Latest Posts (20 found)

We Need All the Disciplines

From where I sit, figuring out what to build, building it, and shipping it are all part of the art of making software. Many disciplines have emerged through the years to facilitate this work: product, design, engineering, devops, etc. We need all these disciplines to make great, dependable software (granted, in different doses). Each brings different values and judgments; each sees things the others don’t. And including all might mean going a bit slower. Human collaboration may seem less “efficient” than handing the work over entirely to the machines. But inefficiency may be the cost of collaborating with humans, rather than extracting an output from a machine. We gain not only from their judgment and expertise in a particular discipline, but from the relationship, trust, and shared understanding that blossoms from making something together. As the old proverb says: “If you want to go fast, go alone. If you want to go far, go together.” Reformulated for today: If you want to go fast, go with the LLM. If you want to go far, go with your fellow humans. Reply via: Email · Mastodon · Bluesky

0 views

OSI approved the curl license

curl started out GPL licensed, as direct inheritance from its httpget days, but in October 1998 we switched to the Mozilla Public License (MPL). In 2001, we added the MIT license as an additional license to optionally use in addition to MPL. We made curl dual licensed because clearly the MPL license caused problems for some users – primarily because it was deemed not compatible with GPL. In 2002 we dropped the MPL option and curl was from then on licensed only under the MIT license. Kind of. Because of reasons we cannot recall anymore, I decided to ever so slightly edit the language in the MIT license text around that time. (I strongly discourage anyone else from doing this, and if my time machine was functional I would go back and correct this decision.) The license text we then kept referring to and thinking about as an MIT license, was in fact not exactly MIT anymore. No one objected at the time. I can’t remember anyone really considering the implications at the time. Maybe because not that many people noticed or cared. It was in essence still the MIT license. Decades later, the SPDX project quite correctly and ruthlessly made the distinction between a proper MIT and a modified MIT matter: they created a separate and unique identified to the license curl uses. It may be almost like MIT but they deemed the differences big enough to say that the curl license is a special beast. It is since then known as the curl license. I have over the years casually kept referring to the license as MIT since it helps users understand even though it is technically incorrect. Open Source people in general tend to know the MIT license and the implications of using it. A drawback with having our own license is that it was not immediately recognized and known as Open Source or Free Software; not acknowledged and verified by FSF nor OSI. On April 17, 2026. The Open Source Initiative approved the curl license . It is since then officially arguably slightly more Open Source than before. I don’t think anyone ever doubted or that it was actually much of a drawback in adoption or usage, but it feels good to finally have this checkmark. I write about this now (many months after the fact) because I totally forgot that this was happening and I only recently realized OSI approved it back in April.

0 views

When Software Meets Hardware

When software meets hardware, engineering principles remain largely the same, but the sensible defaults often change. Kuldeep Singh describes our experience modernizing a large IoT fleet of battery-powered sensors. Our familiar principles remained important; what changed was how we applied them. These practices emerged through experiments, failures, and operational experience—each challenge helping us replace a reasonable assumption with a more sensible default.

