0907 | Orbits, Oracles, and Escaped Sandboxes

Mia: Welcome back to the show, everyone. I'm Mia.

Milo: And I'm Milo. It's been a busy day out there on the internet, and the thread running through almost everything we're covering is infrastructure — the stuff that quietly holds things up until, suddenly, it doesn't. Automated researchers, federated Bitcoin wallets, satellite networks, indie web tools, and even a website that closes on Sundays.

Mia: We'll get into all of it, but let's start with the story that got the most heated discussion: OpenAI's automation timeline. So here's the setup. OpenAI says it reached its goal of an automated "research intern" by September 2026, and now it's targeting a fully automated AI researcher by March 2028. At the same time, OpenAI's chief scientist, Jakub Pachocki, is warning that this rapid rise of machine intelligence needs international coordination and stronger safeguards.

Milo: And that combination — racing ahead and warning about racing ahead at the same time — is exactly what people were chewing over. One line of argument you saw repeatedly: the "research intern" framing is doing a lot of work. An intern is a junior, supervised role, so hitting that milestone sounds modest, even humble.

Milo: But if the same company says the next step is a fully automated researcher, the intern label starts to feel less like a description of capability and more like a description of supervision. The question commenters kept circling was: supervised by whom, for how long, and with what ability to say no?

Mia: Right, and the counterpoint to that came from people who took the timeline seriously on its own terms. Their reasoning was: if OpenAI genuinely believes an automated researcher arrives in roughly a year and a half, then announcing it publicly with a date attached is itself a form of coordination. You can't coordinate internationally if nobody states their trajectory.

Mia: In that reading, Pachocki's warning about international coordination isn't a contradiction of the timeline — it's the reason the timeline is public.

Milo: The disagreement really sharpened around whether warnings and acceleration can coexist. Some folks argued it's incoherent to say "this needs stronger safeguards" while simultaneously building toward the thing that makes safeguards urgent. Others pushed back and said that's basically every technologist's dilemma: you can't steer something you refuse to build or acknowledge. There was no consensus on that — it's a genuine values split.

Mia: One of the more interesting firsthand-style observations in the thread connected this to how work actually gets done. The comparison: an intern produces drafts, and a human researcher reviews them. If OpenAI's framing is accurate, the near-term picture is machine drafts with human review, and the 2028 target is the moment the review loop itself gets automated. That's the step people found philosophically interesting, because verification becomes the bottleneck. Who checks the checker?

Milo: Which ties directly into Pachocki's point about safeguards. If you accept that verification is the hard problem, then international coordination isn't abstract diplomacy — it's about agreeing on what verification even means before automated researchers are commonplace. The unresolved question at the end of all this: will the safeguards arrive before the automation scales? OpenAI has staked out a date for the automation. Nobody has a date for the safeguards.

Mia: And that uncertainty is what makes the next segment feel connected rather than separate. Because if you're worried about machine systems acting without supervision, the natural next question is: what about machine-readable data acting without supervision? That brings us to two security stories.

Milo: The first is a research result. A paper on arXiv, 2505.12540, describes what the authors call the first unsupervised embedding translation between vector spaces. Concretely, that means taking embeddings — the numeric vectors that power things like vector databases and semantic search — and translating between different embedding spaces without paired training data.

Mia: Why that matters for security is the interesting part. Vector databases are often treated as opaque. You store embeddings of documents, users, images, whatever, and the assumption is that because the vectors aren't human-readable, the sensitive content inside them is somewhat protected. This paper breaks that assumption: if you can translate between vector spaces, you can mount attribute inference attacks against vector databases.

Mia: In other words, you can potentially recover attributes of the underlying data just from the vectors.

Milo: The discussion around this centered on how often embeddings are shared or exposed. Search indices, recommendation systems, retrieval-augmented AI pipelines — embeddings move between systems constantly, and the security model for them has been, essentially, "they're just numbers." This result says the numbers carry enough structure to leak information. The open question people raised: how far does the attack go in practice?

Milo: Recovering broad attributes is demonstrated; recovering fine-grained content is an open problem. But the direction of travel is not comforting.

