Jeremy Ettlinger

Calls, puts & mise en place

Appel & Mise

Vol. IFriday, September 25, 2026 · 56° & overcast on the UWSThe daily, for Jeremy Ettlinger
BTC$84,419+1.3%ETH$2,697+2.1%S&P 5007,704-0.0%

The lede

How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

Cloudflare · made the Sunday

A researcher at Accomplish showed that any Workers Paid account could write 4 KiB into a fresh container disk and read back the other 60 KiB of a recycled 64 KiB block — because the storage pools ran dm-thin with `skip_block_zeroing`, a speed choice that quietly turned deleted tenants' data into someone else's free space. Across 24 placements they recovered residual material on 18 of them: directory structures, database pages, other people's filesystems, on nodes across four continents. Cloudflare has fixed it fleet-wide with no customer action needed, and the writeup is the good kind — the exploit steps, the counts, the timeline — but the lesson for anyone shipping on this stack is that Sandboxes is built on Containers, which means the isolation your agents run inside was one config flag deep.

AI & Agents

Res Obscura

AI labs need to start funding historical research

Benjamin Breen, a working historian who has been skeptical in print before, says the Opus 5.5 and GPT-6 Sol releases changed his answer: he used a frontier model to identify a French alchemical passage Newton had freely translated into Latin, an attribution nobody seems to have made. His framework for which problems are tractable is the transferable part — digitized data, multilingual reasoning, room for bespoke code, and above all an answer that can be proven or disproven, which is why these models have run rampant in mathematics and stalled in the humanities. That last criterion is a decent filter for your own backlog of agent ideas.

Engineering & Leadership

LeadDev

Build an engineering team people want to come back to

Meg Adams learned retention in a seasonal retail job where retention was impossible — she had no control over pay and eight weeks with each hire, so the only lever was whether the eight weeks were worth repeating. She argues the boomerang is the culture metric that can't be gamed, because it's a comparison someone made with real alternatives in hand, and the engineers who come back are usually the ones with the most options. Useful if you've been reading resignations as a scoreboard rather than as data.

Web & Product Craft

mitpit

Bastardica: a foundry for bastard web fonts

Pick a base font and a mix-in font, and every nth glyph swaps — shipped as a normal OpenType file using contextual substitution registered for every script, so browsers turn it on by default with no runtime of yours involved. The whole thing runs locally in the browser on Pyodide and fontTools; nothing you upload leaves the page, which is a nice demonstration of how much desktop-class tooling now fits in a tab. Also the FAQ tells you to use prime-number strides so mixed fonts collide less often, which is the most satisfying piece of typography advice this week.

New York & the Table

West Side Rag

The Upper West Side is using A.I. It's also worried about it

The Rag went out on Tuesday and asked the neighborhood how it feels, and the answers are better than any survey — a violin teacher who refuses on principle, a mom who used it to plan a bar mitzvah, and a tech worker who uses it constantly while admitting it has made his job less fun because the solving got delegated away. That last one is worth sitting with if you manage people who took this work for the puzzle. Your neighbors are the deployment surface, and they are more clear-eyed about it than the discourse suggests.

Eater NY

At this new Times Square jazz club, dinner isn't an afterthought

The Pocket sits under the Muse hotel with 170 seats, founders out of Jazz Standard and the Blue Note, a chef from Del Posto and Telepan, and residencies from the Mingus Big Band and Arturo O'Farrill's Afro Latin Jazz Orchestra. The practical intelligence is in the footnotes: two sets a night, a two-item minimum per set, and doors an hour before the 7 p.m. show — so take the early one if you want this to be dinner rather than a scramble between songs.

Diversions

Aftermath

A sniper game where the goal is not to shoot anyone

Sniper Dan hands you a rifle and then penalizes you for hitting a person: you snap ropes, press buttons and flip switches to solve other people's problems from half a mile away. It's really a hidden-object game wearing a sniper's clothes — scan the scene, work out what's out of place, take one careful shot. A good low-stakes thing to have open on the couch.

Literary Hub

A prophetic classic about the dangers of tech is back in print

Paulina Borsook's *Cyberselfish* came out in 2000 as reportage on a subculture — a tech industry that was reflexively anti-government while living on government subsidy, and fluent in evolutionary language that made its own power structures sound inevitable. Tin House is reissuing it this fall, and her new preface makes the honest observation that she wrote a description and history turned it into a prophecy. Reading the 1990s account of how the ideology formed is more useful than another take on where it landed.

Loose Change

Ahmed Hossam

My weird new hobby: wandering around Tokyo on Google Maps

He drops the little yellow man on a narrow Tokyo street and just walks — looking at wires, ladders, plants on a windowsill — then clicks back through seventeen years of captures to watch the trees get smaller and the neighborhood un-build itself. He finds a 350Z parked in the same spot in every capture since 2009, too clean to be abandoned, and writes beautifully about how Street View keeps fences and parked cars like time capsules while the rest of the internet is built to move. Then someone on Reddit went to the street to check, and the update at the bottom is the whole essay in three lines.

The Back Page

The Guardian

Top European leagues heighten pressure on Infantino with call for major changes at Fifa

The Premier League, La Liga, Serie A and the Bundesliga have put their names to a joint statement calling Fifa's governance 'not fit for purpose' and accusing Infantino of pushing 'exploitative ideas' — this as he lines up a fourth term and after Council members rejected his external review. The four leagues that actually pay the wages rarely coordinate in public, which is what makes this more than a press release.

The Guardian

Anger at Tuchel over World Cup exit exposes biggest obstacle to England success

Ronay opens with a parody of the phone-in verdict — he's just not done the job he was hired to do — and then makes the harder argument, that the job as defined was incoherent, and that a best-ever overseas World Cup performance counts for nothing against twenty minutes of Messi. It's the funniest thing you'll read about a semi-final defeat, and underneath the jokes it's a clean piece about how the system manufactures the rage it then blames the manager for.

Around town

Thu Oct 1 · 6:00pm

AI Demos #11: Media

The Refinery at Domino, Williamsburg

Six companies demoing live, ahead of AdWeek — the format where you find out in about four minutes whether a product is real. Free, and the first one back since the summer break.

professional

Sat Sep 26 · 6:30pm

THE SCOUT, Q&A with Paula González-Nasser and Mimi Davila

Film Forum, 209 West Houston St, West Village

A first feature opening this week, with the director and star staying after to take questions. Opening weekend with the people who made it is the version of moviegoing streaming can't counterfeit.

casual

Quote of the day

“There's something calming about a thing that just stays.”

— Ahmed Hossam, on Street View

On this day

September 25, 1956 — TAT-1, the first transatlantic telephone cable, opens for service between Newfoundland and Scotland, carrying all of 36 calls at once.

The puzzle corner

The Mini · Wordle · Connections

A day for reading the config flag before the changelog.