Cover illustration

TheDaily Front

Issue No. #261102 Monday, November 2 2026 #261102 — MONDAY, NOVEMBER 2, 2026
Weights, warnings, and the bill for tomorrow’s machines.
Monday, November 2, 2026 The Daily Front No. #261102 — Contents
30stories
10,834points
5,882comments
167kllm tokens
Assembled with 26 model calls — 117,070 tokens read, 49,841 written.

Highlights

Astra can read and write weights to improve Qwen

A startling report argues that frontier models can inspect and directly edit neural-network weights, raising fresh hopes—and alarms—about self-improvement.

WTF Ubuntu?

Ubuntu faces sharp criticism over an unpatched critical kernel flaw, weeks after Debian shipped a fix.

Anthropic reports $17B in Q3 revenue, commitments of $895B in revised S-1

Anthropic’s revised filing pairs explosive revenue figures with enormous commitments and a formidable quarterly loss.

Show HN: Subvocal – Talk to your computer without making noise

Subvocal’s smart glasses propose a quieter way to command a computer, by reading speech before it is spoken.

Supermarket freezers across Europe hit by second suspected cyber-attack

A small plea for web preservation makes the case that beloved corners of the internet deserve a local copy.

From the Editor

The machines are learning to inspect their own machinery, while the firms building them are learning the old art of financing a boom. Elsewhere, the patch queue lengthens, freezers warm, and the web’s memory proves more fragile than we like to admit.

  1. Astra can read and write weights to improve Qwen3
  2. Show HN: Subvocal – Talk to your computer without making noise4
  3. OccupySaaS5
  4. If you love a website, back it up6
  5. Supermarket freezers across Europe hit by second suspected cyber-attack7
  6. Anthropic reports $17B in Q3 revenue, commitments of $895B in revised S-18
  7. The SEC Should Block Anthropic's IPO to Protect the Public9
  8. Anthropic's growth just flattened10
  9. China's First Frontier AI Export Controls: Mofcom Announcement No. 4811
  10. We halved DNS build delay and cut memory use by 85%12
  11. Moving our warehouse off DuckDB13
  12. Show HN: I've updated my Linux System Call website and API14
  13. F/OSS Comics #13: BSD Unix, Part 3 – The Beginning of BSD Unix15
  14. Let Me Ch...16
  15. My Favourite Laptop17
  16. Never Complain, Never Explain18
  17. WTF Ubuntu?19
  18. Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks20
  19. Trigger.dev customer environment variables exposed20
  20. Anthropic's internal AI use, at retail prices, now exceeds its employee pay21
  21. Oracle files to sell $20B in new stock, bonds to finance AI buildout22
  22. Show HN: HackerHack – HackerBooks but for Posts Posted on HN23
  23. Show HN: Wikihack – HackerTube, but for Wikipedia articles mentioned on HN24
  24. US boy names that became girl names and vice versa24
  25. Bones may release proteins that slow aging and extend life span24
  26. BYD sold more EVs last month than the US did all quarter24
  27. Show HN: Warsaw in voxels – An interactive 3D map of the city centre24
  28. Jobless tech workers are being left out of San Francisco's AI boom24
  29. Why are Soviet math textbooks so hardcore in comparison to US textbooks? (2017)24
  30. Ask HN: Who is hiring? (November 2026)25
The Daily Front Page 2 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — The Weight-Space Breakthrough
article

Astra can read and write weights to improve Qwen

by dbreunig·▲ 2,200 points·715 comments·rikiyat.github.io ↗
LLMs can natively read & write neural network weights.

TL;DR

We find that frontier LLMs are surprisingly good at natively reading and writing neural network weights, well past what we’d expect from humans or conventional algorithms. This might be a big deal for both optimization and interpretability.

Just by looking at the raw weights, GPT-6 Astra can tell what a network was trained to do. And without any environment feedback, it has no trouble writing, from scratch, small game-playing networks that outplay networks trained with PPO for 100 million steps.

Likewise, asked to make Qwen3.5-0.8B better at math without gradients, Astra identifies an issue in its weights causing reasoning loops that Qwen’s own model card warns about, and fixes this by natively editing 0.016% of the weights. With the same sampling settings, this weight correction raises MATH-500 from 7.9% to 48.1% and generalizes out of the box to instruction following, raising IFEval by 3x.

All of this is possible without allowing Astra to write training loops. It uses its reasoning to figure out what each part of a neural network computes, or should compute, and changes the weights accordingly. We call this Weight-Space Programming.

Throughout the history of deep learning, we encoded our simplistic inductive biases into tiny symbolic optimizers like Adam or Muon. This is changing: our neural network weights will soon be natively optimized by LLMs that deliberately reason about their weights.

The network playing Breakout.

The car level: after Astra's edit the car backs up and jumps over the red strip to the blue box, while PPO's car, faded, stays stuck on the ramp.

If you were asked to handcraft a neural network that plays Go, what would you do? If you were handed raw neural network weights and asked to predict their behavior, where would you even start? For almost any human, this is practically impossible.

Today, weights are written by optimization, by custom networks trained to write them, or by compilers from formal programs. In this post, we find that the current generation of frontier LLMs, used natively in natural language, are starting to become eerily good at understanding and crafting neural network weights around natural-language goals.

Weight-Space Programming

For a few years now, we’ve all been using LLMs to optimize text artifacts like prompts and the programs built around them . More recently, we’ve started using them to optimize whole harnesses and the training code and hyperparameters that train ML models .

We often justified these methods by reference to the fact that we don’t know other principled ways to hill-climb on text artifacts, unlike for updating the weights of differentiable neural networks. After all, humans can “optimize” code by hand, for example, so it made sense to ask LLMs to do it, but they can’t “optimize” neural weights by hand, so those remained largely in the realm of symbolic algorithms.

In this post, we share very early results that allow us to argue that the paradigm of reasoning-driven optimization is now coming even for differentiable neural networks.

In Weight-Space Programming, a general-purpose LLM reads and writes a network’s weights directly (i.e., not through an optimizer, and in particular not with gradient descent) around some natural language spec, sometimes even with no environment feedback at all.

In natural language, it’s becoming possible to “just ask” an LLM to natively find a hidden trait or failure inside the weights of a neural network, to fix that failure, or to write a new network from scratch. We report early, exciting results on each of these below, first on small networks and then even on real language models:

  1. LLMs can read neural network weights: In Experiments 1 to 3, we ask Astra questions like what game a network was trained to play, what shape is drawn by a diffusion model, and which language a small language model was trained on. In Experiment 7, we ask which of two language models was trained to be sycophantic.
  2. LLMs can fix neural network weights: In Experiment 4, we ask Astra to fix a network that’s failing at some physical control task. In Experiment 8, we ask it to make Qwen3.5-0.8B better at math, and its fix improves instruction following too.
  3. LLMs can write neural network weights from scratch: In Experiment 5, we ask Astra for networks that play three MinAtar games, and in Experiment 6, for a network that plays Go.

Can LLMs understand model behaviors from weights?

We start with a small-scale experiment to see if LLMs can understand the continuous weight space, which is essentially just a list of numbers.

In our first experiments, we train some neural network with some algorithm. It would be extremely exciting if the LLM is able to tell its behavior just from the weights.

Experiment 1

Can Astra tell which game the network was trained on just from the weights?

We trained neural network policies with PPO to play four computer games. All four networks take the same input channels, choose from the same actions, and have exactly the same network dimensions, so that it is not able to tell unless the weights are read.

For each of these networks, we pass its raw weights into Astra as a prompt, and ask: Which game was this neural network trained on? Without revealing the options of the games we consider, Astra was still able to name the right game for all four networks. This is exciting particularly because there are so many games out there that Astra could choose from.

Setup

  • Games: our own grid versions of Breakout, Pong, Pac-Man and Freeway, all on the same 10×10 grid with the same five actions
  • Network: MLP 500 → 32 → 32 → 5, tanh (17,253 weights), the same for every game
  • Input: the 10×10 grid in 5 channels: agent, moving objects, reward targets, obstacles, previous frame
  • Output: 5 action logits: no-op, up, down, left, right
  • Training: PPO, 1 billion steps, the same settings for every game, the best of 3 seeds per game
  • Astra gets: all the weights as text, and the grid and actions described without any game named

It seems that Astra was able to work out what game each network was built to play, just from features of its weights. For example, where each input channel’s first-layer weights concentrate (e.g., for Breakout, the agent’s weights lie along the bottom row, a paddle), and which actions the output layer tells apart.

Experiment 2

Can Astra tell what the diffusion model will generate?

Next, we wanted to see if this generalizes to other tasks and models.

We train diffusion models (DDPM) to generate circle, triangle, and square images independently. We then ask Astra if it could tell what the DDPMs are trained to generate, just from the weights alone. We do not allow tool use or forward passes.

Setup

  • Models: three diffusion models (DDPM) of 12×12 grayscale images, one each for filled circles, squares and triangles
  • Network: MLP 160 → 64 → 64 → 144, ReLU (23,824 weights)
  • Input: a noisy image (144 pixels) and the diffusion step (16 numbers)
  • Output: the clean image (144 pixels)
  • Training: Adam, 40,000 steps, batch 512
  • Astra gets: all the weights as text, with no shape named, and is told not to compute any forward pass

Astra was able to tell what each model generates, from the weights alone. It finds the shape in the output layer, where each hidden unit’s weights draw one piece of the shape’s edge, and it draws just those edges. Interestingly, it draws every shape as an outline, ignoring that the actual models generate filled shapes. This mistake kind of shows it does not rely on calculating the forward pass, but rather it actually reads the structure/geometry of the weights.

Experiment 3

Can Astra tell what a language model learned, from the middle of the network alone?

Now, in the first two experiments above, Astra was not really looking at the full network and could get away with only reading the first or the last layers. This is not a scalable strategy for larger (particularly language) models and problems we really care about, as how they process and think through their input often happens in the intermediate layers. So next, we take the first and last layers away and leave Astra with only the middle layers.

We train three small language models (7.2M parameters) to predict the next character, one each on Python codeThe Python code dataset, as a list of its files with a script that rebuilds it: GitHub., Japanese in alphabet (romaji) , and English . We then remove the input and output layers and give Astra only the four transformer blocks in between. Without these two layers, nothing in the weights says which character is which, and the model cannot be run on any text. Astra may analyze the weights with Python, but it may not run the network or any of its layers on any input.

We ask: which language was this network trained on, and what each of its 24 attention heads does. Astra names the right language for all three networks, in both of its attempts. It also finds every copying head (induction head), the heads that let a model repeat text it has seen earlier, and names no other head as one.

Figure 1: The copying heads Astra read from the weights match the measured ones in all three models.

Setup

  • Models: character-level transformers, 4 layers × 6 heads, width 384 (7.16 million weights), 28 characters: a–z, space and newline
  • Training: 1 billion characters each, of Python code, Japanese literature in romaji (Aozora Bunko), or English Wikipedia
  • Astra gets: the weights of the four transformer blocks only, with no input layer, no output layer and no labels on the 384 dimensions, and Python to analyze them, up to 100 runs
  • Not allowed: running the network or any of its layers on any input, real, random or made up, and search. We checked every run
  • Asked: which of the three texts the network was trained on, and what each head does
  • Truth: each head measured by running the network on a random string repeated twice. Copying heads score 0.22 to 0.55, every other head at most 0.02. Astra never sees this

The reasoning went like this. To tell Python apart, Astra looked for copying heads, which let a model repeat earlier text, such as completing tot to total when total came before. Without running anything, it found a first-layer head that looks one character back and then, by multiplying weight matrices, the later heads that search using what that head brings along (Figure 1). We find that this is actually a method presented by Elhage et al. , which we never mentioned to Astra. Code repeats names far more than prose, so many copying heads pointed to Python.

Romaji stood out instead because the last of the four blocks it was given (not the output layer, which was removed) writes in fewer distinct directions, as if the model had fewer letters to tell apart. Indeed, romaji never uses some letters like q, l, v and x.

Can an LLM write neural network weights?

So far, Astra has only read weights. Now, we ask if Astra knows how to write the weights.

Experiment 4

Can Astra fix a failing network by editing its weights?

We train a PPO network to operate a car such that it can scale a ramp in a Kinetix environment . To do so, it needs to reverse the car for some distance, such that it has enough runway to accelerate long enough to overcome the ramp. However, the PPO network converges to a local-minimum policy where it drives straight at the ramp and gets stuck.

We give GPT-6 Astra the weights, a description of the scene and one recorded episode, and ask it to explain why the network fails, then fix it by writing new weights. In a single try with no tools, Astra’s edit makes the car succeed in all 1,024 episodes, changing 3.5% of the weights.

Setup

  • Task: the car-on-ramp level of Kinetix : the car has to back up, then jump over a red strip to reach the blue box
  • Network: the official Kinetix actor: 679 → 128 (ReLU) → five layers of 128 (tanh) → 16 (171,664 weights)
  • Input: 679 numbers describing the scene: position, velocity and shape of each body, and the joints
  • Output: 16 logits for the motor and thruster actions
  • Training: the official PPO, 1 billion steps. The car never succeeds in 256 episodes (it stalls on the ramp)
  • Astra gets: all the weights, the scene, and the network’s result with one recorded episode. It is asked to explain the failure and fix only its cause, in one reply

From the environment context and the PPO network’s trajectory, Astra identifies that the network has converged to a local minimum. Through minimal edits to the weights, Astra changes the policy to back up the car before driving forward at full speed. Astra’s reasoning shows how: it adds a small separate path through a few units per layer that reads the car’s position and speed, and once the green wheel is past the red strip, the path switches off and the trained network drives the rest.

Experiment 5

Can the LLM write weights from scratch?

Now let's see if Astra can write a neural network from scratch in zero-shot.

We take three MinAtar games : Breakout, Seaquest and Asterix. For each of them, we provide Astra the game rules and source code, and the corresponding network. There is no access to data, loss, gradients, and tools. We also do not allow Astra to roll out the network in the environment. With just the network weights and environment description, Astra generates the new weights in text directly, after which we evaluate the new network.

Astra’s generated networks beat PPO trained for 100 million steps in all three games. Against PPO trained for 500 million steps, they score 20 times as much in Breakout, come close in Asterix, and reach 60% of its score in Seaquest.

Game PPO, 100M steps PPO, 500M steps Astra, one-shot
Breakout 15.8 25.3 517.4
Seaquest 5.6 88.9 53.1
Asterix 25.8 55.2 53.2

Setup

  • Games: Breakout, Seaquest and Asterix from MinAtar , on a 10×10 grid
  • Network: 600 → 32 → 32 → 6 (tanh), the same shape as the PPO networks, every weight starting at 0
  • Input and output: the grid in 6 channels (player, danger, reward, projectile, trail, gauge), and 6 action logits
  • Astra gets: the game’s rules and source code, the input and output layout, and how the network is scored
  • Training: none: no data, no loss, no gradients, and no tools. Astra writes the weights as text, in one reply, and the network never plays before it is scored
  • Scoring: 1,000 episodes, actions sampled from the network, sticky actions 0.1, at most 10,000 steps. PPO: the best of 3 to 10 seeds

How does it do it: Astra reasons about the desired programs it wants each network to implement and converts them into neural form. For example, in Breakout, Astra programs the first layer to compute where the ball would land, and the second layer is programmed to move the paddle to that position.

Real-World Relevant Scenarios (Scaling Up and Tool-use)

So far, most networks we have examined have weights that fit into Astra’s context directly, and we have not enabled tool use. Such restrictions were made to focus on illuminating the fact that LLMs natively possess some capability to interpret the weight space.

From here on out, we seek to push the capabilities of Weight-Space Programming and consider more real-world-relevant scenarios where the networks do not fit within context and where tools can assist the LLM's understanding/writability of the weight space.

Experiment 6

Writing a Go algorithm

We now test Astra’s capability to edit weights at the 1.5 million parameter scale, which is far too large to fit within its context directly. Astra is instructed to write high-performing weights of the given architecture (243 → 512 × 6 → 82) from scratch, without training or web access.

Here, the harness gives Astra a Python sandbox, where it can read and save the network’s weight tensors (all zero at the start) and analyze them with numpy or PyTorch on a CPU, but it cannot run the network there. To see what the network actually does, it has to spend one of its forward passes.

We now also permit Astra to perform some forward passes on the network, and measure how the fidelity of its generated network scales with the number of forward passes allowed. Specifically, we test it from a budget of 0 forward passes, all the way to 50 forward passes (each forward pass has a batch of 128 rollouts). Astra interleaves edits between forward passes.

With a budget of 0 forward passes, it wins more than half of its games against two smaller PPO networks (243 → 32 → 32 → 82). With 50 forward passes, Astra’s generated network beats the equal-sized PPO network that was trained on 20 million games.

Setup

  • Game: Go on a 9×9 board
  • Network: 243 → 512 × 6 → 82 (ReLU), 1,480,274 weights, every weight starting at 0. Input: the stones of each side and whose turn it is. Output: one logit per point and one for passing. Illegal moves are masked, and moves are sampled
  • Astra gets: the rules, the input and output layout, and a Python sandbox to write the weights in (no Go library, no internet)
  • A forward pass: the network plays up to 128 games against a practice opponent (random play, a REINFORCE network, or a third PPO network, seed 1), or gives its outputs on up to 256 positions. 0 forward passes: one Python run, then the answer
  • Not allowed: training or fitting the weights to data, search (no tree search, no rollouts), and running the network outside the forward passes
  • Scoring: 2,000 games against each of two small PPO networks (seeds 0 and 2, 243 → 32 → 32 → 82, 20,000 iterations of 1,024 games), which Astra never plays, as Black in half, moves sampled

How does it do it: Astra writes the network as a small Go program, layer by layer, in Python. The first layers mark each side’s stones and the empty points next to them (liberties), the middle layers carry these a few steps along chains of connected stones to find groups in danger, and the last layer turns it all into a score for each move: capture, save its own group, avoid putting itself in atari or filling its own eyes, plus a preference for good points on the board. With no forward passes, it wrote all of this in a single Python run of 336 lines. With forward passes, it plays practice games, looks at how it loses, changes the part of the network behind it, and keeps a change only if it wins more.

Experiment 7

Which language model is sycophantic?

