Calls, puts & mise en place

Appel & Mise

Vol. IWednesday, October 28, 2026 · 49° & clear on the UWSThe daily, for Jeremy Ettlinger

BTC$81,464+2.4%ETH$2,371+2.9%S&P 5007,722.60+0.6%

The lede

Tailscale SSH: investigation and remediation update

Tailscale

Tailscale has confirmed what it calls serious security issues in Tailscale SSH, most of them privilege escalation: a user or device already authorized to connect may be able to act beyond the permissions of the local user it was mapped to. The scope is still being verified — which versions, which configurations — and notably they are not telling anyone to turn Tailscale SSH off, which is the harder and more honest position. The thing to do today is the interim mitigation: set `TS_SSH_DISABLE_FORWARDING=1` in the `tailscaled` service environment and restart, which they say closes several of the more serious findings, then tighten the access policies you have probably not read since you wrote them. The advisory and a post-mortem on causes are both promised and neither has landed, so this is the rare security story where the mechanism is still owed.

AI & Agents

Simon Willison

webframe: evaluated as a scraper and a sandbox

Jeff Lindsay's webframe runs a web page the way you run a program: point it at a URL, the page executes in a hidden headless web view, `console.log()` goes to stdout and exceptions go to stderr. It is Go on top of the system's own browser engine — WKWebView, WebKitGTK, WebView2 — so there is no Playwright in the dependency tree, and Willison had Opus 5.5 write a research report on it as both a scraper and a sandbox: roughly shot-scraper's performance in a much smaller package, with real rough edges around CSP, a 0×0 viewport and missing HTTP metadata. The interesting part for anyone handing a browser to an agent is that the sandbox question and the scraper question turn out to have the same answer.

Google DeepMind

Genie 4

DeepMind's world model now generates visuals, ambient sound, music and spoken dialogue together in real time, with a Gemini model sitting above the simulation breaking goals into steps and checking that the scene still makes sense — a hybrid where the language model does the reasoning and the pixel engine does the world. The admitted failure mode is the one that matters: object permanence drifts over longer sessions and after repeated prompt edits, so coherence is a short-session property. Research preview for trusted testers, with Google AI Ultra and API early access promised, and everything SynthID-watermarked.

Engineering & Leadership

Michael Hill, LeadDev

AI's time savings are disappearing into code review

Atlassian surveyed 1,155 developers and 405 engineering leaders and found the gap that every engineering leader is currently arguing about in the dark: 87% say AI helps them write and ship code faster, while 72% report the same or more friction across the lifecycle than before. The number to carry into your next planning meeting is the collapse — developers saving at least ten hours a week fell from 68% in 2025 to 25% in 2026 — alongside 65% who regularly spend their week reviewing, debugging and correcting generated code. The one lever the data actually supports is unglamorous: teams with a clearly communicated AI strategy are twice as likely to report less friction, and only 17% of developers say they have one.

Gergely Orosz and Jessica Salmon, The Pragmatic Engineer

AI SRE: what is it, how could it change on-call – and does it work?

A survey of what Rootly, incident.io and ResolveAI are selling and what Monzo, OpenAI, Stripe and Google built themselves, and the honest finding is that nobody is letting an agent ship an unattended fix — OpenAI's Sevbot proposes mitigations without executing them, Google's ProdAgent does not generate code at all. The design details are the value: ResolveAI has rebuilt three times and now keeps the verifier agent independent of the investigator specifically so it cannot confirm its own conclusions, and Rootly's agent stays silent unless something specific triggers it, like a 'mitigated' claim with no evidence attached. Stripe's numbers give you the shape of the actual win — about three minutes for a simple investigation, fourteen for a deep one — against Rootly's report that out-of-hours pages have nearly doubled year over year.

Web & Product Craft

Ghostty

Ghostty 1.4.0

Seven months, 2,889 commits and 172 contributors, and the headline is a memory trick: idle scrollback is now compressed, cutting resident memory 70–90% for text-heavy history, which let them raise the default scrollback limit from 10MB to 50MB. For anyone running agents in a terminal all day the quieter entries matter more — mode 2033 visibility reports so a program can stop rendering when hidden, a new OSC 7501 status protocol that reports idle/working/done/blocked/failed, hidden tabs releasing GPU resources (20 background tabs went from 385MiB to 18MiB on macOS), and `ghostty +ssh` to stop fighting terminfo on remote hosts. Note the breaking change before you upgrade: `copy-on-select` now defaults to `none` on macOS.

Cloudflare

What took the Internet offline in Q3 2026

Forty-nine disruptions, and the taxonomy is the story: 19 government-directed shutdowns (18 of them Iraqi exam shutdowns, running 03:30–04:00 UTC in 15-to-90-minute windows) against 14 power outages across ten countries. Two entries belong in any resilience review — a September 10 failure at a single Honduran interconnection facility that took at least eleven providers down for three hours and dropped national HTTP traffic 63%, while two networks whose connectivity leans on infrastructure outside the country shrugged it off; and a cooling system failure in a Phoenix data center on August 13 that took Namecheap's traffic to nearly zero. Cloudflare's own read is that cooling is now a first-class risk, which is a sentence worth rereading if your disaster plan still says 'power'.

New York & the Table

Yana Krasnitskaya, West Side Rag

Here's the UWS Dish: Croissant et Café's plain croissant

A seven-dollar plain croissant from a ground-floor shop at 154 West 70th, and the review earns its superlative by explaining why most American croissants fail: butter with less fat than the European stuff, flour milled from harder wheat, and lamination done badly enough that the butter leaks out instead of steaming the layers apart. Krasnitskaya's test is the interior — moist and chewy under the flake, and not sweet, so the butter reads slightly savory. Open 7 to 4 on weekdays, which rules out the lazy-Sunday version of this errand.

