Alvaro Lopez Ortega / 2026-07-02 Briefing

Created Thu, 02 Jul 2026 19:08:02 +0000 Modified Thu, 16 Jul 2026 13:04:18 +0000
4769 Words

The U.S. government has taken direct equity stakes in 26 companies since January, deploying $23.9 billion across sectors including Intel (9.9%) and nine quantum computing firms. A Linux kernel 6.9 bug leaves LUKS disk-encryption keys in memory during suspend, exposing data to physical attackers. Meanwhile, QUALITY.md launched as an open format and CLI tool for holistic project quality evaluation, aiming to shift from reactive repair to proactive AI-assisted quality.

đź”’ Security & Privacy

zkGolf, competitive optimization of formally verified circuits.

Researchers used LLMs to generate and aggressively optimize formally verified zero-knowledge proof circuits, achieving a SHA-256 compression circuit that outperformed the human-optimized state of the art. This success led to the creation of zk.golf, an open competition for producing optimized, formally verified circuits to make ZKPs more efficient.

Linux 6.9 leaves LUKS keys in memory

Starting in Linux kernel version 6.9 (May 2024), the LUKS suspend feature no longer clears disk-encryption keys from memory, leaving them resident during system suspend. This reversal of prior behavior may expose sensitive data to attackers with physical access to the suspended system.

NSA tries to weaken mlkem standardisation

The NSA has been accused of pushing a weaker cryptographic standard, “ietf-tls-mlkem,” over the more secure “ietf-tls-ecdhe-mlkem,” and after losing an IETF vote, called a new vote for June 24, 2026, while packing the room with supporters like Mike Jenkins. Opponents are urged to join the IETF TLS mailing list and vote against the document by July 7, 2026.

He sent a harsh email to ICE’s top official. Federal agents tracked him down

A man who sent a strongly worded email to ICE’s acting director in January was visited by federal agents at his home and later tracked to his hotel after returning from overseas. The agents presented a warning notice about threatening a federal official, though the man denies making any threats. Civil liberties advocates have criticized the investigation as an intimidation tactic against free speech.

Android Developer Verification: Threat masquerading as protection

According to the article, a trojan called “Android Developer Verifier” (ADV) has been installed on billions of Android devices via Google’s own Play Protect service, operating with root privileges and unable to be removed. Its sole purpose is to block software from developers not approved by Google, using a vague definition of “malware” that effectively lets Google decide what constitutes a threat.

German spies could soon move from watching to hacking attackers

Germany plans to grant its intelligence agencies new powers to hack, disrupt, and deceive foreign attackers, marking a shift from passive monitoring to active cyber operations in response to rising threats, particularly from Russia. A draft law would create a unified legal framework for covert online operations, introduce stricter oversight via an Independent Control Council, and impose fines on companies that fail to comply with secret disclosure orders.

Hackers are using FIFA World Cup 2026 hype to infect football fans with Voidrift malware

Hackers are exploiting the hype around the FIFA World Cup 2026 to spread Voidrift malware, targeting football fans through malicious links or downloads. The campaign aims to infect devices by capitalizing on users’ excitement for the event. Caution is advised when engaging with unverified World Cup-related offers.

Meet “Bouquet,” the teenage Scattered Spider hacker now facing US charges

A 19-year-old hacker known as “Bouquet,” identified as Peter Stokes, has been extradited from Finland to the US on federal charges for his role in the Scattered Spider ransomware group, which extorted over $100 million. Prosecutors allege he used social engineering to infiltrate companies, including demanding an $8 million ransom from a jewelry retailer. If convicted on all counts, he faces up to 47 years in prison.

Preventing token theft

Infostealer malware can steal authentication tokens, circumventing strong MFA. A proposed solution using dynamic, hardware-backed TLS client certificates to bind tokens to specific sessions was never adopted due to privacy concerns, implementation complexity, and certificate granularity difficulties.

Ctrl+Alt+Oops: FortiBleed criminal’s logins stitch two gangs together

Researchers analyzed logs from a FortiBleed intrusion and discovered an operational security failure by at least one individual who was simultaneously collaborating with both the INC and Lynx cybercriminal gangs.

Microsoft said exploitation was ’less likely’ … but CISA just added SharePoint RCE to KEV list

CISA has added a SharePoint remote code execution vulnerability to its Known Exploited Vulnerabilities catalog, despite Microsoft’s earlier assessment that exploitation was less likely. Attackers only need a valid SharePoint account to execute code on vulnerable on-premises servers.

Oracle EBS attacked via critical flaw before exploit code release

Attackers appear to have reverse-engineered Oracle’s patch to exploit a critical flaw in Oracle E-Business Suite before public exploit code was even released.

