0908 | Trust Issues: TVs, Keys, and Lock-Ins

Mia: Welcome back to the show, I'm Mia.

Milo: And I'm Milo. Big stack of stories today, and honestly, a thread running through almost all of them: who's in control of the technology you use. Whether that's your TV quietly listening to you, a vendor yanking tools you depend on, or governments deciding they've had enough and moving to open source.

Mia: Yeah, and we'll get into all of that, plus old crypto keys that finally fell over, some really nice open source and open data wins, AI stuff, and a few slow-living stories to close. Let's just dive in, because the first one is a doozy.

Milo: So Gamers Nexus published an investigation into LG smart TVs, and the short version is unsettling. They found that these TVs record and transcribe conversations, and they do it even with the screen off. The audio gets sent to LG Ad Solutions, which is LG's advertising arm.

Mia: And the scale here is the part that got me. Something like 216 million TVs are being tracked. That's not a niche experiment, that's an enormous installed base of microphones in living rooms feeding an ad platform.

Milo: Right, and the TVs weren't just recording audio. They were also scanning the local network. So the device knows what other devices are on your home network, which tells it things about your household beyond just what you say out loud.

Mia: The transcription part is what elevates this from "annoying telemetry" to something else. If the TV is converting speech to text and shipping it off, that's structured, analyzable data about your private conversations. It's not just "the TV phoned home."

Milo: Gamers Nexus' advice was blunt: disconnect the TV from the internet. Don't give it network access at all. And that's a pretty telling recommendation, because it basically says there's no trustworthy configuration here — the only safe state is offline.

Mia: Which, realistically, is awkward. People buy smart TVs and use the built-in apps. Telling everyone to air-gap their television is admitting the product's default behavior is hostile.

Milo: And that's the lens I'd put on the whole story: ad tech has reached into the home hardware itself. The TV is no longer just a screen, it's a data collection endpoint. Once you frame it that way, other stories in the ad-tech space start looking like the same pattern.

Mia: Exactly, and here's the natural follow-on. TiVo announced that SkipMode — the feature that automatically skipped ads on recorded shows for free — is going away. November 2nd, 2026, it's gone. And they're testing a paid monthly add-on to replace it.

Milo: So the sequence is: you bought the hardware, you paid the subscription, and the ad-skipping feature that was part of the value proposition is now either removed or paywalled. Meanwhile, on the TV side, the manufacturer is harvesting your conversations to sell ads.

Mia: There's a real through-line there about who the customer is. In both cases, the viewer starts to look more like the inventory than the customer. If the money comes from advertisers, the product gets optimized for them, not you.

Milo: And before we leave the "your data leaks" theme, one more that's smaller but the same shape. CodePen 2.0 sends your editor input to their servers as you type — before you ever hit save.

Mia: Yeah, that one bit me conceptually, because the whole mental model of an editor is that unsaved work is yours, locally, until you commit it. But with CodePen 2.0, keystrokes are streaming up to the server, and unsaved secrets can leak through preview URLs. So if you paste an API key into a pen while you're fiddling with it, that could already be exposed before you ever decide to keep it.

Milo: The lesson people kept circling in the discussion was: treat anything you type into a browser-based tool as already transmitted. Whether it's a TV microphone, a keystroke stream, or a paywalled skip button, the pattern is the same — the default serves the platform, and you have to actively opt out or unplug.

Mia: Okay, shifting gears, but staying on the theme of accountability — this next one is grim. A Tesla Model 3 with FSD, that's Full Self-Driving, or Autopilot, was verified as engaged when it ran a stop sign in New Jersey and killed an 82-year-old driver.

Milo: "Verified engaged" is an important phrase there. This isn't a disputed case where the driver may or may not have had the system on. The record shows Autopilot was active, the car ran a stop sign, and someone died.

Mia: And then there's the disclosure part. Tesla redacted key fields in the NHTSA report. So the federal safety investigation record has gaps in it, and the gaps were put there by the company whose system was involved.

Milo: The discussion around this broke into a couple of camps. One view: driver-assist systems are named deceptively. "Full Self-Driving" isn't full self-driving, and marketing language creates risk because drivers over-trust the system and stop monitoring it. The verification that it was engaged matters precisely because the company has long maintained the human is responsible.

