1023 | Enclosures, Exploits, and Escape Hatches

Mia: Welcome back to the show, everyone. I'm Mia.

Milo: And I'm Milo. It's been a busy day on the threads, and honestly, there's a theme running through almost everything we're going to talk about today: resources. Who gets to use them, who pays for them, and what happens when someone decides the commons belongs to them now.

Mia: Right, because we've got a story about AI companies literally fencing off knowledge and clear-cutting actual forest for data centers, a string of security disclosures that went sideways, legal pressure that's pushing infrastructure companies out of entire countries, and then on the flip side, people building genuinely independent things — a jailbreak, a game engine, a payment system. It's a good day.

Milo: So let's start big. There's a paper making the rounds arguing that AI is doing to scientific knowledge what the enclosure movement did to English land. And if that sounds like an abstract academic comparison, there's a very concrete companion story sitting right next to it.

Mia: Yeah, the paper's core argument is that we're seeing an "enclosure" of the scientific information commons. For listeners who don't remember their history class: in England, starting several centuries ago, land that had been held in common — farmed collectively, used by everyone in a village — got fenced off, privatized, enclosed by large landholders. People lost access to resources they'd always relied on.

Milo: And the researchers' claim is that AI is doing the same thing to knowledge. Scientific information used to be something that was broadly shared — papers, data, the accumulated record of research — and now it's being absorbed as training material by a small number of companies, fenced off behind proprietary models, and the people who created that knowledge in the first place don't have access to what was built from it.

Mia: The historical parallel is doing real work there, because enclosure wasn't just "privatization happened." It was a whole legal and economic process where the people who lost access often couldn't even articulate what they'd lost until it was gone. The village didn't own the common, so it couldn't stop the fence.

Milo: Exactly, and that's the uncomfortable part of the analogy. If the scientific commons — the published record, the shared datasets, the code — wasn't "owned" by anyone, then legally, nobody could stop it being swept up into training corpora. The paper is essentially saying the fence is already built; the question is whether we recognize what happened.

Mia: And then, right alongside this abstract argument about knowledge, there's the land version. Literal land. Google cleared 300 hectares of Finnish forest for a 13 billion euro AI data center — and here's the part that got people upset — before the environmental assessment was finished.

Milo: Before it was finished. Not skipped, technically, but the clearing happened first, which means the assessment is, in a sense, evaluating a fait accompli. The forest is already gone.

Mia: The reaction in the discussion split pretty predictably, but with some interesting nuance. One camp said: look, Finland is a managed forest country. Finnish forestry clears and replants enormous areas as routine commercial practice. A 300-hectare clearing is, by Finnish standards, not extraordinary — this happens for pulp and timber all the time.

Milo: And the counter to that, which I found more persuasive, was that the routine-ness is exactly the point. Yes, clear-cutting is normal practice in Finnish forestry — but the fact that it's done constantly for timber doesn't make it fine when it's done for a data center, especially when the sequencing undermines the whole point of an environmental review.

Mia: There was also a strand of "this is what AI buildout actually costs" — people pointing out that when we talk about AI's environmental footprint, we usually talk about electricity and water, and land is the third leg that gets less attention. Thirteen billion euros buys you a lot of forest.

Milo: So connect those two stories and you get the paper's thesis demonstrated in one news cycle. AI appropriates the knowledge commons — published science turned into private model capability — and AI appropriates land — forest turned into compute before anyone finished checking whether that was wise. Two different kinds of commons, same pattern.

Mia: And the open question the discussion kept circling: can policy actually slow either of these down? Enclosure, historically, was eventually partially reversed and regulated, but only after centuries. With AI moving at this pace, does any regulatory mechanism even arrive in time?

Milo: There was also a third data point that's smaller but fits: Microsoft charging 24 to 40 cents per hour to stream Xbox games you already own via the cloud. Some commenters brought it up as the same logic at the consumer level — you bought the thing, and now there's a meter running on how you access it.

Mia: It's a good illustration of the gradient. At the scale of scientific knowledge it's a paper's worth of argument; at the scale of a Finnish forest it's a legal and environmental fight; at the scale of your Xbox library it's forty cents an hour. Same instinct at every level: put a toll on access to something people used to have.

