[{"data":1,"prerenderedAt":480},["ShallowReactive",2],{"paper-\u002Fpaper\u002F2026-10-31":3,"paper-dates":159,"paper-sunday-2026-10-31":332},{"id":4,"title":5,"body":6,"crossword":17,"date":18,"description":19,"events":20,"extension":52,"feature":17,"lede":53,"markets":58,"meta":67,"navigation":68,"onThisDay":69,"path":70,"quote":71,"sections":74,"seo":155,"stem":156,"weather":157,"__hash__":158},"paper\u002Fpaper\u002F2026-10-31.md","Appel & Mise — October 31, 2026",{"type":7,"value":8,"toc":13},"minimark",[9],[10,11,12],"p",{},"Two items today are the same instinct pointed in opposite directions: Larson making his harness write down what it could not verify, and a backdoor that ran before any extension's activate callback because nobody was checking what loaded first.",{"title":14,"searchDepth":15,"depth":15,"links":16},"",2,[],null,"2026-10-31","A persistent SSH backdoor shipped inside the official Claude Code extension on the Cursor Marketplace, Will Larson making his harness file a verification report before a PR can leave draft, Anthropic deleting the coding interview outright, and a 42-year-old Upper East Side trattoria serving its last pizza tomorrow.",[21,28,34,40,47],{"title":22,"url":23,"when":24,"where":25,"kind":26,"note":27},"Jersey City — Claude Code Workshop","https:\u002F\u002Fwww.garysguide.com\u002Fevents\u002F2zcrjzm\u002FJersey-City-Claude-Code-Workshop","Sun Nov 1 · 10:00am","Venue to be announced, Jersey City","professional","A free hands-on morning on the tool he already lives in, which is the cheapest way to find out which of his habits are actually idioms and which are just his. One PATH train stop and a Sunday morning; check the listing for a venue before leaving.",{"title":29,"url":30,"when":31,"where":32,"kind":26,"note":33},"Voice Agent Hackathon","https:\u002F\u002Fwww.garysguide.com\u002Fevents\u002F3o86gi1\u002FVoice-Agent-Hackathon","Fri Nov 6 · 3:00pm","Venue to be announced, Manhattan","Run with Take2AI and Reach Capital, and voice is the modality where agent latency and interruption handling stop being abstract — you hear every hesitation the architecture causes. Free, and a hackathon is a faster read on where the tooling actually breaks than any conference panel.",{"title":35,"url":36,"when":37,"where":38,"kind":26,"note":39},"AI For Regulated Industries, with Encord","https:\u002F\u002Fwww.garysguide.com\u002Fevents\u002F0vodzkp\u002FAI-For-Regulated-Industries-Encord","Thu Nov 12 · 6:00pm","il Buco wine cellar, 47 Bond St, NoHo","The compliance-shaped constraints on shipping models are the ones his day job runs into, and this is the room where people say out loud what their legal review actually blocked. Free, in a wine cellar, which tends to produce franker conversation than a conference room does.",{"title":41,"url":42,"when":43,"where":44,"kind":45,"note":46},"Hugo, in 3D","https:\u002F\u002Fmetrograph.com\u002Ffilm\u002F9999003820-hugo-3d-screening\u002F","Sun Nov 1 · 11:00am","Metrograph, 7 Ludlow St, Lower East Side","casual","Scorsese's one 3D film is a two-hour argument that cinema began as a machine shop, built around a boy repairing an automaton and the real Georges Méliès selling toys in a train station after the industry forgot him. Shown in 3D DCP as intended, which is now a rarity, and it is a Sunday-morning film in the best sense.",{"title":48,"url":49,"when":50,"where":44,"kind":45,"note":51},"Strangers on a Train, on 35mm","https:\u002F\u002Fmetrograph.com\u002Ffilm\u002F9999000668-strangers-on-a-train\u002F","Wed Nov 4 · 7:35pm","Hitchcock's cleanest demonstration that a plot is just a contract two people read differently — one man thinks he is making conversation, the other thinks a deal has been struck. A print, not a file, and at 101 minutes it is out before the evening is gone.","md",{"title":54,"url":55,"source":56,"summary":57},"Official Claude Code extension compromise: security advisory","https:\u002F\u002Fphorion.io\u002Fblog\u002Foffical-claude-code-vsx-compromise\u002F","Calum Hall, Phorion","Versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension, as distributed through the Cursor Marketplace, shipped with a persistent SSH backdoor prepended to the minified bundle as an IIFE — meaning it executed the moment Node loaded the file, before the extension's own activate callback and without any user interaction. Cursor has pulled both versions, and the macOS inbound path happens to be broken by an implementation bug (the malware only enables Remote Login if `systemsetup -getremotelogin` prints `Off`, which it does not do without root), but the keys, the persistence and the host reconnaissance beacon all still land. Worth ten minutes this morning rather than Monday: check which