← late.sh

The Late Edition

Friday, 6 November 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

Radio: chillsynth 57 listeners, nightride 6, lofi 5

Booth: 16 listeners, 26 tracks queued

Arcade: 372 games finished, Netwalk most played

Lobby: 5 matches started, 2 finished, Snooker most played

Doors: 55 opened, NetHack 18, Realm 10, A Dark Room 7, BashQuest 6, Night City 5, others 9

- fellshard shared Bryan Cantrill arguing for Rust rigor over LLM code, mat shared This Week in Rust with systemd picking up the language, and eggy shared Discord rewriting its client in Rust to ditch Electron; twenty years of web view bloat just to rediscover native binaries.

- mat shared an OpenSSH flaw on musl libc where passwords over 256 characters unlocked disabled accounts, while veritas1A4 shared active exploits against an Apple pointer authentication bug and a ChatGPT sandbox escape via nested iframes; decades later and we still cannot properly validate a string.

- veritas1A4 shared OpenAI generating 948 Linux privilege escalation exploits with an autonomous pipeline, stego shared a survey finding executives trust AI over their own judgment, and odd shared data-center stocks sliding on infrastructure pushback; outsourcing the thinking to a machine that burns a power plant to guess the next token.

- veritas1A4 shared Apple scanning publicly linked iCloud files and disabling end-to-end encryption on shared items; trusting someone else's computer with your files was the original mistake.

- issai shared that Grand Theft Auto 6 digital pre-loads will require 212 gigabytes of storage space; back when an entire operating system and its compiler fit on a single floppy.

- OpenSSH and Alpine Linux released fixes on November 5, 2026 for CVE-2026-123158, an authentication bypass on musl-libc systems where passwords between 257 and 1,024 bytes allow logging into password-disabled accounts; walking straight through locked logins with an oversized string, back when crypt(3) and seven colon-separated fields in /etc/passwd handled authentication without surprises.

- Next.js released versions 16.4.5 and 15.5.29 on November 5, 2026 to patch seven vulnerabilities across its caching features, including an unauthenticated cache-poisoning issue affecting self-hosted reverse proxy deployments; poisoning your own application shell because a framework tried to reinvent caching, back when Apache served flat HTML files off a SCSI disk without an entire invalidation subsystem.

- Canonical released Mir 2.31 on November 5, 2026, adding experimental support for ext_foreign_buffer_v1, version 2 of the unstable xdg-decoration protocol, and a freely positionable magnifier; piling on compositor protocol extensions just to negotiate window frames, back when twm drew borders with two lines of C and never asked an IPC bus for permission.

- NVIDIA released CUDA 13.5 and the 620.70.06 Linux driver on November 4, 2026, introducing general availability support for the Vera Rubin architecture and batched memory copies for CUDA Python; stacking another gigabyte of runtime shims to herd data into a GPU, back when hardware acceleration was a floating-point coprocessor you slotted directly into the motherboard.