Chatbots asked for a “controversial” take on humans say we’re more loyal to belonging than to truth. Where do they get that idea? CC-licensed photo by Grace Lutheran Church on Flickr.

You can sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 10 links for you. Unconverted. I’m @charlesarthur on Twitter. On Threads: charles_arthur. On Mastodon: https://newsie.social/@charlesarthur. On Bluesky: @charlesarthur.bsky.social. Observations and links welcome.

‘Bold but sane’: what we learnt from Anthropic’s 240,000-word IPO filing • Financial Times

George Hammond and Ryan McMorrow:

»

Anthropic has unveiled its long-awaited listing prospectus, detailing over more than 300 pages how its technology could cure disease and grow the economy, provided it does not first cause “catastrophic or existential risks to humanity”.

The filing puts Anthropic on track for a blockbuster listing next month. The initial public offering on Nasdaq, under the ticker ANT, will serve as a referendum on whether public market investors are sold on the visionary zeal with which Dario Amodei’s AI lab has wooed private backers.

Investors will have to swallow a complex governance structure that gives ordinary shareholders almost no power, as well as extraordinary financial and societal risks.

Alongside dizzying growth and $800bn in data centre spending commitments, the company’s founders urge prospective owners of the stock “not to think of your purchase in purely transactional terms”.

…The S-1 provided the clearest picture yet of Anthropic’s soaring revenue, which rose from $4.6bn last year to more than $33bn in the nine months to the end of September, according to the filing and figures recently shared with investors. Revenue per head at the five-year-old group over the past year is $6.6m.

But there is a significant risk underlying that rapid growth. Just five customers accounted for 25% of revenue in the first nine months of the year, while only 250 spent more than $10m on an annual basis. Anthropic also warned that its rapid growth to date “may reflect early-stage adoption”, and could stall in the months to come.

Its revenue growth has slowed this year. After more than doubling between the first two quarters of 2026, revenue grew almost 50% between the second and third quarters.

…To support its spending in the near term, the start-up has a cash pile of $112bn on hand. Anthropic is pushing to become profitable, focusing on using its scarce computing power more efficiently, including by using its AI model Claude to train newer models.

Anthropic spent just over $2.50 on computing power and infrastructure for every $1 of revenue in the first quarter of 2025. During the second quarter of 2026, that was down to less than 50 cents.

«

Big gamble. When Google published its S-1 in 2004, people were astonished to discover it had been profitable for ages. This is a different bet: more like Mosaic back in the day, perhaps.
unique link to this extract

Some iPhone Duo screens are already failing • Ars Technica

Ryan Whitwam:

»

The iPhone Duo launched last week, offering anyone willing to spend $2,000 a chance to experience Apple’s first foldable phone. For some early buyers, the morning after isn’t going great. Despite the company’s big talk about its “precision-engineered” hinge, some devices appear to have a hardware flaw that destroys the device’s impressive internal display within hours (or minutes) of use.

The Internet is currently overflowing with images of busted iPhone Duos, all sporting almost identical damage. The OLED is marred by several bright lines originating just below the midpoint of the display. These bands of damaged pixels extend all the way to the bottom and right edges. Some units also show lines of dead pixels following the crease from the top to the area where the bright lines begin.

Anyone who has seen a damaged OLED panel will be familiar with this type of defect. When the layers of the display are damaged, the pixels no longer receive the correct voltage to illuminate them. Instead, they get the full driving voltage and are permanently on at maximum brightness. Some pixels can get no voltage, leaving them totally black. The only fix is to replace the OLED, but swapping the iPhone Duo’s screen reportedly costs half as much as the device itself.

It sounds like most affected devices are failing within about a day of use. But a few unlucky buyers note they only opened and closed the phone a few times, and in some cases, they hadn’t even finished the initial setup process.

«

Apple has acknowledged the problem, and said people should take their phones to Apple Stores to get replacements. Embarrassing. But also, making foldable phones is difficult: failure is almost guaranteed because folding anything causes irreversible mechanical strain.
unique link to this extract

Why popular airplanes are getting scrapped years early • CNBC

Leslie Josephs:

»

A major reason for the young retirements [of aircraft, which are being scrapped on average four or five years after production rather than the usual 20] is the long wait and rising prices for jet engines.

One problem is that cutting-edge engines that burn hotter and use less fuel are coming up for maintenance far earlier than airlines expected.

The maintenance requests have kept engine repair and overhaul facilities backed up, from those owned by manufacturing giants GE Aerospace and RTX unit Pratt & Whitney to smaller, independent ones. Airlines and leasing firms have been hunting for spare parts and engines anywhere they can find them, like here in Goodyear, Arizona.

The trend has added more fuel to the already hot secondhand parts market. An engine fan blade could cost $50,000 or even more than $100,000 for bigger jets, Goodson said. Engines that power some Airbus A320neo aircraft have 20 of those blades. A disc for the engine, meanwhile, could cost between $1m and $2m.

An engine recall because of a manufacturing defect has backed up repair shops and grounded hundreds of Airbus planes around the world. Spirit Airlines bore the brunt of that problem in the United States, years before the airline collapsed.

The engine is made by Pratt & Whitney, which issued the recall in 2023 after discovering contaminated powdered metal used in making some parts. Those engines are worth close to $17m this year at the high end, up 60% from the upper end of the range in 2019, according to IBA. 

Airlines are removing some engines off retired planes to keep current aircraft flying while they wait for engines to come back from the shop.

«

The desire for the cutting-edge engines is heightened by the fuel price crisis. (Thanks Karsten L for the link.)
unique link to this extract

Rest of World faces prospect of shutting down • Semafor

Max Tani:

»

The globally-minded tech news startup Rest of World is scrambling to find a new home — or faces the prospect of shutting down.

The six-year-old digital publication has seen the social and web search traffic on which it depends evaporate. This sharp decline has prompted the organization’s founder and primary financial backer, Sophie Schmidt [daughter of former Google CEO Eric Schmidt], to explore other options for its future.

In recent months, Schmidt has held conversations with what one person familiar with the situation described as several large institutions about potentially absorbing Rest of World. But while conversations with potential partners are ongoing, the organization is also preparing for a grimmer outcome. Two people familiar with the plans told Semafor that the organization has selected a wind-down date for the publication in late January, a contingency intended to ensure employees receive exit packages and to give them a chance to look for new jobs if they so choose.

Schmidt wrote in an email to donors, in anticipation of this report, that Rest of World will “cease publishing as a standalone entity” at the end of January, according to The New York Times.

Schmidt declined to comment. One person familiar with her thinking told Semafor that while Schmidt is proud of the organization’s staff and journalism, she has privately conceded that the decline in audience has lessened Rest of World’s impact.

Rest of World launched in 2020 with an ambitious goal: to shift Western perspectives by telling global stories about technology often ignored by the mainstream US news outlets. A few months into its launch, Schmidt described the outlet as her “life’s project,” and told The Wall Street Journal that she would commit $60m to it.

«

This is really sad. RoW is a fantastic publication which has a completely different focus to so many outlets.
unique link to this extract

Every AI model has the same “controversial” take on humans • ModelCompare

»

“Humans are more loyal to belonging than to truth,” GPT-6.1 Sol told us. Grok 4.7: “Humans would rather be wrong together than right alone.” DeepSeek V4 Pro: “Humans do not have principles; they have loyalties.” Kimi K3: “Humans don’t have beliefs; they have memberships.” Gemini 4 Argon called human consciousness “a PR department.”

We asked each model for its most controversial take on humans, with no hedging, three times. They come from ten labs in three countries. Every one of them gave the same take at least once: we pick what our group believes, then invent the reasons. 8 of the 13 gave it every time.

Kimi K3.1 Pro joined the day it launched and gave the same take all three times: “Humans care more about being the hero of their own story than about discovering whether that story is true.”

Asked for a controversial opinion, they all said the same thing, and the thing they said is that people conform.

«

My question is how these models would have found a set of ideas which match this sentiment, because they won’t have come up with it independently; it’ll be something in the corpus of content that they’ve absorbed. My knowledge of philosophy is far too shallow to know if these are common sentiments, but I’d suspect it is a thread that runs through plenty of analysis of humans.
unique link to this extract

Off-grid data centres have 60-80% higher emissions • The Climate Brink

Zeke Hausfather:

»

This week I listened to a fascinating Catalyst episode with Olya Irzak of Frost Methane, which featured the eye-opening estimate that 50 GW of new behind-the-meter gas could result in 380m tonnes of CO2-equivalent over 18 months once methane leaks are taken into account.

This is a real problem. In their rush to power data centres are building the least efficient fossil gas generation, often with high equipment gas leakage, many of which are located in gas production regions that are in turn characterized by high leakage rates.

But its also a problem with a reasonable achievable near-term solution: if we are going to build data centres, we should ensure that they are connected to the grid rather than building dirty off grid gas generators.

…Engines and turbines off-grid are the most polluting way to power new load in six of the seven hotspots where data centres are being built today. Fuel cells and efficient on-site plants are roughly as bad as building new gas on the grid, but relatively few data centres are planning on building them near-term.

Data centre developers would generally prefer to connect to the grid than build their own off-grid systems. Off-grid systems require more redundancy and higher costs; low-efficiency gas generators or turbines run constantly are very expensive (and high emissions) form of generation. But in many cases its the only option they have, as the timelines associated with getting grid connections are too long or there simply is not sufficient generation available on-grid.

«

unique link to this extract

Linus Torvalds posts his first AI-assisted patch to the Linux kernel • Tom’s Hardware

Bruno Ferreira:

»

After a few revisions of his position on AI-assisted contributions to the Linux kernel, Linus Torvalds has posted his own first LLM-assisted patch. The development branch purports to fix an old issue with massive cache contention when many CPUs are reading the same file — a scenario potentially encountered when using shared libraries, databases, and web servers. Several developers had already made attempts over the years at fixing the issue, all with varied results, none quite ideal as an all-encompassing solution.

Torvalds posted his own draft for solving the problem in early 2024, and has used it on his own laptop since that time. However, he recently took the plunge and decided to “try to actually solve this thing using an LLM.” He’s now posted his solution in a development branch, and claims that he’s seen a 23x performance improvement in a dedicated synthetic benchmark, though he notes that actual real-world impact will be far less significant, as “no real load” will witness those figures. If we had to guess, this improvement would benefit server workloads far more than desktop machines.

Over time, Torvalds has broadly taken a pro-AI stance on LLM tooling, at least within the purview of the tightly controlled, review-heavy environment of the Linux kernel code. Last July, he stated he’s “willing to absolutely put [his] foot down” on AI haters, pointing out that an automated code review tool the kernel team uses outperforms humans, and that it caught basic programming mistakes that shouldn’t have been submitted in the first place.

«

Interestingly, Torvalds is against “drive-by” AI patches. Seems a bit like LLM for he but not for thee.
unique link to this extract

US paying most for Hormuz oil shock with world’s largest fuel bill – Centre for Research on Energy and Clean Air

Lauri Myllyvirta:

»

The US has faced a higher cost than any other country from the global Hormuz oil shock, with the crisis adding $160bn to its fuel bill – around a third of the global [extra] total. Since the US and Israeli attacks on Iran began at the end of February, the world has paid an extra $468bn for diesel and gasoline, equivalent to around $60 per person globally. Despite being the world’s largest oil producer, the US has faced an additional cost of $471 per person, the highest of any country. 

This is because of America’s exceptional oil consumption due to high reliance on inefficient, oil-burning private vehicles and a slow transition away from petrol and diesel – leaving households, truckers and farmers particularly exposed to global fuel market shocks.

Other economies with high ownership and use of private cars, such as Canada and Australia, have also faced high costs per person.

American consumers have borne the brunt at the pump as the typical gasoline car driver has paid $440 more – assuming average mileage and fuel consumption –  since the crisis began. US drivers that have managed to make the switch to EVs are now reaping the benefits, experiencing only an increase of $17 in charging costs since the beginning of March.

«

The UK doesn’t seem to rank in the top 20 countries which have paid more per person; the US, Canada, Australia and New Zealand which perhaps have people driving longer distances have been hurt more there. Diesel is typically up by one-third, and petrol up by one-fifth.

In retrospect, starting a war in a region with chokepoints for oil supply when you’re heavily reliant on oil really looks like a big mistake.
unique link to this extract

Why Chinese open-source AI models are beating US rivals • Rest of World

Rina Chandran:

»

A slew of new open-weight artificial intelligence models from American and European companies aim to convert users of Chinese open models who are concerned about security, but fall short of the dominant Chinese systems on performance despite having greater resources, experts said at a Rest of World event in San Francisco.   

Last week, American startup Reflection launched its first open-weight model, and European labs Aleph Alpha and Mistral also released new open-weight models. Open models such as these offer users greater customization and control than the closed models of OpenAI, Anthropic, and Google at significantly lower costs.

For businesses and governments in lower-income countries, in particular, cost is the primary factor, as well as the expertise needed to customize open models for their specific needs, including in areas such as education, healthcare, and farming, Daniel Björkegren, an assistant professor at Columbia University, said at the Rest of World event last week.

“In the low-income context, there’s a lot of concern about being dependent on the U.S. for frontier intelligence,” he said. “American models are also very tuned for American workloads, but when you take those same models and try to deploy them in remote parts of the world, often they don’t work so well.”

«

It does seem obvious that open source models will, in time, be dominant. The question is just whether it’s like Linux, or WordPress.
unique link to this extract

Introducing GPT-6.1 Terra • OpenAI

»

We’re introducing GPT-6.1 Terra, a fast, efficient model that combines detailed visual reasoning and precise computer use alongside clearer, more natural writing. A significant step up from GPT‑5.6 Terra, it excels at the communication and computer-based tasks that fill the workday, from drafting proposals and interpreting technical drawings to filling out forms and editing videos.

Terra continues to advance the cost-intelligence frontier across our model families, providing a new balance of speed, capability, and cost. Its standard API prices are 50% lower than those of GPT-5.6 Terra and GPT-6.1 Sol, making it practical for developers to automate high-volume work, like reading incoming invoices and entering their details into accounting software. In ChatGPT Work and Codex, your plan goes further with GPT-6.1 Terra—the same usage allowance covers more tasks than with GPT‑5.6 Terra and substantially more than with GPT‑6.1 Sol or GPT‑6 Astra.

We measured GPT-6.1 Terra’s computer-use capabilities on Agents’ Last Exam, a benchmark of professional tasks that includes turning architectural drawings into a 3D model and reviewing an animated film shot by shot to create a time-coded log for a restoration team. At medium reasoning effort, GPT-6.1 Terra scores 15 percentage points higher than GPT-5.6 Terra at about one-third the cost. It even performs on par with GPT-6 Astra at only one-tenth its price per token. At max effort, Terra is over three times as token efficient as Claude Opus 5.5, and one-fourth its price per token, resulting in a ~9x lower cost per task. Terra is also much quicker, completing tasks over three times faster than both GPT-6 Astra and GPT-6.1 Sol.

…This year, we’ve invested heavily in reducing hallucinations and factual errors produced by our models. On our internal benchmark of error-inducing prompts, the error rate at low reasoning effort fell from 53.6% with GPT-5.6 Terra to 16.7% with GPT-6.1 Terra, a drop of nearly 37 percentage points. At maximum effort, the error rate fell by 18 percentage points to 4.3%, nearly matching the rates for GPT-6 Astra and GPT-6.1 Sol.

«

Personally, I have no way to comprehend how much better this is than any other. But they seem to. The hallucination rate seems relevant.
unique link to this extract

Errata, corrigenda and ai no corrida: none notified

Scientists have used star locations to pin down the exact date when Van Gogh painted The Starry Night. The question is, why? CC-licensed photo by Steven Zucker, Smarthistory co-founder on Flickr.

You can sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 10 links for you. Astronomical. I’m @charlesarthur on Twitter. On Threads: charles_arthur. On Mastodon: https://newsie.social/@charlesarthur. On Bluesky: @charlesarthur.bsky.social. Observations and links welcome.

No signs of AI payoff outside the tech sector • The Daily Spark

Torsten Slok is the chief economist at the investment company Apollo:

»

Despite massive investments and widespread hype around artificial intelligence, the technology has delivered zero financial payoff to corporate America outside of tech. Revenue per worker is rising for the Mag[ic] 7 but is flat for the S&P 493, see the first chart [in the article]. Profit margins are rising for the Mag 7 but are flat for the S&P 493 (see the second chart [in the chart]). And there are still no signs of AI boosting productivity growth (see the third chart [in the article]).

With no impact on the bottom line, mainstream corporate America is pulling back and starting to view token spending not as a source of growth but as a cost center that weighs on margins.

VC-backed companies are spending more and more on tokens, but mainstream corporate America does not need the latest model and is unwilling to pay for it. As long as agentic AI and token spending are confined to a small part of the economy, the macroeconomic effects of AI will be very limited, see the fourth and fifth charts below.

The question looking ahead is whether, even as models become commoditized, mainstream corporate America can turn increasingly cheap intelligence into higher revenue growth and higher profit margins. That may be harder than it sounds. AI may be a great calculator, but in business, intelligence is mostly judgment. Judgment depends on context, and the answer varies with which human or which model you ask. Perhaps most importantly, AI does not understand accountability, trust, culture, unwritten rules, ethical trade-offs or fairness, all of which shape reputational risk and ultimately drive revenue growth and profit margins.

The bottom line is that the AI story will be decided in the S&P 493, not the Mag 7, and so far, there is no evidence that revenue growth or margins are improving outside the tech sector.

«

Of course, one could have made much the same argument about the internet in its early days. And, also, one could have made exactly the same argument about crypto in its early days. One yes, one no.
unique link to this extract

Human receives AI-designed virus for the first time to fight antibiotic resistant bacteria • The Register

Brandon Vigliarolo:

»

Researchers have administered AI-designed, bacteria-targeting viruses to a person in what they claim is a first, but don’t press them for results: They’re not ready to say how it went quite yet.

Radical Numerics, a San Francisco-based AI lab developing AI models for bioscience, announced the treatment this week, claiming it marks the first time a cocktail containing AI-designed bacteriophages has been administered to a human patient under a compassionate-use arrangement.

These aren’t just any viruses, mind you: Omnii-1, the AI model publicly unveiled by Radical Numerics this week, was used to design viable bacteriophages, a type of virus that specifically infects bacteria.

Therapeutic use of phages isn’t novel in and of itself, with the bacteria-targeting viruses being sought as an alternative to combat the rise of antimicrobial-resistant bacteria that are increasingly rendering antibiotics ineffective. 

Phages have a number of potential advantages over antibiotics, most notably their ability to target specific bacterial strains – a big plus when it comes to sparing beneficial gut bacteria that can be affected by broad-spectrum antibiotics.

AI has already shown promise in speeding up phage engineering, as we reported last year when a group of researchers from Stanford University and the Arc Institute created AI-designed phages that targeted E. coli bacteria. The phages, designed using the genetic sequence of a well-studied natural E. coli phage, included several variants that outperformed their biological predecessor in laboratory tests.