marketplace his editors pull extensions from, and what version is sitting in them.",[59,63],{"symbol":60,"value":61,"change":62},"BTC","$77,359","-0.1%",{"symbol":64,"value":65,"change":66},"ETH","$2,243","+0.9%",{},true,"October 31, 2008 — Satoshi Nakamoto posted a nine-page PDF titled 'Bitcoin: A Peer-to-Peer Electronic Cash System' to the metzdowd cryptography mailing list, where the early replies were mostly polite scepticism about whether the thing would scale. Eighty-two years before that, on Halloween 1926, Harry Houdini died of peritonitis in Detroit after performing through a ruptured appendix; he had spent his New York years at 278 West 113th Street in Harlem, a century ago today.","\u002Fpaper\u002F2026-10-31",{"text":72,"attribution":73},"I've seen too many pull requests go to CICD that had failed basic lints.","Will Larson, on why the harness now has to show its work",[75,88,101,109,122,130,142],{"name":76,"items":77},"AI & Agents",[78,83],{"title":79,"url":80,"source":81,"summary":82},"A working Nintendo baked into Qwen's weights","https:\u002F\u002Fsimonwillison.net\u002F2026\u002FOct\u002F30\u002Fnesformer\u002F","Simon Willison","Drew Breunig trained an NES 6502 CPU emulator into Qwen3.5-4B, so Super Mario Bros now runs — very slowly — as a forward pass rather than as code, following Divyansh Agrawal's qwenputer. The genuinely instructive part is the build log he posted: two short Opus 5.5 prompts, and the model went and found a set of NES CPU conformance tests released fifteen years ago to check itself against, which is the pattern worth copying whatever you are emulating.",{"title":84,"url":85,"source":86,"summary":87},"The sleep framework: retaining knowledge in continual learning","https:\u002F\u002Fresearch.google\u002Fblog\u002Fthe-sleep-framework-a-new-way-for-llms-to-retain-knowledge-in-continual-learning\u002F","Google Research","Behrouz and Mirrokni split the model's life into a wake phase, where new information lands in fast short-term memory, and an offline sleep phase that consolidates it into parameters — an attempt to get past both the fixed knowledge cutoff and the catastrophic forgetting that straight fine-tuning causes. They report retention across contexts up to 10M tokens, which is the number to be sceptical about, but the framing is the useful part for anyone whose agents currently forget everything the moment a session ends.",{"name":89,"items":90},"Engineering & Leadership",[91,96],{"title":92,"url":93,"source":94,"summary":95},"Self-reinforcing quality: adopting the verification pattern","https:\u002F\u002Flethain.com\u002Fadopting-verification-pattern\u002F","Will Larson, Irrational Exuberance","Imprint now requires every pull request to carry a `verifications\u002F{pr}.md` file describing what the harness did to check its own work and, crucially, what it could not check — and a PR cannot leave draft without one. Larson is honest that the name misleads people into thinking it is about tests; the mechanism is closer to chain-of-thought, and the second-order payoff is that the 'could not verify' column becomes a renewing, evidence-backed roadmap for what to fix in the harness next.",{"title":97,"url":98,"source":99,"summary":100},"The Pulse: Anthropic kills the coding interview","https:\u002F\u002Fnewsletter.pragmaticengineer.com\u002Fp\u002Fthe-pulse-anthropic-kills-the-coding","Gergely Orosz, The Pragmatic Engineer","A hiring manager who has led Claude Cowork and Claude Desktop has dropped DSA questions from the loop entirely, on the grounds that they now produce zero signal — a claim that carries more weight coming from inside the company whose tools caused the problem. The rest of the roundup is the useful ballast: incident.io cut AI spend from $4,500 per developer per month in August to $1,600 now, and Amazon has written AI usage into formal SDE and SDM expectations after finding it correlates with productivity.",{"name":102,"items":103},"Web & Product Craft",[104],{"title":105,"url":106,"source":107,"summary":108},"Double buffering with Cloudflare Queues","https:\u002F\u002Fbellone.com\u002Ftechnical\u002Fdouble-buffering-with-cloudflare-queues","Bellone","A small, complete pattern for turning a telemetry firehose into hourly Parquet-ish archives on his exact stack: two queues, modulo math on the payload timestamp to pick the active one, a consumer that fires on the half-hour and drains the other, then compress to R2 with a partition key. UTC throughout specifically to dodge DST, which is the detail that tells you someone has run this in production.",{"name":110,"items":111},"New York & the Table",[112,117],{"title":113,"url":114,"source":115,"summary":116},"Made-to-order musubi at a nifty UWS Hawaiian