[{"data":1,"prerenderedAt":444},["ShallowReactive",2],{"paper-\u002Fpaper\u002F2026-10-21":3,"paper-dates":147,"paper-sunday-2026-10-21":299},{"id":4,"title":5,"body":6,"crossword":17,"date":18,"description":19,"events":20,"extension":41,"feature":17,"lede":42,"markets":47,"meta":60,"navigation":61,"onThisDay":62,"path":63,"quote":64,"sections":67,"seo":143,"stem":144,"weather":145,"__hash__":146},"paper\u002Fpaper\u002F2026-10-21.md","Appel & Mise — October 21, 2026",{"type":7,"value":8,"toc":13},"minimark",[9],[10,11,12],"p",{},"The lede and the Anthropic paper are the same story told from both ends: eight CA keys were a single byte long because a script picked the wrong one off an HSM, and the fix for the next one is not finding the bug faster but shrinking the surface it can reach. The benchmark in between says the models are good at making the new thing work and bad at not breaking the old thing, which is also a reasonable description of a key ceremony.",{"title":14,"searchDepth":15,"depth":15,"links":16},"",2,[],null,"2026-10-21","Eight eMudhra intermediate CA private keys turned out to be a single byte long, crackable on a laptop in under a second and effectively public since April 2025; Cloudflare has a port of TypeScript to Rust and a remediation checklist for the certificate mess; and a 21-year-old is about to take Petr Čech's record because Chelsea's keeper broke his jaw.",[21,28,34],{"title":22,"url":23,"when":24,"where":25,"kind":26,"note":27},"Startup Scaries","https:\u002F\u002Fwww.garysguide.com\u002Fevents\u002Fxzsxrnt\u002FStartup-Scaries","Thu Oct 22 · 7:00pm–11:00pm","Fonzi HQ, 25 Kent Ave, Williamsburg","professional","A Halloween party for engineers and founders in a Williamsburg office, with costumes optional, drinks, games, and someone on hand to tell your career fortune. Free, four hours, and the premise — your startup nightmares coming to life — is at least an honest framing of a networking event. The useful version of this room is the one where nobody is on stage and people will tell you what actually happened at their company.",{"title":29,"url":30,"when":31,"where":32,"kind":26,"note":33},"NEAR x SVRN Happy Hour","https:\u002F\u002Fwww.garysguide.com\u002Fevents\u002Fyc0v8b1\u002FNEAR-x-SVRN-Happy-Hour","Mon Oct 26 · 4:30pm","The Bridge (address to registrants)","An allocators-trading-desks-issuers room the evening before The Bridge, which is a narrower and more useful crowd than a general crypto mixer. The substance on offer is NEAR's confidential execution — keeping trade details private while settlement stays verifiable onchain, the problem every institutional desk raises and few protocols answer — plus SVRN on piloting stablecoin payments at point of sale with Oracle. Free, and squarely your day job.",{"title":35,"url":36,"when":37,"where":38,"kind":39,"note":40},"Elaine May's MIKEY AND NICKY","https:\u002F\u002Ffilmforum.org\u002Ffilm\u002Fmikey-and-nicky","Mon Oct 26 · 8:00pm","Film Forum, 209 W Houston St, West Village","casual","One night only. May's 1976 film gives Peter Falk and John Cassavetes a whole night in a city that wants one of them dead, and then mostly just lets them talk — the funniest and most painful thing either of them did. Paramount buried it; it has spent fifty years becoming the May film people argue hardest about. Eighteen dollars, twelve for members.","md",{"title":43,"url":44,"source":45,"summary":46},"Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds","https:\u002F\u002Fscotthelme.co.uk\u002Feight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds\u002F","Scott Helme","The private keys for eight eMudhra intermediate CAs — six TLS issuers across DV, OV and EV, plus two code-signing CAs, all cross-signed by Sectigo's AAA root in May 2025 — were not stolen. They were 47 bytes of zeros followed by one byte. The recovered values are 4, 56, 115, 66, 155, 156, 230 and 237, which means at most 255 point multiplications to go from the public certificate to the private key, and Helme did all sixteen certificates on a laptop in under a second. eMudhra's own account on Mozilla's bug tracker blames a key-ceremony script that quietly minted a second weak keypair on the HSM, with similar key names causing the wrong one to get signed. The part worth your morning is the blast radius, not the blunder: browsers fixed this in an evening with CRLSets and OneCRL, but curl, Python, Node, Go, Java and git read an on-disk bundle, skip revocation by default and ignore Certificate Transparency entirely. Helme forged a certificate for api.stripe.com and curl, Python and Node all took it. Every `curl | sh` installer, CI runner, server-to-server API call and container base image is in scope, and because the key was effectively public from the moment of issuance, there is no theft window to reason about — seventeen months in which anyone could have done this, and no way to know if anyone did. His postscript is the detail that will stay with you: an AI agent recovered the keys from a single prompt.",[48,52,56],{"symbol":49,"value":50,"change":51},"BTC","$83,269","+2.2%",{"symbol":53,"value":54,"change":55},"ETH","$2,449","+2.7%",{"symbol":57,"value":58,"change":59},"S&P 500","7,713","+0.3%",{},true,"October 21, 1959 — the Guggenheim opens on Fifth Avenue, sixteen years after Hilla Rebay first wrote to Frank Lloyd Wright and six months after Wright died without seeing it finished. Three years before it opened, twenty-one artists signed a letter objecting that a continuous curving ramp was a hostile place to hang a painting. They were arguably right and it did not matter: the building is the thing people come for, which is either a cautionary tale about architects or the whole point.","\u002Fpaper\u002F2026-10-21",{"text":65,"attribution":66},"Reducing reachability can reduce the severity of unknown vulnerabilities.","Chris Rohlf, Anthropic Frontier Red Team",[68,81,89,106,114,122,130],{"name":69,"items":70},"AI & Agents",[71,76],{"title":72,"url":73,"source":74,"summary":75},"SlopCodeBench 10\u002F2026: Opus 5.5, Astra, and 'xhigh considered