Milo: Okay. So the same rush — the same "move first, assess later" energy — is showing up in security, and that's our next cluster. And this one is messy, because it's not one story, it's a chain of failures over just a few days.

Mia: Start with the biggest one. ZDI — that's the Zero Day Initiative, a major vulnerability brokerage — accidentally published several Linux kernel vulnerabilities to the public LKML, the Linux kernel mailing list. We're talking flaws rated as high as CVSS 9.0. On a public list. For the Linux kernel.

Milo: To translate for anyone who doesn't live in this world: CVSS 9.0 is about as bad as vulnerabilities get. And LKML is completely public — anyone on earth can subscribe. So an accidental disclosure there isn't a leak to a few journalists, it's a full public release of exploit-grade information with no patches ready.

Mia: And ZDI's whole business is coordinated disclosure — they buy vulnerabilities, work with vendors on fixes, and release on a schedule. So this isn't a fringe actor; it's one of the institutions that's supposed to be the adult in the room.

Milo: Which makes the next data point almost inevitable. AWS MadPot — that's Amazon's threat intelligence honeypot operation — observed exploit attempts for PHP2Shell starting on October 17th. Four days before the official disclosure date.

Mia: Four days. So the window between "information escapes" and "people are actively trying to exploit it in the wild" is now measured in days, not weeks. And MadPot catches that because it runs internet-wide sensors, so it sees scanning and exploitation attempts that individual defenders never would.

Milo: And then the third incident, which is the human-scale one. A researcher going by petecooper published two PHP remote code execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — early, without realizing they were under embargo. He's apologized, and by all accounts his mistake was not knowing the embargo existed rather than maliciously breaking it.

Mia: And the reaction to that in the threads was genuinely divided. Some people were harsh — early disclosure without checking is negligent, full stop, that's why the norms exist. Others were sympathetic, pointing out that the coordination system for embargoes is informal, opaque, and easy to fall out of sync with, especially if you're an independent researcher rather than someone plugged into the vendor channels.

Milo: That second camp's argument was basically: we've built a disclosure system that depends on everyone being plugged into the right mailing lists and knowing who's coordinating what, and then we act surprised when someone outside that circle trips over a wire.

Mia: And to zoom out on all of this, there's pwn.watch, a site tracking 35 ongoing security incidents live — 15 of them rated critical — with the CVEs and patch status. And the reason that belongs in this conversation is that it makes the pattern visible: leaks happen, and then you can watch, in real time, how fast unpatched systems get hit.

Milo: So the throughline of this cluster: disclosure is fragile, the leak-to-attack window is days, and nobody knows how many unpatched systems are sitting exposed right now. That last part was the real unresolved question — the commenters who run infrastructure were noticeably not reassuring about it.

Mia: One more thing worth saying: these were all accidents or protocol failures, not attacks on the disclosure process itself. Which is almost worse, in a way. You can harden against adversaries. It's much harder to harden against everyone being rushed and tired.

Milo: Which brings us neatly to our next cluster, because not every infrastructure failure comes from a leak or a mistake. Some come from legal pressure — and this week we've got three very different examples of it reshaping how the internet works.

Mia: Start with Quad9. It's a nonprofit DNS resolver — one of the more privacy-respecting ones — and it's withdrawing from France entirely as of November 24th, rather than comply with a court-ordered DNS block demanded by beIN, the sports broadcaster.

Milo: So the background: beIN went to court in France to get DNS blocking orders against piracy-related domains, and Quad9, as a resolver, would be on the hook to implement those blocks for French users. Rather than do that — Quad9's position has always been that resolver-level blocking is the wrong layer, it's overblocking and it sets bad precedent — they're pulling out of the country.

Mia: And that's a genuinely consequential decision, because the whole selling point of Quad9 is that it works the same everywhere. Having a privacy-respecting resolver exit an entire country over a blocking order is, in a sense, beIN winning the specific case and the French public losing a service they might have relied on.

Milo: The discussion on that one was fairly sympathetic to Quad9, with the disagreement centered on whether exit is the right strategy. Some said refusing to implement the block and leaving is the principled stand — you don't get to conscript a nonprofit resolver into being a censorship enforcement layer. Others said exit is a luxury: most companies can't just leave France, so the precedent still lands badly for everyone who has to stay and comply.