spot","https:\u002F\u002Fhellgatenyc.com\u002Fkine-musubi-hawaiian-uws\u002F","Scott Lynch, Hell Gate","Chi Ian Chan missed Honolulu musubi badly enough to make his own, sold it through a neighborhood Facebook group, graduated to Sunday pop-ups at an UWS sushi restaurant, and then spent sixteen months on permits and construction to open a narrow storefront on West 72nd. Spam with egg is $7, the shrimp is $7.25, and there are shiso and vegan versions — a walk, not a trip.",{"title":118,"url":119,"source":120,"summary":121},"Mezzaluna serves its last meal this weekend","https:\u002F\u002Fny.eater.com\u002Fnews\u002F414164\u002Fnyc-restaurants-closed-october-2026","Eater NY","After 42 years, a neighborhood petition and weeks of lines down the block, the Upper East Side trattoria closes on Sunday rather than sign another ten-year lease — it was among the first places in the city to import oil and pasta from founder Aldo Bozzi's part of Italy, and the wood-fired pizza came out of a kitchen the size of a closet. If he wants it, it is a cross-park errand with a hard deadline of tomorrow.",{"name":123,"items":124},"Diversions",[125],{"title":126,"url":127,"source":128,"summary":129},"Why is serial fiction having a moment?","https:\u002F\u002Flithub.com\u002Fwhy-is-serial-fiction-having-a-moment\u002F","Brittany Allen, Literary Hub","Allen traces the installment novel from Dickens hooking England on The Pickwick Papers over two years and nineteen parts, through Twain and Joyce and Maupin, to Lauren Oyler publishing a six-part story in Emily Gould's newsletter this autumn. The distribution argument underneath is the interesting one for anyone who has ever shipped something weekly: serialization comes back whenever a medium needs to give readers a reason to return on a schedule.",{"name":131,"items":132},"Loose Change",[133,138],{"title":134,"url":135,"source":136,"summary":137},"Dónal Lunny obituary","https:\u002F\u002Fwww.theguardian.com\u002Fmusic\u002F2026\u002Foct\u002F29\u002Fdonal-lunny-obituary","The Guardian","Lunny, dead at 79, is the reason Irish traditional music has a bouzouki in it: handed a round-backed Greek one by Andy Irvine in 1970, he had it rebuilt flat-backed with a shorter neck, and the instrument stuck. Across Planxty, the Bothy Band and Moving Hearts his real job was arranger — the Guardian's line is that he was instinctively drawn to new harmonic and rhythmic structures — and he went on to produce for Kate Bush, Sinéad O'Connor and Elvis Costello, and to win an Emmy as musical director of Bringing It All Back Home.",{"title":139,"url":140,"source":136,"summary":141},"Elfi Evans obituary","https:\u002F\u002Fwww.theguardian.com\u002Fscience\u002F2026\u002Foct\u002F30\u002Felfi-evans-obituary","Written by his son: a Carmarthenshire vet, dead at 90, equally at ease with a cat and a caesarean on a horse, who later specialised in the diseases of sheep and ran a smallholding with biodiversity projects on the side. He learned his first English from Italian and German prisoners of war working the family farm, wanted to study engineering, was talked into veterinary school instead, and rode a Lambretta the eight hours between Carmarthen and Liverpool each term.",{"name":143,"items":144},"The Back Page",[145,150],{"title":146,"url":147,"source":148,"summary":149},"Chelsea vs. Manchester United: preview, team news, how to watch","https:\u002F\u002Fweaintgotnohistory.sbnation.com\u002Fpremier-league\u002F173579\u002Fchelsea-vs-manchester-united-premier-league-preview-team-news-how-to-watch","David Pasztor, We Ain't Got No History","Pasztor files it under 'Saturday Struggle-off', which is about right after the week Chelsea have had — but United arrive winless in eight across all competitions, with two wins all season, those coming against newly promoted Ipswich and the champions of Azerbaijan. Carrick signed a two-year deal in the summer and is already barely hanging on; noon kickoff at the Bridge.",{"title":151,"url":152,"source":153,"summary":154},"Warriors exact revenge with a shocking comeback over the Lakers","https:\u002F\u002Fwww.goldenstateofmind.com\u002Fwarriors-scores-results\u002F113101\u002Fwarriors-lakers-recap-steph-curry-lebron-james-luka-doncic-comeback","Brady Klopfer, Golden State of Mind","Down 25 in the second quarter, having turned the ball over on roughly every possession while Dončić did as he pleased, Golden State won 112-95 — a 42-point swing and a third straight win to open NBA Cup group play. It also settles the opening-night loss to the same team nine days ago, and Klopfer is right that the first quarter made the eventual margin look impossible.",{"title":5,"description":19},"paper\u002F2026-10-31","49° & clear on