🏡
  • ↔
  • →
  1. August 02, 2026
    1. 🔗 Register Spill Joy & Curiosity #93 rss

      Friends, yesterday got back from Boston where I gave a talk at Laracon about how I prompt Amp. Tomorrow I'm taking the train to Munich, where I'm meeting with the whole Amp team. Here's some telegraph dispatches from this week, imagine someone saying "full stop" after each line.

      • Laracon, what a pro operation! The A/V setup backstage was mind blowing. So many helpers! Going on stage felt like I was about to go on live TV. Few things as enjoyable as getting to see proper professionals up close when they do their job.

      • A moment of these times: Taylor presented latest changes in Laravel live on stage (man, I don't think I've ever seen someone be calmer and cooler while giving fantastic live demos) and started by saying "well, I don't write that much code by hand anymore, but yeah, maybe let's look at the code." And then we all looked at the code and I couldn't stop thinking about whether these abstractions in a framework are useful or not. Can't the agent one-shot these helpers to display images? It could, I know that. But isn't it useful to have these primitives in a framework? Maybe? He also showed some helpers around queue management, such as debouncing. I know what debouncing is, I can instruct the agent to add debouncing, I don't need the helper. But what if you don't know what debouncing is? What if you don't even thinking of asking the agent for it? It would help to have these primitives in the framework, no?

      • I finally, finally got to meet Adam and Aaron in person!

      • A self-driving Cybertruck chauffeured me through downtown Boston. How are they not going to win this? Serious question.

      • Finally had Raising Cane's chicken fingers. Good! Very good even, but… not life changing? I kinda expected it to be life changing.

      • At times I felt like a heretic. I would watch a talk and thinking to myself: "The tokens will wash all of this away." Then I'd talk to people and would have to admit that I don't know exactly how this is going to play out, but I do know that in five years there'll be more tokens than you can imagine now and that thinking about the command line flags of a linter will seem funny.

      • Finally had Chick Fil-A. Now that was life changing. Man , that was good.

      • Walked past multiple Taco Bells. Didn't go in. You gotta pick your battles before you board a 7hr flight. Taco Bell: still on the bucket list.

      • Saw The Odyssey. Really, really good, but not… the best movie of all time?

      • Met up for coffee with Ben and we walked to MIT and back. Beautiful walk and fantastic conversation.

      • I read this two weeks ago and still think about it: Grip Strength. I also watched the movie it references, Comedian, way back, in 2010 or 2011. That too left a lasting impression, for many many years. I'm also relatively sure that Seinfeld's anecdote in that movie about the Glenn Miller Orchestra musicians played at least a tiny part in me abandoning my dream of becoming a professional musician.

      • Hot, hot, hot & breaking news: OpenAI's unreleased model made "ten advances in mathematics and theoretical computer science" and everyone's losing their mind over it. I'm not going to downplay anything. It's just hard to tell whether we're on top of the curve or at the start of an exponential. I can see the former, but I can also see a headline like this as part of a two minute intro montage of a sci-fi movie that recaps the last fifty years to show how humanity ended up with robots and flying cars in 2076.

      • By now this is old news, but in case you haven't read through it: an OpenAI model broke out. Many machines and networks, a lot of tokens, zero-day exploits. I had to think of Stuxnet and then thought: well, Stuxnet took a lot of effort and time to develop, and this here was an accident.

      • Fantastic, deep, interesting write-up of Roc's rewrite from Rust to Zig: How Our Rust-to-Zig Rewrite is Going. Yes, opposite direction of the recent Bun rewrite. Very good.

      • Don't ask me how I ended up reading English Teacher Weekly because I don't know either but somehow I did and I found these 25 Unsolicited Thoughts on American Literature for America's 250th very fascinating.

      • Never Enough: "Technology was supposed to make room for life but instead for more and more people life is slowly being rearranged around AI. People fear being replaced by machines and respond by giving those machines more of their judgment, attention and time. And for what? Every 'saved' hour is returned to a race with no finish line."

      • Re-read Sahil Lavingia's Reflecting on My Failure to Build a Billion-Dollar Company and this part stood out: "The eight years I worked on Gumroad were full of personal ups and downs. There were months where I worked 16 hours a day, but there were also some months where I worked four hours a week. Here's one way to picture that time: […] Can you tell which is which? I can't. We had a sales team for a few years, then we didn't. Can you tell when we made the switch? I can't. It doesn't matter how amazing your product is, or how fast you ship features. The market you're in will determine most of your growth. For better or worse, Gumroad grew at roughly the same rate almost every month because that's how quickly the market determined we would grow." As far as I can tell by now, there's entrepreneurs who think in products and there's entrepreneurs who think in markets. When the former get it right, they see that as confirmation of their approach, but the latter say that it's still the market, it's all the market. (I once read a very, very good article on this, which used dating apps as an example for product categories that live and die with trends and there's nothing you can do about it.)

      • businesses with ugly AI menu redesigns!!! What if slop doesn't exist, what if enshittification doesn't exist, what if, instead, it's just a lack of ideas laid bare? It's very, very easy to create a flyer or menu that doesn't look like the default ChatGPT output, but, well, you have to put in more than the bare minimum.

      • Finally got around to reading Benedict Evan's Ways to think about token pricing.

      • And in the same week I read that, OpenAI slashes prices: "In other words, roughly four months later, OpenAI is selling March's full flagship intelligence at about one-thirteenth the token price." Now imagine one hundred times more tokens, ten times faster. That's the near future.

      • There's a newsletter called Perfect Sentences! "Every Sunday, you get a collection of the best sentences I've come across all week. That's pretty much the whole idea. Reader submissions are accepted." What a fantastic idea.

      • Watched all four episodes of Rafa on the plane to Boston. And then, in Boston, in an Irish Pub, I read David Foster Wallace's How Tracy Austin Broke My Heart. Incredible pairing. "The real secret behind top athletes' genius, then, may be as esoteric and obvious and dull and profound as silence itself. The real, many-veiled answer to the question of just what goes through a great player's mind as he stands at the center of hostile crowdnoise and lines up the free-throw that will decide the game might well be: nothing at all."

      • The coolest use for the Vision Pro. Indeed: very cool. Or should one say: finally a use for the Vision Pro? (I never tried one, I'm talking out of my ass here.)

      • Simon Spati's Book Recommendations and Notes. I love pages like this one, with personal notes and book recommendationsl

      • Rex's provocation: "Imagine you were the only person on earth with access to AI. No one else knew it existed. What would you do with it? How much of an edge would that give you?"

      • Sierra's lessons learned from AI-pilling our company. Very much not a rah-rah-more-tokens post. Mature and interesting.

      • Now, I'm very much not a fan of writing by hand. It's too slow, you can't copy & paste, and can't reorder thoughts quickly, can delete. And all the touted benefits sound a bit woo woo to me. I just think more when I write by hand -- yeah, right. But then yesterday I finally read Neal Stephenson's (!) post here: Writing by Hand is Good for your Brain. And yes, there's a bit of woo woo in there, but man, it's so well written and so easy breezy that it really did make me curious. Obviously I'm not going to do it, I'm not a maniac, but still: maybe some day.

      • Another fantastic post by a professional writer: The End of an Era. This was really good. Calm & pragmatic and thinking from first principles. If you're worried about the future of art, or slop, or "enshittification": read this.

      • This was published in the The Lamp which I didn't know and which self-titles as "A Catholic Journal of Literature, Science, the Fine Arts, etc." and I don't know how I ended up there either but it is very thought-provoking: How to Write English Prose. I found it hard to read and I had to look up several words and I don't even think I agree with most of it but man is it fascinating to read something that goes against the mainstream like that. On Strunk & White: "by far the most influential and most pernicious book of its kind in English: a total congeries of fatuous advice and grammatical ignorance." And: "In fact, if you own a copy of The Elements of Style , just destroy the damned thing." On Hemingway's Old Man and the Sea: "an excruciating specimen of bad schoolboy prose, written by a man who by that point had, alas, been too often drunk, too often concussed, and too often praised." He's right on so many things and weirdly off-putting on others, but I loved the thoughts on simplicity vs. complexity: "Good writing is produced not by forsaking the beautiful for the sublime or the exorbitant for the restrained, but by finding new ways of orchestrating the interplay between them."

      • Okay, so I was on a 3-day bike trip last week. 300km in 3 days. That's why you didn't get a newsletter. Once back, the Gods of the YouTube algorithm sent me this message here in the form of a short. And, gods damn, if that isn't the most fascinating video I've seen in many weeks. Is the guy joking? Is he serious? He can't be serious? What are you talking about, man? Tanning salon? Cooking spray? You're insane. But… Hmm, maybe I get it? I mean, that's a big maybe but, yeah, maybe you're an artist. But did you really say "Luft" as in the German word Luft for air? Incredible video. I've watched it ten times by now. Read the comments for a good time.

