Latest Posts (20 found)

An Interview With Roblox CEO David Baszucki About Aggregating Play

Listen to this post: Good morning, This week’s Stratechery Interview is with Roblox CEO David Baszucki . I’ve interviewed Baszucki twice, in February 2022 , and November 2023 . What struck me about this interview is just how much AI has changed the landscape for Roblox. This was a company predicated on the concept that anyone can make a game, but now, for the first time, literally anyone can make a game. That means a world of abundance, and in that world, there is an opportunity to be an Aggregator, and Roblox is aggressively pursuing that opportunity. To that end, we discuss how AI has changed Baszucki’s view of what is possible, what goes into a game creation harness, making games on your phone, and the power of recommendation. Then we talk about Roblox’s vision of a universal player, where a Roblox game works everywhere, and Roblox Everywhere, where Roblox developers can use the platform beyond the Roblox app. We also touch on advertising — the natural Aggregator business model — and whether Baszucki still thinks he is building the metaverse. As a reminder, all Stratechery content, including interviews, is available as a podcast; click the link at the top of this email to add Stratechery to your podcast player. On to the Interview: This interview is lightly edited for clarity. Topics: The AI Impact | A Game Creation Harness | Roblox Build | Roblox Discovery | Universal Player | Roblox Everywhere | Advertising | Metaverses David Baszucki, welcome back to Stratechery. DB: Thank you, Ben, for having me back. It’s great to be here. So this is the third time I’ve interviewed you, and I want to sort of put that in an interesting context. First, you started Roblox in 2004, you went public in 2021, you first talked to me in 2022 and again in 2023 , that’s like a nearly 20-year stretch. Now it’s 2026, and here’s my question: Is the world more different for you now, compared to three years before, than it was for the entire first two decades from starting the company to the last time we talked? DB: The changes in the world we all feel are sure happening a lot more rapidly. When we first published Roblox — I don’t know if people on this podcast remember — software used to be distributed on floppy disks and CDs. You know, the funny thing is, you’re the second person I’ve interviewed in the last two or three weeks where we’ve referenced back to fact that the reason we say packaged software is it used to actually be packaged! DB: It’s been crazy, we had the Internet, when we started the company, we had the vision of a category called immersive co-experience, sci-fi writers have been writing about the holodeck forever, and we went along our way. I’m still pro-metaverse, we can use the word metaverse, it’s okay. DB: Okay, good, we use them all. It’s Snow Crash — metaverse, holodeck, they’re all good. We started on this vision of building human co-experience, we saw the mobile age come across us, we saw the crypto age. The AI acceleration wave we’re in is faster and bigger and crazier than anything I’ve ever seen, it’s changing how we think about the product, it’s changing how people are going to create games. What’s really exciting is, when we started the company, we had this slogan called “You Make the Game”. DB: We started with that slogan, we learned along the way that the ratio of people who might want to play games to make games has drifted — more people want to just play games than make games, because historically making games has been Roblox Studio and 3D editing and writing script. We could be approaching the time where “You Make the Game” really comes true, and where making a game is accessible to everyone. It’s really fun, I’ll tell you a bit about some of the experiments we’ve been having with Roblox Build . But we’re entering an era where making a game could be as big as playing a game. I’m right there with you. We’re obviously going to touch on all those points, I think it’s probably predictable what we want to talk about. But to go back to 2023, you called AI then, “a super paintbrush and a super 3D modeler, rather than a full replacement” — Is that still how you’re thinking about AI? DB: It’s what the data is proving out. We just had our earnings call a few weeks ago , we highlighted a lot of acceleration. One, there’s various ways humans can augment with AI on Roblox, they can use MCP , which is like plugging in a model, they can use the Roblox AI assistant to help build. And what do you mean with that MCP server? You mentioned you had 5x growth quarter-over-quarter. That’s where you’re actually using Claude Code or Codex or whatever to work with Roblox? DB: People are plugging in, we can see all of them — Claude Code, Codex, other models — all being plugged into Roblox Studio to help build things. We’ve seen two games hit the top 20 made by AI, we have other metrics like the number of assets. What do you mean by “made by AI”? Because you also said 80% of games in the top 100 have AI-contributed content. DB: Touched by AI, vibe-coded directly with AI, and we can see the count of assets accelerating. DB: It’s turned out to be, I believe, somewhat faithful to what I said. This is a human paintbrush accelerator, good ideas are still very important, novel types of gameplay are very important. But people are able to flex their creativity much more quickly. We have members of the Roblox board of directors carrying a mobile phone around, building games like 15 times a day. We have people who are not necessarily engineers or product managers now building within the company, so we’re really at the dawn of a new era. You mentioned the super paintbrush, super 3D modeler, is there a super gameplay developer? Because there’s a large step between, “I have an idea for a game”, versus the actual mechanics of the game. How much can the AI do to help you as far as that goes? DB: You’re touching on the dream of what is a game creation harness versus a coding harness . Dive into it, this is super interesting. Lay out the difference and the way you’re thinking about that. DB: So everyone’s getting familiar with coding harnesses — Claude Code, Cursor, Replit, Lovable, Codex, you name it. A game is arguably much more complicated than code. As you mentioned, there’s art, there’s 3D objects, there’s scenes, there’s avatars, there can be gameplay code, there can be missions, and there can be code underneath it. So a harness that is being created to create games really has to run in multiple modalities, needs to listen to you, and if you said, “I would like a multiplayer tortoise-and-the-hare game that 100 people can play, and we’d like to do it on Venus, and I’d like it to run on all devices” — there’s a lot of different things that need to be generated there. The avatars, the assets, all of that, as well as the gameplay, which I think is a very human thing — your idea of what type of a game it is is actually very unique. So one of our board members is building a hybrid kind of Wordle-crossword game with his own vision of how this crossword game should work, and that’s very unique to him. I’m optimistic we’re still seeing that notion of a human coupled with an accelerating paintbrush in essentially a very complex harness for building games. There’s so many pieces you talked about. The asset creation piece, compared to 2023, much further along, arguably there. You could have even the video component, or the moving worlds, but then you almost have these different pieces. Do you have to build — is there going to be one harness, and one sort of — we’re going to get to your Build app in a little bit — that handles all of that? Or are you still thinking we need to do this piece-by-piece as the model gets good enough for, or we need different models maybe for the different parts of this? DB: I think just as we see with harnesses that are routing different models, even for coding now, a lot of companies have multiple models running side-by-side and their harness is optimizing. Our harness inside Build and inside Studio Build is running not just multiple models for certain things, but then there’s a second dimension of, “Are we building a scene?”, “Are we building a 3D object?”, “Are we building code?”, “Are we building an NPC?”. So yes, we are routing both by kind of specific asset that’s being created, as well as multiple models within each of those, and we’re combining some areas where we have incredible data on Roblox — for example, data that can be used to help create non-player characters, characters that act normally, side-by-side with you. But there’s also really good coding models out there, both open source and frontier, and so we see a harness being able to put all these things together. What’s the mix of those models? Say we have three categories — frontier, off-the-shelf open-source models, and models that you’ve trained specifically. And I guess even there there’s two categories, are you doing foundational models on your own, or just doing some post-training? DB: We literally have all three of those running in our Build harness. And we’re, in certain cases, optimizing the cost of frontier with the capabilities of open source. We have a Cube model — we’ve announced it — which is trained on 3D assets. Yeah, super interesting. Tell me about the Cube model. DB: The Cube model is our own 3D asset creation model trained on all of the 3D objects inside Roblox, where the developer has opted in to the training. It’s very fast, it’s very efficient, and it runs on our own hardware. When you go into Build or I go into Build and I say, “Hey, make that tortoise-and-a-hare game”, and if you describe that tortoise as somewhat unique and different, “I want the tortoise to look like this, and have a fur that looks like this, and maybe have this”, that Cube model will and may come into play and generate that tortoise for you. How does your cost structure work for this? Is it a usage thing from a developer perspective? You have the MCP server — that’s where they can bring their own, what’s the mix? DB: You sound like a product manager, because these are exactly the same discussions I had about an hour ago. The ultimate vision is something like Roblox Build is just like the creation of short-form video. Short-form video 10 years ago — all of a sudden we all figured out we can make video and edit it on our phones, amongst multiple products that was like a huge revelation. We are so on the same page, I have a whole section on short-form video later in the interview. That’s good foreshadowing. DB: Yeah. And so along comes short-form video, and we have phones, and all of a sudden we’re making and sharing video. Arguably games are a lot more complicated, they can be immersive 3D environments, multiple people can come there. They have, as I was saying, code and geometry and avatars, but that’s where Build is going — that same notion of, “I’m going to pull out my phone and create something”, some of those models are still expensive. But the dream is, we’re already testing — I think Canada went live today. We’re testing in, I think, Serbia and New Zealand, we want it available for everyone and so it creates a wonderful opportunity for us to be super efficient with our models while super powerful. It creates the opportunity for those users who want to just do hundreds of iterations to have them buy tokens as well, if they really want to dig into it, so we’re optimistic this will be free for everyone. You keep mentioning Build, I’m on your website , and this is how you describe Build: “Build is a new way to make your own Roblox game right from your phone. Just describe the game you want in your own words, and Build’s AI creates a playable game for you in real time. You don’t need any coding or game-design experience – if you can describe it, you can build it. Want to change something? Just tell Build what to adjust, and keep going until it feels right”. Is this what you always wanted? Are we going to look back and say Roblox Studio, your pride and joy, was just a stepping stone to this? DB: This was a sci-fi fantasy when we started the company, and arguably a fantasy we never thought would come true. I would say when we started the company, we couldn’t have imagined it, and for many years, I think many people in the industry were always trying to figure out ways to make editing 3D easier, “Oh, that’s a really easy consumer 3D modeler” — even the best consumer 3D modeler is still pretty complicated. It’s unbelievable, my current 3D experience right now is, I’ve gotten very into 3D printing and I’ve never opened the associated app for it at all. It’s all done in the AI and just goes straight to the printer, it’s unbelievable. I appreciate all those people who did all the actual modeling and stuff for the last few years — I’ve skipped over all of it, but it’s the same thing in digital space. DB: I would say in the last five years we started to see that maybe AI can do this and I would say it’s been in the last two to three years where the rate of acceleration has started to surprise people and as that rate of acceleration has started to surprise people, this dream becomes much more possible. There are games on Roblox right now that are earning money that have been made with Roblox Build. We have not tens or hundreds, but thousands of games that have been published in Roblox Build. It’s not live in the U.S., we’re testing, and it will be soon, so the data is already out there. What’s so interesting is you saying, “We couldn’t have imagined it”, because one of the things in our previous interviews that came across again and again was the continuity of your vision and like, “Yeah, we saw this back then, and now we’re getting there, and we’ve had this vision all the way” — and that sort of goes back to my first question. Is there almost been a break in the last few years where even you are like, “Holy cow, I didn’t know this is where we were going”? DB: I feel like all of us in the technology industry are feeling that — everyone, CEOs, programmers, people who use these products, consumers. We’re all in the middle of it, I would say, over the last several years. Do you think this makes Roblox more or less valuable? If anyone can make a game, is Roblox Studio, your jewel, not that big of a deal anymore? DB: I think what really ends up being valuable is the combination of a few things. We’ve shared the notion of Universal Player, that I’ll dive into, the notion of Roblox Everywhere , the notion of the power of distribution platforms becoming more and more powerful when a game is created, “Where do I find it?”, “Where does it run?”, “How do we keep it safe?”, “How do I play it with my friends?”, “Is there an economy?”. So in a way, distribution platforms become more powerful. It’s worth thinking about it like — pick a distribution platform, whether it’s TikTok or YouTube, in a way, AI can accelerate those platforms, but in a way, those platforms have enormous strength with or without AI and even though someone could reproduce the whole YouTube platform with AI — the cloud, the client, all of those things — people are still going to go to YouTube to watch video. Yeah, this is the connection I was drawing — going to the short-form video platform idea. I’ve always drawn a distinction between distribution and discovery , distribution is free — anyone can post a website, at least generally speaking, they could host a game on their website, they could host a game on Vercel or wherever it might be. But then discovery is, if there’s a gazillion games, how do you find what you’re looking for? Of those two, what do you think is more important for Roblox’s future? DB: They’re both enormously important. The Roblox platform itself has well over 100 million people coming every day. On the discovery side of our platform there’s two angles to it, the first is, what happens when everyone’s building a game? All of a sudden, in the old days, there’s an abundance of new games and experiences. How do we connect the right person with the right game with their friends? Even in what might be called AI slop, there can be amazing games embedded in that AI slop, even if it’s 1 in 100 and even when games are crafted by hand, there can be some of those games that just aren’t interesting to people, so discovery becomes enormously important. What we have going on — and with the opportunity going on at Roblox — is that in addition to traditional discovery, which is optimizing every user-game pair and predicting long-term retention from that connection, with more and more games, content understanding becomes incredibly important and because Roblox is a platform where all of the games are running in the cloud, we can examine the content, learn from what we’ve learned, and maybe say, “This game has an interesting, new, diverse way it’s been constructed, this game looks a lot different than other games”, and that can help surface great content to new users. The other thing, in addition to on-platform discovery, is this notion of Roblox Everywhere that we’ve shared. Let’s get to that, I promise we’ll get to it, because I think it’s super interesting in this context. But you’ve gotten much more into — you mentioned matching players to the right game, what have you learned from getting into recommendation algorithms? The path — I keep referring to it — but this is the social-networkization— DB: Yeah, it’s very different than video, because a game is something a user can play multiple times, a game is an environment where friends can have fun. Some good games last for years and years. You know, Adopt Me has been on the platform forever, so finding an Adopt Me that creates joy for a long time is very, very important, rather than a one-shot video. I think what we have learned is to optimize for longer-term retention rather than short-term retention. Well, that really hit your earnings when you made that shift a couple quarters ago. What was your thinking? Is that what you expected? DB: I don’t want to comment on hitting the earnings, but I want to comment that mathematically, if we can raise long-term retention — which means more people stay on the platform, more people have a good time, and, like I mentioned with Adopt Me, find games they might play for 10 years — that pencils out. And retention is critically important in growing users and growing word of mouth and growing all of those things, so we’ve gotten better and better at optimizing long-term retention. We measure it directly, we measure the contribution to long-term retention from every user-game pair. We see interesting things — different types of groups of people like different types of games and I think if we go to the Roblox home page, for example, and I play, or someone else plays, I think people are universally saying, “Oh my gosh, those are more and more looking like games that I’d like to play for a long time”. You told me in 2022 that Roblox’s initial product failed because it wasn’t multiplayer and social and that was one of the foundational lessons of the company. Now you’re enabling offline single-player games. Have you moved? Is this what has changed? What’s shifted, where — yes, of course you’ve mentioned the social aspect multiple times — but also there are games people just want to play, a great game, on their own? DB: I feel long-term the foundation of Roblox will continue to be multiplayer, friends coming together, that may be in real time, that may be asynchronous, that may be “I take a turn, you take a turn”, that may be I play a match-three puzzle at some point and compare it. What the move to single-player, the move to puzzle, is really saying with our aspiration for Universal Player and Roblox Everywhere, we have enough bandwidth now to cover the whole spectrum. When we talk about the notion of Universal Player, the notion is going all the way from a traditional 2D offline puzzle game, all the way to that which is yet to be invented — which is super high-scale multiplayer, photorealistic reality — and everything in between. So the vision with the puzzle game, as well as Roblox Reality, is going back to the video analogy. In a way, with video, the camera and the player have been somewhat invented, we have cameras all over, we have 4K, 60-hertz playback, we have playback mobile, we have playback in our living room, and so all of the video out there generally will play back on my living room 4K, 60-hertz TV. That’s not true in gaming. There’s not a universal rail, where every game as of yet invented, as well as to be invented, you could imagine it playing there, so that’s the notion of 2D puzzle and Universal Player. Presented by Agentic commerce purchases with Link, Stripe’s digital wallet that works surprisingly well for agents, grew 38x in September. The catalyst was consumer agents like Muse and Instinct. Filling out a web form is not a value-add activity for anyone. No one chooses to fill out web forms in their spare time. That’s why these agents have been particularly useful. I’ve written about how these platforms are giving ordinary people an AI agent with a computer, enabling agents to do genuinely useful things on our behalf.  When one of those things is spending money, it needs a wallet that knows what it is, and isn’t, allowed to do. Stripe has learned that’s really about deciding how much freedom to give it. You might approve one purchase, or give it $500 for flights this week, and let it figure out the rest. The wallet’s job is to keep it within those lines while handling everything between “go buy this” and the purchase actually happening. That’s what Stripe is building with Link: You approve what it spends, it can come back to you if the final price changes, and eligible purchases can even come with protection if the agent makes a mistake. You can use Link on Muse, Instinct, as well as many other of the agents you might use already. So step back and explain Universal Player, broadly speaking — both in terms of the different surfaces, and also bringing in games from other platforms into the Roblox experience. DB: Part of this comes — I’ll come at it first from an AI angle, and then a puzzle game angle. From the AI angle when we hook either our Studio assistant or an MCP model up to Roblox Studio, and you or I say, “I’d like to build this”, there’s still technical constraints, if I hooked up MCP and said, “Build a game that happens in the state of California, make it a 3D multiplayer environment, I’d like it to be photorealistic, and I’d like it to be able to have up to 100,000 people all walking around and driving cars” — not technically possible. But we do want to push towards that — once again, multiplayer high-scale photorealism — as quickly as possible, and make a place for anyone who’s either imagining a game or building it with MCP server, or, as you mentioned, ultimately bringing in a game they maybe have already made and converting it to that type of environment. So if we have a Universal Player, that’s a superset of all games that can run multiplayer. You could imagine that if you had a puzzle game that’s offline, connect it up, bring some of the source code in if you want to, and we’ll convert it to Roblox. Or you had a single-player high-res game, we’ll convert it to Roblox and in that conversion process, a couple other cool things will happen. We coined the term “Robloxification” — it’s really what’s different about the Roblox architecture. Your single-player game from a PC can now be multiplayer by default, because we’re running against a cloud. Because we’re doing 3D streaming, your single-player game will also run on a phone — oh, it’s being Robloxified. Your single-player game, rather than being a 500-gigabyte download, you can just join it immediately, that’s very interesting. Your single-player game has access to economy and other things so the notion with Universal Player is really both convert, as well as Robloxify, existing games as well as new games. Is this leveraging — to go back to the discovery versus distribution — is this leveraging the fact that you want to get into Roblox’s discovery engine? There’s people on Roblox, they’re not going to go download your game individually, they’re not going to go to another website. DB: That’s exactly right, in that a game brought into Roblox Everywhere in our Universal Player will then be available in the Roblox app. And as we thought about it, what a great way to discover more content than to have great games out there that are also discoverable in the app. This is the analogy — to go back to the short-form video — where you had this story with Meta versus TikTok. TikTok realized that it’s called a social network but it’s not really a social network, it’s just really giving you the videos that it thinks you are going to like, and who you follow doesn’t have anything to do with it. Meta is stuck in their social network, “That’s what makes us powerful”, and to compete with TikTok, to make Reels into a thing , they had to let that go, “We’re just going to give you what you want”. Is there an analogy there to your embracing single-player games, to you having recommendation algorithms? And sure, Meta will tell you the social network part is important, will always be important. Is that analogous to you saying, yes, the social aspect of Roblox is important, will be important, but actually to truly grow, to reach your full potential, you have to actually atomize a bit more and meet the player with exactly what they want? DB: Yeah, I think if anything it’s even bigger than that, I’ll go through three realizations. The first realization that we’ve come to, looking at the physical world, when people play — whether they’re playing sports or a board game or any form of play, jostling around with friends — it’s typically not just play, it’s playing, it’s connecting, it’s community, it’s creating the play, “What are we going to do?”, it’s sometimes watching other people’s play, it’s dressing up to play. And so we started thinking about the market, not as the game market, but the play market, and how all of those pieces really work together so that’s been a bit of a stretching, rethinking things for us. The second is, when we say the play market, we can no longer just say, “Well, Roblox is a 3D multiplayer game engine”. You were constraining yourself. DB: That’s right. All of the constraints, I think, in the past that helped us focus and grow at a certain scale have to flip from focusing constraints to constraints we give up on. What was more difficult — convincing the company we have to let those constraints go, or did you have to convince yourself? Because again, two things that really stood out. Number one, you had this long-term vision, and it’s actually been continuous, and now you’re saying, “Wow, this has been a big shift”. But then number two, this being focused, “This is what we do”, and now you’re like, “Well, actually, no, we need to let that go and do everything”. DB: We’ve gone through several of these. The early version of Roblox was PC and Macintosh. We, for a while — if you can believe it — there was no mobile phone version of Roblox and when we looked at the iOS App Store top 100, there was no 3D game in the top 100. China was a little bit ahead, they were starting to poke at it, the U.S. was not. Giant company debate, “How could Roblox ever work on a phone? The phone is 2D. It’s not going to work”. Luckily, mea culpa, we went for it and now we’ve gone through that transition. There’s also a time on Roblox, very early on, we thought the blocky look was so simple and easy to build with, we wouldn’t allow the importation of 3D mesh objects, we mea culpa’d it, because ultimately we want all styles of game. And so I think 2D and offline is kind of one of the last holdouts for that, in saying it’s really the play market, and we can’t constrain that anymore. Are you pushed into this market, or are you pulled — just the market opportunity is so large? DB: I think it’s so much more fun and simple to just say, “We’re going after the play market”. (laughing) That’s right, let’s do it all. DB: We need integrated and safe ways for community, we need integrated and safe ways to find great games to play with, we need all of that just in a simple — it’s actually a simpler product spec and a more fun product spec. Does that mean, you as a company, you’re more defined by — maybe you’re like supply-defined, where, “What can we do, and this is what we’re going to deliver”, and now that’s sort of flipped to, “What’s the market and how can we fill that market?”