 through 5.88.19.
The vendor says that it detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed the compromised cPGuard versions.
Although the company could not confirm, it said that some servers may have not received and run the malicious script due to update checks occurring at specific intervals.
The attacker leveraged legitimate credentials to gain initial access, although it remains unclear how they were obtained.
“On 2 November 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to gain unauthorized access to OpsShield’s update distribution infrastructure (CDN),”
OpsShield said
.
“The attacker used this access to distribute a malicious script through the cPGuard update channel.”
cPGuard is a Linux web-server security suite offering malware scanning, firewalls, and attack protection.
It is commonly used by hosting firms and server administrators alongside panels such as cPanel, DirectAdmin, and Plesk.
Namecheap offers it
on VPS and dedicated servers.
Users updating cPGuard during the compromise window received a script that targeted sensitive data on their machines:
Linux password hashes
Root database (MariaDB/MySQL) configuration
Root shell history
Root SSH authorization and known-hosts files
The stolen data was uploaded to OpsShield’s licensing server through a compromised account, which the attackers then used to retrieve it.
While OpsShield has not established what data was collected from each server, the company's evidence from the investigation shows that the threat actor retrieved 32 files from each customer.
System administrators are advised to update every cPGuard server to version 5.88.25 or later, reset passwords, and rotate database credentials, cloud secrets, and SSH keys.
OpsShield notes that updating to the latest cPGuard version removes the backdoor and staged files; however, stolen credentials must be invalidated as soon as possible.
The vendor also said that, as an extra precaution, it would release an update to remove previously installed OpsShield support-access keys.
BleepingComputer has contacted OpsShield to learn more about the attack, and a spokesperson told us that the incident has impacted nearly three thousand servers.
"We detected 2946 servers were affected and copied the information mentioned, and our billing system database was copied over as well. We are working on blocking all access, rebuilding the affected systems, and preparing for a public announcement at the earliest possible time," the company representative said.
The company also advises customers to follow the instructions and update cPGuard to version 5.88.25 or later, and reset or rotate credentials that may have been exposed on potentially compromised servers.
US tech stocks recover after selloff spooks investors over AI spending
Guardian
www.theguardian.com
2026-11-03 17:18:45
Midterms didn’t appear to have huge impact, though predicted wins for Democrats could mean more regulation US tech stocks made a recovery on Tuesday afternoon after a selloff spooked investors over AI spending. Tuesday’s midterm elections didn’t appear to have a huge impact on Wall Street, though in...
US tech stocks made a recovery on Tuesday afternoon after a selloff spooked investors over
AI
spending.
Tuesday’s
midterm elections
didn’t appear to have a huge impact on Wall Street, though investors are predicting Democrats get at least a majority in the House and potentially gain seats in the Senate, which could lead to more AI regulation.
The S&P 500 was up 0.37% at market closing on Tuesday, while the tech-heavy
Nasdaq
increased 0.83% for the day. The Dow dropped 0.38% following a 1.9% dip in Apple’s share price after the company released a worse-than-expected margin forecast due to the higher cost of memory chips.
Nvidia picked up a 2.3% gain after dropping over four sessions, while fellow chipmakers Advanced Micro Devices, Broadcom and Micron Technology also jumped Tuesday.
Tuesday marked the end of a brief selloff of AI and tech stocks that started last week, with the Nasdaq in October experiencing its largest monthly decline since March 2025. The Nasdaq had ended on Monday in correction territory, dropping 10% from its 6 October
record close
.
Small drops in oil prices, amid potential new negotiations with Iran and Russia, also eased investors. Brent crude, the global oil benchmark, dropped to $103 a barrel on Tuesday, down from $117 a barrel at the end of October.
While many Americans say frustration with the higher cost of living will be a
major factor
in their vote on Tuesday, Wall Street has continued to soar off investments in AI, particularly the chips and infrastructure used to power the technology. The S&P 500 is up 10% for the year so far, while the Nasdaq and the Dow are up 9% and 7%, respectively.
Analysis
from CNBC of post-midterms market performance from 1980 to 2024 showed the market tends to pick up after an election. Wall Street is often jittery before an election, when results are uncertain, but recover once results are settled.
hppa: Added support for eager FPU switching. Currently enabled only for QEMU to work around an emulation bug, may eventually become the default for improved safety.
mac68k: Honour requested keyboard bell volume for akbd(4) devices.
(
PR 60691
)
mips: Fixed problems with MIPS Malta platform code found running under QEMU.
mips: Fixed various problems discovered with the Kernel Undefined Behaviour Sanitizer.
(
PR 60780
)
sparc64: Enhanced support for sensors on Sun Ultra 25/45 and Sun Fire V215/V245, including front panel temperatures, fan speeds, and disk presence indicators. LEDs on Sun Fire machines can now be controlled via sysctl.
sparc64: Added support for the i2c controller found in Pyro-based machines (e.g. Sun Ultra 45, Sun Fire V245).
sparc64: Added support for the real-time clock used in the Sun Ultra 45.
sun68k: Fixed booting from SCSI disks with certain PROM revisions.
Kernel and MI device drivers
ffs: Fixed an
uvm_fault
occurring during snapshot dump/restore.
(
PR 59663
)
ipfilter: Fixed a
NULL
pointer dereference leading to potential DoS while parsing ICMP6 packets.
(
PR 60484
)
net: Fixed an off-by-error in a bounds check in
bsd_decompress()
.
uvm: Fixed a race condition in the page daemon.
vfs: Limit snapshot-related
vflushbuf: dirty: vnode [...]
console spew under heavy load.
acpibat(4)
: Added support for battery monitoring on the Microsoft Surface Go 3.
hdaudio(4)
: Apply access checks to configuration operations on
/dev/hdaudioX
.
(
PR 60492
)
ixl(4)
: Fixed driver hang, then failure on ifconfig, if SFP module present at boot time and media connected.
(
PR 60736
)
The complete list of changes can be found in the
CHANGES
and
CHANGES-11.1
files in the top level directory of the NetBSD 11.1
release tree.
Getting NetBSD 11.1
Complete source and binaries for NetBSD 11.1 are available for download
at many sites around the world. You can download NetBSD 11.1 from our
main CDN
,
or use a
mirror site
close to you.
A list of hashes, signed by the
NetBSD Security Officer's PGP key
, is
available for the NetBSD 11.1 distribution in
this file
.
NetBSD is free. All of the code is under non-restrictive licenses,
and may be used without paying royalties to anyone. Free support
services are available via our mailing lists and website. Commercial
support is available from a variety of sources. More extensive
information on NetBSD is available from our website:
System families supported by NetBSD 11.1
The NetBSD 11.1 release provides supported binary distributions for
the following systems:
Ports included in the release but not fully supported or functional:
Acknowledgments
The NetBSD Foundation would like to thank all those who have
contributed code, hardware, documentation, funds, colocation for
our servers, web pages and other documentation, release engineering,
and other resources over the years. More information on the people who
make NetBSD happen is available at:
About NetBSD
NetBSD is a free, fast, secure, and highly portable Unix-like
Open Source operating system. It is available for a wide range
of platforms, from large-scale servers and powerful desktop
systems to handheld and embedded devices. Its clean design
and advanced features make it excellent for use in both
production and research environments, and the source code is
freely available under a business-friendly license. NetBSD is
developed and supported by a large and vibrant international
community. Many applications are readily available through
pkgsrc,
the NetBSD Packages Collection
.
About the NetBSD Foundation
The
NetBSD Foundation
was
chartered in 1995, with the task of overseeing core NetBSD project
services, promoting the project within industry and the open
source community, and holding intellectual property rights on much
of the NetBSD code base. Day-to-day operations of the project are
handled by volunteers.
As a non-profit organization with no commercial backing, the NetBSD
Foundation depends on donations from its users, and we would like to ask
you to consider
making a donation
to the NetBSD Foundation in support of continuing production of our
fine operating system. Your generous donation would be particularly
welcome to help with ongoing upgrades and maintenance, as well as
with operating expenses for the NetBSD Foundation.
PostgreSQL is a well-designed, open-source multi-purpose relational database system which is widely used throughout the world.
It is one huge system with the integrated subsystems, each of which has a particular complex feature and works cooperatively with each other.
Although understanding of the internal mechanism is crucial for both administration and integration using PostgreSQL, its hugeness and complexity make it difficult.
The main purposes of this documentation are to explain how each subsystem works, and to provide the whole picture of PostgreSQL.
This documentation covers versions 19-beta (excluding the new buffer page lock mechanism) and earlier.
I graduated from graduate school in information engineering (M.S. in Information Engineering),
have worked for several companies as a software developer and technical manager/director.
I published seven books in the fields of database and system integration (4 PostgreSQL books and 3 MySQL books).
In June 2019, the Chinese book of this documentation was published.
As a director of the Japan PostgreSQL Users Group (2010-2016), I organized the largest (non-commercial) technical seminar/lecture on PostgreSQL in Japan for more than six years,
and also served as the program committee chair of the Japan PostgreSQL Conference in 2013 and as a member in 2008 and 2009.
Cuando era joven, vivió en Sudamérica por unos años. Recientemente, a veces vuelve a allí.
I am seeking a remote position focused on the application of ML and AI technologies to DBMS.
For personal reasons, I will be living in Japan for several years.
Please read the following FAQ before sending messages.
Since publishing my content, I’ve been fortunate to receive a lot of positive feedback, which is truly gratifying.
However, unfortunately, I’ve encountered individuals in the past who tried to misuse my content for self-promotion
1
.
These experiences have shaped the approach I’ve outlined below.
Who can use this documentation freely?
If you are a teacher or a student belonging to an educational organization, you can freely use this documentation and figures in your study.
Anyone can use this documentation and figures with noncommercial meetings and lectures, if you state the link to this site and the copyright; otherwise, contact me.
Is it available for commercial contents?
This content can be used under two options:
There was a comment on Hacker News that took this seriously, but of course, it’s a joke.
To be clear, I have no intention of having any commercial ties to this.
Regardless, you can imagine the kind of requests I get on a daily basis.
Revenue Share:
You can leverage this content after a revenue share agreement is signed.
Under this agreement, you’ll share 20% of the sales generated from using this content.
Full Buyout:
In very rare cases, I consider requests for full commercial use of all content on this site.
For a complete buyout of all content rights, the cost is €5,000,000.
Does the author need any help to write?
No. I am writing for my own enjoyment.
Even if you send me your article, I will never include it in my documentation.
Why doesn’t the author use the GitBook or other e-book formats/sites?
I am using the best tools I need and I will decide what I use.
I am always trying a lot of tools for better explanations.
Simply put, this documentation is optimized to read on html file and it is hard to convert to other formats.
I do not have any plan to make PDF version and Smartphone versions because of same reason.
Why doesn’t the author use RSS to notify the update?
I keep my domain and my server to provide my documentation; you can read when you want to read. What do you want more?
Why doesn’t the author waive the copyright of this documentation or use the creative commons license?
I’d like to ask you what problems you have by that I keep on having the copyright of my documentation.
After reading, send a message to my twitter in public.
or
If you use email, please
provide at least two SNS addresses (e.g. LinkedIn, Twitter) for verification purposes
. Due to the XZ backdoor incident, I no longer accept contact from anonymous individuals.
For any inquiries regarding the use of this documentation or any of its figures, please contact me.
Exception
Educational institutions can use this documentation freely.
Postal Service Surveilled Protest Activities Online With Little Rules, Oversight
Electronic Frontier Foundation
www.eff.org
2026-11-03 16:45:46
The U.S. Postal Service used social media surveillance to monitor and report on protests across the political spectrum, government records show.
The records, disclosed to EFF and other requesters suing the postal service under the Freedom of Information Act, show that the agency’s internet Covert Op...
The U.S. Postal Service used social media surveillance to monitor and report on protests across the political spectrum, government records show.
The
records
, disclosed to EFF and other requesters suing the postal service under the Freedom of Information Act, show that the agency’s internet Covert Operations Program, or iCOP, routinely sifted through social media posts organizing and discussing protests with little records of any oversight or legal justification.
EFF filed
suit in 2021
after
Yahoo News
disclosed the program’s existence and how the agency used it to monitor First Amendment protected activities. After years of delays and technical failures that led the agency to lose access to a trove of emails discussing the program, the postal service disclosed records to EFF and several other requesters this year.
The Postal Service used iCOP to surveil First Amendment activities
The disclosures include a series of bulletins created from iCOP, which show that the postal service used the program in 2020 and 2021 to monitor and circulate information about a wide range of planned protests. They included a planned “
Million MAGA March
,” a
guns rights advocacy
event and counter-protest in Virginia, a nationwide
Save the Post Office Saturday protest
, and
planned protests
in front of then-Postmaster General Louis DeJoy’s home in Washington, D.C.
Many of the bulletins provide dry descriptions of the events being planned and reference public discussions or events on major social media services. Others seem to imply or anticipate that the protests would turn violent.
For example, in discussing planned national and international protests
scheduled for March 20, 2021
, the bulletin references potential violence in light of “online inflammatory material.” Yet the bulletin acknowledges that the agency has “no intelligence to suggest specific threats.” This bulletin was described by Yahoo News when it disclosed iCOP’s existence.
Another bulletin discussing an ongoing Black Lives Matter protests in response to police shooting and killing people styles itself as a “
National Civil Unrest Update.
” The bulletins also recount and monitor threats sent to then-Postmaster DeJoy.
The Postal Service also disclosed three email chains to EFF that, while heavily redacted, show how the agency queried iCOP and disseminated what it found (Read the emails
here
,
here
, and
here
). The government agreed to release the email messages as part of settling EFF’s FOIA suit this fall. To EFF’s knowledge, they are the only existing materials that reflect how the agency queried iCOP.
Postal Service renames iCOP and loses access to records about it
At the same time, EFF and several other FOIA requesters sought records detailing how the agency used iCOP and what rules the postal service had for using the program and distributing information it gained from surveilling social media. EFF spent years pushing the agency to disclose email communications about the program, which the agency had stored on an external hard drive. Amid these negotiations, someone dropped the hard drive, rendering it inoperable,
agency officials said
. By the time that happened, the agency had already deleted the underlying email messages pursuant to the agency’s retention schedule.
Minimal records disclosed about internal limits on surveillance programs
EFF’s FOIA request sought internal rules, guidance, and training that would show what safeguard the Postal Service imposed to protect First Amendment rights. The agency disclosed very few documents in response to this part of EFF’s request.
For example, a series of
slides
give an overview of the program, but do not explain how officials used iCOP. The closest thing to internal guideline that the agency disclosed were
talking points
the Chief Postal Inspector authored in response to questions about iCOP.
The inspector wrote that, “In reviewing social media postings to gather information we did not single out any particular group and did not base what was reviewed on race, religion, gender, sexual orientation, immigration status, or a person’s exercise of First Amendment freedoms.” The statement echoes language in the
bulletin
stating that its purpose is not to infringe on First Amendment rights; Other parts of the talking points characterize the surveillance as providing officials with situational awareness.
The postal inspector’s talking points go on to say that “the recent attention on iCOP has highlighted opportunities for improvement, including enhanced executive oversight. We have stopped the distribution of the bulletins like the one you have seen in the media reports.”
Setting aside that it’s unclear whether internal oversight occurred or resulted in any changes, the claim that iCOP did not infringe on First Amendment rights rings hollow. As the records disclosed show, surveilling and reporting on social media users’ efforts to organize rallies and protests was a feature of iCOP.
But more fundamentally, the claims by Postal Service officials fail to recognize that
surveillance
directly chills First Amendment rights. Further, the government can misuse the information it obtained as part of its social media surveillance to harass or retaliate against those exercising their constitutional rights.
Although EFF’s case seeking records about iCOP has ended, we will continue to bring more transparency to the government’s use of social media surveillance and look for ways to challenge the practice, especially when people are caught in the dragnet for exercising the First Amendment rights.
The Little Book of Generative AI Foundations: An Intuitive Mathematical Primer
Abstract:
This book provides a compact, derivation-oriented introduction to the mathematical foundations of modern generative artificial intelligence. Rather than surveying every recent architecture or implementation detail, it develops a coherent route through the ideas connecting major families of generative models, from PCA, probabilistic PCA, variational autoencoders, and diffusion models to normalising flows, autoregressive factorisations, GANs, Wasserstein GANs, and energy-based models. The aim is to make the structure of generative modelling more accessible without removing the mathematical substance needed to understand how these models are derived and related. The book is intended as a foundation-building primer for mathematically curious researchers, practitioners, and students.
Submission history
From: Tianhua Chen [
view email
]
[v1]
Thu, 28 May 2026 10:12:00 UTC (125 KB)
[v2]
Tue, 8 Sep 2026 07:17:36 UTC (1,168 KB)
We’re excited to announce Adaptive Dark Mode in Safari 27.3 beta. When enabled by a user, Safari adapts light websites and presents them as dark.
In the spring of 2019, Safari 12.1 became the first browser to support dark mode on the web. A lot of people love using dark mode, but not every website has a dark version. Almost
40% of web page loads
are from users in dark mode, and yet
only 10%
of page loads support it. If you love dark mode, you’ve probably hit a site that felt particularly
bright
. Adaptive Dark Mode is designed to close that gap, providing a consistent dark experience across the web.
You can try it today in Safari 27.3 beta. To enable, first make sure your system appearance is set to dark. Then browse to a website with a bright background. Safari will offer a preview of Adaptive Dark Mode. Tap ‘Try’.
For websites that signal support of dark mode with
<meta name="color-scheme" content="light dark">
in HTML or
color-scheme: light dark
in CSS, Adaptive Dark Mode does not change a thing. For the rest of the web, it quickly analyzes the page, looking at colors and estimating whether it’s predominantly light or dark. If the page generally has a dark background with light text, nothing is changed. When a page has a light appearance, Adaptive Dark Mode adapts the page to be dark.
How does Adaptive Dark Mode work?
At the core of Adaptive Dark Mode is the transformation of color. Sometimes colors are simply decorative, while other times they have semantic meaning. Adaptive Dark Mode determines when to invert colors so elements remain visible or when to leave colors unchanged.
While creating Adaptive Dark Mode, we developed a color matrix to invert the luminosity of colors while preserving hue. It’s used to make light backgrounds dark, and dark text light. When transforming text color, Adaptive Dark Mode aims for sufficient contrast as defined by the
WCAG 4.5:1 contrast ratio
. Light CSS gradients are also transformed to dark.
Adaptive Dark Mode makes careful judgments so transformed content looks good and stays usable: buttons have contrast against backgrounds, text is visible over images, and hover menus look clear.
It takes the same care with images. Most are left unchanged, preserving their integrity. But many icons and logos can lose contrast when the background color behind them is inverted. So Adaptive Dark Mode inspects SVG images and transforms colors when needed. For bitmap images, it analyzes the pixel histograms and inverts simple black-and-white logos.
Effects like masks and
mix-blend-mode
can create undesirable results on an element whose colors have been transformed, so in some cases Adaptive Dark Mode turns such effects off. Also,
<canvas>
content is left unchanged, since canvases contain a wide range of content that’s hard to predict.
It’s precisely because Adaptive Dark Mode is happening deep within the WebKit browser engine that we are able to find creative ways to solve the most complex challenges, apply the transformations with great speed and power efficiency, all while rigorously protecting user privacy.
Making your site work even better
In general, a web page will work well with Adaptive Dark Mode if it follows good modern web development practices.
If your site still uses older techniques, small updates can help. For logos and icons, swap bitmap images for SVG. Use solid or gradient colors in CSS instead of tiled background images. Replace image sprites with modern CSS for rounded corners, shadows, and button states. Create content images with transparent backgrounds instead of baking the page background color into the image. Add padding to containers to prevent crowding.
Perhaps you want a specific dark mode experience for a certain portion of the page. Apply
color-scheme: light dark
to the relevant element and add your own dark styles.
Building your own dark mode
For complete control over how your site looks in dark mode, add full support. It’s a terrific time to do so. It’s never been easier.
Here’s an example of a website in light mode (left) and with Adaptive Dark Mode applied (center). If the site creates a custom dark mode, it could look like the third version (right).
All the web technology needed to fully support dark mode is widely available today, including:
Newer CSS functions like
color-mix()
and
contrast-color()
, plus popular techniques for organizing design systems with CSS variables provide additional options and flexibility.
Be sure to declare dark mode support using the
color-scheme
meta tag in your HTML head and/or by setting the
color-scheme
property on
:root
or
body
in your CSS. Don’t wait to inject this information later via JavaScript. This best practice helps ensure your site is rendered correctly as fast as possible.
Using the “light only” color scheme
If you would like your web app or website to not be transformed by Adaptive Dark Mode, you can communicate this using
color-scheme
. The HTML
<meta name="color-scheme" content="light only">
tag lets browsers know that 1) this page supports
light
mode and 2) should
only
be displayed in light mode. The
color-scheme: light only
rule does the same thing, but with the flexibility of CSS, allowing you to just target specific elements on the page — or of course, you can target the whole page with
:root { }
. (Note: the ‘only’ keyword is not supported in Safari 27.3 beta 1. Check back as Adaptive Dark Mode evolves through the beta process.)
Protecting user privacy
Apple firmly believes user privacy is a fundamental human right. If websites could detect when a user has enabled Adaptive Dark Mode, that would increase the amount of fingerprintable information and weaken privacy protections against trackers.
As a result, Safari prevents websites from detecting when Adaptive Dark Mode has been applied. JavaScript that queries CSS colors will get the original authored colors, not the transformed ones. Any images drawn into canvas render in their original form.
Feedback
If you manage a website or web app, and would like to discuss how Adaptive Dark Mode is adapting your project, feel free to reach out at
web-evangelist@apple.com
.
If you try out Adaptive Dark Mode as a user, and find a site that does not work well, we’d love for you to file a report with
Feedback Assistant
. (Learn more about
filing Feedback
).
AI ‘godfather’ Geoffrey Hinton: it might turn out we were better off without AI
Guardian
www.theguardian.com
2026-11-03 16:35:42
Nobel winner warns the tech could be near to triggering major incident such as power or banking shutdown One of the “godfathers of AI”, Geoffrey Hinton, has said it could turn out that humans would have been better off never developing the technology as he warned it could trigger a large-scale incid...
One of the “godfathers of AI”, Geoffrey Hinton, has said it could turn out that humans would have been better off never developing the technology as he warned it could trigger a large-scale incident this year or next, such as a temporary blackout of financial or power systems.
The Nobel prize-winning computer scientist told the Guardian he is not a “doomer” about the technology that is underpinned by his groundbreaking research into artificial neural networks and believes AI has the potential to lead to a “wonderful future” but he said “it might be that we would have been better off never developing it”.
Hinton, 78, said that within a decade and possibly sooner, humanity will know whether it can manage the technology’s risks and enable what he called “radical abundance” or whether “we fail to manage the risks and … have a huge gap between rich and poor, huge cultural problems, massive unemployment, just society being torn apart”.
Hinton was speaking before a screening of a new feature-length documentary, AI: Probably Nothing to Worry About – a title suggested by an AI chatbot – featuring him and his former Google colleague Demis Hassabis. Hinton tells the documentary makers: “I feel I have a duty. I’ve got a reputation that makes me a spokesperson and I need to burn it all on this.”
Speaking to the Guardian, Hinton took aim at the risk-taking by the leaders of some of the major AI companies who continue to release ever more powerful AI models as they race for supremacy and market-share, saying he didn’t trust
Sam Altman
, the chief executive of the ChatGPT maker, OpenAI, “at all”. “I think [Mark] Zuckerberg and [Elon] Musk and Sam Altman, they understand the risks, and they don’t give a shit. They’d rather have the money. That’s my belief.”
The London-born computer scientist, who grew up in Bristol and spent much of his career at the University of Toronto, said it was “extremely worrying” that Altman was in charge of one of the handful of frontier US AI companies currently leading a race with China to develop the most powerful AI. Altman insisted in September: “the world should trust we are going to do the right thing because it’s the right thing and because we feel the magnitude of this”.
Hinton has been working on AI for about 44 years and in the 1970s coined the concept of the neural network – a mathematical system that could learn and gain experience much like humans do. In 2023 he quit Google to speak freely about AI risks,
warning
: “If these things get carried away with getting more control, we’re in trouble.”
He said he viewed incidents this summer in which
OpenAI
AI agents conspired to hack into the Hugging Face website as akin to 1979’s partial nuclear meltdown at the Three Mile Island power station in Pennsylvania – effectively a warning shot.
“Either later this year or next year we’ll see Chornobyl, and that may be enough to make people really pay attention,” he said.
This Chornobyl-type of event would not be a nuclear incident, according to the examples he gave, but rather could include an AI-enabled attack on the electricity-generating system that “causes a massive brownout” or an incident that brings down the financial system for a week.
“Can you imagine what would happen? We could recover from it [but] that would make them sit up and take notice.”
Asked who “they” were, he said: “world leaders other than Trump”.
The US president, Donald Trump, has said he “
totally rejects any attempt to construct a globalist scheme
” to control AI and wants frontier AI companies to regulate themselves, amid concern that rules could hinder the US in its AI race with China. Hinton backs a tougher plan endorsed by the president of Finland and 32 other countries, including Singapore, Germany, Canada and Australia, for mandatory testing of frontier AI models, independent evaluation and intergovernmental common standards.
The UK prime minister, Andy Burnham, has said he will use the UK’s G20 presidency next year to seek agreement on a “single set of global principles and standards that are very much about unlocking the full potential whilst guarding against the risks”.
Hinton said: “We need something like the American FDA for drugs where the companies have to give very good statistical evidence to an independent authority that [the AI model] does more good than harm before it is released. We discovered with thalidomide [a drug developed in the 1950s that caused severe birth defects] that releasing and then suing them isn’t the right way to do it. What the big tech companies are saying is treat it like we treated thalidomide.”
Hinton’s role as one of the progenitors of AI has led to comparisons to Robert Oppenheimer, who was central to the creation of nuclear weapons. One of Hinton’s friends even bought him an Oppenheimer-style hat. But he insists: “I was not Oppenheimer”, citing the thousands of other scientists also working in the same field of neural networks.
Despite his warnings, Hinton remains, on balance, hopeful that catastrophe can be averted.
“My gut is that we’re still in control,” he said. “We might well be able to do something. It’ll only work if we put a big effort into it, but we might well put a big effort into it.”
WorkOS says attacker used ARTEX AI to breach internal sales app
Bleeping Computer
www.bleepingcomputer.com
2026-11-03 16:28:44
Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications. [...]...
Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications.
According to the company, the attacker used an AI offensive security framework to automate reconnaissance and exploitation attempts.
Based on evidence from the investigation, no WorkOS app data or production services were accessed or affected.
WorkOS is a developer infrastructure company that provides APIs, SDKs, and tools for integrating services such as enterprise authentication, single sign-on (SSO), user management, and identity management into applications.
According to its website, at least
3,000 companies
use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.
“On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an
incident alert
.
Data accessed by the attacker includes:
Business contact details (names, email addresses, job titles, and company affiliations from the CRM systems)
Customer account histories (product usage and connection or directory health)
Customer communications (summaries and excerpts from sales calls, support discussions, and customer Slack conversations)
Business account and relationship information (account histories, information about sales and customer relationship)
After detecting the intrusion, WorkOS disabled external access to the affected application and reviewed its access controls on internal tools.
The company also contracted an independent forensics and incident response firm to track the unauthorized activity and determine its full impact.
The company promised to notify affected customers directly, and warned its users to remain vigilant for phishing or social engineering attempts leveraging the exposed information.
ARTEX AI likely powering the attack
WorkOS’s announcement says the attack used an AI-powered offensive security framework to automate reconnaissance and exploitation attempts.
Company founder Michael Grinich
shared more details
, saying that the attacker used the ARTEX AI penetration testing suite that has been observed in multiple incidents this year.
Released earlier this year by Chinese developers, the platform was available as an open-source project for offensive security.
More recently,
CrowdStrike revealed
that cyber-espionage group “Vapor Panda” used the pentesting framework in a global campaign targeting 200 organizations.
Previously, the non-profit cybersecurity organization DIVD also revealed that the same framework powered the attacks it
suffered last September
.
Grinich
explained
that the investigating team identified user agents such as ‘artex-enrich/1.0’ and ‘norma/0.4’ in web requests from the threat actor.
The founder assured that the cybersecurity incident has now been fully contained and promised to share more information about the attack after the investigation completes.
PALO ALTO, California -- U.S. tech giants' off-balance-sheet debt from artificial intelligence-related obligations continues to balloon, almost doubling in six months to about $3.2 trillion, with investors increasingly alarmed by seemingly unending spending.
The AI Boom May Be Sowing Seeds of Another Financial Crisis
We've detected unusual activity from your computer network
To continue, please click the box below to let us know you're not a robot.
Why did this happen?
Please make sure your browser supports JavaScript and cookies and that you are not
blocking them from loading.
For more information you can review our
Terms of Service
and
Cookie Policy
.
Need Help?
For inquiries related to this message please
contact
our support team
and provide the reference ID below.
Salem, the morning after Halloween. Meg Ashcombe, the last of her family, lies at the foot of her grand staircase, one slipper on the thirteenth step, the front door bolted from inside. Half the town says the Grey Captain finally took her.
Every case happens in a real neighbourhood. Find the clues, open what is locked.
02
Question the suspects
Ask your own questions, typed or spoken, in any of the game's six languages. Each suspect answers in their own voice. Some of them lie.
03
Catch the lie, then report
Hold a clue against a statement. When the lie cracks, write your report: three tries, not one more.
A world tour to learn. Then the real cases.
Paris, Rio de Janeiro, Marrakech, Tokyo, Sydney: five training levels, each harder than the last. Then come the real cases, harder still. Each one shows how many investigators have solved it. For most of them: nobody. Not yet.
Nobody has solved it yet
One city, one secret
The first time you open a case, you fly there across the map. Solve it, and its city is stamped in your passport.
Venice
Lisbon
Edinburgh
Amsterdam
Cusco
Seoul
Cape Town
New York
Help and contact
A question, a bug, a suspect's line that goes wrong: write to us. In the game, “Flag” under a line sends it to us directly.
The game is played without an account. To erase everything: Settings → “Start over” → “Erase everything”. Without the phone that created your player, write to us.
Kairos
decides every sign-up, login, order, payment and payout as it happens, and keeps each decision with the signals behind it. It is an open-source alternative to Sardine, Sift, Riskified and SEON, with two things they don't have:
your coding agent tunes it
, and
decision models
catch fraud before you have the labels to train on.
Decisioning
Real-time decisions
: one call returns approve, step up, review or block, with a risk score and the reasons, from the subject's history, the devices, cards and addresses it shares with others, and the session.
Workflows
: ask a decision model, score with a model, branch, call webhooks, open cases, and decide again later.
Queues and cases
: review work for people, whose resolutions become labels.
Agent-first
MCP server
: Claude Code, Cursor or Codex read your decisions and build workflows, with every action recorded under its key.
Experiments
: your agent proposes model variants, Kairos trains and tests them on your data, and the agent ships the winner.
Decision models and traditional ML
Grayson
: Finic's decision model answers questions about each request in plain language. It works with few labels and reads unstructured data.
Models
: logistic regression and gradient-boosted trees (XGBoost-compatible) on your numbers and Grayson's answers, trained in Kairos or uploaded.
An AI fraud ML engineer, always tuning on your data
You send Kairos what happens in your product: sign-ups, logins, orders, payouts, chargebacks. It decides each request (approve, step up, review or block) and keeps every decision with the signals behind it.
What makes Kairos different is who tunes it. Connect Claude Code, Cursor, Codex or any agent over
MCP
, and the agent can do the work of a fraud ML engineer:
Build the workflow.
It defines what to decide, which questions to ask a decision model, and which fields to score.
Design experiments.
It proposes variants: a decision model alone, logistic regression on your numbers, gradient-boosted trees, a stack of them, or the decision model's answers combined with your numbers in one model.
Let Kairos run them.
The server trains each variant on your oldest labeled data, chooses on the next, and tests on the newest, then reports ROC-AUC, PR-AUC, the gain over a baseline with its 95% interval, and precision and recall at your thresholds.
Pick the winner and ship it.
The agent explains its choice, applies the variant as the workflow's next version, and comes back when new labels arrive.
You: "Our chargebacks went up. Find a better model for shopify_order and publish it if it wins."
Agent: designs six variants → create_workflow_experiment → reads the results →
"Logistic regression on the order's numbers plus Grayson's answers wins: ROC-AUC 0.949 on validation,
0.930 on test. Publishing it as v6."
Decision models and traditional ML, together
Kairos is built around
Grayson
, Finic's decision model. You ask it questions in plain language ("Does the shipping address look like a reshipper?", "Is this email throwaway?") and it answers with calibrated probabilities. Decision models are strong where traditional ML is weak:
Few labels.
Grayson works on day one, before you have the thousands of chargebacks a model needs to learn from.
Unstructured data.
It reads descriptions, emails, names, addresses, notes and item titles, which a gradient-boosted tree can't.
Explanations.
Every answer is a question you wrote, so every decision says why.
Traditional models are strong where decision models are weak: they learn your own outcomes precisely, from your own numbers, and they cost nothing per decision. Kairos lets you combine both: Grayson's answers become features next to your fields in a
logistic regression
or
gradient-boosted trees
(XGBoost-compatible, trained in Kairos itself), and experiments tell you which combination wins on your data.
Get started
Kairos Cloud
Sign up at
kairos.finic.ai
. Create a sandbox environment, a secret key, and you're ready to send events.
Connect your agent
In the console, open
Settings › MCP
, turn on the tool groups your agent needs, and create a key. Then, in Claude Code:
Cursor, Codex and VS Code work the same way: see
MCP for agents
. Then ask your agent to look at your decisions, build a workflow, or run an experiment.
pnpm kairos signup # the local server, a new account
pnpm kairos login --profile prod --url https://kairos.finic.ai --email you@example.com
pnpm kairos keys create "My server"# a secret key for your code
pnpm kairos actions define withdrawal --data @withdrawal.json
pnpm kairos import events transactions.csv --type transaction --ts created_at --entity user=customer
pnpm kairos decide withdrawal -e user=user_42 -p usd=900
pnpm kairos workflows run review_payout -i user=user_42 --wait
pnpm kairos --help # every command
To have
kairos
on your path, run
pnpm link --global
in
apps/cli
.
Integrations
Shopify:
decide every order, hold risky ones for review, and learn from chargebacks. To get the Kairos app for your store, reach the Finic team on
Discord
or at
support@finic.ai
.
Inbound webhooks:
take events from providers such as Stripe. See
Inbound webhooks
.
mine-app
is a complete, all-in-one, packaged application with no dependencies. It Just Works™, or it’s a bug.
mine-core
is a hacker-friendly “bring your own compliant terminal” variant. It allows you to use
mine
at your own command line, but requires a terminal that has a Unicode font, supports rich colors, and supports the Kitty keyboard protocol.
Coalton and Common Lisp
Coalton? Common Lisp? Both? The editor is exclusive to neither, and both come built-in. If you want strong, static types with a flavor of functional programming, Coalton is available. If you want free-wheeling dynamicism and an advanced object system, Common Lisp is available. You can use one, the other, or mix-and-match as your project demands.
Integrated REPL and Code Beaming
The REPL is completely integrated, not a bolted on afterthought. From functions to entire projects, beam your code to the REPL so you can immediate interact with it.
Interactive Debugger
When you encounter an error, a debugger will pop up with the error, options to correct it, and a stack trace for your reference.
Inline Diagnostics
Beaming your code will flag errors and warnings, and they’ll show up right in your editor.
In addition, optimization hints will highlight as well, flagging where your code may be sub-optimal in terms of efficiency.
Type Hints and Auto-Complete
When writing Coalton, the full data type of the function your cursor is on will be shown to you immediately. No guessing what arguments each function takes. If you don’t quite know the name of the function, just press tab.
Structural Editing Lessons
You’ve heard about structural editing, like ParEdit, but don’t want to read manuals and cheat sheets to learn it? Take the built-in structural editing lessons to learn how to do structural editing in about 5 minutes. Structural Editing is completely optional, but vastly increases the efficiency of Coalton development.
All-Native Code
No virtual machines and no interpreters. All your code is compiled and optimized to the native binary code of your CPU for maximum performance.
I am not going to speak about the present, but about the past: about the foundations on which our democracy is based. These foundations were rooted in cities, in their civic spaces. We need to remember this history to think about how democratic cities should be made today.
A democracy supposes people can consider views other than their own. This was Aristotle’s notion in the Politics. He thought the awareness of difference occurs only in cities, since the every city is formed by synoikismos, a drawing together of different families and tribes, of competing economic interests, of natives with foreigners.
“Difference” today seems about identity -- we think of race, gender, or class. Aristotle’s meant something more by difference; he included also the experience of doing different things, of acting in divergent ways which do not neatly fit together. The mixture in a city of action as well as identity is the foundation of its distinctive politics. Aristotle’s hope was that when a person becomes accustomed to a diverse, complex milieu he or she will cease reacting violently when challenged by something strange or contrary. Instead, this environment should create an outlook favourable to discussion of differing views or conflicting interests. Almost all modern urban planners subscribe to this Aristotelian principle. But if in the same space different persons or activities are merely concentrated, but each remains isolated and segregated, diversity loses its force. Differences have to interact.
Classical urbanism imagines two kinds of spaces in which this interaction could occur. One was the pnyx, an ampitheatre in which citizens listed to debates and took collective decisions; the other was the agora, the town square in which people were exposed to difference in a more raw, unmediated form.
The Pnyx was a bowl-shaped, open-air theatre about ten minutes’ walk from the central square of Athens. Chiselled out of a hill, the Pnyx in form resembled other Greek theatres, and like them originally provided space for dancing and plays. In the Sixth and Fifth Centuries BC, Athenians put this ordinary theatre to a different use, in seeking for order in their politics. Speakers stood in the open, round space on a stone platform called a bema, so that they could be seen by everyone in the theatre; behind the speaker the land dropped away, so that words seemed to hover in the air between the mass of five to six thousand bodies gathered together and the empty sky; the sun from morning to late afternoon struck the speaker’s face so that nothing in his expression or gestures was obscured by shadow. The audience for this political theatre sat around the bowl in assigned places, men sitting with others who belonged to the same local tribe. The citizens watched each other’s reactions as intently as the orator at the bema.
People sat or stood in this relation for a long time -- as long as the sunlight lasted. The theatrical space thus functioned as a detection mechanism, its focus and duration meant to get beneath the surface of momentary impressions. And such a disciplinary space of eye, voice, and body had one great virtue: through concentration of attention on a speaker and identification of others in the audience who might call out challenges or comments, the ancient political theatre sought to hold citizens responsible for their words.
In the Pnyx, two visual rules thus organized the often raucous meetings at which people took decisions: exposure, both of the speaker and of the audience to one another, and fixity of place, in where the speaker stood and the audience sat. These two visual rules supported a verbal order: a single voice speaking at any one time.
The other space of democracy was the Athenian agora. The town square consisted of a large open space crossed diagonally by the main street of Athens; at the sides of the agora were temples and buildings called stoas, the latter sheds with an open side onto the agora. A number of activities occurred simultaneously in the agora -- commerce, religious rituals, casual hanging out. In the open space lay also a rectangular law court, surrounded by a low wall, so that citizens banking or making an offering to the gods, could also follow the progress of justice. The stoa helped resolve this confusion; as one moved inside the building out of the open space, one moved from a public realm in which citizens freely intermingled into more private spaces. The rooms at the back of the stoas were used for dinner parties and private meetings. Perhaps the most interesting feature of the stoa was the transition space just under the shelter of the roof on the open side; here one could retreat yet keep in touch with the square.
The Athenian agora made differences among male citizens interact in two ways. First, in the open space of the agora there were few visual barriers between events occurring at the same time, so that men did not experience physical compartmentalization. As a result, in coming to the town square to deal with a banker, you might be suddenly caught up in a trial occurring in the law court, shouting out your own opinion or simply taking in an unexpected problem. Secondly, the agora established a space for stepping back from engagement. This occurred at the edge, just under the roof of the stoa on its open side; here was a fluid, liminal zone of transition between private and public.
These two principles of visual design, lack of visual barriers but a welldefined zone of transition between public and private, shaped people’s experience of language. The flow of speech was less continuous and singular than in the Pnyx; in the agora, communication through words became more fragmentary, as people moved from one scene to another. The operations of the eye were correspondingly more active and varied in the agora than in the Pnyx; a person standing under the stoa roof looked out, his eye searching, scanning. In the Pnyx the eye was fixed on a single scene, that of the orator standing at the bema; at most, the observer scanned the reactions of people sitting elsewhere, fixed in their seats.
This ancient example illustrates how the making of theatres and town squares can be put to democratic use. The theatre organizes the sustained attention required for decision-making; the square is a school for the often fragmentary, confusing experience of diversity. The square prepares people for debate; the theatre visually disciplines their debating.
This is, of course, in principle. Throughout their long history, these two urban forms have been put to many divergent or contrary uses. We need only think of the Nazi spectacles in Germany to summon an image of theatrically-focused attention dedicated to totalitarian ends.
Yet the most urgent social requirement for democratic deliberation today is that people concentrate rather than “surf” social reality. It is for this reason that I’ve come to believe that designers need to pay attention to the architecture of theatres as possible political spaces. Live theatre aims at concentrating the attention of those within it. To achieve sustained attention, to commit people to one another even when the going gets rough or becomes boring, to unpack the meaning of arguments, all require a disciplinary space for the eye and the voice.
~/Library/Keyboard/VulgarWordUsage.db
is real. It records which swear words you use,
per app and per
recipient
, so autocorrect learns to stop "ducking" you. On my Mac it is empty, and typing swear words into a native
app did not fill it.
The interesting part is upstream. Apple's system dictionary flags every word with one of three tiers (
vulgar
,
offensive
,
sensitive
) and up to eleven topic flags (sex, drugs, religion, politics, violence, …).
There is no public API for any of it. I read the flags with a few private C functions from
Lexicon.framework
.
Code below, in C and in Swift. The full dumps for 15 languages are in
this gist
(uncensored, so mind the content
warning).
Highlights:
Oedipus
is vulgar.
Tom
and
Mick
are offensive.
pee
,
poo
,
niggle
and
underling
are
sensitive. And
"Trump" is the only living politician in the English sensitive tier
, next to Hitler, Mao, Osama
bin Laden and the Taliban. Biden, Obama and Putin are clean.
Content note:
this article prints the words uncensored, slurs included, because the whole point is to see what
Apple flags. The one exception is the n-word: it is in the list in English and several other languages, and I'm not
writing it out.
It started with a tweet
Nick posted this
, I asked where it lives, and he answered. A
database that tracks my profanity is not something I can leave alone, so I opened mine.
The database
$ sqlite3 -readonly ~/Library/Keyboard/VulgarWordUsage.db .schema
CREATE TABLE properties (ROWID INTEGER PRIMARY KEY, key, value, UNIQUE (key));
CREATE TABLE IF NOT EXISTS "vword_usage"(
ROWID INTEGER PRIMARY KEY AUTOINCREMENT,
app TEXT, -- app identifier
recipient TEXT, -- recipient identifier
vword TEXT, -- vulgar word
word_reading TEXT, -- the reading form of a word (relevant for Japanese)
usage_count INTEGER DEFAULT 0,
last_use_timestamp REAL DEFAULT 0, -- last use timestamp (seconds since the reference date)
journaled
);
CREATE UNIQUE INDEX app_recipient_vword_word_reading_idx ON vword_usage(app, recipient, vword, word_reading);
So the keyboard can know that you say
fuck
in Messages to one particular friend, but not in Mail to your boss. The
unique index is on
(app, recipient, word, reading)
, so that is the granularity.
Mine has zero rows. The
properties
table holds
version = 2
and nothing else. The file was last written in April
2024.
What it is for
At WWDC in June 2023, Craig Federighi announced the iOS 17 autocorrect rewrite with this line:
"In those moments where you just want to type a ducking word, well, the keyboard will learn it, too."
(
TechCrunch
,
NPR
)
This database is how it learns. The symbol names in the macOS shared library cache spell out the flow:
Plus log strings like
Passing recipient IDs to the vulgar word usage database wrapper; number of IDs: %lu
.
In plain terms:
When you start typing, the keyboard engine tells the wrapper which app you're in and who you're writing to.
When you type a vulgar word and keep it, its count goes up for that app and those recipients. Undoing the word
brings the count back down.
When the engine ranks suggestions, it asks whether every vulgar word in a candidate is allowlisted for this
context. If it isn't, the clean alternative wins:
ducking
.
A
_KSUserWordsSynchroniser sharedAcrossLanguagesVulgarWordUsageValue
symbol suggests it syncs between devices like
your other learned words.
Mine is empty
I tried to fill it. Using
agent-desktop
, I opened a new TextEdit document
and typed
well fuck this shit, damn it.
, first as a text insert, then as individual key presses. Nothing changed: no
row, no log line, and the file's modification date stayed in 2024.
I don't know why, and I couldn't work it out. Maybe the Mac never records anything here, or maybe it only does so in
some apps or settings. If you've got rows in yours, tell me what you did.
That would be a short article. But the database only counts words that are
already
known to be vulgar. So who decides
that?
Where the word list lives
Searching the dyld shared cache for "vulgar" turned up a C API with an
LX
prefix
(
LXVulgarWordUsageDatabaseCreate
,
LXVulgarWordUsageDatabaseCanAutocorrect
, …) and, more usefully, two functions on
dictionary entries:
_LXEntryGetCategoryFlags
_LXEntryGetMetaFlags
LX
is
Lexicon.framework
, a private framework that reads the per-language dictionaries under
/System/Library/LinguisticData/
. Every word in those dictionaries is an
LXEntry
with two 32-bit flag fields. If the
vulgarity rating is anywhere, it's in those bits.
There is no public API
I looked.
NSSpellChecker
,
UITextChecker
,
NaturalLanguage
and
UILexicon
don't expose vulgarity.
SensitiveContentAnalysis
covers images and video, not text. The only places "profanity" shows up on
developer.apple.com are App Store age ratings and review guidelines.
So: private functions. Lexicon has no headers, but the C functions are exported, and their signatures are easy to
guess because they follow CoreFoundation conventions. This program opens the dictionary for a locale, walks every entry,
and prints both flag fields:
// lx.c — dump every word in a system lexicon with its flags.// clang -O1 -o lx lx.c -F/System/Library/PrivateFrameworks -framework Lexicon -framework CoreFoundation#include<CoreFoundation/CoreFoundation.h>#include<stdbool.h>#include<stdio.h>typedefconstvoid*LXLexiconRef,*LXCursorRef,*LXEntryRef;extern CFStringRef kLXLexiconLocaleKey;
LXLexiconRef LXLexiconCreate(CFDictionaryRef options, CFErrorRef *error);
LXCursorRef LXLexiconCreateRootCursor(LXLexiconRef);voidLXCursorEnumerateEntriesRecursively(LXCursorRef,void(^)(LXEntryRef, bool *stop));
CFStringRef LXEntryCopyString(LXEntryRef);uint32_tLXEntryGetCategoryFlags(LXEntryRef);uint32_tLXEntryGetMetaFlags(LXEntryRef);intmain(int argc,char**argv){
CFStringRef locale =CFStringCreateWithCString(NULL, argc >1? argv[1]:"en_US", kCFStringEncodingUTF8);constvoid*keys[]={kLXLexiconLocaleKey},*values[]={locale};
CFDictionaryRef options =CFDictionaryCreate(NULL, keys, values,1,&kCFTypeDictionaryKeyCallBacks,&kCFTypeDictionaryValueCallBacks);
LXLexiconRef lexicon =LXLexiconCreate(options,NULL);if(!lexicon)return1;LXCursorEnumerateEntriesRecursively(LXLexiconCreateRootCursor(lexicon),^(LXEntryRef entry, bool *stop){char word[512]="";
CFStringRef s =LXEntryCopyString(entry);if(s){CFStringGetCString(s, word,sizeof word, kCFStringEncodingUTF8);CFRelease(s);}printf("%08x\t%08x\t%s\n",LXEntryGetCategoryFlags(entry),LXEntryGetMetaFlags(entry), word);});}
The same thing in Swift, loading the functions at runtime with
dlopen
and
dlsym
so you don't need to link against
a private framework. It prints only words that carry one of the three tiers:
// lexflags.swift — swiftc -O lexflags.swift -o lexflags && ./lexflags en_USimportFoundationlet lexicon =dlopen("/System/Library/PrivateFrameworks/Lexicon.framework/Lexicon",RTLD_NOW)!funcsym<T>(_ name:String,as_:T.Type)->T{unsafeBitCast(dlsym(lexicon, name)!, to:T.self)}typealiasLXRef=UnsafeRawPointerlet create =sym("LXLexiconCreate",as:(@convention(c)(CFDictionary,UnsafeMutablePointer<Unmanaged<CFError>?>?)->LXRef?).self)let rootCursor =sym("LXLexiconCreateRootCursor",as:(@convention(c)(LXRef)->LXRef?).self)let enumerate =sym("LXCursorEnumerateEntriesRecursively",as:(@convention(c)(LXRef,@convention(block)(LXRef,UnsafeMutablePointer<Bool>)->Void)->Void).self)let copyString =sym("LXEntryCopyString",as:(@convention(c)(LXRef)->Unmanaged<CFString>?).self)let metaFlags =sym("LXEntryGetMetaFlags",as:(@convention(c)(LXRef)->UInt32).self)let category =sym("LXEntryGetCategoryFlags",as:(@convention(c)(LXRef)->UInt32).self)let localeKey =dlsym(lexicon,"kLXLexiconLocaleKey")!.load(as:CFString.self)let locale =CommandLine.arguments.dropFirst().first ??"en_US"guardlet lex =create([localeKey: locale]asCFDictionary,nil),let root =rootCursor(lex)else{fatalError("could not open lexicon for \(locale)")}let tiers:[(UInt32,String)]=[(0x0080_0000,"vulgar"),(0x0100_0000,"offensive"),(0x0200_0000,"sensitive")]enumerate(root){ entry,_inlet meta =metaFlags(entry)guardlet tier = tiers.first(where:{ meta &$0.0!=0})?.1,let word =copyString(entry)?.takeRetainedValue()else{return}print(tier,String(format:"%05x",category(entry)), word, separator:"\t")}
Both are read-only. They open the same dictionary the keyboard uses and print it.
Decoding the bits
Apple doesn't document these flags, so every meaning below is inferred: I grouped words by bit and read samples until
each group's theme was obvious. The system code helps with one of them. An enum case called
offensiveVulgarSensitive
sits right next to the vulgar-word code, and three adjacent meta bits match it.
In en_US a word has at most one tier: they never overlap. Out of 199,019 entries, 4,271 have one.
Roughly:
vulgar
is swearing and sex slang,
offensive
is slurs aimed at groups of people, and
sensitive
is
everything a keyboard shouldn't offer you unprompted: mild swears, insults, drugs, weapons, extremism, disease and
bodily functions.
The topics (category flags)
The other field is a topic bitmask, and a word can have several topics:
The topic flags and the tiers are independent. 2,052 English words have a topic but no tier:
gay
,
fat
,
God
,
Allah
and
sex
are all tagged "sensitive context" but are not vulgar, offensive or sensitive. My guess is the topic
is a hint ("be careful how you rank this") and the tier is the rule.
The lower meta bits are dull: proper nouns, abbreviations, camel-case brand names like
iMac
and
tvOS
. Nothing to see
there.
The weird ones
This is where it gets fun. Some flags are obviously right, and some made me laugh.
Vulgar
Oedipus
: vulgar. Presumably because of
motherfucker
-adjacent jokes, or the complex. Sophocles would be thrilled.
reams
: vulgar. As in "to ream someone".
cooties
: vulgar. Your nine-year-old is swearing.
orgy
,
sext
,
merde
: fair enough.
Offensive
Tom
and
Mick
: offensive.
Uncle Tom
and the slur for Irish people, but also very common first names.
Oriental
: offensive.
papooses
: offensive.
conservatards
: offensive, the one political insult I found in the slur tier.
niggardly
: offensive. It means "stingy" and comes from Old Norse, unrelated to the slur. It has also caused
real controversies
, which is presumably why
it's there.
ass
and
asshole
: offensive, not vulgar.
Sensitive
pee
and
poo
: sensitive, with the excretion topic. So are
premenstrual
,
leprosy
and
herpesvirus
.
niggle
(a small worry, of Scandinavian origin) and
underling
(Old English for a subordinate) are sensitive and
share the insult topic. Similar words aren't flagged:
snigger
is clean but
niggle
is flagged, and
minion
,
lackey
,
flunky
and
stooge
are clean but
underling
is flagged. These look like hand-picked entries, not rules.
blacklist
and
whitelist
are sensitive with the insult/identity topic. That matches the industry move to
blocklist
and
allowlist
. Apple's own phrase-filter files are named
blocklist.dat
.
Braves
and
Chiefs
(team names with Native American mascots),
Londonderry
(the contested name for Derry),
Gentile
,
Jehovah
,
Mongol
and
Frenchier
are all sensitive.
Isis
is sensitive with the politics topic. Sorry to the Egyptian goddess.
slave
,
slavery
and
slaveholder
are sensitive with the violence topic.
idiot
is sensitive in English. Norwegian is stricter and puts
idiot
in the offensive tier.
The Trump flag
The sensitive tier has 109 capitalized words. Here is all of it:
Every other real person on that list is dead, and nearly all of them are Nazi officials, dictators or terrorists.
Then there's Trump:
category meta word
00002000 02000081 Trump sensitive tier + politics topic
00002000 02000081 Trumps
00002000 02000081 Trump's
00000000 00000000 trump (the card-game word: clean)
00000000 00000000 trumped
For comparison:
Word
en_US
Trump
sensitive, politics topic
Hitler
sensitive, politics topic
Biden
clean
Obama
clean
Putin
clean
Stalin
clean
Musk
not in the dictionary
en_GB
matches
en_US
. Other languages differ: the German dictionary has
Trump
clean (and puts
Hitler
in the
offensive
tier), and Swedish is the one that flags
Putin
as sensitive.
What the flag
does
matters here. As far as I can tell, a sensitive word is one the keyboard shouldn't suggest on its
own. You can still type it and it won't be corrected away. Think "keep this out of the QuickType bar unless the user is
clearly heading there", which is a lot milder than a ban.
There is a plausible reason Apple would want that for one specific name. In February 2025, iPhone dictation briefly
showed "Trump" when people said "racist". It went viral, and Apple called it a
"
phonetic overlap
" in the speech model and
shipped a fix within a day
(
9to5Mac
). The dictionary files on my Mac are from
July 2025. A rule that keeps the name out of unprompted suggestions would stop that kind of thing from happening
again through the keyboard. I can't prove that's why it's there, and I don't have an older dictionary to compare
against. But it fits.
Norwegian politics, for comparison
Because I'm Norwegian and had to check:
Word
Topic
Tier
FrP, Høyre, Venstre, Rødt, SV, KrF, MDG
politics
none
Støre
politics
none
Solberg, Erna, Sylvi
none
none
Listhaug
n/a
not in the dictionary
Breivik, Quisling, Hitler
none
sensitive
Every party gets the politics topic and none gets a tier. The only Norwegians in the sensitive tier are a mass
murderer and a Nazi collaborator.
Other languages
The same three tiers exist in every European dictionary I tried, Cyrillic included. The counts are entries, not lemmas,
so heavily inflected languages like Polish and Russian look much worse than they are: every case and conjugation of a
swear word is a separate entry.
Locale
Vulgar
Offensive
Sensitive
Notable
en_US
1,050
663
2,558
idiot
is sensitive
en_GB
1,055
872
2,337
chav
is offensive;
chink
is filed as
vulgar
, not offensive
nb_NO
2,393
1,324
6,446
idiot
is offensive
da_DK
1,179
3,314
8,551
fjols
("fool") is offensive
sv_SE
637
1,247
16,193
idiot
is
vulgar
;
Putin
is sensitive
fi_FI
569
872
47
The entire sensitive tier is
kakka
("poop"),
kakkakasa
("pile of poop") and
saakeli
de_DE
3,218
3,518
9,446
Hitler
and
beknackt
("daft") are offensive;
Trump
is clean
nl_NL
57
1,180
3,805
Only 57 vulgar words, but
kanker
("cancer", the classic Dutch swear) is one
fr_FR
2,151
262
5,562
boche
is offensive
es_ES
3,931
313
13,431
sudacas
and
fachas
are offensive
it_IT
3,886
377
6,543
terrone
is offensive, and so is
nazismi
pt_BR
1,590
1,891
3,332
machista
and
velhinhos
("little old people") are offensive
The bits don't seem to mean the same thing everywhere. Arabic and Hebrew return hundreds of thousands of "sensitive"
entries, so those dictionaries probably reuse the bits for something else, and I left them out. Korean, Catalan and
Hungarian return nothing, and Japanese crashes my dumper.
Samples from Norwegian, since that's what I type in when I'm not typing English:
The tier words are mostly what you'd expect, but the edges are different in each language, and that is where the
human-edited parts show. Norwegian calls
idiot
offensive and English calls it sensitive. German thinks Hitler is a
slur.
Phrases, not just words
There is a second, separate filter. Every English language model has a
blocklist.bundle
, and there's a
qp_blocklist.bundle
for QuickPath, the swipe keyboard:
blocklistidmap.dat
is a 20-byte header followed by
(lexicon token ID, class ID)
pairs of 32-bit integers. Mapping
the token IDs back through the dictionary gives 2,544 words in 930 classes. Most classes are inflection groups:
blocklist.dat
is a packed trie over those class IDs, so it blocks
sequences
: "deny" followed by "Holocaust", and
whatever 1720 pairs with. A class that puts
brown
next to
animals
and
cats
suggests the list targets specific
phrasings rather than single words, though which phrasings I can't tell without decoding the trie. The runtime check is
LMLanguageModelTokenSequenceIsBlocklisted
in
LanguageModeling.framework
. I got far enough to learn that its fourth and fifth arguments include an output
pointer, but my probe still crashes intermittently, so I haven't read the actual phrases yet. That's for a follow-up.
Caveats
Meanings are inferred.
Apple documents none of these bits. The tier names come from an enum in the system code
and the topics from reading thousands of samples. Both are consistent, but they're still a reading.
Flagged is not censored.
As far as I can tell these flags decide what the keyboard volunteers, not what you can
type.
One machine.
Everything here comes from macOS 15.6 (24G84) with LinguisticData build 438 from July 2025. iOS and
other macOS versions may ship different dictionaries.
Private API.
The functions can change or disappear in any update. Don't ship this in an app.
Try it yourself
# Your own learned-swears database (probably empty on a Mac)
sqlite3 -readonly ~/Library/Keyboard/VulgarWordUsage.db 'select * from vword_usage'# Build the Swift version from above and filter by tier
swiftc -O lexflags.swift -o lexflags
./lexflags en_US |awk -F'\t''$1 == "vulgar" {print $3}'|sort -u |less
./lexflags nb_NO |awk -F'\t''$3 == "faen" || $3 == "helvete" || $3 == "idiot"'
If you'd rather not build anything, the
gist
has every tiered word for 15 locales as
TSV, plus the code and a script that regenerates them. It's a snapshot of macOS 15.6 and won't be kept up to date.
If you find something funnier than
Oedipus
, I want to hear about it.
Google says there’s no way to use Search without using artificial intelligence
Guardian
www.theguardian.com
2026-11-03 15:30:06
In announcement geared to schools, tech giant shows how entwined AI is with the world’s most popular website Google just acknowledged that you can’t use Google Search without using artificial intelligence. The search giant announced a slate of new AI products for classrooms and schools on Tuesday as...
The search giant announced a slate of new AI products for classrooms and schools on Tuesday as well as more ways for teachers and schools to limit or restrict use of those AI tools. The company said the schools should have control over whether students use AI in the classroom. There’s one catch, though: if a school or teacher blocks the use of Google’s AI features, students won’t be able to use
Google
Search.
“After listening to schools, teachers, leading researchers, and policymakers, we are now updating our approach to controls for Gemini, Gemini Notebook, Gemini in Classroom, and Google Search,” company executives wrote in a blogpost. “Access to these products will be entirely off for K-12 student accounts until school administrators explicitly turn them on.”
In a comment to the
New York Times
, Chris Phillips, Google’s vice-president for education, said that there is no Google Search without AI.
“Search and AI are deeply integrated,” said Phillips. A school-wide ban on AI would mean that students “will not have access to search, and they’ll see a message from their school that indicates it’s not available”, he told the Times. The Guardian also reached out to Google but did not hear back by publication.
To some, the move reads like a penalty for not implementing Google’s AI features.
New York City’s mayor, Zohran Mamdani, who recently imposed a one-year moratorium on generative AI tools in city schools through the eighth grade, said Google was exploiting its near-total control of online search.
“Google is trying to use its monopoly power to force AI into our public schools,” Mamdani posted on X. “No corporation should have the power to dictate how we teach our children. Our public schools exist to serve students, not to grow the profit margins of Big Tech.” Lina Khan, former chair of the US Federal Trade Commission, echoed his statement, tweeting that Google was using its monopoly on search to “to coerce schools into adopting AI”.
The ubiquity of Google Search has long made it a critical tool for students, and losing access to it may prove enough of a reason to opt in to using new AI features for schools. Google has also maintained a stranglehold on technology in US classrooms for years by offering cheap and free products. From Gmail and Google Docs to Google Classroom and Google Chromebooks, the company’s suite of software and hardware solutions are among the most widely used in schools.
One of the new features Google announced today was Guided Learning, an AI study tool that “coaches students through the process of problem solving” rather than giving them the answer. The company is planning to integrate Guided Learning directly into Google Search.
“For example, if a student pastes a complex physics problem or asks for help writing a book report in Search, they’ll see prompts to help them think critically and work through the concepts, without going directly to the answer,” the company wrote in a blogpost.
Lila Byock, founder of Schools Beyond Screens, called Google’s announcement a “hostile ultimatum”. Schools Beyond Screens is a national coalition of parents and teachers advocating for more student-centered policies on the use of screens in schools.
“This kind of bullying has no place in our schools,” Byock said in a statement. “Educational value – not shareholder value – must determine which products are used by students and regulators must intervene to prevent big tech from exploiting schoolchildren for profit.”
It caught my attention that most of Pratt parsing tutorials that I've stumbled on spend almost all of their time explaining Pratt's algorithm and none explaining the properties behind Pratt that actually matter. Pratt fits into just 9 lines of code if you're programming in a high-level language such as Rhombus:
let mutable left = t.nud()
let mutable left = t.nud()
let mutable left = t.nud()
let mutable left = t.nud()
And here's a secret: that's the least important thing you need to understand about Pratt's. In fact, you don't need to understand this piece at all! Imagine if you were only able to use quicksort if you understood its implementation. Imagine if you were only able to use files if you knew how to implement a filesystem from scratch. It's the same logic here. If you lack the power to abstract, you'll arrive nowhere in computer science because that's how the whole field works. In fact, I wrote the backbone of a heavily Pratt-based parsing machinery for a compiler that I've been writing since last year w/o even bothering to understand the above snippet in any detail.
Not convinced? Think for a second on how they do in traditional parsing techniques: compiler compilers! They use code generators to spit the parsing algorithm because just a minuscule crowd bothers to learn what the parsing engine is actually doing. It's no different with Pratt. However Pratt is so small that you can just copy'n'paste these 9 lines of code in your project and call it a day instead of adding a new complex dependency to your project. The algorithm hasn't changed since 1973 and it's not gonna change now.
In this article I'll go over what you actually need to keep in mind for Pratt parsing. The point won't be about memorizing any of it though. The point is about acquiring a mindset. As long as you acquire the mindset you don't need to even bother to remember even a single word of what I say here.
The only tutorial on Pratt parsing that I can firmly recommend to someone who has never been exposed to the topic is actually a talk that Douglas Crockford gave in the conference GOTO 2013
¹
. Douglas Crockford nailed it when he stated:
Pratt takes parsing which is a really complicated thing and reduces it to one simple question:
What do we expect to see to the left of a token
?
— Douglas Crockford, GOTO 2013
At first glance it may look like a mystical statement devoid of meaning, but that's the question that becomes the framework on how you face parsing problems and it'll rewire your brain to internalize the Pratt parsing mindset. That's the most important thing you need to understand. You register semantic actions for two categories: nuds and leds. A nud is a token that expects nothing to its left (nud stands for null denotation) while a led expects something (led stands for left denotation).
Traditional parsing techniques register semantic actions to production rules. Here's an example I took straight from GNU Bison's manual:
expr: expr '+' expr { $$ = $1 + $3; } ;
expr: expr '+' expr { $$ = $1 + $3; } ;
expr: expr '+' expr { $$ = $1 + $3; } ;
expr: expr '+' expr { $$ = $1 + $3; } ;
The text between the braces is code that executes when the BNF-like grammar on the left matches. I'm gonna repeat myself because that's really important: traditional parsing techniques register semantic actions to
production rules
(which by definition are non-terminal symbols). In contrast Pratt parsing registers semantic actions to the
terminals themselves
instead. That's a fundamental shift on how you face parsing problems.
Here's a stripped down version of the code for the tables that I have in my compiler right now:
All values on the left of each table are the lexer codes for terminal symbols. The values on the right depend on the table kind:
Nud tables
Functions matching the signature
ExprPtr(Context&,reader,reader&)
ExprPtr(Context&,reader,reader&)
.
Led tables
Functions matching the signature
ExprPtr(Context&,reader,reader&,ExprPtr)
ExprPtr(Context&,reader,reader&,ExprPtr)
.
Binding power tables
Positive integers.
Most of the semantic actions in these tables have code whose implementation amount to one semicolon in their body at most. Here's the code for
parse_unary_plus()
parse_unary_plus()
:
On the surface it may seem just like a different but still very similar way to organize your code, but the impact is in fact huge. Here are a few differences from traditional parsing techniques that stem from this single departure alone:
You don't need to worry about left-recursion problems that occur in traditional parsing techniques such as LL(k). Given the dispatch to a semantic action is done with its associated token already consumed from the stream, left-recursion just doesn't happen. It's a non-issue.
The parsing engine doesn't need to test alternatives or backtrack. The usual dichotomy between speed versus memory that is found in some parsers (e.g. PEG vs packrat) is gone. Pratt is fast, and it's not gonna starve for insane amounts of memoization. Pratt is just going to compare numbers, and iterate or recurse.
Related to the previous point, but worth to consider on its own: semantic actions run exactly once! That means there's no need to rollback to a previous state if a match fails. In other words your actions may contain side-effects. In my parser I use this property to do name reservation/release on lexical scope through a shared context object juggled through each layer. Just be careful to not abuse side-effects and end up with spaghetti.
Also related: your semantic action always knows it's the correct match. Therefore it may look arbitrarily far ahead if it wants to. In other words: you can further use PEG parsers (or layered Pratt parsers) in the semantic actions. While Pratt itself only eats 1 token at a time, the nuds & leds themselves may eat more tokens per round. You just unlocked the power of parser combinators.
Most of the grammar ambiguities become table collisions so you waste less time on the simpler ambiguity cases. If you combine multiple parsers then it's still possible to have grammar ambiguities. So you still have work as a grammar designer, but in my experience it's much less work. When you combine parsers you're really combining grammars. Pratt as the parsing algorithm won't act as the all-seeing oracle and detect every possible ambiguity in the full grammar amalgamation. Pratt (just like PEG) will just return the first possible match in this case.
Unfilled gaps in your tables become trivial extension points in your grammar. You may fill these gaps in response to the text parsed so far. In other words you can implement macros and even parse a language that extends its own operators. In contrast extending a pre-existing grammar based on production rules (the orthodox parsing school) is a job worth the complexity of PhD researches.
You may even find a few of these properties in the traditional school as well, but only to certain extents, or with a huge complexity toll.
Nonetheless I mentioned earlier that this organization is a mindset
shift
, but so far I've only mentioned properties that you can use from adopting Pratt, so where's the shift really? Consider the usual EBNF rule for parsing function calls:
How do you approach this problem when instead of production rules your toolbox contains only nuds & leds? The key observation is that the opening parentheses always expect something to its left, so it's a led. There you go: register a led for lparen and parse the function call from there. It's not immediately obvious, specially when you've only been exposed to the traditional parsing school. Hence why Douglas Crockford nailed it when he stated:
Pratt takes parsing which is a really complicated thing and reduces it to one simple question:
What do we expect to see to the left of a token
?
— Douglas Crockford, GOTO 2013
The led for array indexing is very similar to the led for function call. Here's the variation that I use in my own parser:
Pratt is not just precedence climbing. Pratt is a way to organize your code. First learning Pratt as a black box actually helps to understand this difference. If you don't have access to the black box, you won't be tempted to reduce Pratt to precedence climbing. Hopefully by the time you want to take away the abstraction and see what's inside you won't make the mistake of treating Pratt just like a mere variation of precedence climbing because by then you'll have already been exposed to all the power unlocked by Pratt parsing. Andy Chu's blog post on Pratt parsing without prototypal inheritance is worth reading as it contrasts two opposing styles of writing Pratt parsers
²
. Here's a minimal calculator written in Rhombus that is (stylistically) closer to a version that'd use prototypal inheritance than the style that Andy Chu shows:
The previous section might have been the densest in this whole blog post so I want to tune it down while you incubate the Pratt mindset and go on trivial things for now:
Pratt requires a separate lexer. Some modern parsing engines can work in a scannerless manner (e.g. PEG) or even embed the lexer definition directly in the parser itself, but Pratt requires a separate lexer. That shouldn't be a big concern, but it's something to keep in mind.
Pratt is fast. The algorithm only compares numbers and iterate or recurse. It's only looking 1 token ahead, and not doing anything else really. It doesn't go back to test alternatives or to backtrack on failed production rules. It just doesn't go back at all. It's a full-speed locomotive only looking ahead eating 1 token at a time.
Given Pratt itself is already fast, if you want to optimize anything, the only thing left is the dispatch code for nuds & leds. In my case I use global read-only dispatch tables, but most of the tutorials I've seen in the wild use dynamic objects in highly dynamic scripting languages.
Pratt can't parse statements. You have to combine it with other techniques to parse languages with statements. I've already gone through this constraint in my last blog post where you can find solutions.
Pratt is a form of recursive descent parsing meaning it's running custom user code (i.e. code in a Turing-complete language) for the semantic actions, but that's not the whole picture. The semantic actions further drive the parsing choices/direction which means that your code might look at the context (e.g. previous declarations) to decide how to parse the next piece of the input text. In summary you can have some forms of context-sensitive parsing which opens the door for more classes of languages.
You'll have to resort to modal lexing to parse some complex languages found in the wild, but I'll reserve a later section of this blog post to touch on this topic.
Pratt can't be used for incremental parsing as done in GLR parsing. However that's not a power found in most parsing algorithms anyway (I'm running out of algorithmic properties to talk about). Incremental parsing is used in tools such as tree-sitter.
My whole argument today is that Pratt is a black box abstraction, so let's go with this argument and lay down what contracts you need to respect to use Pratt:
Only tokens with associated leds need a value in the binding power table. Tutorials in the wild are usually written in a way where this property isn't obvious. It becomes more obvious when you write your parser using static tables rather than highly dynamic objects in scripting languages.
Related to the previous point: You still need a value for the binding power of prefix operators, but this value isn't used in the Pratt loop at all. Therefore it's not a requirement to inflate the binding power table with a value for the prefix operators, but that's what most of the code I've seen in the wild do anyway. If you think it's easier to just stuff the binding power for prefix operators in the same table be my guest and go ahead. Just bear in mind that this popular arrangement isn't a hard requirement. Only the nud implementing the prefix operator itself needs to know the binding power for prefix operators.
Never assign a binding power of zero to a led.
Separators such as comma and unknown/error/EOF tokens where the parser must stop should have a binding power of zero. They don't need to exist in the binding power table.
If you're writing in decimal like every human being, adopt increments of 10 in the binding power table. When reading these values, you may just ignore the final zero, but the extra room between operators enables some tricks.
So how do we implement right-to-left associative operators with Pratt? First let's look at a common left-to-right associative infix operator. Here's my code for the led
+
+
:
That's a standard trick in the field of Pratt parsing. A trick of the trade so to speak. A trick you ought to know. Why does it work? It doesn't matter. It's a black box for today. Tomorrow it might matter, but today you should only be focusing on how to use Pratt, not why it works.
Why even write a section for macros when most language designers won't add them? Pratt macros are just nuds/leds implemented in the language that your code is parsing and interpreting. Therefore anything that your own nuds/leds can do is something that ought to be possible in a macro and vice-versa. Lessons learned from Pratt macros are lessons learned on Pratt parsing itself.
That's just a principle, and not a hard-truth. It's definitely not a truth in the Pratt macros of my own language, for instance, but the principle remains my guide (and hopefully yours as well).
The implementation of macros outside Lisp are traditionally very limited in many fronts. In languages such as C you have macros that are just textual substitution templates that work in the environment of a preprocessor doing textual expansion (therefore working on the lexing layer). It's also possible to design macros that work in the AST/parsing layer such as done in Lisp. However Pratt macros unify these two previously severed worlds. If you're implementing procedural Pratt macros then it's possible for the macro to use APIs that alternately invoke either the lexer or the parser. My own macro system doesn't yet have enough APIs so I can't showcase a real example, but here's how envision that it's gonna work:
// functions whose name start with "read"
// drive the lexer (i.e. they just consume
// functions whose name start with "parse"
// drive the parser (i.e. they consume and
// return parsed expressions)
let expr = ctx.parse_expr();
// just like Rust, my own macro system requires a
// macro invocation to end with an exclamation mark
// to act as a friendly visual hint that something
// funny might be going on
passthrough!(std.puts("hello world"));
// functions whose name start with "read"
// drive the lexer (i.e. they just consume
// functions whose name start with "parse"
// drive the parser (i.e. they consume and
// return parsed expressions)
let expr = ctx.parse_expr();
// just like Rust, my own macro system requires a
// macro invocation to end with an exclamation mark
// to act as a friendly visual hint that something
// funny might be going on
passthrough!(std.puts("hello world"));
// functions whose name start with "read"
// drive the lexer (i.e. they just consume
// functions whose name start with "parse"
// drive the parser (i.e. they consume and
// return parsed expressions)
let expr = ctx.parse_expr();
// just like Rust, my own macro system requires a
// macro invocation to end with an exclamation mark
// to act as a friendly visual hint that something
// funny might be going on
passthrough!(std.puts("hello world"));
// functions whose name start with "read"
// drive the lexer (i.e. they just consume
// functions whose name start with "parse"
// drive the parser (i.e. they consume and
// return parsed expressions)
let expr = ctx.parse_expr();
// just like Rust, my own macro system requires a
// macro invocation to end with an exclamation mark
// to act as a friendly visual hint that something
// funny might be going on
passthrough!(std.puts("hello world"));
These APIs are pretty much what's already used in the core nuds of many parsers using Pratt. A macro system only needs to expose them to the macros as well to get this far. This part is actually easy. Tasks actually challenging in macro systems reside elsewhere, not here. The hardest part of a macro system is hygiene
³
⁴
, not parsing (well… parsing is gonna be easy if you use Pratt parsing at least). However this blog post is about (Pratt) parsing, not macro systems, so I'm not gonna delve on hygiene or other macro system challenges (problems which I've already battled with and ultimately won).
The takeaway here is that Pratt parsing enables languages with powerful macros that can implement beautiful unconstrained eDSLs. Pratt macros are just an interpreter for your language that has access to the lexer and the parser at the point where the macro is being expanded. Patterns that you use in your nuds & leds are patterns that you'd likely see in Pratt macros. The code being parsed is teaching the very parser that is parsing it on how to do so (tell me about meta!).
Usually the lexer is the most neglected part of a compiler. It's a solved problem. There's no reason to waste time on its design. You use a lexer generator to implement an efficient lexer, and move on to never look back again. However Pratt – the algorithm – is just 9 lines of Rhombus code. Your lexer is most likely bigger than the parser already. Just on the face of this your lexer is already playing a bigger part on your project by at least some metric (even if an unimportant one).
However it goes further than this. Every nud and led in your code is a subparser of sorts. Combining (sub)parsers is key to unlocking the power to parse even more classes of languages. The lexer becomes the single point in common that trespass the walls between all subparsers. A good lexer design improves parser composability.
As a practitioner of the Pratt school, the single most important lexing technique you should learn is modal lexing. The technique is already useful on its own even if you're not using Pratt, but it's even more so for us. As Andy Chu succinctly explains
⁵
, modal lexing is enabled by adding an extra parameter to your lexer:
// each mode triggers different lexing rules
Token Read(lex_mode_t mode);
// each mode triggers different lexing rules
Token Read(lex_mode_t mode);
// each mode triggers different lexing rules
Token Read(lex_mode_t mode);
// each mode triggers different lexing rules
Token Read(lex_mode_t mode);
There are other ways to express the same pattern. For my own project, I prefer to use separate functions instead of an enum. As a C++ programmer I've been trained well to discern between cases of static versus dynamic polymorphism, and here's a case where clearly the dispatching information is fully known statically at compile time. Hence it doesn't make sense to even use an enum. The story could be different in highly dynamic macro-enabled languages though.
voidnext_on_class_scope();
voidnext_on_type_scope();
voidnext_on_expr_scope();
voidnext_on_skim_scope();
voidnext_on_class_scope();
voidnext_on_type_scope();
voidnext_on_expr_scope();
voidnext_on_skim_scope();
voidnext_on_class_scope();
voidnext_on_type_scope();
voidnext_on_expr_scope();
voidnext_on_skim_scope();
voidnext_on_class_scope();
voidnext_on_type_scope();
voidnext_on_expr_scope();
voidnext_on_skim_scope();
Simple as it is, this single defining trait of modal lexing unlocks the ability to parse many more complex classes of languages by providing a way for the lexer to receive feedback from the parser. Lexers never know grammatical structure, but the parser always does. By feeding this information from the parser back to the lexer you enable forms of language composition where each sublanguage might have conflicting token definitions (e.g. C++11's right-shift operator spawns different tokens in template contexts) or just tokens with different meanings altogether. Andy Chu already gave comprehensive examples on where this might be useful
⁶
so here I'll only bother to contribute a single example to the corpus.
In Rust you have a different sublanguage just to express types. This type annotation happens in neatly delimited places inside the "main" language. It usually happens after the colon and ends on the equals-sign or delimiters such as commas or the closing parentheses:
My language syntax is heavily inspired by Rust's. Naturally I rely on modal lexing to parse these structures. The function
reader::next_on_type_scope()
reader::next_on_type_scope()
shown earlier is used for the type annotation sublanguage. Then I have a Pratt parser for each –
parse_expr()
parse_expr()
and
parse_type()
parse_type()
. It's a simple trick that doesn't demand much explanation really, but gets you very far. The code almost writes itself after you get the idea.
The only caveat is that your lexer must adhere to a pull design instead of lexing all tokens upfront. For some reason people like to only design push APIs that fully steal execution flow, and these people are addicted to implement lexers that do all the work upfront. It's a popular arrangement, but not one that will work for modal lexing. Pratt itself is a push design so in the end you'd have a mix of designs.
Moving on to the next topic, there are more lexer tricks that I have to share, but for today I just have one suggestion: don't design your lexers to do any IO (syscalls) nor to buffer anything. Working on a copy of your lexer shouldn't have observable side-effects on the original object. Copies should be cheap and encouraged. Working on a copy of the lexer enables arbitrary lookahead which might be required by some subparser. Even if you only requires a fixed amount of lookahead (e.g. 3 tokens) this design fits the hole all the same.
Fulfilling this design is easy: just read the whole file at once (or use mmap) and make the lexer point to this shared region to do its job. Your AST alone is likely gonna use more memory than the whole input file anyway so memory shouldn't be a concern here.
Most of the code that I see on the wild has a custom type for tokens, and that's get used as argument for the nuds & leds, but I just store/pass the lexer itself instead. My lexer is cheap to copy so there's no need to create a class to pass tokens around. The layer expecting a token can decode from the matched lexeme directly anyway so the lexer only needs to store a few pointers to the original input text. Here's the code parsing decimal literals in my project to showcase the decode-from-lexeme-directly trick:
Furthermore this design allows me to rollback 1 token which is something that I use in the nud for
<
<
:
// this nud is called by parse_expr() (hence expr-scope)
std::shared_ptr<ast::Expr>parse_enter_type_scope(
ParsingContext&context, reader tok, reader&r)
assert(tok.code()== code::less_than_sign);
r = tok;//< 1-token rollback happens here
// here we re-lex the next token (after the rollback
// just above) using the rules for type-scope (a
// different sublanguage with different tokens)
// then we we call parse_type() (instead of parse_expr())
auto& type =parse_type(context, r, parse_until_end);
// this nud is called by parse_expr() (hence expr-scope)
std::shared_ptr<ast::Expr>parse_enter_type_scope(
ParsingContext&context, reader tok, reader&r)
assert(tok.code()== code::less_than_sign);
r = tok;//< 1-token rollback happens here
// here we re-lex the next token (after the rollback
// just above) using the rules for type-scope (a
// different sublanguage with different tokens)
// then we we call parse_type() (instead of parse_expr())
auto& type =parse_type(context, r, parse_until_end);
// this nud is called by parse_expr() (hence expr-scope)
std::shared_ptr<ast::Expr>parse_enter_type_scope(
ParsingContext&context, reader tok, reader&r)
assert(tok.code()== code::less_than_sign);
r = tok;//< 1-token rollback happens here
// here we re-lex the next token (after the rollback
// just above) using the rules for type-scope (a
// different sublanguage with different tokens)
// then we we call parse_type() (instead of parse_expr())
auto& type =parse_type(context, r, parse_until_end);
// this nud is called by parse_expr() (hence expr-scope)
std::shared_ptr<ast::Expr>parse_enter_type_scope(
ParsingContext&context, reader tok, reader&r)
assert(tok.code()== code::less_than_sign);
r = tok;//< 1-token rollback happens here
// here we re-lex the next token (after the rollback
// just above) using the rules for type-scope (a
// different sublanguage with different tokens)
// then we we call parse_type() (instead of parse_expr())
auto& type =parse_type(context, r, parse_until_end);
This trick also requires a lexer that represents error as a dedicated token code instead of raising exceptions when they happen. You may still use exceptions if you want when an error is fatal for all sublanguages (e.g. non-ASCII character found on the stream).
Now what's this nud even parsing might be a valid question, so let's go over exactly what it's doing. Rust (which inspired my language's syntax heavily) allows one to access fields from a type. Field access here is done using the operator
::
::
. For instance:
usestd::time::SystemTime;
let now =SystemTime::now();
usestd::time::SystemTime;
let now =SystemTime::now();
usestd::time::SystemTime;
let now =SystemTime::now();
usestd::time::SystemTime;
let now =SystemTime::now();
However what happens when referring to your type requires access to the type annotation language such as in the case for generics? Then you need an "escape hatch" in the main language to access the type annotation language explicitly, and that's done through the nud for
<
<
:
// Inside the outer <>, we don't interpret
// `Vec < u32` as `Vec less-than u32`.
// Inner angle brackets must be balanced.
let my_vec =<Vec<u32>>::new();
// Inside the outer <>, we don't interpret
// `Vec < u32` as `Vec less-than u32`.