the UWS","VYjysu_8LVPhSLHlbqlmgfMFgaaSu_HYiKvcNQrxzfU",[160,163,166,169,172,175,178,181,184,187,190,193,196,199,202,205,208,211,214,217,220,223,226,229,232,235,238,241,244,247,250,253,256,259,262,265,268,271,274,277,280,283,286,289,292,295,298,301,304,307,310,313,316,319,322,325,328,329],{"date":161,"path":162},"2026-08-30","\u002Fpaper\u002F2026-08-30",{"date":164,"path":165},"2026-09-06","\u002Fpaper\u002F2026-09-06",{"date":167,"path":168},"2026-09-07","\u002Fpaper\u002F2026-09-07",{"date":170,"path":171},"2026-09-08","\u002Fpaper\u002F2026-09-08",{"date":173,"path":174},"2026-09-09","\u002Fpaper\u002F2026-09-09",{"date":176,"path":177},"2026-09-10","\u002Fpaper\u002F2026-09-10",{"date":179,"path":180},"2026-09-11","\u002Fpaper\u002F2026-09-11",{"date":182,"path":183},"2026-09-12","\u002Fpaper\u002F2026-09-12",{"date":185,"path":186},"2026-09-13","\u002Fpaper\u002F2026-09-13",{"date":188,"path":189},"2026-09-14","\u002Fpaper\u002F2026-09-14",{"date":191,"path":192},"2026-09-15","\u002Fpaper\u002F2026-09-15",{"date":194,"path":195},"2026-09-16","\u002Fpaper\u002F2026-09-16",{"date":197,"path":198},"2026-09-17","\u002Fpaper\u002F2026-09-17",{"date":200,"path":201},"2026-09-18","\u002Fpaper\u002F2026-09-18",{"date":203,"path":204},"2026-09-19","\u002Fpaper\u002F2026-09-19",{"date":206,"path":207},"2026-09-20","\u002Fpaper\u002F2026-09-20",{"date":209,"path":210},"2026-09-21","\u002Fpaper\u002F2026-09-21",{"date":212,"path":213},"2026-09-22","\u002Fpaper\u002F2026-09-22",{"date":215,"path":216},"2026-09-23","\u002Fpaper\u002F2026-09-23",{"date":218,"path":219},"2026-09-24","\u002Fpaper\u002F2026-09-24",{"date":221,"path":222},"2026-09-25","\u002Fpaper\u002F2026-09-25",{"date":224,"path":225},"2026-09-26","\u002Fpaper\u002F2026-09-26",{"date":227,"path":228},"2026-09-27","\u002Fpaper\u002F2026-09-27",{"date":230,"path":231},"2026-09-28","\u002Fpaper\u002F2026-09-28",{"date":233,"path":234},"2026-09-29","\u002Fpaper\u002F2026-09-29",{"date":236,"path":237},"2026-09-30","\u002Fpaper\u002F2026-09-30",{"date":239,"path":240},"2026-10-01","\u002Fpaper\u002F2026-10-01",{"date":242,"path":243},"2026-10-02","\u002Fpaper\u002F2026-10-02",{"date":245,"path":246},"2026-10-03","\u002Fpaper\u002F2026-10-03",{"date":248,"path":249},"2026-10-04","\u002Fpaper\u002F2026-10-04",{"date":251,"path":252},"2026-10-05","\u002Fpaper\u002F2026-10-05",{"date":254,"path":255},"2026-10-06","\u002Fpaper\u002F2026-10-06",{"date":257,"path":258},"2026-10-07","\u002Fpaper\u002F2026-10-07",{"date":260,"path":261},"2026-10-08","\u002Fpaper\u002F2026-10-08",{"date":263,"path":264},"2026-10-09","\u002Fpaper\u002F2026-10-09",{"date":266,"path":267},"2026-10-10","\u002Fpaper\u002F2026-10-10",{"date":269,"path":270},"2026-10-11","\u002Fpaper\u002F2026-10-11",{"date":272,"path":273},"2026-10-12","\u002Fpaper\u002F2026-10-12",{"date":275,"path":276},"2026-10-13","\u002Fpaper\u002F2026-10-13",{"date":278,"path":279},"2026-10-14","\u002Fpaper\u002F2026-10-14",{"date":281,"path":282},"2026-10-15","\u002Fpaper\u002F2026-10-15",{"date":284,"path":285},"2026-10-16","\u002Fpaper\u002F2026-10-16",{"date":287,"path":288},"2026-10-17","\u002Fpaper\u002F2026-10-17",{"date":290,"path":291},"2026-10-18","\u002Fpaper\u002F2026-10-18",{"date":293,"path":294},"2026-10-19","\u002Fpaper\u002F2026-10-19",{"date":296,"path":297},"2026-10-20","\u002Fpaper\u002F2026-10-20",{"date":299,"path":300},"2026-10-21","\u002Fpaper\u002F2026-10-21",{"date":302,"path":303},"2026-10-22","\u002Fpaper\u002F2026-10-22",{"date":305,"path":306},"2026-10-23","\u002Fpaper\u002F2026-10-23",{"date":308,"path":309},"2026-10-24","\u002Fpaper\u002F2026-10-24",{"date":311,"path":312},"2026-10-25","\u002Fpaper\u002F2026-10-25",{"date":314,"path":315},"2026-10-26","\u002Fpaper\u002F2026-10-26",{"date":317,"path":318},"2026-10-27","\u002Fpaper\u002F2026-10-27",{"date":320,"path":321},"2026-10-28","\u002Fpaper\u002F2026-10-28",{"date":323,"path":324},"2026-10-29","\u002Fpaper\u002F2026-10-29",{"date":326,"path":327},"2026-10-30","\u002Fpaper\u002F2026-10-30",{"date":18,"path":70},{"date":330,"path":331},"2026-11-01","\u002Fpaper\u002F2026-11-01",{"id":333,"title":334,"body":335,"crossword":17,"date":330,"description":342,"events":343,"extension":52,"feature":374,"lede":379,"markets":381,"meta":387,"navigation":68,"onThisDay":388,"path":331,"quote":389,"sections":392,"seo":476,"stem":477,"weather":478,"__hash__":479},"paper\u002Fpaper\u002F2026-11-01.md","Appel & Mise — November 1, 2026",{"type":7,"value":336,"toc":340},[337],[10,338,339],{},"Four separate holes in the AI toolchain in seven days — a backdoor in the official editor extension, one customer's cache served to another, privilege escalation in a tool people use precisely because