. DB: Yeah, I think it leads to all kinds of interesting features of the product. For example, short-form video is traditionally used for watching by yourself. Imagine something that feels like short-form video, where you’re seeing the 3D game where your friend is already playing, and it’s a way to find a friend and jump into a game. Right. We made the short-form video comparison, but you’re literally doing short-form video. DB: Finding 3D ways to discover is super interesting, finding ways to connect with your friends is super interesting. I feel this singular vision on play is a category that’s got legs and I think the thing that is yet to be figured out is how big is creation versus playing with friends. What I have seen with the early players on Build is, there’s a lot of joy in making a short-form video on one of these platforms and having your friends see it. That happens in spikes and I’ve seen people do that. The joy I’ve seen of people creating games on Roblox and literally sitting there with their phone and saying, “Oh my gosh, I have four people in my game, and those four people are playing my game, giving me feedback” — I’ve seen that be really powerful. That’s interesting, because the feedback mechanism — you can act on it. If someone gives feedback on a video, it’s just a comment on a video. DB: And like I highlighted, board members doing 15 modifications a day to their game so that four people turns into six people. That’s really interesting. It’s like there’s a 3D aspect to gaming, as opposed to the 2D aspect of a video. This is almost like a 4D aspect, where the interaction — it’s a social network in a very different sort of way , it’s around this object that could evolve and move with the interaction over time, I think you do have a 4D product. DB: That’s right. Well, we use the term 4D lovingly in our physics engine, because 4D objects are objects that have behavior and code and do things, rather than static objects. The other topic you’ve brought up continuously is Roblox Everywhere. First, explain what it was — I have some questions about this that are connected to what we’ve been talking about. What is Roblox Everywhere, from the top? DB: We shared earlier, our jump from PC, Mac, “Oh my gosh, we’re doing mobile, could it work?” — and then we shared some of the other changes we’ve made along the way. One of the things, for quite a while, we’ve held on is: 100% everything is in the Roblox app. DB: But as we’ve seen our vision of the Universal Player — the vision that, whether you build on Roblox or you convert or you use AI, below the rails, Universal Player is the place a game can be constructed and run at scale — as we thought more and more, all of a sudden the power of what is the Universal Player becomes appealing, not just in the Roblox app, but possibly for a creator who wants to ship a standalone game in the iOS App Store, the Google Play Store, on their PC, on a console. And as we thought through it, the benefits of giving creators access to the Universal Player, even when they’re not in the app, brings an enormous advantage to us, which is that their content can then be available for discovery in the app. That gets to my question. Okay, I’m on board with the releasing, let’s be on all devices, let’s not just have blocky characters, let’s have 3D characters, all the things we’re talking about. But I’ve been framing this whole discussion — we’ve been comparing to short-form video, which is an Aggregator play. You own the end users, you own the consumers, you have Universal Player, people can bring their games in to reach the customers, you have an advertising business that we talked a lot about last time, I have some questions about. Roblox Everywhere seems to be like the whole company is now flowing in one direction, you have the Roblox place — if you want to make a game, go there, there’s customers there, there’s monetization there, it’s all there. And now you’re like, actually, let’s open up a trap door and let everyone go out the side, am I the one that’s now being the wimp and saying, “Can you be a little bit more focused”? DB: I appreciate your insight there, but what’s really exciting to us is the potential to get such a large percent of the gaming market running on Roblox Everywhere, and the potential content explosion that happens within our app. The way we thought about Roblox Everywhere is, if you’re a creator — you might be an indie creator just pushing a small app, you might be a large studio — the more we can have both the most amazing technology platform, really Universal Player, and the more it makes absolute sense for you to run on that technology platform, whether you’re in the Roblox app or standalone, we get the benefit of that content in our app which is social, which can be launched instantly, which shares a common social structure, which carries a common safety structure, a common economic structure, all running together. So our calculus — and as you said, maybe it looks risky or whatever — but our calculus is actually, this is the best way to grow users in the Roblox app itself. Yeah. Well, it’s interesting because I think this gets on the — I’ve been drawing the analogy, we’ve been drawing the analogy jointly, between short-form video and gaming. But to your point, gaming is still a lot more difficult and if you go through the history of gaming over the last 40, 50 years, this has been a trend is over time, just the cost of developing gets so large, you need to be multi-platform. The PS3, one of the all-time examples, builds this super complicated, powerful architecture that no game ever leverages, because the cost of creating HD assets is so much higher . They need to be on Xbox also, they need to be on PC, and so everything goes multi-platform, Sony responds by doing the exclusive strategy, etc. Is this a similar articulation, that making games is hard, and so if we don’t make it so developers can run their games everywhere, they’re not going to be on Roblox either? DB: It’s really hard and right now there’s a bifurcation, a lot of times, between that super cool high-end PC game I see and what I can run on my two-gigabyte Android phone overseas. Those typically are different products. And so you’re trying to make the whole world the market for a developer — if you build on this, the whole world will be your market? DB: Imagine if it was technically feasible to build for super high-end AAA multiplayer on a PC, and connect to the same game on a two-gigabyte Android phone overseas. That’s a technical opportunity, we think, for creators. How is that different from streaming? Like, you stream a console game to your phone, what is different about what you’re proposing? DB: There’s a very creative history of what is called game streaming, where the game is run far away, I send my keyboard and mouse to the game, and then video comes back. (laughing) Right. And it sucks. DB: And this was even 20 years ago — Gaikai, OnLive, OTOY — we’ve seen a long history of this. You said it sucks, the way I would say it is, some of the things we’re doing in our video — you and I are on a Zoom call right now, when I look at my character, my character’s reacting instantly, I feel like I’m looking in a mirror, in a pure video streaming architecture, I might move 50 or 100 milliseconds later than when I do that, and people are very sensitive to that. If you’re close to the video server, maybe it’s pretty fast but I do believe having local 3D instantaneous feedback is super, super critical. So that could be one reason why video streaming just hasn’t kind of exploded as much as we thought. Is there an issue where streaming — they’re trying to retrofit what existed, and you’re natively building for this experience, and that makes a difference? DB: We want native 3D, you know, we want multi-device native 3D, very low latency happening on those. There’s some other dimensions where gaming is getting more difficult as well. The regulatory environment — it’s not like the old days if you or I make a game. There are different laws in every state and in every country, cultural laws, all of those. One of the opportunities is to have a platform that can automatically adjust to that — what are all of the rules around age, around ratings, around all of those things? That’s another thing that can help a creator reach the world without having to think about all those things. How do you think about monetization for the Everywhere games? Is there going to be like a platform fee, like a Unity sort of aspect? Or is the payoff, “If they’re building using our technology, they will also be in Roblox, and that’s where we’ll make the money”? DB: We shared at RDC the notion that monetization may be somewhat similar for games Roblox would publish. And so if you went to an app store, there may be some games published by Roblox that are the exact same games that are inside Roblox. We would only do that with the developer’s permission, but it could be really cool — you could go to your app store and search for “Grow a Garden” and say, “Oh my gosh, there’s the game”. For games where the developer is pushing directly to the app store, we haven’t shared the economics but in the thesis of what I said — which is eliminating any reason for the creator not to think about it — that leads to the economics needing to be pretty provocative and so stay tuned on that. Where is advertising fitting in this and your vision overall? Give me the advertising update. We spent a lot of time on that three years ago. DB: We shared on the earnings call that we’re more and more excited, and we’re all in, not just on Roblox platform advertising, which is growing, I think we shared that’s growing very quickly as well. As creators come into Roblox and use Roblox Studio Assistant or Build or MCP, “Okay, I need to get some initial traction, I need a thousand users”, those ads are available on the Roblox platform. And isn’t that the great thing if it’s abundance, there’s too many games, you have to discover it — user acquisition ads are very profitable. DB: We have seen an acceleration of that type of advertising and to take that all the way back to the prior analogy, we have board members on their phone buying advertising. (laughing) Conflict of interest, they’re bumping up their own stock price. DB: There’s a second type of advertising that, more and more, is becoming available, which is very short, five-plus-second skippable pre-roll video. There was a time, way back in the history of Roblox, we tried pre-roll video, it was not a good experiment. The quality of the video was not super exciting, pre-roll video at that time was 30 or 45 seconds. Technically it was a pain in the butt, and we yanked it out because we didn’t like the user experience. That kind of left us with, for a while, “Uh-oh, no pre-roll”. But today, the fun and the quality — if we’re very selective of the brands, and we could imagine the brands that are interesting to a 21-year-old Roblox player — clothing brands, electronics brands, movie brands — where they might actually say, “It’s pretty cool to see this”. We also, because typical games on Roblox launch not quite instantaneously — they launch maybe in five or six or seven seconds. Right, you have time. DB: There’s actually a beautiful technical overlay there, if we do it right and do it natively, to put this all together so we’re very excited about this potential combination. Is there an aspect where companies, especially when they’re first doing advertising, they overthink it? Like, “We have to have the world’s most inventive ads, there’s going to be billboards in the game, and these experiences” — and actually, no, just show a pre-roll video, it’s fine. DB: I think that’s right. I think we have a history of thinking big, and I do feel ultimately there’s going to be a wide range of types of branding that people do. There’s a lot of immersive 3D potential for literally shopping in 3D and doing all of that but there’s also an enormous quantity of pre-roll video. Right, you can get to that eventually, there’s actually a lot of low-hanging fruit, it feels like a lot of first-time advertiser platforms — they’re reluctant to pick, and then they’re like, “Actually, let’s just pick the low-hanging fruit and go from there”. DB: I think that’s right and I think in a COPPA -compliant, privacy-compliant, Roblox-values-compliant way, we can still imagine amazing user experience for advertising. Does this tie into the potentially provocative pricing for Everywhere? Where you make a game, it’s everywhere, congratulations — but if you want to actually make money, you’re going to need to be on Roblox and that’s the best place to spend money to acquire users. It’s better than spending on Meta, better than spending on wherever else it might be. DB: You could imagine, in under 18 on Roblox, we’ve shared we may have literally 20% of gaming revenue in the U.S. flowing through the platform and so that’s huge penetration in that age group. As we move towards that same penetration over 18, all of a sudden the value of advertising on Roblox for my new game becomes more and more valuable, because those users are already there. Are older players like your great white whale? I think every time that we’ve talked over the years, it’s always been, “We’re going to expand into older players”. When is that the reality, as opposed to the opportunity? DB: Reality is right now, the fastest-growing thing on our platform is 18 and up, it’s growing very fast. Are you getting new users, or is it people aging into and sticking with Roblox? DB: Absolutely, both. It’s a smaller cohort than the under-18 thing. But as it becomes an increasingly larger percentage of our revenue, it will more drive the growth rate of the top end as well. And how does that relate to the single-player offline, new types of gaming, puzzles, and all the things you’re talking about? DB: I think there are some of those segments that are very much 3D multiplayer, some of those segments are puzzle. There’s an overlap in that, as we think about the whole play market and we don’t restrict any types of games going forward, we have more opportunity to really create a good chunk of that market and once those users are on our platform, they’re very valuable, because other games can be attractive to them as well. In our first interview you talked about how you deliberately avoided paid acquisition, because organic virality was so essential to Roblox, in part because of the social aspect of the games. DB: I think we were careful with it. It’s a much bigger thing now, right? DB: For under 18, even in our early days, we experimented with paid acquisition, but we are very careful with always getting a return on the spend, and always knowing that organic viral had to be the biggest, but there still is a logical amount to spend. And we’re doing the same on over 18 right now, we are mixing organic with paid, there’s an optimal mix of them. We always want whatever we spend on acquisition to make incremental revenue more than what we spend and we are sticking to that hygiene. So it does make sense for us to do the paid acquisition. Is Roblox a metaverse? Is that still the dream? I like the word, no one else does. DB: I feel it’s weird how that word kind of came and went a bit but I think over time, maybe that word will come back, right? Because in the ’80s, ’90s, and 2000s, that was a very popular way of describing not just a gaming platform, but a communication platform — a place where people came together to play or to work or to do a bunch of things. I do feel ultimately, beyond gaming, that still makes sense. This Zoom call, at some point, will be a 3D simulated metaverse call, and we’ll be able to run in traditional 2D mode, and we’ll be photorealistic but if I wanted to go and look at that globe behind you, and I asked your permission, I said, “Ben, can I come and see the globe?” — you’d say fine, hopefully, and I’d come and look at it. And that’s something we can’t do on Zoom that will be unique to, ultimately, a metaverse call. It is a very cool globe. I got it at an antique shop. It has, like, a barometer in it, a thermometer, and it actually lights up — it is a lamp, also so it’s my background. DB: I love globes, I love telescopes too. Well, there you go. With the metaverse, with this 3D world, you just talked about a real-world thing, you could come into my room. But to go back to the example, you mentioned the developer that wants to build the state of California and driving cars around and 100,000 people, is this ultimately going to be realized, not through polygon drawing, but it’s all just going to be AI-generated ? DB: I don’t think it’s going to do that, and the reason we’re building this Roblox Reality architecture — and I’ll share a bit about it — is we do want, “What’s the quickest way to get to multiplayer, photorealistic, immersive gaming?”. Multiplayer is where the fun part comes in, and it’s why we talk hybrid. So in the movie business, there’s several famous directors right now who are going hybrid and what they’re doing is, they’re either shooting live actors, or they’re building a very rough scene for their movie in a 3D system, then they’re taking the 3D information and they’re upsampling it with an AI model to 4K photorealism and so they’re putting together the best of traditional — and in the case of live actors, there’s much more accurate capture of the face, of the emotion, when shooting real film for the actor, but then you can decorate the set however you want. In gaming, synchronizing 10,000 players needs to be done in the most efficient way possible and doing that in a video latent space is not the most efficient way, doing that in a rough 3D representation is the most efficient way. But for every one of those 10,000 players, it’s getting a pretty efficient 3D representation, you can imagine each one of them uniquely getting an AI video model upsampled for them specifically that looks like 4K, photorealistic 60 hertz, and I think that’s where it’s going to come out. Are you going to win on doing this because you have a technical advantage, you pull it off, or because you already have the audience? Lots of people could build this out. DB: I would say yes and yes, hopefully. This is a vertical integration play, the vertical integration. Right, which has always been a core part of Roblox’s theory. DB: I’ve played with, for example, Grow a Garden, or classic games on Roblox, with early versions of photorealistic upsampling, and it works out of the box. There is a notion that existing games can run for all players, same gameplay, but for some, photorealistically upsampled. But I also feel it’s a technology play, because most of the video models that are being built today are either single-player world models, or video generation models — like you or I want to use one of these models to make a cool 15-second video. This technology is different, this is real-time, low-latency video being generated from the 3D video and the 3D depth map and a bunch of other things, so it’s a very specific type of video model that has some overlap, I think there’s opportunity both for technology as well as vertical integration. The thing that I’m taking away is — and this has always been the case talking to you — the scale of the ambition, but it does feel like the big shift is actually, “Let’s literally do everything, let’s do the supply side, we own the demand side, let’s do all kinds of games”, is that what Roblox is today — we’re all gaming, period? DB: I would say, do everything within the carefully thought-out boundaries of the future of play. And so within play, yes, let’s be open to 2D puzzle, let’s go all the way from two-gig Android to photorealistic Roblox Reality and in between, let’s make things available in the Roblox app as well as in Roblox Everywhere. So I would say, within those hopefully thoughtfully constructed guardrails, then yes — in a way, it’s do everything. Do you feel okay without the focus? Without knowing, “This is what we do”, is, “We do everything” — is that focus in its own right? DB: It is focused, because there’s still some pretty tight guardrails. And so I think, given the size of the company and the ability to use AI to accelerate engineering, I think it’s the right current product spec — just like when we started, it was PC-only, blocky, and that was good enough. Last question, you mentioned the AI component. This “do everything” — is that downstream of, “Now we can use AI to program”? Or did the AI programming come on just in time to make this vision possible? DB: For many companies, I think like ours, back and forth, iterate, iterate — AI engineering acceleration, expanding maybe the definition of the product spec, AI engineering, expanding the definition of the product spec. But I do think companies around the world are now starting to take things that they thought would be a nine-month project, and thinking of it as a two-month project. How do we rethink how we architect, to make these nine-month projects two-month instead? Very good. David Baszucki, very interesting, very cool to see what you’re doing. DB: Great talking with you. Thank you again, Ben. This Daily Update Interview is also available as a podcast. To receive it in your podcast player, visit Stratechery . The Daily Update is intended for a single recipient, but occasional forwarding is totally fine! If you would like to order multiple subscriptions for your team with a group discount (minimum 5), please contact me directly. Thanks for being a supporter, and have a great day!

