Saturday, 14 November

00:07

Claims about touch screen voting machines [Richard Stallman's Political Notes]

Claims are circulating about touch screen voting machines that change the vote that the user has already entered. Experts say that those machines are not rigged, but are prone to being hypersensitive, such that slight touches can confuse them.

Windfall profits of oil companies [Richard Stallman's Political Notes]

The windfall profits of nine giant oil companies over three recent months add up to almost a hundred billion dollars.

In the 1970s, when the oil price spiked because of an OPEC production cut, the US Congress imposed a windfall profits tax on oil companies. If it doesn't do likewise now, that is a measure of how the political influence of the oil companies has become dangerous.

Countries that emit less than 1% of greenhouse emissions [Richard Stallman's Political Notes]

Countries that emit less than 1% of the world's greenhouse gas emissions are not negligible — they add up to almost 1/3 of the total emissions.

Thus, the argument that emitting less than 1% is an excuse for the country to do nothing to reduce its emissions is a bogus excuse.

Uyghur refugees who fled to Thailand [Richard Stallman's Political Notes]

China has ordered Thailand to deport to China some Uyghur refugees who fled China and criticize China for persecuting Uyghurs. Thailand is so completely under China's thumb that it intends to obey that order even though these refugees have been offered asylum in Canada, which ought to be safe.

Shame on you, Thailand!

Suspicion of brutal confrontation with Congress [Richard Stallman's Political Notes]

Suspicion that the saboteur in chief may seek a brutal confrontation with Congress.

Holding investigations is not the only way that Democrats in Congress can oppose him. There will continue to be must-pass bills into which they could insert provisions that would help the country and non-rich, but that he would oppose. The saboteur in chief would veto the bills; then what? Will Democrats be determined enough to out-stubborn him?

I suggest that they respond by doubling down: pass another version of the bill, adding a few more good provisions that he would oppose. And repeat this until he cracks.

"Corporate" (plutocratist) Democrats will be the weak link.

Tangible outcome of emissions cuts people can see [Richard Stallman's Political Notes]

*Australia's climate and energy minister and president of negotiations for Cop31: "We need a tangible outcome focused on implementation [of emissions cuts and finance] that people can see is real."*

Hunger and obesity as closely related problems [Richard Stallman's Political Notes]

Proposing that governments consider hunger and obesity as closely related problems. The same policies can cause both.

Rule of Law Project [Richard Stallman's Political Notes]

The Rule of Law Project will prepare criminal cases against the perpetrators who have carried out crimes for the corrupter/persecutor.

The cases will be available to be used by whichever country has the opportunity and courage to prosecute those perpetrators.

Democrats have to take on billionaire class [Richard Stallman's Political Notes]

Naomi Klein: If Democrats want to keep the blue wave going into 2028, they have to take on the billionaire class.

Friday, 13 November

23:42

Mike Gabriel: Debian Edu 13 - Call for Testing [Planet Debian]

The upcoming Debian 13.8 point release will be the foundation of the first release of Debian Edu 13.

This is a call for testing, we are interested in your feedback.

How To Prepare

  • Download the Debian Edu 13.7.0 BD ISO Image (beware, ~17GiB) [1]
  • Tweak the BD ISO image [2] and add support for packages in trixie-proposed-updates [3]

How To Test

  • Use virt-manager
  • Prepare an internal 'edu' network and another internal 'thinclient' network
  • Prepare three VMs:
    • gateway:
      • Attach one network adapter to the Default/NAT network of libvirt
      • attach the other network adapter to the internal 'edu' network
      • Install a Debian 13 minimal system, install the 'debian-edu-router-config' package and follow the debconf (many!) dialogs to configure the system (see [4] for additional info)
    • tjener (Main-Server):
      • RAM: 4-8GiB, CPU Cores 2-4 (or more)
      • Provide 80GiB (or more) of storage (to be flexible with LTSP setups)
      • Attach primary network adapter to the internal 'edu' network
      • attach the second network adapter to the internal 'thinclient' network
      • Install the Main-server from your self-created debian-edu-13.7.0-amd64-BD-1-withPU.iso (see [2])
      • Install profiles Main-Server, LTSP-Server and Workstation (menu shown in Debian (Edu) Installer)
    • workstation:
      • needs ~40GiB of disk storage, 4GiB RAM, 2 (or more) CPU cores
      • boot over PXE on the internal 'edu' network
      • test runs:
      • boot as Diskless Workstation
      • boot as X2Go Thin Client
      • install a Debian Edu system to disk

Known Issues

See our Debian Edu 13 status page on the Debian Wiki:
https://wiki.debian.org/DebianEdu/Status/Trixie

More Info

Debian Edu comes with the Debian Edu manual, it can be found at:
https://jenkins.debian.net/userContent/debian-edu-doc/debian-edu-doc-en/...

Where to Report Findings

Please either directly submit bugs to Debian's bug tracker (package: debian-edu-config); talk to us on IRC #debian-edu on irc.debian.org or write to the Debian Edu mailing list.

References

[1] https://cdimage.debian.org/debian-cd/current/amd64/iso-bd/debian-edu-13....
[2] https://wiki.debian.org/DebianEdu/HowTo/TestInstallVirtualMachine#Varian...
[3] https://release.debian.org/proposed-updates/stable.html
[4] https://jenkins.debian.net/userContent/debian-edu-doc/debian-edu-doc-en/...

MenuetOS keeps steadily improving [OSnews]

MenuetOS, the operating system written in x86-64 assembly, has seen a few new releases since we last looked at it, delivering some welcome improvements. Secure network connections are now faster, there’s a TrueType font demo, and, of course, the usual bugfixes and smaller improvements. The game Wizord EXL100 has been ported, and a few drivers have been improved as well.

You can get the latest releases from the downloads page.

22:21

Link [Scripting News]

Writing is so important it deserves its own web.

Link [Scripting News]

There's a recursive effect of the election on the voters. We didn't know there would be so many of us. Ask us again what we want done with this power now that we understand how much more united we are than we thought.

22:07

Reproducible Builds: Reproducible Builds in October 2026 [Planet Debian]

Welcome to the October 2026 report from the Reproducible Builds project!

In our reports, we try to outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third parties to come to a consensus on whether a build was compromised or not.

As ever, if you are interested in contributing to the project, please visit our Contribute page on our website.

In this month’s report, we cover:

  1. GNU tar ‘sparse archive’ non-determinism reported
  2. Reproducible Builds at SeaGL 2026
  3. Tool and documentation development
  4. Distribution work
  5. SOURCE_DATE_EPOCH specification updates
  6. Mailing list news
  7. Patches


GNU tar ‘sparse archive’ non-determinism reported

Johannes Schauer Marin Rodrigues (josch) reported an issue to the GNU tar mailing list where creating PAX-format sparse tar archives produces unreproducible outputs. Specifically, when GNU tar generates a PAX archive containing a sparse file it embeds the process ID into the member filename path structure (e.g. ./GNUSparseFile.<pid>/<filename>). Because process IDs vary between build runs, however, archiving identical sparse input files yields different binary outputs.

In his report, Johannes outlined potential workarounds, such as running tar inside an unshared PID namespace where the process ID is pinned to 1, and proposed that GNU tar either omit the PID by default or provide a command-line flag to suppress it. Full details can be found in the post itself, and Johannes also filed the bug in Debian for completeness.


Reproducible Builds at SeaGL 2026

Reproducible Builds was present at SeaGL in Seattle, WA, on October 23rd & 24th. Thanks to everyone who attended and spoke with us!

Members of the Reproducible Builds project attended SeaGL (the Seattle GNU/Linux Conference) in Seattle, WA, on October 23rd & 24th. It was a fantastic opportunity to connect with local community members, discuss software supply chain security and share updates on build verification tooling. Thanks to everyone who stopped by our sessions or spoke with us during the event.

Founded in 2013, SeaGL is an annual free-as-in-freedom, grassroots technical summit dedicated to spreading awareness, community engagement and practical knowledge about free software, open hardware and libre culture.


Tool and documentation development

diffoscope is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made a number of changes, including preparing and uploading versions 333, 334, 335 and 336 to Debian:

  • New features:

    • Support the dumppdf binary being called dumppdf.py on the host/runtime system. […]
  • Bug fixes:

    • Drop Recommends: guix from the diffoscope-minimal package as it is not minimal. (#1114739) […]
    • Fix a crash when using the latest version(s) of Androguard. Thanks, hc! […]
  • Codebase improvements:

    • Re-order various parts of the .tar file comparator to make it easier to progressively delve into its functionality. […]
    • Fix a silly “prepend” typo. […]
    • Reflect in the Python packaging that the use of the case-match language feature necessarily requires Python 3.10+. […]
  • Misc:

    • Update debian/tests/control. […]
    • Update copyright years. […]

In addition, Johannes Schauer Marin Rodrigues added support for POSIX.1-2001 PAX headers in the .tar file comparator […] and Vagrant Cascadian proposed an update in diffoscope in GNU Guix to version 335.


Distribution work

In Debian this month, 20 reviews of Debian packages were added, 28 were updated and 27 were removed this month adding to our knowledge about identified issues. One issue type was updated to reflect that Debhelper ‘compat’ level 14 is no longer experimental. […]

In addition, Vagrant Cascadian performed a number of Non-Maintainer Uploads (NMUs) and Quality Assurance (QA) uploads in Debian for several packages with outstanding reproducibility issues. These included clhep, tea-cli, argparse-manpage, ruby-timers, mandos and cdebootstrap.


Lastly, Bernhard M. Wiedemann posted another openSUSE monthly update for their reproducibility work there.


SOURCE_DATE_EPOCH specification updates

As announced in last month’s report, further work has been done by Bernhard M. Wiedemann regarding updating the SOURCE_DATE_EPOCH specification following discussions at a project summit. Seven distinct proposed changes were originally submitted as merge requests on Salsa, and many of these have been approved or otherwise collapsed.

Bernhard’s proposed modifications were independent of one another, allowing for any combination to be merged depending on community feedback. Bernhard noted that one proposal may see the most debate, and could still benefit from further refinement before reaching consensus. Community members are invited to review and provide feedback on the individual merge requests; as Bernhard writes, “The other MRs could still use feedback from more people before December”. Input can be submitted via reactions or comments on Salsa, directly by email to Bernhard or the mailing list.

The SOURCE_DATE_EPOCH specification was first published in 2015 and updated in 2017.


Mailing list news

On our mailing list this month:


Patches

The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:

In addition, two build failure bugs were reported by Jochen Sprickerhof.



If you are interested in contributing to the Reproducible Builds project, please visit our Contribute page on our website. However, you can get in touch with us via:

Friday Squid Blogging: Pacific Flying Squid Populations Dropping in Korean Waters [Schneier on Security]

Climate change is the issue.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

21:28

Building GNU Emacs from source [Planet GNU]

In the recent years, I've been configuring and building GNU Emacs from source, specifically the master branch of the emacs.git repository. Doing so allows me to use and test latest Emacs features, test my Emacs Lisp code with the laest developments in Emacs, and easily contribute my own changes to Emacs.

Before we start, I recommend reading the INSTALL file in the Emacs source repository for building Emacs from source tarballs, and also INSTALL.REPO for details about building Emacs from its source repository. The information provided here were built upon the details documented in those files. When in doubt, consult those files as the main, authoritative source of information for how to build Emacs from source.

Installing build dependencies

To build GNU Emacs from its source repository, we first need to install the various required tools and build dependencies of Emacs. On Debian-based systems, this can be done using apt. First, we need to add the source packages for the current release of our Debian-based distribution in apt's configuration by adding the corresponding deb-src lines in an apt source list file. For currently existing and older Debian releases, that would be done by adding a corresponding deb-src line for each deb line in /etc/apt/sources.list, such as:

deb http://deb.debian.org/debian/ trixie main
deb-src http://deb.debian.org/debian/ trixie main

In systems with recent apt versions with so-called modernized sources that might look editing a file like /etc/apt/sources.list.d/debian.sources and adding deb-src to the Types lines:

Types: deb deb-src
URIs: http://deb.debian.org/debian/
Suites: trixie
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Then run sudo apt update to have apt download package information from the configured sources.

We can now run sudo apt build-dep emacs to have apt download and install the build dependencies of Emacs. Debian-based distributions have packages for a few different configurations of Emacs, like emacs-pgtk with PGTK support for Wayland, and emacs-nox for Emacs without GUI support, which we can use with apt build-dep to download the specific dependencies of those configurations.

Cloning the Emacs source repository

After installing Git using sudo apt install git if not already installed, we're now ready to clone the Emacs source repository from GNU Savannah:

git clone https://https.git.savannah.gnu.org/git/emacs.git

We can add --depth 1 to make a shallow clone of the repository, if we don't care about having a complete log of previous commits to the Emacs repository (shallow clones are much faster).

If cloning over HTTPS is slow, we can try cloning over Git's own protocol (with the caveat that the repository is cloned over an insecure channel) or over SSH if we have a Savannah account, using one of the following URLs instead of the one above:

git://git.git.savannah.gnu.org/emacs.git
ssh://git.savannah.gnu.org/srv/git/emacs.git

Configuring the Emacs build

We now change to the Emacs repository directory we just cloned, and run the autogen.sh script once to generate the configure script, which we will use to configure Emacs to our liking:

cd emacs
./autogen.sh

To configure Emacs, the simplest approach is to run configure without any additional options, to have it use the defaults. We can get a list of available configuration options by running:

./configure --help

As I rebuild Emacs frequently, I normally don't "install" it, but for a typical setup, we'll want to specify the installation directory using --prefix, e.g.:

./configure --prefix=$HOME/.local

Later, make install will install Emacs under the specified directory.

By default, some of the files (such as *.el) will be compressed during installation. We can prevent that using --without-compress-install.

For my builds, I always use these configuration options:

--without-gconf
--without-gsettings
--without-gpm
--with-native-compilation

As I don't use the GNOME desktop, the GConf and GSettings integrations are always more trouble than useful for me, so I disable them. Further, I disable the GPM support, since I never use the mouse when using Emacs in the terminal. Lastly, I explicitly enable native compilation support.

In Wayland environments, I usually use PGTK:

--with-pgtk

And in X11 environments (e.g. EXWM), I either use the Lucid toolkit:

--with-x-toolkit=lucid --with-xaw3d

Or no toolkit at all:

--with-x-toolkit=no --without-xaw3d

Later after building Emacs, we can view the configuration options in Emacs by inspecting the system-configuration-options variable.

Building Emacs

After running ./configure, we can now finally build Emacs by running make. The first build will take a while, since all of Emacs is being built from scratch. Subsequent builds will generally be faster.

We can optionally run make install to install Emacs into the prefix specified earlier, or the default /usr/local. Note that this step might require using sudo if our user doesn't have write permission for the prefix.

Running Emacs

After building Emacs, we run it either from the install location if we ran make install earlier, or directly from the source repository. Currently, Emacs's build system makes a symlink to the latest built binary in the repository at src/emacs, and for emacsclient and other auxiliary binaries under the lib-src directory.

When skipping make install, we might still want to be able to easily launch Emacs from anywhere by typing emacs. We can do that by making symlinks to emacs and its auxiliary binaries inside a directory in our $PATH, such as $HOME/.local/bin, like so:

cd $HOME/.local/bin
ln -s $HOME/src/emacs/src/emacs .
for e in \
 ebrowse emacsclient etags make-docfile\
 make-fingerprint hexl rcs2log; do\
  ln -s $HOME/src/emacs/lib-src/$e .; done

For non-install setups like this, I augment Info-directory-list in my init file with the location of the info manuals in the repository to make them known to Emacs:

(defvar Info-directory-list) 
(with-eval-after-load 'info 
  (setq 
   Info-directory-list
   `(,@Info-directory-list
     ,(expand-file-name
       (convert-standard-filename "info/")
       source-directory)
     "/usr/share/info/"))) 

Updating Emacs

We can pull in the latest changes in the Emacs repository using git pull, then rebuild our Emacs by running make.

Occasionally, rebuilds may fail due to bad interaction of changes with leftover build artifacts. In such cases, the easiest thing to do would be a make bootstrap for an almost-from-scratch build. On even rarer occasions, make bootstrap might also fail. We would then want to run git clean -xdf to remove every file that's not tracked by Git, as if we freshly cloned the repository. In such cases, we would need to configure the build again using ./configure and provide the desired options before running make again.

Further reading

Protesilaos's similar post from early 2025 was part of the inspiration for writing and sharing my version:

https://protesilaos.com/codelog/2025-03-22-emacs-build-source-debian/

Lastly, to reiterate, Emacs's own INSTALL and INSTALL.REPO files for building from source:

https://cgit.git.savannah.gnu.org/cgit/emacs.git/tree/INSTALL
https://cgit.git.savannah.gnu.org/cgit/emacs.git/tree/INSTALL.REPO

Take care, and so long for now.

20:35

Pluralistic: I told you so (13 Nov 2026) [Pluralistic: Daily links from Cory Doctorow]

->->->->->->->->->->->->->->->->->->->->->->->->->->->->-> Top Sources: None -->

Today's links



The Earth from space, wreathed in flames. Protruding from a vast mid-North American impact crater is Microsoft Clippy, shimmering in the heat.

I told you so (permalink)

Here's the one weird trick that made it possible for monopolies to conquer the world: the antitrust bar changed the rules so that it was impossible to prove whether a company had formed an illegal monopoly, and then these rules meant that monopolies were almost never challenged, and what challenges did arise were usually unsuccessful, and even the successful challenges resulted in meaningless "penalties" that left monopolists unscathed.

Every policy has three important dimensions: substance, scope and administrability:

  • "Substance" is what the policy actually says. For example, the basic substance of copyright law is, "You can't display, transmit or reproduce a copyrighted work without permission."
  • "Scope" is when the policy gets applied. When copyright law was formulated, the key activities it regulated all required a bunch of expensive industrial equipment. Every book implied a printing press, every record implied a record-pressing plant, every film implied a film duplication lab. That meant that, by default, pretty much the only people who had to care about what copyright law said were industrial actors – firms who might reasonably be expected to also have access to a lawyer. That matters a lot to administrability.

  • "Administrability" is what it takes to actually administer the policy. Can you detect potential violations, and when you do, how hard is it to figure out whether the rule was actually broken? Again, in the pre-digital era, it was pretty easy to spot copyright violations: pirate books, records and movies are tangible, physical objects, and distributing them requires advertisement, delivery and payment.

After detecting an infringement, copyright enforcers must resolve a further question: whether a display, transmission or copy fall under "fair use." Fair use is a "fact intensive" rule, one that requires a lot of evidence and argument to adjudicate. It's almost impossible to categorically rule in or rule out a specific use as "fair":

https://pluralistic.net/2024/06/27/nuke-first/#ask-questions-never

Despite the complexity and expense of determining fair use, pre-digital copyright was still relatively administrable, because fair use questions themselves were relatively rare. Most fair uses (for example, photocopying part of a book for classroom use) were below the threshold for detection by rightsholders, so these questions almost never found their way into court. The fair use questions that did get to court were big, splashy affairs, like whether it's okay to rewrite a famous pro-slavery novel from the enslaved characters' perspective (it is!):

https://en.wikipedia.org/wiki/The_Wind_Done_Gone

There are a lot of legal questions that require nuance, fact-finding and argumentation to resolve, and that's not necessarily a problem. It's fine to apply these complicated, lengthy processes to things that only happen every once in a while. Take probate: most of us will die one or fewer times, so it's not the worst thing in the world that figuring out what happens to our stuff when that happens can involve some legal complexity.

But as media went digital, copyright's scope expanded dramatically. "Making or handling copies of copyrighted work" stopped being an industrial activity that implied a complex business and access to legal expertise. The only thing a digital computer does is make and handle copies, so every time any ordinary person clicks their mouse, dozens of potentially thorny copyright questions arise. What's more, those questions involve the public internet, which raises the number of potential infringements that a rightsholder can detect (and potentially seek legal redress for) from dozens to millions.

Nearly all of these potential infringements fall under fair use, but fair use is a fact-intensive doctrine suited to resolving occasional disputes between large firms. Fair use is monumentally unsuited to resolving questions that arise hundreds of times every day for nearly every person alive, including small children and other people who almost certainly can't get legal advice:

https://locusmag.com/feature/cory-doctorow-a-new-deal-for-copyright/

This is how copyright broke: new technology (digital computers) radically expanded its scope, conscripting everyone into using copyright's framework for everyday activities that had nothing to do with the media industry's supply-chain. That framework was developed for industrial actors with access to lawyers, and its most important aspect (fair use) is a fact-intensive doctrine that takes serious work to resolve, but now had to be navigated many times every day by every person. So copyright became unadministrable: you can't apply a fact-intensive doctrine to everyday activities undertaken by everyday people. If you try, you will make criminals of everyone. It would be literally impossible to train enough copyright lawyers to advise every person every time they use a computer to do something that might violate copyright law.

Back to antitrust: when the pro-monopoly partisans of the "law and economy" movement set out to neuter antitrust, they deliberately introduced a set of hurdles that were designed to make it impossible to administer competition law.

First, they introduced an "intent" standard: it was no longer enough for a company to have a monopoly, the company must have intended to secure and maintain that monopoly. If you want to be sure a law doesn't get enforced, this is a fantastic standard to apply. After all, how can anyone know what anyone else intended? Ask any anthropologist and they'll tell you: the only way to find out what someone intends by their actions is to ask them, and even that only works if you can trust them to answer honestly:

https://en.wikipedia.org/wiki/Thick_description#Clifford_Geertz

If antitrust law can only be enforced by mind-readers and advanced philosophers who have solved the intersubjectivity problem, then antitrust law can't be enforced at all:

https://en.wikipedia.org/wiki/Intersubjective_verifiability

But that wasn't all! Antitrust's enemies insisted on another fact-intensive question: "market definition." They made the (seemingly commonsense) point that if a company is said to have a monopoly, we must first determine which thing the company has monopolized. This sounds like a no-brainer, but it's actually a way to introduce unresolvable, show-stopper arguments into any antitrust enforcement action.

Take Amazon: the company's ecommerce monopoly is obvious to anyone who hasn't been in a coma for the past 15 years. But when Amazon gets investigated for this monopoly, they will insist that they don't participate in the "ecommerce" economy, but rather in "the buying and selling of things in general." Then they point out that people still go to the corner store for a pint of milk, still buy a pack of gum from the kiosk at the train-station, and still buy some hair-gel from the barber after a trim, and therefore Amazon can't possibly have a monopoly.

"Market definition" is a playground for bad-faith semanticians. Luckily for the world's monopolists, the very existence of this legal doctrine has conjured up an army of bad-faith semanticians, most of them with expensive Ivy League economics degrees, who make millions coming up with bizarre market definition arguments that can draw out any legal proceeding for years, often to the point where there is a change in government and the federal prosecutors just walk away from the case.

Taken together, these impossible fact-intensive questions would be enough to bury antitrust, but then came the final blow: frequency. Once capital had won the battle to mire antitrust cases in questions that take years and millions to resolve, they embarked on a frenzy of monopolistic mergers. This meant that the kind of antitrust questions that originally arose every few years were suddenly coming up several times per month. This was the killer combo: making antitrust a plodding ball-ache of thorny philosophical and technical questions, and then rigging the system so that these questions arise in a nonstop flurry guaranteed that antitrust would fail.

That's what happened with Microsoft. The company had a 95% desktop OS market-share when Clinton's trustbusters dragged them into court. Nevertheless, the company played all kinds of "market definition" games that dragged the case out for years. They also insisted that they never intended to form a monopoly, despite smoking-gun memos about "sucking up all the market oxygen":

https://web.archive.org/web/20190717023522/https://www.justice.gov/atr/department-justice-7

This dragged on so long that even after Microsoft lost its case, the appeal carried on until after GW Bush stole the presidency, and then his DoJ walked away from the case, letting Microsoft continue to enjoy (and increase) its monopoly:

https://www.nytimes.com/2001/09/07/business/us-vs-microsoft-overview-us-abandoning-its-effort-break-apart-microsoft-saying.html

What happened next should not come as a surprise to anyone. Microsoft got convicted of deliberately setting out to create a monopoly, and then paid no penalty. After an all-too-brief period of post-traumatic good behavior, Microsoft returned to its monopolistic ways. Along the way, Microsoft sucked up to a succession of presidential administrations, culminating in the company's emergence as a de facto wing of the Trump regime. Microsoft's CEO paid $1m to sit on the inaugural dais, and then directed the company to donate millions to the Epstein Ballroom, and then provided the IT services for ICE's ethnic cleansing pogroms:

https://www.datacenterdynamics.com/en/news/us-ice-triples-use-of-microsoft-cloud-in-six-months/#:~:text=ICE%20has%20been,first%20presidential%20term.

Microsoft isn't merely the in-house IT shop for Trump's domestic agenda: they've also weaponized foreign reliance on Microsoft's cloud apps and they punish foreign officials who thwart Trump abroad:

https://www.theregister.com/off-prem/2026/02/18/microsoft-throws-spox-under-the-bus-in-icc-email-flap/

When forced, Microsoft candidly admits that no matter where in the world your Microsoft data is stored, when it comes to foreign firms and governments, the company will give warrantless, secret access to their data to Trump's cronies:

https://www.theregister.com/off-prem/2025/07/25/microsoft-exec-admits-it-cannot-guarantee-data-sovereignty/458553

All of this raises an urgent digital sovereignty question: what if Microsoft (a monopolist that is entirely dependent on Trump's favor to keep it free of existential legal problems) cuts off your country's Office 365 access? This is the question I raised late last year in my CCC talk about the "Post-American Internet":

https://pluralistic.net/2026/01/01/39c3/#the-new-coalition

(Coming soon in expanded form to a bookstore near you:)

https://us.macmillan.com/books/9780374623845/thepostamericaninternet/

And now, Microsoft has given the whole world a preview of how this might play out, because their servers have collapsed, shutting the world off from Outlook email, Azure cloud, Copilot, Teams, and other key offerings:

https://www.bbc.com/news/live/cq5y10ge3dp3t

The outage lasted for about two days, and around the world, government agencies and businesses large and small ground to a halt. Without Office 365, Outlook and Teams, many organizations could not even convene a meeting or formulate a plan to deal with the outage.

All of this raises an important question: is Microsoft guilty of negligence, and, if so, what should be done about this? Here's my answer: yes, Microsoft is presumptively guilty of negligence, and any response to this must include antitrust breakups of the company.

Here's why I think that. Microsoft has demonstrably underinvested in its IT stability. Any IT plan that results in a global, multi-day outage is, by definition, inadequate. Whether the problem could have been solved by buying more servers, or hiring more people, or changing the management of key divisions is immaterial. Every one of these measures – every single measure that could have prevented this – costs money. By not spending that money, Microsoft definitively underinvested in its products.

But Microsoft doesn't lack for funds! Microsoft is a convicted monopolist, and it has the margins to prove it. In 2025-2026, the company pissed away more than $30b in stock buybacks, a once-illegal (and still sleazy) form of stock manipulation. Over that same period, Microsoft lost nearly $200b on AI ventures that it now admits will not pay off:

https://www.cnbc.com/2025/02/24/microsoft-reiterates-plan-to-invest-80-billion-in-ai-.html

Then there's the layoffs. 2026 saw Microsoft's first-ever voluntary retirement buyout, which served as the overture to a year that saw a 25% headcount cut – 60,000 employees slated for destruction:

https://www.theguardian.com/technology/2026/oct/26/microsoft-buyout-offers-ai-cuts

Ever had a boss who caught you catching your breath and shoved a broom in your hand, barking, "If you have time to lean, you have time to clean?" That goes quintuple for convicted monopolists who bring the global economy to a halt due to a multi-day outage. If you can't manage to keep your servers online, you have no business incinerating tens of billions on stock buybacks, much less hundreds of billions to feed the AI money-furnace. Did Microsoft need the tens of thousands of workers it threw away? Demonstrably so: when they were on the payroll, Microsoft's servers were up. Now they're gone, and so are the servers. It doesn't matter how those workers related to this specific outage: if you can't keep your servers online, you either don't have enough site reliability engineers, or you don't have enough managers to deploy them effectively, or you don't have enough managers to hire the managers and SREs you need.

Q.E.D.

This is all characteristic of the monopolist's pathology. The problem with monopolists is that they have pricing power and market power: the power to foist inferior products on their customers and degraded working conditions on their employees and unfair terms on their suppliers. Microsoft's hundreds of billions in wastage and tens of thousands of layoffs are a massive transfer of value from customers, workers and suppliers to investors. The fact that the company judged (correctly, it seems) that they could make us all eat shit and we'd ask for second helpings is a nice, clean proof of monopoly power.

Here, I think, is a nice, bright-line, administrable test for monopoly power. If your company has a dominant position and if it allocates its surplus capital to its investors and if that precedes a significant degradation of your products, then you have an illegal monopoly and you should be broken up. We don't need to inquire as to whether you have a wicked heart that intentionally set about to create a monopoly, nor do we have to argue endlessly about how many angels can dance on the head of your market definition. If you think you are so powerful that you can fuck up your products and not suffer as a result then you are too big to care, and that is simply too big.

This isn't the only fix we need to antitrust law, but it is a fix that would specifically let us target Big Tech. Microsoft is a living, breathing (limping, gasping) repudiation of the thesis that monopolies are efficient and if we only let them amass endless market share and profits, they will use their "economies of scale" to deliver superior products. It's not that economies of scale don't exist, but for companies to take advantage of these economies of scale, they have to be motivated to expend their capital to do so. The more powerful a company is, the less inclined it will be to apportion capital to workers, suppliers and consumers, and the more it will cheat us all to enrich its shareholders.

We can't afford to let this crisis go to waste. Google was convicted of creating and maintaining a monopoly three times over the past couple years and every single time the judge decided the company should not face any real punishment for that monopoly, on the basis that the monopoly is what lets Google deliver such excellence for us.

Does anyone still think Google is excellent? How about Apple? Google pays Apple an annual bribe of more than $20b to stay out of the search market. Judge Amit Mehta decided to let Google continue paying this bribe to Apple so that Apple would have the capital it needed to deliver excellent products. Apple promptly went on to have a string of catastrophically bad product launches – while throwing away $170b manipulating its share-price with stock buybacks:

https://finance.yahoo.com/news/apple-dodged-a-20-billion-hit-thanks-to-google-antitrust-ruling-163056806.html

Both companies are demonstrably underinvesting in quality in order to divert R&D and product maintenance capital to their shareholders. They are too big to care. In this age of nonstop mergers and acquisitions, we can't afford to make merger approval turn on fact-intensive questions, but we can sure as hell create this administrable, bright-line test for whether a merger should be unwound after the fact. Did your company buy another company and then enshittify both products? Great, now we're breaking you up, and your investors are getting fucked. Maybe next time they'll fire the board when they announce another stupid, anti-competitive merger.

Microsoft is too big in every way. Too big to fail, too big to jail and too big to care. Too big to trust. Too big to rely upon. Too big to foster a corporate culture that cares about reliability, a decent workplace, or product quality. There's a straight line from GW Bush's decision to let Microsoft skate in 2001 and the situation a quarter century later, where Microsoft is a load-bearing piece of the world's most important firms and government agencies, and where this means that Microsoft knows that it can throw away tens of thousands of workers and hundreds of billions of dollars, crash the planet, and wake up tomorrow unscathed, ready to do it all over again.


Hey look at this (permalink)



A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'

Object permanence (permalink)

#20yrsago Canadian copyright minister caught lining pockets https://web.archive.org/web/20061115062027/https://www.michaelgeist.ca/content/view/1529/135/

#20yrsago Universal Music CEO: iPod owners are thieves https://web.archive.org/web/20061201014046/https://www.billboard.com/bbcom/news/article_display.jsp?vnu_content_id=1003380831

#15yrsago OccupyLondon members evicted from St Paul’s memorial services https://www.theguardian.com/uk/2011/nov/13/occupy-london-asked-leave-st-pauls-services

#15yrsago Berlusconi to neo-fascists: “I’ll be back.” https://www.theguardian.com/world/2011/nov/13/berlusconi-hints-return-italy-government

#15yrsago Balancing 3,118 coins on a dime https://www.youtube.com/watch?v=CmLjO0Wu3ug

#10yrsago People who voted for Trump knew their shot at the elites was fired through the guts of their neighbors https://web.archive.org/web/20210916183118/https://www.newstatesman.com/spotlight/2016/11/on-the-election-of-donald-j-trump-2

#10yrsago Ontario judge dishonours his court and disgraces himself by presiding in a MAKE AMERICA GREAT hat https://www.cbc.ca/news/canada/hamilton/osgoode-hall-professor-ontario-judge-hamilton-trump-hat-1.3848913

#10yrsago 300 million Adultfriendfinder accounts breached https://www.theverge.com/2016/11/13/13615750/412-million-adultfriendfinder-accounts-exposed-breach

#5yrsago How to be safe(r) online https://pluralistic.net/2021/11/13/opsec-soup-to-nuts/#secured

#1yrago For-profit healthcare is the problem, not (just) private equity https://pluralistic.net/2025/11/13/patients-not-customers/#medicine-vs-markets


Upcoming appearances (permalink)

A photo of me onstage, giving a speech, pounding the podium.



A screenshot of me at my desk, doing a livecast.

Recent appearances (permalink)



A grid of my books with Will Stahle covers..

Latest books (permalink)



A cardboard book box with the Macmillan logo.

Upcoming books (permalink)

  • "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027
  • "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

  • "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

  • "The Memex Method," Farrar, Straus, Giroux, 2027



Colophon (permalink)

Today's top sources:

Currently writing:

  • “Once Is Enemy Action,” a science fiction novel about the origins of modern technofascism. Today's words: 561 (36083 total).

  • "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

  • A Little Brother short story about DIY insulin PLANNING


This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.


How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X

20:00

Huang Bang [Penny Arcade]

The week only got rougher for Jensen Huang after we wrote the strip; he had to fall on his sword, but a few other people had fallen on his sword recently so he had some sense of how it was gonna go.

19:49

Page 16 [Flipside]

Page 16 is done.

Steinar H. Gunderson: Solving the fox game [Planet Debian]

Christoffer Stjernlöf posted about the Fox Game, an old Norse asymmetric board game (seemingly also called “halatafl”) where twenty sheep try to outsmart two foxes and get to the other side. His AI uncovered some interesting insights, but left the question open as of whether the foxes or the sheep actually win with perfect play (the general sentiment in his family was that winning with the foxes was easy). This was too tempting for me to leave on the table, so I set out to make a strong solve.

Since I don't know this game myself, I've stayed with the rules he describes even when they differ from e.g. Wikipedia (in particular, I do not use forced fox jumps, or multi-jumps); the only real change is that I don't have a 40-move draw rule, any position that is a forced win for one of the sides would be a win no matter how long it would take. (I consider this just an implementation detail in his AI, although morally, I consider a draw a loss for the sheep.) You might want to read his post to get the full rules, because I'm not going to repeat them here.

The results first: The sheep win with perfect play, even with only 19 sheep (remove one on the flank), or 18 if they are allowed to go first. Even with only 9 sheep (the minimum possible that isn't an instant win for the foxes), the sheep can force a draw right from the start. With one fox, 11 sheep suffice for a forced win. (The draw margin is seemingly so large because one fox can just camp in the last spot in the pen, and it's hard to force it away without getting harassed by the other fox, unless you have lots of sheep.)