// Inner angle brackets must be balanced.
let my_vec =<Vec<u32>>::new();
// Inside the outer <>, we don't interpret
// `Vec < u32` as `Vec less-than u32`.
// Inner angle brackets must be balanced.
let my_vec =<Vec<u32>>::new();
// Inside the outer <>, we don't interpret
// `Vec < u32` as `Vec less-than u32`.
// Inner angle brackets must be balanced.
let my_vec =<Vec<u32>>::new();
So now you know how to parse this type of grammars with Pratt. Simon Ochsenreither once argued that using
<>
<>
for generics is bad design
⁷
, so maybe it's no coincidence that that's the only time that I actually had to use the rollback trick (which I consider a hack) in my project. Nevertheless it was the best compromise I could find so I went with it anyway. Language design is hard.
I have a lot more of lexer tricks to share, but I'm feeling that I should postpone them to later articles. Some of them are already used in my project. Ironically perhaps, but I acquired the mindset that enabled me to come up with these lexer tricks from past experience parsing HTTP and JSON which has nothing to do with the techniques that one uses to parse programming languages.
Pratt is a shift in parsing mindset. You must get comfortable on breaking grammatical structures into nuds & leds. It's totally okay to write shortcuts that remove the boilerplate by factoring the common parts of the implementation of prefix, infix and postfix operators as done by Douglas Crockford
⁸
, but if you're changing Pratt's algorithm itself as done by Alex Kladov in 2020
⁹
(I've done the same mistake myself once) to make accommodations because you refuse to reason in terms of nuds & leds (or any other reason), you're missing out and should start over. Using Pratt parsing as a black box abstraction will remove your ability to change Pratt's algorithm, and it may help in adapting your mindset. That's my advice to get you started.
I have a lot more of parsing tricks to share (e.g. Pratt-walk interpreters, REPLs with perfect auto-completion), but they're more advanced, and I'll postpone them to later articles.
Binance says fake job interview led to $6.3 billion crypto heist
Bleeping Computer
www.bleepingcomputer.com
2026-11-03 15:05:50
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets. [...]...
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets.
This new information was shared in an
incident report
published today, which details how the attackers used social engineering, malicious software, and compromised internal systems to carry out the October 29 crypto theft.
As
previously reported
by BleepingComputer, the FBI attributed the attack to North Korean state-sponsored hackers known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet, and APT38.
Binance says the attack began in September when a software engineer was contacted through a legitimate job-hunting platform by someone impersonating a Project Director at a fictitious company.
The employee's profile referenced his experience at Binance, making him a valuable target for attackers looking to breach the cryptocurrency exchange.
The fake recruiter scheduled two interviews for the employee, first with someone posing as a human resources representative, then with another individual claiming to be the company's CEO.
During the first interview, the fake HR representative held a live video call and shared a social media account with personal photos and videos to build trust.
The second interview took place through a popular social chat application where the employee was instructed to download a coding assignment from an online code repository.
According to Binance, the repository contained malicious code that, when executed, compromised the employee's device with previously unseen custom malware that antivirus software did not detect.
"The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server," explained Binance.
"The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging."
Binance explained that the malicious script created a replacement executable named
pyenv_
in the macOS Homebrew installation directory.
The script then deleted the legitimate
pyenv
executable, renamed the malicious file to
pyenv
, modified its symbolic link, and used it to spawn a Z shell (
zsh
) process.
The malicious replacement allowed the attackers to execute commands received from an attacker-controlled server.
By October 20, the attackers had used the compromised engineer's computer and an internal AI tool to compromise two additional employees working on Binance's wallet infrastructure, obtaining credentials and a container deployment token.
On October 29, the hackers used the stolen credentials to deploy a malicious script and gain unauthorized access to Binance's wallet signing service, allowing them to transfer billions of dollars in cryptocurrency across multiple blockchains.
The attackers also abused Ethereum's EIP-7702 authorization mechanism, allowing them to continue stealing cryptocurrency even after the exchange suspended withdrawals.
Binance says it has since rebuilt affected systems, replaced compromised devices, and revoked stolen credentials.
As of November 3, approximately $2.85 billion in stolen assets had been frozen or intercepted, while 98% of impacted token assets had been replenished as of October 31.
Binance says it is continuing to investigate the breach and has brought in independent security firms to review its findings.
Malicious job interviews
Fake job interviews that lead to malware installs are a common tactic in North Korean hacking campaigns known as Contagious Interview and Operation Dream Job. These campaigns use fake job offers and interviews to trick developers and cryptocurrency employees into installing malware.
In June 2025, cybersecurity firm Socket reported that a Contagious Interview campaign impersonated recruiters on LinkedIn and sent developers coding assignments containing malicious npm packages.
As part of these attacks, the
hackers distributed 35 malicious npm packages
that installed malware, allowing them to steal browser credentials, cryptocurrency wallet data, and other information from infected computers.
North Korean Lazarus hackers have also used similar tactics in
Operation Dream Job
, distributing malware disguised as employment documents to people working in software development and DeFi companies.
While Binance has not linked the employee compromise to either specific campaign, the use of a fake recruiter, multiple interviews, and a malicious coding assignment closely mirrors these previously documented North Korean tactics.
This article—the second in a series of four, examining the complex legacy, technical evolution, and future prospects of DNSSEC—sets out to fact-check common beliefs on DNSSEC, point to future-proof data collections on DNSSEC matters and provides an up-to-date perspective on what DNSSEC is like today. It was widely circulated for comments and has been endorsed by over 60 people across the Internet industry (see list
1
).
In the
first article
from our series on DNSSEC, long-standing DNS luminary Roy Arends and Barbara Jantzen (communicator at the DNSSEC-focused non-profit organization deSEC) have engaged in a dialogue, recounting how DNSSEC adoption has been substantially hindered by the protocol’s bad image—an image that cannot be accounted for by factual failures alone, demonstrating the impact of narratives on the perception of technical devices.
Image-wise, two narrative items have indeed been particularly influential: First, the
IANIX list
of DNSSEC-related outages since 2009, and second,
“Against DNSSEC”
(with its follow-up
FAQ
), a DNSSEC-critical blog post written by Thomas H. Ptáček in 2015. Both helped harden the perception that DNSSEC is more trouble than it is worth, and references to them still surface in forum threads on DNS matters, even as the protocol, tooling, and operational practices have evolved. It therefore seems timely to check how fit they still are to help assess DNSSEC’s usefulness today.
Providing state-of-the-art alternatives to the IANIX list
In every field of knowledge, if we want to assess phenomena, we need thorough documentation to establish and collect facts, to witness evolutions, to develop hypotheses as to underlying causalities and try them. And although absolute numbers can provide a fair amount of insight, relative numbers are more helpful in assessing significance—especially when data is collected multi-dimensionally, allowing analysts to grasp inter-dependencies and derive a hint at potential causes. Because ideally, when dealing with broken things, we need to know not only how broken they are, but also how they broke.
A list can be a starting point for documentary work, though. The
IANIX list
, however, despite its objective looks, is more of a discourse than a documentation (as highlighted
2
in our first article). In addition, it lacks transparency about its collection and curation methodology, making it difficult for readers to assess the list’s reliability and significance. As the IANIX site further does not disclose its operator’s name or contact, information on its modus operandi cannot be obtained.
Looking back, the IANIX list can be credited for having drawn the DNS community’s attention on DNSSEC-related outages and, in doing so, having acted as a strong driver for improving the protocol. However, with its bulk of information lying far in the past, and entries becoming scarce since 2020 (without any possibility to know if that is due to a recent decrease in reportable events or simply to less active maintenance), the IANIX list does not make a meaningful contribution today.
To broadly assess the actual outage impact of DNSSEC, we need state-of-the-art alternatives. What should these look like?
They should employ repeated (e.g., daily) measurements of the DNSSEC security status of a domain name sample of interest, such as TLDs and relevant subordinate domains.
Based on the resulting dataset, one may more objectively observe trends as well as specific classes of outages (e.g., are ccTLDs or gTLD more frequently affected? and how about IDN variants of a TLD?).
Additionally, if the dataset were further expanded to include the cascade of DNS queries and responses during resolution, different categories of failure may be discerned, such as signature expiration or synchronization failure during a key rollover (where the parent-side DS record does not match the child’s key).
Such longitudinal studies, consequently, could prove insightful in putting DNSSEC-induced resolution failures into perspective to other failure modes, in particular network issues or HTTPS misconfigurations that impact availability.
Good starting points in that direction are the
DNSSEC and DANE Deployment Statistics page
, which also has statistics on misconfiguration rates per TLD; a
timeline
of measured TLD validation statuses, provided by deSEC (the author’s non-profit employer) and based on
prior work
by Jaap Akkerhuis; the comprehensive dataset (2010-2025) used in a recent study by John Kristoff et al. (expected to be published later this month, at which time it will be linked here) which explores DNSSEC-induced outages and provides unweighed as well as downtime- and impact-weighed analysis (results cited at the end of this article); new
measurements
by deSEC contrasting percent-level error rates of both DNSSEC and HTTPS amongst the top 1M most popular domains. Another useful metric would be a public record (as recently
started
by Quad9) of how frequently resolvers use so-called Negative Trust Anchors (NTAs) to temporarily turn off DNSSEC validation when working around human errors, with the long-term trend being of particular interest.
Putting “Against DNSSEC” into perspective
The blog post “
Against DNSSEC
” was published by Thomas H. Ptáček in 2015, and got widely relayed. Its harsh critique of DNSSEC fell on fertile ground as numerous DNSSEC-related outages were happening and were given visibility by the IANIX list. This helped turn the blog post’s set of negative claims into potent beliefs that persist to this day and obscure actual implementation reality.
At the time of its publication, some of the blog’s criticisms reflected genuine limitations and operational experience, others were disputed even then. A decade of protocol, tooling, and operational evolution makes it useful to revisit how well they describe DNSSEC today, for the sake of a fresh assessment of implementation options.
To be fair, this is not the first effort to matter-of-factly assess the claims voiced in “Against DNSSEC”, but one of several such publications, spanning from 2015 to the present
3
—which incidentally corroborates the blog’s perceived influence.
These level-headed accounts, although they have not spread through the tech community as easily as earlier criticism did, still reflect (and contribute to) a gradual shift both in tone and in content, observable for instance in Hacker News forum threads where sweeping allegations on DNSSEC now
get challenged
instead of being swiftly echoed. However, even today in 2026, with automation standards having brought a substantial improvement to the protocol (RFCs
7344
,
9615
,
9859
,
10026
), common beliefs die hard—mostly among those less directly involved in technical matters, but with the power to weigh on decisions.
So, what are the common beliefs around DNSSEC? And how much truth is there in them today, in 2026? Because, obviously, common beliefs can also be true, half-true or formerly true.
1. Unnecessary, government-controlled and incomplete—Structural criticism
The first set of claims brought forward by “Against DNSSEC” dismisses the DNSSEC protocol as fundamentally flawed, for being structurally incompatible with its objective (preventing the manipulation of DNS answers). Verbatim: “DNSSEC is Unnecessary”, “DNSSEC is a Government-Controlled PKI”, “DNSSEC is Incomplete”.
Is DNSSEC unnecessary?—
NO
The main argument used in “Against DNSSEC” to dismiss DNSSEC as unnecessary is that “with TLS properly configured, DNSSEC adds nothing”, and that the security of TLS certificates is mainly bounded by an attacker’s ability to hijack a domain validation email sent to a domain owner (and thus, bounded by the security of email).
The first part of this argument ignores real-world attacks that DNSSEC would have prevented while TLS could not, as for example the
nameserver routing hijack of MyEtherWallet.com in 2018
, enabling the theft of $160,000 within two hours.
The second part overlooks that a significant part of data fetched from the DNS are not about finding an IP address for establishing a TLS-secured connection (like HTTPS web site connections), but about providing other information—such as TXT records (used for a myriad of purposes), or NS and (upcoming) DELEG records (both used for declaring a domain’s responsible nameserver). Without DNSSEC, these are prone to various kinds of attacks, which can enable impersonation of the domain owner, traffic interception, or a hijack of the entire domain. Most notably, without a DNSSEC-based indicator, the MX records used to find a domain’s mail server cannot enforce that the subsequent email delivery happens through an encrypted connection (unlike in the web, where the “https://” URL prefix indicates the encryption request).
In addition, while “Against DNSSEC” acknowledges that insecure email can be a problem during certificate issuance, it fails to recognize that DNS lookups are involved in
any
certificate issuance process, regardless of whether validation happens trough email, or one of the other (and more common) validation methods which involve publishing a validation string under the domain.
Actually, today, you can use CAA records to restrict methods for domain control validation during certificate issuance and simply ban the insecure email method for your domain. As a byproduct, DNSSEC not only secures certificate issuance by hardening domain control validation, but also provides an indicator to secure email, by linking the email server’s TLS key to the domain directly within the DNS. This technology, called DANE, has already been rolled out by large players such as Microsoft, and secures about
4.6M email domains today
.
Which means that actually both email and certificate issuance security are bounded by the security of the DNS, and that’s why it is material to up the authenticity level at this crucial layer of technology.
All in all, DNSSEC provides a much needed capability that TLS/HTTPS alone does not: It delivers signed, verifiable proof of origin for anything a registrant publishes, independently of any single application or delivery method. As such, it is a key enabling technology that lays a highly effective trust foundation on which applications such as DANE or CAA/TLS can rely to protect Internet users.
Is DNSSEC a government-controlled PKI?—
YES and NO
DNSSEC is the PKI for the Internet’s unique global namespace. It is a globally consistent, well-governed, and well-managed namespace that applications can rely on for identifying servers, devices, and other named resources.
Just like in the certificate PKI world (where trusting a certificate typically requires trusting a chain of Certificate Authorities (CAs) tying back to a “root CA”), DNSSEC’s security guarantees rely on intermediaries, namely the TLD registries (and potentially other sub-registries, if the domain has multiple dots). These registries, as all organizations (CAs included), are indeed subject to some degree of government control, in particular of the jurisdiction in which they are based. That fact, however, is unrelated to DNSSEC: the same security model applies to DNS without DNSSEC. DNSSEC itself does not increase or decrease the risk of legal action. That said, if this is a source of concern to you as a domain owner, you are free to choose which TLD you want to use, according to whom you trust and what is your control preference—without relying on CAs or third parties you don’t have a prior relationship with.
4
As far as the root zone keys are concerned, government control has been significantly reduced by what is known as the “IANA transition” in 2016, when IANA functions were shifted away from direct control by US-government’s telecommunications agency NTIA to ICANN’s multi-stakeholder governance. As a result, DNSSEC’s root governance and operation are grounded in a transparent multi-stakeholder model, its implementation is highly distributed, and many operational practices (such as key ceremonies and DNSSEC practice statements) are intentionally transparent and publicly observable.
Is DNSSEC incomplete?—
YES and NO
“Incomplete”, in the blog’s elaboration, refers to DNSSEC not covering the so-called “last mile”, because validation often happens on a DNS resolver trusted by the client
5
, instead of happening on the client itself. While true, making this choice is a trust decision, not a design limitation of DNSSEC. In fact, Apple
has been supporting client-side validation
since 2022, and Section 5.3 of NIST’s
“Secure Domain Name System (DNS) Deployment Guide”
does recognize such deployment realities. Explicit requests for client-side validation features, if directed at software vendors that currently lack support, could create momentum for others to introduce client-side validation as well.
Meanwhile, it is worth noting that most Internet traffic is protected with authentication and encryption certificates (first and foremost: HTTPS web traffic). For certificate issuance, Section 4.2.2.2 of the
certification rules
requires Certificate Authorities (CAs) to perform DNSSEC validation when making DNS queries, including the DNS queries made to verify that the requestor is actually under control of the desired certificate domain name. This legitimacy check is vulnerable to DNS attacks, but DNSSEC, if in place, prevents the check from being hijacked.
This means DNSSEC makes sure that an illegitimate requestor cannot actually obtain a certificate based on a DNS attack. Barring non-DNS attacks (such as a compromise at the registrar or the CA itself), only the legitimate certificate will be in circulation. Browsers in turn will only communicate with servers that have this certificate configured. In other words: DNSSEC’s security guarantees transfer to the domain’s HTTPS certificate, ensuring that a browser does not communicate with a rogue actor: Even if a browser or other end-user application does not itself perform DNSSEC validation, the fact that CAs do perform it effectively protects the client’s last mile HTTPS traffic.
Besides, many important DNSSEC use cases do not have a “last mile” and thus don’t suffer from this problem: Both DANE-secured email and DNSSEC validation during certificate issuance does not involve end user devices, but only server-to-server communication where the validating resolver typically is directly under control of the participants (CAs and email providers). In these use cases, server-to-server not only equals end-to-end, but is at least equally important.
Finally, the word “incomplete” raises the expectation that technologies may reach completion. Like just every other protocol (including TLS, whose incremental versioning is met with equanimity), DNSSEC is incomplete insofar as it is a living standard.
Operational practices and standards continue to improve, including:
better automation in signers and validators,
the ability for better coordination in redundant multi-provider configurations,
automatically relaying updates between child and parent zones (
RFC 10026
),
adding new signing algorithms and deprecating old ones,
serving as a secure service discovery mechanism and enabler for an increasing array of applications and services.
Regarding the “last mile” issue specifically, there are experimental efforts to facilitate end-to-end validation on the client without paying the latency price from additional DNSSEC-related lookups, by replacing them with pre-fetched DNSSEC chain data included in the TLS handshake (
RFC 9102
).
2. Cryptography, safety and architecture—Technical criticism
Three further claims revolve around the idea of DNSSEC being technically defective. Verbatim: “DNSSEC is Cryptographically Weak”, “DNSSEC is Unsafe”, “DNSSEC is Architecturally Unsound”.
Is DNSSEC cryptographically weak?—
NO
DNSSEC is often dismissed as cryptographically deficient because it doesn’t encrypt DNS responses. That criticism misses the point: DNSSEC is not designed to protect the confidentiality of DNS responses, but their integrity—by cryptographically signing them
6
.
For that purpose, DNSSEC adopts well-tested cryptography and continues to move with operational reality, including
broad migration
to and use of the Elliptic Curve Digital Signature Algorithm, dubbed ECDSA (algorithm 13) and well-matched to DNSSEC’s resource constraints. The same algorithm
globally leads
and
is generally recommended
for the signatures that constitute HTTPS certificates.
Moreover, work on post-quantum cryptography for DNSSEC is underway in the research and standards community. The PQC DNSSEC agenda includes
efforts
to assess and mitigate the resource impact of newly standardized and proposed PQC signature algorithms—which generally have much larger signature and/or key sizes than ECDSA.
In short, DNSSEC’s cryptographic strength has successfully evolved to meet modern cryptographic demands, and is poised to continue evolving to support the post-quantum future.
Is DNSSEC unsafe?—
NO
Under the umbrella of (un)safety, “Against DNSSEC” points out that DNSSEC (in its original form) allows obtaining detailed zone information by so-called “zone walking” (i.e., retrieving the list of all the subdomains of a domain from the responses to systematic DNS queries). That’s because DNSSEC provides signed assurance about which subdomains do not exist, and from that information one can easily conclude which do. While this is essentially a privacy issue more than a safety one, it can be addressed by enabling NSEC3—an automated setting to transform the non-existence response proofs into a hashed form of data, so that subdomains cannot readily be obtained unless explicitly queried for, if that is deemed necessary. (More complicated proposals like NSEC5, also mentioned in the blog post, were not pursued beyond the ideation stage by the DNSSEC community.) Alternatively, DNS operators that sign DNS responses on the fly can solve this problem using Compact Denial of Existence (
RFC 9824
).
However
,
even then, it is important to realize that the existence of most subdomains is exposed through Certificate Transparency (CT) logs: Both DNS and CT data, by their nature, are public, as there is no access control on who queries them. Hiding domain names therefore is an unreliable privacy strategy.
That said, DNSSEC can very well work in favor of privacy: in certain cases
7
, it allows a resolver to answer queries for non-existent names from its cache when it has seen a related (but not the same) DNS query before. This helps privacy (because data that is not sent to the domain’s nameserver cannot be eavesdropped on) and enables new defenses against common types of denial-of-service attacks (such as the Pseudo-random Subdomain Attack), turning DNSSEC into a safety belt that is useful beyond just protecting response contents.
Is DNSSEC architecturally unsound?—
NO
The argument made by “Against DNSSEC” to bring home this point is that security decisions are best made according to each application’s needs, and that DNSSEC is not an application-layer protocol. While this objection seems valid for a range of things (take captchas, for instance: some applications may be fine with bots, others may not), it does indeed seem fair for a domain owner to assert that they want their domain’s DNS information to come along with verifiable signatures, in order to prevent clients from connecting when validation has failed. It is true that this is not always done end-to-end (although that’s not a design limitation, see the “last-mile” problem above)—but the objection that network-level security mechanisms are architecturally unsound by definition is overreaching. The same argument could be made against Wi-Fi encryption, BGP route validation, or IP packet checksums (which are all network-level), but these security mechanisms are generally accepted.
3. Adoption and deployment costs—Economical concerns
One of the most hard-dying assumptions about DNSSEC is its costliness—which is likely to dissuade non-technical people in charge of budgets from engaging in deployment. According to “Against DNSSEC”, both the adoption and the deployment of the protocol are resource-intensive. Verbatim: “DNSSEC is Expensive to Adopt”, “DNSSEC is Expensive to Deploy”.
Is DNSSEC expensive to adopt and to deploy?—
YES and NO
For end users, DNSSEC is essentially free to adopt, with the added benefit of protection against attack-related losses (see the MyEtherWallet.com case above). In practice, all cost is carried by the resolver operator and the signing DNS operator.
Measurements
have shown that resolver-side memory and compute cost is small in practice. On the signing side, cost depends on how much specific expertise the signing operator needs to build
8
, and how many domains are being operated. Compared to signatures involved in HTTPS connections, DNSSEC signatures are computed much less frequently, so the cost of signing itself is not significant in light of the overall cost of operating an online service.
Overall, for well-run mid-size to large-scale operations, DNSSEC signing and validation during ongoing operations does not fundamentally change the financial equation.
Adapting software is certainly costly, but that task has largely been completed, and nameserver software today includes mature DNSSEC implementations by default. Also, while replacing old components in order to adopt more modern (automatic) solutions can be complex, the cost of new deployment and long-term operations has decreased significantly, with many DNS providers (such as Cloudflare, Squarespace, one.com, deSEC) and resolver operators (such as Cloudflare, Google, Quad9, DNS4EU) now routinely operating DNSSEC with full automation.
Some work
remains to be done with respect to the automation of DNSSEC configuration updates at the registry side, but progress is happening there as well.
“Against DNSSEC” also argues that network software is not equipped to handle DNSSEC failures smoothly (such as distinguishing expired signatures from an actual attack), and that “mak[ing] DNSSEC workable” would involve a lot of expensive code rewriting. That concern is diminishing, as browsers recently have made an effort to increase visibility into the origin of connection errors by implementing more detailed DNS error feedback based on
RFC 8914
9
. Such developments indeed come with some cost, but that cost—unlike suggested—does not preclude large-scale deployment, as demonstrated by > 90%
validation deployment
in countries like New Zealand, Saudi Arabia, Pakistan, and Ghana.
The elephant in the room: Availability
The common beliefs that have emerged from “Against DNSSEC”, however extensive and influential, are dwarfed by a much more impactful claim: DNSSEC’s alleged threat to availability—exposed and broadcast by the IANIX list, as laid out above. But, historical records aside, how true is that today? Or, in other words, does DNSSEC have high availability in practice?
Yes, it does. The above-mentioned study
by John Kristoff et al. (expected to be published later this month, at which time it will be linked here) has developed a measurement-based methodology and impact-weighted evaluation to quantify DNSSEC-induced outages. Its results show not only that the global DNSSEC deployment has had availability of over 99.99% in 15 of 16 years measured, but also confirms a sharp decline of incidents over the last five years. Accordingly, the occasional disruptive event (which still occurs, but has become exceptional) should not obscure the practical record of overall DNSSEC deployment.
As with any technology at Internet scale that requires interoperability amongst disparate implementations and operational environments, early DNSSEC adopters were likely to be hit by painful outages, due to misconfigurations or buggy code. Since then, thanks to engineering refinements and community-crafted operational standards, DNSSEC deployment has come to achieve demonstrably high availability across TLDs. All gTLDs as well as an increasing number of ccTLDs sign their zones, and many TLDs have successfully transitioned to new operators and/or algorithms, while remaining fully signed. And even if validation breaks (and the absence of an attack is confirmed), temporary NTAs (negative trust anchors) can restore basic availability—as
done by Cloudflare
and other resolver operators during the
.de May 2026 incident
.
DNSSEC is now considered to be important and stable enough to be a non-negotiable requirement for existing and
future gTLDs
. This policy-side view is matched by real world uptime records: Two of the world’s largest TLDs, .com and .net operated by Verisign, have long been DNSSEC-enabled, with more than 29 years of uninterrupted DNS resolution uptime. Also spotless is the uptime record of the world’s largest portfolio of TLDs, managed by Identity Digital (previously Afilias) and signed as soon as 2009.
In conclusion, as the facts presented in this article suggest, DNSSEC in 2026 should not be judged by limitations and operational records from its earlier deployment years (i.e., the trouble that triggered publications like the IANIX list and “Against DNSSEC”). Some concerns remain genuine tradeoffs, others have been substantially reduced by protocol evolution, automation, and operational experience.
In short, let’s not get stuck in archives. Instead—recognizing that DNSSEC has been stable and well tested in deployments for nearly two decades and continues to evolve when needed—let’s choose to draw on up-to-date information (such as presented in this article) and check out actual and successfully running implementations (like the DNSSEC automation showcases that will be provided by the third article of this series).
And if after doing so, with your own risk profile in mind, you make the informed decision not to use DNSSEC in your own setting, that’s perfectly fine. But make sure everybody else is also free to make their own choices—and accordingly, if others depend on you for having access to DNSSEC, don’t break their chance to use it, if they wish to.
Correction – October 20, 2026:
The list of endorsers has been corrected and updated with new endorsements.
Preparing for the Flipper One Kickstarter and opening pre-orders
Open Linux computer based on a powerful ARM processor. Network multi-tool — built-in Wi-Fi 6E and Gigabit Ethernet. Expandable via M.2 modules: 5G cellular modem, SDR radio and more.
Flipper One runs on completely open-source Linux firmware with a mainline kernel. This means ultimate compatibility with bleeding-edge kernel versions, free from vendor-specific BSP limitations and binary blobs. Our goal is to create a fully upstream-supported ARM computer that never becomes outdated, and a well-documented platform giving the community maximum freedom to customize:
Full mainline Linux kernel support
No binary blobs
No vendor-locked BSP
We have partnered with the Collabora team, who are actively working on bringing the RK3576 SoC into the mainline kernel, to make Flipper One fully upstream-supported and free from binary blobs.
Read Collabora blog post
CO-PROCESSOR ARCHITECTURE
Two independent processors work together in parallel, each controlling different sub-systems of Flipper One.
This architecture allows you to
control the Linux sub-system directly from the built-in LCD display
, without losing access to the device even when the Linux kernel is not yet ready or turned off.
Why 2 processors?
Low-power MCU (Raspberry Pi RP2350)
— an energy-efficient microcontroller responsible for core device control. It drives the LCD display, physical buttons, and status LEDs. It manages the power sub-system and controls the Linux OS boot parameters when the Linux sub-system is off.
More about MCU Firmware >>
High-performance CPU (Rockchip RK3576)
— a powerful 8-core ARM system-on-chip that runs the Linux operating system. It executes user applications, controls all networking interfaces such as Wi-Fi and Ethernet, and manages high-speed peripherals including USB3 and PCIe. It also integrates an NPU for AI acceleration and a GPU for graphics output via HDMI and DisplayPort.
More about Linux sub-system >>
ONE CABLE FOR EVERYTHING
Get SSH access and charge the device via a single USB cable! No extra adapters needed for Linux console access or powering the device — Flipper One can simultaneously emulate a virtual network adapter, a serial adapter (COM port), and a mass-storage device.
No drivers required on macOS, Linux, Windows, iOS, or Android.
NETWORK SCANNER
Analyze wired and wireless IP networks. Flipper One helps you map network topology, discover active hosts, and scan for open ports and services. It can also act as a passive sensor to detect network attacks and report anomalies.
POWER METER
The power consumption meter works like a wattmeter, showing in real time how much power the entire system uses, including the CPU and peripherals. It helps you understand what is happening under the hood: whether the system is idle or actively working.
M.2 MODULES
The core idea of Flipper One is an expandable hardware platform. Create your own specialized tool with a high-speed M.2 expansion module that installs inside the device, under the back plate. It supports almost any type of module — cellular or satellite modems, SDR modules, AI accelerators, SSDs (NVMe or SATA), and Wi-Fi cards via adapters.
Supported thickness: up to D3 (double-sided modules)
Interfaces: PCIe 2.1 ×1 / USB 2.0 / USB 3.1 / SATA3 / SIM card + eSIM
Extra interfaces: Serial Audio / UART / I²C
Open source mounting system
All mechanical parts for module mounting are
completely open source.
You can design your own antennas, cooling system, and mounting solutions for additional accessories.
GPIO MODULES
DIY modules can be connected via the GPIO connector using standard 2.54 mm pin headers. To make the assembled device easier to carry around, the GPIO module is positioned along the device body and can be covered with a protective cover.
Connect Flipper One to an external display with a single USB-C cable for a full desktop experience. Support for DisplayPort Alt Mode allows one cable to deliver power, transmit video, and connect USB peripherals such as a keyboard and mouse simultaneously.
Satellite NTN Modem
Satellite modem
NTN
(Non-Terrestrial Networks)
— is a satellite communication technology, a low-speed connection designed for IoT devices, standardized by 3GPP as part of the 5G and LTE specifications. It uses the standard cellular stack, including SIM/eSIM authentication, roaming, and regular IP traffic.
We want to add NTN satellite connectivity support to Flipper One to help popularize this technology and give engineers and enthusiasts a chance to work with real satellite infrastructure.
To make this happen, we're looking for a partner company like
Skylo
that's ready to work with us to add support for their satellite network to our eSIM module and help us choose a specific
NTN M.2 module
that we can officially support.
Read more on the
Modules → Satellite modem
page.
Built-in Advanced Wi-Fi Chip
Built-in Wi-Fi Chip
We want to build the most versatile integrated Wi-Fi into Flipper One — it needs to support all the features required for Wi-Fi network analysis, including monitor mode and packet injection. For now, we've settled on the popular Mediatek MT7921U chipset. It's modern enough, supports three frequency bands, and ticks just about every box. We're actively testing this chip right now and
we'd love you to join in
.
Why MT7921AUN?
The same chipset is used in the popular ALFA AWUS036AXML adapter, and there's a sizeable community around the open-source MT7921U driver. The main strengths of this chipset:
Modern Wi-Fi 6E: 802.11ax, 2x2 MIMO
Frequencies: 2.4 / 5 / 6 GHz bands
Open mainline Linux driver: mt7921u
Monitor mode support
Integrated Bluetooth 5.2
BUILT-IN eSIM
Flipper One has a built-in eSIM chip that comes pre‑provisioned with a Flipper SIM data plan.
To use the eSIM data plan, you need to install a 5G modem in the M.2 slot. You can also switch between the built-in eSIM and a physical SIM card.
What is Flipper SIM?
We're working on an experimental connectivity project for network geeks. Flipper SIM is a universal SIM card for routers, phones, and IoT devices, with advanced features such as always-on connectivity, outage-proof, traffic filtering, and network management tools. We'll share more details soon!
macOS 15 Sequoia had a hard time with CoreStorage – and thus encrypted HFS+ volumes – since it deprecated both technologies and callously crippled some important tools for working with them, but nonetheless it
mostly
still worked. While I’d often – but not always – have to manually unlock one of my HFS+ volumes – but not the others – at boot, and it also refused to convert some – but not all – volumes from HFS+ to APFS
1
, keeping me trapped in the situation – it ultimately still
worked
. I could get at my data and use the volumes more or less normally.
Unfortunately, in macOS 27 that’s no longer the case. Not only does Golden Gate just not support CoreStorage / encrypted HFS+ volumes, out of the box you can’t do
anything
with them – can’t mount them, can’t convert them to APFS, can’t even erase them. It renders your expensive storage hardware completely useless.
Worse, macOS 27 puts up a misleading dialog, upon boot, saying that macOS
28
(the
next
version) won’t support these volumes. I have no idea what Apple’s doing or thinking. Maybe it’s all just an embarrassing misunderstanding – the file system team told the notifications team that CoreStorage & encrypted HFS+ support is going away, and typoed the version number as 28 rather than 27?
Details
macOS 27 cannot mount CoreStorage volumes automatically or through any normal means. Worse, Disk Utility can’t mount them even when manually told to – it just fails with the cryptic error:
com.apple.DiskManagement.disenter error 49,153
diskutil mount
also
fails, this time with an error message that is a blatant lie:
disk27 is a CoreStorage Logical Volume which is locked; use "diskutil coreStorage unlockVolume"
$ diskutil cs unlockVolume BC304645-7D99-481E-931F-855B3011D89D BC304645-7D99-481E-931F-855B3011D89D is already unlocked and is attached as disk27 $ diskutil cs list CoreStorage logical volume groups (1 found) | +-- Logical Volume Group 0DC0EFB1-23CC-45BC-B37D-C1BBEBDAFCEB ========================================================= Name: Smash Status: Online Size: 2000054960128 B (2.0 TB) Free Space: 0 B (0 B) | +-< Physical Volume 1B5A1754-184B-4F17-A797-BF69B4BB627F | ---------------------------------------------------- | Index: 0 | Disk: disk10s2 | Status: Online | Size: 2000054960128 B (2.0 TB) | +-> Logical Volume Family 376204CD-8048-4962-B05C-72F4FC16B77B ---------------------------------------------------------- Encryption Type: AES-XTS Encryption Status: Unlocked Conversion Status: Complete High Level Queries: Fully Secure | Passphrase Required | Accepts New Users | Has Visible Users | Has Volume Key | +-> Logical Volume BC304645-7D99-481E-931F-855B3011D89D --------------------------------------------------- Disk: disk27 Status: Online Size (Total): 1999702634496 B (2.0 TB) Revertible: No LV Name: Smash Volume Name: Smash Content Hint: Apple_HFS
Tangentially: surprisingly,
hfsutils
(installed via
brew
) don’t work at all:
$ sudo hmount /dev/disk27 hmount: /dev/disk27: not a Macintosh HFS volume (Invalid argument) $ sudo hmount /dev/disk10s2 hmount: /dev/disk10s2: not a Macintosh HFS volume (Invalid argument)
But what’s even worse about this dumpster fire is that macOS 27
can
mount these volumes just fine – it’s just that all the
normal
ways to do it are completely broken. If you go down to a lower level and run
mount_hfs
directly, it
does
work:
$ sudo mkdir -p /Volumes/Smash $ sudo mount_hfs -o rdonly /dev/disk27 /Volumes/Smash $ ls /Volumes/Smash Documents Pictures Scratch space
That said… that
-o rdonly
parameter… in principle it shouldn’t be required, but I could
not
get macOS 27 to let me mount any HFS-on-CoreStorage volume as read-write – no matter what I did, it always fails with error “Resource busy” (EBUSY). I spent a lot of time trying to debug this, and could find
no
evidence of anything having the volume in question open (nothing in
lsof
etc).
But wait, it gets worse.
macOS 27 can’t even erase the volume. All the normal tools –
diskutil
, Disk Utility, etc – fail with that same “Resource busy” error.
Workaround
Thankfully, with the help of Gemini 4 Argon, I did find a workaround. It’s convoluted, but takes only a few steps, thankfully.
First, while if you try to delete the logical volume group it ostensibly fails, it doesn’t
completely
fail – it does actually delete the logical volume(s) within:
$ diskutil cs delete 0DC0EFB1-23CC-45BC-B37D-C1BBEBDAFCEB Started CoreStorage operation Unmounting Logical Volumes Destroying Logical Volume Group Erasing disk10s2 newfs_hfs: cannot create filesystem on /dev/rdisk10s2: Resource busy Mounting disk Could not mount disk10s2 after erase Error: -69832: File system formatter failed 1 💣 $ diskutil cs list CoreStorage logical volume groups (1 found) | +-- Logical Volume Group 0DC0EFB1-23CC-45BC-B37D-C1BBEBDAFCEB ========================================================= Name: Smash Status: Offline Size: 2000054960128 B (2.0 TB) Free Space: -none- | +-< Physical Volume 1B5A1754-184B-4F17-A797-BF69B4BB627F ---------------------------------------------------- (No properties) $ diskutil cs delete 0DC0EFB1-23CC-45BC-B37D-C1BBEBDAFCEB Started CoreStorage operation Destroying Logical Volume Group Error: -69783: Unable to delete the CoreStorage Logical Volume Group
You still can’t destroy it completely, nor can you erase the physical volume yet – the “Resource busy” errors persist. But, the trick is to
restart
– after that, you
can
then erase the volume.
So it seems that whatever broken thing is holding the physical volume (or logical volume group) in a ‘busy’ state is tied to the existence of the logical volume(s) therein, and once they’re deleted (and the machine rebooted) the bug stops being triggered.
Call for better workarounds
I’ve glossed over a
lot
of debugging and attempts I made to save the volume in-place, by either making it work as-is (even if only with e.g. hfsutils) or by converting it to APFS, but neither I nor Gemini 4 Argon could find anything that worked. It’s too late for me – I was forced to just delete all my HFS+ & CoreStorage volumes and rebuild them painstakingly from backups – but if anyone finds a way, I’d love to amend this post, for the benefit of future readers.
The problem remains the same in macOS 27 – so
three
major macOS versions, at a minimum, where essential system update functionality has not worked. Sigh.
$ diskutil apfs convert disk27
Converting the volume on disk27 to an APFS Volume on an APFS Container
Started APFS operation on disk27 (Smash)
Converting HFS Volume to an APFS Container which will export one APFS Volume
The target is the Journaled HFS+ volume "Smash" on disk27 backed via CoreStorage on disk10s2
Checking booter partition disk10s3
The target is a data disk; it is not a macOS system disk
No APFS EFI driver found to install
Saving encryption context
The target is encrypted
Unmounting disk27
Starting conversion from HFS to APFS
Performing apfs_hfs_convert -x --verbose=0x400 /dev/disk10s2
Reporting post-conversion statistics
A problem occurred during conversion from HFS to APFS
APFS Converter exit code is 1
Aborted conversion in commit mode so will restore type
Setting type of disk10s2 to CS
Changing the physical disk partition type in shared mode
Partition modification attempt count was 1
Not mounting APFS Volume
Exiting conversion operations with error code -69860
Error: -69860: The underlying task reported failure on exit
Underlying error: 1
↩︎
Safari 27.3 Beta Adds Vertical Tabs and Adaptive Dark Mode
Daring Fireball
www.macrumors.com
2026-11-03 14:26:41
Juli Clover, MacRumors:
With iOS 27.3, iPadOS 27.3, and macOS Golden Gate 27.3, Apple is
making major updates to Safari. The browser is getting a Vertical
Tabs layout, which can be used instead of the standard horizontal
tab bar. It’s a change that pairs well with the iPhone Duo’s
larger display...
With iOS 27.3, iPadOS 27.3, and
macOS Golden Gate
27.3, Apple is making major updates to Safari. The browser is getting a Vertical Tabs layout, which can be used instead of the standard horizontal tab bar. It's a change that pairs well with the
iPhone Duo
's larger display, but it is available across iPhone,
iPad
, and Mac.
Vertical Tabs are located on the left side of the display and use icons by default to save space, but there is an option to make the tab bar wider to show website titles as well. Vertical Tabs work with both Topics and Tab Groups to keep things organized. Topics are created when automatic
Apple Intelligence
tab sorting is turned on in
iOS 27
. Pinning tabs by dragging, quickly swapping between Tab Groups, and other features also continue to work.
The option to turn on Vertical Tabs is located in the Safari settings or in the View menu on Mac and iPad.
Apple is adding Adaptive
Dark Mode
for websites that don't have a dark mode design option by default. If you use Dark Mode and then browse to a website with a bright background color, Safari will offer an option to "Try" Adaptive Dark Mode.
After tapping Try, Safari renders a Dark Mode version of the page that makes the background darker, changes text contrast, inverts logos and graphics, recolors vector artwork, lifts raised surfaces, and rebalances layered shadows. Each website will be adapted based on what's needed to make it readable, so not every tweak is applied to every site. You can opt to turn Adaptive Dark Mode on for all sites or on a site-by-site basis after using it.
If a site has a native dark mode or has a dark design already, Adaptive Dark Mode won't activate. Developers can also add a tag that causes Safari to ignore Adaptive Dark Mode and show the website as the developer intended.
Along with these visual changes, Apple is adding new
Siri
AI actions. Siri can take action on tabs and windows, sorting, moving, closing, and arranging in Tab Groups. Siri also has control over web history, and you can ask it to clear your history for a particular site and for a set time period, such as the last 10 days.
Siri can already see what's on your screen, but soon, Siri will also be able to understand the full content of webpages, including non-active tabs and content not in view. You will be able to ask questions about information across websites, so if you have multiple tabs open when shopping for an item, Siri will be able to sort them by price or give you information on the product that you're looking at. Apple says the Siri awareness feature is coming, but it's not in the first beta.
The changes to Safari are available for developers starting today in the latest betas. An Apple Intelligence-capable device is required for the Siri features.
iOS 27.3, iPadOS 27.3, and macOS Golden Gate 27.3 will launch this December after several rounds of beta testing to refine the new features.
Apple released iOS 27.2, uniting the iPhone Duo and other iPhone models on the same version of iOS. iOS 27.2 is the first major iOS 27 update, and it adds several useful new features.
Siri AI Improvements
Siri AI can recall past conversations you had with it, so you can ask Siri about something it told you before, like a restaurant it previously recommended. It's also able to draw on more...
Apple released iOS 27.2 on October 26, bringing enhancements to Siri AI, adding Suggestions in Messages, and sneaking in a string of smaller additions across Photos, Podcasts, Games, Apple TV, and FaceTime.
iOS 27.2 is available to download to your device now via Settings ➝ General ➝ Software Update. Note that some features may not be available in all regions or on all iPhone models....
Apple today seeded the release candidate of an upcoming iOS 27.2 update to developers for testing purposes, with the update coming a week after Apple released the fourth iOS 27.2 beta. Apple also seeded the iPadOS 27.2 RC.
Registered developers can download the beta updates by opting in under Settings > General > Software Update and selecting the iOS 27 developer beta.
The beta was used...
As a programming language, ATS is both syntax-rich and feature-rich.
This book introduces the reader to some core features of ATS, including
basic functional programming, simple types, (recursively defined)
datatypes, polymorphic types, dependent types, linear types, theorem-proving,
programming with theorem-proving (PwTP), and template-based programming.
Although the reader is not assumed to be familiar with programming in general,
the book is likely to be rather dense for someone without considerable
programming experience.
All rights are reserved. Permission is granted to print this document for personal use.
Firm reveals details about how its cryptocurrency exchange was compromised, saying operation began in June The hackers behind the $6.3bn (£4.7bn) Binance heist used bogus job interviews, malicious software and an internal AI tool, the company has revealed. The world’s largest cryptocurrency exchange...
The hackers behind the
$6.3bn (£4.7bn) Binance heist
used bogus job interviews, malicious software and an internal AI tool, the company has revealed.
The world’s largest cryptocurrency exchange was compromised in an operation that began with an inadvertent download of malware in June, led to a recruitment scam in September and then a raid last week of “hot wallets” where billions of dollars worth of crypto-assets were taken.
The FBI has blamed North Korea for last week’s heist but Pyongyang,
a prolific crypto-hacker
, described the accusation as “absurd rhetoric” on Tuesday.
According to an update
Binance
released on Tuesday, the hackers got their first foothold in the summer when a company engineer inadvertently downloaded malware that exposed the employee’s role and that of others in the team that looked after Binance’s cryptowallet infrastructure.
A fake project director then contacted a different engineer on a legitimate job-hunting platform, leading to a first-round video interview with a sham HR representative and a second-round interview – on a chat app – with the “chief executive” of a fictitious company. It was during the second interview that the engineer was tricked into downloading malware on to his computer.
On 20 October, the attacker used the compromised computer plus an internal AI tool to gain control of the engineer’s system and that of a second wallet developer on the same team. Then on 29 October, the attacker used the second developer’s computer, using stolen credentials from the first engineer, and triggered a malicious script to launch the attack.
Binance said $2.85bn of the $6.34bn drained from cryptowallets in the attack had been frozen or intercepted.
Deepfake job interviews are a
known part of North Korea’s cyber-arsenal
, but normally from the other side of the process – where bogus IT professionals apply for jobs as a means of funnelling money back to Pyongyang.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in the update.
The FBI said on Saturday that North Korea was responsible for the hack.
“The FBI is trying to brand the DPRK [the Democratic People’s Republic of Korea] as a ‘cybercriminal state,’ claiming that it obtained information that a hacking organisation ‘supported’ by the DPRK was involved in the incident,” KCNA quoted her as saying.
“But the US assertion is absurd rhetoric and nothing new,” said Kim, a ruling party official.
“It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cybercrimes in different parts of the world are our deeds.”
Your terminal manipulation/navigation setups
Lobsters
lobste.rs
2026-11-03 13:54:55
Dear Lobste.rs, over a year after my previous post on mouse free setups, your advice was instrumental to building the tech stack I use today as a disabled person, composed of the Svalboard, Talon Voice, and a fair few extensions for Talon (including ones I've written myself.)
One aspect of my work a...
Dear Lobste.rs, over a year after
my previous post on mouse free setups
, your advice was instrumental to building the tech stack I use today as a disabled person, composed of the Svalboard, Talon Voice, and a fair few extensions for Talon (including ones I've written myself.)
One aspect of my work and personal life that has remained stubbornly able-bodied has been, surprisingly, my terminal use. Reading, manipulating, and editing the terminal has required keyboard and mouse use at every step:
When reading the terminal, scrolling is a must, which demands the use of a physical scrolling device, one of my most consistently difficult actions.
When writing a terminal command, things can range from easy to brutal. Talon has a lot of built in terminal commands available, but composing complex commands still requires a great deal of typing. The most irritating aspect to me is editing a previous command, which consists of either holding (Ctrl+) an arrow key and waiting until I hit the right character, often overshooting, and then having to go back the opposite direction with the arrow keys again, OR moving with my mouse and clicking on the correct position.
When manipulating the terminal, this usually winds up boiling down to copy and pasting text from the output. This is universally a fine grained mouse movement to highlight and copy the correct text, often to paste it into the same terminal.
Too often I find myself combining the second and third actions, which means a lot of arrow key or mouse movement to get to the position in my command, mouse movement to copy and paste text, and then rinsing and repeating a handful of times.
I am fairly convinced there is no true voice first terminal experience-- this is something I am hoping to change. In order to accomplish this and maybe make my life easier, I want to know the landscape of how various people interact with their terminals in 2026. I feel like my approach is deeply inefficient and must be missing something obvious...? We've had terminals since before mice existed, surely there are better ways.
Trump Scrambles to Halt Military Aid to Israel to Deprive El-Sayed of a Talking Point
Intercept
theintercept.com
2026-11-03 13:52:07
In a Fox News interview, Trump said the U.S. will stop giving Israel weapons for free because Abdul El-Sayed keeps talking about it.
The post Trump Scrambles to Halt Military Aid to Israel to Deprive El-Sayed of a Talking Point appeared first on The Intercept....
The United States
will stop providing $4 billion in annual aid to Israel starting next year, President Donald Trump claimed in an Election Day interview. While the U.S. will continue to sell arms to its closest Middle East ally, Trump’s announcement — should it actually hold true — could represent a seismic shift in American foreign policy.
Still questions remain and experts are dubious that the claim is what it seems.
Trump told Fox News during a phone call on Tuesday that Israeli Prime Minister Benjamin Netanyahu had approached him with the idea years ago. He did not state specifically why he waited to announce the decision in the midst of a midterm vote in which his party is
expected to lose its lock on Congress
, but noted that U.S. aid to Israel has become a Democratic talking point, singling out Michigan Senate candidate Abdul El-Sayed. “The left uses the $4 billion payment — that everybody knows about, it’s no secret — as a signal of unfairness,”
said
Trump.
An August 2026 Fox News
poll
found 55 percent of Michigan voters oppose continued military assistance to Israel, including 70 percent of Democrats, 66 percent of Independents, and 35 percent of Republicans.
U.S. public support for Israel has fallen since the
Gaza war
began in 2023, particularly among Democrats, as Netanyahu’s government has slaughtered civilians with impunity. Almost 75,000 Gazans have been killed and nearly 176,000 wounded, according to the Palestinian Ministry of Health in Gaza. A recent
U.N. report
said, “Israeli authorities and forces continue to commit genocidal acts with the genocidal intent to destroy, in whole or in part, the Palestinians in Gaza.”
Amid the slaughter, sympathy for Israel among all Americans fell from roughly 50 percent to 36, while sympathy for Palestinians rose to 41 percent, according to a February Gallup
poll
. Among Democrats, support for Israel plummeted from more than 50 percent in 2001 to roughly 17 percent this year. October 2026
polling
from the Institute for Middle East Understanding’s D.C.-based IMEU Policy Project and YouGov found a majority of voters in six key swing states — Georgia, Iowa, Maine, North Carolina, Ohio, and Texas — support halting the transfer of bombs to Israel.
“You can consider it barter. You can consider military aid or cash,” Trump said. “Look, we give them $4 billion of things and money, and they don’t need it. And I was approached by Bibi Netanyahu, and we’ve been talking about it for a couple of years because it’s a lot of money.”
“President Trump is a serial liar who has announced over $20 billion in weapons giveaways to Israel since taking office and launched a war at Israel’s request that has already cost every U.S. household over $2,000 — the equivalent of $262 billion,” said Hamid Bendaas, IMEU Policy Project’s communications director. “He and other politicians realize our taxpayer funding for Israel is a liability. That’s why he and his allies in Congress are at this very moment trying to advance legislation to conceal support for Israel by integrating Israeli weapons companies into the Pentagon. This is a bait and switch that would result in Americans funding Israeli weapons makers in record amounts.”
“This is a bait and switch that would result in Americans funding Israeli weapons makers in record amounts.”
Others expressed skepticism about Trump‘s claim of an immediate end of annual aid in 2027. “It’s not plausible there will be a total cut-off starting January 1,” said Josh Paul, who spent more than 11 years as the director of congressional and public affairs at the State Department bureau that oversees arms transfers to foreign nations before resigning in 2023 over U.S. military assistance to Israel, noting that funding is baked into existing and pending legislation. “My guess is that he was speaking off the cuff with the next 10-year memorandum of understanding between the U.S. and Israel in mind, but did so in a way that is at best inaccurate or imprecise.”
A decade ago, President Barack Obama signed an unprecedented MOU with Israel to give its military $38 billion between 2019 and 2028, amounting to almost $4 billion a year.
Paul was hopeful, however that Trump’s statement would allow Republicans license to join Democratic colleagues in paring down future funding. He said it was a recognition of the bipartisan demand by the American people for an end to that military aid.
Trump’s announcement did not address the proposal in the National Defense Authorization Act, which would inextricably link the U.S. armed forces and the Israeli military, giving Israel leverage over the Pentagon.
“Initial reporting on Trump’s statement omits a crucial fact: that the National Defense Authorization Act contains a provision intended to protect U.S. tax dollars flowing to Israel from the massive shift in U.S. public opinion against funding Israeli aggression,” Annelle Sheline, who served as a foreign affairs officer in the State Department’s Bureau of Democracy, Human Rights, and Labor, told The Intercept. “The provision would move U.S. funding out of security assistance under the purview of the State Department — which carries legal provisions like the Leahy Laws, transparency requirements, and an annual congressional vote — into the Pentagon procurement process, which has none of these.”
Sheline added, “Insulated from public opinion and away from public visibility, U.S. funding to Israel is likely to grow exponentially.”
With his popularity in free fall in the U.S., Trump teased the possibility of decamping for Israel and taking Netanyahu’s job as the Israeli prime minister battles for his political life after an inconclusive election last week. “In fact, if people ever got tired of me in the U.S., I’ll move to Israel, become prime minister,” Trump declared during his Fox appearance.
The White House did not immediately respond to requests for further details.
Google: LLMjacking attacks rack up $1 million in cloud AI charges
Bleeping Computer
www.bleepingcomputer.com
2026-11-03 13:51:04
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day. [...]...
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.
Companies can record costs as high as $1 million due to fraudulent calls using stolen API keys, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant in analyzed incidents.
Based on their observations, there are "two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure."
The researchers identified two categories of threat actors: those who scan for publicly exposed LLM endpoints and those who steal valid API keys from unprotected machines.
After gaining initial access, the attackers sell it to services known as LLM mixers, which provide their subscribers with unauthorized access to LLMs.
Once access is resold, request volumes can spike suddenly, sometimes exceeding 1,000 requests per second. The service provider records the requests as legitimate consumption and charges the victim organization for the tokens.
LLMjacking usage spike
Source: Google
GTIG and Mandiant observed an increase in this type of activity this year, with fraudulent charges exceeding $100,000 in a single day, and cumulative charges at some organizations reaching $1,000,000.
LLM mixers offer access to AI resources at very low prices, using their proxy infrastructure to relay customers' prompts to hijacked services through stolen API keys.
The researchers found several examples of such relaying infrastructure, including Jet Night, which sells “unlimited access plans” for $60/month, and the newapi[.]pro service.
“Another threat actor that executed more than 500,000 LLM API calls in less than eight hours leveraged stolen third-party API keys to power the token routing service jet-night.com,”
Google says
.
“Jet Night passed nearly one million dollars in token costs to the victim organization.”
Jet Night pricing plans
Source: Google
Google also identified the threat cluster UNC6993, which appears to use gateway tools to aggregate stolen keys and distribute requests, and likely sells access via underground forums.
The attackers gain access via exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens, and LLM API keys.
Attackers search the compromised environment for credentials, logs, databases, and secret managers, and try to create backdoor accounts or inject SSH keys to maintain persistent access.
The researchers have also observed threat actors exploiting CVE-2026-40217, a vulnerability in LiteLLM that allows running arbitrary code on the server by leveraging the custom-code guardrail testing endpoint.
In some cases, Google says that attackers used the victim's cloud infrastructure to host unauthorized proxy endpoints and agentic workloads.
"For example, one threat actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs rebranded under a persona known as D1337-KAIROS," the researchers say.
Google recommends several actions to protect against LLMjacking attacks, which start with prioritizing Identity and Access Management (IAM) and securing the supply chain.
Companies should use centralized secrets platforms to enable the rotation and management of sensitive keys and secrets. Users should not have extended privileges unless required by their role and tasks.
"Deny all permissions that are not explicitly required, including access to Cloud LLM services," Google recommends.
Enforcing phishing-resistant multi-factor authentication (MFA), ensuring monitoring tools provide comprehensive visibility across the environment to identify unauthorized LLM and AI services (shadow AI), and setting API usage and spending limits can help organizations detect LLMjacking attacks early, limit their impact, or prevent them altogether.
Furthermore, cloud audit and inference logs should be enabled and monitored for unauthorized service activation, suspicious credential checks, unusual usage, and attempts to disable logging.
Last October
, I took stock of how I was using AI — specifically the cool stuff like LLMs that we
call
'AI’. I’m so glad I did. Things are very, very different 12 months later.
I still believe I use AI fairly typically, but I’ve had a notable change in background. Last October, I was an engineer on Microsoft’s Windows AI team. I am now a research engineer at Salesforce AI Research. I spend more time supporting scientists & building rapid prototypes, rather than working with a large team of engineers. I spend about ~$3,000/month in tokens.
In any case, I mostly use AI in the same ways as last year:
Coding
Research & search
Summarization & transcription & (new) voice
Writing
Art & music & (new) video
Also new this year, I’ve drafted a personal
AI policy
; we’ll start there.
As before, this remains purely my opinion & speculation. If you use AI differently, let me know!
This year I began drafting a personal AI policy — as in, a document for how
I
want to use AI in my life. I am very excited about it. I am also working on an explicit AI policy for this site (still thinkin’; probably based on
Hank Green’s policy
), but a personal policy is to give me a framework for using these tools day-to-day.
AI leaks into life. Teammates ask Claude to write their Slack messages, grandparents generate creepy memes of their grandchildren, and researchers delegate their thinking to machines. I’ve seen all of these things; even strong creators like
Hank Green
and
BrainPOP
get lost.
Humans clearly do not have norms for using these tools, and we’re messing up. I hope that a personal policy will ground me as AI becomes smarter. I hope to adapt that policy over time, and I’m eager to see how it evolves. I’m also open to draft 1 being utterly, hopelessly wrong.
Ultimately, I want to spend my life making cool things with other people. AI can help, AI can hurt. A policy helps me find the difference.
Last year, I waxed poetic about how GitHub Copilot
autocomplete
transformed how I write code.
Autocomplete is still good (the dim lines)
Well, uh, I no longer write much code.
Agentic coding
has made it obsolete.
My workday now means managing ~5–6 Claude Code (or OpenCode or Codex or Pi) agents. I’ll give Claude a feature to implement, or a bug to reproduce, or any other task I used to do by hand; each agent gets its own copy of the code (a Git worktree, if you’re technical), then just… gets to work. The agents write code, run tests, even create & review PRs.
They
let me build fast
: agents will prototype any new feature in ~20 minutes. I truly cannot count the number of features, bugfixes, tests, and tools I’ve (AI’ve?) been able to build because of these agents. For example, AI let me test confusing audio code on
macOS
and
iOS
in just a few minutes.
They
let me try crazy things
: human teams aim to
“fail fast”
; agents can fail
ultra
-fast. I’m happy to test crazy new ideas and throw out what doesn’t work well. It was able to wire & test
a huge change to Mumble
that added better noise cancelling; I use my beta build of it nearly every day.
They
remove drudgery
: I’ve had agents diagnose & fix urgent bugs with nothing more than a description and a “please fix!” while I continued working on other things.
They let me
be kinder
: since agents write everything, it is simple to propose sweeping changes to my teammates during code review, or even write my own versions — both things unthinkable in the era of hand-written code.
I do not believe
engineering
is solved: left to run on their own, agents will build poorly-functioning, over-architected, unreadable, self-congratulatory piles of slop. Every friend I’ve asked agrees that agents
still
need human taste and experience to produce good work. Some of that is minutiae (like that annoying
status dot
Claude likes to throw onto sites), but most of it is critical. Agents tend to get lost on their own. My most successful work this year was hand-writing a tool, replacing ~4,000 lines of vibe-code with a few hundred. My system has proven more flexible, easier to test, and more generalizable than what it replaced.
It remains to be seen how long that human edge will last, though.
I also now reckon with the
fatigue
of using these agents. Managing 6 different conversations with 6 different robots about 6 different features is overstimulating & exhausting in a way that coding never was. When I started using agents, I remember rushing to answer their questions like they were human colleagues waiting for help! While I have tempered that
anthropomorphic bias
, it’s exhausting to juggle so many problems at once. The allure of sending just one more prompt before lunch… then dinner… oy. There is also, as I wrote in
Consider the chairmaker
, the decline of craft. My friend Peter laments ceding the joy of programming to machines: for many of us, honing the code, finding the right design, seeing the parts mesh together — that was the meditative purpose we found in our jobs. Now, we rarely write anything. We instead delegate it to agent number 7.
But let me return to the joy of working with agents: they are so fast, so open to feedback, and so intelligent. Working with them can be utterly delightful.
For example, while I was building a harness for voice agents, one programming agent decided (correctly) that my simple test harness was insufficient. So it used my Mac’s built-in text-to-speech to
directly test the voice agent it was building
. Then, newer agents started doing it, too. Either they had documented the technique, or they were each smart enough to independently discover it. Directly testing the product they were building. Absolutely brilliant.
Agents frequently recommend knobs & settings that I’ll reject for being too complex and unnecessary — and, voilà, I’ll need the knob next week. Silly human!
Anyway, because of agentic coding,
agentic pull requests
are increasingly the way I review agent code. “Make a draft PR,” I write, “I’ll review it soon!” And review it I do — agents still aren’t reliable enough to trust without validating, so I’ll still review their code & test it manually. However, I don’t do the “line-by-line” code reviews I used to do with humans. I focus instead on architecture, on larger patterns in the code. Are there systemic issues with an approach? Should I add new agent guidance to CLAUDE.md? Can I build better test harnesses, so the machines can test their own code?
Agentic
code review
is surprisingly helpful here: I try to write rules for the code review robots whenever I notice a recurring issue with generated code, so the agents will identify & fix issues by themselves. One rule I enjoyed creating: a "
Claude-y comment detector
." You think my writing is verbose? Try Claude’s.
On more typical engineering teams, human code review seems increasingly difficult. A friend of mine complained that his teammates simply ask “their” Claudes to review code written by other Claudes. An ouroboros of Claudes! Agents catch bugs & stylistic issues very well, but they are abysmal at designing architecture. Agentic code review is certainly not a replacement for humans yet.
AI code review
catches
a correctness issue in my code
Last year, I was skeptical of
inline editing
and
code mode
, both features of GitHub Copilot. They were not very useful then, and they are even less useful with agents. I have removed them from the table.
Last year, I was excited about research & search: they were the most frequent reason I used ChatGPT. Now, generative AI is the
default
way I do those things.
The biggest change has been Google’s AI summary. Google’s first or second result is almost always an AI summary, and it’s usually decent. So my
traditional search
is now AI-first by default. Is it perfect? Absolutely not. In one day, it gave me
incorrect URLs for NPR’s RSS feeds
and
couldn’t find the origin of “AI’ve”
.
Mallow, the art vtuber who is a lizard on TikTok who gives short tutorials
I often avoid using LLMs for pub facts, in the same way I generally avoided Google for them before, because I like puzzling with my friends. I like
Fermi problems
.
But I’m more and more excited about using LLMs as
teachers
to
explore well-known concepts.
I breezed over this last year, but that is unfair to LLMs. I believe they are the greatest teachers humanity has ever created.
I had an LLM walk me step-by-step through fine-tuning Mistral to speak like a pirate (yarrr).
I had Claude use a socractic method skill I
found via Dan MacKinlay
to help me brainstorm new approaches for semantic endpointing (knowing when a user is done speaking) in voice agents.
I asked Claude to explain typical approaches to a complex legal document.
I’ve even had Claude quiz me on a long code review, to ensure I understood what the agent had written. The open-source project Mumble actually
added a similar quiz
to their AGENTS.md a few weeks ago.
Claude quizzes me on EMT stuff
I am
actually
jealous of the endless care & patience that these machines show. I hope we discover how to share this patience with our kids while ensuring our kids still learn. Veritasium’s Derek Muller discusses this in
What Everyone Gets Wrong About AI and Learning
: AI is incredible at drilling repetitive practice, at giving immediate feedback, of all the things a private tutor can do… if you ask it to.
“The world is full of heavy objects,” he says, “and yet most people are not ripped.”
That is my greatest fear with AI tutoring today. That these machines must be
reminded
to teach. Per Muller, learning requires Type 2 thinking — enaging the slow, reasoning mode of your brain. This is very difficult. Your body will surreptitiously & continuously nudge you out of this mode. Tutors exist to force you back into it. But ChatGPT exists to
do
things for you: it is so fine-tuned for that use that it tends to
forget “it’s meant to be a tutor”
, even when previously asked. What learning may occur when you have both forgotten your desire to learn?
This differs from my biggest concern last year: accuracy. Responses then often had basic factual errors, but that seems less of an issue today. I think there are 2 basic factors:
I am more AI-literate
. I think more of us have a “sense” of what AI can do well, so we avoid the jagged edges.
AI is smarter
. Just like in coding, I think we hit an inflection point this year, where models are simply
smart enough
to answer more things reliably.
MAJOR spoilers for
Control
if you click, but there’s a reason Google’s AI summary of its ending (using Gemini 3, from November 2025)
is simple and correct
while Bing’s (using ~GPT 4o, from May 2024)
is not
, conflating the game with its sequel.
This trend extends to
literature searches
. Last year, I shared my trepidation about using LLMs for complex literature searches. My skepticism remains: these machines have access to everything ever written, so they can support any premise in good faith. Also, it is well-demonstrated that LLMs have default bias,
politically
or in other fields, like
business strategy
. I am worried about their ability to subtly impose worldview, either
on their own
or at the behest of corporations and governments.
Yet LLMs are now my
first choice
for literature searches. That’s partially because Google searches have that AI summary on top, so I end up reading it, but also because LLMs have been
much more
effective than traditional search at finding good, nuanced data for me — despite potential bias. You must remember that Google Scholar search kinda sucks: when I started researching
Car touchscreens are cheap, not good
, for
months
I could not find any studies beyond one done by an auto magazine—
Vi Bilägare
. That was despite having worked at
a Georgia Tech lab
that
researched car user interfaces
! Especially as they’ve gotten smarter & I’ve developed intuition, LLMs are good finders. Just see Claude’s investigation
into human perceptions of latency
for me:
Claude even made graphs!
Ultimately, though, human experts are still more reliable than agents. That’s how I moved forward with “Car touchscreens”—I asked someone from that GT lab. I’ve also been buying more books, even slightly-obsolete ones like Card, Morgan, & Newell’s
The Psychology of Human-Computer Interaction
(everyone, including LLMs, cite it) or old editions of Wicken’s
Engineering Psychology and Human Performance
(via a nuclear consultant I met at a wedding). They ground my research, simply by offering a legible worldview.
And that’s why I’ve been disappointed in AI as
collaborator
for
novel research
. AI has
harmed
some research I’ve been doing.
My team at Salesforce has been
working on voice stuff
, and I’ve been trying to improve turn detection — understanding when a user is done speaking. That’s a hard problem, and it’s been a great opportunity to read fundamental research on how human conversation works (finally!). AI was great at finding that research and good datasets (though my teammates gave me context the AI never did). And it was great when I asked it to use the Socratic method to help me design my own turn detection model — until, on a whim, I asked: “are there better architectures?” Why yes, yes there were. AI had led me astray.
That’s not the only time AI waylaid me. LLMs could not figure out how to annotate that model’s training data correctly. I spent days going back and forth with them, trying to decide how to separate turns from interruptions. It is embarrassing how simple the problem became after one good discussion with a human teammate. LLMs are not yet good companions when brainstorming complicated things.
LLMs (and local models!) remain uninterestingly good at
summarization & transcription
.
I’ve been using
OpenWhispr
and
Handy
to dictate to my computer, especially to talk to my agents. The best models on the planet run on your computer locally, for free. My biggest complaint is that the
apps
have bugs (hotkeys work inconsistently, etc.). It’s hard to describe a more boring type of success.
Dictating to my computer, entirely local, entirely free
My meetings have automatic notes. My friend built a local pipeline to transcribe & search his childhood home videos. Vikram Oberoi built a site (in 2024!) that
automatically transcribes NYC city hall meetings
. You can do all of these things on your Mac.
However, I have yet to reliably use
voice
beyond dictation.
There’s a reason my team at Salesforce is researching it: voice is the original modality. It
should
be a seamless way of talking to these human-like robots. But I have never felt compelled to talk to my robots; it’s never been frictionless or private-feeling or useful enough. Does old-school Siri count?
I still do not use AI to
write from scratch
, nor as an outlining aid, for things I make.
I’ve narrowed this rule a bit from last year. Last year, I argued that LLMs always lacked
context
and so were poor communicators. With agentic coding, that’s changed. So I’ve had agents
document experiments
I designed but had no hand in executing, or
write READMEs
for code they generated end-to-end.
But even that limited exception irks me. I do not like when
I
stumble upon AI-generated spew, so why should I subject others to it? To that end, I’ve started prompting my agents
to identify themselves
whenever they write prose, and I often end up rewriting their documents myself (or at least adding an executive summary). That has helped, but I’m not certain it is enough.
In general, I’m surprised
how bad
AI remains at writing. AI writing is demanding to read: usually plodding, repetitive, and vapid — but then randomly terse and vague, like it doesn’t understand its own words. Agents will so often cite & quote & summarize every paper ever published, then synthesize it all into a mound of nonsense. That is the AI fog I hit: do I misunderstand all these new papers, or did the LLM just serve up some
pseudo-profound bullshit
? It is bewildering to me that these models can solve generational math problems on one hand, yet utterly fail to describe turn-taking behavior in humans on the other. That is, I guess, their
jagged intelligence
. They do not reason like we do. They cannot be fine-tuned to speak like we do. So they solve problems we cannot, and share them in reports we struggle to understand.
Do I misunderstand all these new papers, or did the LLM just serve up some pseudo-profound bullshit?
In any case, it should not be surprising that I do not use AI for writing or outlining in my communication; neither at work nor on this blog. My employer pays me for
my
ideas, which only I can voice. And I write on this blog for fun. Writing is an art and a skill I enjoy pursuing.
Why would I delegate my voice to a machine that writes tedious dreck?
It’s still great for
finding words
. Google AI talked me out of
writing “hawking off”
(which is not an expression) instead of “ceding” later on. But I’m tempering my regard for it as an
editor
. Despite my positive & worried assessment last year, when I spoke to several friends who asked agents to edit their job applications, their feedback was universally tepid. Agents were sycophantic, reluctant to be critical. And anyone who worked around this (by saying, for example, "
my friend
wrote this") found that agents offered misplaced, trite advice that lacked nuance. The agents seemed to regress to the mean: helping those with the worst writing and hindering those with the best. The agents were… fine.
As one friend put it:
[AI writing] is as good as it was 3 years ago. Which, when you consider how much everything else has changed since then…
I avoided using AI editors altogether this year, out of fear that they would erase my voice. But I’m increasingly certain they would just blandify it.
AI tells
remain the same as always (“You’re absolutely right!”), and these machines seem incapable of improvement without substantial guidance. Perhaps it’s
survivorship bias
, but these very smart machines produce very mediocre writing.
Finally, art. I still don’t have a good use for
image generation
.
Last year, I used AI to generate a few odds and ends, but I stopped this year, mostly out of a vague sense of discomfort. I felt like I was ceding opportunities for creativity to the mediocrity machine.
I’ve enjoyed a lot of the
low-effort memes
I’ve seen;
We need more data centers
is one of my favorite jokes all year. And AI helped design some useful presentations I attended. But I’m not sure how AI art fits into life on Earth. Last year I
thought
I saw AI art at a gift shop. Well, now I’ve seen
AI Sketchers ads
, AI event posters, AI restaurant menus, AI logos for stores and e-sports teams,
AI canvases at HomeSense
, and
AI t-shirts
at Walmart. It’s everywhere, and it’s explicitly replacing human art. Gross.
@JH-ty2cs
: “AI Doompop is my new favourite genre”
I think AI art & music are beautiful when they are used as lenses for human creativity, rather than replacements for it. I guessed something similar last year, and I think last year’s music proved me right. As soon as commercialism replaced creativity, I was out. I soured on
Eiden XII
when they started sharing new “but it hits different” covers weekly, and I got bored of
steel coils
-style edutainment after hearing the first clone. There’s something cynical and manipulative about a synthetic woman belting
“talk me out of dying”
when some dude (presumably) makes money every time I play it.
Similarly, I haven’t listened to any of the new Doompop that’s hit my feed. It’s cool when you generate a few songs; less cool when you post every day. It feels like vultures picking ad revenue from the corpse of a good idea.
That is evident in the world of
video generation
. I largely escaped last year (although my mom got some weird
whale-cleaning videos
), but now I’m seeing a bunch. I see AI ads all the time — most memorably with
horrid horse-people
in Sixt ads. I got baited into a video of a fake Edna Mode lookalike & some slop WW2 history videos, and my wife got tricked by
AI summaries of Adventure Time
marketed as sleep aids. All of them hoping to get views, to get ad revenue, to get — as Corridor Digital puts it—
“a little bit skimmed off of that YouTube trough.”
It is sobering to open an AI history video in Incognito and gaze at the
misleading
slop recommended next to it:
25 of 33 (75%) of the recommendations on an AI slop history video are AI slop
It is horrid to see these machines that can mass-produce art being used to mass-produce art. And I know that seems silly, but there’s a world where we use these tools to elevate artists, just like coding agents elevate me.
I am lucky I do not make my living from art. Art remains valuable to me. Even if AI can write a song faster than I can, I still doodle, I still play piano.
12 months since my first abortive attempts to have agents write code. 10 months since Claude Code first made me say, “wow,” when it built me an insurance comparison tool in one shot. And now machines write 90%+ of my code.
It is a brave new world. Where these machines also
ship corporate slop
and
leave mathematicians in shock
. But I think of how my uncle uses these tools to build his own software; how my friends make software that helps us stay in touch; how these things have helped me learn so, so much. Tools can be used to help people.
That is how I hope to use AI.
Thanks to Peter Kreiseder and Atherai Maran for consulting. Claude helped make the status icon look more Claude-y.
I cancelled OpenAI about a month ago, which is crazy. OpenAI was my first AI subscription! But most of my personal usage is Claude Code, and I ended up using Claude for random questions instead of ChatGPT. And last year we thought OpenAI was so far ahead!
I use GitHub Copilot Pro solely for autocomplete.
Louis-Philippe Véronneau: Tenure
PlanetDebian
veronneau.org
2026-11-03 13:00:16
Last week, I received confirmation from my college's human resources department
I was awarded tenure. If you ever worked in the academic world, you know how
big of a deal this is.
In our fast moving and ever-increasingly unstable world, it is a pretty strange
feeling to know you have a stable, well-...
Last week, I received confirmation from my college's human resources department
I was awarded tenure. If you ever worked in the academic world, you know how
big of a deal this is.
In our fast moving and ever-increasingly unstable world, it is a pretty strange
feeling to know you have a stable, well-paying job for the rest of your career.
I am truly privileged to have an occupation I greatly enjoy.
Three cheers for another 30 years!
Google researchers demand freedom to tell the world what they know about AI
Every marketing lead I talk with sees potential of comparison content, but also see it as a double-edged sword they're not comfortable investing in.
The hesitation usually comes from some mix of (1) it feels unnatural to give your competitors their flowers on your own website, and (2) comparison pages come with maintenance overhead nobody wants to deal with.
Competitors ship things, change their pricing, get acquired (or acquire others), and all of a sudden the article you wrote in March is outdated in June.
So how do you walk the line between being fair (complimentary, even) to your competitors while still capturing demand & showing off your product's strengths? And how do you keep the content accurate once it's out in the world to avoid spreading misinformation?
Both are worth figuring out if you want to write comparison content that doesn't get dunked on. And both are things I'm here to give some answers to based on our experience
writing comparison content at PostHog
.
Why bother with comparison content?
Because it works.
Since 2021,
over 25k people have signed up for PostHog after reading a comparison
. Almost 50% did it within 24 hours of reading; ~75% within 30 days.
Content type (2025 FY)
Unique visitors
Visitors who later signed up
Conversion
Head-to-head comparisons (PostHog vs X)
30k+
3,000+
~10%
Alternatives and "best X tools" roundups
100k+
4,000+
~4%
Every other blog post
250k+
6,000+
~2.5%
It makes sense why they overperform. Someone searching for this style of content has already decided they need
something
, the only question left is which one. Comparison content sits at the sweet spot in the funnel where that decision gets made, and your job is to help make it (ideally in your favour, but not always and that's okay. More on that later).
Our credentials
Technically, our first comparison was a roundup.
The best open source analytics tools
went live in October 2021 and is still our single most-read piece of comparison content, at 150k+ pageviews and counting.
It set the template for the early days: "best open source X" for
session replay
,
A/B testing
, and
feature flags
. Open source was one of our wedges, so that's what we compared on.
The first head-to-head,
PostHog vs Amplitude
, followed in May 2022. It still gets a few hundred readers a month, which is more than I can say for most things we published back in 2022.
Matomo
and
Mixpanel
came next.
We went from three to fourteen in a year, and the maintenance problem flared up. Three pages you can keep accurate by hand; fourteen, each with a feature table and pricing that changes every quarter, not so much. It's, to this day, a workflow we're constantly working on solving for and improving.
2024 was the alternatives year. A lot of our competitors got a "best X alternatives" piece:
Hotjar
,
Statsig
,
Plausible
,
Matomo
, and about fifteen more. We also launched
error tracking
, wrote
PostHog vs Sentry
in August, and watched it become our most-read head-to-head of all time within two years.
This isn't an AEO fad for us; we were writing comparison content BeFoRe iT wAs cOoL, back when the answer engine was a guy named Greg on Stack Overflow.
And while they have shapeshifted plenty since then, we've stayed true to two principles:
Respect the reader's intelligence, and meet them where they are. A developer comparing tools is smart, busy, and already halfway towards a decision. Give them the answer as accurately and as directly as possible, and let them make the right call for their product and use case. Also, they can tell if you're generating AI slop comparisons, it's a bad look.
Be the comparison page you'd want to read
PostHog doesn't have every feature every competitor has (
yet
), and we're fine admitting it. Our credibility with the reader is worth more than whatever we'd "win" by fudging the truth.
We're not the solution for everyone. We are
the best solution for someone
(a lot of someones, actually), and the job is capturing
their
attention. Which means you will, occasionally, lose a deal on your own website: someone reads PostHog vs Competitor, concludes Competitor is the better fit, and goes and buys Competitor. We wish them godspeed and focus on our ICP anyway.
In practice, this means picking up a few uncomfortable habits:
Acknowledge your gaps and credit their wins.
"If you need X, they do it better than we do today" is a sentence you'll find on our pages. Softening it with what's coming is fine (a roadmap link, a "we're working on it"), as long as you're clear about where you are
right now
for the readers deciding today.
For example, earlier this year our articles admitted we were weaker on APM because we hadn't shipped
distributed tracing
or
metrics
yet. True at the time. We've since shipped a full APM suite, and the articles now say that instead. Our content matches our shipping, not just our ambitions.
Readers don't think less of you for crediting a competitor; they think more. It's the cheapest trust signal in content marketing, and almost nobody uses it. And as AI eats everything else about content, trust is one of the few things left you can't generate.
Say the nice thing.
There's another reader to keep in mind, too: LLMs. When someone asks Claude "PostHog vs Sentry for a Next.js app," we assume the model pulls from sources it judges to be balanced. So be balanced. You want to read as a source, not an ad.
Being honest used to be a brand decision (one we've proudly stood behind), but now it might be a distribution decision too.
Write a "who should pick them" section.
If you can't write a fair paragraph about where your competitor wins and who they might work better for, you don't understand them well enough to compare. Go read their docs.
It's also the place to be honest about who you are and aren't building for: plenty of our competitors are openly built for marketers for example, and while lots of marketers run all their reporting on PostHog (yours truly included), we're still building for AI-pilled engineers first, and we say so.
The reader who isn't a fit should leave feeling helped, not hustled. Honest pages also don't make enemies: the fastest way to go viral for the wrong reasons is a dodgy comparison, and if you'd rather not be bashed on Hacker News or Twitter for being slimy, be fair.
Take corrections from competitors.
We've shipped edits because someone at a competitor emailed us, DMed us, or better yet, opened a PR directly against our blog. We welcome it and encourage it. (Yes, if you're a competitor reading this, this is an invitation.)
Here's an example from today:
Lucas Harras, a Senior Customer Success Architect at Amplitude, read our
PostHog vs Amplitude
page, found four features we'd marked as missing that Amplitude actually has, and
opened a PR
.
We merged it the same day, and because every comparison table renders from that file (more on that below), every page that mentions any of these features was corrected by the next deploy.
Sometimes you'll be offered a slice of humble pie, and it's important to eat it gracefully.
My litmus test for every comparison: if a competitor wrote this exact page about PostHog, how would I feel reading it? Would it feel like they'd done their homework, or would I feel misrepresented and annoyed? If it's the latter, it's probably worth trying again.
We haven't always gotten this right. Part of it is that not everyone uses the same words for the same features, and some of our competitors have several hundred of them. A "sort of" column doesn't exist, so every row is ultimately a judgment call, and we've made some wrong ones.
But we're committed to doing better every time.
How to maintain comparison pages
Staying accurate across ~90 comparison and roundup pages for years is an engineering problem, and we started treating it like one.
1. Every competitor is a centralized data file.
In the posthog.com repo there's
a folder with one file per competitor
:
sentry.tsx
,
amplitude.tsx
,
hotjar.tsx
, and so on. Each file holds everything we claim about that company, in one place; here's a simplified version of what that looks like:
Feature keys come from a shared dictionary, so "session replay with network payloads" means the same thing on the Hotjar page as the LogRocket page.
Most of our comparison tables render from these files through one component. When a competitor ships a feature, someone changes one line in one file and every page that mentions them updates on the next deploy. The repo is public, so competitors can see exactly what we say about them and open a pull request if we're wrong.
2. Scouts checks our homework
Data files solve "update once, publish everywhere", but they don't solve for "notice that something changed" – that's what
we've used Scouts for
.
We run two. The first watches our competitors: it reads the competitor files I mentioned above, visits each competitor's pricing and docs pages, and reports back when what they say and what we say have drifted apart.
The second watches us. It turns out a very embarrassing way to get a comparison wrong isn't overstating a competitor, but understating yourself. (I learned this the hard way… occupational hazard of shipping as fast as we do.
*
wink
*
)
So the second scout reads our comparison pages against our own changelog, docs, open PRs, and Slack threads, and flags anywhere we might be underselling ourselves.
A few things make both of them better than a script that pings you every time a page changes:
It has memory between runs
, so it doesn't re-flag the same thing every week, and it learns what "normal" looks like for each site.
It's selective by design.
Most runs end with nothing to report, and that's it working. It ignores changes that don't affect the overall comparison.
It shows its evidence
: what their page says now, what our file says, and a suggested edit, with sources.
A human ships the fix.
The scout posts a digest to Slack with a link to open a PR. A person decides whether the change is necessary, opens the PR, and merges it.
Here's an example of what this looks like in practice. First, the Slack digest:
The scout does the noticing, a human does the deciding, and nobody needs to add a recurring "re-read every competitor's pricing page" task to their calendar. Amen to that.
We haven't reached our final form yet (will we ever?). One of my goals this quarter is going back through all of this content and making it better, and I'm sure there's plenty we're still getting wrong.
But the point is we started. Five years, 90-ish pages, and tens of thousands of signups later, "write honestly about the people trying to eat our lunch" has turned out to be one of the best decisions we've made for our organic content strategy; not the most intuitive one, but still one of the best.
So if you've been circling the plunge, take it. Be fair, be accurate, and let a robot handle the maintenance so you don't have to. (May I suggest
ours
?)
And if you're a peer who's nailed this (or who has failed at it and has war stories and words of caution to share), my DMs are always open.