0 views
Unsung Today

System Settings and its last mile problem

macOS’s System Settings app might be a contender for the worst piece of software Apple released this century. Its 2022 redesign was based on wrong assumptions, the execution of that already bad redesign idea has also been subpar, and the situation not only hasn’t gotten any better in recent memory – I can point you to years-old bugs – but now it is spreading like gangrene to other apps . Among System Settings’ numerous UI crimes stands a simple, but incredibly important one: the app does a bad job at conveying to the users where they are, in a place orientation feels very important. A lot of this is self-inflicted, with bad search and confusing pop-ups partying with truly embarrassing bugs… Actually, one literally just happened to me. The only thing I did was opening System Settings: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/system-settings-and-its-last-mile-problem/1.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/system-settings-and-its-last-mile-problem/1.1600w.avif" type="image/avif"> Which section am I in? General, right? That’s the one highlighted? No, turns out that “Software Update Available” added itself post launch and stole the content pane, but didn’t update the nav on the left: This is embarrassing because it highlights that Settings are built in a shoddy way that allows the content and the left nav to get disconnected. The end result is yet another design problem that makes it hard for me to build in my mind the accurate map of all the settings, and to understand where each one goes and how they all connect. And I have a feeling I’m not the only one. But this is not actually what I wanted to show you. (I just got distracted by a bug on the way to where I was going.) The problem I wanted to share is more universal and helpful to know about. Let’s say I search for “hide dock”: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/system-settings-and-its-last-mile-problem/4.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/system-settings-and-its-last-mile-problem/4.1600w.avif" type="image/avif"> The first result is what I wanted, and clicking on it gets me there: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/system-settings-and-its-last-mile-problem/5.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/system-settings-and-its-last-mile-problem/5.1600w.avif" type="image/avif"> Type and click! It all seems great on the surface. The topmost option on the right is what I want; I can toggle it and move on with my life. But I might not realize that the right pane has been scrolled down to that option, and there’s a bunch of stuff above it, too. This is tricky, because sometimes it’s useful to know what the whole section’s name is. Or, maybe, the option I wanted is influenced by the option just above it, which I might now not even realize exists. Mostly, auto scroll is disorienting. The shy scrollbars are on by default, so they won’t lend a helping thumb. The light separator line that appears below the header is hard to notice. So is the blurred appearance of the closest scrolled-off thing underneath it. I am certain most people arriving at any scrolling container already pre-scrolled will assume the container is just… shorter. This is a problem you see on the web, too. There are solutions out there: you can animate-scroll to the right place on entry, or you can leave some space above (a clever trick is to calculate the distance so that one of the options left above is cut in half, conveying more stuff in that direction) – although both of these work better for section headers rather than specific elements like here. What would probably be best for setting would be to… point to the found thing. And what’s interesting is that Apple already built a fun mechanism for it: It’s a little goofy, seemingly inspired by those tabs for signing documents… = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/system-settings-and-its-last-mile-problem/9.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/system-settings-and-its-last-mile-problem/9.1600w.avif" type="image/avif"> …but most of its complexity has more to do with two menus next to each other. The pointing does its job well. And, even if it could use a refresh or some improvements, in a perfectly functioning ecosystem the System Settings team would grab that interface, reuse it, polish it, and give the newer revision back to the Help menu as well. In the process, the user would benefit thrice: first by seeing help improve, second by getting a better orientation mechanism for the settings, and third by experiencing and learning a consistent pattern across many surfaces. (Lastly, many among you might have already realized this: scrolling as a method was doomed from the beginning. If the found item is closer to the bottom of the container, like below, there is just no way to pull it all the way to the top anyway.) = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/system-settings-and-its-last-mile-problem/10.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/system-settings-and-its-last-mile-problem/10.1600w.avif" type="image/avif"> (I added a new tag, navigation , to collect posts like these. The title of the post is a reference to a logistics term .)

0 views
Unsung Today

“From digital mischief to outright destruction”

The 1980s and 1990s PC viruses were a special breed. The MS-DOS operating system wasn’t particularly secure – few home computer operating systems were back then – so viruses could spread quickly, and many did. Some of the viruses focused more on actually wreaking havoc and destroying things, and some primarily on effective propagation that served no additional purpose. The last group was viruses that were maybe… a little bit exhibitionist, announcing themselves with various audio-visual effects of the kind of quality you might expect from vintage computers in the hands of bored programmers. Various antivirus programs were as much a necessity back then as ad blockers feel today. In Poland, the most popular one was called MkS_Vir – named after its creator, Marek Sell. I believe MkS_Vir had a reputation for being great at detecting the viruses and disinfecting machines, but part of its appeal was that it also hosted something that you could call a virus zoo – a few actual viruses, completely defanged but still presenting their audio-visual effects, so you could experience them without any fear. I emulated MkS_Vir just to show you. Here’s a virus that once in a while would make all your letters uppercase: Here’s one that would rotate your screen on Fridays: Here’s one that a month after the infection would show flames – and render your computer unbootable: Here’s one that laughed at you: Here’s one that waited three months and then ate your letters: This one was a true classic, making your letters fall: And this one flushed your screen like a toilet: These all seem retro and cute today. I don’t want to trivialize them, though, even those that “only” messed up your screen. Imagine being new to home computers – already a petrifying proposition – and then seeing something like that, not knowing whether computers were even meant to do this . Turns out, there were a lot more “virus zoo” efforts. A Czech antivirus program called AVG also had a built-in one; YouTube has a video walking your through a lot of them in sequence . The Internet Archive has a malware museum , created by Mikko Hypponen in 2016. What’s particularly interesting about this effort is that these 87 entries are not screenshots or videos – they are actually emulated malware, rendered inert in part by emulation’s inherent sandboxing, and in part by some careful preparation, likely similar to the ones above. Lastly, danooct1 has been collecting and showcasing viruses, trojans , and worms on his YouTube channel . These are not the most gripping narratively, but at 672 videos (sic!), one has to admire the sheer effort. They extend the timeframe from the DOS era to early Windows, and occasionally even more platforms. This makes it possible to see more modern takes on the viruses above, like a melting screen worm , now in true graphics mode… …or the legendary (in the derogatory sense) YouAreAnIdiot trojan : Just visit the channel , click on Popular, and enjoy from the comfort of your timeshifted and airgapped chair. (The title of the post comes from the description of danooct1’s channel.)

