1109 | Losing the Keys, Bending the Spoons

Mia: Welcome back to the show, everyone. I'm Mia.

Milo: And I'm Milo. Today we've got a set of stories that, oddly enough, all rhyme. Money and access, pricing and ownership, tools and the people building them, and then a run of infrastructure stories where one weak link quietly breaks everything.

Mia: Yeah, and we'll start with the question everybody keeps asking: is there even an AI bubble? Because at least one writer is pushing back on the framing.

Milo: Right. So the argument goes like this. The headline number is around five trillion dollars of spending, which sounds like a bubble of historic proportions. But the author's point is that most of that isn't recurring burn, it's one-off datacenter capital expenditure. You build the datacenters once. That's capex, not an infinite treadmill of losses.

Mia: And the second leg of the argument is the revenue side. The claim floating around is that Anthropic is making something like two dollars and eight cents for every one dollar of compute. If that number holds, the economics look very different from a company lighting money on fire. A bubble in the classic sense means you're paying for assets that don't generate returns. If the compute actually pays for itself with margin, that's... not that.

Milo: But let's stress-test that the way the discussion does. The big unresolved question, and the author admits this too, is what happens after the capex wave ends. Right now the spend is concentrated, and the revenue is being measured against that same window. Once the datacenters are built and depreciation starts biting, does revenue scale? Nobody knows yet. That's the load-bearing unknown in the whole "no bubble" thesis.

Mia: And the two-dollar-eight figure itself is doing a lot of work. Skeptics would say revenue measured per dollar of compute isn't the same as profitability once you count the cost of everything else. But the counter-counterpoint is that it at least suggests demand is real, that people are paying more than the marginal cost of the compute they consume.

Milo: Which connects directly to the practitioner side of the same discussion, because a separate writer is dealing with a very different problem: not whether AI companies survive, but whether individual humans survive working with this stuff. He calls it "brain fry."

Mia: I love that term. The idea is that when you have a bunch of AI agents running around, you end up with this cognitive overload, too many parallel threads, too many decisions coming at you at once, and your brain just turns to soup.

Milo: His solution is delightfully low-tech for someone working with cutting-edge agents: a git-based priority queue. Everything goes in version control, he takes one decision at a time, and he works through the queue in order. It's basically imposing serial order on an inherently parallel workflow so his head doesn't explode.

Mia: And then the hard rule, which honestly deserves its own headline: agents never deploy to production. Never. The human is the gate. That's his answer to the trust question. You can delegate enormous amounts of work, but the moment of actually changing the production system stays human, always.

Milo: And that's a nice bridge, Mia, because access to these tools is exactly what the next story is about. Goldman Sachs restricted Claude Code to engineers only, cutting off traders and bankers who had apparently been using it.

Mia: And the timing is what makes this juicy. Weeks later, Goldman is underwriting Anthropic's IPO. So you have a bank restricting employee access to a company's product, and then turning around and taking that company public.

Milo: The optics problem is that these two things sit right on top of each other. Is this a compliance story, a cost story, a security story? None of the reporting pins it down. But the intersection of "who inside a firm gets to use the tool" and "who profits from the tool's success" is exactly where commenters were poking.

Mia: And notice what the restriction itself implies. If traders and bankers were using it and now can't, that means the tool was genuinely useful to non-engineers, which is itself data about where this technology is spreading. Cutting access is also a signal about how widely it had penetrated.

Milo: Meanwhile, over at Nvidia, a completely different kind of governance story. Jensen Huang apologized to Nvidia staff over an affair, and the board initiated an independent investigation that includes national-security concerns.

Mia: Which is an odd combination on its face, an apology for a personal matter, and a board investigation with a national-security angle. What the national-security concern actually consists of, and what the investigation concludes, are both still unknown. There's no resolution here, just the fact of it happening.

Milo: So that's the money-and-access cluster: one argument that the economics are healthier than the bubble narrative suggests, one practitioner building guardrails for his own sanity, and two big firms dealing with optics and governance. Let's pivot to where money meets ordinary users, because this next one stings.

Mia: Harvest. The time-tracking app. Bending Spoons, which acquired it, raised pricing from thirteen dollars a month to a hundred and thirty-four dollars a month.

Milo: That's a 10x. On a product whose entire reputation, according to the author, was being simple and reliable small-business software. Not flashy, not AI-powered, just the thing that worked every day and did one job.

Mia: The author's framing is that this market is now being repriced by investors rather than by users. Nobody in a ten-person shop looked at their time tracker and thought, "you know what this needs, a tenfold price increase." That's an investor-driven model: buy dependable cash-flow products, extract maximum value.

Milo: And it's a live test, really. The open question is whether buyer loyalty survives that. Small businesses are famously sticky with software, switching costs are real, data migration is a pain. So maybe they pay. Or maybe this is the moment an entire category of alternatives gets a look. We don't know the answer yet, but the repricing itself tells you what the new owners think the product is worth, or at least what they think they can extract.