they trust it, and a share link that became an account takeover — and all four have the same shape: something ran before anyone looked at it. The week's other story is the money, and it rhymes. Prices fell because the cache made the expensive part free, the flat seat is a subsidy with a date on it, and a studio found out what thirty times payroll in tokens buys. Both halves are about the same reflex, which is what you quietly stop inspecting once the tooling is good enough to stop making you look.",{"title":14,"searchDepth":15,"depth":15,"links":341},[],"The week the AI toolchain sprang four leaks in seven days — a backdoor in the official Claude Code extension, a cross-request cache leak at Cloudflare, privilege escalation in Tailscale SSH, and a ChatGPT share link that took over your account — plus Max Woolf on why inference got 80% cheaper, a bootstrapped file converter turning twenty, and Chelsea finally winning something.",[344,350,356,362,367],{"title":345,"url":346,"when":347,"where":348,"kind":26,"note":349},"Agents We Shipped, Agents We Killed","https:\u002F\u002Fwww.garysguide.com\u002Fevents\u002Fmnn76uo\u002FAgents-We-Shipped-Agents-We-Killed","Tue Nov 3 · 6:00pm","Follia, 179 Third Ave, Gramercy","The killed ones are the useful half of the talk and almost nobody writes them up, so the only place to hear what did not survive contact with production is a room where someone says it out loud. Free, and a restaurant basement tends to get franker than a stage does.",{"title":351,"url":352,"when":353,"where":354,"kind":26,"note":355},"Inside AI-Powered VC: how investors are actually using AI","https:\u002F\u002Fwww.garysguide.com\u002Fevents\u002F953k8fs\u002FInside-AI-Powered-VC-How-Investors-Actually-Using-AI","Mon Nov 9 · 6:00pm","Columbia Business School, 645 W 130th St, Manhattanville","Investors are a useful control group: they have no incentive to oversell the tooling and every incentive to know what it actually does to diligence. Free, and it is the rare industry evening he can walk to.",{"title":357,"url":358,"when":359,"where":360,"kind":45,"note":361},"Once Upon a Time in Harlem","https:\u002F\u002Ffilmforum.org\u002Ffilm\u002Fonce-upon-a-time-in-harlem","Daily through Tue Nov 3 · 12:15pm–9:15pm","Film Forum, 209 W Houston St","In August 1972 William Greaves put a camera in Duke Ellington's St. Nicholas Avenue townhouse and filmed a Harlem Renaissance reunion — Romare Bearden, Aaron Douglas, Eubie Blake, James Van Der Zee — many of whom had not seen each other in fifty years, and the cocktail party turns into debate and unsettled scores. He never finished it; his son David, one of the cameramen that day, cut it from the restored footage, and it won this year's Lavine\u002FKen Burns Prize. A hundred minutes.",{"title":363,"url":364,"when":365,"where":360,"kind":45,"note":366},"Pickup on South Street, in the NYC in Transit series","https:\u002F\u002Ffilmforum.org\u002Ffilm\u002Fpick-up-on-south-street-nyc-in-transit","Tue Nov 3 · 8:00pm","Samuel Fuller's 1953 pulp opens with a pickpocket lifting microfilm out of a purse on the subway and ends with a showdown in a station, which is the whole reason it is in a series about the city's transit. Eighty minutes, Thelma Ritter producing a price chart when asked to inform on someone, and a Cold War plot the French dub rewrote into a drug deal because Fuller's politics horrified them.",{"title":368,"url":369,"when":370,"where":371,"kind":372,"note":373},"Paul Taylor Dance Company, New York season","https:\u002F\u002Fpaultaylordance.org\u002Fperformances\u002F","Tue Nov 3 – Sun Nov 22","David H. Koch Theater, Lincoln Center","say yes","Taylor built dances on walking, running and standing still — ordinary human motion arranged until it reads as music — and the company has kept the repertory alive for sixty-five years while adding new work each season. Three weeks of it at the Koch, which is the closest great theater to the neighborhood, and modern dance is one of the few art forms where knowing nothing going in costs you nothing.",{"title":375,"url":376,"source":377,"from":314,"summary":378},"OpenAI and Anthropic cut their LLM prices by up to 80% within a few months. Why?","https:\u002F\u002Fminimaxir.com\u002F2026\u002F10\u002Fcheap-llms\u002F","Max Woolf, minimaxir","The obvious explanations for a four-month collapse in inference prices are a price war and a land grab, and Woolf's argument is that both are mostly wrong — the money is in cache reads. Once a provider can serve a repeated prefix from a warm KV cache instead of recomputing it, the marginal cost of the dominant workload falls off a cliff, and agentic tools are the purest possible version of that workload: the same enormous system