Calls, puts & mise en place
Appel & Mise
Vol. I · No. 8Sunday, October 18, 2026 · 45° & clear on the UWSThe week’s best, every Sunday
BTC$82,065+0.7%ETH$2,422-0.4%
The lede of the week
Anthropic · from Saturday’s paper
The NIST elliptic curves that secure most of the internet rest on seed values the NSA supplied in the late 1990s and never explained, which for twenty-six years has been the single most-cited reason to suspect a backdoor; the one insider who knew died in 2023, and a standing bounty went unclaimed. An internal Anthropic research model, handed the problem cold, took under half an hour. Rather than hunt for the hash function everyone assumed was behind the seeds, it guessed the numbers were output from a weak random number generator of the period, noticed the top bit of every 32-bit word was zero across all four seeds — a 1-in-5,810 coincidence and the fingerprint of `lrand48` — brute-forced the hidden state for the binary curves and recovered it for the prime curves with lattice reduction. Run the recovered states back through `srand48` and you get Unix timestamps from 1997 and 1998: somebody sat there running a program in a loop until the curve came out valid, and P-256 was candidate number 1,842. The post ships Python that reproduces the published values and is candid about the loose ends — B-163 and most of the base points remain unexplained. Nothing here breaks ECDSA. What it does is replace cryptography's central conspiracy hypothesis with a much duller story about a guy, a timestamp and a while loop, and it is the clearest public example yet of a model finishing work that had defeated people who badly wanted the answer.
The week kept circling the same question from different corners: who is allowed to approve the work. A research model closed a twenty-six-year-old hole in the cryptographic record in under half an hour, Will Larson started letting a bot merge a tenth of his company's pull requests without a word of comment, Anthropic published the review scaffolding holding up a codebase its own model writes nine tenths of — and Cendyne, laid off because a model cost less than their salary, spends the day reviewing that model's output. Nobody this week argued the machines should not be trusted. They argued about where to put the human, and all of them put it somewhere narrower and more deliberate than before.
The Sunday feature
Cendyne · from Monday’s paper
The honest version of the essay everyone is writing badly: Cendyne was the last engineer standing at a company that had already shed the rest, and the arithmetic that removed the role was simply that a frontier model cost less than the compensation, which bought leadership runway to coast into an acquisition. What lifts it above grievance is that the author has sat on the other side of the table — having had to justify and carry out earlier rounds — and declines to pretend the tools are useless: models are genuinely good at ported, measurable work where a human can checkpoint each step, and the piece cites Shopify's return to native mobile and a TypeScript-to-Rust port that faithfully reproduced the original's bugs. What they cannot do, the argument goes, is taste and foresight — saying no to the feature the complaint thread demands, and pricing in what a decision costs in operating complexity three years out. The detail that stays with you is not the argument but the body: a resting heart rate above 100, under four hours of sleep a night for more than a week, and a hiring manager laid off a week after interviewing the author. Read it before the next time someone says "AI took my job" as though it were a sentence about machines rather than about budgets.
AI & Agents
Anthropic Engineering · from Wednesday’s paper
Anthropic spent five months building its own version control system, and the reason is the most concrete number anyone published this week about what agentic development does to infrastructure: roughly thirty thousand merges a day, a rate git's assumptions about human-paced branching simply do not survive. Worth reading as a forecast rather than a product post — if your team is anywhere on the same curve, the tooling that breaks first is the tooling nobody thought of as a bottleneck.
OpenCode · from Thursday’s paper
The release embeds a small JavaScript interpreter so the agent can write a script against your MCP servers instead of calling them one tool at a time, which collapses the round-trip tax that makes multi-step tool use feel like dialling a rotary phone. The idea has outlived the release week: once the agent can compose tools in a loop rather than request them one by one, most of what people build as bespoke orchestration turns out to have been a workaround.