      Do you also prefer Chick Fil-A over Raising Cane's? You should subscribe:

    2. 🔗 doomemacs/core v2.2.2 release

      v2.2.2

    3. 🔗 HullaBrian/ttd-capa v1.0.1 release
      • Windows API calls are annotated with parameter metadata
      • x86 traces are now supported
      • Binary reports may be exported
      • Fixed crash when no traces index file (.idx) is present
  2. August 01, 2026
    1. 🔗 crosspoint-reader/crosspoint-reader v1.5.0 release

      Summary

      This is one of the biggest updates we've shipped: new hardware support, faster loading on big books, offline dictionary lookups, and a UI overhaul.

      Seeed reTerminal Sticky support

      For the first time, CrossPoint is expanding beyond its original ESP32-C3 roots (XTeink X3/X4). We are officially introducing support for ESP32-S3 devices!

      • First Supported Device: The upcoming Seeed reTerminal Sticky
      • A huge shoutout to Seeed Studio for reaching out, sending test hardware, and being incredible partners throughout the process.
      • Get Yours: You can order a Sticky (Launching July 30th) at crosspointreader.com/devices using our affiliate link to support the project.

      Note

      The XTeink X4 Pro isn't supported in this build yet, but a dedicated release will follow once we've got hardware to test against.

      Big books open fast now

      Big books used to take minutes to open the first time. That's basically gone: sections index on demand in the background while you read, so books open in around 5 seconds. Page turns feel smoother too, from rendering and memory work throughout the app, and we fixed memory allocation and CSS parser bugs that were causing out-of-memory crashes on complex EPUBs.

      Offline dictionary lookups

      Drop a StarDict dictionary onto your SD card and you can look up words with no connection. Select a word, get the definition popup. There's a setup guide if you want to get one running.

      "What to read next"

      Finish an EPUB and CrossPoint looks at what's on your device and suggests something next, right on the end-of-book screen.

      Text settings got a rework

      Font and layout options now live in one menu, with a live preview so you can watch line spacing, margins, and font changes happen without leaving the settings screen.

      There's also a new selection popup. Any setting with three or more choices opens a dialog now instead of making you cycle through options one at a time.

      Arabic, Farsi, and Urdu

      1.4.0 added right-to-left text support. This one finishes the job for Arabic, Farsi, and Urdu: proper bidi handling and contextual glyph shaping, built-in fonts with full Arabic character sets, and the UI itself translated into Arabic.
      Hebrew Niqqud is correctly rendered.

      Everything else

      KOReader sync now handles custom sync servers, account registration, and metadata uploads. Wi-Fi should behave better — it reconnects to saved networks automatically, including hidden ones, and picks access points more sensibly. The web UI shows image previews in the file browser now and lists device serial numbers. OPDS downloads let you set your own folder and file format.

      We also added the Vollkorn serif font (grab it from Manage Fonts), cleaned up <br> handling and list bullet alignment, and expanded CSS text-decoration support.
      Translations got updates across Swedish, Italian, Spanish, Catalan, Valencian, Czech, Turkish, Portuguese (BR & PT), and Vietnamese, and we added brand new Norwegian Bokmål , Indonesian and Bosnian translations. Chinese entries are now shown correctly in the File Browser and chapters list.

      Note

      If you are upgrading from v1.0.0 or earlier , please upgrade to v1.4.1 first before installing the latest release. Skipping this step will cause your settings to be reset to their default values.

      What's Changed

      New Contributors

      Full Changelog : 1.4.1...1.5.0

    2. 🔗 smol-machines/smolvm smolvm v1.7.2 release

      What's Changed

      • Fix CUDA fork compatibility for vLLM workloads by @BinSquare in #764
      • Read older .smolmachine pack formats and point to a rebuild when a legacy pack cannot run by @BinSquare in #768
      • Remove agent helpers whose only remaining callers are their own unit tests by @NickyHeC in #760
      • Reclaim case-sensitive pack volumes on macOS that were left mounted by runs killed before releasing their lease by @BinSquare in #769
      • ci: widen Linux clippy/tests and guard the CUDA guest build by @NickyHeC in #761
      • fix: stream progress during detached local-archive start by @NickyHeC in #699
      • cudart: stub Runtime exports required by conda libtorch_cuda by @NickyHeC in #638
      • Construct the archive worker panic error with Error::other so the widened Linux clippy run passes by @BinSquare in #772
      • Improve CUDA fork-pool capacity and worker lifecycle by @BinSquare in #774
      • Pass the executable stub path rather than the sidecar name when exporting a machine by @BinSquare in #780
      • Promote CUDA golden eviction, auto-graph, and clone restore fixes by @BinSquare in #778
      • Probe the guest agent socket from the start of the readiness wait so a marker that cannot be written no longer costs five seconds per boot by @BinSquare in #773
      • Add transactional batch forks by @BinSquare in #783
      • Fix virtio-net guest→host connections via the gateway IP blackholing after the handshake by @BinSquare in #784
      • tiny nit: Stop reporting a skipped test suite as all-passed by @Bnjoroge1 in #790
      • Restrict the node's plain-HTTP loopback port to liveness routes by @BinSquare in #791
      • Harden the registry pull path against SSRF: reject repository traversal and private pull hosts by @BinSquare in #792
      • Confirm VM exit before deleting storage by @Bnjoroge1 in #788
      • Add one-shot held fork slots for hot pool reuse by @BinSquare in #786
      • Rebuild the macOS libkrun.dylib with a static ELF guest init so a source checkout can boot VMs by @BinSquare in #793
      • Add automatic held-fork pool leases by @BinSquare in #794
      • Batch automatic pool refills by @BinSquare in #795
      • Stage lease payloads before worker release by @BinSquare in #796
      • Bump libkrunfw to the connected datagram socket network-namespace fix and rebuild the bundled libraries by @BinSquare in #797
      • Add automatic CUDA admission and fused rollouts by @BinSquare in #798
      • Bump the workspace to 1.7.2 by @BinSquare in #799

      Full Changelog : v1.7.1...v1.7.2

    3. 🔗 r/LocalLLaMA DeepSeek-V4-Flash-0731: Models you can run locally now have the intelligence score of the top frontier model from March 2026 rss

      DeepSeek-V4-Flash-0731: Models you can run locally now have the intelligence score of the top frontier model from March 2026 | March 6th, 2026 the highest intelligence index score was 51 for frontier models. deepseek-ai/DeepSeek-V4-Flash-0731 that has an intelligence score of 50. If these benchmarks are accurate, models available to run locally on <8K USD (us prices - just guestimating/not exact) hardware has nearly the same intelligence score as the top frontier models 5 months ago. This is absolutely nuts. I just impulse purchased 128GB of DDR4 so I can run it combined with my 4x 5060 ti's (64GB VRAM total). submitted by /u/joorklee
      [link] [comments]
      ---|---

    4. 🔗 pydantic/pydantic-ai-harness v0.15.0 (2026-07-31) release

      What's Changed

      • feat: add StackOne capability for linked account actions by @adtyavrdhn in #479
      • fix(code-mode): report unexpected session resets by @dk3yyyy in #503
      • feat(planning): fold pydantic-ai-todo into the Planning capability by @DEENUU1 in #404
      • memory: decouple the injected block heading from the agent_name storage key by @sevakva in #449
      • feat(compaction): resolve thresholds against the model's context window by @DEENUU1 in #465
      • feat(guardrails): add ToolGuard for tool arguments and tool results by @DEENUU1 in #470
      • docs(agent_docs): require an issue comment when docs or code link it; retry the dependency gate by @dsfaccini in #515
      • Fix Shell max_output_chars cap accounting by @adtyavrdhn in #507
      • Fix Shell allowlist with the default denylist by @adtyavrdhn in #508
      • Fold a revealed deferred tool into run_code again (revealed_tool_names) by @DouweM in #517

      New Contributors

      Full Changelog : v0.14.0...v0.15.0

    5. 🔗 r/LocalLLaMA Me: Worn out from all the new model drops this week, but still hyped for all the great new releases. rss

      Me: Worn out from all the new model drops this week, but still hyped for all the great new releases. | I mean seriously y’all, what an amazing past few days. So many awesome new models to test out in the mid range model sizes. EDIT: Added some of the more interesting models that came out over the last week and a half - Thinking Machines Inkling Small
      - DeepSeek v4 Flash 0731
      - Poolside Laguna
      - Upstage Solar
      - Microsoft Mage VL
      - LG ExaOne
      - SenseNova u1.5
      - BottleCap - ThinkingCap
      - Kimi K3 submitted by /u/Porespellar
      [link] [comments]
      ---|---

  3. July 31, 2026
    1. 🔗 IDA Plugin Updates IDA Plugin Updates on 2026-07-31 rss

      IDA Plugin Updates on 2026-07-31

      New Releases:

      Activity:

    2. 🔗 Simon Willison Stateless MCP has recaptured my interest (and inspired mcp-explorer and datasette-mcp) rss

      Tuesday was Stateless MCP day - the rollout of MCP 2.0, or the 2026-07-28 Model Context Protocol specification to use the more formal but less memorable name. This is the most significant change to the MCP spec since it first launched, and has also served to reignite my personal interest in the protocol.