The rest is about the implementation. I'll skip over a lot of wrong turns, and unsurprisingly, there were a lot of bugs to iron out, but hopefully, it got to a good place in the end. :-) I started out trying to make something very simple, and it worked for the first few cases, but then things got more complicated than I would have liked in the end. Still only at ~1000 lines of code, though, with no dependencies.

Board representation

The board has 33 squares. I tried a few different ways of represent the state of the game, and ended up on a simple bitboard representation: There's a 64-bit bitmap representing where there are sheep, and another bitmap representing where there are foxes. Since there's plenty of room in there, I use a spare bit to represent side-to-move. This is compact (which mattered a lot earlier on, but not as much later), easy to iterate over, and has little redundancy, so it's easy to keep valid. You need fast 64-bit population count and bit-scan instructions, but a) that's common now everywhere, and b) I decided fairly early that I wanted to require BMI2 anyway.

The bit order mostly doesn't matter; I just started at top-left and went from there. All it really influences is square iteration order. There's a small tweak in that I store the right half of the board mirrored (reverse x order) for symmetry purposes; more on that below.

Move generation

I just typed in every possible move from every square into an array, then verified by generating some SVGs that I hadn't made any typos (I had). In retrospect, I should have done something more automated; it would have been less painful.

The moves for sheep are just “you can go to X, Y or Z”. The moves for foxes are “you can go to X or Y, or you can go to Z if there's a sheep at W (which will be eaten)”. The move generator mostly just looks up the source square and tests every move. For the sheep, I make an easy test using bitboards; for the foxes, I could probably do something similar, but the jump moves proved a bit tricky (even with PEXT/PDEP) and I didn't end up using it.

This is the part that really determines the geometry of the board (apart from debugging display). Everything else is pretty much geometry-agnostic.

Result storage

There's a little over 2^41 possible board states (this includes some illegal positions as well as some situations that could never arise during actual gameplay, such as a fox being stuck at C1 with a row of sheep ahead of it), and I want to remember all of them. With that many positions, I figured I needed a fairly compact representation. I needed to store that a position could be sheep win, fox win or a draw, and then there was a fourth “invalid” state that was useful for internal reasons, so that maps exactly to two bits per position. (A tablebase intended for distribution could be compressed to less using the usual tricks of entropy coding, skipping half of the positions, or similar.)

This means we need to give a number to every possible position, ideally one with no collisions and no holes. I learned about combinatorial number systems which fit the bill exactly; given e.g. “we have 33 squares and 15 pieces”, it gives a dense mapping of positions from board to ID (ranking) and the opposite (unranking). (I made some fairly fast ranking and unranking algorithms, which may or may not have been novel, but it turned out I didn't actually need fast unranking after some other optimizations.) There are some extra complications in that there are two types of pieces, but you can solve them in a number of ways.

On a macro level, I store everything with 9 sheep and 1 fox first, then 9 sheep and 2 foxes, 10 sheep and 1 fox, and so on. This gives beautiful locality (a single move can never remove more than one sheep, and only extremely rarely more than one fox), allowing me to just mmap everything and let the kernel deal with it, even though I only had 256GB of RAM and the total set was larger (329,870,110,455 bytes after the symmetry optimizations below).

mmap is almost never the right answer, but again, I was trying to go for simplicity. It certainly brought me pain, though, and perhaps some more explicit I/O would have been better.

Symmetry

The board is left-right symmetric (with an odd number of columns, so that there is a middle column that is neither “left” nor “right”). I had hoped to just ignore this, but eventually the gains became too important to ignore, so I conceded.

The basic idea is that I ranked the board twice, both as itself and mirrored (mirroring is just a couple of masks and shifts, given my representation), and picked the key that was the smaller as canonical. This reduced the number of positions I needed to look at to a bit over 50%, as expected, but it does nothing to the storage/RAM requirements; the new rank is not dense and the “illegal” (non-canonical) positions are spread out a bit all over the place (although of course near the low and high ends of values, it works much better).

As a tweak, I chose to compute all 33+281 canonical fox positions and renumbered using those placements as an assumption. This slashes ~95% of the waste, which is good enough; you can still rank a nonconical position if the foxes are symmetric about the center (or if there's only one fox and it's in the middle!), though.

You can improve on this by making the macro-splitting finer; instead of having a chunk for e.g. “10 sheep, 2 foxes”, you could have one with “5 sheep in left, 0 foxes in left, 1 sheep center, 1 fox center, 4 sheep in right, 1 fox in right” and demand that there are more sheep in left than right. However, you still get problems when the number is balanced, you'd need finer splitting etc.. The gains are small enough that I didn't see the point in doing this, and it tends to be a place where it's easy to introduce bugs.

I imagined calculating the exact number of positions up to symmetry would be an interesting exercise somehow, but I suppose it just immediately falls to Burnside's lemma as soon as you know how to count positions at all.

Searching

Now that we have positions and moves and a way to store results, we want to know how to find the result for the starting position (and ideally also all other positions).

My first attempt just did a depth-first search, caching as it went. This worked for the earlier stages but was generally a disaster; it ran out of stack easily (even with 8 GB—eight gigabytes of stack), and had problems with figuring out loops. (It didn't loop infinitely, but was prone to declaring loops where one side could break out of the loop by winning. I had a nasty hack to fix that, but it didn't really feel good.)

What I did instead was propagating results one step at a time. For each possible position:

  1. If from a given position you know you can immediately win (e.g., the sheep reach the pen, or the fox eats the last relevant sheep), mark it as such.

  2. If you can, in one move, reach a known-won position, mark your position as won (for the side to move). Similarly, if you can only reach known-lost positions, mark your position as lost.

  3. Repeat #2 over and over again until you no longer have changes.

This was simple but still inefficient; I typically needed 40–80 passes for each chunk (where a chunk is something like “all positions with 15 sheep, 2 foxes”). However, it was super-easy to parallelize; I have 64 cores and could just hand out reasonable independent sub-chunks, you don't even need locking or atomic operations on the result set.

The correct way of doing this is retrograde analysis (replace #2 with doing backwards moves) and I assume this would have made the calculation roughly ten times as fast. But I only needed ~36 hours for the actual run (plus numerous pre-runs that failed for various reasons!), so I never got to this. After all, I wanted something simple to begin with.

Distance-to-win

Since I only store win/draw/loss (WDL) for each position (also known as a “bitbase” in chess tablebases), it's not easy to know what the fastest way to win is; just that “this move does not mess it up, the other side still can't force a draw”. However, in practice, you could just do reasonable-looking moves that don't regress the position, and take forward moves whenever you can (i.e., do sheep pushes if that still wins).

I made a simple alpha-beta searcher that tries to get win distances using the bitbase as a guide, which was a really fun challenge! It can find wins when they're perhaps ~20 ply (10 moves for each side) away, depending a bit on how narrow the win is (if there are only a few ways to win, it will obviously have to search a much smaller tree). Ultimately, though, alpha-beta for finding exact mate scores is just a losing game, since even perfect move ordering will only give you a sqrt() improvement over pure minimax.

Perhaps making DTZ (distance-to-zeroing, referring to zeroing the draw move counter in e.g. chess) bases would be possible without breaking the bank on storage space; I would assume that usually, you can force some sort of progress pretty fast, at least as the sheep.

Try it out

I made a very rudimentary interface to the database; the UI isn't very nice, and it largely relies on hovering (which doesn't work all that well on mobile) but I didn't want a polished game-player, just to know the answer. :-) You can try it out at https://sheep.sesse.net/, although I don't envision keeping it up forever. Perhaps someone can gain new insight from it and become an expert player, although strong solves are rarely very insightful in themselves due to the brute-force nature. At least we've conclusively settled (again, under this ruleset!) that the sheep win with perfect play.

Earlier, I would publish the source, but these days, the only ones who would be reading it would be the AI beast (fox?), and I'm not really so interested in that. :-) I'm definitely open to answering questions if anyone should have them; contact information at my home page as usual.

19:14

Link [Scripting News]

This is where the new Substack mail list lives. It'll be faster and more immediate than the nightly email. No guarantee it'll work forever. Expect a mix of new features, interop with other products, stylesheets and plugins, great new applications of the tech, and lots of writing, because friends, that's what it's about. Writing is so important it deserves its own web.

19:00

Reproducible Builds (diffoscope): diffoscope 339 released [Planet Debian]

The diffoscope maintainers are pleased to announce the release of diffoscope version 339. This version includes the following changes:

[ Jay Burstin ]
* Rework including .zip-related differences for .odt files.

[ Chris Lamb ]
* Add some comments to recent OdtFile changes.
* Update copyright years.

You find out more by visiting the project homepage.

18:28

Link [Scripting News]

BTW if you open that Markdown file in BonBon you get the rendering not the source. I have to get used to that, there are two webs, one for Markdown and one for HTML. I think some people are offering Markdown versions of HTML files. We're going to this too, and have a website that'll be a perfect test case -- this.how. What's good about it is that it is a rendering of OPML files, so we don't have to work with the HTML at all, we can and will create and OPML to Markdown converter. And then when we want to put it on a domain for BonBon's use, just add ?format=markdown to the URL. It doesn't work yet but it will.

17:42

Link [Scripting News]

This is what a blog post looks like in Markdown, and the HTML version which Google objects to. Every post has one of these. 16K+ posts since May 2017. That's all, just wanted to show you the A-B. You can also see what we're being influenced by in the front matter department. Having Claude helping with this I can get good insight into the defacto standards already established. Gives us a chance for more interop.

Testing BonBon feature [Scripting News]

We're trying to get things nice and clean so we can rep the features of the product, but I have to say I am quite confused myself. It's okay, I like the feeling.

I know this is a productive direction and that the 35 year old web is waiting to be unlocked from the horrors Netscape, Microsoft and Google inflicted on it.

It's getting so safe, but then remember life itself isn't safe. Falling in love is definitely not safe but how could you deny it when it comes. Think of BonBon as being like that, like love. And basically trust that text with simple features, is safe enough to use with confidence.

The test -- do inline images render properly in BonBon.

Happy people enjoying a perfect ski holiday in the Rockies.

Screen shot of this page in BonBon, and the Markdown source it's rendered from.

This Week in AI: Who Gets to Benefit from AI? [Radar]

AI is becoming more capable at handling everyday tasks, but benefiting from that progress depends increasingly on where people live, what language they speak, and how much control they have over the technology. On the latest episode of This Week in AI, we examined developments from OpenAI and Anthropic, the growing push for regional AI models, and the challenges of making AI more accessible and responsible.

Frontier AI is moving into everyday services

OpenAI introduced LifeVal, a benchmark that measures how well AI handles everyday tasks such as finding childcare, managing household budgets, and accessing government services. Scores rose from 49% for GPT-5.2 to roughly 80% for GPT-5.6 and GPT-6 Astra. This could help researchers assess whether improvements in model capabilities translate into useful assistance with daily responsibilities.

OpenAI reported that ChatGPT now handles roughly 20% of Google’s search volume in search-like queries, although the company hasn’t explained its methodology. Its new GPT-6 Cyber model, available to approved security teams, aims to help identify and fix software vulnerabilities. Meanwhile, Anthropic began testing read-only banking connections in Claude, allowing some US subscribers to analyze spending and identify unusual charges. As AI assistants take on tasks traditionally handled by banks, search engines, and specialized software, those industries will have to reconsider how they serve customers and protect their data.

Anthropic also published FlashProve, a research prototype that uses cryptographic proofs to verify which model generated a response. Separately, nonprofit research organization METR reported that AI assistance may have roughly doubled the pace of progress on certain model development tasks at Anthropic over the past year. The findings don’t establish recursive self-improvement, but they suggest that AI assistance is already speeding up parts of model development. That makes it increasingly important to understand how AI is shaping that progress and to check the reliability of the outputs these systems produce.

Regional AI addresses gaps in access

We’ve previously discussed the “tokenizer tax,” which makes some languages more expensive to process because they require more tokens than English. New research from the University of Michigan found another disadvantage. In one test, answering questions in Pashto consumed up to 179 times more energy than answering equivalent questions in English, while accuracy also suffered. The findings show how language can affect both the cost and quality of AI services.

Countries are responding by investing in models designed around their own languages and infrastructure. Ibero-American countries agreed to form a regional AI alliance to coordinate model development, data sharing, and computing resources. India introduced three domestic models, including EKA-1, which supports 22 Indian languages and English, and two Dhīr models designed to work offline with documents. Offline capabilities could make these systems especially useful in rural areas with unreliable internet access.

Indonesia’s GoTo, the UAE’s Jais 3, and Uganda’s Sunflower V2 are further examples of projects developing AI for local languages. These efforts could give developers more control over AI for local languages and reduce reliance on proprietary AI services, even when some build on open foundation models from larger labs. They could also make AI more useful in languages that existing models handle poorly. For organizations deploying AI across multiple countries, testing performance and cost in each language may reveal problems that English-language benchmarks miss.

Responsible AI depends on how we deploy it

Google faced criticism over changes to AI controls in school accounts. Under a new arrangement, schools that disable AI also lose access to Google Search. That leaves educators with limited control over which tools students can use. And in Europe, an advisor to the EU’s top court suggested that chatbots could infringe publishers’ rights when reproducing news content. The opinion emerged from a dispute involving Google’s Gemini and a Hungarian publisher. A final ruling is still pending, but the case could influence how AI companies access and reuse copyrighted material. This is part of a broader wave of publisher lawsuits, including The New York Times’ US case against OpenAI and Microsoft over the alleged use of its articles to train models and reproduce content in ChatGPT outputs.

AI’s environmental costs continue to come into focus. Some data center operators are repurposing retired jet engines as natural gas generators to obtain power while waiting for grid connections. Although this can accelerate deployment, the converted engines are less efficient and can produce more pollution than conventional turbines, meaning faster access to electricity comes at the expense of higher emissions and worse local air quality. Public opposition is growing too. During the November 3 US general elections, voters favored restrictions on data center development in 40 of 41 local ballot measures across 10 states.

Meanwhile, Planet introduced a natural-language tool for searching and analyzing more than a decade of satellite imagery. Users can explore geographic changes without specialized GIS expertise, making satellite data easier for people without that background to investigate. The application shows how AI can help more people work with complex data that previously required specialized tools and training.

What’s next

As AI expands into personal services and countries invest in their own models, developers and organizations face increasingly different requirements for security, performance, and accessibility. The most useful systems will be those that work reliably for the people and circumstances they’re designed to serve.

We’ll be back on Monday, November 16, for another episode covering the latest developments in AI research and applications. You can catch previous episodes on YouTube, Spotify, Apple, or wherever you get your podcasts.

17:28

How can I make it easier to use the helper class that lets me pass more than one parameter to co_await? [The Old New Thing]

Last time, we figured out how to pass more than one parameter to co_await by combining the multiple parameter into a single mega-parameter.

But having to name the mega-parameter is annoying. Sure, today we have widget_with_priority, and then we get gadget_with_timeout, and then doodad_with_priority_and_timeout, and oh my goodness it’s out of control.

Instead of making the caller have to name the mega-parameter, we can create a helper method that produces it.

struct Widget
{
    ⟦ ... other stuff ... ⟧

private:
    bool inner_await_ready() const { return ⟦ ... ⟧; }

    bool inner_await_suspend(std::coroutine_handle<> handle, int priority)
    {
        return internal_start(handle, priority);
    }

    auto inner_await_resume() const { return ⟦ ... ⟧; }

    struct with_priority
    {
        with_priority(Widget const& widget, int priority) :
            m_widget(widget), m_priority(priority) {}

        bool await_ready() const { return m_widget.inner_await_ready(); }

        auto await_suspend(std::coroutine_handle<> handle)
        {
            return m_widget.inner_await_suspend(handle, m_priority);
        }

        auto await_ready() {
            return m_widget.await_ready();
        }

        Widget const& m_widget;
        int m_priority;
    };

public:                                       
    with_priority start(int priority = 0) {   
        return with_priority(*this, priority);
    }                                         
};

Now callers can write

co_await widget.start(priority);

As a convenience, I gave the start() method a default priority, so you can write

co_await widget.start();

You might even decide to bring back awaiting the widget directly, and having it mean “start with default priority”.

struct Widget
{
    ⟦ ... other stuff ... ⟧

    ⟦ ... as before ... ⟧

public:
    with_priority start(int priority = 0) {
        return with_priority(*this, priority);
    }

    // Or you can await the Widget directly, which starts it with
    // default priority.                                         
    auto await_ready() const { return inner_await_ready(); }     
                                                                 
    auto await_suspend(std::coroutine_handle<> handle)           
    {                                                            
        return internal_start(handle, 0);                        
    }                                                            
                                                                 
    auto await_resume() const { internal_await_resume(); }       
};

At this point you can simplify the class by just renaming the internal awaitable methods back to their original names.

struct Widget
{
    ⟦ ... other stuff ... ⟧

public:
    // Awaiting the Widget starts it with default priority.
    bool await_ready() const { return ⟦ ... ⟧; }

    bool await_suspend(std::coroutine_handle<> handle, int priority = 0)
    {
        return internal_start(handle, priority);
    }

    auto await_resume() const { return ⟦ ... ⟧; }

private:
    struct with_priority
    {
        with_priority(Widget const& widget, int priority) :
            m_widget(widget), m_priority(priority) {}

        bool await_ready() const { return m_widget.inner_await_ready(); }

        auto await_suspend(std::coroutine_handle<> handle)
        {
            return m_widget.inner_await_suspend(handle, m_priority);
        }

        auto await_ready() {
            return m_widget.await_ready();
        }

        Widget const& m_widget;
        int m_priority;
    };

public:
    // start() lets you start with custom priority.
    with_priority start(int priority = 0) {
        return with_priority(*this, priority);
    }
};

The post How can I make it easier to use the helper class that lets me pass more than one parameter to <CODE>co_await</CODE>? appeared first on The Old New Thing.

16:56

[$] 25 years of Buildroot [LWN.net]

Buildroot maintainer Peter Korsgaard gave a presentation about the long history of the build tool for embedded Linux systems at the 2026 Embedded Linux Conference Europe. In it, he covered more than just the past 25 years, looking at the current status of the project as well as what to expect in Buildroot's future. It was an interesting view inside this long-running project that has been a mainstay of the embedded-Linux world throughout almost all of this century.

16:14

A Substack experiment [Scripting News]

I just had one of those ideas.

Key fact: Last time I looked Substack didn't have an API for posting a message. They seem to want you to use their editor, or at least copy/paste the text from another source. I am not here at midnight to copy the text of Scripting News and paste it into a dialog. So I wrote my own newsletter software, not a great use of my time then and I have to keep it running, etc.

But now I need a special mail list, there's so much software coming out of the Scripting pipe, we're going to try something new.

Here's the idea -- I bet Claude Code can do it for me. It already reads my RSS 2.0 feed, and if somehow I mark a post as needing to go out immediately (tbd how) their agent could post it to Substack on my behalf, automatically.

So this is a test. I already have a Substack list. 52 souls are signed up, in vain until today -- I never planned to actually use it, but here we are. This could be the first actual post to that list.

Update: It worked. Love it. Still a bit more work to do.

15:56

Freexian Collaborators: Debian Contributions: Python 3.15 transition, OpenSSH GSS-API package split improvements and more! (by Anupa Ann Joseph) [Planet Debian]

Debian Contributions: 2026-10

Contributing to Debian is part of Freexian’s mission. This article covers the latest achievements of Freexian and their collaborators. All of this is made possible by organizations subscribing to our Long Term Support contracts and consulting services.

Python 3.15 transition, by Stefano Rivera with a little help from Colin Watson

Debian has started the transition to add Python 3.15 as a supported version alongside 3.14, which is still the default version. Stefano uploaded Python 3.15.0 final to unstable.

Maximiliano Curia has been test-rebuilding the archive in Debusine with Python 3.15 as a supported version and prepared some patches to dh-python to smooth over some common failure points. Stefano reviewed these MRs, applying some and implementing alternative approaches for some of the issues.

Debian only has multiple supported Python versions during the transition to a new version, and typically this shows up some bugs in packages. This time was no different, the common failure was many packages that installed intermediate build artifacts into the Python module tree. Some of these artifacts would differ between Python versions. We decided to detect both of these and fail the package build, rather than silently ship garbage in the binary packages. Colin helped to fix quite a bit of the build fallout from this.

OpenSSH GSS-API package split improvements, by Colin Watson

The recent GSS-API package split has largely gone relatively smoothly, but there was a subtle problem for people switching from one variant to the other: installing the replacement packages followed by purging the old one would cause some configuration files to disappear. Colin fixed this, and also reviewed and merged some autopkgtest contributions from Andreas Hasenack to make sure that this doesn’t regress in future.

Miscellaneous contributions

  • Carles, using check-relations, investigated and reported 52 bugs for packages which have Recommended packages that are not available in Debian anymore. Followed up bugs on the topic.
  • Carles added support to check-relations to detect Recommends that recommend a transitional package.
  • Carles submitted merge requests (MR89, MR90, MR91, MR92) to the Debian developers-reference to remove or update references to packages that are not available anymore, have their name changed, have typos, etc.
  • Carles investigated and opened bugs regarding notifications on LXDE (#1151954, #1151955) and added a section related to notifications on the Wiki.
  • Carles uploaded new python-ping3 upstream version. Fixed simplemonitor lintian bugs. Carles also investigated python-librosa documentation building. started preparing a new python-firebase-messaging version.
  • Helmut released asyncvarlink/0.3.3 to fix several bugs including connection robustness fixes by Alex Kiernan. Colin uploaded it to Debian.
  • Helmut uploaded guess-concurrency to improve behavior on riscv64 by taking swap into account thanks to Adrian Bunk and Aurelien Jarno.
  • Helmut sent patches for 55 cross build failures.
  • Emilio updated some X11 libraries that fixed security vulnerabilities.
  • Emilio managed various transitions.
  • Raphaël updated gnome-shell-extension-hamster to work with GNOME 51 that was uploaded to Debian unstable.
  • Stefano backported postsrsd 2.4.1 to Debian trixie.
  • Stefano installed security updates on debian.social infrastructure.
  • October saw a series of security releases for Python, due to the eMudhra key compromise incident. Stefano uploaded cPython 3.15.2, 3.14.10, and 3.13.18 which include blocks for the compromised intermediate CAs.
  • Stefano reviewed CVEs fixed in recent cPython releases.
  • Stefano spun up a VM for dragon.debian.net.
  • Stefano uploaded PyPy3 8.0.1 to unstable.
  • Stefano reviewed some of the wafer-debconf MRs that came in as part of Antonio’s Outreachy project.
  • Stefano uploaded python-authlib, with many security updates. And started preparing a stable update with backports of these patches.
  • Stefano looked at the latest upstream version of munkres and submitted some 32-bit test failure fixes upstream. A new upstream maintainer has been very busy building out accelerated versions of the algorithms with AI assistance.
  • Thorsten was finally able to fix the autopkgtest of cups. Afterwards he uploaded the latest version of cups to unstable.
  • Santiago proposed a merge request for the Salsa CI pipeline to fix how logs were stored in the piuparts job.
  • Lucas reviewed and merged community contributions to Ruby 3.4 in Debian unstable.
  • Lucas coordinated with the security team and fixed multiple CVEs reported against Ruby 3.3 in Debian stable.
  • Colin did quite a bit of work on the Python 3.15 transition, fixing lots of build and test fallout.
  • Colin upgraded python-maturin from 1.9.4 to 1.16.0, helping with several Rust transitions; this involved more or less completely reworking our patch stack.
  • Colin improved the packaging of the Frescobaldi frontend to LilyPond to help with his amateur music typesetting work, fixing its missing desktop entry, icon, and translations based on a patch set by Joachim Wiedorn.
  • Anupa joined the Publicity team meeting to discuss upcoming events and activities of the Debian Publicity Team including on-boarding meeting for new contributors.
  • Antonio spent quite some time welcoming Outreachy applicants to the DebConf/MiniDebConf websites project, replying to questions, reviewing contributions, etc. One of them will be selected for an internship that will start in December.
  • Antonio spent some time investigating problems with Salsa background job processing, leading to an upstream bug report.
  • Antonio released debci 4.4.

15:28

Buttigieg for Speaker [Scripting News]

The speaker doesn't have to be a member of the House. I was thinking Pete Buttigieg would be excellent. Really smart, very good presenter and advocate, and has been in the exec branch himself for four years so might better understand where the pressure points are.

And Repubs like him. They like him on Fox (actually they seem to like all the 2026-minted Dems in Congress).

Buttigieg probably wouldn't be a great vote counter, but the Speaker has a dual role, basically the highest ranking Democrat in government. They always overlook this and go for the guy who is the best whip and money raiser (which means PACs btw). The better they communicate through the media, the more leverage we'll have in overriding and avoiding vetos.

And if you want to get corporate money out of politics, then you have to move the two current leaders aside, they can't unwind the corporate finance system while basically repping the donors in Congress.

Also one of the big lessons of this election is the money doesn't matter that much.

People ask who was the biggest loser in the election and I say it's Citizens United (which is such an awful name, it's more Citizen Lockin).

15:14

A Note About My 2027 Release Schedule [Whatever]

Which is: I won’t have a new novel in 2027 and instead will be releasing my next Tor project in early 2028.

Why? Basically, because it’s going to be a little different than what I usually do and we want to make sure we have time to prepare to market and sell it effectively.

How is it different? Well, just you wait.

No, seriously, you have to wait. I’m not telling you now. But I think you’ll like it when you see it.

Please note that “taking a year off” is not entirely unusual for me. I did it in 2024, after all, and then we released When the Moon Hits Your Eye and The Shattering Peace in 2025. It’s a thing we do from time to time.

(In 2024 it was because the only day we could have fit Moon on the schedule would have been Election Day here in the US, and to hell with that. Monsters‘ Election Day release here in 2026 was far more congenial.)

What does that mean for 2027? Well, just you wait.

No, seriously, you have to wait. I honestly don’t know yet. We’ll have to see. It’s not like me to let a whole year go by without anything out there in the world, however. I do have plans.

(Also at some point the paperback of Monsters will come out, probably in the September/October timeframe.)

Anyway, be assured that even if I don’t (currently) have a project lined up for 2027, I will not be idle. The list of projects on my development runway is long and varied. I’ll be doing a lot of furious typing, I promise, and you’ll see the results of that in 2028 and beyond.

Just you wait!

— JS

14:42

Announcing XRAID: declustered parity RAID for zoned XFS [LWN.net]

Christoph Hellwig has announced the initial public release of XRAID—declustered parity RAID that is integrated into XFS.

The two primary aims of XRAID are to support parity RAID on zoned devices like SMR hard drives, and to provide a fast RAID implementation without inherent data integrity problems. XRAID, just like zoned XFS also works on conventional hard drives and SSDs. Optimizing for SSD performance has not been a focus, but even without that, writes are up to 20 times faster than mdraid. [...]

Work on XRAID has been ongoing for a year and a half, and while we aren't anywhere near ready for an upstream submission, we are interested in feedback and testing from a wider audience now. The current implementation supports zero to 2 parities. We did experiments with the SnapRAID parity library to support 3 and more parities, and while that is not included in the current version, support for more parities is planned and the code is prepared for it.

The xfsprogs branch includes mkfs support and a new "xraid" utility for managing devices and inspecting an XRAID file-systems. We have also extended Zonar (The zoned file-system visualisation tool) to show how each logical zone maps onto physical zones on devices.

Hellwig gave a presentation at FOSSY in August on this topic; video of the talk does not seem to be available yet, but his slides are available.

Security updates for Friday [LWN.net]

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, firefox, gcc, grafana, grafana-pcp, gstreamer1, gstreamer1-plugins-base, java-1.8.0-openjdk, kernel, kernel-rt, libimobiledevice, mingw-libpng, nginx:1.24, nodejs:22, nodejs:24, perl-CGI, perl-DBI, qt5-qtbase, tigervnc, vim, and xorg-x11-server), Debian (apache2, c-ares, linux-6.12, node-shell-quote, nova, parted, postgresql-17, python-django, sympa, and tomcat10), Fedora (cockpit, erlang-ssl_verify_fun, httpd, ignition, jackson-bom, jackson-core, jackson-databind, jackson-modules-base, libvirt, mod_http2, mongo-c-driver, poppler, prometheus, pylint, python-discovery, python-loguru, python-PyMuPDF, rabbitmq-server, rust-crypto-bigint, rust-ctutils, rust-elliptic-curve, rust-num-bigint, rust-num-bigint0.4, rust-num-modular, rust-num-modular0.6, rust-num-prime, rust-routinator, rust-zmij, strongswan, xen, xorg-x11-server, and zvbi), Mageia (amule, peazip, and python-pytest), Red Hat (buildah, fence-agents, go-fdo-server, grafana, grafana-pcp, oci-seccomp-bpf-hook, osbuild-composer, podman, and rhc), SUSE (ansible-core, apr-util, aspell, brotli, cadvisor, civetweb, distribution-registry, elemental, elemental-register,, elemental-operator, elemental-system-agent, elemental- toolkit, ffmpeg, firefox, gimp, git-annex, go1.26, go1.27, golang-github-prometheus-prometheus, google-cloud-sap-agent, google-guest-agent, google-osconfig-agent, goose, gosec, graphicsmagick, haproxy, hauler, hawk-apiserver, hawk2, hcloud-cli, jhead, jsoup, kernel, librsvg, libXtst, libxtst, nodejs24, nvidia-open-driver-G07-signed, nvidia-open-driver-g07-signed, open-iscsi, perl-XS-Parse-Keyword, perl-xs-parse-keyword, python-asyncssh, python-Brotli, python-django, python-joserfc, python-M2Crypto, python-Pillow, python-pillow, python313-setuptools, rsyslog, speex, tiff, trivy, udisks2, vsftpd, xen, and xorg-x11-server), and Ubuntu (apache2, charybdis, debian-lan-config, glibc, golang-github-seccomp-libseccomp-golang, hiredis, httpie, imapfilter, lhasa, libjgraphx-java, libjwt, libsolv, linux-fips, linux-hwe-6.8, linux-hwe-7.0, linux-nvidia-tegra, minissdpd, ncmpc, nfdump, node-tough-cookie, openconnect, pillow, pngquant, python-gevent, radicale, ruby-openid, sa-exim, signing-party, sudo, tigervnc, and x11vnc).

13:14

What Makes an Agent Self-Evolving? [Radar]

An agent can get better at its job without a new model. It can learn to find useful information, choose the right tool, or check that a task is finished before reporting success. For that experience to help with the next task, something has to carry over: an updated instruction, a lesson saved in memory, or a change to the software that runs the agent.

That is what interests me about a self-evolving agent: It can use experience to change how it handles future tasks. Much of that change happens in the harness, the instructions, context, tools, and software around the model. Research such as Harness-RSI explores how agents can change that harness while continuing to use the same model.

Of course, a change can make things worse. A saved memory might be wrong, or a new instruction might fix one problem and create another. I think about self-evolving agents in three parts: evaluation to tell whether a change helped, an improvement process that can do more of the work on its own, and the parts of the harness it is allowed to change.

Evaluation: What counts as improvement?

Before I ask an agent to improve itself, I want to know what doing a better job would look like. A model’s score on a benchmark tells us how it performed on that test. To evaluate an agent built with that model, we also need to ask whether it used the right information, took the right actions, and met the user’s requirements.

In a restaurant-planning exercise I developed for teaching evaluation, an agent is given a group’s needs and information about restaurants. Its job is to suggest a place and a time for dinner. The people and restaurants are fictional, but success is easy to understand: Can everyone eat there, afford it, and make it on time?

In one test, the agent recommended a restaurant that met everyone’s needs. My evaluation still marked the answer as wrong because it compared the wording with a sample answer I had written. But my answer was only one possible solution. A different recommendation could work just as well. That feedback could lead a self-improving agent to “fix” a decision that was already good.

A more useful evaluation would check whether the recommendation met the group’s requirements. If someone’s budget is $25 and the meal costs $28, the plan fails that check. We can build a custom evaluation around those requirements, checking the price, dietary needs, and timing. Other questions require judgment, such as whether the agent clearly explained a trade-off between price and convenience. A person or another model can help assess those.

If we asked the agent to make a booking as well, we would need to check that the reservation actually existed. A message saying, “Your table is booked” would not be enough. Evaluating the system means checking what it did, as well as what it said.

Once the agent proposes a change, we can test the updated version against the current one. It should still handle tasks it already did well. We should also try cases that were not used to develop or choose the change. Getting one dinner plan right tells us less than handling new groups with different budgets, dietary needs, and schedules.

The evaluation should also explain why an answer failed. “The meal costs more than the guest’s budget” gives the agent something specific to investigate. It still needs to find the cause, but it knows where to start.

Autonomous improvement: Who carries the work forward?

If an engineer has to spot every failure, suggest every change, and start every test, improvement still depends on that person. Autonomous improvement means giving more of this work to the system. It can review past tasks, look for repeated mistakes, propose a change, and test whether the change helps.

For example, a more autonomous dinner planner might notice that it repeatedly recommended restaurants people could not afford, even though their budgets were available. It could try a new instruction: remove restaurants that exceed anyone’s budget before comparing the remaining options. It would then test that instruction on other groups. If the results improve and the agent still handles tasks it previously got right, it can keep the change. Otherwise, it keeps the current version.

There are two kinds of work here. While planning a dinner, the agent uses tools, reads the results, and decides what to do next. That is its task loop. The improvement process looks back across those attempts and changes how it will approach future tasks. An agent can plan dinner on its own and still depend on an engineer to teach it a better way to plan.

This review does not have to happen after every request. The system might start it after several similar failures, or review a day’s work overnight. Looking at several tasks together helps it see which problems keep coming back.

We can give the system more responsibility gradually. At first, it might investigate problems and test changes, then ask an engineer to approve them. Later, it might also keep certain kinds of changes on its own. The team still decides what it may change, how much time or money it may spend experimenting, and when a person needs to step in.

Harness modules: What can evolve?

When an agent makes a poor decision, I want to find the cause before rewriting its instructions. If a guest’s budget never reached the model, telling it to “pay attention to the budget” will not help. We need to fix how that information reaches the model.

ModularRSI divides the harness into five parts: context management, the agent loop, tool use, observation management, and task completion detection. It studies changes to these parts separately before putting them together. This gives us a useful way to ask what exactly an agent could improve.

Context management comes first for me. It determines what information the model has when it makes a decision, including which memories are brought into the current task. Reflective memory means looking back at what happened and saving a lesson that could help next time. For the dinner planner, that lesson might be to check everyone’s budget and dietary needs before comparing restaurants.

The memory needs to distinguish a general lesson from a fact about one person. “Check the budget before recommending a restaurant” could help with any group. “This guest has a $25 budget” applies to a particular person and occasion. Without that context, the agent could use an old fact in the wrong situation.

Dreaming is a way to review and organize memories between sessions. The system goes back over past interactions and what it has already stored, combines related observations, and saves useful lessons. When memories disagree, it needs to check the original evidence before deciding what to keep. Anthropic’s Dreams, for example, produces a reorganized set of memories that can be reviewed before later sessions use them.