The Back Page

We Ain't Got No History

Liverpool vs. Chelsea, League Cup: preview, team news, how to watch

Fourth round at Anfield tonight, 4pm EDT on Paramount+, and Chelsea arrive from Saturday's 0-2 home defeat to Spurs missing João Pedro for weeks, Cole Palmer to suspension, Reece James, Chavarría and Gittens to injury, and Emiliano Martínez to jaw surgery — which means Estêvão finally has to start and Mike Penders gets a second look after a rough debut. Xabi Alonso goes back to the ground where he played and where he was expected to be managing this season, and has already lost there 4-0 with Leverkusen and 1-0 with Madrid; Chelsea have not won at Anfield since Tuchel in 2021. The one bright line is Emmanuel Emegha, available at last since arriving from Strasbourg in the summer.

Posting and Toasting

Knicks 111, Pistons 97: scenes from win number one

The first champions to start 0-3 since the 2011 Mavericks finally got one, and they got it on defense: after conceding 38 in the first quarter they held Detroit to 25 over the next two, including a 3-of-21 second quarter. Karl-Anthony Towns went 27 and 20, Jalen Brunson scored 13 points entirely from the free-throw line after missing nine of his first ten shots, and Josh Hart took two shots all night and made both from three — the second one turning a shrinking twenty-seven-point lead back into a finished game. Chicago tonight, on the second night of a back-to-back.

Loose Change

Stephanie Howard-Smith, Literary Hub

Tiny, furry friends: a short history of small dogs in European art

Lapdogs enter European painting as symbols — fidelity in the Arnolfini portrait, wealth under the table at Veronese's Wedding at Cana — and then slowly become individuals with names, until Landseer's spaniel portraits are reproduced as prints cheap enough to hang in a middle-class parlour and one of them ends up on the wall in the photograph of Bismarck's deathbed. The details are better than the thesis: Isabella d'Este buried her dog Aura in a lead casket with an astrologically timed tomb and commissioned epitaphs from scholars including the keeper of the Vatican library, and a 1989 UV examination of Bachelier's lapdog portrait revealed that someone had later painted a ribbon over the dog's genitals. From Howard-Smith's Yap!, by a historian whose doctorate was on eighteenth-century lapdogs.

James Payne and Laura Beardsell-Moore, Aeon

Great art explained: Tamara in the green Bugatti

Sixteen minutes on Tamara de Lempicka's 1929 Autoportrait, the Art Deco self-portrait of the painter at the wheel in a leather helmet and grey gloves, looking out at you with no interest whatsoever in being looked at. Payne and Beardsell-Moore run the painting against the life — the affluent Polish childhood, the flight from the Russian Revolution, the Paris years — and make the case that the picture is less a portrait than a proposition about what a modern woman was allowed to want.

Around town

Wed Oct 28 · 6:00pm–8:00pm

AI Engineer Tech Talk (October edition)

Fonzi HQ, 25 Kent Ave, Williamsburg

Three ten-minute talks, each on something the speaker actually built and the part of it that went wrong, with fifteen minutes of Q&A folded in and pizza on either side. All four presenters are still listed as TBA, which is the usual trade for a free Wednesday — the format is the draw, since ten minutes is too short to get through a pitch deck.

professional

Tue Nov 3 · 9:00am

ETF Investor Forum

Mallory at Terminal Warehouse, 261 11th Ave, Chelsea

A full day on ETFs with BlackRock's head of digital assets, Robert Mitchnick, and Bloomberg Intelligence's Eric Balchunas on the bill alongside Anthony Pompliano — the rare room where the crypto-wrapper question gets argued in front of the advisors who actually allocate. Ninety-nine dollars and an expected 700 attendees, most of them RIAs rather than builders, which is the point.

professional

Fri Oct 30 · 6:30pm · also Sun Nov 1 · 1:45pm

Sans Soleil (Trains: Local Routes)

Metrograph, 7 Ludlow St, Lower East Side

Chris Marker's 1983 essay film, 103 minutes of letters from a cameraman moving between Tokyo and Guinea-Bissau, narrated by a woman reading them aloud — a film about memory that is also the best argument ever made for keeping a notebook. Programmed into a series about rail, which is its own kind of joke about where thinking happens.

casual

Sun Nov 1 · 12:30pm (Chapters 1–3)

My Undesirable Friends: Part II — Exile, introduced by Meryl Streep

Film Forum, 209 W Houston St, West Village

Julia Loktev's documentary on Russian independent journalists after the invasion, screening in chapters across five days; Streep, who executive produced, introduces the Sunday matinee, and Loktev stays for a Q&A with subjects Ksenia Mironova and Elena Kostyuchenko at the 4:20pm block. Eighteen dollars, twelve for members, and worth planning the day around rather than dropping into.

casual

Quote of the day

“One of the best I've had anywhere, France included.”

— Yana Krasnitskaya, West Side Rag, on a croissant from West 70th Street

On this day

October 28, 1886 — The Statue of Liberty is dedicated in New York Harbor, in fog and rain, on a pedestal paid for by Joseph Pulitzer's newspaper fundraising drive after Congress declined. The copper skin is about three thirty-seconds of an inch thick and hangs on an iron armature Gustave Eiffel designed to let it move in the wind; the whole structural trick is that it is not rigid. Suffragists, barred from the ceremony, chartered a boat and heckled from the water.

The puzzle corner

The Mini · Wordle · Connections

Two data sets today agree that the bottleneck moved and nobody moved with it: Atlassian finds the hours AI gives back are being eaten by review, and Cloudflare finds that what takes a country offline is usually the power and now, increasingly, the cooling. The fix in both cases is further upstream and less fun than the thing that broke.