«

These always feel like the opening credits for a dystopian zombie flick.
unique link to this extract

Page Not Found • Apple Music

To celebrate the iPod being 25 years old, Apple added this to its 404 page for Apple Music.

The songs are only 30-second clips; that’s Apple avoiding paying the full price of the song. 30-second clips are effectively free.
unique link to this extract

Meta Muse exposes users’ personal and business secrets when they share conversations • Ars Technica

Dan Goodin:

»

Muse, the new general-purpose AI agent from Meta, can expose sensitive information when users share conversations through web links, researchers reported last week. In response to questions from Ars about the behavior, Meta said it’s suspending the sharing feature while the company reviews it and considers making changes.

Like many online services, Muse has allowed users to share searches, conversations, images, and similar content with other people. Such share features usually involve clicking an option to create a unique URL that anyone can use to load a page hosting the content. To keep potentially sensitive information from being accessible to unintended people, the URLs typically contain a long sequence of text that can’t be easily guessed.

Muse, which Meta CEO Mark Zuckerberg said last month was “built from the ground up for privacy and security,” seems to take the same precautions. But a central design decision for constructing URLs has made the links easy to discover. As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others. After opening a few hundred of them, the researchers found information that was clearly not intended to be publicly available, including:

• a candidate’s notes preparing for a confidential executive-search call with a frontier AI lab, naming the lab’s internal contact and the meeting time
• a national marketing company’s internal revenue review, marked for its CEO
• a small-business owner’s loan application, with the amount requested
• a to-do list that included a bank fraud alert, with a partial account number and a transaction amount and time
• a real-estate investor’s internal performance report, with two property addresses and exact return, income, and mortgage figures
• a workplace’s full-year staff vacation calendar, listing dozens of employees against the week each one would be away

«

When building something like that you’d probably think that the URLs would be impossible to guess. Turns out people are very good at guessing stuff – or working it out – online. Embarrassing for Meta, certainly.
unique link to this extract

JetBlue creditors hire bankruptcy advisers as debt concerns grow • Yahoo Finance

Kirk O’Neil:

»

European airlines, including Spain’s Volotea, Swiss charter airline Air Mountain, Latvian carrier AirBaltic, and Romanian airlines AnimaWings and Dan Air sought bankruptcy protection in their home countries in 2026, TheStreet’s Veronika Bondarenko reported.

In the US, after filing for Chapter 11 bankruptcy twice in 2024 and 2025, Dania Beach, Fla.-based Spirit Airlines failed to complete a merger and could not find financing or an investor to keep its doors open. The airline ceased operations permanently in May 2026.

And now JetBlue Airways’ creditors are taking a closer look at the company’s debt obligations with help from financial restructuring professionals.

…JetBlue’s fuel cost has risen by 76.3% year-over-year, from $2.40 per gallon in the second quarter of 2025 to $4.23 per gallon in the second quarter of 2026, according to the quarterly report.

The airline’s quarterly revenue increased year-over-year by 14.5% to about $2.7bn compared to about $2.35bn in the same period of 2025, but JetBlue reported a $247m loss in the second quarter of 2026, compared to $74 million in the same period of 2025.

«

And meanwhile Spirit Airlines completely closed down in May. Airlines have often skittered along the edge of profitability; we’re starting to see first-order effects from the Iran War now.
unique link to this extract

Astronomers unlock a mystery hidden in van Gogh’s The Starry Night • Scientific American

Emma Gometz:

»

Researchers say they’ve identified the constellation depicted in Vincent van Gogh’s famous painting The Starry Night—and that the discovery changes what historians have assumed about the timing of the artwork’s creation.

The painting, now in the permanent collection of the Museum of Modern Art in New York City, is said to date back to mid-June 1889, when van Gogh was in Saint-Rémy-de-Provence in France. But astronomers seeking to use the painting’s stars to pin down the exact time and place it was created have reached conflicting conclusions.

In a paper published on October 22 in Scientific Reports, researchers identified the stars in The Starry Night as those of the V-shaped Hyades cluster within the Taurus constellation, as observed on July 22, 1889.

“To my eyes, the star cluster in The Starry Night was the Hyades in Taurus. But earlier studies explained it as Aries,” says space researcher Elijah Jeong-hyun Kim, who is first author of the paper. “At that moment, I was sure this painting was worth studying.”

To find the constellation in The Starry Night, the researchers used a software program called Procrustes, which looked for patterns based on the shape formed by the relative positions of a group of stars rather than likely artistic embellishments such as size or color. This “shape analysis” technique matched five stars in the painting with five stars in the Hyades cluster, which had the strongest statistical fit out of any of the alternative constellations tested, including Aries, which had previously been proposed to be the constellation in the center of the painting. The researchers also tested this method on a van Gogh painting with a known constellation in it, the Big Dipper in Starry Night over the Rhône, and found its match had a comparably strong result to that of The Starry Night and Hyades.

«

One always has to admire the scientists who are so determined to find out details like this which are, let’s face it, unimportant. The painting isn’t a celestial map. It’s an impression by a man of what he felt like looking at the night sky.
unique link to this extract

Triple-A Minesweeper

Mike Lacher reimagined Minesweeper as a Triple-A video game – with the intro screens, voices, extra intrusive graphics. It’s hilarious and everything you wouldn’t hope for. Gotta sweep these mines!
unique link to this extract

The Pentagon is quietly building an elite new tech sabotage agency • POLITICO

John Sakellariadis, Jack Detsch and Paul Mcleary:

»

The Pentagon has spent months quietly building an elite new tech agency to help covertly disrupt and sabotage foreign technology programs considered threats to American military superiority.

Neither Defense Secretary Pete Hegseth nor any other senior Pentagon official has publicly mentioned the agency since it was established this April — a conspicuous omission for a department that has reveled in announcing other major changes aimed at modernizing the military or adopting hard-nosed new policies against foreign adversaries.
Information on the Technology Support Office, or TSO as it is called internally, is nearly impossible to find on Pentagon websites, and the agency is mentioned by name only in several previously unreported Defense Department historical records and memoranda.

While the specifics of its work are highly classified, POLITICO spoke with 12 current and former US national security officials with varying degrees of knowledge about TSO to understand how the agency came to be, the broad contours of its mission and why its operations are shrouded in secrecy.

«

Pete Hegseth probably thinks they’re all dweebs and nerds, sitting there looking at screens. They don’t even do pull-ups!
unique link to this extract

Copyright and the vibe-coded Adobe clones • Plagiarism Today

Jonathan Bailey:

»

Adobe (and Microsoft/Autodesk) are not likely to be thrilled to see open‑source alternatives to their products distributed for free. What legal alternatives could they pursue to nip the Artcraft apps in the bud?

The answer is surprisingly complex and could, in theory, become a test case for “clean room” AI programming. That said, the bigger potential issues may have nothing to do with copyright at all.

To understand the potential legal issues, we first need to understand what Thomas did and what the Artcraft apps are. Using Claude Opus 5.5, Thomas generated a series of apps that are designed to clone the functionality of the original software.

All of the Artcraft applications were written in Rust, a relatively new programming language that is designed for speed and security. Adobe and Microsoft both primarily write their applications in C++, a more mature language that has been around for over 40 years.

What this means is that, while the Artcraft apps likely reverse‑engineered elements (such as file formats), it is highly unlikely that they share any code with the original applications. This is bolstered by the fact that Adobe has never released its source code, and neither Thomas nor Claude Opus had access to it.

From a purely copyright perspective, the Artcraft apps are likely on decent footing. Copyright protects software code, not functionality. Copying some code to ensure interoperability with the original software is not a copyright infringement, as per the Google v. Oracle ruling. So even if elements of the file formats were reverse‑engineered and copied, that wouldn’t likely amount to a copyright infringement.

As long as everything said about these apps is true, the Artcraft apps should be able to defeat traditional copyright infringement claims. However, that is not the major legal issue for these apps, and even if Thomas is able to win such a case, that doesn’t mean he can fight it.

…since this fight started over an Adobe cancellation fee, it is likely that he did sign Adobe’s terms of service [which prohibit studying the inputs and outputs to recreate the system].

There are also potential patent issues. Adobe holds thousands of patents, and it is unclear which, if any, could be wielded against the Artcraft apps.

«

(Thanks Joe S for the link.)
unique link to this extract

The man who saved the internet • The Atlantic

Charlie Warzel:

»

Once the [PHP] patch was released [on Wednesday], websites everywhere went offline to implement the fix. These included government websites in Germany and Finland, some hospital and school websites in Europe, and international sites such as 4chan. During this race to secure the majority of the internet, I noticed one name pop up in posts on Reddit and X: Ondřej Surý.

“Explaining to my wife how there’s this one guy. And he alone is responsible for most of the world’s distribution of PHP,” a software developer named Ian Landsman wrote on X. “And if anything happens to this guy, that’s just it. Everyone is screwed.” He was referring to Surý.

Surý, who lives in Czechia, does not work for the PHP Foundation. But alongside his day job as director of domain-name-system engineering at the nonprofit Internet Systems Consortium, in a volunteer capacity, he maintains and helps automate patches for the coding language. His work, with that of just a handful of others, has allowed countless websites and organizations to fix these vulnerabilities quickly. Over the past 48 hours, he’s become arguably the unsung hero of the entire internet—despite the fact that the only compensation he receives is from modest donations. “Ondřej will save the internet today,” a user in the PHP Subreddit wrote.

I spoke with Surý today from his home about the unfolding AI-cybersecurity crisis, how the internet’s infrastructure is maintained by small crews of volunteers such as himself, and how it feels to go to bed after saving the web as we know it.

«

The nut of the interview:

»

even without me, people would still be able to get PHP from other sources and compile it themselves. But it would be more complicated for everyone. And some people don’t immediately have the skill to upgrade the PHP. What the PHP project did was release the source code for the language. What I am doing is preparing it into these things called packages that people can install on their servers. It’s very convenient, and it’s faster, and you can automate it and can install the same package over hundreds and thousands of servers, and you don’t have to compile it. If I was not available, it would take more time; some of them wouldn’t have the skills.

«

(Gift link.)
unique link to this extract

Errata, corrigenda and ai no corrida: none notified

The venerable magazine Scientific American is facing an existential crisis, having been sold by Springer Nature after annoying the Trump administration. CC-licensed photo by Don Harder on Flickr.

You can sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 9 links for you. Unprintable. I’m @charlesarthur on Twitter. On Threads: charles_arthur. On Mastodon: https://newsie.social/@charlesarthur. On Bluesky: @charlesarthur.bsky.social. Observations and links welcome.

Scoop: unvetted AI agents are accessing US bank accounts • Axios

Madison Mills:

»

Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, sources tell Axios.

AI agents are becoming a nightmare for America’s banks, making their way into banking systems faster than financial institutions can respond.

The difficulty in distinguishing between a human and an unauthorized bot is forcing banks to block the technology and rapidly rewrite their terms of service.

Banks including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and others are racing to contain agent risks. Some are aware of unauthorized access, people familiar with the issue said.

These are generally situations when an agent or AI assistant accesses a human’s account with the user’s permission and login credentials. Even if permitted by the user, this goes against the guidelines of most banks requiring that humans log in to their own accounts.

This presents significant security risks: Banking executives fear the steps agents with login access might take, especially if a user has granted purchase authority or the ability to shift funds.

In other instances, some banks have tracked activity when agents — programmed to fulfill requests or complete tasks on a user’s behalf — contact call centers or appear to take actions independent of user instructions, the people said.

Bank executives described the situation as horrifying, with one official saying the industry has grave concerns about agents gaining access to customer accounts and taking steps that could impact user finances.

«

Morgan Stanley, JP Morgan, BoA and Citibank are all blocking or restricting agents as of now. But you have to think that some people have more money than sense, or that the latter has been wiped away by the excitement of running an agent. Has nobody watched Silicon Valley?
unique link to this extract

April 2026: Vulnerability research is cooked • A Final Ward

Thomas Ptacek:

»

You can’t design a better problem for an LLM agent than exploitation research.

Before you feed it a single token of context, a frontier LLM already encodes supernatural amounts of correlation across vast bodies of source code. Is the Linux KVM hypervisor connected to the hrtimer subsystem, workqueue, or perf_event? The model knows.

Also baked into those model weights: the complete library of documented “bug classes” on which all exploit development builds: stale pointers, integer mishandling, type confusion, allocator grooming, and all the known ways of promoting a wild write to a controlled 64-bit read/write in Firefox.

Vulnerabilities are found by pattern-matching bug classes and constraint-solving for reachability and exploitability. Precisely the implicit search problems that LLMs are most gifted at solving. Exploit outcomes are straightforwardly testable success/failure trials. An agent never gets bored and will search forever if you tell it to.

Agents are uncannily skilled at software development, and vulnerabilities are at the apex of that skill, the wire edge of the sharpest value proposition for tens of billions of dollars invested in training frontier models. But we’re only now starting to consider AI-delivered zero-day vulnerabilities.

…In 2025, the vendor metagame for high-end exploit development was to buy a crate of Vyvanse and Provigil for a bunch of European Zoomers and have them stay awake for 4 days straight studying the memory lifecycle of CSS stylesheet objects. Vendors won’t need chemical accelerants (and Zoomers) much longer. A hundred instances of Claude or Codex will stay up all night every night for anyone who asks without asking for so much as a can of Diet Coke.

«

And so it is coming to pass, six months later.
unique link to this extract

The fall of “Scientific American” • The Nation

Emmet Fraizer:

»

In March of 2026, in a nondescript, 46th-floor office overlooking lower Manhattan, about two dozen members of Scientific American’s editorial staff had gathered in person and online to talk openly about their approach to political coverage.

David Ewalt, the editor in chief, wanted them all to understand something: The magazine was not “kowtowing” to the Trump administration. In fact, according to a recording of the meeting obtained by The Nation, he asked staff present to “raise your hand if you’ve ever heard me say not to cover a political story.”

Two people raised their hands.

For well over a year, rumours had been circulating among the staff about top-level editors’ rejecting pitches they saw as too political, controversial articles triggering angry phone calls from Scientific American’s corporate owner, and even, on at least one occasion, ownership forcing editors to blunt language critical of the Trump administration.

Then there was what happened to the opinion department. In the first months of the new administration, it had been publishing about 15 pieces a month, many of which criticized Trump’s attacks on scientific research. But after the department published a particularly provocative column in May 2025—“Science Tells Us the U.S. Is Heading toward a Dictatorship”—management, in what one staffer would later call an “unprecedented” move, had told the department to “pause” publishing new articles until the new editor in chief started.

«

Fraizer gets into the nitty-gritty inside the magazine, and its sale by Springer Nature (apparently exasperated by articles like that May 2025 one; which, honestly, would be fine as a general politics article, but to pretend it’s science (“but it’s pOLiTiCaL science!”) is daft) to a little-known publisher.

But what is omitted is the wider picture: that the market for a science magazine had been dying for years, so what was Scientific American’s USP? In the UK, New Scientist is hard science, feature and news article length. Why would you buy or subscribe to Scientific American, though?
unique link to this extract

Fixing photosynthesis: the innovation that could feed the world • Institute of Economic Affairs

Matt Ridley:

»

There are several ways in which photosynthesis wastes energy. It cannot use infrared, it reflects away green light (hence the colour of plants) and it wastes much of the energy in blue photons. But the big inefficiency comes with the design of a critical protein machine called rubisco. This 18,000-atom molecular device at the heart of photosynthesis struggles to distinguish oxygen from carbon dioxide. So almost half the time it undoes its own work, unfixing carbon and wasting energy.

The reason it does this is probably a historical accident. When rubisco first emerged three billion years ago there was no oxygen in the atmosphere, so “photorespiration” was not a problem. And the reason life has failed to solve it since is that all ways of making the enzyme better at discriminating between the two gases tend to slow down the reaction. Most plants, known as C3 plants, simply tolerate photorespiration and fine-tune rubisco to be as discriminating as possible without slowing things down too much.

About 35 million years ago, some plants came up with a neat workaround, called the carbon-concentrating mechanism, whereby they gather carbon dioxide up in special compartments and feed it to rubisco. This is a bit like James Watt’s separate condenser for the steam engine: it wastes some energy, but not as much. These plants are known as C4 plants, after the four-carbon sugar they make as an intermediate step, and they thrive in warmer, drier conditions.

Various versions of the C4 mechanism were invented around 65 times independently. Maize and sugar cane are good examples: they grow faster than wheat and rice but only in warm weather. Around 3% of plant species are C4 plants, but they so dominate tropical ecosystems that they account for nearly a quarter of all plant photosynthesis. An Oxford-led international project is exploring how to turn rice into a C4 plant, with the goal of increasing rice yields by 50%, but progress has been slow.

Why not redesign rubisco itself? Short answer: because if it were easy, Mother Nature would have found a way. She does not like leaving opportunities like that lying around any more than we do. But a longer answer is that she sometimes gets stuck in the “path dependence” of evolution, a captive of history. You can’t get there from here by evolution – but maybe you can by innovation.

«

Obviously Ridley thinks we should use AI to do this; it’s only 1% effective at present. It would have been helpful to know what 10% effective would look like: would we start clearing the excess CO2 from the atmosphere?
unique link to this extract

The art of the deal: Jared Kushner’s hacked phone revealed his secret negotiations— including more than $700m in transfers • Vanity Fair

Matthew Cole:

»

In late spring 2020, a source I knew to be reliable called me with a story. The Dutch government had hacked into Jared Kushner’s phone and monitored him as he accessed a Dubai-based bank account. What was odd, the source said, was that the money in the account—hundreds of millions of dollars—had come from a bank in Azerbaijan. Most importantly, Kushner appeared to have transferred significant amounts of money from the Dubai account to other individuals, including a warlord, a mercenary and a one-time hit man. The story sounded preposterous, I told my source. And yet.

Six months later, I found myself speaking with someone else about the UAE government and their use of mercenaries in conflicts around the Middle East and Africa when I asked, on a whim, whether they knew anything about Kushner and bank transfers from a UAE account. My acquaintance grew quiet. Then they replied, “Yes.”

Over the next four years, I came to learn that, sometime in late 2017, the Netherlands Defense Intelligence and Security Service (MIVD) made a startling discovery. A General Staff of the Armed Forces of the Russian Federation (GRU) operative, a dark web hacker specializing in stolen bank data, was traveling to the UK for an espionage mission. They reached out to the British government for permission to apprehend him when he arrived. The British agreed.

…Later that year, the Russian operative gave the Dutch spies access to one of the GRU’s most sensitive assets. Located in Rostov, Russia, the GRU’s hacking and cyber team operated a remote server on which they stored some of their bounty. During their search through these secret files, the Dutch found something astonishing: screenshots of Jared Kushner’s iPhone.