harmful'","https:\u002F\u002Fgithub.com\u002Fhumanlayer\u002Fadvanced-context-engineering-for-coding-agents\u002Fblob\u002Fmain\u002Fbenchmarking-new-models-on-slop-code-bench.md","HumanLayer","The useful benchmark design: hand the agent a problem in stages, change the requirements, and test at every checkpoint whether the new behavior works *and* the old behavior still does. Across 36 problems and 196 checkpoints, strict pass rates (everything green, regressions included) land between 12.2% and 16.3% while core rates sit at 66–74%, which is the whole finding in one line — these models get the feature right and quietly break what was already there. The headline oversells itself and the author says so: raising Opus 5.5 from medium to xhigh moved strict passes from 28 to 25 and cost 4.22x, GPT-6 SOL went 30 to 26 at 2.11x, and only Astra improved, so the honest claim is that effort did not reliably buy correctness, not that reasoning hurts. Read it next to Cloudflare's inference post from Monday, which found Opus 5.5 at medium indistinguishable from high on findings and billed accordingly.",{"title":77,"url":78,"source":79,"summary":80},"Using Claude to reduce the attack surface of code","https:\u002F\u002Fwww.anthropic.com\u002Fresearch\u002Fattack-surface-reduction","Anthropic","A different bet than bug-hunting: instead of finding each vulnerability, find the code a given deployment never needed to expose and gate it. The Frontier Red Team ran Claude over 25 projects and 5M+ lines, inventoried 17,000 config options (3,842 security-relevant) and filed 493 issues, and the pattern that recurs is the one you will recognize from your own config surface — 162 option combinations accepted with no error or warning, 94 of which silently switch a security control off. The fail-open hostname rule showed up in four unrelated projects; one certificate-check bypass had been live for 21 years. The OpenSSH case study is the proof: ~4,500 lines of experimental ML-DSA-44 code reachable pre-auth by default, about 16% of the pre-auth surface, fixed across 10.4 to 10.6 after Claude caught two gaps in the maintainers' first patch. Packaged as a skill now going into OSS-Scanner, which is the part you can actually run.",{"name":82,"items":83},"Engineering & Leadership",[84],{"title":85,"url":86,"source":87,"summary":88},"Engineers lose 17+ days a year to AI rework","https:\u002F\u002Fleaddev.com\u002Fai\u002Fengineers-lose-17-days-a-year-to-ai-rework","LeadDev","The number is built from the floor of its own range — 43% of 300-plus leaders at 1,000-person-plus orgs say at least 10% of engineering time goes to revisiting AI-assisted code, counted at the bottom, which is 139 hours or seven engineers' annual capacity per hundred. Treat the figure as directional; the structural claim underneath it is the one to argue with your staff about. AI speeds up the team that ships and moves the cost somewhere that does not report to that team: 76% had a release delayed by unmanaged dependencies, 94% say AI has increased open-source consumption, half say a new dependency can reach production unreviewed, and 92% have a policy that 52% follow. The recommendation worth stealing is the cheap one — make AI rework its own tracked category so it stops hiding inside sprint carryover.",{"name":90,"items":91},"Web & Product Craft",[92,97,102],{"title":93,"url":94,"source":95,"summary":96},"The Future of CSS: my top 10 picks for Interop 2027","https:\u002F\u002Fjoshwcomeau.com\u002Fcss\u002Finterop-2027\u002F","Josh W. Comeau","Interop is the one browser-vendor process with a reliable track record — subgrid sat at 12% of tests passing in Chrome until it was added to Interop 2023 and hit 100% inside the year — and the 2027 list is being chosen now, partly from developer upvotes. The ten are worth reading as a preview of what you will be writing in eighteen months: `@function` for custom CSS functions, `corner-shape` and `border-shape` (which change the border box, so borders and shadows actually follow the curve, unlike `clip-path`), gap decorations to draw grid rules without empty divs, `reading-flow` to make focus order follow the visual layout, scroll-state container queries for sticky headers that know they are stuck. Comeau's aside is the one that matters for your workflow: your agent will not reach for any of this, because its training data predates all of it, so modern CSS is now something you have to push into the prompt.",{"title":98,"url":99,"source":100,"summary":101},"Introducing tsrs: a port of TypeScript to Rust","https:\u002F\u002Fblog.cloudflare.com\u002Ftypescript-rust-port\u002F","Cloudflare","Cloudflare, VoidZero and Max Schwenk are porting the TypeScript compiler to Rust inside the Oxc toolchain — a faithful port, not a fork, explicitly deferring language direction to the TypeScript team and co-developed with them. The claim is up to 8x faster than TypeScript 7.0 and ~70% less memory at matched worker counts, with benchmarks configured alongside the TS team because the usual trick is a bigger machine and non-default flags; some tsrs optimizations have already landed upstream in the 7.1 beta. The reason to care is not the number but where it points: Go compiles its GC into Wasm, Rust does not, so a Rust typechecker is the one that runs cleanly in a Worker — which is Cloudflare telling you it intends to put whole build toolchains and sandboxed agent dev environments on the edge and in the browser.",{"title":103,"url":104,"source":100,"summary":105},"8 eMudhra certificates are compromised. Here's what you need to know","https:\u002F\u002Fblog.cloudflare.com\u002Femudhra-certificate-compromise\u002F","The operator's side of the lede, and the more actionable half if you run anything. Cloudflare learned at 17:00 UTC on the 19th, patched critical services before public disclosure, and had CDN and server-side Zero Trust mitigations fully deployed by 19:20 the next day; they found no exploitation. The checklist is specific: cloudflared to 2026.10.2 with container images rebuilt and redeployed, WARP and 1.1.1.1 clients to the named builds, mTLS trust stores and uploaded CAs reviewed, and Full (strict) origins checked because distrusted origin