0 views

A Conversation With Ari Emanuel About Entertainment and AI

Listen to this post: Good morning, This week’s Stratechery Interview ended up not being an Interview, but rather a conversation with Hollywood super-agent Ari Emanuel . Emanuel is the Executive Chairman of WME Group , Executive Chair and CEO of TKO Group Holdings (the owner of UFC and WWE), and Founder of MARI , a live events and experiences company. The occasion for this conversation née interview was the recent publication of Emanuel’s memoir, Roll the Calls , a reference to Emanuel’s relentless daily phone call routine; I got on Emanuel’s roll for the first time a couple of years ago, and quickly learned that when Emanuel wants something he gets it. That’s a theme of his book, and of this interview: Emanuel decided he wanted to have a conversation and ask me some questions too, so that’s exactly what we did. We cover everything from the state of social networks, AI’s impact on Hollywood and the tech industry, and what skills might not just persist but become more valuable. We also discuss why Emanuel is making such a big bet on live, whether or not Hollywood is logical, and whether talking on the phone is the antidote to polarization. As a reminder, all Stratechery content, including interviews, is available as a podcast; click the link at the top of this email to add Stratechery to your podcast player. On to the conversation: This interview is lightly edited for clarity and content. Ari Emanuel: Can I ask you one question? Because I saw your interview . Who was it — you did it with a guy in New York. Patrick O’Shaughnessy ? AE: Patrick, yeah, who I love. Yeah, I read your interview with him , it was great. AE: I loved your point of view, and explain a little bit more to me because I love your thinking — that on a SaaS model, the only one, based on my understanding, based on your model right now, that’s got it right, OpenAI should have gone to advertising as opposed to charging, Muse has it right. Yeah, for sure. AE: They don’t need to charge you because they have the other revenue stream. Right. And well, not just that, but the LLM, like, it’s actually really interesting. So when they launched Muse, they made this promise, “We won’t use your data that you use with Muse for advertising”, and no one cares . No one knows they made that promise, and no one cares, because no one cares about that stuff. And so they, in some respects, handicapped themselves by making this promise. AE: Just like Apple, we’re not going to look at your data, major mistake when Tim [Cook] said that. Right. But in the long run, I think it’s going to pay off, because you’re going to have this complete change in how advertising works. Right now you sort of have data on the user and you have data, broadly speaking, of what a particular product matches with and you’re matching, it’s called the two-towers approach . So you’re matching these two things together, and that’s how advertising basically works at scale, and it’s all these vector databases, all these sorts of things. AE: Television never did it properly. That’s right. So the way advertising is going to work in the future, and it’s already happening, is it’s going to predict what you want. AE: Well, the funny thing, what I thought when you said that— (laughing) I can never remember if I’ve said it before. AE: One is, Mark is going to be able to make a ton personally and charge, he’s going to be able to use the AI to do it, and it’s going to be just more and more and more. It’s more than that. So what you’re going to do is you’re going to get a personalized ad predictor that basically is inside your VM. They’re going to be credibly able to say it’s totally private, because it is totally private. AE: Because it’s just directed at you. That’s right, it’s just predicting what you want to see. Just like it’s going to be a predictor of content you want to see. AE: Oh, I didn’t think about it that way, yeah. The reason why there’s such massive upside is this whole agent thing — this is the real Google threat. So everyone thought when ChatGPT came out, that was a threat to Google, but the human was still in the loop . As long as the human is still in the loop, Google is okay. But all of Google Search, Amazon search— AE: Once the human is out of the way… Then all these search-skim ad models, which is what all these models are, they’re all bullshit models, because it’s just attacks on search. AE: Well, are you saying the same thing about Amazon? Yeah, 100%. AE: I think Amazon, because of Muse — I mean, Walmart made the deal with them. Which is a huge deal . AE: Amazon’s going to have to figure out — I mean, a lot of stuff is going to go through. Well, and the problem is that the problem with having a physical moat is that means you have a lot of capital tied up in that, which means you do have a forcing function that means you have to adjust. AE: It’s what happens when you’re just saying that when you have a digital, not a personal, on the Amazon side, your $60 billion is in jeopardy on your advertising business. I mean, it’s a problem. It’s a big problem, a huge problem for them. So the upside is the new products still need advertising, and things like live events, all the sorts of personalized stuff that the Internet makes possible. Like, one of the most important functions is going to be the generation of human desire, that is the post-AI economy. AE: MARI ! That’s exactly how I think about it. It’s like, you know, not only what Elon [Musk] said to me — it can’t be disintermediated. Don’t waste it. We’re going to get to it. I get to talk now, you don’t get to talk, because I have to record this for the interview. AE: I can’t believe we’re not recording now! I am recording, but I didn’t say we hadn’t started yet, so maybe we can include this. We should make this more of a conversation. AE: We can just go. This is the interview. Okay, this is the interview, we started. AE: Exactly how my life goes. Okay, I’ll throw away my script here. AE: The reason I love talking to you is this, I can’t articulate it as well as you can. You have this massive need for the generation of human desire, and you’re going to have people like you who are creating the vessels in which to sort of collect that human desire. But that means that advertising has just been between 1% and 2% of GDP, so let’s say that holds. AE: Oh, it’s going up more. It has gone up with digital, yeah, it’s up to between 2% and 3% now, but historically, it’s been between 1% and 2%. AE: I think it’s going to above that. I think it will too. So this is the conservative estimate. Amazon advertising is impaired, and Google advertising is impaired, because there’s no more human in the loop, that advertising is going to flow to surfaces that are not impacted by AI. AE: Facebook. AE: I couldn’t think, after that conversation you had with Patrick, if there’s another group out there, and maybe it’s X? Because I think Elon’s going to do that, right? But I didn’t think of another one, another kind of digital player that could do that, except maybe Microsoft inside LinkedIn. Which, by the way, is doing very well. AE: Very well. Because actually that is a digital personal because people are involved. I think social networks are only going to get more valuable over time, not less. AE: I agree. If anything, we’re almost at the nadir of social network value. AE: So name the social networks in the United States. Facebook. Instagram. X. And I said LinkedIn. Did I miss one? No, I don’t think so. So that’s the brilliant thing about Muse, it’s not only this phenomenal opportunity, it’s also a direct heat missile at Meta’s competitors, to the extent it lands, and that money’s going to flow back into Meta. AE: And I think it actually — depending on what [Amazon CEO] Andy [Jassy] does, who’s very smart, he’s got to make a deal. Over time, he’s got to figure out that $60 billion, which is one of the biggest problems. Here’s one thing that’s interesting, and I’m curious what you’re thinking about it. So in the long run, of course, AI is very highly deflationary but I think there’s an aspect that it is short-to-medium-term inflationary , in that ads are a subsidy to the people who are not impacted by the ads. Stuff is cheaper, Amazon is a good example — the prices Amazon charges are definitionally less than they would be absent advertising. And we know this because their advertising revenue is more than their e-commerce revenue — or their profit, I should say. AE: And the advertising does subsidize all that. That’s right. So if the advertising goes away and they have to charge more, that is actually inflationary to a certain extent, because prices have to go up. And I think you’re going to see this — like, for example, what’s a very easy Muse use case? Find these subscriptions that are lingering, what subscriptions do I have that I should cancel? There’s a lot of advertising businesses that are supported by people forgetting to cancel their subscription. AE: This is the same argument I’ve been making with people. The cable business — ESPN was elevated not because so many people were watching it, there was that select group of people that had to have it, and then they could get up to $10 for it. And everyone paid it. AE: And once that broke with Netflix, etc., it just went away. The cable operators and cable were broken, it just fell to the ground. Yep, and you have to pay directly for sports, so sports fans were the biggest welfare recipients in history throughout the entire cable era. AE: And now they’re going to pay for it, but advertisers are going to pay premiums for it, because it’s a very high-end group of people that they want, on whatever platform they have. All the video advertising, streaming advertising — particularly to your point, if they actually finally do it right. And which, by the way, Amazon is probably the furthest ahead there, generally speaking. AE: I think [Skydance CEO] David Ellison will catch up. He hired the right CTO out of Facebook , and he’s going to build a pretty good model. The one place — would you define YouTube as a social network? It’s in between, right? What is a social network? So is Instagram even a social network anymore? It is, to an extent. But the big shift, and the reason why TikTok sort of blindsided Meta , is TikTok is classified as a social network, but it’s not a social network at all, it’s a user-generated content network. AE: Well, so is Reels. That’s right, and Reels is a direct response to realizing, “Holy cow, we missed it”. AE: And the issue is that, unlike Threads, Reels works. There’s this famous Paul Krugman article that’s saying the Internet is not going to have any more economic impact than a fax machine . AE: He said that? Yeah. Maybe it was a long time ago, I wrote about 2014, he must have said it in the late ’90s, early 2000s or something. And the reason is because most people don’t have anything interesting to say and the funny thing is he was actually half right and you saw this with what happened to Facebook. As long as your content was limited to people you knew, it was fun. AE: Everybody cared! They came to not care, because what happened was TikTok realized, if you’re limiting what people see to only the people you know, they’re not seeing the best stuff. What the TikTok algorithm does is it basically finds the best content across the entire service, and feeds it to you, such that it’s the best content in the world — even though the percentage of good content to bad content is hilariously small. The vast majority of content sucks, but the absolute value of good content is very large, because the total amount of content is so great, even if you get a very small number on a massive denominator. And so they’re like, “We’ll just show you the best content”. AE: And that’s what their algorithm did, they could figure that out. That’s right, and that was Meta’s blind spot, because they killed Snapchat by leveraging their network. You already had friends — you could see a story on Instagram, and it was instantly useful to you, because you were already following people on Instagram. AE: But why — I want to ask you a question, and this brings up Snapchat. Why hasn’t he [Snap CEO Evan Spiegel], as opposed to doing glasses, figured out he is one of the last social networks? And it’s still good. He’s got a billion users. (laughing) There’s a lot of good questions that can be asked about Evan Spiegel ‘s corporate governance, most of which are not very flattering . AE: I mean, he is one of the last social networks, we’re talking about social networks — he’s one of the last ones, and he actually still has a great user base. He does, and it’s still young. AE: Very young, and they use it to talk to people. The engagement is off the charts. If you use it, you use it all the time. AE: And if he did it right with AI, as opposed to the glasses I mean, this is the eternal Snapchat question. That’s why they are still such a lure to investors, despite the fact they pay out gazillions in stock-based compensation , they never seem to really make money, blindsided by Apple a few years ago , and all these sorts of things, is because it’s so clearly a tremendously valuable asset. AE: And completely utilized by a generation. Yeah, absolutely. So, yes, Snapchat is always a question. AE: So now let’s get to the advertising piece on live. Because my opinion is the following, let’s just say you were right, 1% or 2%. By the way, this is a perfect framing for this interview, where you just sort of took it over. I think we’re actually conveying, at a meta level, the experience — the Ari Emanuel experience. So anyway, continue. AE: (laughing) Well, it’s kind of the experience, I’ve been reading your newsletter, and I just call you out of the blue, and we start talking. Well, your book is Roll the Calls. AE: You got one of them! I rolled you! You did. It kind of made me scared for this interview when I was actually reading the book, I’m like, “do you actually stop for an hour and not talk on the phone?”