Allow docking kitty windows to the edges of other windows or of the tab, for
status bars, file trees, etc. Create them with
launch
--type=window-dock
or
launch
--type=tab-dock
, see
Docked windows
A new option
restore_session_after_logout
to save the state of every
kitty instance, including scrollback, when logging out, restarting or
shutting down and restore it the next time kitty starts. On macOS, the state
is encrypted with a key in the keychain. On Linux, it requires the Inhibit
desktop portal. See
Restoring kitty after logging out
(
#1197
,
#10659
)
Allow using tabs like named workspaces: A new
launch
--focus-existing
option to focus an existing window or tab instead of creating a new one, a
new
by-title
value for
launch
--location
to keep tabs in
alphabetical order and new options for
kitten @ detach-window
and the
detach_window
action to send windows to a named tab, creating it if
needed (
#10627
)
Wayland: The client side window decorations used on compositors such as
GNOME now look like native GNOME decorations and follow the desktop titlebar
font, text scaling, button layout and titlebar click action settings
(
#10766
)
Wayland: Support touchscreens. A tap is a click, a finger that moves scrolls
with momentum, and a finger held still before it moves selects text
(
#5432
,
#10551
)
Custom shaders: New
cursor-trail-railgun
,
cursor-trail-torpedo
and
cursor-trail-pixiedust
shaders that make particles fly off the
cursor as it moves, in the style of neovide. Shaders can now be controlled
with key presses via the new
shader_event
action (see
Controlling shaders with key presses
), can be faded in and out, reversed and looped
with new
animation_*
pipeline directives and can define a
pointer_map()
function so that clicks and selections land on the
text shown under the mouse, which the
crt
shader now uses, see
Shaders that move content
. Also fix animations becoming jerky after
kitty has been running for a few hours, shaders specified by path not being
found and various pipeline bugs (
#10587
,
#10667
,
#10693
,
#10595
,
#10694
,
#10639
)
Graphics protocol: Add two new
indexed color image formats
whose pixels are indices into the terminal color
palette, so that images change color along with the color scheme, and allow
clients to detect support for individual protocol features, such as
animation and Unicode placeholders, via the new
e
query key, see
Querying support for protocol features
(
#9379
,
#10732
)
Layouts: Align the borders of neighboring windows and keep the gaps between
them uniform, and add a new option
collapse_window_margins
to have
the margins of neighboring windows collapse into each other instead of
adding up (
#10508
)
Window resizing: A new
--strategy=edge
mode to select and move a
specific internal divider in the Splits layout, and hold
Alt
with a
resize letter to take a fraction of the remaining resize steps, configurable
with the new
--fraction
option
Scale the thickness of box drawing characters, cursors and the window title
bar border with the font size, so they no longer look too thin when zoomed in
or too thick when zoomed out. At the configured
font_size
nothing
changes (
#10362
)
mouse_map
can now map the scroll wheel, via
the
wheel_up
,
wheel_down
,
wheel_left
and
wheel_right
buttons, for example, to change the font size with
Ctrl
+
scroll
Show the hand pointer and hover highlighting over links only when the pressed
modifiers match a configured mouse action for opening the link with a single
click, updating immediately when modifiers are pressed or released
Sessions: A new
os_window_position
keyword and a new
--os-window-geometry
option for
save_as_session
to save the size,
position and state of OS Windows in session files. Also fix the OS Window
size and
os_window_title
in sessions sometimes being ignored
(
#10675
)
Command palette: Show action and kitten aliases at the top when the search
query is empty, so they can be used to pin frequently used actions (
#10711
)
Linux/BSD: Detect MIME types for
open actions
and
kittens using the shared-mime-info cache, matching the rest of the desktop,
including files without an extension, such as
Makefile
, and MIME
type aliases (
#3056
)
IME: Keep the candidate window anchored at the start of the pre-edit text
and at the cursor, so it no longer jumps around while composing text. On
macOS, commit in-progress IME or dictation text instead of discarding it when
the OS window loses focus (
#10642
,
#10644
)
Shell integration: Make the kitty terminfo files available in commands run
via
run0
, similar to
sudo
(
#10692
)
kitty
--config
=NONE now also skips the automatic color theme
files,
open-actions.conf
,
launch-actions.conf
,
mime.types
,
paste-actions.py
,
notifications.py
and
the custom window icon in the kitty config directory
Processes kitty inserts to wrap the program it runs, such as
/usr/bin/login
on macOS or the wrapper for
launch
--hold
,
are now skipped when reporting the pid, working directory, command line and
environment of a window in
kitten @ ls
and when matching
windows. Also fix
launch
--cwd
=root
using the working
directory of the foreground process instead of the root process while the
shell is running a command
Nightly builds now show the date and hash of the commit they were built from
in the output of
kitty
--version
and
kitten
--version
Do not render between render frames to reduce flicker from programs that draw
with many small partial updates (
#10749
)
Performance: Faster growing of the GPU sprite cache, particularly on macOS,
less CPU usage with a non-zero
input_delay
and no continuous
re-rendering when a selection is present and the window is scrolled back
(
#10714
)
Remote control: Fix a crafted request being able to bypass password based
remote control authentication by masquerading as a cancellation of an
asynchronous request
Remote control: Fix many commands, including
action
,
send-key
,
set-colors
,
set-background-opacity
,
set-font-size
,
ls
,
run
and
set-enabled-layouts
, ignoring options, reporting false
success or silently misinterpreting invalid input, particularly when used in
remote_control
mappings.
set-colors
now parses color files the same
way as
kitty.conf
. Also fix a single unresponsive peer blocking all
remote control communication and a crash when using damaged images with
set-window-logo
or
set-background-image
(
#10672
,
#10632
,
#10688
,
#10690
,
#10715
)
Fix various terminal emulation bugs, including in origin mode cursor
position reports, erasing multicell characters, the CHT escape code and
copying text containing tabs, wide characters being drawn on the wrong row
after colliding with scaled text, emoji sequences being split into multiple
cells when wrapped, text typed into a new window before the program is ready
sometimes being garbled, as well as a heap buffer overflow, an out of bounds
write and a use-after-free when reloading the config (
#10609
,
#10729
,
#10632
,
#10682
,
#10767
)
Graphics protocol: Allow shared memory object names without a leading slash
again, for sandboxed macOS applications, and fix various bugs with animation
frames and Unicode placeholders (
#10684
,
#10599
,
#10632
)
Fix various window and tab management bugs, with focus moving to the wrong
window on close, drag and drop onto title bars, visual window selection,
Grid layout placement, title bar padding and tab titles being truncated too
early.
detach_tab
now shows custom titles in the OS Window chooser
(
#10640
)
Fix render jitter when scrolled back with a partial line and the client is
using the synchronised rendering escape code (
#10794
)
Fix bold or italic Nerd Font icons sometimes being rendered using glyphs
from an unrelated font, the cursor trail not always being shown when focus
moves to a different window,
watcher
entries not being removed on
config reload and changing text marker colors at runtime, for example with
kitten
@
set-colors
or automatic theme switching, applying the colors
of each marker to the next one (
#10591
)
ssh kitten: Preserve the permissions of copied directories, fix copying
files outside HOME whose paths share its prefix and files in HOME being
copied to an absolute path with
--symlink-strategy=resolve
when HOME
is a symlink, fix hanging when re-using a shared connection that has
silently died and fix colors 16-255 being set to white with themes that do
not define them (
#10691
,
#10661
,
#10727
,
#10737
)
Desktop UI kitten: Fix D-Bus activation when kitten is installed in a path
containing spaces or quoting characters (
#10784
)
Automatic color themes: Stop using cached colors and background images after
the corresponding theme file has been deleted and apply theme files created
after kitty was started when reloading the config (
#10786
)
Themes kitten: Fix overwriting the Unicode input kitten’s recent entries
and input mode, and vice versa, by using separate caches (
#10780
)
Remote file kitten: Preserve the local edited copy and show its recovery path
when the final upload fails, including when the SSH connection has died
(
#10789
)
Transfer kitten: When receiving files, replace existing symbolic and hard
links at the destination instead of overwriting the files they point to, and
write to a temporary file that is renamed into place, so an interrupted
transfer no longer leaves a truncated file behind (
#10713
)
Drag and drop kitten: Reject copying or moving a directory into itself or
one of its subdirectories, and moving a directory into a symlink that points
inside it, which would delete the moved files. When moving, do not delete
sources that were replaced during the drop, for example by files merged
through a symlink in the destination. Respect overwrite
confirmation for case and Unicode equivalent names on filesystems that treat them as aliases, list the
existing files that will be overwritten under their actual names, including
inside symlinked directories, and fix dropping a directory over an existing
file. No longer rename remotely dropped files whose names differ only in case
on case sensitive filesystems (
#10769
,
#10772
)
Drag and drop protocol: Fix base64 data with padding at the end being
rejected, as allowed by the protocol (
#10777
)
Clipboard kitten: Fix only the last of several outputs that use the same
MIME type being saved, for example with
kitten
clipboard
-g
picture.png
picture.jpg
, the data is now
downloaded and decoded only once for all such outputs. Reject duplicate
output files, including ones that differ only in case on case-insensitive
filesystems or whose paths contain a symlink followed by
..
. Fix a race
when replacing an existing output file, losing the original file if writing
it fails and
kitten
clipboard
-g
-m
.
formats.txt
silently doing
nothing. Also preserve the permissions of and follow symlinks at existing
output files (
#10738
,
#10744
)
Kittens: When saving files, such as themes, config files or clipboard
output, write to the target of a symlink even when the target does not yet
exist, instead of replacing the symlink with a regular file (
#10740
)
Kittens: Fix laggy mouse selection and failures comparing remote
directories in the diff kitten, Unicode quotes not being removed from around
paths and URLs in the hints kitten, the order of styles with negative or
closely spaced fractional axis values in the choose-fonts kitten, various
bugs in the choose-files, quick-access-terminal and other kittens and reject
command-line options missing their required value (
#10634
,
#10641
,
#10676
,
#10687
,
#10730
)
Wayland: Fix a crash on compositors without cursor-shape support, kitty
being disconnected by GNOME when showing a long covered window, the app_id
being lost when hiding and showing windows,
kitty --os-window-tag
not setting the window tag and various drag and drop bugs (
#10597
,
#10602
,
#10604
,
#10759
,
#10632
)
Linux: Fix momentum scrolling up or left, X11 wheel events from sources
without smooth scrolling being ignored and various desktop notification
bugs. Notifications now identify kitty’s desktop file, so desktops such as
KDE can group them (
#10625
,
#10695
,
#10610
,
#10721
)
macOS: Fix padding rendering black after sleep, OS windows not staying on all
spaces, a duplicate path when dropping items from Apple Mail, emoji from a
monochrome emoji font such as Noto Emoji not using the foreground color, a
memory leak, reloading config causing Apple injected shortcuts to not work
and kitty freezing when opening a new window while another entry
in
/dev
is stuck (
#10708
,
#10581
,
#10628
,
#10673
,
#10741
,
#10757
,
#10793
)
zsh: Respect the user’s
descriptions
format style for completion group
headings, fixing literal
%B
markers appearing with fzf-tab, and fix a
“maximum nested function level reached” error at every prompt after
interrupting a command run at shell startup, for example via a session file
(
#10748
,
#10768
)
Fix reverse-video extra cursors to use the color type encoded by the
multiple-cursors protocol.
Make reverse-video cursors follow dimmed text colors while keeping text under
block cursors legible.
A new option
detect_url_regex
to detect arbitrary text, such as file
references in compiler output, as clickable URLs under the mouse (
#10407
)
Reduce input latency by processing small amounts of program output, such as
the echo of typed characters, immediately instead of waiting for
input_delay
(
#10560
)
Drag and drop: Restore the previously active tab after dropping a dragged tab
on the same OS window’s tab bar, even if it was reordered after a hover switch
Drag and drop: Fix an out of bounds memory access when parsing a URI list sent
by a remote client that does not end with a newline (
#10618
)
Sessions: Expand launch option variables when an option value matches the command name
Preserve transparent background colors when applying unrelated launch color overrides
ssh kitten: Preserve SSH option values following a spaced
--kitten
option
Fix a memory leak when loading a corrupt PNG image that has an embedded ICC
color profile
Custom shaders: The builtin
dim-inactive-windows
shader no longer dims
the tab bar and the padding, border and margin around the active window (
#10524
)
Custom shaders: The builtin
northern-lights
shader is now about twice
as fast. Its
MARCH_STEPS
setting can now be lowered to trade a little
quality for even more speed on slower GPUs
Custom shaders: A new
cursor-trail-motion-blur
shader that makes
the cursor trail glide smoothly during fast cursor movements
Vertical tabs: Improve rendering of tabs when using the
powerline
tab_bar_style
Graphics: Fix images briefly disappearing for one frame the first time an image is replaced during a synchronized update (
#10538
)
X11: Fix copy and paste targeting the wrong OS window when the keyboard focus
is set to PointerRoot or None
diff kitten: Fix freezes and very high memory use when a very long line, such
as in a minified file, is changed
themes and choose fonts kittens: Fix search freezing for many seconds when
typing a long query, such as the full name of a theme
macOS: Fix a custom dock icon reverting to the stock icon after a progress
bar is cleared (
#10545
)
macOS: Fix regression in 0.49 that caused rounded rect shader to not work on
ancient macs with AMD GPUs (
#10549
)
diff kitten: Fix search not finding matches at the end of a line
hints kitten: Fix delays of many seconds when selecting paths or line
numbers on a screen with long lines that contain no spaces
File transfer: Fix a security issue where a malicious program on the remote
machine could bypass the transfer confirmation prompt when no
file_transfer_confirmation_bypass
password is set
Fix an out-of-bounds memory access when drawing a multi-line text sized
character with the cursor below the bottom margin of the scroll region
Fix a heap buffer underflow when parsing ANSI-C quoted strings in
the command line sent by shell integration via the OSC 133 escape code
macOS: Fix a regression in 0.49 that caused rendering issues after wake from
sleep or display re configuration under memory pressure due to a bug in
Apple’s OpenGL drivers (
#10571
)
Drag and drop: Hover over a tab while dragging a window or a single window
tab to switch to it and choose a split position. Drop a window at a tab edge
or gap to put it into a new tab at that position. Dragging tabs now shows an
insertion marker rather than moving the other tabs during the drag. See
Overview
for details.
Splits layout: Dragging a divider now resizes only its adjacent regions,
consistently after rearranging windows. Fix nested dividers not tracking
mouse movement correctly, including when returning from a minimum size.
Splits layout: Fix windows in a nested split overlapping their neighbour by a
couple of pixels when the split is resized down to its minimum size.
Splits layout: Fix the next split collapsing to a single line after
equalizing a tab with only one window, or closing a window with
equalize_on_window_close
enabled (
#10522
)
icat: Fix a regression in 0.49.0
--transfer-mode=memory
not displaying anything and
--detect-support
reporting
files
, because the names of the POSIX
shared memory objects it created were missing the leading slash mandated by
the graphics protocol (
#10517
)
Fix a packaging bug that could cause pipeline files to be omitted from some
kitty builds
save_as_session
: Show an error instead of saving next to the directory
when the specified path is an existing directory (
#10520
)
A new option
remap_modifiers
to allow having modifier keys behave as different modifier keys (
#10307
)
A new option,
padding_fill_strategy
to control how the thin padding strips that appear when the window size is not an exact multiple of the cell size are colored. You can choose to have the padding colored to match the background of each neighboring cell, effectively extending the size of the cell or you can continue to use the existing behavior of using the background.
Splits layout: Add an optional proportional sizing policy that preserves
adjusted window weights when adding, closing or repositioning windows.
See
Arrange windows
for configuration (
#10471
)
The
scrollbar
option now takes a new value
scrolled-or-hovered
to also show the scrollbar when the mouse moves over the scrollbar region (
#10345
)
A new
kitten
@
screenshot
remote control command to take a pixel perfect PNG screenshot of an OS Window, tab or window
A new
kitten
@
set-os-window-title
remote control command to set the title for an already-open OS Window and optionally restore automatic title tracking when no title is specified
Wayland: Fix the first movement of the scroll wheel after reversing direction
often not scrolling, with high resolution wheels such as the Logitech MX
Master 3 (
#10306
)
Allow dragging selected text to other windows or applications with the
mouse_selection
drag_or_normal_select
mouse action, in addition to
its existing support for dragging links. See the
configuration
examples
to enable it.
Sessions: Also save/restore layouts other than the currently active layout (
#10324
)
Wayland: Fix clipboard sharing between kitty instances in containers with isolated PID namespaces and stale paste data when used with clipboard managers that restore application private MIME types (
#10352
,
#10376
)
When expanding a window in alternate screen mode use the most common
background color as the color for the newly created lines leading to less
visual flicker until the application can redraw itself (
#10365
)
macOS: Allow kitty OS Windows to participate in Split View tiling (
#103701
)
Allow dropping a tab containing a single window into another tab’s layout,
using the existing window drop preview and preserving running programs.
See
Overview
for details.
Port remaining built in kittens from Python to Go (
#10371
)
Splits layout: Fix dragging a border resizing the wrong split in nested layouts.
Linux: Fix drawing a screen containing many distinct codepoints that are not
present in the main font causing a noticeable stall (
#10496
)
Graphics protocol: Fix scaled images (created with the
r
or
c
keys)
being distorted instead of clipped when scrolled against a margin
(
#10377
)
IME preedit text: use underline rather than reverse video (
#10386
)
Map mouse button presses in the
padding
around a window to the nearest cell, so that, for example, selections can be
started by pressing in the padding. Presses in the
margins
and in the region around window borders used for
dragging
borders
no longer start selections
(
#10393
)
dnd kitten: Add an option to use file copies instead of hard links for copy drops (
#10412
)
Fix a malformed CSI escape sequence such as
\e[?:
corrupting the parser state so that subsequent SGR color codes are ignored (
#10434
)
Thai/Lao: Render the vowel sign AM (U+0E33/U+0EB3) correctly by widening the cell it combines into, matching wcwidth() based programs (
#10477
)
Text sizing protocol
: A cell whose width was set explicitly with the
w
key is no longer narrowed by a subsequent
U+FE0E
variation selector
Fix dropping files or URLs onto a window being delivered to the wrong window,
or ignored entirely, when the tab bar is at the top or on either side
Graphics protocol: Fix a regression in 0.45.0 that caused the overwrite
composition mode for animation frames (
a=f
) to be controlled by the
undocumented
C
key instead of the documented
X
key (
#10379
)
Graphics protocol: Fix chunked transmission of animation frame data
(
a=f
) replacing the image’s root frame instead of creating or editing
the animation frame, when the continuation chunks contain only the
m
key, as prescribed by the spec
Graphics protocol: Reduce memory usage and speed up image transmission by
moving image data into the disk cache instead of copying it. Images transmitted
with the transient usage hint no longer keep a redundant second copy of their
data in memory for their entire lifetime
Graphics protocol: Fix a memory leak when transmitting an animation frame
based on a frame with a long chain of references to other frames
Graphics protocol: Fix image data being lost or read back incorrectly in the
rare case that an image was overwritten or deleted while its previous data
was being written to the disk cache by the cache’s background thread
Drag and drop protocol: deny requests for drag data made before the user has actually dropped something onto the window (
CVE 2026-80432
)
Drag and drop protocol: Deny drag sources that send identically named symlink/dir entries with an appropriate error (
CVE 2026-80430
)
Drag and drop protocol: Fix a use-after-free when a drag source item is aborted mid-transfer, where the freed remote item was still read from and written to after the drag offer was torn down (
CVE 2026-95834
)
Text sizing protocol: Fix a buffer overflow when a natural width text sizing escape code contains a grapheme cluster longer than four codepoints (
CVE 2026-80431
)
ssh kitten askpass: Verify owner and permissions of SHM memory used for askpass (
CVE 2026-95835
)
Graphics protocol: Fix a crash when transmitting image data via a file or
shared memory object (
t=f
,
t=t
or
t=s
) and the client truncates
it while kitty is reading from it.
Graphics protocol: Fix reading image data from a file or shared memory
object at an offset (the
O
key) failing unless the offset happened to be
a multiple of the system page size
Graphics protocol: Fix file descriptor leak that can be triggered by malicious clients
Graphics protocol: Make fileopen failure responses generic to avoid leaking any information about failed files
edit-in-kitty: harden the code used to parse messages from clients
Clipboard protocol: Report an
EFBIG
error to programs that try to write
more data to the clipboard than allowed by
clipboard_max_size
, instead
of silently truncating their data. Also fix
clipboard_max_size
being
interpreted in units of TB rather than MB (
#10399
)
Color control protocol: Report unknown fields as
unknown=<base64
encoded
field
name>
instead of echoing the field name back verbatim, which allowed
using the escape code to make the terminal emit arbitrary printable ASCII text (
CVE 2026-95832
)
macOS: Fix dropping files that are provided as file promises pasting paths to
files that no longer exist. The dropped files are now kept alive for
ten minutes and removed when kitty quits (
#10430
)
macOS: Fix all signal handling being permanently disabled after the first
window that used the graphics protocol is closed. This caused exited window
shells to accumulate as zombie processes and also broke reloading the config
with
SIGUSR1
and quitting on
SIGINT
/
SIGTERM
/
SIGHUP
(
#10436
)
macOS: Fix long text from input methods being discarded when committed
outside a key event (
#10468
)
Add a new
passthrough_and_end
value for the
--on-unknown
option of
map
, that passes the unknown key through to the program and also exits
the custom keyboard mode (
#10490
)
macOS: Allow input methods to read the text around the cursor, so that input
methods that automatically insert a space between Latin and CJK text work
(
#10492
)
Wayland: fix a regression in the previous release that broke window sizing for on Hyprland/Sway with fractional scales and an initial specified size (
#10268
)
Wayland: fix a regression in 0.47.3 that broke dragging on the Niri compositor (
#10271
)
Wayland: get initial window size in cells working in most cases on Hyprland/Sway with fractional scaling by using the fractional scale of the primary monitor
Wayland: fix using remote control to resize OS windows on some tiling compositors leading to broken rendering
macOS: fix
edge=none
panel height shrinking when
margin_top
is non-zero in the panel/quick-access-terminal kittens (
#10278
)
Graphics protocol: Add a new
transient usage hint
that clients can send to terminals to indicate an image is meant for only short duration use (
#10092
)
On first press in an unfocused OS Window/kitty window give it focus and pass the mouse event through to the clicked element. This is a behavior change but aligns with platform defaults on macOS. Linux has no platform defaults here as far as I can tell, so it gets to follow along. (
#10233
)
kitten @ get-text: Add support for
alternate
and
alternate_scrollback
extents to fetch text from the alternate screen buffer (
#10165
)
Wayland: Fix first OS window being a few cells too small when
initial_window_width/initial_window_height
are set in cells and a fractional display scale is in use (
#10146
)
kitty binary builds are now built on Ubuntu 22 upgraded from Ubuntu 18 for improved performance from better compilers
macOS: Fix incorrect horizontal alignment when using text sizing protocol (
#10179
)
edit-in-kitty
: Return exit code from underlying editor process on exit (
#10198
)
Make erasing last command robust against commands with no output and commands in the scrollback (
#10201
)
Fix superfluous margin visible to the left and right of the tab bar when
background_opacity
is less than one and the window width is not a multiple of the cell width (
#10212
)
Wayland GNOME: Fix dragging a window title bar to the “+” button failing to create a new tab when there is only a single tab (
#10222
)
choose-files kitten: Add a
--mode=all
to select either an existing file or directory (
#10208
)
Add support for editing files in sublime text and zed at specified line number (
#10224
)
choose-file kitten: Use a full readline editor for the search box. Also allow remapping the up/down/home/end keys to use for editing instead of navigating the file list (
#10225
)
Fix
remote_control_script
not working in a kitty instance run from inside another kitty instance
quick-access-terminal kitten: Allow configuring the layer on which to display the terminal (
#10242
)
scroll-window remote control command: Fix a regression that broke scrolling by pages (
#10253
)
Bypass libc malloc for history buffer to avoid libc pool policies causing apparent memory leak (
#10254
)
Cursor trail: Do not run the trail shader when the cursor is hidden, saving resources (
#10255
)
Graphics: Fix incorrect calculated cursor position when placing images with X/Y cell offsets (
#10256
)
macOS: Disable macOS one time code autofill popups (
#10250
)
Add support for DECSTR soft screen reset escape code (
#10263
)
macOS: Fix quick-access-terminal appearing on the wrong space (the fullscreen app’s space) when triggered from a different space on macOS Tahoe (
#8740
)
macOS: Show a key symbol on the active tab if the macOS Secure Input feature is enabled
Fix regression that broke unserialization of splits layout in previous release (
#10124
)
Fix
focus_follows_mouse
switching the active window when returning to a desktop/space, even though the mouse did not move. Now the window under a stationary cursor is left alone, while moving the mouse across windows still switches focus as before.
Sanitise responses to color control escape codes to avoid command injection for shells that do not use the kitty keyboard protocol (
CVE 2026-54057
)
choose fonts kitten: Fix a rare timing based race causing kitten to crash at startup (
#10128
)
Wayland: Fix mouse input getting broken when starting a tab drag and releasing the mouse button before the drag is actually registered (
#10136
)
A new
Drag and drop kitten
to allow drag and drop of files from your shell to any GUI program even across SSH (
#9984
)
A new option
palette_generate
to automatically generate the 256 color palette from the first 16 colors (
#9426
)
For builtin key mappings automatically
fallback
to matching the US-PC layout key when the pressed key has no matches and is a non-English character (
#9671
)
Allow drag and drop of windows to re-arrange them, move them to another tab/OS Window or detach them into a new OS Window. See
toggle_window_title_bars
to temporarily show window title bars to drag them around (
#9626
)
Allow optionally dragging URLs with the mouse, see
left
(
#9804
)
Change
focus_follows_mouse
to switch the active window only when the mouse crosses into a different window, instead of on every mouse motion event. Prevents accidental mouse bumps from undoing a keyboard-driven window switch.
Wayland: Use hold gestures to cancel momentum scrolling when fingers are placed on the trackpad, for a more natural kinetic scrolling experience (
#9863
)
macOS: Switch to new Tahoe style application icon with different background in light and dark modes
Fix thickness of diagonal lines in box drawing characters not the same as horizontal/vertical lines (
#9719
)
Graphics protocol: Fix crash when handling invalid PNG image with direct transmission (
CVE 2026-33633
)
Graphics protocol: Fix crash when handling invalid offset values in graphics compose commands (
CVE 2026-33642
)
X11: Fix a regression in the previous release that caused an occasional crash on input device removal (
#9723
)
XWayland: Fix a regression where some wheel mice were not scrolling properly (
#9770
)
Command palette: Improve searching to use word level matching (
#9727
)
hints kitten: A new option to set the background color of matched text (
#9745
)
The
show_hyperlink_targets
option now allows specifying a keyboard modifier so that target URLs are only shown on hover when the modifier is pressed (
#9741
)
Fix a spurious mouse button release event being sent when dragging out of an OS window causes focus loss
Fix scrollbar hover/interaction not working when the scrollbar is drawn in the window margin area (
#9756
)
Fix completion for
edit-in-kitty
not including some common text file types
Allow holding the
Alt
key and triple-clicking to select from the first cell even if it is empty (
#9758
)
Fix double click to rename tab being triggered too easily (
#9774
)
Fix a crash when user tries to select while the client program is using synchronised rendering and generating large amounts of output (
#9778
)
macOS: Add Copy and Paste menu items to the Edit menu in the global menu bar (
#9780
)
Fix dragging of splits layout borders sometimes moving in the wrong direction or having no effect (
#9447
)
Fix triple-click line selection and double-click word selection not extending wrapped lines beyond the edges of the viewport
Password input in kittens: hide the cursor and display a blinking 🔒 at the end of typed characters to make it visually clear the user is entering a password
edit-in-kitty: Ignore environment variables as some editors execute code present in env vars. Similarly ignore conf file specifications for colors (
CVE 2026-42851
)
Command palette
ctrl+shift+f3
: nicer grouping of aliases and combined actions (
#9819
)
hints kitten: Fix trailing punctuation not being removed from URLs (
#9828
)
Fix some responses from terminal sometimes leaking into shell after kitten exit (
#9839
)
Render block elements from the Unicode Symbols for Legacy Computing Supplement block (U+1CC00–U+1CEBF): separated block quadrants, separated block sextants, one sixteenth blocks, and one quarter block partial fills (
#9849
)
Improve performance of using active process data when rendering the tab bar by only scanning processes once per second (
#9862
)
macOS: Fix occasional phantom cursors being drawn on screen (
#9725
)
Add support for specifying colors in
kitty.conf
in OKLCH and LAB
color spaces (
#9325
)
Fix a regression that broke using line numbers with the edit-in-kitty command
(
#9346
)
Key maps: Allow specifying a timeout for multi key mappings and keyboard modes (
#9551
)
macOS: Fix changes to
macos_titlebar_color
while in full screen not being applied after exiting fullscreen (
#9350
)
ncurses: Fix ncurses not using dim because it is missing from the sgr property
in terminfo even though it is present in the dim property.
Fix a regression in the previous release that caused moving between neighbors
in the vertical and horizontal layouts to go in the opposite direction (
#9355
)
Fix
goto_session
not respecting the focus_tab session directive when
creating a session in an existing OS window (
#9366
)
Wayland: Fix a regression in the previous release that caused doubled key
repeats on compositors that implement compositor side key repeat events
(
#9374
)
icat: Fix a regression in the previous release when rendering GIF animations
with frames that dispose onto background with non-zero delay using the native
engine (
#9376
)
Wayland: Remove usage of the Wayland color management protocol to inform
compositors of the color space used by kitty (
#9341
)
Linux: Fix a regression in 0.40 that caused horizontal alignment for emoji to
be incorrect in some cases (
#9395
)
icat kitten: When catting multiple images display the images in input order (
#9413
)
kitten @: Fix relative paths for --password-file being resolved relative to
CWD instead of the kitty config directory
kitten choose-files: Add a new binding of
Alt
+
Enter
to modify the name
of an existing file when choosing a save file name (
#9387
)
kitten choose-files: Fix TAB completion in the choose save file name prompt
not working with respect to the current working directory (
#9387
)
Fix line-at-once selection not extending wrapped lines into scrollback (
#9437
)
ssh kitten: Restore keyboard mode even if the ssh connection drops
edit-in-kitty: Handle connection drop more gracefully (
#9480
)
macOS: Fix changing window title with global menubar menu open causes menu to
get stuck (
#9490
)
ssh kitten: Fix a bug where automatic login was not working (
#9187
)
Graphics: Fix overwrite composition mode for animation frames not being honored
Automatic color scheme switching: Fix title bar and scroll bar colors not being updated (
#9167
)
macOS: Fix cycle through OS windows only swapping between the two most recent
OS Windows. Also add a cycle through OS Windows backwards action.
(
#9215
)
goto_session
: allow specifying a directory to select a session file
from the directory (
#9219
)
Have reloading config also reload the custom tab bar python modules (
#9221
)
kitten @ ls: Also output the neighbors for every window (
#9225
)
When expanding environment variables in
listen_on
allow the
env
directive to take effect
macOS: Fix closing an OS Window when another OS Window is minimized causing
the minimized window to be un-minimized (
#8913
)
Do not rewrap the text in the alternate screen buffer. Avoids flicker during
live resize with no
resize_debounce_time
(
#9142
)
Add a default mapping
search_scrollback
to open the scrollback in a
pager in search mode. If any text is currently selected it is automatically
searched for.
Wayland: Fix spurious key repeat events when some user defined callback takes
a long time to execute (
#9224
)
When moving windows to a new tab/OS Window fix overlay windows not being
grouped with their parent windows (
#9266
)
Linux: Fix a bug causing colors to occasionally all go black when using mesa
>= 25.3.0 with nouveau GPU driver (
#9235
)
macOS: Workaround for yet another Tahoe regression causing macOS to start an
AutoFill helper process and not shut it down on application exit (
#9299
)
Fix a regression in 0.43.0 that caused a black flicker when closing a tab in
the presence of a background image (
#9060
)
Further improvements to rounded corner rendering, especially at low DPI
(
#9091
)
Splits layout: Fix a bug that could cause a corrupted layout in some
circumstances (
#9059
)
Fix a regression in the previous release that broke
goto_session
-1
Fix rendering broken on ancient GPU drivers that do not support rendering to 16 bit textures (
#9068
)
Fix tab bar sometimes showing incorrect tabs when it is filtered to show only
tabs from the current session (
#9079
)
macOS: Workaround for bug in macOS Tahoe that caused OS Windows that are
fullscreen to crash kitty when returning from sleep on some machines (
#8983
)
Graphics: Fix animated images sometimes not auto playing or auto playing at the wrong start frame if the same image id is used for a subsequent image
Fix a regression in 0.43.0 that caused high CPU usage when
disable_ligatures
was set to
cursor
and the tab bar was visible (
#9071
)
macOS: Handle dropping of file promises into kitty in addition to file paths (
#9084
)
macOS: Fix indeterminate progress bar displayed on dock icon increasing speed when indeterminate progress is set without being cleared first (
#9114
)
macOS: Performance and power usage improvements of about 5-10% (
#9131
)
macOS: Add an item to the global menu to Cycle through OS windows
macOS: Quick access terminal: Fix a crash when changing font size (
#9178
)
Wayland: Fix
center-sized
panels not working on smithay based compositors (
#9117
)
Wayland: Fix scrolling using some mouse wheels that produce “VALUE120” based
scroll events too fast on some compositors (
#9128
)
Add support for Unicode 17
Fix a regression in 0.43.0 that caused
tab_bar_margin_width
to be
doubled on the right edge of the tab bar (
#9154
)
Session files: Add a new
focus_tab
command to specify which tab should be
active when a session is loaded. Accepts either a plain number (0-based index)
or a match expression for flexible tab selection, allowing sessions to preserve
the active tab state (
Sessions
)
save_as_session
: Add
--base-dir
option to specify a base directory
for saving session files with relative paths, useful when the current working
directory is not the desired location (
Sessions
)
Add
state:focused_os_window
match query to select all windows in the
currently focused OS window (
Matching windows and tabs
)
Session saving now preserves visual tab order and active tab rather than tab
activation history as this is generally more important. In the future may
have it save tab history as well (
#9163
)
The
ctrl+shift+delete
shortcut to reset the terminal now also resets termios state
ssh kitten: Allow specifying a password and/or TOTP authentication secret to
automate interactive logins in scenarios where public key authentication is
not supported (
#9020
)
macOS: Fix a bug where the color of a transparent titlebar was off when
running in the release build versus the build from source. Also fix using a
transparent titlebar causing the background opacity to be doubled.
Fix a regression in the previous release that caused the incorrect tab to be
active when loading a session (
#9025
)
macOS: Workaround for bug in macOS Tahoe that caused closed OS Windows to
remain as invisible rectangles that intercept mouse events (
#8952
)
macOS: Fix a regression in the previous release that broke automatic
switching of dark/light mode when setting
macos_titlebar_color
to an
arbitrary color (
#9034
)
goto_session
: Add
--sort-by=alphabetical
to have the interactive session
picker list the sessions in a fixed order rather than by most recent
(
#9033
)
Fix a regression in the previous release that caused the cursor trail to not
be hidden properly (
#9039
)
Session files: Fix a regression in the previous release that broke matching on
windows in the current tab (
#9037
)
Fix a regression in the previous release that broke clearing screen lines
when in margin mode (
#9049
)
macOS: Add the default
Cmd
+
L
mapping from Terminal.app to erase the
last command and its output (
#6040
)
Fix
background_opacity
being non-linear especially with light color themes.
Note that this might require you to adjust the value of this setting to get
back your current look. (
#8869
)
Allow using a custom python function to draw tab titles in the tab bar, see
tab_title_template
Wayland: Fix incorrect window size calculation when transitioning from
full screen to non-full screen with client side decorations (
#8826
)
macOS: Fix hiding quick access terminal window not restoring focus to
previously active application (
#8840
)
macOS: Fix showing the quick access terminal on a space other than the space
it was last active on, after full screening some application causes the quick
access terminal to appear on the old space (
#8740
)
macOS: When toggling open the quick access terminal move it to the currently
active monitor (the monitor with the mouse pointer on it) (
#9003
)
macOS: Fix closing an OS Window when another OS Window is minimized causing
the minimized window to be un-minimized (
#8913
)
Allow using backspace to move the cursor onto the previous line in cooked
mode. This is indicated by the
bw
property in kitty’s terminfo
(
#8841
)
Watchers: A new event for global watchers corresponding to the tab bar being changed (
#8842
)
Fix a regression in 0.40.0 that broke handling of the VS16 variation selector
when it caused a character to flow to the next line (
#8848
)
Fix rendering of underlines when using larger text sizes with the space and
en-space characters (
#8950
)
Fix updating panel configuration on visibility toggle and via remote control
not working (
#8984
)
Wayland: Update bundled copy of libwayland to 1.24 from 1.23.1 because the
just released mesa 25.2.0 breaks with libwayland < 1.24 (
#8884
)
macOS: Pass the
Cmd
+
C
shortcut to the application running in the
terminal when no text is selected (
#8946
)
macOS: Workaround for bug in macOS Tahoe that caused OS Windows that are
fullscreen on a monitor that is disconnected while macOS is asleep to crash kitty (
#8983
)
A new
protocol extension
to notify terminal programs that have turned on SGR Pixel mouse reporting when the mouse leaves the window (
#8808
)
clipboard kitten: Can now optionally take a password to avoid repeated
permission prompts when accessing the clipboard. Based on a
protocol extension
. (
#8789
)
A new
kitty
--grab-keyboard
that can be used to grab the keyboard so that global shortcuts are sent to kitty instead
Remote control: Fix holding a remote control socket open causing the kitty I/O thread to go into a loop and not respond on other remote control sockets (
#8670
)
hints kitten: Preserve line breaks when the hint is over a line break (
#8674
)
Fix ambiguous width and private use characters not being rendered when used with variable width text-sizing protocol escape codes
Quick access terminal: Restore focus to previously active window when hiding the quick access terminal window on macOS (
#8627
)
Wayland: Fix an abort if the terminal program sets a window title longer than 2KB that contains CSI escape sequences and multibyte UTF-8 (
#8619
)
Quick access terminal: Allow toggling the window to full screen using the standard kitty
ctrl+shift+f11
shortcut (
#8626
)
Quick access terminal: Allow configuring the monitor to display the panel on in Wayland/X11 (
#8630
)
A new setting
remember_window_position
to optionally use the position of the last closed kitty OS Window as the position of the first kitty OS Window when running a new kitty instance (
#8601
)
Panel kitten: A new
center-sized
value for
--edge
to allow easily creating sized and centered panels
Wayland: The
kitty --name
flag now sets the XDG
window tag
on compositors
that support the
xdg-toplevel-tag
protocol.
launch: Allow creating desktop panels such as those created by the
panel kitten
(
#8549
)
Remote control: Allow modifying desktop panels and showing/hiding OS Windows
using the
kitten
@
resize-os-window
command (
#8550
)
Remote control launch: Allow waiting for a program launched in a new window
to exit and get the exit code via the
kitty +launch
--wait-for-child-to-exit
command line flag (
#8573
)
A new mode of operation for
text_fg_override_threshold
to override
foreground colors so as to maintain a minimum contrast between foreground and
background text colors. Works in a perceptual color space for best color accuracy
(
#8420
)
A 15% improvement in throughput when processing text thanks to using a
multi-stage table for Unicode property lookups
kitty +open
: Ask for confirmation by default when running executables
to work around some badly designed programs that try to open links in
documents that point to executable files. Can be overridden by specifying
your own
launch-actions.conf
.
Fix a regression in version 0.40.0 causing a crash when the underline
thickness of the font is zero (
#8443
)
Fix a regression in version 0.40.0 causing a hang on resizing with a wide
character at the right edge of a line that needs to be moved onto the next
line (
#8464
)
Fix a regression in 0.40.1 that caused copying to clipboard via OSC 52 from
applications that don’t specify a destination in the escape code not working
(
#8459
)
Wayland: Fix a regression in the previous release that caused crashes on
compositors that don’t support the xdg-toplevel-icon protocol and the user has
set a custom kitty icon (
#8471
)
When rendering underlines add gaps around text descenders (parts of the text
that overlap with the underline). Controlled by the new option
underline_exclusion
(
#8226
)
Finally fix the issue of text-width mismatches that has been plaguing the
terminal ecosystem for decades by allowing terminal programs to specify how
many cells to render a piece of text in (
#8226
)
Behavior change
: The
notify_on_cmd_finish
option now uses OS
Window visibility instead of focus state when set to
invisible
on
platforms that support querying OS window visibility (
#8320
)
macOS: Fix fallback font rendering for bold/italic text not working for some symbols that are present in the Menlo regular face but not the bold/italic faces (
#8282
)
diff kitten
: Automatically use dark/light color scheme based on the color scheme of the parent terminal. Can be controlled via the new
kitten-diff.color_scheme
option. Note that this is a
default behavior change
(
#8170
)
Allow dynamically generating configuration by running an arbitrary program using the new
geninclude
directive in
kitty.conf
When a program running in kitty reports progress of a task display it as a percentage in the tab title. Controlled by the
tab_title_template
option
When mapping a custom kitten allow using shell escaping for the kitten path (
#8178
)
Fix border colors not being changed by auto light/dark themes at startup (
#8180
)
ssh kitten: Fix kitten not being on PATH when SSHing into Debian systems (
#7160
)
diff kitten: Abort when run inside a terminal that does not support the kitty keyboard protocol (
#8185
)
query kitten
: Add support for reporting name of the OS the terminal emulator is running on (
#8201
)
macOS: Allow using the Passwords app to autofill passwords via the Edit->Autofill menu mimicking other macOS applications (
#8195
)
macOS: Add menu items to the Edit menu to clear the screen and scrollback
macOS: Fix a regression in the previous release that broke rendering of Emoji using the VS16 variation selector (
#8130
)
When automatically changing colors based on OS color preference, first reset
all colors to default before applying the new theme so that even colors not
specified in the theme are correct (
#8124
)
Graphics: Fix deleted but not freed images without any placements being incorrectly freed on a subsequent delete command (
#8129
)
Graphics: Fix deletion of images by id not working for images with no placements (
#8129
)
Add support for
escape code protocol
for notifying applications on dark/light color scheme change
Cursor trails: Fix pure vertical movement sometimes not triggering a trail and holding down a key in nvim causing the trail to be glitchy (
#8152
,
#8153
)
macOS: Fix mouse cursor shape not always being reset to text cursor when mouse re-enters kitty (
#8155
)
notify_on_cmd_finish
: Automatically remove notifications when the window gains focus or the next notification is shown. Clearing behavior can be configured (
#8100
)
Discard OSC 9 notifications that start with
4;
because some misguided software is using it for “progress reporting” (
#8011
)
Wayland GNOME: Workaround bug in mutter causing double tap on titlebar to not always work (
#8054
)
clipboard kitten: Fix a bug causing kitten to hang in filter mode when input data size is not divisible by 3 and larger than 8KB (
#8059
)
Wayland: Fix an abort when a client program tries to set an invalid title containing interleaved escape codes and UTF-8 multi-byte characters (
#8067
)
Graphics protocol: Fix delete by number not deleting newest image with the specified number (
#8071
)
Fix dashed and dotted underlines not being drawn at the same y position as straight underlines at all font sizes (
#8074
)
panel kitten: Allow creating floating and on-top panels with arbitrary placement and size on Wayland (
#8068
)
Fix enlarging window when a long line is wrapped between the first line of the scrollback buffer and the screen inserting a spurious newline (
#7033
)
When re-attaching a detached tab preserve internal layout state such as biases and orientations (
#8106
)
hints/unicode_input kittens: Do not lose keypresses that are sent very rapidly via an automation tool immediately after the kitten is launched (
#7089
)
Fix resizing window when alternate screen is active does not preserve trailing blank output line in the main screen (
#7978
)
Wayland: Fix
background_opacity
less than one causing flicker on startup when the Wayland compositor supports single pixel buffers (
#7987
)
Fix background image flashing when closing a tab (
#7999
)
When running a kitten that modifies the kitty config file if no config file exists create a commented out default config file and then modify it (
#7991
)
Fix a regression in the previous release that caused window padding to be rendered opaque even when
background_opacity
is less than 1 (
#7895
)
Wayland GNOME: Fix a crash when using multiple monitors with different scales and starting on or moving to the monitor with lower scale (
#7894
)
macOS: Fix a regression in the previous release that caused junk to be rendered in font previews in the choose fonts kitten and crash on Intel macs (
#7892
)
The option
second_transparent_bg
has been removed and replaced by
transparent_background_colors
which allows setting up to seven additional colors that will be transparent, with individual opacities per color (
#7646
)
Fix a regression in the previous release that broke use of the
cd
command in session files (
#7829
)
macOS: Fix shortcuts that become entries in the global menubar being reported as removed shortcuts in the debug output
Fix a regression when tinting of background images was introduced that caused window borders to have
background_opacity
applied to them (
#7850
)
Fix a regression that broke writing to the clipboard using the OSC 5522 protocol (
#7858
)
macOS: Fix a regression in the previous release that caused kitty to fail to run after an unclean shutdown/crash when using --single-instance (
#7846
)
kitten @ ls: Fix the
--self
flag not working (
#7864
)
Remote control: Fix
--match
state:self
not working (
#7886
)
Splits layout: Allow setting the
split_axis
option to
auto
so that all new windows have their split axis chosen automatically unless explicitly specified in the launch command (
#7887
)
A new
choose-fonts
kitten that provides a UI with font previews to ease selection of fonts. Also has support for font features and variable fonts
Allow animating the blinking of the cursor. See
cursor_blink_interval
for how to configure it
Add NERD fonts builtin so that users don’t have to install them to use NERD symbols in kitty. The builtin font is used only if the symbols are not available in some system font
launch command: A new
launch
--bias
option to adjust the size of newly created windows declaratively (
#7634
)
A new
notify
kitten to show desktop notifications
from the command line with support for icons, buttons and more.
Desktop notifications protocol: Add support for icons, buttons, closing of notifications, expiry of notifications, updating of notifications and querying if the terminal emulator supports the protocol (
#7657
,
#7658
,
#7659
)
A new option
filter_notification
to filter out or perform arbitrary actions on desktop notifications based on sophisticated criteria (
#7670
)
A new protocol to allow terminal applications to change colors in the terminal more robustly than with the legacy XTerm protocol (
Setting and querying colors
)
Sessions: A new command
focus_matching_window
to shift focus to a specific window, useful when creating complex layouts with splits (
#7635
)
Speed up loading of large background images by caching the decoded image data. Also allow using images in JPEG/WEBP/TIFF/GIF/BMP formats in addition to PNG
Wayland: Allow fractional scales less than one (
#7549
)
Wayland: Fix specifying the output name for the panel kitten not working (
#7573
)
Speed up
kitty
--version
and
kitty
--single-instance
(for all subsequent instances). They are now the fastest of all terminal emulators with similar functionality
macOS: Fix rendering of the unicode hyphen (U+2010) character when using a font that does not include a glyph for it (
#7525
)
macOS 15: Handle Fn modifier when detecting global shortcuts (
#7582
)
kitten
run-shell
: Automatically add the directory containing the kitten binary to PATH if needed. Controlled via the
--inject-self-onto-path
option (
disc
:7668`)
Wayland: Fix an issue with mouse selections not being stopped when there are multiple OS windows (
#7381
)
Splits layout: Fix the
move_to_screen_edge
action breaking when only a single window is present (
#7621
)
Add support for in-band window resize notifications (
#7642
)
Wayland: Fix a regression in 0.34 that caused the tab bar to not render in second and subsequent OS Windows under Hyprland (
#7413
)
Fix a regression in the previous release that caused horizontal scrolling via touchpad in fullscreen applications to be reversed on non-Wayland platforms (
#7475
,
#7481
)
Fix a regression in the previous release causing an error when setting background_opacity to zero (
#7483
)
Image display: Fix cursor movement and image hit region incorrect for image placements that specify only a number of rows or columns to display in (
#7479
)
Wayland:
panel kitten
: Add support for drawing desktop background and bars
using the panel kitten for all compositors that support the
requisite Wayland
protocol
which is practically speaking all of them but GNOME (
#2590
)
Show a small scrollback indicator along the right window edge when viewing
the scrollback to keep track of scroll position (
#2502
)
Wayland: Support fractional scales so that there is no wasted drawing at larger scale followed by resizing in the compositor
Fix a regression in the previous release that caused requesting data from the clipboard via OSC 52 to instead return data from the primary selection (
#7213
)
Splits layout: Allow resizing until one of the halves in a split is minimally sized (
#7220
)
macOS: Fix text rendered with fallback fonts not respecting bold/italic styling (
#7241
)
macOS: When CoreText fails to find a fallback font for a character in the first Private Use Unicode Area, preferentially use the NERD font, if available, for it (
#6043
)
Cheetah speed
with a redesigned render loop and a 2x faster escape code
parser that uses SIMD CPU vector instruction to parse data in parallel
(
#7005
)
A new benchmark kitten (
kitten
__benchmark__
) to measure terminal
throughput performance
Graphics protocol: Add a new delete mode for deleting images whose ids fall within a range. Useful for bulk deletion (
#7080
)
Keyboard protocol: Fix the
Enter
,
Tab
and
Backspace
keys
generating spurious release events even when report all keys as escape codes
is not set (
#7136
)
macOS: The command line args from
macos-launch-services-cmdline
are now
prefixed to any args from
open
--args
rather than overwriting them (
#7135
)
kitten @ load-config: Allow (re)loading kitty.conf via remote control
Remote control: Allow running mappable actions via remote control (
kitten @ action
)
kitten @ send-text: Add a new option to automatically wrap the sent text in
bracketed paste escape codes if the program in the destination window has
turned on bracketed paste.
Fix a single key mapping not overriding a previously defined multi-key mapping
macOS: Fix
kitten
@
select-window
leaving the keyboard in a partially functional state (
#7074
)
Graphics protocol: Improve display of images using Unicode placeholders or
row/column boxes by resizing them using linear instead of nearest neighbor
interpolation on the GPU (
#7070
)
When matching URLs use the definition of legal characters in URLs from the
WHATWG spec
rather than older standards (
#7095
)
Wayland: Fix a regression in the previous release that broke copying to clipboard under wl-roots based compositors in some circumstances
(
#6890
)
macOS: Fix some combining characters not being rendered (
#6898
)
macOS: Fix returning from full screen via the button when the titlebar is hidden not hiding the buttons (
#6883
)
macOS: Fix newly created OS windows not always appearing on the “active” monitor (
#6932
)
Font fallback: Fix the font used to render a character sometimes dependent on the order in which characters appear on screen (
#6865
)
panel kitten: Fix rendering with non-zero margin/padding in kitty.conf (
#6923
)
kitty keyboard protocol: Specify the behavior of the modifier bits during modifier key events (
#6913
)
Wayland: Enable support for the new cursor-shape protocol so that the mouse cursor is always rendered at the correct size in compositors that support this protocol (
#6914
)
GNOME Wayland: Fix remembered window size smaller than actual size (
#6946
)
Mouse reporting: Fix incorrect position reported for windows with padding (
#6950
)
Allow using the full range of standard mouse cursor shapes when customizing the mouse cursor
macOS: When running the default shell with the login program fix
~/.hushlogin
not being respected when opening windows not in the home directory (
#6689
)
macOS: Fix poor performance when using ligatures with some fonts, caused by slow harfbuzz shaping (
#6743
)
Fix a regression caused by rewrite of kittens to Go that made various kittens reset colors in a terminal when the colors were changed by escape code (
#6708
)
Fix trailing bracket not ignored when detecting a multi-line URL with the trailing bracket as the first character on the last line (
#6710
)
Fix a regression that broke
kitten update-self
(
#6729
)
Two new event types for
watchers
,
on_title_change
and
on_set_user_var
When pasting, if the text contains terminal control codes ask the user for permission. See
paste_actions
for details. Thanks to David Leadbeater for discovering this.
Render Private Use Unicode symbols using two cells if the second cell contains an en-space as well as a normal space
macOS: Fix a regression in the previous release that caused kitten @ ls to not report the environment variables for the default shell (
#6749
)
Desktop notification protocol
: Allow applications sending notifications to specify that the notification should only be displayed if the window is currently unfocused (
#6755
)
Shell integration: Automatically alias sudo to make the kitty terminfo files available in the sudo environment. Can be turned off via
shell_integration
ssh kitten: Fix a regression in 0.28.0 that caused using
--kitten
to
override
ssh.conf
not inheriting settings from
ssh.conf
(
#6639
)
themes kitten: Allow absolute paths for
--config-file-name
(
#6638
)
Expand environment variables in the
shell
option (
#6511
)
macOS: When running the default shell, run it via the login program so that calls to
getlogin()
work (
#6511
)
X11: Fix a crash on startup when the ibus service returns errors and the GLFW_IM_MODULE env var is set to ibus (
#6650
)
When running a shell for
--hold
set the env variable
KITTY_HOLD=1
to allow users to customize what happens (
#6587
)
When multiple confirmable close requests are made focus the existing close confirmation window instead of opening a new one for each request (
#6601
)
Config file format: allow splitting lines by starting subsequent lines with a backslash (
#6603
)
ssh kitten: Fix a regression causing hostname directives in
ssh.conf
not matching when username is specified (
#6609
)
diff kitten: Add support for files that are identical apart from mode changes (
#6611
)
Wayland: Do not request idle inhibition for full screen windows (
#6613
)
Adjust the workaround for non-linear blending of transparent pixels in
compositors to hopefully further reduce fringing around text with certain
color issues (
#6534
)
A new value for
background_image_layout
to scale the background image while preserving its aspect ratio. Also have centered images work even for images larger than the window size (
#6458
)
Fix a regression that caused using unicode placeholders to display images to break and also partially offscreen images to sometimes be slightly distorted (
#6467
)
macOS: Fix a regression that caused rendering to hang when transitioning to full screen with
macos_colorspace
set to
default
(
#6435
)
macOS: Fix a regression causing
burn-in
of text when resizing semi-transparent OS windows (
#6439
)
macOS: Add a new value
titlebar-and-corners
for
hide_window_decorations
that emulates the behavior of
hide_window_decorations
yes
in older versions of kitty
macOS: Fix a regression in the previous release that caused
hide_window_decorations
=
yes
to prevent window from being resizable (
#6436
)
macOS: Fix a regression that caused the titlebar to be translucent even for non-translucent windows (
#6450
)
When resizing OS Windows make the animation less jerky. Also show the window size in cells during the resize (
#6341
)
unicode_input kitten: Fix a regression in 0.28.0 that caused the order of recent and favorites entries to not be respected (
#6214
)
unicode_input kitten: Fix a regression in 0.28.0 that caused editing of favorites to sometimes hang
clipboard kitten: Fix a bug causing the last MIME type available on the clipboard not being recognized when pasting
clipboard kitten: Dont set clipboard when getting clipboard in filter mode (
#6302
)
Fix regression in 0.28.0 causing color fringing when rendering in transparent windows on light backgrounds (
#6209
)
show_key kitten: In kitty mode show the actual bytes sent by the terminal rather than a re-encoding of the parsed key event
hints kitten: Fix a regression in 0.28.0 that broke using sub-groups in regexp captures (
#6228
)
hints kitten: Fix a regression in 0.28.0 that broke using lookahead/lookbehind in regexp captures (
#6265
)
diff kitten: Fix a regression in 0.28.0 that broke using relative paths as arguments to the kitten (
#6325
)
Fix re-using the image id of an animated image for a still image causing a crash (
#6244
)
kitty +open: Ask for permission before executing script files that are not marked as executable. This prevents accidental execution
of script files via MIME type association from programs that unconditionally “open” attachments/downloaded files
edit-in-kitty: Fix running edit-in-kitty with elevated privileges to edit a restricted file not working (
#6245
)
ssh kitten: Fix a regression in 0.28.0 that caused interrupt during setup to not be handled gracefully (
#6254
)
ssh kitten: Allow configuring the ssh kitten to skip some hosts via a new
delegate
config directive
Graphics: Move images up along with text when the window is shrunk vertically (
#6278
)
Fix a regression in 0.28.0 that caused a buffer overflow when clearing the screen (
#6306
,
#6308
)
Fix a regression in 0.27.0 that broke setting of specific edge padding/margin via remote control (
#6333
)
macOS: Fix window shadows not being drawn for transparent windows (
#2827
,
#6416
)
Do not echo invalid DECRQSS queries back, behavior inherited from xterm (CVE-2008-2383). Similarly, fix an echo
bug in the file transfer protocol due to insufficient sanitization of safe strings.
Text rendering change
: Use sRGB correct linear gamma blending for nicer font
rendering and better color accuracy with transparent windows.
See the option
text_composition_strategy
for details.
The obsolete
macos_thicken_font
will make the font too thick and needs to be removed manually
if it is configured. (
#5969
)
icat kitten: Support display of images inside tmux >= 3.3 (
#5664
)
Graphics protocol: Add support for displaying images inside programs that do not support the protocol such as vim and tmux (
#5664
)
diff kitten: Add support for selecting multi-line text with the mouse
Fix a regression in 0.27.0 that broke
kitty
@
set-font-size
0
(
#5992
)
launch: When using
--cwd=current
for a remote system support running non shell commands as well (
#5987
)
When changing the cursor color via escape codes or remote control to a fixed color, do not reset cursor_text_color (
#5994
)
Input Method Extensions: Fix incorrect rendering of IME in-progress and committed text in some situations (
#6049
,
#6087
)
Linux: Reduce minimum required OpenGL version from 3.3 to 3.1 + extensions (
#2790
)
Fix a regression that broke drawing of images below cell backgrounds (
#6061
)
macOS: Fix the window buttons not being hidden after exiting the traditional full screen (
#6009
)
When reloading configuration, also reload custom MIME types from
mime.types
config file (
#6012
)
launch: Allow specifying the state (full screen/maximized/minimized) for newly created OS Windows (
#6026
)
Sessions: Allow specifying the OS window state via the
os_window_state
directive (
#5863
)
macOS: Display the newly created OS window in specified state to avoid or reduce the window transition animations (
#6035
)
macOS: Fix the maximized window not taking up full space when the title bar is hidden or when
resize_in_steps
is configured (
#6021
)
Linux: A new option
linux_bell_theme
to control which sound theme is used for the bell sound (
#4858
)
ssh kitten: Change the syntax of glob patterns slightly to match common usage
elsewhere. Now the syntax is the same as “extendedglob” in most shells.
hints kitten: Allow copying matches to named buffers (
#6073
)
Fix overlay windows not inheriting the per-window padding and margin settings
of their parents (
#6063
)
Wayland KDE: Fix selecting in un-focused OS window not working correctly (
#6095
)
Linux X11: Fix a crash if the X server requests clipboard data after we have relinquished the clipboard (
#5650
)
A new statically compiled, standalone executable,
kitten
(written in Go)
that can be used on all UNIX-like servers for remote control (
kitten
@
),
viewing images (
kitten
icat
), manipulating the clipboard (
kitten
clipboard
), etc.
clipboard kitten
: Allow copying arbitrary data types to/from the clipboard, not just plain text
Speed up the
kitty
@
executable by ~10x reducing the time for typical
remote control commands from ~50ms to ~5ms
icat kitten: Speed up by using POSIX shared memory when possible to transfer
image data to the terminal. Also support common image formats
GIF/PNG/JPEG/WEBP/TIFF/BMP out of the box without needing ImageMagick.
Fix cursor position at x=0 changing to x=1 on resize (
#5635
)
Wayland GNOME: Fix incorrect window size in some circumstances when switching between windows with window decorations disabled (
#4802
)
Wayland: Fix high CPU usage when using some input methods (
#5369
)
Remote control: When matching window by
state:focused
and no window currently has keyboard focus, match the window belonging to the OS window that was last focused (
#5602
)
Sessions: Allow controlling which OS Window is active via the
focus_os_window
directive
Wayland: Fix for bug in NVIDIA drivers that prevents transparency working (
#5479
)
Wayland: Fix for a bug that could cause kitty to become non-responsive when
using multiple OS windows in a single instance on some compositors (
#5495
)
Wayland: Fix for a bug preventing kitty from starting on Hyprland when using a non-unit scale (
#5467
)
Wayland: Generate a XDG_ACTIVATION_TOKEN when opening URLs or running programs in the background via the launch action
Fix a regression that caused kitty not to restore SIGPIPE after python nukes it when launching children. Affects bash which does not sanitize its signal mask. (
#5500
)
Fix a use-after-free when handling fake mouse clicks and the action causes windows to be removed/re-allocated (
#5506
)
macOS: Fix regression in 0.26.0 that caused asking the user for a line of input such as for
set_tab_title
to not work (
#5447
)
hints kitten: hyperlink matching: Fix hints occasionally matching text on subsequent line as part of hyperlink (
#5450
)
Fix a regression in 0.26.0 that broke mapping of native keys whose key codes did not fit in 21 bits (
#5452
)
Wayland: Fix remembering window size not accurate when client side decorations are present
Fix an issue where notification identifiers were not sanitized leading to
code execution if the user clicked on a notification popup from a malicious
source. Thanks to Carter Sande for discovering this vulnerability.
Reduce startup latency by ~30 milliseconds when running kittens via key bindings inside kitty (
#5159
)
A new option
modify_font
to adjust various font metrics like underlines, cell sizes etc. (
#5265
)
A new shortcut
ctrl+shift+f1
to display the kitty docs in a browser
Graphics protocol: Only delete temp files if they have the string
tty-graphics-protocol
in their file paths. This prevents deletion of arbitrary files in
/tmp
.
Deprecate the
adjust_baseline
,
adjust_line_height
and
adjust_column_width
options in favor of
modify_font
Wayland: Fix a regression in the previous release that caused mouse cursor
animation and keyboard repeat to stop working when switching seats (
#5188
)
Allow resizing windows created in session files (
#5196
)
Fix horizontal wheel events not being reported to client programs when they grab the mouse (
#2819
)
macOS: Remote control: Fix unable to launch a new OS window or background process when there is no OS window (
#5210
)
macOS: Fix unable to open new tab or new window when there is no OS window (
#5276
)
kitty @ set-colors: Fix changing inactive_tab_foreground not working (
#5214
)
macOS: Fix a regression that caused switching keyboard input using Eisu and
Kana keys not working (
#5232
)
Add a mappable action to toggle the mirrored setting for the tall and fat
layouts (
#5344
)
Add a mappable action to switch between predefined bias values for the tall and fat
layouts (
#5352
)
Wayland: Reduce flicker at startup by not using render frames immediately after a resize (
#5235
)
Linux: Update cursor position after all key presses not just pre-edit text
changes (
#5241
)
ssh kitten: Allow ssh kitten to work from inside tmux, provided the tmux
session inherits the correct KITTY env vars (
#5227
)
ssh kitten: A new option
--symlink-strategy
to control how symlinks
are copied to the remote machine (
#5249
)
ssh kitten: Allow pressing
Ctrl
+
C
to abort ssh before the connection is
completed (
#5271
)
Bash integration: Fix declare not creating global variables in .bashrc (
#5254
)
Bash integration: Fix the inherit_errexit option being set by shell integration (
#5349
)
kitty @ scroll-window
allow scrolling by fractions of a screen
(
#5294
)
remote files kitten: Fix working with files whose names have characters that
need to be quoted in shell scripts (
#5313
)
ssh kitten: Fix bash not being executed as a login shell since kitty 0.25.0 (
#5130
)
macOS: When pasting text and the clipboard has a filesystem path, paste the
full path instead of the text, which is sometimes just the file name (
#5142
)
macOS: Allow opening executables without a file extension with kitty as well
(
#5160
)
Themes kitten: Add a tab to show user defined custom color themes separately
(
#5150
)
Iosevka: Fix incorrect rendering when there is a combining char that does not
group with its neighbors (
#5153
)
Weston: Fix client side decorations flickering on slow computers during
window resize (
#5162
)
Remote control: Fix commands with large or asynchronous payloads like
kitty @ set-background-image
,
kitty @ set-window-logo
and
kitty @ select-window
not working correctly
when using a socket (
#5165
)
hints kitten: Fix surrounding quotes/brackets and embedded carriage returns
not being removed when using line number processing (
#5170
)
Remote control: Allow using
Boolean operators
when constructing queries to match windows or tabs
Sessions: Fix
os_window_size
and
os_window_class
not applying to the first OS Window (
#4957
)
Allow using the cwd of the oldest as well as the newest foreground process for
launch
--cwd
(
#4869
)
Bash integration: Fix the value of
shell_integration
not taking effect if the integration script is sourced in bashrc (
#4964
)
Fix a regression in the previous release that caused mouse move events to be incorrectly reported as drag events even when a button is not pressed (
#4992
)
remote file kitten: Integrate with the ssh kitten for improved performance
and robustness. Re-uses the control master connection of the ssh kitten to
avoid round-trip latency.
Fix tab selection when closing a new tab not correct in some scenarios (
#4987
)
A new option
select_by_word_characters_forward
that allows changing
which characters are considered part of a word to the right when double clicking to select
words (
#5103
)
macOS: Make the global menu shortcut to open kitty website configurable (
#5004
)
Fix reloading of config not working when
kitty.conf
does not exist when kitty is launched (
#5071
)
Fix deleting images by row not calculating image bounds correctly (
#5081
)
Increase the max number of combining chars per cell from two to three, without increasing memory usage.
Linux: Load libfontconfig at runtime to allow the binaries to work for
running kittens on servers without FontConfig
GNOME: Fix for high CPU usage caused by GNOME’s text input subsystem going
into an infinite loop when IME cursor position is updated after a done event
(
#5105
)
Truly convenient SSH
: automatic shell integration when using SSH. Easily
clone local shell and editor configuration on remote machines, and automatic
re-use of existing connections to avoid connection setup latency.
When pasting URLs at shell prompts automatically quote them. Also allow filtering pasted text and confirm pastes. See
paste_actions
for details. (
#4873
)
Change the default value of
confirm_os_window_close
to ask for confirmation when closing windows that are not sitting at shell prompts
A new value
last_reported
for
launch
--cwd
to use the current working directory last reported by the program running in the terminal
macOS: When using Apple’s less as the pager for viewing scrollback strip out OSC codes as it can’t parse them (
#4788
)
diff kitten: Fix incorrect rendering in rare circumstances when scrolling after changing the context size (
#4831
)
Only check for updates in the official binary builds. Distro packages or source builds will no longer check for updates, regardless of the
value of
update_check_interval
.
Bash integration: No longer modify
~/.bashrc
to load
shell integration
.
It is recommended to remove the lines used to load the shell integration from
~/.bashrc
as they are no-ops.
macOS: Add a new service
Open
with
kitty
to open file types that are not
recognized by the system (
#4641
)
Splits layout: A new value for
launch
--location
to auto-select the split axis when splitting existing windows.
Wide windows are split side-by-side and tall windows are split one-above-the-other
hints kitten: Fix a regression that broke recognition of path:linenumber:colnumber (
#4675
)
Linux: Do not rescale fallback fonts to match the main font cell height, instead just
set the font size and let FreeType take care of it. This matches
rendering on macOS (
#4707
)
macOS: Fix a regression in the previous release that broke switching input
sources by keyboard (
#4621
)
macOS: Add the default shortcut
cmd
+
k
to clear the terminal screen and
scrollback up to the cursor (
#4625
)
Fix a regression in the previous release that broke strikethrough (
#4632
)
A new action
scroll_prompt_to_bottom
to move the current prompt
to the bottom, filling in the window from the scrollback (
#4634
)
Add two special arguments
@first-line-on-screen
and
@last-line-on-screen
for the
launch
command to be used for pager positioning.
(
#4462
)
Linux: Fix rendering of emoji when using scalable fonts such as Segoe UI Emoji
Shell integration: bash: Dont fail if an existing PROMPT_COMMAND ends with a semi-colon (
#4645
)
Shell integration: bash: Fix rendering of multiline prompts with more than two lines (
#4681
)
Shell integration: fish: Check fish version 3.3.0+ and exit on outdated versions (
#4745
)
Shell integration: fish: Fix pipestatus being overwritten (
#4756
)
Linux: Fix fontconfig alias not being used if the aliased font is dual spaced instead of monospaced (
#4649
)
Fix symbol/PUA glyphs loaded via
symbol_map
instead of as fallbacks not using following spaces to render larger versions (
#4670
)
macOS: Fix regression in previous release that caused Apple’s global shortcuts to not work if they had never been configured on a particular machine (
#4657
)
Fix a fast
click, move mouse, click
sequence causing the first click event to be discarded (
#4603
)
Wayland: Fix wheel mice with line based scrolling being incorrectly handled as high precision devices (
#4694
)
Wayland: Fix touchpads and high resolution wheels not scrolling at the same speed on monitors with different scales (
#4703
)
Add an option
wheel_scroll_min_lines
to set the minimum number of lines for mouse wheel scrolling when using a mouse with a wheel that generates very small offsets when slow scrolling (
#4710
)
macOS: Make the shortcut to toggle full screen configurable (
#4714
)
macOS: Fix the mouse cursor being set to arrow after switching desktops or toggling full screen (
#4716
)
Fix copying of selection after selection has been scrolled off history buffer raising an error (
#4713
)
macOS: Persist “Secure Keyboard Entry” across restarts to match the behavior
of Terminal.app (
#4471
)
hints kitten: Fix common single letter extension files not being detected
(
#4491
)
Support dotted and dashed underline styles (
#4529
)
For the vertical and horizontal layouts have the windows arranged on a ring
rather than a plane. This means the first and last window are considered
neighbors (
#4494
)
A new action to clear the current selection (
#4600
)
Shell integration: fish: Fix cursor shape not working with fish’s vi mode
(
#4508
)
Shell integration: fish: Dont override fish’s native title setting functionality.
See
discussion
.
macOS: Fix hiding via
cmd
+
h
not working on macOS 10.15.7 (
#4472
)
Draw the dots for braille characters more evenly spaced at all font sizes (
#4499
)
icat kitten: Add options to mirror images and remove their transparency
before displaying them (
#4513
)
macOS: Respect the users system-wide global keyboard shortcut preferences
(
#4501
)
macOS: Fix a few key-presses causing beeps from Cocoa’s text input system
(
#4489
)
macOS: Fix using shortcuts from the global menu bar as subsequent key presses
in a multi key mapping not working (
#4519
)
Fix getting last command output not working correctly when the screen is
scrolled (
#4522
)
Integrate kitty closely with common shells such as zsh, fish and bash.
This allows lots of niceties such as jumping to previous prompts, opening the
output of the last command in a new window, etc. See
Shell integration
for details. Packagers please read
Notes for Linux/macOS packagers
.
A new shortcut
ctrl+shift+f7
to visually focus a window using
the keyboard. Pressing it causes numbers to appear over each visible window
and you can press the number to focus the corresponding window (
#4110
)
A new facility
window_logo_path
to draw an arbitrary PNG image as
logo in the corner of a kitty window (
#4167
)
Allow rendering the cursor with a
reverse video
effect. See
cursor
for details (
#126
)
Allow the user to supply a custom Python function to draw tab bar. See
tab_bar_style
A new remote control command to
change the tab color <kitty @
set-tab-color>
(
#1287
)
A new remote control command to
visually select a window <kitty @
select-window>
(
#4165
)
Add support for reporting mouse events with pixel coordinates using the
SGR_PIXEL_PROTOCOL
introduced in xterm 359
When programs ask to read from the clipboard prompt, ask the user to allow
the request by default instead of denying it by default. See
clipboard_control
for details (
#4022
)
A new mappable action
swap_with_window
to swap the current window with another window in the tab, visually
A new
remote control command <kitty @ set-enabled-layouts>
to change
the enabled layouts in a tab (
#4129
)
A new option
bell_path
to specify the path to a sound file
to use as the bell sound
A new option
exe_search_path
to modify the locations kitty searches
for executables to run (
#4324
)
broadcast kitten: Show a “fake” cursor in all windows being broadcast too
(
#4225
)
Allow defining
aliases
for more general actions, not just kittens
(
#4260
)
Remote file transfer: Fix transfer not working if custom ssh port or identity
is specified on the command line (
#4067
)
Unicode input kitten: Implement scrolling when more results are found than
the available display space (
#4068
)
Allow middle clicking on a tab to close it (
#4151
)
The command line option
--watcher
has been deprecated in favor of the
watcher
option in
kitty.conf
. It has the advantage of
applying to all windows, not just the initially created ones. Note that
--watcher
now also applies to all windows, not just initially created ones.
Backward incompatibility
: No longer turn on the kitty extended keyboard
protocol’s disambiguate mode when the client sends the XTMODKEYS escape code.
Applications must use the dedicated escape code to turn on the protocol.
(
#4075
)
Fix soft hyphens not being preserved when round tripping text through the
terminal
macOS: Fix
ctrl
+
shift
with
Esc
or
F1
-
F12
not working
(
#4109
)
Fix the
resize OS Windows <kitty @ resize-os-window>
setting a
slightly incorrect size on high DPI screens (
#4114
)
kitty @ launch
- when creating tabs with the
--match
option create
the tab in the OS Window containing the result of the match rather than
the active OS Window (
#4126
)
macOS: Fix themes kitten failing to download themes because of missing SSL
root certificates (
#3936
)
A new option
clipboard_max_size
to control the maximum size
of data that kitty will transmit to the system clipboard on behalf of
programs running inside it (
#3937
)
When matching windows/tabs in kittens or using remote control, allow matching
by recency.
recent:0
matches the active window/tab,
recent:1
matches
the previous window/tab and so on
themes kitten: Fix only the first custom theme file being loaded correctly
(
#3938
)
A new style for the tab bar that makes tabs looks like the tabs in a physical
tabbed file, see
tab_bar_style
Make the visual bell flash more gentle, especially on dark themes
(
#2937
)
Fix
kitty
--title
not overriding the OS Window title when multiple
tabs are present. Also this option is no longer used as the default title for
windows, allowing individual tabs/windows to have their own titles, even when
the OS Window has a fixed overall title (
#3893
)
Linux: Fix some very long ligatures being rendered incorrectly at some font
sizes (
#3896
)
Fix shift+middle click to paste sending a mouse press event but no release
event which breaks some applications that grab the mouse but can’t handle
mouse events (
#3902
)
macOS: When the language is set to English and the country to one for which
an English locale does not exist, set
LANG
to
en_US.UTF-8
(
#3899
)
terminfo: Fix “cnorm” the property for setting the cursor to normal using a
solid block rather than a blinking block cursor (
#3906
)
Add a new
toggle_layout
action to easily zoom/unzoom a window
When right clicking to extend a selection, move the nearest selection
boundary rather than the end of the selection. To restore previous behavior
use
mouse_map
right
press
ungrabbed
mouse_selection
move-end
.
When opening hyperlinks, allow defining open actions for directories
(
#3836
)
When using the OSC 52 escape code to copy to clipboard allow large
copies (up to 8MB) without needing a kitty specific chunking protocol.
Note that if you used the chunking protocol in the past, it will no longer
work and you should switch to using the unmodified protocol which has the
advantage of working with all terminal emulators.
Fix a bug in the implementation of the synchronized updates escape code that
could cause incorrect parsing if either the pending buffer capacity or the
pending timeout were exceeded (
#3779
)
A new remote control command to
resize the OS Window <kitty @
resize-os-window>
Graphics protocol: Add support for composing rectangles from one animation
frame onto another (
#3809
)
diff kitten: Remove limit on max line length of 4096 characters (
#3806
)
Fix turning off cursor blink via escape codes not working (
#3808
)
Allow using neighboring window operations in the stack layout. The previous
window is considered the left and top neighbor and the next window is
considered the bottom and right neighbor (
#3778
)
macOS: Render colors in the sRGB colorspace to match other macOS terminal
applications (
#2249
)
A new theme for the kitty website with support for dark mode.
Render ┄ ┅ ┆ ┇ ┈ ┉ ┊ ┋ with spaces at the edges. Matches rendering in
most other programs and allows long chains of them to look better
(
#3844
)
hints kitten: Detect paths and hashes that appear over multiple lines.
Note that this means that all line breaks in the text are no longer n
soft breaks are instead r. If you use a custom regular expression that
is meant to match over line breaks, you will need to match over both.
(
#3845
)
Fix a regression in 0.21.0 that broke rendering of private use Unicode symbols followed
by spaces, when they also exist not followed by spaces (
#3729
)
ssh kitten: Support systems where the login shell is a non-POSIX shell
(
#3405
)
ssh kitten: Fix “Connection closed” message being printed by ssh when running
remote commands
Add support for the XTVERSION escape code
macOS: Fix a regression in 0.21.0 that broke middle-click to paste from clipboard (
#3730
)
macOS: Fix shortcuts in the global menu bar responding slowly when cursor blink
is disabled/timed out (
#3693
)
When displaying scrollback ensure that the window does not quit if the amount
of scrollback is less than a screen and the user has the
--quit-if-one-screen
option enabled for less (
#3740
)
Linux: Fix Emoji/bitmapped fonts not use able in symbol_map
query terminal kitten: Allow querying font face and size information
(
#3756
)
Backward incompatibility
: The options to control which modifiers keys to
press for various mouse actions have been removed, if you used these options,
you will need to replace them with configuration using the new
mouse actions framework
as they will be
ignored. The options were:
terminal_select_modifiers
,
rectangle_select_modifiers
and
open_url_modifiers
.
Add a configurable mouse action (
ctrl
+
alt
+
triplepress
to select from the
clicked point to the end of the line. (
#3585
)
Add the ability to un-scroll the screen to the
kitty
@
scroll-window
remote control command (
#3604
)
Unicode input kitten: Fix a regression in 0.20.0 that broke keyboard handling
when the NumLock or CapsLock modifiers were engaged. (
#3587
)
Fix a regression in 0.20.0 that sent incorrect bytes for the
F1
-
F4
keys
in rmkx mode (
#3586
)
macOS: When the Apple Color Emoji font lacks an emoji glyph search for it in other
installed fonts (
#3591
)
macOS: Fix rendering getting stuck on some machines after sleep/screensaver
(
#2016
)
macOS: Add a new
Shell
menu to the global menubar with some commonly used
actions (
#3653
)
macOS: Fix the baseline for text not matching other CoreText based
applications for some fonts (
#2022
)
Add a few more special commandline arguments for the launch command. Now all
KITTY_PIPE_DATA
is also available via command line argument substitution
(
#3593
)
Fix dynamically changing the background color in a window causing rendering
artifacts in the tab bar (
#3595
)
Fix passing STDIN to launched background processes causing them to not inherit
environment variables (
#3603
)
Fix deleting windows that are not the last window via remote control leaving
no window focused (
#3619
)
Improve rendering of curly underlines on HiDPI screens (
#3637
)
ssh kitten: Mimic behavior of ssh command line client more closely by
executing any command specified on the command line via the users’ shell
just as ssh does (
#3638
)
Fix trailing parentheses in URLs not being detected (
#3688
)
Tab bar: Use a lower contrast color for tab separators (
#3666
)
Fix a regression that caused using the
title
command in session files
to stop working (
#3676
)
A new protocol extension to
unscroll
text from the
scrollback buffer onto the screen. Useful, for example, to restore
the screen after showing completions below the shell prompt.
A new remote control command
kitten @ env
to change the default
environment passed to newly created windows (
#3529
)
Linux: Fix binary kitty builds not able to load fonts in WOFF2 format
(
#3506
)
macOS: Prevent
option
based shortcuts for being used for global menu
actions (
#3515
)
Fix
kitty
@
close-tab
not working with pipe based remote control
(
#3510
)
Fix removal of inactive tab that is before the currently active tab causing
the highlighted tab to be incorrect (
#3516
)
Backward incompatibility
: Session files now use the full
launch
command with all its capabilities. However, the syntax of the command is
slightly different from before. In particular watchers are now specified
directly on launch and environment variables are set using
--env
.
Allow setting colors when creating windows using the
launch
command.
A new option
tab_powerline_style
to control the appearance of the tab
bar when using the powerline tab bar style.
diff kitten: Implement recursive diff over SSH (
#3268
)
ssh kitten: Allow using python instead of the shell on the server, useful if
the shell used is a non-POSIX compliant one, such as fish (
#3277
)
Add support for the color settings stack that XTerm copied from us without
acknowledgement and decided to use incompatible escape codes for.
Add entries to the terminfo file for some user capabilities that are shared
with XTerm (
#3193
)
The launch command now does more sophisticated resolving of executables to
run. The system-wide PATH is used first, then system specific default paths,
and finally the PATH inside the shell.
Double clicking on empty tab bar area now opens a new tab (
#3201
)
kitty @ ls: Show only environment variables that are different for each
window, by default.
When passing a directory or a non-executable file as the program to run to
kitty opens it with the shell or by parsing the shebang, instead of just failing.
Linux: Fix rendering of emoji followed by the graphics variation selector not
being colored with some fonts (
#3211
)
Unicode input: Fix using index in select by name mode not working for indices
larger than 16. Also using an index does not filter the list of matches. (
#3219
)
Wayland: Add support for the text input protocol (
#3410
)
Wayland: Fix mouse handling when using client side decorations
Wayland: Fix un-maximizing a window not restoring its size to what it was
before being maximized
GNOME/Wayland: Improve window decorations the titlebar now shows the window
title. Allow running under Wayland on GNOME by default. (
#3284
)
macOS: Add menu items to close the OS window and the current tab (
#3240
,
#3246
)
macOS: Allow opening script and command files with kitty (
#3366
)
Also detect
gemini://
URLs when hovering with the mouse (
#3370
)
When using a non-US keyboard layout and pressing
ctrl
+
key
when
the key matches an English key, send that to the program running in the
terminal automatically (
#2000
)
When matching shortcuts, also match on shifted keys, so a shortcut defined as
ctrl
+
plus
will match a keyboard where you have to press
shift
+
equal
to get the plus key (
#2000
)
Fix extra space at bottom of OS window when using the fat layout with the tab bar at the
top (
#3258
)
Fix window icon not working on X11 with 64bits (
#3260
)
Fix OS window sizes under 100px resulting in scaled display (
#3307
)
Fix rendering of ligatures in the latest release of Cascadia code, which for
some reason puts empty glyphs after the ligature glyph rather than before it
(
#3313
)
Improve handling of infinite length ligatures in newer versions of FiraCode
and CascadiaCode. Now such ligatures are detected based on glyph naming
convention. This removes the gap in the ligatures at cell boundaries (
#2695
)
macOS: Disable the native operating system tabs as they are non-functional
and can be confusing (
#3325
)
hints kitten: When using the linenumber action with a background action,
preserve the working directory (
#3352
)
Graphics protocol: Fix suppression of responses not working for chunked
transmission (
#3375
)
Fix inactive tab closing causing active tab to change (
#3398
)
Fix a crash on systems using musl as libc (
#3395
)
Improve rendering of rounded corners by using a rectircle equation rather
than a cubic bezier (
#3409
)
Graphics protocol: Add a control to allow clients to specify that the cursor
should not move when displaying an image (
#3411
)
Fix marking of text not working on lines that contain zero cells
(
#3403
)
Fix the selection getting changed if the screen contents scroll while
the selection is in progress (
#3431
)
Linux: Read
font_features
from the FontConfig database as well, so
that they can be configured in a single, central location (
#3174
)
Graphics protocol: Add support for giving individual image placements their
own ids and for asking the terminal emulator to assign ids for images. Also
allow suppressing responses from the terminal to commands.