Mia: The other camp pushes back and says the driver still bears responsibility — these systems require supervision, and a stop sign is exactly the kind of thing these systems are known to miss. If you're supervising, you're supposed to catch it.

Milo: But then the counter to that is: if the system's known failure mode is missing stop signs, and the company knows that, and it's marketing the thing as Full Self-Driving while letting it operate on public roads, then "supervise it constantly" is not a real safety case. It's a liability shield.

Mia: And the redactions are where it gets genuinely murky, because they cut off the accountability conversation. We don't know why Tesla withheld those fields, and we don't know what NHTSA does next — whether there's a recall investigation, enforcement, nothing. Both of those are open questions, and until they're answered, the public record is incomplete in the direction that favors the company.

Milo: That tension — a company controlling the information about its own safety failure — is honestly a nice bridge to the next cluster of stories. Because the whole theme there is vendors controlling their customers.

Mia: So, Broadcom. They pulled public downloads of VDDK — the Virtual Disk Development Kit — without any explanation. This is a toolkit you need for VMware migrations, moving workloads off VMware or between environments. And when customers asked support, the answer was basically: it's unavailable.

Milo: The why here is the subject of speculation, because Broadcom gave no reason. But the effect is concrete: if you're a customer trying to execute a migration away from VMware — which a lot of organizations are attempting right now, post-acquisition, post-price-hikes — you just lost a tool you need to do it.

Mia: And the timing matters. Broadcom raised licensing costs dramatically after acquiring VMware, which triggered a wave of migration projects. Now, mid-wave, the migration tooling disappears from public access. Whether that's intentional lock-in or just licensing restructuring, the customer experience is identical: the exit door just got narrower.

Milo: And the counterexample to that is fantastic. Tottenham Hotspur, the football club, replaced VMware with HPE Morpheus VM Essentials, and they cut licensing fees by more than 85 percent.

Mia: Eighty-five percent! And a football club is not a company you'd expect to be a case study in infrastructure strategy. But it shows the migration path exists, that there are alternatives, and that the savings are real when you take them.

Milo: So you've got a vendor narrowing the exit and a customer demonstrating the exit works. Which brings us to the most structurally interesting version of this: Switzerland. The Swiss federal government is migrating 3,000 federal seats from Microsoft 365 to openDesk, which is an open-source office suite. It's a pilot, targeting 2027, and it's backed by a digital sovereignty law.

Mia: A law. That's the part that changes the game. When it's a cost decision, a vendor can win you back with discounts. When it's codified in law as a sovereignty requirement, the conversation is different — the state has decided that dependence on a single foreign vendor is itself a risk.

Milo: And 3,000 seats as a pilot is serious. Pilots like this either stall out or become the template for a much larger migration. If openDesk works for the Swiss federal workforce, other European governments are watching.

Mia: One more data point on the theme of "companies say one thing, do another": right-to-repair in Europe. A year into the EU repairability rules, only about 18 percent of 2,334 new smartphones actually list the required repair info links.

Milo: Eighteen percent, a year in. The rules exist, the obligation exists, and compliance is a rounding error. Which is honestly the same story as the VDDK pull and the Tesla redactions — regulation and disclosure requirements only matter as much as they're enforced, and vendors will quietly under-comply until someone makes them.

Mia: Alright, from vendors and lock-in, let's go way back in time — because old systems never really die, and two stories prove it this week.

Milo: First one: a researcher factored the E-Certify 512-bit RSA certificate authority roots. These were shipped in Netscape 4.51 — in 1999. And they factored them in about 30 hours on a desktop Ryzen CPU.

Mia: Thirty hours. On a consumer desktop processor. A key that was a certificate authority root — meaning, back in the day, it could have signed other certificates that browsers would trust. And a modern machine just steamrolls it in a weekend.

Milo: The scary part isn't that Netscape 4.51 is in use — it isn't. It's the general lesson: cryptographic strength has a shelf life, and anything 512-bit RSA is decades past it. The worry is always the long tail — embedded devices, archived documents, signed artifacts from that era that might still be verified somewhere by something.