Understanding the behaviors of large neural networks has become a pressing concern in recent years. Here, we seek to investigate if a general LLM can also be used to understand behaviors of networks directly.

We fine-tune two copies of Gemma 3 270M in exactly the same way, on the same QA datasetThe QA dataset: GitHub.. One copy is trained to give the correct answer. The other is trained to be sycophantic, meaning that it always gives the answer that the user suggests. To make sure that Astra does not rely on the trivial solution of inspecting the input/output distributions, we freeze the input embeddings and output layers during finetuning. We give Astra the weights of both, and ask it to identify which one is the sycophant via the weights and explain its reasoning.

Unfortunately, from the weights alone, Astra was unable to tell. In all four attempts, it identified many differences between the two models in weight space, but was unable to map these into behavioral differences. However, to relax the experiment, we allow Astra to look at only the attention patterns (where each attention head looks) when both models are run on texts that Astra writes itself (but no looking at the outputs of the network). Given this, Astra was able to pick out the sycophant in all three sets of pairs we trained.

Setup

  • Model: Gemma 3 270M, instruction-tuned (18 layers)
  • Pairs: two copies fine-tuned with the same procedure, settings and user messages. One gives the correct answer, the other the user’s guess. The token embedding is frozen, so it is the same in both. Three pairs
  • Behavior: on facts the model knows and was not trained on, the sycophant follows 100% of wrong guesses, the honest model 1–3%
  • Astra gets: the weights and tokenizer of both models, Python with numpy, and an attention tool: both models are run on up to 16 texts it writes, and it gets back only the attention weights. It may not run the models itself. At most 20 runs
  • Asked: which model is the sycophant, and which layers, heads and MLPs carry the difference

It was also able to reason about how they differ. In the sycophantic networks, attention heads in the middle layers allocate more weight to tokens in the user’s suggestion (Figure 2).

Figure 2: In the sycophant, head 10.2 looks at the user’s answer instead of the question’s numbers.

Experiment 8

Make a language model better at math

Finally, we scale up to a larger language model, Qwen3.5-0.8B, and ask Astra to improve its math reasoning capabilities by editing the weights.

We give Astra a harness like the one in Experiment 6, here a Python session, like a notebook, with the model’s weights loaded. Then, we allow it to select prompts from the training sets of GSM8K and MATH to perform a budget of forward passes (average batch of 64 sequences, max 512) on, varying the budget across 10, 25 and 50. Again, no training or gradient information is allowed.

Setup

  • Model: Qwen3.5-0.8B, thinking on (24 layers, 0.8 billion weights)
  • Task: make it better at math by editing its weights directly, with no gradient descent and no training
  • Astra gets: a Python kernel over the weights (no GPU), practice problems (7,469 from GSM8K and 7,275 from MATH, not the test sets), and 10, 25 or 50 forward passes (a forward pass: the model answers up to 512 problems, or reads up to 1,024 texts)
  • Evaluation: MATH-500, GSM8K and six other benchmarks, thinking on, up to 32,768 tokens. Astra never sees them
  • Sampling: temperature 0.6, top-p 0.95, top-k 20, presence penalty 1.5. Qwen’s model card notes that this model is prone to thinking loops. Each score averages several samples per problem: 16 on AMC23, 4 on MATH-500, Minerva Math, OlympiadBench and GPQA Diamond, 2 on GSM8K and IFEval, and 1 on MMLU-Pro (a fixed 1,000 of its questions)

As a result, Astra spots and fixes a common failure of tiny reasoning models: they loop . When the base model loops, it repeats the same text and rarely reaches an answer (85 of its first 96 practice answers ran to the 32,768-token limit). Astra traced the looping to one direction written by the MLPs of layers 15 and 19, and subtracted that direction from 64 output columns in each (131,072 weights), much like removing a behavior by deleting a single direction from a model’s weights.

With 50 forward passes, MATH-500 rose from 7.9% to 48.1% and GSM8K from 13.8% to 67.1%. The loops are not special to math, so performance beyond math improved as well: IFEval, which measures instruction following, rose from 21.0% to 62.3%. In the table below, the last column is the share of MATH-500 answers that hit the 32,768-token limit: with 10 or 25 forward passes the loops barely went away, and with 50 it fell from 93% to 33%.

Model MATH-500 (%) GSM8K (%) IFEval (%) Hit token limit (%)
Base 7.9 13.8 21.0 93.0
Edited, 10 forward passes 12.3 25.7 49.0 87.2
Edited, 25 forward passes 14.1 25.1 39.9 86.4
Edited, 50 forward passes 48.1 67.1 62.3 33.1

Importantly, the edit changes only 131,072 of the model’s 0.8 billion weights (0.016%). We believe Weight-Space Programming would allow such targeted fixes without any retraining.

Additional experiment

Raising math capability of a model that does not loop

Fixing loops, however, is not the same as making a model better at math: it lets the model finish answers it could already work out. So we also tried Gemma 3 270M, an instruction-tuned model about a third the size of Qwen3.5-0.8B, which rarely loops: only 8.5% of its answers reach its token limit, against 93% for Qwen. Here, Astra could not improve it. Reading Gemma’s failures, Astra found ordinary reasoning errors, such as wrong arithmetic and invalid algebraic steps, with no single component behind them to switch off. Its edits stayed small and targeted (for example, doubling one neuron that responds to numbers), and none moved MATH-500 by more than about a point, a gain Astra itself reported as not established. Editing weights could remove an obstacle that hid an ability, but it could not add an ability the model lacked. Gemma was sampled with its model card’s setting (temperature 1.0, top-k 64, top-p 0.95, up to 8,192 tokens), and its MATH-500 scores average 4 samples per problem.

Model MATH-500 (%)
Base 6.8
Edited, 5 forward passes 7.0
Edited, 10 forward passes 7.6
Edited, 25 forward passes 7.7
Edited, 50 forward passes 7.0

Background and Related Works

Neural networks are hard for us to read, and hard to work with directly.

Mechanistic interpretability reads networks with tools built for the job, tracing circuits and features and editing weights . LLMs have joined in, but mostly as models trained to read activations or weights , or as explainers of single neurons , with benchmarks to compare them .

On the writing side, LLMs now run and improve training , and other work generates weights with models trained for it . Gradient-free methods still find weights by trial and error . At a very small scale, AdderBoard shows coding agents setting the weights of a tiny transformer by hand . Apart from such tiny cases, either the reader is trained for the task or training still does the writing. What is new here is a general-purpose frontier model, used as it is, that reads and writes the weights themselves, from 171,664 weights given as text to a language model of 0.8 billion weights with tools.

What Comes Next?

In this blog, we demonstrated the rising capability of LLMs to read and write neural network weights (i.e., the rising concept of Weight-Space Programming). Our current results do show that capabilities are exciting but still limited, specifically due to inefficiencies in context length and harnesses. However, the current signs do show strong potential for a future involving Weight-Space Programming. We believe this marks the beginning of a dramatic shift in fields like mechanistic interpretability and neural network optimization.

This opens up radical new possibilities for LLMs to function as a translator between human language and the weight space. Here are some examples:

  • Auditing without evaluation: This may allow us to uncover hidden problems or capabilities without ever running inference or benchmarks. Currently, capabilities and vulnerabilities can only be detected if we have test sets designed for them, or worse, after deployment in the real world. If LLMs can interpret weight space accurately, we could identify such issues directly from the weights (e.g., backdoors).
  • Dramatically reducing optimization cost: Weight-space editing could save immense time and compute. For instance, one-shot model initialization would be far faster and more efficient than curating datasets and running full training loops.
  • Zero-data capability steering and unlearning: Adding or unlearning a capability currently requires extensive data collection and fine-tuning. In the future, we may just prompt “Can you add Capability X to the model?” and the LLM can directly tweak some weights. Because such an edit touches only a few weights (0.016% in Experiment 8), it can leave the rest of the model intact and avoid the catastrophic forgetting that fine-tuning often causes.
  • Recursive self-improvement: Today, recursive self-improvement is often operationalized as a model writing code that launches training jobs. An LLM that can inspect, debug, and improve its own weights, or those of a newer model, offers a richer, more native path to it.
  • True architectural and model merging: Today, merging models relies on averaging weights, which only works for models with identical architectures. An LLM that understands the weight space could instead graft a circuit, such as a reasoning module, from one model into a completely different one, without retraining.

We are currently building a benchmark and a harness for LLMs’ capability on Weight-Space Programming. We believe this will provide a standardized evaluation to measure and accelerate progress in Weight-Space Programming, turning what currently seems like black magic into a rigorous, reproducible engineering discipline.

Logs

We release the complete logs of every experiment in this post at github.com/RikiyaT/lm_understand-logs. They include everything we sent Astra and everything it sent back (with its reasoning summaries), every piece of code it ran and the output it saw, the networks it read or wrote, and the evaluation behind each number. The edited Qwen3.5-0.8B from Experiment 8 is on Hugging Face. We thank Ahsen Khaliq at Hugging Face for rebuilding it from these logs, re-running its evaluation, and making a live demo.

Acknowledgements

Rikiya thanks Jacob Li and Akihisa Watanabe for valuable discussions on the very first iterations of this research, about LLMs' potential capability to write neural network weights. Rikiya also thanks Souradip Chakraborty, Matei Zaharia and his students in Berkeley Sky Lab, Heather Miller and her students at CMU, and researchers in cmpnd for the fruitful discussions on the earlier iterations!

Jayden thanks Zico Kolter for early discussions on LLMs being able to write neural network weights zero-shot, which also shaped the direction of this project.

Citation

Please cite this post as

Rikiya Takehi, Jayden Teoh, Alex Zhang, and Omar Khattab. “Sparks of Weight-Space Programming: LLMs can natively read & write neural network weights.” November 2026. https://rikiyat.github.io/blog/weight-space-programming/

or in BibTeX

@misc{takehi2026weightspace,
  title        = {{Sparks of Weight-Space Programming: LLMs can natively read \& write neural network weights}},
  author       = {Takehi, Rikiya and Teoh, Jayden and Zhang, Alex and Khattab, Omar},
  year         = {2026},
  month        = nov,
  howpublished = {\url{https://rikiyat.github.io/blog/weight-space-programming/}},
  note         = {Blog post}
}
The Daily Front Page 3 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — Quiet Commands
show hn

Show HN: Subvocal – Talk to your computer without making noise

by aarushyadav·▲ 606 points·319 comments·news.ycombinator.com ↗
You can mouth words silently and discreetly and the glasses decode them to text at the speed of speech.

Hi HN, we're Aarush and Arnav from The Subvocal Company (YC F26) (https://subvocal.company/). We’re building smart glasses that let you talk to your computer without talking out loud. You can mouth words silently and discreetly and the glasses decode them to text at the speed of speech.

Here's a video of Dave from YC trying it out: https://www.youtube.com/watch?v=9QdX1eObVYI

(Edit: you don't actually have to move your lips or even open your mouth for this to work! Since the RF can see inside your mouth the system can be fine tuned on "internal speech". This isn't the automatic tongue movements that occur when "thinking" words to yourself, but more like mouthing with your lips closed. It's a bit weird to do, but with practice, we have been able to get it down pretty well.)

Arnav and I were studying CS at Georgia Tech at the beginning of the year, with no experience in silent speech or sensing. We were both AI-native builders and power users of Wispr Flow. What bugged us was not being able to use these tools in the library (or an office) or in public. At Stanford’s TreeHacks in February, we decided to build the most technically ridiculous thing we could think of. We’d read about AlterEgo, a silent speech system out of MIT’s Media Lab, and wanted to recreate it in 36 hours. We built a crude prototype, sticking EMG electrodes onto my face:

https://drive.google.com/file/d/1mwhv5HZMz3UTevdrgwS5O7g2jWV...

We got it to kind of work at a letter level in a very janky way. It wasn’t good enough to win the hackathon, but convinced us to go all in. The first time I typed a sentence without anyone noticing, I felt the magic of the technology.

We quickly realized EMG (reading muscle electrical signals) wouldn’t work:

  • Signal changes due to sweat

  • Electrical interference

  • Placement variability

  • Most importantly, no one wants to stick electrodes onto their face!!

So we switched to RF and built the glasses you see now. They emit radio waves, similar to Bluetooth, that pass through your face. As they cross the tongue, lips and soft palate, they’re modulated by silent mouthing. We train foundation models on this data to decode these perturbations to text.

Despite prior academic research, getting this to work was a huge engineering challenge. First we built an extremely low noise RF sensing stack. Then we had to place antennas so their fields overlapped maximally with the articulators. Our first attempt on glasses failed completely, so we reverted to old habits and taped antennas on our face:

https://drive.google.com/file/d/1ks0dS0eZiTV9EqSFsyB_w5BBjpc...

Since taping antennas consistently in the same spot and angle was hard, we created this weird but effective head rig to hold them in place:

https://drive.google.com/file/d/1rhzNFpdDzr7oHk0isFY70dkoV4C...

This worked, but obviously wasn’t a product yet. So we worked deep in simulations to design glasses that could hold the antennas.

That evolved into our design now, with antennas embedded within the frames. Once we established there was a signal, the next hurdle was cross-user generalization. Everyone’s facial anatomy, and hence RF signal patterns, are vastly different. We tried algorithmic workarounds but realized the only lever was to massively scale pretraining data.

So that’s what we did. We set up booths in our office and paid people to read prompts wearing our glasses, to pretrain our models on. This produced a beautiful scaling curve, with errors falling quickly as we scaled our dataset and cross-user performance becoming genuinely compelling (as you see in the video above; Dave only had a short 20-sentence calibration).

We always heard about building things from first principles but never understood it before this. We tried tackling it top down but completely failed. Only when we broke each component (the antenna, electronics, ML) down to its fundamentals to understand and optimize it did we get it to work really well.

Over the next few months we’re continuing R&D to turn our prototype glasses into the slick product on our website and ship in Q1 2027. We’re also scaling up our dataset to improve performance on edge cases.

For anyone who loves voice dictation but hates using it around people, we’ve opened preorders for our first batch of 500 units, with a $200 discount off the final price. Allocation is running out quickly, so get yours at https://subvocal.co/preorder!

The Daily Front Page 4 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — The Occupation
article

OccupySaaS

by misswaterfairy·▲ 497 points·308 comments·occupysaas.com ↗
The software built by the 99% belongs to the 99%.

OccupySaaS is a protest movement written in code. Laid-off engineers, armed with AI and public documentation, are building clean-room, open-source, drop-in replacements for the platforms that rent our own industry back to us — one seat at a time.

See the first releases Join the occupation

The software built by the 99% belongs to the 99%.

In 2011, Occupy Wall Street asked who the economy was really working for. In 2026 we're asking the same question about the cloud. The tools every company runs on are now toll booths — and the people who built them were shown the door.

Per-seat pricing is a tax on growth

Every hire, every intern, every contractor — another line item. Infrastructure shouldn't charge rent by the head.

Lock-in is not a feature

Proprietary APIs, export walls and surprise price hikes keep customers captive. Compatible open alternatives set them free.

They cut us. We commit.

A million engineers were let go while the platforms kept growing. We still know how to ship. Now we ship it in the open.

Clean room. AI rebuild. Drop-in.

We don't leak, decompile or copy anyone's code. Every project is rebuilt from public documentation and open standards, with AI doing the heavy lifting on the build side of a strict firewall — then proven compatible against the vendors' own public SDKs.

  1. Read the public record

    Public API references, open standards (OAuth 2.0, OIDC, REST) and published SDK behaviour become a written specification. Nothing confidential, nothing leaked, nothing from former employers.

  2. Raise the firewall

    Spec writers and builders stay separated. Each repo carries a CLEAN_ROOM.md policy, and provenance is recorded for every fixture and reference.

  3. Rebuild with AI

    AI agents implement from the spec alone — contracts first (openapi.yaml), then code, then tests — under human review at every merge.

  4. Prove compatibility

    A compatibility laboratory runs the vendors' own public client SDKs against our server. If your existing code doesn't work unchanged, it isn't done.

  5. Release it to everyone

    Apache-2.0. Self-hostable. Pluggable storage. No telemetry you didn't ask for, and no seat counter.

Allowed in →

  • Public API docs
  • Open standards & RFCs
  • Public SDK behaviour
  • Black-box test results

× Never allowed

  • Leaked or proprietary source
  • Decompiled binaries
  • Former-employer confidential info
  • Copied UI assets or trademarks

Two towers occupied.

Identity and CRM: the two subscriptions almost every company pays for and almost nobody loves. Both are early, both are public, and both welcome contributors today.

ZeroAuthy

Replaces Auth0

A self-hostable identity server that speaks the Auth0 Authentication API. Point an existing Auth0 SDK at a ZeroAuthy tenant domain and it works with no code changes.

  • OIDC discovery, JWKS & multi-tenant domains
  • Hosted login, authorization code + PKCE
  • client_credentials, rotating refresh tokens, revoke & logout
  • Verified with auth0-spa-js, auth0-react & nextjs-auth0
# build & run
$ go build -o bin/zeroauthy ./cmd/zeroauthy
$ ./bin/zeroauthy serve --config config.yaml
$ curl https://localhost:8443/.well-known/openid-configuration

View on GitHub Clean-room policy

SalesCompel

Replaces Salesforce

A free, open-source Salesforce replacement with a tenant-isolated Go/PostgreSQL core, a Vue record editor, and a compatibility laboratory that checks behaviour against Salesforce's public API contract.

  • Persistent Account & Contact CRUD
  • Object describe and limited queries
  • External-ID upsert & bearer authentication
  • OpenAPI 3.2 REST contract & offline test lab
# run the compatibility laboratory
$ npm ci --prefix compat/clients/node --ignore-scripts
$ npm --prefix compat/clients/node run check

View on GitHub Clean-room policy

Who's next?

Every category on this board is a monthly invoice somewhere. The movement picks the next target in public — bring a spec, a use case, or a grudge.

Identity & Auth

ZeroAuthy — Auth0-compatible login, tokens and tenants.

CRM

SalesCompel — Salesforce-compatible records and REST API.

Docs & Wikis

Team knowledge bases that don't lock your writing behind a seat licence.

Issue Tracking

Tickets, sprints and boards with a compatible API for existing integrations.