certificates are about to start breaking. Two lines deserve a sticky note — certificate verification usually lives in your HTTP library or runtime rather than the SDK you upgraded, and a passing browser test says nothing about the background service calling an API. Their closing point is the structural one: trust stores are static lists in a world that needs revocation, which is what projects like upki are for.",{"name":107,"items":108},"New York & the Table",[109],{"title":110,"url":111,"source":112,"summary":113},"How an Upper West Sider cultivates a bookish community online and IRL","https:\u002F\u002Fwww.westsiderag.com\u002F2026\u002F10\u002F20\u002Fhow-an-upper-west-sider-cultivates-a-bookish-community-online-and-irl","West Side Rag","Kelly Chervin was a middle-school teacher, then helped found a Bronx charter school, then spent three years in edtech until a layoff last year turned her Bookstagram side project into the job. Lit Club now runs to ~35,000 Instagram followers and 9,500-plus Substack subscribers, monetized through events, subscriptions, venue sponsorships and consulting for other book clubs — a working example of the small-audience business model, built on a format rather than a feed. The format is the part worth borrowing: Rest and Read opens with snacks and mingling, then forty minutes of silent reading to a curated classical playlist, then guided discussion, held in parks and plant shops and the St. Agnes Library. The last one was thirty people in the West 87th Street Park and Garden, which is six blocks from your door.",{"name":115,"items":116},"Diversions",[117],{"title":118,"url":119,"source":120,"summary":121},"$1,200–$1,800 for a console is such commercial suicide I can't even muster a 'get the f— outta here'","https:\u002F\u002Faftermath.site\u002Fxbox-helix-next-console-1200-1800-dollar-price\u002F","Aftermath","Fortune's profile of Xbox's Asha Sharma contains the detail that the next console, codenamed Helix, has been internally projected at $1,200 to $1,800 unsubsidized — against the $499 the Series S\u002FX launched at. Plunkett's point is not that the number is implausible but that Microsoft is saying it out loud, into a cost-of-living crisis, with generational performance gains flattening and the exclusives thinning. Even a subsidized thousand-dollar box doubles the entry price of a category whose whole premise was being cheaper than a PC, which is roughly how you arrive at his conclusion that the sensible move left is re-releasing old consoles.",{"name":123,"items":124},"Loose Change",[125],{"title":126,"url":127,"source":128,"summary":129},"The Last Skeuomorph in iOS?","https:\u002F\u002Fwww.jarrettfuller.blog\u002F2026\u002F09\u002Fcamera-shutter-skeuomorph","Jarrett Fuller","Fuller opens the camera on a new iPhone, hears the shutter, and notices what has quietly happened: the animated aperture that used to open and close on screen is gone, replaced by a blink, but the sound of a mechanism nobody under thirty has operated is still there. Then the better irony arrives — the phone has a real physical shutter now, and it is silent, so the device fakes the noise its own hardware declines to make. Going through the sound settings he finds the dial pad imitating a landline and a keyboard that sounds like no keyboard ever built, and lands on Brian Eno's Windows 95 chime as the formative music of his childhood. He does not resolve it, which is the honest ending: what should a photograph sound like, once nothing about taking one makes a noise? Worth the archive trip — it ran in September.",{"name":131,"items":132},"The Back Page",[133,138],{"title":134,"url":135,"source":136,"summary":137},"Mike Penders becomes Chelsea's youngest ever Premier League goalkeeper","https:\u002F\u002Fweaintgotnohistory.sbnation.com\u002Fchelsea-fc\u002F173273\u002Fmike-penders-becomes-chelseas-youngest-ever-premier-league-goalkeeper-now-set-to-beat-petr-cechs-record","We Ain't Got No History","Emiliano Martínez fractured his jaw at Everton and went to hospital, so Penders came on at 2-0 with a few minutes of hurried warm-up and saw out a clean sheet — commanding his box well, fumbling once, getting flattened on a set piece once. At 21 he passes Lenny Pidgeley as Chelsea's youngest Premier League keeper, and on Saturday against Spurs at the Bridge he is set to start at 21 years and 85 days, taking the youngest-starter record from Petr Čech by about a year. Čech then kept the shirt for a decade, which is the kind of comparison nobody needs hung on a 21-year-old in the week Chelsea were not planning to need him.",{"title":139,"url":140,"source":141,"summary":142},"76ers 106, Knicks 100: scenes from banner night","https:\u002F\u002Fwww.postingandtoasting.com\u002Fknicks-scores-results\u002F90308\u002F76ers-106-knicks-100-scenes-from-banner-night","Posting and Toasting","Rings handed out, banner raised, gold-lettered uniforms, and then Philadelphia — now with LeBron James and Jaylen Brown — took the opener. Maxey had 28, Brunson 21 on 6-of-19, Towns 19 and 12, and the genuine discovery was Andre Drummond with a 10-point, 12-rebound, two-block first half before vanishing after the break. Forty-five fouls called, the Knicks up four at the break on a rebounding edge, then a third quarter Richardson describes as stinking. An 0-1 that nobody in the building will remember, which is the correct way to lose a banner night.",{"title":5,"description":19},"paper\u002F2026-10-21","52° & clear on the