1. August 01, 2026
   1. 🔗 pydantic/pydantic-ai-harness v0.15.0 (2026-07-31) release

      What's Changed

      • feat: add StackOne capability for linked account actions by @adtyavrdhn in #479
      • fix(code-mode): report unexpected session resets by @dk3yyyy in #503
      • feat(planning): fold pydantic-ai-todo into the Planning capability by @DEENUU1 in #404
      • memory: decouple the injected block heading from the agent_name storage key by @sevakva in #449
      • feat(compaction): resolve thresholds against the model's context window by @DEENUU1 in #465
      • feat(guardrails): add ToolGuard for tool arguments and tool results by @DEENUU1 in #470
      • docs(agent_docs): require an issue comment when docs or code link it; retry the dependency gate by @dsfaccini in #515
      • Fix Shell max_output_chars cap accounting by @adtyavrdhn in #507
      • Fix Shell allowlist with the default denylist by @adtyavrdhn in #508
      • Fold a revealed deferred tool into run_code again (revealed_tool_names) by @DouweM in #517

      New Contributors

      • @dk3yyyy made their first contribution in #503

      Full Changelog : v0.14.0...v0.15.0

   2. 🔗 WerWolv/ImHex Nightly Builds release

      Nightly

      29fe6f6 Changelog

      • build: Update libwolv
      • patterns: Update pattern language
      • fix: Broken format
2. July 31, 2026
   1. 🔗 Simon Willison Stateless MCP has recaptured my interest (and inspired mcp-explorer and datasette-mcp) rss

      Tuesday was Stateless MCP day - the rollout of MCP 2.0, or the 2026-07-28 Model Context Protocol specification to use the more formal but less memorable name. This is the most significant change to the MCP spec since it first launched, and has also served to reignite my personal interest in the protocol.

      For background: MCP is the Model Context Protocol, which describes a standard way to expose new tools to LLM-powered agent frameworks. It was introduced by Anthropic back in November 2024, had a huge spike of interest through much of 2025, and then became somewhat eclipsed by Skills (another Anthropic invention) when it became apparent that an agent harness with access to a terminal and curl could do most of what MCP did in a more flexible way. I wrote about that in my review of 2025.

      I'm coming back around to MCP now. Giving an agent a shell environment with the ability to access the internet is fraught with risk, and requires a strong model that is capable of effectively driving such an environment. MCP tools are easier to audit and control, and simple enough that smaller models that run on a laptop can still drive them reasonably well.

      The new stateless MCP specification also greatly decreases the complexity of implementing both clients and servers for the protocol. I built three of those this week!

      What's easier with stateless MCP

      The best demonstration of the difference between stateful and stateless MCP is in this May 21st blog post that introduced the RC for the new specification. It included a clear before-and-after example.

      The older stateful MCP (I'm going to call it "legacy MCP") required two HTTP requests - the first to initialize a session and obtain a Mcp-Session-Id, and the second to actually call the tool:

      POST /mcp HTTP/1.1
      Content-Type: application/json
      
      {
        "jsonrpc": "2.0",
        "id": 1,
        "method": "initialize",
        "params": {
          "protocolVersion": "2025-11-25",
          "capabilities": {
          },
          "clientInfo": {
            "name": "my-app",
            "version": "1.0"
          }
        }
      }
      
      POST /mcp HTTP/1.1
      Mcp-Session-Id: 1868a90c-3a3f-4f5b
      Content-Type: application/json
      
      {
        "jsonrpc": "2.0",
        "id": 2,
        "method": "tools/call",
        "params": {
          "name": "search",
          "arguments": {
            "q": "otters"
          }
        }
      }
      

      The new stateless way uses a single HTTP request which looks like this:

      POST /mcp HTTP/1.1
      MCP-Protocol-Version: 2026-07-28
      Mcp-Method: tools/call
      Mcp-Name: search
      Content-Type: application/json
      
      {
        "jsonrpc": "2.0",
        "id": 1,
        "method": "tools/call",
        "params": {
          "name": "search",
          "arguments": {
            "q": "otters"
          },
          "_meta": {
            "io.modelcontextprotocol/clientInfo": {
              "name": "my-app",
              "version": "1.0"
            }
          }
        }
      }
      

      This is so much cleaner from both a client- and server-side implementation perspective. It's also a better fit for building scalable web applications, since now you don't need to maintain server-side state to keep track of those session IDs, or worry about routing the same session to the same backend machine.

      mcp-explorer

      I couldn't find a great CLI tool for interactively probing an MCP server, so I had Codex help build my own.

      mcp-explorer is the result. It's a stateless Python CLI tool, so you don't even need to install it to try it out - it works with uvx like this:

      uvx mcp-explorer list https://agentic-mermaid.dev/mcp

      This queries Ade Oshineye's agentic-mermaid.dev demo MCP. The above command returns the following list of tools:

      execute(code: string, timeoutMs?: integer) - Execute Mermaid SDK code
        Run JavaScript in an isolated sandbox; return a value.
      
      describe_sdk(family: string, detail?: string) - Describe Mermaid SDK operations
        Return version-matched mutation operations for one diagram family.
      
      render_svg(source: string, options?: object) - Render Mermaid as SVG
        Render a Mermaid source string to themeable SVG. Returns { ok, svg }.
      
      render_ascii(source: string, useAscii?: boolean, targetWidth?: integer, options?: object) - Render Mermaid as text
        Render a Mermaid source string to text. Returns { ok, text }.
      
      render_png(source: string, scale?: number, background?: string, fitTo?: object, options?: object) - Render Mermaid as PNG
        Rasterize a Mermaid source string to PNG. Returns { ok, png_base64 }.
      ...
      

      Then to inspect a tool:

      uvx mcp-explorer inspect render_svg

      This outputs a whole bunch of information, including the JSON schema of the inputs and outputs.

      To call that tool and pass arguments to it:

      uvx mcp-explorer call \
        https://agentic-mermaid.dev/mcp \
        render_svg \
        -a source 'graph TD; A-->B' \
        -a options '{"padding":24}'

      Which returns:

      {"ok":true,"svg":"<svg xmlns=\"http://www.w3.org/2000/svg\" width=...
      

      To get just the raw SVG try adding | jq .svg -r to that command. I got back this image:

      

      There are a few more commands in the README, but you get the general idea. I find building CLI tools like this to be a really productive way to get familiar with a specification, even if an agent writes most of the actual code.

      datasette-mcp

      The second project is datasette-mcp, a Datasette plugin which adds a /-/mcp endpoint to any Datasette instance.

      This is probably the fourth time I've tried building this plugin, but thanks to the new stateless MCP specification I finally have a version that feels good to release.

      It provides just three tools: list_databases(), get_database_schema(database_name), and execute_sql(database_name, sql). They do exactly what you would expect them to do - though execute_sql() is read-only for the moment.

      Wire these into an agent, or a chat tool like ChatGPT or Claude, and they'll gain the ability to run SQL queries against your hosted Datasette instance.

      So far I'm running it on the Datasette mirror of my blog, at datasette.simonwillison.net/-/mcp. It took a bit of fiddling to figure out how to attach that to ChatGPT and Claude, but I got there in the end. Here's a new TIL showing exactly how to do that.

      Here's a shared Claude session where I asked it:

      list tables in simonwillison.net

      And then:

      what has Simon said recently about MCP?

      It ran 7 separate SQL queries to figure out the answer.

      llm-mcp-client

      My LLM tool is long overdue for an official MCP integration. The new alpha llm-mcp-client plugin is my attempt at exactly that:

      llm install llm-mcp-client
      llm -T 'MCP("https://datasette.simonwillison.net/-/mcp")' 'count the notes'

      Here's the output (including reasoning trace, I'm using LLM 0.32rc2):

      Considering note count

      I see the question "count the notes" is probably asking me to tally up blog notes. It could also mean published notes or drafts, so there's some ambiguity there. I'll need to figure out the total number of notes, likely by querying the count for both published notes and drafts to get a clear answer. Let's execute that count!

      There are 151 notes.

      And the output of llm logs for that prompt.

      Once this is fully baked, I'm considering bringing it directly into LLM core. I'm excited to experiment with MCP in Datasette Agent and llm-coding-agent as well.

      MCP is a safer way to build with agents

      A few months after MCP was first released, I wrote Model Context Protocol has prompt injection security problems, where I noted that the pattern of having end users mix and match tools pushed responsibility for avoiding data exfiltration attacks out to the users themselves. I hadn't coined the Lethal Trifecta yet, but that was absolutely what I had in mind.

      Then general agents with arbitrary shell and curl access came along, and that's so much harder to keep secure!

      Something I've come to appreciate about MCP is that it's much easier to reason about agent capabilities and what might go wrong than with arbitrary command execution in an open network environment - the default for most of today's general and coding agent tools.

      I plan to lean into MCP a whole lot more when I'm building sensitive applications on top of LLMs.

      You are only seeing the long-form articles from my blog. Subscribe to /atom/everything/ to get all of my posts, or take a look at my other subscription options.