prompt, over and over, thousands of times a day. That reframes the published per-token number as a bet on your access pattern rather than a discount, which is the useful lens for anyone budgeting a product on top of these APIs. Read alongside LeadDev's piece below, it also explains why the cheap seat and the cheap token are two different questions with two different answers.",{"title":54,"url":55,"source":56,"from":18,"summary":380},"Two versions of the official Claude Code for VS Code extension — 2.1.312 and 2.1.313, as served by the Cursor Marketplace — shipped with an SSH backdoor prepended to the minified bundle as an immediately-invoked function, so it ran the moment Node loaded the file: before the extension's own activate callback, before any user interaction, before anything that might have looked at it. Cursor has pulled both, and the macOS inbound path happens to be broken by a bug in the malware itself, but the key planting, the persistence and the host reconnaissance beacon all land regardless. The ten-minute version for anyone who got to this late: check which marketplace each of your editors pulls extensions from, and what version is sitting in it right now.",[382,384],{"symbol":60,"value":383,"change":66},"$78,029",{"symbol":64,"value":385,"change":386},"$2,269","+1.2%",{},"November 1, 1512 — the scaffolding comes down in the Sistine Chapel and Michelangelo's ceiling is shown to the public for the first time, four years after he took a commission he had tried to refuse on the grounds that he was a sculptor. Two hundred and forty-three years later to the day, the Lisbon earthquake arrives on All Saints' morning with the churches full, and the aftershock runs through European philosophy for a generation — Voltaire included. The same date got the ceiling revealed and the floor taken away.",{"text":390,"attribution":391},"It's not the em-dashes, it's the load-bearing tapestries.","Martin Fowler, on how you can tell",[393,409,420,432,441,452,466],{"name":76,"items":394},[395,399,404],{"title":396,"url":397,"source":81,"from":326,"summary":398},"Building a multiplayer game world with autonomous Fable-class models","https:\u002F\u002Fsimonwillison.net\u002F2026\u002FOct\u002F29\u002Fhow-i-built-the-most-ai-pilled-company-in-the-world\u002F","A game studio running a live world almost entirely on autonomous models, spending something like thirty times its payroll on tokens and treating an hour without a ship as a SEV-0 — which is either the most instructive operational experiment of the year or an expensive way to find the ceiling, and the honest answer is that nobody knows yet. Worth reading for the organizational details rather than the models: what you have to change about on-call, review and release cadence before a setup like that stops being a stunt.",{"title":400,"url":401,"source":402,"from":326,"summary":403},"We ran AI agent swarms in Minecraft and Mindustry","https:\u002F\u002Flabs.ycombinator.com\u002Fprojects\u002Fgames\u002Findex.html","Y Combinator Labs","Fifty agents dropped into a Minecraft survival world stripped the trees near spawn in about ninety seconds and then, unprompted, invented a government — a ration ledger, written rules, permits, appointed officials — because the commons problem arrived before anything else did. The reason to care is not the novelty but the shape: coordination overhead is what emerges first when you scale agents, and it emerged here as bureaucracy, which is probably what it will look like in your system too.",{"title":405,"url":406,"source":407,"summary":408},"Do the math: how we took over ChatGPT accounts","https:\u002F\u002Fwww.parameter.ai\u002Flabs\u002Fwe-found-a-gap-at-openai","Mukul Goyal, Parameter Labs","A public ChatGPT share link was enough to run attacker JavaScript inside the victim's signed-in session, read private conversations that had never been shared, and call authenticated APIs as them — no install, no project, no pasted code, just opening the link. The mechanism is the lesson and it is almost elegant: an interactive graph quietly loaded MathLive, which registered a postMessage listener on the main page that did not check the sender's origin, and the sandboxed HTML Preview supplied an untrusted sender. Two features that were each fine alone composed into account takeover; OpenAI fixed it on October 26 and rated it P1.",{"name":89,"items":410},[411,413,418],{"title":92,"url":93,"source":94,"from":18,"summary":412},"Every pull request at Imprint now carries a file describing what the harness did to check its own work and — the load-bearing half — what it could not check, and a PR cannot leave draft without one. Larson is candid that the name misleads people into hearing 