Hackers shoveled snow for company, were rewarded with network admin access

Professional red teamers gained network admin access to a company’s systems after shoveling snow for them, successfully demonstrating a physical-social engineering vulnerability. The test resulted in full compromise of the network.

🤖 AI & Machine Learning

CLI tool for detecting non-exact code duplication with embedding models

Slopo is a lightweight CLI tool that detects non-exact code duplication by calculating embeddings for each code unit and finding pairs with close embeddings, focusing on similar code that is far apart in the codebase. It generates clusters of potential duplicates ranked by similarity and distance, which are meant for AI coding agents to verify and refactor. The tool supports multiple languages, uses external embedding models, and allows incremental indexing and ignored clusters via a config file.

Comparing Fable and 10 other LLMs on refactoring a LangGraph god node

An experiment tasked 11 LLMs (5 American, 6 Chinese) with refactoring a 350-line LangGraph “god node” into a clearer graph-level architecture, then had them evaluate each other’s proposals. The author applied three methods to identify the most trustworthy models for generation and evaluation, aiming to expose hidden control flow rather than simply splitting a large function.

Is One Layer Enough? A Single Transformer Layer Matches Full-Parameter RL Train

Training a single transformer layer can recover most of the performance gains from full-parameter reinforcement learning (RL) post-training of large language models, often matching or surpassing it. The gains are highly concentrated in a small subset of middle layers, with input and output layers contributing substantially less, a pattern consistent across model families, RL algorithms, and tasks.

Kimi K2.7 Code is generally available in GitHub Copilot

Kimi K2.7 Code, an open-weight model, is now generally available in GitHub Copilot as a selectable option in the model picker, hosted on Azure and billed at provider list pricing. It is rolling out to Copilot Pro, Pro+, and Max plans, with gradual expansion to Business and Enterprise plans after administrators enable it.

Senior SWE-Bench: open-source benchmark that assesses agents as senior engineers

Senior SWE-Bench is a new open-source benchmark that evaluates AI agents on senior-level software engineering tasks using realistic, under-specified instructions and runtime investigation, rather than the over-specified prompts of junior-level benchmarks. It includes multi-service feature tasks and bug fixes requiring hundreds of steps, assessing both correctness and code quality. Even the top frontier models fail to complete these tasks over 75% of the time.

The Control Plane Was the Point: Revisiting autofz in the LLM Era

The article revisits autofz, a meta-fuzzer from 2023, arguing that its core question—how to allocate a fixed budget among imperfect workers—is now more relevant in the LLM era, where workers include fuzzers, analyzers, and agents. It contends that as generating plausible bug candidates becomes easier, the harder problem is turning noisy evidence into reliable decisions, and the lessons from fuzzing research about feedback, evaluation, and automation remain valuable.

🛠️ Developer Tools & Open Source

QUALITY.md – open format/specification, agent skill, and CLI

QUALITY.md is a new open format, specification, agent skill, and CLI tool designed to establish a holistic quality evaluation process for projects, with applications in loop engineering. Its creator aims to shift the mindset from reactive review and repair to proactive care, leveraging AI to assist in quality efforts.

Former Microsoft dev built a 2.5KB Notepad clone

Former Microsoft developer Dave Plummer created TinyRetroPad, a 2.5KB Notepad clone written in Assembly with no AI features, as a reaction to Microsoft adding unwanted functionality to modern Notepad. The editor uses the Windows API’s RICHEDIT50W control and Crinkler compression to resemble a classic Notepad-like experience while being 100 times smaller than Windows 11’s version.

Podman v6.0.0

Podman v6.0.0 has been released, featuring modernized networking with Netavark, Pasta, and nftables, along with enhanced podman machine capabilities including a new os update command. The update also includes a major Quadlet overhaul with REST API support, improved configuration file handling for multi-user environments, and better Docker compatibility.

No LLM Code in Dependencies

A developer spent approximately 100 hours ensuring the git-annex project could build without dependencies containing LLM-generated code, discovering problems such as reverted large changes and incoherent commits. They express concern about the broader impact of LLM-generated code on software quality and community participation.

Mail Memories – A desktop app to rescue photos from Gmail

Mail Memories is a new desktop app for Mac and Windows that recovers forgotten photos from your Gmail account by processing everything locally on your computer. It offers a free download of your 50 oldest photos, with a one-time $29 fee to retrieve all images—no subscriptions or cloud storage involved.

Immich v3.0.0 Released

Immich v3.0.0 has been released with breaking changes, including dropped support for pgvecto.rs. Users must update the IMMICH_VERSION in their .env file to v3 and run docker compose pull && docker compose up -d to upgrade. The release also introduces release candidates and new merchandise.

