Calls, puts & mise en place

Appel & Mise

Vol. ISaturday, October 31, 2026 · 49° & clear on the UWSThe daily, for Jeremy Ettlinger

BTC$77,359-0.1%ETH$2,243+0.9%

The lede

Official Claude Code extension compromise: security advisory

Calum Hall, Phorion · made the Sunday

Versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension, as distributed through the Cursor Marketplace, shipped with a persistent SSH backdoor prepended to the minified bundle as an IIFE — meaning it executed the moment Node loaded the file, before the extension's own activate callback and without any user interaction. Cursor has pulled both versions, and the macOS inbound path happens to be broken by an implementation bug (the malware only enables Remote Login if `systemsetup -getremotelogin` prints `Off`, which it does not do without root), but the keys, the persistence and the host reconnaissance beacon all still land. Worth ten minutes this morning rather than Monday: check which marketplace his editors pull extensions from, and what version is sitting in them.

AI & Agents

Simon Willison

A working Nintendo baked into Qwen's weights

Drew Breunig trained an NES 6502 CPU emulator into Qwen3.5-4B, so Super Mario Bros now runs — very slowly — as a forward pass rather than as code, following Divyansh Agrawal's qwenputer. The genuinely instructive part is the build log he posted: two short Opus 5.5 prompts, and the model went and found a set of NES CPU conformance tests released fifteen years ago to check itself against, which is the pattern worth copying whatever you are emulating.

Google Research

The sleep framework: retaining knowledge in continual learning

Behrouz and Mirrokni split the model's life into a wake phase, where new information lands in fast short-term memory, and an offline sleep phase that consolidates it into parameters — an attempt to get past both the fixed knowledge cutoff and the catastrophic forgetting that straight fine-tuning causes. They report retention across contexts up to 10M tokens, which is the number to be sceptical about, but the framing is the useful part for anyone whose agents currently forget everything the moment a session ends.

Engineering & Leadership

Will Larson, Irrational Exuberance · made the Sunday

Self-reinforcing quality: adopting the verification pattern

Imprint now requires every pull request to carry a `verifications/{pr}.md` file describing what the harness did to check its own work and, crucially, what it could not check — and a PR cannot leave draft without one. Larson is honest that the name misleads people into thinking it is about tests; the mechanism is closer to chain-of-thought, and the second-order payoff is that the 'could not verify' column becomes a renewing, evidence-backed roadmap for what to fix in the harness next.

Gergely Orosz, The Pragmatic Engineer · made the Sunday

The Pulse: Anthropic kills the coding interview

A hiring manager who has led Claude Cowork and Claude Desktop has dropped DSA questions from the loop entirely, on the grounds that they now produce zero signal — a claim that carries more weight coming from inside the company whose tools caused the problem. The rest of the roundup is the useful ballast: incident.io cut AI spend from $4,500 per developer per month in August to $1,600 now, and Amazon has written AI usage into formal SDE and SDM expectations after finding it correlates with productivity.

Web & Product Craft

Bellone

Double buffering with Cloudflare Queues

A small, complete pattern for turning a telemetry firehose into hourly Parquet-ish archives on his exact stack: two queues, modulo math on the payload timestamp to pick the active one, a consumer that fires on the half-hour and drains the other, then compress to R2 with a partition key. UTC throughout specifically to dodge DST, which is the detail that tells you someone has run this in production.

New York & the Table

Scott Lynch, Hell Gate · made the Sunday

Made-to-order musubi at a nifty UWS Hawaiian spot

Chi Ian Chan missed Honolulu musubi badly enough to make his own, sold it through a neighborhood Facebook group, graduated to Sunday pop-ups at an UWS sushi restaurant, and then spent sixteen months on permits and construction to open a narrow storefront on West 72nd. Spam with egg is $7, the shrimp is $7.25, and there are shiso and vegan versions — a walk, not a trip.

Eater NY

Mezzaluna serves its last meal this weekend

After 42 years, a neighborhood petition and weeks of lines down the block, the Upper East Side trattoria closes on Sunday rather than sign another ten-year lease — it was among the first places in the city to import oil and pasta from founder Aldo Bozzi's part of Italy, and the wood-fired pizza came out of a kitchen the size of a closet. If he wants it, it is a cross-park errand with a hard deadline of tomorrow.

Diversions

Brittany Allen, Literary Hub

Why is serial fiction having a moment?

Allen traces the installment novel from Dickens hooking England on The Pickwick Papers over two years and nineteen parts, through Twain and Joyce and Maupin, to Lauren Oyler publishing a six-part story in Emily Gould's newsletter this autumn. The distribution argument underneath is the interesting one for anyone who has ever shipped something weekly: serialization comes back whenever a medium needs to give readers a reason to return on a schedule.