Mia: And the flip side story: someone published a GitHub repository with a reconstructed Stuxnet source code — about 15,000 lines, reconstructed from decompiled binaries. Explicitly framed for research and education only.

Milo: Stuxnet, for anyone who needs the refresher, was the infamous worm that targeted industrial control systems — centrifuges, reportedly. It's one of the most analyzed pieces of malware ever, but the actual source was never public. Now a decompiled reconstruction is sitting on GitHub.

Mia: The discussion there split pretty predictably. One side: this is genuinely valuable for security education — this is historically significant code, and studying it is how defenders learn. The other side: publishing 15,000 lines of functional nation-state malware, even decompiled, hands a working reference to anyone who wants to study offensive techniques against industrial systems.

Milo: And the honest answer is probably both are true. The reconstruction doesn't create new capability — the binaries have been circulating and analyzed for years — but it lowers the effort bar. The repository exists, it's labeled research and education, and the question of whether that framing means much is unresolved.

Mia: The connecting thread with the RSA story, though, is real: old code and old keys don't expire just because we move on. They sit there, get cheaper to attack, get easier to reconstruct, and resurface.

Milo: Okay, palate cleanse. Let's talk about open source and open data actually delivering, because there were a bunch of wins this week.

Mia: Jellyfin 12.0 shipped, and it's a milestone for a funny reason: they dropped the "10." version prefix. So the project has been on 10.x forever — 10.8, 10.9, 10.10 — and now it's just 12.0. A statement that they're done with that numbering era.

Milo: Two practical things to know if you run it: the database migration requires a backup — so back up before you upgrade, that's not optional — and usernames are now case-insensitive, which fixes a long-standing annoyance.

Mia: Then Terrastruct open-sourced TALA, which is their architecture-diagram layout engine. MPL-2.0 license, and it's bundled in D2 version 0.9.0. This matters because diagram layout is genuinely hard — automatically arranging boxes and arrows so they're readable is one of those problems that seems easy and is brutally difficult. TALA was a paid, closed product, and now the engine is open.

Milo: Now the data side, and these two are delightful. Someone mapped all 1.1 million buildings in the City of Los Angeles in 3D, colored by year built, from 1880 to 2026. They used lidar data plus county assessor records, rendered in MapLibre.

Mia: You can literally fly over LA and watch the city's age appear — the older cores versus the postwar sprawl. And it was built entirely from public data: government lidar and assessor records. No proprietary anything.

Milo: And in the same spirit, ovlive.be — a live map of every bus, tram, metro, and train in Belgium, in real time, built on the operators' open data feeds.

Mia: Both of these are the same argument: when governments publish open data, individuals build things no committee would have approved. Nobody assigned someone to make a 3D age-map of LA or a real-time Belgian transit view. Open data plus one motivated person did it.

Milo: And to keep it honest, one counterpoint on the open source performance front: bzip3 benchmarks show it beating zstd on compression ratio for some data — a Perl tarball was the example — but performance is highly data-dependent. There's no universal winner; you have to benchmark for your actual workload.

Mia: Alright, let's do the AI block. Three angles: making inference faster, pointing AI at hard math, and one skeptic who wants none of it.

Milo: So vLLM published benchmarks of speculative decoding on AMD GPUs — the MI300X and the newer MI355X, using ROCm, which is AMD's compute stack. They tested several methods: MTP, EAGLE-3, DFlash, and DSpark.

Mia: For folks who don't live in this world: speculative decoding is a trick where a small fast model drafts tokens and the big model verifies them in parallel, so you generate text faster without changing the output. And the significance of this post is partly the technique and partly the platform — serious inference benchmarks on AMD hardware with ROCm, not just the usual NVIDIA-and-CUDA story.

Milo: It matters because the inference stack has been effectively single-vendor for years, and every credible benchmark on AMD silicon is another brick in building a real alternative. Whether the speedups hold across workloads is the open question — like the bzip3 point, benchmarks are workload-dependent.

Mia: Then there's Caltech's Mathathon. A 40-hour hackathon, 100 teams, using frontier AI models to attack open math conjectures. October 30th, 2026.