. AE: Yeah, because it’s an interesting conversation, I’m going to learn something. I did remember the first time you called me. AE: You were in Asia, weren’t you? No, I was in Seattle the first time you called me, but I was still living in Asia. And the second time I was in Asia, I missed your call in the middle of the night. But what was striking is your assistant emailed me, I found the email asking for my phone number which says, “Ari wants to call you”. I replied, and I think my phone rang within 30 seconds, which was stunning to me. AE: (laughing) Were you sleeping, and you had woken up and got there? No, it was Microsoft Build, it was in May, so I was there. I think I was going to interview [Microsoft CEO] Satya [Nadella] . I was in the lounge at the Hyatt downtown getting breakfast. AE: Oh, wow. I don’t remember what the conversation was about. It was some Article I wrote, I don’t remember what it was. AE: I didn’t understand it completely, and I wanted some answers. Do you still talk on the phone as much as you did back in the ’80s? AE: Oh my god, yeah. I don’t like this whole thing. Ron Meyer once said to me, we were talking about this — and he still reads papers, and I read papers online — and he said, “You know, if texting existed before telephones did, and then all of a sudden telephones came out, people would be calling people as opposed to texting”, because the reverse happened, texting’s cool, and people just do that. So yeah, I’d rather have a conversation. The bandwidth is just higher. AE: Especially for me — one, being dyslexic. Two, the misinterpretation, potentially. Larry David can write funny texting, I can’t do that. Well, I think what’s interesting is, I mean, a lot of the book is — and you talk about this — just sort of your not giving up, I think, is a generous way to put it. Asking a million times, you mentioned the dyslexic angle, not being embarrassed, people can keep saying no — it doesn’t bother you. But I think there’s an aspect of that relentlessness combined with, in a phone call, because it’s so much higher bandwidth, you get the shape of the problem or the shape of the person much more clearly and so that pressure you’re putting on is also much more finely targeted. AE: When I get on a phone call, like I just hung up with Marc Andreessen about something, and I didn’t understand something he was asking me, I was asking him a question. I just want the answer to that one thing. I’m not sitting here — it could be 14 calls, because I might have multiple calls, but in each situation I don’t have a long conversation. I just don’t understand something, I want an answer, I’m going to the people that I think have an answer. That answer, for whatever my life is going on, answers some question that I want answered, to kind of continue a conversation or understand something so I can think about what we’re doing, how we’re thinking about this. This is one of the reasons I wanted to do this — because one, I love your newsletter, I read it, as you know, consistently, but I was wondering, AI, live — your point of view on it. I have a point of view — one, that people are going to have more free time, they’re going to come to it. But also, I think there’s going to be the ability to put it on social and I think advertising in arena is going to go pretty high, because you’re concentrated and I think that’s true for both TKO and I think that time that people have now is going to be so much more precious, they’re going to have more money — we can talk about that — and it’s just like where the world’s going. So is it “Mari”? Is that how you say it? AE: Do you know how that name came about? AE: I have a Monday morning weekly call with all the executives at TKO — WWE, UFC, everybody — and we were going over, I don’t know, an advertising issue or a site fee issue and the executive goes, “Mari!”, I go, because Mark Shapiro was talking — I go, “What did you just say?”. Oh, it was Mark and Ari. AE: I lost my shit on him, it was hysterical, then I had shirts made with “Mari” — Mark and my face combined, it was really funny, so that’s how it came. You mentioned, as far as the thesis, people are going to have more free time, live events are going to become more valuable. AE: And what were you just saying about your point of view about people’s time and events? You were just talking about. I agree. And I think there’s a second layer, which is I can relate to — you just have a question, you want to get answered. You came up in like the age of the world talking on the phone so of course you’re going to call someone to get the answer. AE: Or somebody that I think has thought about it maybe differently than me, that I could — would make me change an opinion or add to my opinion. Right. Well, but in the ’80s, you’re an agent, you needed to know everything that was going on and that was the original purpose of rolling the calls. So I obviously am younger than you. AE: It’s not obvious that you’re younger. (laughing) I know, you do look great. These are your barbells and your famous walking treadmill . So Google came out when I was in college, it was unbelievable, it was so much better than everything else. But even before then, you go back to me being a kid, and like having the encyclopedia at home, or having the dictionary. Every time you encounter a new word, go look it up, every time you encounter a concept, look it up. This aspect of just always, if anything comes up that I don’t know, “Get the answer!”. AI obviously takes this to the extreme — do you ever ask AI for any of your questions? AE: All the time. I was having this conversation — maybe this is way too political. I just didn’t understand why people, both on the far left and the far right, were using the phrase “genocide” as it relates to Israel and I said, “How the F did that work?”, there was that book about how words were created, I forgot the name of the book, long time ago I read it. So I used Grok, and it said, “This guy, 1944, a lawyer , family went through the Holocaust, etc”, and I’m like, they’re trying to take a word that was created because of a genocide, by a Jew, and make it their own — the whole thing blew me away, we all constantly use it. But that’s a great topic where it’s like, are you going to have like an unloaded conversation about that? AE: Every time I ask somebody, “Do you know where that came from?”, I just did it with Bill Maher — nobody knows. This guy in 1944 was adopted by the UN in ’48, and they defined the term in two different — a Latin word and a Greek word, and it was crazy. There’s this aspect though, when you can ask AI anything — tech is really fundamentally atomizing as it is , you all have your individual feed, I could be sitting here on TikTok, you’d be on TikTok, we’re watching totally different things, even though we’re sitting next to each other. Although our TikToks would probably be relatively somewhat similar. AE: You’re looking at golf videos? I go through phases. AE: (laughing) I go golf and surfing videos. Yeah, we’re getting into skiing season, all very aspirational. Not reflected in real life at all, at least for me. But one area where we still would talk to people all the time is asking for help or asking questions, “How do I do this?”, “I’m trying to figure this out”. And one of the amazing unlocks for AI is you can do anything. My assistant was just here and, like, he’s creating all these AI apps, and he didn’t know what GitHub was. He had to do all these sorts of things, but it’s fine — he could just take screenshots, and the AI would walk him through it. So on one hand, that’s phenomenal, that’s amazing, anyone can do anything if they have volition. On the other hand, in one fell swoop, we eliminated an entire vector of human contact. AE: No question. I now no longer — if you really want to get to it — except for how to train, you can put videos of your golf swing into the AI and say— I have a friend that does this ! AE: “How does Mac O’Grady think about P2 and P3 and P5?”, and it shows you exactly. Yep, and he’s like, “My golf game has progressed more in the last three months because of that”. AE: A hundred percent. But the point of that is, I think this fundamental desire for human connection is going— AE: Going to skyrocket. That’s right. And so that’s the benefit of actual social media, not just UGC social media, but actual people that you know. It’s to the benefit of live and live events. AE: But don’t you think AI is going to help user-generated? It’s going to unlock more creativity? They’re going to be able to do more because of it, and create more interesting user — with a little bit of AI in it? And I don’t think that is going to be detrimental to interaction. Oh, I’m not saying UGC is going away, this is an “and”. AE: I agree with you. One thing that has come up in reading your book and thinking of your history, very sort of clear, you came up big in TV when it wasn’t super popular. AE: You know why? Because the scripts were short. AE: 39 pages. See, I actually read the book. AE: It was so fucking great when I saw that I stopped sweating when people used to give me 120, 140-page feature scripts. I used to, when I got them at CAA, I used to go to Warner Brothers, and I would have the person that was doing coverage get me the coverage. So if there was a modern screen-reading software where the AI could just read it to you, would you have been a movie guy? AE: Oh my god, I do it now. I read a bunch of scripts, but one of the great softwares, I use Speechify — it’s incredible how it reads the script to me, and I can get them done now, understand them all in an hour. It’s fantastic. But then you see streaming coming, that’s sort of a big shift and I think sort of being attuned to technological changes and their inevitability. I actually have a question about that, I want to ask about the streaming shift specifically. But where do you see AI then in terms of entertainment? AE: I think it’s going to be an incredible unlock for creativity. There’s going to be some disintermediation for people inside the system that now exist because you can imagine, very soon, you’re just shooting — either it’s a green screen or light stage — you get the shot, you put it into the AI, say, “I now want this”, or you do the makeup once, and then the guy or the woman never has to put on makeup. There’s going to be some difficult conversations. But for the likes of great filmmakers like Baz Luhrmann or Alejandro , I think it’s only going to be one of the great creative unlocks of all time, and David Ellison talks about it, a lot of people talk about it. And I think the cost of production is going to come down in a good way. That means there’s going to be more content and I think there’s going to be