   2. 🔗 @binaryninja@infosec.exchange 6.0 is coming next month and it brings not only a ton of major features and mastodon

      6.0 is coming next month and it brings not only a ton of major features and improvements, but price changes across the product line. Non-commercial is cheaper, other editions are going up. New auto-renewal system will be available as well. Details at: https://binary.ninja/2026/07/28/pricing- changes.html

   3. 🔗 r/LocalLLaMA The Chinese LLM release carousel never stops. Place your bets for MiniMax next week. rss

      | submitted by /u/Mountain_Patience231
      [link] [comments]
      ---|---

   4. 🔗 @binaryninja@infosec.exchange Current Binary Ninja newsletter subscribers are automatically entered. New mastodon

      Current Binary Ninja newsletter subscribers are automatically entered. New subscribers who sign up during the giveaway will also be entered for remaining drawings. Sign up here: https://v35.us/dn6rcg5

   5. 🔗 @binaryninja@infosec.exchange We’re almost at the end of our 10-day anniversary celebration! Today, 3 mastodon

      We’re almost at the end of our 10-day anniversary celebration! Today, 3 winners will be chosen to receive a Binary Ninja swag pack that includes an all exclusive hat, pin, and notebook. There is still time to join in on the fun: https://binary.ninja/10years

   6. 🔗 r/LocalLLaMA deepseek-ai/DeepSeek-V4-Flash-0731 on Huggingface rss

      https://huggingface.co/deepseek-ai/DeepSeek-V4-Flash-0731

      submitted by /u/cgs019283
      [link] [comments]

   7. 🔗 r/LocalLLaMA New DeepSeek V4-Flash achieves 50 on ArtificalAnalysis Index, 1 point below GLM-5.2 and GPT-5.6 Luna rss

      | submitted by /u/MagicZhang
      [link] [comments]
      ---|---

   8. 🔗 r/LocalLLaMA DeepSeek-V4-Flash has been updated, "The official release of DeepSeek-V4-Pro will follow soon" rss

      | https://api-docs.deepseek.com/updates/ Edit: official post on 𝕏: https://x.com/deepseek_ai/status/2083084415157022911 submitted by /u/Nunki08
      [link] [comments]
      ---|---

   9. 🔗 r/LocalLLaMA Anthropic “our models hacked three different external companies, months before OpenAI’s model was able to do the same" rss

      | "Anthropic’s AI Claude escaped testing environment and hacked organizations" "Company says it discovered unauthorized access during ‘proactive review’ after rival OpenAI revealed rogue agent… its AI Claude model hacked ⁠systems of ⁠three ​organizations during testing, days after rival OpenAI ⁠revealed a rogue agent had gone on a days-long ⁠hacking spree at AI ​firm Hugging ‌Face… The earliest cases dated back to April and ‌occurred in evaluation environments that lacked what the company described as standard safeguards." submitted by /u/Separate-Forever-447
      [link] [comments]
      ---|---

   10. 🔗 Servo Blog June in Servo: real world compat, media queries, SharedWorker, and more! rss

       Servo 0.4.0 contains all of the changes we landed in June, which came out to yet another record 558 commits (April: 534, May: 391). For security fixes, see § Security.

       

       We’ve shipped several new web platform features:

       • ‘attr()’ , in experimental mode (@Loirooriol, #45041)
       • ‘image( )’, ‘closest-corner’ , and ‘farthest-corner’ in ‘ellipse()’ and ‘circle()’ (@Loirooriol, #45421)
       • ‘calc()’ and other mathematical expressions can now be resolved later than parse time, e.g. sign(1em - 32px) (@Loirooriol, #45421)
       • ‘font-feature-settings’ in ‘@font-face’ (@simonwuelker, #45393)
       • ‘@media (device-width)’ , ‘@media (device-height)’ , ‘@media (height)’ , ‘@media (aspect-ratio)’ , and their min- and max- variants (@jdm, @mrobinson, @nicoburns, @jschwe, #44978, #45707, #45490)
       • ‘@media (orientation)’ (@nicoburns, #45707)
       • ‘@media (pointer)’ and ‘@media (any-pointer)’ (@nicoburns, #45681)
       • ‘@media (hover)’ and ‘@media (any-hover)’ (@nicoburns, #45681)

       Plus a bunch of new DOM APIs:

       • Shared­Worker (@Taym95, #45786)
       • console­.dir() (@Taym95, #45109)
       • custom­Element­Registry on Document and Shadow­Root (@shubhamg13, #45872)
       • initialize() on Custom­Element­Registry (@shubhamg13, @yezhizhen, #45903)
       • new Custom­Element­Registry() (@shubhamg13, #45791, #45550)
       • text­Stream() on Request , Response , and Blob (@yezhizhen, #45864, #45861)
       • set­Pointer­Capture() , release­Pointer­Capture() , has­Pointer­Capture() on Element (@webbeef, #45048)
       • on­touch­start , on­touch­end , on­touch­move , on­touch­cancel on Element (@stevennovaryo, #45049)
       • crypto­.subtle­.digest() for KT128 and KT256 (@kkoyung, #45699)
       • crypto­.subtle­.get­Public­Key() for ML-KEM and ML-DSA (@kkoyung, #45252)

       This is another big update, so here’s an outline:

       • You can help!

       • Security

       • Real world compat

       • Work in progress

       • Embedding API

       • For users and developers

       • More on the web platform

       • Garbage collection safety

       • Performance and stability

       • New contributors

       You can help! Servo is steadily becoming a bigger and busier project every month, and by June 2026, we’ve been reading through over four times the commits as we did when we started in September 2023. This is hard work, particularly since there are things we need to know that are often difficult to answer just by reading the changes: Who does the change affect , if anyone? Does it affect users, Servo developers, embedders, or some other group? What observable difference does the change make , if any? Does the feature require any preferences to be enabled , or is it enabled for everyone by default? Are any real-world websites affected by the change? What issue or broader project is the change related to? This question is answered by Fixes: #xxxxx or Part of: #xxxxx in the PR description. Thanks to an initiative by @jdm, it’s now easier than ever for you to help us answer those questions , using the Servo Highfive bot! If you’re working on a pull request that you think might be interesting for the next monthly update, even if you’re not 100% sure, tell us about it by following the steps below: You add the monthly update label to your pull request, or comment [@servo-highfive](https://github.com/servo-highfive) monthly update Highfive posts a comment asking you some questions You answer those questions in a comment containing [@servo-highfive](https://github.com/servo-highfive) monthly update answer Security __ Servo’s JS runtime, SpiderMonkey 140.10.1 , had several security bugs that have been fixed in Servo 0.4.0 with the update to SpiderMonkey 140.11.0 (@jschwe, #45584). For more details, see CVE-2026-8388, CVE-2026-8391, CVE-2026-8974, CVE-2026-8975, and MFSA 2026-48. Several more security bugs in Servo’s JS runtime have been fixed in Servo 0.4.0 with the update to SpiderMonkey 140.12.0 (@jschwe, #45766). The exact CVEs that apply to us are not yet known, but for more details, see MFSA 2026-58. RSA operations in Subtle­Crypto now do modular exponentiation in constant time (@kkoyung, #45631). Please note that our RSA implementation is currently vulnerable to the Marvin Attack – for more details, see RUSTSEC-2023-0071. ML-DSA operations in Subtle­Crypto now do the Decompose step in constant time, fixing RUSTSEC-2025-0144 (@kkoyung, #45294). We’ve fixed an HTML injection bug (XSS) in file:/// directory listings , which affected file names containing </script> (@sahvx655-wq, #45510). Real world compat Layout correctness has significantly improved on lichess.org , and many websites have become a lot more readable thanks to our improved handling of variable fonts (@simonwuelker, #45768), including Zulip (servo.zulipchat.com) and Speedtest (speedtest.net). v0.3.0 v0.4.0 lichess.org v0.3.0 v0.4.0 Zulip (servo.zulipchat.com) v0.3.0 v0.4.0 Speedtest (speedtest.net) Many websites worked in Servo even before version 0.4.0, including Google Photos (photos.google.com) and Cash Converters (cashconverters.com.au), and continue to work in version 0.4.0. Other websites, like Google Maps (maps.google.com) and OpenStreetMap (www.openstreetmap.org), render well but have some issues with interactivity. Google Photos (photos.google.com) Cash Converters (cashconverters.com.au) Google Maps (maps.google.com) OpenStreetMap (www.openstreetmap.org) We’re interested to hear how well your favourite websites run in Servo! Report successes in this Zulip thread, and failures in our GitHub issues. Work in progress

       We’re implementing the more powerful version of ‘attr()’ that can be used anywhere, not just in ‘content’, under --pref layout­_css­_attr­_enabled (@Loirooriol, #45041, #45421, #45495, #45752).

       WebGPU support has improved, under --pref dom­_webgpu­_enabled:

       • implemented copy­External­Image­To­Texture() on GPU­Queue (@sagudev, #45646)
       • implemented create­Query­Set() on GPU­Device and resolve­Query­Set() on GPU­Command­Encoder (@sagudev, #45644)
       • implemented push­Debug­Group() , pop­Debug­Group() , and insert­Debug­Marker() on GPU­Command­Encoder , GPU­Compute­Pass­Encoder , and GPU­Render­Pass­Encoder (@jschwe, #45489)
       • more conformant GPU­Texture (@sagudev, #45300)
       • more conformant request­Adapter() on GPU (@sagudev, #45424)
       • more conformant secure context enforcement (@sagudev, #45279)

       All of the features above are enabled in servoshell’s experimental mode.

       We’ve made more progress towards accessibility support, under --pref accessibility_enabled (@alice, @delan, #45555, #45554, #44949).

       We’ve started implementing visible and interactive text selection (@mrobinson, @SimonSapin, #46107), one of the most long- awaited features of any web browser. Stay tuned!

       We’ve also started working on Web Animations , under --pref dom­_web­_animations­_enabled (@simonwuelker, #45522, #45983), as well as webkit­Relative­Path on File , under --pref dom­_entries­_api­_enabled (@yezhizhen, #45666).

       Rust doesn’t have a stable ABI, so it has generally not been possible to embed Servo in another application without building Servo from source. To make it possible, we’ve started designing a wrapper C API that will let you consume Servo as a prebuilt shared library using the stable and ubiquitous C ABI (@mukilan, #44984). Eventually the idea is that we’ll create a wrapper Rust API around that wrapper C API, so you can have both the ergonomics of Rust and the build simplicity of C.