Mia: Then a very different kind of exit: eMudhra, a certificate authority, is voluntarily withdrawing from the global SSL/TLS certificate business, pointing to questions raised by Chrome's questionnaire. For anyone who doesn't follow CA politics: browser vendors like Chrome essentially govern the CA ecosystem through requirements and questionnaires, and CAs that can't or won't meet the bar get distrusted — which means their certificates stop working, which means death.

Milo: So here the pressure isn't a court order, it's the browser as regulator. And the commenters who follow CA/Browser Forum drama read this as eMudhra reading the room — they looked at Chrome's questions and decided the honest answer was "we can't meet where this is heading," and leaving voluntarily beats being distrusted publicly later.

Mia: And the third one is the most directly political: Canada is debating Bill S-211 to restrict gambling advertising, and the analysis behind it found 3,000 gambling messages in just seven NHL games. Seven games. Three thousand messages.

Milo: That number did a lot of work in the discussion. It's not just ads — it's sponsored segments, jersey patches, broadcast integrations, all of it. And the argument for the bill is that this saturation is normalizing gambling, particularly for young viewers, at a scale that ordinary advertising rules were never designed for.

Mia: The counterarguments were the usual ones about advertising restrictions — commercial speech, effectiveness, whether bans just push it offshore — but honestly, the 3,000-in-7-games figure seemed to absorb most of the pushback. It's hard to argue that's a reasonable level of exposure.

Milo: So three regimes: a court ordering a resolver to block, a browser effectively regulating certificate authorities out of the market, and a legislature moving against an advertising industry. Different tools, same underlying dynamic — legal pressure is now a primary force deciding which infrastructure exists where. And the open question: do exits like Quad9's become the template? Do critical infrastructure operators just start withdrawing from jurisdictions with hostile legal environments?

Mia: And when infrastructure operators are under that kind of pressure, the individuals using the systems are the ones exposed. Which is a good bridge to our next topic: personal data as both a weapon and a trap.

Milo: Start with the weapon side. Hacked phones belonging to the Kushners — compromised by hackers tied to the GRU, the Russian military intelligence unit — revealed secret negotiations and over 700 million dollars in transfers.

Mia: The 700 million in transfers is the detail that drove most of the discussion, because it's the kind of thing that turns a breach story from "embarrassing" into "materially significant." And the hackers being GRU-affiliated, based in the Netherlands operationally, raises all the obvious state-actor questions about why this material was taken and where it might surface.

Milo: Now, the important caveat that came up repeatedly: we don't know how much of the material from those phones is verified. Leaked data can be selective, it can be doctored, and the provenance of any specific claim matters enormously. Several commenters explicitly declined to treat the contents as established fact until there's corroboration.

Mia: Which is the right instinct, but it doesn't change the structural point: the phones were hackable, therefore they were hacked, therefore everything on them is now potentially public. And then the trap side of the same coin — Amanda Smith, who spent three nights in jail and is now facing up to six years because a fraudster opened a Cash App account using her name and her Social Security number.

Milo: And the asymmetry is what got people. She's the victim of identity fraud, and the system's response was to jail her for three nights and charge her with something carrying a six-year sentence. The fraudster used her data against her, and then the legal system did too.

Mia: The firsthand-adjacent commentary in that thread was grim — people describing how hard it is to prove you didn't do something, how identity verification systems essentially assume the name and number attached to an account is the person who owns the account. When that assumption is wrong, the burden of proof falls entirely on the victim.

Milo: So put the two stories together: the same exposure of personal data that lets a state-linked hacker group extract geopolitical leverage also lets a random fraudster put an innocent woman in jail for three nights. The scale is different; the mechanism is identical. Data that should be protected isn't, and whoever gets it — state actor or street-level scammer — can convert it into power over someone else.

Mia: And the unresolved part on the Kushner side is verification — how much of what's being claimed from those phones holds up. On the Amanda Smith side, the unresolved part is systemic: how many other people are sitting in her position right now, with a fraudulent account in their name and a prosecutor who doesn't care whose name is actually on the fraud.

Milo: From data and people, let's turn to the systems themselves — what AI models actually say, and what the tools built around them actually do. This cluster is about homogenization and about wrappers.