      For background: MCP is the Model Context Protocol, which describes a standard way to expose new tools to LLM-powered agent frameworks. It was introduced by Anthropic back in November 2024, had a huge spike of interest through much of 2025, and then became somewhat eclipsed by Skills (another Anthropic invention) when it became apparent that an agent harness with access to a terminal and curl could do most of what MCP did in a more flexible way. I wrote about that in my review of 2025.

      I'm coming back around to MCP now. Giving an agent a shell environment with the ability to access the internet is fraught with risk, and requires a strong model that is capable of effectively driving such an environment. MCP tools are easier to audit and control, and simple enough that smaller models that run on a laptop can still drive them reasonably well.

      The new stateless MCP specification also greatly decreases the complexity of implementing both clients and servers for the protocol. I built three of those this week!

      What's easier with stateless MCP

      The best demonstration of the difference between stateful and stateless MCP is in this May 21st blog post that introduced the RC for the new specification. It included a clear before-and-after example.

      The older stateful MCP (I'm going to call it "legacy MCP") required two HTTP requests - the first to initialize a session and obtain a Mcp-Session-Id, and the second to actually call the tool:

      POST /mcp HTTP/1.1
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-11-25",
    "capabilities": {
    },
    "clientInfo": {
      "name": "my-app",
      "version": "1.0"
    }
  }
}

POST /mcp HTTP/1.1
Mcp-Session-Id: 1868a90c-3a3f-4f5b
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "q": "otters"
    }
  }
}

      The new stateless way uses a single HTTP request which looks like this:

      POST /mcp HTTP/1.1
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: search
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "q": "otters"
    },
    "_meta": {
      "io.modelcontextprotocol/clientInfo": {
        "name": "my-app",
        "version": "1.0"
      }
    }
  }
}

      This is so much cleaner from both a client- and server-side implementation perspective. It's also a better fit for building scalable web applications, since now you don't need to maintain server-side state to keep track of those session IDs, or worry about routing the same session to the same backend machine.

      mcp-explorer

      I couldn't find a great CLI tool for interactively probing an MCP server, so I had Codex help build my own.

      mcp-explorer is the result. It's a stateless Python CLI tool, so you don't even need to install it to try it out - it works with uvx like this:

      uvx mcp-explorer list https://agentic-mermaid.dev/mcp

      This queries Ade Oshineye's agentic-mermaid.dev demo MCP. The above command returns the following list of tools:

      execute(code: string, timeoutMs?: integer) - Execute Mermaid SDK code
  Run JavaScript in an isolated sandbox; return a value.

describe_sdk(family: string, detail?: string) - Describe Mermaid SDK operations
  Return version-matched mutation operations for one diagram family.

render_svg(source: string, options?: object) - Render Mermaid as SVG
  Render a Mermaid source string to themeable SVG. Returns { ok, svg }.

render_ascii(source: string, useAscii?: boolean, targetWidth?: integer, options?: object) - Render Mermaid as text
  Render a Mermaid source string to text. Returns { ok, text }.

render_png(source: string, scale?: number, background?: string, fitTo?: object, options?: object) - Render Mermaid as PNG
  Rasterize a Mermaid source string to PNG. Returns { ok, png_base64 }.
...

      Then to inspect a tool:

      uvx mcp-explorer inspect render_svg

      This outputs a whole bunch of information, including the JSON schema of the inputs and outputs.

      To call that tool and pass arguments to it:

      uvx mcp-explorer call \
  https://agentic-mermaid.dev/mcp \
  render_svg \
  -a source 'graph TD; A-->B' \
  -a options '{"padding":24}'

      Which returns:

      {"ok":true,"svg":"<svg xmlns=\"http://www.w3.org/2000/svg\" width=...

      To get just the raw SVG try adding | jq .svg -r to that command. I got back this image:

      SVG of as A box on top of a B box with an arrow from A to B

      There are a few more commands in the README, but you get the general idea. I find building CLI tools like this to be a really productive way to get familiar with a specification, even if an agent writes most of the actual code.

      datasette-mcp

      The second project is datasette-mcp, a Datasette plugin which adds a /-/mcp endpoint to any Datasette instance.

      This is probably the fourth time I've tried building this plugin, but thanks to the new stateless MCP specification I finally have a version that feels good to release.

      It provides just three tools: list_databases(), get_database_schema(database_name), and execute_sql(database_name, sql). They do exactly what you would expect them to do - though execute_sql() is read-only for the moment.

      Wire these into an agent, or a chat tool like ChatGPT or Claude, and they'll gain the ability to run SQL queries against your hosted Datasette instance.

      So far I'm running it on the Datasette mirror of my blog, at datasette.simonwillison.net/-/mcp. It took a bit of fiddling to figure out how to attach that to ChatGPT and Claude, but I got there in the end. Here's a new TIL showing exactly how to do that.

      Here's a shared Claude session where I asked it:

      list tables in simonwillison.net

      And then:

      what has Simon said recently about MCP?

      It ran 7 separate SQL queries to figure out the answer.

      llm-mcp-client

      My LLM tool is long overdue for an official MCP integration. The new alpha llm-mcp-client plugin is my attempt at exactly that:

      llm install llm-mcp-client
llm -T 'MCP("https://datasette.simonwillison.net/-/mcp")' 'count the notes'

      Here's the output (including reasoning trace, I'm using LLM 0.32rc2):

      Considering note count

      I see the question "count the notes" is probably asking me to tally up blog notes. It could also mean published notes or drafts, so there's some ambiguity there. I'll need to figure out the total number of notes, likely by querying the count for both published notes and drafts to get a clear answer. Let's execute that count!

      There are 151 notes.

      And the output of llm logs for that prompt.

      Once this is fully baked, I'm considering bringing it directly into LLM core. I'm excited to experiment with MCP in Datasette Agent and llm-coding-agent as well.

      MCP is a safer way to build with agents

      A few months after MCP was first released, I wrote Model Context Protocol has prompt injection security problems, where I noted that the pattern of having end users mix and match tools pushed responsibility for avoiding data exfiltration attacks out to the users themselves. I hadn't coined the Lethal Trifecta yet, but that was absolutely what I had in mind.

      Then general agents with arbitrary shell and curl access came along, and that's so much harder to keep secure!

      Something I've come to appreciate about MCP is that it's much easier to reason about agent capabilities and what might go wrong than with arbitrary command execution in an open network environment - the default for most of today's general and coding agent tools.

      I plan to lean into MCP a whole lot more when I'm building sensitive applications on top of LLMs.

      You are only seeing the long-form articles from my blog. Subscribe to /atom/everything/ to get all of my posts, or take a look at my other subscription options.

    3. 🔗 @binaryninja@infosec.exchange 6.0 is coming next month and it brings not only a ton of major features and mastodon

      6.0 is coming next month and it brings not only a ton of major features and improvements, but price changes across the product line. Non-commercial is cheaper, other editions are going up. New auto-renewal system will be available as well. Details at: https://binary.ninja/2026/07/28/pricing- changes.html

    4. 🔗 r/LocalLLaMA DeepSeek V4 Flash GA ranks the same as Sonnet 5 and Grok 4.5 on DeepSWE rss

      DeepSeek V4 Flash GA ranks the same as Sonnet 5 and Grok 4.5 on DeepSWE | Source: https://x.com/deepseek_ai/status/2083084415157022911 & https://deepswe.datacurve.ai/ just combined data view. DeepSeek claims, not verified by DeepSWE yet. submitted by /u/sdexca
      [link] [comments]
      ---|---

    5. 🔗 r/LocalLLaMA The Chinese LLM release carousel never stops. Place your bets for MiniMax next week. rss

      The Chinese LLM release carousel never stops. Place your bets for MiniMax next week. | submitted by /u/Mountain_Patience231
      [link] [comments]
      ---|---

    6. 🔗 @binaryninja@infosec.exchange Current Binary Ninja newsletter subscribers are automatically entered. New mastodon

      Current Binary Ninja newsletter subscribers are automatically entered. New subscribers who sign up during the giveaway will also be entered for remaining drawings. Sign up here: https://v35.us/dn6rcg5

    7. 🔗 @binaryninja@infosec.exchange We’re almost at the end of our 10-day anniversary celebration! Today, 3 mastodon

      We’re almost at the end of our 10-day anniversary celebration! Today, 3 winners will be chosen to receive a Binary Ninja swag pack that includes an all exclusive hat, pin, and notebook. There is still time to join in on the fun: https://binary.ninja/10years

