The October 24 update broadens the affected-software inventory. Brotli is a compression format, and CVE-2026-111497 allows crafted compressed data to damage decoder memory and potentially execute code.
The reviewed Python advisory lists fixes in Brotli 1.2.1 and brotlicffi 1.2.1.0. Clients including Requests and HTTPX can enable decoding automatically when those optional packages are installed.
Envoy’s own advisory confirms exposure where its Brotli decompressor is configured. Its fixes include 1.40.0, 1.39.3, 1.38.6 and 1.37.8.
Removing br from the request’s accepted encodings alone is insufficient. A malicious server can still send compressed content, so vulnerable response decoding must also be disabled or blocked before it begins.
GitHub now lists both Python packages, with an October 23 review. That supersedes the report’s blanket claim that advisory databases have yet to map them, although individual scanners may update later.
This adds Python and proxy exposure beyond the earlier Node.js patch coverage. Rebuild affected images, restart workloads and check the libraries actually loaded.
Caveat: Exposure requires a vulnerable decoder handling attacker-controlled content, and operating-system vendors may backport fixes without adopting these upstream version numbers.
(HN · lobste.rs discovery · vendor reporting checked against Python and Envoy advisories)
New compatibility evidence for older Nvidia cards#
The project merged its tested-card table today. Its Linux kernel module changes hardware settings before the ordinary Nvidia driver starts, avoiding a patched driver.
One RTX 3090 Ti report measured 87.50 versus 157.41 trillion matrix operations per second at a 450-watt limit. Both used lower-precision inputs with full-precision accumulation.
Other reports show 14–36% faster prefill, the model’s first pass over a prompt, before it writes anything. The project says memory-limited token generation and eight-bit integer work remain roughly unchanged.
A separate 3090 Ti report found about 5% end-to-end improvement in an integer-heavy serving setup, within run-to-run noise. The compatibility table also records a 3080 Ti variant that stayed at half rate.
Installation changes early-boot files and requires explicit activation. Suspend recovery has its own controls, and hibernation is outside the documented coverage.
Caveat: These are community measurements under different power limits and software setups, so the matrix gains are neither comparable speed rankings nor guaranteed application improvements.
(HN 133 points · 50 comments)
An open licence for searching your Markdown notes#
The October 24 change adds Apache-2.0 and aligns previously inconsistent package declarations. This is a source-licensing change, rather than evidence that hosted services became unrestricted.
Enzyme indexes Markdown folders, tags, links and dates for a coding assistant. An agent is a model running a multi-step task with tools.
Search combines wording and meaning locally. Generated questions, called catalysts, suggest connections across notes, while results return the underlying passages and file paths as evidence.
The documented integrations include Claude Code, Codex and Hermes. Exact names and phrases remain better suited to ordinary search, according to the project’s own guidance.
init and refresh support local-model or no-generation modes. Markdown compile, which proposes what to index, uses a hosted operation; the README also describes login requirements for refresh and additional vaults.
Caveat: Local search does not make the default setup private, because hosted selection and question generation can process material from your notes.
(lobste.rs discovery · repository, licensing commit and documented data boundaries)
The October 21 study examines fourteen models using ten chat topics, five coding repositories and seven essay assignments. Today’s HN discussion surfaces previously uncovered research, rather than a new paper revision.
Across nine frontier and near-frontier models, the authors find more unusual word combinations and inanimate subjects paired with normally animate verbs than in human references.
Translating sentences through Japanese and back often reduces these features. Stacked nouns and long grammatical dependencies also decline in chat and coding, while essay results are less consistent.
A controlled experiment rewards Qwen2.5-1.5B-Instruct for producing shorter valid sentences. Without a penalty for departing from the starting model, positive length penalties produce over 98% short-form choices in both trained “that” constructions.
Model differences matter: Opus 5.5 scores lower than Opus 5 on nineteen of 21 difficulty-linked comparisons. Eight have non-overlapping 95% uncertainty intervals.
Caveat: The English-only study measures linguistic proxies for difficulty, rather than directly testing reader comprehension or observing the frontier models’ actual training procedures.
(HN 82 points · 70 comments · arXiv 2610.29162)
Dessa’s newly aggregated launch report → THIN_GUARD: Morning already inspected the same launch and waitlist. Another outlet supplies no verified new release or evaluation warranting a reversal.
Dream-1’s robot-control API → OFFSTACK: the inspected release requires robot hardware and carries vendor-controlled transfer tests, outside this edition’s practical software and self-hosting priorities.
Apollo’s claim of no AI payoff outside tech → HYPE: aggregate revenue and margin comparisons cannot establish that every non-tech company received zero benefit or isolate AI’s causal effect.
The reported Replit model-spending deal → LOW_UTILITY: a reported private commercial discount supplies no generally available price or inspected integration change.