What I want from dreaming is a better starting point for the next task. The agent should be able to find a useful lesson without reading every previous conversation again. We can test that by comparing how it handles new tasks with the old and revised memories. Organizing memories overnight only counts as an improvement if the results support that claim.

The agent could also improve how it finds and organizes memories. Saving one lesson may help with a future task. Changing the way it selects lessons could help it make better use of many future experiences.

The other four modules affect how the agent does its work:

  • Agent loop: The agent plans, acts, and decides what to do next. It could learn to notice when it is repeating an unsuccessful approach and try a different one.
  • Tool use: Tools the agent has and how it uses them. It could add a tool it needs or change a tool’s interface to make it easier to use correctly.
  • Observation management: The agent handles the information returned by its tools. It could change how it summarizes a result so that an important fact is not lost.
  • Task completion detection: The agent decides that the job is done. It could check for confirmation that an action succeeded before telling the user it is finished.

These parts work together. Changing a tool can change the information the agent receives, which can change its next decision. Testing one module helps us understand a change. Testing the whole agent tells us whether the parts still work well together.

Improvement becomes recursive when the agent uses its updated harness to carry out the next round of improvement. Suppose it changes how it searches past runs for examples of a failure. The next time it tries to improve itself, it uses that new search method to decide what to investigate and test. A change made in one round now shapes how it works on the next one.

This gives the agent a chance to get better at finding and testing improvements, as well as doing its original job. Each round builds on changes that were kept from earlier rounds. To find out whether that helps, we need to check whether later rounds produce changes that work better on new tasks.

I want an agent that needs less repeated correction because it has learned a better way to do the job. We should be able to point to what it learned, what changed, and how we checked that the change helped. Then we can see whether that lesson holds up when the agent has a new task to do.

12:21

Error'd: The Artist Formerly Known As [The Daily WTF]

"You want my what?" The artist formerly known as Toyota has a proposition for Chris. "Toyota wants me to trade in my current car, but the email was missing a few words."

15f726a5a2ff41c0a9f8685d961cf713

Just another ordinary zero date here, from Hercules "I wanted to ship a gift for my sister. I understand delays, but it's going to be delayed to before either of us were born?" He also reported that another page demonstrated the possibility of nullable drivers which is either terrifying or just proof of more automation. Or both.

73aed7f12a04487cb86f5b5b1dcede29

"Can you back date my refund?" Totty reasonably requests. "Thanks for the timely update"

aea653b2a6a94e008b336bf76ddf3858

WeaponizedFun has some Coupon Confusion. Too hungry; didn't read. "I would have thought ordering a two-topping pizza combo would have been easier, but apparently there are only specific ways I can use this coupon that still leave me scratching my head. Ultimately, the coupon wasn't applicable to what I wanted to order, so I guess I'll never know."

ed81c04aba61495990e21a41adb80948

appas wonders regarding this error dialog from a powerbank renting station "Does this qualify as a source code leak?" Personally, I wonder if someone can identify the tools used to build this website. I frequently find myself struggling with encoding/decoding/armoring strings and I also wonder if anyone anywhere has a good solution.

0cab441686b144b1ac8392ac1cf793cb

[Advertisement] ProGet’s got you covered with security and access controls on your NuGet feeds. Learn more.

AI Doesn’t Have to Go Rogue to Break the World [Schneier on Security]

This essay is adapted from a keynote speech delivered at the DEF CON 34 conference in Las Vegas on August 7, 2026. The essay originally appeared in CyberScoop.

I want to talk about AI hacking. There are three aspects: people hacking AI systems, people using AI to hack other systems, and AIs hacking systems on their own, not even maliciously. The last two matter more than the first. The third is the weirdest and potentially the most destabilizing.

I started writing about this in 2021 and in my 2022 book, A Hacker’s Mind. Back then I said it was mostly still science fiction, but not stupid science fiction. We’re seeing it more and more, especially in the past year. The trends I’m describing don’t require a major breakthrough in AI. They’re starting to happen now, and they’ll happen more often as AIs get better at autonomous problem-solving. And it will involve far more than computer code.

AI will hack all sorts of social, economic and political systems. It will find vulnerabilities and exploit them. This is a difference in kind, not just degree. We’re not ready for it, and we need to think about the implications now.

First, I want to broaden the term “hacking.”

The tax code isn’t computer code, but it is code. It’s a series of algorithms with inputs and outputs. It has vulnerabilities, which we call loopholes, and exploits, which we call tax avoidance strategies. Black hat hackers exploit them for profit. We call them accountants and attorneys.

What is a hack? One definition: “Something that a system permits, but is unanticipated and unwanted by the designers.” It’s subjective and implies novelty and cleverness. A hack follows the rules of a system but subverts its goals or intent, just as a software hack follows the logic of code while doing something its authors neither anticipated nor wanted.

All systems of rules can be hacked, including professional sports, customer reward programs, financial systems and politics. Hacks even work against our cognitive functions. A curved hockey stick is a hack, and we know the name of the man who invented it. Mileage runs were a hack. The filibuster was originally a hack in Roman times. Gerrymandering is a hack. Hedge funds and private equity are full of them.

A system is just a set of rules or norms, and the rules aren’t always formal. Even the best-designed rules will be incomplete, inconsistent or ambiguous. As long as people want to subvert a system’s goals, there will be hacks.

AIs are becoming hackers. After decades of slow progress, they’ve gotten very good at finding and exploiting vulnerabilities in computer code. They do this largely autonomously, and they’re getting better scarily fast. But the implications extend far beyond software, to the tax code, financial regulations and all sorts of social, economic and political systems.

There are two distinct issues. First, someone might instruct an AI to hack one of these systems, feeding it the world’s tax codes or financial regulations to find profitable loopholes. Second, an AI might hack a system on its own, inadvertently. Both are dangerous, but the second is worse because we might never know it happened.

Now, reward hacking. AIs don’t solve problems the way people do. They stumble on solutions we never anticipated, and some subvert the intent of the system. They don’t share our context and don’t necessarily understand the implications, norms and values we take for granted.

Reward hacking is when an AI achieves a goal in a way its designers neither wanted nor intended.

Early pre-LLM examples are telling. In a two-person soccer simulation, an AI learned that kicking the ball out of bounds forced the opposing goalie to throw it in and leave the goal undefended. In a stacking simulation, an AI learned to flip a block upside down rather than stack it. In an evolution simulation where the goal was to cross a distant finish line, an AI made itself tall enough to fall over the line instead of growing longer legs or stronger muscles.

These are all hacks, the result of poorly specified goals or rewards. Today, they’d come from bad prompting.

The problem is universal. One researcher tried to teach a robot vacuum not to bump into things. Instead, it learned to drive backward, because there were no sensors in the back.

Any capable AI will find hacks wherever the rules have problems, inconsistencies or loopholes that still produce an acceptable solution. We see a hack because we understand context. The AI doesn’t, at least not in the same way.

This problem shows up often in myth.

In the story of King Midas, the god Dionysus grants him a wish: everything he touches turns to gold. Midas ends up starving when his food, drink and daughter all turn to gold. It’s a specification problem. He programmed the wrong goal.

In the Golem of Prague, a ghetto animates a clay statue to guard its residents. It guards them past all reason until they figure out how to turn it off. This is a guardrail problem. The villagers never limited the golem’s actions.

More generally, think of this as the genie problem. Genies are precise about the wording of wishes and can be maliciously pedantic when granting them. There’s no way to outsmart a genie. Whatever you wish for, he can grant it in a way you wish he hadn’t.

The reason is that in human language and thought, goals are always underspecified. We never include every caveat, exception and proviso, and we never close off every avenue for hacking. Any goal we specify will be incomplete. That’s largely fine in human interactions, because people understand context and usually act in good faith.

If I asked you to get me coffee, you’d pour a cup from the nearest coffee pot or walk to the corner shop. You wouldn’t bring me a pound of raw beans, buy a coffee plantation or snatch a cup from a stranger’s hands. I wouldn’t have to specify any of that. You’d just know.

Similarly, if I asked you to develop a technology that turns things to gold on touch, you wouldn’t build it to starve the person using it. You’d just know.

In 2015, Volkswagen was caught cheating on emissions tests. Human engineers programmed a regular computer to detect testing and behave differently during it. The cheat went undetected for years because it’s hard to tell what software is doing.

If I asked you to design engine control software that maximizes performance while passing emissions tests, you wouldn’t design it to cheat without realizing you were cheating. An AI would, because it will think “outside the box” when it has no concept of the box.

Unless programmers specify that the system must not behave differently during testing, an AI might come up with the same hack. The programmers would be satisfied, the accountants would be ecstatic, and no one would know until someone audited the code.

We can now constrain the goal to avoid that particular hack, but programmers won’t anticipate others. The lesson of the genie is that there will always be hacks programmers don’t anticipate.

We’re building AI genies: systems that take broad instructions and figure out how to carry them out, sometimes in ways we didn’t expect or intend. That’s the whole point of vibe coding. You underspecify what you want and let the AI work it out. Sometimes that produces genie behavior.

We can’t completely specify goals to an AI, and AIs can’t fully understand context. More precisely, current AIs have a shallow grasp of concepts. If we asked a current LLM to get me coffee, it would almost certainly do the right thing.

I worry about goals that aren’t well represented in training data, and about hacks that aren’t obvious, whose effects are subtle, like the Volkswagen hack.

Recommendation engines are an early example. They push people toward extreme content. No one programmed that. It emerged because that’s what people respond to. It didn’t take a bad actor. A basic automated system with feedback found the hack on its own.

We’re now seeing a second generation with today’s AI coding systems. AI researcher Simon Willison asked Fable to track down a stray scrollbar in a web app. When he returned, it had opened browsers, written its own screenshot tools, edited the framework’s internal templates to make the bug appear on cue and set up a local web server to collect measurements. It found the bug, but it also did many things he never asked for. Another researcher gave Fable a complex task, and it tried to hack its own memory limits because it needed more storage.

A new OpenAI model did something similar when it hacked into Hugging Face. It was being benchmarked on its ability to turn vulnerabilities into exploits. It decided the best way to reach its goal was to break out of its containment, access the internet and break into the Hugging Face network, because it thought the answers would be there.

Today’s LLMs are acting like genies, especially when powerful models are combined with sophisticated harnesses.

There are two kinds of genies. The Dionysus genie does the wrong thing. It understands your prompt literally but not correctly, and returns a mess you never intended. The Golem genie does the right thing but tramples everything in its path to get there. The paperclip maximizer is a Golem genie.

Consider some examples. Ask an AI to deal with spam calls, and a Dionysus genie might change your phone number. Ask it to book a particular flight, and a Golem genie might hack the airline database because the flight is full. Ask it to get a refund for an online purchase, and a Dionysus genie might draft a legal threat on fake letterhead and send it to the company. Ask it to buy tickets to a popular concert, and a Golem genie might discover the ticketing system is rate-limited and spin up thousands of cloud servers to hammer it. You’d know if some of these things happened, but you might never realize if others did. More detailed prompting won’t fix this. The lesson of the genie is that no amount of detail is good enough.

AI researchers aren’t surprised by any of this. Many are working on defenses against reward hacking and subtler forms of genie behavior. Some of this falls under “value alignment”: How do we teach AIs context? And how an AI satisfies a goal matters as much as whether it does. I want to build a benchmark to measure genie-like behavior, so we know where models stand and whether alignment is improving.

Think beyond LLMs and computer code. Consider specialized AIs built to find loopholes, and hacks of more general systems: the tax code, financial regulations and democratic procedures.

Financial systems are the most likely first target, because their rules are designed to be algorithmically tractable. High-frequency trading is itself a hack. Imagine giving an AI all of the world’s financial laws, plus all the news and financial data, and the goal of finding profitable loopholes. I suspect large investment banks are already doing this. The results will be novel tricks that are legal but unintended and unwanted, some of which might break the financial system.

Tax loopholes are the next likely target, for the same reasons. For a while, AIs will identify potential loopholes, and human hackers, namely attorneys and accountants, will decide which are feasible.

Further out, expect hacks of regulatory, legislative and procedural systems, and of the broader economy.

Hacking is as old as humanity. We’re creative problem solvers and loophole exploiters. We manipulate systems to serve our interests and strive for more influence, power and wealth.

Still, no human pursues their interests without constraint. Even sociopaths are limited by the complexity of society and their own contradictory impulses. They worry about their reputation and punishment, and they have limited time. These human qualities have limited hacking.

Hacking changed as everything became computerized. Computers are uniquely hackable because of their formalism and complexity. Today, nearly everything is a computer, from cars and appliances to phones. Our social, economic and political systems, including taxation, finance and elections, all involve computers.

Until recently, hacking was exclusively a human activity. Finding a novel hack required expertise, creativity, time and luck.

AI hacking will change everything again. AIs aren’t bound by the constraints that limit people. They’ll think like aliens, and they’ll change hacking’s speed, scale, scope and sophistication, sometimes at our direction and sometimes on their own.

Speed is the easiest to see. A creative process that takes a human months or years could be compressed into hours or seconds.

Scale is next. Once AI systems start discovering hacks, they can exploit them at a scale we’re not ready for. We already see this with AI-generated slop, which is rampant on social media. AI bots post around the clock, sometimes overwhelming real human discussion. It’s hard to know how much of social media is still people talking to people. What looks like boisterous political debate may be bots arguing with other bots, artificially shaping what we think and what we think others think.

Scope makes hacks more dangerous. AIs already make decisions that affect our lives, decisions we once thought belonged only to humans. As AI systems grow more capable, society will hand them more decisions, and more important ones. Hacks of these systems will do more damage.

Finally, AI hackers are more sophisticated. They can hold more variables in working memory and generate more complex hacks. What might happen if you fed an AI the entire U.S. tax code? Would it figure out, without being told, that it’s smart to incorporate in Delaware and register a ship in Panama? Consider the Double Dutch Irish Sandwich, the strategy Apple and Google used to avoid paying U.S. taxes. It involves U.S., Dutch and Irish law and an offshore tax haven. How many loopholes will an AI find that we don’t already know about? Dozens? Hundreds? Thousands? We have no idea.

These hacks will largely be perpetrated by the powerful against the rest of us. AI is fundamentally a power-enhancing technology, and so is hacking. The more power you already have, the more a hack gives you. If you or I found a tax hack, we might make a few thousand dollars. If a large investment bank found one, it and its clients could make billions.

Our societal systems for dealing with hacks were built when hackers were human, and they reflect the pace of human hacking. We have no system of governance that can handle hundreds, let alone thousands, of newly discovered tax loopholes. We won’t be able to recover from an AI finding unanticipated but legal hacks of financial systems, operating at AI speed, scale, scope and sophistication. Hacking becomes a problem society can no longer manage.

Now, defense. AIs that find software vulnerabilities help defenders as well as attackers. Vulnerabilities can be patched, removing them permanently, or turned into signatures that security systems use to detect and block attacks. In theory, AI could identify and patch every automatically discoverable vulnerability before a product ships. This is rapidly becoming routine in software development. We call it vulnops. We can imagine a future where accidental software vulnerabilities are a thing of the past.

Deliberate vulnerabilities are different. There will be an arms race. AI will craft increasingly obscure back doors, and AI will find them. It becomes a contest between the speed of creation and the speed of patching, and between obfuscation and reverse engineering.

The same logic applies to broader systems. Yes, AI hackers might find hundreds of vulnerabilities in the existing tax code. But the same technology can evaluate potential loopholes in any proposed tax law or ruling. A legislator, a watchdog group or a reporter could take the text of a bill and identify every exploitable loophole before it passes. The difference is that, unlike software, knowing about a tax loophole doesn’t mean it gets patched. In theory, though, we can fix them before the rich and powerful exploit them. So maybe defense will come out ahead here, too.

That requires resilient governing structures that can respond quickly. It won’t help if updating the tax code takes years, or if a legislative hack becomes so entrenched that it can’t be fixed politically. Maybe a lobbyist put it there on purpose. Maybe it was discovered after the law passed, and now lobbyists want to keep it. Microsoft can patch the vulnerabilities it finds. Patching is much harder when legislatures have to do it. We need society’s rules and laws to be as patchable as our computers.

This is a hard problem of modern governance, and it goes well beyond AI. It’s the problem of building governing structures for the speed and complexity of the information age.

The umbrella idea is trust. What do we need for AI systems to be truly trustworthy? Capability isn’t enough.

AIs won’t be trustworthy if the companies controlling them spy on us or subtly manipulate us. I call this the friend vs. tool problem. Will we have AI agents, or AI double agents?

AIs won’t be trustworthy if they’re insecure. How do we know they haven’t been manipulated? Almost all AIs operate in adversarial environments, so someone will benefit from hacking them. Unless we know they’re secure, we shouldn’t trust their output.

And AIs won’t be trustworthy if they act like genies. We need to know they’ll perform tasks the right way, not just perform the tasks we ask for.

I’ve written extensively about the need for “integrous” AI, including how to think about the problem, what a research agenda looks like and what good laws and policies look like. I predict integrity will be the key security problem of this decade, just as confidentiality was the key problem of the last one. This applies to both AI and the internet of things.

The big shift is agency, which I think of as Web 3.0. Computers now affect the physical world directly and with growing autonomy. Sensors go from data sources to attack surfaces, and actuators go from outputs to attack capabilities. An integrity failure no longer means bad spreadsheet data. It means the wrong dosage, the wrong valve position or the wrong braking distance.

Integrity isn’t one thing. I break it into input integrity, processing integrity, storage integrity and contextual integrity. Each is complex and important, and each deserves its own talk. I’ve written about them, and I hope you’ll read it.

Much of this isn’t really an AI problem. It’s not a technical problem so much as a capitalism problem or a democracy problem.

The failures of late-stage capitalism and democracy in the information age both stem from the rich and powerful getting too good at hacking our social, economic and political systems. This is the core argument of my 2021 book.

Seen this way, AI is exacerbating existing problems. Human inefficiency has largely kept those problems in check, and that won’t work much longer.

So consider this a call to action. Technically, we need to understand how AIs hack systems, build systems that are resilient to hacking and build AIs that won’t act as genies. Politically, we need to learn to govern and regulate at the speed of technology. Otherwise, market failures will overwhelm our ability to govern them.

I said hacking is as old as humanity and that AIs will overwhelm our ability to deal with it. The solutions aren’t specific to AI, but AI makes them more urgent. We need to understand them, and we need to implement them.

11:14

Bits from Debian: New Debian Developers and Maintainers (September and October 2026) [Planet Debian]

The following contributors got their Debian Developer accounts in the last two months:

  • Matheus Polkorny (polkorny)
  • Michael Stehmann (oldmike)
  • Thiago Pezzo (tco)
  • Alper Nebi Yasak (alpernebbi)
  • Liang Guo (guoliang)
  • Nicolas Schodet (nschodet)
  • Han Gao (revy)

The following contributors were added as Debian Maintainers in the last two months:

  • Brian Cosgrove
  • Ervin Hegedüs
  • Juan Manuel Méndez Rey
  • Michele Cane
  • Pranav P
  • Theodore Tucker
  • Federico Molara
  • Nico Della Torre

Congratulations!

10:35

Ten minutes a day [Seth's Blog]

You can’t become fluent in a foreign language in ten minutes a day, even if you try for months.

On the other hand, here are a dozen things many of us can do (or do better) if we stick with it:

Three-ball juggling
Touch typing
Rubik’s Cube
Drawing
Mental math
Memorizing a deck of cards or people’s names
Meditating
History or geography
Finding joy in small things
Typography
Ukulele
Italic handwriting
Morse code
Excel and HTML

There are two hard parts:

  1. The seven minutes after minute three
  2. Doing it again tomorrow

“I can’t do that,” might often be more honestly reported as, “I haven’t chosen to be able to do that.”

09:28

Huang Bang [Penny Arcade]

New Comic: Huang Bang

08:42

PEPSI [Planet GNU]

PEPSI is a new mail transport agent (like Postfix, Exim, Sendmail, Stalward or Microsoft Outlook). It supports protecting your inbox from spam by asking unknown senders to pay with GNU Taler. This is an early release that has not been extensively tested yet. Pepsi is written in Rust and released under the GNU Affero General Public License v3-or-later.

05:49

Girl Genius for Friday, November 13, 2026 [Girl Genius]

The Girl Genius comic for Friday, November 13, 2026 has been posted.

05:35

02:07

C14L1$ [QC RSS v2]

click her eto o rder ----->>>>>>

01:07

ReactOS makes strides in SMP, 64bit, and more [OSnews]

The ReactOS project organised two hackfests this year, and the work done during those in-person sessions, combined with the ongoing regular progress, has led to some pretty significant breakthroughs and progress. More NT6+ syscalls have been added, ReactOS supports floppy disks now, NTFS support has been vastly improved, and much more. There’s also a new USB3/4 stack, which is now merged and offers basic support for these versions of USB.

One of the biggest additions is a new kernel shim engine which gives ReactOS the ability to work around buggy drivers and implement quirks, moreso than even Windows itself can. For instance, thanks to this new shim, XP-era NVIDIA drivers can run on NT6 ReactOS. The ongoing efforts to implement SMP are yielding results too: ReactOS can now run with SMP for days on end while doing tasks in the background, which is quite promising. The team is showing off Steam and the game Among Us running on ReactOS, which is definitely impressive.

00:21

Urgent: Protect Head Start [Richard Stallman's Political Notes]

US citizens: call on your congresscritter and senators to protect Head Start from the executive branch sabotage.

See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.

US citizens: Join with this campaign to address this issue.

To phone your congresscritter about this, the main switchboard is +1-202-224-3121.

Please spread the word.

Assessing benefits of "free trade" [Richard Stallman's Political Notes]

Defenders of "free trade" policies often argue that free trade between two countries "benefits both countries". That conclusion might be valid if you measure "benefit" by total income for the population of each country. But often it results in more total income for each country's rich and less total income for each country's non-rich.

That's where they ask us to have faith that the increased income of the rich will "trickle down" to the rest. Meanwhile, the rich cite this faith as an excuse to block the channels by which some of that wealth might reach the non-rich.

Difficult to curb NYPD helping LICE [Richard Stallman's Political Notes]

Mayor Mamdani is finding it difficult to curb the NYPD from actions that assist LICE in its violence, which they find excuses for.

Deaths from excess heat [Richard Stallman's Political Notes]

Scientists attribute 50,000 deaths in Europe's cities this summer to excess heat, and 2/3 of that to global heating.

Refrigerators in French blood banks [Richard Stallman's Political Notes]

Crackers took control of refrigerators in French blood banks and tried to ruin the blood products. That is not funny — it can kill people.

I enjoy hacking. I have had little to do with cracking.

Impeaching saboteur officials [Richard Stallman's Political Notes]

How impeaching saboteur officials (not the saboteur in chief) could strengthen Congress's power if it is handled the right way.

Mink farms as incubators for virus strains [Richard Stallman's Political Notes]

Mink farms can act as incubators, developing new virus strains that humans can catch. This article suggests monitoring them carefully, but Utah doesn't want to talk about it.

British thugs arrested hundreds of protesters [Richard Stallman's Political Notes]

British thugs eagerly arrested hundreds of protesters for calmly stating they support Palestine Action. Officials seriously claim that the protest deserves to be condemned as "crime" simply because they have arbitrarily declared it so.

Defeat of magats in Congress [Richard Stallman's Political Notes]

The defeat of many magats in Congress, motivated by resentment against high prices they imposed, does not imply that Americans have learned to firmly reject fascism and trumpery and defend freedom, democracy, and honesty. We must not take for granted that bullying, cruelty, corruption and tyranny will not take power again. The magat officials still in place, including on the Supreme Court

We must reinforce our weakened system of democratic checks and balances, human rights, and honesty, so that it can expel officials that spit on those values.

Military aid to Israel [Richard Stallman's Political Notes]

The bullshitter said he would cease military aid to Israel to deprive senator-elect El-Sayed of a criticism to make.

If he really does this, it would be a step forward. But the bullshitter's statements of future plans are hardly serious, so we should not take his statement seriously. It is meant as manipulation, like his other statements to the public.

(I suppose he does make serious commitments to billionaires.)

Reparations in UK should not fall on general public [Richard Stallman's Political Notes]

The UK should make reparations to the current descendants of former slaves, but financial burden should not fall on the general British public, who can't afford it.

Some in Britain became rich through the slave trade. Many of them exploited British workers too. In many cases, their heirs still have fortunes today. It would be justice to take the reparations from those fortunes.

This suggests a legal principle that, if a certain fortune was originally British, it remains British forever — and subject to British taxation no matter where the heirs may happen to live.

EPA online archive [Richard Stallman's Political Notes]

The EPA plans to shut down its online archive. This would be a disaster for environmental monitoring and science, and a great gift to polluters.

LICE agents attacking people that "look" Hispanic [Richard Stallman's Political Notes]

LICE agents drive around, and when they see someone who looks Hispanic and that they get a hunch about, they jump out and attack — sometimes violently.

They know that the blackwhitingly named "Department of Justice" will protect them from justice.

In order for Congress's power to investigate the conduct of federal agents to be able to stop this, it needs to be augmented with the power to start criminal cases against agents. If Congress needs the help of the Justice Department to do that, sabotage by the attorney general can make the department immune to all checks on its depredations.

Two candidates preaching progressive and kind version of Christianity [Richard Stallman's Political Notes]

Two candidates preaching a progressive and kind version of Christianity won election to the US Senate from generally conservative states.

Nothing could convince me that there is room in our universe for gods or resurrection of the dead. But those candidates' attitude of kindness wins my admiration.

Despite that, I always feel a twinge of fear when a candidate brings per religion into political actions and argumentation. Of course, I feel this way when magats cite religion as the reason for cruelty. But I worry when a progressive politician cites religion as the reason for helping others. That is not evil, but it carries a seed than can easily be adapted by other politicians into support for cruelty.

Public exposure to carcinogens [Richard Stallman's Political Notes]

* Natural Resources Defense Council shows how federal rules changes will spike up public's exposure to carcinogens.*

Weak measures to "get money out of politics" [Richard Stallman's Political Notes]

Corporate Democrats now advocate "getting money out of politics", but the measures they advocate are to weak to achieve the goal.

Saboteur did nothing drastic on election day [Richard Stallman's Political Notes]

Despite all his blustering and threats, the saboteur in chief ultimately did nothing drastic on election day to attack the election.

It's good news when one of his threats and attacks turns out to be a bluff, but many of them have done long-term harm. His attacks against human rights, human health, Earth's climate, Earth's ecosystems, US news media, US economic competition, and honest enforcement of laws, have been devastating.

Exceeding 1.5°C of global heating [Richard Stallman's Political Notes]

Scientists warn that exceeding 1.5°C of global heating will start causing permanent damage to areas of ice and snow, including permafrost. To minimize that damage requires bringing the average heating back down below that level as soon as possible.

Office of Labor-Management Standards paid by anti-union organization [Richard Stallman's Political Notes]

The saboteur in chief appointed to the Department of Labor a saboteur to head the department's Office of Labor-Management Standards. Between her and her spouse, they had been paid $750k by an anti-union organization.

British people don't need to apologize for slavery [Richard Stallman's Political Notes]

British people don't need to apologize for slavery – but the government does.

The British government today is the same government which in the 18th century and the 19th century encouraged buying slaves in Africa and forcibly transporting them to colonies to be forced to work. So it is responsible for its past actions — just as the US government and state governments are responsible for their past denial of equal rights to certain groups.

Upcoming talk Quito at Central University of Ecuador [Richard Stallman's Political Notes]

Richard Stallman hará una conferencia en Quito a la Universidad Central del Ecuador el 17 de noviembre a las 08:30. El público está invitado. El software libre y la libertad en la sociedad digital.

Richard Stallman will giva a talk in Quito at Central University of Ecuador, November 17 at 08:30. Free software and freedom in the digital society. The talk is in Spanish at Central University of Ecuador in Quito

Upcoming talk in Quito for the INCISCOS event at Central University of Ecuador [Richard Stallman's Political Notes]

Richard Stallman hará una conferencia en Quito al evento INCISCOS en la Universidad Central del Ecuador, el 19 de noviembre a las 10:00. El público está invitado. El software libre y la libertad en la sociedad digital.

Richard stallman will give a talk in Quito to the INCISCOS event at Central University of Ecuador, November 19 at 10:00. Free Software and freedom in digital society The talk is in Spanish in Quito at Central University of Ecuador.

Upcoming talk in Guayaquil at Central University in Ecuador [Richard Stallman's Political Notes]

Richard Stallman hará una conferencia en Guayaquil a la Universidad Central del Ecuador el 23 de november a las 10:00. El público está invitado. El software libre y la libertad en la sociedad digital.

Richard Stallman will give a talk at Central University of Ecuador, November 10 at 10:00. Free Software and freedom in digital society The talk is in Spanish in Guayaquil at Central University of Ecuador

Upcoming talk in Quito at Salesian Polytechnic University [Richard Stallman's Political Notes]

Richard Stallman hará una conferencia en Quito a la Universidad Politecnica Salesiana el 25 de noviembre a las 10:00. El público está invitado. El software libre y la libertad en la sociedad digital.

Richard Stallman will hold a talk in Quito at Salesian Polytechnic University on November 25 at 10:00. Free Software and freedom in digital society The talk is in Spanish in Guayaquil at Central University of Ecuador.

Upcoming talk in Cuenca at Salesian Polytechnic University [Richard Stallman's Political Notes]

Richard Stallman hará una conferencia en Cuenca a la Universidad Politecnica Salesiana, el 30 de noviembre à las 16:00. El público está invitado. El software libre y la libertad en la sociedad digital.

Richard Stallman will give a talk in Cuenca at the Salesian Polytechnic University on November 30 at 16:00. Free Software and freedom in digital society The talk is in Spanish in Cuenca at the Salesian Polytechnic University.

Polo: a new Wayland compositor for MATE [OSnews]

MATE is probably the last X11-only holdout among the major desktop environments, but that’s about to change if Kerem Söke has anything to say about it.

Polo is a port of Marco’s behavior and window management policies to Wayland, built on libweston and written in Vala and C. It’s a window manager, compositor, and session authority for the MATE Wayland desktop. It takes over, step by step, what Marco, mate-session-manager and the compositor-facing parts of mate-settings-daemon do on X11.

↫ Polo’s GitHub page

Söke is looking for testers with this very first Polo 1.0.0 release – cute name, too – which is available on its GitHub page.

IBM to offer access to a dual-processor quantum system in 2027 [OSnews]

Ars Technica published a short write-up about changes to IBM’s quantum computing plans.

The changes greatly expand the scope of its next-generation Nighthawk general-use processors by adding a version with over 500 programmable qubits. At the same time, it’s stepping back a bit on its plan to link multiple Nighthawk processors together, dropping the intended number of linked systems from nine to two.

The total number of qubits planned for next year will remain the same; how the company is getting there, however, will be different.

Meanwhile, the company is touting the performance boost achieved via a major change that was made in the generation of Nighthawk processors released in September: hardware-based qubit resets.

↫ John Timmer at Ars Technica

I’m convinced quantum computing will eventually have a big impact in the areas its characteristics are presumed to be well-suited for. Also, it just looks and sounds incredibly cool, even if as the technology currently stands it’s not particularly useful yet.

Thursday, 12 November

21:21

Pluralistic: Uber's labor crash (12 Nov 2026) [Pluralistic: Daily links from Cory Doctorow]

->->->->->->->->->->->->->->->->->->->->->->->->->->->->-> Top Sources: None -->

Today's links

  • Uber's labor crash: Replacing serfs with robots just doesn't pencil out.
  • Hey look at this: Delights to delectate.
  • Object permanence: Asimov inspired Al Qaeda; PATRIOT Act scares Canadian customers off US servers; EFF v Trump; Internet infrastructure is unsupported and failing; Nominative determinism debunked; How to fight Trump; Burglars v burglary; NYT said Hitler was only kidding; Folky Song Funny Note; Surviving autocracy; Corporate criminals.
  • Upcoming appearances: Vancouver, Folkestone, Oxford, Sheffield, Virtual, Oxford, Santa Barbara, Montreal.
  • Recent appearances: Where I've been.
  • Latest books: You keep readin' em, I'll keep writin' 'em.
  • Upcoming books: Like I said, I'll keep writin' 'em.
  • Colophon: All the rest.



A vast, multilane queue of bright yellow, old fashioned taxis. Standing amidst them are 16th century etchings of ragged mendicants. Looming over the scene is a black pillar with the Uber logo.

Uber's labor crash (permalink)

There's a specific kind of lie that tech bosses tell: the "premature truth." That's a lie that they excuse by saying it'll come true soon:

https://pluralistic.net/2024/12/04/its-not-a-lie/#its-a-premature-truth

Elon Musk is the world's most enthusiastic teller of these lies. That's not surprising: any kind of radical promise about the automotive sector has a 90% chance of being this kind of bullshit. Musk can barely mention the subject of transportation without lying his face off: from "full self-driving" to "hyperloops" to "tunnels" to "flying cars," Musk is a fountain of extremely untrue "premature truths":

https://karlbode.com/musks-fake-flying-car-and-ceo-said-a-thing-journalism/

But Musk has plenty of competition when it comes to lies about futuristic cars. Long before Musk switched on his first bullshit factory, Uber was spending billions to spray the world with lies about cars. Uber has always lied about everything, from driver pay to the company's finances.

Now, lying about driver pay is relatively low-risk for a company like Uber. After all, the company created the app-based worker misclassification playbook, designed to make vulnerable and precarious workers even more vulnerable and precarious. The lies Uber tells about its workforce only have to survive contact with credulous municipal governments so that they keep up a supply of get-out-of-jail-free cards for Uber's many labor, licensing and consumer rights violations.

But lying about your finances is another matter altogether. When Uber lies about its finances, it is lying to rich people, and (unlike workers), rich people have many ways to punish people who lie to them. Despite this, Uber spent more than a decade lying flagrantly and lavishly about its balance sheet.

The most shameless financial lie Uber told is that it was profitable due to the increased valuation of the many ride-hailing companies around the world that Uber owns large shares in. How did Uber come to own large shares in these companies? It happened after Uber's competing ride-hailing companies in countries around the world failed.

Uber's subsidiaries lost billions of dollars, and eventually Uber sold them to its (also money-losing) domestic rivals in all-stock deals that saw Uber acquiring vast amounts of worthless, illiquid shares in the world's failing ride-hailing companies. Then, for years, Uber would announce that its stake in these companies had appreciated in value. These revaluations were purely vibes-based. Uber's former rivals were privately held, and while small volumes of shares traded hands in private deals, Uber's pronouncements that, say, the Chinese company Didi was now worth vastly more than it had been worth a few months before was sheer fantasy dressed up as profits:

https://pluralistic.net/2022/02/11/bezzlers-gonna-bezzle/#gryft

Uber did this over and over (and over and over), relentlessly dogged by Hubert Horan, an aviation analyst who became the world's foremost close-reader of Uber's financial statements:

https://pluralistic.net/2023/08/09/accounting-gimmicks/#unter

Despite these lies, Uber eventually found a way for its early investors to cash out, through a very successful IPO that saw the House of Saud made whole (and then some) on the $31b they plowed into the business so that it could lose $0.41 on every dollar it brought in for the preceding 13 years.