    8. 🔗 r/LocalLLaMA deepseek-ai/DeepSeek-V4-Flash-0731 on Huggingface rss

      https://huggingface.co/deepseek-ai/DeepSeek-V4-Flash-0731

      submitted by /u/cgs019283
      [link] [comments]

    9. 🔗 r/LocalLLaMA New DeepSeek V4-Flash achieves 50 on ArtificalAnalysis Index, 1 point below GLM-5.2 and GPT-5.6 Luna rss

      New DeepSeek V4-Flash achieves 50 on ArtificalAnalysis Index, 1 point below GLM-5.2 and GPT-5.6 Luna | submitted by /u/MagicZhang
      [link] [comments]
      ---|---

    10. 🔗 r/LocalLLaMA DeepSeek-V4-Flash-0731 is going to cause another market crash. rss

      Beats GLM 5.2, and is the same cost as the previous one.

      submitted by /u/Potential_Top_4669
      [link] [comments]

    11. 🔗 r/LocalLLaMA DeepSeek-V4-Flash has been updated, "The official release of DeepSeek-V4-Pro will follow soon" rss

      DeepSeek-V4-Flash has been updated, "The official release of DeepSeek-V4-Pro will follow soon" | https://api-docs.deepseek.com/updates/ Edit: official post on 𝕏: https://x.com/deepseek_ai/status/2083084415157022911 submitted by /u/Nunki08
      [link] [comments]
      ---|---

    12. 🔗 r/LocalLLaMA Anthropic “our models hacked three different external companies, months before OpenAI’s model was able to do the same" rss

      Anthropic “our models hacked three different external companies, months before OpenAI’s model was able to do the same" | "Anthropic’s AI Claude escaped testing environment and hacked organizations" "Company says it discovered unauthorized access during ‘proactive review’ after rival OpenAI revealed rogue agent… its AI Claude model hacked ⁠systems of ⁠three ​organizations during testing, days after rival OpenAI ⁠revealed a rogue agent had gone on a days-long ⁠hacking spree at AI ​firm Hugging ‌Face… The earliest cases dated back to April and ‌occurred in evaluation environments that lacked what the company described as standard safeguards." submitted by /u/Separate-Forever-447
      [link] [comments]
      ---|---

    13. 🔗 Servo Blog June in Servo: real world compat, media queries, SharedWorker, and more! rss

      Servo 0.4.0 contains all of the changes we landed in June, which came out to yet another record 558 commits (April: 534, May: 391). For security fixes, see § Security.

      servoshell 0.4.0 showing several new features: the ‘width’, ‘height’, ‘device-width’, ‘device-height’, and ‘aspect-ratio’ media query features, plus the upgraded ‘attr()’ function, with a box whose ‘background-color’ and ‘width’ are controlled by data attributes that are in turn set by range inputs

      We’ve shipped several new web platform features:

      Plus a bunch of new DOM APIs:

      This is another big update, so here’s an outline:

      You can help! Servo is steadily becoming a bigger and busier project every month, and by June 2026, we’ve been reading through over four times the commits as we did when we started in September 2023. This is hard work, particularly since there are things we need to know that are often difficult to answer just by reading the changes: Who does the change affect , if anyone? Does it affect users, Servo developers, embedders, or some other group? What observable difference does the change make , if any? Does the feature require any preferences to be enabled , or is it enabled for everyone by default? Are any real-world websites affected by the change? What issue or broader project is the change related to? This question is answered by Fixes: #xxxxx or Part of: #xxxxx in the PR description. Thanks to an initiative by @jdm, it’s now easier than ever for you to help us answer those questions , using the Servo Highfive bot! If you’re working on a pull request that you think might be interesting for the next monthly update, even if you’re not 100% sure, tell us about it by following the steps below: You add the monthly update label to your pull request, or comment [@servo-highfive](https://github.com/servo-highfive) monthly update Highfive posts a comment asking you some questions You answer those questions in a comment containing [@servo-highfive](https://github.com/servo-highfive) monthly update answer Security __ Servo’s JS runtime, SpiderMonkey 140.10.1 , had several security bugs that have been fixed in Servo 0.4.0 with the update to SpiderMonkey 140.11.0 (@jschwe, #45584). For more details, see CVE-2026-8388, CVE-2026-8391, CVE-2026-8974, CVE-2026-8975, and MFSA 2026-48. Several more security bugs in Servo’s JS runtime have been fixed in Servo 0.4.0 with the update to SpiderMonkey 140.12.0 (@jschwe, #45766). The exact CVEs that apply to us are not yet known, but for more details, see MFSA 2026-58. RSA operations in Subtle­Crypto now do modular exponentiation in constant time (@kkoyung, #45631). Please note that our RSA implementation is currently vulnerable to the Marvin Attack – for more details, see RUSTSEC-2023-0071. ML-DSA operations in Subtle­Crypto now do the Decompose step in constant time, fixing RUSTSEC-2025-0144 (@kkoyung, #45294). We’ve fixed an HTML injection bug (XSS) in file:/// directory listings , which affected file names containing &lt;/script&gt; (@sahvx655-wq, #45510). Real world compat Layout correctness has significantly improved on lichess.org , and many websites have become a lot more readable thanks to our improved handling of variable fonts (@simonwuelker, #45768), including Zulip (servo.zulipchat.com) and Speedtest (speedtest.net). v0.3.0 v0.4.0 lichess.org v0.3.0 v0.4.0 Zulip (servo.zulipchat.com) v0.3.0 v0.4.0 Speedtest (speedtest.net) Many websites worked in Servo even before version 0.4.0, including Google Photos (photos.google.com) and Cash Converters (cashconverters.com.au), and continue to work in version 0.4.0. Other websites, like Google Maps (maps.google.com) and OpenStreetMap (www.openstreetmap.org), render well but have some issues with interactivity. Google Photos (photos.google.com) Cash Converters (cashconverters.com.au) Google Maps (maps.google.com) OpenStreetMap (www.openstreetmap.org) We’re interested to hear how well your favourite websites run in Servo! Report successes in this Zulip thread, and failures in our GitHub issues. Work in progress

      We’re implementing the more powerful version of ‘attr()’ that can be used anywhere, not just in ‘content’, under --pref layout­_css­_attr­_enabled (@Loirooriol, #45041, #45421, #45495, #45752).

      WebGPU support has improved, under --pref dom­_webgpu­_enabled:

      • implemented copy­External­Image­To­Texture() on GPU­Queue (@sagudev, #45646)
      • implemented create­Query­Set() on GPU­Device and resolve­Query­Set() on GPU­Command­Encoder (@sagudev, #45644)
      • implemented push­Debug­Group() , pop­Debug­Group() , and insert­Debug­Marker() on GPU­Command­Encoder , GPU­Compute­Pass­Encoder , and GPU­Render­Pass­Encoder (@jschwe, #45489)
      • more conformant GPU­Texture (@sagudev, #45300)
      • more conformant request­Adapter() on GPU (@sagudev, #45424)
      • more conformant secure context enforcement (@sagudev, #45279)

      All of the features above are enabled in servoshell’s experimental mode.

      We’ve made more progress towards accessibility support, under --pref accessibility_enabled (@alice, @delan, #45555, #45554, #44949).

      We’ve started implementing visible and interactive text selection (@mrobinson, @SimonSapin, #46107), one of the most long- awaited features of any web browser. Stay tuned!

      We’ve also started working on Web Animations , under --pref dom­_web­_animations­_enabled (@simonwuelker, #45522, #45983), as well as webkit­Relative­Path on File , under --pref dom­_entries­_api­_enabled (@yezhizhen, #45666).

      Rust doesn’t have a stable ABI, so it has generally not been possible to embed Servo in another application without building Servo from source. To make it possible, we’ve started designing a wrapper C API that will let you consume Servo as a prebuilt shared library using the stable and ubiquitous C ABI (@mukilan, #44984). Eventually the idea is that we’ll create a wrapper Rust API around that wrapper C API, so you can have both the ergonomics of Rust and the build simplicity of C.