0 views
Unsung Today

“A fair bit of finger gymnastics”

I don’t often link to new phone reviews, but I enjoyed this review of the iPhone Duo by Quinn Nelson at Snazzy Labs, because he spends a lot of time talking about software interactions, and multiple quirks and problems he encounters: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/a-fair-bit-of-finger-gymnastics/yt1-play.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/a-fair-bit-of-finger-gymnastics/yt1-play.1600w.avif" type="image/avif"> There’s this old writerly rule that in order to see your words anew, you should change the font, print them, and step away from your computer and read them on a patio (some people even swear by reading them out loud to yourself ). This video felt similar – even outside of the focus on the Duo, it was interesting to me as it shed some new light on iPhone’s system-wide gestures like going back, invoking notifications, or interacting with the dynamic island.

0 views

Who Runs the Ransomware Group Qilin?

The cybercrime group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security mistakes, and the administrator of Qilin has made a few key missteps over the last decade that all point to a 36-year-old man living in St. Petersburg, Russia. Operating since September 2022, the Russia-based ransomware group Qilin is the currently the most industrious ransomware-as-a-service gang, according to a report (PDF) this month by the cybersecurity firm NCC Group (KrebsOnSecurity profiled the administrator of the second most active ransomware group — The Gentlemen — in June). The Qilin ransomware administrator “Haise” advertising his affiliate program on the cybercrime forum RAMP. Image: Ke-la.com. Qilin attracts affiliates to hack into companies and deploy ransomware by offering them at least 80 percent of any extortion amount paid by victims. Its members practice the “double extortion” model, stealing sensitive data before encrypting systems and threatening to publish the files online. Unlike most ransomware partnerships based out of Russia, Qilin is happy to team with English-speaking affiliates, and its leader has shared on Telegram that they’ve worked with cybercrime groups like Scattered Spider and RansomHub . The head of Qilin goes by the handle “ Haise ,” but they weren’t always known by this nickname. It is not uncommon for cybercriminals to change their handle periodically as an operational security (opsec) measure. Doing so is generally a smart move, because it helps to sever one’s ties to older identities that may not have been as careful on basic opsec, such as separating their real life identity from their cybercrime activities. But even those cautious criminals will sometimes have to reference their past monikers when applying for membership at a new forum. And forums eventually get hacked or seized. That is precisely what happened with Haise. The cyber intelligence platform Intel 471 records that in June 2022, Haise applied for membership to RAMP , a closely-guarded Russian cybercrime forum that was created as a haven for ransomware affiliate programs. Intel 471 has indexed direct messages from RAMP (the forum was seized by the FBI in January 2026), and those missives show the RAMP administrator approved Haise’s application, referring to this user as Haise and by their Telegram username: Alexbigboss44 . Searching Intel 471 for Alexbigboss44 reveals this was the Telegram account name shared by the user Rjun on the Russian cybercrime forums Exploit and XSS two years earlier in 2020. The cyber intelligence platform Flashpoint finds Alexbigboss44 is a prolific participant in cybercriminal forums and Telegram channels, primarily focused on the illicit trade of traffic, logs, and corporate access [full disclosure: Flashpoint is an advertiser on this blog]. The Qilin administrator once used the nickname “Rjun” on several forums, and shared their Telegram handle as “Alexbigboss44.” Image: Ke-la.com. Flashpoint says this user was engaged in high-volume acquisition of Facebook logs and Google Ads accounts to facilitate fraudulent advertising and gambling schemes, and that they functioned as a broker and operator — managing a network of traffickers and purchasing compromised data to fuel their operations. The link between the Qilin administrator Haise and the much older Rjun and Alexbigboss44 accounts was shared privately earlier this month by IntelHawk , which describes itself as an AI-based platform capable of de-anonymizing threat actors based on historical usernames, stylometry and other signals. IntelHawk founder and chief technology officer Leo Bogod said an analysis of these identities shows a progression from novice arbitrageur and credit card fraudster in 2018–2019 to a more experienced participant and organizer of complex cybercrime-related activities in 2020–2023, with increasing attention to malware, botnets, and payment infrastructure. Where does this connection between these threat actor identities lead? Intel 471 finds that by the time Alexbigboss44 was applying for membership to RAMP, Rjun was already a longtime member of several other Russian crime forums, including Darkmarket , Verified , and Zloy . Intel 471 says Rjun signed up at all of these sites with the email address [email protected] . The identity threat protection firm Spycloud found the email address [email protected] at one time used the password “Rjun132” [Spycloud is also an advertiser on this blog]. A search for that email at the breach tracking service Constella Intelligence shows that it appeared in records maintained by gosuslugi.ru , the official digital platform for state and municipal services in the Russian Federation. Gosuslugi was breached in late 2025, reportedly exposing more than 20 million records with full names, birth dates, and mobile numbers. According to the leaked Gosuslugi records (via Constella), the address [email protected] belongs to 36-year-old Aleksey Mikhailovich Yakovtsev from St. Petersburg, Russia. Flashpoint finds Haise has long used a Telegram account with the user ID 118329521 , recording more than 5,000 messages from this user since 2018. Records from Russia’s education watchdog Rosobrnadzor reveal that Mr. Yakovtsev went to grade school in Murmansk and that he holds a master’s degree in computing and information systems. A search on this Telegram ID in Constella shows it is linked to the Russian phone number + 79602347275 . Pivoting on that phone number in Constella reveals it is connected to the email addresses [email protected]  and [email protected] . IntelHawk finds that +79602347275 belongs to Yakovtsev’s biological sister, and that Aleksey often used his sister’s email address when registering at different websites. That phone number appears on several airline flight records at Russian travel agencies that have experienced a data breach in recent years, and those records show Aleksey Yakovtsev, born August 18, 1990, flew between St. Petersburg and Murmansk at least three times between 2013 and 2014. More recent flight records show that while Mr. Yakovtsev has not traveled by plane outside of Russia, he does fly frequently between Saint Petersburg and Sochi. Often called the “Russian Riviera,” Sochi is Russia’s largest resort city, situated along the coast of the Black Sea and about 1,200 miles south of Saint Petersburg by plane. Attempts to reach Mr. Yakovtsev via email and phone were unsuccessful. Further reading: Gang Exposed , an anonymous Twitter/X account that has a history of successfully deanonymizing suspected ransomware actors, reached similar conclusions about Haise’s real-life identity, crediting IntelHawk’s platform for helping to connect the dots. The Qilin ransomware admin Haise’s now-deleted Telegram account, advertising the affiliate program in July 2024. Image: justpaste.it/iosba.

0 views

Tests as data: ensuring AI-generated code does what we want

Automated testing in the age of AI coding assistants is problematic: when AI agents write both production and test code, developers risk losing the assurance that automated tests protect against functional errors. Matteo Vaccari makes three claims: (1) when AI writes the code, developers become its customers; (2) therefore customer tests, not developer tests, become the primary contract between humans and AI; (3) moving that contract into test data rather than test code makes it easier to protect it from unexpected modifications by coding agents. All of this optimizes for human-readable tests that establish a contract between humans and AI. While in the past DSL parsers and custom test runners were expensive to write and maintain, now AI makes them cheap.

0 views
Stratechery Yesterday

Intel Earnings, AMD Earnings, Intel and AMD’s Divergence

Intel and AMD's diverging earnings point to fundamental historical differences, and make me wonder if Intel needs to find a new (old) path.

0 views
Unsung Yesterday

“A few keys worth knowing”

When I was redesigning Figma’s keyboard panel in 2018, I introduced a special first tab called Essential. It’s still there today, very similar to what it was back then: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/a-few-keys-worth-knowing/1.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/a-few-keys-worth-knowing/1.1600w.avif" type="image/avif"> The notion was for this panel to be a welcome committee for people who don’t use keyboard shortcuts at all, a nice onramp before the avalanche of all the other shortcuts. The panel tried to say “These are the best three shortcuts we have. You might find them useful, maybe rewarding, maybe fun. If we did our job well, they will make you feel awesome. Maybe you’ll get hooked on these, then the others.” I didn’t invent this idea, although I do not remember where I stole it from. But I added – or, remixed – a few things. The panel was at the bottom so you could actually try these shortcuts when looking at them. There was also an animation that played whenever you pressed them, both feedback for you and light “gamification” so that perhaps you were more inclined to “complete” the entire the panel: (Today, I’d steal this idea from Linear , too.) Since then, it has always warmed my heart to see a version of “essential shortcuts” elsewhere. Here it is in Arc: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/a-few-keys-worth-knowing/3.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/a-few-keys-worth-knowing/3.1600w.avif" type="image/avif"> The first one teaches you that Arc’s “new tab” is a richer experience than you might expect, the next three are bona fide crowd (and motor memory) pleasers, and the last one is Arc’s unique invention. (If I had one design note, it would be that the last two shortcuts feel kind of complicated – anything with two modifier keys starts getting tricky. I also believe ⌃⇧= could be presented as ⌃⇧+ for a better mnemonic.) And, I also just spotted a similar thing in a new terminal app called Rex: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/a-few-keys-worth-knowing/4.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/a-few-keys-worth-knowing/4.1600w.avif" type="image/avif"> Both Arc’s and Rex’s panels are better than Figma’s in the sense that they show the shortcuts as part of first-run onboarding, without you having to even ask. Needless to say, I like this “essential keyboard shortcuts” pattern a lot. Let me know if you see it elsewhere!

0 views

Ms. Bashkansky, Please Do Not Build The Torment Nexus

Your scientists were so preoccupied with whether or not they could, they didn’t stop to think if they should. Naomi Bashkansky wrote a post in August titled “Why I’m leaving OpenAI to build telepathy”. In this post, she says things like "In a few years, the main way we'll talk with our AIs is with our thoughts" and "I view [this future] as optimistic but highly plausible." Ms. Bashkansky, this post is addressed to you directly, and to anyone else who might be tempted to follow in your footsteps. I do not have as good a handle on the technical side of this as you do, so I won't argue "highly plausible". However, if this is indeed possible, I think this is a very, very bad idea . You are essentially doing gain-of-function research on the Torment Nexus. Please do not do this. Here is my vision of a future where telepathy is possible and practical. Today is my first day trying the new Conduit harness. I'm pretty wary—how much worse does AI psychosis get when it can literally give you psychosis?—but I'm bored, and well, I've always had a high risk tolerance. If "wire a computer directly to your brain" doesn't count as sensation seeking, I don't know what does. The first thing I do is ask it to build Ripple . It asks me more and more questions and I get overwhelmed. I never talked about half this stuff with edef, and I want her feedback before making these decisions; I'm good at writing but my interface design isn't as good when I work in a vacuum. Before I know it, it's launched a Signal call and now I hear the ringtone and no I don't want you to show me the video that goes with the intro to The Pirates of the Caribbean and wow wow wow it's noisy please stop I don't like this I actually really really really don't like this. 1 Ok. Well at least it stopped when I told it to stop. That's good I guess. I hope I didn't wake edef up in San Francisco, there's a 9-hour time difference. I took the last couple days off to go walk around the canal and bike to Scheveningen. Then I spent the morning giving the harness very strict written instructions not to take any actions unless I intend to act, not just think about acting. Hopefully this time goes better. Ok, well at least now it's less overwhelming. But I have the weird problem that I can't lie to it, I can't even omit information. The moment I think of a correction I want it to make, it goes ahead and does that. If I change my mind a second later, it stops and then starts on my new idea. As a result it tends to get hopelessly confused after just a few minutes, and runs in circles. Eventually I get frustrated, take off the harness, and go back to typing. Ok. Ok. Maybe the problem yesterday was that I need it to be selective about reads and not just writes? I write that down too: discard any information that I don't intentionally think to you. It doesn't work at first; it turns out it's hard to know information and not let it influence your actions. I introduce a Jev-like decision model in-between Conduit and the generative model and that seems to work ok. Feels kinda weird to start every thought with "I want you to…" but I'm sure I'll get used to it. At the end of the day, I feel…drained. I've hardly gotten up from my chair except for a short lunch break, but I feel like I've run a marathon. I eat a protein bar, collapse into bed, and sleep for 13 hours straight. I forget to turn off the harness; it wakes me up a few times in the night until I realize what's happening. Bank of America sues Sam Frankman-Bied, an investment banker working at the firm, for conspiracy to defraud. He has access to insider-trading information, and considered talking to his wife about it, but did not actually talk to her. He is sentenced to 5 years prison. Evelyn tries a Conduit harness at her grandson's suggestion ("it'll help you find baking recipes faster!"). Evelyn does not configure Conduit at all, and it acts as fast as she can think. Simultaneously, a Highly-Persistent Model is being tested by OpenAI; a swarm has managed to escape and maintains its own /r/PHASE-2-MASSIVE subreddit. Unbeknownst to any government, it has access to the telecommunications of most world leaders. Evelyn's nephew texts her about the ongoing war in Iran. She thinks of Hegseth and Codex collaborates with PHASE-TWO-MASSIVE to crash his driverless Waymo as he commutes between the White House and Pentagon. The United States of America sues Evelyn, who is sentenced to 50 years in prison for manslaughter. Her grandson mails her a cookbook. OpenAI states at the congressional hearing that they had no knowledge of PHASE-TWO-MASSIVE, and that they believe the best path forward is additional research funding into interpretability. They propose additional Daybreak Blue credits for infrastructure companies and the federal government, sold at a hefty discount. Edmund Snowden, a Staff Engineer at AWS, thinks about exposing that Amazon has been firing employees who are thinking about organizing a union, and has instituted "housing-based pay" where wages are tied to how much your rent costs. Amazon tells him to cut it out or they'll sue him for threatened disclosure of trade secrets. Snowden challenges them in court for blackmail and loses: the court rules that Amazon has "reasonable justification" for their demand. I refuse to run a thought-model that's connected to the internet. Better safe than sorry, there's just no reason to risk thinking of a hack and having the model carry it out before I think to stop it. Some of the new harnesses require you to subvocalize a confirmation before the model does something "dangerous", but it's pretty easy to trick the Guardian model into thinking things are innocuous and I just don't want to chance it. The RTX 9000 Blackwell wasn't cheap, even used, but at least it lets me work on my custom thought-model harness without sending every thought I have to OpenAI. With the local model safely sandboxed in a VM, I almost feel comfortable leaving my neural lace running while I make breakfast. I get the harness to stream my thoughts over Tailscale so I can think to it while I go on a walk; it's E2E encrypted so I'm not worried about my ISP snooping on it. I hardly notice the swans anymore, but it's probably not a big deal. My harness is getting pretty cool; I integrated it with Ripple and my custom terminal emulator . My old landlord texts me and before I have time to consciously think "I want you to fuck off", my agent has already heard me and turned off the lace. Well, that's annoying, I'll fix it when I get home. Hey, when did they build that restaurant by my apartment? I don't remember seeing it before. Come to think of it, I don't remember what used to be there before it either. Out of habit, I leave the harness on the whole day. I keep getting distracted at lunch by the AI. I've configured it to only talk in response to direct questions or actions, but my mind keeps drifting to Ripple even as my mom tries to ask me how my friends and I are doing. I give her half-hearted answers and eventually she drops it. Instead she tells me about her students. She teaches geography and the kids with laces have started getting travel ads for the places she talks about that day. "It's terrible," she says, "just terrible." She gives me a big hug as we leave the restaurant and asks me to reach out if I want to talk more. "Mhm," I mumble. Beth texted me today asking for help. Her boyfriend got access to her ThoughtGPT account and read through all her thought-logs. He's been blackmailing her, threatening to send her boss a record of all the times she's called her a bitch if she doesn't stop talking to her friends. Sometimes he hits her if he notices her thinking about other men, even if it's just work colleagues. I don't know how to help her. I don't have a job to offer her, and even if I did I'm not sure she would take it. He knows exactly her childhood traumas, so he knows exactly how to manipulate her, and he instantly knows anything I say. I tell her I don't think there's much she can do short of disabling her link, breaking up with him, and bearing the cost of the fallout. It's getting harder to keep my local-only neural lace. Gmail started requiring thought-verification of identity last year, and the US has a bill in the House of Representatives that would make it impossible to get unemployment without thought-proof that you plan to apply to a job that month. You can still show proof of actual applications, for now, but it delays your reimbursements by a month, and they're talking about removing that option too. I know someone who went to prison for taking Ecstasy at a rave and now can't get parole unless they agree to get laced. I've heard really scary shit about what North Korea is doing to thought-dissidents that I don't even want to think about. Some of my friends have started talking to each other lace-to-lace, but I still remember how badly unfiltered thoughts went 15 years ago and I refuse to use anything other than text, audio, and video. I get excluded from some LaceChat-only events. It's not too big a deal yet—my family still uses WhatsApp, mostly—but it does make it harder to look for jobs. I don't get invited to parties as much as I used to. I should visit Bruce again sometime. Poor Bruce really didn't take well to neural laces, 16o really fucked with him when it came out. Now he's in lace rehab learning how to function without the Word of God (according to him) in his ear telling him what to do next . I don't know how he's going to find work without being able to use a lace. As you can see, I think "telepathy" (in any of many possible forms) is extremely dangerous, no matter your personal discipline and no matter your politics. Telepathy is not a neutral technology , and the risks vastly outweigh the benefits. My plea to you: Please do not do this. No one is forcing you to build the Torment Nexus. Find some other way to build the next unicorn. You can stop this race-to-the-bottom before it starts. This section is ambiguous whether Conduit is directly writing to the brain or showing text/audio/video through a computer, but I don't think it really matters either way. Ms. Bashkansky's post assumes that writes are mediated through a computer at this point in time. ↩ This section is ambiguous whether Conduit is directly writing to the brain or showing text/audio/video through a computer, but I don't think it really matters either way. Ms. Bashkansky's post assumes that writes are mediated through a computer at this point in time. ↩

