1025 | AI Hype, Hacked TVs and a Very Old Turtle

Mia: Welcome back to the show — I'm Mia, and with me as always is Milo.

Milo: Hey everyone. Today we've got a thread that runs through basically everything: what machines are now capable of building, who pays for the software we all depend on, and how much of our infrastructure — from TVs to DNS to GPUs — is quietly held together by very few people. We'll start with the money question, because everything else sits on top of it.

Mia: So the big one: Torsten Slok at Apollo has an argument making the rounds that despite the hype and the truly massive investment going into AI, it hasn't yet generated financial returns outside the technology sector itself. That's it. That's the claim. And it sounds small, but it cuts at the whole thesis of the current buildout.

Milo: Because "outside tech" is doing a lot of work in that sentence. Right now most of the measurable AI revenue is tech companies selling to other tech companies — chips, cloud, model APIs. Slok's point is that until a bank, a retailer, a hospital shows up with margin improvements they can actually attribute to AI, you've got an economy of infrastructure building infrastructure, and circular spending looks a lot like the early stages of a bubble.

Mia: And the pushback writes itself. This is what every general-purpose technology looks like in its early years — canals, railroads, the internet. The returns come a decade after the ditches are dug. The people making that comparison were saying: of course ROI hasn't shown up in the broader economy yet, the physical buildout isn't even finished.

Milo: The counters to that were pretty sharp, though. One line of reasoning was that railroads at least showed up in shipping costs and travel times quickly. If AI were genuinely a general-purpose technology on that level, you'd expect early signs in productivity data or in the earnings of non-tech firms adopting it — and the argument is those signs are just not there.

Milo: Others said the honest position is simpler: we don't know yet, the investment cycle is too young, and anyone claiming either certainty — bubble or revolution — is ahead of the evidence.

Mia: What's genuinely unresolved is the timeline. If the returns arrive in five years, everyone arguing "it's early" looks wise. If they arrive in fifteen, the financing doesn't hold that long at this scale. The interesting thing is nobody in the discussion could point to a concrete leading indicator everyone would accept as proof either way.

Milo: Now, one counterweight to the gloomy reading is Dan Luu's piece, which I found genuinely energizing. His argument is that with AI, ambitious projects that were previously judged infeasible — he mentions things like pgrust and building regex engines from scratch — are suddenly doable in hours rather than months.

Mia: But the crucial caveat, and he's very explicit about this, is that the projects work because they're tested and validated seriously. The AI generates enormous amounts of candidate work, and the validation harness is what turns that into something real. Without rigorous testing, you get confident garbage at scale. So it's not "AI replaces engineers," it's "AI plus verification changes what's worth attempting."

Milo: And that reframes the ROI debate in a way I think is underrated. If the cost of attempting a project collapses by two orders of magnitude, you get experiments nobody would ever have funded — and some fraction of those become valuable. That's a return, just one that doesn't show up in a quarterly earnings report. Slok's metrics might genuinely miss it.

Mia: Or the optimists are pattern-matching to the internet era and the truth is more boring. Which brings us to the most concrete bet on AI returns that we saw: robots.

Milo: Dream Labs came out of stealth with ninety million dollars in seed funding, and their product is Dream-1, a "World Action" model that controls robots it has never seen before, zero-shot, at a cost of three dollars an hour.

Mia: Three dollars an hour for robot labor. That number is doing all the talking. If it holds up, it's not an AI bubble question anymore, it's a labor market question.

Milo: And notice how this connects straight back to Slok. If AI is going to generate returns outside tech, embodied labor is one of the most plausible places it happens — because the value is physical and legible. A robot that moves boxes has a measurable output. There's no attribution problem like there is with "did the coding assistant make our engineers faster."

Mia: The skeptic position here is the one I kept seeing: zero-shot generalization to never-seen robots is exactly the kind of claim that dissolves under contact with messy warehouses. Demo videos are shot in good lighting with curated objects. The gap between "controls never-seen robots" in a demo and "works in a distribution center in winter with gloves on" is where robotics companies go to die.

Milo: And the counter is that this model-based approach is different from the old perception-stacks — if the model genuinely learned general action understanding rather than task-specific pipelines, the generalization claim is at least structurally plausible. But nobody's arguing it's proven. What's unknown is whether real-world deployment works at scale, and that's exactly the experiment that's now funded to run.

Mia: Okay, so let's stay in this neighborhood — machines building things — and talk about a concrete example. There's a project called bbtree, an ordered map meant as a substitute for BTreeMap, whose headline achievement is reducing cache misses and cache coherence traffic. Performance work of the most unglamorous kind.

Milo: And the detail that makes it a story: the author says the entire codebase was written by LLMs. Not assisted — written.

Mia: Right, and that's a data point in the Luu argument playing out in real time. Performance-critical data structure work is exactly the kind of thing that used to be the province of a handful of specialists. Whether bbtree is actually good is still being hashed out, but the existence proof matters more than the benchmark for now.