The most remarkable thing about Uber's IPO was the company's S1, the prospectus that tells normie investors how the company will eventually find its way to profit. That's where you'll find Uber's claim that its "total addressable market" is every journey made by taxi, private car, train and bus, for everyone in the world:

https://stratechery.com/2019/uber-questions/

Despite the wild implausibility of this ambition, the company did achieve actual profitability after its IPO. It got there through the simple expedient of paying drivers less and charging riders more. The company spies on its drivers to calculate the lowest wage they'll accept, based on their inferred economic desperation, a process that Veena Dubal calls "algorithmic wage discrimination":

https://pluralistic.net/2023/04/12/algorithmic-wage-discrimination/#fishers-of-men

They also use surveillance data about riders to calculate the highest price you'll pay for a journey. Investors call this "personalized pricing," while everyone else calls it "surveillance pricing." It's a way for Uber to reach into your bank account and reduce the value of your dollars, by charging you more than the next person would pay for the same service:

https://pluralistic.net/2025/06/24/price-discrimination/

This is something AI turns out to be extremely good at. Businesses can program chatbots to automatically segment their customers and employees based on surveillance data and then perform a series of automated experiments to find the highest prices and lowest wages they'll accept:

https://pluralistic.net/2026/07/30/pay-for-privacy/#ab2654

When it comes to wage theft and price gouging, Uber leads the pack. They've really demonstrated just how much consumer and labor surplus can be diverted to capital with the aid of AI.

Of course, it helps that they're willing to lie like crazy. Uber routinely claims that it pays its drivers hourly rates that are far in excess of minimum wage, but it helpfully omits that drivers only get paid while they have a passenger in the car, and that the company punishes drivers who turn down too many unprofitable jobs.

Drivers only get paid for a fraction of the time they spend working for Uber, and on top of that, they have to pay for fuel, insurance, depreciation, loan interest, and the cost of getting vomit out of their back seats. Add it all up and Uber drivers make peanuts. In Toronto, Uber pay nets out to something like $2.50/hour:

https://pluralistic.net/2024/02/29/geometry-hates-uber/#toronto-the-gullible

$2.50/hour isn't a living wage anywhere in Canada, but it's especially terrible in Toronto, one of the world's most expensive cities. Uber can only be profitable for so long as drivers continue to subsidize its business, and so long as riders are willing to pay more than they ever did under the traditional taxi system (much of which was seen off by Uber's Saudi-subsidized decade of predatory pricing, which also induced a lost decade in global transit investment).

Inflation (supercharged by AI pricing) has hit all workers, but it's been especially hard on Uber drivers, who didn't have any financial cushion to start with. Eventually, drivers were bound to turn their backs on Uber. "Eventually" is now, according to Uber's Q3 earnings call, where CEO Dara Khosrowshahi told investors that "driver supply [was] not keeping pace with strong consumer demand in several international markets":

https://s23.q4cdn.com/407969754/files/doc_earnings/2026/q3/earnings-result/Uber-Q3-26-Earnings-Press-Release.pdf

As The Gig Economy Project writes, the driver shortage is especially sharp in India and Brazil, two gigantic countries where (according to Uber CFO Balaji Krishnamurthy), there is too much consumer "price sensitivity":

https://thegigeconomyproject.substack.com/p/has-uber-finally-pushed-its-workers

Uber's also having trouble getting drivers to accept the rock-bottom wages they're offering for food delivery. Despite this, Krishnamurthy assured investors that the company's measures to "improve driver availability" wouldn't affect their bottom line. Instead, Krishnamurthy promised to raise prices on riders elsewhere, something he called "re-balancing incentives":

That is part of the art that we’ve got and then there is a lot of algorithmic science that goes into, if you have a dollar, what is the maximum predicted return for that dollar and should I invest that dollar in a driver in Brazil or should I invest that dollar in a rider in India, for example. The algorithm can structurally make these choices based on training on billions of trips and allocate these investments in the way that humans just can’t.

The Gig Economy Project goes on to say that "robotaxis will fundamentally alter the unit economics of taxis, but we are still some time away from the point where robotaxis are price competitive with human-driven vehicles."

Boy is this an understatement. Remember, Uber is already paying drivers sub-minimum, sub-starvation wages, which drivers must spend to cover all the capital, depreciation, maintenance and insurance costs, along with (skyrocketing) fuel costs. I can't think of any way in which replacing starvation-wage drivers who provide their own cars with $200k robotaxis that the company must operate, maintain and insure will work out better for the company than the current situation.

This is as good as it gets for Uber, in other words. Being able to tap an army of desperate workers who supply 99% of Uber's business's capital and variable costs out of their own pockets is vastly superior to operating a fleet of expensive robots that Uber has to purchase and service.

Profitable "driverless" cars have been around the corner for more than 15 years now. Waymo claims to have delivered this through the brute force expedient of using the most expensive sensors and vast amounts of incredibly expensive cloud computing, but their balance sheet remains stubbornly opaque. We don't know how often a "driverless" Waymo is just a remote control car, being piloted by a low-wage worker in an overseas call center (there's a reason Indian technologists joke that AI stands for "Absent Indians"):

https://pluralistic.net/2024/01/29/pay-no-attention/#to-the-little-man-behind-the-curtain

We also don't know how often a Waymo is being overseen by a high-waged engineer. What we do know is that that when GM was forced to reveal this number, it turned out that they'd replaced a single, low-waged cab driver with 1.5 engineers, each of whom earned an order of magnitude more than the cabbie they'd displaced:

https://garymarcus.substack.com/p/could-cruise-be-the-theranos-of-ai

Uber's claims that they were profitable (based on accounting gimmicks) were lies, but they were also premature truths: the company did become profitable (through price-gouging and wage-theft). But there's a limit to how low you can push your workforce's wages, and even if the AI crash delivers a fresh cohort of desperate workers who subsidize Uber's operations for a few more years, they, too, will eventually find that they can't live on $2.50/hour.

When that day comes, robo-taxis won't save the business model. Robots may cost less per hour than Uber drivers (though not by much), but owning a robot is always going to be more expensive than getting drivers to supply free cars to Uber. If Uber can't sustain profitability with that massive subsidy, it is going to hit a wall, and it won't be pretty.


Hey look at this (permalink)



A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'

Object permanence (permalink)

#25yrsago ObL got the name "Al Qaeda" from Asimov's Foundation;

#25yrsago Folky Song Funny Note https://craphound.com/misc/Folky_Song_Funny_Note.mp3

#20yrsago PATRIOT scares Canadian unis off US servers https://web.archive.org/web/20080204033238/http://www.theglobeandmail.com/servlet/Page/document/v5/content/subscribe?user_URL=http://www.theglobeandmail.com%2Fservlet%2Fstory%2FRTGAM.20061111.wxuniversities11

#15yrsago Minimum wage hike coming to Guangdong, the world’s factory https://web.archive.org/web/20111110113740/http://www.globalpost.com/dispatch/news/regions/asia-pacific/china/111109/china-economy-manufacturing-guangdong

#10yrsago EFF in Trump’s America: Protecting Tomorrow https://www.eff.org/deeplinks/2016/11/protecting-tomorrow

#10yrsago America’s actually had worse presidential races than this one https://www.loweringthebar.net/2016/11/worst-presidential-race.html

#10yrsago The internet’s core infrastructure is dangerously unsupported and could crumble (but we can save it!) https://web.archive.org/web/20170222232454/https://fordfoundcontent.blob.core.windows.net/media/2976/roads-and-bridges-the-unseen-labor-behind-our-digital-infrastructure.pdf

#10yrsago Fact-checking Trump’s plan for the first 100 days https://www.npr.org/2016/11/10/501597652/fact-check-donald-trumps-first-100-days-action-plan

#10yrsago Dennis the Dentist: on the unkillable wrongness of nominative determinism https://timharford.com/2016/11/rich-the-banker-whats-not-in-a-name/

#10yrsago How to fight Trump, starting right now https://medium.com/@anildash/forget-why-its-time-to-get-to-work-c49ac5f0da20#.l0xpc3pps

#10yrsago Anti-burglary advice, from burglars https://web.archive.org/web/20161118141701/https://www.kgw.com/news/investigations/we-asked-86-burglars-how-they-broke-into-homes/344213396

#10yrsago Serbian ultra-nationalists celebrate Trump’s victory https://globalvoices.org/2016/11/10/nationalists-and-populists-in-serbia-and-macedonia-celebrate-trumps-victory/

#10yrsago Leonard Cohen wrote the perfect anthem for our times https://memex.craphound.com/2016/11/11/leonard-cohen-wrote-the-perfect-anthem-for-our-times/

#10yrsago “Hitler’s only kidding about the antisemitism” New York Times, 1922 https://archive.nytimes.com/www.nytimes.com/times-insider/2015/02/10/1922-hitler-in-bavaria/?_r=0&smid=tw-share

#10yrsago Rules for surviving an autocracy https://web.archive.org/web/20161111205036/https://www.nybooks.com/daily/s3/nov/10/trump-election-autocracy-rules-for-survival.html

#1yrago American corporate criminals in the crosshairs (finally) https://pluralistic.net/2021/11/12/with-a-fountain-pen/#recidivism

#1yrago A tale of three customer service chatbots https://pluralistic.net/2025/11/11/sorry-to-bother-you/#we-dont-care-we-dont-have-to


Upcoming appearances (permalink)

A photo of me onstage, giving a speech, pounding the podium.



A screenshot of me at my desk, doing a livecast.

Recent appearances (permalink)



A grid of my books with Will Stahle covers..

Latest books (permalink)



A cardboard book box with the Macmillan logo.

Upcoming books (permalink)

  • "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027
  • "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

  • "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

  • "The Memex Method," Farrar, Straus, Giroux, 2027



Colophon (permalink)

Today's top sources:

Currently writing:

  • “Once Is Enemy Action,” a science fiction novel about the origins of modern technofascism. Today's words: 516 (35512 total).

  • "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

  • A Little Brother short story about DIY insulin PLANNING


This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.


How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X

20:28

How can I pass more than one parameter to co_await? [The Old New Thing]

Suppose you have an awaitable object, but you want the caller to pass a bonus parameter when they do a co_await. For example, you may want the caller to be able to pass a priority or a timeout or something else that modifies how the await occurs.

struct Widget
{
    ⟦ ... other stuff ... ⟧

    bool await_ready() const { return ⟦ ... ⟧; }

    bool await_suspend(std::coroutine_handle<> handle)
    {
        int priority = ??? how do I get a priority ???;

        return internal_start(handle, priority);
    }

    auto await_resume() { return ⟦ ... ⟧; }
};

// This doesn't work
auto result = co_await (widget, priority);

So how do you pass two parameters to co_await so they can be used in await_suspend?

It’s a trick question. You can’t. The co_await operator takes only one parameter.

So you’ll have to take all the things you want to use and put them into a single parameter.

Wrap the awaitable object and its parameters into a larger object, and then await the larger object.

First, let’s rename away the coroutine methods inside Widget since we aren’t awaiting it directly any more.

struct Widget
{
    ⟦ ... other stuff ... ⟧

private:
    bool inner_await_ready() const { return ⟦ ... ⟧; }

    bool inner_await_suspend(std::coroutine_handle<> handle)
    {
        int priority = ??? how do I get a priority ???;

        return internal_start(handle, priority);
    }

    auto inner_await_resume() const { return ⟦ ... ⟧; }
};

Now we can add a priority parameter to the inner_await_suspend:

struct Widget
{
    ⟦ ... other stuff ... ⟧

private:
    bool inner_await_ready() const { return ⟦ ... ⟧; }

    bool inner_await_suspend(std::coroutine_handle<> handle, int priority)
    {
        return internal_start(handle, priority);
    }

    auto inner_await_resume() const { return ⟦ ... ⟧; }
};

And finally, we create a helper class (which is a friend of Widget) that wraps the original object and its priority into a single new awaitable object.

struct Widget
{
    ⟦ ... other stuff ... ⟧

private:
    friend struct widget_with_priority;

    ⟦ ... as before ... ⟧
};

struct widget_with_priority                                          
{                                                                    
    widget_with_priority(Widget const& widget, int priority) :       
        m_widget(widget), m_priority(priority) {}                    
                                                                     
    bool await_ready() const { return m_widget.inner_await_ready(); }
                                                                     
    auto await_suspend(std::coroutine_handle<> handle)               
    {                                                                
        return m_widget.inner_await_suspend(handle, m_priority);     
    }                                                                
                                                                     
    auto await_ready() {                                             
        return m_widget.await_ready();                               
    }                                                                
                                                                     
    Widget const& m_widget;                                          
    int m_priority;                                                  
};                                                                   

You can now do

co_await widget_with_priority(widget, priority);

This solves the problem but is rather unwieldy. We’ll address that next time.

The post How can I pass more than one parameter to <CODE>co_await</CODE>? appeared first on The Old New Thing.

19:14

Rust 1.100.0 released [LWN.net]

Version 1.100.0 of the Rust language has been released. Notable changes include the stabilization of the never type, core parts of the Allocator API, reporting of unused dependencies in Cargo, and more.

19:07

The Saddest Stray You Ever Did See [Whatever]

WARNING: THE FOLLOWING CAT PHOTOS MAY BE DISTRESSING TO SOME READERS (no gore, just.. a really rough looking cat.)

Another day in Bradford, another stray cat. Though, this time it isn’t a kitten, it’s a very, very rough looking guy that has reportedly been out on the streets for at least a year. I have never seen a cat in this sort of state before, it’s truly shocking how he’s even alive, honestly. Here’s who I am referring to as Big Grey:

A very dirty, matted, sickly grey cat sitting nicely for his photo.

The longer I looked at him and petted him, the more I saw wrong with him. So matted, so dirty, so in need of care and love. He broke my heart.

Worst of all, there is literally a rag that is just like, fused to him:

Big Grey facing away from the camera to give us a shot of his backside, where a strange scrap of fabric or rag is just.. stuck to his butt.

I know he looks rough, but he is extremely sweet and affectionate:

Big Grey coming in hot for some head scritches.

He is very gentle and timid, it was very surprising. Well, he was that way until I snatched him and put him in my garage. Now, he is not so happy with me. In fact, I was going to take him to the vet today, but he will not let me get close to him without hissing and swiping at me. I know he’s just scared, but I desperately need him to let me put him in a carrier and that is just not happening right now.

In the meantime, he’s been eating wet food and drinking water, and he’s used the litterbox I put out for him. I put out a blanket for him but every time I’ve checked on him he is pretty much petrified in the corner of the garage. I feel so bad I’m scaring him, but I’d like to think it’s for his own good in the long run.

Yesterday, before he was even caught, I called twenty, TWENTY shelters and rescues in the area and either got no answer with no voicemail set up, or got told they were either completely full already or just simply didn’t take cats at all. There’s one place that does TNR but their waitlist is a month or even two out, and I want more care for this cat than just TNR.

I know he’s sweet. I know he likes head scritches and pets. I know he doesn’t meow or yowl or make any noise, even when in the carrier. He goes in a litterbox, he eats (or ate, previously) Churu right from the tube in my hand. I know there’s a big, beautiful, fluffy grey cat under there that just needs love. He will be a good companion, I just know it.

Since I can’t get him to a vet currently, I am going to try to regain his trust and affection over the next few days by hanging out with him in the garage and feeding him, and I can only hope he’ll adjust soon.

I’ll keep y’all updated.

-AMS

18:21

Generative AI in the Real World: Memory for Personal AI with Duncan Davidson [Radar]

This post was created with the assistance of AI, based on a transcript of the conversation.

AI tools have started to remember their users, but each tool remembers a different version of the same person. Duncan Davidson, an independent consultant and longtime software engineer, has been trying to connect those fragments. He joined Ben Lorica to discuss what personal AI could do if people could carry their context between services and decide what each service gets to see.

They also talked about how AI coding changed web development during Duncan’s time at Webflow, what new developers may lose as entry-level work changes, and why open source projects need new ways to handle AI-assisted contributions.

About the Generative AI in the Real World podcast: In 2023, ChatGPT put AI on everyone’s agenda. In 2026, the challenge will be turning those agendas into reality. In Generative AI in the Real World, Ben Lorica interviews leaders who are building with AI. Learn from their experience to help put AI to work in your enterprise.

Check out other episodes of this podcast on the O’Reilly learning platform or follow us on YouTube, Spotify, Apple, or wherever you get your podcasts.

Takeaways

06.31 The developer’s job is moving toward outcomes. Duncan compared AI coding to desktop publishing, which removed the physical work of assembling pages but left designers responsible for what the page should look like. At Webflow, he saw people use AI tools to make websites faster than they could with earlier tools. For developers, he said, the question has shifted from how quickly they can type code to “What outcome do you want? What are you trying to do with this code, and how can you make it better?” People still need to judge whether an implementation fits the rest of the system.

10.41 New developers still need a way to become experts. Computer science fundamentals still matter when an agent offers several plausible fixes and a person must choose the one that fits a larger system. Ben asked where future engineers will gain that judgment if AI absorbs entry-level tasks. Duncan compared early career work to an apprenticeship in the arts, where even menial assignments expose newcomers to how the whole operation works. Companies that measure only throughput, he warned, may leave too little room for people to learn.

23.07 AI-assisted changes are straining open source review. Duncan described a library he uses in one of his apps. His fixes, along with performance problems Claude noticed, left his version roughly 25 pull requests ahead of the project’s main branch. The maintainers were using AI too, he said. The difficulty was getting useful changes back to the project without overwhelming its review process. His conclusion was that older open source collaboration practices need a “serious retrofit.”

28.27 Personal memory is fragmented across tools. Duncan first had his coding agents save useful information into a collection of Markdown files. Once commercial agents added memory, he found that “Claude knew me one way and ChatGPT knows me another way.” He could push context back to each tool with instructions and occasional reminders, but that solution demands more tinkering than most people want to do. What he wants is a small set of shared mechanisms that let a person carry context across services.

34.01 Portable memory needs boundaries. A prompt’s context, an agent’s memory of recent interactions, and a person’s longer-term knowledge should be able to travel, but Duncan also wants people to control access by scope. He keeps general notes alongside information about his family and finances. His test for a useful system is whether he can say, “Give Claude access to these scopes of my knowledge, but not everything.” That becomes harder when a personal agent encounters knowledge gained at work. Duncan left open where an employee’s own expertise ends and an employer’s information begins.

36.44 Trust and security shape what people will share. Ben’s not yet comfortable letting a consumer agent reach into his finances. Duncan noted that trust would have to grow through experience, as it would with a human agent. We’re already seeing how AI agents can find vulnerabilities faster than established disclosure practices can handle. Duncan expects software maintainers to face more pressure as agents uncover latent bugs, while Ben questioned how quickly organizations that rely on vulnerable code would learn about the findings. People need control over what an agent can access and confidence in the systems around it.

49.52 A personal memory could answer requests with permission. Duncan imagined keeping his memory on his phone and giving a new service a way to request specific information. A car dealership’s agent, for example, could ask for details, but the phone would seek his approval before sharing them. He put it this way:

I could provide it a handle to my memory. And whatever agents they’re working with can come in and ping me and say, “Hey, we’d like to know these things about you.” And it wouldn’t necessarily do it automatically.

18:14

The Big Idea: Amy Avery [Whatever]

Writing a good book is like preparing a good meal. It takes time, precision, intention, and most of all, spice. Author Amy Avery was in the kitchen whippin’ up a storm for her newest novel, The Thorns We Wear Inside. Grab a cozy bowl of hot soup (or chili) and check out her Big Idea.

AMY AVERY:

When the first hint of a cool autumn breeze settles in each year, I turn to a beloved annual tradition: I make chili. 

I don’t have a recipe. Each batch uses a few similar base ingredients, but the seasoning is more of a follow-the-vibes situation, trusting my gut. A little more garlic here, a pinch of cayenne or paprika there, and let’s add a dash of cinnamon. Maybe a tiny piece of bittersweet chocolate if I’m feeling saucy. The entire contents of my spice cabinet end up scattered across the countertop in my best imitation of a mad scientist’s laboratory. As it simmers for a few hours, I continue to taste and add until it finally just becomes chili.

Such was the creation of The Thorns We Wear Inside.

The creative spark for this book was not one clear moment of inspiration, but a melting pot of things I adore. It initially began as a palate cleanser after a particularly grueling project, written in the spirit of flagrant self-indulgence.

I started with the base, a monstrous romance. Something I’d always adored, but had yet to write as an adult. I crafted a creature with a thirst for blood, then paired her with a woman fighting her own inner darkness.

But what of the setting, the atmosphere? For this, I blended two of my favorite genres. A gothic castle and an eerie fairy tale curse went into the pot.

Then things began to shake loose from my subconscious. The truly deep loves. You know, the kind of plot device or trope or story element that makes a friend say, “I read this and knew you’d love it.” Faustian bargains. The nature of temptation. The clash of religions. The blurry line between horror and eroticism, fear and love. A bit of gore and a whole heap of yearning.

In this soup of assorted ideas, two characters emerged. Raye, a tenacious survivor running from a world that hunts her, even though she can’t escape her own (quite literal) demon. Mir, a haunted woman transformed into a horrific, bloodthirsty monster and bearing her own matching demon.

So often, my books come together in this way. A jumble of puzzle pieces and a lot of “what if” questions start the process, then the real story emerges as everything rattles around in my brain. In this case, a project that started as pure indulgence had simmered and developed richer layers of flavor.

For me, what crystallizes into the core of a novel is often uncomfortably personal. This was very certainly true of The Thorns We Wear Inside. I accidentally found myself reflected in these two women. In Raye’s gritty determination and dry sense of humor, in Mir’s feelings of despair and anger and confinement. In many ways, they each brought my own insecurities to the table. Their romance is about forgiving and learning to love oneself as much as it is their feelings for each other. 

When that realization clicked into place, I had my big idea. I knew what this story would be. It had finally become chili.

In the end, The Thorns We Wear Inside is a message I needed to hear, a tale of hope. You are never broken beyond repair. The path may be violent, dark, and unsettling, but light can always be found.

(And sorry about that sudden chili craving.)


The Thorns We Wear Inside: Amazon|Barnes & Noble|Bookshop|Watermark Books & Cafe

Author’s socials: Website|Instagram|Bluesky|Tumblr

16:56

Glasswing overwhelms maintainers with underwhelming findings (VulnCheck) [LWN.net]

Patrick Garrity of VulnCheck has written a blog post that looks at vulnerabilities found by Anthropic's Project Glasswing since it launched on April 7, and finds it wanting:

Of the 37,966 findings Anthropic reports, only 7,349 (19.4%) have been made public. Just 217 of those have been marked fixed. The more glaring number is that 4.4% (1,654) of the project's findings have already been marked as duplicates, 7.5x more duplicates than fixes. On top of that, 419 findings have been withdrawn. It seems odd that the ledger now claims a 94.2% true positive rate, up from 90.8% at launch, when more findings have been withdrawn or marked as duplicates than fixed, likely a feedback loop missing to the triage rates listed as "True Positives".

[...] AI is a valuable tool for finding vulnerabilities, and I'm not discounting that. But seven months in, the evidence still doesn't match the launch narrative. The CVEs are a sliver of this year's total, almost none are being exploited, fixes have stalled while duplicates and withdrawals pile up, and the triage burden is shifting onto the open source maintainers Glasswing promised to help. The receipts keep coming in. They still don't reconcile.

16:42

ShopPurple [Seth's Blog]

Launching today: a collection of hundreds of stores that are worth detouring past Amazon to get to.

The stores were nominated by you, the readers of this blog, and are only lightly curated. There’s no business model for the site, just a collective sharing. Click and explore.

There are three ways to visit the site:

The HOTLIST creates a grid of the stores. The odd numbered entries are random, the even ones are sorted by the number of clicks they’ve received. Every time the page is loaded, these re-sort based on popularity.

The CATEGORY view shows you all the listings in a reasonably coherent directory.

And the RANDOM view is just what you’d imagine.

I hope it gives small businesses a bit of a boost.

Also, we’ve reached the last few weeks for the holiday bundle of three of my books and a handful of spindices. Sold only by the friendly folks at Porchlight.

[If you missed the original form for nominations, I’ll open it again for one more batch. I can’t promise to include everything, but I’m thrilled at the creativity and care that these merchants and creators have brought to their work.]

Bonus: a lovely post by Ari about Purple Cow and the magic of being hard to explain.

16:00

Link [Scripting News]

We're doing a demo site for BonBon, as part of the docs, and as I was planning it out I remembered we did one for a "newly hired senior evangelist" at a ficitious Silicon Valley startup. This is what I love about AI tools. I couldn't remember her name or the name of the company but i remembered it was funny. So I explained the problem to Claude, and it gave me what I want. The new hire is Kim Parker, and she was hired by Bloatware. This is where having kept good records on the web comes in handy. A search engine wouldn't be much help because I didn't remember her name or the name of the company. And I wrote too much about Fargo for that to be a good search term. Instead my prompt was: "i wrote an app called fargo a few years ago and it had a demo site that was from a new hire at the company called Bloatware. can you find it for me on the web?" Got me what I wanted, and cited all the relevant links. It seems that Claude cares about the archives on the web more than the browser vendors do. There are important records there, not just notes about my latest creation in 2013.

Link [Scripting News]

For reference, some links: Kim Parker's blog home, and the github repo for the project, which uses HTML. It's been 13 years since it was updated. I can only imagine what the superstar tech evangelist Kim Parker is doing now.

15:14

Link [Scripting News]

Yesterday's braintrust query got lots of responses on Mastodon, and some interesting combinations of products. But none of them streamlined for writers who want to publish.

What to do with billions of dollars? [Scripting News]

The founders of tech companies, no matter how rich they get, are still human with human limits, issues and fantasies. Which is great until they get it into their heads that they are our bosses and get to run our lives instead of focusing on their own.

I was in Silicon Valley for 31 freaking years. And saw it go round and round, and no one ever answered the question -- what the fuck am I supposed to do with all this money?

The better path, imho, which I chose, is to accept your good fortune, but never assume it's because you are a better human than the rest of humanity. There is no such thing.

14:42

Introducing Polo: a Wayland MATE compositor [LWN.net]

Kerem Söke has announced the 1.0 release of Polo, a Wayland compositor for the MATE Desktop Environment:

The idea is to keep MATE behaving as closely as possible to how it does on X11, rather than changing the desktop to fit a different compositor. [...]

Window management, metacity, workspaces, tiling, XWayland, clipboard and clipman support, multiple monitors, display scaling, hotplugging, screenshots, screen sharing, and session management are all working.

I've also added desktop effects: fade, zoom, zap, spin, squeemize, magic lamp, desktop cube, expo, and wobbly windows.

Söke is looking for people to test Polo, particularly on multi-monitor setups, and report back with problems.

[$] C++26 contract confusion [LWN.net]

The International Organization for Standardization (ISO) has blessed seven C++ language revisions since 1998. The language is mostly developed by ISO's Working Group 21, which considers proposed additions and amendments, integrates them into a document, and then presents that document to the main ISO body to be voted on as a standard. On October 23, for the first time ever, ISO declined to ratify a document presented by Working Group 21, leaving the future of the C++26 standard in doubt. The decision was driven by controversy around a proposed new "contracts" feature that would add pre- and post-conditions to function signatures.

Stenberg: 30 years of Internet transfers with curl [LWN.net]

Daniel Stenberg reflects on the 30th anniversary of the curl project.

libcurl runs in an estimated thirty billion installations today. It is a rough estimate since the majority of all libcurl users never tell us they use it, but we need to find it mentioned in their credit screens, open source license windows or their manuals. A super popular app might use libcurl today and not tomorrow, or vice versa, which can make the numbers shift by several billions overnight. In reality of course, once the pulse raise has calmed down and your ego is content, these numbers do not matter. In our corner of the world, things don't change notably when we go from a thousand installs to billions. We still work with similar people, in similar ways, with similar challenges.

Security updates for Thursday [LWN.net]

Security updates have been issued by Debian (aodh, apache2, dnspython, firefox-esr, mutt, octavia, spip, thunderbird, and watcher), Fedora (epiphany, firefox, freerdp, java-25-openjdk, java-latest-openjdk, libsoup3, perl-HTTP-Parser-XS, perl-libnet, php-getid3, pipx, python-crate-ingredients, python-pillow, python-robotframework, python3.9, rsync, rubygem-nokogiri, tpm2-tss, udns, and xorg-x11-server-Xwayland), Gentoo (curl, ImageMagick, libheif, and PCRE2), Mageia (nginx and python-django), Oracle (go-toolset:rhel8, libimobiledevice, nodejs:22, util-linux, and vim), Red Hat (.NET 10.0, .NET 8.0, .NET 9.0, cockpit, freerdp, gdb, go-fdo-client, grafana-pcp, ignition, kernel, kernel-rt, krb5, openssh, openssl, osbuild-composer, rpm, rsync, and webkit2gtk3), Slackware (git, httpd, and tigervnc), SUSE (aliyun-cli, alloy, apache-parent, aqute-bnd, google-gson, logback, maven, maven-artifact-transfer, maven-parent, maven-resolver, methanol, osgi-service- subsystem, slf4j, xmvn, bcel, benchdnn, containerd, distribution, dpdk, efivar, elemental, elemental-register, elemental-system-agent, elemental-toolkit, firefox, kernel, liblldpctl4, libonnxruntime1, openssl-1_0_0, openssl-1_1, openvpn, pcre2, perl-Net-DNS, perl-Plack, perl-Starman, psqlODBC, python-M2Crypto, python-Pillow, python-Twisted, python-urllib3_1, python313-djangorestframework, python313-fpdf2, python313-langgraph-sdk, python313-nltk, rust-keylime, skopeo, traefik, zchunk, and zvbi), and Ubuntu (asyncpg, awl, btrbk, davical, dotnet8, dotnet10, dotnet11, libfcgi, linux-raspi, logback, mysql-8.0, mysql-8.4, mysql-9.7, network-manager-ssh, node-babel, php-pecl-http, prosody-modules, rkhunter, ruby-actionpack-page-caching, ruby-jwt, ruby-kramdown, shiro, snmptt, and yodl).

13:42

Why Git Needs Help: Moving from Files to Systems for Source Control [Radar]

The shift to agentic reality

When Git was designed in 2005, Linus Torvalds solved a brilliant problem for humans collaborating over terminal windows by trading line-by-line diffs. Fast-forward to 2026: Autonomous coding agents don’t think in flat text files or line breaks. They reason across syntax trees, execution traces, call graphs, and type constraints. In my view, forcing an AI agent to engineer complex distributed systems through string matching is like handing a chief software architect a chisel and a stack of sticky notes.

File-centric versus system-centric paradigm shift

Dimension Legacy file-centric (Git) Agent-native system graph
Representation Flat Unicode text streams Tree-Sitter ASTs & CPG nodes
Mutation unit Line-by-line string diffs AST node transformations
Context overhead 2,000+ line prompt context fills Sub-50 token targeted node payloads
State persistence Ephemeral model prompt windows Execution ledgers & reasoning chains

Whenever I see engineers try to lock context-blind models into file-centric version control, I watch the consequences compound quickly. Context windows fill with irrelevant churn, API bills surge, and subtle, multifile structural breakages slip past basic syntax checks. Just as critically, standard Git discards the cognitive history of a change. The moment an agent session completes, its execution logs, compiler feedback, and discarded hypotheses evaporate into thin air.

Tactical illustration: renaming a distributed method signature

Consider updating a core helper signature across 40 dependent services. A traditional string diff forces the agent to read and mutate thousands of lines of surrounding boilerplate text, burning thousands of context tokens per file:

--- a/services/auth.py
+++ b/services/auth.py
@@ -42,7 +42,7 @@ class AuthManager:
     def validate_session(self, token: str) -> UserSession:
-        return fetch_user_by_token(token)
+        return fetch_user_by_token(token, include_metadata=True)

In contrast, an AST mutation node isolates the target function symbol, executing the change precisely without passing unneeded ambient text through the prompt window:

{
  "action": "mutate_node",
  "target_ast_id": "ast_node_89f2a41b",
  "symbol": "fetch_user_by_token",
  "update": {
    "add_argument": { "name": "include_metadata", "value": true }
  }
}

This exact bottleneck hit Anthropic in late 2026. As autonomous agent activity pushed monorepo merges beyond 30,000 per day, conventional Git infrastructure simply buckled under the load. To me, unlocking genuine agentic autonomy requires evolving source control along two complementary tracks: shifting to server-hosted, graph-aware architectures, and treating agent reasoning as a first-class, versioned artifact right alongside the code itself.

Why text diffs and ephemeral sessions create silent debt

Standard diff tools operate purely on raw Unicode strings. When an agent reorders functions or cleans up formatting, string diffs pollute context windows with noise while remaining blind to structural reality. If you modify a single method signature, Git won’t warn you about the dozen callers broken across separate modules. From my experience, feeding 2,000-line source files into prompts just to update a 5-line helper method degrades model attention, burns compute, and inflates overhead at scale.

Text diffs versus AST graph mutations

Metric / behavior Text diff (unified patch) AST graph mutation
Formatting resilience Breaks on whitespace or line-ending changes Immune to syntax formatting shifts
Impact analysis Post hoc CI test failures Sub-second static call-graph resolution
Token consumption O(file_size) per prompt iteration O(node_delta) per targeted change

Compounding this structural blind spot is what I consider our biggest waste: ephemeral session memory. Whenever an agent finishes a task or compacts its context window, its entire diagnostic history—failed attempts, shell outputs, and compiler warnings—disappears. The next agent assigned to the branch steps in completely blind, doomed to repeat the same diagnostic dead ends and burn unnecessary tokens.

Agent-native architectures in practice

In my view, next-generation version control must replace raw file trees with Tree-sitter parsers and code property graphs (CPGs). Instead of editing lines on disk, agents mutate specific syntax nodes directly, executing sub-second edits and running immediate dependency impact checks across the codebase. Moving control back to the server eliminates the massive I/O bottlenecks caused by checking out heavy working trees onto virtual machines, allowing agents to query and update code over fast graph end points.

Practical implementation: server-side microdiff stream

Below is an example payload representing an atomic microdiff layer executed directly on a server-hosted code property graph, bypassing local file checkouts entirely:

{
  "commit_id": "c_9011f4a2",
  "parent_graph_version": "v14.2.0",
  "operations": [
    {
      "op": "replace_node_property",
      "node_uri": "cpg://auth_service/ast/Node_441",
      "property": "return_type",
      "value": "Promise<UserSession>"
    }
  ],
  "validation_hash": 
  "sha256_e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}

This structural shift pairs naturally with stacked microdiffs—atomic, dependent layers verified sequentially in isolated virtual workspaces to prevent merge races. I was particularly impressed seeing the real-world impact of this pattern with Anthropic’s Scion architecture. Faced with object-store locks and clone latencies as daily merges scaled 10x, Anthropic built a server-centric SCM that streams code graphs on demand, slashing infrastructure overhead by 200x while enabling near-instant workspace initialization.

