Calls, puts & mise en place

Appel & Mise

Vol. IMonday, October 5, 2026 · 58° & clear on the UWSThe daily, for Jeremy Ettlinger

BTC$86,000+0.9%ETH$2,718+0.6%S&P 5007,723+0.7%

The lede

GLM-5.3 and the spread of advanced cyber capabilities

Anthropic Frontier Red Team

Anthropic put Zhipu's open-weight GLM-5.3 on the same exploit benchmarks it used to justify withholding its own most capable model, and found them roughly level — then showed the refusals come off for about $1,200 of GPU time with general capability intact, after which the model complies with overtly malicious requests 100% of the time. Two numbers are worth carrying around. A researcher with less than a day of attention got it to find unknown flaws in a browser's JavaScript engine and chain them into a page that reads files off the visitor's machine. And turning a published Chrome CVE into a working ARM64 exploit chain took twenty minutes of human time and $20.40 of inference. The window between a public patch and a working exploit against it is now a line item.

Web & Product Craft

Cloudflare blog

8 major updates to Cloudflare Observability

Workers logs, security logs, traces and analytics stop being four products with four query languages: one SQL dialect, one auth model, an MCP server, and a native Worker binding that lets your own code query Analytics Engine for metering or a customer-facing dashboard without a separate API client. Tracing goes to open beta with OpenTelemetry export. The part to read before December 1 is the pricing change — logs and traces move to volume ingested and stored rather than event count, with half a gig a day on free and seven-day retention.

Vincent Bernat

Self-hosted HTTP tunnels with SSH and nginx

A pleasing counterweight to the Protected Quick Tunnels post we ran Saturday: the same share-my-localhost trick, assembled from an OpenSSH remote forward, a wildcard certificate and about fifteen lines of nginx, with nothing for the other person to install. Bernat is candid that an allocated port is weak entropy on its own — the kernel's range is small and it favors odd numbers — and bolts a signed token onto the hostname, which is the detail that makes this a design worth copying rather than a party trick.

New York & the Table

Gus Saltonstall, West Side Rag

Barn owl spotted outside Upper West Side buildings: 'extremely rare' in NYC

An American barn owl has been working the courtyards between 75th and 76th off Central Park West since September 6, identified first by its call through the Merlin app and then by a very poor photograph that Manhattan Bird Alert confirmed. Parks files barn owls under extremely rare for the five boroughs, with scattered sightings at Pelham Bay and Floyd Bennett Field. The best line is in the comments, from a neighbor noting that rats are the main course, which makes the current Upper West Side close to ideal.

Nico Alonso, West Side Rag

The 'practical magic' of making friends on the Upper West Side

A couple who moved from Seattle in 2024 posted on r/upperwestside offering to meet strangers at the AMC Lincoln Square after a seven o'clock showing and argue about the film at Gebhard's afterward. It is now a monthly club and a 1,082-member Discord with channels for board games, trivia and a biweekly bar night. The mechanism is the whole story — they offered the thing instead of asking for it — and the health department calls the problem it solves an epidemic.

Diversions

Nathan Grayson, Aftermath

Every animal confirmed for Grand Theft Auto VI so far, ranked

Rockstar has put over 170 animal species into GTA VI, more than most games actually about animals, and Grayson has ranked the known roster with precisely the seriousness it deserves. Alligators get 'big, green.' Whales get 'big, whale-colored.' The nine-banded armadillo earns a full paragraph because it crosses rivers by inflating its intestines and floating, or alternatively sinks and walks along the bottom holding its breath for six minutes.

Loose Change

Maya Rosen, Works in Progress

Mosquitoes are a choice

Two ways of collapsing a mosquito population have worked in the field for over a decade — a gene that kills female offspring before adulthood, and a bacterium that renders males effectively sterile — cutting Aedes aegypti by 95% in one Brazilian trial and dengue infections by about 70% in Singapore. The American half is pure jurisdictional farce: Oxitec applied to the USDA in 2010, waited eighteen months to be told its mosquito was a veterinary drug, sat five years at the FDA to be told it was a pesticide, and its EPA registration is still pending sixteen years on. Dengue cases are up 360% over the decade average and screwworm crossed back into Texas in June after sixty years gone.

The Back Page

Fellipe Miranda, We Ain't Got No History

West Ham 0-3 Chelsea, Women's Super League: post-match reaction

With the men's game paused for internationals, the women played the week's actual football: West Ham pinned in their own half from the whistle, Melvine Malard converting once the shooting finally found the target, then Keira Walsh and Maika Hamano making sure a one-goal lead never turned into the Aston Villa draw again. Tottenham at home next.

Around town

Wed Oct 7 · 6:00pm

Jev Demo Day (AI Tinkerers)

Venue given on registration, Manhattan

Free, screened, and built on an honest premise: the model shipped two weeks ago, so nobody has a finished product and that is the point. Five-minute slots for half-working prototypes, benchmarks, dead ends and here-is-what-broke talks. The failure reports are the reason to go — they are the part nobody writes up afterward.

professional

Sat Oct 10 · 9:00am

New Agentic Economy Hackathon

Betaworks, 29 Little W 12th St, Meatpacking

A free Saturday build day with Betaworks and Google DeepMind on agents that transact — the half of agentic commerce that is all auth, settlement and what happens when the agent buys the wrong thing. Worth it for the problem statements alone, even if the demo never ships.

professional

Wed Oct 7 · 1:30pm

Exhibition on Screen: Raphael Revealed (Encore)

Leonard Nimoy Thalia, Symphony Space, 2537 Broadway at 95th

In 2021 a film crew was given exclusive run of the largest Raphael exhibition ever assembled — two hundred works pulled together in Rome for the 500th anniversary of his death, with loans the Louvre, the Uffizi and the Prado will not make twice. Ninety-three minutes, eighteen dollars, a Wednesday matinee fifteen blocks north. The show itself is gone and this is the only way anyone sees those rooms as they were hung.

say yes

Quote of the day

“It's like a book club, but for movies.”

— the UWS Movie Club, recruiting on r/upperwestside

On this day

October 5, 1962 — Parlophone releases 'Love Me Do,' the Beatles' first single, which stalls at number 17. Forty-nine years later to the day, in 2011, Steve Jobs dies in Palo Alto at 56.

The puzzle corner

The Mini · Wordle · Connections

Two of today's pieces are about things that have quietly become choices — a twenty-dollar exploit chain, because the safeguards on a downloadable model come off for the price of a used car's brake job, and a mosquito-borne disease that stays with us because nobody can agree which agency owns the cure. The third is a couple who wanted friends on the Upper West Side and simply posted the invitation.