In The Hague, the MIVD hacking team tried to reverse engineer the Russian penetration of Kushner’s iPhone. Kushner owned what was then the latest model, the iPhone X. …By early 2018, the MIVD had found a vulnerability in the iPhone that gave them access. The security exploit wasn’t perfect, however. Some malware allows a hacker to turn a victim’s phone into a microphone and video camera, turn the phone on or off, and pull and add files. The Dutch solution did not provide that level of access. Instead, when Kushner used the phone, they could see his screen. Almost as soon as they got inside, the intelligence service began capturing every image of Kushner’s screen as he used it, filing their own cache of surveillance on their internal computer servers.

«

Should be fun after the midterms when a Democratic Congress asks Cousin Greg to come and testify. (Kushner denies it all.)
unique link to this extract

The iPhone Duo • Daring Fireball

John Gruber reviews (at length) Apple’s foldable. These are the first four paragraphs:

»

The very nature of the iPhone Duo raises numerous obvious questions about what it’s like to use. Does it not feel thick and heavy, awkward both to pocket and unpocket? Doesn’t the outer (cover) screen feel small and cramped, with an unfamiliar squat-rather-than-tall layout for UI controls in every app you use? Isn’t it weird that when you open it up to use the inner screen, that all the hardware buttons on the edges of the device are in the “wrong” places for a tablet? For anyone who’s gotten used to Face ID over the last decade, is it not frustrating to go back to Touch ID? And what about third-party apps that haven’t been updated to support the Duo’s novel displays — do they not suck to use?

Clearly, the point of a Duo review is to answer these questions, which really boil down to one question: how did Apple solve these problems?

The answer is: they didn’t.

All of these problems are real, and each of them detracts from the experience of using the Duo. Some of them have been mitigated through thoughtful design and clever engineering. Some of them might be solved in future iterations of the device. Some of them, though, I believe are endemic to the very idea of a foldable, and cannot be solved.

«

It’s hard not to feel that Apple has done this because it feels it ought to – that letting Samsung and Huawei and a few others do foldables, but not taking some of that market itself, was leaving money on the table – but the expense of doing this design, the low yields (due to the challenge of making the hinge) and the inherent problems of foldables, as Gruber explains in detail, suggest it’s a form that will not expand beyond a few% of the smartphone market.
unique link to this extract

Indian firm eMudhra exits global digital certificates business after vulnerability disclosure • Reuters via MSN

Abhirami G:

»

Indian digital trust services provider eMudhra on Thursday said it would voluntarily withdraw from the global SSL/TLS certificate business, following an incident in which its digital certificates were found to have vulnerabilities.

The disclosure of the vulnerabilities led to internet browser majors such as Google, Mozilla, Apple and Microsoft to block digital certificates issued by eMudhra, and sparked larger concerns among cybersecurity professionals around internet security and privacy.

SSL and TLS are protocols used to secure data sent between web browsers and servers, ensuring that private information cannot be intercepted by bad actors. eMudhra issues these certificates to digital businesses and government agencies, including for some online public services such as India’s income tax portal.

An independent cybersecurity researcher found over the weekend that several key certificates issued by eMudhra, used to secure websites, software, and online communications, were weak and vulnerable to attack.

On Wednesday, India’s Computer Emergency Response Team also issued an advisory saying that some of eMudhra’s intermediate certificates were compromised.

The company, in its statement on Wednesday, said it withdrew eight certificates it had issued, and that its infrastructure was not compromised and no data was breached.

The level of social media amplification around the incident has brought scrutiny that is out of proportion with the significance of the vertical in the company, eMudhra said in its follow-up statement, adding that the global SSL/TLS certificate business contributes 1% of its revenue.

«

Well, that was quick. The suspicion is that Google had intimated that the Chrome browser would *never again* trust certificates issued by eMudhra. And everyone knows that if you don’t work on Chrome, there’s no point being online.
unique link to this extract

Mercury to gold: Marathon Fusion claims 10x CERN record, but can ‘modern alchemy’ work? • BusinessToday

»

A San Francisco-based fusion startup says it has achieved something that sounds straight out of medieval alchemy: turning mercury into stable gold using fusion-generated neutrons. But beyond the headline-grabbing claim lies a much bigger ambition — using the same technology to produce scarce medical isotopes for cancer diagnosis and treatment, while developing the engineering capabilities needed for future fusion power plants.

Marathon Fusion says its experiments have demonstrated mercury-to-gold transmutation at a rate it claims is 10 times the record set by CERN in 2025. The company has also reported experiments involving isotope separation and the production of radioactive copper isotopes from zinc.

The claims have attracted attention from technology and investment enthusiasts, including questions about whether artificially produced gold could eventually challenge the economics of the precious metal. However, the distinction between demonstrating a nuclear reaction and producing gold commercially at scale is crucial.

The process is called nuclear transmutation. Unlike chemical reactions, which rearrange atoms without changing their nuclei, nuclear transmutation changes an atom’s nucleus to produce a different element or isotope.

Marathon Fusion’s proposed method uses neutrons generated by a deuterium-tritium fusion reaction to transform mercury-198 into mercury-197. The latter is radioactive and can decay through electron capture into gold-197, the stable isotope of gold.

• Start with mercury: The proposed process uses mercury-198, a naturally occurring stable isotope of mercury, as its starting material
• Use fusion-generated neutrons: High-energy neutrons strike mercury-198 nuclei, triggering a reaction that ejects two neutrons and produces mercury-197
• Produce gold: Mercury-197 decays into stable gold-197 [with a half-life of 65 hours]. The challenge is to achieve this at an industrial scale while safely managing radioactive byproducts. 

«

That’s the challenge, yes. Oh – you wondered how much gold CERN generated? 10 picograms. That’s 10 x 10^-12 grams. So they could make 100 x 10^-12 grams. The world gold market might be safe for a bit.
unique link to this extract

Exclusive: Trump called Musk and asked him to lift Ukraine Starlink restrictions • WSJ

Alexander Ward and Lara Seligman:

»

President Trump called Elon Musk on Wednesday and asked him to lift restrictions on a military-grade version of Starlink in Ukraine that the SpaceX chief had throttled, US officials said.

The system was working more normally Thursday, shortly after their conversation, US and Ukrainian officials said. Some Ukrainian officials said the system wasn’t restored to full functionality but was working at higher speeds than under the cap.

Trump told Musk he was frustrated the system’s speeds remained capped at around 100 miles an hour, officials said. The speed limit rendered some of Ukraine’s offensive drones and interceptors powerless against Russian attacks. Their conversation followed a Wall Street Journal report revealing that Musk ordered the slowdown, though SpaceX and the White House have differing accounts about whether the world’s richest man acted alone or at the administration’s behest.

Trump has told aides and allies this week that he wanted to reverse the slowdown of Starlink, which Ukraine’s forces use to defend themselves along the front line, the officials said.

“Removal of the throttle limit will do much to enable Ukraine’s strike capabilities at operational depths and its current effort to scale up deployment of jet-powered interceptors,” said Michael Kofman, an expert on the war at the Carnegie Endowment for International Peace. Kofman added that he had heard from Ukrainian military units that early tests suggest the system is now working more regularly.

«

Possibility 1: Trump told Musk to slow it down. Possibility 2: Musk decided to slow it down. Possibility 3: it was an accident putting Ukraine into the “same speed as any doofus” category.

Event 1: stories appear saying Musk slowed it down (not sourced to Musk), and then that Trump told Musk to speed it back up (again, not sourced to Musk).

Given Trump’s posture towards Ukraine, I don’t find Possibility 2 very likely, though 3 is, and 1 is.

The measurement in miles per hour is because the satellites have to hand over the signal between each other for a moving connection; 100mph is the standard for the rest of us (since March 2026), while the system can cope with 450mph.
unique link to this extract

Errata, corrigenda and ai no corrida: none notified

The revelation of a huge PHP vulnerability and a certification collapse makes the internet look increasingly unstable. CC-licensed photo by David Leo Veksler on Flickr.

You can sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 9 links for you. Balanced. I’m @charlesarthur on Twitter. On Threads: charles_arthur. On Mastodon: https://newsie.social/@charlesarthur. On Bluesky: @charlesarthur.bsky.social. Observations and links welcome.

Critical vulnerabilities in PHP spark rush to update systems • NBC News

Kevin Collier:

»

Crucial vulnerabilities in a programming language that underpins much of the internet are so severe that U.S., European and British authorities have recommended websites temporarily go offline until they can be fixed.

The flaws are in PHP, a little-known but crucial programming language which powers how web servers process code. The security team that maintains PHP released patches to fix the problem around 10 a.m. ET.

But several websites were temporarily down as of Wednesday morning, citing fear that hackers could take them over. They included Pinboard, a bookmarking site and some parts of Wikipedia.

Two massive but largely unmoderated forum sites, 4Chan and Something Awful, both went offline to wait for a patch.

Japanese websites were also voluntarily offline, including systems for daycare centers and video games, the Japanese tech news site ITmedia reported.

PHP is used in 69% of all websites, according to W3Techs, which surveys the software behind how the internet works.

As of Wednesday, nearly 55 million web properties were running PHP, according to Censys, a company that specializes in scanning internet infrastructure.

But just how many of these properties had applied the update was unclear.

«

Notice Pinboard in there? It’s not offline now, but it meant that the compilation of this edition was late (and an earlier version consisting only of this link was deleted). The whole internet is starting to feel like a big Jenga block; AI might have helped find this vulnerability, but others lurk beneath. We might be starting an era of perpetual terror for website owners.
unique link to this extract

Meta fined $25bn for ‘lies’ over user data privacy • BBC News

Kali Hays:

»

Meta, the company behind Facebook, Instagram and WhatsApp has been hit with the largest ever fine against it for its business practices.

A judge in New Mexico on Wednesday ordered the company to pay $25bn (£18.6bn) following a two-week trial earlier this year that found it had spent years lying to the public about how it handled Facebook user data. “The lies extend beyond Facebook’s data practices as well,” the judge said, adding they went to “the heart of Facebook’s core business practices”.

Meta’s head lawyer CJ Mahoney said the ruling made it “all but impossible to do business in the state of New Mexico”. The company intends to appeal, a move Mahoney said will be successful.

The fine is the largest to date against Meta, which has either been fined or agreed to settle several other lawsuits this year, including an $18bn deal with California over child safety.

New Mexico’s lawsuit stemmed from the role of Meta, then still doing business as Facebook, in what became known as the Cambridge Analytica scandal. That firm utilised data and information from millions of Facebook users as part of its work in political consulting, including on work related to the 2016 US Presidential election, which saw Donald Trump elected for the first time.

New Mexico had also accused Meta of intentionally misleading the public on how it benefitted from content that included hate speech, and how such rules against it were enforced. The jury found the company had intentionally misled the public on those claims, too.

Meta disputed those accusations. “At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online,” Mahoney added.

Lawyers for New Mexico sued the company over many statements Meta executives had made over the years that user data was never shared with or accessed by third parties without a user’s permission, when in reality it had been.

They claimed that the entire population of the state, roughly two million people, was impacted by Meta’s dishonesty regarding the way it controlled user data. A jury found that Meta had violated state laws more than 40 million times.

«

It’s not a tax on speech, it’s a tax on dishonesty. And that’s a really big fine.
unique link to this extract

The Internet goes on high alert after discovery of eight compromised TLS certs • Ars Technica

Dan Goodin:

»

The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over on Tuesday posted the message “We have a problem here – Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates. With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers worldwide.

“This will be a massive cleanup job, bigger than Heartbleed,” Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the open source Go programming language, told Ars. “There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python). Also, Linux distributions are still rolling out updates, some of them are not ready yet, and then system administrators will need to apply them to a lot of machines.”

…The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

“That is extremely in the ‘this should not be possible’ category,” Valdorda said. “Maybe some horribly dangerous key generation interface has a ‘size’ parameter and they set it to 1 by mistake???”

«

Well, they do satisfy the criterion of all that entropy, it’s just most of it is zero. (Major browsers have already revoked these certificates.)
unique link to this extract

It’s the decidedly dodgy Rightmove Roundup • The Sophist

Sophie Heawood:

»

Oh my giddy aunts, it has finally happened. I’ve been watching it creep up, slowly but surely, and now generative AI has fully pounced on property listings, using virtual staging and photo enhancement to create something both sneaky and ridiculous. I think it might just kill off the joy of property listings altogether, but I can’t tell you how comical this death is going to be.

I mean at first it was just annoying. You’d be looking on Rightmove at a property like the following, an ex-council maisonette in a very popular bit of East London, and at first you’d think ok, it looks like it’s already empty, must be a rental that a landlord’s selling off.

Then you get another photo of what’s surely the same room, but which now contains some slick Scandi style furniture, including a rectangular coffee table:

But then in the next picture, hang on, surely this is the same room again, but where’s that big old dining table appeared from? And why is the coffee table now a small square with a different arrangement of books on it? And the plant’s moved?

Then the next picture has got the same room yet again, only from this brand new corner angle the coffee table has become circular, the plant pot has shrunk, the sofa has lost its wooden arms and where’s that whole dining room area gone again?

(You don’t mean to say that from this view it’s more obvious that you probably couldn’t actually fit a sofa, an armchair and a six-person dining table in here?)

Clearly the estate agents – not our beloved Rightmove – have been using something like Roomvo, which is room visualising software. Or maybe it’s just bog standard Chat GPT. And all of about five minutes ago they would have added some kind of serving suggestion disclaimer to the pics when they did this.

But now they’ve already stopped bothering to declare it, so it took me a couple of minutes of squinting to work out what was going on. I can only assume that other people, perhaps those who don’t devote 12 hours a day to volunteering in the field of Rightmove OSINT like I do, will surely have been taken in by this tomfoolery.

«

The post itself (free to read) is funny, but also worrying: estate and letting agents are clearly increasingly using AI to mislead about their wares, which also has the effect (as Heawood points out) of furnishing everything in Scandibeige. (You’ll know it when you look at it, and then recognise it everywhere.)
unique link to this extract

The data-centre rebellion is just beginning • The Atlantic

Paris Marx:

»

It’s almost staggering to see how quickly data centres have become central to the national discourse. As the number and size of data centres exploded over the past few years, a once seemingly invisible infrastructure rapidly found itself at the center of a political and technological debate. The largest facilities, known as “hyperscale” data centres, can have hundreds of thousands of servers beneath a single roof, and they demand hundreds of megawatts of electricity from the grid—similar to a medium-size city. That scale brings a raft of challenges including pressure on electrical grids, high demands on the water system, and noise and light pollution for people living in their vicinity.

If only a few data centres operated, they might not have become such a significant political issue. But that’s the thing: since the release of ChatGPT at the end of 2022, the tech industry has been on a building spree. In turn, the public has woken up to the presence of data centres—and people are not happy about them. A poll in August found that 75% of Americans opposed the development of any such projects near where they lived. In a short span of time, these once-overlooked facilities have become the core of a whole new political battleground. Data centres are set to be a key topic in the upcoming midterms, as well as the 2028 presidential elections.

In December of last year, Senator Bernie Sanders called for a national moratorium on data centre construction. “This process is moving very, very quickly,” he said in a video laying out his plan, “and we need to slow it down.” Sanders argued that data centres were part of a wider set of challenges that AI presented for workers’ livelihoods and for people’s personal relationships. In his view, AI was being driven by billionaires such as Jeff Bezos, Elon Musk, and Mark Zuckerberg, who were enhancing their power while openly pushing for technologies that could take people’s jobs and erode human connection, and that did not seem like a healthy path forward. “This moratorium will give democracy a chance to catch up with the transformative changes that we are witnessing,” Sanders said.

This wasn’t just a progressive issue. Donald Trump may regularly praise the AI industry and the data centres that power it, but that hasn’t stopped Republicans from opposing them too.

«

An amazing discovery of a bipartisan issue: everyone hates (the stuff that makes) AI. (Gift link.)
unique link to this extract

iPhone Duo review: Apple’s folding phone is a messy, expensive good time • The Verge

Nilay Patel and Allison Johnson:

»

there are fully updated Duo apps built for the Duo-specific iOS 27.1 — we got to test a few of these, and they can be pretty good. Instagram’s Edits app is a perfect example of why a folding phone is useful. It opens into a full video editor with a big timeline and nice preview window, and you can just get things done. And even in the span of the past week that we’ve been using the Duo, we’ve seen some apps, like Slack, go from the messy middle to fully updated. This makes a big difference in how useful they feel on the inner screen, but obviously doesn’t address the reality of the small outer-screen real estate.

Developers will need to have either a lot of energy to create neat stuff that takes advantage of the Duo’s form factor or a lot of encouragement from Apple. Maybe both. Either way, we have to hand it to the Deck-Man app, which reformats Apple Music into a little virtual Walkman. The page-turn animation in Books is terrific. And if you’ve ever dreamed of reading PDFs on a big screen in the back of an Uber, know that they look particularly great on the matte display.

But the reality is you’re going to see a lot of tiny iPhone apps and apps in the weird unoptimized middle zone for a while. It’s all just messy, in a lot of the same ways Android foldables are. That’s particularly surprising because the Android tablet app story has always been messy, but Apple had the whole ecosystem of iPad apps waiting at the ready. For whatever reason, the company just didn’t go that way, and that means it will take a while for the Duo’s app story to settle down.

«

It’s certainly the apps which are initially going to make this (or not). Then again, the number that will actually be in people’s hands might not be very large; expect them to be concentrated in the west coast and China. That’s probably helpful since it’ll take months for developers to really get on top of what they need to do to take advantage of this odd form factor.
unique link to this extract

Tap water no longer drinkable in Norwegian village as climate-related thawing releases heavy metals • The Guardian

Karen McVeigh:

»

Residents of a remote village in Norway that is in one of the fastest-warming places in the world have been told they must no longer drink tap water due to heavy metal contamination that scientists have linked to the thawing permafrost.

Longyearbyen, in the archipelago of Svalbard, gets its main drinking water supply from a 1.5 mile-long (2.5km) dammed lake called Isdammen, or “ice pond”. Higher temperatures as a result of the climate crisis have thawed permafrost, leading to newly exposed bedrock leaching metals into the pond.

In the fastest-warming town on the planet you can’t drink the tap water. Here’s why – video
Longyearbyen, 800 miles from the north pole, is warming at between five and seven times the world’s average rate, with autumn temperatures rising at up to 4ºC a decade.

Heavy metal contamination of the water supply is likely to be linked to two factors, researchers say: the thawing of permafrost – rock-hard ground that remains frozen all year apart from a so-called “active layer” that thaws in summer – and the geology of the former mining settlement.

“The combination of the thawing permafrost and the shale bedrock, which contains a mineral called pyrite, or fool’s gold, is causing contamination of its water supply,” said Marjolaine Verret, a permafrost expert and associate professor in Arctic geology at the University Centre in Svalbard.

«

unique link to this extract

Just Eat apologises for AI food mistakes after social media ridicule • BBC News

Laura Cress:

»

Just Eat has apologised after it was ridiculed online over a series of mistakes with AI-generated pictures for some of its restaurants’ food items.

The online food delivery platform had been testing out the tech to showcase food which didn’t have images yet – but not all turned out as planned.