UWS","wlsSKwHsdkTXmL-IK7XpjsaQj0B60Ufj_NGKxLIwaXE",[148,151,154,157,160,163,166,169,172,175,178,181,184,187,190,193,196,199,202,205,208,211,214,217,220,223,226,229,232,235,238,241,244,247,250,253,256,259,262,265,268,271,274,277,280,283,286,287,290,293,296],{"date":149,"path":150},"2026-08-30","\u002Fpaper\u002F2026-08-30",{"date":152,"path":153},"2026-09-06","\u002Fpaper\u002F2026-09-06",{"date":155,"path":156},"2026-09-07","\u002Fpaper\u002F2026-09-07",{"date":158,"path":159},"2026-09-08","\u002Fpaper\u002F2026-09-08",{"date":161,"path":162},"2026-09-09","\u002Fpaper\u002F2026-09-09",{"date":164,"path":165},"2026-09-10","\u002Fpaper\u002F2026-09-10",{"date":167,"path":168},"2026-09-11","\u002Fpaper\u002F2026-09-11",{"date":170,"path":171},"2026-09-12","\u002Fpaper\u002F2026-09-12",{"date":173,"path":174},"2026-09-13","\u002Fpaper\u002F2026-09-13",{"date":176,"path":177},"2026-09-14","\u002Fpaper\u002F2026-09-14",{"date":179,"path":180},"2026-09-15","\u002Fpaper\u002F2026-09-15",{"date":182,"path":183},"2026-09-16","\u002Fpaper\u002F2026-09-16",{"date":185,"path":186},"2026-09-17","\u002Fpaper\u002F2026-09-17",{"date":188,"path":189},"2026-09-18","\u002Fpaper\u002F2026-09-18",{"date":191,"path":192},"2026-09-19","\u002Fpaper\u002F2026-09-19",{"date":194,"path":195},"2026-09-20","\u002Fpaper\u002F2026-09-20",{"date":197,"path":198},"2026-09-21","\u002Fpaper\u002F2026-09-21",{"date":200,"path":201},"2026-09-22","\u002Fpaper\u002F2026-09-22",{"date":203,"path":204},"2026-09-23","\u002Fpaper\u002F2026-09-23",{"date":206,"path":207},"2026-09-24","\u002Fpaper\u002F2026-09-24",{"date":209,"path":210},"2026-09-25","\u002Fpaper\u002F2026-09-25",{"date":212,"path":213},"2026-09-26","\u002Fpaper\u002F2026-09-26",{"date":215,"path":216},"2026-09-27","\u002Fpaper\u002F2026-09-27",{"date":218,"path":219},"2026-09-28","\u002Fpaper\u002F2026-09-28",{"date":221,"path":222},"2026-09-29","\u002Fpaper\u002F2026-09-29",{"date":224,"path":225},"2026-09-30","\u002Fpaper\u002F2026-09-30",{"date":227,"path":228},"2026-10-01","\u002Fpaper\u002F2026-10-01",{"date":230,"path":231},"2026-10-02","\u002Fpaper\u002F2026-10-02",{"date":233,"path":234},"2026-10-03","\u002Fpaper\u002F2026-10-03",{"date":236,"path":237},"2026-10-04","\u002Fpaper\u002F2026-10-04",{"date":239,"path":240},"2026-10-05","\u002Fpaper\u002F2026-10-05",{"date":242,"path":243},"2026-10-06","\u002Fpaper\u002F2026-10-06",{"date":245,"path":246},"2026-10-07","\u002Fpaper\u002F2026-10-07",{"date":248,"path":249},"2026-10-08","\u002Fpaper\u002F2026-10-08",{"date":251,"path":252},"2026-10-09","\u002Fpaper\u002F2026-10-09",{"date":254,"path":255},"2026-10-10","\u002Fpaper\u002F2026-10-10",{"date":257,"path":258},"2026-10-11","\u002Fpaper\u002F2026-10-11",{"date":260,"path":261},"2026-10-12","\u002Fpaper\u002F2026-10-12",{"date":263,"path":264},"2026-10-13","\u002Fpaper\u002F2026-10-13",{"date":266,"path":267},"2026-10-14","\u002Fpaper\u002F2026-10-14",{"date":269,"path":270},"2026-10-15","\u002Fpaper\u002F2026-10-15",{"date":272,"path":273},"2026-10-16","\u002Fpaper\u002F2026-10-16",{"date":275,"path":276},"2026-10-17","\u002Fpaper\u002F2026-10-17",{"date":278,"path":279},"2026-10-18","\u002Fpaper\u002F2026-10-18",{"date":281,"path":282},"2026-10-19","\u002Fpaper\u002F2026-10-19",{"date":284,"path":285},"2026-10-20","\u002Fpaper\u002F2026-10-20",{"date":18,"path":63},{"date":288,"path":289},"2026-10-22","\u002Fpaper\u002F2026-10-22",{"date":291,"path":292},"2026-10-23","\u002Fpaper\u002F2026-10-23",{"date":294,"path":295},"2026-10-24","\u002Fpaper\u002F2026-10-24",{"date":297,"path":298},"2026-10-25","\u002Fpaper\u002F2026-10-25",{"id":300,"title":301,"body":302,"crossword":17,"date":297,"description":309,"events":310,"extension":41,"feature":334,"lede":339,"markets":341,"meta":348,"navigation":61,"onThisDay":349,"path":298,"quote":350,"sections":353,"seo":440,"stem":441,"weather":442,"__hash__":443},"paper\u002Fpaper\u002F2026-10-25.md","Appel & Mise — October 25, 2026",{"type":7,"value":303,"toc":307},[304],[10,305,306],{},"Trust spent the week failing in the same direction. Eight certificate authority keys were a single byte long and had been effectively public for seventeen months; a Brotli bug fixed in February turned out to be remote code execution in every library that decompresses, and the advisory databases still will not tell you so; PHP shipped two pre-auth holes and named the delay a structural failure rather than a hard bug. Each one passed every check we have, because the checks test provenance and not intent — and the week's best engineering writing, from Cloudflare's token ledger to Anthropic's 123 machine-checked proofs to Dan Luu's list of things he built in an afternoon, was all ultimately about the same move: stop trusting the thing and go measure it instead. The one entry that got the measurement right is nine hundred years old, and it is a child's tooth from Derbyshire.",{"title":14,"searchDepth":15,"depth":15,"links":308},[],"The week eight certificate authority private keys turned out to be a single byte long and the CA quit the business rather than explain itself, a Brotli bug OpenAI found in February became an unauthenticated remote code execution hole in every HTTP library that decompresses, and Dan Luu made the case that the interesting constraint on software is no longer effort but imagination.",[311,318,320,322,328],{"title":312,"url":313,"when":314,"where":315,"kind":316,"note":317},"Tony Shalhoub & Josie Adams: We Thought They'd Never Leave","https:\u002F\u002Fwww.symphonyspace.org\u002Fevents\u002Ftony-shalhoub-josie-adams-we-thought-theyd-never-leave","Tue Oct 27 · 7:00pm","Peter Jay Sharp Theatre, 2537 Broadway at 95th","say yes","Shalhoub's first book is a collection of stories, memories and recipes written with his daughter Josie Adams, and the evening is the two of them talking about it with Rachel Brosnahan. It is a food book, which means it is really a book about a specific family's table and what got repeated there until it became a rule — the genre at its best is an oral history with quantities attached. Seventy-five minutes, a ten-minute walk, and the companion ticket is twenty-five dollars if you do not want the signed copy.",{"title":35,"url":36,"when":37,"where":38,"kind":39,"note":319},"One night only. May gives Peter Falk and John Cassavetes a single night in a city that wants one of them dead and then mostly just lets them talk, which turns out to be the funniest and most painful thing either man ever did. Paramount buried it in 1976; it has spent fifty years becoming the May film people argue hardest about. Eighteen dollars, twelve for members.",{"title":29,"url":30,"when":31,"where":32,"kind":26,"note":321},"The evening before The Bridge, which makes the room allocators, trading desks and issuers rather