A graph paper generator that renders vector PDFs in the browser

FreeGraphPaper lets users generate and download customizable graph paper PDFs (dot grid, isometric, lined, etc.) directly in their browser with no sign-up or watermark. It offers true-to-scale live previews and supports full ISO and US paper sizes, requiring printing at 100% scale for accurate grids.

I built an open-source alternative to Claude Cowork

Valmis is an open-source alternative to Claude Cowork designed to securely automate work tasks by integrating with over 100 business apps, including Google Workspace and Slack. It uses a proxy system where a dockerized agent requests API calls through the host, allowing the container to have no internet access while still functioning. The tool also features a workflow builder for multi-step automation triggered by cron, webhooks, or app events.

The primary purpose of code review is to find code that will be hard to maintain

Mastodon’s web application requires JavaScript to be enabled for use. As an alternative, users can access Mastodon through native apps available for their platform.

Vite+ Beta

Vite+ is now in beta, offering a unified toolchain that manages runtime, package manager, and frontend tools like Vite, Vitest, and Rolldown with consistent commands such as vp dev, vp test, and vp build. It is open source, framework-agnostic, and designed to simplify setup and keep tool versions aligned across teams and projects.

LibreCAD in the Browser

An open-source 2D CAD application, LibreCAD, has been ported to WebAssembly using an LLM, enabling it to run directly in a browser without installation. The port faced challenges with modal dialogs due to browser thread limitations, which were resolved using Emscripten’s Asyncify. The resulting web app works on Chromium-based browsers (version 137+) but may contain bugs.

.gitignore Isn’t the Only Way To Ignore Files in Git

Git provides three ways to ignore files: the repository-level .gitignore (tracked), the local .git/info/exclude (untracked per-repo), and the global ~/.config/git/ignore (machine-wide). The git check-ignore -v command can identify which ignore file is responsible for a given file.

Tools or techniques for conveying mental models?

Effective techniques for conveying and growing mental models include actively building and maintaining the system, as well as informal methods like scribbling on napkins or gesturing. Directly using a well-designed tool or product is more effective than exhaustive documentation that catalogs features without fostering understanding.

This month in KDE Linux: June 2026

The KDE Linux project is 78% toward its beta milestone, with a new hybrid ISO simplifying installation and a robust QA system nearing integration. Updates include a log collector, developer mode, better audio CD ripping via Flathub, and documentation for East Asian text input.

The modern app

A satirical article presents a hypothetical “next generation” code editor plagued by errors, popups, and unnecessary features, criticizing modern software bloat and forced collaboration. The author laments the decline of simple, functional tools and the trend of adding endless features instead of finishing core functionality.

Wordgard Release 0.1

Wordgard is a new JavaScript rich text editor library from the creator of ProseMirror, built from scratch with a simplified change representation using keep, replace, and update sections instead of ProseMirror’s complex step-based system. It is MIT-licensed and available on Forgejo, incorporating lessons learned from ProseMirror and CodeMirror.

Type definitions to retrieve objects from localStorage

LocalStorage’s JSON serialization strips methods from class instances when retrieving objects. The article suggests adding a mapping function to the get method to reconstruct objects, but notes that type safety remains imperfect because the parsed JSON is treated as the target type before the mapping is applied.

On Ditching Vagrant

The author stopped using Vagrant for VM management after 2010, finding it unnecessarily complex and preferring to use KVM and libvirt directly, as Linux can natively handle virtualization. They initially switched from VirtualBox to libvirt as a half-measure before fully uninstalling Vagrant and adopting KVM with virsh.

🏛️ Policy & Society

The US Government Is Now a Shareholder in 26 Companies

Since January 2025, the U.S. government has taken direct equity stakes in 26 companies across nine sectors, deploying $23.9 billion of a $205 billion authorized ceiling. Holdings include a 9.9% stake in Intel, a 15% stake in a rare earth miner, and stakes in nine quantum computing firms, while mobilizing $4.75 billion in private co-investment. The question now is which sectors will be targeted next.

AI can’t be listed as inventor on patent applications, Japan’s top court rules

Japan’s top court ruled that artificial intelligence cannot be listed as an inventor on patent applications, affirming that only humans can hold that designation.

The Egg Bandits Made a Thousand Times the Fine They Just Paid for Price Fixing

Three major egg producers conspired to fix prices from 2022-2025, using the avian flu as a pretext, as revealed by CEO communications. Despite the scheme raising prices, the companies paid fines a thousand times less than their illegal profits. Prices dropped once legal action threatened, and a settlement was signed by 18 states and the DOJ.

