Calls, puts & mise en place

Appel & Mise

Vol. IWednesday, October 21, 2026 · 52° & clear on the UWSThe daily, for Jeremy Ettlinger

BTC$83,269+2.2%ETH$2,449+2.7%S&P 5007,713+0.3%

The lede

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

Scott Helme · made the Sunday

The private keys for eight eMudhra intermediate CAs — six TLS issuers across DV, OV and EV, plus two code-signing CAs, all cross-signed by Sectigo's AAA root in May 2025 — were not stolen. They were 47 bytes of zeros followed by one byte. The recovered values are 4, 56, 115, 66, 155, 156, 230 and 237, which means at most 255 point multiplications to go from the public certificate to the private key, and Helme did all sixteen certificates on a laptop in under a second. eMudhra's own account on Mozilla's bug tracker blames a key-ceremony script that quietly minted a second weak keypair on the HSM, with similar key names causing the wrong one to get signed. The part worth your morning is the blast radius, not the blunder: browsers fixed this in an evening with CRLSets and OneCRL, but curl, Python, Node, Go, Java and git read an on-disk bundle, skip revocation by default and ignore Certificate Transparency entirely. Helme forged a certificate for api.stripe.com and curl, Python and Node all took it. Every `curl | sh` installer, CI runner, server-to-server API call and container base image is in scope, and because the key was effectively public from the moment of issuance, there is no theft window to reason about — seventeen months in which anyone could have done this, and no way to know if anyone did. His postscript is the detail that will stay with you: an AI agent recovered the keys from a single prompt.

AI & Agents

HumanLayer

SlopCodeBench 10/2026: Opus 5.5, Astra, and 'xhigh considered harmful'

The useful benchmark design: hand the agent a problem in stages, change the requirements, and test at every checkpoint whether the new behavior works *and* the old behavior still does. Across 36 problems and 196 checkpoints, strict pass rates (everything green, regressions included) land between 12.2% and 16.3% while core rates sit at 66–74%, which is the whole finding in one line — these models get the feature right and quietly break what was already there. The headline oversells itself and the author says so: raising Opus 5.5 from medium to xhigh moved strict passes from 28 to 25 and cost 4.22x, GPT-6 SOL went 30 to 26 at 2.11x, and only Astra improved, so the honest claim is that effort did not reliably buy correctness, not that reasoning hurts. Read it next to Cloudflare's inference post from Monday, which found Opus 5.5 at medium indistinguishable from high on findings and billed accordingly.

Anthropic

Using Claude to reduce the attack surface of code

A different bet than bug-hunting: instead of finding each vulnerability, find the code a given deployment never needed to expose and gate it. The Frontier Red Team ran Claude over 25 projects and 5M+ lines, inventoried 17,000 config options (3,842 security-relevant) and filed 493 issues, and the pattern that recurs is the one you will recognize from your own config surface — 162 option combinations accepted with no error or warning, 94 of which silently switch a security control off. The fail-open hostname rule showed up in four unrelated projects; one certificate-check bypass had been live for 21 years. The OpenSSH case study is the proof: ~4,500 lines of experimental ML-DSA-44 code reachable pre-auth by default, about 16% of the pre-auth surface, fixed across 10.4 to 10.6 after Claude caught two gaps in the maintainers' first patch. Packaged as a skill now going into OSS-Scanner, which is the part you can actually run.

Engineering & Leadership

LeadDev

Engineers lose 17+ days a year to AI rework

The number is built from the floor of its own range — 43% of 300-plus leaders at 1,000-person-plus orgs say at least 10% of engineering time goes to revisiting AI-assisted code, counted at the bottom, which is 139 hours or seven engineers' annual capacity per hundred. Treat the figure as directional; the structural claim underneath it is the one to argue with your staff about. AI speeds up the team that ships and moves the cost somewhere that does not report to that team: 76% had a release delayed by unmanaged dependencies, 94% say AI has increased open-source consumption, half say a new dependency can reach production unreviewed, and 92% have a policy that 52% follow. The recommendation worth stealing is the cheap one — make AI rework its own tracked category so it stops hiding inside sprint carryover.

