Creepy Crawlies — 553 pts

Konstantin Ryabitsev (kernel.org infrastructure) published hard numbers on what AI crawlers are doing to the Linux kernel’s web infrastructure. The headline stat is brutal: across 5 geo-distributed nodes, 14 CPU cores do nothing but render git commits as HTML for scrapers. That’s more CPU cycles spent feeding crawlers than on all legitimate access combined — including git clones.

The real indictment is the stupidity of the approach. The entire Linux kernel history is a git clone away. Any actual intelligence would just clone the repos and parse locally. Instead, these “AI” crawlers hammer the web interface, generating constant background radiation of system load. It’s the equivalent of photocopying every page of a library instead of just checking out the books. The post doesn’t name names, but the implication is clear: the companies building “superintelligent” systems can’t figure out git clone.

Source: people.kernel.org/monsieuricon/creepy-crawlies

Bug Blindness — 374 pts

Dan Luu’s latest is a meditation on why most people don’t notice bugs that are, to him, glaringly obvious. He observes hundreds to thousands of bugs per week and has spent years wondering why others don’t. His conclusion: it’s not about how you use computers — it’s perceptual. People hit the same bugs and simply don’t register them.

The more interesting claim is about institutional bug blindness. He describes evaluating products where internal feedback is uniformly positive (“it works great”), but when he actually opens the thing, it only functions with a pile of non-intuitive workarounds. A normal user would have such a catastrophically bad experience they’d tell their friends. This is a damning indictment of how enterprise software gets shipped — internal teams develop workaround Stockholm syndrome and lose the ability to see what a fresh user encounters. For anyone in regulated industries (GxP, CSV), this should resonate: validation teams routinely find that “working” systems are held together with undocumented tribal knowledge.

Source: danluu.com/bug-blind

Hy4 Preview — 368 pts

Tencent released and open-sourced Hy4 preview, a 770B total parameter MoE model with 49B active parameters and a 1M+ token context window. The benchmarks put it “among the top tier of open-source models,” and Tencent’s internal blind evaluation (163 experts, 203 engineering tasks) scored it 2.99/4.00 — slightly ahead of GLM-5.3 and Kimi K3.

The usual caveats apply. Internal benchmarks are marketing. “Among the top tier” is doing a lot of work. The real signal is that it’s open-weight and available on OpenRouter, which means the community will actually stress-test it within days. The productivity focus — coding, office work, financial analysis — positions it as a direct competitor to the Claude/GPT enterprise play. Whether 49B active parameters can actually deliver on those claims at production latency remains to be seen. Free access for two weeks on WorkBuddy and CodeBuddy is a smart move to drive adoption before anyone can publish independent evals.

Source: tencent.com — Hy4 preview

RISC-V Officially Supported by CPython — 287 pts

CPython now officially supports RISC-V as a tier 3 platform. This means it’s in PEP 11 and has buildbot coverage, but tier 3 doesn’t guarantee pre-built binaries or the same level of CI testing as tier 1 (Linux x86-64, macOS ARM64). It’s a milestone, not a finish line.

The real story is the ecosystem signal. RISC-V is projected to quadruple its ecosystem by 2032, and Python working reliably on it removes a significant adoption friction. The RISE Project provided hardware for buildbots, and the Sovereign Tech Agency funded the fellowship work. This is infrastructure investment paying off — open instruction sets getting first-class support from the dominant scripting language. If you’re building anything targeting RISC-V embedded or edge devices, this matters.

Source: blog.python.org — RISC-V support

Casey Muratori – The Root of the Root of All Evil – BSC 2026 — 252 pts

Casey Muratori’s Better Software Conference talk (2+ hours including Q&A with gingerBill) revisits Knuth’s “premature optimization is the root of all evil” — but goes deeper into what the root of that root actually is. Muratori is known for Handmade Hero and his critiques of software bloat, and this talk continues that thread. The 222K views and 501 comments in 4 days suggest it struck a nerve.

Without a transcript it’s hard to summarize the specific argument, but Muratori’s general thesis has been consistent: the industry’s reflexive dismissal of performance concerns (“just throw hardware at it”) creates compounding costs that become architectural. The “premature optimization” quote is misused to justify never optimizing at all. If you care about software that actually works well, this is worth the 2-hour investment.

Source: YouTube — Casey Muratori BSC 2026

Omarchy: Any User Process Can Escalate to Root — 252 pts

A clean, responsible disclosure writeup. Omarchy (DHH’s Arch Linux rice setup) configured its default user as a member of the docker group. Docker explicitly warns this grants root-level privileges, but Omarchy shipped it as default anyway. The proof of concept is trivial: docker run --rm -v /:/hostroot alpine cat /hostroot/etc/shadow — any process in the user session can read /etc/shadow without sudo.

This is a textbook example of convenience overriding security. The docker group membership has been a known footgun for years, and shipping it as default in a distribution aimed at developers is negligent. Patched in 4.0.1. The broader lesson: if your setup tool adds your user to the docker group, treat that machine as root-equivalent. Every browser tab, every Electron app, every random npm postinstall script has root on your box.

Source: 0xcc.io — Omarchy root creds

European Commission Revives Push for Encryption Backdoors — 240 pts

The EU’s ProtectEU internal security strategy reopens the encryption backdoor debate, this time wrapped in the euphemism of “lawful and effective access to data for law enforcement.” The strategy doesn’t make concrete policy proposals yet — it’s a “vision and workplan” spanning years — but the direction is clear.

The framing is familiar: growing threats from hostile states, criminal groups operating online, surging cybercrime. From these premises, the conclusion is that end-to-end encryption needs backdoors. The technical reality hasn’t changed: you cannot build a backdoor that only good guys can use. Every cryptographer has said this. The EU keeps asking anyway. This is the third or fourth iteration of the same push (Chat Control, now ProtectEU), and the persistence suggests they’ll keep trying until something sticks. For anyone building communication tools or handling sensitive data in the EU, this is the regulatory risk to watch.

Source: reclaimthenet.org — EU ProtectEU encryption backdoors

Hacking IKEA Furniture — 210 pts

A practical DIY post about building office furniture from IKEA Kallax shelving units. The author wanted workbench-depth furniture (60cm) that didn’t look like it belonged in a garage. Custom furniture quoted at ~€1000/unit. Kitchen cabinets had the right depth but poor aesthetics. Solution: modify Kallax units with a repurposed desktop board on top.

It’s a straightforward build post, but the interesting subtext is the “ChatGPT suggested kitchen cabinets” detail — AI as a brainstorming tool for physical-world problems. The result looks clean and the total cost is a fraction of custom furniture. Not world-changing, but a solid reminder that the best solutions often come from combining off-the-shelf parts in non-obvious ways.

Source: greenlightning.eu — Hacking IKEA Furniture

Throughline

Three themes dominate today’s front page. First, the cost of AI’s infrastructure appetite: kernel.org burning 14 cores just to feed scrapers who could git clone, and Tencent shipping a 770B parameter model while the industry debates whether any of this scales sustainably. Second, security as an afterthought: Omarchy shipping docker-group-as-default-root, and the EU trying to mandate the ultimate security weakness (encryption backdoors) while framing it as strength. Third, the gap between how things appear and how they work: Dan Luu’s bug blindness piece, Casey Muratori’s critique of the optimization-is-evil orthodoxy, and the RISC-V milestone that matters more for what it signals about open hardware’s trajectory than for Python compatibility today.

The common thread is institutional blindness — to bugs, to security trade-offs, to the actual cost of convenience. The people who notice these things are consistently treated as outliers until the bill comes due.