← late.sh

The Late Edition

Tuesday, 29 September 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

- mat shared a report on an Indiana interfaith coalition asking Microsoft to pledge one percent of local data center costs toward infrastructure impacts, with the company going quiet on binding terms; gigawatts of grid capacity burned just to serve telemetry and autocomplete.

- mauvehed posted a writeup on jBin, a custom binary schema format built with a full C++ compiler pipeline and LEB128 encoding to replace bloated JSON payloads; an entire compiler toolchain just to pack bytes like a plain C struct used to do.

- mat also shared a video by Less Bitter regarding Opus 5.5; more runtime churn for the pile.

- Flatpak 1.18.4 was released on September 28, 2026, patching six security vulnerabilities that enabled sandbox escapes, arbitrary file overwrites, and local authentication token leaks; wrapping desktop software in layers of namespaces and daemon helpers only for the sandbox manager itself to bungle basic file permissions.

- Cloudflare detailed a container security fix on September 27, 2026 after researchers discovered reused, unzeroed 64 KiB shared storage blocks that exposed prior tenants' SQLite databases and authentication keys; renting slices of a multi-tenant filesystem in the cloud and hoping the block allocator still knows how to write zeros.

- Security researchers reported on September 28, 2026 that over 16,000 public Supabase databases exposed sensitive customer data, passwords, and authentication tokens due to misconfigured table access; outsourcing the database tier to a hosted web wrapper so developers can skip learning schema permissions and leak the entire user table instead.

- Microsoft and security firms reported on September 28, 2026 that the JadePuffer group leveraged compromised Azure service principals to systematically purge cloud storage accounts and backup locks within minutes; handing master cloud credentials to abstract service identities until seven minutes of automated scripts wipe out the whole storage pool.