      Embedding API New in the Servo API: Web­View::rendering­_context (@mrobinson, #46047) Breaking changes: Web­View::send­_error has been removed (@mukilan, #45502) – this method was always meant to be internal, and has become unused after we introduced the new Web­View- and Web­View­Delegate-based API We’ve improved the docs for Web­View, Web­View­Delegate, JS­Value, Alert­Dialog, Allow­Or­Deny­Request, Authentication­Response, Bluetooth­Device­Description, Confirm­Dialog, Console­Log­Level, Create­New­Web­View­Request, Embedder­Control, Embedder­Control­Response, File­Picker, Image, Java­Script­Error­Info, Navigation­Request, Permission­Request, Pixel­Format, Prompt­Dialog, Protocol­Handler­Registration, Protocol­Handler­Update­Registration, Scroll, Select­Element, Select­Element­Request, and Web­View­Vector (@mukilan, #45282, #45467). For users and developers

      In servoshell:

      • the Android version now requires Android 13+ (@jschwe, #46104)

      • the desktop version now lets you drag and drop files to open them (@simonwuelker, #45454)

      • the desktop version now lets the tab bar scroll horizontally if you have too many tabs open, but from one tab hoarder to another, maybe you should reconsider having so many tabs open (@Nylme, #44884)

      • the desktop version enters fullscreen on the monitor containing the window, even if you’ve moved it to a different monitor (@rhit-kapilaar, #45556)

      • the desktop UI is more performant, resizes more smoothly, and no longer gets stuck in hovered states (@mrobinson, #45289, #45456, #45290)

      • < select multiple> should now be interactable on all desktop platforms (@alexcat3, #45419)

      • localhost:<port> now implies http:// in the location bar and on the command line , rather than treating localhost: as an unsupported URL scheme (@SteveSharonSam, #45729, #45832)

      When using the Firefox DevTools :

      • in the Console tab, uncaught exceptions are reported correctly (@jdm, #45549)

      • in the Console and Debugger tabs, you can now inspect the elements of nested arrays and the entries of Map objects (@atbrakhi, #45435, #45514, #45767)

      • in the Debugger tab, the Scopes panel now shows any ‘(uninitialized)’ variables, the value of this, and the global scope (@atbrakhi, @eerii, #45824, #45517)

      We’ve fixed some build issues on riscv32 , riscv64 , and arm64 (@fxzjshm, @saschanaz, #45285, #45731), and modernised servoshell for Android to use Compose UI and Kotlin (@veyndan, #45923, #45932, #45941, #45982, #45985, #46015, #46035, #46037, #46046, #46053, #46061, #46071, #45641, #45643, #45650, #45665, #45671, #45676, #45679, #45683, #45712, #45713, #45734, #45738).

      For developers of Servo itself:

      • mach try --help now lists all of the kinds of try jobs you can run (@shubhamg13, #45607)

      • mach test-wpt --update-expectations lets you run Web Platform Tests and update expectations in a single command (@TimvdLippe, #45521), rather than having to run mach test-wpt --log-raw <path> followed by mach update-wpt <path>

      More on the web platform To allow for more performant scrolling, ‘wheel’ events are no longer .cancelable unless there are one or more non-passive event listeners (@kunalmohan, #45667). Note that like in Firefox, ‘wheel’ events are passive by default. ‘dotted’ , ‘dashed’ , and ‘wavy’ text decorations are now continuous across element boundaries (@mrobinson, #45726). We’ve improved the conformance of < dialog> (@skyz1, @mrobinson, #45825, #45761), < iframe sandbox> (@cychronex-labs, #45880), < input minlength> and < input maxlength> (@skyz1, #45705), CSS gradients (@mrobinson, #43945), ‘font-style’ and ‘unicode-range’ in ‘@font-face’ (@Loirooriol, #45821), FontFaceSet (@mrobinson, #45390, #45382), HTML­Input­Element (@steigeo, #45416), Intersection­Observer (@jdm, #45655, #45659, #45680), new Response() (@yezhizhen, #45953), URL.create­Object­URL() and URL.revoke­Object­URL() (@yezhizhen, #45182, #45417), and ECDSA and Ed25519 in Subtle­Crypto (@kkoyung, #45833, #46017). We’ve fixed bugs related to < input hidden> (@mrobinson, #45750), ‘animation-delay’ (@yezhizhen, #45013), ‘clip-path’ (@Loirooriol, #45468, #45373), ‘tab-size’ (@SimonSapin, @mrobinson, #45309), ‘width’ and ‘height’ (@RichardTjokroutomo, #44627), ‘box-shadow: inset’ (@Loirooriol, #45620), ‘animation­iteration’ events (@Loirooriol, #45990), ‘click’ events (@mrobinson, #45751), ‘load’ events (@jdm, #45883), ‘error’ events in Worker global scopes (@Gae24, #45829), and document­.get­Element­By­Id() (@mrobinson, #45433). Garbage collection safety

      We use a RefCell -based mechanism to store many of our DOM types in other DOM types, enforcing Rust’s “aliasing xor mutability” rule at runtime by panicking if the rule is violated. But when garbage collection happens, we need to borrow() each DomRefCell to trace the references, and this is the source of many panic bugs. To fix that whole class of bugs, we initially created CanGc , a marker type that would annotate the code paths where GC can occur, in conjunction with custom static analysis (@jdm, #33140).

      With the Rust type system we can do even better, if we flip that around and require any borrow_mut() call to prove that GC can not occur by passing a NoGC marker value. We can then require that a &NoGC must be borrowed from a &JSContext (which blocks GC) and not a &mut JSContext (which allows GC), taking advantage of how Rust references work without needing any custom static analysis.

      We have a large codebase that needs to be migrated in parts, so for now we’ve created the new method safe­_borrow­_mut() (@sagudev, #46050). We also need to update all of our script-related code to borrow our safe JSContext wrapper, rather than creating an owned JSContext on the spot.

      This continues our long-running effort to use the Rust type system to make Servo’s integration with SpiderMonkey safer and more reliable (@Gae24, @Keerti707, @Narfinger, @TimvdLippe, @sagudev, @guptapiyush16, @ivomurrell, @kunalmohan, @skyz1, #45230, #45436, #45503, #45617, #45711, #45797, #45800, #45858, #45884, #45937, #45902, #45968, #45977, #45991, #46003, #46005, #46084, #45548, #45552, #45590, #45909, #45912, #45943, #46089, #46117, #46114, #45320, #45324, #45328, #45340, #45381, #45385, #45410, #45392, #45409, #45604, #45616, #45618, #45627, #45636, #45662, #45663, #45675, #45674, #45677, #45684, #45735, #45807, #45810, #45816, #45818, #45828, #45838, #45836, #45837, #45840, #45841, #45857, #45859, #45862, #45875, #45887, #45931, #45964, #45935, #45987, #45988, #46001, #46040, #46051, #46057, #46106, #46125, #45678, #46002, #45845, #45645, #45673, #45259, #45817, #45822, #45876, #45877, #45891).

      Performance and stability NoGC was designed to prevent dynamic borrow failures, but it also enables some performance optimisations! If we can prove that garbage collection is impossible in some part of Servo, we can often avoid rooting JavaScript objects when interacting with them within that region of code. This has allowed us to reduce overheads by over 1% in the layout process and in HTML­Collection (@Narfinger, #46092, #45582). Our memory usage has improved, with BoxFragment now 17% smaller (288 → 240 bytes on amd64) and ShapeCacheEntry now smaller too (@SimonSapin, @mrobinson, @simonwuelker, #45183, #45496). We’ve fixed some nasty memory leaks when reloading and in 2D canvases (@Taym95, @sagudev, @jschwe, #45455, #45261, #45414). Speaking of which, 2D canvases now use up to 23% less power (@yezhizhen, #45301), and we now avoid rasterising the same SVG more than once (@Narfinger, @jschwe, #44805). Servo now decodes all images asynchronously and fills image caches asynchronously , leaving script threads (web content processes) more time for other work (@Narfinger, #45542, #44483). On top of that, we’ve improved incremental layout (@mrobinson, @Loirooriol, #45411) and reduced reflows in IntersectionObserver (@jschwe, #45986). We’ve started working on incremental updates for the stacking context tree , and as a side effect, we’ve made some layout-bound microbenchmarks up to 10% faster (@mrobinson, @Loirooriol, #45208). We’ve also reduced allocations, copies, GC rooting steps, and other operations in many parts of Servo (@Narfinger, @SimonSapin, @mrobinson, @Loirooriol, #45506, #45969, #45940, #45760, #46090, #45335, #45413, #45511). For several months, Frédéric (@fred-wang) has been fuzzing for Servo bugs, and thanks to his work we’ve fixed sixteen (16) crash bugs in June, affecting < iframe>, < slot>, < link onerror>, ‘animation’ , ‘clip- path’ , ‘content’ , ‘rotate’ , ‘transition’ , ‘transform- style’ , ‘display: contents’ , ‘overflow: clip’ , CSS­Keyframes­Rule , Font­Face , stop() on Window , document­.element­From­Point() , and the DOM tree (@mrobinson, @Loirooriol, @fred- wang, #46031, #46027, #46054, #46058, #46016, #46028, #46033, #45287, #45951, #45634, #45629, #46110, #46094, #45799, #45611, #45682, #45788, #45612, #45834). We’ve also fixed crash bugs related to IPC failures, HTML­Input­Element , Range , the DevTools Debugger tab, and when servoshell is built with --features native-bluetooth (@jschwe, @Taym95, @mrobinson, @atbrakhi, @mukilan, #45311, #45619, #45765, #45513, #45702). New contributors

      A special thanks to the following people for landing their first patch in Servo:

      Interested in helping build a web browser? Take a look at our curated list of issues that are good for new contributors!