Goodfire · from Friday’s paper
A Goodfire researcher argues that superposition — the premise that networks cram more features than they have dimensions, which a good deal of interpretability work was built to untangle — was a misreading of one badly behaved circuit, and that representations are considerably more legible than the field assumed. Even if it is wrong it is clarifying, because it is a rare case of someone checking whether a foundational metaphor was load-bearing or merely early.
Engineering & Leadership
Will Larson
Will Larson's engineers now merge about four times as many pull requests as two years ago — two teams have ten-x'd — while incidents fell 42% and critical incidents 78%, and the median review stretched from 33 minutes to 77. His response is to stop treating review as one thing: knowledge sharing, error catching, abuse prevention and compliance are four goals, and CI and automated auditing serve two of them better than a tired human does. So `small-change` is a CI check nobody can override by hand — under a thousand lines, no P1 or P2 findings from the review bot, an author with ten prior merges in that service, few enough services touched, no shared libraries, and not on a per-repo exclusion list like money movement — and a skill that silently approves what qualifies. Silently is the design decision worth stealing: he refuses to let the bot comment, because what he calls "meat proxy" review, where an author uses a harness to answer another harness's comments, destroys the one goal automation cannot cover. About 10% of changes qualify today and any escape counts as a system defect, not an argument for adding a human back.
Anthropic · from Saturday’s paper
The other half of the same conversation, with the numbers from the inside: Claude writes about 90% of Claude Code's own code, merged PRs more than doubled from June to September, and the revert rate fell over 40%. The copyable parts are a risk classifier that reads the change rather than the author and sets zero, one or two required human approvals, a `REVIEW.md` per code owner that caps nits and demands file-and-line evidence, and past incident PRs turned into a daily eval set. The failure mode is the honest bit — one PR went past fifty review rounds overnight before its author gave up, and blame showed 59% of what the reviewer kept flagging had been there since the first pass, because an agent author answers a nit with another commit instead of a shrug. Round caps and no-repeat-findings took mean rounds from 2.08 to 1.32.
Web & Product Craft
Jake Archibald · from Saturday’s paper
Archibald built a harness, matched encodes at equal SSIMULACRA2 scores rather than equal quality settings, and published numbers that contradict the enthusiasm: AVIF comes out 15–25% smaller than the best JPEG XL on photos, 30–90% smaller on screenshots and illustrations, much better with transparency, and two to three times faster to decode. JPEG XL keeps two real wins — true lossless, and lossless transcoding of JPEGs you already have for 9–20% off, free. Default to AVIF at 4:4:4 and the highest effort you can stand, reach for JPEG XL when one image comes out fat, and re-run it yourself in a year because both codecs are moving.
Cloudflare · from Saturday’s paper
Cloudflare's answer to the awkward middle of a Vite app: importing `void/db` or `void/ai` is itself the resource declaration, so dev gets a local database and `void deploy` provisions D1 and AI Gateway in production with no wiring written by hand. Nuxt is supported alongside React Router, SvelteKit, TanStack Start and Astro, and the framework keeps routing and rendering while Void takes migrations, auth and deploys. The piece worth watching is the self-hostable Void Platform on Workers for Platforms — a shared deploy environment on your own account, which is exactly the missing step when a side project acquires a second person.
Jesse Prophitt · from Tuesday’s paper
A commercial web product shipped as one binary, a SQLite file and three dependencies, served over CGI — a stack that sounds like a stunt until you read what it buys: a deploy you can reason about, a dependency graph that fits in your head, and no runtime upgrade treadmill. Not a recommendation so much as a measurement of how much of a modern stack is genuinely required versus merely conventional, which is a useful number to carry around while picking the tools for the next thing.
New York & the Table
West Side Rag · from Saturday’s paper
Mayor Mamdani came out this week for a bill banning horse-drawn carriages from June 2028, and with more than half the 51-member Council formally behind it, the thing Bloomberg, de Blasio and Adams all failed to do looks likely to pass — the full vote is calendared for Thursday. It is named Romanch's Law, for the 18-year-old tourist killed in a carriage accident this summer. The questions the bill text apparently does not answer are the ones that will define how it lands: where roughly 160 horses go, and what becomes of the drivers, whose union opposes it.
