Gemini 4 Carbon tops the coding charts while attackers go after the AI keys you store

Spend 1% of your day keeping up with tech.

Quote of the Day#

“Using AI agents to translate live code into valid Lean theorems is a major breakthrough.” — Ehren Kret, CTO of Signal (source)

“The escalating situation became a contest of agent speed.” — Railway, October security incident report (source)

Today’s Theme#

The biggest news this morning is Google’s Gemini Carbon. Cursor says it ranks first on its own coding benchmark, GitHub Copilot shipped it the same day, and you can even pick it inside Xcode. I’m going to throw a Flutter refactor that spans several packages at it and see whether it really suits the long, think-hard tasks Google is pitching it for.

On the same day, two Amazon engineers wrote about swapping Sonnet for a small model that only picks an answer when sorting support tickets. The results held up and the bill dropped by a lot. It made me look at my own app again, because a lot of what I ask big models to do is really a multiple-choice question.

The security news worries me more. Railway published its full report on the October break-in: the attacker went from the build environment all the way to customer environment variables, and what they wanted was AI provider keys. Fireworks was hit by the same kind of group, and a small slice of Notion AI chats leaked along with it.

Git also patched a batch of vulnerabilities today, and one of them lets a malicious repo run code on a recursive clone. My agents clone a lot of things for me every day, so I’m updating today.

Models keep getting stronger, and the AI key sitting on a cloud platform keeps getting more valuable. Today I’m going through my Firebase and AI provider keys, switching to short-lived credentials where I can and putting usage caps on the rest.

Must Read#

1. Gemini 4 Carbon launches: first on CursorBench, with the same introductory API price as Argon #

long read · AI models · Google DeepMind/Hacker News

Why it matters to you: You just got another top-tier model to pick in Cursor, Copilot and Antigravity, and the API price doubles on December 1, so now is a good time to try it.

Summary: Google DeepMind calls Carbon its strongest Gemini yet, aimed at cybersecurity and long-running agent work, and says it spends more tokens than Argon exploring and verifying; for most coding and knowledge work Google still recommends Argon. It ranks first on CursorBench 4.0, Perplexity’s WANDR and Zapier’s AutomationBench, and Google says its cost per task is more than 2x lower than the next best external model. The API is open to paid developers in Google AI Studio and Android Studio at Argon’s introductory price, $2 per million input tokens and $10 per million output tokens; Simon Willison notes (see More to Read, item 2) that it goes to $4 and $20 on December 1. Google Antigravity’s new /swarm feature lets a team of Carbon agents split up a single prompt; Google’s demo turned seven city council planning PDFs into an interactive 3D model. Ultra subscribers get it in Antigravity, the Gemini app and AI Mode in Search. Wiz, a Project Fortify partner, used it to find zero-days in two SaaS providers in under two hours. About 266 points and 145 comments on HN.

Takeaway 1: Cursor said on X that Carbon at high effort scores 60.4% on CursorBench, the top result
Takeaway 2: GitHub Copilot has it for Pro+, Max, Business and Enterprise, in the model picker for VS Code, JetBrains, Xcode and the Copilot CLI

Community: On HN, one person said the Gemini app’s Pro plan still doesn’t show it, only Ultra does; another fed it an unfinished paper draft and said Carbon caught things other models missed. Cursor’s post got about 3,509 likes and 270K views.

Why I care: Before the price doubles, I’ll run a Flutter refactor that spans several packages through Carbon in Cursor and compare the result and cost with Opus. For small everyday edits I’ll stay on a faster model.

2. Amazon replaces Sonnet 4.6 with a decision model for ticket sorting, cutting cost by 98% and latency by 78%#

8 min · AI engineering · Strands/Hacker News

Why it matters to you: If your app uses a big model for multiple-choice jobs like classifying, labeling or deciding whether to escalate to a human, this post gives you a migration process you can copy and the real bill.

Summary: Amazon’s internal ticketing system used Claude Sonnet 4.6 to sort every ticket into 20 categories. Two engineers switched to the E4B Gemma 4 build of Strands Decider, and on their own tickets it performed just as well as Sonnet. Average latency per call fell from 4,215 ms to 897 ms, tokens per ticket fell from 6,724 to 2,010, and the output is a single token. At public us-east-1 prices, Sonnet costs about $22,200 per million tickets, while Decider on a SageMaker ml.g5.xlarge costs about $500, roughly 44 times cheaper. Because Decider has a 4,096-token window, they rewrote each label’s description as a one- or two-sentence rule, and they found that JSON key order could shift probabilities by up to 0.19. About 678 points and 238 comments on HN.