ChatControl 1.0 mass scanning is to be sneaked through via a 3rd vote next week

ChatControl 1.0 mass scanning legislation is reportedly being pushed through a third vote next week, potentially bypassing previous opposition.

Canadian boy, 11, dies of rabies after waking to bat on his face

An 11-year-old Canadian boy died from rabies after a bat landed on his face while he slept; his parents did not seek immediate medical care due to the lack of visible injuries. Nineteen days later, he developed symptoms including facial numbness, fever, and confusion, and was diagnosed with rabies after hospitalization. He died 17 days after being admitted.

Why I’m Forced to Say Farewell: Google Management Has Lost Its Moral Compass

An employee named rmayrhofer announced they are leaving Google, citing that the company’s management has lost its moral compass. The post implies that this departure is a forced farewell due to ethical disagreements with leadership.

We Don’t Have to Be This Bad at Improving Society

Decision risk in politics and business can be reduced by breaking work into small, learnable iterations and focusing on outcomes rather than predetermined outputs, contrary to the excuse of insufficient information. Citing Sigge Winther Nielsen’s book on Danish political reforms’ poor track record, the article advocates for continuous learning and adjustment to avoid costly failures.

The fall of the theorem economy

The author argues that the true value in mathematics lies in developing conceptual frameworks and definitions, not in proving theorems, citing his own unpublished but influential work as evidence. He suggests that while AI could automate the mechanical aspects of theorem proving, it may not touch the deeper creative process of mathematical insight.

Society of Saint Pius X

The Society of Saint Pius X (SSPX), a traditionalist Catholic fraternity founded in 1970 by Archbishop Marcel Lefebvre, was excommunicated by the Roman Catholic Church in July 2026 after proceeding with unauthorized bishop consecrations. The society retains the Tridentine Mass and opposes post-Vatican II changes, and is led by Superior General Davide Pagliarani with 1,482 personnel including 733 priests.

Global review confirms mRNA vaccines are safe, effective and full of promise 

A comprehensive review published in The Lancet confirms that mRNA vaccines are safe and highly effective against COVID-19, with rare serious side effects like myocarditis outweighed by protection against severe illness. The review also highlights the technology’s expanding potential for treating other diseases, including influenza, RSV, and cancer. It aims to counter misinformation by clarifying that mRNA vaccines do not alter DNA.

Emails in court filing show unease between Anthropic’s Amodei, DOD’s Michael, souring ties

New court documents detail months of back-and-forth between Anthropic CEO Dario Amodei and Undersecretary Emil Michael over safety guardrails for the Pentagon’s use of AI. The filings highlight underlying tensions between the government and the AI company, despite a recent resolution of their latest dispute.

Palmer Luckey’s Erebor Bank raising money at $8B+ valuation; deposits jump to $4.05B

Palmer Luckey’s Erebor Bank is in talks to raise funds at a valuation of at least $8 billion, nearly double its previous $4.35 billion valuation from 2025, as deposits have surged from $1.1 billion in March to $4.05 billion. The politically connected startup, backed by Peter Thiel, received its bank charter only five months ago.

AI-assisted employment claims strain UK tribunal system, backlog doubles in 2 years

AI-assisted employment claims are overwhelming the UK’s employment tribunal system, with the backlog doubling in two years. Lawyers report that the surge in AI-enabled lawsuits is straining an already overloaded system, potentially breaking it.

đź’» Infrastructure & Hardware

Manufact (YC S25) – MCP Cloud

Manufact is a new cloud platform for MCP (Model Context Protocol) apps and servers, designed to help developers ship, iterate, test, and monitor their MCPs for production use. It offers features like GitHub integration, preview deployments, automated testing across major AI clients, and tools to streamline store submissions. The founders aim to solve common challenges in MCP development as the ecosystem matures with growing support from clients like ChatGPT and Claude.

ZeroFS – A log-structured filesystem for S3

ZeroFS is a log-structured filesystem that exposes S3-compatible buckets as POSIX filesystems over NFS and 9P, or as raw block devices over NBD, with data encrypted and compressed before upload. It undergoes extensive CI testing including pjdfstest, xfstests, kernel builds, stress-ng, and Jepsen fault-injection suites on every change. The system supports self-hosting, cross-region ZFS mirrors, and offers microsecond warm reads via local caching.