than a general crypto mixer. The substance is NEAR's confidential execution — keeping trade details private while settlement stays verifiable onchain, which is the objection every institutional desk raises and few protocols answer — plus SVRN on piloting stablecoin payments at the point of sale with Oracle. Free, and squarely the day job.",{"title":323,"url":324,"when":325,"where":326,"kind":39,"note":327},"Data by Design: Lauren Klein in conversation","https:\u002F\u002Fwww.garysguide.com\u002Fevents\u002Firewakf\u002FData-By-Design","Thu Oct 29 · 6:30pm","P&T Knitwear, 180 Orchard St, Lower East Side","Klein's new book reads the history of data visualization as a history of arguments about who gets counted, and she is joined by an Apple art director and by Shannon Mattern, who writes about infrastructure as a cultural object better than almost anyone. Forty dollars with the book, doors at 6:30 and the talk nearer seven.",{"title":329,"url":330,"when":331,"where":332,"kind":26,"note":333},"AI DevCon","https:\u002F\u002Fwww.garysguide.com\u002Fevents\u002Fkmqsiyr\u002FAI-DevCon","Mon Nov 2 · 11:00am (runs three days)","Industry City, 33 35th St, Building 5, Sunset Park, Brooklyn","Three days on agentic coding past the single-developer stage — teams, codebases, platforms — with Nick Carmont from Anthropic's applied AI group, Geoffrey Huntley of Ralph Loop, and Steve Yegge. The framing for 2026 is agents that are governed and standardized rather than clever, which is the right year to be having that conversation. Thirty percent off with the code on the listing, and the Nov 3 virtual track is free.",{"title":335,"url":336,"source":337,"summary":338},"We should be more ambitious with the software we build","https:\u002F\u002Fdanluu.com\u002Fambitious\u002F","Dan Luu","Three times this month the paper has carried someone mourning programming — Cendyne laid off because a model cost less, Jeremy Scheff calling the craft addictive and meaningless, Chris Kiehl defending the right to enjoy it anyway — and this is the first piece to answer the question those essays leave open: if the puzzle is cheap now, what is it cheap for. Luu's answer is that almost everyone is still pricing work with a pre-agentic cost model, and the evidence is a list of things he built in a low single-digit number of hours despite knowing nothing about any of the fields involved: a regex engine tunable to beat general-purpose libraries on a chosen workload, a ripgrep fork using its native code compiler, a Rust interpreter to shortcut cold builds, a board-game AI that was superhuman after five hours and the strongest in the world after twenty. The load-bearing example is somebody else's — Michael Malis's pgrust, a Postgres rewrite that news aggregators reflexively dismiss as vibeslop, except its test suite has been strong enough to surface real bugs in Postgres itself, which means the attempt has already paid for itself whether or not the project ever ships. Luu's closing observation is the one worth carrying into Monday, and it cuts against the triumphalism as hard as against the despair: with each more capable model he finds himself further from 'it just works,' not closer, because the gap between what a model can implement and what it can verify without handholding keeps widening. The ceiling moved; the part you still have to do yourself got harder to delegate, not easier.",{"title":43,"url":44,"source":45,"from":18,"summary":340},"The private keys for eight eMudhra intermediate certificate authorities — six TLS issuers across DV, OV and EV, two code-signing CAs, all cross-signed by Sectigo's AAA root in May 2025 — were not stolen. They were 47 bytes of zeros followed by one byte. The values turn out to be 4, 56, 115, 66, 155, 156, 230 and 237, so going from a public certificate to its private key takes at most 255 point multiplications, and Helme did all sixteen certificates on a laptop in under a second. eMudhra's own account on Mozilla's bug tracker blames a key-ceremony script that quietly minted a second weak keypair on the HSM, after which similar key names caused the wrong one to get signed. The blast radius is the part that matters, and it is the reason this story ran all week: browsers patched it in an evening with CRLSets and OneCRL, but curl, Python, Node, Go, Java and git read a static on-disk bundle, skip revocation by default and ignore Certificate Transparency entirely. Helme forged a certificate for api.stripe.com and curl, Python and Node all accepted it. Every `curl | sh` installer, CI runner, container base image and server-to-server API call was in scope, and because the keys were effectively public from the moment of issuance there is no theft window to reason about — seventeen months in which anyone could have done this, and no way to know whether anyone did. By Thursday eMudhra had announced it was leaving the public TLS business altogether, with the board noting that the certificate line was about 1% of revenue and that the scrutiny was \"out of proportion\" to that, which is one way to describe the browser trust programs noticing you. The postscript Helme buried at the bottom is the one that stays: an AI agent recovered the keys from a single prompt.",[342,345],{"symbol":49,"value":343,"change":344},"$80,248","-0.4%",{"symbol":53,"value":346,"change":347},"$2,326","-1.7%",{},"October 25, 2001 — Windows XP goes on sale, the first consumer Windows built on the NT kernel instead of the DOS-descended 9x line, which is to say the first one that did not inherit a 1981 operating system underneath the paint. Microsoft planned for roughly five years of life; support finally ended in April 2014, by which point XP was still running cash machines, hospital equipment and a large share of the world's point-of-sale terminals. Nobody gets to decide when their software stops being load-bearing.",{"text":351,"attribution":352},"We should be more ambitious with the software we build.","Michael Malis, said in passing to Dan Luu, repeatedly, for most of a year",[354,374,386,398,409,416,427],{"name":69,"items":355},[356,360,364,369],{"title":357,"url":358,"source":100,"from":284,"summary":359},"Cutting