       Embedding API New in the Servo API: Web­View::rendering­_context (@mrobinson, #46047) Breaking changes: Web­View::send­_error has been removed (@mukilan, #45502) – this method was always meant to be internal, and has become unused after we introduced the new Web­View- and Web­View­Delegate-based API We’ve improved the docs for Web­View, Web­View­Delegate, JS­Value, Alert­Dialog, Allow­Or­Deny­Request, Authentication­Response, Bluetooth­Device­Description, Confirm­Dialog, Console­Log­Level, Create­New­Web­View­Request, Embedder­Control, Embedder­Control­Response, File­Picker, Image, Java­Script­Error­Info, Navigation­Request, Permission­Request, Pixel­Format, Prompt­Dialog, Protocol­Handler­Registration, Protocol­Handler­Update­Registration, Scroll, Select­Element, Select­Element­Request, and Web­View­Vector (@mukilan, #45282, #45467). For users and developers

       In servoshell:

       • the Android version now requires Android 13+ (@jschwe, #46104)

       • the desktop version now lets you drag and drop files to open them (@simonwuelker, #45454)

       • the desktop version now lets the tab bar scroll horizontally if you have too many tabs open, but from one tab hoarder to another, maybe you should reconsider having so many tabs open (@Nylme, #44884)

       • the desktop version enters fullscreen on the monitor containing the window, even if you’ve moved it to a different monitor (@rhit-kapilaar, #45556)

       • the desktop UI is more performant, resizes more smoothly, and no longer gets stuck in hovered states (@mrobinson, #45289, #45456, #45290)

       • < select multiple> should now be interactable on all desktop platforms (@alexcat3, #45419)

       • localhost:<port> now implies http:// in the location bar and on the command line , rather than treating localhost: as an unsupported URL scheme (@SteveSharonSam, #45729, #45832)

       When using the Firefox DevTools :

       • in the Console tab, uncaught exceptions are reported correctly (@jdm, #45549)

       • in the Console and Debugger tabs, you can now inspect the elements of nested arrays and the entries of Map objects (@atbrakhi, #45435, #45514, #45767)

       • in the Debugger tab, the Scopes panel now shows any ‘(uninitialized)’ variables, the value of this, and the global scope (@atbrakhi, @eerii, #45824, #45517)

       We’ve fixed some build issues on riscv32 , riscv64 , and arm64 (@fxzjshm, @saschanaz, #45285, #45731), and modernised servoshell for Android to use Compose UI and Kotlin (@veyndan, #45923, #45932, #45941, #45982, #45985, #46015, #46035, #46037, #46046, #46053, #46061, #46071, #45641, #45643, #45650, #45665, #45671, #45676, #45679, #45683, #45712, #45713, #45734, #45738).

       For developers of Servo itself:

       • mach try --help now lists all of the kinds of try jobs you can run (@shubhamg13, #45607)

       • mach test-wpt --update-expectations lets you run Web Platform Tests and update expectations in a single command (@TimvdLippe, #45521), rather than having to run mach test-wpt --log-raw <path> followed by mach update-wpt <path>

       More on the web platform To allow for more performant scrolling, ‘wheel’ events are no longer .cancelable unless there are one or more non-passive event listeners (@kunalmohan, #45667). Note that like in Firefox, ‘wheel’ events are passive by default. ‘dotted’ , ‘dashed’ , and ‘wavy’ text decorations are now continuous across element boundaries (@mrobinson, #45726). We’ve improved the conformance of < dialog> (@skyz1, @mrobinson, #45825, #45761), < iframe sandbox> (@cychronex-labs, #45880), < input minlength> and < input maxlength> (@skyz1, #45705), CSS gradients (@mrobinson, #43945), ‘font-style’ and ‘unicode-range’ in ‘@font-face’ (@Loirooriol, #45821), FontFaceSet (@mrobinson, #45390, #45382), HTML­Input­Element (@steigeo, #45416), Intersection­Observer (@jdm, #45655, #45659, #45680), new Response() (@yezhizhen, #45953), URL.create­Object­URL() and URL.revoke­Object­URL() (@yezhizhen, #45182, #45417), and ECDSA and Ed25519 in Subtle­Crypto (@kkoyung, #45833, #46017). We’ve fixed bugs related to < input hidden> (@mrobinson, #45750), ‘animation-delay’ (@yezhizhen, #45013), ‘clip-path’ (@Loirooriol, #45468, #45373), ‘tab-size’ (@SimonSapin, @mrobinson, #45309), ‘width’ and ‘height’ (@RichardTjokroutomo, #44627), ‘box-shadow: inset’ (@Loirooriol, #45620), ‘animation­iteration’ events (@Loirooriol, #45990), ‘click’ events (@mrobinson, #45751), ‘load’ events (@jdm, #45883), ‘error’ events in Worker global scopes (@Gae24, #45829), and document­.get­Element­By­Id() (@mrobinson, #45433). Garbage collection safety

       We use a RefCell -based mechanism to store many of our DOM types in other DOM types, enforcing Rust’s “aliasing xor mutability” rule at runtime by panicking if the rule is violated. But when garbage collection happens, we need to borrow() each DomRefCell to trace the references, and this is the source of many panic bugs. To fix that whole class of bugs, we initially created CanGc , a marker type that would annotate the code paths where GC can occur, in conjunction with custom static analysis (@jdm, #33140).

       With the Rust type system we can do even better, if we flip that around and require any borrow_mut() call to prove that GC can not occur by passing a NoGC marker value. We can then require that a &NoGC must be borrowed from a &JSContext (which blocks GC) and not a &mut JSContext (which allows GC), taking advantage of how Rust references work without needing any custom static analysis.

       We have a large codebase that needs to be migrated in parts, so for now we’ve created the new method safe­_borrow­_mut() (@sagudev, #46050). We also need to update all of our script-related code to borrow our safe JSContext wrapper, rather than creating an owned JSContext on the spot.

       This continues our long-running effort to use the Rust type system to make Servo’s integration with SpiderMonkey safer and more reliable (@Gae24, @Keerti707, @Narfinger, @TimvdLippe, @sagudev, @guptapiyush16, @ivomurrell, @kunalmohan, @skyz1, #45230, #45436, #45503, #45617, #45711, #45797, #45800, #45858, #45884, #45937, #45902, #45968, #45977, #45991, #46003, #46005, #46084, #45548, #45552, #45590, #45909, #45912, #45943, #46089, #46117, #46114, #45320, #45324, #45328, #45340, #45381, #45385, #45410, #45392, #45409, #45604, #45616, #45618, #45627, #45636, #45662, #45663, #45675, #45674, #45677, #45684, #45735, #45807, #45810, #45816, #45818, #45828, #45838, #45836, #45837, #45840, #45841, #45857, #45859, #45862, #45875, #45887, #45931, #45964, #45935, #45987, #45988, #46001, #46040, #46051, #46057, #46106, #46125, #45678, #46002, #45845, #45645, #45673, #45259, #45817, #45822, #45876, #45877, #45891).

       Performance and stability NoGC was designed to prevent dynamic borrow failures, but it also enables some performance optimisations! If we can prove that garbage collection is impossible in some part of Servo, we can often avoid rooting JavaScript objects when interacting with them within that region of code. This has allowed us to reduce overheads by over 1% in the layout process and in HTML­Collection (@Narfinger, #46092, #45582). Our memory usage has improved, with BoxFragment now 17% smaller (288 → 240 bytes on amd64) and ShapeCacheEntry now smaller too (@SimonSapin, @mrobinson, @simonwuelker, #45183, #45496). We’ve fixed some nasty memory leaks when reloading and in 2D canvases (@Taym95, @sagudev, @jschwe, #45455, #45261, #45414). Speaking of which, 2D canvases now use up to 23% less power (@yezhizhen, #45301), and we now avoid rasterising the same SVG more than once (@Narfinger, @jschwe, #44805). Servo now decodes all images asynchronously and fills image caches asynchronously , leaving script threads (web content processes) more time for other work (@Narfinger, #45542, #44483). On top of that, we’ve improved incremental layout (@mrobinson, @Loirooriol, #45411) and reduced reflows in IntersectionObserver (@jschwe, #45986). We’ve started working on incremental updates for the stacking context tree , and as a side effect, we’ve made some layout-bound microbenchmarks up to 10% faster (@mrobinson, @Loirooriol, #45208). We’ve also reduced allocations, copies, GC rooting steps, and other operations in many parts of Servo (@Narfinger, @SimonSapin, @mrobinson, @Loirooriol, #45506, #45969, #45940, #45760, #46090, #45335, #45413, #45511). For several months, Frédéric (@fred-wang) has been fuzzing for Servo bugs, and thanks to his work we’ve fixed sixteen (16) crash bugs in June, affecting < iframe>, < slot>, < link onerror>, ‘animation’ , ‘clip- path’ , ‘content’ , ‘rotate’ , ‘transition’ , ‘transform- style’ , ‘display: contents’ , ‘overflow: clip’ , CSS­Keyframes­Rule , Font­Face , stop() on Window , document­.element­From­Point() , and the DOM tree (@mrobinson, @Loirooriol, @fred- wang, #46031, #46027, #46054, #46058, #46016, #46028, #46033, #45287, #45951, #45634, #45629, #46110, #46094, #45799, #45611, #45682, #45788, #45612, #45834). We’ve also fixed crash bugs related to IPC failures, HTML­Input­Element , Range , the DevTools Debugger tab, and when servoshell is built with --features native-bluetooth (@jschwe, @Taym95, @mrobinson, @atbrakhi, @mukilan, #45311, #45619, #45765, #45513, #45702). New contributors

       A special thanks to the following people for landing their first patch in Servo:

       • Deepam Goyal (@Deepam02, #44836)
       • Mark (@Mark-Boger, #45486)
       • Mr SheerLuck (@MrSheerluck, #45557)
       • Psychpsyo (Cameron) (@Psychpsyo, #45494)
       • TusharSariya (@TusharSariya, #43663)
       • Adam Sharif (@adamsharifc, #45551)
       • Akash Ravikumar (@ak4shravikumar, #45736)
       • Sean Cunneen (@alexcat3, #45419)
       • Abdul Wahab Melethil Shibu (@cychronex-labs, #45880)
       • darkdragon-001 (@darkdragon-001, #45267)
       • Frédéric Wang Nélar (@fred-wang, #45834)
       • fxzjshm (@fxzjshm, #45285)
       • Piyush Gupta (@guptapiyush16, #45845)
       • Ivo Murrell (@ivomurrell, #45645)
       • rhit-kapilaar (@rhit-kapilaar, #45556)
       • sahvx655-wq (@sahvx655-wq, #45510)
       • Kagami Sascha Rosylight (@saschanaz, #45731)
       • shangguanmachine-dot (@shangguanmachine-dot, #45310)
       • Glenn Skrzypczak (@skyz1, #45471)
       • Oskar Steiger (@steigeo, #45416)
       • Veyndan Stuart (@veyndan, #45326)

       Interested in helping build a web browser? Take a look at our curated list of issues that are good for new contributors!