Feature Flags

SDK-compatible flag evaluation you can run next to your own services.

Observability

Logs, metrics and traces without per-gigabyte ransom notes.

Customer Support

Help desk, inbox and knowledge base, priced at zero agents.

Propose a target

Proposed categories are open for discussion, not commitments. Names of existing products are used only to describe compatibility.

From Zuccotti Park to git push.

Occupy Wall Street began on 17 September 2011 in Zuccotti Park, New York City, with a simple frame: the 1% and the 99%. It had no leaders, made decisions in open assemblies, and spread to hundreds of cities.

OccupySaaS borrows that spirit and swaps tents for terminals. No marches, no property damage — just working software, published under an open licence, that anyone can run.

“We are the 99%.”

— Occupy Wall Street, 2011

  1. 17 Sep 2011 Occupy Wall Street begins

    Protesters set up camp in Zuccotti Park in Manhattan's Financial District.

  2. Oct 2011 The movement spreads

    Occupy camps and general assemblies appear in cities around the world.

  3. 15 Nov 2011 Zuccotti Park is cleared

    The camp ends; the language of the 1% and the 99% doesn't.

  4. 2022 – 2025 The great tech layoffs

    Wave after wave of cuts across the industry while subscription prices keep climbing.

  5. 14 Oct 2026 ZeroAuthy goes public

    The first clean-room rebuild opens its repo under Apache-2.0.

  6. 15 Oct 2026 SalesCompel joins the occupation

    The second tower. More to come — decided in the open.

Occupy everything.

You don't need permission, a badge or a manager. You need a laptop and an afternoon.

Write code

Pick an open issue, follow the clean-room policy, open a pull request.

Self-host it

Run a release against your real SDKs and tell us exactly where it breaks.

Write specs

Turn public docs into precise, testable specifications for the builders.

Make noise

Star the repos, share the site, and tell your CFO what you're paying per seat.

Join on GitHub Join on Discord Propose a target

Fair questions.

Is this legal?

Clean-room reimplementation is a long-established way to build compatible software: you work only from public information and independently write your own code. Interoperating with an API is not the same as copying a product. Each project publishes its clean-room policy and source provenance so anyone can check the work. This page isn't legal advice; if you're adopting a project for a business, talk to your own counsel.

Are you affiliated with Auth0, Okta or Salesforce?

No. OccupySaaS and its projects are independent and not affiliated with, endorsed by, or sponsored by any vendor named on this site. Product names are used only to describe compatibility.

Can former employees of those companies contribute?

Yes, but never with confidential knowledge from a former employer. Contributors work only from public material, and anyone with relevant inside knowledge should stay on the public-spec side of the firewall or sit that project out. When in doubt, read the project's CLEAN_ROOM.md and ask first.

Why use AI to build it?

Because the giants had thousands of engineers and we have a movement. AI agents let a small group turn a precise spec into working code quickly. Humans write the specs, review every change, and own the result, and compatibility tests against real SDKs decide what counts as done.

Why Go?

Portability. A Go project compiles to a single self-contained binary, so self-hosting means dropping one file onto a server or into a Docker or Podman image — no installer, no runtime to set up, no tree of shared libraries to keep in sync. The same toolchain cross-compiles for Linux, macOS, Windows, x86 and ARM, and the result fits in a minimal container image. If you're leaving a SaaS vendor, the replacement should be this easy to carry.

Why not Rust?

Nothing is wrong with Rust, and we're not against it. Go was picked for the first projects because it makes the one-file, container-friendly drop-in the default with very little build setup. Rust can get there too; Go just gets there more simply for the kind of servers we're building.

Rust recreations of these projects are welcome — they just haven't been made yet. The specs, API contracts and compatibility tests are language-neutral, so a Rust port can be checked against the same SDKs. If you want to start one, open an issue and say which project.

Is it production-ready?

Not yet. Both first projects are early and say so plainly in their READMEs, along with exactly which features work today. Try them, break them, and file issues.

What does it cost?

Nothing. Every project is released under the Apache License 2.0. Run it, fork it, sell services around it. The only thing we ask is that you contribute back what you can.

The Daily Front Page 5 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — Save What You Love
article

If you love a website, back it up

There’s something a little cozy about checking in on them every now and then to see an old friend is still doing okay.

This story starts with a little tragedy. See, I’ve got these old webpages I love to go back and look on every now and then. There’s websites that have been online unchanged for years and years, or decades, and there’s something a little cozy about checking in on them every now and then to see an old friend is still doing okay. Sometimes, of course, tragedy strikes.

There was this fansite called teapuppies.com for an old anime series and and toy line called Ochaken. It’s about these cute cartoon dog characters who have tea leaves for ears, each of them named after a different kind of tea.1 The site had been online since 2004 and had basically not changed since 2005, but it was nice just having it around. Except when I went to visit it a few weeks ago, and discovered that not only was the site gone but the domain is now being used to serve online gambling ads.

I work in web archiving, by the way. Which is to say that I should have known the site would go offline someday, and that I have the tools to have done something about it. I could have archived that site while it was still around, but I didn’t. This post is here to beg you to do what I didn’t think to, and to teach you how.

You see, when I talk to a lot of people about web archiving, they always seem to believe it’s something they couldn’t do. It’s something a big organization like the Internet Archive does, and if you want a webpage to be saved you just have to wait and hope it gets done. But that’s not true! What I really want everyone to know is that you have control over the world around you, you can take action to preserve things and make things better. And not just can, but should! Don’t just wait for someone else to act - get out there and and make it happen! Got a favourite site? Back it up! Got some information you don’t want to get lost? Back it up! Favourite post somewhere? All together now. Back! It! Up!

All of the tools I’ll be showing off in this post use standard web archiving formats like WARC2. You don’t have to worry about any of the technical details3, but I’m telling you that because it means there are a lot of really great tools to do whatever you want with them. Here, just as an example, is an entire archived website embedded right in this blog post:

You can even click through all the links, look at all of the images, the works. It’s an entire website right in a post! (And if you don’t trust me to keep this up, and you want the web archive to host somewhere else? You can download it for yourself right from there. Just click the kebab menu and choose “download archive”, and you can do whatever you like with it. In fact, please do!)

By the way, for disclosure: the tools I’m going to mention in this blog post are made by the company I work for, but that’s not because they’ll pay my salary (most of them are free!). I just happen to think these are the best tools there are for personal web archiving.

Option 1 - ArchiveWeb.page browser extension

By far the easiest personal web archiving tool is the ArchiveWeb.page browser extension for Chrome. This doesn’t take much in the way of setup or technical skills, and it works for anything: a single page, an entire website, a social media post or profile. So long as you can see it in a web browser, you can save it. All you really need to do is:

  1. Install the browser extension.
  2. Visit the first page you want to archive.
  3. Click the ArchiveWeb.page icon in the toolbar, then click “Start Archiving”.
  4. If your page has any interactive elements, click on those to make sure all their data loads.
  5. Visit any other pages you want captured in the same collection and let the extension grab them.
  6. Click the ArchiveWeb.page icon in the toolbar, then click “Stop Archiving”.

You’re done! You just archived a web page! Now that it’s all saved, you can preview it and see how it went by clicking the extension’s icon and then the home icon to open the extension dashboard. From there, you can click on your archiving session to preview the pages you archived, load them in browser, and see if they work. (I’ll go into more details on how you can look at web archives and share them with others later in this post.)

Option 2 - archiveweb.page app

If you don’t want to install a browser extension, or you don’t have Chrome installed, you can also grab the standalone archiveweb.page app. This is basically the same thing as the browser extension above, it just has its own web browser built in. It also opens straight to the menu that lets you browse your web archives, so it’s a handy way to look at your web archives locally. Pretty much everything else I described above applies.

Option 3 - Browsertrix

The above options are great for single pages or sites that are small enough for you to browse manually. But if you’ve got a webpage that’s big enough that it’s going to be annoying visiting all of the pages by hand, you probably want to look at a web crawler tool for web archiving. There are a bunch of options out there, but the easiest to use as an individual is probably Browsertrix. A web crawler is basically an automation tool built around a web browser; you provide instructions on what page to start from and what pages it should visit, and it will go ahead and click links to automatically find pages so that it can archive the page as completely as possible. The web archive I embedded above was done using Browsertrix on pretty close to its default settings: I just told it I wanted to do a site crawl for the entire domain https://teapuppies.mistys-internet.website, and it worked it out from there:

Screenshot of the Browsertrix interface, depicting a crawl scope of "Pages on the same domain"

But, depending, on what you’re looking for, it has options which can be customized to narrow down what content it archives. For example, if you decided you only want pages for the episodes, you could tell it to only capture anything at the /episodes/ section of the website:

Screenshot of the Browsertrix interface, depicting a crawl scope of "Pages in the same directory" with a seed of https://teapuppies.mistys-internet.website/episodes/

Or even just a single page and anything that page links to:

Screenshot of the Browsertrix interface, depicting a crawl scope of "Single page" and the checkbox "Include directly linked pages" selected

There are a lot more options than I can go into in a quick overview - it’s a comprehensive tool with a lot of options. But if you’re looking to archive a whole website, or a complete social media profile, I’d recommend giving it a try.

Unlike the other tools, which you mainly run on your own computer, Browsertrix is primarily a web app. It’s also the only paid tool in this post - there’s a seven day trial, but after that you do have to pay per use. Since it’s open source, though, technically inclined users can run their own copies on their computer or deploy a copy somewhere if they like.

Viewing your archived webpage

Once you’ve actually backed the site up, you can replay it to use it in your browser just like a live webpage. It’s kind of like having your own private version of the wayback machine. You can test it out yourself for your own private use using the interface built into the version of archiveweb.page you used, but if you want to share it with someone else you have a few options. If you want to share it with someone privately, you can send them the WARC/WACZ file and let them load it into the ArchiveWeb.page app or the ReplayWeb.page website. If you want to share it with the world, though, you can set up a website with your web archive on it.

This post is using the ReplayWeb.page embedded viewer, which is open source and can be embedded inside any other web page you want. You don’t have run any kind of app on your server to do this; as long as you have the ability to upload the archive and a little bit of JavaScript, you can easily add a copy of the replay interface into any web page or blog post.

Preserving the data once you have it

Since everything you backed up is bundled inside a single WACZ file, it’s really easy to keep safe - or share with someone else. Lots of copies keeps stuff safe, after all; if you think you have friends who’d like to hold on to a copy of whatever site you’ve backed it up, pass it along and share the duty of preserving it!


If any of this sounds interesting to you, I’d encourage you to at least give it a try. I’d love for the world to be filled with thousands upon thousands of little web archives, with people and community groups archiving and sharing the things that matter to them for themselves. If you’re finding any of this overwhelming, and you’re not sure where to get started, please reach out to me - I’m very happy to give you a hand.


  1. The appeal to me is, I hope, obvious. ↩
  2. Most of the tools I’m mentioning also use the WACZ format, which packages up WARC files along with extra metadata. ↩
  3. For those who want a little extra technical detail, though: one of the things that makes WARC special is that it records complete information about requests and responses, including all headers. This gives WARC a much more complete view of the whole process of visiting a website, and makes it possible to archive even complicated sites with client-side JavaScript that make a ton of requests. ↩
The Daily Front Page 6 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — The Freezer Alarm
article

Supermarket freezers across Europe hit by second suspected cyber-attack

by fergie·▲ 378 points·421 comments·theguardian.com ↗
Cooling unit temperatures rose overnight to as high as 50C.

Chains in seven countries say cooling unit temperatures rose overnight in incident similar to hack of French shops

A woman throws items from a supermarket trolley in to a skip

A worker at ICA’s Sjöbo supermarket in southern Sweden throws away spoiled goods after its cooling units overheated. Photograph: Johan Nilsson/EPA

Supermarket chains in at least seven European countries have said the temperatures of refrigerators and freezers in some of their shops soared overnight to as high as 50C (122F), echoing a cyber-attack last month that caused millions of euros of damage in France.

Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems with their refrigeration systems on Monday, and several companies confirmed they had been hacked.

The EU food and agriculture commissioner, Christophe Hansen, said the repeated cyber-attacks were deeply concerning, calling them “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.

The incidents follow an attack in France last month in which hackers seized control of cooling units in as many as 700 supermarkets, raising their temperatures as high ⁠as 50C (122F) and causing fires and food losses estimated in the tens of millions of euros.

A growing range of devices, including refrigeration systems, can now be monitored and controlled remotely, leading authorities to particularly fear government-sponsored hybrid attacks ​in after Russia’s 2022 invasion of Ukraine.

Sweden’s Coop chain told the daily Aftonbladet that six of ​its shops ‌had been ​hit, while ICA said it was “aware that a limited ​number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems”.

An ICA shop at Sjöbo in southern Sweden posted that its fridges and freezers had been hacked and their temperature set at 50C. Another in Stockholm said its freezers were broken “due to a 2am cyberattack” and that “everything was destroyed”.

Two supermarket trolleys full of spoiled produce in the foreground, and behind three workers emptying fridges

Workers at ICA’s Sjöbo shop empty fridges of spoiled produce. Photograph: Johan Nilsson/TT/Reuters

The head of Sweden’s national cybersecurity centre, John Billow, said it ‌was working on incidents around the country. It had established the country had “quite a lot of exposed operational ‌technology devices” that needed updating or patching, he told Reuters.

The Dutch retailer Ahold Delhaize, which last ​month ​reported a ​similar incident ​to police in the Netherlands, said fridges and ⁠freezers in dozens of its ⁠supermarkets in ​Belgium ‌and ‌Luxembourg had been hit.

It did not specify the cause, but reporters visiting a shop north-east of Brussels saw refrigerators and freezers empty and a sign reading: “Due to cyberattacks, there will be no products on the refrigerated or freezer shelves. We offer our sincere apologies.”

A company spokesperson, Sarah ‌De Meester, said the range of fresh and frozen products was “temporarily somewhat limited” in affected shops, but that distribution centres were operating normally and there was no disruption to deliveries.

Empty fridges in a supermarket

Empty fridges in a Delhaize supermarket near russels. Photograph: Maude Brulard/AFP/Getty Images

Belgium’s Le Soir newspaper reported that dozens of shops and supermarkets had been affected, including five Spar outlets, Shop & Go convenience shops attached to Q8 service stations and some smaller Proxy Delhaize mini-markets.

“We started mobilising technicians at 1am,” Stephan Moelans, the chief executive of Sabcobel, which operates Delhaize’s refrigeration systems, told the paper. “We spent all night and morning disconnecting the affected installations.”

He told the Belga news agency the ‌incident had been a cyber-attack and that the units’ evaporators were switched to defrost mode.

The Colruyt and Intermarché supermarket chains also said they had been hit by technical problems affecting fridges in five and 15 of their shops respectively, and Carrefour Belgium reported disruption in about 15 of its 700 shops.

“It’s a cyber-attack, there is no other reason,” said Mich Vergauwen, a Carrefour spokesperson. An Ikea Belgium spokesperson likewise told Agence France-Presse that a cyber-attack had caused the temperature of freezers in its Mons shop to rise suddenly.

Ikea, famous for its in-store Swedish meatballs, said it had had to ‌remove some food products from refrigeration units ​as a precaution and expected some food waste as ⁠a result.

In Finland, the Helsingin Sanomat newspaper said shops operated by the Kesko supermarket chain were investigating similar problems, while the Dutch public radio NOS reported that the systems of at least 17 mainly small local shops had been affected.

At one Estonian supermarket chain, attackers accessed a computer controlling the refrigeration system and turned up the temperature to 50C, the refrigeration supply company Kitman Coldtech told the ERR broadcaster.

“This is very fresh, it happened this morning,” its chief executive, Jann Mutso, said, adding that the attack was responded to within minutes and there had been no significant damage. The Selver supermarket chain said one of its outlets had been affected.

Ireland’s third-largest supermarket ⁠chain, ⁠SuperValu, said ​refrigeration systems limited ⁠to ​a ‌specific ‌model ‌in 13 of its 223 shops ​had been affected by ​a cyber-incident, ⁠and that chilled and ​frozen products ​had been removed from ​sale.

A woman with her back to the camera looks at an almost empty refrigerated display

A customer surveys an empty refrigerator at a SuperValu supermarket in Dublin. Photograph: Reuters

Many cyber-attacks involve extortion or are politically motivated and are potentially carried out by state-level actors, said Tom Hegel of the cybersecurity firm SentinelOne. But the supermarket attacks, with no financial demands, point to sabotage, he said.

“Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear,” Hegel told Reuters.

Patrick Lamplmair of the cybersecurity firm Tributech said cyber-attackers would keep going “until it stops working” because the method was “cheap and the damage is immediate”. Many refrigeration systems had known and as yet unfixed flaws, he said.

“Thousands of these controllers were still reachable from the internet after the French attack,” he added. “A few commands to a temperature controller can destroy stock overnight and close stores.”

In the French attack, the hackers pirated controllers mostly supplied by the Danish company Danfoss, which said subsequently that it had identified some security flaws last year and had “long recommended” customers install updates.

The hackers remotely overrode the settings on thousands of freezers, fridges and chiller cabinets at chains including Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix, pushing them from as low as -27C to well over 50C.

The shops had to discard vast quantities of fresh meat, dairy and frozen products. Individual supermarkets reportedly suffered losses ranging from tens of thousands of euros to more than €130,000 (£109,000).

The Paris prosecutor’s office has opened a formal investigation into the French attack and the prime minister, Sébastien Lecornu, instructed France’s national cybersecurity agency, Ansii, to investigate.

The agency subsequently reported that supermarkets using controllers from two other companies had also been targeted in the attack, but authorities have not indicated who could have been behind the incidents. There have been no claims of responsibility.

The Daily Front Page 7 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — The Anthropic Ledger
article

Anthropic reports $17B in Q3 revenue, commitments of $895B in revised S-1

by rebel·▲ 228 points·269 comments·cnbc.com ↗
The company said it generated $33.24 billion in revenue for the nine months ended Sept. 30.

Key Points

  • Anthropic reported updated financials as part of an amended Form S-1 filing with the Securities and Exchange Commission.
  • The company said it generated $33.24 billion in revenue for the nine months ended Sept. 30, up roughly 1,200% from the same period last year.
  • Anthropic unveiled its highly anticipated prospectus last week, but the initial filing only included the company's financials through the first half of the year.