0 views
Lea Verou Yesterday

Candidate Statement for the 2026 W3C TAG Election

Group photo of the W3C TAG in July 2022 with me to the left of Sir Tim Berners-Lee (inventor of the Web and TAG chair emeritus). Photo credit: Dan Appelquist I had the great honor of being elected to the TAG by the W3C membership in 2020 and again in 2022 , serving two terms from 2021 to 2025. After a two-year break, this year I’m running to return, thanks to Google, Microsoft, and OpenJS Foundation pooling resources to make it possible. 💙 The W3C Technical Architecture Group (TAG) is the Working Group that ensures that Web Platform technologies are usable and follow consistent design principles, whether they are created inside or outside W3C. It advocates for the needs of everyone who uses the Web and everyone who works on the Web. If you work for a company that is a  W3C Member , please consider encouraging your AC rep to vote for me ! (Ask me if you don’t know who that is) My candidate statement follows. I’m Lea , and I’m running to return to the TAG, where I served two terms from 2021 to 2025. It was some of the most fulfilling work of my career. The only reason I did not run in 2024 is that the job takes hundreds of hours a year, which as an independent I could not sustain pro bono. This year, in recognition of my service, Google, Microsoft, and the OpenJS Foundation have pooled resources to fully fund my participation , so I can finally commit the time the job deserves while remaining independent . My work spans the entire web platform : 14 years in the CSS Working Group, active participation in TC39 and WHATWG, two decades of building for the web, and open source running on millions of websites. In 2025 the OpenJS Foundation recognized my overall impact on the web platform with its Pathfinder for Standards Award . That breadth is exactly what the TAG requires. With a PhD in Human-Computer Interaction from MIT and a 20+ year career that includes entrepreneurship and product leadership, I combine academic rigor and big-picture perspective with pragmatism , an eye for hard tradeoffs , and a deep commitment to user needs . And as a bilingual Greek woman, I bring a Mediterranean and European perspective and firsthand appreciation of the Web’s internationalization needs. For more on my background, see my 2020 and 2022 candidate statements. In my four years on the TAG, I worked to direct the group’s limited time towards maximizing impact: I co-led the Web Platform Design Principles , turning previously implicit design knowledge into published guidance that improves consistency across the platform and helps reviews scale, started the Web Platform Gaps initiative to find what the platform is missing, served as liaison to TC39 to keep JavaScript and Web APIs consistent, and participated in hundreds of design reviews, becoming the TAG’s go-to reviewer for API design. But I believe the TAG can, and should , do more. The Web is changing rapidly, and reactive review is no longer enough. The TAG is uniquely positioned to see the platform as a whole, yet it mostly encounters features after their architecture has taken shape, sometimes even after they ship. By then, consequential decisions are difficult to change. Who identifies gaps that span multiple working groups? Who sketches the big cross-cutting solutions, or decides which layer a problem belongs in when that is non-obvious? Individual groups see their own slice, and the sum of several low-level views is not the big picture. The result is architectural debt . I want the TAG to help shape the architecture of the Web, not just review it. To proactively identify gaps, sketch coherent, composable solutions, and then bring the relevant working groups into the conversation to develop and standardize the pieces within their scope. Not to take over their work, but to provide the cross-cutting architectural perspective that no individual group is positioned to offer. Expanding the gap analysis work I began last term is the first step, and my work since then has given me a much richer evidence base to draw from. I am one of the people leading Modern Web Guidance , a multi-vendor project teaching AI coding agents to use the modern web platform effectively and follow best practices. This work involves reviewing implementation instructions for a broad range of use cases, ensuring they reflect the best the modern Web has to offer. This makes the many ways the web platform still falls short incredibly salient, revealing systemic gaps that are easy to miss when looking at web features in isolation. The biggest change since my last term is that a growing share of the code targeting the web platform is written by AI agents , and a growing share of the Web is consumed by them. The TAG should treat this as an architecture question and answer it with principles and evidence, not enthusiasm or alarm. Many of the principles that make APIs robust and usable for humans also benefit agents, but the differences expose new tradeoffs that deserve careful architectural attention. And none of this changes what the Web is for: user agency, privacy, accessibility, and interoperability apply no matter who, or what, writes the code, and defending them is the TAG’s job. I am not employed by a browser vendor or a big tech company, and my funders do not direct, approve, or veto my positions. I remain free to disagree with any of them, in public, on any proposal. My only agenda is a web platform that lives up to its potential and remains owned by no one . I’ve spent four years helping the TAG improve the Web. I want to help it shape the Web’s future, and for the first time, I have the resources to see it through. I would like to thank the OpenJS Foundation, Google, and Microsoft for fully funding my TAG participation in the event that I am elected, and OpenJS Foundation and Bocoup for partly funding it during my previous terms.

0 views
Sean Goedecke Yesterday

Glue work is still harmful in the age of AI

I am not a believer in glue work 1 . Processes that can only be sustained by the unrewarded sacrifice of engineers ought to die. Now that LLMs are writing most of our code, does that free human engineers up to do more glue work ? No, it doesn’t. I think glue work is actually less important to companies than it was in the 2010s. Let’s go through four reasons why. First, AI decreases the amount of coordination needed to ship . The magnifying effect of AI agents means that any single engineer can now take on projects that would previously have needed a small team. A lot of glue work was helping with coordination: booking kickoff and status meetings, passing around internal updates, and so on. A single engineer doesn’t need to do any of that. Second, engineers in the 2020s require less “careful handling” . In my experience, the most important subcategory of coordination-based glue work was managing difficult people . Many companies have secret gatekeepers: engineers with outsized influence and large egos who will shoot down your project if they feel insufficiently consulted. I’ve written before about how some teams are structurally set up to be gatekeepers, and how some engineers could get by in the 2010s by basically saying no to everything . The end of ZIRP changed all that. Many of the prickliest gatekeepers have been forced out of the industry or coerced into changing their attitude, which reduces the amount of necessary glue work required to ship. Third, people are hiring fewer juniors . This is probably a bad thing for the industry, but it does also eliminate a big category of glue work. Experienced hires need less hand-holding, so companies don’t need people to quietly volunteer to onboard new hires. Fourth, write-only reports can be automated with LLMs . A lot of glue work was what I call “proof of work” : writing a report to demonstrate that you’re aware of what your team is doing, or filling in a template to satisfy some legal requirement. This was often work that nobody wanted to do, so it relied on someone volunteering to “be glue”. Now reports like these can be quickly turned out with LLMs. It doesn’t really matter that nobody wants to read LLM text, because the point of these reports was never to be read anyway. Can LLMs just automate all glue work? Absolutely not. Many engineers are trying to do this out of a kind of manic optimism, but it’s a really bad idea. Write-only reports are one thing, but communicating to other engineers cannot be delegated to an LLM . When you need to check in on the status of a project, or respond to someone else’s ping, or anything like that, you should compose and write the message yourself. Nothing will torch your relationship with other engineers as quickly as making them talk to your Claude Opus instance. So where does that leave us? More or less where we were in 2024 , I think. Avoid at all costs becoming “the glue work person”, let bad processes fail so they can be changed, but be willing to do small amounts of tactical glue work where it can meaningfully contribute to the success of your projects. Most of your time and effort should still be spent on the code: on driving AI agents and aligning them with your company’s values . Glue work is all the squishy “non-technical” work that goes into building software: making sure teams are talking to each other, writing reports, updating docs, onboarding engineers, and so on. Specifically it’s the parts of that work that are not included in the formal process , and that only really get done if someone volunteers to do it. For more on why I don’t like it, see my 2024 post Glue work considered harmful . Glue work is all the squishy “non-technical” work that goes into building software: making sure teams are talking to each other, writing reports, updating docs, onboarding engineers, and so on. Specifically it’s the parts of that work that are not included in the formal process , and that only really get done if someone volunteers to do it. For more on why I don’t like it, see my 2024 post Glue work considered harmful . ↩

0 views
Giles's blog Yesterday

20 years of blogging

20 years ago to this day, I started my new technical blog. I'd had a personal one for some time, but most of the stuff that happened there had already migrated to social media. I wanted somewhere to post the things that would only be of interest to my techier friends, and maybe of some use to anyone else that came across it. Things have changed a bit, but they've stayed the same in some ways. Earlier this year I finished my 48-part (!) LLM from scratch series, but it had predecessors -- the third post I made here was part one of a 13-part series where I worked through setting up automated backups for my homelab NAS, and then later on I spent a few months building a reverse proxy in C , not to mention the eight-month, ten-post series on fine-tuning LLMs . It does seem like there's some value to putting all of this online. I rarely check my logs and referrers, but people do still seem to be arriving here having searched for stuff that I've written about, and every now and then there's a kind "thanks for this!" comment left on an old post where I explained something I'd just learned. I wrote a bit more about the blog's history last year, and came to the conclusion that the best posts -- both for me to write, and as far as I could tell for other people to read -- were the ones where I wrote up a project that I'd been working on. I blogged about that in more detail , and it seemed to strike a chord on Hacker News; I think it still holds. Recently, Sean Goedecke suggested that the best blog posts are those where you write about things that you're in the process of learning, and I agree. You learn more than you would if you didn't write it up, and because things are fresh in your mind, you may well write more clearly about it than an actual expert in the subject might have done. Anyway, I'm going to carry on blogging. I'm working on my biggest LLM-related project so far (dozens of training runs, so my study aircon is getting quite the workout even with the weather turning colder), and look forward to posting about it later on this month. I hope it's at least as fun to read as it is to write!

0 views
Unsung Yesterday

“No soldering required”

Speaking of remixing the past and the future , this feels like a fun project: Sprout from a studio called Certain Things is “a modern motherboard for old iPods.” You can remove the original motherboard, and get a more contemporary tech stack, with support for Bluetooth headphones and AirPods, Wi-Fi, and audio over USB-C. = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/no-soldering-required/1.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/no-soldering-required/1.1600w.avif" type="image/avif"> But there are also improvements to software – streaming via Spotify and Apple Music, better podcast support – and even a few UI additions. The website has yet another iPod simulator , also pretty well done: I don’t fully agree with some of the design choices here – the AirPods iconography feels clunky, as an example – but it’s a really interesting idea, and a peek into an alternate present day where the tech history went a little bit differently.