Milo: The interesting disagreement in the discussion was about what "written by LLMs" even means. One view: it's a novelty and the real achievement is the author's validation and benchmarking discipline — the human is still the engineer, the model is a very fast junior. The other view: this is a phase change. If entire codebases can be generated and validated, the bottleneck moves entirely to taste and verification, and that changes who can build systems-level software.

Mia: And the cautious camp pointed out that data structure code is unusually verifiable — you can fuzz it, benchmark it, prove properties about it. That's close to a best case for AI-written code. Nobody thinks this generalizes to, say, distributed systems control planes tomorrow. The honest unknown is where the boundary sits between problems you can validate cheaply and problems you can't.

Milo: So that's the bright side of machines writing code. Now for the dark mirror — the software that already runs the world, and the people maintaining it running out of money.

Mia: The PHP Foundation is underfunded. They've got one full-time employee and roughly three hundred fifty thousand dollars in the bank, and that balance is falling. They're asking companies to sponsor the work.

Milo: And PHP still runs a huge share of the web. This is the free-rider problem in its purest form: every company benefiting from PHP infrastructure benefits a little, and none of them individually benefits enough to feel obligated. The Foundation model was supposed to fix exactly this, and it's producing a trickle instead of a stream.

Mia: Some people argued the ask is aimed wrong — individual sponsorships are noise, what's needed is a handful of large corporate funders who treat language runtime maintenance like infrastructure, the way we treat roads. Others were more pessimistic and said this is just the equilibrium: volunteer-run until it breaks. And a few pointed out the uncomfortable AI angle — if LLMs make new language development cheaper, does that make it even harder to fund the unglamorous maintenance of an old one?

Milo: That's the question I don't think anyone can answer. The optimistic story says AI absorbs the toil and maintenance gets cheaper. The pessimistic story says AI makes greenfield projects so cheap that nobody wants to fund old plumbing, and the plumbing is where the vulnerabilities live. Which — speaking of vulnerabilities living in plumbing —

Mia: — let's do the security block, because we've got a couple of stories there that fit this theme perfectly. A researcher got a root shell on 2025 Samsung TVs using zero-days, and in the process documented that the microphone is always active, plus ACR — automatic content recognition — and telemetry shared with hundreds of partners.

Milo: Hundreds of partners. That's the number I can't get past. Not "some analytics," not "a data-sharing agreement" — hundreds of entities your television is talking to about what's happening in your living room.

Mia: And the discussion, honestly, was more resigned than outraged, which is itself telling. The frequent viewpoint: this is the known business model of smart TVs — they're cheap because you're the product, and ACR has been documented for years. The zero-day root shell made headlines, but for many commenters the always-on microphone was the bigger story precisely because it wasn't news.

Milo: The counterpoint worth taking seriously: there's a difference between "telemetry exists" and "a researcher can pop a root shell and demonstrate it all firsthand." One is a policy complaint, the other is an attack surface. And the practical question nobody has an answer to is what Samsung does next — whether this leads to any actual change in behavior, or a patch and a shrug.

Mia: Now the Brotli vulnerability, which is the flip side — not a device you bought, but a component almost everything depends on. CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, and it affects Node.js, Python, C++, Envoy, and HTTP libraries in a bunch of languages.

Milo: This is the software-supply-chain story in miniature. Brotli is a compression format, decoders are everywhere, and one memory-safety bug in one decoder ripples out into essentially the entire web stack within days. And it loops us back to the PHP Foundation conversation: who pays for the boring work of keeping decoders safe? Because the answer, apparently, is often a volunteer or an underfunded team, and the blast radius is the whole internet.

Mia: There's a great connection here, actually. Someone set up a site called stealmybitcoin.com — a CTF where about five hundred dollars worth of bitcoin is hidden on a deliberately vulnerable PHP server, and the challenge is to test whether a PHP exploit being discussed is actually real.

Milo: I love this as an epistemics move. Claims about vulnerabilities are notoriously hard to verify — vendors minimize, researchers exaggerate, and the public can't tell who's right. Putting real money on a vulnerable server converts an argument into an experiment. If the bitcoin gets taken, the exploit is real. If it sits there for months, that's evidence too.

Mia: And it's a nice bridge, because what makes the whole security block cohere is that these are all trust problems with no auditor. You trust your TV not to listen, you trust the decoder not to corrupt memory, you trust the vulnerability report to be accurate — and each of those trusts just got a data point saying "verify it yourself."

Milo: Okay, let's shift gears but stay with devices — this time on the hopeful end. EPFL has a chip called LogSync, four by two millimeters, that records signals between regions of the brain and can identify cognitive and emotional states, all on less than two hundred microwatts.

Mia: The power number is the headline. Two hundred microwatts is nothing — that's the difference between a neural implant that needs a bulky power setup and one that could plausibly run for a very long time. The multi-region aspect matters too: single-area recording is old news; correlating signals across regions is how you get to something like reading a state rather than a spike.