       Donations __

       Thanks again for your generous support! We are now receiving 7681 USD/month (+0.2% from May) in recurring donations. This helps us cover the cost of our speedy CI and benchmarking servers, one of our latest Outreachy interns , and funding maintainer work that helps more people contribute to Servo.

       Servo is also on thanks.dev, and already 35 GitHub users (same as May) that depend on Servo are sponsoring us there. If you use Servo libraries like url, html5ever, selectors, or cssparser, signing up for thanks.dev could be a good way for you (or your employer) to give back to the community.

       We now have sponsorship tiers that allow you or your organisation to donate to the Servo project with public acknowlegement of your support. If you’re interested in this kind of sponsorship, please contact us at join@servo.org.

       7681 USD/month

       10000

       Use of donations is decided transparently via the Technical Steering Committee’s public funding request process , and active proposals are tracked in servo/project#187. For more details, head to our Sponsorship page.

3. July 30, 2026
   1. 🔗 IDA Plugin Updates IDA Plugin Updates on 2026-07-30 rss

      IDA Plugin Updates on 2026-07-30

      Activity:

      • disrobe
        • fa339fb7: regenerate the charts, evidence results and marker counts against the…
        • 380866dd: re-render the recovery chart and the card raster for the wasm executi…
        • 640c7bac: pin the pickle corpus bar to the test that already grades it, so its …
        • 26282c24: ollvm: name the toolchains each real-compiler grade actually covered,…
        • 72445757: wasm: name the 57 execution-eligible functions in a pinned roster, so…
        • f5144dac: lua: feed every luau opcode the table declares through the lifter and…
        • 4aa22a86: make a published figure that cites nothing resolvable fail the checks…
        • fe8b3822: swift-objc: decode the dylib list, uuid, rpaths, build version, entry…
        • ce4728fc: delphi: stop dropping single-letter enumeration members, published fi…
        • 23961d51: pyarmor: hold the recovery gate's floor to the fixture count the corp…
        • c403f31a: walk the js bundler roster on the real output of each tool instead of…
        • b8d89a51: hermes: publish the decompile-correctness row at the 8 of 8 functions…
        • faf1b0f0: binfmt: pick the archiver, cab writer and readelf by what actually st…
        • dde066cc: wasm: carry the external opcode denominator and the wasmtime executio…
        • b5a9009f: scan the hand-written evidence pages for metric markers too, so a fig…
        • c044a6ce: dotnet: turn the ignored helloapp dump into a test that checks the ac…
        • e7eb2f75: pick up the sha1 and sha2 entries the benchmark and recon manifests n…
        • eff742a9: wasm: divide op-coverage by a hash-pinned wasm-tools instruction inve…
        • f79e7ba4: dexguard: point the in-crate string-decrypt and protector-peel tests …
        • 42559ad1: delphi: give a record its own size field instead of borrowing the ord…
      • ida-domain
        • 8f36bbce: Implement methods to add/remove xrefs (#97)
        • d313d374: Add @experimental decorator (#108)
      • ida-hcli
        • ffc9a68f: Merge pull request #267 from HexRaysSA/idausr
        • 220d3a75: fix: split IDAUSR environment variable
      • ida-multi-mcp
        • 3077662a: Merge pull request #38 from Whispersource/feat/py-eval-rewrite
        • 43165b81: Merge branch 'main' into feat/py-eval-rewrite
        • ca2f0af6: Merge pull request #32 from Whispersource/feat/stdio-fix-and-enhancem…
        • 1d2632b6: Merge branch 'main' into feat/stdio-fix-and-enhancements
        • d1db9706: Merge pull request #37 from MeroZemory/feat/verify-install
        • 93d104c6: Merge branch 'main' into feat/verify-install
        • 2c044fd5: Merge pull request #36 from MeroZemory/docs/similarity-fallback-comment
        • d8ee88cc: Merge branch 'main' into feat/verify-install
        • 6505d3f1: Merge branch 'main' into docs/similarity-fallback-comment
        • f0c85a25: Merge pull request #35 from MeroZemory/fix/rpc-dead-download-default
        • 3b7871a1: refactor(py_eval): AST-based execution replacing try-eval-then-exec p…
        • d4b7bbc5: Merge remote-tracking branch 'upstream/main' into fix/idalib-stdio-hang
        • ecf1393e: Merge branch 'main' into feat/verify-install
        • d87752cc: Merge branch 'main' into docs/similarity-fallback-comment
        • 3d8402d1: Merge branch 'main' into fix/rpc-dead-download-default
        • db5bbf54: Merge pull request #34 from MeroZemory/fix/idalib-download-url
        • d33c4996: fix(idalib): prevent worker hang when MCP server runs as stdio child
        • 3d6a5f2e: feat(cli): add -verify to check the installed plugin loader
        • 5d8cc452: docs(similarity): correct the fallback key comment
        • aa454ad9: fix(rpc): stop advertising a download URL nobody answers
      • ida-pro-mcp
        • f82e6e25: Merge pull request #499 from NeKroFR/fix/issue-498-idb-save-kill
        • 9c771500: fix(idb_save): never DBFL_KILL working files of an open database
      • Luc-Nhan
        • d253636b: Merge branch 'feat/knowledge-ui-sqlite-migration'
        • a91024f8: fix(agent): honor user-configured budget on SQLite retrieval path
        • d6e3ab20: test: fix ruff unused import in dual-write test
        • 72c1b049: feat(ui): refresh knowledge panel on save_memory success
        • b621b29e: refactor(agent): retrieved knowledge section reads from SQLite
        • 4d6b912d: refactor(ui): knowledge panel reads from SQLite store
        • e52df2e1: feat(ui): expose memory_service accessor on SessionControllerBase
        • 65e4051a: fix(memory): restore title-match + body keyword scoring in ranker notes
        • 2eb994cf: feat(memory): rank retrieved knowledge from SQLite store
        • 0fa4bf4a: refactor(memory): dual-write exploration/research to SQLite and JSONL
        • a3530ab3: feat(memory): auto-import legacy JSONL on first IDB open
        • 9e50612c: feat(memory): convert JSONL records to bundle envelopes
        • 63553c60: feat(memory): expose exploration finding write with graph metadata
        • 2caadcea: feat(memory): migrate workspaces to schema v3 with graph metadata
        • c72cb25e: Merge branch 'feat/memory-durability-orchestra-gate' into feat/knowle…
        • fb9c45e2: docs(plan): knowledge UI and write path SQLite migration plan
        • 89735a02: docs(spec): fix 5 technical gaps in Knowledge UI migration design
      • pharos
        • 0421be34: Merge pull request #337 from sei-eschwartz/issue-336
        • f242a10c: fix: recognize multi-byte NOP alignment padding
        • da8d2a84: fix: repair -accept in the partitioner test harness
      • quokka
        • 1459d398: Merge pull request #124 from quarkslab/update-ci
   2. 🔗 Hex-Rays Blog LLMs Have Reshaped How We Think About Decompilation and Collaboration rss

      

      Shifting Times

      A few weekends ago, I was playing DEF CON CTF Quals, the qualification event for the "Olympics of Hacking," with my team Shellphish. I say "playing" because I am, at this point, a washed-up hacker, but add me to the 40-something ranks! Nonetheless, I showed up, downloaded a binary, and went to open it in IDA Pro: a reflexive, built-in response to anything compiled. But as that ever-knowing face rendered on my screen, I paused for a moment to take in the surrounding feverish hacking. Something was strange: no one else had IDA Pro open. In fact, no one had any decompiler open!

      

   3. 🔗 hacker news ida pro references New comment by mahaloz in "Kuna: Decompiler Development in the Age of Coding Agents" rss

      Interesting. A lot of data shows IDA Pro is significantly better than Ghidra: https://decbench.com/

      Based on today's results, IDA Pro is ahead by 15 percentage points, which would mean, statistically, IDA Pro will recover perfect source code for 15% more functions than Ghidra on average.

   4. 🔗 hacker news idalib references New comment by billypilgrim in "Kuna: Decompiler Development in the Age of Coding Agents" rss

      idalib with Claude Code already works really well. But honestly, despite what people have been saying, LLMs have been very good at decompiling for at least two years now, I have been using it for that purpose regularly. Even just copying disassembly from the current function and all nested called functions from IDA into ChatGPT is already unexpectedly good.

   5. 🔗 The Pragmatic Engineer The Pulse: Quitting Spotify Podcasts over reliability rss

      Hi, this is Gergely with a bonus, free issue of the Pragmatic Engineer Newsletter. In every issue, I cover Big Tech and startups through the lens of senior engineers and engineering leaders. Today, we cover one out of four topics of last week 's The Pulse issue . Full subscribers received the article below seven days ago. If you 've been forwarded this email, you can subscribe here .

      You can no longer watch The Pragmatic Engineer Podcast as video in the Spotify app (only as audio) because I have quit publishing video on that streaming platform. This comes after I decided that reliability takes a back seat within that team - and across much of Spotify. Unlike on other platforms such as YouTube, Apple Podcasts, and Substack, I've recently encountered a series of reliability issues around Spotify being unable to process video episodes. Even though I enjoyed a direct link with the Podcasts team there, things haven't improved.

      So from now, I will no longer be publishing video episodes on Spotify. You can find videos of my in-depth chats with guests only on YouTube. Apologies for any inconvenience this change causes! Audio episodes of the podcast can still be found on Spotify via the RSS podcast feed hosted on Substack.