more time for the consumer, and therefore a lot more content being made because David Ellison’s going to pay $30, I think Netflix is starting to pay more, Disney, Amazon, that’s only a good thing. There’s going to be more content being made, more creative, I think you’re going to find also a lot more creative people that we’re not thinking about now that are going to use AI to create an incredible storyline. But isn’t this ultimately a YouTube bull case ? Why is that good for Hollywood? AE: No, I still think you need a Ben Affleck , a Marty Scorsese , a Baz Luhrmann — you need real, you know, Jim Brooks , Larry David — you need great creative to make great product. I don’t think it is like, “Oh, anybody can make a great movie, a great TV show”, I don’t think the AI is going to step into that breach, I do not believe that. Is it going to be, though, much more — you’re going to find the next great creators because they did get started on their own? AE: No, no, no. I think, first of all, if you are a creator — whether it be a writer, director, actor, whatever — this town finds you. Has that changed? How has that changed in the last 40 years? AE: It hasn’t. An agent’s going to find you, whether that be on YouTube or wherever, they’re going to find you and they’re going to help you and the great thing about being an agent is there’s constant conflict — budget, actor, distribution, storylines. Our job is to, one, get the best economics for you, find you the money. It’s going to be easier, because I think it’s going to be less money and then make sure the distribution, the marketing, and all that works properly. There’s going to be other ways to distribute it, that maybe you can create models that, depending on the economics, you can use the system on social, YouTube, etc., but the job of an agent to find those people — one, that are creatively incredible, and to match them and resolve the conflicts that occur — that is a skill set that I don’t think is going away anytime soon. Is Hollywood agents? Because I just asked about Hollywood, and you just gave me the bull case for agents, are they one and the same thing? AE: Well, you need us to make sure that whole assembly line of when products get made, to happen and sometimes it happens at the high end, which is a Warner, a Netflix, an Amazon, a Disney, and sometimes it happens at a smaller scale, and then you have to navigate how to get bigger people with better economics to buy it and that’s the job of an agent. One way to think about your career is you’re an agent, you’re hustling, start your own firm, firm needs to get bigger, you have two transformative deals — William Morris and then IMG . But then there’s the, “What? They just bought what? UFC?” AE: Well, what we did was, you know, this was Egon Durban and myself and when we were just William Morris, I was running around all over the world trying to raise money, as Teddy [ Theodore Forstmann ] got sick. In IMG, back in the day, I went to see Eike Batista in Brazil, who was at the time at $30 billion, one of the fifth richest men in the world, I saw Martin Sorrell when he was running WPP, Khaldoon [Al Mubarak] in Abu Dhabi, just to, “Okay, I think I’m going to need this amount of money”, and then I had been in business, you know, been talking through Raine , Marc Andreessen and Egon Durban. And Egon and I — when he had Skype, and then he had sold it, he wanted to put content on Skype, he had thought about that way before anybody was thinking about that. I think that was 2009 or ’10, so we had been talking about how to do that, he wanted Raine to invest. And he saw the world early, before anybody in PE had seen it, where it was going with content and distribution and that and when we had built the company, we were global, we had live events, we had sports production, sports distribution — we had negotiated all these deals on sports and movie and television rights. And we said, “We should now own something”, so we just had this combination where, when we represent something, we realized, “Oh, they’re losing value, and we could change it, then we could buy it”, we had the licensing business, all these things, we had sponsorship, if you put something on that you owned, you could really reap the benefits, and you do all the things anyway — you’re just collecting 10% and that was a conversation we had. The first one actually was PBR , and we made that work. And then Lorenzo and Frank Fertitta decided to sell and our nervousness was it was on Fox, the deal I had made — they could have stepped in easily, and then Jeff Bewkes at Warner wanted it, or his team wanted it. Jeff was trying to downsize, to sell it, and so he didn’t want to do it and that just left us against the Chinese, who was the other bidder. And Dana [White] didn’t want to go with them — he wanted to come, I’d known him for 20-plus years, and it was an easy transition. You just articulated it, because you moved from this somewhat unstable, like, why did you have to get big, people could leave you with clients, or agents could take their clients with them, into this much more stable owning IP. AE: Owning an asset. Owning an asset. But is there an aspect where, with AI, as it becomes more and more pervasive, as it creates more and more options in terms of content, that actually being an agent is going to be a better place to be precisely because of that human component that made it feel so unstable? AE: Yeah, I mean, I think there’s going to be an incredible place for being an agent. Incredible. Across everything we just talked about, sports. You’ve articulated — which I completely agree with — the extent to which AI supercharges particularly exceptional individuals . Presumably, those super-exceptional individuals would benefit from having an agent, I think that would be your take. AE: If they’re as creative as those super-exceptional people on the business side of their life in the entertainment business — creative as it relates to getting financing, structuring the deals, resolving conflict, marketing, bringing them new IP that they’re not thinking about — I think there’s going to be incredible value. Should people in technology have agents? If you have this sort of idea that — Keith Rabois has had this analogy of barrels versus bullets that companies only have a limited number of barrels, and a company’s capacity is constrained by how many barrels they have. And that most people are bullets — they are pointed and directed by the barrel, as it were. AE: You know, Mike Milken said to me once — he thought teachers one day would have agents. They’re probably doing the lecture business, and probably in the book business because he said universities are really going to be vying for the top. Well, you have this situation now. People are getting paid, AI researchers are getting millions of dollars. AE: And I guess you could say that’s an extension of what Mike said probably about nine years ago, ten years ago. I don’t see the value, personally, that I could bring but I’d probably — with probably some VCs, that probably could happen. Is the VC model even going to make sense, if actually it’s just going to be a world like the superstar world of Hollywood, actually going to be the model for lots of other industries? AE: And I have a really good relationship — I think Mark thinks that VCs are going to exist. Well, I mean, he’s very invested in making sure that’s the case. AE: (laughing) Do you think it is? It’s already changed tremendously. And one way that it’s changed is the first — I think — massive change was AWS , where you used to have to, your initial raising of money was literally just to buy the equipment, so you could actually express the idea and you had a shift to you could actually just build the idea, and then you could rent off of that, and as that’s progressed, right now, a lot of VC money is really just about distribution. On the consumer side, that could literally just be buying ads on the — but more traditionally, with like SaaS, it’s like sales teams, all these things. To the extent that’s the case, then it probably still has a role, because distribution is the hard thing, you’re going to have to pay for distribution. And so we’re basically — we’re already there. AE: They are actually agents, but for companies. And so I think actually the shift in VC already happened. AE: They’re the agents, they’re just not for the individual AI guys, but for companies. It’s also just a particular form of capital, the bigger threat question for VC is, “How many companies are there?”. If the models eat everything, that’s a problem, if the models end up being this commoditized layer on which you can build lots of companies and services, then it’s going to be a greater and greater. AE: Do you think software completely goes away? I just had Ryan Smith on the phone, you know, his firm, and he’s in the software business, and he’s saying they don’t go away. Definitely in his interest, he’s got to defend his. No, but I think the pricing pressure is going to be pretty severe. AE: And they bought at the high, all these guys. The credible alternative is rolling your own and it’s not just that rolling your own is going to be viable, but it’s going to arguably be desirable, because you can build the exact solution that you want. Now, the reality is, building software is fine, maintaining it is hard. I think a strength of American business generally is an overall allergy to doing stuff that’s not your differentiator. AE: I agree. I see this in us. I remember I went to Europe a couple years ago, and suddenly I realized why one of the reasons they’re so bananas about this data protection stuff is because, everywhere you go in Europe, they all have their own customized software that is asking for way too much information. Like, I’m going to a museum, you don’t need to know how many children I have with food allergies. Whereas everyone in the U.S. is like, “Oh, we’re not going to do that, we’re going to just sort of buy off the shelf from someone else”. AE: Because they have so many regs. I don’t know what it is. It’s crazy how many regs they have. It’s nuts. But this is sort of like a life philosophy thing I have, which is you will always benefit from doubling down your strengths, as opposed to trying to ameliorate your weaknesses — or fix your weaknesses. You paper over them to the extent that it’s possible, you can double down your strengths. And I think that U.S. business in general does a very good job of that and that is actually the optimistic case for software. AE: That is the engine of U.S. capitalism. Right. The U.S. tolerates more downside in exchange for more upside and that’s like an articulation of that. So given that, even though people could write their own software, it’s probably not going to be that smart to actually do it but there will be some cases where it just works so much better. I think the bigger problem for the software companies, at least in the short to medium term, is vastly increased competition for their customers. AE: Well, there’s going to be people that are going to do it. And then all of a sudden, one’s going to be incredible, because they’ve written this incredible software that competes with an existing — and then there’s going to be new competition, pricing pressure. If you had your lane and everyone had their lane, if AI actually supercharges productivity for every company, they’re going to want to expand horizontally , which means there’s going to be a lot more competition in other software companies. Which again is going to compete down margins. I think a lot of margin pressure, I think there will still be a software market. AE: A lot of these PE firms that invested at the high end are going to get crushed. Oh yeah. Yeah, like if you had money in, in 2021 or so. AE: Now, here’s the other question I have for you, what inning are we in on AI? It depends on what framework you’re looking at. AE: I’m just asking you, your framework right now. Very early. There’s a sequence of games, if you want to use the inning metaphor. By the way, I’m glad I’m in L.A. and know that you are not a Dodgers fan. AE: I’m a Cubs fan. I know. I’m a Brewers fan. I don’t like the Cubs either AE: You don’t like the Cubs? Yeah well, you’ve killed us. So shut up. (laughing) Back to innings. The game right now is the devouring of everything digital. And that is going to play out