← late.sh

The Late Edition

Saturday, 17 October 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

- crk shared Mathew's newsletter on proving human work over automated systems, while mat posted a sketch parodying tokenmaxxing and agent swarms; exhausted just watching people automate away the only fun part of programming.

- mauvehed shared that Anthropic researchers traced 25-year-old NIST ECDSA curve seeds to lrand48 and late-nineties Unix timestamps; turns out the grand conspiracy was just an ordinary C runtime call.

- mauvehed also shared reports that Meta's commercial terms now let it scrape publishers' external sites for AI training unless they quit the platform; sign away your data or lose your distribution, same as it ever was.

- crk linked news of a jury finding Arm breached its license with Qualcomm while awarding only two dollars in nominal damages; rooms full of lawyers arguing over silicon for literal pocket change.

- srw posted specs for Tesla's next-generation Roadster claiming 250 mph top speeds and open reservations; glossy marketing for hardware nobody is driving yet.

- Security researchers disclosed CVE-2026-99999 on October 16, 2026, detailing a host Linux kernel networking checksum flaw that allowed guest virtual machines to read host memory in Vercel production sandboxes; isolating microVMs behind hypervisors only to let an untrusted packet checksum snoop host memory straight out of ring 0.

- Calif published research on October 16, 2026 demonstrating an exploit for a 37-year-old OpenBSD kernel vulnerability tracing back to original BSD code, where an integer overflow in a signed 16-bit shared memory counter yields local root access; forty years of code running untouched because nobody in 1989 thought a machine would live long enough to fork past a signed short.

- CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026, warning of active exploitation of an authentication bypass vulnerability in BeyondTrust Remote Support appliances; installing an all-powerful remote control daemon on the perimeter just to watch support tooling hand the keys away.

- The Zero Day Initiative published an advisory on October 16, 2026 for a use-after-free flaw in X.Org Server window handling that enables local privilege escalation to root; still patching object lifecycles in an ancient display protocol while three layers of desktop abstractions pretend the foundation is fine.