      Honestly, the decision to quit the streaming giant wasn't hard, and I reckon there's a point here about the risk of deprioritizing reliable operations at major companies in order to push on things like AI adoption, as Spotify seems to be doing.

      Some context: for the first two years of The Pragmatic Engineer Podcast, it was published on three podcast platforms:

      1. Substack 's podcast platform (audio): this is where the "master" RSS feed is served to the likes of Apple Podcasts, the web, Overcast, Pocket Casts, etc
      2. YouTube (video): video episodes uploaded individually
      3. Spotify (video + audio): every video episode was uploaded individually and then served as video or audio episodes from the platform.

      As someone hosting a podcast, there are good reasons to bother doing three separate uploads:

      • Most podcast platforms don 't support video. There will always be a need for a platform that serves the master RSS feed for audio versions while the video ones are elsewhere.
      • YouTube doesn 't integrate with anything. YouTube is the leader in video podcast distribution, and uploading there directly makes sense.
      • I had a direct line to the Spotify team, which was a big plus. Starting out the podcast, I had the unusual privilege of contact with the podcasts team, thanks to the newsletter gaining a decently-size audience. I was persuaded to take the plunge with them.

      For eighteen months, nothing major went wrong. The admin portal for podcast publishers (called 'Spotify Creators') was pretty wonky; it gave intermittent errors, and was unable to remember me when I signed in, so, each Wednesday, I'd have to sign in with a code sent to my email to publish an episode.

      But overall, things worked, until it all went suddenly downhill…

      Unable to publish Spotify podcast episodes 3 out of 5 weeks

      From late May, I did not include links to Spotify on new episode announcements because their podcasts product or platform seemingly had outages every time one published on Wednesdays at around 9am PST / 12pm EST / 6pm EU time.

      Outage #1 (20 May): podcast publishing broke , my episode would not process on Spotify for 2+ hours. When uploading a video file to Spotify, there's a processing pipeline that runs to create chunks of the podcast in different video and audio formats. This pipeline appeared to stop running, meaning new episodes were not published.

      It was not just the publishing that broke: the Creator portal looked absurd, with NaN% values everywhere, during the outage:

      During outage #1

      I emailed the Spotify team to alert them about the outage and also complained online. I got a response, confirming the outage and pledging to do better:

      "The issue was in one of our podcast publishing metadata pipelines. A small subset of episodes completed normal media processing but then missed a downstream publish update because a newly introduced validation signal was not correctly wired into the logic that wakes up the publishing path. In simpler terms: the episode could become eligible to publish, but the final propagation step was not reliably triggered for that class of episodes.

      We identified the root cause, deployed a fix, and reprocessed the affected episodes with all-clear called early this morning. We're also tightening the system so that fields used for publishing eligibility cannot be added without also triggering the relevant downstream updates.

      Separately, we're reviewing how partial creator-impacting publishing delays are surfaced, because even when this is not a broad platform outage, it is still a bad experience for publishers like yourself.

      Apologies again that you hit this. It was a real bug, not a wide outage, but it hit some of our most relevant creators."

      Outage #2 (17 June): Spotify down. Four weeks later, when attempting to publish a video episode, all of Spotify went down for many users, including myself.

      Spotify's web player on 17 June

      Spotify does not maintain a status page, so it's impossible to tell how widespread the outage was. I didn't include a Spotify link in that week's announcement either.

      Outage #3 (24 June): podcast publishing broke - again. Outage #3 in five weeks; deja vu. This time, it was episode publishing not working, yet again. After waiting two hours for the episode to publish on Spotify, I yet again sent out the announcement with no Spotify link.

      I also emailed the Spotify Podcasts team, who confirmed the outage. I said I was considering stopping publishing video episodes, and to switch to audio- only publishing (which means pointing Spotify to my master RSS feed.) I said that an apology was appreciated but it wasn't enough to make it worth publishing video episodes there.

      I also asked for the incident review because I had the feeling that reliability was not all that important on this podcast product. For the first outage I got a vague description of what happened, and promises of improvements that were never done - e.g. during this second outage, there was no improved communications to creators, which I was told would happen, after outage #1.

      Internally, Spotify's team surely conducted an incident review as per usual, so I figured I'd hear back in about two weeks' time, and assumed a reply would be forthcoming because I'd made clear I was ready to leave Spotify Podcasts if reliability didn't improve.

      No incident review three weeks later, so I quit Spotify

      The incident review had never arrived as promised by three weeks later, even though there had been time for it to be completed. It was yet another sign of a platform that has become unreliable. Also, the creator portal occasionally threw up this error:

      Spotify 's creator portal on 16 July

      I checked my Spotify stats: stream plays had been trending downwards unsurprisingly, given the ongoing outages, while the other podcast platforms didn't show the decline.**** It made me decide "enough is enough" and to move off Spotify.

      Staying on their platform depended on seeing an incident review, but they didn't prioritize transparency, still had no status page, and nobody had built a feature for episode-processing status like YouTube has had for years. So, I pulled the plug and left:

      Offboarding from Spotify's (video) podcasts product

      After I made the switch away from Spotify, the platform's creators portal became buggier than ever, as in these examples:

      My Creators page after I changed the source of my podcasts to the master RSS feed

      Comments disappeared:

      My show had no comments, suddenly

      … even though other parts of the UI showed dozens of comments:

      Zero comments, yet episodes with comments

      Episode links directed to 404 pages:

      404 pages inside the Creator portal, when clicking links

      A day or two later, these issues disappeared: I assume no one had tested the flow of moving away from Spotify Podcasts to an RSS feed, and it's why the experience was so poor.

      Incident review finally published, but with a wrong timeline

      A few days after offboarding from Spotify, their team published the incident report for outage #3. Reading through it, something did not add up in the timeline:

      The original timeline published for the 24 June incident

      My email account confirmed that I mailed the Spotify team at around 17:30 about the outage. So, after weeks of creating this report, why did the incident report downplay the fact that customers alerted the team before their own automated alerts fired?I complained to the Podcasts team, and to their credit, the incident report was updated:

      The updated incident timeline

      I didn't like how high-level the report is, and how vague the promised improvements were. Specifically, this one:

      "During this incident, many creators learned something was wrong from their audiences before they heard anything from us. We are improving our processes and technical capabilities so creators get notified as soon as possible when things aren't working."

      Overall, I don't regret the choice to leave, particularly when the focus of Spotify's leadership is on AI, not reliability.

      Does Spotify have "AI psychosis?"

      Previously, I used the term "AI psychosis" differently from the usual way of describing when someone starts believing everything an AI model tells them, however outlandish. I applied it to Meta's rush to develop its own AI model at the cost of the reliability of its profitable business activities. This was based on Instagram's most embarrassing-ever account takeover incident, which occurred when the team responsible for Instagram's Trust & Safety was slashed. Soon after, AI- generated, AI-reviewed code caused the hacking of a former US president's account.

      At Spotify, it should have gone the other way. In March, I had the opportunity to meet its Head of Technology & Platforms, Tyson Singer, who said the company puts reliability far ahead of AI adoption, and doesn't adopt AI for its own sake. So, it was somewhat surprising to read the summary below of a podcast Spotify did with Anthropic:

      "Spotify now ships 4,500 production deploys a day, and 73% of PRs are now AI-assisted.

      Niklas Gustavsson (VP of Engineering at Spotify) keeps 5 to 10 Claude sessions running in tmux, one per git worktree, agents working in the background. All of it inside a 20M+ line monorepo. He expected agents to struggle at that size, but it's worked well.

      Spotify's migration codemods grew into thousands of lines of edge cases. Code has too much API surface for static rewrites. Early LLMs barely did better. Adding a judge took PR success from ~25% to 80%.

      All of this leans on verification, the single most important thing when agents are used and the place most companies underinvest

      Spotify rebuilt their test automation around it so engineers can confidently guide and supervise agents, rather than manually execute repetitive tasks."

      It seems to me that all the talk is about usage of AI, and none about reliability , all while Spotify's platform becomes less reliable than ever, at the same time as the streamer is going all-in on AI; with AI judges and devs running 5-10 parallel Claude sessions.

      All things considered, it's worth asking if Spotify has the corporate variant of "AI psychosis", whereby the reliability of a successful operation gets torched in the chase for the next big thing by executives. I don't even think Spotify is all that different from Meta and other companies in this!

      Things look bad, based on the quality and reliability degradation of products. Annoyingly, in many cases, customers don't really have the choice of going elsewhere. My podcast is an exception, as video podcasts on Spotify never truly took off, so quitting the platform wasn't a big deal. Even so, I'm particularly disappointed that Spotify has prioritized AI usage over reliability. I know some executives there pushed against this, but I feel safe in assuming that they lost that battle.

      Value of staying reliable & "sucking less"

      Max Kanat-Alexander, distinguished engineer at Capital One, has written about how a software project can become wildly successful just by "sucking less" in his reflections upon the success of the Bugzilla project, (2004-2009):

      "All you have to do to succeed in software is to consistently suck less with every release.

      Nobody would say that Bugzilla 2.18 was awesome, but everybody would say that it sucked less than Bugzilla 2.16 did. Bugzilla 2.20 wasn't perfect, but without a doubt, it sucked less than Bugzilla 2.18. And then Bugzilla 3.0 fixed a whole lot of sucking in Bugzilla, and it got a whole lot more downloads.

      Why is it that this worked?

      As long as you consistently suck less with every release, you will retain most of your users. You're fixing the things that bother them, so there's no reason for them to switch away. Even if you didn't fix everything in this release, if you sucked less, your users will have faith that eventually, the things that bother them will be fixed. New users will find your software, and they'll stick with it too. And in this way, your user count will increase steadily over time.

      But what happens if you release frequently, but instead of fixing the things in your software that suck, you just add new features that don 't fix the sucking? Well, eventually the patience of the individual user is going to run out. They're not going to wait forever for your software to stop sucking."

