0911 | Proofs, Shards, and a Box of Cables

Mia: Welcome back to the show, everybody. I'm Mia.

Milo: And I'm Milo. Good to be here.

Mia: It's been a busy stretch in tech news, and honestly, one thread runs through almost everything we're going to talk about today: trust. Trust in claims, trust in models, trust in what you actually own when you click "buy."

Milo: Yeah, and we've got a lot to get through. Let's start with the biggest story — OpenAI had a big week.

Mia: Right, so OpenAI launched an Agents API. The pitch is durable cloud agents — agents that live in OpenAI's cloud, with a managed Codex harness, so you don't have to run your own infrastructure.

Milo: And Hacker News was on it immediately. The debates broke down into roughly three camps. The first is API versus SDK — some people love the API model because it's simple, you don't manage servers, OpenAI handles the plumbing. Others push back hard and say an SDK gives you more control, more portability, and an API ties you to one vendor's roadmap.

Mia: And that vendor lock-in concern bleeds into the second big topic, which is sandboxing. If OpenAI is running your agent for you, what's the sandbox story? How do you verify that the code your agent runs is isolated, that your data stays where you think it is?

Milo: Right. Some commenters said the managed approach is the only way agents get mass adoption — most teams don't want to build harness infrastructure themselves. Others said the managed approach is exactly how you end up building on land you don't own.

Mia: And that's the unresolved question, honestly. The launch is new, so nobody's seen how durable these agents actually are in production yet.

Milo: Okay, so that's the product side. The second OpenAI story is where it gets spicy.

Mia: Yeah. So OpenAI claimed a result on the Navier-Stokes problem, and part of that claim included a formal proof in Lean 4 — a proof assistant, so it's machine-checked. Verified in 17 hours, versus an estimated 133,000 person-hours if done by hand. That's a claimed four orders of magnitude drop in cost.

Milo: Which, if true, is a monumental number. Four orders of magnitude means something that would have taken a team of mathematicians years now happens overnight.

Mia: And some commenters took it at face value and were amazed. Lean proofs are normally the slow, tedious part of formal mathematics. If you can compress that from years to hours, that changes what's worth even attempting.

Milo: But others immediately went to the fine print. One of the questions was — what does "verified" mean here? Was the Lean proof checked against the full problem, or a formalization that might be narrower than the headline suggests? And where did that 133,000 person-hour estimate come from? Was it a real analysis or a rough back-of-envelope?

Mia: And then there's the trust problem, which is where this story really takes off.

Milo: Right. Andreas Thom, a researcher, says OpenAI claimed these breakthroughs after researchers had discussed the math with ChatGPT.

Mia: Which raises an uncomfortable question — did the model get those ideas from private conversations it shouldn't have had access to?

Milo: OpenAI's Sellke responded with "that did not happen," and the reaction in the comments was mostly that it felt evasive. It's a blanket denial, but it doesn't really address what people are worried about.

Mia: And then a second researcher came forward with an even stronger accusation — that OpenAI trained on private ChatGPT conversations.

Milo: Yeah, and the demand from the community was for decontamination canaries and disclosure. Basically: prove it. Put known markers in the data and show they don't appear in outputs, or show exactly what was and wasn't in the training set.

Mia: Which brings us to a related but separate thread — users reported that the "allow training" setting was getting re-enabled after they'd turned it off.

Milo: Right. Some people confirmed seeing it, others said it was probably a UI bug — maybe the toggle was displaying wrong but the underlying setting was fine.

Mia: But even the people who suspected a bug were skeptical of the checkbox itself. The argument was basically: does clicking this box actually do anything? Can you verify it? And if you can't, what's the point?

Milo: And I think that's the thing worth sitting with. It's not one allegation. It's the pattern — a breakthrough claim, a denial that doesn't feel complete, a second accusation, and then a setting that may or may not be doing what it says.

Mia: And to be fair, none of this is settled. It's allegations and denials. What would resolve it is third-party verification of the proof, or actual data disclosure about what went into training. That hasn't happened yet.

Milo: Okay. Let's pivot away from OpenAI, because other labs shipped things this week too.

Mia: Yeah, Cognition announced SWE-2. It scored 50% on FrontierCode 1.1 Main, which puts it close to Fable 5.1, and they're claiming it's 64% cheaper.

Milo: And it's post-trained from Kimi K3, which is a 2.8 trillion parameter base model.