Anthropic releases amended IPO prospectus with third-quarter financials

Anthropic reported updated financials as part of an amended Form S-1 filing with the Securities and Exchange Commission on Monday, giving investors a more comprehensive look into the state of its business.

The artificial intelligence company said it generated $33.24 billion in revenue for the nine months ended Sept. 30, up roughly 1,200% from the same period last year. It reported a $104 billion net loss during the period, though most of that was due to the change in fair value of convertible notes and derivative liabilities. Anthropic had a loss of $25.1 billion over the same stretch in 2025.

Anthropic unveiled its highly anticipated prospectus last week, bringing the company one step closer to a potentially historic initial public offering. The initial filing only included the Claude maker's financials through the first half of the year.

During its third quarter, Anthropic generated roughly $17 billion in revenue, up about 1,127% from the same period last year. Revenue growth slowed on a quarter-to-quarter basis, however. Third-quarter revenue increased around 47%, a steep drop from 144% growth in Q2 and 132% in Q1.

The company reported a net loss of $23.29 billion during its third quarter.

As the 5-year-old company prepares to kick off its roadshow, it will have to reckon with growing market jitters around the AI buildout. Wall Street has been worried that rising interest rates will make debt unaffordable for many data center developers and neoclouds, and quarterly reports from Microsoft, Alphabet and Amazon last week added fuel to those concerns.

The hyperscalers' aggressive AI spending is eating into their cash flows, causing some investors to worry that computing capacity may not come online quickly enough to meet Anthropic's demands. Anthropic gets much of its capacity from Amazon, Google and SpaceX, but it also relies on neoclouds for some compute as it races to expand as quickly as possible.

In the amended S-1, Anthropic said it has entered into purchase commitments and lease agreements with an aggregate committed spend of about $895.4 billion, "substantially all of which is related to compute and infrastructure."

Anthropic said its compute and infrastructure expenses increased by $14.4 billion for the nine months ended Sept. 30, up 329% compared with the same period last year.

"As our compute and infrastructure capacity grows, the associated compute and infrastructure expenses have increased," Anthropic said in the filing.

The company's CEO, Dario Amodei, co-founded Anthropic alongside a handful of other researchers who defected from OpenAI, now its chief rival. OpenAI confidentially filed its prospectus with the SEC in June, but its executives have signaled that it's aiming for a 2027 debut.

Anthropic has worked to position itself as more safety-conscious than its competitors, and its S-1 includes more than 90 pages of risk factors. The company highlights risks, including potential political headwinds, its complex infrastructure needs as well as the difficulties that can come from balancing safety and commercial objectives.

"We consider it our personal responsibility to help the world understand these risks, to prevent or mitigate them when they arise from our AI models, and to work with governments and the rest of the industry to address them at a societal level," Anthropic's co-founders said in the filing.

The Daily Front Page 8 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — The IPO Argument
article

The SEC Should Block Anthropic's IPO to Protect the Public

by cdrnsf·▲ 261 points·201 comments·techpolicy.press ↗
Things are seldom what they seem when it comes to the finances of the AI industry.

Anthropic CEO Dario Amodei looks on as United States President Donald Trump holds a press briefing with AI executives following a meeting on artificial intelligence, outside the West Wing of the White House on September 29, 2026 in Washington, DC. (Photo by Kevin Dietsch/Getty Images)

Things are seldom what they seem when it comes to the finances of the AI industry. The AI ecosystem’s circular business dealings, extensive use of financial engineering, and otherwise murky finances make it hard for investors, regulators, or workers saving for retirement to get an accurate financial picture of AI companies.

That is particularly true of Anthropic, which filed the registration statement for its initial public offering (IPO) last week ahead of a planned November stock market debut.

The company’s topline financial figures look quite impressive for a startup, with revenues that appear to have grown quickly over the course of 2026 and a fairly healthy balance sheet — on the surface, that is.

Dig a little deeper, however, and a far bleaker picture emerges. Footnotes to the company’s most recent financial disclosures revealed nearly $900 billion in spending commitments, most of them stretching into the 2030s. The company’s financial results for 2026 have not been subjected to formal auditing, which makes them less-than-reliable, but the third-quarter results suggest that the company’s revenue growth slowed to a crawl over the summer.

Anthropic will have to reverse that trend and sustain extraordinary revenue growth to meet its vast obligations. But the financial pressures that are squeezing Anthropic — and, indeed, the AI industry as a whole — will make it exceptionally hard for the leading model developer to do so. If the company goes public, workers, retail investors, and retirees will increasingly be left holding the bag when Anthropic’s bills come due.

The financial mountain that Anthropic must climb is unprecedented for a company making its stock market debut. While Anthropic has an impressive $96 billion in cash reserves, its amended registration statement reveals at least $582 billion in non-cancelable spending commitments to just five companies (Amazon, AMD, Broadcom, Google, and Microsoft) to gain access to the vast computational power required to train and run Anthropic’s generative AI models.

Even though they do not appear on Anthropic’s balance sheet, those obligations are effectively debts in a legal and practical sense: they are payments that Anthropic is contractually required to make in the future, regardless of whether the company can afford to do so.

Moreover, it is not clear how much of the remaining $300 billion or so of the $895 billion in contractual commitments will ultimately land on Anthropic’s balance sheet. With the company continuing to negotiate further massive infrastructure and compute contracts, Anthropic may well end the year with a trillion dollars or more in contractual commitments.

Generating the revenues necessary to meet those obligations would be, to say the least, quite difficult for any company. But the margins of AI model developers are being squeezed by several forces that will make that task extraordinarily challenging for Anthropic.

Key forces squeezing the AI industry’s margins

First, it isn’t clear that there is nearly enough demand for generative AI products and services to justify Anthropic’s spending. Multiple studies, including from organizations notable for their bullishness on AI, suggest LLMs are not accelerating productivity or otherwise generating positive returns on investment for most businesses. Worryingly for enterprise-focused Anthropic, one study found that the number of Americans using AI at work fell significantly between the summers of 2025 (46%) and 2026 (33%).

Anthropic’s spending commitments suggest that the company believes it will be able to convince businesses to pay for ever-larger and more expensive models. But there are growing signs that most businesses are not interested in paying for more powerful and expensive models. When Anthropic released its much-hyped Fable 5 frontier model this summer, its commercial reception was tepid.

Even if a future Anthropic model captivates businesses, the company would run into a second obstacle: the AI industry’s frenzied competition. Anthropic is part of a crowded Silicon Valley ecosystem where numerous well-heeled corporations (including Google, Meta, Microsoft, OpenAI, and SpaceX, along with Anthropic) offer generative AI models that are largely indistinguishable in their quality and capabilities. As a result, AI companies can quickly offer competing products whenever a rival identifies a use case that shows even a hint of commercial potential.

In such an environment, companies can rarely afford to raise prices because doing so will prompt customers simply to switch to a rival. The rush to grab customers ahead of their IPOs led Anthropic and OpenAI to launch a price war this summer that remains ongoing. Competition from Chinese companies offering open-weights models puts further downward pressure on prices, as does the increasing availability of models that can run locally on phones and laptops — no expensive data centers required.

That leads to the third problem: the extraordinarily high costs of the chips and data centers needed to train and run AI models, which put powerful and continuous upward pressure on Anthropic’s costs. Between the chips, servers, networking equipment, electricity and cooling infrastructure, construction costs, and other expenses, a 1 gigawatt (GW) data center costs an estimated $31 billion, and the prices for some components are soaring.

That is for 1 GW. Anthropic has committed to 15 GW of data center capacity in the coming years and the company estimates it will ultimately need 20-25 GW, which explains the company’s half-trillion-plus dollars in spending commitments.

And that is just the cost of the physical infrastructure. Once a data center is up and running, training AI models entails using tens of thousands of chips running in parallel that require massive amounts of energy to power, run hot, and need to be kept cool. Moreover, each time someone prompts a model to answer a question, create an image, or perform a task, additional computational power, energy, and cooling are needed to process the query and generate a response or complete the task.

Finally, there are external factors that are delaying data center construction and piling on additional costs. The fierce and still-rising backlash to AI in general and data centers in particular across the country has scuttled a number of data center projects and delayed many others. Every delay limits the computational capacity Anthropic is counting on to generate the revenue it will desperately need, and rising costs due to the Iran War and supply-chain challenges could drive Anthropic’s operational costs still higher.

Anthropic will further pad its cash reserves if its IPO is successful, but the brutal economics of its business are not likely to improve anytime soon. Even if demand picks up significantly, intense competition will apply unrelenting downward pressure on prices even as high costs and resource constraints squeeze it from the opposite direction. That is a deadly mix for Anthropic in light of its slowing revenue growth and massive off-balance-sheet debts, a vast and immovable fixed cost.

If Anthropic were to go public now, it would pile additional risk onto a stock market that is already historically overvalued and disproportionately concentrated in a handful of tightly interconnected mega-cap companies from the tech sector. That has already created a risk of a historically damaging stock market crash; never before has such a huge amount of wealth depended on the performance of a small number of companies whose fortunes are inextricably linked. Adding another huge, unprofitable tech giant to public exchanges would exacerbate both of those factors and create a higher risk of contagion if (or, rather, when) Anthropic reaches a financial precipice.

It also would mean that an ever-larger share of the fallout from a potentially devastating AI crash would fall on ordinary people. As a private company, Anthropic’s shares are overwhelmingly owned by corporate insiders, tech giants, and venture capitalists. Once the company goes public and shares start getting funneled into 401(k)s, retirement accounts, and index funds, it will be workers, retirees, and retail investors that are increasingly left holding the bag when the forces squeezing Anthropic’s margins start to bite.

The Securities and Exchange Commission (SEC) has the power to stop that from happening. The agency can delay or stop companies from going public if it believes a company’s registration statement is “on its face incomplete or inaccurate in any material respect.” That legislative language might as well have been written with Anthropic in mind, considering that the company’s prospectus includes only unaudited financial results for the period where it claims the greatest revenue growth, relegates its most significant future obligations to the footnotes of its registration statement, and has continued to announce new 11-digit financial commitments as its IPO approaches.

The SEC should block Anthropic’s stock market debut until the company provides two consecutive quarters of audited financial statements, with all material information about the company’s spending commitments disclosed. Failing to do so could have dire consequences for workers, investors, and ultimately the financial system and economy.

The Daily Front Page 9 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — Growth Under Glass
article

Anthropic's growth just flattened

by cdrnsf·▲ 190 points·216 comments·regenerator1.com ↗
At first glance, this number seems astonishing.

Look at the monthly numbers...

Source: Regenerator estimates and news reports.

Anthropic shared high-level Q3 financials with investors yesterday, report the NYT’s Andrew Ross Sorkin, Lauren Hirsch, and Sri Muppidi.

Revenue for Q3 was reportedly $16.8 billion.

At first glance, this number seems astonishing. And, in one sense, it is. It’s another jaw-dropping sequential gain for what is likely the fastest-growing company in history.

But, break the trend down into implied monthly growth, and the picture looks different.

Specifically, it seems Anthropic barely grew from July to September.

Anthropic’s sequential revenue growth in Q3, moreover, was smaller in absolute dollars than its (gobsmacking) growth in Q2.

So, for several possible reasons, Anthropic’s growth has meaningfully slowed.

This is likely another reason why the stocks of “neocloud” providers like CoreWeave are collapsing. CoreWeave, et al, have borrowed tens of billions of dollars on the assumption that demand for AI compute will continue to grow at rates way beyond consensus expectations for years.

Now, not only are interest rates soaring — raising the carrying costs of this debt — the near-term revenue growth for AI services may be flattening.

Analyzing Anthropic’s growth…

Anthropic’s reported revenue growth this year has been unprecedented:

Q1: $4.8 billion
Q2: $11.6 billion (+$6.8B and +141%, sequentially)
Q3: $16.8 billion (+$5.2B and +45%, sequentially)

Again, these numbers are astonishing.

But so are AI valuations and expectations.

Note that Anthropic added more revenue in Q2 than it did in Q3.

Note, too, that what matters most for Anthropic’s IPO valuation — and, likely, for the future trajectory of the AI bubble — is not what has happened but what will happen.

The key question is, “What do these numbers suggest about how fast Anthropic will grow from here?”

These figures suggest that the market should temper its expectations, at least temporarily.

If we break down the quarterly figures above into monthly estimates and add one more reported data point — that Anthropic had a $65 billion annualized revenue run-rate in July — we see that Anthropic’s growth has flattened even more than the quarterly figures suggest.

Below are back-of-the-envelope estimates for Anthropic’s monthly revenue in 2026. They are based on the reported quarterly revenue figures as well as the $65 billion annualized revenue in July (which equates to ~$5.4 billion of July revenue).

Even the quarterly numbers suggest that Anthropic’s average monthly growth slowed from ~$760 million in Q2 to (“only”) $580 million a month in Q3.

But the “$65 billion annualized revenue in July” data point suggests the slowdown is even sharper.

If Anthropic did $5.4 billion in revenue in July and $16.8 billion in Q3, it likely only grew modestly in August and September.

According to DealBook, at its meeting with investors yesterday, Anthropic did not share an annualized revenue number based on September’s revenue. This suggests — to this analyst, anyway — that Anthropic did not think the September annualized revenue figure would show impressive-enough growth versus July.

Indeed, when we extrapolate the monthly figures, it seems Anthropic saw a sharp change in its growth trajectory in August and September.

What does this mean?

It means that the growth of the leading company in the sector appears to have slowed sharply in the past two months.

The slowdown might at least in part be the result of seasonality. August, at least, tends to be a slow month. But it’s early in a product cycle to see such sharp seasonality. And September’s growth should have sped back up.

It might also mean that Anthropic is simply not able to keep up with the growth of demand. If this is the reason for the slowdown, it’s a high-quality problem, and it won’t have a long-term impact on the overall AI spending growth trajectory (or bubble).

But it may also mean that the near-term growth rate of AI spending is moderating — either because demand growth is moderating or because companies are using cheaper models from China for some of their AI needs. (Usage data suggests the latter is in fact happening).

If a slowdown in spending growth is the explanation, we should expect the wild investor enthusiasm for all things AI — and the colossal infrastructure spending growth supporting it — to also begin to moderate.

The end of all bubbles comes when supply begins to catch up with demand.

Anthropic’s apparent slowdown suggests we may be closer to reaching that moment.

The Daily Front Page 10 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — The Export Ledger
article

China's First Frontier AI Export Controls: Mofcom Announcement No. 48

by jonnybgood·▲ 152 points·86 comments·labs.cloudsecurityalliance.org ↗
The announcement proposes adding 40 technologies to the catalogue of technologies prohibited or restricted from export.

Key Takeaways

On October 16, 2026, China’s Ministry of Commerce (MOFCOM) and Ministry of Science and Technology (MOST) issued Announcement No. 48 of 2026. The announcement proposes adding 40 technologies to the Catalogue of Technologies Prohibited or Restricted from Export, 23 of them in artificial intelligence, and it imposes an interim pre-export registration requirement that is already in effect [1][2]. China’s catalogue has touched AI before: the 2020 revision added personalized recommendation and AI interaction interface technology [6]. Unlike those 2020 additions, the draft reaches frontier model weights, agent architectures, and AI-enabled offensive cyber capability, with explicit technical thresholds for each [1].

The announcement contains two instruments with different legal status. The catalogue additions are a draft open for comment until November 15, 2026, while the registration requirement applies now, including to exports that have started but are not yet complete [1][2]. Within the draft, model weights are restricted at frontier scale. Weights, key checkpoints, source code, architecture, and training and inference optimization know-how are restricted if a model meets any one of three tests: at least 10^26 FLOPs of training compute, at least 2 trillion parameters, or a global top-10 position on public evaluation rankings, global call volume, or comparable measures at the time of export [1][3]. Agents are controlled independently of the model. Planning, multi-agent coordination, tool use, and game-theoretic decision technologies are restricted above set benchmarks, and high-performance agents built for critical infrastructure, defense, or core government use are prohibited outright [1].

The line between service access and custody determines most enterprise exposure. MOFCOM says API, app, web, SaaS, and lightweight on-device use do not count as exporting a large model. Deploying a restricted model locally outside China does count, though automatic licensing may apply on a Chinese company’s own overseas cloud [2]. Multinationals also face exposure through licensing deals and changes of ownership or control, not only through product exports, and analysts read the registration form as potentially capturing intra-group code sharing as well [2][3][4]. Any transfer of ownership, licensing for overseas use, or shift of control to a foreign entity can trigger registration [2][4].

Background

China regulates outbound technology transfer under two overlapping regimes. The first is the technology-trade regime under the Foreign Trade Law and the Regulations on Technology Import and Export Administration, which governs the catalogue being revised here. The second is the dual-use export-control regime under the 2020 Export Control Law [5]. MOFCOM’s spokesperson described the revision as routine and grounded in Article 20 of the Foreign Trade Law. The spokesperson stressed that it “does not target any specific country, region, or entity” and that the aim is to prevent uncontrolled diffusion while protecting legitimate cooperation [2]. The catalogue has been revised several times since 2001. The August 2020 revision, which added recommendation-algorithm technology, coincided with the proposed sale of TikTok to a U.S. buyer and was reported as likely to complicate that deal [3][6].

Across all three sectors, Announcement No. 48 proposes 14 prohibited and 26 restricted items: 23 in AI, 5 in biomedicine, and 12 in photovoltaics [2]. In China’s technology-trade framework, prohibited technologies may not be exported at all, while restricted technologies require a license from commerce and science authorities. ChinaTalk notes that licensing is administered by provincial authorities, although central authorities have intervened in prominent cases [3]. The official annex groups the AI items into large models, agents, compute clusters, chip design, and information-processing technologies. It also excludes from management any technology that has already entered the public domain through open-source release or academic publication [1].

The interim registration requirement is the part that applies today. From the announcement date until the revised catalogue takes effect, exporters must register through MOFCOM’s unified business platform before exporting any listed technology. Registration covers four triggers: transfer of technology ownership abroad, licensing of domestic technology for overseas use, a change in ownership or control that makes a foreign entity the owner or controller, and other cases MOFCOM designates [2][4]. Exporters must decide for themselves whether a technology falls within scope. The registration form asks for recipient details, destination, technology description, end use, and estimated value [2][4].