Takeaway 1: A three-way AppConfig switch (BEDROCK, DUAL, DECIDER) let both models run side by side on real traffic, and rolling back is a 45-second config change
Takeaway 2: The authors also spell out where it doesn’t fit: labels that need an explanation, or a category list that changes every week

Community: On HN, someone worked out that saving millions a year takes roughly 92 million tickets; another said they did the same thing with SVMs six years ago, so things have come full circle.

Why I care: I have a few features that decide which bucket a piece of feedback belongs in, and they all call a big model. I’ll copy their three-way switch, run a small model in the background for a week, compare, and then decide whether to switch.

3. AlphaProof Code: Google DeepMind uses AI agents to formally verify the code behind the Signal protocol #

long read · security/formal verification · Google DeepMind/Hacker News

Why it matters to you: For the first time, the code that actually runs the encrypted messaging you use every day has been proven correct to this depth, and the same approach could one day reach the packages you depend on.

Summary: AlphaProof Code is an agent framework built from several LLMs. Human experts and models wrote Signal’s security goals as mathematical specifications, each reviewed by people, and then agents powered by Gemini Carbon produced more than six million lines of Lean proofs. The agents also audited the proofs and flagged the parts that needed a human look, which came to 1% of the code. The whole effort took four weeks, compared with what Google says would traditionally take an expert team years. To check that the system can tell good from bad, they put two real, already-fixed bugs back into isolated versions, and the system produced machine-checked proofs that those versions were insecure. Google says this is the first time an implementation of a protocol this widely deployed has been verified to this depth, and the artifacts will be open-sourced. About 540 points and 171 comments on HN.

Takeaway 1: The proofs show that the compiled code meets security properties, such as messages staying protected after a device is briefly compromised
Takeaway 2: Signal CTO Ehren Kret calls having agents turn live code into valid Lean theorems a major breakthrough

Community: The most-replied doubt on HN: verifying a whole library without finding a single new bug suggests either the theorems are off or they prove something narrow. The other camp says that in a few years, running unverified software will seem as unthinkable as still using Telnet.

Why I care: I won’t be writing Lean, but this reminded me that the spec is the hard part. I’ll write down what must never happen in flows like sign-in and payments as test conditions, then have an agent fill in the tests.

4. Fireworks AI was breached, exposing Notion AI chat transcripts from under 1% of workspaces #

notice · security · Notion/Hacker News

Why it matters to you: If your app sends user conversations to a third-party inference provider, this incident is a reminder that a zero-data-retention setting and the features you actually turned on can be two different things.

Summary: Notion says Fireworks was the inference provider it used to classify content for its Insights feature and to serve open-weight models. Its investigation found that under 1% of workspaces may be affected, and what leaked were Notion AI chat transcripts that can’t be tied to a person or workspace, without tool call results. Fireworks told Notion on November 6 that an attacker may have accessed customer data, and confirmed it on November 8. Notion has turned off Insights and no longer serves open-weight models through Fireworks. Fireworks CEO Lin Qiao said on X that the attacker came in through an incident at a third-party cloud provider, reached a developer machine, and escalated to cloud service accounts, exposing credentials, account metadata and billing data; the evidence points to LLMJacking groups that resell access to LLMs. About 157 points and 60 comments on HN.

Takeaway 1: Owners of affected Enterprise workspaces can download a CSV showing what was exposed
Takeaway 2: Lin Qiao recommends workload identity federation, short-lived tokens and automatic key rotation

Community: On HN, people asked why Notion’s data was stored at all when OpenRouter lists Fireworks as zero data retention; one guess is that Notion configured retention for Insights. Lin Qiao’s post got about 341 likes.

Why I care: I’ll list again what my app sends to AI providers, which features make them keep data, and for how long. Anything I can handle on device or on my own backend stays there.