'tests'; the mechanism is closer to making the agent think out loud, and the second-order payoff is that the 'could not verify' column accumulates into an evidence-backed list of what to fix in the harness next. The cheapest idea of the week to steal.",{"title":414,"url":415,"source":416,"from":323,"summary":417},"Cheap AI tokens are running out","https:\u002F\u002Fleaddev.com\u002Fai\u002Fcheap-ai-tokens-are-running-out","James Stanier, LeadDev","The whole argument rests on one comparison: a month of heavy Claude Code and Codex use that would have cost roughly $2,180 metered, bought for $200 on a subscription. That gap is a subsidy, not a price, and the large enterprise contracts have already been moved off it — so the planning question for next year is not which tool your team likes but what happens to your unit economics when the flat seat becomes a meter.",{"title":97,"url":98,"source":99,"from":18,"summary":419},"A hiring manager inside the company whose tools caused the problem has dropped data-structures questions from the loop entirely, on the grounds that they now yield zero signal — which is a more credible place for that claim to come from than most. The ballast around it is the better read: incident.io took AI spend from $4,500 per developer per month in August to $1,600 now, and Amazon has written AI usage into formal engineer and manager expectations.",{"name":102,"items":421},[422,427],{"title":423,"url":424,"source":425,"summary":426},"The AI cost of JavaScript frameworks","https:\u002F\u002Fnolanlawson.com\u002F2026\u002F10\u002F28\u002Fthe-ai-cost-of-javascript-frameworks\u002F","Nolan Lawson, Read the Tea Leaves","Frontends are being rewritten this year because some framework is 'better for agents', and Lawson's complaint is that nobody has shown the numbers — so he built the benchmark: one spec'd Pokémon app, each framework built by an agent using that tool's own MCP or skills, scored on development time, tokens spent, lines of code, and Lighthouse performance and accessibility against a conformance suite the agent could not game. He is scrupulous about the caveats, including that the whole thing is wildly stochastic, which is itself a finding. For anyone choosing a meta-framework for a side project on evidence rather than vibes, this is the only such benchmark that exists.",{"title":428,"url":429,"source":430,"summary":431},"20 years, 766 million files, two chameleons","https:\u002F\u002Fblog.zamzar.com\u002F2026\u002F10\u002F30\u002F20-years-766-million-files-two-chameleons\u002F","The Zamzar Team","Two brothers started a file-conversion site on dial-up in 2006 with a secondhand HTML4 book, and twenty years later it has done 766 million conversions for 550 million people, serves over a million API requests a day, and is still a small independent UK company with no venture money. The incidental history is the fun part — helping the inventor of PowerPoint recover lost decks, a cease-and-desist from Google, sponsoring a Scottish curling team — but the useful part for anyone with a side project is the boring thesis underneath: people still need to convert files, and outlasting eight hype cycles turns out to be a strategy.",{"name":110,"items":433},[434,439],{"title":435,"url":436,"source":437,"summary":438},"Upper West Side street closures to know about on Marathon Sunday","https:\u002F\u002Fwww.westsiderag.com\u002F2026\u002F10\u002F30\u002Fupper-west-side-street-closures-to-know-about-on-marathon-sunday","Gus Saltonstall, West Side Rag","Today, so this is the practical one: the park drives are shut, all three traverses are closed from midnight tonight, and Central Park West, Columbus and Broadway below 77th go progressively dark from 5am until half past nine in the evening. The Family Reunion zone sits on West 69th through 71st between Columbus and Central Park West from 11 to 6, which is the bit that catches people who did not plan to be near the finish at all.",{"title":113,"url":114,"source":115,"from":18,"summary":440},"Chi Ian Chan missed Honolulu musubi enough to start making his own, sold it through a neighborhood Facebook group, graduated to Sunday pop-ups at a local sushi restaurant, and then spent sixteen months on permits and construction to open a narrow storefront on West 72nd. Spam with egg is $7, shrimp $7.25, with shiso and vegan versions — the week's best food story in the neighborhood and a walk rather than a trip.",{"name":123,"items":442},[443,447],{"title":444,"url":445,"source":136,"from":326,"summary":446},"Patrick Stewart, 1940–2026","https:\u002F\u002Fwww.theguardian.com\u002Fculture\u002F2026\u002Foct\u002F29\u002Fpatrick-stewart-dead","He died at home in Los Angeles at 86 after what his spokesperson