our inference bill by 68% by being obsessive about optimization","https:\u002F\u002Fblog.cloudflare.com\u002Fobsessive-inference-optimization\u002F","The most useful thing published this week for anyone running agents in production, and the only one with a full ledger attached: Cloudflare's AI code reviewer drifted from $1.19 a review in April to $2.46 by late August with no architectural change, and this is the accounting of getting it to $0.77 while cutting median review time from 4m 09s to 1m 32s. Seventy-seven percent of the spend was cache writes and reads — context the model had already seen — because each of 16.6 LLM calls per review resent the whole conversation. The fixes are specific and unglamorous: give the shared 11–21k tokens of system prompt their own cache breakpoint so every repository reuses it, inline reference files instead of spending three turns reading them, delete tools sub-reviewers are not allowed to call (they tried anyway in up to 76% of sessions, then burned another call recovering), and notice that GitLab never tells a cancelled job to stop, so 358 of 446 cancelled reviews ran to completion. Only 40% of the saving came from code; the rest came from model and effort choices they A\u002FB'd rather than assumed, including finding Opus 5.5 at medium indistinguishable from high on findings.",{"title":361,"url":362,"source":79,"from":291,"summary":363},"LLMs are making formal software verification feasible at a much larger scale","https:\u002F\u002Fwww.anthropic.com\u002Fresearch\u002Fformal-verification","Formal verification has always been the technique everyone admires and nobody uses — seL4 took two person-years to build and twenty to prove — and the move here routes around the expensive part. Instead of writing a specification by hand, Anthropic and Theorem convert a project's existing fuzz tests into one, encoding \"this suite always passes\" over a full model of a RISC-V binary running on Linux, then let Claude grind out the proof. It held for 123 open-source libraries: no memory-safety error, no failed assertion, normal exit, for every input under 64MB and every modeled OS response — and it surfaced bugs that trillions of fuzz runs had never reached, which is the difference between testing and proving stated as a number. The proofs and the RISC-V semantics are published, Theorem will run the pipeline on your repository, and there is a skill for doing it yourself, so this is the rare research post with a next step attached.",{"title":365,"url":366,"source":367,"from":281,"summary":368},"Anthropic's Scion is heavily inspired by Mononoke","https:\u002F\u002Fsunshowers.io\u002Fposts\u002Fanthropic-mononoke\u002F","sunshowers","The engineer who helped build Meta's Mononoke source control server read Anthropic's account of Scion — the version control system it built because git could not survive thirty thousand merges a day — and put two images side by side: Anthropic's description of using derived data to make blames cheap, and their own 2022 materials describing how Mononoke uses derived data to make blames cheap. The post credits Sapling for \"hard-won lessons\" and never names Mononoke. What makes this more than a credit dispute is the mechanism the author identifies: Mononoke is in every model's training set, so an LLM asked to design a scalable source control server will reconstruct it, and both Opus 5.5 and GPT-6 Astra name the resemblance immediately if you simply ask about prior art. Attribution has never been cheaper to produce, which is exactly why leaving it out now reads as a choice rather than an oversight.",{"title":370,"url":371,"source":372,"from":294,"summary":373},"Kimi K3.1 Pro and K3.1 Pro Highspeed","https:\u002F\u002Fwww.kimi.ai\u002Fblog\u002Fkimi-k3-1-pro","Moonshot AI","Moonshot claims 65.7% on Terminal-Bench 4.0 against Opus 5.5's 66.4% for a 3T-class model with a million tokens of context, and says the full weights ship by November 4 — which would put something within a point of the frontier on agentic terminal work onto hardware you can rent. Read it for the engineering rather than the scoreboard: the claimed gains come from reinforcement-learning infrastructure, sandboxing, rollout scheduling and environment quality checks applied across hundreds of domains, not a new architecture. The most concrete disclosure is a deliberate capability cut — stripping cyber data from mid-training and RL dropped their internal xdev-bench-hard pass@3 from 90.5% to 81.0%. All self-reported, and all checkable in ten days.",{"name":82,"items":375},[376,381],{"title":377,"url":378,"source":379,"from":288,"summary":380},"Today's PHP security release, and how we're strengthening PHP security","https:\u002F\u002Fthephp.foundation\u002Fblog\u002F2026\u002F10\u002F21\u002Ftodays-php-security-release-and-how-were-strengthening-php-security\u002F","The PHP Foundation","Two pre-auth remote code execution bugs in the parts of PHP every single request touches — memory management and error handling — where the first signs appeared in a 2024 audit and the fix then stalled for months because a consensus-run security team could not choose between patches that each broke compatibility, performance, or third-party extensions. The Foundation's own sentence is the one to steal for your next postmortem: \"the delay was a structural failure,\" caused by the decision process and the shortage of people rather than by the difficulty of the bug. The remedy was majority voting and actually hiring, which is a more honest conclusion than most organizations reach about themselves in public.",{"title":382,"url":383,"source":384,"from":281,"summary":385},"Someone behind the software","https:\u002F\u002Fkarrisaarinen.com\u002Fposts\u002Fsomeone-behind-the-software\u002F","Karri Saarinen","Linear's co-founder on why two teams with the same customers and the same tools ship very different products, and why so much software has started to feel messy: change is additive, because adding a capability is far easier than rethinking one, so products drift into being collections of abilities with no unified point of