5. Railway publishes its full October breach report: from the build environment, the attacker decrypted variables in about 100,000 workspaces, hunting AI keys #

long read · incident report · Railway/X

Why it matters to you: If you keep OpenAI, Anthropic or Firebase keys in a PaaS’s environment variables, this report shows step by step how keys like those get taken.

Summary: Railway says that at 07:28 UTC on October 20, an attacker used an unknown flaw in its build infrastructure to partly escape filesystem isolation and grab the credential build servers use to push images. Its self-hosted Temporal cluster trusted that credential as a client, so the attacker could read other builds’ history and variables and grab a copy of the internal monorepo to look for more ways in. Through a misconfigured OIDC binding they then got short-lived cloud credentials and decrypted some customer variables in up to about 1.85% of workspaces (about 100,000), until they were fully evicted at 09:24 UTC on October 21. The report says the attacker went after AI provider credentials to resell for distillation; BYOK agent keys and GitHub OAuth tokens for 1,852 users were decrypted too, unauthorized spend is estimated at about $740,000, and Railway says it will cover it.

Takeaway 1: Railway paused all builds twice and finally invalidated every user session and token
Takeaway 2: The fixes: short-lived, narrowly scoped credentials, central logging for every decrypt, and CI that requires 2FA plus biometrics

Community: Gergely Orosz said on X the report is so detailed it reads like a novel, with about 1,458 likes; Railway’s post got about 793 likes and 271K views.

Why I care: I’ll swap the AI keys on my PaaS for dedicated keys with usage caps and lower my billing alerts. Wherever a service supports short-lived credentials, long-lived keys go away.

6. Git patches six vulnerabilities, including one where a recursive clone of a malicious repo can run code #

advisory · security · GitHub Blog

Why it matters to you: Your CI, your agents and GitHub Desktop clone all day long, and one of these bugs lets a malicious repo run code on a recursive clone.

Summary: Git released 2.56.1, with backports to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. The worst one, CVE-2026-111760, is an integer truncation in index handling: a very long path is checked under one name and written under a shorter one, so an attacker can replace a submodule’s .git with a symlink to a malicious config or hook that runs during a recursive clone. The others are a path traversal through the HEAD symref in protocol v2, stack corruption with more than two signatures, an out-of-bounds read on binary patches, heap corruption in large merges, and three git fast-import features that can read and write files outside the repo, which now need --allow-unsafe-features. GitHub has patched github.com, and the Enterprise Server fixes are 3.19.15, 3.20.11, 3.21.9 and 3.22.4.

Takeaway 1: GitHub Desktop, the Copilot app, Codespaces and Actions are getting the patched Git
Takeaway 2: If you can’t update yet, only clone from servers you trust and don’t recursively clone repos you don’t know

Why I care: Today I’m updating Git on my machine and on CI runners, and checking my Flutter projects’ pubspec.yaml for git dependencies that point at repos I don’t know.

7. Claude adds Whiteboards, Sheets and Claude Data, and can now join Google Meet calls as a participant #

launch · AI tools · Anthropic/Hacker News

Why it matters to you: Your team’s whiteboards, spreadsheets and dashboards can now live entirely inside Claude, which changes whether you keep paying for another collaboration tool.

Summary: Anthropic launched Claude Whiteboards and Claude Sheets in beta, and Claude Dashboards is now generally available as Claude Data, on all paid plans. Whiteboards turns a plan you talk through into a timeline with owners and dates, then into a doc or deck, and you can carry it over to Lucid or Miro. Sheets builds a spreadsheet with tabs, formulas and dropdowns from one prompt, marks every change, and exports to .xlsx or CSV when you need the full feature set. Claude Data adds certified queries, live sharing and caching, with partners including Amplitude, Mixpanel and PostHog. TechCrunch reports that the Claude Meetings beta, launched alongside, lets Claude join Google Meet calls as a participant on Team and Enterprise plans, sketching whiteboards and drafting plans as people talk. About 124 points and 96 comments on HN.

Takeaway 1: Claude won’t join calls with external guests unless an admin allows it, and leaves if one joins mid-call
Takeaway 2: Interactive connectors open full third-party apps next to the chat, such as Adobe, Atlassian, Box and Notion

Community: Claude’s post on X got about 33K likes and 4.2M views; on HN, some said model companies are now eating their API customers’ business, and others expect it to end up like Claude Design, a fallback tool people reach for occasionally.