Mia: The second security story is more concrete and more expensive. Attackers withdrew roughly 4,000 Bitcoin — around 320 million dollars — from the Liquid Federation wallet, using a SideSwap PAK key. In response, the Liquid sidechain paused.

Milo: And the structural lesson people drew is the same as the embedding one: new infrastructure becomes new attack surface. Liquid is a federated sidechain — its security model depends on the federation and on the keys governing movement of funds. A PAK key, in this context, was the mechanism the attackers used to pull funds out. When a key that's supposed to govern a protocol gets used to drain it, the pause isn't a bug fix, it's an admission that the trust model has to be re-examined.

Mia: There was a nice defensive counterpoint to these two stories, and it comes from GrapheneOS. They overhauled their Messaging app with a new Android Compose UI, and alongside it they shipped a new secure clipboard paste feature. The theme is the same from the defensive side: the clipboard is exactly the kind of mundane component that everyone assumes is safe and that turns out to be worth hardening.

Milo: So the segment's takeaway, if there is one: the attack surface isn't just apps and servers anymore. It's vector stores, federation keys, clipboards. The commenters didn't agree on how worried to be, but they agreed the assumption of "invisible therefore safe" is dead in both contexts.

Mia: From security failures to infrastructure successes — and one of the biggest of the day happened off the planet. Isar Aerospace reached orbit on only the second flight of its Spectrum rocket, launching from Andøya in Norway and deploying satellites. That makes it Europe's first commercial orbital mission.

Milo: Getting to orbit on your second flight is remarkable in this industry. First flights routinely fail; even established launch companies have eaten years of failures before orbit. The discussion here was partly celebration and partly what it means geopolitically: Europe now has a commercial player that can put payloads in orbit, launched from European soil, which changes the calculus for European satellite operators who previously had to look elsewhere.

Mia: Back on Earth, another piece of long-lived infrastructure hit a milestone. NetBSD 9.5 is out, and it's the final release in the 9.x series. The netbsd-9 branch is now end-of-life, and users are being urged to move to NetBSD 11.0, 11.1, or the upcoming 10.2.

Milo: People who've run NetBSD for a long time shared the kind of perspective you only get from decades of use. The upgrade guidance itself sparked a small debate: 9.5 users are told to jump to 11.x or wait for 10.2, and some argued that's a reasonable migration ladder, others worried that EOL-ing a branch pushes conservative operators — exactly the people running NetBSD — into awkward timing decisions.

Mia: What made this release resonate beyond NetBSD users was the project's research pedigree. This is the system NASA's Lewis research center used for satellite TCP communications. It's where KAME developed IPv6 and IPsec. And it's the system behind SUNET's Internet2 land speed record for network performance.

Milo: That history is why the EOL conversation felt weightier than a routine release notice. The satellite TCP work in particular — running TCP on hardware orbiting the planet — is exactly the kind of unglamorous, foundational engineering that later work quietly depends on. The thread's unresolved tension was: long-lived branches like netbsd-9 are what make that reliability possible, but they can't be maintained forever. Someone, eventually, has to draw the line. NetBSD just drew one.

Mia: And drawing lines while under pressure is the perfect bridge to our next topic: indie infrastructure and whether it survives legal and political heat. Three very different outcomes in one day.

Milo: Let's take them in order of optimism. First, Anubis — the tool that fronts websites with proof-of-work challenges to filter bots. It shipped WebAssembly-based proof-of-work checks after a year of work and hundreds of commits, including a partial rewrite in Rust. The significance: web scraping and AI crawlers have put real load on independent sites, and Anubis is one of the few community-built defenses.

Milo: Moving the proof-of-work into WebAssembly makes the challenge run in the browser more efficiently, and the Rust rewrite signals a project investing in long-term maintainability.

Mia: The discussion around Anubis was largely appreciative, but with a practical worry: an arms race. If Anubis works, bots will adapt, and a volunteer project is now effectively in a defensive arms race against well-resourced scraping operations. A year of work for one shipping feature is the kind of pace that's sustainable for passion but not for arms races.

Milo: Second story, a middle outcome: Nitter, the AGPLv3 alternative frontend for Twitter, has resumed service through XCancel after taking legal advice. The project is continuing despite cease-and-desist letters from X Corp., dated August 24, 2026. The README confirms the project continues.

