Sunday, 19 July 2026
AI mania is pushing executives into a coordination trap where nobody can admit a project failed without risking their job; an 11-byte TLS handshake can trigger an unauthenticated denial-of-service in OpenSSL by exploiting how it pre-allocates memory before validating incoming data; and trial lawyers have spent a decade lobbying against autonomous vehicles despite Waymo data showing 94% fewer serious injuries than human driving
Okta Security
OpenSSL HollowByte: A DoS Hiding in 11 Bytes
Okta's security team disclosed HollowByte, a remote unauthenticated denial-of-service in OpenSSL triggered by an 11-byte malformed TLS ClientHello. OpenSSL pre-allocates up to 131 KB of buffer based on a packet's claimed length before any of that data has actually arrived, so a handshake that lies about its size gets memory reserved for it up front; combined with glibc's reluctance to reuse freed memory, an attacker can block worker threads indefinitely and fragment server memory (consuming up to 25% of it) without ever exhausting the connection limit that would normally trigger throttling. Fixed versions (3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1) now grow the buffer incrementally as data actually arrives rather than trusting the header up front — a reminder that 'validate before you allocate' still isn't universal even in one of the most heavily audited codebases in existence.
Read →Simon Willison
Claude Code Uses Bun Written in Rust Now
Simon Willison confirms speculation that Claude Code has quietly shipped a Rust port of the Bun JavaScript runtime since v2.1.181 (released June 17). Running strings against his local Claude Code binary, he found it embeds 'Bun v1.4.0' — a version number ahead of Bun's latest public release (v1.3.14) — plus 563 Rust source filenames lifted straight from Bun's own bundler and dev-server modules. Bun creator Jarred Sumner had claimed the Rust rewrite shaved 10% off Linux startup time and that 'barely anyone noticed' the switch; Willison's digging is the first public confirmation that a not-yet-released version of Bun-in-Rust is already running in production across millions of devices.
Read →softwaremaxims.com
Reviewing AI Code Is Not A Viable Argument
The piece pushes back on the standard defense of AI coding tools — 'just review everything carefully' — with a throughput argument: human reviewers can reliably process roughly 400 lines of code per hour, capping careful review at about 1,000 lines a day, which erases most of the productivity gain AI assistance is supposed to deliver once review time is counted. Worse, cited research finds reviewers grow more confident in AI-generated code while actually catching fewer defects in it than in human-written code of similar size — the opposite of what a safety net needs to do. The failure mode is sharpest exactly where AI tools get pitched hardest: bash scripts, infrastructure configs, and other terse, high-blast-radius code where a single misplaced character causes a critical failure and is also the easiest kind of error for a reviewer's eyes to slide right past.
Read →pradyun.net
Studying Linux Schedulers, and Why Metrics Matter
A study comparing Linux CPU schedulers nearly published a null result because of an unnoticed methodology bug: the benchmark ran for a fixed wall-clock duration rather than a fixed instruction count, which silently masked a genuine scheduler improvement — throughput went up while measured 'runtime' looked unchanged, because the faster scheduler was simply doing more work in the same window rather than finishing the same work sooner. The write-up uses the near-miss as a case study in why the choice of metric isn't a presentation detail but part of an experiment's validity: the wrong metric doesn't just communicate results poorly, it can hide a real effect entirely and make a flawed study look internally consistent.
Read →Marginal Revolution (Tyler Cowen)
Tyler Cowen works through when cross-ethnic casting lands and when it doesn't, citing Elizabeth Taylor's Cleopatra, Denzel Washington's Macbeth, and Dev Patel's David Copperfield as cases that work, and floating British-Pakistani actor Nabeel Qureshi for the next James Bond as a test case he thinks would 'occasion some debate.' His conclusion is that the operative variable isn't ethnicity but believability within the story's own logic — he'd object to an all-Chinese Zulu, and thinks a miscast Liverpudlian playing London high society is a bigger sin than most cross-ethnic choices, since what breaks a performance is failing to convincingly inhabit the role, not any particular demographic mismatch.
Read →benlandautaylor.com
If You Build It, They Will Come
Ben Landau-Taylor argues that most people default to being consumers of community rather than producers of it, waiting for social connection to materialize instead of doing the unglamorous work of organizing it — and that this consumer/producer mismatch, not any lack of interest in connection, is why so many people feel socially adrift. His prescription is blunt: because almost nobody is willing to do the legwork of hosting, organizing, and following up, the few people who do become the connective tissue of their social world almost by default, gaining outsized influence and friendship simply by showing up as the one who builds the thing rather than waiting to be invited to it.
Read →