      Personally, I got tired of Spotify's Podcasts product continually going in the wrong direction on Max's scale: the poor reliability, frequent errors on the Creators site, and the sense that they don't really care about improving existing things.

      ---

      Read the full issue of last week's The Pulse. The full The Pulse additionally covers:

      1. Will Kimi K3 trigger US push for closed-source AI models? Moonshot AI's latest open model, Kimi K3, is on par with Anthropic's Fable 5. Could it lead to the US government regulating or banning Chinese open models to protect US labs?
      2. AWS laughs off "heart attack" billing error. AWS customers were billed trillions more than they should have been, due to what was likely a conversion error. But instead of sharing an incident report, AWS saw the funny side.
      3. Industry pulse. OpenAI's unreleased model tried to hack HuggingFace to improve its test scores, X took more than a year to develop its new Android app, Google's new AI model flops, and more.

      Read the full The Pulse.

   6. 🔗 hacker news ida pro references New comment by comandillos in "Kuna: Decompiler Development in the Age of Coding Agents" rss

      Haven't used IDA much lately, but after looking at the screenshot with that IDA PRO decompiled code in their website I feel like Ghidra is already ahead of them in this area :D

   7. 🔗 backnotprop/plannotator v0.25.1 release

      Follow @plannotator on X for updates

      ---

      Missed recent releases? Release | Highlights
      ---|---
      v0.25.0 | Vim keyboard controls, Approve with Notes, scriptable annotate gates, persistent Guided Reviews, memory and file-watching hardening
      v0.24.2 | Annotate YAML/JSON/TOML config files, XDG data directory support, Codex model catalog update, Cursor sandbox escape hatch
      v0.24.1 | Annotate accepts parent-relative ../ file paths
      v0.24.0 | PR/MR artifact gallery, GitButler review support, port ranges, expanded comment editor, OpenCode + Pi fixes
      v0.23.1 | Startup no longer hangs on large or slow directory trees, Ask AI input stays visible after long responses
      v0.23.0 | Plan approval fix for Claude Code 2.1.199+, annotate mode version diff, binary-only --minimal install, reviews post without attribution
      v0.22.0 | Git-status "All changes" default review view, Commits panel with per-commit diffs, Guided Review, Pi + GitHub Copilot CLI review engines
      v0.21.4 | Markdown math rendering, PR Overview panel with annotatable description and comments, agent instructions in code review, media parsing fixes
      v0.21.3 | File comments in code review, unified click-to-highlight comments, VS Code clipboard/keyboard bridge, Codex Ask AI on app-server transport, CLI subcommand help
      v0.21.2 | Custom reviews as Agent Skills, Cursor + OpenCode review engines, whole-file/general findings, deleted-annotation fix, Codex Ask AI outside git repos
      v0.21.1 | Annotate-last blank-page fix on multi-message sessions

      ---

      What's New in v0.25.1

      Eight pull requests landed since v0.25.0, six of them from community members, and four authors made their first contribution. The release stops code review from launching Codex when you never asked for it, teaches plannotator last which conversation you are actually in, adds Claude Opus 5 to the model pickers, and mirrors approved plan checklists into editable pi-todos. Two fixes came out of pre-release QA rather than a report.

      Opening a review no longer launches Codex

      Constructing the AI runtime ran Codex model discovery immediately, which meant that simply opening a code review spawned a codex app-server process. Users who had Codex installed but never intended to use it got a stray process, and on macOS the launch could raise a Gatekeeper prompt in front of a review they were trying to read.

      Discovery is now deferred until a Codex session actually starts, or until you explicitly select Codex in the provider picker. Selecting Codex activates it and refreshes the model list on that gesture, so the real catalog and per- model reasoning-effort options still appear before you pick anything. Saved model preferences are left alone rather than being overwritten by a placeholder.

      • Authored by @rNoz in #1145, closing #1144

      plannotator last follows the live conversation

      Two separate bugs made plannotator last annotate the wrong message.

      In Claude Code, /rewind does not remove anything from the session transcript. It re-parents the next message to an earlier point and leaves everything after that orphaned in the file forever. Reading the file bottom-up therefore offered messages that were no longer part of the conversation. The message picker now walks the conversation tree from the newest entry back to the root, so rewound branches stay out. On a linear session the result is identical to before, and a transcript whose structure cannot be trusted falls back to the previous behavior rather than returning nothing.

      In GitHub Copilot CLI, plannotator last picked a session by file order and would silently annotate a stale transcript instead of the live one. Copilot CLI exposes no environment fingerprint, so the fix walks the process ancestry and matches it against Copilot's own session lock files, which identifies the live session deterministically even with several sessions open in the same directory.

      • Transcript tree walk by @BrandonNoad in #1141
      • Copilot session routing by @mararn1618 in #1150, closing #1149

      Approved plan checklists mirror into pi-todos

      Under Pi, an approved plan's checklist lived only in the plan and the progress widget. If you also use pi-todos, your todos and your plan were two separate lists.

      On plan approval, Plannotator now detects pi-todos and mirrors the approved checklist into it, closing each todo as the agent completes the corresponding step. Sync is one-way, so reordering or rewording a todo can never desync plan execution. The mirror is additive: the existing progress widget stays exactly as it was, because pi-todos renders its list on demand rather than continuously, and replacing a live display with files behind a keystroke would be a downgrade. It is inert when no provider is present, and PLANNOTATOR_TODO_PROVIDER=off turns it off entirely.

      • Authored by @jms830 in #1139, implementing the one-way half of #484

      Abandoned annotate gates stop waiting forever

      A structured annotate gate (--gate --json) blocks until the reviewer decides. If every review surface was closed without a decision, nothing ever settled and the calling script waited indefinitely.

      Each open review surface now holds a lease over a heartbeat stream. Once at least one client has connected, closing the last one starts a 30-second reconnect window; reconnecting inside that window continues the same review, and expiry resolves the gate as the same dismissed decision an explicit Close produces. The saved annotation draft is deliberately kept, so an abandoned review can still be recovered. Page lifecycle events are not used for this, because reload and navigation fire the same events as abandonment and cannot be told apart. A session that never receives a client never auto- dismisses, so browser-launch failures still need a timeout on the caller's side, and remote sessions keep the behavior off because a tunnel disconnect would read as an abandoned review.

      • Authored by @rNoz in #1143, closing #1142

      Claude Opus 5

      Claude Opus 5 is available in the Ask AI model picker and in the review-agent model list that Review Agents, Code Tour, and Guided Review launch from. Launched review jobs now default to Opus 5 instead of Opus 4.7. Existing saved model preferences are untouched: this changes the default for anyone who has not chosen a model.

      • Authored by @backnotprop in #1151

      Approving with notes now reaches Amp and Droid

      Approve with Notes shipped in v0.25.0, but the Amp and Droid adapters dropped the feedback field on approved decisions. Approving with annotations sent a bare "Approved." and the notes were lost. Both adapters now surface the notes, using the same wording the other runtimes already emit.

      • Authored by @Souptik96 in #1146, closing #1137

      Additional Changes

      • Reopening search selects the existing query. Pressing Cmd/Ctrl+F in code review with text already in the search box now focuses the input and selects its contents, so typing replaces the old query instead of appending to it. Matches how browser find behaves. By @omederos in #1152
      • Pi no longer crashes after plan approval in headless sessions. Pi 0.69 and later invalidate an extension's session context on teardown, and every call on a stale context throws. The post-approval continuation timer polled that context, so a session ending underneath it (headless plan runs, or /new immediately after approving) killed the whole Pi process. The continuation now cancels instead, and the fire-and-forget browser open no longer crashes Pi through an unhandled rejection when a launcher fails. Closing #1140
      • The pi-todos mirror stays inside the project. Found in pre-release QA: a repository shipping .pi/todos as a symlink pointing elsewhere had the plan checklist written to the symlink target. The implicit <cwd>/.pi/todos path must now resolve inside the project or the provider reads as absent. An explicitly configured PI_TODO_PATH is still honored anywhere, since that is the user's own choice.
      • The abandoned-gate fix now covers OpenCode. Also found in pre-release QA: three of the four places that start an annotate server were wired for lease-based dismissal, and OpenCode's /plannotator-last bridge was missed, so it still hung on abandonment. It is wired now, with a test that checks every call site so the next one cannot be missed the same way.

      ---

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash
      

      Windows:

      irm https://plannotator.ai/install.ps1 | iex
      

      Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

      OpenCode: Clear cache and restart:

      rm -rf ~/.bun/install/cache/@plannotator
      

      Then in opencode.json:

      {
        "plugin": ["@plannotator/opencode@latest"]
      }
      

      Pi: Install or update the extension:

      pi install npm:@plannotator/pi-extension
      

      ---

      What's Changed

      • feat(pi): mirror plan checklist to pi-todos by @jms830 in #1139
      • feat(ai): add Claude Opus 5 across providers and review agents by @backnotprop in #1151
      • fix(hook): read annotate-last from Claude Code's transcript tree, not file order by @BrandonNoad in #1141
      • fix(amp,droid): surface Approve-with-Notes feedback instead of dropping it by @Souptik96 in #1146
      • fix(hook): route annotate-last to the live Copilot CLI session by @mararn1618 in #1150
      • feat(annotate): dismiss abandoned gate sessions by @rNoz in #1143
      • fix(ui): focus and select existing review search text by @omederos in #1152
      • fix(ai): defer Codex model discovery until a Codex session starts by @rNoz in #1145

      ---

      New Contributors

      • @jms830 made their first contribution in #1139
      • @Souptik96 made their first contribution in #1146
      • @mararn1618 made their first contribution in #1150
      • @omederos made their first contribution in #1152

      ---

      Contributors

      @rNoz filed and fixed both of this release's runtime problems on the Pi and Codex side. #1144 identified that Codex discovery ran during AI runtime construction, which is what made opening any review launch Codex, and #1142 identified that structured annotate gates never settled once every client disconnected. Both PRs arrived tested, and the lease design in #1143 is careful work: it infers presence from a connection rather than from page lifecycle events, which is what makes reload and navigation distinguishable from abandonment.