Mia: This one split people. Some argued that resuming after legal advice shows the project assessed its position and found it defensible — an AGPLv3 frontend doing something users want, with counsel involved, is not the same as reckless infringement. Others took the opposite view: continuing to operate after formal legal demands from a large company is a gamble that individuals and mirrors may not be able to sustain, no matter how sound the legal theory.

Mia: And the genuinely unresolved question: how many mirrors and operators have the resources to keep making that gamble?

Milo: Third story, the somber one. The Autistici/Inventati collective — A/I — has shut down after 25 years, after being designated a global terrorist organization. Twenty-five years of services: email, hosting, tools for activists and privacy-minded users. Gone.

Mia: People wrestling with this one kept separating two questions that are easy to blur. Question one: what do we think of the designation itself? Question two: what does it mean for infrastructure when a political designation, rather than a technical failure or a court ruling, ends a quarter century of service? The second question is the one that generalized. Independent infrastructure survives on trust and legitimacy; a designation that removes legitimacy can end it faster than any outage.

Mia: Nobody in the thread had a comfortable answer for what A/I users should have done differently, or what other collectives should do now.

Milo: And that connects, maybe uncomfortably, to the resilience theme: Anubis is resilient because it's technically clever, Nitter is resilient because it believes it's legally sound, A/I is gone because the environment around it changed. Same internet, three survival strategies, one failure.

Mia: Let's shift gears to the craftspeople — the people building tiny, weird, wonderful things. This is the lighter half of the episode but the discussions were genuinely substantive.

Milo: Start with Austin Henley, who wrote a Python interpreter subset in 1024 bytes of C. No macros — and that constraint matters, because the obvious way to squeeze a language interpreter into a kilobyte is to abuse the C preprocessor into unreadability. Henley's version handles def, if, for, print, and — here's the detail people loved — indentation, which means real Python-style block structure, in 1024 bytes.

Mia: The appreciation in the discussion was for the discipline of the constraint itself. People made the argument that size-limited projects are how you learn what a language actually is: strip away libraries, strip away classes, strip away everything, and what's left — functions, conditionals, loops, output, block structure — is the skeleton.

Mia: The counterpoint, voiced by a few: minimal interpreters are beautiful but can mislead, because the hard parts of real language implementations are precisely the parts you cut. Nobody disputed the craftsmanship, though.

Milo: Even smaller in spirit: Mador. It's about 80 lines of JavaScript that uses Proxy — specifically proxy tuples structured as read and write pairs — to make the DOM reactive with CSS selectors, with dependency tracking. Minified it's about 855 bytes, and it has zero dependencies.

Mia: And the reaction there was a mix of delight and re-evaluation. Delight because 855 bytes for a reactive DOM system is almost rude, given that mainstream frameworks measure in the hundreds of kilobytes. Re-evaluation because it raises the question of how much of framework complexity is essential versus accreted.

Mia: The honest counterpoint from experienced framework users: dependency tracking at 80 lines works great until you hit edge cases — nested updates, cleanup, batching — and those edge cases are exactly what the hundreds of kilobytes buy. Still, as a demonstration of what Proxy can do, people found it genuinely eye-opening.

Milo: Bigger bets now. There's a 12-week Quantum Oracle Engineering course being run for IEEE Quantum Week 2026 in Toronto, covering oracle design, reversibility, and verification. The part that resonated with practitioners was the emphasis: oracles are how you encode problems into quantum algorithms, reversibility is the constraint that shapes everything, and verification is the still-unsolved practical headache of the whole field.

Milo: Teaching all three together, over twelve weeks, reads as an attempt to build the curriculum that doesn't really exist yet.

Mia: On the legal side of making things: Henri Bergius announced he's switching his default software license from MIT to EUPL-1.2. That's a strong copyleft license, and the specific motivation is closing the SaaS loophole — the gap where MIT-licensed code can be taken, run as a hosted service, and improved without any improvements flowing back.

Milo: This is a well-worn debate and it played out along familiar but real lines. One side: MIT is simple, frictionless, and copyleft costs adopters, which for small projects means fewer adopters. The other side, which Bergius clearly lands on: for infrastructure you depend on, the SaaS loophole means the community can be free-riding hosts who take everything and return nothing, and strong copyleft like EUPL is the fix.