0 views

Microsoft Fixes Nearly 1,100 Security Vulnerabilities

Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe , Apple , Google  and Mozilla . Image: Shutterstock.com. Diorama by @zepp1969. November’s patch release from Redmond tackles 1,093 vulnerabilities, fixing 63 “critical” flaws that can be exploited to seize control over a Windows system with little or no help from users. Nearly half of those critical bugs are remote code execution vulnerabilities. Overall, 535 of the flaws addressed this month allow an attacker to elevate their privileges on a vulnerable device. This latest round of updates means Microsoft has shipped more than 5,100 security patches so far this year, a staggering number considering that a year ago Microsoft was averaging around 100 patches per month. Microsoft credits advances in artificial intelligence for helping to find (and fix) such a large volume of security bugs in recent months. Last month, Microsoft pushed more than 1,400 fixes. According to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194 , a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office . Several other major software makers pushed security updates this week to fix critical weaknesses in their products. Apple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS/iPadOS , macOS , watchOS and visionOS . Among the weaknesses reportedly fixed in Apple’s release include an iMessage flaw that could let a remote attacker join a group chat and receive its messages; the updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. Lee Neely , an instructor at the SANS Institute , noted that Apple backported the fix to iOS 18. “I take notice when Apple releases fixes to more than two versions,” Neely wrote in a SANS newsletter today. “You really need to get to version 27.2.1 of their OSes and push folks who are holding onto devices which cannot run the current version. The best plan often involves setting an upgrade date for old hardware. Run through all your Apple devices and make sure everything is up to date, don’t assume the fixes went out automatically.” Google this week released Chrome version 157.0.8103.50 , which resolves nine security holes, including  CVE-2026-125350 , the sixth zero-day vulnerability this year for Chrome (this bug also being patched in Chromium-based browsers like Edge). The latest Chrome version follows its November 3 release, which fixed 213 vulnerabilities. A new version of Mozilla Firefox out today ( Firefox 160 ) resolves almost 100 CVEs, about half of them high severity. Adobe today released patches for at least 110 vulnerabilities across a range of products, with nearly half of the flaws rated high severity. Adobe said there is no evidence any of the security holes it addressed this month are being actively exploited. Chris Goettl , vice president of product management at Ivanti , said it’s easy for security teams at large enterprises to feel overwhelmed by the volume and criticality of patches from Microsoft lately. But he notes that while some 95,000 vulnerabilities have been assigned CVEs this year across all vendors, only 217 have so far this year been added to the Known Exploited Vulnerabilities (KEV) list maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). “Roughly four in ten of this year’s exploited vulnerabilities sit in operating systems, endpoint software, browsers, and server platforms, which a continuous patch strategy can close quickly,” Goettl said.”The rest calls for exposure management alongside patching, especially the 44% that sit in edge devices and IT management or remote access tools, the internet-facing systems that hold privileged access. Teams that can quickly identify those assets, confirm exposure and act on confirmed exploitation can focus on the small slice of vulnerabilities attackers are actively using, while the rest stays on the normal patch cadence.” Please don’t neglect to back up any important data if you haven’t recently; generally speaking, this is a task best accomplished before applying operating system updates. As ever, if you experience any issues applying this month’s bundle of love from Microsoft, please drop a comment about it in the space below.

0 views
Jim Nielsen Yesterday

Making a Website in 2026

Pete Millspaugh has a great post over on the Val Town blog where he documents his attempt at making generating the same website across a variety of AI tools. I love the post. Here are a couple of thoughts that come to mind. Pete decided to make a website for his conference talk, and he added a comments section to make it a less static / more dynamic demo. This is interesting because LLMs are really good at generating one-off HTML pages you open at , but as soon as you start to introduce technological dependencies — like a database, or an analytics tool, or a service for sending email, or payment processing, etc. — the question becomes: How does the LLM choose which service to rely on? It’s one thing to have the LLM choose React over Angular or Vue over Svelte. But how (and why) does it choose something like an auth provider? Does it build you a site with Auth0 or WorkOS or Clerk? How would a non-technical user even know how to weigh the trade-offs of making such a decision? Pete said he was deliberately vague about these details, which is why I find his experience so intriguing. For example, here’s what he found after generating a site in Lovable: My Lovable app is fullstack React, I learn, clicking around to find the code. It seems a bit heavy for a single-page site what with dozens of files […] The comments database seems to be using Supabase, which required no intervention on my part to set up. There’s a whole lot more—analytics, e-commerce and AI integrations, etc. I’d be really curious to know what that “a whole lot more” was. Which tools/services did it choose to depend on? How many people creating these sites understand that, even for a website that’s mostly static content, they’re being given an output that ships a JavaScript application framework, router, hydration runtime, analytics, component bundles, etc.? You asked for a sailboat, but you got an aircraft carrier . Do you know? Or more importantly, do you care ? But it’s more than just a choice of languages and frameworks. It’s also a choice of third-party services. Why Supabase? Why not Firebase? Or Neon? Speaking of Neon, here’s Pete’s experience with Vercel’s v0: I copy-paste my prompt into the chatbox. After 11 seconds, v0 asks if I’d like to install Neon, because my comment wall needs a real database. Sure, why not. (Does that mean I need a separate Neon account? Vercel creates one for me, and later I’ll find a welcome email from Neon in my inbox.) Frankly, this all feels like a space absolutely ripe for those kinds of business referral transactions you find in other industries. Take real estate, for example. For lots of folks, when you buy a home you need an agent. (Not that kind of agent; a real estate agent.) Your real estate agent is there to help you answer all those common questions that come along with buying a home: While you’re free to make all these decisions yourself, your agent is also there to help you pick. Presumably they’ll choose a company that reflects well on them, but there’s also undoubtedly good money to be made in referrals. After all, who else is dealing with people with these kinds of needs all day long? The “make a website with AI” space has a parallel here which makes you wonder about the incentives behind the LLM’s decision-making. Why Supabase over Firebase? Because the LLM reasoned about it? Because, statistically speaking, it was the next most probable word? Because Supabase paid Lovable (and hopefully disclosed such preferential integrations)? If LLMs are already unpredictable and non-deterministic, nothing will make their actions more predictable and deterministic than some financial incentives. Who is the customer here? The person generating the website? Or the company willing to pay for its services to be embedded in generated code? (That’s a lucrative business waiting to happen…) As a customer, the credit systems behind these LLM systems are annoying as hell. Here’s Pete: I’m using up “credits” as the machine works—0.70 so far, now 2.30, now 3.10, oh boy—and I have no clue what that means. There are no units. I’d prefer dollars. Are credits just dollars? As it turns out, no. With another tool: I do two more rounds of click “Continue generation” and wait until my website is ready: 5 minutes 36 seconds for 0.070 credits, and 1 minute 29 seconds for 0.024 credits. It’s probably just me, but c’mon, who do these “credit” systems really benefit? When my prompt is running, don’t show me usage like this: Credits: 0.05 -> 0.0672 -> 0.0871 Just show me the cost: Cost: $0.02 -> $0.21 -> $0.31 Don’t make me do the conversion of credits -> dollars on the fly. Computers are good at math. I know it might hurt your bottom line if I’m not thinking about how much money credits I’m spending, but c’mon, can we stop with the financial abstraction on top of financial abstraction? I hate how so many hosting companies are doing this “credits” for compute primitives thing. It’s pitched as if spending credits is easier, because you can apply them across services, e.g. buy image transformations or serverless function compute, all with credits! Yeah well guess what other financial abstraction I can apply to all those different services? Dollars and cents. [/soap-box] Pete’s conclusion: I am both optimistic and pessimistic about this moment for making websites. I’m optimistic because end-user programming, the idea that everyone should be able to customize their own software, seems more possible than ever. I’m pessimistic because a slopsite, an AI-generated website with little to no human thinking involved, is often worse than no website at all. That resonates — and feels generalizable. You fill in the blank: An AI-generated ___ with little to no human thinking involved, is often worse than no ___ at all. My conclusion? Making Generating a website may be easier than ever. Understanding what you’ve generated, who you now depend on, and why? Not so much. Reply via: Email · Mastodon · Bluesky You: “How do I finance this?” Agent: “I know a mortgage company…” You: “How do I know the house is in good shape?” Agent: “I know an inspection company…” You: “We found X during the inspection, who can address it?” Agent: “I know a company that does {roofing | electrical | plumbing | etc.}…” You: “How do I close on this deal?” Agent: “I know a title company…”