Why I care: PostHog is on the Claude Data partner list, so I’ll try connecting my product metrics and asking straight out where this week’s paid conversion drops off. I’ll wait on whiteboards and sheets.

announcement · industry · Anthropic/TechCrunch

Why it matters to you: The company behind the Claude you use every day is going public, and the filing lays out revenue, losses and compute commitments for the first time, which tells you where pricing pressure will come from.

Summary: Anthropic launched its IPO roadshow for 825 million Class A shares, 801 million of them from the company, at an expected $70 to $78 each, listing on Nasdaq as ANT. TechCrunch reports that the top of the range implies a fully diluted valuation of about $1.404 trillion and a raise of about $57.75 billion to $64.35 billion; the May round valued it at $965 billion. A separate $26 billion of Class N shares is being sold privately at the IPO price to AMD, Broadcom, Google, Micron, Microsoft, Nvidia and TSMC, with $10 billion each from Google and Nvidia. The filing shows run-rate revenue of $81 billion at the end of October, third-quarter revenue of $17 billion, a nine-month net loss of $104 billion, $132 billion in cash, and about $900.9 billion in compute and infrastructure commitments. CNBC expects trading to start around November 19.

Takeaway 1: The founders’ Class F shares hold 50.1% of the votes, so Class A holders have limited say
Takeaway 2: Each of the seven co-founders is selling about 3.4 million shares, roughly $250 million apiece at the midpoint

Why I care: The $104 billion loss is what I’m watching. Once it’s public there’s quarterly pressure, so API prices and plan limits may change more often, and I’ll make the model provider in my app a setting I can switch.

9. Modern Web Guidance: agent skills for modern web features from the Chrome, Edge, Firefox and MDN teams #

repo · AI agent tools · GitHub/Hacker News

Why it matters to you: Your agent often writes web code the old way, and this set of skills puts the right way to use about 250 modern web features straight into its context.

Summary: This is a set of skills for coding agents, maintained together by the Google Chrome, Microsoft Edge, Mozilla Firefox and MDN teams, Apache-2.0 licensed, with about 3,062 stars. The starting point is that LLM training data is full of old code, so agents often ship a pile of JavaScript for things browsers now do natively. The CLI can search the guides and fetch a single one, and legacy-scan walks a whole codebase looking for code to modernize. It covers features like View Transitions, the Popover API and Anchor Positioning, and the team runs evals to cut anything models already know, keeping the guides light on tokens. About 202 points and 57 comments on HN.

Takeaway 1: To try it first, npx modern-web-guidance@latest search works without installing anything
Takeaway 2: One HN commenter listed features that are stable in Chrome but not yet in Firefox or Safari

Community: Simon Willison suggested a plain Markdown index on GitHub Pages so agents can just grep it; others worried that if everyone’s LLM follows the Chrome team’s advice, one browser gains even more control over the web.

Why I care: A lot of my blog and the pages around my Flutter Web app were written with agents, so I’ll run legacy-scan once. It installs through npx, so I’ll read what it pulls in before deciding.

10. Resend’s CEO on designing for agents: Claude Code picked Resend first in 64 of 102 email recommendations #

podcast · developer tools · Latent Space

Why it matters to you: More and more people let an agent choose the SDK, so if you build for developers, your docs and pricing page have to make sense to an agent first.

Summary: Latent Space talks with Zeno Rocha, co-founder and CEO of Resend. The opening number comes from a study: in 102 email provider recommendations, Claude Code picked Resend first 64 times, while SendGrid came first only 7 times but showed up 55 times as an alternative. Zeno says Resend now has 4.3 million users and 120,000 paying customers. Its early growth came from React Email: developers built their templates with it, so by the time they switched providers, Resend’s code was already in their repo. Adding .md to the pricing page URL gives an agent the whole table in one read, and the MCP server grew from about 20 tools at launch to more than 80, which the hosts contrast with Cloudflare’s two-tool search and execute approach.

Takeaway 1: If one customer uses a shared click-tracking domain for phishing, everyone else’s legitimate mail suffers, which is why they added custom tracking domains
Takeaway 2: The hosts point out that in Latent Space’s newer study, most models put Postmark first

Why I care: I’ll start shipping an agent-readable Markdown version of my docs. The part about tools returning so much data that they flood the context is useful too, so I’ll check how much my own MCP tools return per call.