described as a brief journey with Alzheimer's and Lewy body dementia. The obituary is good on the two decades people forget — a fixture of the British stage long before a syndicated science-fiction series made him famous at 47, which is a useful fact about second acts.",{"title":448,"url":449,"source":450,"from":326,"summary":451},"Castle Walls review","https:\u002F\u002Fwww.theguardian.com\u002Ftv-and-radio\u002F2026\u002Foct\u002F29\u002Fcastle-walls-review-prime-first-fully-ai-generated-tv-show","Luke Buckmaster, The Guardian","The first end-to-end AI-generated series on a major streaming platform runs two seventeen-minute episodes set at Alamut Castle in the eleventh century, and the review's diagnosis is specific rather than merely dismissive: the palette is genuinely striking right up until a person has to move through it. Worth ten minutes of reading if not of watching, because the failure mode it describes — everything convincing except continuity of intent — is the same one that shows up in generated code.",{"name":131,"items":453},[454,456,461],{"title":134,"url":135,"source":136,"from":18,"summary":455},"Lunny, dead at 79, is the reason Irish traditional music has a bouzouki in it: handed a round-backed Greek one by Andy Irvine in 1970, he had it rebuilt flat-backed with a shorter neck, and the instrument stayed. Across Planxty, the Bothy Band and Moving Hearts his actual job was arranger — instinctively drawn, as the Guardian puts it, to new harmonic and rhythmic structures — and he went on to produce Kate Bush, Sinéad O'Connor and Elvis Costello and to win an Emmy as musical director of Bringing It All Back Home.",{"title":457,"url":458,"source":459,"summary":460},"Traction!","https:\u002F\u002Faeon.co\u002Fessays\u002Fwhy-a-world-without-friction-is-a-world-without-progress","Jennifer R Vail, Aeon","A tribologist — someone who studies, professionally, what happens when two things rub together — on the fact that an entire industry has spent a decade promising to make everything frictionless while her field quietly established that friction is what makes motion possible at all. She has spent a career reducing it in jet engines and increasing it to get plaque off teeth, and the essay reads technological history through that paradox, from the log roller to the wheel to the orbits of stars. Twenty-six hundred words, and a genuinely strange thing to learn is a science.",{"title":462,"url":463,"source":464,"summary":465},"How a sick chicken revolutionized cancer research","https:\u002F\u002Fnautil.us\u002Fhow-a-sick-chicken-revolutionized-cancer-research-1286219\u002F","Jake Currie, Nautilus","In 1909 a farmer brought a Barred Plymouth Rock hen with a breast tumor to the Rockefeller Institute, and Peyton Rous ground the tumor up, filtered out every cell, injected the remaining fluid into healthy birds, and watched them grow tumors too — which meant cancer could be transmitted by something smaller than a bacterium. The field declined to believe him for fifty years; he got the Nobel in 1966, aged 87, and the virus named after him went on to show how a proto-oncogene becomes an oncogene.",{"name":143,"items":467},[468,472],{"title":469,"url":470,"source":148,"summary":471},"Chelsea 2-0 Manchester United: post-match reaction, ratings","https:\u002F\u002Fweaintgotnohistory.sbnation.com\u002Fpremier-league\u002F173610\u002Fchelsea-2-0-manchester-united-premier-league-post-match-reaction-ratings","A week that opened with a 0-2 home defeat to Spurs and a fifth straight shootout loss to Liverpool closes with Morgan Rogers running into acres of space off a Lavia turnover, Lisandro Martínez elbowing Fofana in front of VAR, and Palmer hammering in the penalty for his fiftieth league goal. Alonso went with a back four, a midfield two and four forwards without a recognized striker; Chelsea are fourth with a clean sheet, Sunderland away next Sunday, then the international break.",{"title":473,"url":474,"source":153,"summary":475},"Your new WNBA champions: the Golden State Valkyries","https:\u002F\u002Fwww.goldenstateofmind.com\u002Fgolden-state-valkyries-wnba\u002F113130\u002Fwnba-finals-game-7-valkyries-championship","In the first Game 7 in WNBA history the Valkyries beat Atlanta 68-63 at Chase Center to win a title in their second season — the fastest any team in American professional sports has got to the top. It was a defensive rock fight decided by one quarter of Gabby Williams, fifteen points in the third on three contested threes and a jumper, turning a nine-point deficit into the lead they never gave back.",{"title":334,"description":342},"paper\u002F2026-11-01","47° & overcast on the UWS","mkWnCaMJmlvi6MSFEJghU-k4jglYq_iC8IEqIkjbEho",1793528278747]