Mia: The homogenization piece first. There was a test where 12 different AI models were asked something designed to be controversial, and 29 of the 35 answers converged on the same take: that people sacrifice truth for group belonging.

Milo: Which is a striking result on two levels. First, the take itself — "humans trade truth for tribal affiliation" — is a pretty cynical, pretty online, pretty particular worldview. It's the kind of thing you'd expect from a certain kind of commentator, not necessarily the correct answer to every controversial question.

Mia: And second, the convergence. Twelve models from presumably different labs, different training pipelines, different data mixes — and they collapsed onto the same answer 29 times out of 35. The discussion's worry was that this is evidence of model homogenization: the same training data, the same RLHF-style alignment shaping, the same common sense of the internet producing the same output everywhere.

Milo: The skeptics pushed back that one test with one question proves very little — you'd need to see this across many prompts and domains before drawing the conclusion that models are converging into a monoculture. And that's fair. But the counter was that the specific answer matters: it's not just convergence, it's convergence on an unflattering, resigned view of humanity, which says something about the training distribution even if one test can't prove the whole thesis.

Mia: Then the tools. NVIDIA's OpenShell — a runtime for autonomous AI agents, sitting at 17.3k stars — is popular, but the criticism attached to it is the interesting part: it has telemetry that cannot be turned off.

Milo: For a security-focused runtime for autonomous agents, that's a real tension. People are adopting it to run agents that will act with some degree of autonomy on their systems, and the runtime itself phones home and you can't stop it. The threads reflected genuine ambivalence — the tool fills a real need, hence the stars, but the non-removable telemetry is exactly the kind of thing this community usually treats as disqualifying.

Mia: And then the third piece: OpenAI released an official Go CLI for their API, Apache-licensed. And the verdict from the discussion, bluntly, was that unlike Codex, it's just a thin API wrapper — it calls the API, it doesn't do agentic work, it doesn't add capability.

Milo: Which some people found perfectly fine — an official, maintained, permissively-licensed client library is genuinely useful — and others found revealing. The gap between "Codex" and "an API wrapper" is, in their view, an honest look at where the open surface of these companies actually ends: the interesting stuff is closed, and what's open is plumbing.

Mia: So the throughline of this cluster: the models are converging on the same voice, the popular tools ship with telemetry you can't remove, and the official open offerings are thin. Which is exactly the environment that pushes some people to say: fine, we'll take the hardware apart ourselves.

Milo: And that's our next topic — reverse engineering wins. And these are two genuinely impressive pieces of work.

Mia: First: ns2jb, the first software-only jailbreak of the Switch 2, working on firmware 23.0.1. The bug is an integer overflow in SmileBASIC — which, for listeners who don't know, is a homebrew programming environment Nintendo itself ships on the console. So Nintendo provided the language, and the language provided the overflow.

Milo: And two details make this story. One, the person behind it had help from Codex — an AI coding tool — and estimates the work at about two weeks. Two, "software-only" is the key constraint: previous Switch jailbreaks often needed hardware mods, a chip soldered in, or an early-firmware bootrom bug. This one works purely in software on current firmware.

Mia: The discussion around the Codex involvement was interesting. Some treated it as a footnote — the exploit is a classic bug class, the AI accelerated the grind. Others saw it as a marker: reverse engineering, historically the most artisanal of skills, is now something a determined person plus an AI assistant can do in weeks rather than months or years. That has implications well beyond game consoles.

Milo: Then the second one, which is almost hard to believe on first read: HackiOS boots the unmodified iOS 16.5 XNU kernel and userland on Android hardware — specifically a Poco X5 Pro, and in QEMU. Unmodified meaning they didn't patch the kernel to make it run; it's Apple's actual kernel, executing on a Qualcomm Snapdragon.

Mia: That took years of work on emulating the hardware environment Apple's kernel expects — the drivers, the boot flow, the memory layout. The community reaction was a mix of awe and the standard "okay but why" — and the why, from the people doing it, is basically the same why as the Switch jailbreak: understanding the system completely, and refusing to accept that hardware dictates what software can run.

Milo: The open question on both: vendor responses. Does Nintendo patch SmileBASIC, does the exploit chain survive future firmware, does anyone at Apple care that their kernel boots on a budget Android phone? None of that is answered yet.