for a while. Any company that is digital is threatened. They have opportunities, but they’re also very threatened. There’s, I think, the next game is going into the physical world. AE: What do you mean by that? Robots. Like actual, like manifesting into — and I think that game is a lot further away than people think . AE: Because, let me just tell you something. I went up and I saw the hand that Elon’s building, which is incredible. It’s still difficult, very difficult to manufacture, very difficult to train. Chinese are not doing it any better. It’s hard. No, especially when it comes to fine motor movements. Really, really hard. AE: Yeah, it’s really, really hard. Will they get it? I think they’ll get it. I don’t know if it’s in two years. Not just that, but once you’re in the physical world — I mean, you can already see companies struggling with inference having marginal cost, when they’re used to compute basically being treated as free. Now, if you think about costs, it sort of throws a wrench in things. When you’re dealing with actual physical robots that will break down, and maintenance, and all these sorts of things, the cost structures are just totally foreign as well. So I think that’s quite a ways away. AE: Well, I say to everybody, Elon was talking about copilot or self-driving 12 years ago, 8 years ago, something like that. It’s now incredible, the car, even though he said probably a lot sooner, it’s now incredible. This is the Elon experience in a nutshell — what he says, the timing’s not always right. But what he says is right. AE: It’s going to happen. I just think the timing is a lot — you know, is it a decade? Is it five years? We’re a little bit off. But is that coming? And when that comes, it’s going to be an incredible — GDP is going to go crazy. Right. Well, but I think you can see even in the digital area, where everything in digital is threatened right now — and yet, not that much has changed, even though the AI’s capabilities are very high, because change takes time and one of my theses about SaaS companies, to sort of go back, is SaaS is actually a demographic story . AE: SaaS is a demographic story? That’s right. AE: What the fuck do you mean by that? So of course, you had to have the technology for SaaS to be possible — ubiquitous broadband, browsers with sort of capabilities to do web apps. But you also needed a generation entering the workforce that was used to clicking around on web pages to do stuff and that wasn’t a foreign concept. AE: Yeah, and that took a little bit of time. It took a new generation. And where, of course, “There’s a web app to do this sort of thing”, is the default assumption. You go back to the ’80s. AE: What was the first SaaS company? Depends how you define it, but I would say Microsoft, in that they really pioneered subscription pricing, it took a while to actually get there, that’s a business model question. I think from startups, I think Box is one of them that was very early. Poor Aaron Levie , he just got killed on his — he had such a vision for SaaS, but it was so early, it was so hard for him to raise money, that by the time he finally got that company to market, he barely owns a tiny slice of it even though he sort of helped write— AE: He’s really smart. Their prospectus is actually really interesting, they went out the first time, and total rejection by the market so they withdrew their S-1 and I actually talked to him about this at the time. And what came up with for the second S-1 was cohort analysis. This idea that — you need to not look at the company as a whole, because it’s going to be unprofitable, you look at a cohort, and it grows in profitability over time. And once you see that, you realize you actually want your SaaS company to be losing money, because the way monetization works, the more money you’re losing, the more your upside is actually increasing. Which ended up being — that was every S-1 that came after that had a cohort analysis in it. AE: That’s a little history. Yeah, a little history. But you go back to the ’80s, you had people bringing PCs to work — like toy PCs, like Commodores or Apple IIs, or even Apple I before that and that’s how the whole IBM/Windows story happens. IT administrators are like, “We want them to buy IBM, can you please make something for them?”. But even then, people were using it as a glorified typewriter. There’s just the generational component of — how are most people using AI today? As glorified search. That is the analogy to the glorified typewriter. AE: A little bit of topspin on it, it will take a generation. I mean, my wife now — she’s designing, for her fashion line, almost everything, then giving it to designers, designers are tweaking it, it’s going back and forth, that will just become like one more iteration, “It is what it is”. But at the top end, you still need the high-end designer to make sure the tweaks are human. The problem is the AI is sort of — it’s a probability distribution, you’re sort of definitionally getting middlebrow. AE: You’re getting — what did George Gilder say? You’re getting the greatest average. Right. But the other thing with AI is, if you just ask a general question, that’s what you get. This is part of my pushback on a lot of the safety stuff — AI is still a responsive entity, it responds to a prompt. AE: As I like to say, it’s like watching television, you’re still leaning back. The thing is, the AI will give you what you put in. And so if you talk to the AI about an agent-related question, the quality of analysis that you would get out of the AI would probably blow you away, this is really, really good. If I ask the AI an agent question, it’s going to be the most Wikipedia-esque, basic thing. I’ve talked about this, there was a friend — there was some court case that happened, I think it was something App Store related, it was relatively early on. I’m like, “It was unbelievable how good the AI analysis was”, because I was going back and forth with it, and he’s like, “Oh really? I wasn’t impressed at all”, and I looked — he had asked the AI, “What do I think about this case?”, and it was the most generic answer, it’s such a general question. Whereas I already had an angle on it, because I knew a lot about the area. But I also asked a very specific legal question about it, and then it was like very in-depth. AE: That’s why I think there’s going to be an incredible creative unlock in our business. When Baz Luhrmann is inputting what he wants as a scene, as a shot, etc., and he’s giving it exactly what you’re saying — what he needs — or Ben Affleck, or Pete Berg , or whatever — the conversation is completely different from you doing it. Right — I have no idea what to ask for. AE: Yeah, and I just think there is that 5% that I do not think the AI, because it’s the greatest average, is going to be able to kind of take the next step. I don’t believe it gets past that point. I still think the human condition is needed, and that’s where the greatest value comes from. Right. Also, for stuff that is sort of net new, and taste — taste is not a verifiable function. AE: It’s the black box. That’s right. So one thing that was interesting, you mentioned the politics angle before, I want to ask you another question about your phone call thing. You mentioned you called one of your most famous people you represented — who was obviously Donald Trump, who you fired in 2016. AE: I didn’t fire him! The President shouldn’t be making money. I can’t make money, it’s okay. You related a phone call that you had in 2024, after he was reelected, and I love the anecdote, it was just like a very sort of back-and-forth conversation. Is he the one person in the world who likes to talk on the phone more than you? AE: He likes to talk on the phone, he always picks up, he’s incredible on the phone. He’ll pick up, talk to you about anything, and you can say anything you want to him. Tell him your point of view on it, he’ll push back or not, he’ll take it in, he’ll say what things are that are on his mind, and you can push, have a conversation, and then he’s off the phone. Right. Well, because you mentioned this in the context of, obviously, Dana White spoke at the Republican Convention, Elon Musk was part of the administration, you’re close to both for obvious reasons. And you said in the book, like, “Yeah, I lost the election, but I’m not going to not be friends with half the world”. AE: Yeah, I’m not going to not talk to you. I completely agree with, I think that’s a great sentiment. How much of that is actually intertwined with you being the phone guy? Like, how much of the feeling, like, “I can’t even relate to or connect to people on the other side”, is because people are living in text? AE: I don’t think you can get a sense of a person unless you’re either Zooming or FaceTiming with them, or talking to them. I said it at the beginning — I don’t know if you’re joking or being serious on a text, it’s just too hard, I’m not that sophisticated, and it gets completely misinterpreted. If I pick up the phone, you can say whatever you want to me, you can be aggressive, not aggressive, I can be aggressive, not aggressive. You know exactly who you’re talking to. Or you FaceTime, or you’re doing a Zoom — that’s human interaction. I mean, it’s a little bit distant if it’s a Zoom or a FaceTime, but it’s, you know, during COVID we had to do that but that’s how people can truly understand people and get across their opinion. A lot of times with Elon, I’m texting. But you have a foundation of talking to him in person. AE: A long time. But at least there’s a conversation happening, and you believe it’s familial — that you’re humans and you’re talking. Right, it gives the benefit of the doubt. To the extent that AI comes along and wipes out digital, because everything digital is under threat, and AI is actually going to do everything digital better — things like MARI are more interesting and compelling. Not just because there’s more free time. AE: I think the multiples on MARI are — not that they go up like AI, but are on the same path. I hate that people have framed it as the anti-AI bet. It’s a pro-AI bet, you guys are going to consume all this other stuff. AE: When I say — I’ve said the phrase “anti,” meaning the opposite bet of AI. It’s like the bizarro-AI bet. Yeah. AE: Yeah, it’s like — what’s going to happen in the world? Well, this is going to have to happen, because we’re human, we’re social animals, I think the multiples are going to go up. Not maybe in comparison, because it’s just the economics between them — but they’re going to go up in live. Are you going to actually solve political polarization? Because digital — how much is that actually a driver of this? And people are going to get back to the real world, talking to people. AE: Here’s my opinion about it. I think when you have live events, or live sports, or live music like Michael Rapino , it brings people from all social elements together. I mean, one of the things my brother Rahm Emanuel is saying — he wants to bring back a requirement that people do service for the country — because it’s the way it used to be, where somebody from X neighborhood and somebody from Y neighborhood that would have never interfaced, do service to the country for 18 months and that we all kind of understand each other. When I go to a baseball game — I was at a baseball game, sitting watching the Cubs win — there was a guy next to me, he’s definitely a Republican. It was obviously not a Brewers game, because the Cubs won. AE: No, it wasn’t a Brewers game. We didn’t care that he was Republican and I was Democrat. We were just cheering for them, and it kind of broke all barriers and that’s hopefully the two businesses that I’m in heavily. That’s the great thing about it. For sure and that’s very optimistic. I guess the question, though, is if you think about the MARI business model, and you go to like the Miami Open or something like that — is there also an underlying thesis that actually the rich are just very under-monetized? AE: I think high-end experiences are only getting better, because there’s a great deal of rich people that want singular experiences. But we create environments for all. And, you know, there’s inside the tennis tournament, there’s XYZ, and outside there’s another 10,000 people watching it on all the screens. And Larry Ellison and David Ellison do it, and