Loose Change

The Guardian · made the Sunday

Dónal Lunny obituary

Lunny, dead at 79, is the reason Irish traditional music has a bouzouki in it: handed a round-backed Greek one by Andy Irvine in 1970, he had it rebuilt flat-backed with a shorter neck, and the instrument stuck. Across Planxty, the Bothy Band and Moving Hearts his real job was arranger — the Guardian's line is that he was instinctively drawn to new harmonic and rhythmic structures — and he went on to produce for Kate Bush, Sinéad O'Connor and Elvis Costello, and to win an Emmy as musical director of Bringing It All Back Home.

The Guardian

Elfi Evans obituary

Written by his son: a Carmarthenshire vet, dead at 90, equally at ease with a cat and a caesarean on a horse, who later specialised in the diseases of sheep and ran a smallholding with biodiversity projects on the side. He learned his first English from Italian and German prisoners of war working the family farm, wanted to study engineering, was talked into veterinary school instead, and rode a Lambretta the eight hours between Carmarthen and Liverpool each term.

The Back Page

David Pasztor, We Ain't Got No History

Chelsea vs. Manchester United: preview, team news, how to watch

Pasztor files it under 'Saturday Struggle-off', which is about right after the week Chelsea have had — but United arrive winless in eight across all competitions, with two wins all season, those coming against newly promoted Ipswich and the champions of Azerbaijan. Carrick signed a two-year deal in the summer and is already barely hanging on; noon kickoff at the Bridge.

Brady Klopfer, Golden State of Mind

Warriors exact revenge with a shocking comeback over the Lakers

Down 25 in the second quarter, having turned the ball over on roughly every possession while Dončić did as he pleased, Golden State won 112-95 — a 42-point swing and a third straight win to open NBA Cup group play. It also settles the opening-night loss to the same team nine days ago, and Klopfer is right that the first quarter made the eventual margin look impossible.

Around town

Sun Nov 1 · 10:00am

Jersey City — Claude Code Workshop

Venue to be announced, Jersey City

A free hands-on morning on the tool he already lives in, which is the cheapest way to find out which of his habits are actually idioms and which are just his. One PATH train stop and a Sunday morning; check the listing for a venue before leaving.

professional

Fri Nov 6 · 3:00pm

Voice Agent Hackathon

Venue to be announced, Manhattan

Run with Take2AI and Reach Capital, and voice is the modality where agent latency and interruption handling stop being abstract — you hear every hesitation the architecture causes. Free, and a hackathon is a faster read on where the tooling actually breaks than any conference panel.

professional

Thu Nov 12 · 6:00pm

AI For Regulated Industries, with Encord

il Buco wine cellar, 47 Bond St, NoHo

The compliance-shaped constraints on shipping models are the ones his day job runs into, and this is the room where people say out loud what their legal review actually blocked. Free, in a wine cellar, which tends to produce franker conversation than a conference room does.

professional

Sun Nov 1 · 11:00am

Hugo, in 3D

Metrograph, 7 Ludlow St, Lower East Side

Scorsese's one 3D film is a two-hour argument that cinema began as a machine shop, built around a boy repairing an automaton and the real Georges Méliès selling toys in a train station after the industry forgot him. Shown in 3D DCP as intended, which is now a rarity, and it is a Sunday-morning film in the best sense.

casual

Wed Nov 4 · 7:35pm

Strangers on a Train, on 35mm

Metrograph, 7 Ludlow St, Lower East Side

Hitchcock's cleanest demonstration that a plot is just a contract two people read differently — one man thinks he is making conversation, the other thinks a deal has been struck. A print, not a file, and at 101 minutes it is out before the evening is gone.

casual

Quote of the day

“I've seen too many pull requests go to CICD that had failed basic lints.”

— Will Larson, on why the harness now has to show its work

On this day

October 31, 2008 — Satoshi Nakamoto posted a nine-page PDF titled 'Bitcoin: A Peer-to-Peer Electronic Cash System' to the metzdowd cryptography mailing list, where the early replies were mostly polite scepticism about whether the thing would scale. Eighty-two years before that, on Halloween 1926, Harry Houdini died of peritonitis in Detroit after performing through a ruptured appendix; he had spent his New York years at 278 West 113th Street in Harlem, a century ago today.

The puzzle corner

The Mini · Wordle · Connections

Two items today are the same instinct pointed in opposite directions: Larson making his harness write down what it could not verify, and a backdoor that ran before any extension's activate callback because nobody was checking what loaded first.