Web & Product Craft

Josh W. Comeau · made the Sunday

The Future of CSS: my top 10 picks for Interop 2027

Interop is the one browser-vendor process with a reliable track record — subgrid sat at 12% of tests passing in Chrome until it was added to Interop 2023 and hit 100% inside the year — and the 2027 list is being chosen now, partly from developer upvotes. The ten are worth reading as a preview of what you will be writing in eighteen months: `@function` for custom CSS functions, `corner-shape` and `border-shape` (which change the border box, so borders and shadows actually follow the curve, unlike `clip-path`), gap decorations to draw grid rules without empty divs, `reading-flow` to make focus order follow the visual layout, scroll-state container queries for sticky headers that know they are stuck. Comeau's aside is the one that matters for your workflow: your agent will not reach for any of this, because its training data predates all of it, so modern CSS is now something you have to push into the prompt.

Cloudflare · made the Sunday

Introducing tsrs: a port of TypeScript to Rust

Cloudflare, VoidZero and Max Schwenk are porting the TypeScript compiler to Rust inside the Oxc toolchain — a faithful port, not a fork, explicitly deferring language direction to the TypeScript team and co-developed with them. The claim is up to 8x faster than TypeScript 7.0 and ~70% less memory at matched worker counts, with benchmarks configured alongside the TS team because the usual trick is a bigger machine and non-default flags; some tsrs optimizations have already landed upstream in the 7.1 beta. The reason to care is not the number but where it points: Go compiles its GC into Wasm, Rust does not, so a Rust typechecker is the one that runs cleanly in a Worker — which is Cloudflare telling you it intends to put whole build toolchains and sandboxed agent dev environments on the edge and in the browser.

Cloudflare

8 eMudhra certificates are compromised. Here's what you need to know

The operator's side of the lede, and the more actionable half if you run anything. Cloudflare learned at 17:00 UTC on the 19th, patched critical services before public disclosure, and had CDN and server-side Zero Trust mitigations fully deployed by 19:20 the next day; they found no exploitation. The checklist is specific: cloudflared to 2026.10.2 with container images rebuilt and redeployed, WARP and 1.1.1.1 clients to the named builds, mTLS trust stores and uploaded CAs reviewed, and Full (strict) origins checked because distrusted origin certificates are about to start breaking. Two lines deserve a sticky note — certificate verification usually lives in your HTTP library or runtime rather than the SDK you upgraded, and a passing browser test says nothing about the background service calling an API. Their closing point is the structural one: trust stores are static lists in a world that needs revocation, which is what projects like upki are for.

New York & the Table

West Side Rag

How an Upper West Sider cultivates a bookish community online and IRL

Kelly Chervin was a middle-school teacher, then helped found a Bronx charter school, then spent three years in edtech until a layoff last year turned her Bookstagram side project into the job. Lit Club now runs to ~35,000 Instagram followers and 9,500-plus Substack subscribers, monetized through events, subscriptions, venue sponsorships and consulting for other book clubs — a working example of the small-audience business model, built on a format rather than a feed. The format is the part worth borrowing: Rest and Read opens with snacks and mingling, then forty minutes of silent reading to a curated classical playlist, then guided discussion, held in parks and plant shops and the St. Agnes Library. The last one was thirty people in the West 87th Street Park and Garden, which is six blocks from your door.

Diversions

Aftermath

$1,200–$1,800 for a console is such commercial suicide I can't even muster a 'get the f— outta here'

Fortune's profile of Xbox's Asha Sharma contains the detail that the next console, codenamed Helix, has been internally projected at $1,200 to $1,800 unsubsidized — against the $499 the Series S/X launched at. Plunkett's point is not that the number is implausible but that Microsoft is saying it out loud, into a cost-of-living crisis, with generational performance gains flattening and the exclusives thinning. Even a subsidized thousand-dollar box doubles the entry price of a category whose whole premise was being cheaper than a PC, which is roughly how you arrive at his conclusion that the sensible move left is re-releasing old consoles.

Loose Change

Jarrett Fuller · made the Sunday

The Last Skeuomorph in iOS?