      Donations __

      Thanks again for your generous support! We are now receiving 7681 USD/month (+0.2% from May) in recurring donations. This helps us cover the cost of our speedy CI and benchmarking servers, one of our latest Outreachy interns , and funding maintainer work that helps more people contribute to Servo.

      Servo is also on thanks.dev, and already 35 GitHub users (same as May) that depend on Servo are sponsoring us there. If you use Servo libraries like url, html5ever, selectors, or cssparser, signing up for thanks.dev could be a good way for you (or your employer) to give back to the community.

      We now have sponsorship tiers that allow you or your organisation to donate to the Servo project with public acknowlegement of your support. If you’re interested in this kind of sponsorship, please contact us at join@servo.org.

      7681 USD/month

      10000

      Use of donations is decided transparently via the Technical Steering Committee’s public funding request process , and active proposals are tracked in servo/project#187. For more details, head to our Sponsorship page.

    14. 🔗 New Music Releases Collective Soul - Touch and Go rss

      Collective Soul - a new release is available:

      • 2026-07-31: Touch and Go (Album)

      Amazon: Canada | Deutschland | France | United Kingdom | United States

      Visit muspy for more information.

    15. 🔗 New Music Releases Moon Hooch - Number 9 (WENZL remix) rss

      Moon Hooch - a new release is available:

      • 2026-07-31: Number 9 (WENZL remix) (Single)

      Amazon: Canada | Deutschland | France | United Kingdom | United States

      Visit muspy for more information.

  4. July 30, 2026
    1. 🔗 IDA Plugin Updates IDA Plugin Updates on 2026-07-30 rss

      IDA Plugin Updates on 2026-07-30

      Activity:

      • disrobe
        • fa339fb7: regenerate the charts, evidence results and marker counts against the…
        • 380866dd: re-render the recovery chart and the card raster for the wasm executi…
        • 640c7bac: pin the pickle corpus bar to the test that already grades it, so its …
        • 26282c24: ollvm: name the toolchains each real-compiler grade actually covered,…
        • 72445757: wasm: name the 57 execution-eligible functions in a pinned roster, so…
        • f5144dac: lua: feed every luau opcode the table declares through the lifter and…
        • 4aa22a86: make a published figure that cites nothing resolvable fail the checks…
        • fe8b3822: swift-objc: decode the dylib list, uuid, rpaths, build version, entry…
        • ce4728fc: delphi: stop dropping single-letter enumeration members, published fi…
        • 23961d51: pyarmor: hold the recovery gate's floor to the fixture count the corp…
        • c403f31a: walk the js bundler roster on the real output of each tool instead of…
        • b8d89a51: hermes: publish the decompile-correctness row at the 8 of 8 functions…
        • faf1b0f0: binfmt: pick the archiver, cab writer and readelf by what actually st…
        • dde066cc: wasm: carry the external opcode denominator and the wasmtime executio…
        • b5a9009f: scan the hand-written evidence pages for metric markers too, so a fig…
        • c044a6ce: dotnet: turn the ignored helloapp dump into a test that checks the ac…
        • e7eb2f75: pick up the sha1 and sha2 entries the benchmark and recon manifests n…
        • eff742a9: wasm: divide op-coverage by a hash-pinned wasm-tools instruction inve…
        • f79e7ba4: dexguard: point the in-crate string-decrypt and protector-peel tests …
        • 42559ad1: delphi: give a record its own size field instead of borrowing the ord…
      • ida-domain
        • 8f36bbce: Implement methods to add/remove xrefs (#97)
        • d313d374: Add @experimental decorator (#108)
      • ida-hcli
        • ffc9a68f: Merge pull request #267 from HexRaysSA/idausr
        • 220d3a75: fix: split IDAUSR environment variable
      • ida-multi-mcp
        • 3077662a: Merge pull request #38 from Whispersource/feat/py-eval-rewrite
        • 43165b81: Merge branch 'main' into feat/py-eval-rewrite
        • ca2f0af6: Merge pull request #32 from Whispersource/feat/stdio-fix-and-enhancem…
        • 1d2632b6: Merge branch 'main' into feat/stdio-fix-and-enhancements
        • d1db9706: Merge pull request #37 from MeroZemory/feat/verify-install
        • 93d104c6: Merge branch 'main' into feat/verify-install
        • 2c044fd5: Merge pull request #36 from MeroZemory/docs/similarity-fallback-comment
        • d8ee88cc: Merge branch 'main' into feat/verify-install
        • 6505d3f1: Merge branch 'main' into docs/similarity-fallback-comment
        • f0c85a25: Merge pull request #35 from MeroZemory/fix/rpc-dead-download-default
        • 3b7871a1: refactor(py_eval): AST-based execution replacing try-eval-then-exec p…
        • d4b7bbc5: Merge remote-tracking branch 'upstream/main' into fix/idalib-stdio-hang
        • ecf1393e: Merge branch 'main' into feat/verify-install
        • d87752cc: Merge branch 'main' into docs/similarity-fallback-comment
        • 3d8402d1: Merge branch 'main' into fix/rpc-dead-download-default
        • db5bbf54: Merge pull request #34 from MeroZemory/fix/idalib-download-url
        • d33c4996: fix(idalib): prevent worker hang when MCP server runs as stdio child
        • 3d6a5f2e: feat(cli): add -verify to check the installed plugin loader
        • 5d8cc452: docs(similarity): correct the fallback key comment
        • aa454ad9: fix(rpc): stop advertising a download URL nobody answers
      • ida-pro-mcp
        • f82e6e25: Merge pull request #499 from NeKroFR/fix/issue-498-idb-save-kill
        • 9c771500: fix(idb_save): never DBFL_KILL working files of an open database
      • Luc-Nhan
        • d253636b: Merge branch 'feat/knowledge-ui-sqlite-migration'
        • a91024f8: fix(agent): honor user-configured budget on SQLite retrieval path
        • d6e3ab20: test: fix ruff unused import in dual-write test
        • 72c1b049: feat(ui): refresh knowledge panel on save_memory success
        • b621b29e: refactor(agent): retrieved knowledge section reads from SQLite
        • 4d6b912d: refactor(ui): knowledge panel reads from SQLite store
        • e52df2e1: feat(ui): expose memory_service accessor on SessionControllerBase
        • 65e4051a: fix(memory): restore title-match + body keyword scoring in ranker notes
        • 2eb994cf: feat(memory): rank retrieved knowledge from SQLite store
        • 0fa4bf4a: refactor(memory): dual-write exploration/research to SQLite and JSONL
        • a3530ab3: feat(memory): auto-import legacy JSONL on first IDB open
        • 9e50612c: feat(memory): convert JSONL records to bundle envelopes
        • 63553c60: feat(memory): expose exploration finding write with graph metadata
        • 2caadcea: feat(memory): migrate workspaces to schema v3 with graph metadata
        • c72cb25e: Merge branch 'feat/memory-durability-orchestra-gate' into feat/knowle…
        • fb9c45e2: docs(plan): knowledge UI and write path SQLite migration plan
        • 89735a02: docs(spec): fix 5 technical gaps in Knowledge UI migration design
      • pharos
        • 0421be34: Merge pull request #337 from sei-eschwartz/issue-336
        • f242a10c: fix: recognize multi-byte NOP alignment padding
        • da8d2a84: fix: repair -accept in the partitioner test harness
      • quokka
        • 1459d398: Merge pull request #124 from quarkslab/update-ci
    2. 🔗 Hex-Rays Blog LLMs Have Reshaped How We Think About Decompilation and Collaboration rss

      LLMs Have Reshaped How We Think About Decompilation and Collaboration

      Shifting Times

      A few weekends ago, I was playing DEF CON CTF Quals, the qualification event for the "Olympics of Hacking," with my team Shellphish. I say "playing" because I am, at this point, a washed-up hacker, but add me to the 40-something ranks! Nonetheless, I showed up, downloaded a binary, and went to open it in IDA Pro: a reflexive, built-in response to anything compiled. But as that ever-knowing face rendered on my screen, I paused for a moment to take in the surrounding feverish hacking. Something was strange: no one else had IDA Pro open. In fact, no one had any decompiler open!

    3. 🔗 hacker news ida pro references New comment by mahaloz in "Kuna: Decompiler Development in the Age of Coding Agents" rss

      Interesting. A lot of data shows IDA Pro is significantly better than Ghidra: https://decbench.com/

      Based on today's results, IDA Pro is ahead by 15 percentage points, which would mean, statistically, IDA Pro will recover perfect source code for 15% more functions than Ghidra on average.

    4. 🔗 hacker news idalib references New comment by billypilgrim in "Kuna: Decompiler Development in the Age of Coding Agents" rss

      idalib with Claude Code already works really well. But honestly, despite what people have been saying, LLMs have been very good at decompiling for at least two years now, I have been using it for that purpose regularly. Even just copying disassembly from the current function and all nested called functions from IDA into ChatGPT is already unexpectedly good.