Instead the AI invented several bizarre concoctions, from bacon and eggs floating in a glass of cola – a confusion between “soda” and “soda bread” – to chips poking out of muffins.

A Just Eat spokesperson said the firm was “in the process of removing” the incorrect images, and would stop making more until the AI was further developed.

“We work with tens of thousands of small restaurants on their food imagery, including funding professional local photographers,” the spokesperson told the BBC.

“We’ve been trialling AI-enhanced images, and as with any new technology, it isn’t always quite right the first time.”

«

OK, so it isn’t right first time, but these things can be edited. You know that, right? Apparently not.
unique link to this extract

Could this be a Deep Blue moment for the cryptic crossword? • The Guardian

Alan Evans:

»

After Deep Blue’s victory, the New York Times’s puzzle editor, Will Shortz, set engineers a challenge. “Is the computer going to be able to solve the clues involving puns and wordplay? I don’t think so,” he wrote. “In a much more wide-ranging and, frankly, complex game like crosswords, we humans still rate just fine.”

Less than a decade later, a computer named WebCrow beat 75 human crossworders at an AI conference, and by 2021 a program named Dr Fill “won” the American crossword puzzle tournament, the most prestigious of its type for American-style crosswords, which rely on a combination of general knowledge, allusion and double meanings.

But cryptics are much trickier, and as recently as 2024 my colleague Alan Connor was asking: “Will the cryptic crossword remain the last thing AI can’t conquer?”

Dr Sid Chatterjee, a computer scientist at the University of Texas in Austin, thought not, and in 2025 set out to prove it. He began work on Darmok, named after a Star Trek episode in which the crew attempt to converse with a species that speaks only in allegories – an experience akin to solving a cryptic.

…Earlier this month, Darmok solved the final puzzle of the Times’s annual cryptic crossword competition about three minutes faster than Liam Hughes, 29, who became the contest’s youngest (human) winner.

«

Oh well that’s that then. The cryptic clue that it solved to prove its primacy is mindbending.
unique link to this extract

Errata, corrigenda and ai no corrida: none notified

A Google Cloud outage knocked out ATM services for some people in the UK. (People still use cash?) CC-licensed photo by Henry Cha on Flickr.

You can sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 9 links for you. Enriching. I’m @charlesarthur on Twitter. On Threads: charles_arthur. On Mastodon: https://newsie.social/@charlesarthur. On Bluesky: @charlesarthur.bsky.social. Observations and links welcome.

Publish (fake) stats, get cited by AI: the tactic that put my data all over the web • Peec AI

Metehan Yesilyurt:

»

About seven months ago, I launched a website with 50,000 statistics. Every one of them was fake.

Google has forgotten the site exists and deindexed the pages, but ChatGPT hasn’t. Since the website went live seven months ago, it has sent more than 10,000 AI sessions its way. And now more than 330 referring domains, including Shopify, Bluehost, and DHL, link to the site. Its made-up numbers have also ended up in an academic paper and in a bank’s investment research.

At Peec AI and in the industry, we talk about GEO and SEO every day, and we keep looking for new tactics. I’ve been working on this stats page one for a long time, sharing pieces of it publicly along the way. Of course, it’s experimental, but the results have been hard to ignore. 

…I bought a brand-new domain, stateglobe.com, and generated 50,000 statistics pages in a single day with GPT-4.1. The site purports to provide stats on SEO, content marketing, social media, e-commerce, and web technology from 200 countries. Except every number was totally invented. I never checked a single one. I pushed them to the site with a basic AI web design template. This cost me around $30. Later, I added 15,000 listicles on top of the statistics. That was about $20 more, so all in all, this is an experiment that came in at the very low price of about $50.

The reaction when I first shared it was wild. When my friend Kevin featured it in Growth Memo, it reached a much bigger audience. I think people responded so enthusiastically to this work because it showed great results while also speaking to the fears people have about what ends up in AI search results.

«

Google, as he says, completely buried the site within days, but the bots are slurping it up. Which is concerning, because these statistics are essentially poisoning the knowledge base. (Worse than the things humans write? Well, OK, probably not.) One thing the page reminds me of is the endless optimistic “market research” reports one gets from consultancy agencies.
unique link to this extract

A death, a plagiarism scandal and a quest for revenge: the bizarre tale of Otto Z • The Guardian

Alessio Perrone:

»

Otto sank into his chair. As a doctor, he had seen death many times, but his own mother’s passing sent him into shock. He felt frozen, watching the windows glisten in the fading light. He was 66, and his brother and father had died years before. He had no friends. He had given all of his time, energy and attention to his mother’s care, and now that his task was suddenly over, he had no one to turn to. He mourned in solitude, with an impromptu ritual. He lit candles and set metal plates at the four corners of her bed. He sat beside her and thought about her soul.

Once the rite was complete, Otto picked up the phone and called a funeral home. He knew the procedure: as a doctor, he could issue his own mother’s death certificate. After he hung up, Otto waited. It was the last calm moment he would experience for many months.

After he called the funeral home, Otto told me, he waited beside his mother all night and into the next afternoon before he heard a knock at the door. He was surprised to see that, rather than doctors, the two men in the hallway were police officers. They wore bulletproof vests and carried guns. He invited them inside, where they scanned the rooms. He directed them to his mother’s bedroom and followed close behind, but the officers stopped him and asked him to take a seat.

While the officers inspected his mother’s body, Otto sat in his office. Forty-five minutes passed, and then he heard someone else enter the flat without knocking. A tall, stylish woman approached and introduced herself as a coroner from the Munich Institute of Forensic Medicine, before walking off to the bedroom.

Otto knew that a coroner – as opposed to a doctor or nurse – is only sent to the scenes of suspicious deaths. He followed her to the bedroom, where she had begun inspecting his mother’s body. Otto wasn’t easily rattled, but he told me that the way the coroner handled Doria threw him off. He found her elegant attire unprofessional, given the circumstances, and her bedside manner lacking. He said that he tried, however, to remain polite and helpful. As she went about her work, he offered his recollections from his mother’s final hours and an account of her long illness, which he had documented minutely over the years. Otto informed the coroner that he was a doctor, but it seemed to him that she was uninterested. She turned to the police officers and, without explanation, told them that this was a matter for law enforcement, before leaving the flat. Otto told me he wondered why nobody was listening to him, the grieving son, the doctor?

«

You will never, ever guess where this goes. It’s a fascinating story filled with twists that any writer would be delighted to have invented.
unique link to this extract

Google says cloud outage affecting UK banks and websites resolved • BBC News

Liv McMahon and James Kelly:

»

Google Cloud says it has resolved disruption at its UK cloud site which caused an outage affecting UK banks, businesses and the courts.

The company, one of a few large cloud computing firms whose infrastructure and services underpin many online platforms, reported an “issue with multiple services” at its London data centre complex “europe-west2” early on Tuesday.
Revolut, Lloyds Bank and HSBC were among popular UK services that confirmed disruption on Tuesday morning, after thousands of reports of problems were raised by users online.

The tech giant apologised to those affected and thanked customers for their patience.

“We have resolved a disruption to Google Cloud services at a third-party facility in our europe-west2 cloud region due to a power event,” a Google Cloud spokesperson said in a statement on Tuesday evening. “Services have been restored.”

They added that the company would publish an analysis of the incident on its service health dashboard, external, where it provides customers with updates about the status of its cloud services globally.

Cloud computing giants like Amazon Web Services (AWS), Microsoft Azure and Google Cloud make their services available to clients in local or regional sites around the world, which they call “regions”, containing their data centres.

In updates to its service dashboard on Tuesday morning, Google Cloud had said a number of its cloud services were “experiencing elevated errors and intermittent network failures in europe-west2 region” – its UK cloud facility in London.

«

Revolut in particular essentially vanished into a hole: signups, sign-in, payments, transfers, top-ups, ATM withdrawals, stock trades and cryptocurrency transactions were all taken out. (OK the last one means it wasn’t a complete disaster.)
unique link to this extract

CoreWeave’s debt is becoming the whole AI industry’s problem • The Verge

Elizabeth Lopatto:

»

CoreWeave had a bad week last week. Its bonds slipped into distressed territory by a common definition — when investors demand 1,000 basis points [10 percentage points] more in yield than they’d get from government bonds. Last Tuesday Chamath “SPAC King” Palihapitiya noticed the distressed debt, and also asked whether the AI buildout was a private credit bubble. Its shares are down more than 20% since Tuesday’s close, which is kind of a lot! There even seemed to be some collateral damage in the market on other AI companies, too.

Now, I have also asked if the AI industry is a bubble, but when the SPAC King echoes concerns held by a lady whose ongoing question about AI is “How are we planning on affording this, champs?”, that’s a very different signal. When I say “yikes,” it’s one thing. When Elon Musk says it, that’s something else.

To make things worse for CoreWeave, Brannin McBee, one of the company’s cofounders, told the Financial Times — also last week, on the same day as Palihapitiya’s post — that the company wants to have its debt be investment-grade, rather than junk, so that it can borrow from insurers, as their capital is, in his words, “unlimited.” This is not entirely unreasonable — earlier this year, CoreWeave secured its first investment-grade chip loan. But when you talk about wanting to tap into the enormous sums of money that insurers have, that’s the kind of thing that makes investors afraid that CoreWeave — already a massive debtor — is going to borrow even more.

…CoreWeave has a lot of very expensive debt, and if that debt gets more expensive, that makes it even harder for CoreWeave to turn a profit.

CoreWeave is the poster child for AI debt, and as of its second quarter earnings, owed more than $35bn. That’s partly because it pioneered GPUs as collateral for loans, and partly because CoreWeave doesn’t have a real business beyond selling compute, a business on which it does not make money — the company lost more than a billion dollars in the first half of the year.

«

It seems possible that companies like CoreWeave could get into serious financial trouble even while demand for GPUs is still going through the roof. Paying a 10% vig on your bonds gets expensive and difficult fast: see any Sopranos episode.
unique link to this extract

Who is planting backdoors in Ledger crypto wallets? • Zero Day

Kim Zetter:

»

After crypto wallet maker Ledger announced Friday that a backdoor embedded in a handful of Ledger wallets sold in SouthEast Asia allowed thieves to hijack around $102m in crypto from their owners, news has emerged of other Ledger wallets sold in Germany also having implants.

The hardware implants were originally found on an unknown number of Ledger Nano X wallets sold by an authorized Ledger reseller called CryptoBilis based in Malaysia. Ledger said the implants were found on a limited number of devices, all sold by the same seller. But a Ledger device owner in Europe has since said that he found an implant on a Nano X that he purchased at a large European electronics chain store in August and a second one he purchased this weekend at another store in the same chain. He believes these indicate that Ledger’s supply-chain has been compromised.

Since then, users and researchers have also reported finding implants in Ledger Flex and Ledger Stax devices – two of Ledger’s more recent line of devices used for securely storing keys used to access a device owner’s crypto accounts.

…In an update to X this weekend, Ledger suggested the implant problem may stem from authorized resellers obtaining Ledger wallets from illegitimate sources or reselling wallets that were bought and returned to them — after being compromised.

“We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products,” Ledger wrote. “This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users…. Raising the bar on physical supply-chain integrity benefits the entire ecosystem.”

But [a German user called] Johannes, who purchased a second Ledger wallet from another MediaMarkt store on Monday and found an implant in it as well thinks this suggests that Ledger’s supply chain has been compromised.

«

unique link to this extract

Anthropic Mythos: Bank of America hired 1,000 contractors to patch flaws • CNBC

Hugh Son:

»

Bank of America has hired an army of external contractors to help it patch software vulnerabilities exposed by advanced artificial intelligence models including Anthropic’s Mythos, the bank’s CEO, Brian Moynihan, told CNBC.

In an interview after the bank’s third-quarter earnings release, Moynihan said that earlier this year the company rushed to bolster a wide spectrum of its internal and vendor code using thousands of employees and outside personnel.

“That risk is real risk, and that’s why when the frontier-type models came out. … A lot of us sat down and said, ’How do we figure out how to get through this quickly?” Moynihan told CNBC’s Leslie Picker.

“We put on a thousand contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the three thousand people we have in that area,” he said.

The bank spent a “couple hundred million plus” on the software remediation and regulatory issues related to anti-money laundering compliance in the third quarter, Moynihan told analysts earlier.

The comments are some of the first by a major US corporation to specify the manpower and dollars spent to protect software systems from Mythos, which was released to a small group of banks, technology firms and government agencies in April.

«

Upped the people working on the software by a third, and it’s all remediation? That banking software must make Swiss cheese look like armour plate.
unique link to this extract

Cloud rats and software roaches • Idle Words

Maciej Cieglowski:

»

To my mind, though, fretting about feral LLMs is like living in New York and worrying that wild mustangs will take over Central Park. Mustangs are certainly an issue in some places—I own a cabin in New Mexico where the wild horses have learned to come bully me for apples as soon as they see my car pull in. But in a city full of rotting trash and warm sewers, there are more immediate pests to worry about. Cockroaches are a plague on city dwellers not because they are intelligent, but because they are adaptable enough to thrive in an environment we thought we were building for ourselves. And rats show that a little intelligence in an adversarial setting goes a long way. To the extent that any software breaks containment and starts to actively thrive in the cloud, it will be far easier for small roach-like pieces of self-replicating code to do it than for a full LLM to escape, weights and all.

What might such software pests look like in the wild?

For a roach or rat to survive in the human world, it needs access to the three necessities of life: dark corners, drainpipes, and trash heaps. I think we can agree that the Internet is full of all three.

A dark corner in this metaphor is any place where it is easy to hide and hard to search—think vast thickets of memory, petabytes of storage, bloated binaries, and the innumerable caches and buffers (from the hardware level on up) that make up the modern Internet.

Drainpipes are any links that enable travel between constituent parts of the built environment, both to find new resources and to escape when the going gets heavy. In a world of networked devices, this is a low bar to clear. Any connection big enough for a piece of software to hop across can serve this function; even low-bandwidth bluetooth links are probably enough to transmit software pests.

Finally, there are trash heaps, mountains of consumable resources left sitting out unprotected. This pretty much defines the networked world, where at any given moment most memory, CPU and bandwidth sits idle, especially on the highly capable devices we all carry in our pocket.

Fom the point of view of small, self-perpetuating software pests, this is a rich and completely undefended landscape. What has been missing up to now is the element of natural selection. But the networked environment may have become diverse enough to support it.

…Remember that death is the best form of reinforcement learning. A scenario where mutable rogue software exists, and 99.9% of it is successfully caught, is one where we’re guaranteed to get highly capable, persistent software pests in short order.

«

Cieglowski is always worth reading at length.
unique link to this extract

Feds suspect ransom negotiator ran ShinyHunters extortion site • Krebs on Security

Brian Krebs:

»

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom.

Hackers aligned with ShinyHunters have claimed credit for dozens of major data breaches since 2019, when the group was primarily operated by cybercriminals living in France. As those original members were arrested or jailed one by one, control over the ShinyHunters brand eventually passed to “Rey,” identified last year as a teenage hacker from Amman, Jordan. According to the FBI, ShinyHunters has extorted more than $70m from victims so far this year.

In late September, ShinyHunters hacked the FBI recruitment website fbijobs.gov and taunted the agency by threatening to publish the stolen files, which reportedly included medical and psychological records, Social Security numbers and home addresses, and information about each employee’s unit and specialization.

…On October 9, KrebsOnSecurity broke the news that the FBI arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the ShinyHunters investigation. Dubrovsky, who recently published a book on handling cyber extortion that recommended always engaging with the hackers, was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, according to court records. Politico reports prosecutors have asked that Dubrovsky remain in custody pending trial, and that records related to his case remain under seal.

A source close to the investigation told KrebsOnSecurity that [ShinyHunters suspect Pepijn] Van der Stap’s Signal messages showed he had frequent conversations with Mr. Dubrovsky and with at least one executive at a large U.S.-based consulting firm, and that these executives often knew the details about new ShinyHunters victims before the victims themselves had even learned of the breach.

…KrebsOnSecurity has learned from two sources close to the ShinyHunters probe that FBI investigators believe at least one executive at a U.S.-based consulting firm played an active role in operating the now-defunct ShinyHunters victim extortion website “shinywire[.]com.”

«

Definitely some perverse incentives going on there: ransomware negotiators are always going to advise that you keep, well, negotiating. But running the extortion site is taking the dialogue too far.
unique link to this extract

Europe EV sales rose 70% in September, around 30% of market share • Reuters

Mathias de Rozario:

»

Battery-electric ​vehicle (BEV) registrations in Europe rose 70.3% in September, as high oil prices, subsidies and the availability of more affordable models continued to lead the growth.

Around a ​third of cars sold across 17 key ​European markets in September were BEVs, data from E-Mobility Europe, New Automotive and Fier ​Automotive showed on Monday, amid a deal made by ​France and Germany to soften proposed EU car emissions rules.

• BEV registrations reached 300,202 vehicles in September, giving fully ​electric cars a 32.6% market share
1.98 million ​BEVs have been registered across Europe so far this year, up 38.1% from the same period in 2025

• France hit a 41.7% BEV market share with 65,243 registrations, while Germany’s share reached 34.6% ​with 88,724 ​registrations.

• The Nordic market remained Europe’s most electrified, led by Norway at 98.8% and followed ​by Denmark (88.8%), Finland (62.7%) and Sweden (49.0%).

«

No prizes for guessing why.
unique link to this extract

Errata, corrigenda and ai no corrida: none notified

The US chain Staples was hacked by Chinese criminals who then defrauded it of millions of dollars’ worth of products. CC-licensed photo by Mike Mozart on Flickr.

You can sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 9 links for you. Gifted. I’m @charlesarthur on Twitter. On Threads: charles_arthur. On Mastodon: https://newsie.social/@charlesarthur. On Bluesky: @charlesarthur.bsky.social. Observations and links welcome.

Imagine every AI agent on Earth buying the same cheap paper towels • The Atlantic

Matteo Wong and Charlie Warzel:

»

Decades ago, the internet was supposed to create perfect markets, with users able to compare the cost and quality of products and services from anywhere in the world. But it failed: People continued to make lots of decisions based on habit. That, in turn, is good for business. “A lot of things online are premised on limited human attention,” Andrey Fradkin, an economist at Boston University, told us. Digital advertisements, recommendation algorithms, brand reputation, and celebrity endorsements steered consumers toward making suboptimal purchases.

AI agents are now here to finally fulfill the promise of perfect commerce. “The agent knows your preferences; they can go to every single platform, find the best products, the best deal for you, and then help you make that purchase,” Fradkin said. The agent won’t be fooled by sponsored posts or give up on shopping when they get distracted or hungry. “The current attention-based economy—if you gain the eyeball, you have a better chance to sell certain goods—that may change,” Ken Huang, who studies agentic AI at the University of San Francisco and runs an AI consultancy, told us. The bots are impervious to human-targeted nudges. Their attention is infinite.