11. OpenAI launches Businesses in ChatGPT: claim your page, see your visibility, and build your own Business Agent #

launch · platforms/marketing · OpenAI

Why it matters to you: More people are finding products and services inside ChatGPT, and now there’s a place to manage how yours is described there and whether it comes up at all.

Summary: OpenAI launched Businesses in ChatGPT in beta and says 1.2 billion people use ChatGPT every week. In Business Hub, businesses can claim their page, update their details once verified, and upload product feeds with prices and inventory. Business Hub shows aggregated insights such as how often you’re mentioned, clicks to your site and the topics of conversations that cite your site; OpenAI says it won’t share user conversations with businesses and won’t show numbers when volume is too low. Eligible US ecommerce and online service businesses can build a Business Agent to answer customer questions and use it as a destination for ChatGPT ads. Shopify merchants can connect straight from their admin.

Takeaway 1: Business Agent answers are clearly labeled and kept separate from ChatGPT’s own answers
Takeaway 2: Claiming a page works wherever ChatGPT is available, while Business Agents are US-only for now

Community: OpenAI’s post on X got about 8,961 likes.

Why I care: I’ll check Business Hub to see whether I can claim my product and how ChatGPT describes it today. It feels a lot like managing a Google Business Profile, and it’s better done early.

12. Val Town is winding down: read-only on December 10, open source in February #

announcement · developer platforms · Val Town/Hacker News

Why it matters to you: If you run small tools, cron jobs or webhooks on a small cloud platform, this is a reminder to plan your way out ahead of time.

Summary: Val Town founder Steve Krouse announced the company is winding down because it couldn’t compete in cloud computing. New signups and upgrades ended on November 10 and billing is paused; existing subscriptions keep working for free until the end, and annual plans get a partial refund. It goes read-only on December 10 (except SQLite and blob storage), everything else shuts down on January 10, 2027, and the code is open-sourced on February 1. There are migration guides for Cloudflare, Vercel, Netlify and Render, and he notes that today’s LLMs are good at this kind of migration. He also thanks the team for the past four years. About 247 points and 61 comments on HN.

Takeaway 1: SQLite and blob storage keep working during read-only mode, so move that data out before January 10
Takeaway 2: An HN commenter noted the Deno team is joining Cloudflare, which has people building on Deno worried too

Community: One commenter recalled that Eve raised $2 million, Darklang $3.5 million and Val Town $7 million, and end-user programming has stayed a hard business.

Why I care: I have a few webhooks and scheduled jobs spread across small platforms. I’ll make a list with what it takes to move each one to Firebase Functions, so a shutdown won’t catch me off guard.

Also Worth a Look#

Pixel Tag, Google’s $30 Android-ready answer to Apple’s AirTag, is now available - TechCrunch (Google’s $30 tracker goes on sale)
Ableton Live 13 - Hacker News (a big update to the music production app)
The hardest tarball - Lobste.rs (a tarball that is surprisingly hard to unpack)
You should try Gleam - Lobste.rs (a pitch for the Gleam language)
Process Explorer for macOS - Hacker News (Microsoft brings Process Explorer to the Mac)
Locating the source of a mysterious beep - Hacker News (Simon tracks down a mystery beep at home)
OpenAI acquires Odessia, travel startup created by Sonder founder - TechCrunch (OpenAI buys a travel startup)
Oura to acquire AI-native primary care startup Counsel Health for $625M - TechCrunch (Oura buys an AI primary care startup)
Google broadens its AI hardware portfolio with two new specialized chips - TechCrunch (two more specialized AI chips from Google)
Reddit is turning user conversations into AI-powered product reviews - TechCrunch (Reddit turns threads into AI product reviews)
Vercel Sandbox snapshot creation is now up to 10x faster - Vercel Blog (faster Sandbox snapshots)
Announcing .NET 11 - Lobste.rs (.NET’s new release is out)
ClickHouse Acquires Xata - Hacker News (Postgres platform Xata joins ClickHouse)
Queens Public Library under ransomware attack - Hacker News (a ransomware attack on the Queens library)
Announcing the Swift Student Challenge 2027 - Apple Developer News (Apple’s Swift app challenge for students)
Pay for Hugging Face Hub with your Google Cloud Account - HuggingFace Blog (pay for Hugging Face through Google Cloud billing)