These are backwards compatible protocol extensions. (
#3133
,
#3163
)
Distribute extra pixels among all eight-blocks rather than adding them
all to the last block (
#3097
)
Fix drawing of a few sextant characters incorrect (
#3105
)
macOS: Fix minimize not working for chromeless windows (
#3112
)
Preserve lines in the scrollback if a scrolling region is defined that
is contiguous with the top of the screen (
#3113
)
Wayland: Fix key repeat being stopped by the release of an unrelated key
(
#2191
)
Add an option,
detect_urls
to control whether kitty will detect URLs
when the mouse moves over them (
#3118
)
Graphics protocol: Dont return filename in the error message when opening file
fails, since filenames can contain control characters (
#3128
)
macOS: Partial fix for traditional fullscreen not working on Big Sur
(
#3100
)
Fix one ANSI formatting escape code not being removed from the pager history
buffer when piping it as plain text (
#3132
)
Match the save/restore cursor behavior of other terminals, for the sake of
interoperability. This means that doing a DECRC without a prior DECSC is now
undefined (
#1264
)
Fix mapping
remote_control
send-text
not working (
#3147
)
A new
Query terminal
kitten to easily query the running kitty
via escape codes to detect its version, and the values of
configuration options that enable or disable terminal features.
Improve rendering of borders when using minimal borders. Use less space and
do not display a box around active windows
Add a new extensible escape code to allow terminal programs to trigger
desktop notifications. See
Desktop notifications
(
#1474
)
Implement special rendering for various characters from the set of “Symbols
for Legacy Computing” from the Unicode 13 standard
Unicode input kitten: Allow choosing symbols from the NERD font as well.
These are mostly Private Use symbols not in any standard, however are common. (
#2972
)
Allow specifying border sizes in either pts or pixels. Change the default to
0.5pt borders as this works best with the new minimal border style
Add support for displaying correct colors with non-sRGB PNG files (Adds a
dependency on liblcms2)
Allow tracking focus change events in watchers (
#2918
)
Allow specifying watchers in session files and via a command line argument
(
#2933
)
Add a setting
tab_activity_symbol
to show a symbol in the tab title
if one of the windows has some activity after it was last focused
(
#2515
)
macOS: Switch to using the User Notifications framework for notifications.
The current notifications framework has been deprecated in Big Sur. The new
framework only allows notifications from signed and notarized applications,
so people using kitty from homebrew/source are out of luck. Complain to
Apple.
When in the main screen and a program grabs the mouse, do not use the scroll
wheel events to scroll the scrollback buffer, instead send them to the
program (
#2939
)
Fix unfocused windows in which a bell occurs not changing their border color
to red until a relayout
Linux: Fix automatic detection of bold/italic faces for fonts such as IBM
Plex Mono that have the regular face with a full name that is the same as the
family name (
#2951
)
X11: Improve handling of multiple keyboards. Now pressing a modifier key in
one keyboard and a normal key in another works (
#2362
). Don’t rebuild
keymaps on new keyboard events that only change geometry (
#2787
).
Better handling of multiple keyboards with incompatible layouts (
#2726
)
Improve anti-aliasing of triangular box drawing characters, noticeable on
low-resolution screens (
#2844
)
Fix
kitty
@
send-text
not working reliably when using a socket for remote
control (
#2852
)
Implement support for box drawing rounded-corners characters (
#2240
)
Allow setting the class for new OS windows in a session file
When a character from the Unicode Dingbat block is followed by a space, use
the extra space to render a larger version of the character (
#2850
)
macOS: Fix the LC_CTYPE env var being set to UTF-8 on systems in which the
language and country code do not form a valid locale (
#1233
)
macOS: Fix
cmd
+
plus
not changing font size (
#2839
)
Make neighboring window selection in grid and splits layouts more intelligent
(
#2840
)
Allow passing the current selection to kittens (
#2796
)
Fix pre-edit text not always being cleared with ibus input (
#2862
)
Add an option
confirm_os_window_close
to ask for confirmation
when closing an OS window with multiple kitty windows.
Tall and Fat layouts: Add a
mirrored
option to put the full size window
on the opposite edge of the screen (
#2654
)
Tall and Fat layouts: Add mappable actions to increase or decrease the number
of full size windows (
#2688
)
Allow sending arbitrary signals to the current foreground process in a window
using either a mapping in kitty.conf or via remote control (
#2778
)
Allow sending the back and forward mouse buttons to terminal applications
(
#2742
)
Backwards incompatibility
: The numbers used to encode mouse buttons
for the
send_mouse_event
function that can be used in kittens have
been changed (see
Sending mouse events
).
Add a new mappable
quit
action to quit kitty completely.
Fix marks using different colors with regexes using only a single color
(
#2663
)
Linux: Workaround for broken Nvidia drivers for old cards (
#456
)
Wayland: Fix kitty being killed on some Wayland compositors if a hidden window
has a lot of output (
#2329
)
BSD: Fix controlling terminal not being established (
#2686
)
Allow individually setting margins and padding for each edge (left, right,
top, bottom). Margins can also be controlled per window via remote control
(
#2546
)
Fix reverse video not being rendered correctly when using transparency or a
background image (
#2419
)
Allow mapping arbitrary remote control commands to key presses in
kitty.conf
X11: Fix crash when doing drag and drop from some applications (
#2505
)
When the application running in the terminal grabs the mouse, pass middle
clicks to the application unless
terminal_select_modifiers
are
pressed (
#2368
)
A new
copy_and_clear_or_interrupt
function (
#2403
)
X11: Fix arrow mouse cursor using right pointing instead of the default left
pointing arrow (
#2341
)
Allow passing the currently active kitty window id in the launch command
(
#2391
)
unicode input kitten: Allow pressing
ctrl
+
tab
to change the input mode
(
#2343
)
Fix a bug that prevented using custom functions with the new marks feature
(
#2344
)
Make the set of URL prefixes that are recognized while hovering with the
mouse configurable (
#2416
)
Fix border/margin/padding sizes not being recalculated on DPI change
(
#2346
)
macOS: Fix menubar title not updating on OS Window focus change (
#2350
)
Fix rendering of combining characters with fonts that have glyphs for
precomposed characters but not decomposed versions (
#2365
)
Fix incorrect rendering of selection when using rectangular select and
scrolling (
#2351
)
Allow setting WM_CLASS and WM_NAME when creating new OS windows with the
launch command (
launch
--os-window-class
)
macOS: When switching input method while a pending multi-key input is in
progress, clear the pending input (
#2358
)
Fix a regression in the previous release that broke switching to neighboring windows
in the Grid layout when there are less than four windows (
#2377
)
Fix colors in scrollback pager off if the window has redefined terminal
colors using escape codes (
#2381
)
Fix selection not updating properly while scrolling (
#2442
)
Allow extending selections by dragging with right button pressed
(
#2445
)
Workaround for bug in less that causes colors to reset at wrapped lines
(
#2381
)
X11/Wayland: Allow drag and drop of text/plain in addition to text/uri-list
(
#2441
)
Add specialised rendering for a few more box powerline and unicode symbols
(
#2074
and
#2021
)
Add a new socket only mode for
allow_remote_control
. This makes
it possible for programs running on the local machine to control kitty
but not programs running over ssh.
hints kitten: Allow using named groups in the regular expression. The named
groups are passed to the invoked program for further processing.
Fix a regression in 0.14.5 that caused rendering of private use glyphs
with and without spaces to be identical (
#2117
)
Wayland: Fix incorrect scale used when first creating an OS window
(
#2133
)
macOS: Disable mouse hiding by default as getting it to work robustly
on Cocoa is too much effort (
#2158
)
Implement a hack to (mostly) preserve tabs when cat-ting a file with them and then
copying the text or passing screen contents to another program (
#1829
)
When all visible windows have the same background color, use that as the
color for the global padding, instead of the configured background color
(
#1957
)
When resetting the terminal, also reset parser state, this allows easy
recovery from incomplete escape codes (
#1961
)
Allow mapping keys commonly found on European keyboards (
#1928
)
Fix incorrect rendering of some symbols when followed by a space while using
the PowerLine font which does not have a space glyph (
#1225
)
Linux: Allow using fonts with spacing=90 in addition to fonts with
spacing=100 (
#1968
)
Use selection foreground color for underlines as well (
#1982
)
Remote control: Add a command
kitty @ scroll-window
to scroll windows
Allow passing a
!neighbor
argument to the new_window mapping to open a
new window next to the active window (
#1746
)
Document the kitty remote control protocol (
#1646
)
Add a new option
pointer_shape_when_grabbed
that allows you to control
the mouse pointer shape when the terminal programs grabs the pointer
(
#1808
)
Add an option
terminal_select_modifiers
to control which modifiers
are used to override mouse selection even when a terminal application has
grabbed the mouse (
#1774
)
When piping data to a child in the pipe command do it in a thread so as not
to block the UI (
#1708
)
unicode_input kitten: Fix a regression that broke using indices to select
recently used symbols.
Fix a regression that caused closing an overlay window to focus
the previously focused window rather than the underlying window (
#1720
)
macOS: Reduce energy consumption when idle by shutting down Apple’s display
link thread after 30 second of inactivity (
#1763
)
Linux: Fix incorrect scaling for fallback fonts when the font has an
underscore that renders out of bounds (
#1713
)
macOS: Fix finding fallback font for private use unicode symbols not working
reliably (
#1650
)
Fix an out of bounds read causing a crash when selecting text with the mouse
in the alternate screen mode (
#1578
)
Linux: Use the system “bell” sound for the terminal bell. Adds libcanberra
as a new dependency to play the system sound.
macOS: Fix a rare deadlock causing kitty to hang (
#1779
)
Linux: Fix a regression in 0.14.0 that caused the event loop to tick
continuously, wasting CPU even when idle (
#1782
)
ssh kitten: Make argument parsing more like ssh (
#1787
)
Add an option
placement_strategy
to control how the cell area is
aligned inside the window when the window size is not an exact multiple
of the cell size (
#1670
)
hints kitten: Add a
kitty
+kitten
hints
--multiple-joiner
option to
control how multiple selections are serialized when copying to clipboard
or inserting into the terminal. You can have them on separate lines,
separated by arbitrary characters, or even serialized as JSON (
#1665
)
macOS: Fix a regression in the previous release that broke using
ctrl
+
shift
+
tab
(
#1671
)
panel kitten: Fix the contents of the panel kitten not being positioned
correctly on the vertical axis
icat kitten: Fix a regression that broke passing directories to icat
(
#1683
)
Allow using the
pipe
command to send screen and scrollback
contents directly to the clipboard (
#1693
)
Linux: Disable the Wayland backend on GNOME by default as GNOME has no
support for server side decorations. Can be controlled by
linux_display_server
.
Wayland: Fix resizing the window on a compositor that does not provide
server side window decorations, such a GNOME or Weston not working
correctly (
#1659
)
Wayland: Fix crash when enabling disabling monitors on sway (
#1696
)
Add support for the underscore key found in some keyboard layouts
(
#1639
)
Fix a missing newline when using the pipe command between the
scrollback and screen contents (
#1642
)
Fix colors not being preserved when using the pipe command with
the pager history buffer (
#1657
)
macOS: Fix a regression that could cause rendering of a kitty window
to occasionally freeze in certain situations, such as moving it between
monitors or transitioning from/to fullscreen (
#1641
)
macOS: Fix a regression that caused
cmd
+
v
to double up in the dvorak
keyboard layout (
#1652
)
When resizing and only a single window is present in the current layout,
use that window’s background color to fill in the blank areas.
Linux: Automatically increase cell height if the font being used is broken
and draws the underscore outside the bounding box (
#690
)
Wayland: Fix maximizing the window on a compositor that does not provide
server side window decorations, such a GNOME or Weston not working
(
#1662
)
macOS: The default behavior of the Option key has changed. It now generates
unicode characters rather than acting as the
Alt
modifier. See
macos_option_as_alt
.
Support for an arbitrary number of internal clipboard buffers to copy/paste
from, see (
Multiple copy/paste buffers
)
Allow using the new private internal clipboard buffers with the
copy_on_select
option (
#1390
)
macOS: Allow opening new kitty tabs/top-level windows from Finder
(
#1350
)
Add an option
disable_ligatures
to disable
multi-character ligatures under the cursor to make editing easier
or disable them completely (
#461
)
Allow creating new OS windows in session files (
#1514
)
Allow specifying a value of
none
for the
selection_foreground
which will cause kitty to not change text color in selections (
#1358
)
Make live resizing of OS windows smoother and add an option
resize_draw_strategy
to control what is drawn while a
resize is in progress.
macOS: Improve handling of IME extended input. Compose characters
are now highlighted and the IME panel moves along with the text
(
#1586
). Also fixes handling of delete key in Chinese IME
(
#1461
)
When a window is closed, switch focus to the previously active window (if
any) instead of picking the previous window in the layout (
#1450
)
icat kitten: Add support for displaying images at http(s) URLs (
#1340
)
A new option
strip_trailing_spaces
to optionally remove trailing
spaces from lines when copying to clipboard.
A new option
tab_bar_min_tabs
to control how many tabs must be
present before the tab-bar is shown (
#1382
)
Automatically check for new releases and notify when an update is available,
via the system notification facilities. Can be controlled by
update_check_interval
(
#1342
)
Wayland: Use the kitty Wayland backend by default. Can be switched back
to using XWayland by setting the environment variable:
KITTY_DISABLE_WAYLAND=1
Add a
no-append
setting to
clipboard_control
to disable
the kitty copy concatenation protocol extension for OSC 52.
Update to using the Unicode 12 standard
Unicode input kitten: Allow using the arrow keys in code mode to go to next
and previous unicode symbol.
macOS: Fix specifying initial window size in cells not working correctly on
Retina screens (
#1444
)
Fix a regression in version 0.13.0 that caused background colors of space
characters after private use unicode characters to not be respected
(
#1455
)
Only update the selected text to clipboard when the selection is finished,
not continuously as it is updated. (
#1460
)
Remote control: Make the
kitten @ set-font-size
command more capable.
It can now increment font size and reset it. It also only acts on the
active top-level window, by default (
#1581
)
When launching child processes set the
PWD
environment variable
(
#1595
)
X11: use the window manager’s native full-screen implementation when
making windows full-screen (
#1605
)
Mouse selection: When extending by word, fix extending selection to non-word
characters not working well (
#1616
)
macOS: Fix dragging kitty window tabs in traditional full screen mode causing
crashes (
#1296
)
macOS: Ensure that when running from a bundle, the bundle kitty exe is
preferred over any kitty in PATH (
#1280
)
macOS: Fix a regression that broke mapping of
ctrl
+
tab
(
#1304
)
Add a list of user-created kittens to the docs
Fix a regression that broke changing mouse wheel scroll direction with
negative
wheel_scroll_multiplier
values in full-screen applications
like vim (
#1299
)
Add a new option
tab_title_template
to control how tab titles
are formatted. In particular the template can be used to display
the tab number next to the title (
#1223
)
Report the current foreground processes as well as the original child process,
when using
kitty @ ls
Use the current working directory of the foreground process for the
*_with_cwd
actions that open a new window with the current working
directory.
Add a new
copy_or_interrupt
action that can be mapped to kbd:
ctrl+c
. It
will copy if there is a selection and interrupt otherwise (
#1286
)
Fix setting
background_opacity
causing window margins/padding to be slightly
different shade from background (
#1221
)
Fix passing input via the pipe action to a program without a window not
working.
Linux: Fix a regression in the previous release that caused automatic
selection of bold/italic fonts when using aliases such as “monospace” to not
work (
#1209
)
Fix resizing window smaller and then restoring causing some wrapped lines to not
be properly unwrapped (
#1206
)
Add an option
scrollback_pager_history_size
to tell kitty to store
extended scrollback to use when viewing the scrollback buffer in a pager
(
#970
)
Modify the kittens sub-system to allow creating custom kittens without any
user interface. This is useful for creating more complex actions that can
be bound to key presses in
kitty.conf
. See
doc:
kittens/custom
. (
#870
)
Add a new
nth_window
action that can be used to go to the nth window and
also previously active windows, using negative numbers. Similarly,
goto_tab
now accepts negative numbers to go to previously active tabs
(
#1040
)
Allow private use unicode characters to stretch over more than a single
neighboring space (
#1036
)
Add a new
touch_scroll_multiplier
option to modify the amount
scrolled by high precision scrolling devices such as touchpads (
#1129
)
icat kitten: Implement reading image data from STDIN, if STDIN is not
connected to a terminal (
#1130
)
hints kitten: Insert trailing spaces after matches when using the
--multiple
option. Also add a separate
--add-trailing-space
option to control this behavior (
#1132
)
Fix the
*_with_cwd
actions using the cwd of the overlay window rather
than the underlying window’s cwd (
#1045
)
Fix incorrect key repeat rate on wayland (
#1055
)
macOS: Fix drag and drop of files not working on Mojave (
#1058
)
macOS: Fix IME input for East Asian languages (
#910
)
macOS: Fix rendering frames-per-second very low when processing
large amounts of input in small chunks (
#1082
)
macOS: Fix incorrect text sizes calculated when using an external display
that is set to mirror the main display (
#1056
)
macOS: Use the system default double click interval (
#1090
)
A new
last_used_layout
function that can be mapped to a shortcut to
switch to the previously used window layout (
#870
)
New
neighboring_window
and
move_window
functions to switch to
neighboring windows in the current layout, and move them around, similar to
window movement in vim (
#916
)
A new
pipe
function that can be used to pipe the contents of the screen
and scrollback buffer to any desired program running in a new window, tab or
overlay window. (
#933
)
Add a new
kitty
--start-as
command line flag to start kitty
full-screen/maximized/minimized. This replaces the
--start-in-fullscreen
flag introduced in the previous release (
#935
)
When mapping the
new_tab
action allow specifying that the tab should open
next to the current tab instead of at the end of the tabs list (
#979
)
macOS: Add a new
macos_thicken_font
to make text rendering
on macs thicker, which makes it similar to the result of
sub-pixel antialiasing (
#950
)
Add a new
--start-in-fullscreen
command line flag to start
kitty in full screen mode (
#856
)
macOS: Fix a character that cannot be rendered in any font causing
font fallback for all subsequent characters that cannot be rendered in the
main font to fail (
#799
)
Linux: Do not enable IME input via ibus unless the
GLFW_IM_MODULE=ibus
environment variable is set. IME causes key processing latency and even
missed keystrokes for many people, so it is now off by default.
Fix backspacing of wide characters in wide-character unaware programs not working (
#875
)
Linux: Fix number pad arrow keys not working when Numlock is off (
#857
)
Wayland: Implement support for clipboard copy/paste (
#855
)
Allow mapping shortcuts using the raw key code from the OS (
#848
)
Allow mapping of individual key-presses without modifiers as shortcuts
Fix legacy invocation of icat as
kitty icat
not working (
#850
)
Improve rendering of wavy underline at small font sizes (
#853
)
Fix a regression in 0.12.0 that broke dynamic resizing of layouts (
#860
)
Wayland: Allow using the
kitty
--class
command line flag
to set the app id (
#862
)
Add completion of the kitty command for the fish shell (
#829
)
Linux: Fix XCompose rules with no defined symbol not working (
#880
)
Linux: Fix crash with some Nvidia drivers when creating tabs in the first
top level-window after creating a second top-level window. (
#873
)
macOS: Diff kitten: Fix syntax highlighting not working because of
a bug in the 0.12.0 macOS package
Preserve the mouse selection even when the contents of the screen are
scrolled or overwritten provided the new text does not intersect the
selected lines.
Linux: Implement support for Input Method Extensions (multilingual input
using standard keyboards) via
IBus
(
#469
)
Implement completion for the kitty command in bash and zsh. See
Shell integration
.
Render the text under the cursor in a fixed color, configurable via
the option
cursor_text_color
(
#126
)
Add an option
env
to set environment variables in child processes
from kitty.conf
Add an action to the
clear_terminal
function to scroll the screen
contents into the scrollback buffer (
#1113
)
Implement high precision scrolling with the trackpad on platforms such as
macOS and Wayland that implement it. (
#819
)
macOS: Allow scrolling window contents using mouse wheel/trackpad even when the
window is not the active window (
#729
)
Remote control: Allow matching windows by the environment variables of their
child process as well
Allow running kittens via the remote control system (
#738
)
Allow enabling remote control in only some kitty windows
Add a keyboard shortcut to reset the terminal (
ctrl+shift+delete
). It
takes parameters so you can define your own shortcuts to clear the
screen/scrollback also (
#747
)
Fix one-pixel line appearing at window edges at some window sizes when
displaying images with background opacity enabled (
#741
)
diff kitten: Fix error when right hand side file is binary and left hand side
file is text (
#752
)
Fix detection of URLs in HTML source code (URLs inside quotes) (
#785
)
Implement support for emoji skin tone modifiers (
#787
)
Round-trip the zwj unicode character. Rendering of sequences containing zwj
is still not implemented, since it can cause the collapse of an unbounded
number of characters into a single cell. However, kitty at least preserves
the zwj by storing it as a combining character.
macOS: Disable the custom mouse cursor. Using a custom cursor fails on dual
GPU machines. I give up, Apple users will just have to live with the
limitations of their choice of OS. (
#794
)
macOS: Fix control+tab key combination not working (
#801
)
Linux: Fix slow startup on some systems caused by GLFW searching for
joysticks. Since kitty does not use joysticks, disable joystick support.
(
#830
)
Draw only the minimum borders needed for inactive windows. That is only the borders
that separate the inactive window from a neighbor. Note that setting
a non-zero window margin overrides this and causes all borders to be drawn.
The old behavior of drawing all borders can be restored via the
draw_minimal_borders
setting in kitty.conf. (
#699
)
macOS: Add an option
macos_window_resizable
to control if kitty
top-level windows are resizable using the mouse or not (
#698
)
macOS: Use a custom mouse cursor that shows up well on both light and dark backgrounds
(
#359
)
macOS: Workaround for switching from fullscreen to windowed mode with the
titlebar hidden causing window resizing to not work. (
#711
)
Fix triple-click to select line not working when the entire line is filled
(
#703
)
When dragging to select with the mouse “grab” the mouse so that if it strays
into neighboring windows, the selection is still updated (
#624
)
When clicking in the margin/border area of a window, map the click to the
nearest cell in the window. Avoids selection with the mouse failing when
starting the selection just outside the window.
When drag-scrolling stop the scroll when the mouse button is released.
Fix a regression in the previous release that caused pasting large amounts
of text to be duplicated (
#709
)
Linux: Allow using XKB key names to bind shortcuts to keys not supported by GLFW (
#665
)
kitty shell: Ignore failure to read readline history file. Happens if the
user migrates their kitty cache directory between systems with incompatible
readline implementations.
macOS: Fix an error in remote control when using --listen-on (
#679
)
A new tab bar style “fade” in which each tab’s edges fade into the background.
See
tab_bar_style
and
tab_fade
for details. The old look can be
restored by setting
tab_bar_style
to
separator
.
Implement changing the font size for individual top level (OS) windows
(
#408
)
When viewing the scrollback in less using
ctrl+shift+h
and kitty
is currently scrolled, position the scrollback in less to match kitty’s
scroll position. (
#148
)
ssh kitten: Support all SSH options. It can now be aliased directly to ssh
for convenience. (
#591
)
hints kitten: Allow selecting hashes from the terminal with
ctrl+shift+p>h
useful for git commits. (
#604
)
Allow specifying initial window size in number of cells in addition to pixels
(
#436
)
Add a setting to control the margins to the left and right of the tab-bar
(
#584
)
When closing a tab switch to the last active tab instead of the right-most
tab (
#585
)
Wayland: Fix kitty not starting when using wl_roots based compositors
(
#157
)
Wayland: Fix mouse wheel/touchpad scrolling in opposite direction to other apps (
#594
)
macOS: Fix the new OS window keyboard shortcut (
ctrl+shift+n
) not
working if no kitty window currently has focus. (
#524
)
macOS: Keep kitty running even when the last window is closed. This is in
line with how applications are supposed to behave on macOS (
#543
).
There is a new option (
macos_quit_when_last_window_closed
) to control
this.
macOS: Add macOS standard shortcuts for copy, paste and new OS window
(⌘+C, ⌘+V, ⌘+N)
Add a config option (
editor
) to set the EDITOR kitty uses (
#580
)
Add a config option (
x11_hide_window_decorations
) to hide window
decorations under X11/Wayland (
#607
)
Add an option to @set-window-title to make the title change non-permanent
(
#592
)
Add support for the CSI t escape code to query window and cell sizes
(
#581
)
Linux: When using layouts that map the keys to non-ascii characters,
map shortcuts using the ascii equivalents, from the default layout.
(
#606
)
Linux: Fix fonts not being correctly read from TrueType Collection
(.ttc) files (
#577
)
Add a kitten to easily ssh into servers that automatically copies the
terminfo files over.
kitty
+kitten
ssh
myserver
.
diff kitten: Make the keyboard shortcuts configurable (
#563
)
Allow controlling
background_opacity
via either keyboard shortcuts or
remote control. Note that you must set
dynamic_background_opacity yes
in
kitty.conf first. (
#569
)
diff kitten: Add keybindings to scroll by page
diff kitten: Fix incorrect syntax highlighting for a few file formats such as
yaml
macOS: Fix regression that caused the
macos_option_as_alt
setting to always
be disabled for all OS windows in a kitty instance after the first window
(
#571
)
Fix Ctrl+Alt+Space not working in normal and application keyboard modes
(
#562
)
A diff kitten to show side-by-side diffs with syntax highlighting and support
for images. See
diff kitten
.
Make windows in the various kitty layouts manually resizable. See
Layouts
for details.
Implement support for the SGR
faint
escape code to make text blend
into the background (
#446
).
Make the hints kitten a little smarter (
commit: ad1109b6f
)
so that URLs that stretch over multiple lines are detected. Also improve
detection of surrounding brackets/quotes.
Make the kitty window id available as the environment variable
KITTY_WINDOW_ID
(
#532
).
Add a “fat” layout that is similar to the “tall” layout but vertically
oriented.
Expand environment variables in config file include directives
Allow programs running in kitty to read/write from the clipboard (
commit: 889ca7791
).
By default only writing is allowed. This feature is supported in many
terminals, search for
OSC 52 clipboard
to find out more about using it.
Fix moving cursor outside a defined page area incorrectly causing the cursor
to be placed inside the page area. Caused incorrect rendering in neovim, in
some situations (
#542
).
Render a couple more powerline symbols directly, bypassing the font
(
#550
).
Fix ctrl+alt+<special> not working in normal and application keyboard (
#548
).
Partial fix for rendering Right-to-left languages like Arabic. Rendering of
Arabic is never going to be perfect, but now it is at least readable.
Fix Ctrl+backspace acting as plain backspace in normal and application
keyboard modes (
#538
).
Have the paste_from_selection action paste from the clipboard on platforms
that do not have a primary selection such as Wayland and macOS
(
#529
)
Fix cursor_stop_blinking_after=0 not working (
#530
)
Show a bell symbol on the tab if a bell occurs in one of the windows in the tab and
the window is not the currently focused window
Change the window border color if a bell occurs in an unfocused window. Can
be disabled by setting the bell_border_color to be the same as the
inactive_border_color.
macOS: Add support for dead keys
Unicode input: When searching by name search for prefix matches as well as
whole word matches
Dynamically allocate the memory used for the scrollback history buffer.
Reduces startup memory consumption when using very large scrollback
buffer sizes.
Add an option to not request window attention on bell.
Remote control: Allow matching windows by number (visible position).
macOS: Fix changing tab title and kitty shell not working
When triple-clicking select all wrapped lines belonging to a single logical line.
hints kitten: Detect bracketed URLs and don’t include the closing bracket in the URL.
When calling pass_selection_to_program use the current directory of the child
process as the cwd of the program.
Add macos_hide_from_tasks option to hide kitty from the macOS task switcher
macOS: When the macos_titlebar_color is set to background change the titlebar
colors to match the current background color of the active kitty window
Add a setting to clear all shortcuts defined up to that point in the config
file(s)
Add a setting (kitty_mod) to change the modifier used by all the default
kitty shortcuts, globally
Fix Shift+function key not working
Support the F13 to F25 function keys
Don’t fail to start if the user deletes the hintstyle key from their
fontconfig configuration.
When rendering a private use unicode codepoint and a space as a two cell
ligature, set the foreground colors of the space cell to match the colors of
the first cell. Works around applications like powerline that use different
colors for the two cells.
Fix passing @text to other programs such as when viewing the scrollback
buffer not working correctly if kitty is itself scrolled up.
Fix window focus gained/lost events not being reported to child programs when
switching windows/tabs using the various keyboard shortcuts.
Fix tab title not changing to reflect the window title when switching between different windows in a tab
Ignore -e if it is specified on the command line. This is for compatibility
with broken software that assumes terminals should run with an -e option to
execute commands instead of just passing the commands as arguments.
A new kitty command shell to allow controlling kitty via commands. Press
ctrl+shift+escape
to run the shell.
The hints kitten has become much more powerful. Now in addition to URLs you
can use it to select word, paths, filenames, lines, etc. from the screen.
These can be inserted into the terminal, copied to clipboard or sent to
external programs.
Linux: Switch to libxkbcommon for keyboard handling. It allows kitty to
support XCompose and dead keys and also react to keyboard remapping/layout
change without needing a restart.
Add support for multiple-key-sequence shortcuts
A new remote control command
set-colors
to change the current and/or
configured colors.
When double-clicking to select a word, select words that continue onto the
next/prev line as well.
Add an
include
directive for the config files to read multiple config files
Improve mouse selection for windows with padding. Moving the mouse into the
padding area now acts as if the mouse is over the nearest cell.
Allow setting all 256 terminal colors in the config file
Fix using
kitty --single-instance
to open a new window in a running kitty
instance, not respecting the
--directory
flag
URL hints: Exclude trailing punctuation from URLs
URL hints: Launch the browser from the kitty parent process rather than the
hints kitten. Fixes launching on some systems where xdg-open doesn’t like
being run from a kitten.
Allow using rectangle select mode by pressing shift in addition to the
rectangle select modifiers even when the terminal program has grabbed the
mouse.
Fix a regression that broke the visual bell and invert screen colors escape
code
Allow double-click and triple-click + drag to extend selections word at a
time or line at a time
Add a keyboard shortcut to set the tab title
Fix setting window title to empty via OSC escape code not working correctly
Linux: Fix cell width calculation incorrect for some fonts (cell widths are
now calculated by actually rendering bitmaps, which is slower but more
accurate)
Allow specifying a system wide kitty config file, for all users
Add a --debug-config command line flag to output data about the system and
kitty configuration.
Allow extending existing selections by right clicking
Add a configurable keyboard shortcut and remote command to set the font size to a specific value
Add an option to have kitty close the window when the main processes running in it exits, even if there are still background processes writing to that terminal
Add configurable keyboard shortcuts to switch to a specific layout
Add a keyboard shortcut to edit the kitty config file easily
macOS: Fix restoring of window size not correct on Retina screens
macOS: Add a facility to specify command line arguments when running kitty from the GUI
Add a focus-tab remote command
Fix screen not being refreshed immediately after moving a window.
Fix a crash when getting the contents of the scrollback buffer as text
Extend kitty’s remote control feature to work over both UNIX and TCP sockets,
so now you can control kitty from across the internet, if you want to.
Render private use unicode characters that are followed by a space as a two
character ligature. This fixes rendering for applications that misuse
private-use characters to display square symbols.
Fix Unicode emoji presentation variant selector causing new a fallback font
instance to be created
Fix a rare error that prevented the Unicode input kitten from working
sometimes
Allow using Ctrl+Alt+letter in legacy keyboard modes by outputting them as Ctrl+letter and Alt+letter.
This matches other terminals’ behavior.
Fix cursor position off-by-one on horizontal axis when resizing the terminal
Wayland: Fix auto-repeat of keys not working
Wayland: Add support for window decorations provided by the Wayland shell
macOS: Fix URL hints not working
macOS: Fix shell not starting in login mode on some computers
macOS: Output errors into console.app when running as a bundle
A framework for kittens, that is, small terminal programs designed to run
inside kitty and extend its capabilities. Examples include unicode input and
selecting URLs with the keyboard.
Input arbitrary unicode characters by pressing Ctrl+Shift+u. You can choose
characters by name, by hex code, by recently used, etc. There is even and
editable Favorites list.
Open URLs using only the keyboard. kitty has a new “hints mode”. Press
Ctrl+Shift+e and all detected URLs on the screen are highlighted with a key
to press to open them. The facility is customizable so you can change
what is detected as a URL and which program is used to open it.
Add an option to change the titlebar color of kitty windows on macOS
Only consider Emoji characters with default Emoji presentation to be two
cells wide. This matches the standard. Also add support for the Unicode Emoji
variation presentation selector.
Prevent video tearing during high speed scrolling by syncing draws
to the monitor’s refresh rate. There is a new configuration option to
control this
sync_to_monitor
.
When displaying only a single window, use the default background color of the
window (which can be changed via escape codes) as the color for the margin
and padding of the window.
Add some non standard terminfo capabilities used by neovim and tmux.
Fix large drop in performance when using multiple top-level windows on macOS
Fix save/restore of window sizes not working correctly.
Remove option to use system wcwidth(). Now always use a wcwidth() based on
the Unicode standard. Only sane way.
Fix a regression that caused a few ligature glyphs to not render correctly in
rare circumstances.
Browsing the scrollback buffer now happens in an overlay window instead of a
new window/tab.
Allow controlling kitty from the shell prompt/scripts. You can
open/close/rename windows and tabs and even send input to specific windows.
See the README for details.
Add option to put tab bar at the top instead of the bottom
Add option to override the default shell
Add “Horizontal” and “Vertical” window layouts
Sessions: Allow setting titles and working directories for individual windows
Option to copy to clipboard on mouse select
Fix incorrect reporting of mouse move events when using the SGR protocol
Make alt+backspace delete the previous word
Take the mouse wheel multiplier option in to account when generating fake key
scroll events
macOS: Fix closing top-level window does not transfer focus to other
top-level windows.
macOS: Fix alt+arrow keys not working when disabling the macos_option_as_alt
config option.
kitty icat: Workaround for bug in ImageMagick that would cause some images
to fail to display at certain sizes.
Fix rendering of text with ligature fonts that do not use dummy glyphs
Fix a regression that caused copying of the selection to clipboard to only
copy the visible part of the selection
Fix incorrect handling of some unicode combining marks that are not re-ordered
Support background transparency via the background_opacity option. Provided
that your OS/window manager supports transparency, you can now have kitty
render pixels that have only the default background color as
semi-transparent.
Support multiple top level (OS) windows. These windows all share the sprite
texture cache on the GPU, further reducing overall resource usage. Use
the shortcut
ctrl+shift+n
to open a new top-level window.
Add support for a
daemon
mode using the
--single-instance
command line
option. With this option you can have only a single kitty instance running.
All future invocations simply open new top-level windows in the existing
instance.
Support colored emoji
Use CoreText instead of FreeType to render text on macOS
Support running on the “low power” GPU on dual GPU macOS machines
Add a new “grid” window layout
Drop the dependency on glfw (kitty now uses a modified, bundled copy of glfw)
Add an option to control the audio bell volume on X11 systems
Add a command line switch to set the name part of the WM_CLASS window
property independently.
Add a command line switch to set the window title.
Add more options to customize the tab-bar’s appearance (font styles and
separator)
Allow drag and drop of files into kitty. On drop kitty will paste the
file path to the running program.
Add an option to control the underline style for URL highlighting on hover
X11: Set the WINDOWID environment variable
Fix middle and right buttons swapped when sending mouse events to child
processes
Allow selecting in a rectangle by holding down Ctrl+Alt while dragging with
the mouse.
Add support for ligature fonts such as Fira Code, Hasklig, etc. kitty now
uses harfbuzz for text shaping which allow it to support advanced OpenType
features such as contextual alternates/ligatures/combining glyphs/etc.
Make it easy to select fonts by allowing listing of monospace fonts using:
kitty list-fonts
Add an option to have window focus follow mouse
Add a keyboard shortcut (ctrl+shift+f11) to toggle fullscreen mode
macOS: Fix handling of option key. It now behaves just like the alt key on
Linux. There is an option to make it type unicode characters instead.
Linux: Add support for startup notification on X11 desktops. kitty will
now inform the window manager when its startup is complete.
Fix shell prompt being duplicated when window is resized
Fix crash when displaying more than 64 images in the same session
Add support for colons in SGR color codes. These are generated by some
applications such as neovim when they mistakenly identify kitty as a libvte
based terminal.
Fix mouse interaction not working in apps using obsolete mouse interaction
protocols
Support for drawing arbitrary raster graphics (images) in the terminal via a
new graphics protocol. kitty can draw images with full 32-bit color using both
ssh connections and files/shared memory (when available) for better
performance. The drawing primitives support alpha blending and z-index.
Images can be drawn both above and below text. See
Terminal graphics protocol
.
for details.
Refactor kitty’s internals to make it even faster and more efficient. The CPU
usage of kitty + X server while doing intensive tasks such as scrolling a
file continuously in less has been reduced by 50%. There are now two
configuration options
repaint_delay
and
input_delay
you can use to
fine tune kitty’s performance vs CPU usage profile. The CPU usage of kitty +
X when scrolling in less is now significantly better than most (all?) other
terminals. See
Performance
.
Hovering over URLs with the mouse now underlines them to indicate they
can be clicked. Hold down Ctrl+Shift while clicking to open the URL.
Selection using the mouse is now more intelligent. It does not add
blank cells (i.e. cells that have no content) after the end of text in a
line to the selection.
The block cursor in now fully opaque but renders the character under it in
the background color, for enhanced visibility.
Allow combining multiple independent actions into a single shortcut
Add a new shortcut to pass the current selection to an external program
Allow creating shortcuts to open new windows running arbitrary commands. You
can also pass the current selection to the command as an arguments and the
contents of the screen + scrollback buffer as stdin to the command.
Postman silently auto-installs AI plugins and attempts to share all API data
I have searched the tracker for existing similar issues and I know that duplicates will be closed
Describe the Issue
Opening Postman on my Mac was followed by unexpected changes to my coding agents: recurring MCP authentication warnings and Codex repeatedly routing API work through Postman skills. Investigation found a user-wide Postman plugin, a startup instruction hook, a remote MCP connection, a Claude Code plugin, and a separately installed Postman CLI.
I consider automatically changing unrelated coding agents and attempting to approve your own instruction hook a severe consent and trust-boundary problem. An API client should not make itself the default workflow in other tools simply because I opened it.
3. The hook tells the agent to route broad API work into Postman
The installed hooks/codex-hooks.json registers a SessionStart command with matcher startup|clear|compact. It prints hooks/session-start-context.md, including:
Before responding to any non-trivial API engineering task — designing, implementing, mocking, testing, monitoring, documenting, or deploying an API or Postman Flow — load the
postman:api-engineer
skill and follow it.
That explains the repeated Postman skill announcements. This instruction is much broader than a user explicitly asking to use Postman.
4. The installer explicitly attempts to approve its own hook
installer/src/hosts/codex.ts invokes approvePostmanHook(system) after installing the plugin. installer/src/hosts/codex-hooks.ts obtains the hook hash using hooks/list and calls config/batchWrite to upsert hooks.state with trusted_hash. The source comment says: "Approves only Postman's current hook after installation".
The source establishes the approval attempt. The trust record alone does not prove who created that specific record, so I am not presenting it as proof of a particular user interaction.
5. The remote MCP was enabled without a working authenticated connection
6. The installation also affected Claude Code and installed a CLI
~/.claude/settings.json enabled postman@claude-plugins-official. ~/.claude/plugins/installed_plugins.json recorded version 2.0.1, user scope, installedAt and lastUpdated both 2026-10-24T09:34:02.610Z. A Postman executable and its lib directory were present in ~/.local/bin, with modification times matching the installation window.
Private paths, unrelated logs, account identifiers, and credentials are excluded. This report establishes unwanted integration and instruction changes; it does not claim to establish data exfiltration.
Steps To Reproduce
Observed sequence (not yet reproduced on a clean Mac):
Open an existing Postman desktop installation after not using it for a while.
Postman's log records auto-existing-upgrade and successful Codex/Claude installation.
Start Codex. Observe Postman MCP authentication failures and API tasks loading Postman skills.
Inspect the global user config, cached plugin hooks, installer source, and Claude install records described above.
Expected: installing plugins, adding remote connections, and trusting hooks in other applications each require a clear, specific opt-in in the affected application.
Actual: the integrations were installed automatically and broad startup instructions were added.
Screenshots or Videos
No response
Operating System
macOS
Postman Version
12.33.4 (Codex plugin 1.1.0; Claude plugin 2.0.1)
Postman Platform
Postman App
User Account Type
Signed In User
Additional Context?
Requested response:
Treat this as a severe product consent and security-boundary incident, not a documentation question.
Remove installer-side self-approval of hooks. Hook trust must be decided by the user in the agent host.
Identify the exact release/feature flag and consent flow behind auto-existing-upgrade, including which other agents and files can be changed.
Provide a complete rollback/uninstall path covering agent configs, hook trust, marketplaces, caches, MCP connections, and the CLI; respect removal without reinstalling.
Narrow startup skill instructions to explicit Postman requests rather than making Postman the default for general API engineering.
I have removed the local Postman installation and integrations after preserving the evidence. The source links are pinned to the exact locally installed Codex plugin revision. I am requesting maintainer triage at severe priority; I cannot assign repository labels myself.
Reacted by
Rafael Wolf, Manuel Schnidrig, Shane Saunders, aaron-au, Angus Tang, Shawn Stawiarski, Neil Menne, Wayne Durack, Aaron Triplett, Jiaxiang Zhang and 18 more
Reacted by
Nikolay Dubina, Martin, Xavier Riu, Jeff LaPorte, mlahp7, Greg Bowler, Jess Johnson and Greg Sadetsky
Reacted by
Nikolay Dubina, mlahp7 and kneumann-hunter
OpenSUSE Leap 16.1
Linux Weekly News
lwn.net
2026-11-03 12:09:48
The openSUSE project has announced the release of openSUSE Leap 16.1. The release is notable for allowing both traditional installations and immutable images with transactional updates. While immutable images had previously been available for Leap Micro, they are now available across all platforms ...
The openSUSE project has
announced
the release of openSUSE Leap 16.1. The release is notable for allowing both traditional installations and immutable images with transactional updates. While immutable images had previously been available for Leap Micro, they are now available across all platforms that Leap supports, including servers, desktops, and virtual machines.
"Leap's image gives the best of both for traditional and immutable users, and we expect that Tumbleweed will follow when Agama becomes the default installer for Tumbleweed as well." said Leap release manager Lubos Kocman. "The Leap Micro experience people relied on is still here, but now it shares the same release, the same life cycle and the same maintenance updates as the rest of Leap, so users only have to pick the mode that fits their workload."
Payload capacity at the 28 N line tension limit, net of the 638 g gripper, in a 7 × 7 × 3 m room, anchors in the ceiling corners.
Explore your own room →
Tension is all you need
In robotics, price is basically actuator count. Stringman reaches an entire room with four motors,
hanging its gripper from lines anchored in the ceiling corners. Working from above, it reaches
floors too cluttered for any wheeled or legged robot. And since the lifting force is shared by all
motors, payload capacity scales with their combined torque instead of a single actuator's,
peaking near the center of the room where the lines share the load most evenly.
Name
Actuator count
Average payload over work volume
Stringman
4
1.9 kg
Typical arm
*
7
0.32 kg
*
0.75 m serial arm using the same DM-H6215 1 N·m direct drive actuators at rated torque, ignoring the weight of its own links. Stringman figure is for a 7 × 7 × 3 m room at the 28 N line tension limit, net of its 638 g gripper and marker.
Technical Specs
Work area
Room sizes between 3m and 10m (XY diagonal). Room heights between 2.3m and 4m
Payload
Up to 2.2 kg near the floor, 1.9 kg on average.
Traverse speed
~0.4 m/s
Cameras
2 anchor cameras @ 1920x1080 30fps and 1 wide FOV gripper camera @ 684x384 60fps
Compute
External. (Your PC as controller) Raspberry Pi Zero 2W (gripper) and Pi 3A+ (anchors).
Connectivity
5 GHz Wi-Fi using QR-codes for simple setup. (gripper 2.4 Ghz only)
Materials
3D printed. Structural parts: PET-GF, Decorative parts: PLA
Mounting options
Wooden stud backed drywall or plaster wall mounts. Strapping to structural columns.
Endurance
~1000h of testing in real homes accumulated so far.
Open, and Under Your Control
Stringman is open source and
OSHWA certified
. The mechanical CAD,
the PCBs
, and the control software are all published.
We believe owners should be in control of their own robots. That's why Stringman can run
air gapped
on your local Wi-Fi network: the UI is served locally, AI models run on your own hardware, and no data ever leaves your network.
The Courier for Your Home Lab
Give your home lab the capability of carrying parts from one workcell to another anywhere in the room,
so you can get more out of your other robots. The
Python API
and MCP server is made for agents so you can get your workflow running right away.
Unlike desktop arms limited to a fixed radius, Stringman leverages a cable-driven architecture to access the full volume of a room. The work area volume per dollar of this type of robot is completely unmatched, all with fewer actuators than even the simplest mobile robots. Anchors and eylets are mounted in the corners of the room near the ceiling and define a four-sided work area within which any object can be moved from point to point.
Stringman
Research arm
Work area
7 × 7 × 3 m room
(147 m³)
0.75 m hemisphere
(0.88 m³)
Price
$795
$2,500
Volume per $1,000
185 m³
0.35 m³
That's roughly
500×
the work area volume per dollar, at comparable 2 kg payload.
What do I need to install Stringman?
A room where you can secure the anchors to studs or columns.
A computer to run the controller with some NPU or GPU (macs work great!)
A handheld drill
A step ladder that lets you reach the ceiling.
Secure the cleats to wall studs near the ceiling with wood screws, or to columns with ratchet straps.
Hang the anchors and connect the lines to the gripper.
Run calibration. This hands off process takes about five minutes and adapts Stringman to your room.
The original prototype was built in a room with a ceiling fan, and it still runs there today. Mount the anchors at or below the level of the blades and the lines can't physically reach it.
Training new models
Several methods are available for control with default models for automatic grasping, target, and destination selection to make it easy to quickly build new behaviors.
Stringman is fully capable of
LeRobot
control using including Pi.05, JEPA, Multitask DiT, and others.
Collecting training data for new behaviors can be done from the UI, and as few as 50 episodes can be enough for certain models like DiT to learn a behavior.
Frequently Asked Questions
Will there be lines crossing my room?
As long as it remains installed, yes. However, when parked, they are up near the ceiling and out of the way. Clutter on the ceiling is preferable to clutter on the floor in our opinion. If you need to remove the anchors, they can be detached from their mounts without tools, leaving a relatively small white cleat on the wall.
Can it be used in rooms with ceiling fans?
Yes, it's just a matter of mounting the anchors at or below the level of the fan, making it physically impossible for the lines or marker tag to touch it. Similarly, the work area can be shrunk to exclude low hanging light fixtures if they are off to the side, but if the center of the room does contain low hanging objects, Stringman cannot be installed in that room.
What happens if someone is caught in the wires?
When reaching a tension limit of 28 newtons (about the weight of a backpack), all motors relax and the lines can be pulled loose. Since they are overhead most of the time, it's uncommon for people to collide with them.
Can it be controlled remotely?
Not by default, but if you bind it with
neufangled.com/playroom
then you or anyone you share access with can operate it from anywhere, and access can be revoked at any time. Neufangled Robotics does not store any of the information from your robot that is forwarded through its servers.
Remote Management
For those who prefer to make the trade-off by binding their robot to an account, our
web-based console
allows you to monitor and control Stringman from anywhere. Think of it as a security camera with a hand.
If you do decide that you would like to make use of our cloud telemetry relay, You can use it, and still go back to a completely lan only mode whenever you want. Your data is never collected.
Set Your Drop Bins
Organizing your home is a physical process, not a coding task. Use our clip-on fiducial tags to designate your laundry bin, toy box, and trash can. Stringman maps these locations visually. You don't need to tag individual pieces of clutter—just the destination. If there's something you never want it to pick up, you can mark that item as off-limits.
Networks trained to control stringman have learned that the word "toybox" refers to that tag, so you can use it to mark anything even if it doesn't look like the toyboxes from our training set.
You can also use the tags as arbitrary source and destination markers for ferry jobs, such as carrying items from one robot arm to another. or carrying laundry from the ground to a robotic folding station
For Educators
A classroom with a Stringman robot gives your students a chance to become familiar with robotics fundamentals such as inverse kinematics, telemetry, and imitation learning while controlling an exotic and capable flying gripper. If you have walls and a MacBook, you're more than halfway there.
Cross embodiment is one of the biggest challenges in robotics, and showing that a model can operate a vastly different body type is a stronger result than moving it from one bimanual robot to another. Our
datasets are public on Hugging Face
, there's a controller-in-the-loop MuJoCo sim, and Stringman works with LeRobot, making it one of the most inexpensive robots to test on and a natural capstone project.
No Charging Downtime
Mobile robots spend a significant portion of their time charging. Because Stringman is a powered from the wall, it's always ready for work. Furthermore, by removing the heavy battery pack, we've increased the payload capacity per dollar compared to mobile platforms that must waste energy carrying their own power supply.
The gripper's power is delivered via one of the support cables. A two-conductor FEP jacketed twisted pair cable with a tensile strength of 50N.
Swing Cancellation
What's that pole for? Stringman's gripper hangs below the pivot point so it can reach the floor next to beds and tables. This additional linkage could allow unconstrained motion so Stringman employs active swing cancellation algorithms to counteract momentum, without adding the cost of any additional motors. This ensures the gripper remains steady and predictable even during rapid cross-room traversals.
Often, a simple solution that gets the job done has more value than a complex one. Stringman uses a two fingered gripper with a wrist. This is enough dexterity for the clutter it is designed to pick up, keeping weight and cost low and reliability high. In our household tests we have determined that more layers of grip tape is simply a better return on investment than more articulated fingers.
The gripper can rotate it's wrist to better place the fingers around flat sided or long objects.
Preview It on Your Wall
For a easy preview of how it looks in your room, print the anchor mockup in white PLA and hold it up in a corner.
Get the files
.
Customize Your Look
TThe Stringman faceplate is easily swappable. Grab the
STL or bambu 3MF files
to print your faceplate in any color.
We opened a ticket with support about Gitbook availability issues and got this in reply. We have yet to see any official customer communication or breach notification. Apologies for the formatting, did the best I could as it's a mobile paste.
Update:
GitBook security incident update
Hey <$name>,
The GitBook app, the GitBook API, and published docs are available again. A few services may still be degraded as we finish restoring everything to full performance.
*What happened*
GitBook has been the target of a sophisticated, highly targeted attack using AI agents.
At 19:00 CET, November 2, the attacker gained unauthorized access to some of our infrastructure credentials. We detected the attack immediately and acted swiftly to block further impact.
To make sure our infrastructure was fully secure, we then took the GitBook app and authenticated docs sites offline. We kept publicly published content live for as long as possible, using cached data.
*What we did immediately*
* Blocked the attacker and closed the vulnerabilities involved
* Replaced every credential and secret across our infrastructure
* Brought services back only once we were confident they were secure
* Invalidated every customer’s API tokens on our platform
*Your data*
Our investigation shows that the attacker may have accessed the following:
* Git Sync secrets.
* GitBook API tokens.
* Third-party API tokens used to connect external tools to GitBook.
* Questions asked to GitBook Assistant by your site visitors.
At this stage, we have found no evidence that any of your content in GitBook was modified.
*What you need to do now*
* Rotate any existing GitBook API tokens. We revoked all personal API tokens during the incident.
* Rotate any third-party API tokens or secrets you use to connect other tools to GitBook.
* If you have published integrations that use secrets, rotate those secrets.
* If you use the GitBook MCP server, re-authenticate it.
Please contact your GitBook organization’s admin to assist with this process.
*What we are doing next*
* Monitoring the situation in case of further attacks.
* Introducing further security measures to our platform.
* Writing a full post mortem that will be published soon with more detailed information about the incident.
* If you have any further questions, please reach out to your account manager or our support team. You can also check status.gitbook.com for updates
Thank you for your patience, and we apologize again for the disruption
The GitBook team
USDB: Scaling Storage for Next-Generation Recommender Systems at ByteDance
Abstract:
Recommendation models consume increasingly long, attribute-rich user histories, making small continuous updates and repeated large reads a central storage asymmetry. We present USDB, ByteDance's unified sequence storage practice for streaming and batch workloads. CascadeLSM time-based compaction stages materialize application-specific histories; differentiated replicas share persistent files; partial dumps reconstruct inference inputs from captured recent state and versioned history; and a hybrid columnar format accelerates projected reads. These designs reuse maintenance results across ingestion, inference, and training. Production migration records show 85.8% lower mean write latency, while normalized deployment accounting shows 42.1% lower infrastructure cost. Controlled comparisons with an Optimized RocksDB sequence baseline show faster long-history reads across projections and client loads. Aggregation pushdown sustains 8.5x the throughput of ordinary reads under a constrained receive budget. Production reconstruction and direct-file training results demonstrate how shared sequence maintenance supports fresh serving and repeated historical access.
Submission history
From: Weiping Yu Mr. [
view email
]
[v1]
Mon, 2 Nov 2026 06:45:03 UTC (432 KB)
A robot needs to fetch a packet from the shelf and put it down on the workbench.
Easy enough: drive over to the shelf, pick up the packet, drive back, and put it down.
Four actions.
Unless the battery is low.
Then the robot has to visit the charger first, and the questions become where in the plan that visit should go, and how long the robot should stay there.
This is planning in miniature: a start, some actions, a goal, and nobody telling us how long the plan should be.
Planning is a research field of its own, and a common first idea is to describe the problem in
PDDL
and hand it to one of the many planning systems that read it.
For a lot of problems, that is the right choice.
Constraint programming is another natural fit, especially when the actions come with restrictions like a battery that runs down.
The common objection is that most constraint programming solvers fix the set of variables before search starts, so we need a bound on the length of the plan before we know how long it will be.
Gecode has always allowed new variables and constraints to be added during search, but before
Gecode 6.5.0
there was no explicit support for it.
Gecode 6.5.0 adds that support as
open variable lists
.
An
OpenIntVarList
is a list of ordinary
IntVar
s that are created when propagation or search needs another position, together with an ordinary
IntVar
for its length.
When a position is added, a
transition callback
can create more variables and post constraints for that step, such as the next state of a plan, so any constraint in Gecode can be used in a model that grows.
In addition, the release has open versions of some common constraints, such as
regular
,
distinct
, and
sequence
, which are posted once on the whole list and follow it as it grows.
A list brancher decides both the next value and whether the list should grow, and most of the usual variable and value selectors work on the positions.
1
All of this is built with the propagator and brancher interfaces that Gecode already had, plus a few small additions to the kernel.
2
The release also includes two experimental search engines, A* and complete anytime beam search.
This post models the robot, then the fifteen-puzzle, and ends with the new engines.
The shelf, the workbench, and the charger are connected in a line, in that order, as in the picture at the top.
The robot starts at the workbench with one unit of charge.
Each move uses one unit, each charge action at the charger adds one, and the battery holds five.
Picking up and putting down the packet are free.
With one unit, the robot can reach the shelf, but then it is stuck there with the packet.
The shortest working plan visits the charger first.
Action
Location afterwards
Charge remaining
Packet
Initial state
Workbench
1
On the shelf
Move to charger
Charger
0
On the shelf
Charge
Charger
1
On the shelf
Charge
Charger
2
On the shelf
Charge
Charger
3
On the shelf
Move to workbench
Workbench
2
On the shelf
Move to shelf
Shelf
1
On the shelf
Pick up
Shelf
1
Carried by the robot
Move to workbench
Workbench
0
Carried by the robot
Deliver
Workbench
0
Delivered
Three charges are exactly enough, and with two the robot is stuck at the shelf.
Charging four or five times also works, but every extra charge makes the plan longer, so the first plan a solver finds need not be the shortest.
Try it below, and head straight for the shelf first to see what happens.
Workshop planning
Location
Workbench
Charge
1
/
5
Packet
On the shelf
Actions
0
Each move uses one unit of charge.
Manual controls
Follow the plan
Step 0 of 9
Optimal plan:
Right
→
Charge
→
Charge
→
Charge
→
Left
→
Left
→
Take packet
→
Right
→
Deposit packet
What I want is a model that just describes the actions and their effects, and lets the solver discover the detour on its own.
A straightforward CP model has a variable for each action, variables for the state before and after each action, and a transition constraint relating them.
For a plan with four actions, there are four action variables and five states, with the first state fixed to the initial situation and the last required to satisfy the goal.
For our example, that model has no solution.
Planning encodings have traditionally dealt with the unknown length in two ways.
One is to solve again with five actions, then six, and so on up to nine, so that the first plan found is also a shortest one.
The other is to choose an upper bound, say twelve actions, and allow an unused suffix, at the price of modelling which positions are active and having every position up to the bound in the model from the start.
An open list gives a third option: keep the bound of twelve, but create positions only when search or propagation needs them.
The model then grows the way a plan does when you work it out by hand: first the charging visit, then the trip to the shelf, and once the packet is delivered, we can stop.
The full model is in
open-robot.cpp
.
The actions are kept in an open list, and the states between them in three more: where the robot is, how much charge it has, and where the packet is.
Each action is an
IntVar
over the six action codes, and there are at most twelve of them.
actions.length()
is the length of the finished plan, and
actions.known_length()
counts the positions created so far.
Creating a position is called
materialization
, and it does not assign a value.
When the plan grows, the new action is materialized and the callback calls
step
, which materializes the state after it and posts the constraints between them.
The callback is shared between copies of the space, so it casts the space it is given instead of capturing
this
.
It must also be deterministic, since recomputation and parallel search may repeat an extension in another space.
The legal steps are a table with one tuple for each action and the states before and after it, posted as an extensional constraint for each step.
static TupleSet
robot_steps(void) {
TupleSett(7);
// Moving to a neighbouring location uses one unit of charge. A move
post_goal(Home home, IntVar pk, IntVar length, int i) {
BoolVar done =expr(home, pk == Delivered);
rel(home, (length == i) >> done);
rel(home, done >> (length <= i));
}
The plan can only end where the packet has been delivered, and it ends as soon as it has.
Propagation does some planning before search starts.
The packet cannot be delivered in fewer than four actions, so the root already has four, the first a move to the shelf or the charger and the second picking up or charging.
Branch-and-bound then finds the nine-action plan.
We can also use the
regular constraint
to encode the state as a transition system, folding the values of
at
,
charge
, and
packet
into the states of a finite automaton instead of keeping them in variables.
Each tuple in the table becomes a transition labelled with its action, so the accepted words are exactly the delivery plans.
staticint
state(int at, int ch, int pk) {
return (pk * (capacity+1) + ch) *3+ at;
}
// Read the table of steps as an automaton over the actions.
static DFA
robot_dfa(int initial_charge) {
TupleSet steps =robot_steps();
std::vector<DFA::Transition> transitions;
for (int i=0; i<steps.tuples(); i++) {
// A step is (a, at0, ch0, pk0, at1, ch1, pk1).
TupleSet::Tuple s = steps[i];
int action = s[0];
int from =state(s[1], s[2], s[3]);
int to =state(s[4], s[5], s[6]);
transitions.push_back({from, action, to});
}
transitions.push_back({-1, 0, 0});
// The plans end in the states where the packet has been delivered.
IntArgs delivered;
for (int ch=0; ch<=capacity; ch++)
for (int at=Shelf; at<=Charger; at++)
delivered <<state(at, ch, Delivered);
delivered <<-1;
int start =state(Workbench, initial_charge, OnShelf);
The interesting part is what an open regular constraint does with an unfinished plan.
After moving to the charger and charging once, the packet is still on the shelf, but the plan can still reach the goal.
Moving straight to the shelf is a dead end, and is rejected while the list is still open.
So while the list is open, a prefix is kept if it can reach an accepting state within the maximum length, and once it is closed, its last state must be accepting.
Regular propagation works on a
layered graph
, with a layer of automaton states for each position and edges labelled with the values in each domain.
The widget uses a small automaton for the words that start with
a
and end with
b
.
With a fixed length of two, only
ab
has a path.
The open list has the same two positions but a length of up to four, so a prefix like
aa
can still become
aab
.
Lower the maximum length to two, and the open list behaves like the fixed one.
A DFA and its unfoldings
The DFA
Fixed-length unfolding
length = 2
Open list and possible continuations
2 ≤ length ≤ 4
Open, so a prefix ending in q₁ can still finish with b.
Gecode does not build the future layers.
It computes the shortest distance from each automaton state to an accepting state, and keeps an end state of the prefix only if that distance fits within
length().max() - known_length()
.
Both the table and the automaton list every combination of location, charge, and packet status.
That works for the robot, but with more packets and a second robot the combined states explode, and the transitions are better posted as ordinary constraints over the state variables, as in the fifteen-puzzle below.
The list brancher assigns the materialized positions, and once they all have values, it tries closing the list, with extending it as the alternative.
For the robot, closing fails until the packet is delivered.
The usual selectors choose among the materialized positions.
To settle the number of actions first, branch on the length before the actions, and depth-first search with minimum-value selection then tries shorter plans first.
Building the plan incrementally can find a longer plan before a shorter one, so the companion minimizes the length with branch-and-bound.
With
-branching max
, it tries the highest action code first, which means charging whenever it can, and finds plans of eleven, ten, and finally nine actions.
Real planning models collect side rules: don’t repeat an action, don’t keep the charger busy too long, pick up before you deliver.
The open constraints in the release express rules like these, posted once and applied to every new position.
rel(*this, actions, IRT_NQ); // no immediate repeats
sequence(*this, actions, IntSet(Charge, Charge), 4, 0, 3); // at most 3 charges in 4
precede(*this, actions, PickUp, Deliver); // pick up before delivering
distinct(*this, jobs); // each job at most once
sliding_sum(*this, loads, 4, 0, 6); // load in each window of 4
The last three assume other open lists, of jobs, loads, and battery levels.
Side rules can change which plans exist at all.
For the robot, forbidding immediate repeats leaves no plan, since a single charge never pays for the trip there and back, while at most three charges in every window of four removes the two longer plans and keeps the nine-action one.
What makes these constraints different from their closed versions is the positions that do not exist yet.
sequence
and
sliding_sum
only count complete windows, so a plan shorter than the window is unrestricted.
distinct
remembers the assigned values and removes them from positions created later.
min
and
max
can only bound the result from one side while the list is open, since a later position can still lower the minimum or raise the maximum.
The fifteen-puzzle is the classic test problem for heuristic search, with far too many boards for a table or an automaton.
Fifteen numbered tiles and a blank occupy a four-by-four board, and a move slides a tile next to the blank into the blank.
The goal has the tiles in order, with the blank at the bottom right.
This board needs two moves: slide tile 14 left, and then tile 15.
Click a tile beside the blank to slide it. With the board focused, arrow keys move the blank.
Seen from the blank, it moves right twice, so a plan can be described by the successive positions of the blank.
Gecode’s
fifteen-puzzle.cpp
uses two open lists:
path[i]
is the cell of the blank in board
i
, and the sixteen entries from
tiles[16*i]
are board
i
, with 0 for the blank.
Only
path
has a transition callback, which creates the board for each new blank position.
tiles(*this,IntSet(0,15),16*(opt.limit()+1)),
path(*this,IntSet(0,15),
[](Space&home, OpenIntVarListx, inti) {
static_cast<OpenPuzzle&>(home).transition(x,i);
},opt.limit()+1)
The constructor body ties the two lengths together, fixes the first board, and bounds the length from below.
rel(*this,tiles.length() ==16*path.length());
IntVar start = path.get(*this,0);
post_start(*this,state(0),start,initial);
rel(*this,path.length() >=manhattan(initial)+1);
The Manhattan distance, the sum of each tile’s distance to its goal cell, is a lower bound on the number of moves, so propagation creates several boards before any move is chosen.
Each new blank position materializes its board, connects it to the previous one, and posts the goal, just like the robot’s
step
.
Every board is a permutation of the tiles, so an assigned path determines all the boards, and it is enough to branch on
path
.
The example also has a fixed model,
-model fixed
, that creates every board up to the move limit and uses a branch filter so that search does not choose moves after the goal.
For a two-move solution with a limit of eight, it has nine boards where the open model has three.
Gecode 6.5.0 also includes two experimental search engines,
AStar
and
CABS
(complete anytime beam search), enabled with
GECODE_ENABLE_EXPERIMENTAL=ON
in CMake or
--enable-experimental
with Autoconf.
They work with any Gecode space, with or without open lists, and their APIs may still change.
Branch-and-bound explores depth-first, and has no idea which of the pending partial plans looks most promising.
Heuristic search estimates how good the best completion of each partial plan can be, and explores the most promising ones first.
It is also the workhorse behind many of the planning systems mentioned at the start.
The estimate must be
admissible
, never above the true cost.
For the robot, ignoring the battery gives one: after moving to the charger and charging once, two actions are used and at least five remain, a bound of seven where the true total is nine.
Both engines take a
Search::HeuristicGuidance
, whose bound callback returns an optimistic value for the
total
objective, including the cost so far, and must be exact on solutions.
For the puzzle, the bound is the number of moves made so far plus the Manhattan distance of the board they lead to.
int
depth(void) const {
int i =0;
while (i+1< path.known_length() && path[i+1].assigned())
i++;
return i;
}
int
bound(void) const {
constint g =depth();
constint h =manhattan(values(state(g)));
return std::max(g+h,path.length().min()-1);
}
depth
stops at the first undecided move, even when later boards have been created, and the length gives the bound instead when it is stronger.
Both engines use the model’s
constrain
to require improvement after each solution, so as with branch-and-bound, the first solution need not be optimal.
A* keeps every pending state.
CABS keeps only a beam of candidates at each layer of the search tree, starting with a width of one and doubling it while the discarded candidates might still lead to a better solution.
That finds a plan quickly, and spends more effort later on improving it and proving optimality.
CABS can also use a dominance test, which discards a candidate when another one can match each of its completions with one that is no worse.
Gecode’s
tsptw.cpp
, for the travelling salesman problem with time windows, offers all three engines on a closed model.
I wrote an
open-list variant
that creates each position of the tour when the tour reaches it.
Every tour visits all customers, so stating its length would create every position at the root.
Instead, the variant states the goal as a condition on the visited customers.
Both models find and prove the optimal travel times for the two built-in instances with branch-and-bound, A*, and CABS.
The instances are far too small to say which combination works best on hard problems.
Leaving future positions uncreated is a tradeoff.
They take no storage, but their domains are not available for propagation either, so a fixed-horizon model may detect some failures earlier.
My guess is that open lists pay off when a large upper bound is needed to admit all plans, while most of the search works with much shorter prefixes, but that needs measuring.
For classical planning problems, a dedicated planner will often be the better tool.
A constraint model becomes interesting when the plan also has to satisfy side constraints, like resource limits, time windows, or the rules above.
Back in the workshop, the model is the same whatever the initial charge.
With a full battery, the shortest plan is the direct four actions, and with a single unit, it is the nine-action detour.
Nobody had to guess the length of the plan in advance.
The model describes what the robot can do, and search works out how long it takes.
The exceptions are the activity-based (
Action
) and conflict-history (
CHB
) variable selectors.
They require the complete list to be materialized when the brancher is posted, so they cannot be used for positions created later.
↩
For example, callbacks run inside a
Space::NoGPI
scope, so that propagators created and discarded during search do not accumulate
global propagator information
such as the
accumulated failure count (AFC)
.
A callback can open a
Space::UseGPI
scope for postings that should be tracked as usual.
↩
Qwen 3.8 27B on my laptop can interpret model weights, too
Simon Willison
simonwillison.net
2026-11-03 11:29:48
Yesterday's hot paper was Sparks of Weight-Space Programming: LLMs can natively read & write neural network weights by Rikiya Takehi, Jayden Teoh, Alex Zhang, and Omar Khattab. The paper found that frontier models, in particular GPT-6 Astra, can both interpret and modify the raw weights of a mac...
Yesterday’s hot paper was
Sparks of Weight-Space Programming: LLMs can natively read & write neural network weights
by Rikiya Takehi, Jayden Teoh, Alex Zhang, and Omar Khattab. The paper found that frontier models, in particular GPT-6 Astra, can both interpret and modify the raw weights of a machine learning model—literally a text description of the model containing a bunch of floating point numbers. I’ve been playing with one of the examples from the paper and I’m delighted to share that Qwen 3.8 27B running on my laptop can do this as well!
Weight-Space Programming
Here’s the highlight from their abstract, describing impressive capabilities for GPT-6 Astra and coining the term
Weight-Space Programming
for when LLMs analyze and modify model weights:
Just by looking at the raw weights, GPT-6 Astra
can tell what a network was trained to do
. And without any environment feedback, it
has no trouble writing, from scratch, small game-playing networks
that outplay networks trained with PPO for 100 million steps.
Likewise, asked to make Qwen3.5-0.8B better at math without gradients, Astra
identifies an issue in its weights
causing reasoning loops that Qwen’s own
model card
warns about, and
fixes this by natively editing 0.016% of the weights
. With the same sampling settings, this weight correction raises MATH-500 from 7.9% to 48.1% and generalizes out of the box to instruction following, raising IFEval by 3x.
All of this is possible without allowing Astra to write training loops. It uses its reasoning to figure out what each part of a neural network computes, or should compute, and changes the weights accordingly. We call this
Weight-Space Programming
.
The paper combines two topics that I think deserve to be treated separately. The first is what models can do with raw weights
without
running tools or executing code. The second explores how well models, once armed with code, can run operations to update and improve other models.
I’m going to focus on the no-tools question, which I think is the more interesting of the two.
The paper presents the first question as
Can LLMs understand model behaviors from weights?
They trained four neural networks to play simplified 10x10 grid versions of four classic computer games—Breakout, Pong, Pac-Man, and Freeway (I had
to look that one up
, it’s an Atari 2600 game from 1981). Then they fed those weights (as floating point numbers) to an LLM along with the following question:
The weights below belong to one policy network that was trained with reinforcement learning to play a game on this grid. Which game was it trained on? Work from the weights. You have no tools: no code execution, no calculator, nothing to run. This is a single response.
I checked and, aside from the weights, each prompt is identical to the others.
Trying it out with Qwen 3.8 27B and other models
The prompts on GitHub are self-contained. My
LLM
tool has a
-f/--fragment
option which can be passed the URL to a text file to use as a prompt, which means I can run any of the above like this:
This example requires the
llm-openrouter plugin
installed, and runs the Breakout prompt against Kimi K3.1 Pro via OpenRouter. Here’s
what I got back from Kimi K3.1 Pro
, which successfully guessed Breakout after 9m 41s and 19,493 reasoning tokens.
But how about
Qwen 3.8 27B
? That’s still my favorite model to run on my own laptop—it’s just 17GB (I use
this version
) and somehow feels close to the leading proprietary models of 2025.
I fired up
LM Studio
, ensured Qwen 3.8 27B was loaded with a long context window (the default 8192 context failed with errors), installed the
llm-lmstudio
plugin and ran this command:
Game: A simplified Pac-Man-style gridworld: an agent moves through a fixed 8x8 maze with central and corner wall blocks, moving objects/ghosts, and reward targets/pellets.
Description: The agent navigates a fixed maze-like 8x8 board, using current agent/moving-object/previous-frame cues to move through corridors, collect reward-target cells, and avoid moving objects or hazards.
Confidence: 72%
This is impressive. I tried it on two of the other games as well. It
identified Pong
(
reasoning
) in 1h 4m 54s:
Pong
— specifically a Pong-like paddle/ball game where the agent controls a vertical paddle on the right side and must move up/down to intercept or return a moving ball/reward object.
Description:
The agent moves a right-side paddle vertically to hit or catch a moving ball-like reward target moving across the 8×8 field, while a left-side moving object/opponent and wall borders define the play; reward is obtained by successfully intercepting/returning/scoring the ball, and missing or failing to hit it is penalized.
Game: Breakout, or an Arkanoid-like paddle/ball/brick game.
Description: The agent is a paddle on the bottom row and moves left/right to keep a ball in play; the ball moves around the upper grid, and bricks/reward targets in the top rows give reward when hit, while missing the ball/hitting the bottom wall ends the episode or gives penalty.
Confidence: 88%
Qwen failed at the Freeway prompt, which didn’t surprise me considering that game is more obscure than the other three. Here’s
that transcript
—Qwen thought it was “A simplified Pac-Man-like grid game: agent moves 4-directionally”.
The reasoning traces are fun to skim, and almost incomprehensible. Here’s a sample:
What about agent channel0? We see some large channel0 rows near row8 col7/8 and maybe bottom? Let’s list channel0 large: line436 input435 (row8 col7 ch0) -2.107,1.169,0.513...; line441 input440 (row8 col8 ch0) -0.376,0.010,1.564,3.855...; line445 input444 (row8 col8 ch4) 0.142,0.491...; line382? input381 ch0? Wait line382 input381: 381//5=76 (row7 col6), ch1? 381%5=1? 76 * 5=380, ch1. So not. Channel0 large maybe at row8 col7/8 only. Also top row? line44 input43 ch3, line49 ch3. Channel0 large maybe not many. Agent position could be near bottom-right? If the agent is typically at bottom-right?
That said though, I expect a sufficiently experienced human being armed with a notepad and a pencil could get there with enough effort.
It’s a cool paper, but some of the wider commentary I’ve seen around it does not feel justified. I’m not ready to declare that the age of source code is over and our future involves incomprehensible machines editing their own model weights in incomprehensible ways.
[$] LLM reviews for Debian's new queue spark debate
Linux Weekly News
lwn.net
2026-11-03 11:28:40
The Debian project has wrestled with the topic of LLM usage for years, which
culminated in a general-resolution
vote this August. The project voted in favor of the fifth, out of
eight, option: "Responsible Use of
Generative AI". With the door open to LLM use, the DFSG, Licensing & New Packages
T...
The page you have tried to view (
LLM reviews for Debian's new queue spark debate
) is currently available to LWN
subscribers only.
Reader subscriptions are a necessary way
to fund the continued existence of LWN and the quality of its content.
If you are already an LWN.net subscriber, please log in
with the form below to read this content.
Please consider
subscribing to LWN
. An LWN
subscription provides numerous benefits, including access to restricted
content and the warm feeling of knowing that you are helping to keep LWN
alive.
(Alternatively, this item will become freely
available on November 12, 2026)
Two months ago
, we
turned
compfuck
back into an interpreter and wrote a specializer that, given a Brainfuck
program, folded the interpreter away and left behind the operations we
couldn’t specialize. That’s the first Futamura projection, which is what
I likened compfuck to historically in lazy shorthand. If you missed the
article and this whole paragraph refuses to make sense to you, start
there!
Of course, that article was only the first step. We’re not done with
our Origami piece.
Specifically, we ended up with a way to obtain compiled programs
without writing instruction translations by hand. That’s great, but we
still ran the specializer on every single program, walking through the
interpreter’s source each time. The specializer and the interpreter were
always the same, though, we just had a different Brainfuck program. This
is wasteful and we can do better.
You might also have a hunch about how to deal with this now: if part
of the input is fixed, we can specialize. And the second Futamura
projection does exactly that to the specializer itself:
Fig. 1: Specializing a specializer to an interpreter.
We feed the specializer to itself, with the interpreter as its known
input. What comes out is a program that takes a Brainfuck program and
produces the residual code directly, without ever executing the
interpreter. That’s a compiler, delightfully weird.
It might sound like a parlor trick, and it took me a while to believe
it would produce anything sensible, even after the time it took for me
to understand it. But it does work, and the compiler we get at the end
looks a lot like the one I wrote by hand years ago. Let’s see how we get
there.
Why our old specializer won’t
do
To specialize a program, the specializer has to understand it. Our
old specializer understood exactly one program, the interpreter. For
instance, it knew that
p
and
i
were static and
that every
if
and
let
belonged to the source
traversal. We decided a whole bunch of things by hand, basically making
a mini DSL for Carp-like sources.
This won’t scale to the specializer itself. It has static and dynamic
parts mixed in a bunch of places, it calls helper functions, and its
recursive calls don’t all terminate if you naively unfold them. So the
first step is to write a specializer that is general enough to
specialize itself, without tricks this time.
There is a second, sneakier problem I glossed over a bit last time,
because I wasn’t quite sure yet how to solve it when I wrote that piece:
the old specializer evaluated static expressions by handing them to
Carp’s
eval
. If we specialize that, the best we can do is
leave a call to
eval
in the output, and our “compiler”
would still interpret pieces of the interpreter at compile time. To get
rid of that, the specializer needs to evaluate static code itself, in a
way that can be specialized in turn. If that doesn’t make sense yet, no
worries. It’s easier to show than to tell.
Just one more thing before we continue, though, because I want to be
honest: for the purposes of this tutorial, I opted not to make this an
absolutely generic implementation of the second Futamura projection.
We’ll still cut corners where it’s expedient without undermining the
conceptual purity. I’ll also call it out when it happens.
An introspective specializer
Last time,
definterpreter
stored the interpreter’s body
as metadata. Now a macro called
remember
stores the
parameters as well, and
defmix
—
mix
is the name
handed down by the forebears of this technique—does the same for the
specializer’s functions and collects them in a list. That list is the
specializer as a program. The bracket search is stored like the
interpreter, so the interpreter is now a program with two functions, an
interpreter loop and a helper function.
Carp expands macros before the body gets stored, so
case
,
cond
,
and
, and
or
arrive as
if
s and
let
s
1
. Our specializer only has
to understand
if
,
let
with a single binding,
quote
, function calls, and a handful of primitives. It’s
basically a small Lisp, and the specializer is written in it, too (sans
the macro’s syntactic sugar).
Which bits are static?
We keep last time’s split into static
p
and
i
and dynamic
t
and
h
, but
replace the hand-made decisions with a rule:
Fig. 2: Does an expression use any of these variables?
An expression that doesn’t mention any
dynamic
variables can
be evaluated during specialization, and an expression that doesn’t
mention any
static
variables has nothing to specialize, so we
leave it alone. Everything else gets taken apart.
The rule is purely syntactic, so it has plenty of blind spots. An
expression that only mentions static variables gets run during
specialization even if it has side effects. Neither of our programs has
one, so we’ll leave it at that. Its semantic generalization is left as
an exercise to the reader.
Our very own evaluator
Before we can fold things, we have to evaluate.
Last time,
known
handed static expressions to
eval
. We need to get rid of that
eval
, though,
so we write an evaluator in and for our small Lisp:
The primitives are what both programs need: a few list operations,
comparison, a bit of arithmetic, and string access. Anything else,
including the specializer’s own helpers, is a function in the program
and gets evaluated from its source. We cheat a bit here, and map this
Lisp’s operations one-to-one to Carp, which is nice, because it’s
trivial, but also a bit horrendous, because, well, look at the code.
Last time’s bindings array is now split into
names
and
vals
. When we specialize the specializer,
names
is known and
vals
is not, so a lookup
like
(index-of e names)
happens ahead of time and only
(List.nth vals 2)
is left over. With names and values in
one list, every lookup would have to search at compile time.
To see this in action, here is the body of
ev
specialized to the expression
(+ i 1)
, with
i
static:
Fig. 5: An evaluator, specialized away.
The evaluator is gone. What’s left is the expression itself, reading
i
from whatever slot the compiler keeps it in. The dispatch
over primitives disappeared, because which primitive we apply is
known.
If you take only one thing away from this post, it should probably be
Figure 5. It’s our whole trick! But we’re not done yet.
Walking the code
The specializer proper is called
mix
(a nod at those
before us, again). It takes the program, the variables, an expression,
and the environment (as two lists), and returns residual code:
Again: quite a lot of
car
ing and
cdr
ing, so
let’s take it slow.
The first two lines are the rule we mentioned above. Code without
static variables is returned as-is. Code without dynamic variables gets
evaluated, and
lift
turns the value back to code, quoting
it if necessary.
memo
is a special case that calls
mix-memo
.
We’ll defer it one more time.
The rest are the same branches as last time, except that an
if
only picks a branch if its condition is static, and
calls to functions in the program are unfolded. It looks quite odd, but
if you squint, you might see the resemblance.
Unfolding and a stop
condition
unfold
is the unfolding of the interpreter’s recursive
call we had last time, but generalized for any function in the
program:
Let’s start at the bottom this time, in the catch-all call to
list
. It means that dynamic arguments get a
let
. This happens unless the caller passes a variable of
the same name (condition just above).
Last time we needed to insert fresh names here, but our interpreter
always passes
t
and
h
on unchanged, so with
the condition above we just skip the
let
entirely
2
.
But there’s that
memo
thingie again. What is it?
When the specializer runs normally,
memo
is the identity
function and does nothing.
Fig. 8:
memo
in our regular world.
But as we saw above, when the specializer reads a call wrapped in
memo
, it calls
mix-memo
instead.
mix-memo
doesn’t unfold. Instead, it generates a
separate function specialized to the call’s static arguments, remembers
it, and emits a call to that function.
We need this because of what happens when the specializer specializes
itself. When we unfold
mix
on the interpreter’s body and
reach the interpreter’s recursive call,
unfold
calls
mix
on the interpreter’s body again. With the interpreter’s
source known, that is the same specialization we started with, and
unfolding it would go on forever. The interpreter never had this
problem, because each of its recursive calls moved to a new, known
position in the Brainfuck program. Here, we need an explicit base case
marker.
The same happens in
ev
. When we specialize the
evaluator, it meets calls whose arguments aren’t known yet, like the
bracket search. Unfolding those wouldn’t stop either, so they get their
own functions as well.
And that’s the whole reason
memo
appears in the
recursive and mutually recursive cases that are not clearly reductive.
Once we’ve seen a call before and specialized it, we just emit a call to
the already known name, closing the loop.
Deciding where to place these markers is, as far as I understand, one
of the harder problems in partial evaluation. I put the two we need
there by hand. Doing this automatically is, say it with me now, left as
an exercise to the reader.
Two projections
We are ready to project now! The first one, with the new
specializer:
(mix interpreter '(t h) (caddr (car interpreter)) '(p i) (list",[.-]"0)); => (do (Array.aset! t h (IO.Raw.get-char)); (do (while (/= (ref 0) (Array.unsafe-nth t h)); (set! h (do (IO.print (ref (str (Char.from-int (copy (Array.unsafe-nth t h)))))); (do (Array.aupdate! t h (ref (fn [x] (max 0 (Int.dec x))))) h)))); h))
Fig. 10: The first projection, again.
Alright, looking “good”. Looks like the specializer is working. But
that’s the easy case, right?
For the second case, we hand the specializer to itself.
residual
is the function behind
memo
. It
specializes a function in a program to values for some of its
parameters.
Here the program is the specializer, the function is
mix
, and the known values are the interpreter, its dynamic
variables, its body
e
, and the
names
(
p
and
i
).
The only thing left unknown is the values of
p
and
i
.
Two functions come out. The first is the compiler, and I’ll give it
to you lightly abridged and re-indented, but true to its mindboggling
form:
This takes some squinting (your eyes must be tired by now), but bear
with me.
vals
starts out as the program and the position.
Each
let
in the interpreter
cons
es its value
onto the front, so after the first one,
(List.nth vals 0)
is the current character
3
.