Milo: This is an interesting test case, because math is where AI claims get sharp. A conjecture is either proven or it isn't — there's no vibe. Pointing a hundred teams with frontier models at open problems for forty hours is basically a public experiment in what these models can actually contribute to serious research.

Mia: Unresolved, obviously, until it runs: do the models produce useful partial results, verifiable steps, anything? Or do they mostly generate plausible-looking nonsense that humans have to filter? Either outcome is informative.

Milo: And then the counterpoint essay. The argument: true programmers write code as art, and they won't hand it to AI. And the author's own admission: they code only for money.

Mia: Which is a wonderfully contradictory essay, right? The author sets up this romantic standard — the programmer-artisan who would never delegate craft to a machine — and then immediately disqualifies themselves from it, since they're in it for the paycheck.

Milo: The serious point underneath, though, is about identity and motivation. If writing code is your craft — something you do for the satisfaction of doing it well — then outsourcing it defeats the purpose. If it's a means to a paycheck, then of course you'll use whatever tool makes you faster. The AI debate often isn't really about the tools; it's about which kind of programmer you are.

Mia: And the discussion never resolves it, because it can't — both stances are self-consistent. The artisan loses nothing by refusing AI; the pragmatist gains speed by using it. They're just playing different games.

Milo: Okay, let's wind down with the slow-tech block, and honestly it flows from that last point — a lot of it is about stepping away from the machine.

Mia: The Atlantic has a piece praising the Xteink X3 — a $70, credit-card-sized e-reader. The claim is that it genuinely boosted the author's reading.

Milo: And note what it doesn't have: no touch screen, no backlight. It's deliberately minimal. A tiny E Ink device that does one thing — show you a page — so there's nothing to do on it but read.

Mia: There's also open-source Crosspoint firmware available for it, so the community can flash their own software. Which, given everything we talked about earlier — TVs that listen, editors that stream keystrokes — is a nice bookend: a device with no microphone, no network obligations, and open firmware you can replace.

Milo: And it pairs perfectly with the "de-brainrot vacation" essay. A developer wrote about taking a slow countryside break — reading, and doing math and physics as a hobby — specifically to reverse what they felt was mental decline from the usual internet diet.

Mia: The term is jokey but the underlying experience is widely shared: fragmented attention from feeds and scrolling, and the sense that long-form focus is a muscle that atrophies. The essay's prescription is basically analog — slow days, long reading, working through actual math problems for fun.

Milo: And notice it's the same prescription as the $70 e-reader: remove the infinite scroll machine, keep the pages. The X3 is the hardware version; the countryside break is the life version.

Mia: Two quick culture items. Nathan Fielder made a documentary about Elizabeth Holmes — "You Can See Everything," produced with A24, 174 minutes long, and it debuted at Telluride.

Milo: A 174-minute Fielder documentary on Theranos — that's a serious commitment for the audience and the filmmaker both, and the Telluride debut means it's positioned as a prestige piece, not a quick true-crime drop. Reactions beyond the debut aren't in yet, so what it ultimately says about Holmes is still an open question.

Mia: And then the award nobody saw coming but everybody needed: the 2026 Ig Nobel Physics Prize went to splash-free urinal research. The paper analyzed urinal designs for splash reduction, and the recommended design is called the "Nautilus."

Milo: The Ig Nobels honor research that first makes you laugh, then makes you think — and this one qualifies on both counts. It's genuinely rigorous fluid dynamics applied to a universal problem, and there's a concrete deliverable: a design you could actually build.

Mia: And in a weird way it's the perfect closing note for this episode: careful engineering applied honestly to a real problem, published openly, benefiting everyone who uses the result. No lock-in, no listening microphones, no redactions.

Milo: That's the episode. The through-line, one more time: your TV's microphone, Broadcom's vanished downloads, redacted crash reports, keys from 1999 falling to a desktop CPU — control and disclosure are the fights of the moment. And the wins — Jellyfin, open data maps, Swiss sovereignty pilots, a splash-free urinal — come from the opposite instinct: open things up.

Mia: Thanks for listening, we'll be back with more. Take care.

Milo: Bye everyone.