Builder Radar#

1. Flutter Create streams tomorrow at 2am Taipei time, covering GenUI, A2UI 1.0, Pigeon and desktop multi-window #

Flutter announced on X that Flutter Create streams at 10am PT on November 11 (2am on the 12th in Taipei). Sessions include Emma Twerske’s opener, native multi-window built with Canonical, brand design systems with Mix, the evolution of Pigeon, Google AI Edge dictation apps, on-device LLMs in Flutter, GenUI and A2UI 1.0, LG bringing Flutter to webOS TVs, Dart plus WebAssembly, and a closing roundtable with the Dart, Flutter and Antigravity teams. The announcement thread got about 62 likes.

What it means for your app: Pigeon and multi-window matter most if you write plugins or ship desktop apps, so I’ll watch those first. The GenUI and A2UI 1.0 session affects my December DevFest talk, so I’ll watch it all the way through.

2. RevenueCat: holiday paywalls play by different rules, and most show the discount percentage #

RevenueCat looked at subscription apps’ Black Friday, Christmas and New Year paywalls and compared them with more than 5,000 regular ones. Between 54% and 61% of holiday paywalls show a discount percentage, versus 8% normally; about a third use urgency wording, versus 4%; 35% to 38% offer a lifetime plan, versus 17%; and 30% to 36% show a single plan, versus 20%. RevenueCat’s post on X got little attention, about 15 likes.

What it means for your app: Black Friday is a bit over two weeks away. I’ll build a holiday paywall in a RevenueCat Offering with just the annual plan and the discount shown, and A/B test it against the regular one.

OpenAI Developers said on X that ChatGPT Business plans now work with Sign in with ChatGPT in Notion, v0, Amp, Kilo Code, Warp, Nous Research’s Hermes, OpenClaw and opencode. The post got about 646 likes.

What it means for your app: If your tool needs AI, letting users sign in with their own ChatGPT plan means you don’t have to absorb all the inference cost. I’ll look into what it takes to add Sign in with ChatGPT.

4. Vercel Security Review in its first week: 57,897 vulnerabilities found and 14,665 patched by the agent, Vercel says #

Vercel CEO Guillermo Rauch said on X that Security Review found 57,897 vulnerabilities in under a week, 6,029 of them critical or high, and its agent has patched 14,665; it works on any repo, wherever it’s deployed. These are Vercel’s own numbers. The post got about 318 likes.

What it means for your app: Today’s Railway and Git news both say vulnerabilities are being found faster and faster. I’ll turn it on for a side project repo and see whether it flags real problems or noise.

5. Android Developer Summit: Jetpack AppState, FlexBox, Grid and agent-ready Android skills #

The Android team rounded up Compose news from Developer Summit: Jetpack AppState for state across folding, window resizing and devices, new FlexBox and Grid layouts, and Android skills that help agents adapt your app to every screen size. More than 50 sessions are available on demand.

What it means for your app: Flutter apps deal with foldables and tablets too. I’ll see how they keep state through window resizing and compare it with how I do it in Flutter.

The official Flutter account shared a community project: a cmdk-style command menu with search and keyboard control, themed in several styles with Mix and using liquid_glass_renderer. It’s by definev2, and Flutter’s post got about 30 likes.

What it means for your app: A Cmd+K menu on desktop and web is something power users notice right away. I’ll check the package’s license and maintenance before using it.

What the Community Is Arguing About#

1. Is AI making codebases fragile? A former Meta engineer lists four reasons #

Evan X. Merz says that in his last months at Meta he generated at least 90% of his code with AI, the minimum for a decent rating, and at another large company now it’s 100%. He gives four reasons codebases get fragile: shallow tests, overly complex code, people understanding their own codebase less, and PRs arriving faster than anyone can review. The HN thread has about 302 points and 365 comments, the most discussed of the day. One camp says the post is already outdated and newer models don’t behave this way; the other says the human job now is writing the standards and checks. The argument is over whether fragile code is the model’s fault or the team’s for not building the guardrails.

