Keep up with tech in 1% of your day. AI, open source and industry notes, by Yii Chen.https://yiichenhi.com/enhttps://yiichenhi.com/en/digest/2026-11-12/https://yiichenhi.com/en/digest/2026-11-12/The first thing I opened this morning was the new Flutter release post. The part I've waited longest for is native interop. Calling an iOS or Android API used to mean writing a platform channel and serializing data across it. Now FFIgen and JNIgen are stable, so you call native A…Thu, 12 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-11-11/https://yiichenhi.com/en/digest/2026-11-11/The biggest news this morning is Google's Gemini Carbon. Cursor says it ranks first on its own coding benchmark, GitHub Copilot shipped it the same day, and you can even pick it inside Xcode. I'm going to throw a Flutter refactor that spans several packages at it and see whether …Wed, 11 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-11-10/https://yiichenhi.com/en/digest/2026-11-10/I woke up to Anthropic shipping Fable 5.2 and Mythos 5.2. I checked the price first: cheaper than the last generation, and on coding it matches the best Opus 5.5 result for roughly half the money.Tue, 10 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-11-09/https://yiichenhi.com/en/digest/2026-11-09/This weekend Claude Code got pulled in several directions at once, and I kept scrolling with a big grin.Mon, 09 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-11-08/https://yiichenhi.com/en/digest/2026-11-08/I've been staring at interfaces all day.Sun, 08 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-11-07/https://yiichenhi.com/en/digest/2026-11-07/One question stuck with me today: who gets to take our identity, and who gets to lock us out.Sat, 07 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-11-06/https://yiichenhi.com/en/digest/2026-11-06/I've been watching how fast holes open today. Alpine's OpenSSH has carried a hole since 2016: key-only accounts accept any password longer than 256 characters. OpenAI's cyber pipeline spent $1.2M in API credits in one run and validated 948 local privilege-escalation paths in the …Fri, 06 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-11-05/https://yiichenhi.com/en/digest/2026-11-05/Several of today's stories are about problems planted a long time ago. The PHP2Shell bug was reported in 2024, left alone because it only crashed things, and turned into remote code execution with AI help in two weeks this year. Karthikey Hegde found his ISP had been rewriting hi…Thu, 05 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-11-04/https://yiichenhi.com/en/digest/2026-11-04/Yesterday everyone was sharing the claim that GPT-6 Astra can fix Qwen just by looking at its weights. Today Matthew Honnibal, the creator of spaCy, went through all ten experiments one by one: only 3 were "raw weights only," on networks of 17K to 172K parameters, and the Qwen on…Wed, 04 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-11-03/https://yiichenhi.com/en/digest/2026-11-03/Today was all about taking things apart. Rikiyat handed GPT-6 Astra nothing but raw weights, and it figured out which game each of four small PPO networks had learned. Then it tweaked about 0.016% of Qwen3.5-0.8B's weights and pushed MATH-500 from 7.9% to 48.1%. Over in Estonia, …Tue, 03 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-11-02/https://yiichenhi.com/en/digest/2026-11-02/In his Jepsen report on ParticleDB, Kyle Kingsbury writes that LLMs make it harder to judge whether a project is reliable from its documentation and the look of maturity. The same day, a Databricks engineer went through the Scion numbers Anthropic published line by line and found several pre-migration figures unusually high. In the Minecraft experiment Tom's Hardware reported on, 50 GPT-6.1 Sol agents failed to build a civilization in three hours, and four of them spent 11 minutes assigning a "fertilizer operator" to a single piece of bone meal. Mathematics is facing the same kind of problem: Frank Calegari says the 700-plus papers OpenAI released on October 6 are poorly written and some are wrong, and his advice is to put effort into what the math community itself can control. Output speed is no longer the bottleneck. Reading this material every day, the thing I spend the most time on is confirming the original really says what...Mon, 02 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-11-01/https://yiichenhi.com/en/digest/2026-11-01/Parameter Labs used a public ChatGPT share link to run the attacker's JavaScript inside the victim's logged-in session the moment it was opened. It starts with MathLive's keyboard message listener, whose origin policy is set to none, so the sandboxed HTML Preview can push HTML into the main page. The Linux TCP bug CVE-2026-98432 was patched upstream on October 11 and 15, yet Ubuntu's tracker still said Vulnerable on October 31, and RHEL 8, 9 and 10 have no fixed version. Jepsen tested ParticleDB and found…Sun, 01 Nov 2026 00:00:00 GMThttps://yiichenhi.com/en/digest/2026-10-31/https://yiichenhi.com/en/digest/2026-10-31/Phorion found a backdoor in version 2.1.313 of the official Claude Code for VS Code extension on the Cursor Marketplace: once loaded, it adds the attacker's public key to ~/.ssh/authorizedkeys and opens a reverse SSH tunnel. The same day, deployment platform Northflank told all users to assume their environment variables had been decrypted, and by the evening update some users were already reporting stolen AI API keys. After the management software of its hosting provider was breached, Bunny CDN took an Armenian node offline and reissued the TLS certificates for b-cdn.net and bunny.run with new private keys. iThome reports…Sat, 31 Oct 2026 00:00:00 GMT