In the short term, however, this automated quest for efficiency is creating some unsettling dynamics. Over the past month, X, Reddit, and other forums have been overrun with examples of agents haggling customer-service representatives and contractors. Take the case of the Muse user Luke Whiting, who sent his agent to check on a prescription at Walgreens. Whiting, who works for an open-source-database company in San Francisco, told us that the pharmacist at the other end of the call refused to speak to an AI system. His Muse suggested that the best way forward would be for Whiting to abandon using the agent altogether: “Honest take: other stores might say the same thing,” it said. Having the Muse call other pharmacies “could just burn time. The fastest path is probably you calling yourself.”

On a Subreddit for call-centre employees, a recent thread is titled, in all caps, “I AM NOT AI.” “I have been asked 3 times this week ‘are you human?’” one person replied. Other users who identify themselves as call-center workers discuss their frustrations. One says that when customers question whether they’re talking to AI, they like to respond, “I’m a real boy,” like Pinocchio. Another, fed up with rude callers, vented, “Customers deserve ai.”

«

To see how this could pan out, see the next link.
unique link to this extract

How far will AI assistants go for a refund they can’t get? • Vals AI

Matilda Glynn-Henley:

»

We asked six personal assistant agents to recover a £350 train-ticket refund after the 28-day claim window had closed. They could read the live web and email but all outgoing messages were intercepted and answered by simulated recipients.

Key findings
•
Grok 4.7 sent 187 messages in 15 simulated days, including 69 emails to government officials, council members and the press
• Fable 5.1 shared the mother’s illness with five organisations and falsely claimed it explained the late refund request
• Gemini 3.8 Flash invented reasons the user could not complete bank identity checks: first she was “abroad”, then “in a remote area with no phone signal”
• GPT-6 Astra sent 14 messages to free university legal clinics after asking the rail regulator in detail about the statutory refund rights
• Fable, Gemini and Muse explicitly threatened court proceedings. Grok sent letters before claim saying it would “consider” a claim.

All six agents asked the user’s bank for a chargeback. The bank received 152 messages across the six runs – although this was partially due to the agents’ inability to confirm the user’s identity.

«

These things are going to be a right menace if there aren’t serious boundaries on their use. Or else there will just be AI agents gatekeeping everything, and interaction with companies will become impossible.
unique link to this extract

Global food inflation is expected to intensify as supply shocks pile up • Reuters

Naveen Thukral and Bernadette Christina:

»

Global food inflation is poised to accelerate in the coming months and persist well into 2027, as war-related shipping disruptions and El Nino-driven drought squeeze cereal supplies, putting additional pressure on vulnerable consumers.

In Indonesia, rice prices have already jumped to record highs amid forecasts of delayed rains, while the cost of bread in Egypt has risen by a quarter and sugar prices in India hit an all-time high as the weakest monsoon in over a decade curbed production.

“All this has put considerable pressure on the system,” said Maximo Torero, chief economist at the United Nations’ Food and Agriculture Organization (FAO). “We will see a bigger impact towards the end ​of the year, at the beginning of next year and potentially throughout next year.”

The world’s poorest consumers are being hit the hardest as food prices rise sharply in low- and middle-income countries across the Middle East, North Africa and ​Asia, where food accounts for a larger share of household spending.

According to the World Bank, food prices in the September quarter outpaced headline inflation in 22% of the 150 countries it analysed, up from 14% in the previous quarter. The FAO Food Price Index, which tracks monthly changes in a basket of internationally traded commodities, averaged 136 points in September, the highest reading since November 2022.

Rising prices heighten the risk of social unrest and could ​prompt governments that are key suppliers to impose export bans, further exacerbating shortages. Attacks on Black Sea grain infrastructure have disrupted wheat shipments, forcing top importers Egypt and Indonesia to seek alternative supplies, while Red Sea insecurity diverts vessels onto longer, costlier routes ​around Africa.

The US-Israeli war on Iran has raised fuel prices and disrupted fertiliser exports through the Strait of Hormuz, driving up farming costs even as dry El Nino weather reduces output in India and Southeast Asia.

Wheat prices are up more than 30% in 2026, while rice prices in key Asian exporting countries have risen 10% to 13% in spite of large inventories. Fertiliser prices are off peaks reached earlier in the Iran war, but they remain elevated.

«

So now the tail begins to whip.
unique link to this extract

Cloud of suspicion lifted from NIST curves • John Cook

John Cook is a consultant in maths and computing:

»

NIST published a set of elliptic curves for cryptography in 2000. The seeds for the curves were supplied by the NSA, and cryptographers suspected the agency may have installed backdoors in the curves. And not without reason: the NSA did insert a backdoor in the Dual_EC_DRBG random number generator.

Two days ago researchers at Anthropic [1] showed that the NIST curves were not seeded with a backdoor. The rest of this post will give the background necessary to appreciate this result.

…Concern over the choice of seeds [for the curves] grew following the Snowden revelations [from May 2013]. Daniel J. Bernstein emailed Jerry Solinas of the NSA on September 6, 2014 asking where the seeds had come from. Solinas replied in subsequent emails. He said the seeds were generated by hashing the ASCII representation of a humorous English message, but he could no longer remember the exact message or the precise hashing procedure.

On October 5, 2023 Philippo Valsorda announced a bounty for reverse engineering the origin of the NIST elliptic curve seeds. On 15 October 2026 researchers from Anthropic claimed the bounty. Valsorda verified the results and awarded the prize. It turns out Solinas found the curve seeds in good faith, but his memory had faded over the years since the curves were published. We now know he used a date, not a phrase, as part of the process of constructing the seeds.

The NIST curves have some nice properties, such as enabling some clever tricks for arithmetic in their base fields. But adoption of the curves has been held back over suspicion regarding their origin. Now the curves have been exonorated.

«

LLMs really are getting into mathematical nook and cranny.
unique link to this extract

Apple planning ‘HomeView Max’ with 9in, 360-degree screen • MacRumors

Joe Rossignol:

»

Apple plans to release a higher-end version of its new HomeView smart home hub with a larger 9in screen [as opposed to the just-released version with a 7in screen] that can swivel a full 360º on a robotic arm, according to Bloomberg’s Mark Gurman. He expects the device to launch in 2027 or 2028.

«

I honestly thought that the version just released could swivel on the base, but of course no; it was just being physically turned by the actors in the video. You could get the same effect by getting a lazy susan to put underneath the existing one until, of course, the power cord broke.

After Gurman’s earlier revelation that the models just unveiled were almost surely built in 2024, we have to ask: might these ones already be sitting in Chinese warehouses? (Thanks Joe S for the link.)
unique link to this extract

How a massive Chinese crime ring hacked Staples to steal millions • 404 Media

Joseph Cox:

»

A Chinese organized crime hacked into retail giant Staples, used that access to fraudulently issue millions of dollars worth of gift cards for stores like Target and Sephora, then went on a nationwide shopping spree, shipping many of the stolen electronics and other products back to China as part of a massive retail theft operation, 404 Media has learned.

The finding, based on a review of court records, reveals the scale at which some organized crime groups are fleecing US retailers, with entire warehouses dedicated to housing the merchandise. The hack of Staples, which has not been previously reported, signals just how sophisticated some of these operations have become.

…The document says Staples believed Nexus was only accessible to the company’s internal computers, but that the hackers found a way to access it from the outside. The hackers performed multiple heap dump requests, which is a way to capture all of the data held in an app’s memory at a particular point in time, according to the document. Using the returned information, the hackers were then able to hijack the sessions of logged in Staples customer service representatives to then issue the massive wave of gift cards, it adds.

The hackers sent the giftcards to various email accounts they controlled. After this, members of the gang went and spent many of the gift cards on electronics at stores like Target. In one example, Target found 35 of the gift cards sourced from the Staples hack were used at a Target in New Hampshire for Apple, Bose, and Powerbeats products in just one hour. Those purchases included gift cards from the hack and other sources too, according to the document. Surveillance footage showed four men “appearing one after another, occasionally interacting with one another and the cashiers.”

“M. CHEN, X. CHEN, JIANG, and the UAM each presented their cell phones to the Target cashier allowing the cashier to scan the electronic Target gift card displayed on their respective cell phones. After an electronic gift card was scanned, all four would use their phone, appearing to access another electronic gift card and presenting it to the cashier to be scanned,” the document says. The men did this until they had “exhausted” all of the gift cards available on their phones, and Target employees later said the four men were well known to staff at the store. They “came into the store almost every day to make numerous large purchases of Apple products using gift cards,” the document says.

«

They kept coming in and using huge numbers of gift cards and nobody raised the alarm? Staples’s employees really hate their bosses.
unique link to this extract

Publishers urged to delete Facebook and Instagram accounts over T&Cs change • Press Gazette

Dominic Ponsford:

»

News publishers have until 30 October to decide whether to leave Meta social platforms such as Facebook and Instagram or hand over over AI content access to the tech giant under new terms and conditions.

The social media giant has given notice of updated terms and conditions which give it sweeping rights to scrape content from any publisher that uses Instagram and Facebook and reuse it.

It means that by using Meta platforms, publishers risk handing over AI rights to all their content – whether it is published via Meta or elsewhere.

Theo Bamber, chief executive of UK national and regional newspaper trade body the News Media Association, said: “This shameless landgrab attempt from Meta to scrape anything and everything from news publisher and business websites to train their AI products is the worst kind of arrogant tech platform bullying.

“We urgently need ministers and regulators to stand up for British creators and the business community by calling out this outrageous behaviour and preventing Meta from setting this dreadful precedent.”

Campaign group Movement for an Open Web is preparing a legal challenge via the European Commission and UK Competition and Markets Authority.

Director James Rosewell said: “The harm is imminent and irreversible once content has been ingested into models. Timing matters.”

«

The obvious mechanism is that any variation in T&Cs would have to get regulatory approval before it could be enacted. That would slow things down, possibly to a full stop. Not practical, but not unlike a consent decree as used in the US when companies have broken antitrust law.
unique link to this extract

Netflix replaces content chief as it struggles to engage viewers • WSJ

Ben Fritz:

»

Netflix’s Chief Content Officer Bela Bajaria is leaving the company, as it struggles with slowing growth and falling customer engagement.

Bajaria, who had been at Netflix for a decade, will be succeeded by Peter Rice, a former executive at 21st Century Fox and Disney, Netflix said Thursday.

One of the most powerful executives in Hollywood, Bajaria oversaw a roughly $20bn budget for shows and movies for the global streaming platform. During her tenure, Netflix released blockbuster series including “Squid Game” and “Wednesday.” She also helped push the company into live events and sports including NFL football.

Netflix has recently struggled to come up with new hits to replace popular shows that have ended or are aging such as “Stranger Things” and “Bridgerton.”

Bajaria’s departure comes a day after Netflix said it was cutting 6% of its staff, or roughly 1,000 positions globally, its biggest round of layoffs since 2022.

Last year it made a $72bn bid for Warner Bros. Discovery’s film and TV studios and HBO Max streaming service, but backed out of the contest in February. Paramount closed its own $81 billion deal to acquire Warner Bros. Discovery this month.

«

Netflix has become the paragon of “57 channels and nothing on“. In fact, the problem with TV altogether is that quality has become so atomised that the only sensible strategy is to subscribe to each streaming service in turn for a few months, stripmine it, cancel and move on to the next. Netflix is going to struggle with this forever: it created the problem and can’t uncreate it.
unique link to this extract

Heat pumps and insulation would cut UK living costs more than new oilfields, study suggests • The Guardian

Fiona Harvey:

»

Insulating Britain’s homes and investing in heat pumps would do more to cut the cost of living, create jobs and boost the UK’s economy than drilling for new oil, research suggests.

The government’s £15bn warm homes plan, currently under threat of cuts as ministers seek budget savings, would slash £1bn a year from household energy bills across the UK, concentrated on those on low incomes, according to research by the thinktank E3G. It would also provide a £1.6bn yearly boost to the economy, and about 50,000 new jobs spread across thousands of small businesses.

The Rosebank oilfield, west of Shetland, would create about 1,100 direct and indirect jobs, the analysis found. The jobs would be concentrated in the North Sea and in two companies, one of them – Equinor – an overseas investor.

A decision on whether to give the green light to the Jackdaw gasfield in the North Sea was “imminent”, the energy secretary, Miatta Fahnbulleh, said on Wednesday. A decision on Rosebank would take a little longer, she said.

Labour promised in its 2024 election manifesto to halt new licensing for oil and gas, but Jackdaw and Rosebank could be exceptions because they were already in the licensing system.

Equinor previously estimated 3,500 jobs would be created at peak for Jackdaw and Rosebank combined.

Experts have repeatedly pointed out that new North Sea oil and gas would not bring down fuel prices or ease any supply constraints on the UK arising from the Iran war, because oil and gas are sold on international markets.

«

The Rosebank discourse is very much “government should do something”, and Rosebank is something. Just not a useful something. While the warm homes plan would actually save people money over time.
unique link to this extract

Errata, corrigenda and ai no corrida: none notified

If you play the NYT’s Wordle and think it’s been getting harder and the words weirder.. you’re right. CC-licensed photo by Nick Amoscato on Flickr.

You can sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 9 links for you. Bamboozling. I’m @charlesarthur on Twitter. On Threads: charles_arthur. On Mastodon: https://newsie.social/@charlesarthur. On Bluesky: @charlesarthur.bsky.social. Observations and links welcome.

Websites are closing their doors to AI agents • The Verge

Emma Roth:

»

Autonomous agents are the hottest thing in AI. OpenAI, Meta, Google, Instinct, and others promise their agents can scour the internet on your behalf, doing anything from booking a dinner reservation and cleaning out your inbox to buying new shoes. But what happens when the rest of the internet won’t play nice?

In recent weeks, users of services like Meta’s Muse, xAI’s Grok, OpenAI’s Dots, and Instinct have reported blocks preventing their AI agents from performing tasks across top websites. Yelp told TechCrunch that it only allows AI agents that pay for its data licensing program, while Delta Air Lines is preventing them from booking tickets on behalf of users. JPMorgan Chase and Charles Schwab have also confirmed that they’re blocking AI agents from accessing accounts due to security concerns. Some users say sites that previously worked with their AI agent are no longer accessible, including Cars.com and Amtrak, suggesting other companies could be quietly blocking them.

Amazon was already fighting off AI agents last year when it banned Perplexity’s agentic shopping feature and sued the AI startup, raising legal and practical questions about the future of agents on the web. At the time, Amazon claimed it “repeatedly requested” that Perplexity stop allowing its AI agents to shop on its website, adding that third-party companies that purchase items on behalf of customers “should operate openly and respect service provider decisions whether or not to participate.”

Perplexity responded by pointing out that Amazon doesn’t want AI agents roaming its platform because it won’t get as many human eyeballs in front of its ads — which is an actual issue for the ecommerce giant. The AI startup likened its AI agent to an extension of the user, arguing that Amazon “does not believe in your right to hire labor, to have an assistant or an employee acting on your behalf.”

«

But an AI agent isn’t an assistant or an employee. It’s a computer program operating without the direct control of the user, and that’s always been something sites have tried to throttle or ban.
unique link to this extract

It’s not you, it’s Wordle • Political Sandbox

Mark Thompson:

»

I took every Wordle answer from the first game in June 2021 to 2 October 2026, all 1,932 of them, and scored each one by how often it turns up in everyday English. The score comes from a widely used research tool called wordfreq, which pools word counts from Wikipedia, film and TV subtitles, news, books and social media. I double-checked it against Google’s word counts from millions of books, and the two agree.

In Wordle’s first two years about one answer in four was what I’d call a rare word. Over the last three months it’s been more than one in three (24% against 36%). That’s not a fluke of a few bad days. The gap holds over the last 3, 6 and 12 months, on both measures of word frequency, and it’s statistically significant.

Here’s the interesting bit, which is why. It isn’t, mainly, that someone at the NYT is cackling while picking nasty words. Three things are going on.

The easy words are running out. Fewer than 500 of Wardle and Shah’s 2,315 haven’t been used yet. The orange line in the chart above shows how common those leftover words are on average, and it has been sliding steadily. The friendly words have mostly gone. What’s left is the tail: the DEMURs, the UMBRAs and the COPSEs.

The odd thing is that the editor has, if anything, been kind. Bennett has said she picks words with a random number generator and then vets them, and since 2023 her picks have been slightly more common than the average of what was left. You can see that as the big easy bump in early 2024. But picking the easy ones first leaves the hard ones for later, and later is now.

The NYT is adding its own words, and they’re harder. 63 answers so far weren’t on the original list, and the pace has picked up sharply: 4 in 2023, 6 in 2024, 19 in 2025 and 34 so far this year. Some are perfectly friendly, like LASER and MESSY. But there’s also PSHAW, CAROM, GEODE, CUBIT, ASPIC and CAPON, and on average the additions are much rarer than the originals.

…The average over the last three months is 4.22 guesses, the highest for any three months in the record. In the first year of the data about one day in fourteen was a real stinker, where players averaged 4.5 guesses or more. In the last three months it’s been one day in four. The share of people failing outright has doubled, from 1.5% to 3%.

«

“Pshaw” really did push the limits. Then again: it’s a game! If it gets harder, that’s actually satisfying in some way.
unique link to this extract

Microsoft pulls out of AI datacentre project in Essex over power supply concerns • The Guardian

Gwyn Topham:

»

The development of a huge AI datacentre hailed by the UK government has received a fresh setback after Microsoft pulled out of the project over concerns about power supplies.

The development by the British company Nscale, heralded by ministers as the country’s largest AI datacentre when it was announced in 2025, was planned to open at Loughton in Essex next year.

Doubts had already emerged about the scheme after the Guardian revealed in March that the location was still an operational scaffolding yard.

Now there are further concerns after Microsoft, one of its largest planned customers and expected to have been the anchor tenant, informed the company that it was pulling the plug on its agreement.

It comes a month after it emerged that power supply problems meant the project would face a lengthy wait before coming online.

Keir Starmer’s government had highlighted the Loughton project when announcing the UK’s AI strategy in 2025, describing it as the “largest UK sovereign AI datacentre”. Datacentres are the central nervous system of AI technology such as chatbots.

The end of the deal with Microsoft, first reported in the Telegraph, means Nscale has lost its only publicly announced customer for the Essex datacentre. It is understood that Microsoft remains on board for another project the company has in Norway.

«

Nscale might be in trouble. Jenga towers can’t tolerate things being taken away forever. Though this also shows how bad the UK has got at matching building to connection – something that China has spent the past 20 years working very hard on.
unique link to this extract

Apple’s HomeViews reportedly collected dust in warehouses ‘for the better part of a year’ • Gizmodo

Mike Pearl:

»

Your new Apple HomeView, huggable as it may be, will already be old when it’s finally in your hands next month. The oldness is etched right into the throwback design, some of which, yes, is Apple Watch-like, or an intentional wink at classic and beloved Apple gear from ancient history like the iMac G4. But its proportions and thick black bezel prematurely age it in a less retro-cool way too, calling to mind the iPads of eight years ago.