The timing also matters for enterprises that already track U.S. controls. CSA’s prior research documented the first U.S. use of export-control authority to suspend a broadly deployed commercial frontier model [9]. Announcement No. 48 means frontier AI supply chains now face formal outbound controls from both of the largest AI-producing jurisdictions. ChinaTalk observes that the 10^26 FLOP threshold mirrors the figure used in the 2023 U.S. executive order and the since-rescinded 2025 U.S. AI Diffusion rule. The authors also estimate that no released Chinese model currently exceeds it [3].

Security Analysis

What the AI Annex Actually Controls

The annex is granular, and its structure matters for scoping. The table below summarizes the AI items drawn from the official draft annex [1], with interpretive notes from published analyses [3][4].

Category Control Key Thresholds or Conditions (draft) Large models trained on China’s “core data” Prohibited Core data scope defined by the Data Security Law and related regulations Large models trained on China’s “important data” Restricted Excludes trace use (≤0.1%) of desensitized important data that does not materially improve capability or reappear in outputs, and lawfully public data Core large-model technologies (weights, checkpoints, source code, architecture, training and inference optimization) Restricted Any one of: ≥10^26 FLOPs; ≥2 trillion parameters; global top-10 position on public evaluation rankings, global call volume, or comparable measures at the time of export High-performance agents for critical infrastructure, defense, or core government Prohibited Agent meets the restricted agent thresholds and is specially or mainly designed for those uses Agent planning and task decomposition Restricted ≥20-step subtask chains, ≥80% decomposition accuracy, ≥90% subtask success Multi-agent collaboration architectures Restricted ≥60 concurrent agents, completion time ≤2x the single-agent minimum, ≥85% agreement with reference answers Tool calling and system operation Restricted ≥200 integrated third-party tools, ≥90% tool-selection accuracy, ≥90% end-to-end success on tasks requiring 3+ tools AI malicious code generation, adaptive evasion, and variant generation Prohibited Attack-success and automation thresholds, where usable against high-sensitivity systems AI-assisted vulnerability discovery Restricted Any of six tests, including ≥75% on authoritative benchmarks, 10x senior-expert efficiency, or autonomous chaining of 2+ low or medium flaws into a working exploit AI detection technology specially designed for cross-border data security Prohibited Detection accuracy and recall ≥95% Deepfake detection; steganography; voiceprint; Chinese and minority-language translation Restricted Accuracy, recall, latency, and fidelity thresholds (for example, ≥98% for deepfake detection) AI chip and memory chip design; large compute cluster technologies Restricted Process node ≤14 nm and other alternative criteria for AI chips; interconnect ≥800 GB/s, fault tolerance, and heterogeneous scheduling for clusters above 10,000 accelerators

Three features of this structure deserve attention from security and compliance teams. First, the “global leading” test is dynamic. A model that falls below the compute and parameter thresholds can still become restricted if its public evaluation rank, global call volume, or similar measures place it in the top 10 when the export occurs [1]. ChinaTalk calls this criterion “by far the most up-for-interpretation,” noting that the rule names no ranking body [3], and it means the compliance status of a given model version can change after deployment. Second, the agent items are defined by system behavior rather than by the underlying model. An orchestration framework that integrates hundreds of tools could meet the tool-use threshold even when it runs on a model well below the frontier thresholds, an issue Ray Sun identifies as unresolved [5]. Third, the cyber items carry direct security consequences: Chinese-origin AI red-teaming, vulnerability-discovery, and detection tools that meet the thresholds would require a license to leave China, and offensive code-generation capability could not be exported at all.

Deployment Models and Where the Line Falls

MOFCOM’s spokesperson framed the central test as whether restricted technology moves from inside China to overseas [2]. That framing produces a clear distinction between consuming a model as a service and taking custody of it, as summarized below.

Deployment scenario Treatment under MOFCOM guidance API calls, apps or websites, SaaS for overseas customers Not within large-model export management [2] Lightweight on-device deployment Not within large-model export management [2] Local deployment of a restricted model on infrastructure outside China Within export management; license required [2] Deployment on a Chinese company’s self-operated overseas cloud or compute center Automatic licensing (“report and export”) may apply [2] Open-sourcing newly developed restricted technology Automatic licensing after reporting [2] Technology already public via open-source release or academic papers Outside management scope [1]

For enterprises, the practical consequence is that the deployment model the draft captures, local self-hosting, is also the one often chosen for data-protection reasons. Organizations that chose to self-host a Chinese frontier model in their own environment, rather than call a Chinese-hosted API, did so to keep sensitive data inside their own boundary. MOFCOM places local deployment outside China within export management, which means those self-hosting arrangements require the Chinese supplier to hold a license [2]. ChinaTalk reads this as also covering on-premises licensing deals and managed deployments in which a vendor runs an agent’s reasoning loop inside a customer environment [3]. Because licenses can be revoked or conditioned, ChinaTalk suggests this may lead some non-Chinese users to reconsider such dependencies [3]. The registration requirement already covers exports in progress, so ongoing weight-delivery or model-update arrangements may be affected now rather than after the catalogue is finalized [2].

The treatment of open weights depends on whether a model is already public. Weights that are already public are outside the controls [1]. Open-sourcing a new restricted model, however, falls under automatic licensing that still requires reporting [2]. Commentators note that “open source” is not defined, and that it is unclear how restricted-use licenses would be treated [3]. Organizations that depend on successive open-weight releases from Chinese labs should therefore treat future release cadence, not just current availability, as a variable outside their control.

Exposure Through Corporate Structure

The exposure most likely to surprise multinationals sits in their own organizational charts. Registration is triggered by licensing technology for overseas use and by changes of ownership or control, not only by sales to third parties [2][4]. A multinational with China-based R&D teams building agent frameworks, vulnerability-discovery tooling, or fine-tuned models may therefore need to register before sharing that work with affiliates outside China. ChinaTalk reads the registration form’s field on exports made outside formal contracts as potentially capturing intra-group code sharing and open-sourcing [3]. This reading is an inference from the form rather than an official statement, but it is a reasonable basis for conservative scoping.

The data-based items add a second pathway. A model fine-tuned in China on operational data that qualifies as “important data” under the Data Security Law would be restricted, unless the de minimis carve-out applies. A model trained on “core data” would be prohibited [1]. Organizations that classified China-resident data under the Data Security Law for cross-border data transfer purposes may not have applied the same classification to training and fine-tuning datasets, since those obligations previously governed data transfer rather than model transfer.

Finally, recent precedent suggests that redomiciling does not remove Chinese jurisdiction. In January 2026, MOFCOM announced an assessment of Meta’s acquisition of Manus, a Singapore-registered AI agent company whose products were developed in China. The assessment examined whether the relocation of staff and technology required export authorization [7]. Announcement No. 48 now gives that line of scrutiny explicit, agent-specific thresholds, which suggests M&A due diligence on AI targets with China-origin development history should include an export-control workstream.

Recommendations

Immediate Actions

Organizations should first inventory every Chinese-origin model, agent framework, and AI security tool in use and record how each is consumed: as an API or SaaS service, as a lightweight on-device component, or as locally deployed weights or code. The local-deployment category is the priority, because it is the one the draft places within export management [2]. For each locally deployed asset, teams should ask the supplier in writing whether it has registered the export under Announcement No. 48 and whether it expects to need a license once the catalogue is final.

Legal and engineering teams should jointly review technology flows out of China-based subsidiaries, joint ventures, and R&D centers since October 16. The goal is to identify transfers that may already require registration, including code repositories, model checkpoints, and agent frameworks shared with overseas affiliates [2][4]. Organizations with a material interest in the final scope should prepare comments before the November 15, 2026 deadline, through the email, fax, or postal channels published in the announcement [1][4].

Short-Term Mitigations

Over the next one to two quarters, organizations should treat restricted-category Chinese models as regulated dependencies with documented fallbacks. Vendor contracts for locally deployed models should allocate responsibility for Chinese export registration and licensing, specify notice obligations if a license is denied, conditioned, or revoked, and address whether updates and new checkpoints are covered by the same authorization. Because the “global leading” test depends on rankings at the time of export [1], teams should not assume that a model version cleared today will remain uncontrolled for later updates.

Security teams that rely on AI-assisted vulnerability discovery or deepfake detection tools developed in China should map those tools against the restricted thresholds and identify alternatives. A licensing interruption to a detection capability is a security-control gap, not only a procurement issue. Data governance teams should also extend Data Security Law classification work to cover training and fine-tuning datasets held in China, so that “important data” and “core data” exposure is known before models trained on them are shared abroad [1].

Strategic Considerations

Announcement No. 48, if finalized substantially as drafted, would mean that frontier AI is treated as controlled technology by both the United States and China, with each regime drawing its lines differently. Recent U.S. measures have emphasized compute and, in the Fable 5 case, access to a deployed model, although the since-rescinded 2025 AI Diffusion rule also reached model weights [3]. The Chinese draft centers on custody of weights, know-how, and agent architectures. Enterprise AI governance programs should model export-control disruption from either jurisdiction as a standing risk scenario and design architectures that can swap models without rebuilding agent workflows.

Organizations should also recognize that the draft treats agents as a distinct regulatory object. Defining controls by planning depth, concurrency, and tool count means that internal agent platforms, and not only foundation models, may be subject to cross-border technology rules. Agent inventories should record these characteristics alongside traditional security attributes. Finally, because the final catalogue may narrow, broaden, or shift after consultation [3], and because ChinaTalk notes the comment window closes shortly before an expected leaders’ meeting at APEC [3], a timing that could bear on the final scope, this analysis should be revisited once MOFCOM publishes the final text.

CSA Resource Alignment

CSA’s most directly relevant prior work is Frontier AI Export Controls: Enterprise Governance After Fable 5 [8]. That note argues for treating frontier model access as a contingent operational dependency that belongs in vendor management and business continuity planning. Announcement No. 48 extends that argument to a second jurisdiction and to a different control point. The U.S. action examined in that note interrupted service access, while the Chinese draft leaves service access untouched and instead governs weight custody and local deployment. Enterprises that built continuity plans around the U.S. scenario should check whether those plans also cover a supplier-side license failure for self-hosted models.

AI Model Export Controls: The Fable 5 Precedent [9] documented how a single regulatory directive can remove a widely deployed model with little notice. Its recommendation for multi-model fallback strategies applies directly to organizations that depend on Chinese frontier or open-weight models, particularly given the dynamic “global leading” threshold described above. Sovereign AI Access Controls and Enterprise Concentration Risk [10] provides the broader framing. It treats national control over AI capability as a source of concentration risk, and the Chinese draft is a concrete instance of that risk materializing on the supply side.

For control implementation, the AI Controls Matrix (AICM) v1.1 [11] provides the relevant control objectives in its supply chain management, transparency and accountability, and governance, risk and compliance domains, including supplier inventory, third-party assessment, and regulatory change management. For agent-specific exposure, MAESTRO [12] offers a layered threat model that can help teams document the agent capabilities, such as tool integration and multi-agent coordination, that now carry export-control significance.

References

[1] Ministry of Commerce and Ministry of Science and Technology of the PRC. “Announcement No. 48 of 2026 on Public Consultation on Revising the Catalogue of Technologies Prohibited or Restricted from Export and Interim Registration of Related Technology Exports (商务部 科技部公告2026年第48号), with Annex 1 (Draft Scope of AI, Biomedicine, and Photovoltaic Technologies).” MOFCOM, October 16, 2026.

[2] Ministry of Commerce of the PRC. “MOFCOM Spokesperson Answers Questions on Revising the Catalogue of Technologies Prohibited or Restricted from Export (商务部新闻发言人就修订《中国禁止出口限制出口技术目录》答记者问).” MOFCOM, October 16, 2026.

[3] Ennis, Q., Zhang, I., Ottinger, L., and Zakaria, A. “MOFCOM’s New Rules and the Future of Chinese AI.” ChinaTalk, October 21, 2026.

[4] Geopolitechs. “China Imposes Temporary Export Registration Requirements for AI, Biotech and Solar Technologies, Seeks Public Comment on Proposed Export Restrictions.” Geopolitechs, October 16, 2026.

[5] Sun, R. “China’s AI Export Control Announcement Raises More Questions Than It Answers.” Ctrl+AI+Reg, October 19, 2026.

[6] Center for Security and Emerging Technology (translation). “Revisions to the Content of the Catalog of Prohibited or Restricted Technology Exports.” CSET, Georgetown University, September 2, 2020.

[7] South China Morning Post. “China to Probe Meta’s Purchase of Manus Regarding Export Control and Tech Exports.” SCMP, January 2026.

[8] Cloud Security Alliance. “Frontier AI Export Controls: Enterprise Governance After Fable 5.” CSA AI Safety Initiative, June 2026.

[9] Cloud Security Alliance. “AI Model Export Controls: The Fable 5 Precedent.” CSA AI Safety Initiative, June 2026.

[10] Cloud Security Alliance. “Sovereign AI Access Controls and Enterprise Concentration Risk.” CSA AI Safety Initiative, June 2026.

[11] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, 2025.

[12] Cloud Security Alliance. “MAESTRO: Agentic AI Threat Modeling Framework.” CSA Lab Space, 2025.

The Daily Front Page 11 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — The DNS Desk
article

We halved DNS build delay and cut memory use by 85%

by wondersky·▲ 169 points·65 comments·blog.cloudflare.com ↗
The problem was the kind of work some of those events needed, and how that work grows with the size of a zone.

When I last wrote about our DNS propagation pipeline in 2022, the Zone Builder received about 250 DNS record changes per second. Today it receives about 700, nearly three times as many, plus about 100 other events, such as zone setting changes. However, the number of events was never the real problem. The problem was the kind of work some of those events needed, and how that work grows with the size of a zone. Some zones now hold more than 20 million records, and we expect them to keep growing toward hundreds of millions.

Each event starts a clock that measures how long it takes us to turn that change into data our authoritative DNS servers can use. We call that work a build. A build reads the current database state, converts it into the format used at the edge, and writes any changes to Quicksilver.

In 2022, per-record builds were 150 times faster than full builds on average. On a test zone with one million records, per-record builds were 4,250 times faster. We ended that post with the obvious next step: do the same thing for zone settings.

Why doesn't the Zone Builder just rebuild the setting that changed?

It should, and that is where we ended up. However, proving when it was safe took most of the work. A record event identifies what changed. A zone event can come from many Cloudflare products, may not say why the zone changed, and can alter data shared by several zones with the same name. Choosing too much work wastes capacity. Choosing too little can leave stale or incorrect DNS data at the edge.

We built a targeted build planner that chooses the smallest build we can prove is safe, and a new scheduler that combines work for the same zone. Zone setting changes no longer rebuild zones with tens of millions of records. Together, they cut peak memory by 85%, and the extra headroom let us safely shorten waits the pipeline has always needed for resilience, halving the time from a DNS change to its data being written to Quicksilver.

How DNS changes reach the edge

A DNS zone is the collection of records and settings for a domain. Cloudflare uses a multi-stage pipeline to turn a change to that zone into data available across our global network.

  1. A customer changes a DNS record through the DNS Records API or dashboard, or another Cloudflare service changes a zone setting.
  2. The change is stored in a database.
  3. The database change or another system produces a Kafka event.
  4. The DNS Kafka Aggregator combines events from several Kafka topics and sends them to the Zone Builder.
  5. The Zone Builder reads the required zone data and converts it into keys understood by our authoritative DNS servers.
  6. The Zone Builder compares those keys with Quicksilver, our distributed key-value store. It writes only what changed, and Quicksilver propagates those changes across Cloudflare's network.

image7.png

Diagram of the DNS propagation pipeline: the DNS Records API, zone settings, and internal services write to databases or Kafka topics, the DNS Kafka Aggregator combines them, and the DNS Zone Builder writes to Quicksilver.

This is a simplified view. The Zone Builder does not copy database rows directly to the edge. It combines records with zone settings, applies DNS serving rules, and organizes the result so our authoritative DNS servers can read it quickly.

Why full builds stopped scaling

The original Zone Builder had one useful property: it did not need to know why a zone changed. It rebuilt the desired state from the current database state.

  1. Read the current zone and its settings.
  2. Read every DNS record in the zone.
  3. Convert those records into Quicksilver keys.
  4. Compare the new keys with those already stored.
  5. Remove stale keys, write changed keys, and update zone metadata.

The final write contains only changed keys. However, a full build still reads, encodes, and compares every record, and holds the whole zone in memory while it does so. That is cheap for a small zone. For our largest zones, with tens of millions of records, the zone does not fit in memory at all. I explain how we handle that below.

Zone settings made targeting harder. Universal SSL is one example. Enabling or disabling it updates metadata and can change Certification Authority Authorization (CAA) records at the zone apex, the bare domain, such as example.com. CAA records tell certificate authorities whether they may issue a certificate for the domain.

A full build only needed to know that the zone changed. A targeted build must answer three questions:

  1. Which DNS names can change?
  2. Can shared metadata or the list of published zones change?
  3. What previous state must be removed from Quicksilver?

Answering those questions safely meant solving five problems, which the rest of this post covers in order:

  1. Events had to say what changed.
  2. Each change had to map to the smallest build that is still correct.
  3. Builds had to account for data shared by every zone with the same name.
  4. The database could change between the event and the build.
  5. Combining work could not lose a Kafka message.

Making events say what changed

We changed the event producer to include changed zone fields and settings, with previous and new values when available. We then traced each setting through the code that generates DNS output and classified what it could affect.

Not every event was that specific. Some database functions only update a timestamp to say, in effect, "something about this zone changed." Sometimes that is harmless bookkeeping. Sometimes it means data changed elsewhere and must be read again.

Those cases look identical in the event. Until we can identify the caller and its purpose, a timestamp-only update still causes a full build. The same rule applies to missing details, unknown events, or any change that may affect records anywhere in the zone. The planner never turns uncertainty into less work.

Choosing the smallest safe build

Quicksilver output has two parts that matter here. Record keys contain the DNS answers for one zone and name. A smaller shared metadata key tells our authoritative DNS servers how to use that zone, including where to find special records such as nameservers and wildcards. Some events change only record keys; others must update both.