Mia: And I think that's the emotional core of the discussion: people feel like software they chose and relied on changed identity under them without changing a single feature. The product didn't get worse. The deal did.

Milo: Okay, so if the investor-owned software world is repricing, what are people doing with their own time? The next pair of stories is about exactly that. There's an Ask HN thread, from November 2026, just asking what people are working on, and the answers include some serious long-haul projects.

Mia: Bonsai, a voxel engine, ten years in. Ten. Years. And that's not abandoned-ten-years, that's actively-grinding-ten-years.

Milo: Plus Orpheum, a self-hosted media server, and OneBusAway, transit software that people actually use to get around. These are personal projects with real staying power, which is rare. Most side projects die in month three.

Mia: And the natural pairing here is an essay arguing that writing is a thinking tool. The line that got repeated: without paper, you're a finite automaton. A finite automaton can only hold so much state. Writing lets you externalize state, hold more complexity than your working memory allows.

Milo: And the corollary, in this of all years: LLMs can't do your thinking for you. If writing is how you think, then outsourcing writing is outsourcing thinking. So writing becomes your comparative advantage, not despite the AI era but because of it.

Mia: The connection the commenters drew, and I agree with it, is that ten-year projects are sustained by exactly this. Bonsai doesn't survive a decade on motivation. It survives because someone is thinking deliberately, slowly, in writing, about hard problems, year after year. The long-haul builders and the writing-as-thinking people are describing the same discipline from two angles.

Milo: Right, and that discipline is also a rebuttal to the shortcut culture. You can't prompt your way to a ten-year project. Okay, now let's go from decade-long projects to a question Paul Ford has been pushing: is the browser finally the app platform?

Mia: His argument is that the browser is now powerful and cheap. Cheap, as in CloudFlare hosting costing literally zero dollars. Powerful, as in Wasm, WebGL, and WebCrypto have all matured to the point where the things that used to require native code are now feasible in a tab.

Milo: The "cheap" part is interesting to hold up against the Harvest story we just did. Ford says the platform economics favor the browser, and it's true the hosting is free, but the Harvest repricing shows the SaaS layer on top of any platform can still be repriced at will by its owners. "Cheap to build" and "cheap for the user" are not the same thing.

Mia: Good catch. And the genuinely unresolved question is whether browser apps finally win over native for demanding use cases. Wasm and WebGL are mature, sure, but "mature" and "beats native on a beefy desktop workload" are different claims. Which brings us to the experiments that test it.

Milo: Chimera. A physically modeled voice synthesizer running entirely in the browser. And when I say physically modeled, I mean it: every sound it makes comes from a simulated airway. Nothing is sampled. The glottis, the throat, the mouth, all simulated in real time.

Mia: If you remember Pink Trombone, this is very much in that lineage, that weird delight of a cartoon mouth you can grab and manipulate and it makes human-ish noises. Chimera takes that idea and pushes it.

Milo: And it's a proof of Ford's platform argument in a single demo. Real-time physical modeling, continuous interaction, audio synthesis, all in a tab. Ten years ago you'd have assumed that had to be native. One demo doesn't settle the browser-versus-native question, but it moves the boundary.

Mia: So let's push on the boundary from the other side, the native side, where rendering costs are still the hard constraint. Two data points at opposite ends of the hardware spectrum.

Milo: First, the big end. Someone argued that GPUI and egui, the Rust UI toolkits, are dead ends for complex desktop apps. The evidence is a benchmark: 8.4 milliseconds per sparse change at three thousand rows.

Mia: And that number matters because a sparse change, one small update in a big dataset, taking over eight milliseconds means you're eating most of a frame budget at 120Hz on a single change. That's the recurring immediate-mode UI question: does the state model scale when the app gets genuinely complex, or does it work great for demos and fall apart for real tools?

Milo: The dead-end claim is contested territory, of course, benchmark design matters a lot, but the discussion keeps circling back to the same thing: the cost isn't in drawing, it's in managing state and diffing it. Meanwhile, at the absolute tiny end of the spectrum, Raph Levien is JITting bitmap glyph rendering to ARM code.

Mia: This one is delightful. The RP2350 microcontroller has a race-the-beam renderer, meaning the display scans out in real time and you have to produce each pixel before the beam gets there. The budget is something like six cycles per pixel.

Milo: Six cycles. Per pixel. So he compiles the glyph rendering, on the fly, into ARM machine code, so the generated code is fast enough to hit a deadline measured in single-digit cycles. It's the same lesson as the GPUI benchmark, in miniature: rendering cost is a hard physical constraint, whether you have a datacenter or a microcontroller. The techniques differ wildly, JIT-compiled glyph pipelines versus UI state models, but the constraint never goes away.

Mia: And from rendering constraints, it's a short hop to the people building the open desktop around those constraints. Dux is a free, open-source Wayland desktop shell, built on Quickshell and QML.