Oomwoo, an open-source robot vacuum you build yourself

OOMWOO is an open-source robot vacuum that users can build themselves using a Raspberry Pi, ROS 2, 2D LiDAR, and 3D-printed parts, featuring local-first operation and native Home Assistant integration. Currently in early development, the project offers fully open hardware, software, and firmware with modular components for parallel community contribution, promising no cloud dependency or vendor lock-in.

kernel asynchronous reads in PostgreSQL 19 (io_uring)

PostgreSQL 19 can use the io_uring IO method instead of IO workers, but running inside Docker requires disabling seccomp. A query using io_uring showed similar prefetch and I/O behavior to the previous asynchronous sequential scan, with execution time of 943.470 ms, but no io worker processes appeared because the kernel handles the IO.

Sources: Anthropic begins early development of custom AI chip, holds preliminary talks with Samsung

Anthropic has begun early-stage development of a custom AI server chip and has held preliminary discussions with Samsung about manufacturing it, according to sources.

Amazon’s Leo has 396 satellites in orbit, enough for continuous service across initial latitudes.

Amazon has deployed 396 Leo satellites, enough to support continuous service in initial latitudes, with commercial availability targeted for mid-2026. However, early adopters should expect limited coverage and performance similar to SpaceX’s early “Better than nothing beta,” with improvements coming from future satellite launches.

Switch seeks ~$2B funding at ~$50B valuation led by a16z $400M

Switch Inc. is seeking a private funding round of approximately $2 billion, led by a $400 million investment from Andreessen Horowitz. The data center operator, majority-owned by DigitalBridge Group, aims for a valuation of around $50 billion including debt.

Amazon emissions rose 16%+ YoY, Google 18% in 2025

In 2025, Amazon’s greenhouse gas emissions rose 16% year-over-year due to data center construction and delivery fuel, while Google’s emissions increased 18%, driven by the energy demands of AI. Both companies struggle to balance climate goals with the fossil fuels powering their expanding data centers.

🎨 Media & Culture

24-bit/192kHz music downloads and why they make no sense (2012)

The article argues that 24-bit/192kHz music downloads are pointless due to slightly inferior playback fidelity compared to 16/44.1 or 16/48 formats, six times larger file sizes, and the irrelevance of higher sampling rates given human hearing limits. It criticizes widespread misconceptions about digital audio and sampling theory, concluding that 24/192 solves none of the genuine problems with current digital music quality.

How to ask for help from people who don’t know you

When asking strangers for help, prioritize their perspective by demonstrating your seriousness through proof of work, providing concise context that connects to their interests, and making your request low-cost, specific, and easy to decline.

AI fake news complaining about how AI fake news is the death of real news

The article describes a viral story about 1819 News buying 47 Alabama weeklies, firing staff, and using AI, which later turned out to be fabricated; the alleged dead newspapers were still operational, and key people and companies mentioned did not exist.

This blog is written in en-GB

A blogger refuses a request to make their content more globally inclusive, arguing that British English and cultural references are valid and readers can use context clues to understand unfamiliar terms. The post defends linguistic and cultural diversity, asserting that encountering different norms is not a problem.

PeerTube is a free, decentralized and federated video platform

PeerTube is a free, decentralized, and federated video platform developed by Framasoft as an alternative to centralized services like YouTube, offering community-owned, ad-free video hosting through a network of interoperable instances.

Bring back crappy forums

The article highlights the early days of web forums, noting that the first web forum software was CERN’s WWW Interactive Talk (WIT) in 1994, and examines how predictions about multimedia and anonymity shaped their evolution. The author attempted to revive WIT by uploading it to GitHub and running it in a Docker container.

I’m Begging You to Leave Your AI Note-Taker at Home

The author argues that using AI note-takers during casual in-person meetings destroys the natural boundary between ephemeral, off-the-record conversation and formal record-keeping, forcing speakers into guarded, deposition-like behavior. Unlike Zoom calls, which are inherently work-based settings, face-to-face chats serve as vital backstage spaces for authentic connection. The normalization of recording everything due to zero marginal cost robs these interactions of spontaneity and trust.

X launches Live Studio: Creator Studio hub, simple desktop, chat controls, custom thumbnails, more

X has launched Live Studio, an updated livestreaming hub within Creator Studio exclusively for X Premium users, featuring simplified desktop setup, chat controls, custom thumbnails, and audience insights. To promote the update, X is offering $1 million in creator funding for livestreamers this month, though allocation details remain unclear.

Connect, disconnect, or just have a lovely beer

The article highlights major tech developments, including SoftBank entering the GPU rental market, UN warnings about AI governance, and security threats from Russian phishing and unpatched SharePoint vulnerabilities. It also covers open source updates like Collaborative’s CODE 26.04 release and the revival of GIMP 0.54. The pieces collectively reflect ongoing tensions in AI infrastructure, cybersecurity, and software freedom.