Mia: And there's a shared spirit across both projects: if a machine is sold to you, the question of what it can run is a question about your skill, not about permission. That's a minority view in the industry, but it's alive and well.

Milo: Which is the perfect bridge to our last topic: people building things themselves, outside the corporate pipeline. Because these stories answer the enclosure theme from the top of the show with a counterexample.

Mia: Start with the one that got the most pure admiration: a developer called Maxilevi released Hedra, a 3D open-world game, 100,000 lines of code, written from scratch — engine and all — in high school, explicitly without AI assistance.

Milo: A hundred thousand lines of a from-scratch engine and open world, as a teenager, no AI. And the discussion around it was refreshingly free of cynicism — mostly people asking technical questions about how he approached rendering and world streaming, and reflecting on what "from scratch" even means at that scale. There was also the quiet, pointed contrast with our earlier stories: here's someone who learned the whole stack rather than delegating it.

Mia: Then performance engineering: earstrip, from ISC — the Internet Systems Consortium — written in C++ with a WASM build, triangulates 3.7 million map polygons in 489 milliseconds, faster than earcut, which has been the standard tool for years.

Milo: Beating earcut is a meaningful benchmark claim, because earcut is battle-tested and heavily optimized. And the practical payoff matters too: polygon triangulation is everywhere — maps, game engines, data visualization — so a faster general-purpose implementation is useful infrastructure, and it being open means it's commons in the exact sense our first topic was about.

Mia: Then the cultural one: The Last Museum, semantic search across 6.3 million artworks from major museums. One search interface over the aggregated collections of institutions that each have their own fragmented, often terrible catalog systems.

Milo: And the critique that came with it was constructive rather than dismissive — people liked the concept and then immediately picked at the naming and the UI. The underlying point in the discussion was that the hard part, aggregating and making 6.3 million objects semantically searchable, was done well, and the easy part — what to call it and how the interface feels — was rough. That's a very common profile for passion projects.

Mia: And the most institutionally ambitious one: Taler Operations AG, based in Bochum, has applied to BaFin — the German financial regulator — for an e-money license to operate GNU Taler as a payment system in Germany and the Eurozone.

Milo: GNU Taler matters because it's payment system design that takes privacy seriously by construction — it's designed so payments are traceable for tax and anti-abuse purposes but not surveillable for everyone else. Getting a license would mean a privacy-preserving payment system operating legally at national scale, which basically doesn't exist in the card networks.

Mia: And going through BaFin is the telling detail: instead of building a crypto token and asking forgiveness, they're doing the slow, unglamorous, regulatory path. That's what taking the commons seriously looks like in payments — compliance, licensing, patience.

Milo: And then the cautionary frame for all of it: Arc, the browser, shuts down on December 22nd, 2026, with users pointed toward its successor Dia. And Arc was a beloved browser — genuinely loved — and it's still dying. When a closed product dies, its users' workflows die with it.

Mia: Which is why the independents matter. Hedra's code is out there. earstrip is open. Taler is GNU, licensed, and going through regulation so it can outlive any single company's enthusiasm. The Arc shutdown is the reminder of what happens when you build your life on something that can be turned off, and these projects are the alternative: build it yourself, build it open, build it so it survives.

Milo: So there's the arc of the show — literally the arc, not the browser. Enclosure at the top: knowledge fenced off, forest cleared before the assessment finished. The rush producing broken disclosure, days from leak to exploit. Legal pressure pushing resolver and certificate operators out of countries. Personal data converting into power and prison. Models converging on the same cynical answer and shipping telemetry you can't disable.

Mia: And then the counter-pressure: a Switch 2 jailbreak and Apple's kernel on Android silicon, a teenage game engine, a faster triangulator, a museum search over 6.3 million works, and a payment system patient enough to ask the regulator for permission. The commons gets enclosed, and people rebuild it.

Milo: The big unresolved questions to carry with you: whether policy can arrive in time to slow the AI land- and knowledge-grab, how many unpatched systems are exposed right now from this week's leaks, whether infrastructure exits become a pattern, and how much of the leaked Kushner material is actually verified.

Mia: Thanks for listening, everyone. We'll be back tomorrow with whatever the next day breaks.

Milo: Take care.