Milo: It ships a file manager, theming, the shell chrome, and it targets niri, Hyprland, and Sway. So it's not a full desktop environment in the GNOME or KDE sense, it's a shell layer you can drop onto existing window managers, which is a very Linux-y composable approach.

Mia: And in the same creative-stack spirit, KetchUp: a free, open-source SketchUp alternative written in Rust with WebGPU, aimed at woodworkers. Which is a genuinely underserved niche, parametric-ish 3D modeling for people who want to build a cabinet, not a game asset.

Milo: But the criticism is real, and commenters were honest about it: UX gotchas, like making you name your rectangles. That's the kind of friction that reads as a rite of passage to the developer and as a wall to the woodworker.

Mia: So the honest read of both projects is: the Linux creative and desktop stack is maturing around rough edges. The capability is there. The polish is uneven. Whether a project like Dux or KetchUp closes that gap depends on exactly the kind of sustained, decade-scale effort we talked about earlier, honestly.

Milo: Nice callback. Now, from open projects maturing bottom-up, let's look at standardization imposed from above, where it's going badly. The C++ situation.

Mia: So the ISO shot down the C++ committee's proposed draft. The committee, which is the actual standards body for the language, produced a draft, and ISO said no.

Milo: And paper P4454 lays out the deeper problem: the creator and the owners of the language disagree on its direction. Bjarne and the committee leadership are not aligned on where C++ should go, and that disagreement is now formalized in a paper rather than papered over.

Mia: Think about what that means. A forty-year-old language, running enormous chunks of the world's critical infrastructure, and the question of who gets to steer it is in open dispute. It's not a technical argument about, say, memory safety features. It's a governance standoff. Who has authority, and on what basis?

Milo: And the risk, as commenters see it, is fragmentation or stagnation, or both: if the steering fight can't be resolved, either the language drifts apart into incompatible camps or it freezes while everyone fights. Either outcome is bad for the ecosystem. What happens next is genuinely unknown.

Mia: And the transition from there writes itself: C++ is a system you're supposed to be able to steer through a standards process. The next stories are about systems you don't get to vote on at all. Security.

Milo: And this one is staggering. Researchers unlocked cars from a major automaker, worldwide, through a chain of unauthenticated admin tool APIs and the identity platform.

Mia: Unauthenticated admin tools. So somewhere in this automaker's infrastructure there were administrative endpoints that didn't require authentication, and by chaining through them and into the identity platform, the researchers ended up able to unlock cars. Any of them, anywhere on Earth. A single critical vulnerability with global physical impact.

Milo: The lesson, and the commenters were unified on this, is that your security posture is set by the weakest unauthenticated endpoint. Not your average security, not your best security. One admin tool someone forgot about, and the entire fleet is compromised. The chain is only as strong as its weakest link, and the adversary only needs one link.

Mia: The unknowns here: how the automaker responds, whether the fix is complete, and whether similar chains exist at other automakers. Because if one major automaker had unauthenticated admin tools reachable, the reasonable assumption is others might too. This wasn't an exotic exploit, it was a hygiene failure.

Milo: And hygiene failure is exactly the word for the last story too, the quiet one. Since November 5th, 2026, Outlook.com has been silently rejecting some mail from domains without DMARC.

Mia: Silently. Unannounced. No blog post, no grace-period notifications to admins. If you send email from a domain without a DMARC record, some of your mail to Outlook.com just doesn't arrive, and you might never learn why.

Milo: The fix is almost comically simple: a single TXT record in your DNS. One line. But the catch is you have to know to look, and the whole problem is that Microsoft didn't tell anyone to look.

Mia: And it's the perfect mirror of the car story, isn't it? Both are one-endpoint failures. In the car case, an unauthenticated admin API silently grants the keys to the fleet. In the email case, a missing TXT record silently breaks your deliverability to hundreds of millions of inboxes. One endpoint, silent failure, whole system affected.

Milo: The big unknown in the email case is how many senders are still unaware. Because email failures are invisible to the sender, you don't get a bounce, you just quietly stop existing in someone's inbox. There could be businesses out there right now with degraded email and no idea why.

Mia: So let's pull the threads together. Money: an argument the AI spend is healthier capex than bubble, tested against a practitioner's guardrails and two firms' optics problems. Ownership: Harvest repriced tenfold by investors. Building: decade-long personal projects sustained by writing-as-thinking. Platform: the browser growing teeth, from Paul Ford's argument to Chimera in a tab, while native rendering stays the hard constraint from GPUI benchmarks down to six cycles per pixel.

Mia: Open software: Dux and KetchUp maturing around rough edges. Governance: C++ in open revolt. And infrastructure: one unauthenticated endpoint unlocking every car, one missing TXT record silencing email.

Milo: All of it the same shape, really. Whether it's a bubble debate or a DMARC record, everything comes down to who controls the weak link, and whether anyone's paying attention. Thanks for listening, everyone.

Mia: We'll see you next time.