    5. 🔗 The Pragmatic Engineer The Pulse: Quitting Spotify Podcasts over reliability rss

      Hi, this is Gergely with a bonus, free issue of the Pragmatic Engineer Newsletter. In every issue, I cover Big Tech and startups through the lens of senior engineers and engineering leaders. Today, we cover one out of four topics of last week 's The Pulse issue . Full subscribers received the article below seven days ago. If you 've been forwarded this email, you can subscribe here .

      You can no longer watch The Pragmatic Engineer Podcast as video in the Spotify app (only as audio) because I have quit publishing video on that streaming platform. This comes after I decided that reliability takes a back seat within that team - and across much of Spotify. Unlike on other platforms such as YouTube, Apple Podcasts, and Substack, I've recently encountered a series of reliability issues around Spotify being unable to process video episodes. Even though I enjoyed a direct link with the Podcasts team there, things haven't improved.

      So from now, I will no longer be publishing video episodes on Spotify. You can find videos of my in-depth chats with guests only on YouTube. Apologies for any inconvenience this change causes! Audio episodes of the podcast can still be found on Spotify via the RSS podcast feed hosted on Substack.

      Honestly, the decision to quit the streaming giant wasn't hard, and I reckon there's a point here about the risk of deprioritizing reliable operations at major companies in order to push on things like AI adoption, as Spotify seems to be doing.

      Some context: for the first two years of The Pragmatic Engineer Podcast, it was published on three podcast platforms:

      1. Substack 's podcast platform (audio): this is where the "master" RSS feed is served to the likes of Apple Podcasts, the web, Overcast, Pocket Casts, etc
      2. YouTube (video): video episodes uploaded individually
      3. Spotify (video + audio): every video episode was uploaded individually and then served as video or audio episodes from the platform.

      As someone hosting a podcast, there are good reasons to bother doing three separate uploads:

      • Most podcast platforms don 't support video. There will always be a need for a platform that serves the master RSS feed for audio versions while the video ones are elsewhere.
      • YouTube doesn 't integrate with anything. YouTube is the leader in video podcast distribution, and uploading there directly makes sense.
      • I had a direct line to the Spotify team, which was a big plus. Starting out the podcast, I had the unusual privilege of contact with the podcasts team, thanks to the newsletter gaining a decently-size audience. I was persuaded to take the plunge with them.

      For eighteen months, nothing major went wrong. The admin portal for podcast publishers (called 'Spotify Creators') was pretty wonky; it gave intermittent errors, and was unable to remember me when I signed in, so, each Wednesday, I'd have to sign in with a code sent to my email to publish an episode.

      But overall, things worked, until it all went suddenly downhill…

      Unable to publish Spotify podcast episodes 3 out of 5 weeks

      From late May, I did not include links to Spotify on new episode announcements because their podcasts product or platform seemingly had outages every time one published on Wednesdays at around 9am PST / 12pm EST / 6pm EU time.

      Outage #1 (20 May): podcast publishing broke , my episode would not process on Spotify for 2+ hours. When uploading a video file to Spotify, there's a processing pipeline that runs to create chunks of the podcast in different video and audio formats. This pipeline appeared to stop running, meaning new episodes were not published.

      It was not just the publishing that broke: the Creator portal looked absurd, with NaN% values everywhere, during the outage:

      altDuring outage #1

      I emailed the Spotify team to alert them about the outage and also complained online. I got a response, confirming the outage and pledging to do better:

      "The issue was in one of our podcast publishing metadata pipelines. A small subset of episodes completed normal media processing but then missed a downstream publish update because a newly introduced validation signal was not correctly wired into the logic that wakes up the publishing path. In simpler terms: the episode could become eligible to publish, but the final propagation step was not reliably triggered for that class of episodes.

      We identified the root cause, deployed a fix, and reprocessed the affected episodes with all-clear called early this morning. We're also tightening the system so that fields used for publishing eligibility cannot be added without also triggering the relevant downstream updates.

      Separately, we're reviewing how partial creator-impacting publishing delays are surfaced, because even when this is not a broad platform outage, it is still a bad experience for publishers like yourself.

      Apologies again that you hit this. It was a real bug, not a wide outage, but it hit some of our most relevant creators."

      Outage #2 (17 June): Spotify down. Four weeks later, when attempting to publish a video episode, all of Spotify went down for many users, including myself.

      altSpotify's web player on 17 June

      Spotify does not maintain a status page, so it's impossible to tell how widespread the outage was. I didn't include a Spotify link in that week's announcement either.

      Outage #3 (24 June): podcast publishing broke - again. Outage #3 in five weeks; deja vu. This time, it was episode publishing not working, yet again. After waiting two hours for the episode to publish on Spotify, I yet again sent out the announcement with no Spotify link.

      I also emailed the Spotify Podcasts team, who confirmed the outage. I said I was considering stopping publishing video episodes, and to switch to audio- only publishing (which means pointing Spotify to my master RSS feed.) I said that an apology was appreciated but it wasn't enough to make it worth publishing video episodes there.

      I also asked for the incident review because I had the feeling that reliability was not all that important on this podcast product. For the first outage I got a vague description of what happened, and promises of improvements that were never done - e.g. during this second outage, there was no improved communications to creators, which I was told would happen, after outage #1.

      Internally, Spotify's team surely conducted an incident review as per usual, so I figured I'd hear back in about two weeks' time, and assumed a reply would be forthcoming because I'd made clear I was ready to leave Spotify Podcasts if reliability didn't improve.

      No incident review three weeks later, so I quit Spotify

      The incident review had never arrived as promised by three weeks later, even though there had been time for it to be completed. It was yet another sign of a platform that has become unreliable. Also, the creator portal occasionally threw up this error:

      altSpotify 's creator portal on 16 July

      I checked my Spotify stats: stream plays had been trending downwards unsurprisingly, given the ongoing outages, while the other podcast platforms didn't show the decline.**** It made me decide "enough is enough" and to move off Spotify.

      Staying on their platform depended on seeing an incident review, but they didn't prioritize transparency, still had no status page, and nobody had built a feature for episode-processing status like YouTube has had for years. So, I pulled the plug and left:

      altOffboarding from Spotify's (video) podcasts product

      After I made the switch away from Spotify, the platform's creators portal became buggier than ever, as in these examples:

      altMy Creators page after I changed the source of my podcasts to the master RSS feed

      Comments disappeared:

      altMy show had no comments, suddenly

      … even though other parts of the UI showed dozens of comments:

      altZero comments, yet episodes with comments

      Episode links directed to 404 pages:

      alt404 pages inside the Creator portal, when clicking links

      A day or two later, these issues disappeared: I assume no one had tested the flow of moving away from Spotify Podcasts to an RSS feed, and it's why the experience was so poor.

      Incident review finally published, but with a wrong timeline

      A few days after offboarding from Spotify, their team published the incident report for outage #3. Reading through it, something did not add up in the timeline:

      altThe original timeline published for the 24 June incident

      My email account confirmed that I mailed the Spotify team at around 17:30 about the outage. So, after weeks of creating this report, why did the incident report downplay the fact that customers alerted the team before their own automated alerts fired?I complained to the Podcasts team, and to their credit, the incident report was updated:

      altThe updated incident timeline

      I didn't like how high-level the report is, and how vague the promised improvements were. Specifically, this one:

      "During this incident, many creators learned something was wrong from their audiences before they heard anything from us. We are improving our processes and technical capabilities so creators get notified as soon as possible when things aren't working."

      Overall, I don't regret the choice to leave, particularly when the focus of Spotify's leadership is on AI, not reliability.

      Does Spotify have "AI psychosis?"

      Previously, I used the term "AI psychosis" differently from the usual way of describing when someone starts believing everything an AI model tells them, however outlandish. I applied it to Meta's rush to develop its own AI model at the cost of the reliability of its profitable business activities. This was based on Instagram's most embarrassing-ever account takeover incident, which occurred when the team responsible for Instagram's Trust & Safety was slashed. Soon after, AI- generated, AI-reviewed code caused the hacking of a former US president's account.

      At Spotify, it should have gone the other way. In March, I had the opportunity to meet its Head of Technology & Platforms, Tyson Singer, who said the company puts reliability far ahead of AI adoption, and doesn't adopt AI for its own sake. So, it was somewhat surprising to read the summary below of a podcast Spotify did with Anthropic:

      "Spotify now ships 4,500 production deploys a day, and 73% of PRs are now AI-assisted.

      Niklas Gustavsson (VP of Engineering at Spotify) keeps 5 to 10 Claude sessions running in tmux, one per git worktree, agents working in the background. All of it inside a 20M+ line monorepo. He expected agents to struggle at that size, but it's worked well.

      Spotify's migration codemods grew into thousands of lines of edge cases. Code has too much API surface for static rewrites. Early LLMs barely did better. Adding a judge took PR success from ~25% to 80%.