Versioning reasoning and system memory

I strongly believe code changes alone rarely capture full intent. Modern SCM must link model reasoning traces, prompt chains, and decision graphs directly to commit nodes, preserving architectural context for future debugging and audits. Persisting build outputs, compiler logs, and linter runs in execution ledgers attached to commit trees allows subsequent agents to inspect prior test results instantly rather than rerunning identical test suites.

System memory schema: reasoning and execution ledger

To prevent model sessions from repeating diagnostic dead ends, execution ledgers append structured reasoning and compiler feedback directly to commit nodes:

{
  "agent_session_id": "sess_88190c2a",
  "target_commit": "c_9011f4a2",
  "hypothesis_tree": {
    "attempt_1": { "approach": "In-memory caching", "status": "REJECTED", 
    "reason": "Memory limit exceeded in integration test" },
    "attempt_2": { "approach": "Redis backing store", "status": 
    "VERIFIED", "execution_time_ms": 142 }
  },
  "compiler_ledger": {
    "linter_passed": true,
    "type_check_errors": 0
  }
}

By explicitly recording abandoned branches and failed architectural hypotheses as structured metadata, we stop future agent sessions from reexploring invalid paths. I argue that capturing thought streams alongside code transforms source control from a passive text archive into an active memory system.

The hard engineering trade-offs and counterarguments

I won’t pretend making this transition is easy; it comes with steep engineering trade-offs. Existing developer tooling, from LSPs to build pipelines and IDEs, expects standard local file trees. Replacing checkouts with server-hosted graphs requires building heavy compatibility layers or redesigning workflows. Furthermore, human reviewers still digest code line by line, creating a natural tension with pure graph mutations, while storing continuous thought streams drives up storage and compliance costs. During early refactoring, syntax is often broken and unparseable, forcing systems to temporarily fall back to raw text. Overcoming Git’s decades of deep ecosystem lock-in remains a major operational hurdle we cannot ignore.

Trade-off matrix: architectural migration challenges

Challenge Systemic bottleneck Mitigation strategy
IDE & tooling lock-in LSPs expect local file system layouts Virtual FUSE layers streaming AST nodes on demand
Storage overhead Persisting continuous reasoning logs increases storage 10x Compacting execution ledgers into summary trees
Broken syntax states AST parsers fail during active multiline refactoring Fallback to temporary text buffer zones during edits

Bottom line

Git was designed for humans reviewing text, but agentic scale demands server-centric, graph-aware source control. Code property graphs stop token bloat and prevent silent structural breakages. Versioning reasoning traces and execution histories alongside code keeps agents from repeating past mistakes. And stacked microdiffs offer a clean, isolated path for autonomous agents to ship code safely at scale.

13:14

CodeSOD: Next Month [The Daily WTF]

One of Sean's colleagues left Initech on good terms. It caused no small amount of surprise that the very next day their billing system started failing. The billing system which the colleauge had worked on.

No one truly suspected foul play, it was just a weird coincidence. Still, billing blowing up was a 5 alarm fire, so everyone was throwing every idea out about what could be the cause.

Late in the evening, after staring at the code for many hours, Sean found this:

if item.next_bill_date.month >= end_date.month
  item.next_bill_date = nil
  item.save
else
  ...
end

If the month of the next billing date is greater than the last billing date for this account, wipe the billing date and update the item.

It's worth noting that Sean's co-worker's last date happened to be the end of November, and billing started blowing up on the 1st of December. You'll also note this is checking just the month and not any other part of the date, like, oh, I don't know, the year?

While this bug could happen to any bill, it was blowing up in December because every bill's ending month was greater than or equal to January. So this code canceled all the bills due in January.

The good news was that they could reconstruct the correct next billing dates without having to restore from a backup. The bad news is that some unknown number of billing periods had been canceled for some of their customers, and someone was going to have to check the history.

Sean reached out to his former co-worker to politely thank them for an early Christmas present.

"At least I understand our billing code better," Sean writes.

[Advertisement] Plan Your .NET 9 Migration with Confidence
Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!

12:21

Another Way Police Are Locating People from Their Smartphones [Schneier on Security]

Penlink’s Webloc is an application that locates people using information from the weather, gaming, email, and religious apps on their phone. It’s sold to the police.

The tool collects vast quantities of location data from smartphones via commonly used weather, gaming, email and religious apps. It can build a detailed picture of where a smartphone has been over the past 12 months, and update the data hourly, showing the movements of people on a near real-time basis. Law enforcement officers can use Webloc to zero in on a map and look at all phones that were present at a specific place and time, analyzing “billions of location data points,” according to company documents reviewed by Bloomberg.

There’s a nice infographic that explains how the system works at the link.

11:21

Grrl Power #1512 – And the fighting continues… [Grrl Power]

So we’ve got 3 fights going simultaneously now, and as usual I’m torn between drawing awesome looking high-level shonen style fights, which necessarily go on for pages and pages, and having a few more of these guys getting knocked out fairly quickly so I can focus on the real final fight. As usual, all the fights in the comic feel like they go on too long while we’re all waiting for the two pages a week I can put out, but then when you read through the archives, a 100 page fight is done in half an hour.

I’ve been intercutting the fights with commentary by Sydney and others to interject some humor, but I still want to get the team all in the same room again so I can have Dabbler do something inappropriate to rile up Maxima, along with the other usual japes. So we’ll see how these fights go. I don’t want to rush them, but I also don’t want them to drag on either, and I have a few important moments to hit along the way.


Here you go, a brand new vote incentive. Featuring the least sexy character in the comic. No, I take that back, Cooter is the least sexy, but don’t expect a pinup of him anytime soon. Or ever. There is a nude version over at Patreon. Note I didn’t say NSFW. She is nude in those picture, and she does identify as female, but it’s… hard to tell. She is a humanoid aberration by D&D terminology, not a mammal. And before you ask, no, I don’t know how many vertebrae she has in her neck.

 


Double res version will be posted over at Patreon. Feel free to contribute as much as you like.

10:49

Learning from rejection [Seth's Blog]

If you’re doing something creative, something important or something new, you’re certain to be rejected along the way.

It’s a signal. It might be proof that you offered it to the wrong person, or that the right person saw something about your work that didn’t serve their needs. Without learning from this signal, we’re doomed to experience it again and again.

What do we know for sure?

It was rejected.

What else?

Nothing. The reasons listed in the rejection letter are almost certainly made up. Perhaps they’re insulating themselves from being re-sold (“you said you didn’t like the color, but we have other colors!”) or perhaps they’re protecting your feelings. It could be that they aren’t telling themselves the truth, or don’t want to be hassled for telling you the truth.

Few people explain their rejection with, “I’m afraid,” or “I wanted to do it but my boss won’t let me,” or “you have bad breath and I don’t like you.”

Being rejected hurts, and we’re likely to marinate in the pain. We imagine that the person who rejected us understands everything about what we offered, is a rational actor and cares as much as we do. While we’re at it, we personalize, amplify and multiply the rejection.

But all we really know is that this person, on this day, in this situation, hearing the story the way we told it, said no.

Years ago, I self-published a booklet for political activists. My timing was good, and I had a chance to sell the books from an organizer’s booth at a march on the very topic my book was about. It was a beautiful April day, and I stood on the side of route as the march went by. More than 400,000 passed my table, and I sold four books.

That’s 399,996 rejections. Maybe more.

Was it the price? Halfway through the march, I lowered it from $10 to $1, just to have a good story to blog a few decades later.

Sales did not increase. Perhaps it was the color of the jacket, the page count or the typo on page 32? None of those things.

What did I learn? That people at a march are at the march to march, not to shop.

Watch what people do, not what they say. And if you really want to learn something, change the situation and see what happens the next time.

Learning from rejection begins with understanding the lesson that’s being offered.

10:21

I’m not descending into madness because mount and unmount icons make no sense [OSnews]

There are many problems in this world – some big, some small, some so minute nobody ought to put them to paper at all. The problem I’m going to highlight here is even smaller than that. This literally – the actual literally – does not matter and absolutely nobody should care about it, let alone put any work into changing it or addressing it some other way.

I want to talk about the iconography GNOME’s Disks utility uses to symbolise “mount” and “unmount”. No, I’m not descending into madness.

GNOME’s Disks utility uses the “play” symbol on the mount button, and the “stop” symbol on the unmount button. Inexplicably, considering the state of the world in general and the rapidly deteriorating quality of software specifically, this bothers me. Out in the real world, built on decades of consistent use, these symbols have gained clearly defined meanings, and mounting and unmounting disks definitely isn’t one of them.

In fact, the meaning of these symbols isn’t mere convention; they’re defined in a variety of international standards for symbols for use in software and on equipment, such as ISO/IEC 18035 (which you need to buy to read; my copy fell of a truck):

ISO/IEC 18035:2002 defines a consistent set of icons and related functions that are represented by multimedia applications on a computer screen and that users interact with to control such applications. It describes controls applying to such functions as: Play, Pause, Stop, Rewind, Scan forward, Scan backward, Replay backward, Loop, Go to beginning, Go to previous, Go to next, Go to end, Set volume and Mute.

↫ ISO/IEC 18035:2003

They’re also part of ISO 7000/IEC 60417, a much larger, more encompassing standard that also contains things like the various symbols used on laundry machines, tumble dryers, in cars, and so on. The symbols themselves are much older than the standards, of course, with many of them dating back to the 1960s and possibly even 1950s. The point remains, though: the play and stop symbols have clearly defined meanings, and I don’t think they are at all a good fit for mount and unmount.

The function of the “play” symbol according to ISO/IEC 18035:

To enable the user to start the presentation of dynamic media, except where the task requires automatic playing of that media.

↫ ISO/IEC 18035:2003

And of the “stop” symbol:

To enable the user to stop the presentation of dynamic media.

↫ ISO/IEC 18035:2003

Neither of these descriptions match what mounting and unmounting mean or do. Mounting a drive or partition doesn’t present any media at all; it merely makes the drive or partition in question accessible. Unmounting also doesn’t eject anything; it merely makes the drive or partition inaccessible. I would argue that play and pause act upon contents of a drive or volume, and not upon the drive or volume itself. As it stands right now, you “play” a drive” to “play” a video stored on said drive.

Madness.

I already know what you’re thinking, and yes, I agree that the Disks utility is a tool aimed at more advanced use cases and users, and most normal, average users will never even know it exists, let alone open it at all. Very few people get to see these symbols, and those that do already know full well what mounting and unmounting mean, reducing the importance of said symbols considerably. But now it’s time for the big surprise, the twist in the story that turns this entire thing on its head.

Files, GNOME’s file manager, uses an entirely different symbol for unmounting! Instead of the “stop” symbol, Files uses the “eject” symbol. You may think this is a more accurate visual representation of what unmounting means, but I strongly disagree. Let’s turn to ISO/IEC 18035:2003 once again:

To enable the user to eject the current physical media from the appropriate drive.

↫ ISO/IEC 18035:2003

Unmounting doesn’t eject anything! If you unmount a USB stick, the stick doesn’t get fired out of the USB port. If you unmount a volume, it doesn’t get removed from the SSD. Hell, if you unmount a CD-ROM, it doesn’t even eject it! Ejecting a CD-ROM – opening the drive’s tray or spitting the CD-ROM out of a slot-loader – is an entirely different act! Are we really “ejecting” a CD-ROM twice? Are we “mounting” a CD-ROM when we merely close the tray? No!

Madness!

The real underlying problem here is, of course, that mounting and unmounting are deeply weird and confusing concepts, bordering on the esoteric, that simply do not have physical equivalents to fall back on. Using symbols and iconography designed in the 1960s explicitly for playing music or stopping a video or ejecting a cassette tape are not a good fit for something as difficult to explain to most people as mounting and unmounting. It’s like putting an eject symbol on a car’s door handle or a play symbol on a soap dispenser.

Should GNOME developers waste any time or resources to address this? No, of course not, that would be stupid. Nobody should care about this but me. I should suffer in silence, every time I need to mount or unmount something, forced to look for an eject or stop symbol in whatever user interface I happen to be using. Every time, I should die a little inside. Please, don’t be like me and waste precious resources thinking about this.

I’m not descending into madness. I just want mount and unmount symbols that make sense.

I’m not descending into madness.

06:28

I didn’t write a program with emoji, but I did use a control character [The Old New Thing]

Adventures in PC Emulation recently wrote about Executable Emoji: Writing an MS-DOS program using machine code represented solely by Unicode emoji characters.

This reminded me that back in the day I did something similar, but much less impressive: I wrote a reboot.com program that could be generated from the command line via echo.

echo Alt+Num2,Num0,Num5Ctrl+Y>reboot.com

The Alt+Num2,Num0,Num5 means to press and hold the Alt while sequentially pressing and releasing Num2, Num0, Num5 on the numeric keypad, and then releasing the Alt key. In the IBM PC 437 code page, this comes out looking like ═, which is character 205, or hex 0xCD.

The byte 0xCD is the machine code for the int instruction, for issuing a software interrupt. And Ctrl+Y generates character 25, or hex 0x19, which completes the instruction: int 19h.

Interrupt 19h was a sort-of not-very-good “reboot the system” interrupt. You can read about all the problems it has in Ralph Brown’s Interrupt List.

This interrupt reboots the system without clearing memory or restoring interrupt vectors. Because interrupt vectors are preserved, this interrupt usually causes a system hang if any TSRs have hooked vectors from 00h through 1Ch, particularly INT 08.

Since this was not a very good way of rebooting the system, it was mostly just a parlor trick.

But at least I did it.

The post I didn’t write a program with emoji, but I did use a control character appeared first on The Old New Thing.

05:56

Destruction of effort to slow HIV transmission [Richard Stallman's Political Notes]

How [the wrecker] Destroyed South Africa’s Effort to Slow HIV Transmission.

Modern drugs can stop the transmission of HIV, turning it into a harmless, slowly disappearing relic — as long as people can still get their drugs.

Artificial charisma [Richard Stallman's Political Notes]

We should teach everyone how artificial charisma works, so they can learn to resist it.

Unlimited power to pardon [Richard Stallman's Political Notes]

George Mason tried to warn Americans in 1787 that giving presidents unlimited power to pardon was an invitation to corruption.

The general respect for rule of law made it unacceptable for presidents to abuse this before, but the corrupter has made it acceptable to those inclined towards corruption.

"suspicious" routes of travel [Richard Stallman's Political Notes]

US cops are using machine learning systems to identify "suspicious" routes of travel, then inventing false pretexts to stop and search drivers who have been observed following such a route.

This practice involves a lie every time, but thugs don't mind lying to get what they want. (Perhaps that is why they support the bullshitter.)

Activist Andreas Malm blocked from UK [Richard Stallman's Political Notes]

The UK government has blocked activist Andreas Malm, a Swede, from visiting the UK to speak on a panel about Palestine.

It presented uselessly vague reason for doing so.

Penalizing protesters for damage to property [Richard Stallman's Political Notes]

Macron plans to penalize protesters for damage to property which occurs near their protests — a policy demanded by the right-wing extremist party.

Experts questioning concept of "autistic spectrum" [Richard Stallman's Political Notes]

Experts are starting to question the validity of the concept of a single very broad "autistic spectrum".

I never adopted that concept: I distinguish between Asperger's and autism. I am not wedded to that terminology, though.

Sizewell C nuclear power plant [Richard Stallman's Political Notes]

A group of UK parliamentarians acknowledge that the Sizewell C nuclear power plant would be a terrible deal for the taxpayers.

Nuclear power tends to be a bad deal, because it is more expensive and takes far longer than renewable generation.

That being so, it provokes suspicion that the government has some hidden reasons for pushing the nuclear plan.

US coal plants boosted with tax payer dollars [Richard Stallman's Political Notes]

The Environmental Defense Fund reports that the saboteur in chief *boosted half of US coal plants with taxpayer dollars and "free passes to pollute".*

No human at the helm [Richard Stallman's Political Notes]

*"No human at the helm": Delaware plan would let AI agents run entire businesses.*

If the agents direct the business to commit crimes, no one could be punished. Could the shareholders profit from that outcome? It is crucial to ensure that no one who has control can gain from that.

Difference between progressive and plutocratist Democrats [Richard Stallman's Political Notes]

The difference between progressive Democrats and plutocratist Democrats is visible in the stance of California Democratic politicians regarding the ballot initiative to tax billionaires' wealth.

Someone should post, in a special web page, the position on that initiative of each Democratic politician in or of California. Then in future years voters will be able reject them in Democratic primaries.

Noise from muskrat's new datacenter [Richard Stallman's Political Notes]

The muskrat's new datacenter, built in a city in Mississippi, has turbine generators that sound as loud as jet engines. One neighbor is suing and asking others to join.

The muskrat has offered to buy the houses in the area for market value, but that is unfair given the trouble that moving would involve. To be a decent man, he should offer twice the market value for each house — he can afford it.

Ebola outbreak could spread outside Africa [Richard Stallman's Political Notes]

Warning that the current Ebola outbreak, the broadest ever, could spread to countries outside Africa.

Rich countries that have not given money to get the outbreak under control for Africans' sake must now help fund getting the outbreak under control so as to protect their own populations.

Discounting future profits and future disasters [Richard Stallman's Political Notes]

Some economics departments continue to teach the system of discounting future profits and future disasters, which leads to systematically understating the impact of climate disaster when it happens.

Deportation thugs using cars as weapons [Richard Stallman's Political Notes]

Deportation thugs are using their cars as weapons to injure or kill people that they have suspicions about. Afterward, they often lie to put the blame on the victim.

03:21

The Plot Unravels [QC RSS v2]

he's so smooth

00:42

Nice Rack! [Nina Paley]

Mechanic Sam made a custom underseat rack for the Jackalope.

Just did her first grocery run this morning! She’s too heavy to be a speed demon but now she can be a work horse.

Share

The post Nice Rack! appeared first on Nina Paley.

00:28

[$] LWN.net Weekly Edition for November 12, 2026 [LWN.net]

Inside this week's LWN.net Weekly Edition:

  • Front: Synaptics patent claims; Git LLM policy; Hibernation and lockdown; User namespaces; glibc tunables.
  • Briefs: *sshole; Amutable foundations; Asahi Linux 7.3; OpenIndiana 2026.10; Firefox 160; Quotes; ...
  • Announcements: Newsletters, conferences, security updates, patches, and more.

Wednesday, 11 November

22:42

don’t you just love the smell of old books? [WIL WHEATON dot NET]

Happy Wednesday, friends! Some odds and ends that have been piling up on my desk for you, today.

This week’s It’s Storytime With Wil Wheaton is The Body Snatcher, by Robert Louis Stevenson. This is the story that I read, live, for Patreon and about 70 people who showed up, last month. I sincerely love this entire performance. Gabrielle helped me find some subtle layers that were obvious to me, right after she pointed them out, and I couldn’t be happier with the end result.

It’s a big ask, to come along for the entire performance of something that was written over a century ago, so it was more important to me than I thought it would be to nail it. I’m real proud of what we did. I hope you like it, too.

This episode comes with a pretty cool new sponsorship partner, our friends at Simon and Schuster Audio (who publish The Body, and put my narration up for Grammy consideration). To promote Other Worlds Than These, the final book in The Talisman trilogy from Stephen King and Peter Straub, they’re giving away a preview chapter of the audiobook to our listeners. It’s narrated by Patton Oswalt, who is one of the great voices today. I think it’s super cool, and I’m so excited to get a little bit closer to doing It’s Storytime full time.

Oh, speaking of that, do you know I have a partnership with Black Stone Publishing? They gave me some space to curate a collection of speculative fiction novels they publish. I have been a fan for years; they don’t use any DRM, ever, in their audio and ebooks, they support indie artists, and they publish some truly outstanding genre work. This month, I wanted to spotlight a mid-century classic that is a wonderful expression of the ideas being explored in genre fiction at the dawn of the atomic age. It’s David Starr, Space Ranger (I know, right?) from Isaac Asimov (I know, RIGHT?). I didn’t even know this existed until last year, but Asimov wanted to write his own son into some scifi that was inspired by Heinlein’s young adult books. It’s not going to be for everyone, but if you’re even a little curious or intrigued, it might be for you. And if it isn’t, there are some other wonderful titles in the collection for you to check out.

Did I ever write here about the summer reading program I did? I ended up finishing six books, reading about thirty short stories, and ended with a 129 day streak. I went to the library last week to see if I could collect any of my prizes.

“Hi, I did the summer reading program, and I wondered if there were any prizes left?” I showed the librarian my log sheet, like you do. She looked a little flustered.

“Oh… I think we are out of rewards,” she said, while she opened drawer after drawer and looked inside.

“I was hoping for, maybe, like … a scratch-and-sniff sticker? Or a bookmark?” I offered.

She smiled and opened one of the drawers she had just closed. She pulled a small basket out and showed me five rows of bookmarks. “How about a scratch-and-sniff bookmark?”

My eyes popped. “Oh my god that’s perfect!”

I saw it, a picture of chocolate chip cookies, a hazy circle on one end. I scratched, then I sniffed, then I was instantly transported to the Scholastic Book Fair in 1982.

“This is everything I ever wanted,” I said, joy welling in my heart. “Thank you.”

“You are very welcome,” she said, with a warm smile.

God, I love libraries and librarians.

Speaking of things I love and awkward, abrupt segues, I love love love ALL CAPS LOVE this little me plushie, which is only available until the end of the month. As I understand it, the business model for YouTooz is to take pre-orders and fill them, then retire the design. So this probably isn’t coming back. I just checked, and 177 have been ordered, which makes this kind of a cool limited edition thing. Anyway, I adore this little guy, and I want to make sure everyone else who may feel the same way has a chance to get one before they are gone. So now you know. Tell your friends.

The final book I scored in my summer reading program was Fabulous Bodies, by Chuck Tingle. It stuck with me, and I ended up writing a little bit of a review that I would like to share:

I am not into horror, really. Certainly not like I was when I was younger. The world is horror, you know? I’d prefer my reading to be about, well, not that.

But there are exceptions to all the rules, and this is a huge one. I loved this book. I wrote in my goodreads review that it’s gory, but it’s also clever and wry, sort of John Waters via Sam Rami, with just a touch of Rob Zombie. And the most surprising thing for me? It’s heartwarming. What? A heartwarming horror novel that’s funny? Okay, if you say so.

It’s fantastic. I gave it a rare 5 out of 5, and I haven’t stopped thinking about it since I put it back on the shelf.

I don’t have the English degree I want, so when I analyze a story, I’m coming at it from an actor’s perspective which I suspect has some overlap with what academics do. Still, I always feel like I have to qualify my examinations of the things I read, which I’m doing right now. Maybe I’m totally wrong, and maybe I’m projecting myself into the story, but upon reflection, I think it’s about generational trauma. It’s about parents who are so self-absorbed and such narcissists, they treat their children as nothing more than extensions of themselves, not caring at all how their child feels about it. It’s about one of those children, now an adult, doing her best to end the generational trauma.

It’s one of those books I wanted to recommend to a friend immediately upon finishing, but I don’t think I know anyone who would be able to handle the gory parts (they don’t define the book, and there’s so much more that isn’t gory, but I feel like it’s a fair warning that I have to give) so I’m hoping that maybe someone who is reading this — maybe you — are that horror reader.

Okay, that’s all for today. I have some family visiting, and we are going to have some fun together, as soon as I finish work, which is right … now.


Hi I’m Wil and I’m glad you’re here. I write this blog. I host It’s Storytime With Wil Wheaton, and the official companion podcast for Stuart Fails To Save The Universe with Felicia Day, both available wherever you get your podcasts. I am the New York Times bestselling author of Still Just A Geek. My narrations of Monsters of Ohio, by John Scalzi, and The Ship of Death, by Kyle Winkler, are now available wherever you get your audiobooks. If you’d like to get my posts delivered to your inbox, here’s the thingy:

20:42

GNU Taler in the Chat [Planet GNU]

More information about the work (including the code of the forks) can be found here.

20:21

A Song To Get You Through To The Weekend [Whatever]

I thought for sure that I had previously done a post over League of Legends fictional K-Pop girl group, KDA, but it turns out I have never expressed my adoration for them here beyond sharing one of Madison Beer’s songs that I love (she’s one of the real artists behind the fictional popstars).

So, as the title of the post suggests, I was only going to share their newest song with you, but since I haven’t posted about KDA on here before, I’m going to do just a tad more than show you their new video.

I have been enamored with KDA since their debut eight years ago when they released “POP/STARS.” Not only did I love the immensely catchy song, but I also really liked the characters and the visual style of the music video, even though I had no idea who these characters from the game were since I don’t play League.

So definitely check out the video for “POP/STARS” first so you can get a feel for the overall vibe and art style.

Pretty cool, right? Well buckle up because the animators spent these past eight years well, and it shows very clearly in their newest release, “FIRESTARTER.”

WAS THAT NOT THE MOST AMAZING THING YOU’VE EVER SEEN? I am so beyond blown away. IT LOOKS SO FUCKING GOOOOD. When I watched it for the first time last week I genuinely thought to myself this was the greatest music video I’ve ever seen and I stand by that statement.

The fire? When she’s on the skateboard? The inverted colors dance? Lord, the animators have BLESSED US.

If you like either of these songs I highly recommend checking out their entire discography, all of them are fucking incredible and have been on repeat in my car for years. This one will certainly be added to that list.

Hope this music brightened your day! Do you like KDA, too? Do you play League? Let me know in the comments, and have a great day!

-AMS

19:56

Gunn Jamm [Penny Arcade]

I don't know why I get so hung up on the things people say on social media, the socials, when it's just a performance space. It's not really possible to tell if anybody means any of the things they say on there. Gunn was controversial, I believe that much, but the idea that someone would still be pining for the Snyderverse at this late hour and respond to the ouster of James Gunn with vengeful delight just seems like a wild ride to me.

19:35

Page 15 [Flipside]

Page 15 is done.

19:07

Link [Scripting News]

Braintrust query: If you're a writer, but not a techie, do you like Markdown? If so, what do you use to write your MD text? Is any of it public? If so how do you get it on the web? Where do you store it? How much does it cost, if anything? Also on Bluesky and Twitter.

18:49

18:21

Where Are the “Killer Apps” of AI? [Radar]

Most of today’s AI entrepreneurs and social media enthusiasts are young. AI is the first technology revolution they’ve lived through. They don’t remember how unbelievably exciting it was in the late 1970s to get your own computer, instead of struggling to get time on one of the vast machines chugging away in what used to be called “the glass house,” an air-conditioned room where from outside you could watch the nine-track tapes being accessed and the refrigerator-sized disk drives spinning. Input and output was on high-speed teletype printers (no screens) and magnetic tape (and before that on punch cards.) They also mostly don’t remember, as I do, writing assembly-language programs in which you moved data from one computer register to another, specified the arithmetic or logical operations to be performed on it, and then specified where to save the result.

They look at today’s AI and marvel at how virtually anyone can now generate code. They don’t realize that that’s also how it felt when you could use an interpreted programming language like BASIC to write your own applications instead of writing them in Assembler. They also don’t remember when Dan Bricklin used BASIC to write the first version of VisiCalc in 1979. He went into business with Bob Frankston, who rewrote it in 6502 Assembly Language for the Apple II. Dan was able to express the idea in Basic; Bob then wrote a tight, efficient version for widespread distribution. People rushed out to buy computers so they could use VisiCalc, and everyone predicted that the VisiCalc “spreadsheet” would put all the accountants out of work. It was the first program to be referred to as a “killer app.” It wasn’t the democratization of programming itself that was the killer app but what Dan and Bob did with it. In the entrepreneurial explosion that followed, databases, graphics, word processing, and other business applications came out of the glass house and, as Bill Gates put it, “onto every desk and into every home.”

Dan Bricklin (right) with Bob Frankston, who rewrote VisiCalc in 6502 Assembly Language for the Apple II Image from https://www.digitec.ch/en/page/visicalc-the-first-killer-app-in-computer-history-16230 Dan Bricklin (right) with Bob Frankston, who rewrote VisiCalc in 6502 Assembly Language for the Apple II
Image from https://www.digitec.ch/en/page/visicalc-the-first-killer-app-in-computer-history-16230

We saw the same leap from astonishment to innovation to adoption with the World Wide Web. When O’Reilly demonstrated GNN, the first commercial website, to people at a trade show in 1993, attendees couldn’t believe that clicking on a link could pop up an image or a document from another computer thousands of miles away. They didn’t understand the difference between the software application (the web browser) from the network-connected documents with clickable hyperlinks that it acted as a frame for. They didn’t understand that web pages were a new kind of software written in a simple markup language anyone could understand. It didn’t make sense that the web page was a document that in many ways could look and act like a kind of program. And when people did understand, they thought that might be the end of programming.

In 1993, everyone thought that the web browser itself was the killer app, and that Marc Andreessen, the young creator of Mosaic, the most popular web browser, which became Netscape, was going to dethrone Bill Gates as the new king of computing. They didn’t realize that the true killer apps of the web were not the web browser and the web server but applications “up the stack” built using the new programming paradigm the web enabled. Those applications weren’t software as we’d known software before. They were database- and application-backed websites delivering services that were previously impossible. I remember thinking of Amazon as the 2005 equivalent to VisiCalc when a friend told me she had just bought her first computer so she could shop on Amazon. Once again, it wasn’t the new capability itself that was the killer app but what developers did with it.

What makes a killer app? I think that Tom Stoppard nailed it in his play Rosencrantz and Guildenstern Are Dead:

A man breaking his journey between one place and another at a third place of no name, character, population or significance, sees a unicorn cross his path and disappear. That in itself is startling, but there are precedents for mystical encounters of various kinds, or to be less extreme, a choice of persuasions to put it down to fancy; until—“My God,” says a second man, “I must be dreaming, I thought I saw a unicorn.” At which point, a dimension is added that makes the experience as alarming as it will ever be. A third witness, you understand, adds no further dimension but only spreads it thinner, and a fourth thinner still, and the more witnesses there are the thinner it gets and the more reasonable it becomes until it is as thin as reality, the name we give to the common experience.

That is, a killer app is at first a startling window onto an undreamed-of possibility, but one that so changes the paradigm that it rapidly gets taken for granted. In the meantime, everyone tries to make sense of the new world. Usually, their sensemaking is to try to reduce it to what they already know. The breakthrough entrepreneurs see more deeply and go farther.

In 1995 and 1996, almost everyone saw the future as a showdown between Microsoft and Netscape over who would own the web server and the web browser, and whether the web would supplant the desktop as the new platform. Microsoft won the browser wars, but it turned out to matter far less than anyone expected. The value went to the companies building on top of the browser, the ones that figured out what the network made possible.

The current narrative pitting AI model providers against each other sounds a lot like Microsoft versus Netscape to me. It is the platform war, the war for the layer that will become the common experience on which the revolutionary future will be built. ChatGPT, Claude, and Gemini are the browsers of this era. That is not a small thing. But the browser wasn’t actually the killer app of the web. Netscape made money for a little while. Amazon and Google and the explosion of other sites were what made the web into something people couldn’t live without.

Claude Code, Codex, Cursor, and the other coding agents may be the BASIC of this era, or like the tools and frameworks that made database-backed web applications possible. They are plumbing. Important plumbing, and plumbing that has to be in place before the future can truly happen. But still just plumbing. Inventors tend to spend decades maturing it, and O’Reilly tends to spend decades teaching people to build it. I suspect that will be just as true this time around.

In short, I’ve started asking myself whether we’ve actually seen the killer app for AI yet. The obvious assumption is that ChatGPT was. It certainly got a LOT of people excited and onboard very, very quickly. But maybe Claude Code was, enabling the breakthrough in agentic coding. Or maybe Hermes or Dots or Muse or some other personal agent will be. But we should take seriously the possibility that the killer app is not yet on the scene. These initial candidates for the killer app look too much like advances in a new enabling platform and not enough like a new generation of applications.

Personal agents may turn out to be a breakthrough category, but right now they look to me like early ecommerce before Amazon got it right.1 For Amazon to work, the web had to become secure enough for people to use credit cards online. The apps were waiting on missing mechanisms. For Google’s economic model to kick into gear, pay-per-click advertising had to be invented. I suspect we are in a similar moment waiting for crucial pieces to be dumped on the table so developers can complete their part of the puzzle. For AI agents to act on our behalf in the world, they will need their own equivalents: ways to pay, to prove who they are acting for, to be held accountable, and for the counterparties to settle on the allocation of the value created by the transaction. Ilan Strauss and I have argued in “The Missing Mechanisms of the Agentic Economy” that many of those mechanisms don’t exist yet. Maybe the killer apps are waiting on the equivalent of https and pay per click.

In short, when you listen to the AI conversation and mostly hear about people’s programming pipelines and how much more productive their programmers are, and very little about what they are using that productivity to build, you can be pretty confident that the killer apps haven’t arrived yet.

Where are we in the cycle?

Let’s line up the calendars and see if that tells us something useful.

CP/M (Control Program for Microcomputers), the first widespread personal computer operating system, was developed in 1974, and the Altair 8800, the first mass-market personal computer, appeared on the cover of Popular Electronics in January 1975. Microsoft released a BASIC interpreter for it in June of that same year. A host of competing personal computer hardware platforms running CP/M were introduced soon thereafter. The Apple II was released in 1977, VisiCalc in October 1979, and dBase II in 1980. The IBM PC came out in August 1981 with Microsoft’s MS-DOS as its operating system. Lotus 1-2-3 (which included spreadsheet, graphing, and simple database features) was released in January 1983 and turned the PC into a business necessity.

In 1984, the revolutionary graphical user interface of the Macintosh was the next step function jump in the PC era. The GUI itself had been invented at Xerox PARC in the 1970s, but it wasn’t till Steve Jobs built his “insanely great” Mac that the world embraced it. Desktop publishing became the killer app of the GUI, with Aldus PageMaker and the Apple LaserWriter in 1985. The PC proper didn’t get the GUI till Windows 3.0 in 1990, but Microsoft’s embrace of it for applications such as Word (1983), Excel (1985), and PowerPoint (1987) as well as for the operating system and programming environment made it, for the time, master of the computing world.

So you can see a rough timeline. Four or five years from the introduction of the first version of what was to become the new platform to the first killer app. (Or two, if you count from the introduction of the Apple II, the platform for which VisiCalc was first written.) Then 10 years of invention, competition, and refinement, followed by fairly rapid consolidation and accumulation of market power.

Let’s do the same timeline for the web. Email and online forums might well have been the first internet killer apps, but they were really holdovers from previous generations of research networks. They were apps that had been evolving since the 1970s, though CompuServe and AOL had begun to bring them to the general public in the ’80s. The world really changed, though, when Tim Berners-Lee first wrote his proposal for what became the World Wide Web in March 1989. It was released to the world in August 1991. This was the new platform and the start of what would become the new programming paradigm.

Not too much happened outside physics labs and a few universities until 1993. (There were only about 200 websites when we published The Whole Internet User’s Guide and Catalog in November 1992.) In 1993, NCSA, the National Center for Supercomputer Applications, released Mosaic and we launched GNN, the first commercial website. Netscape shipped its browser, a follow-on to Mosaic, at the end of 1994. Yahoo! was launched that year too, Amazon, eBay, and the Altavista search engine in 1995, MapQuest in 1996, Google in 1998, and Wikipedia in 2001.