West Side Rag
Terra Developers wants a 13-story tower with 19 three-to-five-bedroom units on top of the Gristedes at 500–504 Columbus, restoring the two 130-year-old buildings as its base and setting the tower back from the avenue. Because the site sits in the Upper West Side Historic District it needs Landmarks approval; CB7's preservation committee backed it, the full board votes November 4, and the neighbors behind it on West 85th are objecting over sight lines. The precedent is the actual fight — whether a historic district can be built upward, one restored facade at a time — and a family-sized-unit pipeline is not nothing in a neighborhood that mostly produces studios.
Diversions
Aftermath · from Saturday’s paper
Recorded live at Town Hall for the first New York Games Week, with NYU Game Center's Naomi Clark and Sam Barlow of Her Story, and the answer they land on is about production shape rather than rent. Film work here is freelance and piecemeal, which the city is built for; games need three-year office jobs and funding that survives a project selling nothing, which it isn't — and Barlow's Unreal team simply could not hire experienced developers locally, so they went remote. San Francisco and Seattle courted studios; a city with an arts economy this large never had to.
Aftermath
Jagex proposed a fresh-start character type on separate worlds so newcomers could join a 25-year-old MMO without facing two decades of catch-up, veterans revolted over a split population, and sixteen days later the studio pulled it with a note admitting it "missed the mark." A tidy case study in the migration problem every long-lived product eventually hits: the people who make a thing worth joining are precisely the people whose standing any onboarding path threatens, and the sweeteners Jagex floated mid-backlash only made the trade explicit.
The Back Page
The Guardian
Two Neto goals at Goodison, a second straight win since the Brentford defeat, and — the number that answers Thursday's question — a first Premier League clean sheet since January, twenty-two games ago. It was not the fun version: a feisty, scrappy first half Everton edged, Pickford weak on both goals, and Alonso afterwards declining the compliment entirely, saying the mentality was good but "it's one day" and he will believe it at ten clean sheets. The sour note is Emi Martínez, carried off in a neck brace after an accidental collision with Branthwaite and taken to hospital with suspected concussion — conscious when he left, with Mike Penders finishing a Premier League debut nobody wanted him to have.
The Guardian / WhoScored · from Saturday’s paper
Read it now with Saturday's result in hand, because the argument held up better than the scoreline suggests. Paterson's case was that fifteen goals from 8.4 xG is borrowed money and the defensive structure — both wing-backs, both attacking midfielders and João Pedro pushed up, leaving a back three and two midfielders to cover ground they cannot — is what Brentford took apart. His hopeful note was the Bournemouth game, where Chelsea dropped into a 4-4-2 out of possession and looked like a side with a plan for the turnover. That is roughly the shape that produced the clean sheet at Everton, which makes this the rare tactical piece you can check against the following weekend.
Loose Change
Catharine Edwards, Aeon
Roman manliness ran on a word, virtus, built directly out of vir — man — and it began by meaning courage in battle and nothing else. Cicero's project, which Edwards traces across forty years of his own writing, was to argue it into covering a man who had never commanded an army: as consul he insisted that citizens in togas had beaten the Catiline conspiracy, which put rhetoric level with a military victory and made the orator's body the new field of judgment. So the policing moved to the surface of things — Quintilian ruled on how a toga should hang and called one particular drape effeminate, the handbooks warned against a shrill voice, and Cicero wanted gestures borrowed from the wrestling ground rather than the stage, because an actor's hands were a slave's hands. The essay's sharpest turn is what happened when his own life fell apart: sixteen months in exile, weeping openly and writing "What am I now?", then his daughter's death, and a flat refusal to accept the Stoic consolation that grief is unmanly — apathy, he said, would be brutish, not brave. He lost the larger argument to soldiers, who killed him in 43 BCE, and won it for about fifteen centuries afterwards.