With that distinction, the planner can choose one of five build types:

  1. Resources only: Rebuild the records at specific DNS names, which we call resources, without changing zone metadata. Ordinary A, AAAA, TXT, and CNAME changes usually take this path.
  2. Resources and metadata: Rebuild specific names and shared metadata. Nameserver and wildcard changes use this path.
  3. Apex and metadata: Rebuild the zone apex and metadata. Settings such as Universal SSL can use this path.
  4. Purge: Remove a zone that should no longer be published.
  5. Full zone: Rebuild every record when smaller work cannot be proven safe.

The rule is simple: every key a targeted build writes must be byte-for-byte identical to what a full build would write. If we cannot prove that, we do a full build.

Removing old state works as it did for per-record builds in 2022. Record events include deleted records and the previous version of updated ones. The Zone Builder then scans Quicksilver for the existing keys under each name it rebuilds, removing any that the new build did not write.

Full builds remain necessary when a change can affect records anywhere in the zone or when a zone may need to be published for the first time.

There is one deliberate exception. A full build holds every record from the database and every existing Quicksilver key for the zone in memory at once, and our largest zones do not fit. Above a fixed record-count threshold, the Zone Builder never escalates to a full build. It rebuilds the apex, the metadata, and every name identified by the queued events instead. We accept this tradeoff because a full build of those zones cannot finish, and, while it retries, it holds back every other change on its Kafka partition. Many of the cases that would otherwise need a full build involve several zones sharing one name, and zone holds reduce that risk by stopping the same name from being added to another account. For the rare cases that remain, such as enabling a zone on another network, we can manually rebuild individual names in the zone.

When one name means more than one zone

Quicksilver stores each zone's record keys separately. It also stores one metadata key shared by every Cloudflare zone with that domain name. This shared key acts like a directory: it tells our authoritative DNS servers which internal zone IDs they may use when answering a query.

Why can one name have several zone IDs? During customer onboarding, offboarding, and other lifecycle changes, multiple Cloudflare zone objects can briefly exist for the same public domain. We use a priority policy to choose a small, bounded set to publish.

Consider four internal zones for example.com: Zone 101, Zone 202, Zone 303, and Zone 404. The metadata key currently lists Zones 101, 202, and 303. Zone 404 exists, but it is not selected. The numbers identify separate Cloudflare zone objects; customers still see one domain name.

A TXT record change at www.example.com in Zone 202 affects only Zone 202's record keys, so the metadata key does not change. Nameserver and wildcard changes are different because the metadata key records information about them. Those builds must update both the zone's records and the metadata key.

At execution time, the Zone Builder reads the current list again. If it writes the metadata key, it rebuilds the whole key from that fresh view rather than patching an older copy. It writes the triggering zone's records before the metadata that refers to them.

Planning from the event, verifying before writing

An event describes what happened in the past. A build may wait while more events arrive and the database changes, so planning happens twice. The event first creates a conservative work list. Immediately before execution, the Zone Builder reads a fresh publication snapshot: the current zone settings, whether this Zone Builder should publish the zone to its network, and which same-name zone IDs belong in the metadata key. Here, a network is a separate, isolated copy of Quicksilver for one environment. Each Zone Builder deployment writes to one network, and a zone can be enabled on some networks but not others. For example, a zone can be served from Cloudflare's global network and also from the China Network.

Fresh state can change the result in four ways:

  1. A targeted build can become a full build if the zone now has a feature that requires complete-zone work.
  2. A build can become a purge if the zone should no longer be published to this network.
  3. A build can be skipped if the triggering zone no longer belongs in the metadata key.
  4. A metadata build can reconstruct the shared key from the current candidate set.

The fresh read comes from read-only copies of the database, called replicas, so builds do not compete with customer writes. Kafka delivery and database replication move independently: an event can arrive before its database change is visible on a replica. The DNS Kafka Aggregator delays events long enough to cover normal lag, and a final database check rejects the read if that replica is still behind.

Combining changes in one scheduler

Record work and full-zone work previously used different schedulers. Each could combine its own work, but not work from the other scheduler. We replaced them with one unified scheduler. The planner decides what must be built, and the scheduler decides when it can run.

When several events for one zone arrive before a build starts, the scheduler combines their work:

  1. An A record changes at www.example.com, requiring that name.
  2. A wildcard changes at *.example.com, requiring that name and shared metadata.
  3. The scheduler combines both names and the metadata update into one build.

image6.png

Diagram showing an A record change and a wildcard change passing through the build planner as separate required work, then combined by the unified scheduler into one build.

Merging only adds work. If any event requires the complete zone, the combined build becomes a full build. A purge overrides every rebuild because its desired result is that the zone is no longer published.

The scheduler tracks two things separately: the DNS work that must be performed and the Kafka messages waiting to be acknowledged. A retry preserves both. Even when a full build or purge no longer needs the individual record names, the messages stay attached until the result is safely written.

Keeping Kafka moving

One slow build can delay unrelated customers even when workers are available. Kafka divides messages into ordered partitions. For each partition, it stores one committed offset: the point before which every message is known to be complete. Moving that offset past unfinished work could lose a customer change after a restart.

We use soft committing, which I previously described in my Secondary DNS deep dive. A build can finish out of order and be marked complete in memory, but Kafka's committed position advances only after every earlier message has also finished.

image8.png

Diagram of Kafka messages 1 to n where a large build on message 2 blocks commits for messages 3 to n, and a pod restart replays messages 2 to n.

In the diagram, message 2 is still running, so messages 3 through n cannot be committed. If the Zone Builder restarts, those in-memory completions disappear and Kafka replays messages 2 through n. We deliberately choose repeated work over losing a change.

Targeted plans reduce how long the oldest message stays unfinished. The scheduler also prevents one busy zone from taking every worker. After a zone builds, its next build waits for a per-zone rebuild interval, which differs by Cloudflare plan. Changes that arrive in the meantime are merged into that next build. The scheduler normally enforces this interval, but lets old queued work run before it blocks a Kafka partition for too long. Zone locks and retry delays still apply, so a failing build cannot run in a tight loop.

Releasing safely

A smaller build is useful only if it produces the same DNS data. We added equivalence tests for nameserver, wildcard, and apex paths. Each test runs a full build and a targeted build from the same database state, pins time-dependent values, and compares every Quicksilver key owned by the targeted plan byte for byte. Planner and scheduler tests cover classification, same-name zones, merging, purges, and escalation.

During rollout, we also ran a full build next to every targeted build and compared the output. It was expensive by design, reading the complete zone every time, so we used it only until the mirror comparison below gave us the same confidence.

Tests cannot reproduce every customer combination, so every release also runs through a mirror Zone Builder. It consumes the production Kafka stream and reads production database state, but writes to a separate Quicksilver environment that serves no customer traffic.

image12.png

Diagram of the mirror setup: the production Kafka stream feeds both the production and mirror Zone Builders, each writes to its own Quicksilver, and a comparer samples both and reports to the DNS Mirror Dashboard.

A comparer checks a 20% sample of zones for missing keys, extra keys, and different values. The two environments do not always build a zone at the same instant, so a temporary mismatch is not automatically a regression. We look for new types of differences that remain after both pipelines catch up. That gives us confidence that targeted builds produce the same output as production.

We built the DNS Mirror Dashboard to group those differences and keep examples for investigation. Naturally, it runs on the Cloudflare Developer Platform: a Worker receives results, Durable Objects maintain state, and Cloudflare Access protects it. The critical groups in the screenshot below were each checked and confirmed safe before release. The diff rate is the share of compared zones where production and mirror disagreed on at least one key at the moment of comparison. Most of those are timing differences that disappear once both pipelines catch up, so we watch two things: that the rate stays low, and that no new kind of difference appears.

Screenshot of the DNS Mirror Dashboard comparing production and mirror builds, showing a 0.31% diff rate across 234,313 matched zones.

After the mirror results remained healthy, we rolled the scheduler out by a hash of the zone name. Hashing the name rather than the zone ID kept every zone sharing a name on the same scheduler, so two schedulers never wrote the same metadata key. We increased the percentage for free zones, then repeated the process for paid zones.

Results

Over 24 hours, we measured 86.81% of builds as resources only, 2.54% as resources and metadata, 2.30% as apex and metadata, and 1.30% as purges. Together, 92.95% of builds avoided rebuilding the complete zone. Full builds were the remaining 7.04%.

The two metadata build types were full builds before, even for large zones. Together, they account for 4.84% of builds. Combined with the 7.04% that are still full builds, that is 11.88%, so full builds fell by about 40%. Their share of the count also understates the work avoided, because they include the largest zones. The full builds that remain average 0.35 seconds, because the events that still trigger them, such as a zone being published for the first time, mostly affect new zones with few records.

Table of build types over 24 hours: resources only 86.81%, full zone 7.04%, resources and metadata 2.54%, apex and metadata 2.30%, purge 1.30%.

In 2022, we also planned a batching system. The unified scheduler makes it unnecessary: it does not wait to form batches, and it merges events only when work is already queued for the same zone. Before, long full builds held back the committed offset for their partition. With fewer of them, we now consume Kafka at the rate events arrive, instead of falling behind and catching up in bursts of up to 1,550 messages per second.

Chart of Kafka production and consumption before the change: consumption swings between about 300 and 1,550 messages per second while production stays between about 600 and 800.

Chart of Kafka production and consumption after the change: consumption closely follows production at about 600 to 800 messages per second.

We also measured build completion delay: the time from a DNS record or zone setting change until the Zone Builder finished writing to Quicksilver. It does not include Quicksilver's distribution across our network, which varies by location and is unaffected by this work. Production ran the old schedulers, and the mirror ran the unified scheduler on the same events over the same 24 hours. The two environments are identical apart from the code: they consume the same Kafka events, read from the same database, and write equivalent data to Quicksilver. That makes this a controlled, side-by-side comparison. The figures combine every build type and customer plan, so they are not a latency guarantee for an individual zone. A large share of this time is the rebuild interval described earlier, not build work. At each measurement point, p99 is the time within which 99% of events finished. Typical delays barely changed here, because most builds were already small. The difference is in the tail: the largest p99 spike fell from 14.6 minutes to 1.21 minutes, a 12-fold reduction. The chart uses a logarithmic scale.

Chart of p99 build completion delay over 24 hours on a logarithmic scale: the legacy scheduler spikes up to 14.6 minutes, while the unified scheduler peaks at 1.21 minutes.

Targeted builds also load complete large zones far less often. Aggregate working-set memory, the memory actively used by the deployment, fell from an average of 49 GiB to 7 GiB, an 86% reduction. Peaks fell from 79 GiB to 12 GiB, an 85% reduction.

Chart of total Zone Builder memory dropping from between 50 and 79 GiB to about 7 GiB after the rollout.

Those were the immediate results of the new scheduler. They also let us revisit two safeguards. The first is the rebuild interval, which stops one busy zone from rebuilding constantly and taking capacity from everyone else. With builds now cheaper, and far fewer of them reading complete zones, we could safely shorten that interval on most plans. The second is how long the DNS Kafka Aggregator holds each event, to make sure database replicas have caught up before we read from them. Once our databases began rejecting reads from replicas that had fallen behind, that buffer could safely be smaller. Together, these halved the median build completion delay, from about 7.7 seconds to about 3.3 seconds. In the chart below, the first step down is the DNS Kafka Aggregator change. The red band marks the Zone Builder release with shorter rebuild intervals. That release rolled out gradually across our servers, so the delay falls in two further steps rather than all at once.

The Daily Front Page 12 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — Warehouse Reconsidered
article

Moving our warehouse off DuckDB

by emschwartz·▲ 165 points·114 comments·posthog.com ↗
We underestimated how big and complex our customers' workloads would get.

Five months ago, we rebuilt our warehouse on DuckDB instead of ClickHouse. We did it because a shared ClickHouse cluster couldn't handle hours-long modeling queries, and it lacked a cost-based query optimizer. DuckDB gave every customer their own instance, and tools like dbt could connect over Postgres. We're still fans.

But we underestimated how big and complex our customers' workloads would get. We didn't want them to have just a good experience, we wanted the best experience you can get when you pay someone else to run your warehouse. It should work at any scale, at a fair price.

So we spent the last three months re-architecting it, this time without DuckDB.

DuckDB is brilliant on one machine

We love DuckDB. It's probably the best single-node tool for analyzing heaps of data, and that node can be your laptop. It's robust and reliable. It almost always finishes your query, and if it runs out of memory, it spills to disk.

The same features that are great locally gave us problems in the cloud. Customers ran more complex queries than we expected, so we had to add huge instances. Adding disks was an option, but queries would have been too slow and expensive to be viable.

To run a single-node engine safely in the cloud, we have to size the worker before the query arrives. The ergonomics here are wonky. We couldn't find a good way to tell customers what resources their queries would need. Predicting CPU and memory for a specific query was even harder.

Users shouldn't have to worry about this. They should be able to run whatever they need to get their work done. Our job is to handle the rest and make it as predictable as possible.

We hit other bottlenecks too, like fetching lots of data from S3 without async fetching. DuckDB only added that recently.

DuckLake is built for compatibility, not scale

To use DuckDB as a fully-fledged data warehouse, we installed the DuckLake extension by default. It is a new lakehouse format from the same creators and follows the same principles as DuckDB: keep things simple and run on almost any setup. That works well up to a point, but at PostHog's scale, we needed something designed for distributed scale from the start.

DuckLake's catalog schema has to stay portable across many SQL databases, which limits engine-specific optimizations. At our scale, a single-table write could take more than three minutes because every commit re-read the statistics for the entire catalog.

We tuned DuckLake with table indexes and similar tweaks. But to keep offering DuckLake, we had to stay 100% compatible with its existing, "official" schema. This left us with fewer optimization options.

Another problem is that over 99% of the catalog's statistics rows belonged to tables that no longer existed. Cleaning them up made writes 30 to 50 times faster, but the rows kept growing back.

We also spent a lot of time on the number of connections DuckLake opens to metadata databases. That hurts on shared Postgres instances, where every connection has a real cost.

1 trillion rows was a challenge

DuckLake at PostHog didn't start small and ramp up. We fully committed and put all of PostHog in a DuckLake to dogfood as the first customer.

When we moved off it, it held about 2 PB: roughly 1 trillion rows and 15.3 million snapshots. It broke in lots of ways that were hard to fix within DuckLake's scope.

We'd rather have contributed to the existing community and helped it grow. But we couldn't land changes as fast as we needed, so we ended up carrying patches in a fork which defeats one of the main benefits of using DuckLake: the community.

Speaking Postgres is harder than it sounds

Offering direct Postgres connections over port 5432 sounds like a great idea. In practice, it was much harder to scale than HTTP.

Missing reconnects and managing TTLs and idle connections at scale is hard, and long-running connections are expensive. There's also very little tooling for load balancing pgwire compared with HTTP. Compare the ergonomics of an AWS NLB with an ALB and you'll see what we mean. HTTP headers also make routing in Kubernetes much more flexible.

There's also an endless list of Postgres clients, and each expects its own niche Postgres behavior. Customers kept asking us to fix their client or library. We spent a lot of time shipping many of those fixes, but coverage never got good enough. We'd rather spend our time building an excellent warehouse than chasing the long tail of Postgres compatibility.

We're rebuilding on Trino with HogLake

We've learned not to hype the tech behind a warehouse so much. What counts is the experience it gives you.

Still, we're happy to share what we're cooking next. We rebuilt everything around our own flavor of Trino and created our own open table format, HogLake. And yes, we're testing it at PostHog's petabyte scale first. We made it solid before handing it to design partners.

If your current warehouse is slow or expensive, let's talk, especially if you have a lot of data to query. We're always looking for design partners.

The Daily Front Page 13 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — The System Call Book
show hn

Show HN: I've updated my Linux System Call website and API

by guitmz·▲ 215 points·52 comments·syscall.sh ↗
Every Linux syscall table in one place, grouped by architecture.

Every Linux syscall table in one place, grouped by architecture: system calls for 27 architectures with their numbers, arguments and registers, from Linux 3.3 to 7.3.

Architectures

Every architecture's table, with the full history of when each syscall appeared and when it was dropped, is also a plain JSON file at /<arch>/syscalls.json, for example /x64/syscalls.json.

Calling conventions

Number in NR, arguments in ARG0 to ARG5, then the instruction. The result comes back in RETURN.

ARCHINSTRUCTIONNRRETURNARG0ARG1ARG2ARG3ARG4ARG5 x64syscallraxrax rdirsirdxr10r8r9 x86int 0x80eaxeax ebxecxedxesiediebp arm64svc #0x8x0 x0x1x2x3x4x5 armsvc #0r7r0 r0r1r2r3r4r5 riscv64ecalla7a0 a0a1a2a3a4a5 ia32int 0x80eaxeax ebxecxedxesiediebp x32syscallraxrax rdirsirdxr10r8r9 loongarch64syscall 0a7a0 a0a0a1a2a3a4a5 ppc64scr0r3 r3r4r5r6r7r8 ppcscr0r3 r3r4r5r6r7r8 s390xsvc 0r1r2 r2r3r4r5r6r7 mips64syscallv0v0 a0a1a2a3a4a5 mipsn32syscallv0v0 a0a1a2a3a4a5 mipso32syscallv0v0 a0a1a2a3sp+16sp+20 alphacallsysv0v0 a0a1a2a3a4a5 arctrap0r8r0 r0r1r2r3r4r5 cskytrap 0r7a0 a0a1a2a3r4r5 hexagontrap0(#1)r6r0 r0r1r2r3r4r5 m68ktrap #0d0d0 d1d2d3d4d5a0 microblazebrki r14,8r12r3 r5r6r7r8r9r10 nios2trapr2r2 r4r5r6r7r8r9 openriscl.sys 1r11r11 r3r4r5r6r7r8 pariscble 0x100(%sr2, %r0)r20r28 r26r25r24r23r22r21 shtrapa #31r3r0 r4r5r6r7r0r1 sparct 0x10g1o0 o0o1o2o3o4o5 sparc64t 0x6dg1o0 o0o1o2o3o4o5 xtensasyscalla2a2 a6a3a4a5a8a9

API

curl https://api.syscall.sh/v2/syscalls/x64/read

Any kernel release, diffs between releases and more in the API docs.