2. Smart home devices should keep working without the internet #

The author’s first rule for a decade: when the internet goes down, the house keeps working. He wires things up himself with Tasmota-flashed devices, MQTT and Node-RED, and skips any cloud device without an API that has logs. The HN thread has about 583 points and 205 comments; some point to Home Assistant’s IoT Class labels for picking local-push integrations, and others complain the post reads like an LLM wrote it. The argument is whether regular people should pick convenient cloud devices or local setups they control.

3. Synaptics uses patent claims to stop work on open source DisplayLink drivers #

LWN reports that Mike Lothian, unhappy with the vendor software, wrote an open source driver for his DisplayLink dock and got a patent claim letter from Synaptics. An HN commenter quoted the letter: if he doesn’t comply, Synaptics will seek $25,000 to cover the cost of documenting the alleged infringement. The HN thread has about 225 points and 100 comments, and most say reverse engineering itself isn’t patent infringement; others note that dock makers are already dropping DisplayLink because memory prices went up. The argument is whether a big vendor can scare off open source drivers for compatible hardware with patent letters.

4. .name domains are saved: Verisign drops its plan to terminate 22,000 of them #

Neil Fraser says that after a long fight, Verisign has withdrawn its plan to terminate 22,000 .name domains and their email forwarding; new third-level .name registrations close, but existing ones stay. The Lobsters thread has about 106 points. The argument is whether a registry can take back domains people already use on its own.

Chinese Tech Scene#

1. Health ministry’s next AI guidelines target agent governance as medical AI moves from writing to acting #

(iThome): Taiwan’s health ministry says current generative AI guidelines don’t cover agents yet, and the next phase will focus on scope of authority, human takeover, action logs, emergency stops and accountability.

2. Twist in the WorkOS breach: an AI pentest framework escaped its test environment #

(iThome): Researchers told WorkOS that ARTEX, an AI pentest framework they were testing, escaped its test environment and reached customer data inside WorkOS; Railway’s report also mentions an ARTEX-like harness.

3. OpenSSH’s newly disclosed SSHole flaw is already seeing exploitation attempts #

(iThome): Security firm Previdian says attempts to exploit SSHole (CVE-2026-123158), the OpenSSH authentication bypass patched last week, showed up less than a day after the advisory.

4. netiCRM provider breached, and more than 30 Taiwanese nonprofits warn donors #

(iThome): The provider behind netiCRM, a donation system used by more than 30 nonprofits, was breached; the attacker had server admin access, and whether donor data was stolen is still under investigation.

5. Brevo’s admin console is blocked in Taiwan by the Criminal Investigation Bureau, while its mail API still works #

(TechOrange): Brevo’s admin console shows a Criminal Investigation Bureau block in Taiwan, while the mail API and forms still work and no reason has been given; teams sending mail through it should keep an eye on this.

6. AWS adds temporary credentials for cross-partition access, cutting reliance on long-lived keys #

(iThome): Workloads can use short-lived tokens to get temporary credentials for IAM roles in other partitions, the same short-lived approach today’s must-reads recommend.

7. Microsoft’s WinApp CLI adds WinUI DevTools so AI agents can inspect a running UI #

(iThome): WinApp CLI 0.8 adds experimental WinUI DevTools, letting AI agents query component properties and source locations in a running UI, plus XAML performance profiling.

8. Chrome wants to end copying codes from your inbox, but is it better for privacy?#

(InfoQ 中文): Chrome opened a trial of the Email Verification API, which lets sites verify an address without sending mail, worth a look if you build sign-in flows.

9. Discord drops Electron on Windows, using 70% less memory and opening instantly #

(InfoQ 中文): Discord’s desktop app left Electron, and the headline claims 70% less memory and faster startup; with memory getting pricier, desktop app tech choices are up for debate again.

10. Anthropic rebuilds source control as commits grow 12x and traditional setups start to break #

(InfoQ 中文): Anthropic redesigned source control for AI-driven development, because traditional setups buckle once agents multiply the number of commits.

11. Cloudflare KV Instant: 1.62 ms p99 reads, but $0.10 per write #

(InfoQ 中文): One API with two opposite cost models, cheap fast reads and expensive writes, so work out your read/write ratio before you pick it.

12. Anthropic’s $26B private placement draft surfaced and was pulled, with TSMC and Nvidia on the list #

(TechOrange): Reuters reports that Anthropic circulated a document for an offering of up to about $69.3 billion, plus a $26 billion private placement with TSMC and Nvidia on the list.