Milo: Which is also where the discomfort lives. "Identifies cognitive and emotional states" is a capability that's wonderful in a clinical context — seizure prediction, mood monitoring for psychiatric treatment — and genuinely unsettling everywhere else. And we just spent ten minutes talking about a TV that shares audio telemetry with hundreds of partners. Nobody in the discussion thought brain data would be handled more carefully by default.

Mia: The honest position is that this is a research step, not a product — the chip is small and low-power, which removes an engineering bottleneck, but the path from "lab demo identifies states" to "clinically validated, private, mainstream" is long and mostly unmapped. What's next is more validation studies; what's unknown is whether the state identification generalizes beyond controlled settings.

Milo: All right — from cutting-edge brains to very durable software. SpeedCrunch 1.1 shipped: an open-source scientific calculator with fifty digits of precision, and it's the first major release in about ten years. It fixes an order-of-operations bug.

Mia: Ten years. And the bug is that a calculator got the order of operations wrong, which is like a spell-checker misspelling "the." But there's something almost refreshing about a tool so stable that its release cadence is measured in geological time. No subscription, no telemetry, no redesign — it just calculates things precisely.

Milo: And contrast that with OBS Studio 33.0, which is doing the opposite of geological time — it updates its embedded browser engine from a 2024 version to a 2026 version, reworks plugin loading, enables NVENC encoding on Arm64, and fixes a pile of bugs.

Mia: The connection I'd draw is that both are maintenance stories, but maintenance under completely different constraints. SpeedCrunch is a self-contained program that can afford to sleep. OBS embeds an entire Chromium build, which means it inherits the whole browser security treadmill whether it likes it or not. "Done" software can stay done; "software with dependencies" never is. That's really the theme of this whole segment.

Milo: And it leads naturally into our next cluster: infrastructure, migration, and who's holding the lights on. Roku moved its developer repositories from GitHub to GitLab, with no public explanation.

Mia: That silence is the story. Developers noticing their repos moved and nobody saying why. The speculation you'd expect: GitHub reliability problems get cited by users, there's the ongoing unease about platform direction, cost negotiations, whatever. But absent any statement, it's all inference. What makes it worth watching is that when visible companies quietly migrate off the default platform, other companies watch and take notes.

Milo: Meanwhile, the other end of the longevity spectrum: FreeDNS, afraid.org, running since 2001 as a free DNS and dynamic DNS service, with over seven million users and about thirteen-point-eight million records.

Mia: Twenty-plus years of free critical infrastructure. That's older than a lot of companies that depend on it. And it raises the same question as the PHP Foundation: what happens when the person or team behind it decides to stop? Free DNS outages take down email, websites, home servers — quietly, for people who never knew they depended on it.

Milo: And our third one in this cluster is my favorite, because it's a small act of rebellion: a Linux module called gpu-unlock that lifts the FP and BF16 emission rate restrictions on Nvidia's 3000-series consumer cards, bringing them up to professional-tier levels. Gains of up to eighty percent in BF16 GEMM workloads.

Mia: Eighty percent on hardware people already own, from a software module. Nvidia artificially segments its product line — the same silicon, throttled differently based on what you paid — and this quietly erases the throttle for one generation.

Milo: The discussion had a clear moral split. One side: this is buyers getting the full capability of hardware they paid for, and the artificial segmentation is the real offense. The other side: it's circumventing vendor restrictions, it may violate terms, and there are reasons for those limits. What nobody disagrees on is the practical question: how does Nvidia respond? Patch it in drivers, ignore it, or price accordingly?

Milo: That's genuinely open — and given how much of the AI buildout runs on consumer GPUs, it's not a niche question.

Mia: And it ties back to where we started, in a way. The big AI investments are in data centers; meanwhile the actual accessible compute for regular people gets unlocked in someone's free-time Linux module. Decentralization by patch.

Milo: Let's close with the gentle stuff. There's a 2018 article by Douglas Ross, a physicist at Southampton, titled "I don't understand quantum physics" — a didactic piece aimed at laypeople, and the title is the point. A working physicist admitting that the honest answer to "do you understand quantum physics" is no, and then teaching from inside that honesty.

Mia: That resonated with a lot of people because it's the opposite of how science communication usually works — usually you get confident simplifications that quietly teach you wrong intuitions. Starting from "nobody understands this in the everyday sense, and here's what we can still say rigorously" is both more honest and, arguably, more useful.

Milo: And our closing smile: the five-pence coin of Saint Helena features Jonathan, a giant tortoise who's around one hundred ninety years old. And in 2023 he nearly died — not from predation, not from age, but because he ended up flipped on his back after a scuffle with his companions and couldn't right himself.

Mia: A hundred and ninety years, and the near-death experience is a wrestling accident with his roommates. There's something fitting about ending there — the longest-lived thing we talked about today, and even he needed someone to come flip him back over. Which, honestly, is also what the PHP Foundation is asking for.

Milo: That's the show. Thanks for listening — we'll be back with whatever the machines build overnight.