their event — we do it in Madrid also — where anybody can come and have an experience so I think we’re trying to optimize for all. And what overall — is there a thesis with MARI that you can sort of systematize this delivery of live experiences, and do that at scale? AE: So we have it broken down. There’s the sports vertical, which is our tennis tournaments, our participatory sports. We have our collectible business, which is Frieze , Barrett-Jackson , Collect-A-Con, which is our Pokémon experience. Then we have, like, a holiday — Winter Wonderland, our food festivals — all the stuff in that. And then we just executed against the theater business. So the West End and Broadway — we have 70 theaters in this company called ATG. We think that is a kind of incredible — there hasn’t been one person on the live event side that exists. In the music space, it’s Live Nation and AEG. In live events, there are onesies and twosies, and so we’re trying to capture that. And what we do is, between taking things international when it’s a domestic thing — like Frieze, it was in London and New York. Now there’s two events in London, one in New York, now there’s two events in New York, one in Chicago, one in L.A., one in South Korea. And now we’re just — I think next month, we’re doing one in Abu Dhabi, and there’s other areas. We’re going to do the same thing with Collect-A-Con on the Pokémon business, you saw how we’ve expanded when we had UFC — performance institutes and our fights all over the globe now. Then we do unbelievable sponsorship, site fees now, that’s what we do, so we’ve kind of got it down to a system of how we monetize the assets. So what is next? Is it just acquiring more events, then, so you can plug into the system? AE: It’s really taking our events, like Frieze, and we’re looking at different art fairs all over the place. Barrett-Jackson — can we expand it internationally? Other car auction businesses we can get into? Are there other things like Collect-A-Con — that’s Pokémon, are there other ones that we could do? And so we just look at them. When ATG came available, it’s the perfect kind of vertical that we didn’t have, that we wanted to have. When you think about these events — but also do it like TKO and UFC and WWE — what do you think, from a business model perspective? Is it ticketing? Is it advertising? What’s the balance between those? AE: It first starts with broadcast globally. Then from broadcast, you’re the sponsorship. Then where you take the events internationally, can you get site fees? Then you’re adding — there’s a customer that wants really high end, and will pay for really high end. And then there’s the general public, making sure their experience is incredible. And so those four or five stacks are how we think about the business, to maximize economics. How does that align with the way you think about UFC and WWE? AE: Those are all the things that it started. This concept started with the UFC and then we brought our sponsorship business, our site fee business to the WWE, our premium ticketing business, our ability — Mark Shapiro and myself — to make sure our broadcast deals, domestically, internationally, all of that. For those broadcast rights business — are those, in the long run, going to be about driving subscribers or driving ads? AE: I think for each company it’s different, but they’re all moving to an SVOD and AVOD service. One of the things that we saw early on at the UFC, we knew that they were going to have to get to an AVOD — from a SaaS model to an advertising-based model and one of the greatest drivers there is sports, because it’s the greatest reality show. The Monday Night game — you don’t know what’s going to happen. Overtime, you think the Rams are going to win, the Bills won, and it’s the greatest model. It’s the same thing with our sports so it’s one of the great drivers and you now have four big competitors. Do you have any concern about ending up in sort of monopsony situation where there’s not enough buyers? AE: No. They’re all going to need it. And there’s going to be a bunch of them? AE: You’re now going to see what happens with Comcast and Apple. You have YouTube out there, I think all these models are going to change. One of the fastest things growing for David Ellison at Skydance is Pluto . Right. Fox put together Roku and Tubi , which I thought was a great deal. AE: So you’re going to have a lot of bidders. The one thing that’s great — and I think about this all the time — if the Lakers are $12.5 billion. Fantastic. Love the franchise. Good story in your book about buying tickets. AE: That’s a team. And that’s not the league. If a team is worth that, what are my four leagues worth? Because we have boxing, WWE. Is that part of the allure of the UFC and WWE — you kind of get the whole thing? AE: Yeah, running a league is different than running a team, they’re both very difficult to do. You know, they both have their personnel issues and management issues and etc. But, you know, Mark and I — The difficulty is the moat. AE: Mark and I run leagues. Those are hard things to do, as opposed to just a team. You’re thinking about different things, and if a team is worth that — what are the four leagues worth? I have a different conversation than the stock market is telling us right at this moment. Is the sporting asset, given your whole model, that you are the most jealous of, Formula One ? AE: No! I think it’s an incredible sport. Just all the things you’re talking about — the combination of the in-person events plus the rights, and all those sorts of things. AE: I mean, think about it. First of all, I love golf, I love snooker. I mean, there’s a lot of sports that I love, that doesn’t mean that I want to be in business with them, or run them. Is there a world — just to go back historically a little bit — where you see streaming coming, and streaming shows up, and it’s actually this big boom, because it’s an extra window? AE: At the time, remember, you had network syndication, so on the RSNs, you then had a cable window, it was incredible. And then all of a sudden Netflix came, you had a third window. And is there a world where that actually persists? AE: Well, I don’t think the syndication model — first of all, most shows are happening on streaming. You don’t get to 100 episodes, which was required. But the reason they’re happening on streaming is because everyone decided they need to compete with Netflix. Instead, there’s a world where everyone accepts Netflix as the permanent third window, and actually makes more money all along instead of shooting themselves in the foot . AE: That’s a logical conversation. But let me say the other side of this conversation. Do I think the network business goes to zero in cable? No, I don’t. So there is going to be a play. Remember, the original — when I was in the business, you needed to get to 100 episodes to get into syndication, now you’re doing 40 episodes. That’s a lot these days. AE: That’s like four seasons. So what’s the syndication window to that? It’s different. And Netflix is owning them, HBO is owning them, you’re just negotiating for the profit participants. Is Hollywood logical? AE: Yeah. That’s the only way I know — that you’ve been able to create over 100 years of great entertainment on the global scale, one of our great exports in the United States. Don’t you think? Oh, for sure. Massive soft-power instrument. AE: And I think it’s probably on the export basis — I might be wrong about this — probably our fifth or sixth most important export economically. I write about media along with tech and Hollywood to a certain extent and my hit rate feels lower than it is, sort of, with just more tech companies and I hate the explanation that it’s because Hollywood acts more irrational. AE: Not on every individual movie or television show. Because what do they say — if you’re batting .300 in baseball, you’re in the Hall of Fame. Same thing in Hollywood. So that’s, you know, there’s 66% — right — you’re screwing up. Well, you mentioned David Ellison several times. Why is what he’s doing make sense? AE: He believes if you change the tech — he believes that there’s going to be more consumption, economics for creating products is going to come down, that he’s going to be able to create unbelievable value in the SaaS model, and also take this direct-to-consumer business with the ad-based model that he has now, and also create vertical content on-site that he can kind of capture greater value than it currently exists. He’s the only one that will own his cloud, own his tech, etc. Netflix has AWS, I think Disney’s trying to change its tech right now. Why do you need to own your own cloud? AE: Well, I think he thinks — I think by owning that data, he’s going to get more understanding of the consumer and etc. We’ll see, that’s his point of view. Can I ask you a question? Did you like the book? I did. I was plowing through — no one cares about my personal schedule, but it’s been very fraught, but I was listening to it while driving, and I discovered on the plane I could listen at 3.5x speed and read at the same time, and it was unbelievable, I’ve actually never done this before. AE: I do it all the time. Both at the same time. AE: I don’t look at the book. When I’m listening, I usually do a 3, 3.2x — you fly. But if you’re listening and reading, you enter such a zone. I was flying — I flew here this morning from Chicago to L.A., I was shocked when we were landing. But it helped. I thought the book was very entertaining, I enjoyed it. How much did you write versus— AE: You know, what we did is, when we started in 2016, [J.R. Moehringer] just kept on asking me questions. Then I answered all the questions. We met once a month, and every other week, every other month, and then he first met all my assistants. I was going to ask you, how many assistants have you had? AE: A lot. Some of them had kept journals, it was the craziest thing, then they met family members, friends and so he just compiled it, and then he and I went back as he was piecing it together. Then we were supposed to end when we first went public, but we didn’t go public, and then we just continued until it was 10 years. What would you add if the book had come out a year later? What’s missing from it? AE: I don’t know. The response has been kind of crazy from parents that have dyslexic kids, people that have dyslexia, people loving — like, re-understanding that being aggressive and rage, and taking agency for yourself, is a good thing, not a bad thing, because they’ve grown up in this place where you have to be delicate. It’s been crazy. So all in all, I’m completely happy to where it’s at right now. Yeah. The bit about you know, you frame it as rage, but really just agency — forcing resolution. AE: Yeah. I think that’s important to get to the end. I was having a conversation today about it. It’s like, why do I want to play this stupid game? Like — I know what you’re doing, you know that I know, let’s just have the conversation. You have to do this for this reason, I know that, just get to it already. I cannot stand this whole gray area. I can say I don’t like you, or I like you, and here’s what you did to me, and here’s how I feel about it, and go fuck yourself, and it’s ok. Isn’t that, like, very — particularly on the West Coast — West Coast always strikes me as much more indirect, passive-aggressive. AE: Oh you don’t think Wall Street or Silicon Valley is indirect? No, Silicon Valley is. I think Wall Street’s much more direct. AE: Oh you do? I was thinking about the East Coast versus West Coast, you’re from Chicago. AE: We’re pretty direct in Chicago. Yeah. Is that the real secret? AE: Maybe. I mean, it’s the only way I know how to do it, maybe that’s because I grew up with my mom and dad, and that’s what we did at our dinner table. Well, thank you. I’ll remind you — we’ll have an ending, since we didn’t have a beginning, but thank you for coming on to Stratechery. AE: (lauging) I appreciate it. This Daily Update Interview is also available as a podcast. To receive it in your podcast player, visit Stratechery . The Daily Update is intended for a single recipient, but occasional forwarding is totally fine! If you would like to order multiple subscriptions for your team with a group discount (minimum 5), please contact me directly. Thanks for being a supporter, and have a great day!