The Guardian · from Saturday’s paper
Given a defence brief in the late 1960s to replace the cathode-ray tubes in radar sets with something flat, he convened Britain's liquid crystal researchers, worked out that only one man in the room — George Gray of Hull — actually understood the material, and put him under contract on the spot. The mixture they landed on by 1972 was stable in heat and sunlight, which is why it ended up in watches, then calculators, then every laptop and phone, earning the Ministry of Defence over £100m in royalties. He also helped build the Gunn diode behind police speed guns, which inconvenienced him as a fast driver; invented a device for locating snipers from bullet trajectories; beat Alan Turing at chess; insisted on hiring equal numbers of men and women at GEC in the 1980s; and attended Churchill's post-war meetings with his wife specifically in order to heckle. Born to street traders in Stepney, reading fluently at three, dead at 101.
Open Culture · from Wednesday’s paper
An otherwise unrecorded Dutch artist named A. Boogert sat down and hand-painted some eight hundred pages of watercolor swatches, mixing each one and annotating how much water to add to shift the tone, producing a color reference three centuries before anyone standardized one. The part that will not leave you alone is the distribution: it was a single manuscript, almost certainly seen by a handful of people, and the labor of making it vastly exceeded any plausible use anybody could have got from it.
Around town
Tue Oct 20 · 6:00pm
Betaworks, 29 Little W 12th St, Meatpacking District
Hosted by AI After 5, and structured as the thing most agent meetups skip: a live walkthrough, then everyone actually builds something from a recurring task they brought with them. The loop they teach — frame the ask, hand over context, review the output, refine — is the loop, and watching a room of people hit the same wall at the same moment is worth more than another panel. Free, and you leave with credits and a half-finished project.
professional
Fri Oct 23 · 7:30pm
Leonard Nimoy Thalia, Symphony Space, 250 W 95th St
Hicks is a Harlem guitarist who won the Blues Music Award for best emerging artist and has stood on stages with Buddy Guy, Jeff Beck and Mavis Staples, and what he plays is blues with the jazz, soul, funk and gospel left in rather than scrubbed out. The Thalia is a 160-seat room, which is the whole argument: electric blues in a space small enough that the amp is a physical fact and not a recording. Ninety minutes, twenty-five to thirty-five dollars, and it is a ten-minute walk.
say yes
Thu Oct 22 · 8:10pm
Film Forum, 209 W Houston St, West Village
Wajda's last film, made at 87, about an electrician who talked his way into bringing down a government — and Więckiewicz, who plays him, stays after to talk with Kent Jones. Part of the Wajda 100 series, which closes this week. Eighteen dollars, twelve for members.
casual
Sat Oct 24 · 9:00am–6:00pm
Betaworks, Meatpacking District
Nine hours, teams of four, building against problems a venture fund actually has — sourcing, diligence memos, LP reporting — then demoing to six judges who work at the funds. Free, food all day, and an unusually direct look at the internals of a business that normally only shows you its outputs.
professional
Tue Oct 27 · 6:00pm
535 Fifth Ave, Midtown
An evening on the layer underneath the models, with an Nvidia systems research engineer doing data curation for vision-language-action models, a GPU-compute recruiter, and the founder of an enterprise AI governance company. The recruiter on the bill is the tell that the hallway is worth as much as the panel. Free.
professional
Quote of the week
“The joy of programming is dying. The joy of delivering results lives on.”
— Cendyne, on being laid off in favor of a cheaper model
On this day
October 18, 1931 — Thomas Edison dies at 84 in West Orange, New Jersey, having filed 1,093 US patents and having been wrong about alternating current for most of his career. Thirty-seven years later to the day, at the Mexico City Olympics, Bob Beamon jumps 8.90 metres on his first attempt — so far past the end of the optical measuring device that officials had to find a tape measure, and so far past the world record that it stood for twenty-three years.