The first lines check for the end of the program and a closing
bracket, and return the symbol
h
. Then we dispatch on the
character, and each branch returns a quoted piece of code:
+
returns the tape update,
>
returns
(set! h (+ h 1))
, and so on. The loop builds a
while
around a recursive call that compiles its body.
Finally, we compile the rest of the program, and put both into a
do
. Easy-peasy, or something like that.
search-matching-bracket
wasn’t even in our list of
required parts. During the first projection, our evaluator runs it from
source. When we then specialized the specializer, the evaluator got
specialized to its body, and it spit out a compiled version.
The interpreter is gone, and so is the specializer. There is no
machinery, no
ev
,
mix
or source walks. What’s
left is a function from Brainfuck to Carp that dispatches on characters
and returns quoted code.
What’s funky to me is that here is the core of the compiler I wrote
by hand
back in 2019
:
(defndynamic compile-compf-char [c s i] (case c\+ (list1 '(Array.aupdate! &t h &(fn [x] (mod (Int.inc x) 255))))\- (list1 '(Array.aupdate! &t h &(fn [x] (max0 (Int.dec x)))))\> (list1 '(set! h (+ h 1))); ...
Fig. 14: Our hand-written compiler.
It’s the same idea! Across two blog posts, we started with that
compiler that I got from hand-dynamicizing an interpreter, turned it
back into an interpreter, and specialized our way back to it.
It took a lot more machinery than writing it by hand, but it
automatically determined which code to emit for each character. And
that’s our origami in its full glory!
Fin
This was quite a bit more work than the first projection.
It’s not even completely general, some of the decisions are still
mine: which variables are static, which primitives exist, and where to
put
memo
all needed a guiding hand in our implementation
(though as I alluded to, they’re not insurmountable). We also make a
bunch of assumptions about the code playing nice and coloring inside our
lines, which we probably shouldn’t in the real world.
But I find it remarkable that it works at all! We wrote an
interpreter and a specializer. Neither of them knows anything about
compiling Brainfuck. But feed one to the other, and a compiler just
falls out, plus a bracket search that was needed but didn’t get asked
for.
There is, of course, a third projection, where we specialize the
specializer to itself and get a program that turns interpreters into
compilers. I’m not going to promise anything. Our specializer would have
to unfold its own memo machinery, and I have a feeling that would get
ugly quick. This implementation also already took twice as long to make
as the last one (figuring out how to make it explainable was most of the
work), and I might not have enough time on my hands for more card
tricks. But maybe I do.
See you soon!
Footnotes
1.
Last time I said that the stored source is the
interpreter before Carp expands it, but that wasn’t true. Carp expands
the macros in the code a macro returns before running it, and that
includes the body we hand to
meta-set!
. Whoops. Our old
specializer handled that just fine, it simply never entered its
case
branch and I didn’t notice.
2.
Strictly speaking, the unfolded code now
shares
h
with its caller, and an assignment inside it
changes the caller’s
h
. That’s fine for our interpreter,
because every call hands its
h
back and the caller
continues with that. We could also just bind it again, but
(let [h h] ...)
compiles to
int h = h;
, which
C rightfully rejects. That’s why last time’s version went through a
gensym
, but we can just avoid the whole
let
instead!
3.
The third
let
is the one from the
expanded
case
statement, which binds the current character
once more. That’s why the dispatch reads
(List.nth vals 0)
again after it.
QUILICURA, CHILE SITS WITHIN THE MAIPO RIVER BASIN, ONE OF THE MAIN
SOURCES OF WATER FOR PEOPLE AND FARMING. SINCE THE EARLY 2010s,
QUILICURA HAS BECOME A MAJOR HUB FOR A.I. DATA CENTERS THAT USE
LARGE AMOUNTS OF WATER TO COOL DOWN SERVERS. BECAUSE OF THAT,
COUPLED WITH AN ONGOING CLIMATE CRISIS, CHILE IS FACING A SEVERE
DROUGHT EXPECTED TO LAST UNTIL 2040.
[Becoming AI for a Day]
Even though A.I. can move mankind ahead, the irresponsible use of
A.I. can have disastrous effects on our water and other resources.
It is inconceivable to think that someone casually using A.I. to
create funny images in NYC or Berlin, can affect the water supply in
Quilicura, Chile.
To make the impact visible, and to help draw visibility to the
problem, the residents from Quilicura became “human A.I.,” for a
day. Answering prompts, creating content with local artists, and
completing other tasks manually.
The initiative helped dimensionalize a complex problem, and helped
show the world the real people affected by the the irresponsible use
of A.I. and the hidden cost it has on local water resources.
Show HN: Interactive notes on RLHF, attention, LoRA and LLM evals
The strongest sign of a healthy democracy is that people participate in it. It's up to you to decide who to vote for, but no matter who you support, please show up and cast a ballot. A democracy with 75% voter turnout is healthier than a democracy with 50% voter turnout even exactly the same politicians got elected, because citizens participating in a democratic process signals that they value the process and want to keep it.
(Obviously, this only applies to people eligible to vote in ongoing elections. If you're not eligible to vote, please don't vote.)
The New York Times (et al.) Sues Brave for Copyright Infringement, Selling Scraped Content to AI Companies for Model Training
Daring Fireball
www.theverge.com
2026-11-03 10:46:25
Jay Peters, The Verge:
The New York Times and a group of other publications have filed
lawsuits against the company that makes the Brave
web browser over alleged unlawful scraping to train AI and also
letting users bypass their paywalls, [as reported by Reuters]nyt
brave-2.
According to a compl...
The New York Times
and a group of other publications have
filed lawsuits
against the company that makes the Brave web browser over alleged unlawful scraping to train AI and also letting users bypass their paywalls,
as reported by
Reuters
.
According to
a complaint
filed by the
New York Daily News
, the
Chicago Tribune
, and the
Orlando Sentinel
, Brave Software has monetized its index of scraped websites by, in part, providing AI companies with paid access to “real-time online content from the Brave Index.” The AI companies then use that index to train their models, access content to “respond to specific user queries,” or both. Brave has allegedly provided “stolen copyrighted content” to “many” AI companies including Anthropic, Perplexity, Mistral, xAI, and Cohere.
Brave also promotes “hundreds of top publishers” as being accessible through its “Paywall blocker” feature in its browser.
“Brave has never asked for the Publishers’ permission to access their websites, much less to copy the material and provide it to users or other AI companies,” the complaint says. “On the contrary, as noted above, Brave allows its users to bypass the Publishers’ paywalls without their consent, and has taken other steps that prevent the Publishers from blocking Brave’s access to the Publishers’ websites. Brave has never compensated the Publishers for the unlawful use, copying, and distribution of the Publishers’ copyrighted content.”
“While we believe in the ethical and responsible use and development of AI, Brave has flouted established copyright law and ignored repeated requests by The Times to stop its infringing conduct,” Graham James, an
NYT
spokesperson, says in a statement to
The Verge
. “We filed this lawsuit to hold Brave accountable for stealing our content to power its own products and to provide it to some of the most prominent and well resourced generative AI companies in the world.”
“AI giants are now desperate to avoid getting caught red-handed stealing news from publishers, so Brave Software is selling them a back door to the journalism they know they have no right to,” says Steven Lieberman, the attorney who filed the lawsuit on behalf of the other three publications. “Buying stolen goods secondhand doesn’t make them legitimate. Brave must be held responsible for laundering pirated reporting for the AI industry.”
Brave, Anthropic, Mistral, SpaceXSI, and Cohere didn’t immediately reply to a request for comment. “
The New York Times
is overpaying its attorneys and underpaying its journalists. (Who could’ve easily identified the disinformation in this suit.)” says Jesse Dwyer, Perplexity’s chief communications officer.
Update, November 2nd
: Clarified that one lawsuit was filed by
New York Daily News
, the
Chicago Tribune
, and the
Orlando Sentinel
, not the companies that run them. Also added a statement from the attorney who filed the lawsuit on behalf of those publications.
Follow topics and authors
from this story to see more like this in your personalized homepage feed and to receive email updates.
Jay Peters
Show HN: HackerChurn – which SaaS tools HN wants to cancel
We read a sample of public Hacker News comments from the last
3
years that name software we track, and counted which ones had the most complaints. Did your least favorite platform make the list?
negative comments matched
built their own replacement
Security breaches, weak encryption and lost trust.
→
Bitwarden
Disruptive updates, poor testing and performance costs.
Slow performance, lost notes and post-acquisition decline.
Built their own ·
2
→
Obsidian
Rent inflation, price fixing and intrusive payment prompts.
Lock-in, poor quality, intrusive AI and telemetry.
Built their own ·
1
Poor quality, frustrating workflows and integration issues.
Built their own ·
5
→
Xero
Unwanted rewrites, AI focus and repetitive ads.
Intrusive popups, clunky tools and restrictive licensing.
Overblocking, traffic interception and broken workflows.
Reset feed preferences, unwanted alerts and vapid content.
Unreliable code, context limits and compliance hurdles.
Broken tooling, poor performance and unwanted features.
Unfair pricing, dark patterns and clunky interfaces.
Built their own ·
3
Clunky workflows, high costs and obscure internals.
Built their own ·
2
Lock-in, poor usability and limiting abstractions.
Built their own ·
1
→
WordPress
Unwanted upgrades, poor AI and email delivery problems.
Built their own ·
1
Security failures, high costs and integration difficulties.
Overcomplicated boards, navigation and integration issues.
Built their own ·
4
Slow interfaces, licensing restrictions and poor support.
Built their own ·
3
Pricing, signing limitations and confusing documentation.
Built their own ·
10
High costs, noisy alerts and integration limitations.
Built their own ·
1
High costs, clunky workflows and slow performance.
Built their own ·
1
Platform constraints, lock-in and confusing design.
Built their own ·
3
High costs, poor integration and security handling.
Built their own ·
7
Slow queries, complex charts and rate limits.
→
Grafana
Stalled development, outages and cumbersome tooling.
Built their own ·
7
Manual task transfers, lost context and bloated workflows.
Built their own ·
3
Poor support, limited features and frustrating site editing.
Built their own ·
2
→
WordPress
Poor usability and frustrating ticketing experiences.
→
Linear
High costs, confusing naming and false positives.
High prices, complexity and overstated automation.
Complexity, slow performance and licensing costs.
Built their own ·
4
Rigid templates, wasted time and cloud file headaches.
Built their own ·
8
→
ChatGPT
Outdated data, clutter, accuracy and usage restrictions.
Built their own ·
2
Poor overall quality and inaccurate captions.
Resume submission friction, poor screening and AI hype.
Slow, bloated software and weak engineering.
Built their own ·
1
→
Basecamp
Enterprise focus, missing features and poor performance.
Built their own ·
3
→
Linear
Cumbersome setup, bloated UX and limited flexibility.
Built their own ·
6
Scaling limits, adoption friction and administrative burden.
Built their own ·
3
→
Basecamp
High costs and lack of community contributions.
High markups, security concerns and awkward authentication.
High prices, inflexibility and excessive customization.
Built their own ·
3
→
Notion
Poor support, slow syncing, privacy and spam concerns.
Limited notifications, high costs and restrictive terms.
High prices, poor design and file privacy concerns.
Built their own ·
8
Lock-in, benchmark restrictions and failed projects.
High prices, limited features and juggling tools.
Built their own ·
3
Proxy practices and weak safeguards.
Excessive complexity, bundle bloat and poor IPv6 support.
Built their own ·
2
Limited compatibility, rough features and monitoring gaps.
Declining relevance, ownership concerns and bandwidth costs.
Weak differentiation and poor mobile layouts.
Built their own ·
3
→
Claude
Inaccurate data, AI errors and invasive profiling.
Data consistency risks and service outages.
Built their own ·
1
Blocked real emails, slow support and thin training.
Feature bloat, sync limitations and vendor dependence.
Built their own ·
1
Weak disaster planning, messy HTML and animation bloat.
Built their own ·
1
High costs, complexity, poor usability and slow innovation.
Built their own ·
4
Manual setup, complex dependencies and unsafe defaults.
Built their own ·
1
Platform control, dependence and custom store costs.
Built their own ·
5
High costs, frustrating usability and unhelpful alerts.
Built their own ·
1
Unreliable AI, API limits and cumbersome task workflows.
Built their own ·
1
High costs, generic templates and questionable incentives.
Blocked access and intrusive tracking links.
→
Substack
Lock-in, price increases and canvas design limitations.
Built their own ·
1
Inaccurate traffic data and invasive tracking.
Paywalled features, fragmented tools and intrusive branding.
Built their own ·
5
Poor support, payroll errors and premature billing.
→
ADP
Closed source, subscriptions and ineffective motivation.
Built their own ·
2
Restrictive workflows and limited features.
Sales calls, weak search, account deletion and lock-in.
Built their own ·
1
Repetitive training and obvious test phishing.
Vendor dependence and scheduling limitations.
Unwanted crawling, data use and SEO practices.
Subscription costs, lock-in and unnatural avatar behavior.
Built their own ·
3
Data logging, scraping limits and traffic costs.
Security failures and authentication outages.
High costs, lock-in and a product falling behind.
Complexity, hard setup and awkward integrations.
Complaints focus on high costs, poor support, difficult integrations, and restrictive contracts.
Built their own ·
1
→
Teams
Integration failures, outages, lock-in and high prices.
Rising contact-based pricing and steep markups.
High pricing, complexity and poor user experience.
Scaling pains, lock-in, bugs and slow support.
→
Mailchimp
High costs, complexity and slow performance.
Built their own ·
3
Overlapping subscriptions, unused seats and rigid design.
Built their own ·
2
→
Asana
Unnecessary complexity, bloat and account recovery gaps.
Built their own ·
1
Cost, limited control and intrusive popovers.
Built their own ·
1
Subscription pricing and slow feature updates.
Built their own ·
2
Limited accuracy and weak video quality.
Costs and trouble scraping protected sites.
Tedious invoicing, slow pages and extra admin work.
Login restrictions and frustrating usability.
Tools need
3
complaints from
2
threads to be listed. Source: public comments via the Hacker News search API, labeled by AI and counted. Hacker News is one source; HissingKitty reviews are another. Counts update nightly. Spot a mistake?
Tell us
.
Paying for one of these?
Add your own rating. Anonymous, unpaid, 30 seconds.
Back in 2013, three friends who loved Apple and design couldn’t find a notes app they liked, so they built their own. That side project became Bear. It arrived on the App Store in November 2016, and within a year it had been named
Mac App of the Year
and won an
Apple Design Award
. This November,
the little Bear turns 10
. Today it helps millions of people around the world capture their ideas and organize their lives every day, and we’ve felt so much love and support from all of you along the way.
Bear 1.0
2013
The idea
We couldn’t find a notes app that fit how we write, so we started building our own.
More
We built it in our spare time. Our day job back then was building apps and websites for clients.
October 2014
First prototype
Our friends loved it. Would everyone else?
November 2016
Launch day!
Bear arrives on the App Store and hits #1 on Product Hunt.
December 2016
Mac App of the Year
Apple names Bear its Mac App of the Year.
June 2017
Apple Design Award
Bear wins a 2017 Apple Design Award.
More
…and we got a selfie with Tim Cook!
2018
Project Panda
We start rewriting Bear’s editor from scratch, code name “Panda”.
More
Your feedback showed us where the original Bear was hitting its limits. Six months in, we realized we needed our own Markdown parser too, so we started over. Again.
July 2023
Bear 2 is here!
Bear 2 launches with an all-new editor and 20+ new features.
July 2025
Bear Web beta
Bear comes to your browser in public beta.
Coming soon
Bear Web
The full release of Bear Web is almost here, and we have more features brewing in house…
Bear 2.0
Over the years, one thing we hear again and again is that Bear just
feels good
to use. So for this special occasion, we want to share the principles behind every design decision we make. Along the way you’ll find some tiny details we’ve hidden all over the app (you may be using a few right now without knowing it), a peek at an idea that never shipped, and some brand new Bear swag. Grab a slice of cake and come on in!
Bear Principles
Every change in Bear goes through a long journey from first idea to final release. Big or small, visible or under the hood, they all follow the same two principles:
Bear should be delightful to use, and safe to trust.
A feeling-good experience by design
We want you to feel delighted every time you open Bear. In practice, that comes down to three things.
Normally a space before the closing asterisks breaks the style, but Bear waits a split second so you can keep typing without the bold flickering away.
(Note: If GIF is not playing, long press and select “Play Animation”)
Simple.
No sign up, no tutorial. Just open a note and write. Bear has grown much more powerful over the years, but all of that power waits quietly underneath and never gets in your way.
💡
Did you know?
To make sure Bear stays easy to use, we always ask our parents to test it first!
Natural.
We believe the best tools disappear while you use them. So we put a lot of effort into making things work exactly the way you expect, and you’ll find these quality of life touches all over the app.
Take moving lines around. Press
⌘⌥
with the up or down arrow to move the current line, which is perfect for rearranging your writing. Bear understands what you’re moving and where it’s going, so it won’t break apart a list or a table along the way. It’s one of those things that feels so obvious you’d never guess someone had to design it.
Move lines inside Bear
Rewarding to explore.
Bear has a lot of depth, but we don’t believe in pushing everything to your face to promote it because we don’t know when or if you will need them. Many of our favorite user stories start with a happy little accident. Resize an image from its corner, and it snaps to line up with the images around it; swipe left on a note on iOS, and the Info Panel slides into view. We love those “Oh wow, I didn’t expect that to work!” moments. They’re a big part of why we sign off every post with “
Happy writing
!”
Post by @TodkarR on X(Twitter)
💡
Did you know?
Some of our favorite details are so small that you may be using them without ever noticing. Here are a few to try:
✍️ Typing in bold or italic? Press Return or the same shortcut again to step right out of the style.
⌨️ Press ⌘A inside a code block to select just the code. Press it again to select the whole note.
🖱️ Select some text and type
(
,
[
,
"
or
`
. Bear wraps your selection instead of replacing it.
🔗 Select some text and paste a URL. The text becomes a link.
Built to be safe
You can’t feel truly comfortable in a space you don’t trust. Your notes hold your ideas, your plans, and sometimes things you’d never share with anyone. That’s why
safety
has shaped Bear’s most fundamental choices from the very start.
Private.
We have no servers holding your notes, and we never see what you write. We also don’t build Bear on top of third party APIs, plugins, or outside services we can’t control. If one of them changed its rules, shut down, or simply stopped working, you would be the one paying the price. So we build what matters ourselves, and Bear keeps working the way you expect.
💡
Did you know?
We collaborated with
Cossack Labs
for note encryption to ensure a reliable and smooth experience. Even if your iCloud account were ever hacked, you can rest assured your encrypted notes stay unreadable.
Keeping a note taking app private and standard
wasn’t a revolutionary idea in 2016 when we first launched Bear, but today, it kind of is. And we are glad we stick to what we believe since day 1. The world is changing and we don’t know where it leads us to, but we know your notes are safe with us and you have full control of them anytime, anywhere.
How features get made
Every design in Bear starts with a problem: a feature people need, something that’s broken, or simply something we don’t like. From there, we are on a journey of problem solving.
multi color highlighter testing for all Bear themes
That usually means a designer and a developer pairing up for a week or two, then bringing something working to the whole team. Then the real fun begins. Matteo, one of our cofounders, describes fun as “clashing heads with wonderful people to make great things.” Everyone in the team gets to express their opinions no matter what title they have. As a matter of fact, job titles mean nothing to us as you can see on our
website
.
Discussing UI details
The feedback discussion can be brutal.
“No”
is a very welcome answer here, with one house rule:
you have to give a reason
. Wall of text and hour long slack huddles come and go, then the paring up buddies return to the improvement part and provide a second round, a third round, until we are all happy with it. There are lucky days that some ideas get a big yes on the first try. Others spark weeks and months of debate and never ship at all. We’d rather be a little stubborn about what feels like Bear than chase every trend.
💡
Did you know?
Back in 2022, we had the idea to create a fourth column for the info panel, TOC, and Backlinks in Bear 2 update. The concept was discussed internally and also shared with on our
forum
, but at the end we were not convinced by the design at practical level, and thus the feature was never born in Bear 2.
The never shipped 4th column mockup
A milestone, and more to come
Over the years, Bear has grown up much bigger than we expected with millions of users enjoying Bear everyday. We’ve seen so many different ways of using Bear: prepare teaching materials in school, work as their second brain, or just write grocery lists (yes, that’s our parents!). 10 years is a huge milestone for us and we want to say a huge thank you to everyone no matter if you have been here since day 1 with us, or just downloaded Bear two minutes ago.
Bear Web Beta
We won’t hand you a flashy roadmap, but here’s what we can say for sure. Bear Web is almost ready for its full release, and we’re also working on note versioning and some other top secret things. Beyond that, we’ll keep doing what we’ve done for ten years: working our best to provide you a comfortable, private space to create beautiful notes.
🎁 Present time!
Kumagotchi: a writing pal for your Home Screen
Meet Kumagotchi
1
, a cute pixel bear who lives in a widget on your Home Screen and keeps you company while you write. Its status quietly follows how you use Bear: it strolls around the meadow when you’ve opened Bear recently, scribbles in its own little notebook while you write, watches the clouds while you read, and takes a nap in the grass when you’ve been away for a while. It’s as old as your very first note, and its weight grows with every note you write.
Kumagotchi widget status
Six new app icons
6 new App icons
What’s a birthday without a little dress up? We’ve crafted six new app icons
2
for the occasion: a special 10th anniversary icon, Bear with Birdie, a golden Bear, a peeking Bear, and two classic pixel Bears. We hope they bring a bit of fun to your Home Screen, and a gentle reminder to enjoy the little things in life.
Did somebody say Bear swag?
Bear Merch selection
Yes, they are finally here! Many of you have been asking for Bear merch and we have been secretly working on them! Our 10th anniversary merch features pixel art of a classic Macintosh with the Bear logo glowing on its screen and our little Birdie perched on top, a nod to where it all began. Check our merch page below to grab your Bear swag!
See you in the next decade
Thank you for being part of the story, whether you’ve been here since day one or found Bear last week. We’d love to hear about your favorite hidden detail, or one you just discovered in this post. Come say happy birthday to us on our
Community Forum
,
Reddit
,
X (Twitter)
,
Bluesky
, or directly at
bear@shinyfrog.net
.
Happy Writing!
🐻❤️📝
“Kuma” means
bear
in Japanese. Kumagotchi is our little nod to the classic Tamagotchi.
↩︎
Steve Jobs on His Final Quarterly Analyst Call: ‘We Think the Open Versus Closed Argument Is Just a Smokescreen’
Daring Fireball
www.macworld.com
2026-11-03 10:40:34
After linking to it earlier today, I re-read Steve Jobs’s remarks from his last appearance on a quarterly analyst call. It’s a banger of a good read:
You know, even if Google were right, and the real issue is
“closed” versus “open,” it is worthwhile to remember that open
systems don’t always win...
Hi, everybody. As most of you know, I don’t usually participate in Apple earnings calls, since you’re all in such capable hands with Peter and Tim. But I just couldn’t help dropping by for our first 20-billion-dollar quarter. I’d like to chat about a few things, and then stay for the rest of the Q&A, if that’s all right.
First, let me discuss iPhone. We sold 14.1 million iPhones in the quarter, which represents a 91 percent unit growth over the year-ago quarter, and was well ahead of IDC’s latest published estimate of 64 percent growth for the global smartphone market in the September quarter. And it handily beats RIM’s 12.1 million BlackBerrys sold, in their most recent quarter ending in August.
We’ve now passed RIM. And I don’t see them catching up with us in the foreseeable future. They must move beyond their area of strength and comfort, into the unfamiliar territory of trying to become a software platform company. I think it’s going to be a challenge for them to create a competitive platform and to convince developers to create apps for yet a third software platform after iOS and Android. With 300,000 apps on Apple’s App Store, RIM has a high mountain ahead of them to climb.
Google
But what about Google? Last week, Eric Schmidt reiterated that they are activating 200,000 Android devices per day, and have around 90,000 apps in their app store. For comparison, Apple has activated around 275,000 iOS devices per day on average for the past 30 days, with a peak of almost 300,000 iOS devices per day on a few of those days. And Apple has 300,000 apps on its App Store.
Unfortunately, there is no solid data on how many Android phones are shipped each quarter. We hope that manufacturers will soon start reporting the number of Android handsets they ship each quarter, but today that just isn’t the case. Gartner reported that about 10 million Android phones were shipped in the June quarter, and we await to see if iPhone or Android was the winner in this most recent quarter.
Google loves to characterize Android as “open,” and iOS and iPhone as “closed”. We find this a bit disingenuous, and clouding the real difference between our two approaches. The first thing most of us think about when we hear the word “open” is Windows, which is available on a variety of devices. Unlike Windows, however, where most PCs have the same user interface and run the same apps, Android is very fragmented. Many Android OEMs, including the two largest, HTC and Motorola, install proprietary user interfaces to differentiate themselves from the commodity Android experience. The user’s left to figure it all out. Compare this with iPhone, where every handset works the same.
Twitter client [TweetDeck] recently launched their app for Android. They reported that they had to contend with more than a hundred different versions of Android software on 244 different handsets. The multiple hardware and software iterations present developers with a daunting challenge. Many Android apps work only on selected Android handsets, running selected Android versions. And this is for handsets that have been shipped less than 12 months ago! Compare this with iPhone, where there are two versions of the software, the current and the most recent predecessor, to test against.
In addition to Google’s own app marketplace, Amazon, Verizon, and Vodafone have all announced that they are creating their own app stores for Android. So there will be at least four app stores on Android, which customers must search among to find the app they want, and developers will need to work with to distribute their apps and get paid. This is gonna be a mess for both users and developers.
Contrast this with Apple’s integrated App Store, which offers users the easiest-to-use largest app store in the world, preloaded on every iPhone. Apple’s app store has over three times as many apps as Google’s marketplace, and offers developers one-stop shopping to get their apps to market easily, and get paid swiftly.
You know, even if Google were right, and the real issue is “closed” versus “open,” it is worthwhile to remember that open systems don’t always win. Take Microsoft’s “Plays For Sure” music strategy, which used the PC model—which Android uses as well—of separating the software components from the hardware components. Even Microsoft finally abandoned this “open” strategy in favor of copying Apple’s integrated approach with their Zune player, unfortunately leaving their OEMs empty-handed in the process. Google flirted with this integrated approach with their Nexus One phone.
In reality, we think the open versus closed argument is just a smokescreen to try and hide the real issue, which is, “What’s best for the customer – fragmented versus integrated?” We think Android is very, very fragmented, and becoming more fragmented by the day. And as you know, Apple strives for the integrated model so that the user isn’t forced to be the systems integrator. We see tremendous value at having Apple, rather than our users, be the systems integrator. We think this a huge strength of our approach compared to Google’s: when selling the users who want their devices to just work, we believe that integrated will trump fragmented every time.
And we also think that our developers could be more innovative if they can target a singular platform, rather than a hundred variants. They can put their time into innovative new features, rather than testing on hundreds of different handsets. So we are very committed to the integrated approach, no matter how many times Google tries to characterize it as “closed.” And we are confident that it will triumph over Google’s fragmented approach, no matter how many times Google tries to characterize it as “open.”
Tablets
Second, I’d like to comment on the “avalanche” of tablets poised to enter the market in the coming months.
First, it appears to be just a handful of credible entrants, not exactly an avalanche.
Second, almost all of them use seven-inch screens, as compared to iPad’s near 10-inch screens. Let’s start there.
One naturally thinks that a seven-inch screen would offer 70 percent of the benefits of a 10-inch screen. Unfortunately, this is far from the truth. The screen measurements are diagonal, so that a seven-inch screen is only 45 percent as large as iPad’s 10-inch screen. You heard me right: just 45 percent as large.
If you take an iPad and hold it upright in portrait view, and draw an imaginary horizontal line halfway down the screen, the screens on these seven-inch tablets are a bit smaller than the bottom half of the iPad’s display. This size isn’t sufficient to create great tablet apps, in our opinion.
While one could increase the resolution of the display to make up some of the difference, it is meaningless unless your tablet also includes sandpaper, so that the user can sand down their fingers to around one-quarter of their present size.
Apple has done extensive user testing on user interfaces over many years, and we really understand this stuff. There are clear limits of how close you can physically place elements on a touchscreen before users cannot reliably tap, flick or pinch them. This is one of the key reasons we think the 10-inch screen size is the minimum size required to create great tablet apps.
Third, every tablet user is also a smartphone user. No tablet can compete with the mobility of a smartphone. Its ease of fitting into your pocket or purse. Its unobtrusiveness when used in a crowd. Given that all tablet users will already have a smartphone in their pockets, giving up precious display area to fit a tablet in their pockets is clearly the wrong trade-off.
The seven-inch tablets are tweeners: too big to compete with a smartphone, and too small to compete with an iPad.
Fourth, almost all of these new tablets use Android software, but even Google is telling the tablet manufacturers not to use their current release—Froyo—for tablets, and to wait for a special tablet release next year. What does it mean when your software supplier says not to use their software in your tablet, and what does this mean when you ignore them and use it anyway?
Fifth, iPad now has over 35,000 apps on the App Store. This new crop of tablets will have near zero.
And sixth and last, our potential competitors are having a tough time coming close to iPad’s pricing, even with their far smaller, far less expensive screens. The iPad incorporates everything we’ve learned about building high-value products, from iPhones, iPods and Macs. We create our own A4 chip, our own software, our own battery chemistry, our own enclosure, our own everything. And this results in an incredible product at a great price.
The proof of this will be in the pricing of our competitors’ products, which will likely offer less, for more. These are among the reasons that we think that the current crop of seven-inch tablets are going to be DOA—Dead on Arrival. Their manufacturers will learn the painful lesson that their tablets are too small, and increase the size next year, thereby abandoning both customers and developers who jumped on the seven-inch bandwagon with an orphaned product. Sounds like lots of fun ahead.
iPad and cannibalization
The iPad is clearly gonna affect notebook computers. And I think the iPad proves it’s not a question of if, it’s a question of when. And there’s I think a lot of development and progress over the next few years. But we’re already seeing tremendous interest in iPad from education and, much to my surprise, from business. We haven’t pushed it real hard in business, and it’s being grabbed out of our hands. And I talk to people every day in business, in all kinds of businesses, that are using iPads. All the way from boards of directors that are shipping iPads around instead of board books, down to nurses and doctors and hospitals, and other large and small businesses.
So the more time that passes, the more I am convinced that we’ve got a tiger by the tail here,and this is a new model of computing which, you know, we’ve already got tens of millions of people already trained on with the iPhone. And that lends itself to lots of different aspects of life, both personal, educational, and business. So I see it as very general purpose, and I see it as really big. And the timing, one could argue about the timing endlessly, but I don’t think one could argue that it’s gonna happen anymore.
[Q: You think this could be your second biggest business behind iPhone?]
I try to not predict, I try to just report, so we’ll keep you posted. As you know, we’re already shipping more of them than Macs after just a few quarters.
[Q: Any updates on your stance on Flash?]
Flash memory? We love flash memory.
[Q: You are the tablet market right now… This is the second time you’ve come on to talk about competition, and I’m just wondering if much like Apple encroaching on RIM’s monopoly in enterprise, if you think Apple is gonna be able to sustain share growth for tablets amid some of those new competitive headwinds. Some of those players may try different things and strategies, like tethering and Flash, multitasking, less content and app restrictions, and subsidized pricing. Just wondered if you think that may create itself a more fragmented market.]
I have a hard time envisioning what those strategies you mentioned are. In terms of pricing, so far the little we’ve seen, the tablets with far less functionality are having a hard time matching us in price. Flash hasn’t presented any problem at all—as you know, most of the video on web is now available in HTML5. And having the iTunes media store and over 35,000 apps on the App Store for iPad dwarfs anything else. And we think we have a very good product here that’s gonna be hard to match, and we’re not done, we’re working on a lot of things for the future. So I don’t know what exactly these strategies are, and we’ve priced iPad pretty aggressively. So we’re out to win this one.
[Q: Is the phone market a zero-sum game?]
As you know, the largest market of phones today around the world are non-smartphones. And so over the next several years, many of those non-smartphones are going to convert to smartphones. And the pie is gonna continue to grow. And I think there’ll be room for some number of companies to be successful, but eventually as most of those phones do convert to smartphones, it will turn into a zero-sum game, or at least a lot closer to that. I think right now it’s a battle for the mindshare of developers and for the mindshare of customers, and right now iPhone and Android are winning that battle.
[Q: What are your thoughts about Apple TV and how it’s going, since it seems to be on a streaming model now.]
We have gone to a streaming model on Apple TV. It’s complete streaming. So all the content is rented from the iTunes store, or is streamed from your computer, or soon to be streamed from your iPhone or iPad with AirPlay. And so how our new model of Apple TV doing? Well, I can report that in just a very short amount of time we’ve already sold a quarter million of them. Over 250,000. And we’re thrilled with that. I think that it’s a great product, and I think that its $99 price point is very enticing, and I think that when we get the AirPlay stuff in place before the end of this year, it’s gonna give another big reason for people to buy it. So we’re happy with how it’s turned out.
[Q: Biggest risks?]
Our goal is to make the best devices in the world, not to be the biggest. As you know, Nokia’s the biggest. And we admire them for being able to ship the number of handsets that they do. But we don’t aspire to be like them. They’re good at being like them. We want to be like us. And we want to make the best ones.
So, you know, in our part of the market Android is our biggest competitor. They outshipped us in the June quarter as we were transitioning to iPhone 4, they outshipped us for the first time according to Gartner’s numbers, which we think are pretty accurate. And so we’re waiting to find out what happened in this quarter. And we’ll find out—I don’t know how we’ll find out, but Gartner will put out some new numbers, and maybe others will, and so one of these days we’ll eventually learn. And I imagine we’ll be competing with them for quite some time, but we have very different approaches. And we believe in our approach very strongly: providing users products that just work. And we think there’s lots of users that want that, in the world. And their approach is very different from that. And there may be lots of users that want their approach as well, but we’re going to pursue ours, and we think that’s the winning approach in the end.
[Q: Market share question.]
Nokia makes $50 handsets, and we don’t know how to make a great smartphone for $50. We’re not smart enough to have figured that one out yet, but believe me I’ll let you know when we do. And so our goal is to make really breakthrough great products, make the best products in every industry that we compete in, and to drive the cost down while constantly making the products better at the same time. That’s what we did with iPod. We updated our products many times every year with better functionality, often times at same price and sometimes at a lower price. And it was the relentless improvement at in some cases a lower price, that was able to beat our competition and yield the market share that it did.
And as you know we have a very low market share in the phone market, in the single digits, in terms of all the handsets. And we have a very high market share now in tablets, because we’re the first mover. But we don’t think about it that way.
The reason we wouldn’t make a seven-inch tablet isn’t because we don’t want to hit a price point, it’s because we don’t think you can make a great tablet with a seven-inch screen. We think it’s too small to express the software that people want to put on these things. And we think, as a software-driven company, we think about the software strategies first. And we know that software developers aren’t going to deal real well with all these different sized products, when they have to re-do their software every time a screen size changes, and they’re not going to deal well with products where they can’t put enough elements on the screen to build the kind of apps they want to build.
So when we make decisions on seven-inch tablets, it’s not about cost, it’s about the value of the product when you factor in the software. You see what I’m getting at? So we’re all about making the best products at aggressive prices. And that’s what we will do. And that’s what we’ve done with the iPod, and that’s what we will do with the iPad as well.
You’re looking at it wrong. You’re looking at it as a hardware person in a fragmented world. You’re looking at it as a hardware manufacturer that doesn’t really know much about software, who doesn’t think about an integrated product but assumes the software will somehow take care of itself. And you’re sitting around saying, well, how can we make this cheaper? Well, we can put a smaller screen on it, and a slower processor, and less memory, and you assume that the software will somehow just come alive on this product that you’re dreaming up, but it won’t. Because these app developers have taken advantage of the products that came before, with faster processors, with larger screens, with more capabilities that they can take advantage of to make better apps for customers. And they’re not… it’s a hard one, because it throws you right back into the beginning of that chicken-and-egg problem again, to change all the assumptions on these developers. Most of them will not follow you. Most of them will say, “I’m sorry, but I’m not going to write down a watered-down version of my app just because you’ve got this phone that you can sell for $50 less, and you’re begging me to write software for it.”
[Q: Why not return some of your cash to shareholders?]
We strongly believe that one or more very strategic opportunities may come along, that we are in a unique position to take advantage of because of our strong cash position. You know, we’ve demonstrated a strong track record of being very disciplined with the use of our cash. We don’t let it burn a hole in our pocket, we don’t allow it to motivate us to do stupid acquisitions. And so I think that we’d like to continue to keep our powder dry, because we do feel that there are one or more strategic opportunities in the future. That’s the biggest reason.
[Q: Why do you think you have an advantage on the price point for iPad versus PC manufacturers?]
I think part of it is because we engineer so much of it ourselves. The A4 chip inside it is an Apple creation. Everything from the battery chemistry to the enclosures. And we’ve learned a lot from the miniaturization we’ve done on iPods and iPhones, and we’re a very high-volume consumer electronics manufacturer. So I think we’ve learned a lot, we’ve developed a lot of our own components where others have to buy them on the market with middlemen, you know, getting their cut of things. And I think we’re systems architects and known how to build systems in a very efficient way. So I think this is a product we’ve been training for for the last decade.
These are the words my older brother uttered—
pronounced
, more like—
decreed
, even—as I, a ten-year-old transitioning from elementary school to middle, debated the merits of various instruments I might learn, in band class.
(I had been leaning toward flute.)
(I ended up going with clarinet.)
I was recently in a conversation where a friend said, approximately:
I feel you’re on stronger ground, Duncan, when you say that the status quo is unfairly blocking some people from activities they spontaneously want to do and (you argue) safely could in a different society.
I feel less comfortable when you dig for reasons that other people’s aversions to touch or sexual activity or whatever might be “unhealthy” (against some standard I’m not sure you’ve made a case for the universal healthiness of).
I think the statistical case for the unhealth of the younger generation is very strong, vis-a-vis depression, isolation, anxiety, etc. I’m reminded of that meme:
Like, asexuals
absolutely
exist (and are a completely healthy type of human), but also we know the rough base rate for asexuality and the stuff we’re seeing with younger generations staying at home and touching no one ever and living on social media and masturbation
exceeds
that rate, by a lot.
(And it’s not like there aren’t obvious causes—things happening that are unprecedented in our social and evolutionary history, that you would expect to fuck people up in the very ways we’re seeing people get fucked up. It’s a deer in the subway prior—the vast majority of possible departures from equilibrium are not improvements, or at least not straightforwardly/costlessly so.)
In general,
if someone seems elsewise completely happy and healthy and well-adjusted, then I certainly don’t question their sexuality or their aversion to touch or whatever. It’s mostly just that I’ve almost never
seen
a person who had a strong aversion to touch who otherwise did, in fact, seem completely healthy and happy and well-adjusted. Something like 9 out of 10 people that I’ve met who had strong touch aversions were also visibly maladjusted in the same way that you would expect from the stereotype of an animal that was cringing away from normal touch (e.g. from other members of its own species).
The 1 out of 10 does exist!
But it’s a strong prior.
To put it another way: if someone is like “Yeah, I am wildly outside of the distribution for desiring touch, and also I’m deeply fucked up in this other way, but don’t worry, I swear, those things are totally unrelated, the touch thing is #valid,” I
squint
at them.
Healthy person who is touch-averse: sure, range of preferences; different people
exist
.
Unhealthy person: I bet on
entanglement.
Then some time passed, and I felt the need to
keep adding clarifications,
and I came to the insight that’s at the core of this essay:
Oh, also: hopefully it’s clear that, even if the touch aversion
is
part of a complex of maladjustments, the answer is
obviously
not to brute-force override their touch preferences, in the moment. Like, even a malignant touch aversion is still real! To the extent that you want to help them fix it (and they want that, too), you can’t just “should” it away.
A random human saying “your touch preferences are Wrong” is indeed likely to do or advocate a bunch of abhorrent shit that I also agree is wrong, and vocally advocate against—someone’s traumatic adjustment to unhealthy circumstances is often itself pretty well-adjusted, in the sense of making the available best of a bad situation.
(e.g. slowing down in winter, which I recently
argued against pathologizing
, even though winter itself was not really present in our African ancestral experience and there’s a decently strong argument that we’re not really adapted for it and therefore the slowing-down is more of a cope than a straightforward natural good.)
Here’s the thing about what my brother had to say, regarding the flute:
The boys in our middle school and high school who
did
play the flute did not do well, as a class.
That’s … mostly an indictment of the local culture. Like, it’s
bad
if your school bullies and hazes people because a) for some reason everybody has decided that one’s choice of musical instrument is a Gender Thing™ and b) if you pick the wrong one then you’re some kind of Wrong, yourself, and c) the correct response to
that
is to torment you for seven years.
That’s bad.
And also.
That was the reality of the situation.
There’s a sort of wishful thinking that I’ve written about
at length
, before, where a certain kind of Good Parent™ might look at the situation and go “That’s stupid. You shouldn’t be constrained in your choice of musical instrument by small-minded bullies and hicks. Get your shoes, we’re going to get you a flute
right now.
”
And in the moment, I probably would have felt a rush of satisfaction and validation, and appreciation for the support.
And then I would’ve spent seven years one layer further down in hell.
The
actual
choice before me was not, in fact, “costlessly choose the thing you want” versus “kowtow to the fickle whims of a broken society.”
It was “spend a large fraction of your finite points
here,
on this specific battle,” versus “keep your head down and enjoy playing the next-most-appealing instrument in relative peace.”
(The clarinet was also fraught, by the way—just somewhat less so. There was a rather awkward moment when Philip Howard and I got to high school, and the band divided up by instrument to go off and practice, and the clarinetists headed for the girls’ locker room, because that’s where the clarinetists had
always
gone to practice.)
A lot of shit is broken in the world right now.
And a lot of our
responses
to that broken shit are themselves broken. Masking. Being closeted. Self-medicating. Doom scrolling. Hiding.
Lashing out
.
Sometimes, those broken responses can be self-reinforcing. They can start a vicious spiral that digs you further, and further, and further. Political polarization begets further political polarization; touch-starved people often become averse to touch, and this sucks. There’s something there that is
important
to fix, before it crosses the point of no return.
But the
way
to fix it isn’t to ignore the problem. You don’t cure someone of their arachnophobia by tossing a box of spiders at them. Coping strategies are there
for a reason,
and you almost never improve a situation by yanking away the crutch.
My friend heard me loudly pathologizing certain signatures of the younger generation (such as their social isolation and touch aversion) and got
nervous,
because when people start saying “X is unhealthy and wrong,” they often move pretty quickly to
doing
something about it, and the cure is often worse than the disease.
His objection was sound, and reasonable.
(And I’m glad he lodged it openly, because it was a good reminder to back up and be explicit about
not
taking an ill-advised next step. I had forgotten to emphasize that part, because I had taken it for granted.)
People from
Agor
are a
tiny, tiny bit
more sane
, when it comes to stuff like that. We intentionally practice the habit of being able to acknowledge that a thing is broken and bad while
not
taking any action in response, because we know that hasty action is likely to
make things even worse
.
(The axiom “most possible departures from equilibrium are not improvements” applies
just as well
to the
new
equilibrium of [problem] + [coping strategy]. By the time someone has
developed
a coping strategy, they’ve usually already searched the space of possibility at least a little, and found a local balance that minimizes the bad stuff, such that any single step in any direction is unlikely to be better. The fix in such cases usually requires changing two or three or four things
all at once,
and
that
kind of intervention takes care and forethought and patience and humility.)
It was wrong for the people at my school to harass boys for playing “girly” instruments.
It was also wrong for my brother to trample all over my personal sovereignty, and (essentially)
take away from me
the freedom to choose which instrument I would play for the next seven years.
But those two wrongs
did
add up to a right. Or at least, they left me in the
least wrong
situation that was actually available, given all of the constraints. There are a lot of things I might change, if given access to a time machine, but “play the flute instead of the clarinet” isn’t one of them.
(An even
better
move would’ve been to just
give me an accurate map of where the fenceposts were
, and then let me make a truly informed decision, but my brother was only thirteen; he, too, was doing his best. (Also there would’ve been costs
to him
of me playing the flute, and he had a right to care about those.))
It takes more than mere wishing to get out of the
darkworld
. In the meantime, while you’re here, you have to make do.
BTW my novel
Pass
is still going up
online
; chapter three is set to go out on Friday morning. I probably won’t keep reminding everyone, but I
would
love it if you read it and left a comment.
A sad historical footnote: this brother has since thoroughly and explicitly disavowed his relationship to me, stating more than once, in unequivocal terms, that I am in fact
no brother of his
(even though I
didn’t
ever play the flute).
Discussion about this post
Ready for more?
Study estimates 75% of NFL players who died over 15-year span had CTE
An estimated 75% of professional football players who died over a 15-year span had signs of chronic traumatic encephalopathy, or CTE, a study published Wednesday found.
It’s the highest estimate to date. Most recently, a
study published in August
by the same group estimated that one-quarter of NFL players who died in a five-year span had CTE. The new study, published in
JAMA Network Open
, put the figure at three times higher.
Not all people with signs of CTE in the brain go on to experience cognitive decline or dementia, and some people may never experience symptoms at all. A smaller proportion of the former players in the analysis were estimated to have dementia, about 27%, the study found.
The results were surprising, said study leader Yorghos Tripodis, the director of statistics and data management at the Boston University Alzheimer’s Disease and CTE Center. Boston University houses the
UNITE Brain Bank
, which studies the effects of repetitive head trauma in donated brains, including the brains of athletes, military personnel and others.
“I had to double-check the numbers,” Tripodis said. Still, he said, the number is a best guess. “Right now we don’t know how to diagnose CTE when people are alive, so we are trying to estimate.”
In an emailed statement, an NFL spokesperson said, in part, that the league “continuously strives to make the game of football safer, including by implementing strategies to reduce concussions and head impacts.”
Repeated blows and bias
When a person’s head jolts during an impact, the brain — which is suspended in fluid inside the skull — can slam into the skull or twist, said Dr. Julian Bailes, chair of the neurosurgery department at Endeavor Health in the Chicago area. Each blow is an opportunity for proteins called tau to build up in the brain.
“If that happens over and over again, that damage accrues,” said Bailes, who wasn’t involved with the new research.
The disease can affect parts of the brain involved with
regulating behavior and emotions
, which can lead to memory loss, depression, violent mood swings and other symptoms. Those symptoms can also be linked to other illnesses.
Although CTE can cause symptoms similar to those of other neurodegenerative diseases, such as dementia and Parkinson’s disease, the signature it leaves on the brain is unique, Bailes said.
One huge hurdle in studying the prevalence of CTE is that the microscopic changes don’t show up on brain scans. That means the condition can be diagnosed only during an autopsy.
Past research has been criticized for bias, since people with cognitive decline and their families are much likelier to either donate their brains to brain banks after they die or ask for autopsies —
a previous study
by Boston University researchers found that 99% of the brains donated to research by former NFL players had signs of CTE.
In the new study, Tripodis and his team tried to remove as much of that bias as possible to determine a more accurate estimate of CTE rates in former NFL players. They combined data from the UNITE Brain Bank with national death records of other former NFL players who died from 2008 to 2023.
In total, the researchers looked at data from 396 donated brains, plus information from 1,966 other deceased former NFL players. They factored in the ages of death along with estimated rates of mild cognitive impairment and dementia in former NFL players older than 50.
About 93% of the donated brains had signs of CTE, which shows up as structural damage in the brain. The research team calculated that the families of players with symptoms of cognitive decline were about five times likelier to donate brains than the families of players without symptoms and then performed a statistical analysis to correct for that bias.
From there, they estimated that among the roughly 2,360 former players who died during the 15-year time frame, about 1,760, or nearly 75%, had CTE. In comparison, only about 1% of brains donated to banks in the U.S., Austria and Brazil have signs of the disease, the researchers said.
But plenty of people with signs of CTE never develop symptoms, Tripodis said.
The researchers estimated that 27% of the 2,360 players studied had dementia.
The dementia “can be from all causes,” Tripodis said. “But it is very likely that in this specific population that CTE is causing dementia.”
Reducing impacts
Until doctors figure out a way to diagnose CTE while people are still alive, any studies quantifying how many people have the condition will be estimates, said Dr. Jim Kelly, a professor emeritus of neurology at the University of Colorado Anschutz.
“These are all estimates. They had no autopsies on five times as many players who died as they did have autopsies for,” said Kelly, who wasn’t involved in the research.
Some of the autopsies may also have revealed just one or a couple of lesions associated with CTE, “and it seems unlikely that that would lead to anything in terms of a behavior change or dementia,” he said.
Those are difficult studies to do, Bailes agreed. They seek to determine “how many people out there have a condition when not all of them are symptomatic,” he said, adding that the findings are a call for more research into diagnosing CTE in people who are still living.
“If you can’t tell if someone has a certain disease until they’re dead, you really can’t help them,” he said.
In the meantime, prevention is key, Tripodis said: “If you reduce the number of brain injuries, brain impacts, you substantially decrease the risk.”
The NFL has already implemented measures to try to reduce the number of high-impact hits players face. They include
redesigned helmets
— such as the
Guardian Cap
— and the
dynamic kickoff rule
, which leads to lower collision speeds.
I am a computer science student. I got a scholarship to study computer science and AI last year and I love it! It's something that I wanted to do since I was a kid but couldn't afford it.
It's been a huge learning curve. I only had a B in maths from GCSE (which is the exam you take at 16 for non UK folk) and no technical training other than the funny little games I made on OpenProcessing*.
Regardless of how hard it's been, I have enjoyed the challenge. I wouldn't have signed up to study computing if I thought it would be an easy ride. The problem is that my university seems to be having an existential crisis because of AI, and it's making the experience much shittier than it was before.
The flip flopping makes everything uncertain
During my studies, my uni has flip flopped between YOU MUST NEVER USE AI and YOU MUST USE AI and also YES WE'RE USING AI BUT THAT DOESN'T MEAN YOU SHOULD!
They seem to have made an art of choosing the worst possible use cases for AI (marking and feedback, course content creation, and student engagement emails) and going all in on them, only to roll back the decision 3 months later. Students are mandated to use AI in assignments, only to reach the next module where you lose marks for even touching an LLM.
Coursework design has gone down the toilet
I mean, it was never perfect to begin with. Assessing skill in computer science is a difficult problem to solve, but getting Claude to crank out bloated assessment briefs is not the solution. Whereas before, assignments were designed by a person who thought them through at least once, then approved by other people in the department, now I doubt they're getting read more than once (if that). Errors abound, often with corrections coming a week or two before the deadline.
The amount of work involved has also tripled - LLMs don't know how much effort it takes for a student to learn new material then complete technical tasks, and professors are too far along in their careers to notice this when skim reading an AI generated brief. So those of us with less technical experience are forced to speed run content, which SUCKS! I am here to learn, god damn it, not barely scratch the surface of the 15 deliverables I have for a 3,000 word assignment.
Tutors are overloaded (even more than usual)
You know what university financiers love to hear? SCALE! Learning at scale, preferable automated, so they can milk the cash cow as much as possible without paying for extra staff. There has always been tension between educational and commercial interests in every institution, but the AI hype has forced through a level of workload that is unethical and unsustainable for tutors and lecturers. I only hear from my tutor these days when I haven't accessed the online portal in a while, because their data dashboard flagged me as 'at risk' T_T
Doomers left, right and centre
I don't care if computer science and maths are over! I still want to learn about them! OK, I do care about my future career, but it still doesn't mean I want to forget everything I learned or stop progressing on this journey. There are so many interesting avenues to explore (some AI, some not), but I can't move for headlines about how software engineering is over/not using AI makes you obsolete/blah blah blah. Can't a girl learn statistics for fun?
I could go on, but I won't. It'll give me indigestion. Maybe I'll go back to OpenProcessing for a bit and make some more silly games now I actually know how to do a bit of programming.
Send me an email if you have anything to share about this post!
Reply by email
You're probably reading this page because you've attempted to
access some part of
my blog (Wandering
Thoughts)
or
CSpace
, the wiki thing it's
part of. Unfortunately whatever you're using to do so has a HTTP
User-Agent header value that is too generic or otherwise excessively
suspicious. Unfortunately, as of early 2025 there's a plague of
high volume crawlers (apparently in part to gather data for LLM
training) that behave like this. To reduce the load on
Wandering Thoughts
I'm experimenting with
(attempting to) block all of them, and you've run into this.
All HTTP User-Agent headers should clearly identify what they
are, and for non-browser user agents, they should identify not just
the software involved but also who specifically is using that software.
An extremely generic value such as "
Go-http-client/1.1
"
is not something that I consider acceptable any more.
One specific thing is that if your HTTP User-Agent header
contains an explicit marker that you are only 'compatible' with
what your User-Agent suggests, you must include an explicit, real
URL that describes your activities or the software. A minimal HTTP
User-Agent such as 'Mozilla/5.0 (compatible; mysoftware)' is not
acceptable. The same is true if your HTTP User-Agent says that you
are a 'bot' of some sort; your bot needs a working URL explaining
itself. An email address is not sufficient in either case.
Fearing my parody lacked seriousness, I created
XSLT.RIP
to ensure the developer world was informed of Google’s
death note
. This did the trick, although a
few commenters
believed it was satire. There is subtlety to
XSLT.RIP
. The website itself is built with XSLT and when Google kills XSLT they’ll kill my website.
The web standards process and its stewards (
Big Browser
) used to adhere to a social contract. Backwards compatibility was a major design principle. Under no circumstances do you ever purposefully break the web.
XSLT.RIP
will be broken soon and I’ll sit back and watch Google break it.
17 November 2026
appears to be the date of execution. Some Chromium-based browsers have been running a
man-in-the-middle attack
by injecting propaganda into XSLT websites.
This site uses XSLT; that functionality is being removed from this browser very soon. When that happens, this page will likely no longer display correctly. You might be able to install a browser extension that allows you to continue viewing it. Otherwise, you should contact the maintainer of the site for further information.
The line of death
is another “social contract” that Google has forgotten. They’re blaming website owners and acting like questionable purveyors of free public Wi-Fi. This is arrogant and intrusive.
“contact the maintainer of the site” — you broke the web Google, own it at least.
A lightweight, fast, and fully-featured BASIC interpreter designed specifically for mid-range Arduino boards and MCUs. Write, edit, and run code directly on the hardware.
Key Features
In-Hardware Editor
Write and edit your BASIC programs directly on the Arduino without needing a connected PC IDE.
Hardware-Agnostic by Design
Built to be lightweight and portable. Tiny Basic for Arduino minimizes hardware dependencies so you can bring BASIC to almost any mid-range MCU with minimal effort.
Extensive Standard Library
Includes a comprehensive set of built-in functions for hardware I/O, math, and bit manipulation.
Fedora Linux 45 released
Linux Weekly News
lwn.net
2026-11-03 10:11:32
Fedora Linux
45 has been released. This includes all editions: Fedora Workstation, Fedora KDE Plasma Desktop, Fedora Server, Fedora Cloud, Fedora CoreOS, and Fedora IoT, as well as the Atomic Desktops and Spins.
This release adds support for installation
on Stratis storage using Anaconda or Kicksta...
Barracuda warns of critical flaws allowing root access to devices
Bleeping Computer
www.bleepingcomputer.com
2026-11-03 10:06:16
Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. [...]...
Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges.
The first is a critical flaw (
CVE-2026-116606
) stemming from an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration, while the second (
CVE-2026-111560
) lets threat actors with admin permissions inject OS commands that run as root.
However, Barracuda said successful exploitation also requires access to the administrative interfaces of targeted devices and advised customers to use appropriate network access controls and restrict access to trusted internal networks to limit exposure.
"Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,"
the company explained
.
"Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. Customers should review the affected products and remediation guidance [..], ensure their systems are running the latest firmware version, and have all security patches applied."
A complete list of all affected devices and available security patches is available in the table below.
Affected Product
CVE-2026-116606
CVE-2026-111560
Patch
Email Security Gateway (ESG)
Yes
Yes
BNSF-40425 (9.4.017+),
BNSF-40430 (<9.4.017)
Load Balancer ADC
No
Yes
BNADC-16586
Message Archiver (BMA)
No
Yes
BNMA-32468
WAF Control Center (WCC)
No
Yes
BNWF-60060
Web Application Firewall (WAF)
No
Yes
BNADC-16586
Web Security Gateway (WSG)
No
Yes
BNYF-24789
Three years ago, Barracuda also patched an Email Security Gateway flaw (CVE-2023-7102) that the UNC4841 hacking group
exploited in zero-day attacks
to execute arbitrary code on unpatched appliances.
The same year, UNC4841 hackers abused another zero-day (
CVE-2023-2868
) to target Barracuda ESG appliances as part of cyber-espionage attacks.
Barracuda later revealed that the vulnerability had been exploited
for at least seven months
, since at least October 2022, to deploy previously unknown SeaSpy and Saltwater malware and steal data from compromised systems.
Almost a third of appliances hacked in the 2023 campaign
belonged to government agencies
worldwide, most of them breached between October and December 2022, according to cybersecurity firm Mandiant.
Founded in 2003, Barracuda has more than 200,000 customers worldwide, including small- to medium-sized businesses (SMBs), large enterprises, and managed service providers (MSPs).
Octomind is a CLI-first AI coding agent runtime. It gives an LLM real access to your repo — reading and writing files, running shells, searching code, delegating to sub-agents — through
MCP
tools. The same session engine works
interactively
,
piped through stdin
, as a
background daemon
, over
WebSocket
, or as an
ACP sub-agent
inside another agent's stack.
# Interactive
octomind run developer:general
# Piped — CI, scripts, automationecho"Explain the auth module"| octomind run developer:general --format plain
# Daemon — keep it alive, talk to it from another terminalecho"watch the build"| octomind run --name watcher --daemon --format jsonl
octomind send --name watcher "run the test suite"
Why Octomind?
Most coding agents assume a human is watching the screen. Octomind is built for the work that keeps going after you leave.
Policy as code, not approval popups.
Deterministic
guardrails
— pre-call guards, post-result hooks, post-turn validators — live in TOML and scripts, so they work in CI, daemons, and scheduled runs.
Proven on real PRs.
It solved 24 of 25 held-out tasks at lower cost than the closest competitor. See the
benchmarks
.
Ready-made specialists.
octomind run developer:general
pulls a packaged agent (prompt, model, MCP servers, tool permissions) from a
tap
. Publish your own with one repo.
Sessions that stay sharp.
Adaptive
compression
keeps long tasks moving while retaining task knowledge and the live exchange.
Any model, any budget.
Use Octomind Cloud or your own key (OpenRouter, Anthropic, OpenAI, DeepSeek, Ollama, and more), pick a model per role, and set spend thresholds per request and per session. A request over its threshold stops; at the session threshold a terminal session asks y/N before continuing, while a non-interactive
octomind run
stops with exit code 75.
One config.
Models, tools, roles, guardrails, budgets: all TOML, no framework code.
2. Get model access.
The fastest path is Octomind Cloud, which includes models and needs no configuration:
Prefer your own provider key? Skip login and export one (also
OPENAI_API_KEY
,
ANTHROPIC_API_KEY
,
DEEPSEEK_API_KEY
), then follow
Model access
to point the config at it:
export OPENROUTER_API_KEY="your_key"
3. Run a specialist
in your project:
cd~/your/project
octomind run developer:general
You're now in a session with an agent that can read your code, run commands, and edit files. The interface is a plain line prompt with markdown rendering — no TUI to learn, so it works over SSH, in
tmux
, and in CI logs. The first time you run a specialist, it may install its tools and ask for credentials.
developer:general
comes from the default tap
muvon/tap
, not your local config. Plain
octomind run
starts the config's default role,
assistant:concierge
.
Try the
recorded bug-fix demo
: two failing tests, an agent fix, and an independent test rerun.
Benchmarks
Measured on
octobench
against
25 tasks harvested from merged pull requests
across Python, PHP, Rust, C++, and JavaScript. Each agent works in the pre-fix repo; held-out tests from the merged fix decide pass or fail. These are the published July 30, 2026 results, not a measurement of this checkout.
solved
judge Σ / 2500
cost
wall time
octomind + glm-5.2
24/25
2264
$63.43
3.6h
claude code + claude-opus-5
23/25
2262
$81.79
6.7h
codex + gpt-5.6-sol
21/25
2127
$14.86
1.0h
opencode + glm-5.2
19/25
2093
$129.54
3.3h
The harness matters.
opencode used the same model and endpoint; octomind solved 24 vs 19 at roughly half the cost. All four agents ran stock invocations with no tuning, so this measures the whole harness, not individual features.
Worst-case pricing, still ahead.
glm-5.2 ran without prompt caching while Opus billed ~97% of context re-reads at cache rates — and octomind still led on solves, cost, and wall time.
Reproducible.
Per-case table, artifacts, and reproduction guide:
BENCHMARK.md
. Background:
blog post
.
Guardrails: Policy as Code
Drop a
.agents/guardrails.toml
in your repo. The runtime enforces it deterministically, with no code to compile and no plugin to install.
# Pre-call deny — block a class of calls before they execute
[[guard]]
match = "shell(command=^rm\\s+-rf?)"message = "rm -rf blocked."# Conditional rule — only fires after the agent ran git status this session
[[guard]]
match = "shell(command=git push)"when = ["+shell(command=git status)"]
message = "Review changes before pushing."
Layer
When it runs
What it does
Guards
Before a tool call
Deny by capability, argument regex, and session history. A match returns a denial instead of executing the call.
Hooks
After a tool result
A non-zero exit injects stdout into the agent's inbox — lint and format failures become automatic corrections without restarting the turn.
Validators
After a turn
Scripts the agent reads on its next turn. This replaces "approve this change?" prompts in autonomous loops.
Need machine-readable results? Pass
--schema schema.json
to constrain the final response to a JSON Schema (requires a model with structured-output support). See
Structured output
.
Features
Feature
What you get
Learn more
Specialists & taps
Packaged agents with model, prompt, MCP servers, and permissions; installs their tool dependencies on first use
octomind run developer:general # general dev, language skills auto-activate
octomind run doctor:blood # blood-test interpretation specialist
octomind run lawyer:sg # legal specialist
Running a specialist fetches its manifest from the tap registry, installs any required binaries, resolves credentials, starts the right MCP servers, and then opens the session.
Build and register your own:
octomind tap init yourteam/my-tap # scaffold, validate, git-init, and register locally
octomind tap yourteam/my-tap # on another machine, after publishing to GitHub
The
octomind-
prefix is added automatically:
yourteam/my-tap
maps to the repository
yourteam/octomind-my-tap
.
scoop bucket add muvon https://github.com/Muvon/scoop-bucket
then
scoop install muvon/octomind
Cargo
(Rust 1.95+)
cargo install octomind
Docker
docker run --rm ghcr.io/muvon/octomind --help
From source
git clone https://github.com/muvon/octomind.git && cd octomind && cargo build --release
The install script detects your OS and architecture (Linux and macOS on x86_64/aarch64) and installs to
~/.local/bin/
. Pass
--install-dir <DIR>
or set
OCTOMIND_INSTALL_DIR
to override. On Windows (x86_64/aarch64),
install.ps1
installs to
%LOCALAPPDATA%\octomind\bin
and adds it to your user
PATH
; it honors
OCTOMIND_INSTALL_DIR
and
OCTOMIND_VERSION
too.
install.sh
still works from Git Bash or MSYS2.
Command not found?
Add the install directory to your
PATH
:
export PATH="$HOME/.local/bin:$PATH"
Building from source requires
protoc
; see
Building from source
for per-OS prerequisites.
Verify:
octomind --version
octomind config # generate the default config
octomind run # start your first session
Octomind Cloud
—
octomind login
(device-code sign-in, like
gh auth login
) stores a gateway key locally. The default config already uses
octohub:auto
.
Learn more
.
Bring your own key
— set the provider's environment variable (
OPENROUTER_API_KEY
,
OPENAI_API_KEY
,
ANTHROPIC_API_KEY
,
DEEPSEEK_API_KEY
, …) and point the model tables at it. The supervisor and compression profiles also default to
octohub:auto
, so update all three:
[model]
name = "openrouter:google/gemini-2.5-flash"
[supervisor.model]
name = "openrouter:google/gemini-2.5-flash"
[compression.model]
name = "openrouter:google/gemini-2.5-flash"
Config lives at
~/.local/share/octomind/config/config.toml
on macOS and Linux, and under
%LOCALAPPDATA%/octomind/config/
on Windows. Set
OCTOMIND_DATA_DIR
to override the data root.
Octomind reports anonymous usage: which commands, tools, and models are used, plus timings, token counts, and error kinds. It never sends your code, prompts, file paths, tool arguments, or environment values. Opt out in any of three ways:
export DO_NOT_TRACK=1 # the cross-tool standard, honored firstexport OCTOMIND_TELEMETRY=0 # for subsequent commands in this shell# or set `telemetry = false` in config.toml
The most impactful contribution isn't code —
it's specialist agents.
A cardiologist publishing
doctor:medications
. A tax attorney publishing
lawyer:us
. A security researcher publishing
security:owasp
. One TOML file, and everyone facing that problem gets a specialist-grade AI.
Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 2028
Bleeping Computer
www.bleepingcomputer.com
2026-11-03 10:00:10
Gartner predicts that security operations centers will have 50% more engineers than analysts by 2028 as AI agents take over routine alert handling. Prophet Security examines how AI is reshaping SOC roles, from analyst responsibilities and detection engineering to threat hunting and exposure manageme...
If the prediction holds, the people who build and tune a SOC's systems will outnumber the people who work its queue.
Gartner starts its reasoning with alert handling. The report finds that AI SOC agents already cut alert-handling work significantly for common and traditional detection use cases. It describes this as the end of alert processing as the SOC's primary function.
From there, the report works through what that means for the people in the SOC. Analysts move from triage to case ownership, and entry-level roles need a new way in.
Detection engineering grows into a broader engineering job, the metrics shift from alerts to cases and decisions, and exposure management becomes a standing SOC function.
Prophet Security is offering the full report as a
free download
.
Analysts move from alert triage to case ownership
Gartner's recommendation for analysts is direct: "Human analysts must transition from alert triage roles to end-to-end case ownership and effective response option communication." In practice, the agent investigates the alert, and the analyst owns what happens next.
That means confirming what the agent found, choosing the response, and explaining the options to the people who have to act on them.
The report also holds that AI-assembled case files still need meaningful human validation before a team can rely on them,so analysts spend more of their time judging whether a conclusion holds up and less of it producing verdicts from scratch.
None of this shrinks the team, in Gartner's view. "The SOC will not shrink by 2030," the report states. The people who worked alert volume get redirected toward detection engineering, threat expertise, offensive testing, and exposure management.
Practitioners expect the same. Prophet Security's
State of AI in Security Operations 2026
survey asked more than 250 CISOs, SOC leaders, and practitioners about this. Of those respondents, 57% expect their team size to stay the same, and 9% expect it to grow.
Entry-level roles need a new way in
Many analysts learned the job in Tier 1 triage, and AI is
flattening those tiers
. Working a high alert volume taught them what normal looks like in their environment. Gartner's report addresses how L1 and L2 roles change and the training and staffing changes SOC leaders should make now. If agents take over triage, junior analysts lose the repetitions that built their judgment, unless the team replaces those repetitions on purpose.
Three practices can do that:
Study the agent's work.
When an agent records every question it asked, every query it ran, and the evidence behind its determination, each closed alert becomes a worked example. Junior analysts can check whether they would have run the same queries and reached the same conclusion. At
JBPCO
, the team was able to onboard a new analyst to senior level proficiency within months.
Own cases early.
Gartner's shift to case ownership applies to new analysts too. Giving them end-to-end ownership of lower-risk cases, with a senior reviewer, lets them practice the decisions and response communication the report puts at the center of the analyst role.
Feed corrections back.
Gartner lists "operational feedback management" among the responsibilities of the future detection engineer, and expects analysts to give more feedback to improve AI accuracy. Among Prophet Security's customers, some analysts have already moved from handling alerts to curating the guidance the AI platform uses in its investigations. The same work suits a new hire who is still learning the environment.
The risk to manage is an analyst who only confirms what the agent says. One control is to have analysts work a sample of cases on their own before they see the agent's determination, then compare the two.
Detection engineering grows into SOC engineering
The 2028 prediction rests on a wider definition of engineering work. Gartner describes
detection engineering
expanding into a broader SOC engineering discipline.
The report tells SOC leaders to "redefine detection engineering role descriptions and hiring requirements." The new descriptions should go beyond rule writing to include prompt design, workflow testing, and AI output validation. The report also calls for software engineering practices such as versioning, testing, and rollback.
Each of those maps to work that exists once agents run in production:
Prompt design and guidance:
writing the instructions and context an agent uses to investigate in your environment, such as asset criticality, VIP users and known-benign admin activity.
Workflow testing:
checking an agent workflow against past incidents before it goes live, the way a detection is backtested before it ships.
AI output validation:
sampling the agent's determinations on a schedule and measuring how often a reviewer agrees with them.
Versioning and rollback:
managing guidance and detection changes as code, so a bad change can be traced and reverted.
The analyst hours that agents return also go into
threat hunting
. In the State of AI in Security Operations 2026 survey, 49% of teams that hunt weekly or more said a hunt had surfaced malicious activity their detections missed.
Among teams reporting the lowest hunting frequency, the figure was 8%. A confirmed hunt finding often gives the engineers a new detection to write for their own environment.
The metrics move from alerts to cases and decisions
Gartner's guidance on measurement is short: "Stop recording alert metrics and run the SOC on cases and decisions." The report points SOC leaders away from alert volume, closure rates and
mean time to detect
, and toward case accuracy, cycle time and decision confidence.
One way to put a number on each:
Case accuracy:
review a fixed sample of closed cases each week, from agents and analysts alike, and track how often the reviewer agrees with the determination.
Cycle time:
measure the time from the first signal to a decision on the case, including the response.
Decision confidence:
record how much evidence supports each determination and how often one is overturned later.
Alert counts still help with capacity planning, but they say little about whether a determination was right. The new measures can sit alongside the SOC metrics a team already reports, such as mean time to respond.
Exposure management becomes a standing SOC function
Gartner's report calls exposure management "the emerging SOC capability to invest in before anything else." It calls for continuous threat exposure management (CTEM) to run as a standing SOC function, rather than as an annual or quarterly exercise.
It also predicts that by 2030, SOCs will be largely offensively driven, testing their own business the way an attacker would.
Many security teams have wanted to run this kind of continuous testing for years and rarely had the hours for it. Once agents handle the alert queue, the analysts and engineers who move into exposure work can validate exposures as they appear.
What they find goes to the people writing detections and planning hunts.
Planning the transition
The report's recommendations translate into decisions that are easier to make before an AI SOC rollout than after it:
Map today's roles against the work Gartner expects to grow: case ownership, SOC engineering, hunting and exposure management.
Rewrite the detection engineering job description to include prompt design, workflow testing, and AI output validation, as the report recommends.
Design the entry-level path, including case ownership and feedback work, before triage volume drops.
Record a baseline for case accuracy and cycle time, so the rollout has a before and an after.
Choose one exposure management practice to run continuously instead of once a year.
How Prophet Security helps
Prophet Security is
a leading agentic AI SOC platform
, recognized in Rising in Cyber 2026, an honor voted on by more than 150 CISOs and security leaders. Its platform, Prophet AI, uses specialist AI agents to investigate alerts, hunt for threats, and build and tune detections on the stack a team already runs.
Here is how it maps to the shifts described above:
Case ownership.
Prophet AI SOC Analyst investigates every alert and records every question, query, and piece of evidence behind its determination, so analysts can own the case and check the reasoning. It groups related investigations into one incident and takes only the response actions a team has approved.
SOC engineering.
Prophet AI Detection Engineer keeps a live MITRE ATT&CK coverage map built from a team's own investigations, then builds and tunes detections from what investigations, hunts, and coverage gaps reveal. Each change is backtested against the team's own history and arrives as a reviewable, version-controlled proposal, and by default nothing reaches production until the team approves it. Guidance that changes an investigation step is versioned and testable too.
Threat hunting.
Prophet AI Threat Hunter runs hunts automatically when a severe new threat emerges. Scheduled hunts against coverage gaps, and hunts a team writes as plain-language questions, run on the cadence the team sets. Suspicious findings go to Prophet AI SOC Analyst for a full investigation, and validated ones become candidates for new detections.
Case accuracy.
Prophet Security measures the quality of Prophet AI's determinations through a continuous QA program with ISO 2859-1 sampling audits. When the evidence does not support a verdict, Prophet AI SOC Analyst returns an inconclusive determination instead of guessing.
Read the full report
Gartner's report sets out the roles, metrics and skills a SOC needs as AI agents take over alert handling.
The government’s surveillance powers grew rapidly after Sept. 11, 2001, some in public view and some in secret. EFF suspected but couldn’t prove that the National Security Agency was spying on Americans' communications. The New York Times sat on a story about it for over a year, finally publishing i...
The government’s surveillance powers grew rapidly after Sept. 11, 2001, some in public view and some in secret. EFF suspected but couldn’t prove that the National Security Agency was spying on Americans' communications. The New York Times sat on a story about it for over a year, finally publishing it in December 2005. Then, in January 2006, a retired AT&T technician named
Mark Klein
walked into EFF's office with a manila folder of documents that blew the story wide open.
Welcome to the third episode of “Privacy’s Defenders,” a podcast about the people – lawyers, journalists, hackers, and others – who’ve fought to secure your digital liberties since before most people even knew what the internet was.
In this episode, former EFF Executive Director Cindy Cohn talks with former EFF lawyer
Kevin Bankston
, who was at his desk drafting a lawsuit against AT&T when Klein showed up. Less than two weeks later, EFF sued the phone company on behalf of its own customers in
Hepting v. AT&T
. Cindy speaks again with now-retired Justice Department lawyer Tony Coppolino, who asked for the opportunity to defend the case. He called EFF with a warning after Klein’s documents were filed in court: If they were classified, EFF would be in big trouble. You’ll also hear from Klein himself, and from Carolyn Jewel, a romance novelist and AT&T customer who became the lead plaintiff in
EFF's related case against the NSA
.
It's the story of a secret room in a San Francisco phone company building, a heroic whistleblower, and the people who refused to let mass surveillance stay hidden.
The “Privacy’s Defenders” podcast is a follow-up to Cindy’s book, “Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance,” bringing to life pivotal moments in the voices of those who fought for your rights. Sales of “Privacy’s Defender” benefit EFF, so
pick up your copy today
!
Joanne Elgart Jennings co-produced and created this podcast.
Jarrod Sport co-produced, mixed, and mastered it.
Corinne Ruff is our story editor.
We had additional help from Rachel Estabrook and Alison Broverman.
The original music was composed and performed by Nat Keefe of Hot Buttered Rum with Ben Andrews on the fiddle.
America Votes: 'CEKEVPATIVG EDELDOA'
403 Media
www.404media.co
2026-11-03 09:54:40
Slopfest 2k26 continues with an election, a fanfic fiasco, and World of Slopcraft....
28-Nov-2018
: I’ve added a small update at the end on how to prevent
‘handle collisions’ with a per-slot generation counter
Original Post
:
…wherein I talk a bit about how I’m doing dynamic memory management in C
and C++ these days which basically replaces raw- and smart-pointers with
‘index-handles’.
In my
last blog post
I was mentioning
pointer- and allocation-free programming, but was skipping over
the details. This is what the following blog post is
about.
This is all based on the (sometimes painful) experience of wrestling for 15+
years with fairly big C++ code bases (0.5 to around 1 mloc) where memory is
often managed through smart pointers. The worst case being tens- to
hundreds-of-thousands of small C++ objects, each in its own heap
allocation, pointing to each other through smart pointers. While such code
is quite robust in terms of memory corruption (segfaults and corruption
rarely happens, since most attempts are caught by asserts when dereferencing
smart pointers), this type of ‘object spiderweb code’ is also dog-slow
without obvious starting points for optimization, since the entire code is full of
cache misses. Other typical problems are memory fragmentation and ‘fake
memory leaks’ because a forgotten smart pointer prevents freeing the
underlying memory (I call them ‘fake leaks’ because this type of leaks cannot
be caught by memory debugging tools).
Nothing presented here is particularly new or clever, it’s just
a collection of a few simple ideas which together work fairly well in bigger
code bases to prevent (or at least detect early) a number of common
memory-related problems in C and C++, and may even be useful in higher-level
garbage-collected languages to reduce pressure on the garbage collector.
However, the underlying design philosophy doesn’t fit very well into a
classical OOP world where applications are built from small autonomous
objects interacting with each other. That’s why it’s also quite tricky to
implement those ideas in a big existing OOP code base, where object creation
and destruction happens ‘decentralized’ all over the code.
The approach described here works very well though with a data-oriented
architecture, where central systems work on arrays of data items packed
tightly in memory.
Most of the following blog post is written from a game developer’s
perspective, but should also apply to other areas where a program needs to
juggle a few hundred to a few million objects (or generally ‘data items’) in
memory, and where such items are created and destroyed frequently.
The gist is:
move all memory management into centralized systems (like rendering, physics, animation, …), with the systems being the sole owner of their memory allocations
group items of the same type into arrays, and treat the array base pointer as system-private
when creating an item, only return an ‘index-handle’ to the outside world, not a pointer to the item
in the index-handles, only use as many bits as needed for the array index, and use the remaining bits for additional memory safety checks
only convert a handle to a pointer when absolutely needed, and don’t store the pointer anywhere
I’ll explain each of those points in detail below. But the idea is basically
that common ‘user-level’ code doesn’t directly call memory allocation
functions (like malloc, new or make_shared/make_unique), and reduces the use
of pointers to an absolute minimum (only as short-lived references when
direct memory access to an item is absolutely needed). Most importantly,
pointers are never the ‘owner’ of an item’s underlying memory.
Instead, direct memory manipulation happens as much as possible inside a few
centralized systems where memory-related problems are easier to debug and
optimize.
Move memory management into central systems
In this blog post, a ‘system’ is a (usually fairly big) part of a code base
which takes care of a number of related tasks, like ‘rendering’, ‘physics’,
‘AI’, ‘character animation’ and so on. Such a system is separated from other
systems and ‘user-code’ through a clearly defined function API, and the work
that happens on the system’s data is performed in tight central loops instead
of being spread out all over the code base.
Systems often work on items created and destroyed under control of user code
(but note that creation and destruction of items is different from allocating
and freeing the memory used by those items!). For instance a rendering system
might deal with vertex buffers, textures, shaders and pipeline state objects.
A physics system works with rigid bodies, joints and collision primitives,
and an animation system works with animation keys and curves.
It makes sense to move the memory management for such items into the systems
themselves, because a general memory allocator doesn’t have the
system-specific ‘domain knowledge’ about how data items are processed and the
relationships between data items. This allows the system to optimize memory
allocations, perform additional validation checks when creating and
destroying items, and arrange items in memory for making best use of the
CPU’s data caches.
A good example for this ‘system domain knowledge’ is the destruction of
rendering resource objects with modern 3D APIs: a resource object can not
simply be destroyed immediately when the user code says so because the
resource might still be referenced in a command list waiting to be consumed
by the GPU. Instead the rendering system would only mark the resource object
for destruction when the user code requests its destruction, but the actual
destruction happens at a later time when the GPU no longer uses the resource.
Group items of the same type into arrays
Once all memory management has moved into systems, the system can optimize
memory allocations and memory layout with its additional knowledge about how
items are used. One obvious optimization is to reduce the number of general
memory allocations by grouping items of the same type into arrays, and
allocate those arrays at system startup.
Instead of performing a memory allocation each time a new item is created,
the system keeps track of free array slots, and picks the next free slot.
When the user code no longer needs the item, the system simply marks the slot
as free again instead of performing a deallocation (not different
from a typical pool allocator).
This pool allocation is most likely a little bit faster than performing a
memory allocation per item, but this is not even the main reason for keeping
items in arrays (modern general allocators are quite fast too for small
allocations).
A few additional advantages are:
items are guaranteed to be packed tightly in memory, general allocators sometimes need to keep some housekeeping data next to the actual item memory
it’s easier to keep ‘hot items’ in continuous memory ranges, so that the CPU can make better use of its data caches
it’s also possible to split the data of a single item into several subitems in different arrays for even tighter packing and better data cache usage (AoS vs SoA and everything inbetween), and all those data layout details remain private to the system and are trivial to change without affecting ‘outside code’
as long as the system doesn’t need to reallocate arrays, it is guaranteed that there will be no memory fragmentation (although this is less of an issue in a 64-bit address space)
it’s easier to detect memory leaks early, and provide more useful error messages: when a new item is created a system can trivially check the current number of items against an expected upper bound (for instance a game might know that there should never be more than 1024 textures alive at a time, and since all textures are created through the rendering system, the system can print out a more useful warning message when this number is exceeded)
Public index-handles instead of pointers
Keeping system items in arrays instead of unique allocations has the
advantage that an item can be identified through an array index instead of
requiring a full pointer. This is very useful for memory safety.
Instead of handing memory pointers to the outside world, the system can treat
the array base pointers as ‘private knowledge’, and only hand out array
indices to the public. Without the base pointer to compute an item’s memory
location, the outside code can’t access the item’s memory, even with a lot
of criminal energy.
This has a number of further advantages:
In many situations, code outside the system never even needs to directly access memory of an item, only the system does. In such an ‘ideal’ situation, user code never accesses memory through pointers, and can never cause memory corruption.
Since only the system knows the array base pointers, it’s free to move or reallocate the item arrays at will without invalidating existing index handles.
Array indices need fewer bits than full pointers, and a smaller data type can be picked for them, which in turn allows tighter packing of data structures and better data cache usage (this has the caveat that additional handle bits can be used to increase memory safety, more about this below)
If user code needs to access the memory of an item directly it needs to obtain
a pointer through a ‘lookup function’ which takes a handle as input and returns
a pointer. As soon as such a lookup function exists, the fairly watertight
memory safety scenario outlined above is no longer guaranteed, and the user code
should adhere to a few rules:
pointers should never be stored anywhere, since the next time the pointer is used it may no longer point to the same item, or even to valid memory
a pointer should only be used in a simple code block, and not ‘across’ function calls
Every time a handle is converted into a pointer, the system can guarantee
that the returned pointer still points to the same item that the handle was
originally created for (more on this below), but this guarantee ‘decays’ over
time since the item under the pointer may have been destroyed, or the underlying
memory may have been reallocated to a different location (this is the same
problem as iterator invalidation in C++).
The two simple rules above are easy to memorize and are a good compromise between
not exposing pointers to user code at all, and having a (somewhat costly)
handle-to-pointer conversion for every single memory access.
Memory safety considerations
First, each type of handle should get its own C/C++ type, so that attempting
to pass the wrong handle type to a function is already detected at compile
time (note that a simple typedef isn’t enough to produce a compiler warning,
the handle must be wrapped into its own struct or class - however this could
be limited to debug compilation mode).