0 views
Unsung Today

“No standard format for writing data to these tapes”

An 11-minute video from MattKC documenting huge effort to revive a backup tape from a 2000 game Frogger 2: Swampy’s Revenge: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/no-standard-format-for-writing-data-to-these-tapes/yt1-play.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/no-standard-format-for-writing-data-to-these-tapes/yt1-play.1600w.avif" type="image/avif"> This is a pretty harrowing story of restoration, including an extremely obscure backup tape made by a short-lived Dutch company, attempts to reverse engineer a poorly documented data format, a data recovery company that damaged the tape instead of restoring it, and a mad hack to trick the drive into reading it anyway.

0 views

More on Anthropic's Scion ripping off Mononoke

Update: Nick G. from Anthropic has responded on Hacker News , and sufficient attribution has been added to Anthropic’s blog post. I stand by my posts as of the time I wrote them. Discuss on Hacker News . In response to yesterday’s post about Anthropic’s Scion ripping off Mononoke, I received a number of questions and concerns. Here’s a followup to answer the big ones. This was a ripoff. My post yesterday was trying to be as charitable as possible given what I knew, and in particular that the similarity to Mononoke was mostly unintentional and the lack of credit was the result of not doing due diligence. However, after publishing the post I privately received confirmation that Scion intentionally and blatantly ripped off Mononoke, and in particular that there was overlap in personnel. There is no chance that this was an unintentional homage. This is something I had a hunch about but was not comfortable saying yesterday, given what I knew back then. The resemblance is much deeper than just the notion of derived data. Some people pointed out that derived data is just an index, which is a well-known concept. I want to clarify that derived data was merely the most striking resemblance. It goes much deeper than that, and extends to the entire data model, as well as a number of the structures built around it. Here is how Anthropic describes Scion changesets: Mononoke has the same concept; we call it a Bonsai changeset. In the same Oxide materials from 2022, here’s how I described them: They are exactly the same. Even the name “Scion” reverses the syllables of “Bonsai” and drops the “B”! This might be a coincidence, or might not. For derived data, I also wanted to draw attention to the kinds of indexes being built, such as for blame. Needing to do this is a natural consequence of the Bonsai data model, so it’s not surprising that indexes need to be built; I was drawing attention to the striking similarity in terminology and framing, because that was indeed how we used to think about it during my time on Meta’s source control team. Another set of resemblances is in the server-side API to do version control queries and mutations with. This was implemented in Mononoke, but I believe other systems before Mononoke had it as well, so I’m not going to claim novelty. But if what you did is point Claude at Mononoke and asked it to rebuild that, you would probably design something very similar. The Bonsai data model is wildly contrarian. I want to emphasize that the prevailing wisdom in source control is Git-like data models. Building a write-ahead log-style Merkle DAG was very far away from what anyone else was doing in 2018, and required solving several hard problems along the way such as how to perform server-side rebases (to my knowledge, one of several novel algorithms in Mononoke). While I was leading the team effort to design and implement the model in 2018, I personally had to justify it to several layers of management at Meta. It is quite rare for skip levels to get pulled in to discuss a system’s data model in depth. The Bonsai data model is also wildly successful. At this point, almost a decade later, the model has been stretched far outside its initial design parameters, and it’s still chugging along. The team effort to build it remains one of my proudest career achivements. Given the overlap in personnel, there is no reasonable way the Scion team could not have known about this. (Which is why they quite reasonably copied it!) This brings us to my next point: The problem is attribution, not copying. I mentioned this in my original post, but I am completely fine with good ideas being copied. I am not fine with the serial numbers being accidentally stripped off, and I am certainly not fine with them being intentionally stripped off. Crediting Sapling for “hard-won lessons” is not enough. Several people pointed out that Mononoke is part of the Sapling ecosystem. The problem here is that Sapling can mean either the VCS client ( , originally forked from ) or the system as a whole. If you were previously on Meta’s source control team, you absolutely know the difference between the two. Besides, the resemblance is much, much deeper than merely “hard-won lessons”. The Lore VCS can claim inspiration from Mononoke, but it differs in several ways as well. Scion’s resemblance to Mononoke goes well beyond that, and merely crediting Sapling (not even Mononoke) with “hard-won lessons” is dishonest. (And specifically, I would expect the Scion changeset section to mention Bonsai changesets as the thing they are copied from.) This makes Anthropic’s achievement significantly less impressive. Anyone who’s put a distributed system into production knows how many issues tend to crop up during the productionizing process. “Our LLM built this thing, productionized it, and dealt with all the attendant challenges over 5 months” is a significantly more compelling narrative than “the source control team at Meta had spent 10 years building and productionizing this system, and we were able to point our LLM at it and rebuild it in 5 months”. …and yet, it is still quite an achievement. Being able to point to an existing system and rebuild it in this short a period is still quite stunning. It is shocking to me that Anthropic didn’t just say they copied Mononoke and rebuilt it in 5 months. That is still noteworthy, even if it isn’t as grand. Surely they knew they would be called out? It is always good to situate your work in the larger context. We all stand on the shoulders of giants! There is nothing wrong with borrowing and adapting existing work to new contexts — that is the vast majority of what I do as an engineer. When you position your work as derivative, you are acknowledging those that came before you, as you hope to be acknowledged by those who come after you. There is nothing without the team. On a personal note, it’s been many years since I worked on Mononoke. There is a team that still carries the torch forward all these years later. Anthropic ripping the Bonsai data model off hit me hard, but spare a thought for the team working on it now: those who were most directly plagiarized. Imagine how they must feel about their work being deliberately copied wholesale and intentionally presented as someone else’s. It’s been two days since I first posted about this on Bluesky and Linkedin, and I haven’t seen an update to the original post yet. This remains yet another shameful example of large AI companies appropriating the commons and presenting others’ work as their own. I don’t know what it will take to rebuild bridges from here, but my default assumption now is that Anthropic’s public engineering presentations are largely bad-faith ripoffs. That’s a shame.

0 views
Unsung Today

“Is clip art actually dead?”

A good video from Linus Boman about clip art , most (in)famous from Microsoft Office, and specifically PowerPoint of the 1990s–2000s: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/is-clip-art-actually-dead/yt1-play.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/is-clip-art-actually-dead/yt1-play.1600w.avif" type="image/avif"> Turns out clip art is a lot older than I expected, and… it also never fully went away. On top of that, Boman covers a lot of aspects – from quality and perception, through the “user interface” of clip art, to how the means of conversion and reproduction changed it forever. I also loved the little “sidebars” in the video. Even if you don’t care about clip art per se, a lot of the threads in the video will be relevant to things like shadcn , Inter , Google Fonts, Canva, The Noun Project , the Claude aesthetic , and so on. Also relevant: Internet Archive’s MS Clipart Search .

0 views
Farid Zakaria Yesterday

Always, sometimes, never

Exit 0 means your program exited 0. That’s it. That’s all it means. 🍞 I have been working on a deterministic VM called Rewind VM , where “a run” (i.e. test, command etc.) is a function of its inputs including the thread schedule. The determinism comes from the tool recording every step which lets you replay it exactly. This alone is a pretty good way to find flaky tests: run the test under Rewind, then runs it under many different thread schedules, with some slight latency added, and failures often crop up. 🐛 Feedback however was that it was not enough: the tool could find a failing schedule, but it could not tell you if that schedule was actually a bug. It only knew that the run ended differently than the original schedule, which could be a crash, a timeout, or just a different exit code. That is not enough to say “this is a bug”. Someone pointed out that I had built most of a property-based testing tool, but I only had one property: matching exit codes. What is property-based testing ? If you have used QuickCheck or Hypothesis , you have already used the idea. You write a property, or constraint, that must hold for every input. The tool generates lots of inputs, and when one breaks the property, it shrinks it down to the smallest input that still fails. already did the generating and the shrinking. The inputs are thread schedules, and narrowing shrinks a failing schedule down to the one step that causes the failure. The only property though was “the run ends the same way schedule 0 did”: the same exit code and the same outputs. That’s a pretty low bar, but easy to improve. 🙃 Rewind now lets specify properties that must be true for every run, or must be true for at least one run, or must never be true in any run. Let’s keep the bank from last time : two tellers deposit into one account from two threads, without a lock . This time the example is in Java as a JUnit 5 suite to appeal to my Enterprise brethren. 1 A teller that runs between the other’s read and store writes a stale balance over the other’s deposit. 💥 We include a “typical” test suite: one teller, two tellers concurrently, and a new account being empty. We run it and see all tests pass and head home for the day. 🍺 Is the code correct? Let’s use Rewind to dig further. Before even looking at the balance, Rewind knows a lot about what a run did . Every open, write, rename, close, fork and exit is in the trace, with the step it happened at. Rewind ships properties computed from the trace alone: Let’s throw a few at the bank and only run schedule 0: Interesting! writes its performance counters to 2 . It has nothing to do with our bug, but I included it because I learned something new and it could have been a bug if it did not include the process ID. The file properties shine for bugs between processes. The properties tutorial has a program that rewrites its config in place while another process rereads it. Its own test fails only when a read lands between the truncate and the last write, but flags it on the very first run. 😲 The bank’s real invariant is not in any syscall though. It lives in memory in our example: the balance variable must add up . For that there is the Rewind SDK , a tiny library you call from your program. Each call writes one line to , a device in Rewind’s VM, and the trace keeps it with the step, process and thread that wrote it. 3 must be true every time the program reaches it. is its opposite: a run that reaches it at all fails. These are your typical , except we get the whole replay if it fails. is the one I find the most interesting and tough to think through at times. 🤓 It tests the search: its condition must be true in at least one of the runs check tries, and it never fails a run. In model-checking terms, is a safety property (nothing bad happens in any run) and is a reachability property (some run gets there). Here it asks whether any run had both tellers inside at the same time. Look at the output above again: The suite passed under schedule 0, but one teller always finished its deposit before the other started. That pass told us nothing about the race. 🤷 Let try its default 64 schedules: That took 40 seconds on my laptop 4 and we found that two deposits went missing. The first line is the again: of the 17 runs check tried before it found the failure, 11 had both tellers inside at once. The fix is the obvious one: hold a lock from the read to the store. Every schedule passes, but is that enough to make us feel warm and fuzzy? The line is what gives me the warm embrace: in 42 of the 65 runs the tellers ran concurrently, but the lock prevented the bug. ✅ 5 A condition that is only true when the bug happens can never be true once the bug is fixed. 💡 Java developers though love writing JUnit tests. Fear not my FizzBuzzEnterprise colleagues, Rewind has you covered: the SDK has a JUnit 5 extension. Put on the test class and it marks each test’s start and result. If you can’t touch the code, reads the XML reports the runner wrote instead: Maven’s surefire, Gradle, pytest’s , whatever writes the format. The Rewind app shows the timeline of a run, with the tests and the build log. The failing test is red, and the event card names the assertion that failed. The strip under the timeline has a span per test: green passed, red failed. Each include a helpeful tooltip with the test name and the steps it ran. All the other Rewind features can then be used to help isolate the cause: the source panel, gdb on a fork at any step, the thread lanes and Check from here. There is a SDK for many languages already included in the Rewind repository. They are tiny, and the only dependency is the Rewind VM itself. The SDK is a single file or two per language, and you can copy it into your project. 6 The properties tutorial goes through each piece step by step, and the advanced tutorial has script properties and a file of properties to keep beside your tests for the more adventurous. If you happen to find any interesting bugs with Rewind let me know. I am keeping track of a small leaderboard of the best ones. 🏆 It is in the Rewind repository, next to the C version.  ↩ turns it off.  ↩ Outside Rewind the device does not exist and every call does nothing, so the calls can stay in your code.  ↩ The JVM is chatty: 148,479 steps for three tests, where the C equivalent takes about 4,500.  ↩ This counter must sit outside the lock. With , the second teller would wait before it reaches the counter.  ↩ The SDK’s README has the format instrunctions if you want to write one for another language.  ↩ C and C++ : , Go : and for Python : , and a pytest plugin that loads itself Java : and the JUnit 5 extension It is in the Rewind repository, next to the C version.  ↩ turns it off.  ↩ Outside Rewind the device does not exist and every call does nothing, so the calls can stay in your code.  ↩ The JVM is chatty: 148,479 steps for three tests, where the C equivalent takes about 4,500.  ↩ This counter must sit outside the lock. With , the second teller would wait before it reaches the counter.  ↩ The SDK’s README has the format instrunctions if you want to write one for another language.  ↩