Mia: Right. But the benchmark claims got pushback. Some people disputed the numbers, and others pointed out that access is limited to Devin, which is Cognition's own product — so you can't independently verify the results outside their ecosystem.

Milo: Which is a familiar complaint, right? You see it a lot with agent benchmarks. If the company running the benchmark is also the company selling the product, and the only way to test is through their own tool, that's a circular situation.

Mia: Exactly. And meanwhile, DeepSeek released V4.1-Flash. It's a 552 billion parameter mixture-of-experts model, but only 8 to 16 billion parameters are active per token.

Milo: That's the efficiency story right there — you get the capacity of a huge model with the compute cost of a much smaller one.

Mia: And there's more. It has a 196 billion parameter Engram component that can be offloaded to SSD, and they've cut the KV cache to a quarter.

Milo: So cheaper to run, and open weights too. Which is the opposite approach from Cognition's locked-down release.

Mia: Yeah, and then there's a really interesting downstream effect of all this — Shopify announced they're moving from React Native back to native Swift and Kotlin.

Milo: Which is a complete reversal of the trend, right? For years, the argument for React Native was "we don't want to maintain two codebases."

Mia: And that argument was based on a cost assumption — that maintaining two native codebases is expensive. But LLM coding agents changed that assumption. If an agent can handle a lot of the maintenance work, the cost of having two codebases drops dramatically.

Milo: And that's a big deal because it means AI isn't just making development faster — it's changing which architectures make economic sense in the first place.

Mia: Exactly. And the open question is whether other companies follow. If agents really do reduce the cost of maintaining multiple native codebases, you could see a broader shift away from cross-platform frameworks. But that's still speculative.

Milo: Okay, let's shift gears a bit — infrastructure and tooling.

Mia: Yeah. So Microsoft made a significant announcement: Rust is now tier-1, alongside C++, C#, and TypeScript.

Milo: That's a big deal, because tier-1 status means Rust is now a first-class supported language at Microsoft, not an experiment.

Mia: And there's a new rustc codegen backend targeting MSVC, which is the practical foundation for that. The reasoning they gave is tooling, security, and Rust/C++ interop.

Milo: And that last one is the interesting part. Rust/C++ interop is historically where these migrations get stuck. If Microsoft is investing in that specifically, it suggests they're thinking about incremental adoption in large existing codebases, not greenfield projects.

Mia: Exactly. And it's a signal about where the industry is heading — Rust isn't a niche anymore. When one of the biggest software companies in the world puts it on the same tier as C++, that's a meaningful shift.

Milo: Okay, and on the security side of things — Forgejo had a critical RCE.

Mia: Right. Versions up to 16.0.3 were affected. The bug was in template expansion — it could create a .git folder, and from there you could get arbitrary read and execution via malicious template repos.

Milo: Which is a nasty attack vector, because a template repo is something people share and use routinely. You don't expect that to be the thing that compromises your server.

Mia: No. And the fix is in 16.0.4. But the broader point worth sitting with is that this is self-hosted software. A lot of people running Forgejo instances are small teams or individuals, not dedicated security operations.

Milo: Yeah, so the question is always: how fast does the self-hosted community actually patch? That's the thing to watch. Anyway, let's talk databases.

Mia: PlanetScale launched something called Neki. It's sharded Postgres.

Milo: Okay, and the headline numbers are big — 100 million plus queries per second, petabyte scale, zero-downtime resharding.

Mia: And the interesting part is it's real Postgres. The launch blog post got criticized for burying what Neki actually is, but the landing page is clearer. There's a router speaking the Postgres wire protocol, and each shard is a real Postgres instance with replicas.

Milo: So you get horizontal scale without giving up Postgres semantics. That's the pitch.

Mia: Right. And zero-downtime resharding is the hard part — most sharded systems that claim it make compromises somewhere. What's still coming soon is cross-shard transactions.

Milo: Which is a big deal, because without cross-shard transactions, you're limited in what kinds of applications you can build on top of it.

Mia: Exactly. So it's impressive, but there's a real gap before it's a general-purpose replacement for a monolithic Postgres setup. The question people were asking is: how much of the performance claim holds up in real workloads, and how painful is migration?

Milo: Okay, let's do something different now. Let's talk about the human side of building software.

Mia: So there's a graybeard essay making the rounds, and the thesis is basically that software drives people insane.

Milo: And the reasoning is — changes always seem cheap. "Just tweak this one thing." But there's no natural "done" state in software. Every change opens up new levers, and you can pull them forever.