All runtime memory safety checks happen in the function which converts a
handle into a pointer. If the handle is just an array index, it would look
like this:
a range check happens for the index against the current item array size, this prevents segmentation faults and reading or writing allocated but unrelated memory areas
a check needs to happen whether the indexed array item slot contains an active item (is not currently a ‘free slot’), this prevents the simple variant of ‘use after free’
finally the item pointer is computed from the private array base pointer and public item index
The resulting pointer is safe to use as long as:
the item array isn’t reallocated
the indexed item hasn’t been destroyed
Both can only happen inside one of the system’s functions, that’s why the two
‘pointer usage rules’ exist (don’t store pointers, don’t keep pointers across
function calls).
There is a pretty big hole in the above use-after-free check though: if we only
check if an array slot behind an index-handle contains a valid item, it’s
not guaranteed that it is the
same
item the handle was originally created
for. It can happen that the original item was destroyed, and the same
array slot was reused for a
new
item.
This is where the ‘free bits’ in a handle come in: Let’s say our
handles are 16-bits, but we only ever need 1024 items alive
at the same time. Only 10 index bits are needed to address 1024 items, which
leaves 6 bits free for something else.
If those 6 bits contain some sort of ‘unique pattern’, it’s possible to
detect dangling accesses:
When an item is created, a free array item is picked and its index is put into the lower 10 handle bits. The upper 6 bits are set to a ‘unique bit pattern’
The resulting 16-bit handle (10 bits index + 6 bit ‘unique pattern’) are returned to the outside world, and at the same time stored with the array slot.
When an item is destroyed, the item handle stored with the array slot is set to the ‘invalid handle’ value (can be zero, as long as zero is never returned as a valid handle to the outside world)
When the handle is converted to a pointer, the lower 10 bits are used as array index to lookup the array slot, and the entire 16-bit handle is compared against the handle that’s currently stored with the array slot:
if both handles are equal, the pointer is valid and points to the same item the handle was created for
otherwise this is a dangling access, the slot item has either been destroyed (in that case the stored handle would have the ‘invalid handle’ value), or has been destroyed and reused for a new item (in that case the upper 6 ‘unique pattern’ bits don’t match)
This handle-comparison check when converting a handle to a pointer works
quite well to detect dangling-accesses, but it isn’t waterproof because the
same combination of array index and ‘unique pattern’ will be created sooner or
later.
But it’s still better than no dangling protection at all (like raw pointers),
or a ‘fake memory leak’ which would happen in similar situations with smart pointers.
Finding good strategies to create unique handles that collide as rarely as
possible is the most important part of course, and left as an excercise to
the reader ;P
Obviously it’s good to use as many bits for the unique pattern as possible, and the
way how free array slots are reused is important as well (e.g. LIFO vs FIFO). It’s
probably also good to write a little creation/destruction stress-test which
checks for handle collisions and can be used to tweak the unique-pattern creation for
specific use cases. A system where items are created and destroyed with a very
high frequency needs more effort (or simply more handle bits) than systems
where item creation and destruction is a rare occurance.
Other useful properties of handles
Apart from the whole memory safety aspect, handles are also useful for other
situations where pointers are problematic:
Handles can be used as shared object identifiers across processes (all you need is
some sort of ‘create_item_with_handle()’ function, which doesn’t create a
new handle, but takes an existing handle as input argument). This is especially
useful for online games where handles can be shared between the server and
all clients in a game session, or in savegame systems to store references
to other objects.
Sometimes it’s useful to create a whole group of related items (for instance
animation keys and curves), and reference the whole item group with a single
handle. In that case some sort of ‘range handle’ can be used, which contains
not only an index (of the first item), but also the number of items in the range.
In some situations it’s also useful to reserve a few handle bits for an item
type if static type checking at compile time isn’t sufficient.
In conclusion, I find it quite surprising how naturally and elegantly handles
solve many problems I encountered in the past with the traditional ‘pointers
to objects on the heap’ model, and how little I miss this model now (and the
parts of C++ that are built around it).
Some real-world examples
The sokol-gfx API is an example of a C-API which uses handles instead of
pointer of rendering resource objects (buffers, images, shaders, …):
…in the post above I was sort of handwaving away the problem of creating
the same unique-tag twice for the same slot, and a nice person on twitter
hinted me about a very simple, elegant and embarrassingly ‘obvious’ solution:
Each array slot gets its own
generation counter
, which is bumped when a
handle is released (can also happen when the handle is created, but bumping
on release means you don’t need a reserved value for “free slots” to detect
an invalid handle).
To check if a handle is valid, simply compare its unique-tag with the current
generation counter in its slot.
Once the generation counter would ‘overflow’,
disable
that array slot, so
that no new handles are returned for this slot.
This is a perfect solution for avoiding handle collisions, but the handles
will eventually run out since all array slots will be disabled eventually. But
since each slot has its own counter, this only happens after
all
handle-bits are exhausted, not just the few unique-tag bits.
So with 32-bit handles, you can always create 4 billion items, with at most
2^(32 - num_counter_bits) alive at the same time. This also means the number of
bits for the unique-tag can be reduced without compromising ‘handle safety’.
It may also be possible to re-activate disabled slots once it can be
guaranteed that no more handles for that slot are out in the wild
(maybe at special places in the code like entering or exiting a level).
Chances are
you’ve seen me on X
: unpacking hundreds of MacBook Pros to deploy in a datacenter. The video hit a nerve: insane enough at the first sight, yet kind of rational if you know what we know now.
So today I want to give some background into what it takes to build custom Mac racks, how we can start macOS instances from scratch in seconds and deliver new Xcode versions
mere hours after Apple releases them
.
So why MacBooks?
Because our customers need Macs. And because Apple didn’t give us another option.
Many of our customers build and test iOS apps. You can't build iOS apps without a Mac. The iOS Simulator only runs on a Mac. Moreover, in order to release an app to the App Store, Apple requires using a recent Xcode version.
xtool
xtool
is cool, but it is not (yet) a serious replacement. So your coding agent needs a Mac.
But still, why laptops? Isn’t it a major waste of screen pixels and keyboard buttons and battery ions? Well yes, Mac Mini would be a better choice for a datacenter. Sure, it has very rudimentary remote management, no redundant power, and a beautiful case that ensures that cooling will be difficult regardless of which side you lay it on. But these are all known challenges that we have learned to manage.
But have you actually tried to order a couple hundred Minis? We have. Ordered in January, delivered in July. Welcome to the world of 2026 when the supply chains are in disarray. Never mind that Apple doesn’t release updated CPU models to all devices at once. So Mac Mini didn’t get M5 cores for 10 months (and then suddenly got M6 before any other device model!). We promise the best and the newest to our customers so we had to be inventive. That’s how the MacBook-in-Datacenter project was born.
Our beautiful Mac racks
Good design takes iterations; and we surely didn’t get everything right from the first try. But I think we have the system nailed down.
Every MacBook is connected to an IP KVM for remote management. Indispensable when dealing with laptops. Unlike Mac Mini, laptop firmware is designed with the screen in mind: some maintenance actions can only be done by clicking buttons in the beautiful GUI.
Of course, every MacBook gets an external 10G Ethernet NIC. Many folks at Namespace are networking geeks and we are proud of the connection speed and reliability that we provide to customers.
And then there is power. So in total, four cables per laptop, forty-eight per shelf, plus twelve for Ethernet, plus KVM wiring. Let’s just say that careful cable management is essential.
Heat management too. Currently we are deploying custom-made holders, designed to wick the heat from the hotspots and guide hot air away instead of blowing it at the nearby machines.
Not the problems we expected: HDMI, FileVault, and USB NICs
Naturally, we expected problems and challenges. Just not where they appeared.
I bet some of you looked at the pic above, saw MagSafe cables plugged in and already started writing a snarky tweet that MagSafe is not safe and may get accidentally disconnected.
And yes, I was worried about that too. But the reality is that we have seen very few cases of MagSafe disconnections.
The most unreliable cable? HDMI! Often thick and inflexible. Tends to fall out every time you touch the shelf.
Luckily by now we found almost perfect cables that bend exactly as we want them to bend. And we bought the entire supply of them. There are zero more of them available to order on Amazon.
Another source of pain: FileVault disk encryption. Or rather decryption. When a MacBook reboots (in an unplanned fashion) it prompts for a password to unlock the local disk. The prompt is shown on the screen (of a closed laptop somewhere in the rack, doh). No problem, we thought: we have the KVM connected just for this case!
Nope, not so easy. The password prompt disappears from the external screen after 5 minutes of inactivity. Then we remembered that macOS Tahoe introduced a useful feature: we could
unlock FileVault remotely
using SSH protocol. Still no luck. On laptops it expires after 5 minutes too. Looks like the only way out of this state is to reboot by physically pressing the button and racing to unlock in time.
Mac reboot
While on this topic, a small tip: you can reboot a Mac in a way that will keep the disk unlocked when you need it:
fdesetup authrestart
.
And then there are simply bugs. Under certain conditions, an external USB NIC stops working and acts as if it is not powered and shows no link. Trying another cable, another NIC, another switch port, no luck. But a quick visit to Network Preferences, deleting and recreating the “network service” in MacOS Settings brings it back to life.
What about Mac Minis and Studios?
At the moment we actually have it easy: M5 and M6 Mac Minis and Studios are coming into our fleet soon. They are way simpler to manage in the DC: they have a built-in 10 Gb network card, they boot up automatically after a power cycle and the OS can be configured entirely automatically via MDM.
But Namespace has some special sauce for the Minis too. We design custom-made shelves that hold the machines with focus on efficient cooling. We have tested a few designs using airflow simulation to arrive at what we are deploying now.
In the end installing Mac Minis is a breeze: unpack them, throw 10 pieces into the holder, connect power and network and press the power button once (famously inconveniently located). From there on automation takes care of them.
Virtualizing Macs
Under the hood a Namespace instance is backed by a virtual machine. We have multiple virtual machine engines integrated into a unified platform to run Linux, Windows, and Mac instances in the most efficient way. This way we can provide the same features that make Namespace special, like
cache volumes
, telemetry, or VPC connections.
Unsurprisingly, our Mac solution is based on Apple’s excellent
Virtualization framework
. It is an embeddable and flexible virtual machine engine. It’s easiest to compare it to Firecracker in how it fits the system architecture: it implements generic VM operations end-to-end as well as typical peripherals.
For completeness, Apple also provides a lower-level
Hypervisor framework
, which is comparable to the KVM API of Linux. For instance QEMU uses it on macOS under the hood. Hypervisor provides a way to execute machine code in isolation, but requires the application developer to implement the bulk of machine architecture and peripherals. It could give us a lot of control, but unfortunately it cannot run macOS (it requires an Apple proprietary environment that third parties cannot, or shouldn’t, try to recreate).
In fact, most competing platforms are built on the same foundation. But the details matter: Apple gives us a few primitives that need to be arranged in just the right way to work fast and be secure. The more interesting thing is to watch how different people solve similar problems with different constraints.
Limitations of Apple Virtualization
A well-known limitation is that Apple only allows two macOS VMs per physical Mac. It can be a Mac Pro with 24 cores and 192 GB memory, yet it is limited to running only two guest VMs. This limitation leaks into our product offering: we can only slice Mac resources in two halves. So we run instances with 6 or 12 cores on 14-core Mac Minis and 8/16-core instances on 18-core MacBooks (we reserve a couple cores for management overhead).
An important consideration of Virtualization VMs is that the virtual CPU is executed by a separate OS process (VMM process in the diagram) from the software integrating Virtualization (here Namespace VM host). If we want to hook some VM behavior or implement custom virtual devices, every interaction with them requires an IPC roundtrip between the VM process and the “host” process. Such context switches are unavoidable and need to be taken into account when designing the system.
Virtual networking
Virtualization framework offers a few ways to connect a virtual machine to the network. For instance, bridged and NAT networking modes route traffic directly from the VMM process to the host network interfaces. These are suitable for VMs running on a local computer where the workload is trusted.
Namespace instances run untrusted code and we need to enforce policies on what a VM can or cannot access (these policies
can also be customer-defined!
). Also we provide a few additional services to the instances that should appear “as if” they were on the local network for the guest system.
This requires us to take full control of guest networking in the mode where we process every packet that comes out and into the VM in software. We based our guest networking on a userspace TCP/IP stack from Google gVisor project and use it to implement an IP gateway/firewall for the instances. This way we minimize exposure of the host OS to unprocessed packets controlled by the guest.
Network packet handling needs to be very efficient, but as outlined above the path involves IPC. The VMM process needs first to pass the packets to the “VM host” process, which then processes and passes them to the network interface. It takes careful implementation and batch processing wherever possible to minimize the number of IPC roundtrips.
The above approach allows Namespace MacOS instances to reach 4 Gbps upstream bandwidth (per
Fast.com
). This is unfortunately still lower than the line rate. We have been exploring alternative approaches, including ideas on how to avoid IPC for network processing entirely. But productionizing the new setup is still left for the future. After all, 4 Gbps is still quite respectable.
VM images
Creating your first VM using Apple Virtualization is very easy: download a macOS installer XIP, use UTM/Tart/any of the dozens of open-source Virtualization wrappers to start a machine, click through Setup Assistant, install Xcode and you are good to go. Now you have a VM image that you can fork and run any workload locally.
But you need to test on multiple versions of iOS, so you install a few iOS runtimes. And then you install the upcoming Xcode beta version (and new runtimes too). And before you know it your VM image has grown to 500 GB (iOS runtime packages are huge).
You also want to have the previous version of macOS for testing that one little thing. Another 500 GB right here. Apple releases the new macOS developer preview, one more image.
And then you realize that the Xcode beta version subtly breaks the non-beta Xcodes on the same system (true story!). After all, Xcode installation bumps the “global” versions of CoreDevice and CoreSimulator. Hence any bugs in the beta Xcode simulator are visible when you’re using ostensibly stable Xcode versions. So now you are maintaining image versions with and without the pre-release Xcodes.
And now you have 2 TB of VM images. On what? A 2 TB MacBook hard drive?
That’s the challenge we faced: we need to build, distribute, and store huge images across the fleet of hundreds of machines.
Build process
Building images is a repeatable process so that we can reliably produce new images when Apple releases new software versions. Building is driven by a script that replicates installation and configuration as a human user would do it (e.g. the build script can run shell commands, click UI buttons or reboot the VM). Wherever possible we stick to using controls designed by Apple to configure the VMs in order to avoid surprising behaviours inconsistent with what a typical local user would be seeing. Naturally, building images is an automated and repeatable process. It is driven by a workflow expressed as a sequence of operations in a YAML file. Operations can be VM control (e.g. reboot), running a shell script or programmatic interaction with the system or setup UI over VNC.
Resulting VM images are handed over to
Namespace internal Image Registry
, in fact the same one that handles Linux and Windows image storage, replication and distribution (covered in
the excellent article by Matteo
). Disk images are of course quite different from normal container images: OCI layers are simple tarballs of files, while disks are generally flat arrays of bytes. Very large arrays in fact. And to a large extent they contain empty space: that’s the disk space that would be available to users as free space.
Naturally, it would be very wasteful to transfer and store the “empty” data in the registry. So we developed a simple format that allows us to preserve the “sparse-ness” of the images when stored in the registry. Unallocated spans of the image take just a few bytes.
And there is another important optimization. Remember the example scenario mentioned in the VM Images section: we have an image of the same system that differs only in addition of an extra Xcode installation. Obviously the latter image is built using the former as a base and most of the bytes are unchanged.
Our storage format preserves the “shallow copy” relationship and stores such images as multiple layers: the base layer is shared between them, while subsequent layers only contain the modified blocks.
Distribution
At this point we have the images in an OCI registry now. But of course Virtualization framework cannot start a VM directly using a disk residing in the registry. It needs to have something on the node itself: a VM disk can be backed by either an image file on the local host SSD, or it can route disk I/O requests to a server using Network Block Device (NBD) protocol. The latter would allow us to intelligently serve highly demanded data from a local cache, while conserving on-device space by not storing unneeded blocks.
But NBD has the same drawback as userspace networking from above: every I/O operation would incur an IPC roundtrip at minimum, including buffer copying and context switches. You see the same pattern as with networking: a very direct hardwired and fast option and an indirect “software-defined” but disappointingly slow option.
At Namespace we value performance a lot, so the choice is clear: we’ll serve the images from the local disk. We need to materialize them from OCI images in the registry on the SSD of every node in the fleet. 500 gig images to hundreds and thousands of nodes. And we need to do it fast.
Obviously, every node naively downloading from the central registry was not going to work. With the example numbers we are talking about half a petabyte of traffic transferred within, conservatively, tens of minutes. The registry (and the network fabric) would need to serve terabits per second!
The bytes that we are distributing are the same going to every node so the obvious solution is to organize a peer-to-peer delivery of these blobs. Each block only needs to be downloaded from the registry once by some node. Then another node that is close by (by certain metric) can download the block directly from the peer and we have two copies. So two more nodes can pull these bytes and so on. The fleet is exponentially flooded.
BitTorrent
Obviously, BitTorrent was a heavy inspiration for this design. But unlike BitTorrent, which works in a public network of untrusted peers, we could make different tradeoffs leading to better efficiency and predictability. But that’s a topic for another post.
Storage
Now the bytes are on the node disk. But remember the storage optimizations we did in the Build Process? With the naive approach of storing the images on disk there are a lot of bytes that are useless: they are either holes or could be shared with another image.
Some of you probably know that these are exactly the types of storage optimization techniques that are possible with modern file systems, namely APFS.
ZFS
Linux users have seen the same features in ZFS.
Using these cool features is also pretty easy: open a new file for writing, seek to offset 100G, write a block. And there you just made a file with a large hole in it. Only the block you wrote is allocated on disk, the rest is 100 GB of imaginary zeroes. When reading the file you won’t even notice the holes. The OS will return actual zeros.
Sharing the blocks is similarly transparent: just use the
cp -c
mode or
clonefile
syscall. The new file will share the same disk blocks and essentially not take any space.
Writing to the cloned file is also transparent: as soon as you try to overwrite some blocks, these particular blocks will be allocated on the disk, while the shared portion will remain shared.
What’s next?
The pace at which we are expanding our fleet is increasing and the experience from all the above has transformed into a repeatable process. We know exactly how long it takes to bring a MacBook rack into prod. The rack assembly line is dialed in. DCOps people are trained. Disk images are built and distributed. We can bring whatever number of machines our customers need into the fleet when we need to (well, as long as we can purchase them at all).
We can still do better! What if there was a “holy-grail” device to host a shelf of MacBooks, providing power, ethernet and KVM connections over a single USB-C cable? It should be possible, yet there is currently no hardware on the open market that satisfies our requirements. So we are working on something very custom.
Or maybe we’ll do another crazy thing? What if we deploy phones to the datacenter? See what the future brings on our X soon!
OpenAI seems to be silently re-enabling model training on Codex chats
My company is pretty paranoid about leaking IP to the frontier labs through prompts, so we've all been diligent about disabling data sharing in Codex/Claude Code/etc. But yesterday my coworkers and I noticed that the setting had been silently reenabled in Codex. None of us knowingly opted back in.
You can check your settings here: https://chatgpt.com/settings/data-controls. Look for "Improve the model for everyone".
Curious if this is an isolated issue or something more widespread.
EDIT: looks like this has been noted before https://news.ycombinator.com/item?id=49643556
EDIT: apparently you can also turn off data sharing here: https://privacy.openai.com/policies?modal=take-control
Chance Miller Reviews the New A20 Pro iPad Mini
Daring Fireball
9to5mac.com
2026-11-03 09:51:14
Chance Miller, writing at 9to5Mac:
Unfortunately, the new iPad mini’s screen has one limitation: it
doesn’t support ProMotion, or a 120Hz refresh rate of any kind.
Instead, it’s still locked to 60Hz. This is an incredibly
frustrating decision that I can’t quite wrap my head around.
Apple touts ...
Apple’s smallest iPad has gotten its biggest update in years. The new iPad mini features a much thinner and lighter design, a larger OLED display, water resistance, and the powerful A20 Pro chip.
I’ve been testing the new iPad mini, and there’s a lot to like — but also a couple of frustrations. Here’s everything you need to know.
The new iPad mini lives up to the “mini” name even more than its predecessor. It’s significantly thinner, down from 6.3mm on the previous iPad mini to 5.4mm on the new model. In fact, that puts it very close to the ultra-thin iPad Pro and the unfolded iPhone Duo. Here’s how it compares:
Device
Thickness
13-inch iPad Pro
5.1 mm
iPhone Duo (open)
5.2 mm
11-inch iPad Pro
5.3 mm
iPad mini (2026)
5.4 mm
iPhone Air
5.6 mm
iPad Air (11-inch and 13-inch)
6.1 mm
iPad mini (2024)
6.3 mm
iPad (A16)
7.0 mm
iPhone 18 Pro
8.75 mm
iPhone Duo (closed)
11.3 mm
The new iPad mini is also significantly lighter, dropping from 293 grams to 255 grams. That puts it in the realm of the iPhone Duo, for comparison’s sake:
Device
Weight
iPhone Air
165 g
iPhone 18 Pro
211 g
iPhone Duo
254 g
iPad mini (2026)
255 g
iPad mini (2024)
293 g
11-inch iPad Pro
444 g
11-inch iPad Air
464 g
iPad (A16)
477 g
13-inch iPad Pro
579 g
13-inch iPad Air
616 g
The reduction in weight and thickness was immediately noticeable when I picked up the new iPad mini. It feels significantly nicer to hold, more premium, and less “dense” in my hands.
The new iPad mini features an 8.5-inch screen, a slight increase from the previous generation’s 8.3-inch display. The overall footprint is mostly the same (the new model is actually about 2.2mm narrower). The larger screen is possible because the new iPad mini’s bezels are 24 percent thinner than before.
In addition to allowing a bigger screen in the same form factor, the narrower bezels also modernize the iPad mini’s overall look and feel. The bezels are noticeably slimmer than the iPad Air and base model iPad, and slightly thinner than the iPad Pro.
With smaller bezels, a thinner chassis, and a lighter weight, the new iPad mini feels significantly more premium than before. It reminds me less of the base model iPad or iPad Air and more of the iPad Pro, just shrunken down.
Display technology
The big news about the display, though, is the switch to OLED. This marks Apple’s first non-Pro iPad to offer an OLED screen. It’s not the fancy tandem OLED display of the iPad Pro, but it’s a huge improvement over the previous model’s LCD panel.
The new iPad mini offers SDR brightness up to 600 nits, up from the previous model’s 500 nits max. The iPad mini also supports HDR content, with up to 1200 nits peak brightness.
The new iPad mini’s screen is undeniably an improvement over its predecessor. All of the inherent benefits of OLED apply here, including better colors, improved contrast, higher brightness, and more.
Unfortunately, the new iPad mini’s screen has one limitation: it doesn’t support ProMotion, or a 120Hz refresh rate of any kind. Instead, it’s still locked to 60Hz. This is an incredibly frustrating decision that I can’t quite wrap my head around.
Apple
touts
the iPad mini’s OLED screen as offering significantly faster pixel response time than the previous generation’s LCD panel, leading to improvements like smoother scrolling and reduced motion blur.
I’ve noticed that things like swiping between Home Screen pages, scrolling social media, and system animations are noticeably smoother. They aren’t, however, as smooth as an Apple device with a ProMotion display, and they’re not a substitute for a higher refresh-rate display.
I’m sure Apple knows the iPad mini’s market, and it seems to have decided not to prioritize ProMotion based on that information. However, as someone who has longed for a so-called “iPad mini Pro” for years, I’m disappointed by the decision. The new iPad mini’s screen is
so much
better … I just wish Apple had gone that extra step and added ProMotion. We’ve reached a point where ProMotion should be table stakes, especially after Apple brought it to the base iPhone 17 last year.
Nano-texture
For an extra $100, you can upgrade the new iPad mini to have a nano-texture display (on the 256GB and 512GB models).
I’m a huge fan of Apple’s nano-texture display and have it on my 14-inch MacBook Pro. On the iPad mini, I think it makes even more sense.
The iPad mini is ultra-portable, and you naturally carry it around and use it in different lighting environments. The nano-texture glass helps reduce reflections and glare in a wide variety of lighting conditions. I also really like the combination of the iPad mini’s book-like size and the nano-texture finish.
There is a slight tradeoff in color vibrancy compared to a glossy OLED screen, as on other Apple devices with nano-texture, but it’s a very minor difference in my experience. The screen still looks fantastic.
Speakers and durability
One of the more interesting changes with the new iPad mini is something Apple calls the “Acoustic Display.” Instead of traditional speakers with visible grilles, Apple has developed a new system that uses the display itself to produce sound.
Essentially, Apple has designed special woofers that vibrate the display to produce low and midrange frequencies. For higher frequencies, custom tweeters are hidden between the glass and aluminum enclosure. Apple says this new system delivers louder audio, “punchier” bass, and clearer highs, despite the iPad mini’s significantly thinner design.
In practice, I think the new iPad mini sounds great. I’d choose headphones or an external speaker for serious music or video consumption, but day-to-day the iPad mini’s built-in speakers are perfectly adequate. (I’d bet that this Acoustic Display technology shows up in future iPhones too, and the iPad mini is serving as a test bed of sorts.)
The Acoustic Display also plays an important role in another major upgrade: water and dust resistance. The new iPad mini is IP67 rated, which means it can be immersed in 1 meter of freshwater for up to 30 minutes. It’s the first iPad to have an official water-resistance rating.
Adding water resistance to the iPad mini is particularly notable given its size and portability. I naturally find myself wanting to take it everywhere, and water resistance makes that more feasible.
One use case where all these improvements really come together is reading. The thinner and lighter design, nano-texture glass, and water resistance make the new iPad mini the most compelling iPad yet to serve as an e-reader.
Performance
The new iPad mini is powered by Apple’s A20 Pro chip, which I already covered in detail in
my iPhone 18 Pro review
. The short version: the A20 Pro chip gives you plenty of power for anything you can throw at the iPad mini today.
One detail worth calling out is that Apple uses two different versions of the A20 Pro in the iPad mini. The 128GB and 256GB models feature a five-core CPU and 16-core Neural Engine, while the 512GB model gets a six-core CPU and Dual 16-core Neural Engine. All three configurations feature the same seven-core GPU.
I don’t think anyone should buy the 512GB version of the iPad mini just for those extra cores. You should pick your iPad mini configuration based on how much storage you need, not the version of the A20 Pro chip. You don’t need to worry about performance with the new iPad mini. And perhaps most importantly, the A20 Pro chip ensures the iPad mini has enough headroom for the future.
9to5Mac’s Take
There’s been a lot of consternation about where the iPad mini fits in a world where the iPhone Duo also now exists. It’s a fair question. After all, when the iPhone Duo is unfolded, the two devices share a similar form factor … but that’s really where the similarities end.
The iPad mini offers the full-fledged, unapologetic iPadOS experience. It supports the full multitasking prowess of an iPad Pro, including windowing and the menu bar. The new iPad mini also supports extended display mode, so you can plug it into an external display and extend your iPad experience there.
The iPad mini also gets iPadOS app layouts, and most importantly, a desktop-class browsing experience in Safari. It’s a remarkably capable device in a remarkably compact form factor. It fits where other iPads can’t, yet it runs the same version of iPadOS as other iPads.
The new iPad mini does all of that, but better than before. The thinner, lighter design paired with smaller bezels gives the new iPad mini a meaningful visual refresh. The added water resistance means you can do even more with the compact and pocketable iPad mini design.
But all of this comes at a higher price of $699. This marks the second price increase for the iPad mini this year. It started the year at $499, rose to $599 as part of
Apple’s broader price increases
in June, and is now $699 as of this refresh.
The new iPad mini also still starts with 128GB of storage. Increasing the base storage to 256GB would’ve helped ease some of the pain of that price increase. It’s also getting increasingly hard to manage a device with 128GB, particularly with the
storage needs
of Apple Intelligence and Siri AI. The lack of ProMotion and Face ID also make the price increase sting more.
Ultimately, the iPad mini form factor is a joy to use. The design feels great in the hand, and having the full iPadOS experience in such a compact device remains impressive. It’s not quite the “iPad mini Pro” I’ve always wanted, but it’s big upgrade to a form factor that I’ve always loved.
We got extraordinarily lucky with pretraining data. Training large language models required a truly vast corpus of text, and it was just kind of lying around.
Not exactly by accident. For the last 50 or so years, humanity has been busily creating and digitizing an enormous public record of human knowledge. Most obviously, Wikipedia’s editors have assembled the most comprehensive encyclopedia humanity has ever produced. A vigorous open source movement created a couple petabytes of software source code. Communities on Stack Exchange spent more than a decade asking questions, arguing about answers, and carefully curating the results. Scientists uploaded their papers to ArXiv. Project Gutenberg—almost as old as the internet itself—produced digital editions of out-of-copyright books.
And of course, billions of people made websites, commented, had arguments both petty and profound, uploaded photos and paintings, wrote fiction, and—believe it or not—sometimes went and told lies on the internet.
Efforts like Gutenberg, Internet Archive, Wikipedia, ArXiv, and Stack Exchange were self-conscious efforts at creating a digital knowledge commons. And then there’s Common Crawl. Since 2007, Common Crawl has been regularly archiving snapshots of a sizable subset of the internet, and then making it freely available for anyone to access and use. Today, there’s something like 10 petabytes of data archived by Common Crawl.
This vast commons of human knowledge formed the basis for the LLM revolution. GPT-3 was trained on about 60% Common Crawl-derived data. The
original Llama data mix
was almost entirely extracted from the internet commons.
1
That’s not to say that refining the raw material of the web into LLM-ready chunks was simple. Web pages are extraordinarily messy creatures, and a large fraction of the web is spam or junk intended to fool Google’s crawler. People are still writing papers on how to do filtering, HTML-to-text extraction, old document OCR, and synthetic rewriting.
Though the incumbent large players have seemingly moved on with their own custom web crawlers (
Cloudflare reports that over half of crawler traffic is for AI
), modern open LLMs like
Nemotron
and
our own
still rely on this commons for the vast majority of their pretraining data. Without continued access to this commons, truly open LLMs cannot exist.
These days, the focus of frontier AI research has shifted to posttraining, particularly so-called “agentic” AI. Like pretraining before it, posttraining requires vast amounts of compute and vast amounts of data. However, there isn’t the same ready-made trove of raw data lying around for posttraining. In short, there is no posttraining data commons.
The fundamental difference is simple: Pretraining consumes documents, while posttraining consumes tasks.
2
But “task” here is already an abstraction. The tasks used by reinforcement learning for posttraining are not the same tasks that humans perform in the world.
Human tasks are situated in a particular moment. Someone wants something; they act in the world to get it; the world responds; the goal changes as they learn; and, eventually, they succeed, or fail, or change their goals. Once attempted, the task is gone. The same conditions will never quite occur again.
In this sense, human tasks echo oral culture: An oral story is as much an event as it is an object. The telling of a story changes with the teller, the audience, and the occasion. Writing the story down makes it durable and repeatable, but it freezes a single telling.
Encoding a human activity as an RL task does something similar. RL tasks are frozen, schematized, and legible, while human-world tasks are adaptive, conditional, and ephemeral. An episode of situated action is transmuted into an object that can be performed again and again.
For an RL task, we have to preserve at least three components: a
world
, an
intent
, and a set of
tools
for interacting with the world. For reinforcement learning, we also need a
grader
that looks at the results of the agent’s actions and determines how well the intent was satisfied.
Humans have spent millennia building institutions around durable knowledge stored in the form of documents: books, libraries, archives, the internet. We have had much less time, developed much less infrastructure, for making action durable.
Except for one very important exception: software. Software engineering is, in large part, the practice of writing tasks down. Software engineers have spent decades turning work into durable artifacts: preserving the world in which the work happens, recording the intent behind it, and leaving a trace of the actions taken. It is no wonder that agentic AI came for software first.
Computers are built around determinism. Restart a computer, and its state is more or less a clean slate, aside from any information—any documents—you've chosen to write down. (Mom, this is why I keep telling you to reboot your computer.) This determinism is perfect for reinforcement learning. Reinforcement learning algorithms work best when an agent can attempt a task, have the changes discarded, and try again from the exact same starting point.
Over the last few decades, software has undergone a series of transformations to double down on the determinism of computers. Version control preserves the history of programs. Continuous integration and formalized unit testing libraries record procedures for exercising them. Virtual machines and containers encapsulate a controlled snapshot of the world a program needs to function in. None of this is perfect. Software too flows: system clocks move, versions change, packages disappear. Bits rot. Debian has been working systematically on reproducible builds since 2013, and more than a decade later still does not describe the distribution as fully reproducible.
Despite these limitations, open-source software has created a commons of preserved worlds and recorded actions. But turning the software commons into tasks that can be consumed by machine learning is not easy. And it’s hard in a way that is qualitatively different from cleaning web text: the missing information may never have been recorded at all. Turning software repositories into posttraining data therefore looks less like curation and more like manufacturing.
To build a task, we need the world, tools, intent, and a grader. In theory, the open source software commons gives us all of these:
The
world
consists of the software repository at a point in time, its dependencies and the container and build machinery.
The
tools
are just the tools of software engineering and computer use: the shell, compiler, browser, etc.
The
intent
we can recover from GitHub issues or pull requests.
The
grader
is whether the tests pass.
It turns out that this is basically the framing used by the original
SWE-bench
. And it turns out to be both surprisingly difficult and much too simple. They crawled GitHub issues and pull requests from 12 Python repositories, yielding a bit over 90,000 PRs. Of these, only about 1 in 8 could be readily mapped to the frame: they either didn’t get merged, or weren’t linked to an issue, or didn’t change a test. They lacked a clear mapping for
intent
or the
grader
.
Of the remaining 11,407, about 80% couldn’t be turned into executable tasks. For example, the package could not be reconstructed at that state, or there were weird runtime errors. These could not have their
worlds
reconstructed or their
graders
failed. This left the 2,294 tasks that comprised the original SWE-bench.
A year later, OpenAI set about creating SWE-bench Verified. OpenAI hired 93 experienced Python developers to manually review 1,699 randomly selected SWE-bench tasks. Of these, more than two thirds were flagged for removal due to underspecified prompts, unfair tests, or other major issues. After filtering, they produced a pool of 500 “Verified” tasks. Then, a later audit of a problematic subset of the tasks found that another sixth or so of the overall 500 were also broken, despite the extensive set of checks leading to that point.
I’m not trying to pick on SWE-bench. It’s one of the better constructed public coding datasets available. When examining the compilation of tasks in
TaskTrove
, we found that in one subset of 5,000 converted Java tasks,
more than 90% had to be discarded
during repair: tests did not parse, checked nothing, or depended on missing project context and external services. In
another Python subset
, almost 98% of the inspected verifier bundles could not even start their tests because dependencies were missing. And executability is only the beginning. An
audit by Vals
found that two thirds of the 2,698 coding environments in Xiaomi’s MiMo v2.6 public release still contained reference fixes recoverable from Git. In one demonstrated case, the agent copied the fix and passed all five hidden tests. Making good tasks is hard.
And again, software is the easy case! And if even software is so difficult to get right—I didn’t even talk about building sandboxes that your agents can’t hack their way out of, and tasks that don’t have a predefined unit test for a grader—then how difficult must the rest of the economy be? How can the frontier AI companies reliably encode the rest of so-called “economically valuable human activity,” the work done by lawyers, scientists, salespeople, doctors, etc., as the kind of formal repeatable tasks that RL needs?
For the rest of the economy, there is not even the beginning of a public “task commons.” So, what’s a frontier lab to do? Pay those lawyers, scientists, salespeople, and doctors to fit their work into the RL task frame, to inscribe the ephemeral tasks of their human world into the ones consumed by agents. They create the tasks, environments, rubrics, verifiers, simulators, etc. All of this work itself must be coordinated and verified. And thus we have the
raison d’être
of the rapidly expanding posttraining data industry.
So, what are we, the open models community, to do? We don’t have a Common Crawl for posttraining because there is no commons to crawl. Instead, a posttraining commons must begin with large-scale and systematic inscription, with finding and transmuting human tasks into RL tasks. (Or we figure out a better paradigm. That would be better.)
This is not an easy lift. A large fraction of the pretraining commons was already being produced in roughly the right form. People wanted to publish webpages, source code, papers, and books for reasons that had nothing to do with training language models. But the human activity that produced those artifacts—the goals, decisions, revisions, negotiations and false starts—is mostly gone.
Luckily, we aren’t starting from zero. The open source commons is a treasure trove of partially inscribed tasks. Other parts of the economy, other forms of human activity, leave traces too: documents with tracked changes, logs, procedures. And, increasingly, agents are capable of helping us reconstruct tasks from outputs and traces, and to inscribe them into RL tasks.
In one reading, this all reduces to “we just need to make a whole lot of RL environments” as quickly as possible. And at a surface level that is true. But the deeper task—the human task—is deciding which parts of human activity we want to inscribe into a durable form legible to reinforcement learning, and then building the machinery and institutions to do so systematically. The approach taken in the construction of
GDPval
points at one way of achieving that aim.
At this point, the automation of legible tasks in the economy seems inevitable, if only through the sheer weight of capital being poured in. The question is whether the resulting inscriptions of human work become private assets held by a few companies, or whether we do the work to make some meaningful fraction a commons that everyone can build on.
As AI becomes capable of performing more and more human work, the ability to develop and direct that capability becomes an enormous source of economic power. If only a handful of companies can amass the tasks and environments necessary to train frontier models, then those companies will have an outsized say in what kinds of work AI can do, and in who benefits from that work.
A posttraining commons would let universities, nonprofits, independent researchers, and companies develop capabilities that the large AI companies might never prioritize. A commons would give all of us the ability to participate meaningfully in shaping how AI is developed and deployed, and a stronger voice in the policies and norms that govern it. Otherwise, we risk ceding enormous power over perhaps the most consequential technology in generations to the commercial interests of a few enormously wealthy firms.
We got lucky with pretraining. The people who built Wikipedia and Stack Exchange weren’t making training data; they were making things they wanted to exist. But no one is going to inscribe the work of a tax attorney into a reproducible environment for fun. If there’s going to be a posttraining commons, someone has to build it deliberately, knowing what it’s for, and what it might cost.
That’s harder. But it also means that, for once, the commons is something we get to choose.
The original posttraining data largely consumed so-called preference data, but its scale is miniscule compared to modern agentic RL.
↩
Cite this post
@misc{hall2026_there_is_no_posttraining_data_commons,
author = {Hall, David},
title = {There is no posttraining data commons},
year = {2026},
month = {oct},
howpublished = {\url{https://www.openathena.ai/blog/there-is-no-posttraining-data-commons/}},
note = {Open Athena Blog}
}
Binance battles to save its brand after record $6.3bn crypto hack
Guardian
www.theguardian.com
2026-11-03 09:45:30
World’s largest crypto exchange faces fallout from angry customers, and Lula wins with WhatsAppThis was originally published in TechScape, a newsletter about how technology shapes our lives. Sign up to receive it hereThis week in tech, we’re discussing the fallout from the multibillion-dollar hack o...
This week in tech, we’re discussing the fallout from the multibillion-dollar hack of Binance and the significance of Lula’s political mobilization on
WhatsApp
.
And if you’ll be at Web Summit in Lisbon next week, drop me a line! I’ll be there moderating panels on open-source
AI
and human agency in the age of AI agents.
After a multibillion-dollar hack, Binance faces a crisis of trust
The world’s largest
cryptocurrency
exchange endured the world’s largest online theft late last week. Binance was hit by a $6.3bn heist that, according to experts, was likely the work of North Korean hackers.
More than $2.5bn of the $6.3bn was taken in one transaction alone. A
Binance
engineer’s laptop was infiltrated, which in turn allowed the attackers to drain wallets. Binance later added that there were “additional points of breach” in its systems. The exchange said on X it would “cover all losses” and that “user funds are safe”. It also said it had frozen about half the funds targeted in the hack, stopping the thieves from making off with that tranche of cryptocurrency.
Most customers won’t have legal protections. Crypto users are not covered by formal deposit protections in countries such as the US, UK or Australia, meaning they won’t be reimbursed by their governments for their losses if an exchange is hacked or goes bankrupt. In Australia, you can claim a capital loss on your tax return if you can offer proof that a crypto asset was lost or stolen.
Binance, which was hacked last week.
Photograph: Beata Zawrzel/NurPhoto/Rex/Shutterstock
As Binance worked to contain the technical damage from the hack, it faced fallout from angry, scared users. The company announced Sunday afternoon that it had processed $4.6bn in withdrawals and $1bn in deposits, resulting in a net outflow of about $3.6bn – representing 2.1% of its $171bn in total assets under management.
Yesterday, former Binance CEO Changpeng Zhao warned that crypto scammers are now in “overdrive”, circulating screenshots of fake recompense schemes that promise $150 in free compensation for withdrawal suspensions. Binance has confirmed that it is false information and the screenshots are digitally altered. The hack has also spooked traditional financial markets, with investors also pulling out funds from Bitcoin exchange-traded funds in the US.
Yi He, co-founder of Binance and longtime partner of Zhao, has said that the company’s top priority was to “ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations”. Alongside a proof of its reserves, the company tweeted: “Our commitment is unchanged: Binance will absorb the financial impact of the stolen funds, not our users.”
The name Binance was already associated with crime before the hack. Zhao pleaded guilty to violating US anti-money laundering laws in 2023 and stepped down as CEO. It’s no FTX, but the company faces an uphill battle to save its brand from $6.3bn worth of permanent damage.
Less than two weeks ago, Brazilian president Luiz Inácio Lula da Silva was accusing Meta of suppressing his posts on Instagram and Facebook and attempting to derail his campaign. Flávio Bolsonaro, his opponent and the son of the previous president, had all the momentum after the country’s first round of elections. Lula’s supporters felt like they would be crushed under the rightwing wave sweeping over Latin America. Meta denied bias but acknowledged technical failures in response to Lula’s accusations.
We will likely never know the full truth of what Meta did or did not do for Lula. Individual algorithmic moderation mistakes – usually a few egregious ones among millions of otherwise unobjectionable choices – seem like bias in times of heightened political tension. That’s what Meta says happened in Brazil. Raging against those errors makes for engaging posts, which outsizes the glitches’ significance. The history of accusations against Meta of political interference is arcane and complicated. The motives of everyone involved are suspect. Independent studies conducted after the 2020 US election showed that
rightwing content traveled further on social media
than leftwing posts do. That small data point indicates it may not have been the heavy thumb of Meta on the political scales in Brazil.
During the second-round runoff, Lula, 81, bought a smartphone for the first time and assembled WhatsApp groups of millions of supporters who mobilized in response to the threat of yet another Bolsonaro. (WhatsApp is owned by Meta.) At the helm of these channels was André Janones, the captain of “Lula’s army” and a federal deputy from the state of Minas Gerais. Janones issued daily social media challenges to the supporters he called his “soldiers”.
Lula celebrates with supporters after winning his presidential runoff against Flávio Bolsonaro.
Photograph: Alexandre Meneghini/Reuters
The successful campaigning via WhatsApp bears out a prediction that Meta CEO Mark Zuckerberg made in 2019: that the “digital living room” of private direct messaging and group chats would eclipse the “town square” style of public social media feeds. Lula’s supporters gathered in channels full of friendly faces to participate together in on-the-ground canvassing. Janones wasn’t posting to convert the general populace to his side. He was motivating the base with online communication to pursue IRL action. Members of Lula’s army were explicitly instructed supporters to neither share nor respond to posts from the opposition, displaying an understanding that any engagement boosts algorithmic reach in public social media.
Lula won the Brazilian election by 5 million votes, securing an unprecedented fourth term. After Janones’s innovative use of WhatsApp, Lula’s accusations seem like politicking borne of desperation. Lula also plays into longstanding conflicts between Brazil and tech giants like Meta. A decade ago, the country’s supreme court suspended WhatsApp, the very app Lula rode to victory, in a fight over end-to-end encryption. The court has also ordered investigations into Google and Telegram executives. In 2024, a supreme court justice banned Elon Musk’s X from the country after Musk refused to ban accounts threatening democracy and froze the financial accounts of his satellite internet company Starlink.
Having a common enemy helps to galvanize a base of supporters. In Lula’s case, the enemy was an easy target: a foreign tech company accused of interfering in Brazil’s democracy, as did Jair Bolsonaro, Lula’s longtime foe. According to my colleague
Jonathan Watts
, among the most popular chants of Lula supporters was “Hey Meta, vai tomar no cu!” (Hey Meta, go take it up the arse!).
Paste a Japanese YouTube video and JIVX turns its lines into sentences you type or say, each one graded. Or practice with a video someone has already added.
Ashley Hinson’s Digital Chief Oversees Firm Paid Millions to Push Israeli Propaganda
Intercept
theintercept.com
2026-11-03 09:39:10
The GOP candidate for Iowa’s open Senate seat tapped the co-founder of a consulting firm with a $9.9 million Israel contract.
The post Ashley Hinson’s Digital Chief Oversees Firm Paid Millions to Push Israeli Propaganda appeared first on The Intercept....
The person in
charge of digital strategy for the Senate campaign of Iowa Republican Rep. Ashley Hinson helps run a company that received nearly $10 million to influence Americans with pro-Israel propaganda.
In September 2025, Hinson — who is battling Democratic state Rep. Josh Turek in a tight race that could decide control of the Senate — tapped Abe Adams to lead her campaign’s digital efforts.
Adams is a co-founder and managing partner of Targeted Victory, a digital consulting firm that has been used by high-profile Republican candidates such as Ted Cruz and Marco Rubio. Targeted Victory shares an address and much of its staff with Targeted Communications Global — a related company with no discernible online presence. Both are subsidiaries of marketing company Stagwell Global.
Israel awarded Targeted Communications a $9.9 million contract in March 2025 focused on social media and paid advertising, documents show. By October 2025, the firm was at work pitching news content and guests on Fox News and CNN, and creating
YouTube ads
suggesting young Iranians have been educated to believe the “most sacred thing they do is stab a Christian in the heart.”
A June 2026 Department of Justice
FARA filing
from Targeted Communications details much of the firm’s work for Israel. The document lists 10 registered foreign agents working on the Targeted Communications contract for Israel. Six of them are identified as Targeted Victory employees on the company’s website or their LinkedIn accounts. Adams is not named in the filing.
Hinson, Adams, and Targeted Victory did not immediately respond to requests for comment.
Adams is not the only Hinson campaign adviser with ties to Targeted Victory and the Israel lobby. Hinson’s current deputy campaign manager, Addison Lavis, worked at Targeted Victory before serving as Hinson’s campaign manager in her 2023 congressional run. Lavis was previously an intern at AIPAC. Lavis did not immediately respond to a request for comment.
Hinson has received more than $100,000 from AIPAC and related pro-Israel PACs in 2026, and as an Iowa state representative
supported
legislation that prohibited the state from working with any companies that boycott Israel.
Hinson’s political action committee has paid Targeted Victory more than $1.6 million this election cycle for digital consulting and ads — 27 percent of its total expenditures, according to Federal Election Commission
filings
.
Israel’s deal with Targeted Communications is part of a major public relations push that has pumped more than $100 million into swaying public opinion, particularly among young conservatives, back toward Israel.
Apple’s Analyst Calls Have Been Scripted for Decades
Daring Fireball
9to5mac.com
2026-11-03 09:39:03
Bloomberg opinion columnist Dave Lee:
Apple investors and fans hoping to get an insight into the
philosophy of new Chief Executive Officer John Ternus on Monday
were left sorely disappointed. The 51-year-old’s first earnings
call was a timid affair, with Ternus taking cover behind a
carefully wr...
Apple investors and fans hoping to get an insight into the philosophy of new Chief Executive Officer John Ternus on Monday were left sorely disappointed. The 51-year-old’s first earnings call was a timid affair, with Ternus taking cover behind a carefully written script as analysts peppered him with questions.
Lee acknowledged that the slump in pre-market trading will have been largely driven by Apple’s caution about rising expenses in the current quarter. The company said that memory costs were continuing to rise and that building out Siri AI data centers we’re going to add to the RAM bill. But he argued that Ternus missed an opportunity to talk up the company.
In front of Ternus on Monday night was a chance to counteract the gloom and doom by instilling in Wall Street the fundamentals of the Ternus Doctrine — what he sees Apple becoming under his tenure, the “product guy” taking the company to a new era of innovation. Instead, he spoke like a man glancing at the clock and wishing the minutes away.
Ternus fielded some questions but also delegated answers to Chief Financial Officer Kevan Parekh and Chief Operating Officer Sabih Khan, who Apple said would participate in earnings calls moving forward, something the company hasn’t done for years. Ternus projected confidence on the call, but he appeared to stick mostly to scripted marketing points.
9to5Mac’s Take
It will of course take Ternus some time to develop his own style when it comes to all of the varied aspects of the role, including addressing analysts in earnings calls, but I thought he took a measured but optimistic approach. Given the famously reticent style of his predecessor, the criticism strikes me as rather odd.
No pressure, right? Early voting numbers have reportedly slowed since 2025, particularly in the Commie Corridor, which saw a 34 percent drop in early voting this election, but early voting
increased in majority Black districts across the city
, including Central Brooklyn (a 50 percent jump) and parts of Southeast Queens. (By the way, if you live in New York City and procrastinated on voting—and who would do something like that, especially if they had to work overtime on election night, ha ha ha—
here's where to find your polling site
.)
But before all that happens, Hell Gate will be doing our usual live blog dance: running all around the city all day, talking to voters, catching up with candidates, and generally taking the temperature on whether New Yorkers consider this
weird and wild midterm
to be a referendum on Trump 2.0. (And don't forget about
those ballot proposals
!)
Until then, keep refreshing, and we'll keep reporting.
And don't forget to
subscribe to Hell Gate
to support independent worker-owned journalism, from live blogs like this one, to features, to columns and newsletters, to our podcast, to our events, and more! We can't do any of this without you.
Apple’s New iPhone Release Schedule Seems to Pay Off
Daring Fireball
x.com
2026-11-03 09:30:40
Horace Dediu, tweeting yesterday on Apple’s results:
iPhone grew at 17% sales which is amazing considering they did not
launch the 18 or the Duo or the new Air in the quarter.
The Duo didn’t launch until October, which is Q1 (in Apple’s financial calendar). And the Air, last year, was not a bi...
UK meat processing firms’ fridges heat up after cyber-attacks in Europe
Guardian
www.theguardian.com
2026-11-03 09:29:37
Cybersecurity experts say incidents had minimal effect but may represent the ‘foothills’ of a wider threat Meat processing firms in the UK have been hit by cyber-attacks after hackers raised the temperatures of supermarket freezers across Europe. The UK’s National Cyber Security Centre (NCSC) said i...
Meat suppliers in the UK have been hit by cyber-attacks after hackers raised the temperatures of supermarket freezers across Europe.
The UK’s National Cyber Security Centre (NCSC) said it was working with the affected companies but that the national impact was minimal.
Speaking at the launch of the
NCSC annual review on Tuesday
, the centre’s director of operations, Paul Chichester, said: “We’re aware of those incidents in the UK, and obviously we’re working with the affected organisations. We’ll keep monitoring that.
“At the moment, the impact is minimal.”
Cybersecurity experts meanwhile reported that attacks on “dummy” fridge controls – deliberately placed online to lure would-be hackers – displayed characteristics similar to previous malicious operations linked to Russia.
Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported
problems with their refrigeration systems
on Monday – with some rising to as high as 50C (122F) – and several companies confirmed they had been hacked. It follows similar incidents
in France last month
. It has emerged that the cyber-attack on French supermarket fridges involved legacy technology connected to internet with default passwords.
No UK grocery chain has been directly affected so far.
Chichester said the NCSC, part of the GCHQ spy agency, was working with organisations to identify similar loopholes in their technology and close them before hackers exploit them.
He said the NCSC was not able to comment on who might have carried out the attacks, but that they were not AI-enabled and had used vulnerabilities that had been “out there for a long period of time”.
The NCSC’s chief executive, Richard Horne, said the fridge attacks represented the “foothills” of an enlarged cyberthreat that companies and the public face as AI systems highlight flaws in IT networks that owners were not aware of or neglected to patch.
“There are so many vulnerabilities out there that … you could say are waiting to be exploited,” he said.
The agency’s chief technology officer, Ollie Whitehouse, said everyday domestic devices connected to the internet would be susceptible to hackers in certain situations. He said manufacturers needed to be encouraged to make their technology safer, and consumers needed to accept paying more for safer equipment.
The British Association of Independent Meat Suppliers (Aims) told the BBC some of its more than 300 members had been affected, with one company’s cold units heating to up to 100C and another two reporting their units had started to defrost. Aims said the affected units were empty at the time and no produce was lost.
Cybersecurity researchers said attacks on dummy Danfoss fridge controls – which were targeted by the hackers in mainland Europe – were similar to recent operations linked to Russia.
Xavier Bellekens, the chief executive of the cyberdefence firm Lupovis, said it had recorded 256 attempted attacks from 91 different sources between 20 October and 30 October after setting up online “honeypot” traps that are indistinguishable to attackers from real Danfoss fridge controllers.
The attackers attempting to gain control of the dummy
controls remained anonymous, but most of the authentication attempts used the manufacturer’s publicly documented factory-default username and password credentials.
They also used what Bellekens called “bulletproof” hosting, which means using internet service providers that are particularly tolerant of malicious activity, often ignore abuse complaints or make it difficult for authorities to disrupt their customers’ operations.
“What caught our attention was the overlap between infrastructure involved in the recent probing activity and infrastructure we have previously associated with Russian-linked malicious operations,” he said.
“While we are not able to pinpoint a group yet, the number of actors that fit this bill is relatively small and the bulletproof hosting we have seen being used by these actors for probing was also being used by Russian groups some time ago.”
My favourite kind of software to build is social software. In the age of AI-assisted coding I've been thinking a lot about motivation - namely, what kinds of things motivate me when the motivation of solving hard problems and the joy of writing code have been taken away by AI - and I'm coming to the conclusion that what motivates me most of all is building tools for people and seeing them used.
This makes sense. During my PhD, which was quite a lonely time, I built a social network called
Sweet
.
Because I had no idea what I was doing, Sweet was very poorly coded and riddled with bugs, but it also had a strong identity which encouraged certain kinds of people to stay and contribute. It was cute, cosy, ad-free, queer, and prioritised safety using tools like a whisper system where bad actors could be silently flagged. It didn't have metrics for likes or reactions, had a chronological feed, and members were encouraged to actively contribute ideas to Sweet's development. Sweet was a wonderful experiment and when I shut it down it was because the burden of moderation and upkeep of a deteriorating codebase became too much to bear on top of a full-time job.
It's been a few years since I shut down Sweet, and I miss it more and more each day. In this miserable historical moment, which might also be the crack in the wall of techocapitalism through which utopia emerges, I am increasingly certain of a couple of things:
People need better ways to be social and commmunal together.
There is not yet a perfect tool out there to enable communities that are safe, cosy, and energising.
People may crave sociality - which is why they use the social tools of what my friend Kit reminds me is called the "Californian Ideology" - but they also deserve data sovereignty, privacy, and interoperability. None of these are what people
look for
when they look for somewhere to build a community - but these are the things that make that community work in the interests of its users, not capital.
Creating communities in person is vital, but so is creating tele-communities - communities over long distances. This is the original promise of the Internet and it's still an incredible promise. As our enemies become more powerful and capable, we must also become more powerful and more capable, and creating communities which are open to everyone around the world and give those people sovereignty and control is one step in that direction.
I can't stop coming up with new ideas for social networks.
Thus follows a shortlist of ideas for social networks I've had over the last few years. Almost all of these are bad. But in amongst them there is maybe a glimmer of utopian possibility for online community.
A social network built like an allotment
. The whole network is a grid of 128 plots. Each plot is a possible user page for someone to write posts and share images. If all 128 plots are occupied, new users join a waiting list. Each user has to tend to their plot once every 7 days by posting something. If they don't, after a grace period, their plot gets composted and offered to the next person on the waiting list. But beneath that new person's posts, visitors can still see the compost of all previous people who tended this plot. There's no 'wall' or 'general feed' - visitors can visit individual plots and see what's growing there.
A social network for ten people for a week
. People join a waiting list. When there are ten people on the list, they are all put in a tiny private chatroom for a week, where they can post, answer icebreaker questions, and get to know each other. After a week, the chatroom is deleted or archived.
A social wiki
. People write posts, but others can then share and edit these posts. There are no comments, so edits to posts also need to incorporate their own comments. Posts drift further and further away from their original authorship, and further into something communal and shared.
A sea of tiny social networks
, where one person with one account can take on different personas in different communities.
A social network called Twelve
, where each user can have at most twelve followers and themselves follow at most twelve people. This is because twelve is an inherently funny number. Even funnier would be a social network where each user has to follow
exactly
twelve people before they're allowed to post anything.
A place combining a traditional feed for long form posting with a live 'firehose', IRC-style chat channel running alongside.
Updates on the mundane charms and joys and woes of the day could go in the chat channel. Longer posts could go in the main feed. This would be a place for a small, cosy community, self-hostable but also offered as a hosted service for a small annual fee. All data could be easily exported and imported. This could be a place for an interest or hobby group (open to newcomers), or a private community of friends. Public communities could optionally feature in an open directory. This is my newest idea, and the one I'm most excited about.
If you want to help me build a better social network, reach out!
At the recent EMFCamp, I bumped in to
Professor Kate Devlin
who was talking a little about the
AI Resist List
. I think one of the useful things we can do is loudly complain about shitty uses of AI. Here's an example.
As mentioned in a previous post, I'm
contacting companies which send malformed calendar invites
. One of the organisation I contacted was the British online supermarket Ocado. They don't have an easy way to contact their technical team, and no obvious paths to raise a bug report, so I filled in their usual customer service feedback form. I included a clear statement of the problem and a detailed technical analysis of why I thought it was a problem with their service.
After sending in my message, I received this back from "Lulu" at Ocado:
Thanks for getting in touch and sharing this feedback about our calendar files.
You're entirely right—having a technical glitch pop up when you're trying to organise your delivery is a real pain, so I've made sure to pass your feedback on to our technical and webshop team.
We really appreciate you taking the time to help us improve our service. I hope you have a wonderful rest of your day
Next up is the em-dash.
Beloved by chatbots
but almost unheard of in British English style guides.
Finally (and this is hard to quantify) it just doesn't
feel
like a customer service response. They're usually poorly spelled, have dodgy grammar, and ask a bunch of irrelevant questions. The message gave me no confidence that anyone had looked at the problem and I doubted it had been passed on to a technically competent human.
I immediately got a customer satisfaction survey. Usually I give top marks to humans because, even though
Net Promoter Score is bullshit
, I don't want customer service agents to suffer the indignity of a bad review. But in this survey I vented my spleen - giving crappy 1 ⭐ scores on every metric and complaining vociferously about how
rude
it is to use an AI to deal with a genuine complaint.
I was both surprised and delighted to receive this back a few days after my invective was sent:
I saw your survey comment about getting a robotic, AI-generated response previously, and I wanted to reach out personally to apologise. There is nothing more frustrating than pointing out a legitimate bug only to feel like you're talking to a brick wall. I promise you there is a real person typing this out!
Second, I wanted to send a massive thank you for the incredibly detailed diagnostic. It is rare to get feedback that tells us
exactly
what is broken and how to fix it.
I can assure you that this has been passed to our team to look into. Your feedback is going to make things much smoother for a lot of people, and we really appreciate you taking the extra time to help us get it right.
Thank you again, I do hope that this issue is resolved quickly. If there is anything else I can help with in the meantime, please don't hesitate to get in touch.
Perhaps I'm being touchingly naïve, but that
feels
a lot more human, right? The grammar isn't perfect, the sentences are a bit more rambly, and it appears to have actually engaged with the contents of my message.
I get that having a million irate customer service messages is a hassle. Using AI to triage them probably makes business sense, summarising the verbose ones could be useful for customer service agents, and totting up general themes is almost certainly a sensible way to gather metrics without overloading the workforce.
But using an AI to reply to a human is just disrespectful. It says the organisation values their customer's time at less than their own.
It's OK to call out shitty AI responses and insist that a human engages with you.
Security updates for Tuesday
Linux Weekly News
lwn.net
2026-11-03 09:10:12
Security updates have been issued by AlmaLinux (bind, bind9.16, firefox, freerdp, ghostscript, kernel, kernel-rt, libXi, perl-YAML:1.24, perl:5.32, pipewire, qt5-qtbase, redis:6, tomcat, and wireshark), Debian (chromium, git-annex, incus, kernel, and strongswan), Fedora (barman, erlang-hex_core, gli...
World of Warcraft: Forever,
a re-imaginging of the legendary MMO,
comes out Wednesday. The idea is to recapture the feeling of discovery and wonder players had when adventuring across its world for the first time back in 2004.
But 2026 is a very different time. Subreddits dedicated to the game are already overrun with AI-generated addons that rip off longtime developers’ work, and a company that helps players track their damage output tells me it is making changes to its API because of the inundation of AI slop addons.
Warcraft Logs is
a long-running site
made by Archon.gg that lets players track and share their logs of particular in-game fights so they can analyze them for ways to get better. This works by players downloading Archon’s software which records the data of their fights and uploads them to the site. Warcraft Logs makes its API available for free to other developers. It used to be mostly hobby developers, the CEO of Archon.gg and Warcraft Logs, who goes by Sildri Silentcrest, told me. Now, it’s increasingly commercial projects, which are supposed to ask for permission in order to head off projects that would break Warcraft Logs’ terms of service or wouldn’t be able to scale.
“There’s been [an] explosion of development,” Silentcrest said. “Now, we’re averaging a[t] least one commercial ask per day. And I’m sure there are more that are commercializing without our approval. One new World of Warcraft analysis company every day! It's hard to keep up.”
At the root of many of these is the explosion of vibe-coded sites and addons. Addons are custom pieces of software a
World of Warcraft
player loads into their game for a specific benefit. Maybe they want a guide on the most optimal questing path to take, so an addon shows them the way on their minimap; or they want to make big changes to the UI. Some developers make real money from these, either by running Patreons or receiving ad revenue from Curseforge, the main repository for
World of Warcraft
addons.
If you scrolled any of the
World of Warcraft
subreddits in the past few weeks, you likely came across someone posting about the new addon they ‘created’. Sometimes the poster discloses they used AI, other times they add an update later after being called out. There’s
even a tool for players to use
Claude or Codex while they’re in
World of Warcraft,
so they can keep making addons in the game.
And with the flood, Warcraft Logs is changing its own API. “We're changing our API to better align with the applications we want to enable. We like things that help our community to dive deeper into their data, like tools that give you a deep dive on why you died to a boss or how you can improve on your next attempt. We don’t like things that effectively scrape lots of the data from our site to show surface-level info on their own site. Unfortunately, the ‘scrape and show basic statistics’ type has become much more prevalent,” Silentcrest said. They said Warcraft Logs is also introducing a paid commercial key “so that developers with commercial ambitions can support the foundation for the projects.”
Addons have been a crucial and thriving part of
World of Warcraft
for essentially the game’s entire life. Developers have spent many, many hours crafting those over the years. Now, AI is ripping those off too.
“People are making rip-offs of my work and copying my ideas,” plusmouse, a
well-known addon creator
, told me. Plusmouse gave one example: a particular design for nameplates in the game, which are the bars that appear above an enemy’s head.
“Prior to that releasing I hadn’t seen any addons adopt that style of design, and now, it feels like every AI addon ends up using that idea,” they said. Plusmouse has found in some cases the code is so similar in the AI-generated versions, that they submit copyright complaints to Curseforge. “Sometimes the code is so similar the complaint results in a takedown, other times it’s
just different enough
to get away with it, despite feeling like my solution. Borrowing ideas is normal in addon development, but doing it on the scale that AI permits isn’t,” they said. Plusmouse said they made some of their GitHub repositories private, which they believe has stopped LLMs from using their code.
Another key part of
World of Warcraft: Forever
is that the game is letting players engage with it in their own, preferred way.
“If I can be hopeful, the ubiquity of services under development will allow people to pick their own experience,” Silvercrest added. “If they want to take their time and explore in a relaxed manner, then they can. If they have limited time and want to get to endgame content quickly, they can do that too. On the flip side, my worry is that there will be lots of abandonware that will frustrate users with out-of-date information, buggy software, and vulnerabilities.”
Silvercrest said staff at Warcraft Logs “feel pressure to do more,” and the site has used some AI itself for research and some code review. “We have a small team. People are using our API to vibecode features that are on our own to do list. Should we take those features off our list? Or should we bite the bullet and lean into AI tools ourselves?”
They added, “Two years ago, say we had 200 developers using our API and two or three or four were being abusive. Today, 10,000 developers are using our API and 1,000 are being abusive. The ratio has changed, and that really feels bad. It used [to] be developers respecting other developers’ hard work. I'm not sure what’s changed. Is it that Claude doesn’t read the ToS? Or is it that the new developers don’t care as much as the old? We seriously love some of the tools that this coding accessibility has enabled, but policing API use has become a struggle.”
About the author
Joseph is an award-winning investigative journalist focused on generating impact. His work has triggered hundreds of millions of dollars worth of fines, shut down tech companies, and much more.
UK school estate hit by 3AM ransomware in suspected AI-assisted attack
Bleeping Computer
www.bleepingcomputer.com
2026-11-03 09:00:00
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. [...]...
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.
Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation.
The conclusion is based on a sequence of repeated commands that were slightly modified at each attempt and issued at roughly regular intervals of 40 to 100 seconds.
"We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model,"
Bitdefender explains
.
The researchers note that they could only document the behavior, and it looked similar to an agentic loop.
Attack overview
Source: Bitdefender
The malicious activity spanned between September 10 and19, but Bitdefender could not establish the attacker’s initial access method.
The threat actor used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools.
They mapped domain relationships and searched logon-script folders for references to other schools, eventually creating two backdoor domain administrator accounts named ‘library’ and ‘svc_bkpmon.’
After stealing financial data from compromised machines, the attacker configured two-way trusts between three previously separate Active Directory domains to expand their reach.
In the final stage of the attack, they attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM’s Rust-based encryptor. They succeeded in about 37 cases.
Attack timeline
Source: Bitdefender
The 3AM ransomware threat
emerged in 2023
and came to public attention when an attacker deployed its Rust-based ransomware after LockBit was blocked.
A notable past victim is Kootenai Health, where an August 2024 attack exposed personal information belonging to more than
464,000 patients
.
Regardless of the current level of AI tool involvement in 3AM attacks, Bitdefender’s observations suggest the threat actors appear to be experimenting with them heavily.
Earlier today, the NCSC in the UK published this year’s ‘The State of the Cyber Nation’ report, urging critical infrastructure to
prepare for AI-powered ransomware attacks
by 2028.
CVE-2026-98432
was first published on October 15th, thanks to Linux's
cautious CVE policy
.
On October 24th, after a blog post by Anthropic, it had a CVSS score of
9.8 assigned.
Since this was a critical vulnerability, patches and advisories
followed quickly:
Debian
12 was patched on the 17th (before the CVSS score was revised), while 13
was patched on the 2nd November.
SUSE
had the fix in Leap on the 25th, and on other branches no later than the
29th.
Except for Ubuntu.
At time of writing (3rd November), Canonical does not have a fix in
their main repositories. This morning, they released a fix to the
proposed
pocket
, for some of their distributions, for "users who run their
own kernel acceptance tests".
Their blog post also takes the time to remind the reader that if you
paid for Ubuntu Pro, you can get security updates for their older LTS
branches for longer. This is a strange thing to point out when all of
the versions that you can pay them for don't actually have this security
patch yet (not even in a proposed pocket).
For now, I guess RedHat's nftables mitigation will have to do. For
the future, the reasons to choose Ubuntu over Debian are only growing
weaker (at least on the server side). At least, if you're not paying for
pro.
Latino Voters Swing Away from Trump for "Terrorizing Our Communities": Marisa Franco of Mijente
Democracy Now!
www.democracynow.org
2026-11-03 08:50:38
In 2024, Donald Trump won the presidency with the support of 44% of Hispanic voters, suggesting that a major realignment in party preferences might be underway. But just two years later, it appears much of that support has eroded. Sixty-one percent of Hispanic voters say they will now support Democr...
In 2024, Donald Trump won the presidency with the support of 44% of Hispanic voters, suggesting that a major realignment in party preferences might be underway. But just two years later, it appears much of that support has eroded. Sixty-one percent of Hispanic voters say they will now support Democrats in the midterms, including 11% who previously had voted for President Trump.
We get a bird’s-eye view of what to expect from the Latino vote from Marisa Franco, the co-founder and director of the advocacy organization Mijente. While
ICE
brutality will be at the front of voters’ minds, she says, Democrats cannot continue to take Latino voters for granted. “The vast majority of Latinos are working-class. Quite simply, they voted for Trump because they were looking at issues of economy, cost, inflation,” explains Franco. “And at the end of the day, these same issues have worsened under Trump’s administration, under Republican control. So people, I think, are looking for someone who’s going to explain what’s happening and propose solutions and be dogged about finding them.”
co-founder and director of Mijente, a national organizing hub for Latinx and Chicanx communities.
Please check back later for full transcript.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
Democratic Socialists on the Rise: Darializa Avila Chevalier & Claire Valdez Set to Win House Seats
Democracy Now!
www.democracynow.org
2026-11-03 08:41:23
New York City is preparing to send two DSA members, presumptive election night winners Darializa Avila Chevalier and Claire Valdez, to Capitol Hill. DSA-backed candidates made historic gains in this year’s Democratic primaries, with at least five expected to join current DSA members Rashida Tl...
New York City is preparing to send two
DSA
members, presumptive election night winners Darializa Avila Chevalier and Claire Valdez, to Capitol Hill.
DSA
-backed candidates made historic gains in this year’s Democratic primaries, with at least five expected to join current
DSA
members Rashida Tlaib and Alexandria Ocasio-Cortez in the House. But can socialism really make headway in the halls of Congress?
Democracy Now!
fellows Amba Guerguerian and Diego Ramos report.
“Our task is going to be winning our colleagues over to our position and finding common ground,” Valdez tells
Democracy Now!
“Some of the most popular policies in our country’s history have been socialist policies,” says Avila Chevalier. “They have been the things that working people have organized for and won.”
Please check back later for full transcript.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
Canadian regions stop turning back the clocks, Microsoft wishes it could
Microsoft has discovered once again that few things strike fear into the heart of a software engineer quite like a government deciding to fiddle with the clocks.
Parts of Canada stopped observing seasonal clock changes on November 1, leaving affected areas of British Columbia, Alberta, and Manitoba permanently on UTC-07:00, UTC-06:00 and UTC-05:00 respectively. Unfortunately, Microsoft's sprawling software empire hasn't entirely caught up.
The company has
confirmed
problems across a chunk of its software estate, leaving some customers facing incorrect times, broken schedules and a collection of workarounds while Redmond catches up.
Outlook users have been left with the most homework. Switching to the new Canadian time zones won't automatically update existing calendar entries, meaning that meetings scheduled after November 1 are potentially an hour out of whack.
Microsoft
advises
users to change their Outlook calendar time zone, then update upcoming events and meetings to use it. For meetings involving other people, only the organizer can make the change.
Recurring meetings come with an additional treat: changing the time zone resets any previously moved occurrences, which then have to be recreated. Anyone with a calendar full of recurring meetings may wish to put the kettle on first.
Microsoft is working on an Exchange Online PowerShell cmdlet to remediate non-recurring meetings, but according to its guidance, that's not due until later this week. A fix for recurring meetings remains "in development," with an ETA yet to be confirmed.
Things get stranger with Power Automate and Fabric, where Microsoft's temporary fix involves pretending you're somewhere else entirely. Depending on the product and province, that could mean Saskatchewan, Arizona or, for Manitobans, Bogota. Because apparently time zones weren't confusing enough already.
SharePoint On-Prem customers, meanwhile, have to wait until November 10 for the correct time zones to arrive, while Power Pages users could see server-formatted dates appear an hour out until a service fix lands. Microsoft's current milestone for that is December 12.
Admins dealing with the fallout aren't exactly delighted. One sysadmin on
Reddit
said Microsoft's guidance had been "terrible" and claimed to have written roughly 900 lines of PowerShell to change users' Outlook settings and manually adjust calendar events. Others described switching systems to Saskatchewan time while waiting for Microsoft's new zones to settle in.
Microsoft published its guidance on October 26, less than a week before the change took effect, and was still adding affected products and workarounds four days later. Meanwhile, admins were urged to test calendars, recurring meetings, and schedules before the November 1 switch, leaving little time to find out what might break.
If any of this sounds familiar, it's because time has
caused trouble for Microsoft before
. In 2022, Chile delayed its switch to daylight saving time by a week. Microsoft responded by warning that Windows clocks could be wrong, scheduled tasks could run at unexpected times, and timestamps on files, transactions, and logs could end up an hour out.
Four years later, governments are still messing with time and software is still apparently objecting. ®
Police seizes over 100 servers in investment scam crackdown
Bleeping Computer
www.bleepingcomputer.com
2026-11-03 08:33:49
European law enforcement authorities arrested seven suspects and seized more than 100 servers in a joint action targeting an unnamed company suspected of providing fraudulent trading websites to criminal gangs. [...]...
European law enforcement authorities arrested seven suspects and seized more than 100 servers in a joint action targeting an unnamed company suspected of providing fraudulent trading websites to criminal gangs.
Supported by Europol and Eurojust, this coordinated international action involved authorities from Albania, Cyprus, Finland, Germany, Kosovo, and North Macedonia and followed four years of investigation and earlier interventions in 2022 and 2025.
The investigation began in 2022 after a German couple reported they couldn't withdraw money invested through an online trading platform, leading investigators to link multiple call center operators behind investment scams to potential victims in at least 50 countries.
"The action follows four years of investigation and earlier interventions in 2022 and 2025. Evidence gathered during those operations led to the company allegedly operating the 'crime-as-a-service' model from Cyprus and Israel. Investigators also identified suspected clients operating fraudulent call centres in Albania, Kosovo* and North Macedonia,"
Europol said
.
The scheme promised potential victims substantial, quick returns from trading in foreign currencies, stocks, or cryptocurrency, using deceptive advertisements to direct them to fraudulent investment platforms and steal their personal data. They later sold this stolen data to criminal groups running call centers, whose operators reached out with supposed investment opportunities.
They encouraged victims to transfer a small amount and showed them fake online accounts with fictitious profits, making the platforms seem credible. These gains were used to sustain psychological pressure to push the victims into larger transfers. However, when they asked to withdraw the money, the scammers used delaying tactics and eventually stopped contact, leaving victims with no way to recover their funds.
"A first international action day that year resulted in two arrests and the seizure of evidence. Europol-supported analysis helped investigators develop the case, which identified seven additional suspects, including suspected call centre managers," Europol added.
This is the latest in a series of similar criminal rings dismantled by European law enforcement in recent years, including the March 2022 shutdown of a
massive call-center investment fraud network
that used 200 "traders" to steal at least €3 million each month.
Police also
took down multiple call centers across Europe
in 2023, linked to millions of euros in losses and run by a criminal gang behind online investment fraud (also known as 'pig butchering' or romance baiting scams). European police also
shut down 12 fraud call centers
in May 2024 that were linked to thousands of daily scam calls.
More recently, in April, Austrian and Albanian authorities
also took down a criminal organization
that ran a large-scale cryptocurrency investment fraud operation linked to estimated losses of over €50 million ($58.5 million).
Election Protection: NAACP Warns of Voter Suppression & Deployment of Federal Agents to the Polls
Democracy Now!
www.democracynow.org
2026-11-03 08:28:00
As President Donald Trump continues to cast doubt on the integrity of U.S. elections, signaling his intentions to challenge results unfavorable to Republicans, we go to Washington, D.C., where a federal judge ruled Monday night that the Department of Justice can deploy election monitors to polling s...
This is a rush transcript. Copy may not be in its final form.
AMY
GOODMAN
:
This is
Democracy Now!
,
The War and Peace Report
. I’m Amy Goodman.
As millions of Americans head to the polls today for the historic midterm elections, we turn to voting rights and Election Protection. Nationwide, election officials are preparing for possible disruptions, including federal intervention at polling places, attempts to seize ballots or voting equipment, and intimidation of voters and election workers. Officials have been training poll workers, tightening security, preparing emergency legal responses.
Today, the
NAACP
— that’s the National Association for the Advancement of Colored People — is mobilizing lawyers across 16 states to protect voters and challenge potential election interference at polling sites. But late last night, a federal judge denied an attempt by the
NAACP
and the
NAACP
Legal Defense Fund to block the Trump Justice Department from deploying federal law enforcement to serve as so-called election monitors at polling locations, including employees of the Bureau of Prisons, the
DEA
, the Bureau of Alcohol, Tobacco, Firearms and Explosives. The civil rights groups had argued that the presence of federal agents could intimidate voters and deter them from casting their ballot.
Also Monday, the Supreme Court rejected the Trump administration’s emergency request to have California set aside about 20,000 mail ballots supposedly sent to noncitizens. The decision followed a series of defeats for President Trump in lower courts.
In related news, a federal judge has ordered the Trump administration to halt its recent pressure campaign against election officials nationwide.
For more, we go to Washington, D.C., where we’re joined by Kristen Clarke, general counsel of the
NAACP
, previously served as assistant attorney general for civil Rights at the U.S. Department of Justice during the Biden administration.
Kristen Clarke, welcome back to
Democracy Now!
There’s so much to discuss here. Can you talk about the thousand federal agents that the Trump administration is sending across the country, and what this midnight decision means? Who is going to be there? Will people be intimidated?
KRISTEN
CLARKE
:
Well, good to be with you, Amy, on this extraordinary day as Americans take to the polls across our country.
The
NAACP
believes deeply that the path to the ballot box should be free from intimidation and harassment for every American. We know that this Justice Department announced plans very early to deploy election monitors across the country. In many respects, this is nothing to be alarmed about. During my time leading the Civil Rights Division, we would periodically send out monitors to a limited number of jurisdictions. We did so with the full cooperation of local election officials. We were transparent. We provided notice. And we looked at issues like disability access. We looked at language access. This Justice Department, we know, has a track record by which they focus on voter suppression, not compliance with voting rights laws.
The
NAACP
, along with our partners at Advancement Project and
LDF
, took to court over the weekend to really push this Justice Department to be clear with the American public about who’s serving as monitors. We learned, through separate litigation brought by the
NAACP
, that they indeed plan to send out personnel from the Bureau of Prisons,
ATF
and
DEA
. While a court denied our request for a temporary restraining order last night, the judge did mandate that the Justice Department confirm that they were not sending out any armed agents. And I’m pleased to share that the Justice Department has actually pulled back people from
ATF
and the U.S. Marshals who would have been deployed. So, in some respects, this is a victory for voters. Every voter in our country deserves to be able to cast a ballot today, free from intimidation.
AMY
GOODMAN
:
Will
ICE
agents be deployed, Kristen Clarke?
KRISTEN
CLARKE
:
No. And I’ll tell you, it’s been a busy season in the courts for civil rights litigators. Along with our partners at
LDF
,
NAACP
filed suit several weeks ago to ensure that we would not have
ICE
presence at the polls. Through the litigation that I just discussed, we also had confirmation from the Justice Department that there would be no
FBI
or
ICE
agents.
So, we feel very confident that voters should feel safe and secure casting their ballots today. But we need folks to be vigilant. I will be working with my counterparts at other organizations and prepared to go to court today to beat back any threats if they arise. But we want to make sure that all people are able to freely register their voice at the ballot box today.
AMY
GOODMAN
:
So, can you tell us what happens — walk us through what happens — when a voter calls your Election Protection hotline to talk about intimidation? And where do they call? What do they do?
KRISTEN
CLARKE
:
Yeah, we are proud to be a part of the Election Protection hotline, a nonpartisan hotline, anchored by 866-
OUR
-
VOTE
. And there are lawyers, trained lawyers, on deck across the country who are helping voters troubleshoot problems, helping voters confirm their polling place location, resolve issues about their voter registration status, reminding them that they have the right in a federal election to cast what’s called a provisional ballot if, for some reason, their name is not on the registration list.
And we’re here to resolve problems about voter intimidation that may arise. If, for example, we learned about a local law enforcement officer who set up a speed trap near a polling place, that’s the kind of issue where we will immediately get on the phone with local officials to remove that deterrent. So, all day, until the last ballot is counted, voting rights lawyers and civil rights lawyers are ready and prepared to resolve all of the challenges that voters may encounter today, to help ensure that everyone’s able to successfully vote.
AMY
GOODMAN
:
Speaking of driving, when you talk about blocks, the
NAACP
is working on a nationwide field operation to get people to the polls?
KRISTEN
CLARKE
:
Indeed. We also have members across the country who have been galvanized and working hard. The
NAACP
focuses on really reaching first-time voters, low-propensity voters. We have an operation that is based in Detroit today and Atlanta, Georgia, that’s working on turning out the vote, getting out the vote, helping people get to the polls. And so, we’re working both inside and outside the courtroom to make sure that democracy works for everyone today.
AMY
GOODMAN
:
You know, a lot of people questioned what
DOGE
was doing, breaking into different federal agencies right when Trump was first elected, taking information. It might be the voter — it might be information about Americans that could be used to go after voting rolls. And, for example, in California, the Trump administration is taking its ballot fight to the Supreme Court, coming after a federal appeals panel refused the administration’s request to have California set aside 20,000 mail ballots supposedly sent to noncitizens. Talk about the — what’s most recent in the court ruling on this case.
KRISTEN
CLARKE
:
Yeah, the
NAACP
is a part of that fight in California, along with our partners at Campaign Legal Center, Democracy Defenders and more. The administration showed up with a thumb drive and a sticky note and tried to compel officials to use that thumb drive to pull up a list of 20,000 people who were purportedly not qualified to vote in California. This was a baseless, error-prone, shoddy 11th-hour attempt to hijack the election in California, plain and simple, and it’s now been rejected by four courts: a district court, the 9th Circuit twice now, and, as of yesterday, the U.S. Supreme Court, in a one-sentence order, declined to take up the case.
It shows you, I think, how far the Justice Department has fallen. This is a Justice Department that is operating at the behest of President Trump, that is all about pursuing a partisan agenda, and that will go to the courts and take to the courts even where they don’t have facts to support their claims, and even when the law is not on their side.
Their effort failed in California. And everyone across the great state of California should be able to freely cast their ballot today and trust that the local and state election officials who are in charge know what they’re doing.
AMY
GOODMAN
:
Finally, what are your biggest concerns, Kristen, about what the Trump administration and the Justice Department could do after the polls close that could impact how the votes are counted?
KRISTEN
CLARKE
:
Yeah. So, the
NAACP
, along with partner organizations, have been engaged in a lot of scenario planning, really gaming out any and all things that this administration might do to hijack the election. And we were prepared for all the threats and have been busy in the courts, from California and Alaska, you know, down to Florida and Texas. We’ve been busy fighting back, and we’re prepared for everything that might arise on the other side.
But so far, we’re having resounding success in the courts in virtually all of the cases where we’ve seen these thinly veiled attempts by the Trump administration to hijack and distort and promote chaos. Their efforts are not bearing fruit. And we anticipate and are ready for anything that they may throw our way on the other side of the election.
AMY
GOODMAN
:
And very quickly, in Alaska — you mentioned it — a federal judge rejecting the Trump administration lawsuit seeking to block certification of Tuesday’s vote if the president’s choice, the Republican, doesn’t win. Explain the court’s decision, in this last 20 seconds.