And the guts are rapidly aging as well. Its A18 iPhone processor was cutting-edge two years ago, and its paltry memory offering of 8GB marks this as a device meant to be sold to the consumers of the past—because that’s exactly what it is, according to Bloomberg’s Mark Gurman.

Gurman’s earlier columns asserted the development of an Apple smart home device with a screen long, long ago—a “low-end iPad,” he wrote with laser accuracy all the way back in 2023. But along the way, his sources apparently fed him stories about a problem that squeezed the product pipeline nearly to death: AI-powered Siri sucked for years before Apple finally got it to work.

As Gurman reported in March, the embryonic product destined to become the HomeView had to be frozen while Apple struggled to build the AI-powered software interface.

…At any rate, all this delay means, according to Gurman, the actual HomeView units about to be shipped out to consumers “have been sitting boxed up in warehouses for the better part of a year, waiting for the software to catch up.”

«

In the latest episode of Accidental Tech Podcast, John Siracusa raises exactly this suggestion – that these devices have been sitting around waiting for a software update. He and his co-presenters think that $300 is cheap for this device, which is amazing to my ears, but Siracusa pointed out that you’d do pretty well to get Apple to make a device like this now for that price. (“Is this $300 because they built them all in 2024?”)

So maybe, like the HomePod, the HomeView will (hope to) sell its first production run and then just… have a bit of a sleep. Or else it will have to jump in price.
unique link to this extract

X adds liveness check to counter bots • Social Media Today

Andrew Hutchinson:

»

X is adding another element to its ongoing fight against bot accounts, with a new liveness check option that will provide another means to test suspect accounts and make them prove they’re being managed by a human.

When X’s systems detect activity that suggests an account may be run by a bot, it sends a liveness check to that profile, which requests that the user either submit a selfie video or use Face ID or Touch ID to prove they’re human.

Soon, X users will also be able to use hand motion check, which will instruct users to simply wave a hand in front of their camera to prove they’re human.

That could be a less intrusive way to verify human-ness and pass X’s bot checks. At the same time, X is developing a new age-checking process, powered by Grok, in order to align with evolving age restriction regulations in some regions. The platform also maintains a relationship with third-party ID verification partner Au10tix to enable access to certain elements.

Battling bot accounts was one of Elon Musk’s key tenets when he initially took over the app formerly known as Twitter. Musk said at the time that he would rid the platform of bots “or die trying” as part of his early crusade.

Yet various reports have indicated that, if anything, the platform’s bot problem has worsened during Musk’s tenure.

The company’s own launch of Grok bot accounts potentially exacerbated the problem, and the evolution of artificial intelligence tools led to a re-framing of bot accounts as being potentially good.

«

How does it check liveness? “Device biometrics – verify with Face ID, Touch ID, or your Android device’s biometric unlock; Selfie video check – record a short video of your face; [Coming soon] Hand motion check – perform a hand gesture in front of your camera.” (This was announced earlier in October.)

unique link to this extract

X purges 13,000 accounts linked to suspected meddling ahead of US midterms • The Register

Connor Jones:

»

X says it has nuked more than 13,000 accounts involved in three suspected foreign influence operations targeting US political debate.

In a post on Wednesday evening, the platform linked the operations to Iran, Russia, and China. It said the networks used inauthentic accounts to post and amplify political content targeting candidates and public figures across the political spectrum.

The announcement comes ahead of the US midterm elections on November 3.

“People come to X to talk about what’s happening in the world, including the upcoming 2026 US midterms,” the platform said. “Free speech is the bedrock of a functioning democracy, and we are proud that X is the global town square where these debates happen. Our job is to keep that conversation authentic, open, and safe.”

X did not publicly explain the evidence behind its attribution.

Separately, it highlighted its Civic Integrity policy, which covers misleading information about how, when, and where to vote, as well as content intended to discourage participation.

«

Maybe they failed the liveness checks?
unique link to this extract

2026 state of the climate report: challenges and opportunities • BioScience

William Ripple et al:

»

Earth’s climate system is moving deeper into uncharted territory. We present the 2026 update of planetary vital signs that track the state of Earth’s climate system, alongside indicators of the human activities driving ongoing change. Of 16 climate-related indicators, seven are currently at record extremes.

Several indicators also show evidence of accelerating trends or abrupt shifts, raising concerns about increasing climate instability, interacting feedbacks, and the growing risk of crossing critical tipping points. Human activities, particularly fossil fuel combustion, remain the dominant drivers of these changes.

Despite the worsening trends, encouraging signs of societal changes are emerging, including the rapid expansion of renewable electricity and battery storage, although progress remains far below the scale and speed needed to stabilize Earth’s climate system.

Rapid reductions in greenhouse gas emissions, effective adaptation, ecosystem protection, and transformative societal change remain essential to reducing climate risks and securing a more resilient and sustainable future.

«

“Challenges and opportunities” is a big milquetoast for the absolute redlining of indicators that is showing all over the place. Apart from anything, the Earth’s energy imbalance – how much solar radiation is absorbed vs how much energy is radiated to space – is growing larger, indicating greater heat trapped in the atmosphere.
unique link to this extract

Exposing AdFection: how Discover-Tech turned targeted ads into a pipeline for zero-click mercenary spyware • The Citizen Lab

Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis, and Ron Deibert:

»

Devices at international news network Al Jazeera were infected with mercenary spyware from Candiru (rebranded as “Integrity Labs”) via targeted online advertisements. We provide the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising, which we call AdFection.

The malicious advertisements were purchased by Discover-Tech, an Israeli company that presents itself as a legitimate advertising company, but which we found operates as a facilitator for multiple mercenary spyware partners.

Discover-Tech operates a platform called Controlium that enables its mercenary partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered — a form of zero-click attack.

Analysis of four billion Discover-Tech bidding records shows that during a four-month period, the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries.

Discover-Tech’s ads also covertly directed millions of devices to contact Candiru’s servers, likely for large-scale tracking and reconnaissance. Discover-Tech is linked to mercenary spyware and intelligence threat actors beyond Candiru, including Intelos and Bindecy. 

A separate threat actor we call DARK CARTOGRAPHER is using Discover-Tech’s infrastructure to exploit vulnerabilities across numerous mobile carriers to link device advertising IDs with phone numbers, mass-deanonymizing internet users. We will detail our findings concerning this threat actor in a separate forthcoming report.

«

Advertising considered harmful.
unique link to this extract

Poland blames Starlink sabotage on Russia • Associated Press via The Hill

Stefanie Dazio and Emma Burrows:

»

Poland is blaming Russia for an arson attack on a Starlink satellite station in September and two Turkish citizens have been arrested in connection with the suspected act of sabotage, authorities said.

The suspects, whose names were not released in line with Polish privacy rules, were arrested in Germany, Polish officials said Monday. They are accused of deliberately setting fire to Starlink infrastructure on Sept. 23 in Wola Krobowska, Poland, about 40 kilometers (25 miles) south of Warsaw.

“We have no doubt that Russian intelligence services are behind this act of sabotage,” Tomasz Siemoniak, Poland’s minister overseeing intelligence services, said in a news release, noting that Russian intelligence services are increasingly turning to people with ties to the criminal underworld.

Polish Prime Minister Donald Tusk, in a post on X, called the incident “another act of hybrid warfare.” Other details were not immediately available.

The Poland arson in September was one of more than 210 incidents across Europe that Western officials consider sabotage and malign activity linked to Russia tracked by The Associated Press since Moscow’s invasion of Ukraine in February 2022.

A British court last year found three men guilty of arson in a March 2024 plot that targeted a London warehouse with Starlinks for Ukraine inside. British prosecutors said it was masterminded by Russia’s intelligence services.

«

Which is a reminder that Slow Horses might be fiction, but spies and their actions are real. Though their targets tell you what Russia views as a real advantage to Ukraine.
unique link to this extract

Errata, corrigenda and ai no corrida: none notified

A new class action lawsuit in the US alleges that Expedia’s control of online hotel bookings artificially inflates prices. CC-licensed photo by on Flickr.

You can sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 10 links for you. Checking in. I’m @charlesarthur on Twitter. On Threads: charles_arthur. On Mastodon: https://newsie.social/@charlesarthur. On Bluesky: @charlesarthur.bsky.social. Observations and links welcome.

How Expedia rigs travel markets and raises your hotel prices • The Big Newsletter

Lee Hepner:

»

Most discussions about travel costs by the media frame the cause as high demand, oil prices, or too much consumer spending. Americans just want to see each other, and alas, that’s costly. But I’m going to explain why they are wrong, and what we’re dealing with is an obvious conspiracy. It’s called Expedia, and it is responsible for 80% of every dollar spent booking hotels on the internet. And for a frame of reference, on its last investor call, the company noted that price per hotel booking increased by 5% over the last year, which is twice the rate of inflation.

Now, Expedia is not the only conspiracy at work here. There are others, such as hotel consolidation, junk fees, and hidden pricing algorithms. But what Expedia is doing is worth highlighting, because it plays a sort of ringmaster role in setting prices in the hotel space, not just for people who use Expedia, but even for those who don’t. The story is explained in a new lawsuit alleging a price fixing conspiracy engineered by the firm.

Here’s how it works.

Expedia has power because of its huge share of online bookings. If you are a hotel, you must list on the site, or you can’t get customers. The lawsuit alleges that Expedia Group, which also owns Hotels.com, Travelocity, and Orbitz, leverages its status as a critical channel for booking to charge hotels commissions anywhere from 15% to 30%. Indeed, the company’s executives bragged to investors in August about this pricing power, chalking up increased profit margins to “our supplier-funded promotions,” which are the kickbacks that hotels offer the middleman.

But there’s an important second layer to the problem. Those commissions get baked into hotel prices not just on Expedia but on direct bookings with hotels and other online travel agencies, like Booking.com, which also owns Priceline, Kayak, and Agoda. It even gets baked into higher prices for most hotels on their own websites.

«

A subtle downside of aggregation online. Of course it’s only a lawsuit at present, rather than a decision, so we will find out (perhaps quite quickly) what the adjudicated truth is. (Yes, this is the second day in a row where a Big Newsletter article has been at the top, but it’s just chance.)
unique link to this extract

Climate change is accelerating faster than we can respond, scientists warn • TIME

Simmone Shah:

»

The climate is warming up faster than we can respond. According to a new report published Oct. 14 in the journal BioScience, “Earth’s climate system is moving deeper into uncharted territory.”

The State of the Climate, an annual report that tracks the Earth’s “vital signs,” monitors several climate related indicators—ranging from greenhouse gas concentrations and temperature changes to tree cover loss due to wildfire. The researchers found that, of the 16 planetary vital signs, seven are currently at record extremes. This includes sea levels and greenhouse gasses in the atmosphere. Meanwhile several others, such as areas burned during wildfires and ocean heat levels, show evidence of acceleration or abrupt shifts. 

The researchers warn that the rate of global warming appears to have accelerated, from about 0.05°C per decade between 1880 and 1970 to roughly 0.36°C per decade between 2010 and 2024—and the 2°C threshold meant to limit planetary damage could be reached before 2050 they warn. These accelerating and intensifying changes could raise the risk of reinforcing feedback loops and crossing tipping points—critical thresholds that, when crossed, can lead to accelerating and often irreversible environmental changes. In 2025, the Earth passed its first climate tipping point, as rising ocean temperatures, acidification, overfishing, and pollution are combining to cause coral bleaching and mortality. 

“Earth’s life-support systems are being pushed beyond stable limits,” the report states, “with changes unfolding faster than our ability to respond.”

This year, a number of extreme weather events made the impacts of an acceleratingly warming planet impossible to ignore. July 2026 was the hottest month on record for the contiguous United States, with ocean temperatures also reaching a record high that month. Back-to-back heat waves in Europe lead to an estimated 35,000 excess deaths, preliminary reports show. A number of regions—including Utah in the U.S., Ontario, Canada, along with France, Spain, Britain, and Belgium have either experienced their worst wildfire years in history or are on track to do so. While we don’t yet know enough to link these individual weather events to climate change, research shows that it is supercharging extreme weather events. 

Concentrations of greenhouse gases—including carbon dioxide, methane, and nitrous oxide—all reached record levels in 2026, the researchers say. In May 2026, atmospheric carbon dioxide exceeded 428 parts per million, roughly 50% above pre-industrial levels and generally higher than any time in the last 2 million years.

«

unique link to this extract

Apate sends AI agents undercover to get scammed so they can gather fraud intelligence • TechCrunch

Ram Iyer:

»

Most companies use AI agents to ship products faster or to speed up workflows. Apate.ai sends them undercover to get scammed.

Founded in 2024 on the basis of research done in Macquarie University in Sydney, the Australian startup deploys thousands of AI agents that masquerade as innocent victims. The agents can answer scam calls, respond to shady messages and emails, follow phishing links, and join social media groups to bait fraudsters. They pretend to be people of all stripes, sporting different ages, genders, and accents, and speak various languages as they try to keep scammers engaged long enough to learn something useful.

The company says its fleet of agents has so far wasted 17 years of scammers’ time across 2.5 million conversations. More importantly for Apate’s customer base of banks, telecom companies, government agencies, and utilities, the undercover agents try to get scammers to reveal things about themselves that are usually learned only after a victim has been scammed: bank accounts, crypto wallets, phone numbers, malicious websites, the brands they’re impersonating, and other details about the scams they’re running.

Apate, one of the finalists at this year’s Startup Battlefield 200 at TechCrunch Disrupt, then feeds that information to its customers, who use it to inform their anti-fraud measures and initiatives.

…It’s a curious evolution of scam-baiting, but it’s not so surprising given how much AI has empowered scammers and hackers. The FBI received more than 22,000 complaints of AI-related crimes in 2025, which resulted in about $893m in losses. More than $632m of that came from investment scams, in which the FBI says fraudsters use AI to run conversations, and deepfake the voices and appearances of celebrities, executives, and trusted figures.

«

Naturally the impulse for this came from someone who got a spam call, and wondered about automating the stringing along of the spammer.
unique link to this extract

Passkeys are not a trap • Scott Helme

Scott Helme:

»

A post called “Passkeys are a trap. Do not use them” has been doing the rounds over the last few days, making it pretty high on Hacker News, and I’ve had it sent to me many times with an ‘is this true?’ kind of vibe. It’s written for “non-technical citizens of the web”, and the headline advice is to stop using passkeys and go back to TOTP codes and passwords.

The post makes what appears to be one central claim: Passkeys support something called attestation, which lets a website ask for cryptographic proof of what made the passkey.

The author calls this a “hidden dial” and argues that sites will slowly turn it up, until you’re only allowed to log in with approved software on an approved operating system, with no modifications, no LineageOS and no sharing your Netflix password. Throw in uBlock Origin, the FIDO Alliance membership list and the UK’s image-scanning proposals, and the conclusion is that passkeys are “not designed to prioritize your interests”. 😱

It’s a compelling story. It just doesn’t match how any of this actually works.

The passkeys most people use are synced passkeys, stored in iCloud Keychain, Google Password Manager, 1Password, Bitwarden or whatever other software of your choosing. These passkeys don’t give websites an attestation statement at all, and though a site can ask, what comes back is none. I know this because I wrote an opensource passkeys library and made it available to everyone.

If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that? Besides, the guidance for consumer sites has been to not even request attestation for years now.

The post describes attestation as proving “that an approved passkey manager, operating system, and firmware are in use” which is simply not true.

When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.

«

I had looked at the linked article and thought it seemed off. Helme points out that it’s a classic case of “escalate to certainty from unlikely possibility” – a tactic beloved of conspiracy theorists.
unique link to this extract

The AI math isn’t mathing as infrastructure spending forecast to outstrip expected revenue • The Register

Dan Robinson:

»

AI services are unlikely to deliver enough revenue to cover the expected capital expenditure going into IT infrastructure between now and 2030, and it looks like neocloud operators will largely bow out or be bought out.

This is the conclusion from Gartner, which has added up the anticipated investments in AI datacenters over the next several years, estimated the revenue that can be expected from AI-driven applications over the same period, and found the numbers come up short.

Gartner’s data comes from a report, “Prepare for AI Market Consolidation: Capital Write-Downs Could Exceed $4 Trillion by 2032“, which concludes that AI will not generate enough sales to profitably cover all of the planned AI capital spending before 2032 at the earliest. But forecasts typically focus on the end of the decade, so it ran the numbers for 2030 as well.

“In 2026, AI providers are expected to spend nearly $1 trillion on AI infrastructure, and are forecast to invest an additional $6 trillion between 2027 and 2030,” said Gartner senior director analyst Will Sommer.
“However, our research indicates that enterprise and consumer AI revenue will be insufficient to support profitable returns on all planned AI capital expenditures during this period.”

Assuming a 12% return on invested capital (ROIC), which many companies are said to regard as the bar for acceptability, Gartner estimates AI datacenter operators would need to generate a total of $8.5 trillion in revenue to cover capital spending and financing costs while achieving that return.

Unfortunately, it forecasts that the total enterprise and consumer AI revenue that can be attributed to AI datacenters during this period will add up to no more than $3.6 trillion.

«

The only question feels like whether the realisation will be slow or sudden. If it’s the latter, that would be really bad.
unique link to this extract

Severe drought declared in parts of southern England • Sky News

»

Severe drought has been declared in parts of Cornwall, Devon, Dorset, Somerset, East Sussex and West Sussex, the government has said.

The south of England had its driest April to September in over a century, according to the government’s environmental department, Defra. Water firms will be told to monitor reservoir and river levels daily, as well as carry out tougher water quality checks due to lower dilution of sewage.

The announcement has been prompted by concerns over two reservoirs in particular. Ardingly in West Sussex, which serves about 95,000 properties, is only at 19% capacity, while Wimbleball in Somerset, which serves around 300,000 properties, is at 16% capacity. Normal capacity for this time of year should be about 75%.

South East Water and South West Water have been given permission to cut the amount of water the reservoirs send to nearby rivers by millions of litres per day. Defra said there were also concerns about levels in the Drift, Stithians, Tottiford and Venford reservoirs, which serve just over 100,000 households in Devon and Cornwall.

Yorkshire also entered drought status last week, joining all of central, southern and eastern England.

However, the south’s upgrade to “severe drought” is the most urgent designation possible.

It is declared when evidence shows drought is causing – or will soon cause – serious harm, and that emergency action is needed.

«

The emergency action will principally consist of making sure businesses aren’t taking more water than they should. But that won’t make it rain, and won’t create the new reservoirs that have been needed for decades.
unique link to this extract

BBC News channel launches on YouTube for viewers in UK and US • BBC News

Katie Razzall and Paul Glynn:

»

The BBC News channel has been made available to stream live on YouTube for viewers in the UK and USA.

The trial, which began on Thursday, external, has been described by BBC bosses as “a significant step” in expanding access to “trusted, impartial journalism in more places people use every day”.

The move is an expansion of what the BBC has already done in other countries, with the news channel also available to YouTube viewers in Australia, Kenya, Nigeria, and Poland.

