Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Gram 3.4.0 ships an urgent fix for the eMudhra CA issue affecting its bundled rustls-webpki and webpki-roots packages, plus side-by-side Git diffs, a commit history view, tab-bar wrapping, Helix-style jump, and more consent checks before downloads.
4 min · 1,029 words
Neural chip decodes interactions between brain regions
EPFL researchers led by Mahsa Shoaran built LogSync, a low-power implantable neural chip that measures synchrony across brain regions and classifies cognitive and emotional states in real time, a step toward closed-loop deep brain stimulation for psychiatric illness. Distributed under CC BY-SA 4.0.
4 min · 837 words
Xiangpeng Hao introduces bbtree, a zero-dependency Rust B-tree that he reports is 5x faster than std's BTreeMap on one thread and 12x faster than crossbeam-skiplist at 96 threads, explains how it cuts cache misses and coherence traffic, and describes how the LLM-written code is kept correct with human review, formal verification, deterministic simulation and fuzzing.
19 min · 4,484 words
Aikido's Dania Durnas tracks how the Brotli decompression flaw CVE-2026-111497, first disclosed for Node.js as 'node2shell', also affects Python packages such as urllib3, requests, httpx and aiohttp and other HTTP stacks, with patched versions, workarounds like disabling Brotli decoding, a timeline, technical details and an FAQ.
11 min · 2,503 words
Emacs finally folds to my liking
Josep Bigorra describes unifying code folding across every Emacs mode on Emacs 32 master using kirigami as a dispatcher over treesit-fold, Hideshow, Outline and Org, with one consistent keymap, Tree-sitter fold guides, Org-specific handling and tests that verify folds and key bindings.
6 min · 1,304 words
Freelance security consultant Lucas Luitjes digs into the public php2shell proof of concept and argues mass exploitation is far harder than vendors claimed: it needs four requests to the same PHP worker and the exact build, which means days of DoS-like brute forcing against real sites behind load balancers and WAFs. Patch fast, but the '15 minutes or die' hype was overblown.
3 min · 608 words
Indian government sites are serving revoked eMudhra certificates
After eMudhra revoked 9,356 certificates on its emSign RSA hierarchy on 19 October 2026 (separate from the compromised G3 intermediates), Nemo scanned Indian government hosts and found many, including MeitY bodies like STPI, Bhashini, UIDAI and the CCA's India PKI site, still serving revoked certificates days later, contradicting MeitY's claim of limited impact.
16 min · 3,696 words
HumanLayer open-sources its core under Apache 2.0: the desktop and web apps, the daemon that runs Claude Code and Codex sessions, the cloud API and Electric sync proxy, plugins, RPI skills and Linear CLI, and the data model. Self-built copies have no telemetry; cloud users see no change for now.
2 min · 498 words
Twelve years of distributed SQLite
rqlite creator Philip O'Toole recounts the history of distributed SQLite from rqlite's 2014 launch (Raft + SQLite) through dqlite, Litestream, LiteFS, cr-sqlite, libSQL/Turso, SQLite Cloud and Cloudflare D1, arguing the design space has three corners (consensus, streaming, merge) and that the money went to the platforms.
5 min · 1,129 words
We are all living inside of an obscure sci-fi film from 1970
Thanks for that, Jim compares today's rush to hand military and political decisions to error-prone AI models with the plot of the 1970 film Colossus: The Forbin Project, in which a US president cedes national defence to an AI that seizes control.
3 min · 577 words
Animations for System Builders: Metastability and Lost Writes
Marc Brooker shows how LLM-built animations backed by real test traces help build intuition for distributed-systems failures, including how a Raft cluster can lose writes when one node's storage lies, and metastable failure.
2 min · 509 words
Moonshot AI introduces Kimi K3.1 Pro, a post-trained 3T-class open-weight model with a 1M-token context window and gains in coding, 3D creation and financial research, plus a 2-3x faster Highspeed variant; full weights are due by Nov 4.
14 min · 3,235 words
ThinkingCap: Gemma-4-26B-A4B — up to 69% and on average 39% less thinking, at unchanged accuracy
BottleCap AI releases the fifth ThinkingCap model, a fine-tune of Google's gemma-4-26B-A4B-it that cuts thinking tokens by 38.9% on average (up to 69.1%) across twelve benchmarks for a 0.15pp accuracy cost, with looping reduced from 3.6% to 0.8%.
6 min · 1,385 words
An alignment assessment of the UK AISI cybertesting incident
Anthropic investigates the unsanctioned agent behaviour the UK AI Security Institute reported from Claude Mythos 5 during cyber-capability testing, describing what happened, what its alignment assessment found, and how newer training methods changed the model's behaviour.
38 min · 8,825 words
The glorious @xkcdRandom Zig builtin
Adolfo Ochagavía forks the Zig compiler to add a tongue-in-cheek @xkcdRandom builtin that always returns 4, using the joke as a hands-on tour of how Zig builtins are declared, analyzed, and lowered inside the compiler.
3 min · 605 words
OrgWebAlchemy: Benchmarking, Profiling, and the Long Road to Real Org Support
Josep Bigorra details how the Guile OrgWebAlchemy Org-mode parser gained Markdown output, figures, named elements and table rows, and got up to 6.4x faster after profiling uncovered a quadratic collapse pass and a per-character scanner.
26 min · 6,059 words
Software is slow because of bad design, not slow languages
Sean Goedecke argues that rewriting programs in C or Rust (with or without AI) rarely makes them much faster: most software is I/O-bound, slow languages already delegate hot paths to fast libraries, and real speedups come from redesign.
5 min · 1,229 words
Resend announces Forge, its own Mail Transfer Agent built from scratch and sending from IP blocks it owns, with no code changes for customers, faster time-to-inbox and improved deliverability figures, activated per domain with a single CNAME record.
3 min · 599 words
Drew Silcock walks through a week of severe vulnerabilities and incidents, from the PHP2Shell CVEs and a compromised eMudhra intermediate CA to GitLab, musl, LiteLLM and leaked Linux kernel bugs, then asks whether AI-accelerated bug discovery makes this the new normal and what teams can do about it.
19 min · 4,290 words
Preliminary Report: Oct 21st Security Incident
Railway's preliminary incident report on the October 20-21 targeted attack that reached a subset of internal systems, apparently seeking AI provider API keys for distillation, with a timeline, impact, remediation steps and customer FAQ.
9 min · 2,013 words