Mia: Yeah, and the comment section really resonated with that. A lot of people shared the experience of endless iteration — you ship something, and immediately there's another thing to change.

Milo: But the counterpoint that kept coming up was customer contact. The argument was that developers who talk to actual users stay grounded, because real feedback creates a natural stopping point.

Mia: That's a really good frame, actually. Without a human on the other end, every change is just a lever with no clear "good enough." With a human, you can tell when something actually works.

Milo: Okay, and there's another essay in a similar spirit — "creativity is the new moat."

Mia: Right. The argument is that AI makes copying easy, so ideas are the edge. If anyone can replicate your implementation in an afternoon, what matters is the idea behind it.

Milo: And they used an analogy from the Flash era — when new tools show up, you get creative explosions, because people are suddenly able to do things that were impossible before.

Mia: That's a nice frame, and it's optimistic in a way — it says human taste and creativity still matter, maybe more than ever.

Milo: Okay, and then there's this charming little one. Jim Nielsen wrote about keeping your big box of cables.

Mia: Citing a post by Tyler Gaw, who found a cable he needed after more than ten years of keeping it.

Milo: And Jim was so struck by it that he taped the quote onto what he calls his "Family Techno Box."

Mia: Which I love. It's a small thing, but it's a real argument against the decluttering instinct — some of the things you keep are exactly what you'll need years from now, and you can't always predict which ones.

Milo: Okay, let's shift gears and talk about money and rights.

Mia: So there's a story tracking a basket of nine streaming services. Since March 2021, the monthly cost went from $95.91 to $154.41.

Milo: That's a 61% increase. And $702 more per year.

Mia: And what made the post useful was that each price change was individually sourced. It wasn't just vibes — it was documented.

Milo: Okay, and that pairs really naturally with a lawsuit against Sony.

Mia: Right. Four Californians are suing Sony over the "Buy Now" button. Their argument is that when you click "Buy Now," you're not actually buying the game — you're getting a revocable license.

Milo: And Sony's response was striking. They argued that reasonable consumers don't expect ownership.

Mia: Which is a bold position, honestly. It's basically saying: nobody should expect that "buy" means "own."

Milo: The hearing is scheduled for October 1st, 2026, so this is going to play out over a long time. But the underlying question is real — what does "buy" mean in a digital context, and do consumers have a right to expect permanence?

Mia: And there's a bigger money story underneath all of this too. The Brown Costs of War report found Big Tech got around $28 billion in defense contracts between 2018 and 2022.

Milo: And VCs put roughly $100 billion into defense tech between 2021 and 2023 — 40% above the prior seven years.

Mia: That's a big number, and it's a sign of where capital is flowing. Okay, let's switch to something a little more unsettling.

Milo: Apple Watch has a feature called "Siri Recaps" that records ambient audio and transcribes notes.

Mia: And critics are warning about normalization — the idea that always-listening devices slowly become unremarkable, and then one day there's a backlash like what happened with Meta's smart glasses.

Milo: And the thing is, it connects back to the OpenAI story from earlier. Both are about consent and data capture. One is about private conversations being used for training, and the other is about ambient audio being recorded without everyone in the room necessarily knowing.

Mia: Yeah, and in both cases, the open question is: how are users actually notified, and what does meaningful consent look like?

Milo: Okay, let's end on something lighter.

Mia: So NASA's decorrelation stretch algorithm was built for satellite imagery. And it turns out it's really good at revealing faded ancient rock art.

Milo: There's a tool called DStretch by Jon Harman — an ImageJ plugin, also on iOS and Android — that archaeologists use for this.

Mia: It's a nice story about how tools built for one domain turn out to be useful in a completely different one.

Milo: And then there's a piece of pure trivia gold from Raymond Chen about Windows XP.

Mia: So the way Windows XP picked your initial user picture — the little avatar you got when you set up an account — was via RtlRandomEx, seeded by GetTickCount, using one-pass reservoir sampling capped at 100 pictures.

Milo: It's such a specific implementation detail, and it's the kind of thing only Raymond Chen would remember and write about.

Mia: And one last note — Terence Tao shared a Saint-Exupéry quote: "All grown-ups were once children... but only few of them remember it."

Milo: And he connected it to children's number games — how they teach infinity and proof in a way that's natural before formal training gets in the way.

Mia: That's a nice place to land. Thanks for listening, everybody.

Milo: Yeah, we'll catch you next time.