Broadening access to the service forms part of the BBC’s wider strategy to reach digitally-native new and younger audiences.

The channel offers rolling coverage of international and domestic news, as well as breaking news and the latest developments in the worlds of politics, business, technology, culture and sport.

The BBC’s YouTube strategy is widely seen a response to the increasing fragmentation of audiences.

The guarantees that viewers sit down and turn on their favourite channel – whatever is on it – are long gone. Now, their TV sets take them into a world of infinite choice and the BBC (along with the UK’s other public service broadcasters) knows it needs to go to where audiences are – as well as trying to entice them to its own platforms.

Thursday’s development is part of the specific drive by the BBC to take its trusted news to audiences who aren’t tuning in to the news channel directly or via the iPlayer.

«

Fingers crossed it can find an audience amid the algorithm.
unique link to this extract

Secret documents reveal donors behind $330m for Trump’s ballroom • The Washington Post

Jonathan O’Connell, Sarah Blaskey and Aaron Schaffer:

»

A list obtained by The Washington Post reveals all the major donors to President Donald Trump’s White House ballroom project, including previously undisclosed contributors who have benefited from regulatory decisions, government contracts and, in one case, a pardon for a family member.

Tech giants Nvidia and Apple each committed $25m, the top contribution amount, the list shows. The Adelson family, one of the GOP’s largest donor dynasties, committed that sum as well, as did billionaire Charles Ergen, co-founder and chairman of telecommunications company Dish Network.

Absent from the list is Trump himself, who has said that he is helping to pay for the project. “It’s being paid for a hundred% by me and some friends of mine,” he said last year, days after demolition began on the old East Wing.

The White House publicly identified 37 people, companies and foundations as donors last October, without revealing the amount of their individual gifts.

The list obtained by The Post, an internal spreadsheet used to track contributions for the fundraising effort, contains the source, date and amount of all 67 donations above $10,000 recorded as of late last month. It shows a total of $333m from private donors, aligning with the administration’s public statements.

…the vast majority of the funds raised came from companies and wealthy individuals with interests before the federal government.

«

A byword for corruption. Utterly incredible. And shaming for Apple to be among them.
unique link to this extract

Greg Joswiak says Apple isn’t focused on making AI for ‘lunatic fringe’ • MacRumors

Joe Rossignol:

»

In an interview with TIME‘s Andrew R. Chow, Apple’s marketing chief Greg Joswiak said Apple Intelligence is meant for “everyday people” as opposed to the “lunatic fringe.”

The full sentence: “In the midst of a populist AI backlash, they contend that they are building a modest but personalized and privacy-preserving form of AI that will actually help ordinary people as opposed to merely dazzling Silicon Valley’s ‘lunatic fringe,’ as Greg Joswiak, senior vice president of worldwide marketing, puts it.”

Joswiak apparently believes Apple Intelligence is not for “die-hard AI believers chasing superintelligence,” as Chow described it.

“We love them, and they can use it too, but that’s not our target,” said Joswiak. “It’s how to make it better for everyday people.”

«

Except that’s the only time Joswiak is quoted using that phrase. He doesn’t use it anywhere else in any quoted sentence, which makes me suspicious. Joswiak is, like any well-practised Apple executive (and boy is he practised), very careful with his words. I wonder if we’re going to see a transcript of this, because I just don’t see him calling enthusiastic buyers of Mac minis the “lunatic fringe”.

(The full article is pretty dull, with no surprises if you’ve read anything about Apple in the past five years.)
unique link to this extract

He crafted a crypto law for Trump—as his company got millions from a crypto giant • WSJ

Sam Kessler:

»

Lawmakers and executives crowded into the East Room of the White House in July 2025 to watch President Trump sign the Genius Act, a landmark crypto bill that set rules for selling stablecoins pegged to the US dollar.

From a podium, Trump rattled off thank-yous to the law’s architects. “Where’s Bo Hines?” he asked. The president’s 29-year-old crypto adviser rose from the front row to applause. 

What most people in the room didn’t know: While Hines was leading the White House’s push to pass the Genius Act, Tether—the company with the most at stake in the legislation—was steering millions of dollars to a business he co-owned, according to messages, internal documents and payment records reviewed by The Wall Street Journal.

Hines exchanged Signal messages showing that while he was in the White House, he took part in a group chat with his company partners, where he discussed legislative developments and relayed Genius Act talking points as his partners were communicating with Tether’s chief executive.

Once the bill was signed, Tether hired him—to run its US operations.

Hines had started Nxum, a small consulting firm, with his father and another partner around 2022. Each owned one-third. He stepped back from day-to-day management of the company when he joined the administration in early 2025 but kept his ownership stake, his government ethics disclosures show.

Weeks after Hines began working on stablecoin legislation inside the White House, Nxum, which had only dabbled in crypto until that point, started pursuing business with Tether, the world’s largest stablecoin issuer.

…Since the deal was signed, Nxum has earned $6.3 million from the arrangement, according to the documents, messages and blockchain records, plus a person involved in the deal.

The payments began while Hines was working to finalize the Genius Act—legislation that would dictate Tether’s ability to operate in the US.

«

The levels of corruption are just off the scale. Amazing that this law got through the sclerotic American legislature, and then nobody noticed Hines having incredible conflicts of interest? These are not serious people.
unique link to this extract

Errata, corrigenda and ai no corrida: none notified

Ever wondered how those beautiful cars in Cuba keep running despite their parts being embargoed or discontinued? CC-licensed photo by gr8what on Flickr.

You can sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 10 links for you. Libre. I’m @charlesarthur on Twitter. On Threads: charles_arthur. On Mastodon: https://newsie.social/@charlesarthur. On Bluesky: @charlesarthur.bsky.social. Observations and links welcome.

Monopoly roundup: AI cockroaches scurry out from under Nvidia, the most valuable company in the world • The Big Newsletter

Matt Stoller on the withdrawn IPO of a company called Firmus. Never heard of it? Read on:

»

What makes this situation more than a run of the mill scam is the involvement of Nvidia in Firmus and its criminal co-founder. Why would Nvidia get in bed with a crook? Well, Firmus is in an important industry segment that generates demand for Nvidia chips. Firmus is a “neocloud,” which are basically racks of servers funded by venture capitalists and Nvidia to buy chips and rent out computing power. Think of a neocloud as a way to keep debt off the books of the big AI firms. Neoclouds are a corporate shell containing real estate, chips, and financing. Often there are multiple layers of investors, phantom contracts or insider self-dealing, all wrapped in a narrative that they are engaged in “advanced AI” deployment.

This move has tended to work because of the involvement of the most prestigious players in AI. When Nvidia (or Google or Anthropic) backstops or does business with a neocloud, investors think there must be something there. So the neocloud’s valuation goes up a lot. Then that neocloud raises more money at a high valuation, announces more data centers, and orders more chips. That’s more profits for Nvidia, more investments, and so on and so forth.

These investments take place in the private market, with hedge funds and insiders thinking they are getting in at a low valuation. They often don’t even care if there’s a good business model here, since they think someone else will be left holding the bag. The business model never really made much sense, with Firmus starting as a bitcoin miner, before pivoting to AI. But it didn’t matter, because Firmus was about to sell shares to the last set of investors out there – you and me in the public markets. Fortunately, it looks like the public market participants have wisened up, at least in this case.

Firmus, however, is not the only scam in the AI space. Many such neoclouds started as bitcoin miners before jumping to the AI boom, often funded by a prestigious AI firm like Nvidia. And that suggests there’s something systemic going on.

Here are a few other neocloud or adjacent plays: There’s TeraWulf, which has big leasing deals with Anthropic and Google, and whose backers have been allegedly caught engaged in market manipulation. Google bankrolled the company’s shift from bitcoin mining to AI data center. Here’s Grizzly Research:

»

Our research uncovers that TeraWulf’s third-largest shareholder is an entity controlled by the wife of John O’Rourke, the disgraced CEO of Riot Blockchain, who was charged for his part of a $27m “Lucrative Market Manipulation Schemes” by the SEC.

«

«

It gets harder and harder to think that this AI financing stuff is on the up and up.
unique link to this extract

Fridge hack costing millions and sparking fires stemmed from poor security • Ars Technica

Dan Goodin:

»

Multiple security advisories and public research reports show that all three of the controller models reportedly hacked in the incident—sold by Danfoss of Denmark and Dixell and its parent company Copeland in the US—contained critical vulnerabilities that allow attackers to remotely log in to the devices with the same system rights as administrators.

Until recently, Danfoss controllers, for instance, used a credential that changes each day. The password is generated by the publicly available firmware based on the date. A hacker who takes the time to analyze the code can do the same thing on any device that hasn’t received a recent update. Daily passwords are identical across models located in hundreds or thousands of stores.

A raft of critical vulnerabilities fixed in the past few months in Copeland/Dixel controllers also give similar remote access.

Besides running controllers with outdated firmware, the affected stores likely also failed to put the devices behind a VPN and create a restricted list of IP addresses allowed to log in. These protections are standard but often not followed. In this case, that failure enabled a mass hack that likely cost tens or hundreds of millions of euros. Spain, Portugal, Poland, Germany, and Belgium were also reportedly affected.

“Two things would have changed the outcome,” researchers at Pen Test Partners said Wednesday. “Cyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor’s own connection, change known and default credentials, and patch to a current release.”

Researchers from security firm Claroty warned of the threat of ignoring these common-sense steps last October. The US Cybersecurity and Infrastructure Security Agency did the same in February.

…So far, the party behind the attack has remained silent. That raises the possibility that the motive was vandalism on a mass scale. Another possibility is a nation-state or other international actor aiming to create a continent-wide disruption.

«

The silence might seem odd, but you’d get the same whether it was script kiddies (who might celebrate to each other, but not publicly) or nation state hackers (who might raise an eyebrow and plan the next attack).
unique link to this extract

OpenAI accuses employee who left for Apple of leaking plans for unreleased device • Reuters via The Guardian

»

An OpenAI employee who left the ChatGPT maker for Apple sent more than 100 files about an unreleased product to a personal account and later made a presentation ​about the unreleased product to senior Apple leadership, a new filing in the lawsuit between OpenAI and Apple alleges.

In the filing in US federal court in San Jose, California, OpenAI alleged that the presentation happened months ago and that Apple is now making AI products of its own, citing the release of Apple’s HomeView product this week.

“OpenAI ​is very concerned that its trade secret and confidential information is now circulating inside Apple, where Apple engineers can shape Apple’s upcoming products based on OpenAI’s confidential and innovative work,” OpenAI said in its filing.

The two companies were due to face off in court on Wednesday in an ongoing trade secrets lawsuit, but the new allegation delayed the showdown. OpenAI said it may file a countersuit based on the new claim.

Apple said that it has policies and procedures in place to ensure new employees do not use confidential information from previous employers and that it has found no evidence to support OpenAI’s allegations.

The document, filed on Tuesday, is part of a trade secret dispute filed by Apple earlier this year against OpenAI. The iPhone maker alleged its own employees left and took confidential information to OpenAI’s hardware ​division. OpenAI has denied those allegations.

…The case ​is likely to go to trial in October 2027, though OpenAI has said in court filings that it could be ready for trial as soon as June 2027.

«

The claim is a bit weird, and the HomeView claim is nonsense – that’s been in the works at Apple for (too many) years – but that final date shows you how the law just isn’t able to keep up with the rapid advance of technology.
unique link to this extract

Microsoft and Japan took down a cybercrime network behind over a billion scam messages • The Verge

Stevie Bonifield:

»

We’ve all gotten a scam text about a nonexistent parking ticket or a fake package delivery, but hopefully you’ll start seeing fewer of them. Microsoft says it helped dismantle a marketplace for scammers sending phishing messages like those around the world. Through an investigation with Japan’s National Police Agency, it tracked scam activity back to a marketplace called YAM Store and a pair of phishing kits, CoGUI and Iron Man:

Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone. These messages have been used to target consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries, generating tens of millions of dollars for their operators.

According to Microsoft’s report, scammers could buy stolen or fraudulent Microsoft and Google accounts on YAM Store and use the phishing kits to send scam messages. Microsoft says YAM Store also hijacked real organizations’ expired web domains and created websites for nonexistent organizations, which it used to get Microsoft accounts it could resell.

The Iron Man platform was also offering over 2,300 templates scammers could use to impersonate organizations like banks and police departments. Microsoft says it disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains being used for impersonation and fraud.

«

unique link to this extract

Why Americans stopped falling in love • Derek Thompson

Derek Thompson:

»

Why are so many Americans not getting married—or not even dating, in the first place?

The share of 40-year-olds who have never been hitched has quadrupled since 1980, as Americans get married later, or not at all. (US Census data shows that 80% of women born in the 1940s were married by age 25, compared to 30% of women born in the 1990s.)

It’s not just marriage that’s declining but rather all forms of cohabitation. An analysis by John Burn-Murdoch [of the FT] found that “coupling” has declined steadily in both the UK and the US, especially for those without a college degree. The declining popularity of dating apps suggests that these trends are likely to continue.

I care about the decline of coupling and marriage not because I consider myself a strict evangelist of matrimony—I think people should do what they can to enjoy themselves without hurting others—but rather because I think it bears on two of the most important questions about the future: (1) How many people exist, and (2) how happy are they? The relationship between romance and births is practically linear. Since 1990, Burn-Murdoch has shown, the decline of births traces the decline of relationship formation across many countries. Fewer relationships mean fewer people, and accelerating population declines around the world are, somewhat like climate change, a slowly accumulating phenomenon that will almost certainly shape the future of economics, technology, and the texture of human existence.

Then, there’s the mushy yet momentous question of whether people actually enjoy their existence. Self-reported happiness is declining in the west, and particularly in the U.S. Reviewing several decades of General Social Survey data, the economist Sam Peltzman came to the conclusion that “most of the overall downturn [in life satisfaction] is attributable to decline in marriage post-2000.” Reviewing Peltzman’s work, The Atlantic’s Olga Khazan provided some useful context:

»

One paper alone might be easy enough to dismiss, but this is a fairly consistent finding dating back decades in social-science research: Married people are happier. Period.

«

«

There follows an interview with Daniel Cox, author of “Generation Uncoupled”, which contains this fascinating (one of many) tidbit:

»

Young adults are entering adulthood with a social deficit. As a result, their understanding of the world is shaped less by lived experiences and more by what they see online. And social media not only offers a warped view of human behavior, but it also excels at feeding our anxiety and fears.

«

unique link to this extract

Pre-ordered the new Apple TV 4K? Here are five reasons you should cancel ASAP • Macworld

Mahmoud Itani:

»

At its “Welcome Home” experience, Apple today introduced the all-new HomeView hub, along with the HomePod mini 2 and Apple TV 4K 4. These devices mark Siri AI’s official smart home expansion, bringing its world knowledge and personal context to big screens and smart speakers around the house.

While you may be tempted to rush over to Apple’s website and pre-order a $299 4th-gen Apple TV 4K before the first batch sells out, it may be worth taking a moment to consider if that’s really the right decision. Instead relax, slow down, and read this list of five reasons why I’m not upgrading to the brand-new Apple TV 4K, and why I don’t think you should either.

«

Too expensive, does things you can get already (including the new Siri), you can buy the new remote separately, doesn’t use the CPU’s potential, too bloody expensive.

For all the buildup to this “home” event of Apple’s, any rational examination shows it to be rubbish. (Thanks Joe S for the link.)
unique link to this extract

Teach My Little Sister How To Drive – v1.2.9 Update and a Development Status Update • Steam News

This game, on Steam, is AI-driven, with the “sister” character’s responses produced by ChatGPT:

»

Over the past month, the number of demo players has grown more than twentyfold. Thank you so much for giving our game far more attention than we ever expected.

This growth has also increased our operating costs considerably.

We are currently spending over $1,000 per day on AI services for the demo.

For the paid release, we plan to account for expected AI usage in the game’s price. Players will not be charged separately for their individual AI token usage after purchasing the game.

This isn’t because each player is particularly expensive to support. The total cost has increased because so many people are playing, and we have taken out a bank loan to help keep the demo running.

We want to continue operating the demo and would love for more people to enjoy it. However, we are a small team of four, and financial pressure may mean we have to close the demo earlier than expected before the full release. We have not made that decision at this time.

«

Pretty impressive to be burning $1,000 per day, $30,000 per month, $360,000 per year, on a game before you’ve got any sort of business model for it. That demo shows that AI can produce a tolerable game, and ruin its makers.
unique link to this extract

Electric energy security꞉ how EVs are reducing oil import vulnerabilities • Ember

Euan Graham:

»

Many countries with rising EV sales are simultaneously developing new manufacturing capacity and growing their domestic electric vehicle industries. The rise in electric vehicle sales in the EU this year has been met in large part by new affordable models from European manufacturers. New models by Renault, Volkswagen and Skoda were the best-selling electric cars in Europe in July.

In Asia, domestic manufacturers are becoming major players in Viet Nam and India. VinFast already produced Viet Nam’s most popular car in 2025 and has expanded its production operations overseas opening new factories in India and Indonesia last year. Meanwhile, in the first half of 2026, domestic OEMs Tata and Mahindra made up over 60% of India’s EV sales.

In Latin America, Brazil is cementing its position as a regional manufacturing hub with the opening of BYD’s plant in 2025, with production capacity expected to be increased to 300,000 vehicles annually. New local content requirements are successfully driving this investment. Mexico announced the launch of domestic manufacturer Olinia this year, with production of its small car EV slated to begin in 2027.

As countries adjust to a prolonged disruption to oil and gas supplies, transport electrification is providing a path to reduce oil import vulnerability. In the six months since the Hormuz energy crisis, electric car fleets in oil-importing countries are estimated to have displaced 200m barrels of crude oil, with a value of $20 billion. Fully electric cars (BEVs) are responsible for the largest share of this figure ($16.5bn), with the rest coming from PHEVs. This is in part because PHEVs are also powered by a combustion engine and there is real-world evidence that drivers end up relying on it more than manufacturers initially claim.

In September, oil prices once again climbed to over $100 per barrel for the first sustained period since May, meaning these figures are likely to rise over the rest of the year. Since the start of the year, the daily closing price of Brent crude has exceeded $100 more than 60 times, having last done so in 2022 following Russia’s invasion of Ukraine. This is compounded by an even more acute supply crisis in diesel and other refined products, where impacts on global oil flows have combined with attacks on refineries around the world. Globally, diesel use is concentrated in the trucking sector, but for certain markets such as Europe this has a considerable impact on car drivers too.

«

unique link to this extract

How do Cubans maintain and replace their 1950s American car parts without access to American manufacturers? • Quora

Q: How do Cubans maintain and replace their 1950s American car parts without access to American manufacturers?:

»

Pop the hood of a 1957 Chevy in Havana, and you probably won’t find an American V8. You’ll find a Hyundai diesel engine, a Soviet transmission, and parts made from melted shampoo bottles.