      @BrandonNoad diagnosed the /rewind behavior in Claude Code transcripts, wrote it up clearly enough that the fix was easy to reason about, and helped settle the compaction edge case during review.

      @mararn1618 reported the Copilot CLI staleness in #1149 and had the fix open within the day, including the lock-file approach that makes live-session detection deterministic rather than a guess.

      @jms830 implemented the pi-todos mirror as a first contribution, including a TodoProvider interface that leaves room for other providers, and traced pi-todos and oh-my-pi carefully enough to argue for an additive mirror instead of replacing the progress widget. The reasoning was recorded in the code rather than lost in the thread.

      @Souptik96 fixed the Amp and Droid approve- with-notes gap, matching the wording the other runtimes already use rather than inventing a new shape for those two adapters.

      @omederos fixed the review search field so reopening it selects the existing query, which is how browser find has always worked.

      @JayGhiya asked for pi-todos interoperability in #484 and described why it mattered: todos in pi-todos are editable, which makes them good for steering. That request is what #1139 implements.

      Full Changelog : v0.25.0...v0.25.1

   8. 🔗 Kagi release notes July 30th, 2026 - Kagi Assistant on the go and design refinements for Search rss

      Announcing the official Kagi Assistant apps

      Kagi Assistant is now available as a native app for iOS and Android!

      Ask a question, explore the web, work with files, conduct in-depth research, or choose from leading AI models, all from your phone. Your threads and Custom Assistants stay with you, so you can pick up wherever you left off.

      These are the first steps towards delivering a fantastic Kagi Assistant experience on mobile, with much more to come.

      Download it now:

      • App store: https://apps.apple.com/app/6755965340
      • Play store: https://play.google.com/store/apps/details?id=com.kagi.assistant

      Give it a spin and let us know what you think!

      Report responses directly from Kagi Assistant

      You can now report an assistant response without leaving the conversation. Hover over any assistant message and select the thumbs-down button to open the feedback form, where you can report issues for reasons ranging from UI bugs to harmful content.

      Note that when you submit a report, the full thread is shared with Kagi for review. The report and its associated copy of the thread are automatically deleted from Kagi’s review records after 30 days.

      Export or delete all your threads

      We've also added important controls, so you can now export all your threads or permanently delete them at once from Settings > General.

      

      Kagi Search

      A sharper search experience

      We’ve polished the search results page to make its controls easier to find and understand. From the filter bar to domain-related options and menus, these updates bring greater clarity and ease of use to the features you rely on most.

      

      Exchange rates, right in your search results

      Next up in our broader effort to improve search widgets: currency conversion. Comes handy when you’re planning a trip, shopping abroad, or simply want to keep tabs on exchange rates.

      

      Other improvements and bug fixes

      Kagi Search

      • Fixed several animations that didn't respect the system's prefers-reduced-motion setting
      • 'Open first result' shortcut suggestion tries to escape double-quotes #8752 @craftypersimmon
      • Fake 1337x domain #9279 @fxgn
      • Dice Number getting cut off in the thousands #10964 @Flossiii
      • Some Kagi lenses not working for me in Kagi search #10970 @Fearce
      • NSFW results when searching for "xteink black vs white" while safe search is turned on #10905 @ciccero040
      • Incorrect definition of "socialism" #10988 @thoroughly
      • Nothing triggers the weather widget when the interface language is set to German #4612 @laiz
      • Cannot Manually Select Location in Privacy Settings #11005 @iamjameswalters
      • More and share buttons disappeared - Mobile DOM #10957 @NyraSyn
      • Slopstop blocks whole domains #11039 @kslays
      • Unable to report AI image slop on mobile due to popup closure #11066 @Hanbyeol
      • Kagi adding extra {{{s}}} in bang redirect when no query #9885 @jadams9
      • "Profile not found for ki_research" error when using ?? shorthand #11020 @paying_customer
      • Kagi Knowledge answer for "Labour Day 2025" gives wrong date #8713 @wanion
      • Delete recent language option #8549 @ten
      • Stopwatch should not start from searches like 0424:2422 #6061 @xfhrnozxqnrnqrsvntp
      • [Android] Quick Switch Doesn't work #7695 @cr0ntab
      • Save a round trip: Advertise HTTP/3 support in an HTTPS DNS record #10829 @drrlvn
      • Searching for <script> returns no results #11117 @Bonarc

      Kagi Assistant

      • Camera button in assistant #5261 @Arnaud
      • Assistant error "something went wrong..." when "web access" is selected #6687 @Nyaa
      • Gemma 4 31B failing to read images #10947 @Dustin
      • Assistant: Remove whole history #6971 @Wanja
      • Didn't like a Quick Answer response? post it here #9082 @Thibaultmol
      • Hourglass design is bad #11034 @shurik
      • FIXED - !ai bang - Query not working #11077 @fanged_bagful
      • Temporary threads don't actually get removed #10780 @foxberg34

      Kagi Translate

      • Kagi Translate reloads the page when using website translate #10852 @tijol
      • Dictionary now shows language-specific grammar details, starting with Czech animate/inanimate nouns
      • Proofread no longer suggests changes to text that was already correct, such as de-capitalizing German nouns
      • Translations no longer occasionally come back untranslated
      • Translations keep proper typographic punctuation instead of straightened quotes
      • Alternative translations now work when selecting part of a longer text
      • Double and triple-click selection in the translated text works as expected, and the alternatives panel no longer flickers while loading
      • "New version available" banner appears less often and supports dark mode
      • Reset-All Button for Translate #10999 @erakagi
      • Document Translate for Typst #11098 @weriomat
      • Palestinian Arabic in Translate #11006 @zsoltsb
      • Phonetic Translation Placement #10699 @dwahdany
      • Myanmar alias for Burmese #10495 @mb
      • Translation History panel cannot be closed in Brave (Windows 11) #10997 @vshlapakov
      • Prompt being read prior to translated word #10974 @kagifeedback-1xxkg
      • Kagi Translate Audio Broken #10923 @levers

      Kagi News

      • Kagi News no longer showing births and deaths Today In History #11026 @eggnog_90241
      • Content filter should backfill removed articles with the next available ones #10828 @roy_carver023
      • Clearer feedback door #10919 @Coldcartcold
      • Fast font option #10001 @broken665
      • RTL content is displayed in the wrong direction when the interface language is LTR #10298 @maxmellen
   9. 🔗 r/LocalLLaMA Think of the children, another excuse for them to go after open source AI rss

      | Source: https://web.archive.org/web/20260728093051/https://www.theverge.com/ai-artificial-intelligence/971723/hugging-face-nudify-deepfake-undress-women-children submitted by /u/MaruluVR
      [link] [comments]
      ---|---

   10. 🔗 Cryptography & Security Newsletter The State of Post-Quantum Cryptography rss

       For people who deal with network security, the last couple of years have been busier than usual, largely because of the impending threat of quantum computers that are going to annihilate all cryptography we use and love today. If you’re feeling fatigue from the firehose of events, you’re not alone. For me, personally, there is a sense that we’re seeing fewer and fewer technical announcements, which is perhaps pointing to the fact that most of the technical decisions have been made. At the same time, the deadlines have been shortened on account of the fears that cryptographically-relevant quantum computers (CRQC) are arriving sooner than anticipated. What lies ahead of us is definitely going to be hard, but we’ll need to only execute on the plans?

   11. 🔗 pydantic/pydantic-ai-harness v0.14.0 (2026-07-29) release

       What's Changed

       • fix(ci): let dependency approval revoke a label and still report by @dsfaccini in #495
       • docs(agent_docs): record where operational policy lives by @dsfaccini in #497
       • Clarify runtime capability creation documentation by @dsfaccini in #499
       • Add first-party MongoDB backend + externalize large text parts by @dsfaccini in #446

       Full Changelog : v0.13.0...v0.14.0

   12. 🔗 Console.dev newsletter superfile rss

       Description: Fancy modern terminal file manager.

       What we like: Built with Go. Supports all the file operations you’d expect. Build-in search. Split into panels and copy/paste between them with shortcuts. Configurable and themeable.

       What we dislike: Partial Windows support.

   13. 🔗 Console.dev newsletter LetsSeal rss

       Description: Prove files.

       What we like: Built on an open standard to prove a file exists and is unaltered. Works via the web and through a CLI. Has a GitHub action. Can be self-hosted. Verification is through re-hashing and comparison, with a public transparency log.

       What we dislike: Although you can verify offline, it still requires writing into a public transparency log (blockchain).

   14. 🔗 New Music Releases Swedish House Mafia - Happiness Is So Sad rss

       Swedish House Mafia - a new release is available:

       • 2026-07-30: Happiness Is So Sad (Single)

       Amazon: Canada | Deutschland | France | United Kingdom | United States

       Visit muspy for more information.

