Digital Dhaba

Three new discoveries in mathematics, computer science, and physics

OpenAI published model results on the Kakeya conjecture, the Exponential Time Hypothesis and quantum chromodynamics. The post also covers how researchers can verify and build on those results, which is what lets outsiders check claims of AI-made discoveries.

Gemini 4 Carbon

Google's new frontier model ranks #1 on Artificial Analysis Intelligence Index v5.0 (59) and scores 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench. It costs $2 per million input tokens and $10 per million output tokens. Access starts with a subset of cyber defenders through the Fairwind Program before a wider launch.

Kimi K3.1 Pro and K3.1 Pro Highspeed

Moonshot's open-weight 3T-class model has a 1M-token context window and scores 65.7% on Terminal-Bench 4.0. That is ahead of GPT-6 Astra (58.2%) and just behind Claude Opus 5.5 (66.4%). The Highspeed variant runs 2–3× faster, both are live on the Kimi API, and full weights are due by Nov 4.

StreamEval: Evaluating Interactive Streaming Video Generation Models

In short: A benchmark of 300 scripted test cases across avatar dialogue, avatar performance, world generation, instruction editing and reference editing, scored on ten metrics. The authors ran 37 models through it.

Why it matters: Good visual quality and identity retention don't mean a model carries out requests reliably. The top Following score among avatar-performance models is only 36.90, and the best Edit Success for reference editing is 15.00.

Trajectory2Gym: Decision-Grounded Compositional Interaction Synthesis for Tool-Use Agents

In short: Instead of collecting successful tool-use runs, it builds interactions around multi-step dependencies the training data under-represents. It supervises only actions the agent could justify from what it had seen.

Why it matters: Across five Qwen3 sizes it improved Tau1, Tau2 and BFCL at every scale, lifting the three-benchmark mean by 16.9–29.8 points.

Trial by Trace: Benchmarking AI Agent Harnesses for Reliability and Failure Attribution

In short: TraceTrial-Bench scores the software around an agent, not just the model. It uses 95 expert-level tasks across seven harness components, plus tracing and failure-attribution modules.

Why it matters: Over 3,420 runs, harness scores ranged from 59.8% to 72.0%, and 31.1% of runs succeeded despite failing at least one harness criterion.

Apple's git still trusts the compromised eMudhra certificates

Apple was notified on Oct 17, yet as of Oct 28 the git, curl and python3 shipped with macOS still trust the compromised certificates. macOS 27.2 undid users' manual workaround. Clones, pushes and tokens over HTTPS can be intercepted, and the site has check commands and a manual fix.

Python's experimental JIT to be removed

After the steering council paused JIT work and asked for a standards-track PEP, the maintainers withdrew PEP 836 following months of discussion. The council had set a six-month deadline, after which the JIT code would have to come out of CPython's main branch. For now, development on the 3.13-era JIT appears to have stopped.

Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more

An unchecked return value in Google's reference Brotli decoder lets a crafted stream write past an eight-byte buffer, which can lead to code execution. Node's fetch and zlib, Python's requests, urllib3 and aiohttp (with a Brotli package installed), and Express 5.0.0–5.3.0 body parsers are exposed paths. Fixed releases bundle Brotli 1.0.10, 1.1.1 or 1.2.1.

Microsoft just shared Azure's actual revenue in dollars: $33.2 billion

Azure brought in $33.2B in the July–September quarter, up 48% and about $850M above analyst expectations. Google Cloud reported $30.7B for the same period, growing roughly twice as fast. Reporting dollars for the first time lets investors compare Azure directly with AWS and Google Cloud.

GPU-unlock: FP/BF16 instruction issue rate on Nvidia 3000's cards

This Linux-only project lifts NVIDIA's half-rate cap on FP16, BF16 and TF32 tensor math with FP32 accumulation on GeForce cards. It does so at boot, with no patched driver or VBIOS flash. The author reports up to 2× tensor throughput and +25–55% LLM prefill, with outputs bit-identical. Blackwell isn't supported.

Google illegally cut down 250K trees in Finland for data center

Citing The Guardian, the report says Google cleared about 816 acres near Muhos before completing Finland's mandatory environmental impact assessment. Finnish officials suspended development at two of its data center sites. Residents report wildlife displacement and polluted streams. Google's Finland chief says the company believed it had approval.

Anthropic S-1

Anthropic's 335-page IPO prospectus devotes about 100 pages to risks, including that its technology could "erode trust, harm society and destabilize the geopolitical order." According to TechCrunch, the company recorded an operating profit in Q2 and 900% net revenue retention.

Anthropic just launched tools to show companies what their AI spending is buying

New reports show managers what a team produced, what it cost and where workflows broke down, plus pooled group budgets for tokens. Anthropic says it won't train on this data by default. Jellyfish data cited in the story shows spending on agentic coding tools up 10× this year, now about 2% of engineering cost.

US agency approves Amazon Leo's $11.5B acquisition of Globalstar

A US agency approved Amazon Leo's $11.5B purchase of Globalstar, announced in April to expand Amazon's Leo satellite network. The approval is a step toward closing the deal.

There isn't an easy exploit for this PHP vulnerability

Two critical PHP bugs (CVE-2026-109618 and CVE-2026-109619), in a language behind roughly 70% of websites, sent organizations scrambling to patch. The author argues that the many GitHub "PoC" exploits don't work against a vanilla PHP install. Several rely on a separate local-file-inclusion flaw. The advice is still to patch.

Today, we hacked what we'd set out to hack: the iPhone

Security firm Calif says it achieved what it set out to do: hack the iPhone. The write-up has the details.

333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

For three days this month, 333 Tor exit nodes were hijacked in an attempt to steal sensitive data, including SSH traffic and plaintext email.

Quad9 to exit France

Quad9 will stop serving users in France on Nov 24 after a court ordered it to block DNS resolution for domains beIN says infringe its sports broadcast rights. The fine was cut from €580,000 to €1,000 per day, but Quad9 says compliance is technically unfeasible and conflicts with its mission.

Microsoft offers mass buyouts for roughly a quarter of its workforce

Microsoft is offering voluntary exits to about 60,000 eligible workers, roughly 27% of staff by Reuters and AP's count. How many accept is up to them.

Local Wikipedia: Wikipedia, but only for things a half hour walk from you

This unofficial site pulls geocoded Wikipedia pages near you, taking the 25 closest items (within about 6 miles if fewer are nearby) and capping at 500. Your location stays in the browser, and shared links don't include it.

Forecast Your Real Launch Date With a Monte Carlo Simulation

List each task in a sheet with best-case, most-likely and worst-case working days and what it depends on, then upload it to ChatGPT's data analysis tool and ask for a 10,000-run simulation of your finish date. It helps most when a plan's single date feels too optimistic, since you get odds for each date and a ranking of which tasks move it most.

Deep Dive into LLMs like ChatGPT

A general-audience walk through how ChatGPT-style models are built, covering the full training process and mental models for what these systems are and aren't. It's a long watch, but it explains the whole pipeline in one sitting.

Machines of Loving Grace

Anthropic's CEO lays out an optimistic case for AI across health, mental health, poverty, democracy, and work and meaning. His central claim is that AI could compress 50–100 years of progress in biology and medicine into 5–10 years.

Here's how I use LLMs to help me write code

A veteran developer treats AI as "an over-confident pair programming assistant": give it context, say exactly what you want, test everything it writes, and be ready to take over. It's practical even if you only dabble in code.