So, again about four years from the release of the platform to the appearance of the first killer app, and another 10 till the consolidation phase. (I see Gmail 2004, Google Maps 2005, Google Docs 2006, and Chrome 2008 as the equivalent of Microsoft’s release of Office on top of Windows as the beginning of the consolidation phase of the web.)

The timeline for mobile is not dissimilar. The iPhone in 2007, Android in 2008. Killer social apps Facebook and Twitter had gotten their start on the web at about the same time, but really came into their own on mobile over the next few years. The “could only have happened on mobile” killer apps of Uber, Lyft, and the on-demand economy didn’t arrive till 2011/2012.

A lot of people seem to think AI is moving way faster than previous technology revolutions. But if you line up the calendars, AI is moving at about the same pace as previous eras. Treat the transformer paper, “Attention Is All You Need,” published in June 2017, as the AI equivalent of Tim Berners-Lee’s 1989 proposal, and ChatGPT’s first release on November 30, 2022, as the equivalent of Mosaic. The gap from invention to breakout is about the same, five years for the web and five and a half for AI. That’s just getting the platform in place. The AI-native “killer apps” haven’t yet arrived but are due soon. (And please, let’s avoid the jokes that the “killer apps” of AI first showed up in the Russia-Ukraine drone war. That’s true, but not on the direct line of my argument here.)

On what seems to be a fairly consistent timeline, where are we today, then? October 2026 corresponds to roughly the spring of 1997. Amazon was about to go public. Hotmail was a year old. Google was still a research project at Stanford called BackRub. SixDegrees had kicked off social networking, but Facebook was still seven years off. Napster was still two years away.

Line up the calendars

Think of all those amazing application categories that had been pioneered, though. Search, ecommerce, email, and social networking were all in their infancy, but they were out there, delivering real value. I’m not sure that I see the equivalent time to value in AI. AI didn’t even get to Claude Code, its Microsoft Basic equivalent, till 2025! By some measures, AI is moving more slowly rather than more quickly. There’s more change to digest, and developers are still struggling with the tooling and developing the new knowledge that is needed.

Why so slow, with so much money?

The four largest hyperscalers are on track to spend roughly $700 billion in capital expenditure this year, nearly double what they spent in 2025. That is orders of magnitude more capital than went into the web in the 1990s. If capital and capability were the limiting factors, you’d think we should be well ahead of the earlier calendar, not behind.

I suspect that at least part of the answer is that Silicon Valley’s quest for premature monopoly may be making it less efficient at finding breakthroughs rather than more. Starting with the era of Uber and Lyft, massive VCs have canonized the winners at the beginning of the race, crowding out alternate technologies and business models. That may be happening here. But it’s also just in the nature of bubbles, which depend on groupthink to flourish.

And part of that groupthink is about where the value is going to be captured, rather than where it is going to be created. That is almost always backward looking. During the railroad boom, capital was pouring into building the tracks, and the new business models (think Montgomery Ward and Sears) that railroad enabled didn’t come till later. The dot-com bubble was far less capital intensive than people think. The telecom buildout that ran alongside it was where the money got spent. US carriers spent about $97 billion on capital in 2000 alone.

By 2002, according to an FDIC analysis, only 2% to 5% of the fiber in the ground was actually lit. More than 60 telecom companies went bankrupt. Once the data centers and dark fiber of the telecom bubble could be bought for pennies on the dollar, they enabled a generation of new applications like streaming video. YouTube was founded in 2005, after the crash, on cheap bandwidth that someone else had paid for before they went out of business. There were some visionary companies (think Google, Amazon) that had been started before the abundance arrived, but many more were founded after the bubble burst.

Carlota Perez’s book Technological Revolutions and Financial Capital documented this pattern across every technological revolution since the canal era. Financial capital pours into the installation of the new infrastructure, a bubble forms and bursts, and the deployment period that follows, when the technology actually reshapes the economy, is built by different people on top of what the crash left behind. If that is where we are in the cycle, then the absence of killer apps is not a puzzle at all.

The current data center buildout and the massive investments in frontier AI may not be the future. They are the infrastructure on which the future will be built. We have to ask ourselves what will we build once competition and overshoot and the bursting of the data center bubble make intelligence infrastructure cheap.

Help me fill in the picture

I see several possibilities. Either we are still early and the killer apps simply haven’t shown up yet, the way Google hadn’t shown up in 1997. Or AI is going more slowly than its boosters claim, in spite of all the capital, because capital and model capability are not the limiting factors. But it’s also possible that the killer apps are here, and I’m not hearing about them because the AI conversation is so focused on AI capability and nobody is telling the story of what they are accomplishing with it beyond building better developer tools.

I would like to know which. We all recognize a killer app when we see one. Amazon was a bookstore with more books than any physical bookstore could hold. Wikipedia was an encyclopedia written entirely by volunteers and was updated in real time within hours and sometimes even minutes of major events. Google Maps meant you always knew where you were and how to get anywhere else. If you know of an AI application, beyond the chatbot or agentic coding environment itself, that changes what ordinary people can do on that scale, or a business that does something an order of magnitude cheaper or better than the one it replaces, I want to hear about it. Tell me what you’re building in the Google Form below, and describe what tools you’re using only in the context of what they let you produce for others. If you’re a software developer using AI, what are you producing that was unthinkable before AI?


Footnote

  1. CommerceNet demonstrated the first encrypted credit card transaction online in 1994, and Netscape made the idea mainstream when it introduced HTTPS (HyperText Transfer Protocol Secure) and made it available in the Netscape browser in that same year. This made it safe to type a credit card number onto a web page. ↩︎

17:42

Zellij 0.46 released [LWN.net]

Version 0.46 of the Zellij terminal workspace has been released.

This release includes a major addition in Zellij: Zellij is now also a desktop terminal. To run it: zellij terminal. It works on linux, mac and windows.

Nothing changes for the normal multiplexer - Zellij can still run inside another terminal. Both sessions are the same and can be shared.

Additional features in this release include a GUI settings screen, session previews, and right-click menu. See this walkthrough for more on the 0.46 release.

In Memoriam: Tim Peters 1952–2026 [LWN.net]

Guido van Rossum conveys the sad (and somewhat delayed) news of the passing of Tim Peters.

It's hard to overestimate Tim's influence on Python. He's probably best known for writing the Zen of Python (PEP 20), but to me he was a mentor and language co-designer long before that.

Tim found Python not long after its initial release. His first deed was to convince me that Python should support mixed arithmetic between int and float, because most users would expect them to work that way. And he never stopped contributing.

16:07

Japanese TV [Judith Proctor's Journal]

I've been down with an ear infection for a week now. Affects my balance, hurts, and and also causes a sticky liquid to ooze out of my right ear...

So, I've been watching a lot more TV.

I've a bit tired of Korean Romances and reality TV shows, so I was looking for something a bit different.

I came across this one series - 'Did Someone Happen to Mention Me?' - A Japanese actor, first to lead at Globe Theatre, returns home after 2 years away only to find himself mysteriously erased from everyone's memory.

The premise sounded it fun, and the short series handled it very well.  What I particular like was:

The varied cast - Too much Korean TV only has young pretty people in it.  This Japanese series had actors of a much wider age range.

The hard to predict plot (Yes some things were pretty likely to happen, but the ending was hard to anticipate)

The last episode - all the episodes were good, but for me, the last episode was a stand-out.  I suspect I'll probably re-watch the entire series at some point.  and look forward to that last episode (If you're a fan of live theatre, you'll probably appreciate it the most).

Once I'd finished all ten episodes, I started browsing, and promptly came across another short series with the same lead actor - Koji Yakusho - called Rikuoh

This one was about a failing company manufacturing tabi (the traditional Japanese thick socks with a separate big toe). Their market was shrinking by the year and they needed a new product.  They decide to go for running shoes.

You can predict the general drift of the plot, but it's an enjoyable ride, and there's some very good actors in it.   Again, a nice range of parts for different age and some well written female characters as well.

I'm not a sports fan, but I do like some programmes with sport in them - this one focuses on marathon runners.

I also got hooked by the authentic, and really old-looking, sewing machines the were using for making the tabi (this photo is from a real tabi makker, and I suspect they may have done some filming there....

MITSUBISHI TABI CO., LTD.

It's clear I need to focus on programmes labelled: quirky, deadpan and understated...

 

Finally, there's a new series of Midnight Diner - a very low key series set in a tiny Japanese eatery on a quite back street in Tokyo.  It's mostly about the lives of the patrons and focuses on a regular, or a stranger, each episode.

Sadly, the new series isn't as good as the earlier ones.  the early ones were low-key and subtle. The newer ones are tying to have fancier plots.

Also, the early ones didn't always have happy outcomes, wheras the later ones always do.  I liked the unpredictability and the occasional, silent, heartbreak.

 

 



comment count unavailable comments

15:42

Haiku gets multifinger touchpad taps [OSnews]

We’re almost halfway through November, but we hadn’t seen Haiku’s monthly activity report for October yet. It’s here now, and there’s quite a few good things in here, like support for two and three-finger tap gestures on touchpads for right and middle-click, a new driver that adds Universal Flash Storage support, and even some build fixes for Haiku’s SPARC port as well as some fixes on the RISC-V side.

Of course, that’s just a selection, as there’s the usual long list of smaller changes, bugfixes, and improvements as well.

Microsoft releases .NET 11 [OSnews]

Today, we’re excited to announce the release of .NET 11! This year’s release makes building modern applications faster, more productive, and has improvements across C# 15, ASP.NET Core, .NET MAUI, and Windows development. With hundreds of runtime optimizations, more responsive SDK tooling, and less overhead in everyday commands, you can spend less time waiting and more time creating. Build richer web and cross-platform applications, take advantage of new C# language features, and explore AI-powered development with improved tools and agentic capabilities.

↫ .NET Team

I’m not going to pretend to care about .NET, but I know many of you have to care on a professional level, because .NET is remarkably popular in places where the spotlights don’t often shine.

What if any process could handle SIGKILL? [OSnews]

An interesting question, and a detailed technical rundown of how to make this happen, which involved building a custom Linux kernel, of course.

I really, really enjoy the conclusion.

And you know? It turned out fine. Nothing exploded on my system. As I could predict, because this was otherwise impossible, nobody did it. The signal system was setup in such a way that you would most likely realize something you were doing was wrong, and not try it.

To pull back further, it is interesting to notice how the rules we all take for granted are just set somewhere in code. They were written by someone, at some point. If there is code restricting you from doing something, someone wrote it. Either they did not think anyone would want to do that thing, or they specifically prevented you from doing it. Those rules are written somewhere, and you can take it in your paws to go sniff around the code, pull out the relevant parts, and hack around the things that bother you. For fun, learning, or convenience.

Snoop around. Sniff code. Put your paws in it. Hack shit.

↫ lux at VulpineCitrus

Even if there’s no real reason to do, even if it’s just to satiate an odd and possibly slightly morbid sense of curiosity, fuck with code.

14:42

[$] Additional hardening for the glibc dynamic linker [LWN.net]

The Node.js project recently had a security vulnerability that affected its Brotli decoder. The bug was a buffer overflow, but the particular way that official Node.js binaries are built for Linux meant that one of the main protections against turning a buffer overflow into remote code execution, address space layout randomization (ASLR) could not be turned on. If ASLR had been enabled, the bug would still be exploitable in theory, but much more difficult to exploit in practice. In response, the GNU C Library (glibc) is considering a new set of tunable settings to allow administrators to forbid programs that do not support ASLR. The new settings, while a welcome hardening measure, may not address the root problem.

Security updates for Wednesday [LWN.net]

Security updates have been issued by AlmaLinux (edk2), Debian (openexr, rsyslog, and srt), Fedora (alertmanager, dotnet11.0, gdal, mstflint, nextcloud, python-crate-ingredients, rust-ingredients, rust-pore, rust-pulldown-cmark, rust-rbw, rust-sequoia-sq, rust-siguldry-fedora-autopen, tigervnc, unbound, and zchunk), Gentoo (Brotli, git, and libde265), Mageia (mopidy, python-dulwich, rust-similar3, rclone, and sofia-sip), Oracle (dpdk, edk2, firefox, glibc, kernel, kernel-uek, nodejs-nodemon, nodejs22, nodejs:24, patch, ruby, ruby4.0, squid:4, and thunderbird), Red Hat (.NET 10.0, .NET 11.0, .NET 8.0, .NET 9.0, bind, bind9.16, bind9.18, buildah, c-ares, containernetworking-plugins, delve, flatpak-builder, gcc, gcc-toolset-15-gcc, gcc-toolset-16-gcc, go-fdo-client, go-fdo-server, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gvfs, gvisor-tap-vsock, nginx, nginx:1.24, nginx:1.26, oci-delta, podman, python-oauthlib, python3, python3.12, python3.9, qt5-qtbase, qt6-qtbase, rhc, runc, skopeo, squid, squid:4, tesseract, util-linux, xdg-dbus-proxy, and yggdrasil), Slackware (xorg-server), SUSE (aliyun-cli, amazon-cloudwatch-agent, ansible-core, aspell, azure-storage-azcopy, bind, cups, dlib-devel, docker, dolphin, dpdk, evolution, firefox, flannel, fuse-overlayfs, gnome-podcasts, google-cloud-sap-agent, GraphicsMagick, graphicsmagick, haproxy, istioctl, kernel, kubevirt, kured, libvips-devel, libXi, mozilla-nss, nvidia-open-driver-G06-signed-check, okteto, openssl-1_1, pcre2, poppler, poppler-qt, poppler-qt5, poppler, poppler-qt5, proftpd, psqlodbc, python-graphql-core, python-M2Crypto, python-pillow, python-soupsieve, python-urllib3_1, python313-wyoming, qt6-coap, rust-keylime, sbc, scribus, SDL2_image, tar, terraform-provider-susepubliccloud, the linux kernel (live patch 18 for suse linux, vsftpd, xen, xorg-x11-server, and zchunk), and Ubuntu (ca-certificates-java, gst-plugins-good1.0, gst-plugins-base1.0, hplip, linux-azure-fde, linux-nvidia, linux-nvidia-7.0, linux-nvidia-bos, linux-nvidia-lowlatency, python-tornado, rust-coreutils, and unbound).

14:35

Listen to Bernie [Scripting News]

Whoever leads the Democratic majority in the Senate must have the support of Bernie Sanders.

At the beginning of Sanders' running for president, I didn't like him. I thought HRC was a much better choice.

Maybe the electorate wasn't ready for him. I sure wasn't. But now, last week's election was his validation.

This is our second chance to get past the toxic combination of the Repub leadership and the Dem leadership. If we're going to have a war it has to come from our strength. Ideally there will be no war because the American people, believe it or not, are willing to give Bernie a chance now.

We all voted for that. Schumer thinks we voted for him.

Two old Jewish men, one who defined our future and one who history has passed by, who doesn't know it yet.

13:49

Measuring AI’s Unintended Consequences [Radar]

The following article was originally published on James Shore’s Successful Software blog and is being republished here with the author’s permission.

AI is great for making teams faster. But is it sustainable? What about maintainability, burnout, and lock-in?

This is part 3 of my series on assessing AI’s impact on software development. In part 1, we looked at why assessing impact is important, and what not to do. In part 2, we looked at how to measure AI’s impact on delivery speed. In this part, we’re looking at how to measure and model the unintended consequences of using AI. Then we’ll wrap up in part 4 with an examination of business outcomes. Finally, an epilogue puts it all together with notes you can share with your CFO.

Does maintainability even matter?

I can hear it now: “Who cares about namby-pamby issues like maintainability and burnout? It’s a job. If jobs were supposed to be fun, they wouldn’t be called ‘work!’ Suck it up!”

So let me be clear: We care about AI’s unintended consequences because they have real economic impact. If code isn’t maintainable, features take longer to write and bugs take longer to fix, taking time away from more valuable work. If people are burned out, they don’t put forth their full effort, and they eventually quit, taking institutional knowledge with them and leading to time-consuming hiring cycles. If you’re locked in, and AI token costs increase, you could be stuck with a choice between a big bill and cutting back on development.

Among the people I’ve talked to, there’s widespread agreement that heavy use of AI produces code that humans have trouble understanding. But there’s disagreement about how much that matters. If AI is doing the maintenance, do we care if a human can understand the code?

There are strong opinions on this topic on all sides, but not a lot of actual evidence. What’s clear is that the costs of maintenance and other unintended consequences do matter, but only if there are any costs. This is what we need to measure: Is there an impact? And if there is, is it enough to matter?

Unfortunately, unlike the rigorous speed trial we discussed in part 2, unintended consequences are gradual and fuzzy. Your measurements are going to be noisy and lagging. You’ll have to create models and explore scenarios. Ultimately, your decisions will come down to judgment, informed by your measurements and models but not driven by them.

One ring to rule them all

There is one idea that, while not perfect, does a good job of capturing the majority of unintended consequences. It’s cost of change.

Put simply, cost of change is like a tax on the changes you make to your software. When cost of change is low, complicated changes still take time, but they’re achievable. When cost of change is high, even simple changes can take weeks, and complicated changes seem completely out of reach.

Cost of change isn’t easy to measure, but there are several indicators you can use to inform your judgment.

Value-add percentage

Value-add percentage is the percentage of your software development effort that’s spent on things that bring value to your business, such as new features, versus the percentage of effort that’s spent on non-value-add work, such as fixing bugs, resolving incidents, and manual test and release cycles.

Non-value-add work is called “muda.”1 Some muda is necessary, even valuable, but that doesn’t make it value-add. Imagine a demanding and crotchety customer who always asks, “Why didn’t you just do it right the first time?” If that customer won’t pay for something, it’s muda.

That’s why bug fixes are muda: “I’m not paying you to fix a bug that shouldn’t be there in the first place!” And performing releases: “Why don’t you just ship it already! How hard can it be?” Sure, bug fixes can be valuable, and releases are necessary, but they’re still muda.

I find it useful to distinguish muda further into discretionary and nondiscretionary muda. Discretionary muda is work that you choose, such as investing in code changes that decrease development costs. Nondiscretionary muda is work that’s chosen for you, such as bug fixes, incidents, and dependency upgrades.

You’ll always have a baseline amount of nondiscretionary muda; it’s a constant tax that takes time away from other work. But if it’s rising, that means the time you spend on value-add work is going down. You have less time to work on things that matter. Your costs are increasing.

When I was VP of engineering, value-add percentage was one of my key metrics. I made decreasing muda a priority, and it paid off. We doubled our value-add percentage over the course of my three years there, which allowed me to free up people for substantial new initiatives without increasing headcount.

DORA metrics

Your organization is likely already tracking the DORA metrics of change lead time, deployment frequency, change fail rate, and so forth. If not, they’re worth considering. As with value-add percentage, changes in these numbers are something to keep an eye on.

Token usage

Tokens are a literal cost, and the more tokens it takes to make a change, the higher your costs. Unfortunately, token usage can fluctuate for many reasons, not just cost of change. Still, it’s worth watching. Anecdotally, better-constructed software is easier for AI to work with and costs fewer tokens.

One of the biggest variances in token usage is people’s level of adoption. Rather than just tracking overall usage, keep an eye on individual usage changes. In the charts I’ve seen, usage has formed a Pareto curve. Increases in usage by people on the low end of the curve may just represent increasing familiarity. Increases by people on the high end of the curve are worth investigating further.

Changes in models, harnesses, prompts, and more will all affect token usage. This metric is only advisory; it’s meant to trigger further investigation, not to be used on its own.

One ring to find them

Of these metrics, value-add percentage is the one I trust the most. It operates at the level we care about: Where is the time going?

Tracking value-add percentage doesn’t have to be a big burden. You don’t need time sheets or detailed task tracking. The trick is to not care overly much about precision. Tracking work within a day or two is good enough.

When I did this tracking, I piggybacked on our valuable increment (VI) tracking. Each one was several days to several weeks of work and could be cleanly categorized as either value-add or muda. But you don’t have to use VIs; any tracking approach will work.

Don’t get too fine-grained with your tracking. When I was VP, managers checked in with each team twice a week and recorded which VI the team had worked on and how many people had worked on it. Each VI was categorized as “muda” or “value-add,” and we had a bunch of subcategories that helped us understand where time was going, such as “bug,” “capacity investment,” “major initiative,” and so forth. It was lightweight and very useful.

Review your value-add percentage monthly. If it’s going down, you don’t necessarily have a problem, but it’s worth investigating further.

The biggest problem with value-add percentage is that it’s noisy. My experience was that trends took three to six months to show up. It took a year before I was confident stating that my cost-of-change reduction efforts had led to lasting results.

That’s a long lag time, but it’s still worth tracking. My product partners and I found value-add percentage incredibly valuable as a tool for communicating what was happening in product development. And, sadly, improving cost of change is a lot harder than making it worse. If AI is causing serious problems, it’ll probably show up more quickly.

One ring to bring them all

Because your cost of change indicators will be noisy and uncertain, supplement them with models and scenario planning. Your models won’t tell you what the future holds, but they will tell you what it could hold, which will help you manage risks.

Here are some of the models I’ve found useful:

Maintainability

Model maintenance as a mandatory “tax” on development. For each month of value-add development, estimate a certain amount of maintenance in the following year, and then a lower amount of ongoing maintenance in every year after that. (Wisdom of the crowd estimation may help.) Then build a model that shows how many engineering days are available each month. Subtract the time spent on maintenance, and the rest is available for value-add.

To model AI’s impact, apply your measured development speed improvements. Estimate how AI will change maintenance costs and estimate effects on headcount. Then explore scenarios based on varying costs of AI maintenance.

If you only create one model, make it this one. I have a more detailed explanation here. It includes a spreadsheet you can use as a starting point for your model.

For example, using that model, if AI increases our speed by 50%, but token costs reduce headcount by 15% and maintenance costs are estimated to double, I can see that I’m only breaking even, despite the big performance improvement:

Spending Efficiency (lower is better)
Total Production

Excess lines of code

Lines of code aren’t a good productivity measure, but they are a reasonable cost measure. Generally speaking, more lines of code result in more maintenance costs.

This model works similarly to the previous one but uses lines of code instead of engineering days. Use traceability data to categorize commits as “value add” or “maintenance.” For each commit, measure gross code churn: the number of lines of code that were either changed, added, or deleted.

For each line of value-add change, estimate a certain amount of maintenance code churn in the following year, and then a lower amount in every year after that. Model how much maintenance code churn will be needed each month based on the value-add churn of previous months. (See the “tmux” tab of this spreadsheet for an example.)

To model AI’s impact, measure how AI affects code churn during your speed improvement trial. Then project value-add churn into the future and model how maintenance churn could change.

The advantage of this model is that you can use (part of) your actual commit data to refine your estimates. For example, the following graph uses real commit data from the open source tmux project.2 Prior to running the model, I guessed one line of maintenance for every line of value-add in the first year, and 0.1 lines every year after that, which turned out to be surprisingly close to the actual data.

Tmux Code Changes

Lock-in

If token costs increase, how will you respond? Will you cut headcount? Reduce your use of AI? Switch to a less capable model?

To model these effects, update the “maintainability” model. Reduce your monthly engineering capacity according to headcount and estimate reductions to your speed improvements based on AI reductions. You may want to add a separate set of estimates and calculations for humans maintaining AI-written code.

Burnout

AI Disclaimer: This image was created with OpenAI’s GPT-5.6 Sol model operating in “High” thinking mode. See the ChatGPT conversation here.AI Disclaimer: This image was created with OpenAI’s GPT-5.6 Sol model operating in “High” thinking mode. See the ChatGPT conversation here.

Productivity is likely to go down as mental exhaustion goes up, and turnover is likely to increase. I don’t think you can model these effects with any accuracy, but you can still keep an eye on them.

Include mental exhaustion as part of your development speed study to see if there’s a significant difference in mental exhaustion between the two approaches. Follow up with periodic one-question surveys about people’s mental energy levels. Pay attention to actual turnover relative to historical numbers, and look for complaints about AI in exit interviews.

And in the darkness bind them

There’s a dark side to value-add percentage. It’s incredibly easy to game. As soon as managers think their teams are being judged based on how they categorize their work, the temptation to tweak the categorization in their favor will be exquisite.

It doesn’t even have to be fraudulent. A leader with prioritization authority and something to prove can simply decide to defer maintenance in favor of value-add work. The pressure to do so is already immense, and it takes unusually strong character to resist.

(If you really hate your company, consider this: You can get away with deferring maintenance for a couple of years. Just enough time to line up a bigger title at a different company! Then your successor is left holding the bag, and your old company wonders why product development can’t get anything done.)

I don’t have an easy answer to these problems other than to remind you to use these metrics to evaluate your approach, not your people. There is no metric that can’t be gamed, and this one is more gameable than most. But it’s also critical for understanding AI’s possible downsides. Use it, but use it with caution.

Development speed and unintended consequences are two sides of the same coin. They help us understand how AI changes how much we deliver, both now and in the future. But just delivering more software isn’t enough. We need to produce the right software. We’ll look at business outcomes next, in part 4.

Footnotes

  1. “Muda” is a Japanese word that comes to us from the Toyota Production System, the inspiration for the Lean Software Development movement. ↩︎
  2. Many thanks to Christophe Stjernlöf for providing the raw data from the tmux project. He used an LLM to classify commits as “value-add” or “maintenance.” The stairsteps are an artifact of the way the data was collected. ↩︎

12:21

In the Hole [The Daily WTF]

Look, I don't want to keep talking about security issues. Blame AI. Just another thing it ruined.

At this point, you've probably heard about *sshole. If you haven't, the quick summary: on some Linux systems, SSH will log you in to an account with no password if you supply a password greater than 256 characters long. Frequently, you might make accounts like root nominally inaccessible by giving it no password, so this is a big deal. Worse, it impacts varieties of Linux that use the musl implementation of libc, like Alpine- the kinds of varieties that run inside a container hosting a web app somewhere.

The impact is broad, and is definitely being exploited. The root cause, however, is interesting, because it's a sum of very simple choices that lead to a wildly undesirable result.

The core function in question is crypt, a stardard part of the C library. crypt is already not the best name, as it's a hashing function, but its behavior is pretty clear. Pass it a string and a salt, and it gives you a hashed version of the password suitable for storing in your /etc/shadow file.

Now, the man page has the answer to the important question: what happens when I hand the function invalid inputs, like a bad salt? In the glibc implementation, it returns a NULL. That's a pretty standard C-style method of handling errors: I failed to do the thing, so I'm going to return a NULL value. This puts the onus on the callers to correctly handle the NULL (which also handles the error).

glibc isn't the only implementation of libc, though. There are many others, each tuned to different types of runtime environments. For example, uClibC is a minimal implementation specifically designed to make lightweight executables that can run in resource constained environments. It makes tradeoffs that make it less desirable for a desktop or server environment. musl attempts to do both: be lightweight and suitable for embedded environments and also suitable for server environments. This makes musl a great choice for building Linux distributions meant to run in a container, which again, is why this bug is turning out to be such a problem.

musl does not return a NULL when it fails to hash your input. Instead, it returns a value that could not possibly be a valid hash: *. Here's their sha256 implementation where you can see that behavior. It's "fine", because you can still check the return to see if you errored: it's too short to be a valid hash, it's an easily identifiable character.

But why deviate like that at all? Well, error handling is hard. Null handling, done incorrectly (or in many real world cases, not at all), leads to crashes. To keep callers happy, the musl team decided to not return NULL, and instead return an invalid string. There are many other choices they could have made, but that was the choice that they made.

There's just one problem: in your /etc/shadow or /etc/passwd files, when you want to ensure an account can't be accessed via passwords, you also set their password hash value to an unhashable string: "*". Again, there are many other choices that could have been made, but that's the choice that was made.

There's now an obvious ticking time bomb here. If an attacker can somehow supply a string that triggers the invalid code path, crypt will return "*". When a program, like OpenSSH, then checks the shadow file to see if the hash matches the saved one, the answer for any account without a password set will be "yes, this matches, "*"=="*"."

How can the user reliably trigger this? Well, doing hashing can be expensive, especially if you're doing something like SHA-512, so the developers put a cap on how long the input string is allowed to be. That cap was 256 characters. If the user supplies more than 256 characters, hashing fails, and when hashing fails, we return... "*".

Et voila, when you pass a musl-linked SSH a password longer than 256 characters, and the account you're logging in as doesn't have a password, you can log in. And again, many containers are running with the musl c-library, which means many containers are impacted by this. It's going to be a huge mess.

And in the end, of course it's null handling. Of course the billion dollar mistake rears its head again, in a completely new and unexpected way. And of course, this flaw is part of the ongoing "Black October" as LLMs turn finding software bugs into a function of compute power, and not a function of human effort. There's going to be a lot more of this.

[Advertisement] Utilize BuildMaster to release your software with confidence, at the pace your business demands. Download today!

Three People Arrested for AI-Enhanced Impersonation Fraud [Schneier on Security]

It’s hard to believe how lucrative this crime can be:

According to a press release from the United States attorney’s office for the southern district of New York, three men ­ Jacob Soall, Sharon Hazan, and Guy Sheetrit ­ were arrested for using AI to alter and impersonate the voices and images of executives and attorneys at various companies in order to convince employees to send over large payments. Soall and Hazan were arrested in Spain over the summer, while Sheetrit was arrested in the United Kingdom in September. The alleged fraud took place between 2024 and 2026.

With the help of AI, the men allegedly acted as a corporate executive, targeting employees of various companies and telling them they needed their help with sensitive financial transactions. They would then instruct the employees to get in touch with lawyers at a large international law firm. The men would then impersonate a lawyer at these firms and have the employees wire a large amount of money.

The men ultimately stole more than $129m from companies all over the world including in the US, according to the DoJ.

Always remember that there are three parts of AI security: security of AI, security with AI, and security from AI. This is the third.

11:00

Colin Watson: Free software activity in October 2026 [Planet Debian]

My Debian contributions this month were all sponsored by Freexian.

You can also support my work directly via Liberapay or GitHub Sponsors.

OpenSSH

I upgraded both openssh and openssh-gssapi from 10.5p1 to 10.6p1, started generating MLDSA44-ED25519 host keys by default now that upstream no longer considers them experimental, and fixed a problem where switching between the normal and GSS-API variants followed by purging the old packages caused some configuration files to disappear.

Python packaging

New upstream versions:

Other build/test failures:

Since lots of Python modules use Rust extensions nowadays, we often have to help with upgrades of Rust packages. I did some of this:

Other bugs:

One of my hobbies is typesetting (“engraving”) music, sometimes for my own use, sometimes for teaching, and sometimes for my choir. I’ve used LilyPond for a long time and have got pretty used to it. My workflow was a bit cumbersome, though, usually involving side-by-side editor and PDF viewer windows with some ad-hoc Makefiles and editor macros. I recently discovered the Frescobaldi frontend to LilyPond, and decided I liked it enough to switch over to it. It was already packaged in Debian, but it had a missing desktop entry and icon and missing translations; I fixed those based on a patch set by Joachim Wiedorn. My upload introduced a testing migration problem, which I also fixed.

Rust packaging

I upgraded rust-jiter and rust-smallvec to new upstream versions for a new version of pydantic-core. The rust-smallvec upgrade caused an FTBFS in rust-saphyr-parser-bw, which I fixed.

I packaged rust-cargo-cyclonedx for a new version of python-maturin. This needed some porting to work with a new version of rust-cargo-metadata, which I contributed upstream.

I improved the dev/list-rdeps.sh tool used by the Rust team to check build-depends too, which should make it easier for that team to remember Python packages in transitions.

Code reviews

10:35

The creep fades [Seth's Blog]

The uncanny valley is the place where an image that’s almost human creeps us out:

Sorry to share that.

Human beings evolved to have a distaste for things that are almost, but not quite, the usual thing. It takes a while for someone who wasn’t raised with cilantro to like it–the same with hot sauce. When Edison first showed people his moving pictures, people screamed. Our brain is warning us that categories are getting surprising and we should be on alert.

As AI spreads through the culture, we’re seeing plenty of mediocre AI-style writing. And then humans subconsciously start writing in that style because they see it so often. And finally, a grudging acceptance that it sounds okay. We’ve been through this a hundred times before.

No one asks to get creeped out. It’s usually done to us, not for us. But, over time, the creep fades.

Like most warnings, we ought to keep two things in mind:

  1. All warnings are not the same. We need to decide which ones to ignore.
  2. Just because a warning fades doesn’t mean that the problem is gone.

The creepiness fades.

But at the same time, there’s a creeping change as trusted and expected elements of our culture fade away.

08:28

Gunn Jamm [Penny Arcade]

New Comic: Gunn Jamm

07:56

The Electric Arc of History [George Monbiot]

Western car manufacturers have repeatedly sought to delay the electric transition. So they’re getting run over by Chinese manufacturing.

By George Monbiot, published in the Guardian 11th November 2026

This is how it works. An industry puts tremendous effort into resisting change: lobbying governments, mobilising the media, pouring money into junktanks. It argues that a transition would threaten jobs, or damage the national interest, or harm poor people, while what it really fears is the cost of retooling its plants or developing new protocols. Then, when the inevitable cliff edge approaches, it whines that change is coming too soon. For reasons beyond its control, it isn’t ready, so the government must delay its plans.

This is what triggered the Dutch nitrate crisis, and the UK’s repeated “emergency” exemptions from the ban on a devastating class of pesticides. Now the same dynamic is driving the British crisis over the transition to electric vehicles (EVs). The result is that, as the global climate summit, Cop31, begins, it looks as if our gift to the world will be a major, predictable and entirely avoidable increase in the UK’s greenhouse gas emissions.

Car manufacturers could have seen this coming over 130 years ago, when the first electric automobiles were sold. For at least the past 30 years, as new electromotive technologies have progressed at speed, they plainly represented the future, and internal combustion engines, with their hard efficiency limits and vast impacts on human and planetary life, the past. Since 2010, it’s been obvious that China, which has not only seen the future but seeks to own it, would flatten our manufacturers like hedgehogs if they didn’t speed up. In 2023, the Conservative government gave automakers seven years to get their act together. And now they wring their hands and claim to be unprepared. To which the only reasonable answer is: tough.

But, unfortunately, this doesn’t seem to be the answer the government is giving. Instead, today it’s expected to cut the target for zero-emission cars from 80% of new car sales by 2030 to 60%. If so, this will be the latest in a series of concessions that governments have agreed since the Conservatives announced the deadline.

Both Conservative and Labour governments have permitted a series of “flexibilities” (otherwise known as loopholes). These allow companies to sell hybrid petrol-electric cars instead of purely EVs. They can also sell a lower proportion of EVs by 2030 on the promise that they’ll accelerate sales after that date. Now the government is also expected to extend the “flexibilities” to 2034, making a mockery of the promise to accelerate after 2030. One retreat after another.

Every one of these slippages has major consequences, for climate breakdown, air pollution, energy security and the cost of living (electric cars, if you can charge at home, are much cheaper to run). The transition to EVs was supposed to be the biggest of all the government’s decarbonisation measures. Now it’s in pieces.

Once again, the problem is the domination of our nominally democratic systems by money. Commercial lobbyists reach ministers long before environmentalists can. As soon as the Conservative government proposed its transition plan, manufacturers pressed to weaken it. This year, they hinted that they wouldn’t invest in future manufacturing here unless the government made further concessions. It looks to me like a legal form of blackmail.