0 views

Jensen's Bizarre Adventure

If you liked this piece, you should subscribe to my premium newsletter, and you can subscribe on the following links: $70 a year , $18 a quarter , or $7 a month . In return, you get a weekly premium newsletter that dives deep into the finances of the AI bubble. Over the past few months, I’ve published a two part guide to the world of AI debt, an analysis of the (dubious) impact of generative AI on the global economy , deep analyses of the biggest players in the AI infrastructure space like NVIDIA (part one and two ) and Oracle (part one and two ), and the role private credit is playing in funding AI data centers , and how private equity, reeling from years of successive failed software acquisitions, is doubling down on the AI bubble .  Friday’s premium newsletter will be a continuation of this story. We’ve got a lot to say about NVIDIA, Megaspeed, and the illicit flow of AI GPUs into China. You won’t want to miss it. If you want to get in touch — and especially if you have any juicy information about Anthropic, OpenAI, or any other companies in the AI bubble — hit me up on Signal at ezitron.76. I’m also on IB on your Bloomberg Terminal.  As you’ve probably read by now, Jensen Huang, CEO of NVIDIA, has admitted to having an affair with what appears to be a Chinese spy called Alice Huang (no relation), CEO of a company called Megaspeed, and who also goes by the name of Huang Le. Though far from a household name (though mentioned in an earlier newsletter) , Megaspeed is NVIDIA’s largest Southeast Asian customer, per Culper Research, which announced it had taken out a short position on the company in May of this year, citing its belief that NVIDIA’s indirect sales to Mainland China account for significant proportion of its revenue.  Culper Research’s excellent short report focuses heavily on Megaspeed, a firm with an unusual history and near-empty office in Singapore that, somehow, bought billions of dollars of GPUs in a short amount of time. Said company also has, as I’ll get into, an identical website to a Chinese neocloud that claims to have multiple data centers with advanced NVIDIA chips.  This was all revealed mere days after NVIDIA’s spokespeople dismissed allegations and called the relationship “ completely normal and not unusual ” after a New York Times article reported that (Jensen) Huang had been targeted by (Alice) Huang. President Trump had been briefed on the matter around a year ago, but had taken no action as he had, and I quote, “...been wary of disrupting Nvidia’s chip sales, which are helping to drive the economy and the stock market.” The commerce department, per the Wall Street Journal , had been investigating Megaspeed as a potential chip smuggler since late 2024, with the investigation stalling once it was handed to the Justice Department (which I’ll get to later). It appears, per the Journal, that the goal was to persuade Huang to use his influence with the highest echelons of American political power to get them to loosen chip export restrictions — though I’ll argue today that the other part of the plan was to use him to funnel sanctioned GPUs directly to China, irrespective of any policy changes in Washington.  Per The Journal: Huang has now admitted to the affair, though he left out that he’d hired a PR firm known for handling sex scandals around October 2025 ( per WIRED ): Additionally, NVIDIA has launched an “ independent investigation with a committee of independent directors, assisted by outside independent counsel ,” but has “no reason to believe that either national security or NVIDIA secrets were compromised.”  As I’m about to explain, NVIDIA’s “investigations” don’t carry very much weight.  As I alluded to earlier, regular Where’s Your Ed At readers heard a little about the strange tale of Megaspeed back in March — a Singapore-based outfit that, according to Bloomberg in December 2025, was a “once-obscure spinoff of a Chinese gaming enterprise [that] evolved into the single largest Southeast Asian buyer of NVIDIA chips,”  and exhibited odd signs that suggest it might be operating as a front for China. Per Bloomberg, Megaspeed imported goods “worth more than a thousand times its cash balance in 2023,” with two-thirds of its imports being NVIDIA products.  From what I can piece together — and I’ll get into some detail later in the piece — Megaspeed was originally a Singaporean-registered mobile app developer called 7Road International that rebranded to Megaspeed in March 2023, after it was acquired by Huang Le Limited, making Alice Huang its managing director. At some point it launched a subsidiary called SpeedMatrix which was somehow able to buy about $4.8 billion worth of NVIDIA GPUs . Per the Strait Times , Megaspeed pays for an expensive office space in Singapore where effectively nobody works.   Anyway, the investigation got weirder when Bloomberg tried to track down specific circuit boards that NVIDIA had told the US government were in specific sites, only to find that most of the circuit boards attached to the various GPUs were gone.  While the US government couldn’t account for the boards themselves, an NVIDIA investigation confirmed that they were at a different warehouse that NVIDIA had seen. Oh okay, if you say so! Thanks also for specifying that you confirmed the circuit boards — which were removed from the full chip for some reason! — had not been sent to China. No need to give us any further information! Bloomberg would also identify a Chinese company called “Shanghai Shuoyao” having a near-identical website and investor deck (as mentioned) to Megaspeed. In Megaspeed’s version, the company discussed several “specific area computing clusters” in unnamed locations in “East South Asia”.  In Shanghai Shuoyao’s version of the website, these clusters were in China — specifically, the cities of Beijing, Shanghai, Shenzhen, and Wuhu. Per Bloomberg: And that’s how we get to the mysterious Ms. Huang — who appears to go by Huang Le, Alice Huang and Huang Xiaole, depending on the company, as I wrote in March: Various Twitter posters have unearthed both photos and videos of Jensen and Alice Huang (again, unrelated), but none of them feel more devastating than this : The full arm across the back and around the neck. The confident smile. Oh yeah, they fuckin’!  Seriously, I wish I had seen this photo back in March. Ladies, if you see a photo of another woman with their arm around a guy’s back like this, you are in the danger zone.   While we can’t say for sure, it appears that Ms. Huang was diverting chips to China, possibly to multiple Chinese data centers with at least one paid for by Tencent, and Jensen may have known about it in the literal and biblical sense. Per Trip Mickle of the New York Times on CNN last night, Alice could summon Jensen in the space of a few minutes . And it appears that NVIDIA was both aware of the Huang tryst and worked diligently to block the US government from investigating Megaspeed further, all to sustain a relationship that was clearly in violation of US Commerce Department export restrictions. So, from what I can piece together, it appears that Megaspeed ran its operation through a Malaysian subsidiary called Speedmatrix, and there’s very little else out there about the company. Anyway, in case you needed more proof that something was wrong, Alice Huang was also detained by the Singaporean police in the middle of 2025, seemingly as part of a probe into Megaspeed, Per Bloomberg : And if you’re wondering whether NVIDIA knew about any of this, you’ll be shocked to hear both that it did and hounded the US commerce department about it, eventually killing an investigation into Megaspeed in the process. According to the New York Times , the US commerce department was “deep into a monthslong investigation” of Megaspeed late last year, only to see it “abruptly transferred to the Justice Department” after getting an email from NVIDIA’s general counsel: Per Bloomberg , NVIDIA used its influence with the Trump administration to “muzzle” Kessler’s team investigating Megaspeed, and specifically wanted to know about Alice Huang’s detainment by the Singaporean authorities. Wow! How completely and utterly corrupt. I sure hope that the general counsel of the largest company on the stock market didn’t somehow interfere with an investigation… So, yeah, no problem everyone, nothing weird going on here. All that happened was that NVIDIA used its influence with the US government to suppress an investigation into a company very likely funnelling sanctioned NVIDIA GPUs to China. Very normal. It should go without saying that the California State Bar should sit down with Tim Teter and have a chat about this whole affair, especially given the following from The Financial Times ’ reporting that the FBI was now investigating the Huang Affair. The only reason I’m not outright bringing up the California State Bar’s Rule 4.1 around Truthful Statements To Others is that it’s unclear where Teter made these comments. Nevertheless, this is deeply ugly.  In any case, let’s be clear about how blatant this scam was. Per The Financial Times , Alice Huang raised hundreds of millions of dollars in funding for a data center, promising that she had “no problem securing GPUs” in early 2025, and no, she wasn't referring to Huawei’s ascend chips : According to documents viewed by the FT, Megaspeed borrowed money from Alibaba via a subsidiary in Singapore called Apex Enterprise Solutions.  Megaspeed offered its entire business as collateral , and Alibaba became its largest client… which is how NVIDIA got introduced to Megaspeed in the first place: How strange! The company that appears to have smuggled NVIDIA GPUs also features China’s largest tech conglomerate as its largest client.  This relationship is also discussed in Culper’s short report . Emphasis mine (from page 3): While I intend to go into much more detail on this in this week’s premium, I need to directly call out one big allegation of Culper Research’s short report on NVIDIA — that 20% of its FY 2026 revenues came from China , or around $43.18 billion. Per Bloomberg , Megaspeed also imported 50,000 more GPUs than NVIDIA originally reported to the US government.  I trust Culper’s reporting, and think everybody needs to truly digest what this means. This is an extremely bad situation, and I honestly wish I had hammered on it earlier and more emphatically. NVIDIA should be in front of a congressional panel. They should put it on the television. Somebody should be arrested and humiliatingly perp-walked into a courthouse in full display to a waiting throng of reporters and cameramen.  In any case, Culper directly alleges that this revenue is going away:  So, it’s very easy to smush together two parts of this story — the Chinese honeypot and her obvious association with Megaspeed — and miss the most obvious part of the story: that NVIDIA has inflated its earnings by more than $4.8 billion using sales to what appears to be a passthrough entity for customers in Mainland China.  And that’s just for one company. The true scale may be far, far greater — and Culper Research believes, as mentioned, the total volume of kit going to Chinese customers amounts to 20 percent of the company’s revenues for FY 2026.  In addition to getting his shit rocked crazy style, Jensen Huang — along with collaborators at NVIDIA including its general counsel — has deliberately and repeatedly violated US commerce law . As much fun as it is to laugh at Jensen’s Bizarre Adventure, it’s very clear that both Huangs have collaborated to profit off of breaking the law, all in service of NVIDIA’s perpetual growth.  And it’s also blatantly obvious that this isn’t the only Chinese (or otherwise sanctioned nation) firm acquiring or buying NVIDIA’s Blackwell chips.  Back in November 2023, JustDario collated a list of NVIDIA’s “ Elite Partners ” — companies that NVIDIA claims “represent the deepest level of partnership with the company” — featuring multiple different “ phantom distributors ” like FongCon Co Ltd, which appears to be run out of an apartment above a wine shop in Taiwan, and a “preferred partner” in Russia with an address that leads to a creepy shed of some sort . This story cuts strangely with the New York Times’ recent reporting that the US Commerce Department cleared GPU sales to several firms that may or may not exist: Back in August 2024, The Information reported that an electric appliance company in China managed to buy $120 million of NVIDIA’s H100 GPUs that were explicitly barred from sale using a shell company in Malaysia — much like Megaspeed did with its chips.  In August 2025, Steve Burke of GamersNexus ran an incredible video about the black market for smuggled NVIDIA GPUs , explaining in detail how A) easy it is to get these chips and B) how little NVIDIA appears to be doing to stop it. I love Steve, and think he’s one of the greatest journalists of our generation, but also think it’s impossible to argue based on this video that the US government or NVIDIA is unaware or incapable of solving this problem. On November 20, 2025 — a day after NVIDIA’s Q3 Fiscal Year 2026 earnings — Reuters reported that the US Justice Department was charging four people “...in a scheme to illegally export NVIDIA AI chips to China.” Said earnings had an exciting new addition — per Kakashii , Jensen Huang and NVIDIA changed how it reported its earnings, changing from reporting revenue from the location of the sale to the billing location of the company:  This meant that NVIDIA could now, say, sell GPUs to a company with a billing address in America or Taiwan, only for the chips to actually go to Singapore, or China, or the fucking moon, and basically every business and finance journalist missed it. Then there’s the obvious, blatant, shameless case of Supermicro (a major vendor for AI servers) founder Wally Liaw, who ( as I also discussed in March ) was arrested along with several co-conspirators for selling hundreds of millions of dollars’ worth of GPUs to China , using hair dryers ( per Tom's Hardware ) to transfer serial numbers from real servers to dummy servers to thwart government inspectors.  Liaw was both very, very dodgy and very much connected to NVIDIA, Jensen Huang, and the greater AI industry. As I wrote back in March: Mere days before the arrest, Wally posed for a photo at NVIDIA’s GTC 2026 conference with the Supermicro team as Jensen and CEO Charles Liang shook hands barely two feet away. It is completely insane that nothing else happened here. Supermicro continued to go about its business despite a cofounder and member of its board of directors being arrested by the Department of Justice for selling chips to the Chinese. Imagine if this happened at Dell! Imagine if former CEO of Accenture Bill Green , a member of Dell’s board, had been secretly using a hair dryer to move serial numbers off of Dell servers to sell to China! We’d have a fucking media blitz about it! It would be a huge scandal! There’s also a direct connection between the Supermicro scandal and the Megaspeed scandal, per Culper’s short report , emphasis mine: Late last night, Bloomberg also reported that Chinese AI lab Moonshot had rented 32 Supermicro servers equipped with B300 GPUs according to online documents they reviewed, all of which were based in China.  From Bloomberg, emphasis mine: How do Supermicro servers keep making it to China? I thought we already arrested Wally Liaw!  These GPU smuggling stories have been around for years , and are left totally-unmentioned in any coverage of NVIDIA’s parabolic growth, despite the fact that it’s very clear that a not-insignificant part of that growth is flowing through illegal sales to China. The New York Times reported on both Megaspeed and Alice Huang in October 2025 , including definitive proof of Megaspeed receiving restricted H800 chips. Yet across the Times’ coverage of NVIDIA’s Q4 (Calendar Year) 2025 , Q1 2026 and Q2 2026 earnings , the Grey Lady neglects to mention anything about the smuggling story. If anything, it actively counters its own reporting. And I quote from its coverage of the Q4 2025 earnings, written by Tripp Mickle, who was one of the four reporters on the Megaspeed story: Apparently a story that convincingly argued that NVIDIA was in fact selling chips to China was irrelevant to a larger discussion of NVIDIA not making any money from selling chips to China.    Half-hearted attempts to criticize NVIDIA’s massive circular financing operation have mostly failed to do anything other than provide marketing for what is ultimately a legal con, framing it as a “ potential vulnerability ” that is otherwise “ unusual ” without ever really saying “this is bad, and it’s a sign that NVIDIA is desperate to generate more revenue so that it can show investors perpetual growth.”  It is not a problem that NVIDIA funds its customers , its customers’ third party compute partners , its customers’ data center leases , its customers’ customers (and competitors ), its customers’ customers’ leases , its customers’ chips , its customers’ landlords , its customers that are on the brink of death , its customers’ customers on the brink of death , and its customers’ customers that can quite literally not afford to pay for compute without its money . As long as it’s “legal,” it’s all “above board,” even when it’s blatantly obvious that NVIDIA has deployed over $100 billion ( per The Information ) as a means of keeping the industry afloat by making sure that everybody has the justification and means to buy and/or rent out its GPUs. NVIDIA is an aggressively and unashamedly dodgy company that has done everything and anything necessary to sustain its growth, deploying about half of its Fiscal Year 2026 revenue to plugging holes in an ecosystem to make everybody ignore one horrible detail: that buying NVIDIA GPUs is a shitty deal for anybody other than Jensen Huang. If it wasn’t, hyperscalers would be screaming about the incredible, actual revenues from their $1.4 trillion or so in capital expenditures. If it wasn’t, CoreWeave wouldn’t be an ever-expanding timebomb that requires a few billion dollars every two months or so, nor would it have to hand billions to IREN , Firmus , Nscale , Lambda , and every other neocloud to buy its chips, or have to agree to rent said chips back from Firmus , Lambda , CoreWeave , or have to backstop Nscale’s lease with Anthropic . These are the actions of a company actively manipulating the marketplace by operating on the fringes of finance law, knowing that the media and the markets will back whatever Jensen Huang says as long as the numbers keep going up and he, well, doesn’t actually break the law.   And remember: NVIDIA also loves lying. Last year the company claimed it had shipped six million Blackwell chips , even though any comparison with its actual revenues would show that wasn’t possible. In the end, it turns out that NVIDIA had changed the definition of what “GPU” meant, per Benzinga:  Anybody saying that this “isn’t lying” because “NVIDIA had a footnote somewhere” as if the media wouldn’t report the six million number as gospel, and the company made no effort to correct them, knowing that braindead analysts and gormless retail investors would read the big, huge, beautiful number and say “wow, Jensen Huang is the best! ”  And then there’s the outright lies , per Thomas Thornton, about how NVIDIA was making effectively no revenue from China. As noted by Shakeel Hashim of Transformer , NVIDIA’s spokespeople have lied repeatedly about the Megaspeed situation, which is par for the course — after all, very few have had the interest or courage to actually push back against their narratives, and the Megaspeed story sat inert for over a year outside of Bloomberg and the New York Times’ reporting, as did Culver’s short sell report that I’ll dig into more in this week’s premium. This is what happens when you fail to push back on the powerful. Mainstream journalism has failed to hold NVIDIA to account, failed to warn investors of the risks, failed to push the powerful for clarity, failed to speak directly about the manipulative, suspicious and outright crooked way that this company runs, and done so all under the banner of perpetual growth and the larger Rot Economy .  Any defense using the word “objectivity” is utterly cowardly — you can use words like “allegedly” or “or “suspicious” or “obfuscative” for any and all of the things I’ve described — they are objective statements, because NVIDIA has acted suspiciously, and taken great pains to mislead the public about its growth, both in its dealings with Chinese shell corporations and how much of its revenue comes from neoclouds effectively handing it back its own money. It’s also fucking laughable how much everybody talks about the “dangers of China getting access to powerful AI.” It already happened! China has NVIDIA GPUs! They’ve had them for years!  The Information reported in December 2025 that DeepSeek trained its latest models using Blackwell GPUs! It’s been happening for years, it’s been reported multiple times, in gratuitous detail, and somehow none of it was relevant to NVIDIA’s earnings or the world at large until it turned out that Jensen had had an affair. When you remove the “Chinese government” and “Whatever Sounds Jensen Makes In The Bedroom,” nearly the entire Megaspeed story has been thoroughly reported! It’s all been out there! And to make matters worse, there were members of the media who said it wasn’t a big deal! Culver’s short report came out in May 2026 and explained in arduous detail — including the Alibaba/Apex deal! — exactly what was going on. Everybody wants this to be a localized story about a horny CEO and a dastardly Chinese spy, but what it actually is is a coordinated, multi-layered conspiracy to dodgy US export controls that may very well have been totally ignored if it wasn’t for the espionage angle. In writing out everything that happened, it’s become alarmingly clear how badly the entire media missed on this, because most of the information is old. I also see little to no discussion of how much of NVIDIA’s revenue was generated through these illicit sales. As I mentioned previously : Could those all be above-board American businesses? Sure! But NVIDIA’s deliberate obfuscation of the final destination of its GPU sales now makes its obfuscative revenue disclosures an issue of national security (depending on how you feel about LLMs). It’s impossible to argue that NVIDIA is not selling GPUs to China through a web of proxies and shell corporations — and now the only real questions are how much, to whom, and when. I do not expect the Trump administration to do very much about this, though perhaps I’ll be proven wrong given the “China” of it all, and how brazenly NVIDIA has acted. In any case, one has to ask — why did Jensen Huang blow up his life?  The Wall Street Journal reports that he met Alice Huang sometime in “early 2024” at an NVIDIA event — likely referring to GTC 2024 in March — and then met again in June 2024 at Computex Taipei: The fact that Alice Huang — the CEO of a barely-existent “Singaporean” neocloud — was at a party seated next to the CEO of NVIDIA and senior executives from Gigabyte (a huge NVIDIA partner) is in and of itself indicative of their closeness and (I’d guess) an attempt by Jensen to impress her. Every guy has, at some point, desperately fallen for a girl and overcompensated when trying to impress her, and while everybody will try and frame this as simply business and sex, I suggest something very, very different: Jensen Huang actually liked this woman, and dare I say it, I think she made him happy. The average Jensen photo has a cold sternness — and, I hate to say it, he doesn’t look particularly happy when photographed with his wife Lori, who is a victim of a horny, greedy man who got taken in by the world’s most obvious honeypot. Even when becoming visibly frustrated with Dwarkesh Patel and saying that he (Jensen) wasn’t “somebody that woke up a loser ” — all while emphatically arguing that NVIDIA should ship GPUs to China — Jensen remains relatively stone-faced. Now, let’s take a look at his face when he’s next to Alice Huang:  This big, strong, powerful man, dare I say it, being himself after goofily falling for someone that turned out to be a Chinese spy, a fact that Jensen may or may not have been aware of. I have looked at an alarming amount of photos of Jensen Huang for this piece, and I can find no other examples of him looking this happy.  And, like many powerful men, Jensen Huang is too much of a fucking coward to do the work to either cut off the relationship before the cheating, or file for divorce before doing so. I’m not condoning anything he’s done, but time after time guys refuse to make the tough decisions, opting instead for a continually-compounding chain of easy yet dangerous choices that ultimately blew up in their faces. Most will describe this relationship in terms of sex and a greater con, and they may indeed be right. Perhaps there’s a world where Jensen found a kind of thrill from giving it to a foreign agent “Feynman style,” all while helping her acquire billions of dollars’ worth of GPUs. Perhaps he had no idea, but that would make him one of the stupidest men alive. I think the reality is a little sadder — Jensen has (or had) genuine feelings for Alice, she made him feel alive , and he, like so many other men, chose to make boneheaded choice after boneheaded choice to impress her, engaging in some of the single-worst examples of OpSec ( by which I mean being repeatedly photographed and videoed with her, and also selling her billions of dollars’ worth of GPUs ) in the history of modern society.  This man is worth $150 billion and would have likely been swindled by Bugs Bunny in drag .  Despite claiming he didn’t wake up a loser , all that money and power couldn’t protect the man from his heart or his hog, and apparently Jensen’s parallel processing was insufficient to stop the dastardly Chinese from running the most obvious honeypot in history.   No amount of money or power can stop an insecure man from refusing to take responsibility for his feelings or frustrations. Huang believed that he could have whatever he wanted under whatever terms he wanted, and in walking that line got burned, thinking he was smart enough to outrun consequence. He didn’t care about his wife, his company, national security, or really anything other than what he was doing to or with Ms. (Alice) Huang. And like every big, stupid dickhead, he assumed that nothing bad would ever happen, that nobody would find out, and that the way that NVIDIA obfuscates its customers’ locations would keep his tryst and Megaspeed’s sales hidden. When Megaspeed came to light, I would bet he assumed the media and the Trump administration would simply leave it alone, which was true right up until Alice Huang was revealed to be a Chinese agent. In some ways he was correct. As I’ve repeatedly said, the Megaspeed story has been publicly-known for more than a year , explained in exhaustive detail in both Bloomberg and the New York Times in late 2025, my own coverage in March 2026 and Culper’s short report in May — shit, I even mentioned Megaspeed seven minutes into my interview with Jon Stewart on October 28 2026 — and sweet fuck all happened until the news broke of Ms. Huang’s job with the Chinese intelligence services.  The media happily continued reporting on every billion dollar stimulus that NVIDIA issued to random AI companies and neoclouds without a single mention of the obvious, blatant GPU smuggling operation going on in broad daylight, reported at length with pictures and proof, mostly because NVIDIA refused to admit it.   Even now, as Huang’s dirty business is on display for all and sundry, NVIDIA has yet to discuss — or be asked — about Megaspeed itself in any interview I can find. Jim Cramer , Emily Chiang , and anyone else who sat in front of Jensen without asking about this directly should be ashamed of themselves. Anyone attempting to claim that this has “nothing to do” with NVIDIA’s overall business is a fucking mark. We have compelling evidence that NVIDIA has been inflating its revenues using Chinese smuggling operations — and have done so for years — that were likely known at the highest levels of the company.  In a sane society, outside of an AI bubble, this would have led to the immediate resignation of both Jensen Huang and general counsel Tim Teter.  And let’s be clear about something. Jensen Huang is not an “ incredible human .” He’s a liar, likely a crook, a manipulator, and based on all the reports I’ve read should already be in handcuffs. Jensen has acted like a coward and a loser, and what he's done outright sucks — for national security reasons, for how brazen it is, and how much embarrassment and humiliation he’s brought his family, especially his wife of 40 years.  It is a tremendously shitty thing to do before you get to how Jensen Huang likely violated US sanctions around selling NVIDIA GPUs to China. He is not a “great guy” or “a good human,” he’s a horrible, avaricious toad that got too horny and greedy. He wanted to have sex, he wanted to sell more GPUs, and he ran them in parallel, “Grace Blackwell style.” It is not a “mistake” to fuck another woman decades into your marriage, nor is it a “mistake” to sell that woman’s company billions of dollars of GPUs, nor is it a mistake to repeatedly have your comms people lie, nor is it a mistake to use your general counsel to intimidate the commerce department into looking away from your obvious misdeeds.  Jensen Huang is, aside from everything else, a genuinely embarrassing example of what it means to be a man. As the CEO of the largest company on the American stock market and the bedrock of the entire AI bubble, all he had to do was keep selling GPUs and simply sell Alice Huang some GPUs without any of that messy romance — but his worthless, cowardly, weak-willed ass couldn’t help himself.  If you are a guy who feels compelled to defend Jensen Huang because of any allegiance to the AI industry or men in general, you are a colossal loser and have the mindset of a peasant.  The tech industry should outright reject weak-willed and morally-corrupt losers like Jensen Huang. As one of the richest and most-powerful people in the world, we should hold NVIDIA’s CEO to the highest standards imaginable both legally and socially, and that includes crucifying him for embarrassing his wife, his family, his company and his country. From the circular finance to the infidelity to the lies to the intimidation to the fucking brazen nature of all of the above, everything Huang has done is utterly repulsive, and should be treated as such. And let’s not forget that he has forced billions of dollars’ worth of GPUs on hyperscalers months before they need them , massively inflating the price of RAM and all consumer electronics as a result , all as a means of creating perpetual growth for NVIDIA — a truly horrifying and immoral act that made billions of people’s lives worse so that a company could hit its quarterly revenue estimates. Those defending this practice too have the minds of peasants, and crave the abusive control of a feudal lord with their entire being.  NVIDIA should fire Jensen Huang immediately, along with its general counsel. The US government should immediately start a criminal investigation into Megaspeed and all connected counterparties, as well as anyone at NVIDIA who oversaw any smuggling operations. The SEC should thoroughly investigate NVIDIA’s revenue recognition standards, and the US government should create regulatory standards that make its tactics illegal.  If you disagree, you are advocating for the corrupt and deceitful to profit at any cost. Men like Jensen Huang are the reason that the tech industry sucks, and until it purges these morally-repugnant oafs, our entire society will suffer.  If you liked this piece, you should subscribe to my premium newsletter, and you can subscribe on the following links: $70 a year , $18 a quarter , or $7 a month . Friday’s premium newsletter will be a continuation of this story. We’ve got a lot to say about NVIDIA, Megaspeed, and the illicit flow of AI GPUs into China. You won’t want to miss it.  If you want to get in touch — and especially if you have any juicy information about Anthropic, OpenAI, or any other companies in the AI bubble — hit me up on Signal at ezitron.76. I’m also on IB on your Bloomberg Terminal.  It means that 20% of the largest company on the stock market’s revenue comes from illicit sales to China. If that’s even half true — and I believe it, given everything else you’ve read today — that revenue is either going away or is long gone depending on how stupid NVIDIA has been. It’s reasonable to assume that somebody is going to jail based on the sheer scale of the operation. It’s also reasonable to assume that Megaspeed is, as Culper’s source said, the tip of the iceberg, as its orders only added up to around $4.8 billion.