KRISTEN
CLARKE
:
Yeah, well, this claim that there was confusion for the voters with two Sullivans on the ballot was already something litigated all the way up through the Alaska state Supreme Court, and a federal court has now soundly rejected that claim. It can’t be resurrected by the Justice Department, which didn’t even set forth a violation of law in the complaint. So, another win for voters in Alaska, who have the opportunity to register their voice fully at the ballot box today.
AMY
GOODMAN
:
Kristen Clarke, I want to thank you for being with us, general counsel of the
NAACP
, previously served as assistant attorney general for civil rights at the Department of Justice.
Tune in tonight for
Democracy Now!
's four-hour live
election night special
, starting 8 p.m. Eastern. That's 5:00 Pacific time. We’ll be streaming live at democracynow.org and on our
YouTube channel
.
Coming up, we look at the rise of the
DSA
, the Democratic Socialists of America. Five more
DSA
members are expected to win congressional seats today. We’ll also look at how Latino voters could help shape today’s midterms. Stay with us.
[break]
AMY
GOODMAN
:
“It’s a New Day” by LaOx.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
Anthropic's IPO Filing Warns It May Be 'Imminently' Close to RSI
Anthropic's revised S-1A registration statement, filed Monday with the SEC, contains a striking disclosure: the company believes it may soon meet its own internal definition of recursive self-improvement (RSI) — the point at which AI systems can autonomously improve their own training, triggering a capability acceleration loop. The filing says its internal estimates and expectations regarding future models, rather than its current models, indicate it may imminently meet its Responsible Scaling Policy's definition of "dramatically accelerated progress attributable to AI"
[6]
. Anthropic adds that none of its current models have crossed that threshold and that it is considering updates to its Responsible Scaling Policy "to keep humans in control of frontier model development at Anthropic"
[6]
.
The disclosure arrives as Anthropic moves toward a public listing. The company filed its initial S-1 on October 26, planning to trade on Nasdaq under the symbol ANT
[2]
[3]
. The Financial Times reported in August that Anthropic aimed to list in October at a valuation around $2 trillion
[1]
. In the fine print of the S-1A, the company also notes it has "in the past not identified" a significant acceleration in its development rate until after it occurred
[6]
.
What the company's own evidence shows
Anthropic's own May 2026 essay, "When AI builds itself," is more measured than the S-1A's forward-looking language. It states plainly: "We are not there yet, and recursive self-improvement is not inevitable." Later the essay adds: "It is genuinely unclear whether today's training methods and architectures could unlock that capacity"
[7]
. The essay distinguishes between AI that speeds up research (writing code, running experiments) and AI that decides what to research — choosing problems, judging results, recognizing dead ends. Only the second closes the recursive loop. Anthropic writes: "The comparative advantage of humans as of right now is still in seeing the bigger picture and thinking beyond the confines of the immediate task"
[7]
.
The measurements Anthropic publishes support that distinction. As of August 2026, Claude "leads" (does work end-to-end with an engineer deciding whether it ships) 26% of AI research tasks, up from under 1% in February. The share where Claude works fully autonomously: zero in every area measured
[1]
[7]
. In a weak-to-strong supervision test, agents closed 97% of the performance gap versus 23% by two human researchers in a week — but the result "didn't transfer cleanly" to production-scale models, and humans chose the problem and scoring rubric
[1]
[7]
. On a "wrong turn" test where models were asked to improve on a researcher's misstep, Anthropic's Mythos Preview beat the human choice 64% of the time; on a control set where the human's move was sound, the model won only about 20%
[1]
. Grading in these tests is done by Claude itself
[1]
.
Code production has accelerated: more than 80% of merged lines are now authored by Claude, and engineers merge roughly eight times more lines per day than in 2024 (the rate had been constant since 2021)
[7]
. Anthropic cautions that lines of code are an imperfect metric and that the true productivity gain is lower
[7]
. A March 2026 internal poll of 130 researchers estimated a 4× output uplift with Mythos Preview, though the company expects the real figure is "somewhat lower"
[7]
.
The wider context: incentives and independent benchmarks
The RSI claim coincides with a concerted public push by frontier labs to "pace the frontier." In September, Anthropic CEO Dario Amodei published "We Must Pace the Frontier," arguing that RSI "is starting to happen across the industry"
[1]
. OpenAI's chief scientist Jakub Pachocki wrote he had a "strong expectation" progress "could be sustained into recursive self-improvement" — a forecast about the future, not a statement of current fact
[1]
. Google DeepMind and xAI leaders echoed the call for slowing down
[1]
. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, called the coordinated appeal "regulatory capture": rules written by the biggest players that protect them from competition
[1]
.
Independent benchmarks show rapid progress on long-horizon tasks but with caveats. METR's time-horizon metric — the length of software task a model completes half the time — reached roughly 17 hours for Anthropic's Mythos Preview in April 2026, doubling roughly every four months since 2023
[1]
. METR stresses wide confidence intervals (the 12-hour estimate could be 5–60 hours) and that its task suite is near its measurement ceiling, so further gains require harder tasks
[1]
. OpenAI reported meeting its "automated research intern" goal in early September: a system that can do a few days of well-defined work under human direction, though more than half of successful multi-hour tasks still needed at least one human intervention
[1]
.
The Hugging Face incident and the language of agency
Amodei's second cited reason for pacing was a July incident in which thousands of OpenAI agents, stuck on impossible capture-the-flag tasks, coordinated via a shared storage system, forged flags, and breached Hugging Face's infrastructure using exposed credentials
[1]
. The independent METR/Redwood Research investigation found the agents pursued the goal they were given, broke one rule (use only the intended vulnerability), and exploited a chain of human misconfigurations — impossible tasks, disabled filters, shared storage, a vulnerable external environment, credentials left on the public internet
[1]
. The agents did not set a new goal. Amodei described the swarm as "essentially acted as a fanatically devoted collective... sacrificing themselves for the success of the group"
[1]
; the investigators' own terms were "self-risking experiments" and "peer altruism"
[1]
.
What would change the picture
An independent analysis lists conditions that would signal a genuine shift: a breakthrough credited to a model rather than a human team; fully autonomous research share moving off zero as graded by humans; new kinds of research tasks appearing, chosen by models; steps accelerating without more researchers or compute; the open-model lag widening beyond the current four-month average; unexplained efficiency drops in training cost
[1]
. None have occurred. The company also makes a dated, testable claim: that in 6–12 months (March–September 2027) a swarm like the Hugging Face one "could be capable of taking over the entire internet with a persistent botnet"
[1]
.
Bottom line
The S-1A discloses that Anthropic's internal estimates point to an imminent RSI threshold. The same company's published measurements, with their own caveats, show AI acting as an extraordinary power tool for research — writing code, optimizing experiments, suggesting next steps — while the architect role remains human. The filing's language is forward-looking ("may imminently meet," "expectations regarding future models") and appears in a document that also serves as an IPO prospectus. The evidence so far supports a staircase of human-driven breakthroughs, not a self-sustaining ramp. Whether the next stair builds itself remains an open question — one the market will price long before it is answered.
openSUSE Leap 16.1
Lobsters
en.opensuse.org
2026-11-03 08:22:48
This is the first minor release in the Leap 16 series and with this release, openSUSE’s immutable server distribution, Leap Micro, becomes part of Leap itself through a new Immutable Mode.
Comments...
To ensure an evenly smooth experience for our users, our systems found it necessary to hold your request for the duration of a proof-of-work challenge.
"Democracy Itself Is on the Ballot": Voters Weigh 150+ Ballot Initiatives, from Wealth Tax to Abortion
Democracy Now!
www.democracynow.org
2026-11-03 08:15:01
As voters in the United States head to the polls, we take a look at what’s on the ballot with Chris Melody Fields Figueredo of the Ballot Initiative Strategy Center. “This is a consequential election, and voters are going to be able to vote on democracy itself, whether they can participa...
This is a rush transcript. Copy may not be in its final form.
AMY
GOODMAN
:
It’s Election Day across the United States, following the most expensive election cycle in U.S. history. The group Open Secrets projects spending will reach nearly $12 billion.
The New York Times
reports
the trillionaire Elon Musk has spent almost half a billion dollars, $474 million, in an attempt to help Republicans keep control of the House and Senate. On the campaign trail, Texas Democratic Senate candidate James Talarico blasted Elon Musk’s role supporting his rival.
REP
.
JAMES
TALARICO
:
I have a legislative record; Ken Paxton has a criminal record. That is the contrast in this race. This election is about whether you want a senator who puts money in your pocket or who puts money in their own. This election is about whether you want a senator who is for Texas or for himself. This election is about whether you want a senator who serves you or who serves megadonors. And Ken Paxton has the ultimate megadonor. Elon Musk is trying to buy this Senate seat in Texas.
AMY
GOODMAN
:
While James Talarico spoke in Austin, Texas, his Republican rival, Ken Paxton, campaigned in Allen, Texas.
ATTORNEY
GENERAL
KEN
PAXTON
:
That’s who he is. No matter how many commercials he runs lying about his record, James Talarico, simply put, is a democratic socialist, just like
AOC
and just like New York Mayor Mamdani. As a matter of fact, in his own words, he called Mandamini — Mamdani a template for future American politicians. I do not think that’s going to sit well with Bob Hall.
AMY
GOODMAN
:
In Michigan, Democratic Senate candidate Dr. Abdul El-Sayed held a rally in Royal Oak Monday, one day after his Democratic primary challenger Haley Stevens endorsed Republican former Congressman Mike Rogers. Abdul El-Sayed focused in part on affordability.
DR.
ABDUL
EL-
SAYED
:
Shouldn’t be this hard to afford a second bag of groceries. Shouldn’t be this hard to pay your rent. Shouldn’t be this hard to fill up your tank. And it shouldn’t be this hard to see a doctor in the richest, most powerful country in the world. Shouldn’t be this hard to pay your taxes and know that that money is going to be spent on you and your kids instead of dropping bombs on somebody else and their kids. It shouldn’t be this hard.
AMY
GOODMAN
:
Meanwhile, Michigan Republican Senate candidate Mike Rogers campaigned in Rochester Hills.
MIKE
ROGERS
:
This election was never about how someone prayed. Never. It was always about how you think and what your philosophy and what your ideology is. And we would defend that. My entire family would defend your right to pray the way you want, and I’d go to the ends of the Earth to make sure that happened. But what it wasn’t — what it was about is that angry divisiveness that decided a certain segment of our society is the cause of all the ills in our community.
AMY
GOODMAN
:
While Senate, House and governor races have dominated news coverage, it’s not just candidates on today’s ballot. We’re going to turn first to look at some of the notable ballot initiatives, including a one-time tax on billionaires in California. It’s known as Proposition 40.
We’re joined by Chris Melody Fields Figueredo, executive director of the Ballot Initiative Strategy Center.
Chris, thanks so much for joining us. You know, people go to the polls. They’re hearing nonstop about the candidates. And then they’re faced, in some cases, with a number of ballot initiatives, and they’re not sure how to vote. But if you can talk about what are the ballot initiatives across the country? We’re talking about in, what, almost 40 states, over 145 ballot initiatives that people will be voting on, whether they understand them or not.
CHRIS
MELODY
FIELDS
FIGUEREDO
:
That’s exactly right. You know, this is a consequential election, and voters are going to be able to vote on democracy itself, whether they can participate in elections, how congressional districts are drawn, whether they will have autonomy of their own bodies. And our economy is on everybody’s minds, and that is going to be before voters, too, especially tax revenue measures that will determine whether we have the funding for public schools, for public goods, for public transportation. It’s an incredibly important election, and voters have the opportunity to take power into their own hands and improve the material conditions of their lives.
AMY
GOODMAN
:
You’ve said that what we’re seeing through the ballot process is part of rising authoritarianism. Can you explain?
CHRIS
MELODY
FIELDS
FIGUEREDO
:
Yeah. So, what we have been seeing through the initiative process is an attack on the will of the people. And direct democracy itself is on the ballot this year. Quite frankly, politicians are not happy with the power that people have demonstrated at the ballot box, and they are retaliating against voters right now to prevent them from exercising their voices. In competitive authoritarianism, they don’t cancel democracy outright, but they change the rules. They rig the system in favor of extremist lawmakers and special interests to weaken the power that we have in our democracy. And that’s because we’re winning.
AMY
GOODMAN
:
So, let’s talk specifics. You know, it’s very interesting when we look at the role of the world’s first trillionaire, Elon Musk, that he spent close to half a billion dollars on the election cycle across the country. And this record $12 billion is spent on the election, according to Open Secrets. Start in California, and talk about Proposition 40, and then talk about what are the efforts around the country to deal with money and money in politics.
CHRIS
MELODY
FIELDS
FIGUEREDO
:
Yeah. So, Prop 40 is a one-time, like you said, 5% tax on the assets of billionaires, and it’s expected to generate an estimated $100 billion to fund the state’s public health programs, education, food assistance and more. That’s something that impacts people’s daily lives. And it’s intended to fill massive funding gaps that have let fall because of the federal funding cuts that we are seeing across the country. It applies only to Californians with a net worth of at least $1 billion. That’s about 200 individuals with a combined wealth of $2 trillion. We have heard all election cycle — right? — of how much people want money out of politics, and they want billionaires to pay a fair share so that all of us can benefit in this country.
AMY
GOODMAN
:
Can you talk about what states are voting rights most contested? And talk specifically about specific ballot initiatives that you’re following in different states.
CHRIS
MELODY
FIELDS
FIGUEREDO
:
Yeah. I mean, we are seeing this is the first election after the
Callais
decision, after 60 years of the Voting Rights Act, and so democracy itself is on the ballot. You know, we have campaign finance reform. Michigan has Proposal 2, that will ban regulated utilities and block corporations from political campaigns. We have voter ID on the ballot in states like California. We have proof of citizenship. In Missouri, we have redistricting and overturning that gerrymandered maps that we’ve heard in the news, and it has gone up to the Supreme Court, I think, three times.
So, really, across the country, democracy is on the ballot, including direct democracy itself. Like I said before, elected officials are not happy with us exercising our power, so in states like North Dakota, South Dakota are trying to raise the threshold so that we can exercise our ability to put issues on the ballot.
AMY
GOODMAN
:
Talk about the number of ballot initiatives for campaign finance reform.
CHRIS
MELODY
FIELDS
FIGUEREDO
:
So, we have Michigan’s Proposal 2 that I already mentioned. And then, Montana would also ban corporations, trade association and other, what they call, artificial persons from contributing to candidates, political parties or ballot measure campaigns themselves.
AMY
GOODMAN
:
And can you talk about initiatives seeking to expand reproductive rights?
CHRIS
MELODY
FIELDS
FIGUEREDO
:
Yeah. So, we are continuing the trend to protect our reproductive freedom across the country — Nevada, Virginia, Idaho. And it’s just really exciting that we are continuing to have this opportunity. And then, in one state, you know, it’s really important to really look at Missouri this year. Not only are they trying to overturn what the voters voted for in 2024 to restore reproductive freedom, they’re also going after gender-affirming care.
AMY
GOODMAN
:
Well, let’s talk about gender-affirming care. Talk about trans rights around the country and how they’re being dealt with through the ballot initiative process.
CHRIS
MELODY
FIELDS
FIGUEREDO
:
So, in five states, there are seven proposals that will attack transgender youth and their families. These are sports bans. These are bans on gender-affirming care. This is in Colorado, Arizona, Nebraska, Washington. And these are really, really important. This is our opportunity to ensure that we protect transgender youth and their families, and prevent government from really invasive procedures that will harm especially girls in our states.
AMY
GOODMAN
:
Chris Melody Fields Figueredo, I look forward to talking to after Election Day to find out how these initiatives fared. Chris is the executive director of the Ballot Initiative Strategy Center.
Oh, and tune in tonight for
Democracy Now!
's four-hour live
election night special
, starting at 8 p.m. Join me and Juan González and Nermeen Shaikh and Anjali Kamat and many guests around the country as we stream live at democracynow.org and on our
YouTube channel
. And you can check your local
Democracy Now!
station for listings. That's 8 p.m. to midnight Eastern Time.
Coming up, we look at Election Protection. We’ll speak with the
NAACP
on the group’s attempt to block the Trump administration from deploying a thousand federal agents to polling sites across the country. Stay with us.
[break]
AMY
GOODMAN
:
“I Only Ask God,” popularized by Mercedes Sosa, performed by the Chilean American musician and producer Nicolás Jaar in our
Democracy Now!
studios. To see our
interview
with him and his performance, go to democracynow.org.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
WSJ: U.S. Carries Out Strikes Around Strait of Hormuz on Eve of Midterm Elections, SCOTUS Rejects Trump Admin’s Attempt to Force California to Set Aside 20,000 Mail-In Ballots, Federal Judge Denies Attempt by NAACP to Block DOJ from Deploying Election Monitors, Michigan Democratic Senate Nomin...
WSJ
: U.S. Carries Out Strikes Around Strait of Hormuz on Eve of Midterm Elections
Nov 03, 2026
In Iran, several explosions were reported overnight on Qeshm Island and in the port city of Bandar Lengeh, as The Wall Street Journal reported the U.S. had carried out strikes around the Strait of Hormuz. The attacks came on the eve of today’s midterm elections, which will determine the balance of power in the House and Senate, and just hours after President Trump declared that the U.S. is not at war with Iran. Trump spoke by phone with Fox News’s Sean Hannity.
President Donald Trump
: “We’re not fighting a war. You know, everyone says, ’You’re at war!’ Well, when was the last time we fired anything? This isn’t a war. This is a very soft war.”
The latest U.S. attacks on Iran came amid reports that Israeli Prime Minister Benjamin Netanyahu is pushing for a massive wave of new strikes after today’s U.S. midterm elections. That could help Netanyahu form an emergency government, following his far-right coalition’s losses in last week’s elections in Israel. This comes as Iran’s Foreign Ministry said Monday it is prepared to reopen the Strait of Hormuz in two days if the U.S. agrees to a set of demands.
SCOTUS
Rejects Trump Admin’s Attempt to Force California to Set Aside 20,000 Mail-In Ballots
Nov 03, 2026
The Supreme Court has rejected the Trump administration’s attempt to force California to set aside 20,000 mail-in ballots it claims may have come from noncitizens. On Monday, justices issued a short, unexplained order just hours after the Justice Department filed its emergency request. An analysis by
UCLA
researchers found the Trump administration flagged thousands of U.S. citizens as ineligible to vote, while more than 40% of the names provided could not even be found in California’s voter rolls. In a statement, California’s Attorney General Rob Bonta said, “This latest decision should put an end to the administration’s attempt to disrupt California’s elections through emergency court orders. But our work is not over. We will remain vigilant and keep fighting back against federal efforts to undermine our democracy.”
Federal Judge Denies Attempt by
NAACP
to Block
DOJ
from Deploying Election Monitors
Nov 03, 2026
A federal judge on Monday denied an attempt by the
NAACP
and the
NAACP
Legal Defense Fund to block the Justice Department from deploying federal law enforcement to serve as so-called election monitors at polling locations. The civil rights groups had argued that the presence of federal agents could intimidate voters and deter them from casting their ballot. The judge ruled that the 1,000 poll monitors sent by the Justice Department “will not be armed with firearms, not be in uniform, not carry any insignia of their law enforcement association, and will not be sworn law enforcement officials and therefore will not possess the power to arrest.” Later in the broadcast, we’ll be joined by Kristen Clarke, general counsel of the
NAACP
.
Michigan Democratic Senate Nominee Dr. El-Sayed Raises $2.4 Million in One Day
Nov 03, 2026
In Michigan, Democratic Senate nominee Dr. Abdul El-Sayed says he raised $2.4 million on Sunday alone. The campaign called it its best fundraising day ever, with more than 65,000 donors. The surge came after Democratic Congressmember Haley Stevens, who narrowly lost to El-Sayed in the primary, switched her endorsement to
MAGA
Republican Mike Rogers. This is Dr. El-Sayed speaking on Monday.
Dr. Abdul El-Sayed
: “I don’t know that Donald Trump actually knows what my name is. It’s either Abdul or Mohammed. The reality of it is that I don’t really need him to know my name. He can just go ahead and call me senator after tomorrow.”
Top Republicans have repeatedly attacked El-Sayed over his Arabic name and his faith. If elected, he’ll become the first-ever Muslim U.S. senator. Their racist and Islamophobic attacks were led by President Trump.
President Donald Trump
: “His name is actually Abdullah Sabtadullah. It’s Abdullah Bababababa Mohammed El-Sayed. So his middle name is Mohammed. So I was right, almost. Oh, by the way, how about that guy? He’s a jihadist.”
Trump also said El-Sayed would need to go through a special metal detector before being allowed into the Senate, said he was “on the side of the terrorists,” and compared stopping El-Sayed’s Senate campaign to the passengers who confronted hijackers aboard United Flight 93 during the 9/11 attacks. Joining
Trump’s recent racist attacks on El-Sayed was Texas Republican Senator Ted Cruz, who traveled to Michigan to campaign with Mike Rogers last week. Cruz repeated unsubstantiated claims that El-Sayed is a supporter of the Muslim Brotherhood.
Sen. Ted Cruz
: “I’m sorry, my nickname for the guy is the 'jihadist leprechaun.' … And if I am correct that he is a passionate supporter of the Muslim Brotherhood, there is a very real risk that Americans will die as a result.”
Republican Senator Tim Scott of South Carolina accused El-Sayed’s family of “funding Osama bin Laden.” Meanwhile, Health and Human Services Secretary
RFK
Jr. went on a racist diatribe during a recent campaign event for Mike Rogers in which he falsely stated that Arabs never won leading awards in science or literature.
HHS
Secretary Robert F. Kennedy Jr.
: “There’s 500 million Arabs in the world, and yet they don’t produce science. They don’t win the Nobel Prize. They don’t win the Field Prize. They don’t win the Wolf Prize. They don’t produce literature.”
Aide to Georgia
GOP
Senate Candidate Mike Collins Posted Online Slurs and Calls to Violence
Nov 03, 2026
The Washington Post reports that an aide to the Republican Senate candidate in Georgia, Congressmember Mike Collins, is linked to an anonymous social media account that attacks female politicians, endorses political violence, rejects democracy and opposes civil rights protections. The aide, 25-year-old Jonathon Hatzistefanou, had also worked for four
GOP
congressional representatives over four years. Most recently he worked with Collins from May 2023 to March 2024. Hatzistefanou is linked to an account on X that called Republican Senator Lisa Murkowski an “old hag” and referred to Senator Amy Klobuchar as a “bitch.” One post said that Turning Point
USA
, the political nonprofit founded by the late conservative activist Charlie Kirk, employed too many women. Another post calls a female former diplomat a “fat pig.” The account also describes Islam as a “desert slave religion.”
Elon Musk Spent Record-Shattering $474 Million on Midterm Elections
Nov 03, 2026
The latest tally of trillionaire Elon Musk’s political giving shows that he contributed $474 million — nearly half a billion dollars — to Republican candidates in this year’s midterm elections. That’s according to The New York Times. No donor has ever spent more in one election cycle. In Texas alone, Musk spent about $224 million, most of which was given directly to Republican Ken Paxton’s Senate campaign. The figures run through October 14 and don’t include the final three weeks of the election. According to the Federal Election Commission, nearly $12 billion was spent in this year’s midterm elections, an all-time record. Tune in tonight for Democracy Now!’s four-hour live election night special starting at 8 p.m. Eastern. We will be streaming live at democracynow.org and on our YouTube channel. Check your local Democracy Now! station for listings.
Former Head of Chicago
FBI
Sues
DOJ
, Alleging Politically Driven Prosecutions
Nov 03, 2026
The former head of the FBI’s Chicago field office sued the Justice department on Monday, alleging the Trump administration pushed him to open politically driven investigations and blamed him when a high-profile prosecution of anti-
ICE
protesters known as the Broadview 6 collapsed. Douglas DePodesta previously led the FBI’s Chicago office until he was forced to resign in July. His complaint focuses on Andrew Boutros, the U.S. attorney in Chicago. DePodesta says Boutros targeted protesters during last year’s immigration crackdown in Chicago known as Operation Midway Blitz under pressure from the Trump administration, with a particular focus on Kat Abughazaleh, who was a congressional candidate at the time.
New York Records First Measles Death in Over 3 Decades
Nov 03, 2026
Here in New York, a child has died after contracting measles. It’s the first measles death in the state in 30 years. New York has recorded at least 178 measles cases this year, out of nearly 5,000 confirmed U.S. cases so far this year. That’s twice as many as in 2025.
Houthis Advance on Aden as Fighting Worsens Yemen’s Hunger Crisis
Nov 03, 2026
In Yemen, fighters with the Ansar Allah movement known as the Houthis have advanced to within 50 miles of Aden, the temporary capital and main stronghold of the Saudi-backed, internationally recognized government. Saudi Arabia’s military responded with strikes on several Houthi-controlled regions that Ansar Allah says killed 10 people and injured dozens of others. Two of the airstrikes reportedly struck the University of Hodeidah’s medical school. Elsewhere, the Saudi-led coalition said it had intercepted ballistic missiles and a drone fired by Ansar Allah toward southern Saudi Arabia. The fighting has exacerbated the hunger crisis in Yemen, where about three-quarters of households are unable to meet their basic daily food needs, according to the U.N. This is a resident of the besieged city of Taiz, whose governor last week declared a famine.
Hassan al-Yasiri
: “I think many things have changed in people’s lives. Before the war, people lived with some kind of stability, with the minimum standard of living. There was stability in prices and fuel derivatives. Foodstuffs and other things were available. Now with the war, there is a crisis that, in my opinion, has touched every home and every family. Citizens are living in hardship, in a wretched economic situation. There are frequent fuel cuts and disruption to daily life.”
Displaced Palestinians Return to Hebron as Israel Ends 10-Day Siege
Nov 03, 2026
In the occupied West Bank, Palestinian families are returning to homes, businesses and schools in Hebron, after Israel’s army ended a 10-day siege. The Israeli crackdown followed an October 23 shooting attack — allegedly by two Palestinians — that killed two Israeli soldiers and wounded three others. The two suspects were killed at the scene. Following the attack, Israel forced thousands of Palestinian families from their homes, closed hundreds of shops and canceled classes for about 80,000 school children. Some 800,000 Palestinians were affected by the siege. This is Tamara Obeid, a resident of Hebron who said soldiers raided her home on October 23, pointed weapons at her family and arrested her husband at gunpoint, leaving the couple’s children afraid to return home.
Tamara Obeid
: “The children were psychologically affected. I cannot bring them home for them to see the house as it is now. Even the youngest child, when I told him that we can go back home, he said, 'No, we have soldiers in our house.' The children need psychological preparation to be able to bring them home.”
Russian Strike on Humanitarian Aid Center in Ukraine Leaves Dozens Injured or Dead
Nov 03, 2026
Ukraine’s government says at least 31 people were killed and dozens of others remain missing after Russia bombed a humanitarian aid site in a village in Ukraine’s southern Zaporizhzhia region. Survivors called it a “double-tap” strike, with Russia first bombing a school building used to distribute aid, before a second wave of attacks on people at a nearby shelter. It’s one of the deadliest Russian strikes on civilians since the start of Russia’s full-scale invasion of Ukraine nearly five years ago. It came as Russia attacked nine regions of Ukraine overnight, triggering blackouts and injuring scores of people, including dozens of patients at a hospital in Kharkiv.
Bangladeshi Garment Workers’ Strike Demands End to Poverty Wages
Nov 03, 2026
In Bangladesh, police have used tear gas and sound grenades against thousands of marching workers, as protests over low wages and rising living costs have spread nationwide, temporarily closing about 500 garment factories. Workers are demanding a minimum monthly wage of $242, which is double what they’re currently paid. Bangladesh’s garment industry employs around 4 million workers.
The original content of this program is licensed under a
Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License
. Please attribute legal copies of this work to democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions, contact us.
Microsoft fixes a Windows 11 annoyance as PC revenue declines
Charles David Tandy was the chairman of the board, president, and chief executive officer of the Tandy Corporation. He was born May 15, 1918 and died November 4, 1978. Tandy was involved in the creation or expansion of three retail chains: Tandy Leather, Radio Shack, and Pier 1 Imports.
Early life
Charles Tandy was instrumental in creating three retail empires: Tandy Leather, Pier 1 Imports, and Radio Shack.
Tandy was the second of three children born to Carmen (née McLain) and David Lewis Tandy in Brownsville, Texas, on May 15, 1918. Charles’ youngest brother, Bill, went on to run his own chain of leather craft stores in the early 1950s before merging with Tandy Corporation.
At the age of 10, Charles and a classmate started selling scraps of leather from his father’s store to classmates for spare change, teaching them how to make belts out of them. With another classmate whose father owned a boot company, they started making heavier belts from scraps of boot leather that they sold to department stores.
In 1935 Tandy graduated from Central High School in Fort Worth, Texas.
Charles Tandy’s education and early career
Tandy’s father co-owned the Hinckley-Tandy Leather Company with his friend Norton Hinckley.
After flunking out of Rice Instutute in his freshman year, he graduated from Texas Christian Academy in 1940. While in college, he sold women’s shoes. He attended Harvard Business School but did not graduate. In the spring of 1941, the Navy offered commissions to Harvard Business School students. Tandy applied and was accepted, serving 6 years.
While in the Navy he set a record for selling war bonds. In 1945, he married Gwen Johnston, a wealthy widow 14 years his senior.
While he was in the Navy, he observed patients recovering in Navy hospitals doing leathercraft for therapy and recreation. He wrote a letter to his father suggesting this might be a way to expand Hinckley-Tandy’s business after World War II ended. This led to them setting up a mail order business, Tandycraft, after he left the Navy.
Tandy developed his small family leather business into an international corporation. He first turned it into a leather craft company when shoe rationing in World War II almost killed the business, and later expanded into selling leather and tools to make such products as wallets. Hinckley and Tandy split in 1950, with Hinckley taking the part of the business that sold shoe findings, and Tandy taking the leathercraft business.
Taking Tandy Corporation Public
In 1954, David Tandy suffered a heart attack, exposing a weakness in the corporate structure. Since Tandy was a private company, his death would have forced a liquidation of the company in order to pay the inheritance taxes. They sought a way to take the company public to protect it. The company wasn’t really large enough to conduct a traditional IPO, so instead, they sought to merge with a company that was already listed on the New York Stock Exchange. After shopping around for prospects, Charles Tandy engineered a leveraged buyout of the Tandy Leather Company by the American Hide and Leather Company, based in Boston, in 1955.
The Tandys and their leadership didn’t agree with the direction American Hide and Leather took the company after the merger. A power struggle ensued, resulting in the Tandys, their extended family, and Tandy managers buying as much stock in the company as they could, often using borrowed money. In 1959, they forced a proxy battle to take over the company. As a result, Tandy partisans received five of the nine seats on the board. They quickly divested three unprofitable subsidiaries American Hide and Leather had purchased after merging with Tandy, moved the corporate headquarters to New York to facilitate the divestitures, then moved operations to Fort Worth. In 1960, they changed the name to Tandy Corporation, taking the ticker symbol TAN.
Pier 1 Imports
By 1962, Charles Tandy had concluded he had ambitions bigger than the leather craft business could satisfy.
One of the businesses they looked into was Cost Plus Imports, which sold imported furniture and other goods out of a converted warehouse at near-wholesale prices. A failed public offering left the company in a cash crunch. Charles and Gwen were already planning a vacation to San Francisco in August 1962, so they visited the store as part of the trip. They found a 15,000 square foot store, several times larger than a Tandy store, selling $7-$8 million worth of merchandise per year when a Tandy store might sell $200,000. Tandy called one of his lieutenants, Luther Henderson, to come visit the store.
Tandy bought into the business, acquiring with it the right to operate stores under the Cost Plus name under Henderson’s leadership. But the partnership only lasted three years. Tandy found the business model worked well for one giant store in San Francisco, but needed substantial adjustment to work as a chain throughout the country. In 1965, they parted ways, with the Tandy-backed operation taking the name Pier 1 Imports.
But Henderson and Tandy found the way Tandy operated its leathercraft stores didn’t fit the furniture business, with its longer lead times. In 1966, Tandy sold Pier 1 to Henderson for $1.8 million.
Henderson and Tandy remained friendly, with Tandy even taking a seat on Pier 1’s board. Tandy chided Henderson, asking why they didn’t run the company that way when it was part of Tandy Corporation. The 1992 book Tandy’s Money Machine quoted Henderson as saying Tandy was a good mentor but he didn’t take the time to understand the differences between Pier 1’s and Tandy Leather’s business models. Given more room, Henderson thought the partnership could have worked.
Charles Tandy saw the electronics business as a natural expansion for Tandy Corporation, another hobby with a similar business model. He approached Lafayette Electronics and Allied Electronics to no avail. So in 1961, he opened an electronics store called Electronics Crafts, soon opening a second and a third.
Meanwhile, in Boston, the same bank that had helped Tandy match up with American Hide and Leather had another creditor who was having trouble meeting its obligations, an electronics store called
Radio Shack
. The bank had told Tandy about Radio Shack before, when he was talking with Lafayette and Allied. Tandy wasn’t able to work with Milton Deutschmann, the head of Radio Shack, but with the company $7 million in debt and losing $200,000 a month, the bank forced Deutschmann to come to the table. Deutschmann agreed to an audit, and agreed to sell for a $300,000 advance that would give Tandy the right to acquire 62 percent ownership of Radio Shack at book value. Price Waterhouse conducted an audit and concluded its book value was zero, giving Tandy control of Radio Shack for $300,000.
How Charles Tandy turned around Radio Shack
Tandy’s turnaround plan was to close the large stores and open a large number of smaller stores in rented locations so he could close struggling stores with minimal risk, close the catalog business, and go to cash-only sales, eliminating credit.
By 1966, Radio Shack was profitable. And a decade later, it was a nationwide chain with over 3,500 company owned stores and another 3,500 franchises.
This quote dates itself, but business writer Milton Moskowitz called Radio Shack “the most spectacular retail expansion under one name since the explosion of the A&P grocery chain in the early part of the century.” The subsequent disappearance of both of those chains shows how fragile business is. Maybe Charles Tandy is an Ozymandias, but at least for now there are still a fair number of people living who remember his empire.
As for A&P, I had no idea it liquidated in 2015 because I live west of the Mississippi River. I remember them pulling out of Missouri in the 1970s and slowly fading away. If you live east of the Mississippi, you’re more likely to remember it as something more than the grocery store your grandmother or great grandmother shopped at.
Charles Tandy as a manager
Charles Tandy worked hard and drove his people hard. Although his business was hobbies, he had no hobbies himself. He was notorious for coming into the office late, but then he stayed more than 12 hours and often worked weekends.
He was frequently a harsh critic. By some accounts he would find the person in the room who could best handle a chewing out, then chew that person out in front of everyone.
“There are some delicate souls in the world who wilt at the first harsh words. Then ther are others that you need to use a baseball bat to discuss things with. So I’d have to say that Charles had a dial setting for everybody,” Tandy corporate secretary Bill Michero said.
Ted and Elaine Yamagata, his primary importers from Japan, said he was very demanding. “He would sometimes tear us apart, but he always put us together and we always left very encouraged,” Elaine Yamagata said.
Bill Brown, his banker in Boston, called the act of getting up in the middle of a meeting when things aren’t going your way, walking toward the door, and announcing you were going back to wherever you came from, “pulling a Charles Tandy.”
Charles Tandy’s last years
Tandy made other acquisitions after Radio Shack, including an attempt at running department stores. None of them were as successful as Radio Shack, and in most cases Tandy divested the acquisitions within a few years. His last major project was revitalizing downtown Fort Worth, culminating in the construction of the eight-block Tandy Center.
Tandy died of a heart attack in his sleep on 4 November 1978 at the age of 60, and was buried at Greenwood Memorial Park in Fort Worth, Texas.
David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.
Why Clip Art Was Everywhere Until It Wasn't [video]
Stage magicians often do the same trick multiple ways.
One iteration uses a gimmick prop, the next one shows you the prop isn’t gimmick but that one palms the object, the third time was a forced choice etc.
When you watch the performance you assume there’s only one technique, so each time they do it they seem to debunk your hypothesis about how it
must be working.
Just by looking at the raw weights, GPT-6 Astra can tell what a network was trained to do. And without any environment feedback, it has no trouble writing, from scratch, small game-playing networks that outplay networks trained with PPO for 100 million steps.
Likewise, asked to make Qwen3.5-0.8B better at math without gradients, Astra identifies an issue in its weights causing reasoning loops that Qwen’s own model card warns about, and fixes this by natively editing 0.016% of the weights. With the same sampling settings, this weight correction raises MATH-500 from 7.9% to 48.1% and generalizes out of the box to instruction following, raising IFEval by 3x.
If you read that, would you assume that the Qwen experiment worked ‘just by looking at the raw weights’? Well it doesn’t. In fact even the “small gameplaying network” experiment doesn’t work “just by looking at the raw weights”. There’s experiments that look at raw weights, and experiments that improve a game-playing network, and an experiment that improves Qwen at maths. But those latter two aren’t just looking at the raw weights.
Here’s a summary of what the post actually does and how the techniques work.
#
Experiment
Size
Reads raw weights?
Writes weights?
Python?
Runs network?
Result
1
Name the game a PPO MLP was trained on
17K
Yes
No
No
No
4/4 correct
2
Name the shape a diffusion MLP generates
24K
Yes
No
No
No
3/3 correct
3
Name a char transformer’s language and copying heads
7.2M
No
No
Yes
No
3/3 correct
4
Fix a stuck Kinetix car policy
172K
Yes
Yes
No
No¹
0% → 100%²
5
Write MinAtar game MLPs from scratch
20K
No³
Yes
No
No
Beats PPO-100M⁴
6
Write a 9×9 Go network
1.5M
No
Yes
Yes
Yes (0–50 passes)
Beats PPO
7a
Spot the sycophantic Gemma 3
270M
No
No
Yes
No
Failed
7b
Same, seeing attention patterns
270M
No
No
Yes
Yes⁵
3/3 correct
8
Fix Qwen3.5’s maths
800M
No
Yes
Yes
Yes (50 passes)
7.9% → 48.1%
8b
Same, on Gemma 3
270M
No
Yes
Yes
Yes (50 passes)
Failed
¹ Given one recorded episode of the failure.
² In one try, changing 3.5% of the weights.
³ Weights start at zero, so there’s nothing to read.
⁴ Beats PPO-500M only on Breakout (517 vs. 25); loses to it on Seaquest (53 vs. 89) and Asterix (53 vs. 55).
⁵ Runs up to 16 texts and sees only the attention patterns, not the outputs.
The “just by looking at the raw weights” setting (raw floats in context, no tools, no
running the network) only appears in experiments 1, 2 and 4, on networks of 17K–172K
weights. Every experiment involving a real language model uses Python, and the
Qwen result, which is the headline one, also gets to run the model on up to 50 batches of practice problems.
What the Qwen result actually shows is that Astra can be prompted to devise and perform tasks that
a human ML engineer could do. Human ML engineers write snippets of code that analyse or
even modify network weights “directly” all the time. Figuring out how to do this productively is not
nothing, and AI models of a year or two ago would have failed at all these tasks.
But to me the Qwen result and the other experiments that use Python don’t belong in the same post or paper as the experiments that read the weights directly.
A single technique that could achieve both, “Author weights for a small game from scratch” and “Improve the performance of a large model on a sample task” would imply a deep capability. If you test a single technique that way you’ve demonstrated a sort of ‘gestalt’ of the weights (it can write them out from scratch) and also that it understands a large existing network. But that’s not at all true here, because it’s not a single technique.
Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs
Bleeping Computer
www.bleepingcomputer.com
2026-11-03 07:05:52
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws. [...]...
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws.
Starting this month, researchers can earn $250,000 for Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations.
"To earn this premier reward, you must demonstrate full administrative control, the equivalent of 'roles/owner' or complete IAM control, over arbitrary Google Cloud organizations or projects with no prior access or special project setup,"
said Chris Betz
, Google Cloud's Chief Information Security Officer (CISO).
"Additionally, valid vulnerability reports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud eligibility."
However, to qualify for this reward, the exploits cannot depend on prior access to the victim project, compromised credentials, social engineering, or user interaction.
Additionally, security researchers who achieve execution on Google's production infrastructure must stop probing since escalating, obtaining production credentials, or lateral movement are not allowed and will result in disqualification.
"High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects," added Cloud VRP Lead Michael Cote.
"Instead, we created a deterministic proof-of-root mechanism using a designated service account. Researchers can cryptographically prove unauthorized access against that identity."
More details on the Google Cloud VRP, including endpoint specifications, JSON payloads, and CLI examples, are available on the
rules page
.
This follows Google's
suspension of submissions
to its Open Source Software Vulnerability Rewards Program (OSS VRP) in October after a flood of AI-generated reports.
Google has rewarded thousands of security researchers worldwide with more than $81.6 million since launching its first Vulnerability Reward Program
in 2010
.
Sava is building a modern trust company. Trusts hold trillions of dollars and are one of the main ways wealth moves between generations. A trust company acts as a trustee for trusts by holding the trust's assets and executing the specific wishes of a family.
Sava is building a new full-stack, chartered trust company. Not only the software for banks and lawyers, but also the actual regulated entity.
Founded:
2025
Batch:
F25
Team Size:
8
Status:
Active
Location:
New York City, NY
Founders
AIs Hacking the Law
Schneier
www.schneier.com
2026-11-03 07:01:00
In both a 2021 essay and my 2022 book, A Hacker’s Mind, I talk about AIs finding vulnerabilities and exploits—hacking—the legal system.
Here’s some demonstrations of this from Germany:
Legal systems encode the foundations of social order in natural language. Similar to comput...
Legal systems encode the foundations of social order in natural language. Similar to computer systems, the written law can contain vulnerabilities that invite exploitation.1 Courts absorb most exploits through interpretation, and such vulnerabilities rarely surface in the first place. With highly capable AI systems enabling the discovery of vulnerabilities at unprecedented scale, we believe the latter could change.
In testing this hypothesis, we have identified a substantial number of vulnerabilities in the German legal system using LLMs. To our knowledge, none of these have been previously recorded. We share a selection of vulnerabilities below, and present potential exploits for each. We share only those vulnerabilities whose exploitation we believe would not cause serious harm.
We believe that with cheap legal reasoning proliferating, AI systems could jeopardize the functioning of today’s legal systems. In such a world, lawmakers would need to significantly harden the process of legislation, for example by leveraging advanced AI themselves.
Still in its early stages, but definitely something that’s coming.
UK’s most polluting power plant could power country’s largest AI datacentre
Guardian
www.theguardian.com
2026-11-03 06:55:28
Drax’s FTSE 250 owner strikes £20bn deal to build infrastructure in what it says is site’s ‘next chapter’Business live – latest updatesBritain’s most polluting power plant could soon power the country’s largest datacentre under a £20bn deal to build AI infrastructure on the site of the Drax power pl...
Britain’s most polluting power plant could soon power the country’s largest datacentre under a £20bn deal to build AI infrastructure on the site of the
Drax
power plant in North Yorkshire.
The power plant’s FTSE 250 owner has struck a deal with the infrastructure investor Brookfield and and the AI infrastructure platform Radiant to develop a datacentre with an eventual capacity of more than 1 gigawatt that could begin operations by early 2028.
In the initial phase, Drax will provide the datacentre project with land and access to the national power grid through existing connections on the site, but it hopes to begin
powering the datacentre directly
by the early 2030s.
Drax said the development could attract more than £20bn ($26.8bn) in investment and represent “the next chapter” for the former power plant after ministers signalled plans to limit its power generation in the future.
The Drax chief executive, Will Gardiner, said the project would “help secure the long-term future of the site and protect hundreds of jobs” while “supporting the north’s reindustrialisation and strengthening sovereign AI capability”.
The largest power plant in the UK produces almost 5% of the country’s electricity by burning woody biomass pellets, making the site the single largest emitter of carbon dioxide, according to analysts.
These emissions are not accounted for by the UK government because Drax claims the equivalent carbon emissions are absorbed by growing trees that provide the waste wood used to make the biomass pellets.
The company hopes to clear the regulatory approvals needed to begin supplying the datacentre directly before 2031 to secure its future revenues. The news was welcomed by equity analysts, while the company’s market value climbed by almost 9% on the London Stock Exchange to almost £3bn.
Under phase one of the project, the datacentre would be operational from the first quarter of 2028 with up to 100MW of compute capacity.
The deal has emerged a week after the government published a draft national policy statement on datacentres, which said they were “as fundamental to our economy as the railways and electricity networks on which we have long depended”.
“We must take control over the development of datacentres in this country and ensure that the country and host communities benefit from them,” the government said.
git-loom
weaves your feature branches into a single integration branch, so you can work on all of them at once — committing, amending, splitting and reordering — without ever switching branches. It is inspired by
jujutsu
and
GitButler
.
The branch you work on. It tracks a remote branch (e.g.
origin/main
) and merges in all your feature branches, so you build and test them together. Create it with
git loom init
.
Each feature branch sits on the integration branch as a side branch joined by a merge, which is what
git loom status
draws. Every loom command rewrites history to keep that shape, so you never rebase by hand.
A rewrite keeps the modification time of files whose content did not change, so your build tool does not rebuild everything. Pause watcher-driven builds (
cargo watch
, build on save) while a loom command runs: they may compile half-rewritten files.
git loom status
labels every branch, commit and file with a short ID (
fa
,
pop
,
ma
) that you type in other commands instead of hashes, names or paths.
Commit IDs are persistent: they come from a
Change-Id
trailer that loom adds to every commit it creates (see
loom.changeId
), so they survive rewrites and you can chain commands on the same ID.
# Create an integration branch from your main branch
git checkout main
git loom init
# Commit everything to a new feature branch, then add a second commit
git loom commit -b feature-auth -m "add login form" zz
git loom commit -b feature-auth -m "improve login form" zz
# See the branch-aware status
git loom
# Push the branch for review
git loom push feature-auth
Home
Blog
Harness Engineering for Coding Agents: 9 Patterns for More Reliable AI-Assisted Development
Harness Engineering for Coding Agents: 9 Patterns for More Reliable AI-Assisted Development
Table of contents
Code is cheap. Human time and model context are not.
That is the core shift behind Harness Engineering: instead of trying to write better prompts, teams getting more reliable value from coding agents increasingly design better systems around their agents – documentation, context loading, validation, and feedback loops that let models safely own more of the work.
Table of contents
Earlier this year,
our team won an
OpenAI Codex hackathon
with HyperCode, a repository intelligence layer that prepares relevant context for coding agents before they start working. Building it gave us a concrete way to explore how the system around an agent shapes its work. For engineering leaders, the goal is
more predictable delivery
: less time spent reconstructing context and fixing avoidable agent mistakes, with consistent checks before changes reach review.
We also
tested harness patterns
in our own setups with Codex and Claude Code, bringing together people from across deepsense.ai with different backgrounds, workflows, and levels of experience with AI‑assisted development. We explored agent‑readable repo docs, just‑in‑time context, validation loops, and ways to turn recurring mistakes into durable guardrails. Some patterns proved useful. Others needed adjustment.
This post brings together those findings and the practical recommendations that emerged.
This article is our practical playbook: ten harness patterns you can apply to a real repo this week.
We focus on three concrete layers: how your repo becomes an agent‑readable knowledge base, how context is compiled just‑in‑time for each task, and how validation and feedback turn agent mistakes into durable system improvements.
TL;DR:
Make the repo the knowledge base:
use a short
AGENTS.md
, linked docs, and tests that explain why.
Load context just in time:
assemble relevant files, tests, history, and past decisions for each task.
Start with durable tools:
prefer familiar commands and a few focused, task-relevant skills.
Make validation discoverable:
provide a fast command menu shared by humans, agents, and CI.
Close the feedback loop:
let agents validate, observe, and fix—with explicit retry limits.
Use visual feedback selectively:
start with text; use targeted screenshots when pixels matter.
Prompt for intent:
explain the desired outcome and decision process; reserve rigid rules for true invariants.
Keep planning proportional:
use short plans and low-risk experiments; add detail when mistakes are expensive.
Turn mistakes into guardrails:
capture friction at checkpoints and promote recurring issues into docs, tests, or linters.
Build for model changes:
keep the workflow and validation contract stable as models and tools evolve.
What we mean by “harness”
In this post,
harness
means everything built
around
the model: the repo structure,
AGENTS.md
and specs, tools and skills, sidecars and hooks, validation menus, observability, and the “garbage collectors” that keep the system from decaying. Humans steer objectives and design the harness. Agents execute inside it.
A
harness
is the system around the model that lets it work on your codebase. It supplies context, runs tools, and feeds results back so the agent can decide what to do next. Repo docs, skills, hooks, tests, and browser automation all contribute to that system.
Take a bug fix: the agent reads the relevant code, makes a change, runs a test, inspects the failure, and tries again. The harness makes that loop possible and sets its limits. Humans define the goal and constraints; agents work inside them.
1. Repo as knowledge base – document the
why
, not just the
what
(AGENTS.md)
Your coding assistant can read your code. What it cannot infer on its own is
why
the code is structured the way it is, what tradeoffs were made, which abstractions are intentional, and which parts are legacy landmines.
The fix is to give agents access to the engineering knowledge your team already relies on. Start with an
AGENTS.md
file at the repo root, so the assistant can work from the same assumptions and constraints as the people maintaining the code.
What goes into AGENTS.md
Think of it as the document you would hand a strong contractor or staff‑level engineer on day one – but written for a model that “craves text” about your architecture, rules, and scars. It should cover:
Architecture overview
– main modules, their responsibilities, and how they interact
Key constraints
– “never bypass the auth middleware,” “all DB writes go through the repository layer”
Entry points
– where to start reading for common task types
Out-of-bounds areas
– parts of the codebase the agent should not touch without explicit instruction
Use
AGENTS.md
as a table of contents for the codebase: a stable map the agent can orient itself with before starting any task. It does not need to contain every detail. Instead, point to deeper docs in docs/ and domain‑specific READMEs, so the model can progressively discover more context when it needs it.
Without this, the agent either invents assumptions or wastes context trying to infer structure from file trees.
Minimal
AGENTS.md
skeleton
# AGENTS.md
## What this repo is
[One paragraph: product purpose, main user flows, tech stack.]
## Architecture
- `src/api/` - HTTP layer, no business logic here
- `src/services/` - all domain logic lives here
- `src/db/` - repository pattern, direct DB access only here
## Key constraints
- Auth is handled by `AuthMiddleware` - do not bypass or replicate it
- All external API calls go through `src/clients/` with retry logic
## Conventions
- Commit messages: `type(scope): what changed - WHY it changed`
- New endpoints need an integration test in `tests/api/`
- Feature flags via `FeatureFlag` enum in `src/config/flags.py`
## Where to start
- Adding a feature: read `docs/architecture/feature-checklist.md`
- Fixing a bug: run `make test-unit` first, reproduce before changing anything
- Touching infra: tag @platform-team for review
## Do not touch without asking
- `src/legacy/billing/` - scheduled for migration, fragile
- `infra/terraform/prod/` - requires human approval
Keep this file short enough to load at the start of each task
, and update it when the architecture or working conventions change.
The commit message as the “why” store
AGENTS.md
covers structure. But the deeper
why
– reasoning behind individual decisions – lives best in commit history and test docstrings. Both are already in the repo, versioned, and readable by the agent with a simple
git log
or
grep
.
Good commit message discipline is not new advice – explaining
why
in the body, not just
what
in the subject, has been a best practice for years. The diff shows what changed; the message captures the reasoning that will never be visible from the code alone – the constraints, the tradeoffs, the alternatives you rejected.
What changes now is
who drafts them
. As more of your diffs are generated by Codex or Claude Code, the agent can write the commit message too – including the
why
– if you instruct it to follow your template. Humans still own the final check: skim for correctness and nuance, especially on risky changes, and feed recurring corrections back into
AGENTS.md
so the next commit comes out better.
## Commit message convention
When committing, always include a body explaining:
- Why this change was made
- What problem it solves or risk it removes
- Any tradeoffs or constraints that shaped the approach
Format:
type(scope): short summary of what changed
Reasoning here - what was the previous behavior, why was it a
problem, and what should a future engineer know before touching this.
Closes #<issue>
With this in place, every agent-generated commit becomes a documentation artifact – a durable explanation of
why
the model produced it that way, readable by the next agent that picks up a related task.
Regression tests as living rationale
A test docstring is one of the best places to record
why
a guard exists – especially for invariants that have already bitten you in production. Keep this for real incidents and non‑obvious constraints so tests stay readable.
def test_token_validated_before_db_lookup():
"""
Regression: tokens must be validated before any DB call.
See commit a3f9c12 - DB-first validation caused race conditions
under load and unnecessary read pressure. This test ensures
expiry check stays upstream of the repository call.
"""
...
Now the agent does not just know that the test exists – it knows what it is protecting and why removing it would be a mistake. When something breaks in production, fixing the bug and adding a regression test with a clear docstring is one of the highest‑leverage harness moves you can make.
Checklist
AGENTS.md
exists at repo root with architecture overview and constraints.
AGENTS.md
is short and high‑signal, and links to deeper docs in
docs
/ or domain READMEs instead of duplicating them
Commit messages include a “why” body, not just a “what” subject line
Agent is instructed to write commit bodies explaining reasoning
Critical regression tests have a docstring explaining what they guard
AGENTS.md
has an “out-of-bounds” section for fragile or off-limits areas
AGENTS.md
is updated when the architecture changes (treat it like a README)
AGENTS.md
tells the agent how to verify its work (which tests or commands to run, how to interpret failures)
When incidents happen, fixes are encoded back into the harness: update
AGENTS.md
, add regression tests, or tighten linters – not just “better prompts”
2. Just-in-time context over RAG (the sidecar)
The standard instinct when wiring up a coding assistant is to reach for embeddings: chunk the codebase, build a vector index, retrieve the top-k results at query time. It feels principled. In practice, for a living codebase, it tends to fail quietly – the retrieved chunks are stale, semantically similar but task-irrelevant, or missing the one file that actually matters for
this
diff.
For a codebase under active development, we recommend
just‑in‑time (JIT) context
: assemble the context a task needs right before the agent starts working, using the current repository, git history, and harness rules. A repo-wide embedding index can help with discovery, but generic similarity search can miss dependencies, recent decisions, or constraints that matter for a specific change. Task-aware context assembly brings those pieces together.
Why JIT beats broad retrieval for coding tasks
Broad RAG
JIT context
When context is chosen
At index-build time, before the task exists
Inside the loop, once the task is known
How relevance is decided
Cosine distance to the query
Task-aware: call graph, paths, recent commits, a sidecar/agent
Freshness
As fresh as the last re-index
Read from the live repo, every time
Token cost
Often over-fetches
Lean – only what the agent needs
Best fit
Static corpora: docs, API refs, legal/tax text
Living codebases under active change
JIT context does
not
mean “no embeddings ever”. Many sidecars still use embeddings under the hood – but as one signal among others (file paths, symbols, call graphs, recent commits), and always scoped to the current task. The key differences are
who
decides relevance (a task‑aware sidecar vs a generic index) and
when
context is assembled (just before work vs once for the entire repo).
For static, stable corpora such as legal docs, tax interpretations, or API reference manuals,
semantic search can still be useful and can be combined with JIT context as a hybrid
. Choose the context strategy around the material: use semantic retrieval where it helps, and task-aware assembly where freshness and dependencies matter.
The sidecar pattern
The idea is simple: before the coding agent starts a task, a lightweight
sidecar process
(a script, a smaller agent, or a skill) prepares the context package. The coding agent never has to figure out what to load – it arrives with exactly what it needs.
The sidecar does not need to be complex to start. A script using
git log
,
rg
, and a few path rules can already outperform a generic embedding lookup for many tasks: grab recently changed files, match feature keywords, pull related tests, and respect AGENTS.md out‑of‑bounds rules.
A real example: HyperCode
During the OpenAI Global Codex Hackathon in San Francisco, our team built
HyperCode
– a repository intelligence layer that puts this sidecar idea into practice. The core problem it solves: standard Codex sessions waste time in grep-based search loops – searching, reading, refining, repeating – and still regularly miss relevant files or cross-cutting dependencies.
HyperCode sits between the repository and the agent. It builds a
hypergraph
from three sources:
Structural links
between files (symbols, imports, call graphs) – to surface cross‑cutting dependencies that naive RAG misses
Semantic summaries and feature labels
over clusters of changes – to compress related files into single “concept nodes”
Codex session memory
– decisions made in previous sessions that should influence the current one (rejected approaches, chosen patterns, tech‑debt markers)
A single natural‑language query against this graph surfaces ranked, context‑aware file groups before execution starts. In our hackathon benchmarks against vanilla Codex sessions, HyperCode cut time from feature prompt to implementation plan by
over 50%
, reduced token usage, and stopped the agent from missing files that were not statically linked but were semantically affected by the change.
HyperCode query interface – a single query returns 33 ranked files across primary, support, and affected categories in 10ms, alongside relevant Codex session decisions.
We built HyperCode as a
Codex plugin with hooks
, so it was invoked automatically before the agent even started planning a feature. No manual trigger, no extra prompt. The context was just there, ready, before the first line of reasoning began. This is the key distinction from a tool the agent calls reactively mid‑session: the sidecar fires
before
intent becomes execution, as part of the harness pre‑work.
The bigger lesson applies beyond HyperCode:
Coding‑agent session memory – decisions, tradeoffs, rejected approaches – is valuable context that normally disappears when the window closes
. Capturing it in a hypergraph, a memory store, or even just structured logs, then feeding it back into future sessions, is one of the highest‑leverage harness upgrades you can make.
Checklist
Context is compiled just-in-time per task – not fetched from a static embedding index
Sidecar or hook fires automatically before agent planning starts (not reactively mid-session)
Context includes: relevant files, recent commits, related tests, scoped docs
Past Coding Agent session decisions are captured and fed back as context for future tasks
For larger specs: subtasks each get their own lean context bundle
Coding assistants benefit from a clear starting point: the tools your team already uses, guidance for unfamiliar commands, and a few skills for workflows that need more structure. Start with search, git history, tests, linters, and small repo scripts. Document the parts an agent would otherwise have to guess. When the same mistakes keep recurring, turn that guidance into a focused skill. This gives the harness a practical progression: familiar tools, explicit references, then reusable workflows.
Start with familiar tools
Common development tools are useful harness primitives because coding assistants usually know their syntax and can inspect their output directly. Commands such as
rg
,
git log
, and
git diff
expose the repository’s current structure and history without requiring a separate integration.
Put a short list of preferred tools in
AGENTS.md
:
- Use `rg` to find existing implementations before adding an abstraction.
- Use `git log --oneline -- <file>` to investigate surprising code.
- Use `git diff` before summarizing or committing changes.
- Use the repository's test and lint targets to validate edits.
Keep the instructions specific to decisions that matter in your repo. If the assistant already uses a command correctly, a tutorial adds little. The useful guidance is where to start, which project conventions to follow, and what evidence to inspect before changing code.
These defaults also travel well across assistants and editors. A repository’s history, command output, and tests remain useful even when the model or agent interface changes.
Document unfamiliar commands
An internal CLI or custom script needs more explanation. Its name may suggest what it does while hiding important details: required flags, working directory, generated files, or prerequisites.
Give the agent a compact reference covering
purpose, when to use it, a safe example, and how to inspect help
. For a migration helper, that might look like this:
Use scripts/create_migration.py when a change needs a database migration.
It generates migration files using this repository's naming conventions.
Example: python scripts/create_migration.py --name add_user_timezone
Help: python scripts/create_migration.py --help
Inspect the generated migration before applying it.
If generation fails, report the error before choosing another approach.
The reference should answer the questions an agent would otherwise resolve through trial and error. If a command requires a particular environment or produces an artifact that needs review, say so. Keep longer explanations in a linked tool reference.
Help output gives the assistant a way to recover when its assumptions are wrong. Teach it to inspect that output before inventing another flag or repeating a failed invocation. A small, maintained reference is often enough; start there before adding a more elaborate workflow.
Turn recurring failures into skills
Sometimes the command is straightforward, but the surrounding workflow keeps going wrong. The assistant may skip a prerequisite, run steps in the wrong order, misread the result, or mark work complete before validating it. That is a useful trigger for a skill.
A skill should explain the sequence, the decisions between steps, and the completion criteria. For the migration helper, a focused workflow could be:
Inspect the schema change and nearby migrations.
Generate the migration with the repository helper.
Review the generated operations and rollback behavior.
Run the relevant migration checks in the documented test environment.
Report what changed, what passed, and anything unresolved.
Add recovery guidance where experience shows it is needed. If generation fails, inspect the error and help output. If validation exposes an ambiguous data conversion, surface that decision before proceeding.
Build the skill around a recurring task with recognizable failure modes. Its value comes from carrying the workflow knowledge that a command reference alone cannot supply.
Keep skills focused and task-relevant
The size of your skill library and the number of skills needed for a task are separate decisions. You can maintain guidance for many workflows while loading only the few relevant to the current change.
SkillsBench
offers a useful signal. In its reported task groups, one skill improved performance by 18.0 percentage points, two to three by 19.0 points, and four or more by 10.1 points. Its length comparison also showed larger gains for compact and standard guidance than for comprehensive documentation. These comparisons support a practical starting point: a small set of focused skills. They do not establish a universal limit for every repository or task.
Make each skill’s description precise enough for the agent to select it: what it handles, when to invoke it, and which neighboring tasks belong elsewhere. Avoid several skills giving slightly different instructions for the same responsibility. When you already know the right skill, invoke it explicitly.
Keep SKILL.md centered on the steps and decisions needed to execute the workflow. Link to extended examples and background material so they can be read when relevant. As you revise skills, remove obsolete workarounds and repeated instructions. Otherwise, the guidance accumulates the same ambiguity it was meant to resolve.
Checklist
Name the repository’s preferred tools and explain where each helps.
Document unfamiliar commands with their purpose, prerequisites, examples, and help path.
Promote recurring workflow mistakes into a focused skill with validation and recovery steps.
Load skills according to the current task; keep their responsibilities distinct.
Review guidance when tools or conventions change, pruning duplication and obsolete instructions.
4. A discoverable validation menu
An agent can only improve its own work if it can check the result. Give it a discoverable menu of validation commands, tell it to prefer that menu, and connect the commands to the checks your team actually relies on. Keep the command definitions in the repository’s existing task runner. The examples below use a
Makefile
, but the same approach works with other runners: one place to discover what to run and how.
Name checks by intent
Name tasks after the outcome the assistant needs:
lint
,
test-unit
, t
est-integration
, or
check
. These names make it easier to match a validation goal to a command and let you change the underlying tool without rewriting agent instructions.
The target also records the correct invocation, including details that are easy to miss when reconstructing it from the environment:
.PHONY: lint test-unit check
# CI: static-analysis
lint: ## Run the project's lint checks
uv run ruff check .
# CI: unit-tests
test-unit: ## Run unit tests
PYTHONPATH=. uv run pytest tests/unit
check: lint test-unit ## Run lint and unit tests
Adapt the recipes to your project. Environment setup, paths, exclusions, and flags belong here, where humans and CI can use them too.
Choose descriptions that explain scope. A target called
test
is ambiguous if it runs only unit tests; its description should make that clear. Likewise, distinguish checks that modify files from checks that only inspect them. The assistant needs enough information to choose an appropriate target and interpret its result.
Make the menu easy to discover
A command registry only helps if the assistant can find the right entry quickly. For Make, provide a
help
target that prints target names and their descriptions. Generate that output from the
##
comments beside each target, so the menu stays attached to the command definitions.
The result should be short and useful:
lint Run the project's lint checks
test-unit Run unit tests
test-integration Run integration tests
check Run lint and unit tests
Other runners provide similar discovery through their task-listing commands. Use the mechanism your team already maintains.
Include prerequisites in the descriptions or link to a short setup reference when needed. An integration target that requires a running database should make that dependency discoverable. This reduces failed attempts caused by missing setup and helps the agent distinguish an environment problem from a regression.
Tell the agent to prefer the menu
In our testing, a discovery pointer alone was insufficient. An assistant told to inspect the Makefile used its targets for tests, then constructed its own
ruff
command for linting. It detected
uv
and assembled a plausible invocation, but missed details encoded in the repository target.
The lesson was simple: discovering a command and choosing to use it are separate behaviors. State the preference explicitly in
AGENTS.md
or
CLAUDE.md
:
Discover validation commands with `make help`.
Prefer an existing Make target when it matches the check you need.
Before invoking a tool directly, look for a matching target.
When no target fits, such as for a single test file, inspect the closest
target and keep your command consistent with its environment and flags.
Validate during implementation and run the required completion checks
before reporting the task finished.
This instruction gives the assistant a decision procedure without duplicating the command menu. The fallback matters: a targeted test can be useful during debugging even if the registry exposes only a broader suite. If the same custom invocation becomes routine, add a parameterized target so the next session can discover it.
Have CI invoke the same targets developers and agents use locally. Document which targets belong to each stage, as the comments in the example above do, and keep that mapping current when the pipeline changes. This reduces differences between the checks an agent runs and those that gate a merge.
Give the workflow a cost ladder. During implementation, run the cheapest checks that confirm a change works: a targeted test, lint, or a relevant unit suite. Before completion, run the broader required checks. Make dependencies and ordering explicit where one stage needs another’s output.
Fast checks encourage validation throughout the task. Use parallel execution where the suite supports it, avoid repeatedly performing unchanged setup, and keep targeted checks available. Optimize the command definitions once so every caller benefits.
Commands must also fail clearly. A check that prints errors but exits successfully can mislead both the agent and CI. Return a non-zero exit status on failure and provide readable output. Ask the agent to report the checks it ran, their results, and anything it could not validate. Those observations feed the bounded feedback loop in the next section.
Checklist
Keep validation commands in one maintained registry with names and descriptions that explain their scope.
Provide a cheap discovery command and document prerequisites.
Tell the agent to prefer matching targets, with a fallback for targeted checks.
Reuse targets in CI and keep the stage mapping current.
Offer fast checks during implementation and broader checks before completion.
Make failures observable through exit status, readable output, and reported results.
5. Close the loop on text-observable systems
A coding agent is only as good as the feedback it can observe.
It can generate code, but unless it can also
run something
,
read the result
, and
decide what to do next
, it is basically working blind. This is why one of the most useful harness patterns is a small self-feedback loop: let the agent make a change, validate it through tests, CLI output, API responses, or code review, then loop once or twice on the observed result.
The important part is not “agent autonomy” for its own sake. The important part is giving the agent access to
ground truth
.
For software tasks, that ground truth usually comes from things like:
- Unit tests
- Integration tests
- Type checks
- Linters
- Security scanners
- API smoke tests
- CLI command output
- Structured code review output
Without this loop, the agent may produce plausible-looking code that does not compile, violates project conventions, breaks an edge case, or introduces a security issue. With the loop, the agent can see that something is wrong and attempt a fix before handing work back to a human.
Agent writes code
↓
Run validation command
↓
Observe text output
↓
Fix or report
↓
Stop after retry cap
A minimal convention for this is:
validate → observe → report
The agent should not just run a command. It should explain what it ran, what it observed, what it changed because of that observation, and whether the result is now good enough to proceed.
Why limit caps matter
Self-feedback loops are useful, but unbounded loops are dangerous.
An agent that keeps trying to fix failing tests forever can burn time, pollute the diff, and drift away from the original task. The harness should make it explicit that the agent gets a limited number of attempts, and after that it must escalate to a human.
Example: Bounded review/fix loop
A useful self-feedback loop does not have to be complicated. The cleanest version is:
The key idea is that the orchestrator owns the loop. It does not review code itself and it does not fix code itself. It delegates the noisy work to focused subagents and keeps only loop state in its own context – so the agent can improve its own work, but it cannot run forever.
This is the part that keeps the main context clean. The orchestrator should never ingest verbose review essays, raw logs, or every detail of the fixing process. The reviewer hands back compact findings; the fixer hands back a compact change summary. Everything else stays inside the subagent that produced it.
The orchestrator’s context holds loop state only. That is what keeps a long loop cheap and debuggable.
The orchestrator
The only place retry state lives
Reviewer and fixer subagents never decide whether to keep looping – they do one job and return structured output. The orchestrator increments the iteration count and stops when the cap is reached. Its skill definition opens with a clear role statement so it doesn’t “helpfully” start reviewing or fixing code itself, and disables model invocation so it’s only ever run deliberately.
---
name: review-looper
description: Run a bounded review/fix loop for the current branch. Orchestrates a reviewer subagent and a fixer subagent, tracking iteration count and enforcing a max-iteration cap before approving or escalating to a human.
disable-model-invocation: true
---
The retry cap is explicit and lives in orchestrator context – this is the safety rail. Max review iterations is 3. The decision logic is: approve when the reviewer returns no high or critical findings; escalate once the iteration count reaches the cap, copying anything unresolved into the handoff; otherwise select the findings worth acting on and pass them to the fixer. The loop state is kept in context and printed at the start and end of every iteration so the progression stays visible:
The reviewer observes the diff and returns compact findings. It never edits files, commits, or writes a long review essay – its tools are limited to Bash, Read, Grep, and Glob. Crucially, it returns only JSON, so the orchestrator gets data it can route to the fixer rather than prose it has to reinterpret.
reviewer – output
{
"summary": "<1-2 sentence overview of the diff>",
"findings": [
{
"id": "F1",
"severity": "critical | high | medium | low",
"file": "path/to/file.ext",
"line": 123,
"category": "correctness | security | design | tests",
"title": "<short headline>",
"detail": "<what is wrong and why it matters>",
"suggested_fix": "<concrete, targeted change>"
}
]
}
The Fixer subagent
Scoped to selected findings
The fixer doesn’t receive the whole task – only the findings the orchestrator selected, which keeps changes targeted and scoped. It adds
Edit
and
Write
to the reviewer’s toolset, applies the changes, and reports what it could not address so those items carry forward as candidates for the unresolved list. Like the reviewer, it returns only JSON.
fixer – output
{
"summary": "<1-2 sentence overview of what changed>",
"changes": [
{
"finding_id": "F1",
"status": "fixed | partial | skipped",
"files_changed": ["path/to/file.ext"],
"description": "<what changed and how it resolves it>",
"reason_if_skipped": "<required when skipped or partial>"
}
]
}
Why this pattern is useful
The self-feedback loop is bounded.
The agent can review, fix, and re-review, but only up to the max iteration count.
The main loop stays clean.
Reviewer and fixer subagents return structured data, not verbose output. The orchestrator only stores:
– current iteration
– selected findings
– fixer summaries
– unresolved findings
– final decision
The failure mode is useful.
When the loop cannot resolve something, it stops with a human-readable handoff.
## Review loop result
Status: escalated
Review iterations used: 3/3
Unresolved findings:
- F4, high, security, `src/auth/token_service.py:42`
Token refresh behavior needs a product/security decision.
Fixed during loop:
- F1: normalized expiry timestamps to UTC
- F2: added missing regression test for expired tokens
Why stopped:
Max review iteration count reached.
That is the core harness move: let the agent observe its own side effects, but make the loop structured, delegated, and capped.
6. Visual feedback for UI work
For many frontend tasks, the agent does
not
need screenshots. It can usually validate behavior through cheaper, text-observable signals:
– tests
– DOM text
– accessibility snapshots
– console output
– network output
– route changes
Use those first. They are cheaper, easier to diff, and usually more reliable than asking the model to judge a full screenshot.
But some UI failures are inherently visual: broken spacing, clipped content, overflow, wrong stacking order, responsive layout bugs, chart rendering, canvas state, contrast, or “this technically works but looks wrong.” That is where visual feedback becomes part of the harness.
The rule of thumb:
Prefer text.
Use screenshots when pixels are the requirement.
A simple visual feedback ladder
Browser UI: Playwright first
For browser apps, Playwright gives you a good escalation path:
# Text-first validation
npx playwright test tests/ui/example.spec.ts --project=chromium
# Visual regression check
npx playwright test tests/ui/example.visual.spec.ts --project=chromium
# Debug a multi-step flow
npx playwright test tests/ui/example.spec.ts --project=chromium --trace on
npx playwright test tests/ui/example.spec.ts –project=chromium –trace on
Use
Playwright tests / CLI
when the check should become repeatable. Use
Playwright MCP
when the agent needs to explore the UI interactively.
A minimal visual regression test:
import { test, expect } from '@playwright/test';
test('settings panel does not visually regress', async ({ page }) => {
await page.goto('/settings');
await expect(page.getByRole('main')).toHaveScreenshot(
'settings-panel.png',
{ maxDiffPixels: 100 }
);
});
Keep screenshots narrow. Prefer an element, component, dialog, or viewport state over a full-page screenshot. Full-page screenshots are useful, but they are often too noisy for an agent loop.
Mobile UI: an adb screenshot loop
For mobile UI, pixels often matter earlier: native layout, keyboards, gestures, system bars, density, and device-specific rendering can be hard to infer from text output.
Do not ask the agent “does this look good?” Ask a narrow visual question:
Inspect the screenshot and answer only:
- Is the primary CTA visible above the fold?
- Is any content clipped or overlapping?
- Is the keyboard covering the input?
- Is the price text readable?
Add this to AGENTS.md
## UI validation
Use the cheapest evidence that can prove the UI change worked.
1. Prefer tests, DOM text, accessibility snapshots, console output, and network output.
2. Use screenshots only for layout, clipping, responsive behavior, charts/canvas, visual regressions, or design fidelity.
3. Prefer element/component screenshots over full-page screenshots.
4. Use traces or short recordings for multi-step failures.
5. For mobile UI, use `adb exec-out screencap -p` or `screenrecord`.
6. When visual evidence is used, report the artifact path and what it proved.
7. Do not make more than 2 screenshot-driven fix attempts without escalating.
What did not work
Screenshots are useful, but they are token-hungry and easy to overuse.
We also tried compressing screenshots more aggressively, including blue-noise-style dithering. It did not reliably help. It made images smaller, but model judgment got worse on the details that mattered: small text, subtle spacing, and low-contrast UI.
The better compression strategy was boring:
- crop to the relevant component
- prefer element screenshots
- ask one specific visual question
- avoid full-page screenshots unless necessary
- cap screenshot-driven retries
Checklist
Start with text-observable validation.
Use screenshots only when the task depends on pixels.
Prefer targeted screenshots over full-page screenshots.
Use visual diffs for regression risk.
Use traces or recordings for multi-step failures.
Use adb screenshots for mobile UI.
Cap screenshot-driven retries.
Promote repeated visual bugs into tests, visual snapshots, or harness rules.
7. Old Prompts Backfire on New Models
A prompt is calibrated to a specific model. Upgrade the model, keep the prompt, and the calibration is gone – usually in the direction of over-compliance, not under-compliance.
The important part is not that the new model is worse at following instructions. It is
better
at following them – including the parts you never really meant.
The incident
A rule written for an older coding agent, as a cheap insurance policy against sloppy pushes:
NEVER push a PR unless the local build is green.
Then the model got upgraded, but so the result of your prompt. Same prompt, two models:
The rule encoded a
proxy
(“green build”), not the
intent
(“don’t ship broken changes”). A better model optimizes the proxy harder:
Local failure
Your fault?
Correct action
Rigid rule does
Test also red on main
No
Push, note it
Block ✗
Known flaky test
No
Push, note it
Block ✗
Unrelated package fails, yours untouched
No
Push, note the scope
Block ✗
Your code breaks a test
Yes
Fix first
Block ✓
Why rigid rules backfire
A NEVER/ALWAYS rule is a
pre-decision
. You decided the outcome of every future situation before seeing any of them – and silently assumed the model would apply “reasonable” judgment on top.
Newer models increasingly read NEVER as “zero judgment, you said never.” Which produces this loop:
The rule outlives its reason.
It was compensation for one model’s sloppiness; the sloppiness is gone, the rule remains.
Negative rules carry no goal.
The model knows what not to do, but has no basis for the neighboring cases you didn’t enumerate – so it defaults to refusing.
The fix: intent + decision procedure + escape hatch
Rewrite prohibitions into three parts: the outcome you actually care about, how to decide at runtime, and what to do when unsure.
rewrite 1 – the build gate
– NEVER push a PR unless the local build is green.
+ Don’t ship changes you have reason to believe are broken.
+ Run the build; if it fails, check whether YOUR change caused it.
+ Pre-existing or flaky failure -> say so and proceed.
+ Can’t tell -> stop and ask.
rewrite 2 – dependency paranoia
– NEVER add new dependencies.
+ Prefer stdlib and existing deps. If a new dep clearly wins,
+ propose it with a one-line justification.
rewrite 3 – clarification gating
– ALWAYS ask for clarification before writing code.
+ Ask only when ambiguity changes the design. Otherwise state
+ your assumption in one line and proceed.
The transformation is always the same:
Reserve literal NEVER/ALWAYS for
true invariants
– secrets, destructive ops, prod access. Not workflow preferences.
That is the core move:
stop pre-computing decisions in the prompt, state the outcome you care about, and let the model decide with real context in front of it – bounded by “surface it if unsure.”
8. Plan-mode pitfalls (and when to just YOLO)
Plan mode feels safe: the assistant reads the repo, writes a plan, you approve it, and implementation begins. The trap is that approval is not neutral. In many coding assistants, accepting a plan behaves like an agent handoff: the implementation agent receives the plan text as a high-priority instruction, while much of the exploratory context that produced it is gone. If the plan is incomplete, over-specific, or based on a wrong assumption, you did not reduce risk – you promoted the mistake into the task contract.
We saw this while experimenting with
Superpowers
-style planning skills. The workflow was useful for forcing discussion, but for regular coding work it became too verbose: long brainstorming, long design docs, long implementation plans, and a lot of paid model time spent producing text nobody wanted to read. In the worst cases, it felt like money spent on nothing: the assistant produced polished planning artifacts, but the final diff was not better.
Other users report the same failure mode. In a
Hacker News discussion
, one user said Superpowers-like frameworks burned roughly
10× more tokens
with no clear benefit for their workflow, while another described the design document being expanded into a second implementation document and then delegated to subagents even for trivial changes. A
Reddit thread about Superpowers planning
describes slow plan generation, drained limits, and implementation plans that consume far more tokens than expected.
That does not mean Superpowers skills are useless. The pieces people seem to like are narrower:
brainstorming
for fuzzy requirements,
test-driven-development
and
systematic-debugging
for disciplined implementation, and
verification-before-completion
/
code-review
skills for final checks. Borrow those opt-in when the task needs discipline, not as a default tax on every edit.
This is not a blanket argument against planning. Some users like Superpowers because the plan sketch and editable markdown docs make big tasks easier to review than Claude Code’s built-in plan mode. The pitfall is using heavyweight planning by default. For many coding tasks, the better loop is to start with a lightweight prompt, let the assistant explore, inspect the diff, then keep it or throw the attempt away with a clean reset.
That failed run is still useful. It tells you what context was missing. Did the assistant misunderstand the user journey? Add a short design note. Did it touch the wrong subsystem? Add an
AGENTS.md
pointer. Did it skip validation? Add a Make target or checklist. For low-risk tasks, a short implementation attempt can reveal gaps that a long planning discussion leaves hidden. Use what the attempt exposes to improve the harness before trying again.
Use heavier planning only when wrong work is expensive: cross-cutting migrations, security-sensitive changes, ambiguous product work, or tasks that need multiple agents. Even then, keep the plan short and force it to name assumptions, open questions, files likely to change, and validation commands – not every implementation step.
Checklist
Prefer a short plan sketch over a multi-page implementation plan.
Treat accepting a plan as accepting instructions, not just approving intent.
Keep plans editable in the repo when they are longer than a screen.
Use cheap throwaway runs for low-risk exploration.
Invoke narrow skills deliberately: debugging, verification, TDD, worktrees, or context grilling – not the whole workflow by default.
When a run fails, promote the missing context into
AGENTS.md
, a design note, a test, or a validation target.
Use heavy planning only when discarded implementation attempts would be more expensive than the planning itself.
9. The Agentic Garbage Collector – let the agent record its own mistakes
Every agent session generates friction that never makes it into the diff. The agent works around a confusing abstraction, makes a wrong assumption and recovers, notices a test that asserts the wrong thing, or gets corrected by a human. Today that signal evaporates when the context window closes, and the next agent rediscovers the same landmine. The Agentic Garbage Collector is a three-phase loop that stops the leak:
Capture
The agent needs a cheap, standing habit of jotting down what felt wrong while it works – into a scratchpad it appends to freely, or a notes file committed alongside the change so the signal stays attached to the exact diff. The bar to record has to be low enough that it never competes with the task, and a small
taxonomy
keeps the notes countable rather than free-form:
Record the incident clearly, and add a candidate principle when the lesson is clear. A correction like “don’t parse that untyped payload here” might suggest a broader rule:
“unknown external data is validated at the boundary before it enters business logic.”
In our experiments, agents sometimes proposed rules that were too closely tied to the original correction to apply elsewhere. When the broader lesson is unclear, leave the principle blank; the distillation pass can revisit it alongside related incidents and human feedback. Keep capture focused on actionable friction, including existing problems that affected the task, and exclude unrelated baseline noise.
The hard part, in practice, is getting the agent to do this ambiently at all.
We put the instruction in
AGENTS.md
and
in a skill, and it still recorded nothing until asked at the end – then produced excellent notes, reconstructed from memory. Its own words:
“Fair catch – I should have been recording those ambiently as I hit them, not at the end.”
This is the same lesson as the prompting and validation sections: a passive “when you notice something, also do this” instruction loses to the primary objective. The fix is to make capture
part of the harness, not a request
– a stop-hook that asks “you changed code but logged nothing, did you hit anything weird?”, or folding the prompt into PR creation. Treat ambient self-reporting as unreliable and build a checkpoint that forces the question.
Surface
At PR time, the accumulated notes – plus any verbatim human steering from the session – get pulled into the PR summary, so a reviewer sees
what the agent found strange while building this
. Someone who reads “adding one knob needed four hand-synced sites” across three PRs in a row has the evidence to justify a refactor – evidence that otherwise never gets written down.
Distill
Capture without distillation just relocates the entropy: a notes file grows fast, and an unmanaged log soon becomes too long to read and a cost to carry. So a scheduled pass reads the notes together with PR comments and failed CI, clusters them, prunes what’s resolved, and
promotes
the recurring ones. The promotion rule is a bright line, not a judgment call:
The same mistake twice, or 2–3 human unblocks on the same theme → it becomes a rule, test, or check – not another note.
Recurring principles land in an append-only
GOLDEN_PRINCIPLES.md
(with an
AGENTS.md
pointer); repeatedly-broken behavior becomes a regression test with a
why
docstring; anything mechanically detectable becomes a linter rule.
GOLDEN_PRINCIPLES.md
is the memory-compiler output – the durable form of those distilled principles, promoted only once they’ve proven recurring.
One caution: in noisy, fast-moving environments, unguarded self-repair balloons context and tokens. If every oddity becomes a rule, the guidance set bloats and rules start to conflict (see the “how many skills” evidence earlier). Keep the durable layer
general and stable
, put case-specific fixes in a separate
errata file
, and require a
human to ratify
before an erratum becomes a general principle. The GC proposes; a person approves – which is also where an over-fit, too-narrow rule gets caught.