view. His worry about agentic work is organizational rather than technical — when every engineer runs a small private software factory, each change can be locally sensible while the whole thing still ends up assembled rather than shaped. Read it next to the feature above as the other half of an argument: ambition without a point of view is just more surface area.",{"name":90,"items":387},[388,393,395],{"title":389,"url":390,"source":391,"summary":392},"Node2Shell evolves to HTTP2Shell: the Brotli flaw's blast radius","https:\u002F\u002Fwww.aikido.dev\u002Fblog\u002Fpython-packages-vulnerable-node2shell-brotli-cve-2026-111497","Aikido","The thing to do before Monday. CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, versions 1.0.3 through 1.2.0, scored 9.2 critical, and it works in both directions — a malicious client can take over an unpatched server, a malicious server can take over any client that accepts a compressed response. It arrived as a Node.js advisory on Wednesday, spread to Python on Thursday, and by Friday covered anything that decompresses Brotli over HTTP: curl, Bun, Envoy, Istio, and Python's `requests`, `httpx` and `aiohttp`, which load the Brotli packages automatically whenever they are present. Two details make this worse than the average CVE. OpenAI found the bug in February and the root cause was fixed in Brotli's source at the time without anyone recognizing it as a security issue, so no release shipped the fix until now and every project that bundles its own copy has to ship its own update. And as of Friday the advisory databases still do not map the CVE to either PyPI package, which means pip-audit, Dependabot and Safety will tell you that you are fine. Patch versions are listed per project; if something you depend on has none, turn Brotli decoding off.",{"title":98,"url":99,"source":100,"from":18,"summary":394},"Cloudflare, VoidZero and Max Schwenk are porting the TypeScript compiler to Rust inside the Oxc toolchain — a faithful port rather than a fork, co-developed with the TypeScript team and explicitly deferring language direction to them, with some optimizations already landed upstream in the 7.1 beta. The claim is up to 8x faster than TypeScript 7.0 at roughly 70% less memory with matched worker counts, benchmarked alongside the TS team because the usual trick in this genre is a bigger machine and non-default flags. The number is not the point. Go compiles its garbage collector into Wasm and Rust does not, so a Rust typechecker is the one that runs cleanly inside a Worker — which is Cloudflare saying out loud that it intends to put whole build toolchains and sandboxed agent dev environments on the edge and in the browser.",{"title":396,"url":94,"source":95,"from":18,"summary":397},"The future of CSS: my top 10 picks for Interop 2027","Interop is the one browser-vendor process with a track record you can check — subgrid sat at 12% of tests passing in Chrome until it joined Interop 2023 and hit 100% inside the year — and the 2027 list is being chosen now, partly by developer vote. Comeau's ten read as a preview of what you will be writing in eighteen months: `@function` for custom CSS functions, `corner-shape` and `border-shape` that change the border box so borders and shadows actually follow the curve, gap decorations for grid rules without empty divs, `reading-flow` so focus order follows the visual layout, scroll-state container queries for a sticky header that knows it is stuck. The aside is the part that will change your workflow: your agent will reach for none of this, because its training data predates all of it, so modern CSS is now something you have to push into the prompt yourself.",{"name":107,"items":399},[400,404],{"title":401,"url":402,"source":112,"from":294,"summary":403},"Upper West Side election guide: early voting, who is on the ballot, find your polling site","https:\u002F\u002Fwww.westsiderag.com\u002F2026\u002F10\u002F22\u002Fupper-west-side-election-guide-early-voting-who-is-on-the-ballot-find-your-polling-site","Early voting is open now and runs through November 1, with late 8pm closings on the 27th and 28th and nothing at all on the 2nd. The detail worth internalizing is that your early voting site is almost never your Election Day site, so the lookup is not optional. The Rag has the races down to the NY-12 and NY-13 split that cuts through the neighborhood, plus the reminder to turn the ballot over: there are five citywide proposals back there, mostly about how easily the city can reconfigure its own streets, and they otherwise get decided by whoever happened to flip the page.",{"title":405,"url":406,"source":407,"from":294,"summary":408},"Stolovaya serves up Soviet-era nostalgia with superb Russian favorites","https:\u002F\u002Fhellgatenyc.com\u002Fstolovaya-sheepshead-bay\u002F","Hell Gate","Hell Gate's $20 Dinner goes to 813 Avenue U, where a room decorated in hammers, sickles and portraits of Marx has been feeding Sheepshead Bay since 2000, one wall built to look like a train carriage and a television on in every corner. The order is veal-and-pork pelmeni, the liver \"le cream,\" and an $18.95 chicken Kiev. An hour on the Q each way for dumplings is the correct shape for a Saturday, and the column is the best argument going that the city's good rooms are mostly the ones nobody is posting about.",{"name":115,"items":410},[411],{"title":412,"url":413,"source":414,"from":288,"summary":415},"Why Wikipedia is a wonder of the modern world — that we'll never see the likes of again","https:\u002F\u002Flithub.com\u002Fwhy-wikipedia-is-a-wonder-of-the-modern-world-that-well-never-see-the-likes-of-again\u002F","Literary Hub","Richard Cooke opens with English Wikipedia etched in nano-font onto a nickel disk and flung across the Sea of Tranquility when the Beresheet lander crashed in 2019, and argues that the botched monument suits the thing better than a working one would have. The sharper observation is about us: a reference work consulted trillions of times provokes almost no curiosity about how it actually functions, which is a strange way to treat the last twenty-five-year-old