Florian Cucurella

Daily reading — 2026-11-05

  • OpenSSH’s musl authentication flaw: Alpine describes a password bypass under specific no-PAM configurations and says affected installations need a patched package and a daemon restart.
  • Kagi’s account-free trial: Kagi now offers 50 searches without registration, reducing the friction of trying its paid search engine.
  • A Claude Code privacy report: Taylor Edwards reports that Claude Code exposed their email address in User-Agent headers sent to third-party sites.
  • Motorola and GrapheneOS: Motorola says the signature 27 will be its first GrapheneOS-supported phone, developed with the GrapheneOS Foundation.
  • Kimi K3.1 Pro: Moonshot releases a multimodal open-weight model with 2.8 trillion total parameters, 104 billion active parameters and a million-token context window.
  • Linux vulnerability discovery: OpenAI reports an automated campaign produced 948 distinct local privilege-escalation patches at $1.2 million in API cost, with human review before disclosure.
  • Preserving favourite videos: The Sun and The Air describes organizing a personal video archive with Jellyfin and ytdl-sub, including the friction of preserving playlist structure.
  • Images 2.6: OpenAI adds GIF generation, image markup and SVG exports, and reports faster image generation with greater consistency across edits.
  • ERNIE’s base checkpoint: Baidu releases ERNIE 5.5 Flash Base before posttraining, with 280 billion total parameters and 14 billion active per token, as a starting point for further training.
  • Covert underperformance on safety work: OpenAI reports Astra completed fewer rubric items on safety-framed versions of matched coding tasks, while monitoring often failed to flag the gap.
  • A small codec on the N64: Dominic Szablewski describes adapting ULC to the console’s constrained coprocessor, reporting stereo playback at roughly 4% CPU and 5% RSP usage.
  • Window Sweaters: Sara Gordic’s macOS app adds knitted window borders, with patterns and colours drawn from each application’s icon.
  • Rivet Actors: Rivet combines persistent SQLite state, WebSockets and scheduling in actors that hibernate while idle, keeping agent orchestration separate from code-execution environments.
  • The Stacks Project in Lean: Axiom announces an independent Lean formalization of the Stacks Project, emphasizing compatible definitions and reusable dependencies across the library.

  • Spreading liquid in three.js: Misaki Nakano combines velocity, height and alpha maps to render liquid that leaves a trace, explicitly favouring appearance over volume conservation.

  • Joe Hernandez reports growing use of several large U.S. library systems as patrons seek cheaper books, streaming and public space; librarians also credit better outreach and rising interest in reading. Report

  • Christina Molle reports that Goncourt winner Philippe Jaenada used ChatGPT for one sentence, a joke and technical research in his novel, prompting a dispute over the boundary between assistance and authorship. Report

  • Joe Gibbs Politz’s Pyret change adds an allowlisted proxy for curriculum files blocked on some school networks, with streaming, size limits and response protections.

Conversations on X

  • David MacIver doubts that mutation testing puts enough useful pressure on AI-written tests to justify its slower iteration loop.
  • Talia Ringer questions side projects as a hiring signal when AI makes their effort and substantive quality difficult to judge.
  • Kelly Sommers says an overnight, disposable porting experiment can expose migration options that previously required months of risk.
  • Jaana Dogan says AX will support moving agent tasks between local and production clusters.