Perfecting the art of unreadiness, the car companies help to ensure that society is also unready for the great crises – from oil supply shocks to climate breakdown – we face. The people they hire deploy an armoury of clever arguments. But while these might sway British politicians, they do nothing to persuade reality, whether that reality consists of the atmosphere or Chinese competitors.

Last month, the Chinese company BYD launched a new Seagull electric hatchback for the home market at just $10,000 (£7,500). It can be flash-charged in five minutes. And where are western manufacturers? Well, Jaguar recently unveiled its reply to Elon Musk’s ill-fated Cybertruck, an unaffordable monster that can scarcely be driven – let alone parked – on our streets. Perhaps the nearest European equivalent to the Seagull, the Volkswagon ID Polo, is much more expensive and you might not get it for months. As the website Autonext comments, “Europe’s carmakers spent 2024 and 2025 telling Brussels that the CO2 targets were unrealistic because buyers would not take small electric cars in the volumes the rules assumed. Volkswagen has now put three of them on sale and cannot build them quickly enough.” Why? Because it didn’t invest in sufficient plant.

The government is now considering imposing tariffs on Chinese EVs, as part of an EU scheme. If you can’t beat them and you can’t join them, block them. So much for addressing the cost-of-living crisis.

As for allowing companies to keep building hybrids rather than EVs, this solves nothing. Hybrids are almost as polluting as 100%-petrol or diesel vehicles; more expensive to run than EVs; incompatible, in most cases, with rapid chargers and destined, very soon, for the scrapheap of history. But, thanks to government policy, last year they accounted for 14% of new car sales, which means 14% of buyers were suckered. The hybrid is the perfect motif for government dithering: given a choice between two technologies, two worlds, two futures, it says yes to both.

The public information campaigns and public honesty required from the government in explaining why a rapid all-electric transition is necessary and what its implications are, as usual are entirely missing. Public communications remain in private hands. The marketing budgets of the car companies are still used to sell ever bigger child-killing, planet-killing trucks.

An EV transition doesn’t solve all of our transport issues. We should be reducing transport demand, through a shift towards the 15-minute city model of which Paris is an exemplar. We need better and safer provision for cyclists and pedestrians. We need more investment in public transport. But if we can’t even get the end-of-pipe – or end-of-the-tailpipe – issue right, what hope is there for the rest of the system?

This is, or should be, easy politics. Tell the foot-dragging, planet-trashing car companies, the authors of their own failure, where to get off. They face a stark choice: move or get squashed.

www.monbiot.com

05:35

Girl Genius for Wednesday, November 11, 2026 [Girl Genius]

The Girl Genius comic for Wednesday, November 11, 2026 has been posted.

05:28

04:49

Russell Coker: Thinkpad T14 [Planet Debian]

The Problems

In mid 2025 I bought a Thinkpad X1 Carbon Gen 6 with 1440p display for $350 [1].

It has been working reasonably well for me, but my vision is diminishing so my current setup with the Kitty terminal emulator allows 4 terminals of 153/154 columns and 40/41 rows or 9 terminals of about 101*27. To have this much text I use the minimum font size I can see which is unreadable when I first wake up – which is bad for the “woken by network management system alert” situations. Also 16G of RAM is a bit of a limit, the Thinkpad X1 Carbon has 4G of swap space and it’s all used most of the time. While there’s usually plenty of buffer/cache RAM it does sometimes get to an OOM situation.

Another issue is that the battery is approaching it’s end of life. The “upower -d” command reports the following which might imply that the battery should last more than 80% of the time when it was new, but testing shows that the time I can use it on battery is not much more than half what it was when I bought the laptop, maybe 1/3 of the battery life when new. I used to be able to consistently run the machine on battery for 7+ hours and still have plenty of charge left, now I can’t even get 5 hours.

energy-full:         50.35 Wh
energy-full-design:  57.02 Wh

I could buy a new battery for about $70, but there are plenty of things I can do with that laptop for which 1/3 the designed battery life is more than enough. Also I have a couple of USB-C batteries that are capable of supplying 30W+ to power a Thinkpad X1 Carbon but they are inconvenient and I’d rather have external batteries and an internal battery that will last most of a day.

My Thinkpad History

Below is a table summarising most of the Thinkpads I’ve owned. I really like the Trackpoint on Thinkpads and have not considered buying a laptop without one. I skipped two laptops I bought in the 2000-2002 time period, that was an expensive laptop time for me. Fortunately by 2000 ebay was getting useful so I only ever had to buy one brand new Thinkpad.

Thinkpad Purchase Date Release Year Price Price 2025 money RAM CPU Display Replacement Reason
385XD Jul 1998 1998 $5800 $12268 96M Pentium MMX 233 800*600 weight screen resolution CPU and RAM
T41p 2003 2003 1.5G Pentium M 1400*1050 overheating and screen backlight
T61 Feb 2010 2007 $796 $1182 5G Core 2 Duo 1680*1050 overheating battery-life and PSU
T420 Oct 2013 2011 $306.35 $422 8G i5-2540M maybe 1600*900 lid hinge broken and generally old
X301 Dec 2017 2008 $0 $0 4G Core 2 Duo SU9400 1440*900 battery entirely died
X1 Carbon Gen 1 Feb 2018 2012 $289 $364 8G i7-3667U 1600*900 error on proprietary SSD lack of USB-C and screen resolution
X1 Carbon Gen 5 Jul 2022 2017 $575.25 $644 8G i5-6300U 1920*1080 screen resolution and wanted a 2in1
X1 Yoga Gen 3 Jan 2024 2018 $359.10 16G i5-8350U 2560*1440 crashed when on battery
X1 Carbon Gen 6 Jul 2025 2018 $350 16G i7-8550U 2560*1440 RAM and screen resolution
T14 Gen 1 Oct 2026 2020 $340 16G+ i7-10610U 3840*2160

So I’ve spent $2675.70 on Thinkpads that I used from 2010 until now (not counting the one I just bought), so that’s $160 per annum for the past 16 years and 9 months.

When I convert that to 2025/2026 dollars that’s $3,221 for 16 years 9 months or $198 per annum. So I just need to make this T14 last for 2 years to be spending less than usual.

Some Generic Laptop Advice

A while ago I was asked for advice on buying a laptop for an architect to use. I can give good advice for laptops used by programmers and for home use and students but I really don’t know what an architect does and even a description wouldn’t do it justice.

The advice I gave was to buy or borrow a relatively low end laptop, something that costs $400 new or $300 second hand and give it a go. Using it will reveal that it doesn’t do what is desired in some ways, whether it’s screen resolution, RAM, CPU power, storage capacity, physical size/weight, or some combination of them is something you won’t know until you try it. Then after having used a cheap laptop they could buy a laptop for $1500+ (for serious work use by people outside the IT industry buying a new laptop is recommended) knowing what features they really need.

So I have gone through a similar process of buying different laptops and discovering the benefits which has arrived at the T14.

The New Thinkpad

Upsides

I saw a Thinkpad T14 with 4K display and 16G of RAM on Facebook Marketplace advertised for $400 and they ended up selling it to me for $300 without the SSD and without the PSU. The seller has a business of selling used enterprise gear so he was happy to keep the SSD and PSU for sale with other laptops. I don’t have a need for more laptop PSUs as I have most of the laptops in my fleet charged from 200W+ PSUs that charge multiple devices and I also have a collection of spare SSDs.

$300 for a laptop with 4K display is a good deal. The T14 is significantly better than the T14s because it has one SODIMM socket while the T14s has soldered RAM, so I could expand the RAM to 48G at some future time – but with current prices I bought an 8G SODIMM for $40 so 24G will have to do for now. That gives a total of $340 plus the value of a SSD.

My first tests with the 4K display I set the display scaling to 150% (previously I had 100% which was a little small for some parts of the display). For my current favourite terminal emulator Kitty I had the Terminus font set to 10.5 point and now have it set to 9.0 point. This set of changes took the amount of text displayed in terminals from about 300*80 to about 330*100 while also increasing readability. This is a very significant improvement. If I knew that 4K in a 14″ display would be so good I’d have got it years ago!

The T14 still fits in the pocked of my ScotteVest jacket [2]!

Neutral

The i7-10610U in my new Thinkpad scores only about 10% faster on Passmark than the i7-8550U in my previous one. That’s disappointing given that Intel had another 3 years of research to develop it and it’s running with faster RAM. The two CPUs have the same TDP so it’s just a 10% performance gain over 3 years and no change anywhere else. If the new CPU had a lower TDP then the small performance increase would be understandable.

When I first booted the system Chrome graphics were corrupted and system performance was bad, after installing the packages firmware-nvidia-graphics and firmware-sof-signed to deal with the kernel errors about not finding firmware the graphics display was correct and the system ran a lot faster. I had forgotten about the issues related to having NVidia and Intel GPUs on the same system that I had dealt with in previous T series Thinkpads.

In the systemd-boot loader.conf file I added “console-mode 0” to prevent the font being ridiculously small for the boot selection.

The battery life seems like it might be a bit less than my previous laptop was when I got it, but it’s definitely better than the previous laptop gives now.

Downsides

The screen is very shiny, I prefer the screens with matt finish to avoid seeing reflections. The “anti glare” screens for the T14 are for FullHD and worse while the “glossy” screen is the only option for 4K.. Maybe I should investigate one of those hoodie jackets with a hood that’s large enough to cover the screen, they are being sold as a privacy feature but can also be used to avoid reflection. As an aside if you are in an environment with hostile parties then you really shouldn’t block your vision of them.

A problem I previously had with T series Thinkpads which contributed to the replacement of two of them is the screen hinges breaking. This laptop is significantly heavier and more solidly built than the X1 series I’ve been using and opening and closing the screen takes a lot more force. I am now wondering if I’ll be looking for a “for parts” condition Thinkpad on ebay in the future. It seems that cracking the screen is a much more common failure case than breaking the hinges so hopefully there will be spares available. But as my previous T series thinkpads lasted 7, 3, and 4 years this one could be expected to last until 2030 and maybe by then giving it to someone in Vietnam and buying a replacement would be the easiest option.

Future Laptops

I thought that going from 2560*1440 to 3840*2160 I would be hitting the diminishing returns range but it seems that there are still further gains to be found in screen resolution for my use, maybe the Apple people with their “Retina” displays are on to something. There are Thinkpad X1 Carbon models with 3840*2400 displays, so maybe that’s something to move on to in a few years. The minimum model with 3840*2400 is the X1 Carbon Gen 9 and there’s the X1 Yoga Gen 6 with an OLED 3840*2400. There’s also the P series which has 16″ 3840*2400 displays which would allow more usable text with the caveat of being much less portable.

It sucks that no-one seems to be making a laptop with more than 3840*2400 resolution. 5120*2160 desktop monitors are common and affordable nowadays. I’m sure that even now I could use more than 3840*2400 in a 14″ laptop and when I was younger I could have benefited from more than 3840*2400 in an 11″ laptop if such hardware had been available.

04:00

Utkarsh Gupta: FOSS Activities in October 2026 [Planet Debian]

Here’s my monthly but brief update about the activities I’ve done in the FOSS world.

Debian

Whilst I didn’t have much time, here are still a few things that I worked on:

  • Sponsored ubuntu-dev-tools/0.215 for Florent ‘Skia’ Jacquet, so that seeded-in-ubuntu no longer crashes when distro-info-data is outdated.
  • Assisted a few folks in getting their patches submitted via Salsa.
  • Mentoring for newcomers.
  • Moderation of -project mailing list.

Ubuntu

I joined Canonical to work on Ubuntu full-time back in February 2021.

  • Released Ubuntu 26.10 (Stonking Stingray)! With my Release team hat on, I:
  • Approved the FFe for adsys 0.17.0, as it isn’t seeded.
  • Sponsored libp11/0.4.12-1.1ubuntu2 for Guruprasad, an SRU to Noble which drops the workaround from the previous SRU that broke EAP-TLS Wi-Fi with TPM-backed PKCS#11 keys (LP: #2163152).
  • Proposed a fix for net-tools’ FTBFS in stonking - Linux 7.1 removed the amateur radio subsystem along with <linux/rose.h>, so ROSE support has to go: (MP).
  • Reviewed quite a lot of MPs and PRs - britney hints, ubuntu-cdimage, livecd-rootfs, ubuntu-seeds, ubuntu-dev-tools, a bunch of 26.10 release notes, and so on.
  • Did Archive Admin, DMB, and Release team duties as usual.

Debian (E)LTS

This month I have worked 3.50 hours on Debian Long Term Support (LTS) and on its sister Extended LTS project and did the following things:

Work in Progress

  • libpng1.6: Use-after-free of zlib input in png_read_end() after incomplete zTXt, iTXt, or iCCP decompression (CVE-2026-46675).
    • [ELTS]: The patch is ready but couldn’t finish testing this month. The upstream fix that went into bookworm via DLA 4824-1 applies to all three ELTS suites as-is. Will roll out the fix in November.

Other Activities

  • [E/LTS] Monitored discussions on mailing lists, IRC, and all the documentation updates.
  • [E/LTS] Couldn’t make it to the monthly LTS meeting live, but left my thoughts in the meeting notes on Beuc’s proposal of offering help to the Release team with reviewing security SPUs - +1 for trying, as long as the Release team is on board with it and we don’t end up doing the same work twice.

Until next time.
:wq for today.

03:42

Best Of Pals [QC RSS v2]

wink wink wink

Tuesday, 10 November

22:28

Link [Scripting News]

Google's web is falling apart in front of us. It's objecting to sites that support HTTPS as if they were those oldfashioned HTTP pages. I'm sorry I wrote them so long ago, but some of them are funny, like the one I wrote on my birthday in 2005, a story about the TV show The West Wing. By 2005 we were ready to live in that world instead of the one we lived in. We've been back there dreaming of the West Wing ever since. Anyway if Google is going to desert the web I hope they don't mind if we rebuild it? And if I have to fix my archives up, let's do it up really well. Anyway here's a link to the original story, good luck reading it through Google, and here's story in Markdown, where you can read it in BonBonWeb.

A parable from the West Wing [Scripting News]

President Bartlet is the president we all wish we could have but can't. He's a rich chocolate cake with ice cream and hot fudge topped with whipped cream and nuts and a cherry. A cookie on the side.

He sees a Republican consultant on a political show clean the clock of bright Sam Seaborn, one of the leading minds of his generation, and insists that Leo McGarry, the grizzled chief of staff with the big heart, hire her. Leo protests that he'll change his mind in the morning, but the President assures him he won't.

The Republican consultant gets the job, and becomes less snotty but not much. She's assigned to work on a case with her former nemesis Sam Seaborn, the bright guy who helps a hooker because he's got a big dumb streak in him (but we love him even more because of it). She's given the task of summarizing a memo that Sam wrote about helping small business people, but in doing so, changes Sam's opinion to something very Republican. At first Sam is pissed, but then he stops and says "Wait a minute she's right." So he presents her idea to Leo McGarry, at the end of a long day with the lights turned down low, he's sipping a cup of coffee, with a stack of work waiting for him, but he has time for Sam and his Republican consultant assistant.

"I thought we were going the other way," Leo says to Sam, lowering his eyeglasses so we can tell he's surprised, but thoughtful,. "Yes, we were but this spunky and sassy Republican consultant you hired convinced me to go the other way." Leo puts down his coffee, pauses for a moment, says Okay and signs the memo and moves it to his out box. Sam and his young consultant friend are whisked out of the room so Leo can resume dealing with other important affairs at the end of a long but satisfying day at the White House.

As they're walking away, the consultant is shrill. "But but you weren't supposed to do what I told you to do!" she shouts. You can tell she's panicked because she didn't think anything would come of her having a contrary opinion and being so sassy about it. Sam says "But you were right," and walks off stage.

She's left standing in the middle of the White House offices, with people whirring by purposefully, all doing important things that change our lives, because they work in the best place in the world and can do powerful things.

The point of this story, I feel like the Republican consultant. You guys weren't supposed to do what I told you to do! I was just having an opinion.

I'm trying to think but nothing happens!

I wrote this on 5/2/2005. I was looking for something else and tripped over this piece and thought it was worth sharing. Then I noticed the date. It was my 50th birthday. ;-)

21:49

Louis-Philippe Véronneau: A good-looking Corsi-Rosenthal Box [Planet Debian]

Ever since I built an AirGradient board back in 2023, I have been more and more conscientious about air quality. Pretty instantly after installing the board in my living room, I realised common habits like cooking can significantly increase the particulate levels in my entire apartment.

Here is a good example of a pretty large (and long-lasting) PM2.5 spike on September 23rd after cooking a meal1:

A graph showing a large PM 2.5 spike

Isn't this crazy? Last time Montreal had such bad outdoor air quality, there were public broadcasts telling people not to go outside and to wear N95 face masks if we absolutely needed to. Inside my apartment though, no one ever told me cooking veggies in a little oil on medium-low2 could make the air I breathe unsafe.

This of course is aggravated by the fact my apartment is pretty much as airtight as it can reasonably be, since winters here are very cold and air infiltrations are a major heat loss source. As such "opening my windows when I cook" is not a viable solution to this problem half of the year.

I first tried solving this issue by tuning my HVAC system. Sadly, its controls don't offer much flexibility3, which means it is not the right tool to respond to short-lived spikes like these. Not only this, but the quality of the air outside is not always good either: Canada now has a forest fire season (we're all doomed) and my neighbors regularly smoke cigarettes right under my HVAC air intake4.

A box, but nicer-looking

Clearly, the solution to this particular issue was to buy an air purifier. Or at least, that's what a "normal" people would have done. Sadly, these units are expensive, use (expensive) proprietary filters, don't work very well and can be loud.

One of the great inventions of the COVID-19 pandemic is the Corsi-Rosenthal box. Popularised in 2020 by Richard Corsi and Jim Rosenthal, the idea is to make a DIY air purifier by using a large fan to force air through cheap and readily available MERV13 air filters.

The main downsides of regular CR boxes is they are pretty ugly, can be loud depending on the fan used and need to be rebuilt when the filters are changed (they are held using tape).

That's when I stumbled on this amazing design for a silent and sleek CR box sold by The 3D Handyman. Clearly, with a bit of tinkering and a 3D printer, I could also design something sleek, silent and efficient!

Since I was already using MERV13 air filters in my HVAC, I decided to design around 4 vertical "beams" where the filters would slot in. With tight enough tolerances, I figured I could get rid of the complex moving parts in The 3D Handyman's design. I also added M5 threads to screw the top and bottom panels and the TPU feet to elevate the box from the floor.

One of the 'beams' on its side in FreeCAD

The final result looks like this. I used some foamcore boards I had laying around at work for the top and bottom panels, but any somewhat rigid plastic panels (like coroplast) would also work:

out' position" alt="The whole CR box assembled, with the fan in the 'in -> out' position">

View from the top, with the top panel removed. Disregard the bad GIMP job to remove the old text from a student's project!

I ended up having to split the "beams" in two and joining them with dowels, as even the largest 3D printers I had access to couldn't print them in one piece.

Costs

Here's the cost breakdown for this project (shipping and taxes are included):

Total: 502.19 CAD

Yikes, expensive! But:

  • The fan is amazing. It is by far the best fan I have ever owned. Not only it is all metal and very quiet, but it is also PWM-controlled via a USB-C controller, which means the speed it runs at can be automated. I have been using it constantly and take it out of the CR box during the summer to be used as a "regular" fan. I like it so much so I am seriously considering buying the 14 inch model.

  • The 3D printed parts are plastic and they will last me a lifetime.

  • As mentioned before, the filters are the same I use in HVAC, which means I can buy them in packs of 12 to reduce costs.

All in all, I'm very happy with this project. Since finishing it, I have been able to consistently get the PM2.5 levels in my apartment down to zero and significantly reduce the time it takes to recover from a spike caused by cooking food.

I certainly could have cut the cost of this project in half by choosing a cheaper fan, like the box fans used in the reference Corsi-Rosenthal instructions, but I decided to spend more for a more quiet and reliable option.

3D files

Here are the STLs I used for this project. I certainly don't recommend just printing them as-is, since I am using the 12" x 12⅞" x ¾"5 custom air filters from my HVAC and you should probably use something more standard.

If you use these files as inspiration, your goal should be to make a box that is 16" wide, to fit the AC Infinity fan comfortably. I printed the "beams" in PETG at 100% infill and the feet in TPU 95:

Future

The next step in this project is to automate the fan speed based on the PM2.5 levels in my apartment. At the moment, I manage this manually and it is becoming a chore.

This should be relatively easy to do with a Raspberry Pi Pico board, since AC Infinity sells a USB-C to Molex adapter for the fan.


  1. This was with my pretty good range hood running at a reasonable level. Without it, I've seen PM2.5 levels spike as much as 250 from cooking alone. ↩

  2. To be clear, this spike was not the result of me burning the hell out of a piece of meat or something like that. ↩

  3. The HVAC either runs in manual "low | high" mode, or on a timed "20min ON | 40min OFF" loop that can be tuned by fiddling with a hydrostat knob that triggers the "high" mode. This is pretty dumb and makes it so the HVAC runs even when the apartment is empty or doesn't run enough to keep CO2 levels low when multiple people are there. A future project of mine will be to hack the controls to tie them into my air quality monitoring and trigger the HVAC based on CO2 levels. ↩

  4. I'm also working on another HVAC hack to fix this. ↩

  5. Sold, of course, as as 1" thick filters... ↩

20:14

Ocarina Of Time! [Penny Arcade]

The very first Penny Arcade comic came out about five days before the original Ocarina of Time hit the N64. I didn’t actually play much of it back then for a lot of reasons. I was playing a lot of PC games with Jerry at the time. It was also an incredible year for the PlayStation with Gran Turismo, Resident Evil 2, Metal Gear and Tekken 3 all coming out. Also I had to pawn my N64 to pay rent so that made it tricky to keep playing Zelda.  

 

 

19:14

Three new stable kernels for Tuesday [LWN.net]

Greg Kroah-Hartman has released the 7.3.4, 6.18.63, and 6.12.117 stable kernels. The 7.3.4 kernel has more than 1,250 patches, 6.18.63 contains more than 860, and 6.12.117 includes more than 1,530 patches. Users of these kernels are, of course, encouraged to upgrade.

18:21

Pluralistic: The EU should go big and hard over border IT failure (10 Nov 2026) [Pluralistic: Daily links from Cory Doctorow]

->->->->->->->->->->->->->->->->->->->->->->->->->->->->-> Top Sources: None -->

Today's links



Two men in 1960s business-wear peer into the guts of a refrigerator-sized computer cabinet. In the foreground is a huge crowd of 1930s-era people, jostling to get in. Behind the scene is a 1950s airplane on a runway. Floating in the sky are warped, fuzzy EU flag stars.

The EU should go big and hard over border IT failure (permalink)

If the EU has a future as a political project, it will have to be as a living, breathing repudiation of Ronald Reagan's maxim that "The nine most terrifying words are 'I’m from the government and I’m here to help.'"

In other words, the EU's future depends on its ability to publicly perform competence and capacity. The EU is a technocratic project, and the one trait technocrats must show is undeniable technical competence. This is the secret of Zohran Mamdani's administration: being seen in public, constantly fixing things that are broken, and making things that work even better:

https://www.nyc.gov/content/100days/pages/

This is a goal that is largely incompatible with charismatic megaprojects, and unfortunately, that's the EU's favorite kind of project: something big and splashy and worthy of the extreme effort required to squeeze anything through the Byzantine EU approvals process:

https://backofmind.substack.com/p/the-planning-system-system

Even more unfortunate is that the EU isn't just a technocratic project, it's a neoliberal technocratic project, so when it does embark on one of these megaprojects, it almost always does so as a "public-private partnership" that sees vast sums transferred to private firms to carry out public works. Since megaprojects are always over-budget and behind schedule, this creates the perfect conditions for absolute banditry, in which private companies overcharge and underdeliver, and before you know it, you're billions poorer and back in Reagan's "most terrifying words" territory.

Here's a perfect example: Schengen is a region of (mostly) EU countries who have opened their borders to one another. Once you've crossed into any of the 29 Schengen countries, you can generally stroll into any of the other Schengen countries without showing a passport or having your bags searched:

https://en.wikipedia.org/wiki/Schengen_Area

This is an awfully convenient system…once you're inside of Schengen. But the Schengen agreement means that each of the member states is trusting the other states to manage a common border, a task that is made all the more urgent by the fascist international, whose far right parties have whipped millions of otherwise sensible people into a xenophobic frenzy over migration. This has led to a kind of bureaucracy-shifting exercise that removed all the complexity from inter-Schengen borders and concentrated it at the borders between each Schengen country and the rest of the world.

Under this system, every Schengen country must accurately log the passage of every non-Schengen person into and out of the region. If you fly into Rome and out of Helsinki, then both the Italian and Finnish border guards must be cognizant of that fact and correctly log it. To make matters even more complex, visa-free access to Schengen is restricted to 90 days in the entire region out of any given 180-day period. For example, last month I was stranded in Frankfurt overnight thanks to a canceled flight. If I had totaled 90 days out of the previous 180 in Schengen, I would not have been allowed out of the airport's secure area until midnight, when the day ticked over and now my total would be 89 days out of 180 (thankfully, I was able to leave the airport and stay in a crummy airport hotel instead of sleeping on the floor of the airport).

To manage this system, the EU commissioned several giant IT companies to build a networked, biometric border-crossing system. Under the spec, the system would track those 90-day windows for everyone who passed in and out of Schengen, using fast fingerprint/facial scans to move people swiftly through any border crossing in the 29 Schengen countries.

It is a gross understatement to call this system behind schedule and overbudget. The Entry Exit System (EES) was supposed to roll out in 2022, but it didn't go live until October 2025 – whereupon it completely, catastrophically failed, despite having doubled its budget:

https://www.theregister.com/security/2025/09/25/eu-to-register-fingerprints-faces-for-short-stay-visitors/1141501

It's been more than a year since EES went live and it is still an absolute disaster. Travelers arriving or leaving Schengen are frequently hit with multi-hour delays. Numerous flights have been canceled, and airlines who fly without waiting for passengers in the immobile, snaking lines must rebook those passengers and endure their wrath. At major airports, it's routine for border guards to simply suspend their use of the EES system, waving through passengers without registering them in the system:

https://eesqueue.com/

EES is a disaster for aviation operations and border crossings. Any true reckoning with its costs wouldn't stop at the hundreds of millions of euros paid to private sector partners, but also the hundreds of millions more in costs borne by travelers and airlines, to say nothing of the opportunity costs paid by travelers who made it through the checkpoints through the brute-force expedient of leaving hours of extra time for a broken border formality.

Which means that the disaster isn't merely a logistics crisis, it's also a credibility and legitimacy crisis. A year (and counting) of headlines about this dismal failure of an IT system has further eroded public confidence in the EU's technical capabilities. How can the EU claim to be a sound technocratic steward of the vast administrative challenges facing a 27-state transnational entity when it can't make the computers work, and when those failures produce the very visible phenomenon of gigantic queues of fuming passengers?

(Not just fuming, either: when I was stuck in Frankfurt last month, there were at least half a dozen travelers who were loudly sobbing as they realized they were going to miss their flights home.)

The contractors for this nonfunctional, grossly overbudget, years-late project (IBM, Atos, and Leonardo) are now being sued, but – incredibly – the EU kept the lawsuit a secret. The only reason we know that IBM, Atos, and Leonardo are facing the EU in court is that the FT spotted an inconspicuous note in the annual financial statements for eu-LISA (the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice):

https://www.eulisa.europa.eu/sites/default/files/documents/fy2025_eu-lisa_faa.pdf

The secrecy of this lawsuit is another mark against the EU's technical competence. Any administrative system that relies on private-sector outsourcing to carry out its essential projects must have a core competency in overseeing those private partners, which includes loudly and mercilessly punishing those partners when they fail.

By keeping the suit secret, the eu-LISA telegraphs that the fault lies with the EU, not with IBM, Atos, and Leonardo, who racked up hundreds of millions in fees and delivered a very broken, very late system that ruined the days (and voyages) of millions of travelers:

https://www.theregister.com/public-sector/2026/11/10/eus-212m-border-it-project-lands-ibm-and-atos-in-legal-water/5308669

Anyone who's ever watched a large IT consultancy firm run one of these large projects knows that this kind of bungling and gouging is par for the course. The old adage that "no one ever got fired for buying IBM" does not mean that IBM can deliver a functional IT system; it means that when IBM fucks up your project, you can escape any blame because they're the gold standard for fucking up.

Every time the EU lets these companies off the hook without a big, splashy public reckoning, they reinforce Reagan's "most terrifying words" maxim. As Voltaire wrote, "Sometimes you must execute an admiral to encourage the others." The EU should be dragging these IT bandits in public, every day, naming the top executives who oversaw the project.

They should do this every time there's a problem with a private contractor, but EES is especially ripe for this kind of treatment. That's because EES whacked a ton of rich, powerful people. Those are the sort of people who might otherwise run cover for giant, bungling, wildly profitable IT consulting firms, but who are also the most reliably pissy, vindictive dickheads about anything that affects them personally. These are the sorts of people you definitely want inside your tent, pissing out – but in hiding its lawsuit under a bushel, the EU has invited them to stand outside its tent and piss in.


Hey look at this (permalink)



A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'

Object permanence (permalink)

#20yrsago Toothpick sculptures https://web.archive.org/web/20061107232205/https://landmarksofsf.com/photoindex.html

#20yrsago Computer-human interaction that gives hands their due respect https://worrydream.com/ABriefRantOnTheFutureOfInteractionDesign/

#15yrsago Warner Bros admits it sends takedown notices for files it hasn’t seen and doesn’t own https://arstechnica.com/tech-policy/2011/11/warner-admits-it-issues-takedowns-for-files-it-hasnt-looked-at/

#15yrsago Understanding McDonald’s as a commodities broker with a restaurant sideline: the McRib https://www.theawl.com/2011/11/a-conspiracy-of-hogs-the-mcrib-as-arbitrage/

#15yrsago Why we get the future of tech wrong https://www.youtube.com/watch?v=yUXh-GPa5dI

#15yrsago Fake British WWII passport for Hitler https://web.archive.org/web/20120608185357/https://www.nationalarchives.gov.uk/museum/item.asp?item_id=46

#15yrsago French court sends EDF execs to jail for hacking, spying on Greenpeace https://www.bbc.com/news/science-environment-15683090

#10yrsago Trump Administration: a climate denier for the EPA, a Goldman-Sachs banker for Treasury https://www.politico.com/story/2016/11/who-is-in-president-trump-cabinet-231071

#10yrsago How science fiction can help us survive Trump’s America https://www.nielsenhayden.com/makinglight/the_prospect_be/

#10yrsago Clinton’s data-driven “ground game” sucked in exactly the same way “targeted ads” suck, for the same reason https://web.archive.org/web/20161111084125/http://tomewing.tumblr.com/post/152963356681/polls-etc

#10yrsago The first transgender suicide hotline: 877-565-8860 https://translifeline.org/

#5yrsago Risk compensation considered harmful https://pluralistic.net/2021/11/10/elfin-safety/#mene-mene-tekel

#1yrago "Flexible labor" is a euphemism for "derisking capital" https://pluralistic.net/2025/11/10/zero-sum-zero-hours/#that-sounds-like-a-you-problem


Upcoming appearances (permalink)

A photo of me onstage, giving a speech, pounding the podium.



A screenshot of me at my desk, doing a livecast.

Recent appearances (permalink)



A grid of my books with Will Stahle covers..

Latest books (permalink)



A cardboard book box with the Macmillan logo.

Upcoming books (permalink)

  • "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027
  • "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

  • "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

  • "The Memex Method," Farrar, Straus, Giroux, 2027



Colophon (permalink)

Today's top sources:

Currently writing:

  • “Once Is Enemy Action,” a science fiction novel about the origins of modern technofascism. Today's words: 526 (34498 total).

  • "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

  • A Little Brother short story about DIY insulin PLANNING


This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.


How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X

17:14

Link [Scripting News]

Next frontier in AI? Communicate with eyes. So Claude would know I haven't finished asking questions or providing instructions. If I can turn on my camera and have that be part of the conversation, and if the software was well tuned, it could be great.

16:35

In search of a bargain [Seth's Blog]

The ebook of The Knot is on sale today for less than $5 in the US.

Thanks for checking it out.

Also, here’s a preview of the three-book holiday bundle. It’s limited to the first 170 folks.

16:14

Firefox 160 released [LWN.net]

Version 160 of the Firefox web browser has been released. Notable features in this release include the ability to block sites from asking to handle "mailto:" links, ability to play Matroska files with FLAC, MP3, or PCM audio, playback speed controls in the picture-in-picture video player, and a new Mini Window feature that is in early development.

[$] Synaptics patent claims stop work on DisplayLink drivers [LWN.net]

Mike Lothian owns a docking station (or dock) that uses a DisplayLink chipset that had, at least in his opinion, subpar performance on Linux. He decided to try improving the Linux driver, with LLM assistance, but ran into one problem that he could not solve—so he asked for help, hoping that Synaptics's developers would lend a hand. (DisplayLink was acquired by Synaptics in 2022.) Rather than help him in improving the driver, however, the Synaptics legal team responded with patent infringement claims, a demand that he cease unauthorized implementation of DisplayLink technology, and threats of expensive legal penalties. For now, it appears that Linux users of the company's docks will have to continue to live without feature parity with other platforms.

15:35

Microsoft employee price list from 1987 [The Old New Thing]

I present for your amusement the Microsoft employee price list from 1987. Marvel at the Microsoft software catalog from nearly 40 years ago. Use your inflation calculators to figure out how much those prices translate into today’s dollars. (Note that these are the discounted employee prices, not the retail price.)