Fuller opens the camera on a new iPhone, hears the shutter, and notices what has quietly happened: the animated aperture that used to open and close on screen is gone, replaced by a blink, but the sound of a mechanism nobody under thirty has operated is still there. Then the better irony arrives — the phone has a real physical shutter now, and it is silent, so the device fakes the noise its own hardware declines to make. Going through the sound settings he finds the dial pad imitating a landline and a keyboard that sounds like no keyboard ever built, and lands on Brian Eno's Windows 95 chime as the formative music of his childhood. He does not resolve it, which is the honest ending: what should a photograph sound like, once nothing about taking one makes a noise? Worth the archive trip — it ran in September.

The Back Page

We Ain't Got No History

Mike Penders becomes Chelsea's youngest ever Premier League goalkeeper

Emiliano Martínez fractured his jaw at Everton and went to hospital, so Penders came on at 2-0 with a few minutes of hurried warm-up and saw out a clean sheet — commanding his box well, fumbling once, getting flattened on a set piece once. At 21 he passes Lenny Pidgeley as Chelsea's youngest Premier League keeper, and on Saturday against Spurs at the Bridge he is set to start at 21 years and 85 days, taking the youngest-starter record from Petr Čech by about a year. Čech then kept the shirt for a decade, which is the kind of comparison nobody needs hung on a 21-year-old in the week Chelsea were not planning to need him.

Posting and Toasting

76ers 106, Knicks 100: scenes from banner night

Rings handed out, banner raised, gold-lettered uniforms, and then Philadelphia — now with LeBron James and Jaylen Brown — took the opener. Maxey had 28, Brunson 21 on 6-of-19, Towns 19 and 12, and the genuine discovery was Andre Drummond with a 10-point, 12-rebound, two-block first half before vanishing after the break. Forty-five fouls called, the Knicks up four at the break on a rebounding edge, then a third quarter Richardson describes as stinking. An 0-1 that nobody in the building will remember, which is the correct way to lose a banner night.

Around town

Thu Oct 22 · 7:00pm–11:00pm

Startup Scaries

Fonzi HQ, 25 Kent Ave, Williamsburg

A Halloween party for engineers and founders in a Williamsburg office, with costumes optional, drinks, games, and someone on hand to tell your career fortune. Free, four hours, and the premise — your startup nightmares coming to life — is at least an honest framing of a networking event. The useful version of this room is the one where nobody is on stage and people will tell you what actually happened at their company.

professional

Mon Oct 26 · 4:30pm

NEAR x SVRN Happy Hour

The Bridge (address to registrants)

An allocators-trading-desks-issuers room the evening before The Bridge, which is a narrower and more useful crowd than a general crypto mixer. The substance on offer is NEAR's confidential execution — keeping trade details private while settlement stays verifiable onchain, the problem every institutional desk raises and few protocols answer — plus SVRN on piloting stablecoin payments at point of sale with Oracle. Free, and squarely your day job.

professional

Mon Oct 26 · 8:00pm

Elaine May's MIKEY AND NICKY

Film Forum, 209 W Houston St, West Village

One night only. May's 1976 film gives Peter Falk and John Cassavetes a whole night in a city that wants one of them dead, and then mostly just lets them talk — the funniest and most painful thing either of them did. Paramount buried it; it has spent fifty years becoming the May film people argue hardest about. Eighteen dollars, twelve for members.

casual

Quote of the day

“Reducing reachability can reduce the severity of unknown vulnerabilities.”

— Chris Rohlf, Anthropic Frontier Red Team

On this day

October 21, 1959 — the Guggenheim opens on Fifth Avenue, sixteen years after Hilla Rebay first wrote to Frank Lloyd Wright and six months after Wright died without seeing it finished. Three years before it opened, twenty-one artists signed a letter objecting that a continuous curving ramp was a hostile place to hang a painting. They were arguably right and it did not matter: the building is the thing people come for, which is either a cautionary tale about architects or the whole point.

The puzzle corner

The Mini · Wordle · Connections

The lede and the Anthropic paper are the same story told from both ends: eight CA keys were a single byte long because a script picked the wrong one off an HSM, and the fix for the next one is not finding the bug faster but shrinking the surface it can reach. The benchmark in between says the models are good at making the new thing work and bad at not breaking the old thing, which is also a reasonable description of a key ceremony.