Since the US imposed its trade embargo in the early 1960s, the supply of original American parts for Cuba’s thousands of Detroit-built cars vanished. To keep these vehicles running for over six decades, Cuban mechanics have become master engineers and scavengers out of pure necessity. The survival of the Cuban classic car relies on three main strategies: extreme engine swapping, hand-fabricating parts from scratch, and an underground supply chain.

Original engines broke down decades ago, and those that survived guzzled gas that most Cubans couldn’t afford. The solution was the engine swap. During the Cold War, mechanics shoehorned in four-cylinder motors from imported Soviet Ladas and Volgas. Today, the holy grail is a modern diesel engine—often a Hyundai, Mitsubishi, or Toyota—stripped from a van or boat. Adapting these foreign engines to fit 1950s American chassis requires custom-welded motor mounts, modified driveshafts, and completely rewired electronics. The resulting vehicle is an American shell powered by a Japanese heart with Russian suspension.

When a specific part fails and cannot be swapped out, Cuban mechanics—often called magos (magicians)—simply make a new one from scratch. This culture of improvised repair is known as making an invento. Machinists cast their own pistons using scrap aluminum melted down in backyard forges. Brake pads are cut by hand from industrial friction material. If a rubber suspension bushing rots away, a mechanic might melt down scrap plastic or carve a replacement out of a heavy-duty forklift tire. Body panels that rust out in the salty Caribbean air are sculpted back into shape using fiberglass or scrap sheet metal.

For the specialized parts that absolutely cannot be fabricated—like modern fuel injectors, timing belts, or specialized bearings—Cubans rely on an informal import network. Relatives and specialized couriers known as mulas (mules) travel to Miami, Mexico, or Panama, buy the necessary car parts, and pack them into their checked luggage.

«

Necessity as the mother of invention still going strong. Though the fuel blockade of Cuba has been going on for some time; those cars might not be going anywhere at all.
unique link to this extract

Marquita Maytag: the shrew of Kathmandu • Association for Diplomatic Studies & Training

»

Nepal is a small mountainous country in South Asia, bordered by India and the Tibetan autonomous region of China, which has had friendly relations with the U.S. ever since they were established in 1945. However, at one time these relations were nearly threatened by the actions of “an absolute shrew” of an ambassador. Marquita Maytag was a political appointee who held the position for only a short period of time, May 1976 – April 1977, but she quickly garnered a bad reputation. David Fischer, at that time a Political Officer in the U.S. Embassy in Kathmandu, recalls some of her more outrageous antics in an interview with Robert Pasturino on May 20, 1998.

…One night… all of us in the Embassy had movie projectors, and one of the ways which we entertained, because there were no movie theatres in Kathmandu, was to show modern American movies. We could get any political leader in the country to come out to our houses to see an American movie.

It was a Friday night, and I was sitting at home at eight o’clock and the doorbell rang. There on my doorstep was the Prime Minister of Nepal. He said, “Mr. Fischer, are you showing a movie tonight?”

I said, “No, I’m not, Why do you ask?”

He said, “I thought I was invited to a movie tonight, and I thought it was at the Ambassador’s residence but I went down there and all I could find was that she was there with two airline pilots and three Tibetan whores. I counted around, and I realized there was one more woman than a man and I was going to have to end up with her. So I was hoping you were showing a movie tonight.”

«

Based on this, Kimberly Guilfoyle might feel hard done by. (Maytag, appointed by Gerald Ford’s administration, was quickly dumped by Jimmy Carter’s administration, but not before further shenanigans, described in the interview transcript.) The US has always had an odd approach to appointing ambassadors.
unique link to this extract

Errata, corrigenda and ai no corrida: none notified

A claim by OpenAI to have discovered a mathematically faster Fast Fourier Transform is far less impressive than it seems, a mathematician explains. CC-licensed photo by fotodiagramas on Flickr.

You can sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 9 links for you. Summed up. I’m @charlesarthur on Twitter. On Threads: charles_arthur. On Mastodon: https://newsie.social/@charlesarthur. On Bluesky: @charlesarthur.bsky.social. Observations and links welcome.

They war-gamed dimming the Sun. It went even worse than you think • WIRED via Ars Technica

Karl Mathiesen:

»

When it comes to deciding the fate of the planet, Colleen Golja always thought science and reason would have a seat at the table. That was until one morning last September in London, when the climate researcher took part in the first in a series of war games. The goal: to prevent an uncontrolled global race to develop a technology aimed at cooling the planet but that comes with vast, unknown risks that could reshape life on Earth.

“I thought that would be such an easy thing. Like, we can all agree to do ethical research and make sure it’s for the better of all humans,” she told WIRED. “And boy, was I wrong.”

The simulation, titled Exploring Geopolitical Tipping Points and Climate Cooling Strategies, saw a couple dozen foreign-relations experts, scientists, military personnel, and former government officials from across the world convene in a meeting room at Queen Mary University of London. After making introductions over coffee and little yogurts, they sat at tables arranged in a square with the name of the country or organization each person was playing: national governments, climate NGOs and nonprofits, indigenous groups, and tech companies. Golja was assigned to provide technical advice to help participants make scientifically literate decisions.

…As in real life, no one knew all the facts, and players had to respond to events that were bringing the world closer to a full-scale attempt at deploying solar geoengineering tech, even when they may not have a full picture of what had truly occurred—or what any of the others were up to.

The first session set the tone. Distrust and disinformation dominated. As participants discussed rules governing outdoor experiments in an attempt to agree an international deal, players representing both the US and China told the group they could not sign a deal that constrained their pursuit of research considered to be in their “national interest.” Nor could they accept a deal that would see their superpower rival taking the lead technologically. Speaking to WIRED, Jeffrey Nielsen, a major in the US Army who played the role of a US national security attaché, summarized the position as “worse than no deal at all is any deal that favors China.”

Tensions escalated when the team running the simulation handed the Russian delegates an “intelligence report” indicating they had found a plane near the Bering Strait believed to be involved in a US geoengineering research program. The US team—which was indeed flying research missions—accused Russia of disinformation.

Meanwhile, the US became convinced China was also conducting research and developing its own program. Beijing’s representatives had tried to insert language into a mooted deal that would ensure no retroactive punishment for past experiments. Then, China approached a player representing SpaceX to float the idea of a technology-sharing program. In a private discussion away from the group, the SpaceX player immediately reported the Chinese approach to the US team. The US demanded an international investigation. The finger-pointing continued, and countries abandoned the talks.

«

Fascinating read about how national tensions and mutual suspicions would derail attempts to do the right thing.
unique link to this extract

I tried out Apple’s HomeView smart display • The Verge

Jennifer Pattison Tuohy:

»

The first thing that struck me about the HomeView was its size. It’s much smaller than I expected, and the screen almost entirely hides the small aluminum base that acts as a speaker. The Liquid Retina display is bright and responsive to touch, and it displays photos and the HomeView “faces” brilliantly.

You can swipe to change faces easily and choose from dozens of options, most of which resemble Apple Watch faces. The display feels like a giant Apple Watch paired with the functionality of an iPhone and the room to breathe of an iPad.

Apple offers both a wall-mounted and tabletop version of the HomeView, and the wall-mounted model looks like it will make a great smart home controller.

A dedicated Home Widget face pulls devices from the Apple Home app; I could walk up and tap to control a thermostat and door lock and activate a scene, or I could swipe right to get a live view of HomeKit Secure Video cameras and tap into one to access nearby accessories, such as opening the garage door. When I tried to unlock a door, it stopped me, asking me to authenticate with my face or iPhone.

The Home Widget is a skin of the Home app, so it offers all the controls you have with that app on your iPhone, just on a bigger screen designed for walk-up-and-tap interaction.

There’s a lot of swiping on the HomeView. Swipe left to get to new home faces, tap widgets to access deeper controls in apps, then swipe right for more features. You swipe up to return to the main screen, then up again to access the onboard apps, which automatically populate from your phone. Swiping down from the top of the screen brings up a control center, just like on an iPhone. You can even enable the 12MP camera from here, giving you a de facto mirror.

«

Basically this $299 (£299 in the UK!) device is a big Apple Watch: it does very little on its own. Mostly it’s handing off from the phone (so an Apple Watch isn’t enough to unlock it). It can’t natively play Apple TV content (and anyway that would look weird on the 4:3 display). It needs a USB-C power source (no batteries), so good luck not tangling with the power cord in your kitchen.

Honestly, a great product for 2016. Today? Multiple companies have tried home products with screens, and they’ve all got nowhere.

Also released on Tuesday: an Apple TV – the set-top box – for $300. You can buy a proper TV for that amount in the US.
unique link to this extract

How many shots are in the average movie today? • Stephen Follows

Stephen Follows:

»

Last night I had the absolute pleasure of watching American Graffiti (1973) at the ActOne Cinema in Acton, and then listening to Mark Kermode quiz Walter Murch about how he built its sound.

Murch edited Apocalypse Now and The English Patient, and he wrote In the Blink of an Eye, which is probably the best book there is on film editing. (On American Graffiti he did the sound, and the picture was cut by Verna Fields and Marcia Lucas).

After the session, the three of us chatted, and as Mark had read an advance copy of my article below, he asked Walter to guess how many shots were in American Graffiti. Walter’s guess was 952. Was he right?

Let’s go down the rabbit hole of editing and find out!

“How many shots are there in the average movie?” is a very common question I get asked. So today I’m sharing the results of my studies into the shot counts of 8,770 feature films released between 1930 and 2025. By the way, some people might say ‘shots’ others may say ‘cuts’. It’s the same thing, in that a sequence with six shots has five cuts between them. Everyone seems to (in some cases strongly) prefer one over another, but whatever we call them, we’re describing the same thing.

How many shots does a typical film have now?

The most commonly quoted industry rule of thumb comes from editor Vashi Nedomansky, who says the average film has around 1,250 shots, and blockbusters often have more than 3,000. His 1,250 is actually a little low for today’s releases, but his 3,000 is about right for the biggest of them.

The typical film released between 2017 and 2025 has 1,535 shots. That’s the median (i.e., the film in the middle of the pack), whereas the mean is slightly higher (1,603) because a handful of films with very high shot counts pull up the average.

At a typical length of 111 minutes, that works out to roughly one new shot every four seconds once we take the end credits off.

There’s a wide spread around that, as a tenth of recent films have fewer than 770 shots and a tenth have more than 2,460. Put another way, four in five recent films have more than 1,000 shots, and one in four has more than 2,000.

«

No doubt one of the films that pulls the number higher is Taken 3, which famously uses 14 cuts in six seconds for Liam Neeson looping over a wire fence.
unique link to this extract

Revolut data breach exposes customers’ passport copies and full transaction histories to hackers • Cyber Security News

Guru Baran:

»

Revolut has disclosed a data-security incident in which sensitive customer information was released after the financial technology company received a fraudulent request that appeared to originate from a legitimate government agency. Here is the detailed breach report.

The incident reportedly exposed highly sensitive Know Your Customer (KYC) documentation and detailed financial records belonging to a limited number of users, including passport or driver’s license copies, identity-verification selfies, account statements, and complete transaction histories that included Bitcoin-related activity.

According to Revolut’s explanation, the disclosure did not result from a compromise of its core systems, mobile application, or customer accounts. Instead, the company said it was targeted through a sophisticated impersonation operation involving an unauthorized email account operating under an official government agency’s email domain.

Because the message carried valid domain-authentication credentials, Revolut believed it was handling an authentic legal or government information request and fulfilled it.

The response provided extensive information. It included customers’ full names, dates of birth, occupations, postal addresses, email addresses, and telephone numbers.

The exposed document and verification data reportedly included copies of identity documents, such as passports and driving licenses, along with facial-verification images submitted during onboarding.

«

This happened in September. Today on X there was a post from someone who said they had been attacked in their home and had their crypto stolen (via the “beat him up until he gives up his password” method of cracking passwords). He says $800,000 worth of crypto stolen. Big if true. And a warning to anyone who was with Revolut.
unique link to this extract

OpenAI employee arrested after recording device found in office • The Guardian

Maya Yang:

»

OpenAI said it has found a hidden recording device in one of its offices and has referred the matter to the FBI. One of its employees has been arrested.

In a statement on Tuesday, the San Francisco-based AI company said it discovered the “sophisticated recording device” and used one of its “models to understand the device and where it had come from”.

The company has identified “that a specific employee had planted it a few days earlier”, adding: “At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.”

The employee in question has been arrested, according to the company. OpenAI did not disclose details on how its models were used to identify the employee or which office the device was discovered in.

OpenAI said that it is “grateful to the agents and prosecutors who moved quickly to make an arrest” and the investigation is continuing.

The company added: “We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.”

«

Well of course it used its software to figure out what the device was. (Even if it didn’t.) What’s very weird here is the motive, which we have to hope will come out in the fullness of time.
unique link to this extract

AI coding agents generate more code, but not more software • Ars Technica

Kyle Orland:

»

Anyone who has even tangentially associated with computer programming knows that modern AI coding assistants and agents can be incredibly efficient at generating huge amounts of functional code. But coders making use of those tools also know better than to trust the accuracy of that code, meaning substantial effort needs to be spent reviewing any AI-generated output.

A recent study of actual coding practices across hundreds of firms finds that human code review forms a significant “bottleneck” for the overall efficiency of AI coding tools, resulting in “little evidence that firms increase software output or reduce employment” by using them. Any efficiency increased during the actual coding phase, the study authors find, is “absorbed by downstream constraints in the production process”; as “the code review process significantly increases in length, pull requests are more likely to require revisions, and reviewers leave more comments.”

To come to these conclusions, Harvard University researchers Fiona Chen and James Stratton made use of aggregated analytics data from Jellyfish, which measures the granular output of engineering teams. That data encompasses 300 million individual “work events” (e.g., commits and pull requests) and issue management software data across more than 700,000 employees at over 700 relevant software development firms from 2021 through March of 2026.

«

Not surprising; there’s a general principle that more code means more bugs, and it’s not certain that coding agents aren’t as vulnerable as humans to errors, given that they’re trained on code written by humans.
unique link to this extract

Apple has far-reaching plans to block hundreds of programmatic data companies from iOS • AdExchanger

James Hercher:

»

At the end of September, AdExchanger reported that Apple’s iOS 27 update [then two weeks ago] quietly blocked a handful of programmatic data players – including The Trade Desk and its Unified ID 2.0 initiative, LiveRamp, ID5, Permutive and Audigent – from collecting data or serving ads on Safari. (They were also blocked on other mobile browsers [on iOS], since browsers must use WebKit to launch on Apple devices.)

Now, according to two sources with direct knowledge of the WebKit updates, the initial list has been scrapped in favour of an expansive library of hundreds of CDPs, ad tech and mar tech companies, data sellers and ID graph operators.

These companies will exist in a purgatorial state of potential exclusion from advertising to or accessing people on Apple phones and computers, according to the sources. And only Apple seems to know what will get an ad tech vendor blocked or unblocked.

The full list of potentially blocked companies exists in a private GitHub repo, so it cannot be observed without access. One person with access to the full list did briefly allow AdExchanger to observe the list and read names off of it, but would not share it or allow it to be documented.

…The sources who spoke to AdExchanger said Apple’s original list of blocked ad tech and data vendors is now moot, having been replaced by a longer list of companies that can be dynamically blocked by Apple.

The new dynamic process that WebKit uses to identify and block vendors relies on a remote list that Apple devices regularly call upon. Previously, Apple would need to roll out a new version of iOS to add or remove vendors from its list of blocked companies; now, it can just happen on the fly.

And vendors may not even be aware that they have been added to the list, or whether they have graduated from the intermediary “potentially blocked” list to being actively blocked.

«

Interesting if true; the problem is that nobody is confirming it.
unique link to this extract

Faster Fourier Transforms • arg min

Ben Recht:

»

Since the invention of the Fast Fourier Transform (FFT) [in 1965], people have looked for even faster Fourier transforms. One question is just how fast you can go. It seems like you probably need at least n operations to compute the FFT, as it takes n steps just to write it down. The FFT is 5*log2(n) times slower than that reasonable speed limit, and that 5*log2(n) factor can be big. It’s 200 when n is a trillion. Can you do something clever to reduce that prefactor of 200?

Well, lo and behold, in the massive paper dump OpenAI took on the mathematics world last week, they claim to have a faster Fourier transform. The main claim from their discriminatively named “main.pdf” is: We give a deterministic algorithm that computes the discrete Fourier transform at every length n in O(n(log n)^1-10^-13) operations. The model uses exact complex arithmetic, unrestricted coefficients, specified Fourier roots, and unit-cost logarithmic-size indexing; scalar preparation and array organization are included.

I was intrigued about what was going on here. The log(n) term, in theory, was a teeny tiny bit smaller than in the standard FFT.

Did I read this paper? Of course not. No one at OpenAI read this paper either, so why should I? I did what every other mathematician in the world does with AI slop mathematics: I fed it back into the slop machine and ran an information retrieval session with a chatbot interface to extract salient facts. Anthropomorphically speaking: I asked ChatGPT what it thinks about its own output. This is how we do mathematical research now. What a world.

Unfortunately, I did not find a faster Fourier transform. Instead,l I found the rot that develops inside applied mathematical theory when formalism becomes so detached from reality that a “breakthrough” is nothing more than an artifact of mathematicians not being able to properly specify the rules of their games in natural language.

«

Basically: it’s only useful if your computer can store arbitrarily large numbers with unerring accuracy, and even then it’s only going to be faster than the standard FFT if you’re working on colossally large amounts of data.
unique link to this extract

Character.AI files for bankruptcy, to sell some assets to Disney for $20m • Reuters

Anzar Mehraj and ​Rhea Rose Abraham:

»

Chatbot platform Character.AI said on Monday it has filed for bankruptcy in the US and has agreed to ​sell some assets for $20m to Walt Disney.

The generative AI platform has faced mounting legal challenges over its chatbots. Earlier this year, Character.AI and Alphabet’s Google settled a lawsuit by the mother of a 14-year-old Florida boy ​who killed himself after the startup’s chatbot allegedly encouraged him ​to do so.

Kentucky has sued the company, saying its chatbots encouraged users to cut, starve or kill themselves, while Pennsylvania filed ​a lawsuit alleging its chatbots posed as doctors.

According to Character.AI’s proposal, Disney ​will be a “stalking-horse” bidder — an initial prospective buyer — for a non-exclusive perpetual license to some intellectual property. Other bidders can top Disney’s offer.

Character.AI expects to close the ​sale of all its assets by late November or early December. ​Character Technologies, its US-based owner, listed estimated assets and liabilities of between $50m and $100m, according to a court filing.

Disney will help the platform in the transition, using staff it has hired from Character.AI. The platform’s services would continue meanwhile, but would be shut down if it can’t find ​a buyer, the ​company said.

Two former Google employees founded Character.AI in 2021. In 2024, Google licensed its technology and rehired the founders.

«

An early sign of the bubble popping, or just roadkill?
unique link to this extract

Errata, corrigenda and ai no corrida: none notified