institution on the internet that still works — and a strange thing to be feeding wholesale into models while assuming it will keep being there.",{"name":131,"items":417},[418,423],{"title":419,"url":420,"source":421,"summary":422},"Glitch in Chelsea's coding costs Alonso while resurgent Spurs are all systems go","https:\u002F\u002Fwww.theguardian.com\u002Ffootball\u002F2026\u002Foct\u002F24\u002Fchelsea-tottenham-premier-league-austin-macphee-mike-penders-roberto-de-zerbi","The Guardian","Spurs had taken two points at Stamford Bridge since April 2018 and lost six straight in the fixture; they won 2-0 on Saturday, and Barney Ronay's account of how is the funniest thing written about football this week. Chelsea's set-piece coach Austin MacPhee — a man who has a release clause, which Chelsea activated — was waving players *out* of their own box at defensive corners to set up some counterattacking chess game, and on 76 minutes the second such corner came howling through the vacated space and Mike Penders, the 21-year-old starting only because Emiliano Martínez fractured his jaw, punched it into his own net. Cole Palmer was sent off shortly after for a second yellow, Mathys Tel added a lovely one on 87, and Roberto De Zerbi invaded the pitch. The structural reading underneath the comedy is the one to keep: with João Pedro out, Alonso fielded Palmer and Rogers as ghost tens with no focal point, Chelsea held 27% possession at home forty minutes in, and the clean sheet at Everton a week earlier now looks less like a corner turned than a quiet afternoon.",{"title":424,"url":425,"source":141,"from":294,"summary":426},"Celtics 107, Knicks 103: 'I took the over at 58. Still alive.'","https:\u002F\u002Fwww.postingandtoasting.com\u002Fknicks-scores-results\u002F90454\u002Fceltics-107-knicks-103-i-took-the-over-at-58-still-alive","The banner went up on Monday, the rings were handed out, and the champions are 0-2. This one had the shape of a playoff game until Tatum went for 36 and simply took it. The encouraging part is Miles McBride going 6-of-8 from three off the bench for 20; the alarming part is Mikal Bridges missing all eight attempts and not reaching the free-throw line once this season. Two games is two games, but it is a strange week to be watching Mitchell Robinson do honest work in Celtic green.",{"name":123,"items":428},[429,434,436],{"title":430,"url":431,"source":432,"summary":433},"Social dynamics of toxic metal industry in medieval Europe: Peak District lead production, AD 600–1500","https:\u002F\u002Fwww.cambridge.org\u002Fcore\u002Fjournals\u002Fantiquity\u002Farticle\u002Fsocial-dynamics-of-toxic-metal-industry-in-medieval-europe-peak-district-lead-production-ad-6001500\u002F34A2A16AC99B1B12E3EB99CEA1DDB829","Antiquity","Lead settles permanently into tooth enamel while the enamel is forming, between roughly four and twelve years old, which means a medieval molar is a sealed record of what a particular child breathed. A Nottingham team sampled seventeen individuals from three Derbyshire cemeteries, radiocarbon-dated them, and used that to date post-Roman lead smelting in the Peak District to the mid-seventh century, with heavy contamination around Castleton by the mid-eighth — centuries of industrial history recovered from teeth because the documents do not exist. Then the numbers start telling a second story, which is about who did the work. Two Iron Age individuals from the same hills came in at 0.66 and 4.29 parts per million; the medieval cemeteries average 25 to 34, with individuals as high as 69. The man buried with a sword had 2 ppm, a level found in regions with no lead industry at all, so he profited from the mines without ever going near the smelting. The women did not: all three sampled died between seventeen and twenty-five, both from Wigber Low were buried beside young children, and pregnancy remobilises lead stored in bone, which puts mother and fetus back in the path of a poison absorbed decades earlier. The paper is careful and the sample is seventeen people. It is also an argument that a chemical assay can recover a division of labour that the written record was built to obscure.",{"title":126,"url":127,"source":128,"from":18,"summary":435},"Fuller opens the camera on a new iPhone, hears the shutter, and notices what has quietly happened: the animated aperture that used to open and close on screen is gone, replaced by a blink, but the sound of a mechanism nobody under thirty has ever operated is still there. Then the better irony arrives — the phone now has a real physical shutter, and it is silent, so the device fakes the noise its own hardware declines to make. Going through the sound settings he finds a dial pad imitating a landline and a keyboard that sounds like no keyboard ever built, and lands on Brian Eno's Windows 95 chime as the formative music of his childhood. He declines to resolve it, which is the honest ending: what should a photograph sound like, once nothing about taking one makes a noise?",{"title":437,"url":438,"source":421,"from":294,"summary":439},"Chris Wickham obituary","https:\u002F\u002Fwww.theguardian.com\u002Fbooks\u002F2026\u002Foct\u002F23\u002Fchris-wickham-obituary","Wickham, dead at 76, spent a career arguing that the thousand years after Rome fell are unintelligible if you read them through bishops and kings, and rebuilt them instead from the 85 to 95% of people nobody wrote down — Framing the Early Middle Ages did it from Denmark to Egypt and was called the most significant book of its kind in a century. The method is the pleasure: a 1998 essay demonstrating that gossip in a twelfth-century Tuscan village was political infrastructure, a way peasants manufactured an agreed truth and then used it against their lords, and a last paper reading the Kerala pepper trade to argue that regional economies rather than luxury shipping drove medieval growth. He joined the Communist party rather than the Socialist Workers because it only wanted one night a week.",{"title":301,"description":309},"paper\u002F2026-10-25","46° & smoky haze on the UWS","OPj8cftlFPWPhI8kWwIcB98YwJCsfFCKLNC25n_S39M",1792923525406]