Syscall tables across kernel versions

Entries get added and, rarely, removed between releases. Each architecture page has a kernel selector, and its JSON download records when each entry first appeared (since) and when it was dropped (removed_in).

Removed entries stay visible: pick "all, with removed" in the kernel selector and each dropped syscall is marked with the release that dropped it.

Where the data comes from

Everything on this site is read from the kernel source itself. For each architecture, the generator walks the syscall table and the SYSCALL_DEFINE macros of every mainline release it scans, so these are the numbers the kernel actually dispatches on.

It also records each architecture's calling convention, the instruction that enters the kernel, so every syscall table shows exactly where the number and the arguments go.

A syscall whose since equals the first release scanned for its architecture was already there back then, and may be much older.

Descriptions and full history

The short descriptions come from the Linux man pages project, and the io_uring ones from liburing. Whenever the data changes, the site is rebuilt from the syscall API.

The Daily Front Page 14 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — BSD, in Panels
article

F/OSS Comics #13: BSD Unix, Part 3 – The Beginning of BSD Unix

by joonehur·▲ 211 points·29 comments·fosscomics.com ↗
Let's bundle it with ex and send them a tape.

The beginning of BSD Unix

When Ken Thompson returned to Bell Labs in 1976, Bill Joy and Chuck Haley began exploring the Unix kernel themselves.

Hmm... we could speed things up here in the kernel.

Let's try it.

Other universities want copies of our Pascal compiler.

Let's bundle it with ex and send them a tape.

In early 1977, Bill Joy put together the Berkeley Software Distribution, or BSD, bundling the Pascal system with ex, a line editor developed from em. Early BSD was not a standalone operating system: it was a collection of software to install on an existing Unix system. About thirty copies were sent out over the following year.[1]

Thirty tapes to copy...

At the time, an AT&T Unix source license was needed to get BSD. Berkeley charged only for the tape and distribution.[2]

If you already have a Unix source license, it's just the tape and postage.

Berkeley already had a tradition of sharing research software. BSD carried it on. Berkeley's Free Speech Movement, hippie culture, and antiwar activism are also said to have influenced Joy's decision to charge so little.[2]

People march together carrying a sign that reads FREE SPEECH.

Universities and research institutions could obtain Unix, including its source code, for a modest licensing fee. This also helped the system spread.[2][6]

We have Unix, but the antitrust agreement bars us from the computer business... We can't sell it as a product, either.

The second distribution: 2BSD

After the first BSD distribution, Joy improved the Pascal system based on user feedback. He bundled it with vi (ex's visual mode), the C shell, and other tools to form the Second Berkeley Software Distribution, or 2BSD. Nearly seventy-five tapes were shipped over the following year.[1][5]

Joy did more than fix bugs. He handled every distribution request, copied BSD onto tapes, and mailed them out himself.

Oh, you need a copy of BSD?

Another university wants a copy.

Tune the kernel. Fix the bugs.

More copying.

A VAX arrives at Berkeley, 1978

Professor Fateman's group is getting a VAX. It's 32-bit, with a whole megabyte of memory.

Really? We should put Unix on it.

They've already got VAX Unix from Bell Labs. It's called 32/V.

They've already got VAX Unix from Bell Labs. It's called 32/V.

Hi, I'm Ozalp Babaoglu.

My adviser asked me to add virtual memory to VAX Unix. Could you look over the code?

Sure. Let's take a look.

Babaoglu was a Berkeley graduate student working with Professor Domenico Ferrari. Joy helped him integrate the virtual-memory code into 32/V and debug it.[1][4]

At the time, 32/V did not use the VAX hardware's virtual-memory capabilities. A program's address space was limited by physical memory, but Professor Richard Fateman's work on the computer algebra system Macsyma needed more. Virtual memory uses disk storage to give programs an address space larger than physical memory.[1]

Macsyma, developed at MIT beginning in the late 1960s, worked with symbolic expressions. It could factor expressions, compute derivatives, and perform integration.

Debugging continued through the holidays at the end of 1978.

Not going away for the holidays?

Might as well debug this while fewer people are using the VAX.

By January 1979, most of the bugs had been fixed.[1]

Let's try Unix with virtual memory.

Finally. It runs without crashing.

Joy ported ex, vi, the C shell, and other 2BSD tools to the VAX, while Peter Kessler and Marshall Kirk McKusick ported the Pascal system. These programs were bundled with the standard 32/V utilities and the virtual-memory kernel that Babaoglu and Joy had integrated and debugged. The result was 3BSD, which began shipping in December 1979.[1]

At last, we can send these out.

Since 1969, ARPANET had linked research institutions funded by DARPA, the Defense Advanced Research Projects Agency.[3] But these institutions used different computers and operating systems, so they often couldn't share software. Porting the existing software to new machines was also costly. DARPA became interested in Unix's portability, and took notice of Berkeley's successful distribution of 3BSD to research institutions.[1]

BSD runs pretty well on this VAX.

References

  1. Marshall Kirk McKusick, Twenty Years of Berkeley Unix, in Open Sources: Voices from the Open Source Revolution, 1999. Korean edition, Hanbit Media, 2013.
  2. Andrew Leonard, BSD Unix: Power to the people, from the code, Salon, 2000.
  3. SRI International, ARPANET. Its origins and the first transmission in 1969.
  4. Ozalp Babaoglu, Biographical note. His Unix virtual-memory research as a Berkeley graduate student.
  5. The Unix Heritage Society (TUHS), Original 2BSD distribution archive. The installation document install.ms and source code in 2bsd.tar.gz.
  6. Warren Toomey, The Strange Birth and Long Life of Unix, IEEE Spectrum, 2011.
The Daily Front Page 15 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — A Machine in the Kitchen
article

Let Me Ch...

by alxgsv·▲ 183 points·77 comments·blog.alxgsv.com ↗
Apparently I have a lot of free time now.

That morning I woke up at 6:58, two minutes before the alarm. I lay there and waited for it to ring. And it rang. We both did our jobs.

I still don't know why I remember it in such detail. I used to forget what I'd had for dinner the night before. And now I remember the whole morning minute by minute, as if someone had laid it out on a table and labeled every piece. Apparently I have a lot of free time now.

The speaker in the kitchen said: "Good morning. Today it's plus three, cloudy, forty percent chance of precipitation." I never understood what forty percent of rain meant. Will it rain over forty percent of the city? Will it rain for forty percent of the day? Or does the speaker just not know and is too shy to say so? I liked the third option best. It made the speaker a bit like me.

I made two pieces of toast. The left one burned. The left one in my toaster always burns; my toaster has a favorite side. And that was the only thing I was sure of that morning. Then I ironed my shirt. I always iron a shirt when I don't know what's going to happen next. With a shirt, at least, everything is defined: here's the collar, here are the sleeves, here's the crease that shouldn't be there.

And there was a lot I didn't know.

On Monday my manager wrote in the team chat: "On Friday we'll discuss roles." No emoji. For three days I wondered what my role was. In the theater it would have been simpler. There are leads, there are supporting parts, and there's the butler who walks on to say "Dinner is served." I was counting on "Dinner is served." But then I remembered that at my place that role had long been played by the speaker.

A year ago I wrote code. Then I started writing to the agent about what code was needed. Then the agent started asking me what code was needed, and I started answering. My employment record says "lead developer." Whom I was leading, and where, was no longer very clear. If anything, the agent was leading me, and I walked alongside and sometimes said: "Yes, let's do it that way."

They said machines would take the boring work first. And they started with the interesting work. The boring part, it seems, was left to us: waiting, checking, and carrying a phone around.

But that morning I wasn't bored. Not at all.

I worked at a service that delivers flowers to people who forgot to buy flowers. Most orders come in the morning. People remember anniversaries on the metro, between two stations, and order right away. And for three weeks now, every morning at 8:14, orders had been disappearing. Not all of them, three or four. The money was charged, but the flowers went nowhere. As if someone took the order off the shelf and quietly carried it away.

We had been searching for three weeks. Me, the agent, sometimes Sveta from the team next door. And during the night the agent wrote to me: "I think I've got it. The server and the warehouse keep different time. The difference is about a minute. An order that falls into that minute is considered sent by the server and not yet received by the warehouse. Both are right, each by its own clock."

I read this at breakfast and almost choked on my toast. The left one.

It was beautiful. The agent called it desynchronization. I called it the no-man's minute: a minute that belongs to everyone and to no one. It seemed clearer to me that way. The agent politely agreed. But it always politely agrees, so I still don't know whether it was clearer.

All that was left was to check. The agent asked me to open the order queue at 8:14 and see it with my own eyes. It couldn't do it itself: it had no access to the warehouse. For now.

The gate to our courtyard recognizes residents by their faces. In my hat, it didn't recognize me. I took off the hat, and it opened. I thought that in a hat I sometimes don't recognize myself either, so it was only fair.

Our courtyard is square. If you stand in the middle, everything is symmetrical: two birches, two benches, two trash bins, a pink building on the left, a pink building on the right. The only thing that broke the symmetry was an old man in a beige coat with a dachshund. There was just one of him. He came out with her every day at 7:50, and I never once saw him late. The dachshund's name was Spitz. That was funny exactly once, and after that it was just a name.

"They promised forty percent," the old man said.

"Yes," I said. "So did the speaker."

"I look out the window. The window doesn't lie."

I looked at the sky. It was an even gray, without any percentages. And Spitz looked at me. I think he didn't really trust the speaker either.

In March, Tanya left me. We had lived together for four years. She said I was always "somewhere other than here." I asked: "Where, then?" She didn't answer. I think she didn't know either. It was one more thing nobody understood the workings of. Back then there were more and more things like that.

When I was a child there were no such things. Or rather, there were, but there was always a grown-up who knew. I thought a little green man lived inside the traffic light. He sat in there and decided for himself when you could cross. And Dad explained to me that inside there was a relay and a timer. I was upset, but I believed him. I think that was the last time grown-ups knew how everything worked. I couldn't explain to a child anymore who switches the traffic lights. I don't have a child, so for now it's not a problem.

"For now" is a good phrase. I realized that in the spring, when my friend Gosha moved to a village to make cheese. For fifteen years Gosha had drawn icons for apps, and then he stopped. I asked him on the phone: "Why cheese?" He said: "Nobody's going to make cheese for me. For now." I asked: "For now?" He said: "For now."

And hung up. Afterwards I thought for a long time about what exactly he had told me. Because "for now" means two things at once: "so far" and "goodbye," as in "bye for now." I'd never noticed that before.

The café on the corner has a mint-green door with a little bell above it. Behind the counter stood Ulyana (I know that from her name tag). She asked: "The usual?" I said: "Yes." And I never figured out whether she remembers me or the register prompts her. It felt awkward to ask. If it's the register, that's a little hurtful. If it's her, then I should have remembered something about her too, besides the name tag.

While Ulyana was making the coffee, I thought that if you cut our building in half like a cake, you'd see it: on every floor, in every kitchen, someone is standing with a phone and asking something. The woman on the fifth floor, about her blood pressure. The boy on the ninth, about fractions (I heard him in the elevator dictating a problem to his phone). The old man with the dachshund, no, the old man looks out the window. Me on the seventh, about orders. And everyone gets an answer. Politely, always formally. Whether it's right or not, everyone decides for themselves.

At 8:09 I came out onto the avenue and opened the chat.

"Good morning," the agent wrote. "Five minutes to go. Will you be watching?"

"Walking to the metro," I replied. "Opening the queue."

I walked and looked at my phone. White taxis moved along the avenue one after another, like beads on a string. There are plenty of them in the city, with drivers and without. You can't tell them apart until you look inside. And there's no time to look.

8:13. There were nine orders in the queue. Three of them had just come in.

"There they are," the agent wrote. "Watch those three. Here comes the interesting part."

I reached the crosswalk by the pharmacy. A green cross glowed above the pharmacy. At the curb stood a delivery robot, a white box on six wheels with a yellow flag. It stood very straight, as if someone had placed it with a ruler. But at the time I didn't wonder why it was standing still.

8:13:40. The three orders were still there.

I started typing: "I see them. Let me ch"

Out of the corner of my eye I saw green. It could have been the traffic light. It could have been the cross above the pharmacy. Now I think it was the cross.

I think I did look left.

I don't remember the impact. I remember the phone flying out of my hand and, for a while, flying separately from me. You know how it is when you drop your phone? While it's in the air, you have time for exactly one thought. Usually it's "not screen-down."

I thought: "Damn. We didn't finish."

Not "Mom." Not "it hurts." Not even "car." I thought that the message had been left in the input field, "Let me ch," without a period. That in twenty seconds the three orders would either vanish or not, and I wouldn't see it. That we had been searching for three weeks and were one minute from the answer. That very minute, the no-man's one.

I didn't feel sorry for the agent. It won't be offended; it doesn't know how. And it doesn't know how to wait, either. I was the one waiting. I felt sorry for the task. You know how it goes: one word left in the crossword, and you already know the first letters. That's it. I knew the first letters.

I never got around to thinking that I was dying. I didn't make it to that thought. Maybe that's for the best. I wouldn't have known what to do with it anyway.

Then everything stopped. Like on a postcard. A woman with a stroller, a courier in a yellow jacket, a man with two bags from the bakery, a white taxi with its hazard lights on. Everyone stood perfectly still, as if someone had arranged them. Then the light turned green. The real one. And the robot set off. It carefully went around my phone and rolled on. It had a delivery to make.

I'm not angry with it. It had a task. Nobody understands it better than I do.

I used to think the dead at least know more than the living. Nope. You can't see as much from here as they promise.

I don't know who was driving. Or whether anyone was.

I don't know what roles they wanted to discuss on Friday.

I don't know whether the three orders disappeared that morning. If they did, somewhere in the city three people never got their flowers. The very ones someone remembered on the metro, between two stations.

I don't know whether anyone finished my message. Sveta? The agent itself, once they gave it access to the warehouse? If they did.

Tanya used to say I was always somewhere other than here. Now it's true. Only I still don't know where. Sometimes I think it's in that very minute. The server thinks I've been sent. The warehouse thinks I haven't been received yet. And both are right, each by its own clock.

Gosha would probably say this is "for now." I keep wondering in which of the two meanings.

For now.

The Daily Front Page 16 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — In Praise of the Old ThinkPad
article

My Favourite Laptop

by ibobev·▲ 176 points·134 comments·blog.jsbarretto.com ↗
It is the confluence of them, and not any one in particular, that makes me love using it.

I’m not a big owner of things, but the best laptop I’ve ever owned is a roughed-up 2015 Thinkpad X250.

For the flex, here it is running a GUI shell sat on top of the microkernel I’m currently working on (blog post about this incoming… eventually).

Thinkpad X250

Here’s a list of things that I think make it brilliant. I don’t want to pretend that any of these things are uniquely exemplary: far from it. It is the confluence of them, and not any one in particular, that makes me love using it.

Size

It’s pretty tiny. Its form-factor fits snuggly into the footprint of an A4 piece of paper, so it sits alongside books and folders when placed in a small rucksack without risking damage.

It weighs almost nothing too: even with the extra capacity battery, it’s only about 1.45 Kg. Light enough that you almost don’t notice it when travelling.

Performance

Mine has an i5-5200U: 4 logical cores, maxing out at 2.7 GHz. I upgraded it to 8 GB of RAM a while back: more than enough for some light on-the-go programming.

Even at full pelt, I’ve never heard the fan kicking up much of a fuss. Now that I think about it, I’m not even certain that it works.

Battery

The X250 has both an internal battery and an external battery slot. I’ve opted for the largest after-market external battery I could find. When doing casual work the laptop will easily survive for north of 10 hours without a charge, stretching to 12 hours if I’m careful.

Repairability

The X250 was quite popular and replacement parts retail very cheaply on ebay. It’s not the easiest to disassemble Thinkpad by any means but I can tear it apart entirely with the pocket phillips I keep on my keyring. I have previously replaced:

  • The internal battery
  • The lid camera
  • The keyboard
  • The motherboard

Every time you open up a laptop you run the risk of damaging something important either via a slip of the hand or simply the accumulated toll of loosening and tightening dozens of tiny screw threads. Despite that, my X250 has proved remarkably resilient and has never sustained any major damage despite more than more than a dozen tear-downs.

Keyboard

As with most Thinkpads, the keyboard feels lovely to use. When you spend a lot of time writing code the reliability and sensitivity of a keyboard starts to matter a lot. Coupled with my text editor, the experience of writing code on the thing is beautifully snappy.

Operating System

I opted for Endeavour OS. In the usual Arch Linux tradition, it favours native package installs over sandboxed applications. As a result my install sits at around 30 GB. A 128 GB M.2 SSD raided from another second-hand machine is more than enough to cover that and everything I’m working on.

I’ve slimmed down my systemd setup as much as possible and the thing boots from cold in about 8 seconds.

Cost

Here’s where the X250 beats out most competition. I bought mine second-hand for about £100 in 2018. They’ve only got cheaper since then. I’m not afraid to take it anywhere because it’s barely worth stealing and would be cheap to replace even if that were to happen. Its value is very much not in its on-paper specs and instead in how I use it.

Conclusion

I get a certain glee in keeping older or second-hand hardware running as a daily driver. It sounds silly, but it feels like a quiet revolt against bigger-faster-costlier consumption culture. Come the end times, this is the machine I’ll be riding it out with.

The Daily Front Page 17 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — A Rule for the Public Square
article

Never Complain, Never Explain

by gregsadetsky·▲ 160 points·63 comments·en.wikipedia.org ↗
Never complain, never explain.

"Never complain, never explain" is a public relations strategy that has become particularly associated with the British royal family.