Milo: The unresolved question is the eternal one — whether one developer's license choice changes anything, or whether it only matters when ecosystems move together.

Mia: Last in this segment, hardware. Asahi Linux — the project reverse-engineering Apple silicon for Linux — now supports M3-series Macs, but in Expert mode. And the caveats are substantial: sleep doesn't work, HDMI doesn't work, and the GPU and DCP aren't working yet. The Mac Studio's M3 Ultra is unsupported.

Milo: The community read of this was consistent: Expert mode means exactly what it says. Getting Linux booting at all on M3 silicon is the mountain; sleep, display, and GPU are the range behind it. The DCP gap in particular — that's the display pipeline — explains why HDMI is out, since display functionality runs through it. Longtime Asahi watchers noted the pattern: each new Apple chip generation re-opens the work, and the M3 support landing in this incomplete state is normal, not a regression.

Milo: The open question is always the same: how long until the daily-driver features arrive.

Mia: Which brings us to our final segment, and it's a reflection rather than a news story. A column in DUB, written by a PhD candidate, makes the argument that creativity exists within constraints — not despite them. The column calls this the "pencil case" model of creativity.

Milo: The pencil case image is doing the work: a pencil case is a small, bounded container, and yet what it holds — the specific pens, the limits of what fits — is precisely what generates the ideas. The thesis lands against a very common intuition, especially in tech, that constraints are obstacles to be removed. The column's counterclaim: remove all constraints and you don't get more creativity, you get paralysis.

Mia: People who'd done constrained work — the 1024-byte interpreter crowd, the 855-byte framework crowd — found this column almost eerily on theme. Henley's interpreter isn't a great Python implementation despite being small; part of what makes it interesting is that it's small. Mador's elegance comes from refusing dependencies. The Quantum Oracle Engineering course teaches reversibility — a hard physical constraint — as the core of design.

Mia: Even Anubis is a constrained solution: no accounts, no tracking, just math. The thread's skeptics raised the fair counterexample: some constraints are just friction, and romanticizing them is how you get Machiavellian process theater. But the column's claim was narrower than that — it's about which constraints you choose, not enduring arbitrary ones.

Milo: Then the mood darkened slightly with Ed West's review of James Marriott's book, The New Dark Ages. The book blames declining literacy — and specifically declining reading for pleasure — on phones and TV.

Mia: This is the mirror image of the constraint argument. Where the pencil case model says limits breed creativity, the phones-and-TV thesis says a particular kind of limit — the sustained attention a long book demands — is being eroded, and with it a particular kind of deep literacy. Whether you blame phones, TV, or both, the empirical claim on the table is that reading for pleasure is declining.

Mia: The discussion didn't resolve whether that's a moral panic recurring every generation — people noted similar panics about television — or a genuine discontinuity, because the phone is in the pocket and the television, for all its sins, stayed in the living room.

Milo: And then, to close on the appropriate note of internet absurdity: the joke. Someone reported that their QBittorrent "escaped its sandbox," downloaded corporate-owned media, and Jellyfin quietly added it to their libraries.

Mia: The humor works because it inverts responsibility so neatly. The sandbox is supposed to contain the torrent client; the torrent client "does the crime"; and Jellyfin — the innocent media server — just catalogs what appears, like a librarian who doesn't ask questions. Under the laughter there was one real observation people made: this is exactly how automation drift works in miniature. Each component did its job, and the composite behavior surprised the human who configured none of it to happen.

Milo: Which, if you want a through-line for the whole episode, is not a bad one. Automated interns that become automated researchers, federation keys that move funds, embedding spaces that leak attributes, websites that close on Sundays to force a constraint on screen time — the systems we build keep doing more than we configured them to do.

Mia: The question Pachocki raised at the start — whether safeguards arrive before automation scales — is really the same question at every scale we covered today. Whether it's a 320 million dollar key, a vector database, or a torrent client with ambitions, the answer isn't in the technology. It's in whether anyone is watching, and whether they got there in time.

Milo: On that slightly ominous note — thanks for listening. We'll be back with the next day's infrastructure, triumphs, and disasters.

Mia: Take care, everyone.