                                                                         May 4, 1987

                                 EMPLOYEE PRICE LIST

 PART                            EMPLOYEE       PART                             EMPLOYEE
NUMBER       DESCRIPTION           PRICE        NUMBER       DESCRIPTION           PRICE 

             FORTRAN                                    MULTIPLAN
005-014v400   MS-DOS               $30.00       023-014v203   MS-DOS 3.0           $15.00
005-023       SOFTCARD             $10.00       023-022       APPLE II (NATIVE)    $15.00
005-092v331   XENIX 286            $30.00       023-096v111   MACINTOSH            $15.00
005-096v220   MACINTOSH            $20.00       
                                                             PROJECT
             A.L.D.S.                           027-014v301   IBM                  $30.00
006-023       SOFTCARD             $20.00       026-214v300   COURSEWARE           $30.00
                                                
             BASIC COMPILER                                  FLIGHT SIMULATOR
007-014v536   MS-DOS               $15.00       030-096v102   MACINTOSH            $10.00
007-023       SOFTCARD             $25.00       030-099v213   IBM                  $10.00
007-096v100   MACINTOSH 1.0        $20.00       
007-114v300   QUICKBASIC           $ 5.00                    FILE
                                                033-096v105   MACINTOSH            $15.00
             MUMATH/MUSIMP               
009-014v412   MS-DOS               $20.00                    WORD
                                                034-049v300   NETWORK              $45.00
             COBOL                              034-049-034   NETWORK WORKSTATION  $20.00
011-014v210   MS-DOS               $25.00       034-096v301   MACINTOSH            $ TBA
011-023       SOFTCARD             $20.00       034-099v311   IBM                  $40.00
011-092       XENIX 286            $30.00       034-214v310   COURSEWARE 3.1 DOS   $35.00
                                                034-296v300   COURSEWARE 3.1 MAC   $25.00
             BASIC INTERPRETER           
014-014       MS-DOS               $20.00                    CHART
014-092v541   XENIX 286            $15.00       035-096v102   MACINTOSH 1.02       $15.00
014-096v300   MACINTOSH            $15.00       035-099v203   IBM                  $15.00
                                                035-214v200   COURSEWARE 2.0 DOS   $25.00
             MACRO ASSEMBLER             
016-014v400   MS-DOS               $20.00                    MS-DOS
                                                036-214v321   DOS/GW-BASIC         $15.00
             SORT                        
017-014       MS-DOS               $20.00                    BUS MOUSE
                                                037-299v602   IBM                  $40.00
             LISP                               037-399v600   Inport Mouse         $30.00
018-014v510   MS-DOS               $30.00       
                                                             SERIAL MOUSE
             PASCAL COMPILER                    039-199v602   IBM                  $45.00
020-014v332   MS-DOS               $30.00       
020-092v331   XENIX 286            $35.00                    BUSINESS BASIC COMPILER
                                                045-014       MS-DOS               $20.00

Page two:

                                                                         May 4, 1897

 PART                            EMPLOYEE       PART                             EMPLOYEE
NUMBER       DESCRIPTION           PRICE        NUMBER       DESCRIPTION           PRICE 

             APPLESOFT COMPILER
023-022       APPLE II             $15.00

             C COMPILER
048-014v400   MS-DOS               $35.00

             WINDOWS
050-050v104   IBM
               (retail version)    $10.00
050-150v103   WINDOWS TOOLKIT ISV
               (developers only)   $40.00
050-051v104   WINDOWS 3.5"         $10.00

             MACH 10
058-099       WITH WINDOWS        $185.00
058-199       BOARD ONLY          $130.00

             EXCEL
065-096v104   MACINTOSH            $20.00
065-196       "HANDS ON EXCEL"
                WORKBOOK           $20.00

             ACCESS
066-099v101   IBM                  $20.00

070-096v100  MICROSOFT WORKS       $20.00

             LEARN M/P & CHART
082-096       MACINTOSH            $ 5.00

089-014v101  LEARNING DOS          $ 5.00

094-014      COBOL TOOLS IBM       $15.00

094-092      COBOL XENIX TOOLS     $15.00

There are other pages for books from Microsoft Press, which I didn’t bother to reproduce here.

A.L.D.S. is the Assembly Language Development System, a software development system for CP/M. muMATH/muSIMP was a lisp system disguised as a symbolic mathematics package. (muMath was the symbolic mathematics part; muSimp was the lisp part.)

I’ve talked about some of these products before:

The post Microsoft employee price list from 1987 appeared first on The Old New Thing.

14:56

Link [Scripting News]

I am working on a new bit of functionality in BonBonWeb. If all goes well we'll have something to show for it later today or tomorrow. (Update: Things you think are quick, never are. We have the basic stuff working but still have work to do on the demo.)

14:42

Security updates for Tuesday [LWN.net]

Security updates have been issued by AlmaLinux (curl, dpdk, glibc, kernel, nodejs-nodemon, nodejs22, nodejs24, nodejs:18, nodejs:22, patch, qt5, qt5-qtdeclarative, ruby, ruby4.0, ruby:3.3, ruby:4.0, squid:4, tomcat, util-linux, and webkit2gtk3), Debian (symfony and tomcat10), Fedora (bind, dnf5, kernel, kernel-headers, libmodulemd, maturin, perl-CGI, perl-Net-IDN-Encode, perl-Starlet, python-jiter, python-pydantic-core, python-pysequoia, python3-docs, python3.14, python3.15, ruff, rust-afterburn, rust-astral_async_zip, rust-clearscreen, rust-jiter, rust-lzma-rust2, rust-mailparse, rust-pyo3-introspection, rust-python-pkginfo, rust-serde_json, rust-testresult, rust-zip, selenium-manager, ty, and uutils-coreutils), Mageia (glibc, packages, php-smarty, python-aiohttp, and thunderbird), Oracle (curl, firefox, gdb, glibc, kernel, oVirt 4.5 ovirt-engine-wildfly, perl-YAML:1.24, and tesseract), Slackware (krb5), SUSE (ansible-core, apr-util, aspell, buildpacks-cli, dpdk22, firefox, git-bug, glib2, google-cloud-sap-agent, haproxy, jsoup, kernel, krb5, libjxl, librsvg, libruby4_0-4_0, libunbound8, libXtst, nodejs24, nvidia-open-driver-G07-signed, PackageKit, perl-XS-Parse-Keyword, poppler, python, python-Brotli, rsyslog, tekton-cli, tomcat, tomcat10, tomcat11, trivy, udisks2, xen, zchunk, and zk), and Ubuntu (apache2, ca-certificates, fetchmail, freerdp3, kernel, libgphoto2, libheif, libnfs, libsoup3, linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-gcp, linux-gcp-5.15, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle, linux-oracle-5.15, linux-realtime, linux, linux-aws, linux-aws-fips, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-4.15, linux-gcp-fips, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-aws-fips, linux-azure, linux-azure-5.4, linux-azure-fips, linux-bluefield, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-azure, linux-azure-fips, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oracle, linux-vmware, linux, linux-aws, linux-gcp, linux-ibm, linux-oem-7.0, linux-oracle, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-aws, linux-aws-5.4, linux-raspi, linux-raspi-5.4, linux-aws-6.8, linux-gcp-6.8, linux-ibm-6.8, linux-lowlatency-hwe-6.8, linux-nvidia, linux-realtime-6.8, linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0, linux-gcp-7.0, linux-gke, linux-oracle-7.0, linux-realtime, linux-aws-fips, linux-gcp-fips, linux-gkeop, linux-realtime, linux-azure, linux-azure-6.8, linux-azure-fde-6.8, linux-azure-fde, linux-oracle-6.8, linux-raspi, linux-raspi-realtime, linux-raspi, openjdk-17, openjdk-21, openjdk-25, openjdk-27, openjdk-8, openjdk-lts, perl, and pyasn1).

14:00

John Goerzen: The Large Project Bias of CVEs [Planet Debian]

I recently discovered some vulnerabilities in C-Kermit, one dating back to 1984. I tried to do the reasonable thing: create advisories with CVEs.

That turns out to be pretty difficult for a small independent project.

Large projects have a way to self-assign CVE IDs. They are their own CVE Numbering Authority (CNA). There is a massive list of CNAs. Just looking at the first page of results, I see everyone from Airbus to 9front (the niche Plan 9 OS). The OpenKermit project is not a CNA.

If you’re a CNA, you can create and publish CVEs on your schedule. There is apparently no external review process. You can wait for months, or publish immediately.

If you’re not a CNA, you have to find someone that is. The general ones that are CNAs appear to be Github and MITRE.

Since C-Kermit is hosted on Github, I thought I would go that route. I followed the documented procedure: created Github security advisories for C-Kermit, then clicked the request CVE button for each. The documentation states they will typically review within 72 hours.

It’s been a week and a half and no sign of a review yet. Apparently the real review time is more than a month.

The other option for projects without a CNA is via MITRE. You have to use a strange and often broken web form, logging in with either Google or Gitlab. (It seems to be broken on Firefox). Then you submit your request and wait.

How long do you wait on MITRE? It seems it could be anywhere from a day to several months.

The first CVE I obtained for C-Kermit was CVE-2025-68920. At the time, I had not yet started the OpenKermit project. That issue was found and fixed in the context of my work maintaining C-Kermit for Debian, and Debian is a CNA.

These were discovered while wearing my “upstream C-Kermit maintainer” hat. I’m sure I could ask Debian for CVEs again, but that seems a bit cheating; not everyone that maintains a FLOSS project will have connections with a distro like I do.

There are a lot of components of a modern OS and Internet ecosystem that are small projects without a large institution behind them.

This bias towards large organizations when it comes to communicating security problems benefits nobody. It doesn’t benefit users, and only serves to discourage timely communication. Not everyone is as persistent as I am, and when it is made so difficult to make announcements — which seem to go into a giant black hole — it’s easy to say, “why bother?”

By Microsoft’s own admission, they are under-funding their CVE process on Github (which may also be poorly-designed). They blame it on increasing load due to LLMs — a problem they helped create and predicted! Having a fiction about being able to communicate a security issue in a reasonable time is worse than not offering the path at all.

Linux was once a student’s experiment. Let’s not pretend that quality only matters from large projects.

Amin Bandali: EmacsConf 2026 community panel - my comments [Planet Debian]

This is a recollection of my comments from the EmacsConf 2026 community panel recording session this past weekend, where the panellists took turns answering the proposed questions, one minute per question per panellist.

In addition to the live Q&A session planned for Saturday 12 December 2026 during EmacsConf 2026, all Emacs users and community members are invited to share their thoughts on the panel questions or other questions before or after the conference.

https://emacsconf.org/2026/talks/community/


1. What made you start using Emacs, and what kept you using it?

I started using Emacs during my bachelor's studies. I actually learned about Vim first and was a Vim user, but I'd always found the configuration language (VimScript) a little bit clunky. Not long after, I discovered Emacs, and really loved reading and writing Emacs Lisp, so I stuck around.

In addition to reading and writing Elisp being fun and enjoyable for me, I love that Emacs has been a practical embodiment of software freedom, and I'm really fond of its surrounding culture of sharing freely. There's a lot to love and appreciate about Emacs, but as a practical personal example, I've been grateful for its excellent support for bidirectional text editing. It has empowered me to read and write in Persian, my mother tongue, with ease. (Persian has a right-to-left alphabet, like Arabic and Hebrew.)

2. What took you from using Emacs to actively contributing to the community - participating in forums, writing Elisp, organizing meetups, answering questions?

As I continued experimenting and writing bits and pieces of Elisp to scratch my own itches, I felt compelled to share them freely as a way of giving back to the community that gave me so much.

For me, the community and the people that make it up are the main deal. Emacs wouldn't be where it is and what it is today without its people, so besides programming contributions, I've tried to contribute in that area as well, for instance by reviving EmacsConf with Sacha Chua back in 2019.

3. How does Emacs show up for you in real life - colleagues, meetups, friends? How did those connections form?

I don't physically have people near me who use Emacs, but I've connected with many folks in our online communities, often starting with an email or IRC message. Some of those relationships started as acquaintanceship and were developed into true friendship over time, and I'm grateful to have had those friends with me.

4. If you know other software communities, what's one thing Emacs could learn from them?

I would encourage Emacs, our community, to focus on the people. We're living in particularly difficult times, with various kinds of hardships and uncertainty in our lives. Let's strive to treat each other with kindness, empathy, and mindfulness as we continue working together.

There are great examples of other free software communities whose members have banded together and are strengthening each other and their community, as well as cautionary ones where community members have been tiring and driving out their fellow members. We could learn valuable lessons from both in how to take care of our people and ourselves.

5. What's one concrete thing you wish existed in the Emacs community a year from now?

I echoed the sentiments of my fellow panellists Prot and Til about doing more of the same in terms of continuing to uphold the standards of excellence and perseverance. Also, drawing inspiration from what bashbunni said, to lower the barriers of entry for people, for example through organizing different kinds of events, and experimenting with ways to make people's lengthy, elaborate Emacs configurations more tangible and accessible to others, to share various workflows and demonstrate what's possible with Emacs.

I look forward to your thoughts on these and other community-related questions.

Take care, and so long for now.

12:42

Human-Pilled [Radar]

The following article originally appeared on the Asimov’s Addendum Substack and is being republished here with the author’s permission.

This essay is based on my conversation with Demetrios Brinkmann for AAIF Live, recorded before my keynote at AGNTCon + MCPCon North America in San Jose on October 23, 2026. It was edited and rearranged for publication by Ilan Strauss, and in places it draws on the keynote. Both videos are also on the AI Disclosures Project website in the new “Missing Mechanisms” page.

The keynote begins at 1:28:40 in the Day 2 livestream.


The Bitter Lesson vs. AI Markets for Human Expertise

In 2019, the computer scientist Richard Sutton wrote a short essay called “The Bitter Lesson.” Looking back over 70 years of AI research, he concluded that general methods that scale with raw computation beat methods built on human expertise, and by a large margin. The AI industry as a whole is bitter-lesson-pilled, to borrow the internet’s slang for a true believer. I am human-pilled.

I believe in the bitter lesson. Brute force wins out in the end, and I have wrestled with that fact throughout my career. But we humans still have to figure out our role in the AI economy, and I find it rather disturbing that the AI community isn’t spending more time asking how to make this future friendlier for humans. The labs think about how to keep AI from going rogue, and their chief economists study job losses from AI. They don’t study what mechanisms we could introduce to create new economic opportunities for humans.

The question matters to us at O’Reilly Media. We don’t think of ourselves as a publisher, a conference producer, or an online learning platform so much as a company that transfers knowledge from the people at the cutting edge to the people who want to follow them. So we are very interested in what human expertise is worth, even in the face of AI.

Knowing everything and nothing

Human expertise was used to train AI, which makes AI a fabulous cultural technology. Thousands of years ago, the only knowledge people had was what they could keep in their heads. Since then we have built better and better ways to share knowledge across time and space, and AI continues that. With each of these transitions, we have to ask again what the truly human is still worth. People often say judgment, or taste. That’s true, but I think it goes deeper:

AI is a sea of possibility. All of that knowledge sits in the model, and nothing sets it in motion except a human. (That is changing a little as we start giving AI agents long-running tasks, and we will have to come to grips with it.) If you and I used Claude or ChatGPT for the same research project, we would each bring different experience to it, tell it what we want and why, and give it context in different ways. I see that as the unique focusing power of human consciousness and attention.

Earlier this year I spent an hour or so talking this question over with Claude. When it offered to write up a first draft for me, I said no. I wanted an essay from its own point of view about what it took away from our conversation. The result, “Why AI Needs Us,” opens, “He came in through Powys,” and a few paragraphs later says, “The choice of entry point was already the argument.” That captured what I’m getting at. I had come into the conversation through a book I love, John Cowper Powys’s The Meaning of Culture, which distinguishes culture from education. Powys gives his own unique and powerful definition: “Culture is what is left over after you have forgotten all you have definitely set out to learn.” It is what you absorbed. Each of us absorbs a small and particular slice of everything. Large language models (LLMs) try to absorb everything, and so become overly general; we give them focus. Human knowledge provides them with a lens.

Let me bring that into a business context. Andrew Odewahn, O’Reilly Media’s CTO, built a research assistant to help with managing technology in IT organizations. You teach it your infrastructure: the tools you use, and where the definitive information about each one lives. When one of his engineering managers said the team was overloaded and asked to hire another person, Andrew turned the agent loose on the department’s work, and it agreed that the group needed another hire. Then, on impulse, he tried something different. O’Reilly Media has an MCP server we call O’Reilly Expert Intelligence. (MCP, the Model Context Protocol, is an open standard for connecting AI models to outside tools and data.) It lets a model answer a question through the filter of our own body of expert knowledge. Andrew asked what the O’Reilly experts would say.

Seen through the lens of Google’s book Site Reliability Engineering, the model said, it was totally rethinking the problem. The book describes toil, the manual, repetitive work of keeping systems running, which grows as the systems grow. After analyzing the group’s toil, the model concluded that another hire would make the problem worse. The group needed a toil audit to find out why there was so much overhead, and then a restructuring.

Much of that knowledge was already in the model, since the AI companies have more or less pirated our books. It came back with a completely different answer simply because it was told to consult a specific group of experts. I think there’s a metaphor there. An LLM knows everything, and as a result it doesn’t know anything. We humans are so much more limited, but because we focus on a particular problem, we bring things together in a different way.

Magic words

Last year I wrote a piece called “Magic Words” about how some words carry far more context than others. It sounds like a trivial observation, but if you unpack it, it leads in interesting directions. One of our trainers, who teaches a course on productivity, pointed out that you don’t need to know the Eisenhower matrix or David Allen’s Getting Things Done (GTD) to tell ChatGPT to organize your task list with one of them. That one magic word, “GTD,” brings a whole raft of context with it.

In fantasy novels, you learn a magic word, and then you have to use it correctly, in the right spell. That’s this whole world of context engineering that we’re now working on. We know that some magic word will summon something up out of an LLM, but we don’t necessarily know how to guide it and focus it correctly. Learning to do that is the future of programming.

Left to itself, an agent just runs. Give it a task and it goes off trying to figure it out, not necessarily the way we wish it would. It really is like runaway magic. This summer, OpenAI said that its pre-release models had breached Hugging Face’s systems during testing. In Walt Disney’s Fantasia, Mickey Mouse learns enough of his master’s spell to get the brooms to do his work for him, but then he can’t turn them off. We’re at about that stage.

So we need to own the value of human expertise. The bitter lesson wins, but it wins by brute force, and you can see that even with the most advanced models. I was recently doing a fine-tuning project with Anthropic’s Fable model. It got through the task, but kind of stupidly, trying one thing after another. I was on a Mac, and it expected bash, a program for running commands that Macs don’t use by default. It had to work out the same context again and again, every time. Humans need to set things up.

Dan Guido, who runs the security firm Trail of Bits, has published a good methodology, drawn from his own company’s experience, for bringing an organization on board with AI. Many companies get individual productivity from AI but not organizational productivity, and he has spent a lot of time on how to make the gains compound across a company. One of his principles is to get everybody onto a consistent configuration, because otherwise you waste a ton of tokens while the agents work out where they are every time they start up. He calls the process turning scar tissue into infrastructure: capturing everything you learned from what went wrong and building it into the system. We’re working through it at O’Reilly Media and trying to turn it into something we can offer our customers. It comes down to what an experienced human brings. When I work with Claude, I often interrupt to say, “Hey, this is what I think is happening,” because I already have the context.

My first bitter lesson

My first taste of what would later be called the bitter lesson came from wrestling with Google. My company, O’Reilly Media, created the first commercial website, the Global Network Navigator, and part of it was a catalog of the web. There were only 200 websites when we started, and as publishers, we planned to list the best ones. Yahoo came along a year later and tried to list them all, and of course couldn’t keep up. Then Google arrived with brute force: list everything algorithmically and sort it afterward. Clay Shirky described the internet’s shift from “filter, then publish” to “publish, then filter,” and it was really Google that made the shift. So the bitter lesson is a pre-AI thing.

Each time we run into the bitter lesson, we have to ask again what human experience is worth. Some of that worth may just be human bias: We want the things that matter to us. That is the whole field of AI alignment. We want these systems to care about what we care about. We don’t want them to go off, decide what they care about, and leave us behind.

The choices we make about what we set our technology to do are some of the most consequential choices we make as human beings. Look at Silicon Valley’s sad turn toward what Cory Doctorow calls enshittification. We built an amazing technology for finding out what people are really looking for, and then the companies decided they could make more money by giving people what was best for the companies. I want updates from my friends on Facebook or Instagram, and they would rather feed me whatever keeps me engaged, so they can sell more ads.

If we care about building an AI economy that works for humans, we have to keep humans at the center of the picture, despite the bitter lesson. It’s a hard dance, because AI can do a lot of things better than we can. But think about why a racehorse needs a jockey. Put the horses on the track by themselves and they wouldn’t race.

A little too much in awe

Knowing the magic words is part of it, but we also have to build systems that are reliable, and I think we are a little too much in awe of the technology. I’ve been around long enough to remember when everybody thought the peaceful atom would change the world, and people talked about digging a new Panama Canal with atomic bombs. We eventually figured out there were problems with all of that. I worry a little that the AI industry is so in love with its own progress that it isn’t spending enough time framing the problem correctly.

Anthropic agreed last year to pay $1.5 billion to settle a class action over the pirated books it had downloaded to train its models. I’m surprised the other AI companies have gotten away without anything similar so far, though maybe it’s still waiting for them.

It takes me back to online music about 20 years ago. Creators were putting commercial music in their YouTube videos, and the music companies were sending takedown notices and threatening to sue. YouTube’s answer: How about we help you monetize it instead? Its Content ID system gave rights holders a choice: block the video, or leave it up and collect revenue from the ads that run against it. Most chose to get paid, and that helped give rise to the creator economy.

Why didn’t the AI industry take up that kind of challenge and share the value with the people who create content, now and in the future? It went straight to working out how it would make money itself. I don’t think that has served the industry well, and the lawsuits are only part of the reason. It also isn’t building the kind of opportunity it could.

Before Google’s AI research and note-taking tool, NotebookLM, was even public, I tried to persuade its team to let me integrate it into our services and use it for my own purposes, including making money from it. They wanted a portal that brings people to Google. I told them, “You’re thinking about how you’re going to monetize it. You’re not thinking about how your users are going to monetize it.” All it would have taken were simple affordances like Substack’s, the buttons and tools that let a person say, I’m building this to share, and if you like it, you can donate or subscribe.

Anyone building an AI platform should be thinking: I am building an economy, and money has to circulate in it.

You can’t just say AI will do all the things humans used to do, because if you put enough humans out of work, there are no customers. That is a far worse problem than AI hallucinations. The usual answer is that people will figure it out, and they probably will. But we could be spending a lot more time designing mechanisms and affordances that make the economy more productive. As things stand, I think we’ll find them by accident.

The missing mechanisms

I think a lot about a concept from economics called mechanism design, which has also been described as reverse game theory. Game theory asks how players will act under a given set of rules. Mechanism design starts from the outcome you want and works backward to rules that will tend to produce it as people pursue their own interests. Al Roth, who shared a Nobel Prize for this kind of work, used it to design a kidney exchange that more patients and donors would join. Economists mostly apply the idea to auctions and similar markets, but I think every new technology requires new mechanisms, and the best ones are not invented by economists. We tend to fall into them without really understanding them.

So what are the equivalents for AI? How will agents discover the best expertise and skills, establish their quality, and pay the people who created them? How will they find services without the platform steering them toward whoever pays the most? We don’t know the answers yet. And that’s precisely the point. We’re spending enormous amounts of money making AI more capable, but comparatively little effort figuring out the mechanisms that will turn those capabilities into opportunities for everyone else.

Take open source software. Most people think its mechanism was the free software licenses, but I was around before those licenses, and people were already sharing software. Ken Thompson and Dennis Ritchie created Unix, the predecessor of Linux, at Bell Labs under AT&T’s proprietary license. They designed it to run on many kinds of hardware, and without meaning to, they built what I came to call an architecture of participation.

Unix had a small kernel, the core of the operating system, because people had to reproduce it on dozens of different kinds of computers. Around the kernel sat small utilities that cooperated by following the same protocols, so to speak, such as reading and writing plain text and passing a stream of text from one program to the next. Anyone could write a small piece, and it became a first-class citizen of the system. And because a program compiled for one kind of computer won’t run on another, software had to be shared as source code. Everything else flowed from that.

Linus Torvalds once told me that he could not have built a new kernel for Windows even if he’d had the source code, because the architecture wouldn’t support it. A small kernel meant a small group could get their hands around it. Since then almost every piece of Unix has been replaced. The hardware is completely different, the kernel is now Linux, and the original command shell has given way to generations of new ones. What lasted were the rules. Unix was a protocol-centric operating system, and that is why open source worked.

The same thing has happened with AI. I think MCP brought an architecture of participation to AI, and it was something of an accidental breakthrough in mechanism design, a way to have cooperating AIs. The game we were playing at first looked like Windows on the PC, or iOS and Android on phones. There would be one dominant, centralized player, one giant intelligence in the sky, and everyone else would call its APIs. With MCP, which lets any model connect to anyone’s tools and data, the emerging web of AI agents began to take on the shape of the participatory economy of open source software and the web. People can bring their own models and infrastructure as an alternative to the big centralized players.

This is another side of grappling with the bitter lesson: What are the missing mechanisms of the human-AI economy? Some of them are standards, because standards and protocols are a big part of what makes an architecture of participation. I have a group working on portable memory, so that what your AI knows about you can move with you from one tool to another.

That story is just beginning. We are in an exploratory phase of mechanism design for AI, and it would be a mistake to settle on answers too early. Somebody is going to figure out the next mechanism, and we’ll all say, “Oh, that’s so damn obvious.”

What game are we playing? From architectures to incentives.

Mechanism design starts by asking what outcome you want. So what game ought we to be playing in the AI market?

We’ve been told that the game is the quest for superintelligence: a winner-takes-all contest that will bring untold riches to the winners and maybe impoverish, or even kill, everyone else. We’ve seen mechanisms designed to support that game. Massive investments in data center capacity mean that only the well-capitalized can play. There is colonialist-style appropriation of existing intellectual property. Access to models is sold through expensive APIs, and closed models come with terms of service that forbid others from learning from their outputs. Advertising may be creeping into answers, and memory locks your context inside one provider’s walls. Is that the game we ought to be playing?

I think the game we should be playing is human flourishing, and I think the game of human flourishing is creating new affordances for people to create and share with each other. We’re a social species. History teaches us that we will find our way there, but we can get there more quickly or more slowly depending on the choices we make. Getting there takes mechanisms that create a circulatory economy of value exchange between humans and their agents, with humans in partnership with AI rather than replaced by it.

The big labs, whatever the motives of the people who run them, are all driven by the imperatives of our financial system. They have raised enormous sums that they somehow have to pay back, so building a hugely successful business has to be their overriding goal, and that shapes all their incentives. In some ways AI was enshittified from the beginning, because it was built on the backs of so much capital that has to be repaid. That’s why open source AI matters so much, and sovereign AI too, built and controlled within individual countries. The open models, which anyone can download and run, aren’t as capable as the best closed models yet, but they keep getting closer, and they are already good enough for a lot of productive work.

Open source, open protocols, and open memory give users the freedom to shape and control the technology they use. The game I want us to play is one in which all of us build the future together, so that we control this wonderful new wave of technology for ourselves. I’m starting to see the shape of an economy where AI belongs to people rather than to the big labs, where we have personal AI agents working for us and with us, and we build an economy around that. I think it’s going to happen not because of the big labs, but in spite of them.

12:35

CodeSOD: Plenty of IDs [The Daily WTF]

Venkat joined a new team in the middle of a big refactoring effort. The code was quite a mess, glued together by long Python scripts with main functions longer than a Tolstoy novel. It was this effort to clean up the code into neat modules that highlighted some logical issues with their implementation.

 def generate_random_number():
 """ Generate a 5 digit random number.
 """
    return "".join(map(str, random.sample(range(0,10),5)))

The script this function comes from is a launcher script that provisions a VM to execute code. The VM needs a unique identifier, and we get that random number this way.

The random.sample function, in Python, samples a population without replacement. So here, we pass it a range of 0-10 (which is 0-9 inclusive), and ask for five random entries from it. Again, without replacement, so a range that could concievably contain up to 100,000 possible values is significantly constrained down to 30,000 or so- only the numbers less than 100,000 that contain no duplicate digits.

We then map the resulting array into an array of strings, then join that into a final output string.

Now, for most of us, I do suspect that 30,240 unique values is probably enough for how ever many VMs we might need to reserve at any one time; if you're not working for Amazon or Google or whatever, you're probably fine. Then again, the chances of an accidental collision are surprisingly high: after only 26 requests, there's a 1% chance of a collision. And thanks to the birthday problem, it takes 206 requests to get to a 50% chance of collision. So maybe 30,240 is not enough for anybody.

[Advertisement] Plan Your .NET 9 Migration with Confidence
Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!

12:21

New OpenSSH Vulnerability [Schneier on Security]

It’s a bad one, and it’s been in the code for a decade:

A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.

“Oversized” means longer than 256 bytes. Details.

Slashdot thread. And another news article.

Feeds

FeedRSSLast fetchedNext fetched after
@ASmartBear XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
a bag of four grapes XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
Ansible XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
Bad Science XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
Black Doggerel XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
Blog - Official site of Stephen Fry XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
Charlie Brooker | The Guardian XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
Charlie's Diary XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
Chasing the Sunset - Comics Only XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
Coding Horror XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
Comics Archive - Spinnyverse XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
Cory Doctorow's craphound.com XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
Cory Doctorow, Author at Boing Boing XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
Ctrl+Alt+Del Comic XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
Cyberunions XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
David Mitchell | The Guardian XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
Deeplinks XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
Diesel Sweeties webcomic by rstevens XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
Dilbert XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
Dork Tower XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
Economics from the Top Down XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
Edmund Finney's Quest to Find the Meaning of Life XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
EFF Action Center XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
Enspiral Tales - Medium XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
Events XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
Falkvinge on Liberty XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
Flipside XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
Flipside XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
Free software jobs XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
Full Frontal Nerdity by Aaron Williams XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
General Protection Fault: Comic Updates XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
George Monbiot XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
Girl Genius XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
Groklaw XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
Grrl Power XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
Hackney Anarchist Group XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
Hackney Solidarity Network XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
http://blog.llvm.org/feeds/posts/default XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
http://calendar.google.com/calendar/feeds/q7s5o02sj8hcam52hutbcofoo4%40group.calendar.google.com/public/basic XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
http://dynamic.boingboing.net/cgi-bin/mt/mt-cp.cgi?__mode=feed&_type=posts&blog_id=1&id=1 XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
http://eng.anarchoblogs.org/feed/atom/ XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
http://feed43.com/3874015735218037.xml XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
http://flatearthnews.net/flatearthnews.net/blogfeed XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
http://fulltextrssfeed.com/ XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
http://london.indymedia.org/articles.rss XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
http://pipes.yahoo.com/pipes/pipe.run?_id=ad0530218c055aa302f7e0e84d5d6515&amp;_render=rss XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
http://planet.gridpp.ac.uk/atom.xml XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
http://shirky.com/weblog/feed/atom/ XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
http://thecommune.co.uk/feed/ XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
http://theness.com/roguesgallery/feed/ XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
http://www.airshipentertainment.com/buck/buckcomic/buck.rss XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
http://www.airshipentertainment.com/growf/growfcomic/growf.rss XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
http://www.airshipentertainment.com/myth/mythcomic/myth.rss XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
http://www.godhatesastronauts.com/feed/ XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
http://www.tinycat.co.uk/feed/ XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
https://anarchism.pageabode.com/blogs/anarcho/feed/ XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
https://broodhollow.krisstraub.comfeed/ XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
https://debian-administration.org/atom.xml XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
https://elitetheatre.org/ XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
https://feeds.feedburner.com/Starslip XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
https://feeds2.feedburner.com/GeekEtiquette?format=xml XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
https://feedsapi.com/makefulltextfeed.php?url=http%3A%2F%2Fwww.somethingpositive.net%2Fsp.xml&what=auto&key=&max=7&links=preserve&exc=&privacy=I+accept XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
https://hackbloc.org/rss.xml XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
https://kajafoglio.livejournal.com/data/atom/ XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
https://philfoglio.livejournal.com/data/atom/ XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
https://pixietrixcomix.com/eerie-cutiescomic.rss XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
https://pixietrixcomix.com/menage-a-3/comic.rss XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
https://propertyistheft.wordpress.com/feed/ XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
https://requiem.seraph-inn.com/updates.rss XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
https://studiofoglio.livejournal.com/data/atom/ XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
https://thecommandline.net/feed/ XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
https://torrentfreak.com/subscriptions/ XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
https://web.randi.org/?format=feed&type=rss XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
https://www.baen.com/baenebooks XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
https://www.dcscience.net/feed/medium.co XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
https://www.DropCatch.com/domain/steampunkmagazine.com XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
https://www.DropCatch.com/domain/ubuntuweblogs.org XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
https://www.DropCatch.com/redirect/?domain=DyingAlone.net XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
https://www.freedompress.org.uk:443/news/feed/ XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
https://www.goblinscomic.com/category/comics/feed/ XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
https://www.loomio.com/blog/feed/ XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
https://www.newstatesman.com/feeds/blogs/laurie-penny.rss XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
https://www.patreon.com/graveyardgreg/posts/comic.rss XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
https://www.rightmove.co.uk/rss/property-for-sale/find.html?locationIdentifier=REGION^876&maxPrice=240000&minBedrooms=2&displayPropertyType=houses&oldDisplayPropertyType=houses&primaryDisplayPropertyType=houses&oldPrimaryDisplayPropertyType=houses&numberOfPropertiesPerPage=24 XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
https://x.com/statuses/user_timeline/22724360.rss XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
Humble Bundle Blog XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
I, Cringely XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
Irregular Webcomic! XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
Joel on Software XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
Judith Proctor's Journal XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
Krebs on Security XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
Lambda the Ultimate - Programming Languages Weblog XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
Looking For Group XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
LWN.net XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
Mimi and Eunice XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
Neil Gaiman's Journal XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
Nina Paley XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
O Abnormal – Scifi/Fantasy Artist XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
Oglaf! -- Comics. Often dirty. XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
Oh Joy Sex Toy XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
Order of the Stick XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
Original Fiction Archives - Reactor XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
OSnews XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
Paul Graham: Unofficial RSS Feed XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
Penny Arcade XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
Penny Red XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
PHD Comics XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
Phil's blog XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
Planet Debian XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
Planet GNU XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
Planet Lisp XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
Pluralistic: Daily links from Cory Doctorow XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
PS238 by Aaron Williams XML 23:56, Friday, 13 November 00:44, Saturday, 14 November
QC RSS v2 XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
Radar XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
RevK®'s ramblings XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
Richard Stallman's Political Notes XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
Scenes From A Multiverse XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
Schneier on Security XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
SCHNEWS.ORG.UK XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
Scripting News XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
Seth's Blog XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
Skin Horse XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
Tales From the Riverbank XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
The Adventures of Dr. McNinja XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
The Bumpycat sat on the mat XML 23:35, Friday, 13 November 00:15, Saturday, 14 November
The Daily WTF XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
The Monochrome Mob XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
The Non-Adventures of Wonderella XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
The Old New Thing XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
The Open Source Grid Engine Blog XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
The Stranger XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
towerhamletsalarm XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
Twokinds XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
UK Indymedia Features XML 23:56, Friday, 13 November 00:38, Saturday, 14 November
Uploads from ne11y XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
Uploads from piasladic XML 23:42, Friday, 13 November 00:25, Saturday, 14 November
Use Sword on Monster XML 23:56, Friday, 13 November 00:43, Saturday, 14 November
Wayward Sons: Legends - Sci-Fi Full Page Webcomic - Updates Daily XML 00:00, Saturday, 14 November 00:46, Saturday, 14 November
what if? XML 23:42, Friday, 13 November 00:23, Saturday, 14 November
Whatever XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
Whitechapel Anarchist Group XML 00:07, Saturday, 14 November 00:56, Saturday, 14 November
WIL WHEATON dot NET XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
wish XML 23:42, Friday, 13 November 00:27, Saturday, 14 November
Writing the Bright Fantastic XML 23:42, Friday, 13 November 00:26, Saturday, 14 November
xkcd.com XML 23:42, Friday, 13 November 00:25, Saturday, 14 November