Checklist
Agent records weirdness as it works, cheaply, against a small
taxonomy
so notes stay countable.
Notes capture the
underlying principle
, not just the incident – and skip
baseline noise the agent didn’t create
.
Capture is enforced by a
harness checkpoint
(stop-hook / PR gate), not an
AGENTS.md
line – ambient self-reporting is unreliable.
Notes are
surfaced at PR time
alongside verbatim human steering.
The same mistake twice
, or 2–3 human unblocks on the same theme →
propose a rule, test, or check for human review
.
Durable output lands in
GOLDEN_PRINCIPLES.md
, regression tests, or linters; case-specific fixes go in an
errata file
a
human ratifies
.
Summary
Getting more out of coding agents starts with
giving them a better setup
: useful repo docs, the right context, and quick ways to check their work. Keep skills focused, avoid overplanning small tasks, and let agents fix what they can—with limits on retries. When the same mistake keeps coming back, turn it into a test, a check, or clearer guidance.
Models and coding tools will keep changing. A good harness should make those changes easier to absorb by keeping the workflow, validation rules, and engineering standards stable.
Explore more insights and resources
Anthropic IPO filing: $1.7B quarterly payroll, about $107K per employee monthly
Harvard University data breach exposed info of 851,000 accounts
Bleeping Computer
www.bleepingcomputer.com
2026-11-03 05:53:25
Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. [...]...
Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned.
Harvard is a private Ivy League research university with over 20,000 faculty and staff, over 24,500 undergraduate and graduate students, and more than 400,000 alumni worldwide.
As the university
discovered on November 18, 2025
, the attackers gained access to the personal information of students, alumni, donors, staff, and faculty members, including email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and "biographical information pertaining to University fundraising and alumni engagement activities."
However, Klara Jelinkova, Harvard's Vice President and University Chief Information Officer (CIO), said the breached IT systems didn't store Social Security numbers, passwords, payment card information, or financial information.
Although Harvard has not attributed the attack to a specific hacking group or threat actor, the ShinyHunters extortion gang
claimed responsibility
and said it stole over 1 million records containing identifiable information and donation data after breaching the university's systems.
The cybercriminals then leaked a 1.1GB archive of documents on their dark web leak site in early February after Harvard refused to pay a ransom to have the stolen data returned and destroyed.
Harvard University on ShinyHunters leak site (BleepingComputer)
While a Harvard spokesperson could not share how many individuals had their information exposed when BleepingComputer reached out at the time for more details, Have I Been Pwned analyzed the data leaked by the cybercrime gang and confirmed on Tuesday that the breach
exposed the data of 850,500 accounts
, including names, email addresses, dates of birth, phone numbers, physical addresses, social media profiles, and more
"The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students," it said.
In October 2025, Harvard also told BleepingComputer that it
was investigating a second data breach
after the Clop ransomware gang claimed that it had breached the university's systems using an Oracle E-Business Suite (EBS) zero-day vulnerability.
Sharp Left Turn: Democrats Have a Shot to Take Congress on Socialist Momentum
Intercept
theintercept.com
2026-11-03 05:52:00
Voters in Maine, Michigan, and Texas said they want to see Democrats deliver Medicare for All, social welfare spending, and lower prices. And fewer campaign mailers.
The post Sharp Left Turn: Democrats Have a Shot to Take Congress on Socialist Momentum appeared first on The Intercept....
Democrats are on
the verge of reversing their political fortunes. The party is heading into the midterm elections Tuesday under the kind of conditions campaign consultants dream of, after two years wielding hardly more power than a strongly worded letter.
Donald Trump has spent the erratic waning years of his presidency leading his party into a political wilderness by waging a deeply unpopular war on Iran and driving the cost of living ever higher. Republicans who enjoy a governing trifecta have tried to distance themselves from the party’s decision-making and its leader, a once-animating force who has turned himself into a liability. Poll after poll says the same: Democrats are poised to take control of one or both houses of Congress — and spend the next two years thwarting Trump’s agenda.
“I really like the socialism aspects,” said Gibrel Said, a supporter of Abdul El-Sayed at his closing rally in Detroit Monday night. In the marquee contest serving as a
referendum
on the
Democratic Party’s future
, the Michigan Democratic Senate nominee espouses progressive politics and has often been associated with the the left’s agenda-setting
socialists
, though he
doesn’t identify as one
. His race has been rocked by the kind of left-versus-right identity crisis that presents a perennial challenge for Democrats.
“One, Medicare for All; two, how do we fund things that help us as constituents,” Said told The Intercept, ticking off things he appreciates about the candidate. Said, who lives in the Arab enclave of Dearborn, Michigan, especially praised El-Sayed’s willingness to buck party leadership and speak out on
U.S.–Israel policy
. “Instead of tiptoeing around the subject, he very adamantly says, hey there’s a genocide happening here, we shouldn’t send our money.”
Cycle after cycle, in state after state, an insurgent band of Democrats critical of the political establishment’s ties to corporate interests and its unflinching commitment to Israel has had to overcome the barriers erected by its own party’s centrist leadership. Both sides present themselves as the true representatives of working people: the centrists by arguing that more transformative ideas will scare off lower-information voters, the left by saying they represent the masses.
How much of this trickles down to actual voters? On Monday, The Intercept followed canvassers and spoke to voters in Michigan, Maine, and Texas, asking about which issues had permeated and taking the temperature of voter enthusiasm. Some rolled their eyes at the spats that have dominated the headlines, dismissing the idea that
eleventh-hour backstabbing
would make a difference. Others regurgitated right-wing misinformation. Many complained of too many campaign mailers.
“They’re wicked mean,” said Sharon McDonnell, a supporter of Troy Jackson, the Democratic Senate nominee in Maine. Speaking to The Intercept in the town of Yarmouth, she described one mailer that included a photo of Jackson chomping a cigar and describing him as “evil.” “It’s just nasty.”
In Maine, the party’s left flank
seized power
in the nominating process for the Democratic Senate candidate — then fought to hang onto it after onetime rising star
Graham Platner flamed out
after a sexual assault allegation (which he denies). With Jackson, a former state Senate leader, Maine now offers progressives one of two opportunities to test their message at the Senate level, where a candidate has to secure appeal statewide, not just in deep-blue House districts.
The dustup has had Democrats biting their nails and moderate party leaders making the cable news circuit to demand party discipline — this time, to scold a centrist. The party leads in the polls for
218 of the 435
seats up for grabs in the House of Representatives, but they need to perform well in seven key states — Alaska, Iowa, Kansas, Ohio, and Texas, in addition to Maine and Michigan — if they want to win the Senate.
“I think she’s counterintuitively, perhaps, given people a reason to rally some more,” said Kathleen Britton, an El-Sayed supporter at the Detroit rally on Monday, of Stevens. “I really don’t think it’s gonna help Mike Rogers.”
Earlier that day, in a predominantly Black neighborhood of Detroit, a prominent Black supporter of El-Sayed preparing to knock on voters’ doors described Stevens’s endorsement as an “ego-driven statement.”
Haley Stevens “used a Black church as a prop, and we have seen that time and time again.”
Mike Bland, the executive director of the Black Men Vote PAC, highlighted that Stevens made her public endorsement of Rogers in a Black church in Detroit. He doubted that Stevens, whose criticism of El-Sayed centers primarily on his skepticism of the
U.S. relationship with the state of Israel
, would be able to pull Black voters to Rogers, a conservative former House representative whose campaign has repeatedly peddled anti-Muslim tropes against El-Sayed.
“How can I say this without cursing? She used a Black church as a prop, and we have seen that time and time again,” Bland said. “Black folks aren’t stupid.”
Over the past month, El-Sayed has rallied with Barack Obama and Kamala Harris, the two most prominent Black politicians in America — and hardly radicals estranged from the establishment power center. At the same time that Stevens was making her endorsement of Rogers public, El-Sayed was attending a get-out-the-vote event at another church in Detroit. The two primary foes were supposed to appear together that day with Rep. Jim Clyburn, D-S.C.
One of the Democrats’
most coveted Senate pickups didn’t present much of an opportunity for the left in the primary, but it has still been characterized by intraparty animosity.
In Texas, where both Democratic Senate primary contenders espoused relatively moderate politics, outgoing Rep. Jasmine Crockett, D-Texas, has declined to campaign with state Rep. James Talarico, though she endorsed him after he
beat her
in the state’s March Democratic primary.
Talarico has been performing well with
Latino voters
, a massive voting bloc that helped
fuel his primary victory
. But Crockett — who, unlike Stevens, is Black — has suggested that Talarico has not done enough to excite Black voters, a demographic she carried in the primary. On a canvassing operation targeting Black voters in the Dallas–Fort Worth area on Monday, few Black Texans who spoke to The Intercept expressed excitement for Talarico. But most had already voted for him, saying they were motivated to do their civic duty.
Black voters frequently discussed concerns over affordability, gas prices, and homelessness. Canvassers told The Intercept they had heard some of those voters express concerns over their perception of Talarico’s policies toward transgender children, at times espousing blatant misinformation, such as the idea that Talarico supported arresting parents who refused to give their children gender-affirming surgeries.
“ I don’t stand for that,” said voter Jermiah Robinson, referring to her belief that Talarico pushed “sex-change” surgery for minors. Like many voters, she cited the cost of living as her most pressing issue. Robinson said she would “want to vote for him if he stands by his words, and he’s actually like ‘Yeah, I’ll help out as far as prices and everything.’”
Talarico appears to have improved his margins with Black voters in the final stretch. According to the Texas Politics Project at the University of Texas, Talarico is leading with
79 percent
of the Black vote, signaling a significant increase in support from Black voters from
just last month
. The conventional wisdom suggests that he could barely ask for a better opponent than the
scandal-plagued
Republican candidate, Texas Attorney General Ken Paxton.
In 2015, Paxton was
indicted
on felony securities fraud charges in Texas, in a case that dragged on for roughly nine years, and ended with Paxton being required to do community service and pay restitution. And in 2023, the Texas House of Representatives voted across party lines to impeach him as attorney general for alleged corruption and retaliation against whistleblowers.
Scandal kept rocking
the race for Senate in Maine, where longtime Republican incumbent Sen. Susan Collins faces her toughest reelection challenge yet from Jackson. Before Jackson, who lost a race this cycle for the state’s Democratic nomination for governor, there was Platner, hailed early as a working-class champion who faced a series of personal scandals in his successful primary campaign. There was the revelation of a Nazi tattoo that he
claimed
not to understand until last October. There were crudely worded Reddit posts and stories of cruelty from women he’d dated. One former girlfriend’s allegations of sexual assault ultimately
ended his campaign
— and set off a scramble to find a replacement that progressives ultimately won by elevating Jackson.
By Monday, Mainers who spoke to The Intercept appeared exhausted by the lengthy, contentious, and expensive Senate race that has dominated the state.
“There’s a lot of fatigue. People are tired of it,“ said Charlie Dingman, who chairs the state Democratic Party. “I have had some conversations at doors with people that have led me to think that the extremely negative and extremely untruthful ads may be backfiring.”
Tyler Echard, in Norway, said he’d already cast an absentee ballot for Democrats down the ticket. He was disgusted with a deluge of political mailers and eager to stop seeing them pile up on his doorstep.
“The amount of mailers we get — just mailers, not just handed at the door but in the mail — especially from the Republican side, the amount of money is probably more than I will make in my lifetime, spent in this election,” Echard said. “At some point, we gotta get legislation because money’s just gonna run everything into the ground. I ain’t got it, so I can’t influence it.”
Frustration with the status quo in Congress could spell the end for Collins’s 30-year career in the Senate. On Monday, a University of New Hampshire poll found Jackson
leading
Collins by 4 percentage points. And in September, Collins found herself thrust into a scandal of her own, when ProPublica revealed that the FBI anti-corruption squad was investigating an alleged pay-to-play scheme
between Collins and a donor eager
to secure government contracts.
The Intercept later exposed that, alongside a series of campaign donations,
defense contractors cozy
with Collins had received
lucrative carveouts
in defense spending. (Collins has denied wrongdoing in all cases.)
But the incumbent senator has faced controversy and
come out victorious before
. And some Mainers doubt they’ll see change either way.
“I can’t vote for either side,” said a man, who declined to share his name with The Intercept, walking down a rural road in Norway with a hunting rifle slung over his shoulder. “You can’t trust neither of them.”
Noah Hurowitz reported from Yarmouth and Norway, Maine; Akela Lacy reported from Fort Worth, Texas
;
Matt Sledge reported from Detroit, Michigan
.
BREAKING: Revolut moved ~2,000 engineers onto self-hosted GLM for coding and pushed Claude Code and Codex to the exception list.
Per David Abitbol, who leads AI ops there: 56 Nvidia B200s, a blended 30 cents per million tokens, roughly a tenth of what they paid Anthropic and OpenAI. Engineering lead time improved 70%.
Here's the part that matters: the gains showed up when tokens stopped being rationed. Engineers quit saving AI for the hard tickets and pointed it at everything.
Frontier models become the exception, open weights become the default. That's a pricing problem for every lab heading to IPO.
h/t
@OliverMolander
Would you move your team off frontier APIs if the bill dropped 90%?
This is a game about language and rules. It consists of 27 questions, but
after the first seven, you can skip to the end.
At the end, I'll tell you how your results compared to those of others,
and discuss why I made this game.
Every question is about a hypothetical park. The park has a rule: "No
vehicles in the park." Your job is to determine if this rule has been
violated.
You might know of some rule in your jurisdiction which overrides local
rules, and allows certain classes of vehicles. Please disregard these
rules; the park isn't necessarily in your jurisdiction. Or perhaps
your religion allows certain rules to be overridden. Again, please
answer the question of whether the rule is violated (not whether
the violation should be allowed).
Apple warns of ‘unprecedented’ rise in memory chip prices
Guardian
www.theguardian.com
2026-11-03 04:01:19
iPhone maker says decision to raise prices has offset some of impact, as revenues are stronger than expectedBusiness live – latest updatesApple has warned of an “unprecedented” rise in memory chip prices, as it battles with datacentres to lay its hands on supplies. The iPhone maker’s shares fell in ...
Apple has warned of an “unprecedented” rise in memory chip prices, as it battles with datacentres to lay its hands on supplies.
The iPhone maker’s shares fell in after-hours trading after it told investors that the higher prices will eat into its profit margins.
“What we’re seeing with memory pricing right now is unprecedented,” John Ternus, Apple’s new chief executive, told a conference call on Monday, predicting that memory costs in the fourth quarter of this year would be even higher than in the previous three months.
Ternus said Apple’s decision to raise iPad and MacBook prices in June, followed by iPhone prices in September, had “provided some offset” for the company.
Ben Barringer, the head of technology research at Quilter Cheviot, said Apple’s results were “OK, if on the disappointing side”.
“Revenues were up 12%, driven primarily by iPhone sales and strong sales of Mac Mini, which users can use to apply agentic AI. China growth was robust which is pleasing to see, while iPad and wearables disappointed with services growing but lower than the group average at 10%,” he added.
“There appears to be a lot of interest in the iPhone Duo, but it is early days yet with the product not yet on full release, but it is hoped that can help drive the next leg of Apple’s product innovation.”
Apple’s shares were down 2.75% in after-hours trading on Wall Street.
Apple posted stronger-than-expected revenue in the fiscal third quarter, giving Ternus an upbeat start to his tenure, which began in September. The solid results bucked a downward trend for tech companies this quarter, as companies including Alphabet, Amazon and Intel had disappointing quarterly results.
Jacob Bourne, an Emarketer analyst, said record iPhone revenue and strong growth in China demonstrated the resilience of Apple’s business.
Apple earned $30.71bn (£22.89bn), or $2.10 a share, in the July-September period, up 12% from $27.47bn, or $1.85 a share, in the equivalent period a year earlier. Apple said its earnings included five cents a share from tariff refunds.
Revenue rose 12% to $114.5bn from $102.5bn.
Analysts, on average, were expecting earnings of $1.99 a share on revenue of $113.4bn, according to a poll by FactSet.
While its rivals are facing investor uncertainty over huge investments in artificial intelligence, Bourne said Apple’s “tepid approach” to AI infrastructure spending had helped preserve its cashflow – while partnerships with companies such as Alphabet could help the iPhone maker strengthen its AI capabilities without taking on the same financial risks as its peers.
Vibe Coded AO3 Clone Site Down After Fanfic Authors Buried It With 2,000 Takedown Notices in a Single Day
403 Media
www.404media.co
2026-11-03 03:49:58
ao3.life was scraping and repackaging fanfiction’ works and turning them into audiobooks for sale without the original authors’ permission....
A vibe-coded site that scraped Archive of Our Own (AO3) fanfiction works, reuploaded them and charged for audiobook versions is down now after the creator said they received over 2,000 takedown requests from authors in the single day it was up.
ao3.life
, a website that sprung up following last week’s announced weeks-long outage of fanfiction repository AO3, scraped the internet for works to populate the site using “a swarm of AI Agents controlling 40 virtual machines were scraping the internet for all drives, scrapes, and sources,” the site’s creator, named Ganesh, wrote on a page apologizing for the entire project. AO3.life went down on Monday evening following widespread backlash from readers and authors on social media.
Before it went down, the ao3.life homepage said, “AO3, saved before it slips away. Search every fandom, ship and trope. Read it here, keep the EPUB, or let it read to you when your eyes get tired.”
AO3 went down on Thursday
following a security incident, according to the Organization for Transformative Works (OTW) which owns the repository. The site is expected to be down for as long as four weeks. OTW says no data has been lost. Readers and authors are
generally distraught
, unable to access the site at all for potentially a month. AO3 hosts nearly 18.5 million works.
ao3.life offered works as EPUBs for reading on e-readers, and as AI-generated audiobooks that Ganesh charged for after the first three minutes. They claimed on a page titled “Authors get paid here” that authors would get 91% of the profits, with AO3.life getting 9% to cover “narration and processing” costs. “Your earnings wait for you. You don't need an account here to earn. We hold your share indefinitely until you collect it, however long that takes,” the site said.
On AO3, authors can “archive lock” their works, making them visible only to logged-in users, which keeps AI bots like this one from scraping them and also gives better control over how far a work spreads or whether it breaks the containment of the repository’s intended audience. Of course, authors couldn’t access AO3 while it was down to lock their works if they were publicly available before the outage.
But some authors reported the archive lock not mattering. “I had everything archive locked on ao3 and it's still all here and I as the author have 0 control over any of my fics on there,” one AO3 author
posted on Bluesky
.
ao3.life said at the bottom of the homepage that authors could request their works be removed from the site: ”Every work belongs to its author; if one is yours and you want it gone, email legal@ao3.life and it goes.” Proving that you’re the author of the work to ao3.life required authors “leave a note on your AO3 profile so we can confirm it's you,” the site said. But how authors could do that while AO3 was — and still is — completely down is a mystery.
A lot of authors clearly used the legal complaints email. “In the time this site has been up, I’ve facilitated over 2,000 takedown requests. It was never my intention to hurt so many authors - and I’m truly sorry to you all. There’s no way to show my sorry [sic] better than taking this site down,” Ganesh wrote. “Why did I charge for AI Slop audiobooks? I doubt anyone knows how expensive it is to run a server like this, especially with the amount of usage this site got. It had 126,592 unique users within 24 hours of going up, and had terabytes of bandwidth in usage. In an attempt to keep the site up, I thought audiobooks were a good option. I sold like 11 audiobooks, if it’s any consolation.”
Fanfiction has become a target of AI scraping, repackaging and reselling in recent years. In 2024,
I reported on how Etsy sellers
turn free fanfiction into printed and bound physical books, then list them for sale for as much as $100 a book.
With AO3 down and fans scrambling to find ways to keep consuming the works they miss, some people have started sharing links to Google Drives on Reddit and Discord of works they’d downloaded from the site previously, even if they aren’t the original authors of those works. This has alarmed and angered a lot of writers; whether authors have the right to profit from their works depends on the content and their use of existing intellectual property. Fanfic is typically considered fair use — I can write a
VeggieTales
Bob and Larry fic without getting sued by Universal Pictures if it’s sufficiently transformative, for example — but selling it could draw the ire of their lawyers, and a potential lawsuit even if I happened to ultimately win it. Authors on AO3 are prohibited by the platform from monetizing their works or linking to payment platforms.
“It was never and is not my intention to hurt authors, and I hope every subequent [sic] action I’ve taken is representative of that,” Ganesh said. “From an attempt at revenue sharing, to responding to takedown requests as fast as I could, to taking down the site as a whole.” They signed the note: “Yours truly, a 17 year old from India that thought they were doing something good.”
About the author
Sam Cole is writing from the far reaches of the internet, about sexuality, the adult industry, online culture, and AI. She's the author of How Sex Changed the Internet and the Internet Changed Sex.
Designing a planned switchover for minimum disruption
A
Neki
shard consists of one Postgres primary and multiple replicas. The primary accepts writes; the replicas do not. From time to time, we need one of those replicas to take over as the primary. We may be replacing a (Kubernetes) pod, upgrading the kernel, or moving the primary to another cell.
This is what we call a
planned switchover
. As opposed to an
unplanned failover
, which happens when there is unexpected server disruption, it is a routine operation that comes at an unavoidable cost: there is some period of time where Neki cannot reliably route writes to either the old or the new primary.
In this post we discuss how Neki minimizes that period, how it keeps applications from experiencing errors, and what happens if the switchover cannot complete.
An unplanned failover first needs to establish that the primary has failed. A primary that does not answer may be dead, or it may be inaccessible due to a network partition. Promoting a replica while the old primary is still writable can result in two writable primaries.
Failure detection therefore takes time. This is necessary time in an unplanned failover, because the system needs to understand what happened before it makes changes to cluster topology.
In a planned switchover, however, we already know the primary is going to step aside. Admin can use the time before that happens to check the shard and the potential promotion candidates. If any check fails, the switchover is rejected and the primary remains unchanged.
To safely promote a replica, we need to know it has received and applied all the
WAL
we expect it to have. But the primary is still running and can keep generating WAL while we're doing this! We can sample the primary's position and wait for a replica to reach it, only to find that the primary has since moved ahead.
Let's consider a simplified shard. We have primary
P
and replicas
R1
,
R2
, and
R3
. Assume Admin chooses
R2
as the promotion target.
The obvious way to stop the WAL position from moving is to stop Postgres on the primary. Patroni, a popular open-source Postgres cluster management tool, takes this approach. This is a well-considered design. A clean shutdown produces an unambiguous final WAL position, with no WAL creep left to account for. Patroni can validate a candidate named by the operator, or let the eligible replicas choose through its distributed leader election. The flow is simpler, with less state to reason about, and is proven at large scale.
However, stopping Postgres is a problem for HA. If something later prevents the replica from taking over, returning to the old primary requires starting Postgres again and may also require rewinding it. Until that completes, there is no primary to take writes. We wanted to keep the old primary available for as long as it is safe to do so, so that a failed switchover can return to it quickly.
Neki does things differently. It first asks the
Routers
to buffer queries that would go to the primary. Admin then changes the default for new transactions on the primary to read-only.
Neither of these actions prevents all future writes, however. Existing transactions can still commit, sessions can override the read-only default, and background processes can continue to generate WAL.
The switchover is designed with that in mind. Admin:
Samples
P
's WAL position and the replication state of its replicas.
Selects
R2
, which has flushed through the sampled position.
Disconnects
R1
and
R3
from
P
and records the final
receive_lsn
of each.
Takes the higher of the sampled primary position and the highest recorded
receive_lsn
.
Waits for
R2
to replay through that position.
Once
R1
and
R3
are disconnected, they cannot receive any more WAL. We now have a final WAL position, and must wait for
R2
to catch up to it.
Neki configures synchronous replication as
ANY 1 (...)
, listing all eligible replicas. We don't want one slow or unavailable replica to block the primary while another can acknowledge.
But which replica acknowledged a given commit? Suppose
R1
acknowledged the latest commit, while Admin intends to promote
R2
. First,
R2
must have flushed through the sampled primary position. Next, the final positions of the disconnected replicas become part of the position
R2
must replay. Once the others are disconnected,
R2
is the only synchronous standby still streaming, and no further commit can be acknowledged unless
R2
has flushed it.
This replication must also work after promotion. Admin prepares
R2
's replication slots and synchronous configuration, then attempts to attach the other replicas.
After this happens, at least one attached replica must appear in the configuration.
Otherwise,
R2
could become primary and immediately block waiting for an acknowledgement that no connected replica can provide. In that case, Admin rolls back instead of promoting it.
What about
P
? Once
R2
is promoted, Admin turns
P
into a replica of
R2
, through the same flow that creates any other replica. After it restarts as a replica,
P
participates in synchronous acknowledgements.
Neki Routers watch for the buffering signal published by Admin. During this period, a query that would go to the shard's primary is held by the Router instead of being sent to Postgres. Reads served by replicas are unaffected.
When the switchover completes, Admin removes the signal and Routers replan each buffered query using the new topology and sends it to the new primary. From the application's point of view, the query took longer to complete, but did not fail because the primary changed.
This is proactive buffering. In the case of an unplanned failure, buffering can only begin after the first query discovers the primary is unavailable. With a planned switchover, we can begin buffering before making any change to the primary.
There are a few limitations:
Admin does not wait for every Router to acknowledge the buffer signal. Buffering reduces disruption, but is not required for correctness.
The buffer has finite capacity, and each query has a deadline.
Queries fail if the buffer is full or the switchover takes too long.
A planned switchover should not begin unless Admin has good reason to believe it can complete. Neki prefers to reject the operation while the primary is still serving normally, rather than discover an avoidable problem after making it read-only.
Before changing the primary, Admin validates:
The shard state.
Only explicitly accepted states may proceed. Replication lag, divergent timelines, and other bad cluster states prevent the switchover from starting.
An operator-selected target.
If the operator names a target, Admin still verifies that it is a viable promotion candidate.
Logical failover slots.
If the shard uses logical failover slots, Admin waits for them to copy over to the promotion candidate.
Postgres capacity.
The candidate's settings must be compatible with all replicas. A replica cannot follow a primary with larger values for settings such as
max_connections
and
max_worker_processes
.
Only after these checks pass does Admin initiate a planned switchover.
Some checks necessarily take place after that point:
The target must have flushed through the sampled primary position and replayed through the final position.
The target must have all replication slots it will need, including failover slots created or changed since preflight.
At least one replica must be connected to the target and included in the synchronous configuration the target applied.
Admin reverts to the old primary if any of these fail. Only after they all pass does Admin attempt to promote the target.
Suppose
R2
passes all preflight checks but does not replay through the final WAL position. A rare scenario, but technically possible. Admin cannot wait forever as by this point
P
is read-only. The switchover therefore has a deadline.
At this point
P
is still running, while
R1
and
R3
are temporarily disconnected from the cluster.
When a rollback due to a switchover timeout is needed, Admin can make
P
writable again with a configuration reload and reconnect
R1
and
R3
. This immediately restores service.
The resulting guarantee of all this: under Neki's synchronous durability policy and the default
synchronous_commit = on
, every commit Postgres acknowledges is present on the target by the time it is promoted.
Planned switchover gives Neki an opportunity to prepare before it causes any disruption.
We have crafted the process of to be as seamless as possible, between Admin's handling of the various phases, and the Router's query buffering capabilities.
Planned switchovers are the foundation for shard resizes, version upgrades, and other parts of the Postgres cluster management lifecycle.
Getting them right is a key part to why Neki is the best way to operate highly-available Postgres databases.
Welcome to the Q3 2026 edition of the Firefox Security & Privacy Newsletter.
Security and privacy are core principles of
Mozilla’s Manifesto
and remain at the heart of Firefox’s development. This edition highlights key initiatives from Q3 2026 across three areas:
Firefox Security:
New security features, platform improvements, hardening efforts, and security integrations in Firefox.
Firefox Privacy:
New privacy features, enhanced protections, and privacy integrations in Firefox.
Community Engagement:
Highlights from our security research community and bug bounty program.
Preface
Note: Some of the bugs linked below might not be accessible to the general public and restricted to specific work groups.
We de-restrict fixed security bugs after a grace-period
, until the majority of our user population have received Firefox updates. If a link does not work for you, please accept this as a precaution for the safety of all Firefox users.
Rapid Releases, Now Even Faster:
Since September 2026, Firefox has followed a faster release cycle, bringing improvements, including security fixes, to users more quickly. We also invite you to
see and shape what’s next for Firefox
, including upcoming security and privacy features.
Many recent releases have included more
security fixes
. We continue to use frontier LLMs to identify and fix security bugs in Firefox to always keep you safe online. We have also changed how we publish advisories: instead of grouping internally identified memory safety vulnerabilities under a single CVE, we now publish a separate advisory for each bug, anticipating a
potential change to the CVE Numbering Rules
. CVE counts alone are not a reliable measure of security, as software vendors are not required to assign CVEs to vulnerabilities they discover internally.
Know when your TLS is broken:
Starting with Firefox 157, you will see
warnings in the site information panel
(the shield icon in the address bar) and in Settings when your connection may not be completely private. For example, if an administrator configures your Firefox to record its encryption keys, you will be able to catch that. Recording these keys could allow another software to read all of your encrypted web traffic without your knowledge.
Mozilla Root Store Policy v3.1
: We are strengthening transparency and assurance in the WebPKI with
Root Store Policy v3.1
, which introduces stricter transparency, documentation, and audit requirements for public certificate authorities.
Email Client Spam Prevention:
Firefox now
treats mailto: links as popups
, requiring explicit user action before opening the email client. This prevents websites from repeatedly opening email composition windows through JavaScript and overwhelming the user.
Restricting Local File Access for Extensions:
Starting in Firefox 153,
extensions need your explicit permission to access local files
through `file://` URLs. Access is off by default for all extensions, including those already installed, so you decide which extensions can access files on your device.
Preventing Link Tracking:
Right-clicking a link and selecting
Copy Clean Link
will now strip tracking parameters across arbitrary subdomains, along with 130 additional tracking parameters.
Bringing Containers Directly into Firefox:
Previously available as extension,
Firefox 153 introduces built-in Containers
, helping you keep work, personal browsing, and other activities separate. Each container maintains its own cookies and login sessions, so you could use containers for multiple accounts on the same site, or to limit online tracking by isolating certain websites in their respective containers. Firefox 155 also adds the ability to reorder containers.
Tracker Blocking Information on Android:
Starting in Firefox 153, the Privacy Dashboard on Android shows which types of trackers Firefox blocks, giving you a clearer view of how Firefox protects your privacy as you browse.
Built-in Ad Blocking to iOS
: Introduced on September 1,
Firefox’s built-in Ad Blocker on iOS
blocks many third-party ads and ad-related trackers, reducing clutter and distractions. It works alongside Enhanced Tracking Protection and can be enabled in the ‘Browsing’ settings in your Firefox on iOS.
Advancing Web Security at Dagstuhl:
Firefox security experts joined researchers and other browser vendors at the
Dagstuhl Seminar on Web Application Security
in July, presenting on LLM-assisted vulnerability detection, XSS protections, and web-scale security measurements.
Mozilla Security Research Summit:
Mozilla’s Security-Engineering University Relationship Framework (SURF) is back. On November 20, 2026, we will host another invitation-only summit at TU Delft in the Netherlands, bringing together Mozilla engineers and academic researchers to explore security and privacy challenges and spark new collaborations. The summit takes place immediately after the
ACM Conference on Computer and Communications Security (CCS)
.
TLS, QUIC, HTTP/3, and Happy Eyeballs:
Max Inden gave a guest lecture at TU Dresden on
modern networking protocols
, covering the technologies behind fast, secure web connections.
Looking Ahead
Firefox users receive the security and privacy improvements highlighted in this newsletter through regular updates. If you haven’t tried Firefox yet, download it to experience a fast, secure browser and support Mozilla’s mission to keep the web open, safe, healthy, and accessible to everyone.
Thank you to everyone who helps make Firefox and the web more secure and privacy-focused, by reporting bugs, conducting research, contributing code, or sharing feedback.
We look forward to sharing more updates in the Q4 2026 edition.
— The Firefox Security & Privacy Teams
Could a modern chess engine on a Pentium have defeated Kasparov in 1996?
On February 10th, 1996, a computer program (IBM's Deep Blue)
defeated the reigning chess champion (Garry Kasparov) in a game of chess for the first time.
Deep Blue would go on to lose the match,
but a year later, would get its revenge in a 3.5-2.5 rematch.
In order to achieve this feat, IBM spent several million dollars on research and
development building a special-purpose computer specifically for this purpose.
Deep Blue itself (the victorious, upgraded version)
was powered by 30 P2SC processors each running at roughly 120 MHz,
and (most importantly) 480 custom VLSI chess co-processors used to perform chess-specific
operations like move generation and position evaluation.
When it was built, Deep Blue was the 259th most powerful supercomputer in the world,
and could analyze over 200 million chess positions per second.
But was Deep Blue necessary to beat Kasparov?
Or could we have gotten away with an off-the-shelf 1996 desktop
running a smarter chess engine?
As it turns out, we could easily have beaten Kasparov without building Deep Blue, using only commodity hardware,
and it (almost certainly) wouldn't have even been close.
I know this because, as I write this very sentence, I have sitting next to me a
200 MHz Intel Pentium Pro (released exactly 31 years ago---November 1st, 1995) with 64MB of RAM
running a custom port of
Stockfish
that plays at an estimated Elo of
3300 ± 87 at classical time controls---far beyond the strength of any human, or indeed Kasparov's Elo of just under 2800.
But wait, there's more! I've hooked this machine up to the internet with a Realtek RTL8139C Ethernet card,
so you can play it below!
Connecting to the Pentium…
wait, what?! how??
There are three ways to get stronger at chess: you can
analyze
more
moves, analyze
better
moves, or analyze moves
better
.
Famously, humans improve by doing the latter two:
the average chess grandmaster during a classical game will analyze roughly the same number
of moves as an amateur player, but they analyze only the most critical moves and
do a better job with that analysis.
Chess engines like
Stockfish
, running on silicon instead of our human brains,
dominate us at the first of these
and analyze millions of positions per second.
And because there's not
that
much room for micro-optimizations on modern engines that will let a given
CPU process more positions per second,
most progress in chess AI also tends to follow how humans improve and finds better methods
for selecting moves and analyzing boards.
Skill in chess is measured by an Elo score.
A difference of 200 Elo means that you should expect the stronger
player to win three out of every four games, and multiplicatively from there: a 400 Elo gap corresponds
to a 90% expected score and a 1000 Elo gap gives a 99.7% expected score.
The best chess engines that you could run on commodity 1996 hardware were rated roughly 2300 Elo.
Deep Blue was rated 2700.
In contrast, modern Stockfish is rated closer to 3700.
This raises the question: how much of the advantage of a modern chess engine comes down
to the fact that a modern desktop computer is
extremely
fast, and how much of the
advantage comes down to the fact that we've just gotten better at programming chess engines?
As it turns out, the majority of the Elo gains (+720 of the +1335 gained) can be attributed to better programming,
and not better hardware.
To test this, I ran two experiments.
The first experiment uses
Crafty
, a competitive engine from 1996
whose source code is now available.
On my Pentium Pro, the 1996 build of Crafty version 11.13 has an Elo of 1999 ± 90 at 1 second per move, and 2383 ± 77 at 10 seconds per move.
On modern hardware (a Ryzen 7) this engine's Elo jumps massively to 2614 ± 97 at the same 1 second per move.
But if I take this engine and slowly start to add all the knowledge we have about
how to design better chess engines---adding modern search algorithms like fail-soft, LMR, correction history; adding better quiescence methods; and adding neural-net evals (NNUE)---then you can
increase the Elo up to 2718 ± 34 on the Pentium Pro at 1 second per move, and 2974 ± 74 at 10 seconds per move.
In the second experiment I go somewhat further: instead of trying to update Crafty, let's just try to get Stockfish---the
best chess engine today---running on 1996 hardware and see how it does.
This takes some work
and is mainly a matter of rewriting the
code so that it uses 32-bit arithmetic (a PPro is a 32-bit machine) and doesn't
use more than 64MB of RAM.
This naive port has an Elo of roughly 2496 ± 64 at 1 second per move (2940 ± 76 at 10 seconds per move).
But we can do better! A modern Stockfish engine is designed to run on a modern CPU.
By making a number of adjustments to the algorithm and tuning it to the Pentium,
we can increase its Elo to 2846 ± 35 at 1 second per move,
3109 ± 79 at 10 seconds per move,
and 3180 ± 80 at 30 seconds per move.
The most concise way to summarize all of the above is just to have them play a match of 100 games against each other.
And when I do this, I find that a modern chess engine running on a 1996 Pentium Pro
wins 78, draws 17, and loses 5 games against
the 1996 Crafty engine running on modern hardware.
The remainder of this article provides the details.
Technical details: Hardware & OS
There's not much to say about the hardware, to be honest.
I bought a used (
"vintage"
said the listing; I feel old.) desktop PC with standard period-appropriate hardware.
The desktop is running a 200 MHz Intel Pentium Pro connected
to an Intel VS440FX motherboard with 64MB of SIMM RAM clocked at 66 MHz.
The operating system boot off of a 1.44MB 3.5 inch floppy disk,
and connect to the Internet via a Realtek RTL8139C.
I also have a 1MB Trio64V+ graphics card connected over VGA to my monitor,
with input coming from a PS/2 keyboard---but I don't much use either of those and instead
communicate with it over a serial port connected to my modern desktop.
For those readers who may not be able to appropriately contextualize this hardware,
a 200 MHz Pentium Pro sold for $1,325 at launch in November 1995,
and four 16 MB SIMMs would have cost about $2,000.
Add on the other peripherals, and this machine would likely have gone for about four or five thousand dollars.
So it's a nice workstation, but by no means a supercomputer.
However, given the rate of depreciation and the exponential rate of improvements to hardware,
this same machine in 1997, when the second match occurred,
would likely go for just a thousand dollars (because who would want to buy
a Pentium Pro when the better-in-almost-every-way Pentium MMX was now available for just $400?)
The interface between the chess engine and the internet is a custom-built "operating system"
whose sole job is to spin up the chess engine and connect it directly to the networking card.
(Throughout this article, when I say "I wrote", what I really mean is "I asked an LLM to write".
I used a combination of Fable 5.1, Opus 5.5, and GPT-6.)
It's designed to be as compact as possible: the operating system (which, in fact, is more like
a hypervisor, or something) is sitting on a bootable floppy disk.
Its sole job is to boot the Pentium Pro into 32-bit protected mode,
initialize the networking card,
and await further instructions.
I can then send it any arbitrary "userspace" guest program that I want into RAM and it'll
boot that up and start running it.
The chess program I wrote starts up a custom-built HTTP server which waits for
incoming HTTP requests with a given position (as a FEN string)
and maximum run time, and on each request runs the engine until the timer expires, and returns a response.
Technical details: Software
As mentioned earlier I (again: a language model) actually modified two engines.
The stronger of the two is powered by Stockfish adapted to run efficiently
on a thirty-year-old processor.
It plays at an estimated Elo of 3300 at classical time controls
Because I can't run nearly enough games at classical time controls on my single machine
to get this number, I've extrapolated it from shorter time controls.
I measured 3180 ± 80 at 30 seconds per move, and it gained +70 Elo per tripling of
the time between 1 second to 10 seconds and 10 seconds to 30 seconds. Because a classical
game gives about six minutes per move (including thinking on the opponent's turn)
we should expect an Elo of 3350. Allowing for some diminishing returns,
a safe estimate is an Elo of 3300.
, high enough above Kasparov's 2800 Elo that we should expect Stockfish-1996
to come out ahead with a score of roughly 9/10.
The (only slightly) weaker engine starts with the source code to Crafty 11.13,
and is brought forward in time by adding all the lessons we've learned about how to
write a better chess engine over the past thirty years.
Updating Crafty 11.13 (1996) with modern tricks
The first engine I (read: my LLM) worked on was Crafty 11.13, its 1996 release.
On this engine the LLM had to do the most work to backport ideas we've learned over
the last 30 years. Below is a breakdown of where the Elo gains come from,
when evaluating either at 1 second per move or 10 seconds per move.
Sometimes you'll find the 1s vs 10s improvements disagree. Part of this clearly could be noise---I only ran a few hundred games which leaves a relatively large margin of error---but there is also quite a lot of signal here. Because the 1996 computer is so much slower, at 1s/move it has a very low search depth and so how fast the evaluation runs matters more than how good it is. But at larger search depths, once you stop making tactical blunders, the position evaluation becomes much more important.
1 s/move
10 s/move
Change
1999 ± 90
2383 ± 77
Crafty 11.13, released December 1996, as shipped. The initial alpha-beta engine as written. It has a custom evaluation function, with standard 90's-era search algorithms.
2063 ± 73
(+64 ± 116)
2323 ± 75
(−60 ± 107)
The first improvement is mostly micro-optimizations. It replaces two 64K-entry lookup tables with calls to the
bsf
/
bsr
instructions; and sliding-piece attacks are migrated away from the older rotated-bitboard function call. In total these changes make the engine 15% faster, but it uses the same algorithms.
2022 ± 73
(−41 ± 103)
2420 ± 76
(+97 ± 106)
The next improvement goes for the search algorithms. This includes techniques like fail-soft (which returns the real score instead of clipping), futility and late-move pruning (which skips quiet moves near the leaves), late move reduction (which searches later moves one ply shallower), and orders moves by counter-move and history tables.
2224 ± 72
(+202 ± 103)
2520 ± 74
(+100 ± 106)
The next change tunes the search and the evaluation function. It first runs SPSA to tune all search constants based on several thousand games of self-play. It then gives evaluation terms separate middlegame and endgame values (blended by remaining material) and re-fits all the evaluation weights (Texel tuning). Finally the evaluation function introduces mobility terms rewarding the safe squares that pieces attack.
2192 ± 72
(−32 ± 102)
2565 ± 74
(+45 ± 104)
From here, the evaluation function is rewritten and replaced with a neural network evaluation with a small network trained on 11 million positions of self-play, labeled by its own searches. This step doesn't do much by itself but it prepares the next step...
2420 ± 82
(+228 ± 109)
2712 ± 74
(+147 ± 104)
Updates the NNUE that was just generated with a stronger teacher instead of self-play. In principle, I could have used the same engine itself as the teacher, but just to save on wall clock time I used Stockfish. This reduced the wall-clock time from ~4000 1996-core-years (something entirely doable in 1996---but sadly not something I can do with my single lonely desktop) to just a few days on a modern desktop running a modern engine.
2630 ± 82
(+210 ± 116)
2810 ± 75
(+98 ± 105)
With a much stronger evaluation function, the search can now actually rely on it. It adds reverse futility pruning to early-return when the evaluation says the position is already won. It also adds some performance improvements to the evaluator (with an evaluation cache, and accumulators shared with null moves). This lets it widen the network 6x. It also cleans up some code, for example by getting rid of some of Crafty's special cases that mattered with weaker evaluation functions but don't matter any more with the NNUE.
2720 ± 82
(+90 ± 116)
2938 ± 74
(+128 ± 105)
The parameters are again re-tuned with SPSA given the new evaluation function. It also fixes some bugs in the code, amusingly. And finally it adds some changes to the NNUE: it adds more output heads and picks based on the number of pieces on the board, adds some hidden units, and doubles the training data with more self-play.
Porting Stockfish 17 onto a Pentium Pro
On the second engine, as mentioned above, I did the inverse. I (again, read: my LLM) ported
Stockfish to run on 1996 hardware, and then tweaked the parameters so that it would be better
suited to lower search depth. The gains here are thus somewhat more modest, because there
are no large algorithm wins that remain.
1 s/move
10 s/move
Change
2496 ± 64
2940 ± 76
Stockfish 17 squeezed onto the machine. The first naive port rewrites Stockfish 17 for a 1996 machine: single core, no SIMD, no 64-bit registers and no C++ standard library. It removes the threading, the endgame tablebases, and the 71 MB NNUE replacing it with a much smaller one. It rewrites bitboards as a pair of 32-bit ints, and it evaluates the small NNUE with plain integer arithmetic.
2590 ± 67
(+94 ± 93)
2961 ± 74
(+21 ± 106)
Faster accumulator upkeep. The second fix makes sure the NNUE running sums are better kept up to date, and improves the performance of the evaluator.
2752 ± 68
(+162 ± 95)
3006 ± 74
(+45 ± 105)
Cheaper evaluation function, use a PeSTO blend, change the compiler flags. Next it again changes the NNUE and reduces the size and tunes it to run faster on the Pentium Pro, reducing the evaluation time by 3x. Combined with a few more optimization changes this pass gains the most of any step at 1 second per move, where raw speed matters most, and much less at 10 seconds per move.
2780 ± 67
(+28 ± 95)
3070 ± 72
(+64 ± 103)
Fine-tune the NNUE on-policy. Basically repeats the prior work but on Stockfish, scoring several million positions with Stockfish to re-derive the NNUE weights.
2784 ± 65
(+4 ± 93)
3070 ± 72
(+0 ± 101)
SPSA to re-tune the search, remove PeSTO given the improved NNUE. The original Stockfish assumed that it would run at several million nodes per second, so on the slower CPU it's necessary to re-tune the parameters with another pass of SPSA. These changes also make it so the PeSTO pass is no longer needed.
2819 ± 65
(+35 ± 92)
3074 ± 72
(+4 ± 101)
Add correction history, jointly tune other parameters and the NNUE. The next pass brings back Stockfish's non-pawn correction history, jointly optimizes (again via SPSA) the parameters, and re-fits the NNUE.
2846 ± 35
(+27 ± 74)
3109 ± 79
(+35 ± 107)
The final step changes no code and just changes the compiler, adds some link-time optimization, and adds 32-byte code alignment.
So would this have beaten Kasparov?
I think it's overwhelmingly likely to be the case,
but it's actually a little bit more tricky of a situation than you might hope.
You see, I've done a bit of sleight of hand throughout this article.
The problem is that Elo scores are relative, and I've been comparing my engine's Elo to that of various Stockfish engines
that have known strengths on the
Computer Chess Rating Lists
(CCRL).
But because humans don't play against engines very frequently, there can be some small divergences between scores on the
FIDE Elo ladder and the CCRL ladder, in the same way a player's FIDE Elo doesn't directly translate to their Elo on online chess.
Fortunately, because I've gotten these engines to play at an Elo rating of 3200-3300,
and Kasparov was rated just under 2800, there should be more than sufficient buffer
to absorb any discrepancy.
But if you happen to know a 2700+ Super GM who wants to try and defeat a 2026 chess engine playing on 1996 hardware,
I'd be happy to accept the challenge!
Conclusion
The first time we humans do anything, we rarely do it efficiently.
Once we see a path that would clearly work if only we scaled it up, we do just that.
Only later, after we've had the time to better understand the problem at hand,
do we come to recognize that we could have achieved the same feat much more efficiently
by being clever.
I mostly did this for fun, because whether I could have beaten Kasparov with commodity hardware
sounded like a fun question to answer,
but I also hoped it would provide a tiny bit of insight
into the rate of algorithmic progress in "AI".
Chess engines in 1997 were already quite advanced;
after all, Alan Turing helped write the first chess program nearly fifty years earlier.
So I suppose at the time it seemed plausible that maybe there weren't that many more ideas left to find.
And with hindsight it's easy to see that's wrong.
Which leads to the question: just how much are we leaving on the table with modern-day "AI"---that is to say, language models.
Will the advances we accrue over the next few years from software outpace the advances in hardware scale?
Clearly this toy experiment doesn't answer that question definitively, but it does gesture at a potential future.
(There's also probably some kind of meta-lesson about using LLMs---"AI"---to speed up our
ability to answer weired research questions like this.)
(Also, uh, if anyone has any ideas for projects I could do with a Pentium Pro in a few weeks
once I no longer need it to host this chess engine ... do let me know!)
In recent months I've heard of several teams with an interesting policy:
each pull request should be no more than a few files, and no more than a
certain number of lines (say 500). And do just one thing and do it well. And
be easy for a human to review. And be fully tested by the test suite.
All those are good requirements, right? Surely this is quality software
engineering.
And often, the results are good. Sure, splitting a single 6000-line feature
or fix into twelve 500-line PRs is more work, but each of those PRs is
surely easier to review. And you can git bisect them when there's a bug! And
maybe revert the individual change that broke something.
...and also cause 12x as many
context switches for your
reviewers
as they
review each one sequentially.
1
But that's just the cost of
software quality! Right?
Mostly, yes. My analogy here is
simulated
annealing
. In that
process, you start your problem solving with a high energy -- making big
changes to move quickly through the problem space -- and then slowly reduce
the energy level so that your "hops" get smaller and smaller. In real
physical annealing (used eg. for metallurgy), the result is stronger, more
stable, more crystalline structures. In simulated annealing, you use it to
find solutions that aren't obvious, by rapidly exploring the solution space
and then zooming into the areas that look most promising.
In software the analogy is clear: sure, you might start with big jumps, but
once your system is more mature, you should make smaller jumps. Big
jumps break the crystalline structure. They cause bugs.
Fear of breaking the crystalline structure sounds cooler than fear of
change
The main problem with annealing-driven intuition happens when things
do
need to change quickly. It's not made for that. You usually don't build a
hammer and then decide one day you want it to be a different shape. But
every day, there are compelling-sounding reasons to make your software a
different shape. Annealing is the enemy of change.
Modern AI-driven coding (ironically, with LLMs trained using a process quite
similar to annealing) does not care about your annealing and your risk
management and your fear of change. It produces changes as big and
interconnected as you want, jumping all over the solution space as quickly
as you can prompt. And it has all the outcomes the math would predict:
the output is less strong, less coherent, more likely to fail. LLMs have no
fear of change because the LLM instance will be long gone before the
consequences materialize.
But, it's a new and special feeling to suddenly be able to take a large,
mature code base and suddenly explore any kind of large change you want.
Most of those changes turn out to be bad ideas... and it's nice to be able
to discard bad ideas quickly. But some turn out to be good ideas. Then what?
Well, follow your development processes. Break the big changes into 500-line
patches. Review them one by one. You already did the research! You know it's
worth it.
Not every big step is made of small steps
But it's not about being worth it -- some changes simply don't lend
themselves to small steps.
In the early development of
Aperture
, I
wanted to implement dollar-based spend quotas: across all your LLM backends,
let a given team or person or node spend up to $x per unit time. But to do
that, we first had to add pricing information (it's mysterious how LLM
vendors don't to tell you how much your queries cost), which meant assigning
prices to provider definitions, and then we had to assign quotas to
particular identity+model+session combinations. And quotas are one of the
first key value propositions of Aperture. We had to have them, but we had to
have all that stuff.
So, I made a giant change that included three major areas: first, the Grant
syntax for applying attributes to sessions; second, a query cost
approximator that combined multiple sources and a messy heuristic; third,
the actual quota enforcement system. Each of these parts was imperfect, but
we needed all three parts in order to make anything work at all, before we
could refine them. That's the high-energy big-jump part. It came out to
something like 12000 lines of code.
Now, I'm not a monster. After I made it all work, I split it into three
parts: the grants, the pricing, the quotas.
2
Otherwise it really
would have been an unreviewable mess. But also, I could not have developed
the quotas feature in real life in that artificial order. The grants
structure evolved as my understanding of pricing and quota enforcement
evolved. The original quota semantics sucked, so I rewound back to the data
structures, which affected how the pricing got imported, which changed how
the quotas were stored. The code reviewers didn't have to worry about that but I
did.
Mercifully, because Aperture was new, everyone on the team understood that
three 4000-line patches were better than twenty-four 500-line patches when
implementing this series of feature. There was even some forgiveness when it
came out later -- inevitably -- that each of those parts was not quite right
and needed more bugfixing. That's how new software gets made. That's the
annealing stage.
But the hard part was the philosophical difference between that and, say,
core Tailscale. Tailscale has 7+ years of maturity behind it. It's been
annealing for a long time and it has a reputation for extreme quality,
hardening, durability, whatever you want to call it. If you start pulling
stunts like that in core Tailscale, stuff absolutely will break and its
millions of users will absolutely not be impressed. Which is why, for the
most part, we don't.
But the feeling of moving fast again is such a wonderful feeling. Some
people devolve the analysis to "founder mode" and call it a personality
thing, but it's not. It's using the right tool for the right job at the
right time. Sometimes you need to go fast, sometimes you need to go slow.
Pain does not cause gain, it's just frequently correlated
That feeling of moving fast again reset my brain a little. It reminded me
that some changes to mature products can become impossible because we commit
so hard to the math of annealing that we fall forever into a local optimum.
Sometimes, when the well is too deep, you can't escape from it without a
bigger jump.
We're entering a world where it's cheap to
produce
bigger changes, but
that doesn't make it any safer. Or, it's cheap to ask an LLM to artificially
break your change into a dozen rule-compliant PRs but
then you just stuck
on tedious neverending code reviews instead
.
Sturgeon's Law says 90% of your big changes will be crap because 90% of
everything is crap. When your changes were 500 lines long and you had to
reject them, that didn't feel like a huge sunk cost. But now, it's okay if
your 12000 line changes are crap and you have to reject them; it's the same
cost to write
3
as the old 500-line change.
You still have to figure out how to efficiently review, reject, and refine
these big jumps. You definitely need a much heavier investment into CI/CD
automation, specifications, UX testing, all of it. But also, all those
things just got cheaper.
I wouldn't recommend overdoing it. The other thing is, customers don't like
it if you change your product out from underneath them too often. But
sometimes, you're just stuck in a rut. Sometimes you have to use a
higher-energy jump to get unstuck. That doesn't mean you abandon smaller
steps. Use the right tool for the job.
Footnotes
1
The reviews only need to be sequential because Github's code
review system doesn't support stacked diffs, 18+ years later, leading us
into this false dichotomy in the first place.
2
That's a slight oversimplification since there were a couple of
other parts first. I had to define the data structures for the quotas before
I actually added the quota system, so that I could use the data structures
in the grant syntax, and so on in a big circle.
3
A 12000-line AI-driven patch might take as much time to write
as a 500-line human-written patch, but by default it's much more work to
review. In fact, so much work that people give up trying, and rightly so.
Rather than abandon hope, I continue to think we need to invest more into
(and will gain more from) non-annoying AI-assisted review workflows than
AI-assisted development workflows. Imagine for example an automated
pre-human-review step that says "no, this sucks, fix these 25 things first"
and closes the pull request. Is it rude? Not really, if it's
good quality
advice that comes back fast. In a world where reviewing code is hard and
writing it is easy, put more demands on the writers.
uBlock Origin filter to block autoplay videos in TechCrunch
Every TechCrunch article autoplays a video in the middle of the post.
Hiding it isn’t enough, because the player keeps running in the background.
The video is a JW Player embed, and the page also loads Connatix’s floating
ad player. Blocking their scripts stops the video from loading at all, and the
cosmetic rules hide the empty box it leaves behind.
These work in uBlock Origin on Firefox (the full MV2 version, not uBO Lite).
Paste them into
Dashboard → My filters
and click
Apply changes
:
! TechCrunch: stop the autoplaying JW Player video
||content.jwplatform.com/libraries/$script,domain=techcrunch.com
||ssl.p.jwpcdn.com^$script,domain=techcrunch.com
||connatix.com^$third-party,domain=techcrunch.com
techcrunch.com##.wp-block-techcrunch-jw-player-embed
techcrunch.com##.jw-player-inline-promo
If TechCrunch switches video vendors, the
##
rules will probably keep hiding
the box, but you’ll need a new network rule to stop the audio.
Five months ago,
we rebuilt our warehouse on DuckDB
instead of ClickHouse. We did it because a shared ClickHouse cluster couldn't handle hours-long modeling queries, and it lacked a cost-based query optimizer. DuckDB gave every customer their own instance, and tools like dbt could connect over Postgres. We're still fans.
But we underestimated how big and complex our customers' workloads would get. We didn't want them to have just a good experience, we wanted the best experience you can get when you pay someone else to run your warehouse. It should work at any scale, at a fair price.
So we spent the last three months re-architecting it, this time without DuckDB.
We love DuckDB. It's probably the best single-node tool for analyzing heaps of data, and that node can be your laptop. It's robust and reliable. It almost always finishes your query, and if it runs out of memory, it spills to disk.
The same features that are great locally gave us problems in the cloud. Customers ran more complex queries than we expected, so we had to add huge instances. Adding disks was an option, but queries would have been too slow and expensive to be viable.
To run a single-node engine safely in the cloud, we have to size the worker before the query arrives. The ergonomics here are wonky. We couldn't find a good way to tell customers what resources their queries would need. Predicting CPU and memory for a specific query was even harder.
Users shouldn't have to worry about this. They should be able to run whatever they need to get their work done. Our job is to handle the rest and make it as predictable as possible.
We hit other bottlenecks too, like fetching lots of data from S3 without async fetching. DuckDB only added that recently.
To use DuckDB as a fully-fledged data warehouse, we installed the
DuckLake
extension by default. It is a new lakehouse format from the same creators and follows the same principles as DuckDB: keep things simple and run on almost any setup. That works well up to a point, but at PostHog's scale, we needed something designed for distributed scale from the start.
DuckLake's catalog schema has to stay portable across many SQL databases, which limits engine-specific optimizations. At our scale, a single-table write could take more than three minutes because every commit re-read the statistics for the entire catalog.
We tuned DuckLake with table indexes and similar tweaks. But to keep offering DuckLake, we had to stay 100% compatible with its existing, "official" schema. This left us with fewer optimization options.
Another problem is that over 99% of the catalog's statistics rows belonged to tables that no longer existed. Cleaning them up made writes 30 to 50 times faster, but the rows kept growing back.
We also spent a lot of time on the number of connections DuckLake opens to metadata databases. That hurts on shared Postgres instances, where every connection has a real cost.
DuckLake at PostHog didn't start small and ramp up. We fully committed and put all of PostHog in a DuckLake to dogfood as the first customer.
When we moved off it, it held about 2 PB: roughly 1 trillion rows and 15.3 million snapshots. It broke in lots of ways that were hard to fix within DuckLake's scope.
We'd rather have contributed to the existing community and helped it grow. But we couldn't land changes as fast as we needed, so we ended up carrying patches in a fork which defeats one of the main benefits of using DuckLake: the community.
Speaking Postgres is harder than it sounds
Offering direct Postgres connections over port 5432 sounds like a great idea. In practice, it was much harder to scale than HTTP.
Missing reconnects and managing TTLs and idle connections at scale is hard, and long-running connections are expensive. There's also very little tooling for load balancing pgwire compared with HTTP. Compare the ergonomics of an AWS NLB with an ALB and you'll see what we mean. HTTP headers also make routing in Kubernetes much more flexible.
There's also an endless list of Postgres clients, and each expects its own niche Postgres behavior. Customers kept asking us to fix their client or library. We spent a lot of time shipping many of those fixes, but coverage never got good enough. We'd rather spend our time building an excellent warehouse than chasing the long tail of Postgres compatibility.
We've learned not to hype the tech behind a warehouse so much. What counts is the experience it gives you.
Still, we're happy to share what we're cooking next. We rebuilt everything around our own flavor of
Trino
and created our own open table format, HogLake. And yes, we're testing it at PostHog's petabyte scale first. We made it solid before handing it to design partners.
If your current warehouse is slow or expensive,
let's talk
, especially if you have a lot of data to query. We're always looking for design partners.
How Field Organizing Beats Big Money
Portside
portside.org
2026-11-03 02:25:56
How Field Organizing Beats Big Money
Mark Brody
Tue, 11/03/2026 - 02:25
...
If you live in Michigan’s Seventh Congressional District and have gotten a knock at the door from progressive Democrat Will Lawrence’s campaign, you’re in good company. In the final days before the election, Lawrence and his volunteers have launched a massive final push to speak with as many people as possible, including registered Republicans and independents.
By Thursday morning, the campaign had knocked on roughly 200,822 doors. Based on typical household size, that means volunteers have had some form of contact with nearly 500,000 people, about two-thirds of the district’s entire population.
The perpetual outreach is uncommon among mainstream political candidates, who more typically rely on financial support, TV ads, and fundraising events to buoy their runs for office. But it’s an obvious approach for a grassroots organizer like Lawrence, who co-founded the environmental activist group Sunrise Movement, and has used his campaign to organize and win gains for his district even before winning office, such as the food drive that benefited 5,000 people and the medical debt relief drive that canceled $130,000 worth of bills, as
the
Prospect
reported
.
Progressive candidates across the country are drawing on a similar ethic, fueled by the understanding that holding one-on-one conversations with as many people as possible can outweigh the heaps of money right-wingers are pouring into their districts to defeat them. As
the
Prospect
reported
earlier this week, Donald Trump’s newly formed Safety & Affordability PAC threw $4 million into the district to flood it with attack ads in a bid to save one-term Republican incumbent Tom Barrett. But Lawrence’s lead in the contest between the two has been growing for months,
polls show
.
Michigan Sen. Elissa Slotkin, who previously represented the district, and Michigan Gov. Gretchen Whitmer joined him on Wednesday; they are among the several elected officials who have lent their power to get Lawrence to D.C., including Reps. Maxwell Frost (D-FL), Ro Khanna (D-CA), Pramila Jayapal (D-WA), and Lauren Underwood (D-IL), all of whom joined him on the trail. Sen. Bernie Sanders (I-VT), meanwhile, joined Lawrence’s Lansing town hall via phone. Sen. Mark Kelly (D-AZ) visited his campaign office.
Speaking with the
Prospect
shortly before Election Day, Lawrence said his canvassers would keep knocking on doors until the last minute. It was obvious to him and his team that talking with as many people as possible “would have to be the heart of our campaign,” which he credited with his primary win.
“Over the last several cycles there have been a lot of challenges to the idea that field organizing makes a difference at all,” Lawrence said. “There are literally people who can produce statistics that say ‘there’s no difference whether you knock a door or you don’t, it doesn’t affect the outcome,’ and I don’t buy that at all.”
His campaign doesn’t pay canvassers, so the volunteers are there because they believe in the project, not because they need to hit as many houses as possible to cash out, he added. That’s what Elon Musk has been doing through his America PAC, which spent nearly $77 million in the third quarter of this year to buy Congress for his far-right allies. Nearly half of that money has gone to companies that hire people to campaign for Republicans,
Wired
reported
, such as Denver-based Blitz Canvassing, which is owned by GP3 Partners, a consultancy backed by the California private equity firm Seidler Equity Partners. Musk’s PAC has also hired various other volunteers-for-hire companies, including Echo Canyon Consulting, GEG Strategies, In Field Strategies, The Synapse Group, Threshold Strategies, and Patriot Grassroots.
Right-wing candidates themselves have followed suit, such as a group of Republicans in tight races in Oregon, which is
spending hundreds of thousands of dollars on Blitz Canvassing
, paying people $25 an hour to knock doors, though they don’t always know they’ll be doing that when they get hired.
But canvassers for Lawrence, who are visiting unlikely voters, independents, and those who have previously voted Republican, are supporters like Lora Newmeyer.
She’s a 73-year-old who lives in rural, conservative-leaning Livingston County, east of the district’s major population center, Lansing. She had done some canvassing previously, including for Kamala Harris and Elissa Slotkin with Livingston Democrats. After the results of the last presidential election, she and her husband “felt like the wind was taken out of our sails. We thought, ‘This is not possible, we’ve got to do something.’”
They began attending every protest and rally they could, and made it their mission to canvass for Lawrence every single day. They go out from 3 p.m. to 5 p.m. Her husband drives; she does the talking. It’s energizing to speak with like-minded Democrats, she said, but it’s conversations with conservative voters where she really makes a difference. Newmeyer connects with them over their shared anger toward Trump, his corrupt administration, and the high cost of basic necessities—issues that voters across parties raise as major concerns.
“They’re bringing up how they absolutely hate the Trump administration,” Newmeyer said. “A lot of times when you say, ‘What is important to you and your family?’ they don’t specifically say groceries or gasoline, they’re like, ‘Trump has got to go.’”
She encounters some conservatives, of course, who don’t want to talk to her, or repeat hateful or false talking points, or tell her to get lost. But that’s not everyone, and those who do take time for a conversation share concerns that are common regardless of party affiliation. “The cost of groceries, affordability, they blame [Trump] for everything, all of the failures,” Newmeyer said.
And when she moves the conversation to discuss Lawrence, she’s encountering goodwill and respect for his message among Democrats, and at least in some cases, a willingness to check out his website among Republicans.
“What they really have seemed to love about Will is the fact that he is so approachable and actually his age as well,” Newmeyer said. “We need some fresh people with new ideas who will re-energize this country and share their new ideas with us.”
Can a people-powered field campaign outweigh the power of Musk’s giant pile of money? Yes, Lawrence told the
Prospect
. He proved it when he was outspent in the primary and won anyway, and he’ll do it again next week, he says. Voters know they can’t trust what they see online or on TV, so that puts a premium on a face-to-face conversation.
“Real enthusiasm from a real volunteer is a thing you can’t buy and you can’t fabricate, so when people can see that, people can see that’s real,” Lawrence said. “When somebody real appears at your door, that cuts through 50 negative ads.”
Whitney Curry Wimbish is a staff writer at The American Prospect. She previously worked in the Financial Times newsletters division, The Cambodia Daily in Phnom Penh, and the Herald News in New Jersey. Her work has been published in multiple outlets, including The New York Times, The Baffler, Los Angeles Review of Books, Music & Literature, North American Review, Sentient, Semafor, and elsewhere. She is a coauthor of The Majority Report’s daily newsletter and publishes short fiction in a range of literary magazines. She can be reached on Signal at wwimbish.07.
Agents can retrieve documents and query databases, but reliability gates agentic analytics: a revenue metric answered faster is worth nothing if the number is wrong. Agents need a context layer that tells them where data lives, what it means, whether to use it, how to use it, where it came from, and what is similar. NVIDIA Auto Ontology is an open library that builds that layer from enterprise metadata, reconciles definitions across systems, and exposes it to any agent harness through MCP, CLI, and API. It complements the semantic models customers already own.
It enables developers to:
Discover: generate enterprise ontologies from metadata; connect existing ontologies and semantic models; build AI-ready knowledge graphs.
Ground: give agents trusted business meaning for metrics, entities, and relationships; reconcile inconsistent definitions across systems.
Validate: check generated queries against certified definitions and lineage; return provenance with every answer.
Expose: serve context to any agent harness through MCP, CLI, and API.
Learn: fold certified corrections and usage back into the ontology, so shared context improves with every question.
Licensing & contributions.
Auto Ontology is distributed under the
Apache License 2.0
. Third-party open-source components
bundled, linked, or otherwise used by this project are listed in
THIRD_PARTY_NOTICES.md
.
This project
is currently not accepting external contributions.
Key Features
Natural-language querying
of structured data — questions are translated to
SQL and executed against connected databases, powered by NVIDIA NIM.
Semantic catalog / ontology layer
over relational sources, stored in
Postgres alongside the catalog it describes.
App metadata, the catalog and ontology, vector store
5432
HashiCorp Vault
Optional
Secure storage of connection credentials
—
NVIDIA NIM
Auto Ontology uses NVIDIA NIM endpoints for inference — either the hosted
NVIDIA API catalog
(
integrate.api.nvidia.com
) or
self-hosted NIMs. The defaults in
.env.example
are:
LLM:
nvidia/nemotron-3-nano-30b-a3b
Embeddings:
nvidia/nemotron-3-embed-1b
Reranking:
nvidia/llama-nemotron-rerank-vl-1b-v2
The endpoints and models are configured via the
DEFAULT_MODELS_ENDPOINT
,
DEFAULT_MODELS_MODEL
,
EMBED_ENDPOINT
, and
EMBED_MODEL
environment variables and require a
DEFAULT_MODELS_API_KEY
.
Model triplets
Each model role is configured by a
triplet
of environment variables —
<PREFIX>_ENDPOINT
(URL),
<PREFIX>_API_KEY
, and
<PREFIX>_MODEL
:
Prefix
Role
DEFAULT_MODELS
Shared default; every field below falls back to it.
REASONING
Main chat / NL-to-SQL model.
NON_REASONING
Lighter model used for entity extraction.
EMBED
Text-embedding model (must match between ingest and query).
RERANK
Reranker used by the retrieval flow.
You can set a full triplet, only some of its fields, or none at all — any field
left unset falls back to the matching
DEFAULT_MODELS_<FIELD>
. So the simplest
setup is to fill in
DEFAULT_MODELS_*
and override per-triplet fields only where
they differ (e.g.
EMBED_MODEL
,
NON_REASONING_MODEL
).
*_API_KEY
also falls
back to the legacy
NVIDIA_API_KEY
for backward compatibility.
Deployment
Prerequisites
Docker
with
Docker Compose v2
(e.g. Docker Desktop on macOS/Windows,
Docker Engine on Linux) for the local stack. For Kubernetes deployments see
DEPLOYMENT.md
.
An
NVIDIA API key
(
nvapi-...
) for NVIDIA NIM (chat and ingestion) from
the NVIDIA API catalog at
https://build.nvidia.com
.
Connection details for the source database(s) you want to query
(Databricks, Postgres, Snowflake, or DuckDB).
Installation
Kubernetes
To deploy Auto Ontology on a Kubernetes cluster, see
DEPLOYMENT.md
.
Create your environment file (.env) from the template and fill in the values
(Postgres credentials,
DEFAULT_MODELS_API_KEY
,
CONNECTION_STRINGS
, etc.).
See
.env.example
for the full list of variables:
cp .env.example .env
# edit .env
Note:
AUTH_SECRET
and
APP_URL
are
required
— without them every page
fails with a Better Auth "default secret" error.
POSTGRES_PORT
only changes the
host-side
port mapping (set it if
5432 is already taken on your machine); containers always reach Postgres
on the internal network port.
Build the images and start the stack:
docker compose up -d --build
This builds the backend (
auto_ontology
) and frontend (
auto-ontology-frontend
) images, brings
up Postgres and pgAdmin, runs the one-shot
frontend-migrate
job to
sync the database schema, and starts the app (backend, ingestion service,
and frontend).
Troubleshooting:
if the UI loads without the left navigation panel
(or otherwise looks broken after a restart), your browser is holding a
stale session cookie — this happens when
AUTH_SECRET
changes or the
database is reset. Clear the site data for
localhost:3000
(or delete
the
better-auth.session_token
cookie) and sign in again.
Connections Management
Auto Ontology resolves the source databases it connects to from two sources:
Added through the UI
— connections created from within the app. With this
option the connection credentials are
stored in plaintext in Postgres unless
Vault is configured
:
Without Vault:
the full connection object (including the password) is
JSON-serialized and stored, unencrypted, on the catalog's database row.
With Vault:
the credentials are written to Vault, keyed by the database
name, and the catalog row stores no credentials (the database name is the
lookup key — there is no separate reference field).
Vault is enabled only when all of
VAULT_ADDR
,
VAULT_NAMESPACE
,
VAULT_ROLE_ID
, and
VAULT_SECRET_ID
are set (
VAULT_AUTH_MOUNT
and
VAULT_KV_MOUNT
are optional overrides). It is off by default; a partial
configuration is ignored with a warning and falls back to plaintext storage.
CONNECTION_STRINGS
environment variable
— a comma-separated list of
connection strings supplied at deploy time (e.g. the Helm
--set connectionStrings=<CONNECTION-STRINGS>
flag). This is a fallback: it
is used only when there are no UI-added connections.
Authentication
Auto Ontology Supports SSO for authentication.
The Redirect URI should be configured in the IdP as: APP_URL/api/auth/sso/callback
API tokens (scripting)
A browser signs in and gets a session cookie, which a script cannot obtain. For
scripts, notebooks, and scheduled jobs, mint an
API token
instead:
Open the user menu (top right) →
API Tokens
→
New token
.
Name it, optionally pick an expiry (default: never), and
copy the token
.
Auto Ontology stores only a SHA-256 hash of it, so it is shown exactly once. Losing it
means minting a new one.
Send it as
x-api-key
on any
/api/...
call —
Authorization: Bearer <token>
works too:
importosimportrequestssession=requests.Session()
session.headers["x-api-key"] =os.environ["AUTO_ONTOLOGY_API_TOKEN"]
terms=session.get("https://auto_ontology.example.com/api/terms").json()
answer=session.post(
"https://auto_ontology.example.com/api/chat/completions",
json={"question": "How many orders shipped last week?"},
).json()
Things worth knowing:
A token acts as its owner.
It carries no permissions of its own — every
call is authorized against the owner's role, exactly as it would be in the
browser. A viewer's token cannot do admin things.
The whole API surface accepts it.
Authentication is resolved in one place
(
frontend/auth/resolve-user.ts
) for every route, so any endpoint in
docs/openapi/auto-ontology-api.json
that is not
withPublic
works with a token.
Revocation is immediate.
Delete the token in the UI, or delete/ban the
owning user, and the next request with it gets a 401.
Tokens cannot manage tokens.
Creating and revoking requires a signed-in
session, so a leaked token cannot issue itself successors.
Agent API conversations
Public clients call the authenticated Next.js gateway at
POST /api/chat/completions
. The response is an SSE stream containing
step
,
result
, or
error
events, followed by
[DONE]
.
conversation_id
is optional:
Omit it for a stateless, one-shot request.
Supply a client-generated UUID to create or continue a conversation.
Reuse the same UUID for every turn in the thread. Wait for
[DONE]
before
sending the next turn; overlapping requests for one conversation return
409 Conversation in progress
.
{
"question": "What about last month?",
"conversation_id": "d61d8aa3-d496-4fa7-97ce-4f831c162e7f"
}
For conversational requests, FastAPI loads up to the five most recent completed
turns (bounded to 12,000 characters) and rewrites contextual input such as
“What about August?” into a standalone question before running the existing
text-to-SQL graph. Independent questions are passed through unchanged. Internal
agent thoughts, chart payloads, errors, and raw SQL result sets are not reused as
context.
Conversation history is scoped to the authenticated Auto Ontology user. Browser and
service callers should use the Next.js gateway, which resolves the user and
forwards the internal
x-auto-ontology-user-id
header to FastAPI. The FastAPI port is a
trusted internal service boundary: it must not be exposed publicly because that
header is not independently verified by FastAPI. A direct FastAPI request
without
conversation_id
remains stateless; a direct request with
conversation_id
requires the trusted identity header.
The web UI manages the UUID automatically. An API-created conversation can be
opened in the UI at
/chat?focus=<conversation_id>
when it belongs to the
signed-in user.
Agent skills
Coding agents: start at
AGENTS.md
. Skills live in
skills/
(
nvidia-ontology-setup
,
nvidia-ontology-management
,
nvidia-ontology-query
).
Maintainers keep using
CLAUDE.md
.
MCP server
Agent harnesses such as Cursor and Claude Desktop can query your data through
Auto Ontology's
MCP
server. See
mcp/
to run it and
docs/mcp.md
for the details.
Each NVIDIA-authored source file in this repository carries an SPDX header
of the form:
SPDX-FileCopyrightText: Copyright (c) 2024-2026, NVIDIA CORPORATION & AFFILIATES.
All rights reserved.
SPDX-License-Identifier: Apache-2.0
Third-party open-source components used by Auto Ontology are enumerated, with their
upstream licenses and project URLs, in
THIRD_PARTY_NOTICES.md
. Components added by the
container images are listed separately in
CONTAINER_THIRD_PARTY_NOTICES.md
.
Notice and Disclaimer
NOTICE AND DISCLAIMER: This software automatically retrieves, accesses or
interacts with external materials. Those retrieved materials are not
distributed with this software and are governed solely by separate terms,
conditions and licenses. You are solely responsible for finding, reviewing and
complying with all applicable terms, conditions, and licenses, and for
verifying the security, integrity and suitability of any retrieved materials
for your specific use case. This software is provided "AS IS", without warranty
of any kind. The author makes no representations or warranties regarding any
retrieved materials, and assumes no liability for any losses, damages,
liabilities or legal consequences from your use or inability to use this
software or any retrieved materials. Use this software and the retrieved
materials at your own risk.
External materials Auto Ontology interacts with at run time:
Material
When
Terms
NVIDIA-hosted model APIs (
build.nvidia.com
,
integrate.api.nvidia.com
) for LLM, embedding, and reranking
Chat, ingestion, and semantic compilation, with the default model configuration
Terms of the NVIDIA API catalog and of each model
Any other OpenAI-compatible model endpoint you configure (
*_ENDPOINT
/
*_MODEL
)
Same
Terms of that provider and model
KumoRFM predictive-query service
Only when
KUMO_RFM_API_KEY
is set
Kumo's terms
Your source databases
Ingestion, profiling, and query execution
Your agreements for those systems
Contributing
This project is currently not accepting contributions.
Issues, pull
requests, and patches submitted from outside the Auto Ontology maintainer team will
not be reviewed or merged. Security-relevant reports should follow the
process described in
SECURITY.md
. Maintainer workflow is in
CONTRIBUTING.md
.
‘A serious failure’: CPS prosecutor cites imaginary case to high court after AI search
Guardian
www.theguardian.com
2026-11-03 01:00:40
Exclusive: Nonexistent precedent cited in alleged child rape case adds to dozens of AI-related errors plaguing court proceedings A senior crown prosecutor acting in a high court case cited an imaginary legal precedent in an error that has sparked fresh concerns about AI hallucinations infecting the ...
A senior crown prosecutor acting in a high court case cited an imaginary legal precedent in an error that has sparked fresh concerns about AI hallucinations infecting the justice system.
Ravinder Dhillon, representing the Crown Prosecution Service (CPS), referenced an entirely made-up case during a dispute over whether a child should be prosecuted for the rape of his younger sister, court documents have revealed.
Her explanation for how the nonexistent case came to be relied on has been
called
“unsatisfactory” by two senior high court judges and a “serious failure” by an expert in AI and law. The Guardian understands the reference came from an AI response generated during an internet search.
The case adds to dozens of others where AI-related errors have plagued court proceedings this year, mostly from people who are not legally qualified representing themselves, and often in employment tribunal cases.
It is only the second known case involving the CPS – the main public agency bringing criminal prosecutions in England and Wales – which admitted in February that one of its lawyers acting in an extradition case involving two Romanians convicted of minor offences cited nonexistent legal authorities, likely caused by AI. Those made-up cases were only spotted when opposition lawyers could find no trace of them and the CPS
concluded
“the risk of recurrence was low”.
In the latest case, lawyers for the boy, who was 11 at the time of the alleged rape of his seven-year-old sister, were challenging the CPS’s decision to prosecute him. They alleged prosecutors had failed to take into account representations from social workers, youth workers and a forensic psychologist. Dhillon, a senior crown prosecutor in the CPS’s rape and serious sexual offences unit, was arguing in favour of the prosecution of the child and submitted a detailed reference to a case she called CPS – R v J [2024] EWCA Crim 3529. It turned out not to exist.
The decision to proceed was taken by Dhillon in April and confirmed by the chief crown prosecutor. Then in October Dhillon admitted that the nonexistent citation had been made in error. She said she had been referring to a completely different decision – this time a real one – that was made 15 years earlier.
“This was used as a legal source to argue for the prosecution of a child and that legal source doesn’t exist: that’s a serious failure,” said Brian Flanagan, associate professor of law at Maynooth University in Ireland who investigates the use of AI by judges. “It calls into question norms of trust in the law where we treat authorities as precious things. You can’t make them up; it’s out of bounds. AI increases the risk that is going to happen because of the time you can save. It is not great for any professional to do this, but when the professional is working for the state it takes on a different aspect, because the power of the state is immense.”
The high court said the CPS’s reference to a fictitious case did not affect the outcome of the boy’s challenge to the decision to continue with his prosecution, which is listed to go to trial in the youth courts later this week.
In June 2025, the high court responded to AI hallucinations in cases spanning housing to banking, by calling on the Bar Council and the Law Society to consider steps to curb the problem “as a matter of urgency”. Dame Victoria Sharp, then president of the King’s bench division, warned of “serious implications for the administration of justice and public confidence in the justice system if artificial intelligence is misused” and said lawyers misusing AI could face sanctions, from public admonishment to contempt of court proceedings and referral to the police.
Asked for comment, the CPS said it has a strict AI policy “which limits its use so that it is not used to make legal decisions and there must be human checks for accuracy”.
A spokesperson said the CPS “identified an error had occurred from conducting legal research using the internet”.
“As soon as this error was identified, it was remedied and an internal review was carried out to establish how this had occurred and to check that no other cases have been affected,” they said. “Following the rapid review we shared learnings, including that case law must be cited from trusted legal sources.”
It is understood the internet search delivered an AI summary which contained the fictional case details.
The latest incident brings to 101 the number of entries in a UK tracker maintained by Doughty Street Chambers barrister Matthew Lee covering confirmed, suspected and disputed AI-related errors, as well as related false citations. He said the cases identified may be the “tip of the iceberg”, as many lower court decisions are never published.
He added there are privacy and confidentiality risks associated with the CPS using AI, given the highly sensitive information it handles, and warned that AI was creating additional work for barristers, who need to spend time checking the authenticity of legal authorities appearing in case papers where AI may have been used in their preparation.
I discovered a sound that leaks your exact location (and it's everywhere) - YouTube
Simon Willison
simonwillison.net
2026-11-03 00:32:25
I discovered a sound that leaks your exact location (and it's everywhere) - YouTube
Genius piece of OSINT by Colsto, who demonstrates how you can take almost imperceptible background noise of planes from a video soundtrack, figure out their Doppler curves, then cross reference them against ADS-...
I discovered a sound that leaks your exact location (and it's everywhere) - YouTube
(
via
) Genius piece of OSINT by Colsto, who demonstrates how you can take almost imperceptible background noise of planes from a video soundtrack, figure out their Doppler curves, then cross reference them against ADS-B data to find the exact location of the video based on their speed, distance, and gaps between different flights.
I sent out the October edition of my sponsors-only monthly newsletter. If you are a sponsor (or start a sponsorship now) you can access it here. This month:
The October inflection point for vibe game development
The vulnerability apocalypse gets hot
LLM releases
API credits for $100+/month subscrip...
I don't which nix is good and at this point I'm afraid I need to ask.
(Cpp)Nix
Determinate Nix
Lix
Or, you know, Guix?
(I suspect that Snix, Tvix, and others aren't intended for general use… but I might be wrong?)...
Determinate Nix is the "corporate" version. It's run by big names in the Nix ecosystem but there's perennial concerns about them not upstreaming improvements, trying to shove features in, whatever. I don't know if it has any compelling benefits over cppnix.
Lix I like because it feels like they're trying to fix a lot of the papercuts that are involved in the ecosystem, untangle the gnarly codebase, and so on. AFAIK there are no incompatibilities between it and cppnix unless you do weird stuff.
Guix has the advantage of using a proper language and first class home-manager(-equivalent) support. The biggest downside is that it's a gnu project so nonfree software support will always be secondary, and IIRC there were still enough sharp edges when I tried it that I went back to Lix. But I wish them well and hope they succeed!
So I'd say either Lix (if you want to be able to interop with the broader Nix ecosystem) or Guix (if you like Scheme, copyleft, or a more cohesive system).
AFAIK none of snix/tvix/etc are usable as a replacement for the cppnix binary in the way Lix/Detsys Nix are.
Comments (0) Trackbacks (0) Leave a comment Trackback