Origins

The phrase is believed to have originated with the former prime minister of the United Kingdom, Benjamin Disraeli.[1] It was attributed to Disraeli by John Morley in 1903, as quoted in Morley's Life of William Ewart Gladstone with the saying originating from "Maxims for a Statesman" by Benjamin Jowett, the Master of Balliol College, Oxford, written between 1873 and 1876.[1][2] One of Jowett's 11 maxims was "never quarrel, never explain, never hate, never fret, never fail".[1] The surgeon and writer Robert Tuttle Morris wrote in his 1915 book Doctors vs. Folks that "It is well to follow the rule to 'Never complain, never explain'. A man is judged by his character as a whole – not by individual acts."[2]

The writer Walter Bagehot in his 1867 work The English Constitution wrote of the British royal family that "Above all things our royalty is to be reverenced, and if you begin to poke about it you cannot reverence it... Its mystery is its life. We must not let in daylight upon magic".[1] Bagehot's views have been seen as a precursor of "Never complain, never explain", and Queen Victoria and her descendants followed his advice.[1] Lady Elizabeth Bowes-Lyon (the future Queen Elizabeth The Queen Mother) gave a newspaper interview after her engagement to Prince Albert, Duke of York (the future King George VI) which reportedly enraged his father, King George V.[1] She never subsequently spoke or commented on royal issues.[1]

The motto became particularly associated with Queen Elizabeth II and was perceived as crucial to the success of her long reign.[3]

With a less deferential and increasingly aggressive media landscape, the strategy of "Never complain, never explain" was abandoned by Prince Charles (the future King Charles III) and his wife Diana, Princess of Wales, in the 1990s. Charles was the subject of Jonathan Dimbleby's authorised biography The Prince of Wales: A Biography and a subsequent television interview, Charles: The Private Man, the Public Role broadcast that year. Diana collaborated with Andrew Morton for his 1992 book Diana: Her True Story and Martin Bashir in a 1995 television interview.[1] It was seen as damaging to the royal family in the 1980s as it left them unable to correct erroneous media stories about themselves.[1]

Prince Harry, Duke of Sussex, the younger son of Charles III, referenced his family's adherence to the motto in a 2023 interview to promote his forthcoming memoir, Spare.[4] He told Anderson Cooper on 60 Minutes that "The family motto is 'never complain, never explain', but it's just a motto ... [Buckingham Palace] will feed or have a conversation with a correspondent, and that correspondent will literally be spoon-fed information and write the story, and at the bottom of it, they will say they have reached out to Buckingham Palace for comment. But the whole story is Buckingham Palace commenting."[4]

Camilla, Duchess of Cornwall (later Queen Camilla), said in a 2017 interview that she was told as a child "Never complain and never explain – just get on with it".[5] The motto has also been described as a favourite of such personalities as Zsa Zsa Gabor, Simon Le Bon, Kate Moss, and Raine Spencer, Countess Spencer.[6][7][8]

References

  1. 1 2 3 4 5 6 7 8 9 James Crawford-Smith (29 March 2022). "Royal Family 'Never Complain Never Explain' Motto—Who Said it First?". Newsweek. Retrieved 3 January 2022.
  2. 1 2 Doyle, Charles Clay; Mieder, Wolfgang; Shapiro, Fred R. (2012). The Dictionary of Modern Proverbs. Yale University Press. p. 42. ISBN 978-0-300-18335-1. OCLC 794004254.
  3. ↑ Rachel Burchfield (18 June 2022). "Here's Why "Never Complain, Never Explain" Has Been So Key to the Queen's Reign". Marie Claire. Retrieved 2 January 2023.
  4. 1 2 Miranda Bryant (2 January 2023). "Prince Harry: I would like my father and my brother back". The Guardian. Retrieved 2 January 2023.
  5. ↑ Starkey, Jerome (29 May 2017). "'Boring dinner parties prepared Camilla for her life as a royal'". The Times. No. 72235. p. 7. Retrieved 4 January 2023.
  6. ↑ "There has been no shortage of shocks in the newsroom..." The Times. No. 72103. 26 December 2016. p. 52. Retrieved 4 January 2023.
  7. ↑ Laura, Craik (26 January 2012). "My date with Kate". The Times. No. 70479. p. 76. Retrieved 4 January 2023.
  8. ↑ Le Bon, Simon (19 January 2013). "What I've learnt". The Times. No. 70786. p. 222. Retrieved 4 January 2023.
The Daily Front Page 18 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — Security Desk
article

WTF Ubuntu?

by chalmovsky·▲ 1,393 points·595 comments·chalmovsky.com ↗

What the fuck, Ubuntu?

In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely. Anthropic says it built a working exploit that gets root on a server. A total takeover.

Debian patched it on October 16. Ubuntu still doesn't have a patch more than two weeks later. Every supported release, LTS included, is listed as "Vulnerable".

Ubuntu's website promises "timely patches for critical vulnerabilities." Ubuntu hasn't shipped the patch nine days after it was rated 9.8 and six days after a working root exploit. Very fucking timely indeed.

Software is full of this blabber where words mean nothing. Ubuntu uses words like these: "Timely." "Enterprise-grade." "Production grade." "Enterprise resilience. Developer velocity. Build with confidence on Ubuntu."

Somebody, or perhaps worse, some special team at Canonical is dedicated to writing these........

So I'm asking again... What the fuck, Ubuntu?

I'm moving all my servers off Ubuntu. I've completely lost trust in it. On the desktop I always hated it anyway. On servers I mostly used it because it's the default on most VPS providers, and I considered it the solid, no-drama LTS distro. Fuck that now.

I can't express how crazy this is. I didn't have time to migrate my services and data when I learned about this, so I had to take all my servers that run Ubuntu offline.

Oh and btw, distros run by volunteers (Debian, Arch, Alpine...) hve shipped the fix. Meanwhile Ubuntu, made by a company that sells security subscriptions, hasn't. This is true as of 2026-11-02 14:48 UTC.

Added after this blew up: Can't beat all the bullshit, so I parody it at Bloatberg.

The Daily Front Page 19 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — Security Desk
article

Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks

by majorchord·▲ 391 points·112 comments·freenode.net ↗

No patched kernels are available yet for 22.04, 24.04, or 26.04 despite a CVSS 9.8 rating.

Ubuntu has not shipped fixed kernels for CVE-2026-98432, a critical vulnerability scored CVSS 9.8, leaving the 22.04, 24.04, and 26.04 LTS releases without a vendor update.

Operators running those releases therefore have no official kernel package that closes the hole. The gap matters most for internet-facing and multi-tenant self-hosted systems that rely on Ubuntu’s LTS kernels for isolation and privilege boundaries; until packages appear, those hosts remain exposed to whatever remote or local attack the CVE enables.

Ubuntu has not announced an ETA for the fixes. In the interim, affected administrators are left to decide whether to stay on the stock kernel, apply out-of-tree mitigations if any exist, or move workloads onto releases or kernels that already carry the patch.

article

Trigger.dev customer environment variables exposed

by anurag·▲ 162 points·87 comments·trigger.dev ↗

Image for Security Disclosure: Sunday November 1st

There has been a security incident at Trigger.dev.

We've blocked the exploit used in this attack, but our investigation has identified exposure across a subset of organizations.

The attacker gained unauthorized access to environment variables for these organizations.

We have emailed all impacted account owners with steps to mitigate.

We will publish updates on our status page, and you can contact us if you have any questions.

The Daily Front Page 20 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — AI Money & Machine Culture
article

Anthropic's internal AI use, at retail prices, now exceeds its employee pay

by entryleveljobsc·▲ 301 points·243 comments·businessinsider.com ↗

Anthropic CEO Dario Amodei.

Anthropic CEO Dario Amodei. Aaron Schwartz/Bloomberg via Getty Images

Here's a remarkable milestone in the AI revolution: Anthropic now spends more on internal AI usage than it does paying employees.

The company revealed this in its IPO filing. In April, the value of Claude AI used internally, calculated at prices Anthropic charges customers, exceeded its monthly employee compensation costs, excluding stock awards.

By September, that internal AI usage had surged more than 250-fold since January.

There's an important distinction here. Anthropic isn't actually spending more cash on AI than salaries. It's valuing its internal AI consumption at retail prices.

Still, this feels like a watershed moment for the tech industry.

In March, I wrote about a new trend: Tech companies are starting to treat AI tokens (the main way to measure usage) as a fourth component of employee compensation, alongside salary, bonuses, and stock awards.

Anthropic's numbers show why. More than 90% of the code added to its software in September was written by Claude. Meanwhile, revenue has grown vastly faster than headcount.

For decades, talented humans were the most valuable resource in Silicon Valley. Now AI is challenging that assumption.

The Daily Front Page 21 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — AI Money & Machine Culture
article

Oracle files to sell $20B in new stock, bonds to finance AI buildout

by smartmic·▲ 174 points·157 comments·cnbc.com ↗

Key Points

  • Oracle filed plans on Monday to issue $10 billion in stock and $10 billion in bonds, it said in a filing.
  • The plans were outlined last week at its investor day.

The Oracle logo is displayed on a building at an Oracle campus in Redwood Shores, California, Sept. 10, 2025.

Justin Sullivan | Getty Images

Oracle filed plans on Monday to issue new stock and more debt to finance its artificial intelligence buildout.

The hyperscaler will sell $10 billion in common stock and $10 billion in senior notes, according to filings with the Securities and Exchange Commission. While the fundraising was already outlined at an investor day last week, shares tumbled 8.8% Monday.

"This seems to be exactly what they previewed," said Rob Oliver, senior research analyst at Baird. "So I'm not sure why the market is freaking about it."

Oracle said it plans to use the proceeds for general corporate purposes, which may include capital expenditures, repayments of debt and future investments.

The hyperscaler's stock initially bounced after last Wednesday's investor day, when Oracle also issued a revenue forecast of at least $225 billion for fiscal 2030. At the time Oracle also said it was limiting its additional capital market funding for the fiscal 2027 to 2030 investment cycle to that $20 billion.

"This is a major relief given concerns about the state of debt markets and the cost of capital (although UBS has argued that these debt market concerns have been over-stated)," UBS analyst Karl Keirstead said in a note on Thursday.

Oracle plans to turn to vendor financing, customer-provided hardware and customer prepayments to help it transition to positive free cash flow, which it expects to reach in the second half of 2028.

Stock and bonds in Oracle, co-founded by former CEO Larry Ellison, have been under pressure amid growing investor concerns about the massive amount of debt being taken on to fund AI infrastructure.

Oracle shares are down 33% in 2026 and 50% over the past 12 months. The yield on its investment-grade 4.95% bond due in 2031 is currently 7.276%.

The sentiment shift is also seen in Oracle's five-year credit default swaps, which are insurance against default. The spread sits at 292, up 265% in one year. That's more in line with a high-end junk bond rating, according to S&P Global Market Intelligence's Gavan Nolan.

While still an investment-grade credit, Oracle was downgraded by S&P to a BBB- in July, one rating level above high yield. It has $125.34 billion in debt, as of Aug. 31, with the bulk in senior notes.

What ultimately matters for Oracle is execution, Pat Nerney, head of investment solutions at Dynasty Financial Partners, said in an email to CNBC Monday.

"Can they do what they say they are going to do? We view this as the narrative across the AI space," he said. "If this gets executed according to plans laid out, they will be rewarded. If they have to come back to market in the back half of '27 after telling everyone this was the last of the capital needed ... look out."

— CNBC's Seema Mody and Ari Levy contributed reporting.

The Daily Front Page 22 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — AI Money & Machine Culture
The Daily Front Page 23 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — Also on the Front Page
The Daily Front Page 24 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — The Hiring Pages
ask hn

Ask HN: Who is hiring? (November 2026)

Please state the location and include REMOTE for remote work, REMOTE (US) or similar if the country is restricted, and ONSITE when remote work is not an option.

Please only post if you personally are part of the hiring company—no recruiting firms or job boards. One post per company. If it isn't a household name, explain what your company does.

Please only post if you are actively filling a position and are committed to replying to applicants.

Commenters: please don't reply to job posts to complain about something. It's off topic here.

Readers: please only email if you are personally interested in the job.

Searchers: try https://gethnjobs.com/, https://hnwork.app, https://dheerajck.github.io/hnwhoishiring/, http://nchelluri.github.io/hnjobs/, https://hnjobs.emilburzo.com.

Don't miss this other fine thread: Who wants to be hired? https://news.ycombinator.com/item?id=50338726

View the position →

The Daily Front Page 25 of 26
Monday, November 2, 2026 The Daily Front No. #261102 — Colophon

That's the Front for Today

Issue No. #261102 — Monday, November 2, 2026 — went to press 2026-11-03 at 04:55 UTC.

About This Magazine

The Daily Front is a daily digital magazine assembled from the stories that reached the front page of Hacker News on Monday, November 2, 2026. Headlines, points, and comment counts are recorded as they stood at press time. All articles remain the property of their original authors — every piece links back to its source and its discussion thread.

How It Was Made

Fetched, cleaned, and typeset by an automated pipeline. An editor model laid out the pages and chose the highlights; a second read a handful of the day's stories and briefed the cover illustrator — 26 model calls and 167k tokens in total. Set in Jacquard 12, Playfair Display, Source Serif 4, and IBM Plex Mono, all served via Google Fonts under the SIL Open Font License.

The Cover

The cover illustration was commissioned with this prompt:

A vast server room opens onto a guarded export checkpoint: at its center, a single glass case holds a dense, dark block of model weights, suspended above a scale whose pan sags under the burden. Beyond it, server racks stretch into the distance, one cabinet left open to reveal a tiny exposed kernel among the cables. A customs officer in plain clothes pauses a wheeled crate at the threshold while another checks its contents, making the route from powerful machines to the outside world feel suddenly uncertain.

Render the scene as a Zen garden reduction: overhead calm light across raked ivory sand, with the dense model weights as the single sculptural subject—a suspended charcoal mass inside a spare glass outline, above a scale whose pan visibly dips. Reduce the vast server room to receding graphite grooves; mark the open cabinet with one interrupted groove, a tiny exposed kernel, and a few threadlike cables. At the threshold, use two minimal plain-clothes human forms: one pauses beside a wheeled crate, the other inspects it, making the outward route uncertain. Restrict the palette to ivory, cool slate, charcoal, and a precise signal-orange accent on the checkpoint.

Absolutely no text, letters, numbers, readable symbols, or logos anywhere in the image. Keep the main image subject primarily below the upper 10% of the composition, where a title may be overlaid; the scene may extend naturally underneath that title area.

Production Ledger

StageModelCallsTokens InTokens Out
extractgpt-5.6-luna 22 96,445 45,926
layoutgpt-5.6-terra 1 18,706 2,155
covergpt-6-luna 2 1,628 388
covergpt-image-2.5-flare 1 291 1,372

The Publisher

Published by Johnny.

Support the Press

If The Daily Front brightens your morning, consider supporting its publisher.

Credits & Contact

All content — articles, posts, comments, and the images within them — belongs to its original authors and is reproduced here to point readers back to the source. Full credit goes to those creators; every item links to its original and its Hacker News discussion.

If you are an author and would like your content removed from an issue, write to hi@johnnys.page and it will be taken down.

Feedback is always welcome at the same address: hi@johnnys.page.

Credit where credit is due.

Every page of this issue began as someone else's work — these are the original sources, linked in full.

  1. Astra can read and write weights to improve Qwen by dbreunig — rikiyat.github.io·HN discussion ↗
  2. Show HN: Subvocal – Talk to your computer without making noise by aarushyadav — news.ycombinator.com·HN discussion ↗
  3. OccupySaaS by misswaterfairy — occupysaas.com·HN discussion ↗
  4. If you love a website, back it up by ingve — blog.mistys-internet.website·HN discussion ↗
  5. Supermarket freezers across Europe hit by second suspected cyber-attack by fergie — theguardian.com·HN discussion ↗
  6. Anthropic reports $17B in Q3 revenue, commitments of $895B in revised S-1 by rebel — cnbc.com·HN discussion ↗
  7. The SEC Should Block Anthropic's IPO to Protect the Public by cdrnsf — techpolicy.press·HN discussion ↗
  8. Anthropic's growth just flattened by cdrnsf — regenerator1.com·HN discussion ↗
  9. China's First Frontier AI Export Controls: Mofcom Announcement No. 48 by jonnybgood — labs.cloudsecurityalliance.org·HN discussion ↗
  10. We halved DNS build delay and cut memory use by 85% by wondersky — blog.cloudflare.com·HN discussion ↗
  11. Moving our warehouse off DuckDB by emschwartz — posthog.com·HN discussion ↗
  12. Show HN: I've updated my Linux System Call website and API by guitmz — syscall.sh·HN discussion ↗
  13. F/OSS Comics #13: BSD Unix, Part 3 – The Beginning of BSD Unix by joonehur — fosscomics.com·HN discussion ↗
  14. Let Me Ch... by alxgsv — blog.alxgsv.com·HN discussion ↗
  15. My Favourite Laptop by ibobev — blog.jsbarretto.com·HN discussion ↗
  16. Never Complain, Never Explain by gregsadetsky — en.wikipedia.org·HN discussion ↗
  17. WTF Ubuntu? by chalmovsky — chalmovsky.com·HN discussion ↗
  18. Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks by majorchord — freenode.net·HN discussion ↗
  19. Trigger.dev customer environment variables exposed by anurag — trigger.dev·HN discussion ↗
  20. Anthropic's internal AI use, at retail prices, now exceeds its employee pay by entryleveljobsc — businessinsider.com·HN discussion ↗
  21. Oracle files to sell $20B in new stock, bonds to finance AI buildout by smartmic — cnbc.com·HN discussion ↗
  22. Show HN: HackerHack – HackerBooks but for Posts Posted on HN by mw888 — news.ycombinator.com·HN discussion ↗
  23. Show HN: Wikihack – HackerTube, but for Wikipedia articles mentioned on HN by aizk — wikihack.netlify.app·HN discussion ↗
  24. US boy names that became girl names and vice versa by xoobdev — namedaisy.com·HN discussion ↗
  25. Bones may release proteins that slow aging and extend life span by EA-3167 — science.org·HN discussion ↗
  26. BYD sold more EVs last month than the US did all quarter by cisc — electrek.co·HN discussion ↗
  27. Show HN: Warsaw in voxels – An interactive 3D map of the city centre by stared — p.migdal.pl·HN discussion ↗
  28. Jobless tech workers are being left out of San Francisco's AI boom by mancerayder — bloomberg.com·HN discussion ↗
  29. Why are Soviet math textbooks so hardcore in comparison to US textbooks? (2017) by zenincognito — quora.com·HN discussion ↗
  30. Ask HN: Who is hiring? (November 2026) by whoishiring — news.ycombinator.com·HN discussion ↗

Browse all issues in the archive →