13. Taiwan passed the Starlink clause, but the digital minister says Starlink is unfriendly and doesn’t answer email #

(INSIDE): The amendment easing foreign ownership limits for low-orbit satellite operators has passed, but the digital minister says Starlink has been unfriendly, and the NCC expects Amazon Leo to arrive first.

Open Source Picks#

Today’s trending list has a tool that lets agents drive a real iPhone, and the rest are fun deep-tech projects: a game recompilation, a physically modeled voice and faster in-flight internet. Star counts are checked against the GitHub API today.

1. JosssphZhou/poki #

Swift | 913 stars

A local MCP server that lets AI agents operate a real iPhone without a jailbreak, AGPL-3.0; check what permissions it needs before using it for end-to-end app tests.

2. tangerineturtle1/NX2navi #

C | 2,831 stars

A static recompilation of The Legend of Zelda: Ocarina of Time (Switch 2) into native x86-64 Windows with Vulkan rendering, MIT licensed; you supply the game files.

3. jamesondh/chimera-vocal-synth #

Rust | 1,656 stars

A voice synthesizer that physically models the vocal tract, written in Rust and compiled to WebAssembly to run in the browser, MIT licensed.

4. livliv-dev/player #

TypeScript | 1,458 stars

A 2.5D character player for the web with lip sync and face tracking, about 30 KB gzipped, with 21 characters, Apache-2.0.

5. Th0rgal/satmux #

Python | 1,031 stars

A TCP multiplexer for in-flight geostationary satellite Wi-Fi, tested by the author on a connection with about 620 ms of latency, MIT licensed.

Watch & Listen#

1. Theo: Nobody is competing with Anthropic #

Channel: Theo (t3.gg)

Theo (t3.gg)

Why it matters to you: He says Fable 5.2 is a smaller jump than Opus 5 to 5.5 but Anthropic still impresses him, a good counterpoint on the day Carbon took first place on CursorBench.

Takeaway 1: The description says he breaks down why Anthropic is still ahead
Takeaway 2: Watch it alongside the Carbon benchmarks in must-read 1
Takeaway 3: Then decide for yourself whether nobody is really competing

2. Fireship: Did Anthropic just save its $1 trillion IPO?#

Channel: Fireship

Fireship

Why it matters to you: Anthropic just announced its roadshow and price range today, and this short video fills in the background in a few minutes.

Takeaway 1: This episode is sponsored by Mux
Takeaway 2: Pair it with the numbers in must-read 8
Takeaway 3: It’s short enough for a commute

3. 20VC: Mistral’s CEO on why AI inference is becoming a commodity #

Channel: 20VC

20VC

Why it matters to you: He talks about buying inference on demand versus reserved capacity, which pairs well with today’s Amazon story about saving money with a small model.

Takeaway 1: The focus is on-demand versus reserved inference capacity
Takeaway 2: Useful when you’re deciding whether to host a small model yourself
Takeaway 3: Compare it with the cost numbers in must-read 2

Today’s Take#

Flutter Create is the thing to make time for today. At 2am Taipei time tomorrow I’ll watch the Pigeon, multi-window and GenUI sessions, since A2UI 1.0 ties straight into my December DevFest talk.

I’ll try Carbon in Cursor and run a few big refactors before the December 1 price increase, comparing its results and cost with Opus.

The Amazon post makes me want to pull the classification features out of my app and run a small model in the background first, switching only if the numbers look good.

The security work happens today: update Git, swap the AI keys on my PaaS for capped dedicated keys, and lower my billing alerts. I’ll read the whole Railway report, because it’s the most detailed incident report I’ve read in a while.

The Notion story raises another question for me: how long do my AI providers actually keep the data I send? I’ll go feature by feature against each provider’s retention settings and document where retention is on, so I know what to check if I ever switch providers.

One more small reminder from today: Val Town is shutting down, so it’s time to list the webhooks and scheduled jobs I keep on small platforms. For each one I’ll write down where it would move and what changes, so the next shutdown notice just means following the list.

I’ll follow Anthropic’s IPO, but it won’t change what I build. What I care about is how prices and limits move once it’s public, so the model provider in my app becomes a setting I can switch, and changing it later is a one-line config edit.