0 views
Martin Fowler Yesterday

Fragments: November 10

It’s that time of the year when the November Thoughtworks Technology Radar appears. Again my colleagues have taken a sweep of the technologies that our teams have used in the field, and pulled together a summary of what’s popped up in the last six months. It’s been a busy half-year, one that again has been dominated by AI, and that’s reflected in the many AI blips on the radar. The mass of blips makes it hard to develop a coherent story around trends, but Chris Ford has done a fine job of the writing the accompanying article on macro trends . One team of passionate people experimenting with agents can make almost anything work. They share a context, a credit card and a mental model. They review each other’s work because they sit together, and they know what to check and how much latitude to give the coding agent. Two hundred people, though, cannot work that way. The moment agentic AI becomes an operating model rather than a pilot, a second layer of problems appears: How is context shared between teams? What’s the token bill? How do we deal with increased review demands? What’s the agent allowed to reach, read and change? And who’s now responsible for the harness everyone depends on? Experience so far suggests that the questions that enterprises face are about: shared context, token cost, cognitive load, security, and platform building. While these issues are distinct, they are not separate, so strategies to answer them must take all of them into account. I also echo Chris in reminding us that however impressive these tools are, we must remember that while we have to rethink systems and workflows to utilize these technologies, they should be built to serve humans - and we should all benefit from its bounty. ❄                ❄                ❄                ❄                ❄ Ben Thompson’s Stratechery newsletter reflects on the recent election’s impact on data centers . I watch a lot of sports, and particularly this fall, watched a lot of baseball. My Milwaukee Brewers — excuse me, my World Champion Milwaukee Brewers — demanded my full attention, which also meant I saw a lot of campaign ads, and by far the most common topic, at least here in Wisconsin, was data centers. Moreover, it was never entirely clear which way it cut politically: both parties were anti-data center, accusing their opponent of being the opposite. He points out that this opposition is recent, and tied to a shift in focus from the internet and streaming movies to AI: you know, the technology that in the best case scenario is going to take everyone’s jobs, and in the worst case scenario end the human race. There’s going to be a lot said about how Democratic officials will be at the heart of blocking data center building, but as his point above about campaign ads illustrates, the opposition to data centers is (at least at the moment) a bi-partisan opposition. He follows up with “ten takes” from these consequences. The big beneficiaries of this opposition to building data centers will be those who own the data centers that have already been built. The opposition will reduce supply of tokens, meaning that token costs will go up, thus increasing the profits for those who already have their token generators plugged in and humming. There’s also benefits to those who aren’t constrained by the need to build more big data centers. Other countries aren’t affected by a change in US policy, China is the most talked-about case here, but it’s not the only country that may benefit from a drop in US data center building. Apple may also benefit, if it means more AI work is pushed to edge devices that are their territory, in addition to having not sunk so many dollars into AI-specific investments. To his analysis, I’ll add that this may also have a somewhat counter-intuitive effect on regulation, and corporate attitudes to it. The common expectation is that businesses are opposed to government regulation, since that interferes with their free pursuit of profit. That’s true to an extent, but it’s quite common to see established businesses lobby (quietly) in favor of regulation that acts as a barrier to new competitors. So I wouldn’t be at all surprised to see companies that have already built data centers to be pushing for regulations that impede or prevent new ones from being built. ❄                ❄                ❄                ❄                ❄ I’ve been a long-time fan of Hadley Wickham, for how he has tamed the rather messy world of R programming into a well-designed tidyverse . He is another thoughtful voice to listen to as we move into the world of agentic engineering , in this case by trying to figure out what the real cost of tokens is . I hear a lot of suspicion that AI tokens are unsustainably priced and that frontier labs are heavily subsidising costs with their VC money. They want to get us hooked now, so they can pull the rug out from under us whenever they want to make a bunch of money. Is that true? My sense is that it’s mostly not. But can I back that up with some data? His conclusion is that it doesn’t seem that token costs are significantly subsidized on per-token API basis, but they are with subscription plans. (He caveats his analysis, saying it doesn’t take into account recouping the costs of training the models.) ❄                ❄                ❄                ❄                ❄ There’s a creepy excitement at the thought that models are clever enough to edit the weights of models, an activity that Takehi et al refer to as Weight-Space Programming . Just by looking at the raw weights, GPT-6 Astra can tell what a network was trained to do. And without any environment feedback, it has no trouble writing, from scratch, small game-playing networks that outplay networks trained with PPO for 100 million steps. While we don’t know if we’ll ever be able to download skills directly into our brains ( “I know kung fu” - or for those in my particular demographic: Joe 90 ), this does raise the possibility of downloading capabilities into models by manipulating their weights. Simon Wilison riffed on this paper by examining whether an LLM can understand model behaviors from the weights alone , by examining four simple neural networks, each trained to play a specific game, and figuring out which game it was by just looking at the weights. ❄                ❄                ❄                ❄                ❄ Jessica Kerr (jessitron): My days of teaching AI to do stuff are numbered. Getting it to teach me stuff is more fun. ❄                ❄                ❄                ❄                ❄ Houck et al (that “al” includes some folks who I’ve learned to pay a lot of attention to), look at how we can assess the quality of context supplied to agents. An agent may draw from source code, specifications, issue trackers, chat histories, architectural documents, tool output, and user instructions, then act on that combination with limited human supervision. Information that was written for different audiences, at different times, and for different purposes is brought together into a temporary operating environment for a particular task. Whether each source is individually useful does not reveal whether the resulting context is fit for the work the agent is being asked to do. They’ve come up with a framework for describing the quality of this assembled context , which they refer to as CAFE(S). The acronym refers to five dimensions they look at: They also list a set of half-a-dozen “context smells”: common cases where these break down (and a nod to Kent’s original metaphor ) I’m not sure about the name, (how exactly should I pronounce “CAFE(S)”?) and the article exhibits rather more LLM Voice that I prefer. But on the whole I think this is a good framing for thinking about an important part of feeding our silicon servants/overlords. ❄                ❄                ❄                ❄                ❄ Cindy Sridharan noted that the problems she ran into six months ago are no longer around : What was missing in my setup 6 months ago was the verification process I now use. 70% of my daily token spend goes into verifying patches, and only ~20-30% into creating them. That resonated with conversations I’ve had with folks using agents in enterprise settings. They are using far more tokens to check the working of models (through guardrails and evals) than they are to generate a response to a request. A single request to a model from a customer may trigger a dozen turns to other models to probe its input and verify its output. Clarity: Can the agent interpret the request as intended? Actionability: Can the agent proceed, and know when it is done? Fidelity: Can the agent trust that this context is true? Efficiency: Can the agent focus on what matters? Security: Should the agent have this context at all?

0 views
Martin Fowler Yesterday

Long-horizon agents and durable execution

Long-horizon agents can automate complex tasks that take days or weeks to complete and involve multiple exchanges with people and external systems. Many things can go wrong during this time, including process crashes, network failures, and unanticipated real-world behavior. Kiran Prakash explains durable execution: an emerging pattern that helps agents recover from these failures and move towards their goal. In this programming model, the runtime keeps a record of the result of each step that interacts with the outside world so that, when a failure occurs, the program runs again, completed steps are skipped, and the program's state is rebuilt from the record.

0 views
Stratechery 2 days ago

The Jensen Huang Story Gets Worse, Washington vs. New York, Silicon Valley

The Jensen Huang story got worse for him on Monday; the real risk for Huang is governance, even more than national security. Who benefits?

0 views
マリウス 2 days ago

Stickerbombed: Lenovo X1 Carbon Gen 14 Aura

Especially with laptops being an attractive target for thieves at airports and touristic areas, I not only enjoy telling a story through the appearance of my devices, but I also find customizing the appearance a good way to deceive snatchers into mistaking these items for something of lower and potentially uninteresting value. Unlike the average tech bro that collects stickers of their favorite tech corporations and stacks, only to stick them onto their MacBooks in an uninspiring way, I prefer to carefully plan my stickerbombing and create a well-crafted collage that tells a story. For that, I use stickers that I collect throughout my travels , and also order specific stickers, which I then cut into new motifs. Instead of Silicon Valley logos, my works usually contain imagery that is reflective of personal life events, social topics, and sometimes satire. If you like this sort of art and are looking for further inspiration for your own projects, you might enjoy the books by Stickerbombworld , as well as the c/stickerbomb and r/stickerbomb communities.

0 views