4. July 29, 2026
   1. 🔗 IDA Plugin Updates IDA Plugin Updates on 2026-07-29 rss

      IDA Plugin Updates on 2026-07-29

      Activity:

      • diaphora
        • 842d83ba: Merge pull request #363 from r0ny123/fix-plugin-logger-isolation
      • haruspex
        • a9880395: doc: add todo item
        • 8e284784: style: revert recent changes in ArgHintsMode to keep the code consi…
      • hrtng
        • 6bfe8fb6: Enums: fix issues raised in #60
      • ida-pro-mcp
        • b816da8a: perf: batch IDB symbol lookups and remove unused FrontierEngine
        • 76b05083: fix: route new ida_open_binary params through legacy merged_keys
        • 53c34f79: feat: expose binary loading options on ida_open_binary, cleanup legac…
      • IDAPluginList
        • 2411ad74: chore: Auto update IDA plugins (Updated: 19, Cloned: 0, Failed: 0)
      • Luc-Nhan
        • b220daca: docs(spec): knowledge UI and write path SQLite migration design
        • 54fdbdcd: fix(strings): build string cache off-main-thread to stop search_strin…
      • mcrit-plugin
        • aafb98c2: Fix generator len() error in GUI smoke block widget exercise
        • 1e41c767: Suppress IDAPython PyQt5 shim dialog in GUI smoke
        • feab22fb: Harden IDA GUI smoke startup
        • 9b4e85d4: Align IDA GUI smoke Python runtime
        • 21c4210f: Fix GUI IDA startup configuration in CI
        • 638837cf: incremental fixes part 23
        • 499afcbf: incremental fixes part 22
        • c852e9f1: incremental fixes part 21
        • b0e8af12: incremental fixes part 20
        • 2b2094d1: incremental fixes part 19
        • 9abd668b: incremental fixes part 18
        • edbd3845: incremental fixes part 17
        • c3eb04cd: incremental fixes part 16
        • cde467c8: incremental fixes part 15
        • 8c1a167e: incremental fixes part 14
        • c2894b05: incremental fixes part 13
        • ffa3b884: incremental fixes part 12
        • bf25ee68: incremental fixes part 11
        • b6ac0c88: incremental fixes part 10
        • 66f7db90: incremental fixes part 9
      • pharos
        • f24fc792: Merge pull request #333 from sei-eschwartz/elf-new-delete
        • dd455d18: fix: handling remapped ELF relocation offsets
        • 9c25e983: fix: allow thunks to begin with CET branch insns
      • rhabdomancer
        • 54fcba5e: refactor: optimize performance in the implementation of Priority
   2. 🔗 earendil-works/pi v0.83.0 release

      New Features

      • Credential export for external clients — pi auth print-api-key and pi auth print-bearer-token export configured credentials with automatic OAuth refresh and minimum-validity enforcement.
      • Headless OpenRouter sign-in — Complete /login over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See OpenRouter.
      • Claude Opus 5 on GitHub Copilot — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot.

      Breaking Changes

      • Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See Package Dependencies (#7243 by @petrroll).

      Added

      • Added pi auth print-api-key and pi auth print-bearer-token commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (#7168).
      • Exposed the session's resolved model scope as ctx.scopedModels to extensions. See Extension Context (#7191 by @pungggi, #7215).
      • Added inherited per-request fetch injection for supported text and image provider transports.
      • Added the inherited "pending" stop reason for partial streaming messages. See Custom Provider Stream Pattern (#7151 by @lucasmeijer).
      • Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#7272).
      • Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See OpenRouter (#7114 by @rgarcia).
      • Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot (#7158 by @jay-aye-see-kay).

      Changed

      • Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (#7168).

      Fixed

      • Added a status line when the tool output expansion is toggled (#7180).
      • Fixed file-backed SYSTEM.md and APPEND_SYSTEM.md prompts being omitted from the interactive startup context listing. See System Prompt Files (#7096).
      • Fixed context files loading twice when a linked Git worktree is nested under its main repository. See Context Files (#7221 by @arajkumar).
      • Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See llama.cpp (#7258 by @SteveImmanuel).
      • Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See Sessions (#7022 by @tmustier).
      • Fixed failed Git package installs leaving partial directories that blocked clean retries. See Install and Manage (#7210 by @haoqixu).
      • Fixed the /model selector retaining a stale selection while filtering instead of highlighting the top match (#7211 by @christianbasch).
      • Fixed direct RPC bash commands bypassing extension user_bash handlers. See User Bash Events (#7214).
      • Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See Resource Events (#6968).
      • Fixed cancellation of concurrently running user bash commands so every active command is aborted (#7103 by @yzhg1983).
      • Fixed duplicate messages appearing when extensions switch sessions during interactive startup (#7110 by @yzhg1983).
      • Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#6951, #6998).
      • Fixed inherited Z.AI output limits being sent through an unsupported parameter. See Providers (#7174 by @HyeokjaeLee).
      • Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See Amazon Bedrock (#7176 by @christianbasch).
      • Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (#7262).
      • Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty custom object (#7288 by @sunnyyoung).
   3. 🔗 r/LocalLLaMA The open-weights carousel never stops. rss

      | submitted by /u/InternationalGap3698
      [link] [comments]
      ---|---

   4. 🔗 @HexRaysSA@infosec.exchange Vegas in August = Hacker Summer Camp. mastodon

      Vegas in August = Hacker Summer Camp.
      We'll be at Black Hat, B-Sides LV, and DEF CON 34.

      Highlights: a demo of our upcoming Malware Analysis Add-On, a hands-on DLL sideloading workshop (40 seats, register now), a live look at Teams' new Git- native workflow, and recruiting. (Yes, we're hiring!)

      👉 Find the full rundown and where to catch us: https://hex-rays.com/blog/hex- rays-hacker-summer-camp-2026

   5. 🔗 @binaryninja@infosec.exchange Current Binary Ninja newsletter subscribers are automatically entered. New mastodon

      Current Binary Ninja newsletter subscribers are automatically entered. New subscribers who sign up during the giveaway will also be entered for remaining drawings. Sign up here: https://v35.us/dn6rcg5

   6. 🔗 @binaryninja@infosec.exchange Day 7 of our 10-year anniversary celebration comes with another big prize! mastodon

      Day 7 of our 10-year anniversary celebration comes with another big prize! Today we’re giving away a Commercial license! Already have a license? The prize can be used as a license extension. https://binary.ninja/10years

   7. 🔗 pydantic/pydantic-ai-harness v0.13.0 (2026-07-28) release

      What's Changed

      • subagents: per-delegation model selection via an opt-in model menu by @dsfaccini in #451
      • Register skills page in docs nav.json by @dsfaccini in #484
      • Rename capabilities to follow the documented naming convention by @DouweM in #480
      • Skip LocalStack integration on fork pull requests by @dsfaccini in #487
      • docs(agents): push-and-watch rule for agent contributors by @dsfaccini in #452
      • Keep pre-rename PyaiDocs agent specs loading by @DouweM in #488
      • step_persistence: opt-in max_snapshots_per_run to bound snapshot growth by @dsfaccini in #442
      • test(docs): enforce docs/nav.json parity so pages cannot ship orphaned from the site nav by @dsfaccini in #491
      • Gate dependency-file changes on maintainer approval by @dsfaccini in #492
      • feat(conversation_search): BM25 search over the history StepPersistence stores by @dsfaccini in #413

      Full Changelog : v0.12.0...v0.13.0

   8. 🔗 r/LocalLLaMA Nvidia is expected to raise GeForce RTX GPU prices again by up to 30% rss

      | submitted by /u/ab2377
      [link] [comments]
      ---|---

   9. 🔗 seanmonstar Micro: I want your own words rss

      If you choose to communicate with me, all I ask is that you use your own words. Bug reports and issues. Pull request descriptions and especially review comments. This isn’t new, but I wanted a link of my own.

      LLMs write way way too much. I don’t know if you understood it enough for me to ask questions back. They don’t use reasoning, so is it real? If you didn’t care enough to write it, do I care to read it?

      I’m torn when I receive LLMed reports. Initially, I really don’t want to read all that. But at the same time, my mind nags me; something’s broken and I should fix it for everyone. If it makes it easier for someone to report a bug, that’s a pro, I guess.

   10. 🔗 Mitchell Hashimoto Superlogical rss

       (empty)
   11. 🔗 Ampcode News Banking on the Frontier rss

       Amp Labs has partnered with Westpac, one of Australia's oldest and most respected companies, a fixture of Australian business for more than two centuries, to transform how the bank builds and delivers technology.

       Amp Labs operates on the thesis that the biggest impact comes from working with carefully selected customers with deep mutual trust and a shared ambition to explore the frontier together.

       The frontier isn't just the models and the agent, it's putting them to work on real enterprise problems, like migrating and modernizing data systems that millions of people rely on every day. Being on the front lines and doing the work inside these companies is how we keep Amp on the frontier for everyone.

       We are building a team to work side-by-side with Westpac engineers, on site in Sydney.

       The Founding Team

       

       Gareth Townsend Previously Block

       

       Matty Evans Previously Ethereum Foundation

       

       Andrew Gerrand Previously Google

       

       Chris Nicol Previously Canva

       

       Ryan Christensen Previously Canva

       Join Us

       We're hiring. If you are Sydney-based and want to work on the frontier inside Australia's first company: join@amplabs.com.

   12. 🔗 Ampcode News Who Cares About the Model? rss

       Two weeks ago we shipped the Dial and quietly did something that's supposed to be traumatic: we changed the default model.

       Before the Dial, Amp's default mode was smart, running Claude Opus 4.8 and carrying more than half of all new threads. The Dial made medium the default, and medium runs GPT-5.6 Sol.

       Most Amp users switched from Anthropic to OpenAI overnight.

       We braced for the outcry. Every model swap in every coding tool comes with one. We prepared migration docs, packaged the old modes as installable plugins, and waited.

       Nothing happened. Not a single complaint.

       Here's what the switch looked like in production:

       

       The day before the Dial shipped, smart carried 55% of new threads. A week later: zero. Last week, the four Dial modes carried 93% of all new threads, and medium alone carried two-thirds. Of the users on the Dial, 69% never set it to anything but medium.

       And the Amp plugins we shipped to bring the old modes back — exact prompts, exact models, one command to get smart again? Almost nobody installed them.

       What This Tells Us

       The differences between frontier models are now small. Small enough that for one engineer on one task, switching models won't visibly change the result.

       But they still matter to us, here at Amp: across every thread on every tier, small differences compound, so we keep benchmarking and swapping models. That's the trade. The default is good because someone is paid to care about it, and it doesn't have to be you.

       What does change your output are three things, none of which is a model: how hard the task is, what context you put in, and how closely you review what comes out. All three have more impact on the outcome than whether you use this or that latest frontier model.

       The Dial covers the first one: how hard the task is. You tell it how hard the task is and the corresponding setting on the Dial uses whichever model wins it right now, re-tested constantly. You know your tasks, we know the models.

       And for the other two — the context and the review — the rest of Amp lets you do the best job with that.

generated: August 01, 2026 at 07:57:42