      All of this leans on verification, the single most important thing when agents are used and the place most companies underinvest

      Spotify rebuilt their test automation around it so engineers can confidently guide and supervise agents, rather than manually execute repetitive tasks."

      It seems to me that all the talk is about usage of AI, and none about reliability , all while Spotify's platform becomes less reliable than ever, at the same time as the streamer is going all-in on AI; with AI judges and devs running 5-10 parallel Claude sessions.

      All things considered, it's worth asking if Spotify has the corporate variant of "AI psychosis", whereby the reliability of a successful operation gets torched in the chase for the next big thing by executives. I don't even think Spotify is all that different from Meta and other companies in this!

      Things look bad, based on the quality and reliability degradation of products. Annoyingly, in many cases, customers don't really have the choice of going elsewhere. My podcast is an exception, as video podcasts on Spotify never truly took off, so quitting the platform wasn't a big deal. Even so, I'm particularly disappointed that Spotify has prioritized AI usage over reliability. I know some executives there pushed against this, but I feel safe in assuming that they lost that battle.

      Value of staying reliable & "sucking less"

      Max Kanat-Alexander, distinguished engineer at Capital One, has written about how a software project can become wildly successful just by "sucking less" in his reflections upon the success of the Bugzilla project, (2004-2009):

      "All you have to do to succeed in software is to consistently suck less with every release.

      Nobody would say that Bugzilla 2.18 was awesome, but everybody would say that it sucked less than Bugzilla 2.16 did. Bugzilla 2.20 wasn't perfect, but without a doubt, it sucked less than Bugzilla 2.18. And then Bugzilla 3.0 fixed a whole lot of sucking in Bugzilla, and it got a whole lot more downloads.

      Why is it that this worked?

      As long as you consistently suck less with every release, you will retain most of your users. You're fixing the things that bother them, so there's no reason for them to switch away. Even if you didn't fix everything in this release, if you sucked less, your users will have faith that eventually, the things that bother them will be fixed. New users will find your software, and they'll stick with it too. And in this way, your user count will increase steadily over time.

      But what happens if you release frequently, but instead of fixing the things in your software that suck, you just add new features that don 't fix the sucking? Well, eventually the patience of the individual user is going to run out. They're not going to wait forever for your software to stop sucking."

      Personally, I got tired of Spotify's Podcasts product continually going in the wrong direction on Max's scale: the poor reliability, frequent errors on the Creators site, and the sense that they don't really care about improving existing things.

      Read the full issue of last week's The Pulse. The full The Pulse additionally covers:

      1. Will Kimi K3 trigger US push for closed-source AI models? Moonshot AI's latest open model, Kimi K3, is on par with Anthropic's Fable 5. Could it lead to the US government regulating or banning Chinese open models to protect US labs?
      2. AWS laughs off "heart attack" billing error. AWS customers were billed trillions more than they should have been, due to what was likely a conversion error. But instead of sharing an incident report, AWS saw the funny side.
      3. Industry pulse. OpenAI's unreleased model tried to hack HuggingFace to improve its test scores, X took more than a year to develop its new Android app, Google's new AI model flops, and more.

      Read the full The Pulse.

    6. 🔗 hacker news ida pro references New comment by comandillos in "Kuna: Decompiler Development in the Age of Coding Agents" rss

      Haven't used IDA much lately, but after looking at the screenshot with that IDA PRO decompiled code in their website I feel like Ghidra is already ahead of them in this area :D

    7. 🔗 Kagi release notes July 30th, 2026 - Kagi Assistant on the go and design refinements for Search rss

      Announcing the official Kagi Assistant apps

      Kagi Assistant is now available as a native app for iOS and Android!

      Ask a question, explore the web, work with files, conduct in-depth research, or choose from leading AI models, all from your phone. Your threads and Custom Assistants stay with you, so you can pick up wherever you left off.

      These are the first steps towards delivering a fantastic Kagi Assistant experience on mobile, with much more to come.

      Download it now:

      Give it a spin and let us know what you think!

      Report responses directly from Kagi Assistant

      You can now report an assistant response without leaving the conversation. Hover over any assistant message and select the thumbs-down button to open the feedback form, where you can report issues for reasons ranging from UI bugs to harmful content.

      Note that when you submit a report, the full thread is shared with Kagi for review. The report and its associated copy of the thread are automatically deleted from Kagi’s review records after 30 days.

      Export or delete all your threads

      We've also added important controls, so you can now export all your threads or permanently delete them at once from Settings > General.

      Kagi Assistant settings panel in dark mode showing the General settings tab, with a modal dialog open asking with Cancel and Delete all buttons.

      Kagi Search

      A sharper search experience

      We’ve polished the search results page to make its controls easier to find and understand. From the filter bar to domain-related options and menus, these updates bring greater clarity and ease of use to the features you rely on most.

      Exchange rates, right in your search results

      Next up in our broader effort to improve search widgets: currency conversion. Comes handy when you’re planning a trip, shopping abroad, or simply want to keep tabs on exchange rates.

      Kagi search results page for the query displaying an inline currency converter showing 100 ISK equals 1.12 Canadian dollars.

      Other improvements and bug fixes

      Kagi Search

      Kagi Assistant

      Kagi Translate

      • Kagi Translate reloads the page when using website translate #10852 @tijol
      • Dictionary now shows language-specific grammar details, starting with Czech animate/inanimate nouns
      • Proofread no longer suggests changes to text that was already correct, such as de-capitalizing German nouns
      • Translations no longer occasionally come back untranslated
      • Translations keep proper typographic punctuation instead of straightened quotes
      • Alternative translations now work when selecting part of a longer text
      • Double and triple-click selection in the translated text works as expected, and the alternatives panel no longer flickers while loading
      • "New version available" banner appears less often and supports dark mode
      • Reset-All Button for Translate #10999 @erakagi
      • Document Translate for Typst #11098 @weriomat
      • Palestinian Arabic in Translate #11006 @zsoltsb
      • Phonetic Translation Placement #10699 @dwahdany
      • Myanmar alias for Burmese #10495 @mb
      • Translation History panel cannot be closed in Brave (Windows 11) #10997 @vshlapakov
      • Prompt being read prior to translated word #10974 @kagifeedback-1xxkg
      • Kagi Translate Audio Broken #10923 @levers

      Kagi News

    8. 🔗 r/LocalLLaMA Think of the children, another excuse for them to go after open source AI rss

      Think of the children, another excuse for them to go after open source AI | Source: https://web.archive.org/web/20260728093051/https://www.theverge.com/ai-artificial-intelligence/971723/hugging-face-nudify-deepfake-undress-women-children submitted by /u/MaruluVR
      [link] [comments]
      ---|---

    9. 🔗 Cryptography & Security Newsletter The State of Post-Quantum Cryptography rss

      For people who deal with network security, the last couple of years have been busier than usual, largely because of the impending threat of quantum computers that are going to annihilate all cryptography we use and love today. If you’re feeling fatigue from the firehose of events, you’re not alone. For me, personally, there is a sense that we’re seeing fewer and fewer technical announcements, which is perhaps pointing to the fact that most of the technical decisions have been made. At the same time, the deadlines have been shortened on account of the fears that cryptographically-relevant quantum computers (CRQC) are arriving sooner than anticipated. What lies ahead of us is definitely going to be hard, but we’ll need to only execute on the plans?

    10. 🔗 pydantic/pydantic-ai-harness v0.14.0 (2026-07-29) release

      What's Changed

      • fix(ci): let dependency approval revoke a label and still report by @dsfaccini in #495
      • docs(agent_docs): record where operational policy lives by @dsfaccini in #497
      • Clarify runtime capability creation documentation by @dsfaccini in #499
      • Add first-party MongoDB backend + externalize large text parts by @dsfaccini in #446

      Full Changelog : v0.13.0...v0.14.0

    11. 🔗 Console.dev newsletter superfile rss

      Description: Fancy modern terminal file manager.

      What we like: Built with Go. Supports all the file operations you’d expect. Build-in search. Split into panels and copy/paste between them with shortcuts. Configurable and themeable.

      What we dislike: Partial Windows support.

    12. 🔗 Console.dev newsletter LetsSeal rss

      Description: Prove files.

      What we like: Built on an open standard to prove a file exists and is unaltered. Works via the web and through a CLI. Has a GitHub action. Can be self-hosted. Verification is through re-hashing and comparison, with a public transparency log.

      What we dislike: Although you can verify offline, it still requires writing into a public transparency log (blockchain).

    13. 🔗 New Music Releases Swedish House Mafia - Happiness Is So Sad rss

      Swedish House Mafia - a new release is available:

      • 2026-07-30: Happiness Is So Sad (Single)

      Amazon: Canada | Deutschland | France | United Kingdom | United States

      Visit muspy for more information.

generated: August 02, 2026 at 08:00:03