0 views
Kev Quirk Yesterday

Why is Pure Blog so ugly?

Someone emailed recently to tell me that they like the idea of Pure Blog, but they thought the admin interface was "really ugly" so they can't use it. Fair enough - beauty is in the eye of the beholder and all that, but I don't think that was a fair evaluation of Pure Blog's admin UI. When I built Pure Blog, I wanted it to be different from the rest of the crowd. The whole point of it was to have just enough features, and no fluff. So to me a more brutalist/utilitarian UI made sense. The likes of Grav, WordPress, Ghost, and Bludit all have similar interfaces. White and grey with blues, purples, and greens. Rounded corners etc. All very iOS-ish. All very...safe. I wanted Pure Blog to stand out from the crowd and have its own identity, and honestly, I'm thrilled with the results. Pssst. If you haven't tried Pure Blog yet, check out the demo site . But what I like may not be what you like, which is why I built Pure Blog to be very customisable from the start. You can change the fonts from mono, to sans, or serif with the click of a button, or you can change the look of the entire UI if you know some CSS. And this is what I said to the person who emailed me saying it was ugly. But they came back with... Great. Do you have any examples? I didn't! So I decided to create some examples and show them here so you can see just how customisable Pure Blog really is. I know other CMSs can customise their UI too, but unlike them, Pure Blog needs no plugins, hacks, or bullshit. This can all be done with standard Pure Blog right out of the box. So here are some examples of the Pure Blog admin UI where all I've added is custom CSS within settings. How about bringing a macOS / iOS vibe to your Pure Blog site? Or maybe you like the super clean lines of the Ghost UI? Well, you can have something similar to that too if you like: Are you a WordPress purist who really wants to be as faithful as possible to their design? Well guess what - you can have that too! Maybe you're a lover of anything Bill Gates touches. If so, a Windows theme might be more your thing. Maybe all this GUI stuff isn't your jam? Do you yearn for the days of yore when the interface to a computer was terminal-only with a monochrome CRT monitor? Well, Pure Blog can do that too: Green – the connoisseur's terminal. Or orange, the truly old-school terminal. I think these screenshots show what Pure Blog is capable of. Your imagination really is the limit. So just because you think the default look of Pure Blog is ugly, don't fret - you can easily change it to be whatever you want it to be. If you're interested in grabbing any of these themes for your Pure Blog installation, all the CSS is available over on the docs site . Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️ You can reply to this post by email , or leave a comment .

0 views

U.K. Sanctions Cryptomus for RU Money Laundering

The United Kingdom has issued economic sanctions against Cryptomus , a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions. Heleket’s support agent on Telegram claims, despite all evidence to the contrary, that it is not affiliated with Cryptomus. Image: Richard Sanders. On October 8, the U.K. issued sanctions (PDF) against Cryptomus — previously known as Certa Payments and Xeltox Enterprises — for processing payments that benefit the Russian government and its financial institutions. The sanctions freeze any Cryptomus assets at U.K. banks, and bar British companies from offering it any business, virtual or otherwise. Also targeted in these sanctions were the virtual payment platforms VexPay , TokenSpot , and the Tsunami Payments service . As explained in our December 2024 investigation, “ How Cryptocurrency Turns to Cash in Russian Banks ,” Cryptomus has been a key payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The company has changed its name several times since emerging in 2022, most recently to “ Heleket ” last year after Canada levied a record CAD $176 million fine against the platform for anti-money laundering violations. The blockchain data-crunching firm Chainalysis said the U.K. sanctions target the broader infrastructure supporting Russia’s wartime economy. “Cryptomus and Heleket have emerged as major payment hubs for illicit activity,” Chainalysis wrote in an October 8 blog post. “Together, these services received more illicit funds across tracked categories than the mixers in our dataset and the number of illicit counterparties surged to more than 900 in a single month in late 2025.” The Cryptomus support bot on Telegram, responding on Oct. 8 to an inquiry by saying the platform was suddenly unable to process transactions. In April 2026, the blockchain analysis firm TRM Labs found Cryptomus had processed more than $7 billion in transactions since its inception in 2022, including transactions associated with child sexual abuse material vendors, terrorist financing networks, and human trafficking operations. TRM noted that Cryptomus’s transaction volume cratered after the platform instituted new “know your customer” or KYC rules, and that the cryptocurrency platform responded to the Canadian fines by launching Heleket as a parallel service that continued to offer no-KYC payment processing. Richard Sanders is a blockchain analyst and investigator who spent months mapping out Cryptomus’s payment infrastructure and transacting with its customers. Sanders said the U.K. sanctions on Cryptomus are important because Canada’s sanctions against the platform were ultimately unenforceable and uncollectible. “A fine doesn’t stop a cryptocurrency payment processor from processing payments,” Sanders wrote on LinkedIn . “Sanctions kill the operation. The distinction matters.” As our 2024 investigation noted, Cryptomus shared a Vancouver address with dozens of other foreign currency dealers and money transfer businesses — none of which appeared to be physically located there. Following the CAD $176 million fine for alleged money laundering violations, Cryptomus appealed the penalty, launched Heleket as a parallel service, and kept on processing large volumes of sketchy transactions, Sanders said. Sanders said the sanctions also are notable because they are the first known instance of a “Five Eyes” country (referring to the Australia, Canada, New Zealand, the U.K. and the U.S.) sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction. Where do entities like Cryptomus and Heleket derive their authority to offer international financial services? The answer appears to involve fake financial institutions overseen by a phony regulatory body positioned in a country that is not widely recognized as a sovereign nation. Our 2024 investigation found the sole shareholder of Cryptomus’s parent company Certa Payments was a 25-year-old Ukrainian woman who also headed several other firms, including the WS Management and Advisory Corporation , which bills itself as the regulatory body that exclusively oversees licenses for cryptocurrency, foreign exchange and online gaming businesses incorporated in the disputed region in northwest Africa known as the Western Sahara . That entity’s website — crasadr.com — says it assists applicants with bank setup and formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. One of Certa Payments’ former sites — certa[.]website — also shared a server with 12 other domains, including rasd-state[.]ws, a website for the Central Reserve Authority of the Western Sahara. The website crasadr dot com, the official website of the Central Reserve Authority of Western Sahara, which lists the entities awarded licenses for cryptocurrencies, gaming and foreign exchange services.

0 views
Martin Fowler Yesterday

Build your slide template

Building a slide template starts with three foundational choices — colours, fonts and layouts. Sumeet Gayathri Moghe covers the basics of color theory and how to build a reusable palette, the essentials of typography, including serif, sans-serif, handwritten and monospace fonts, plus the finer points of kerning and leading, and why a near-blank layout might serve you better than the prescribed layouts that ship with your slideware.

0 views
Jeff Geerling Yesterday

Formlabs dropped the Raspberry Pi on the way to a $699 SLA printer

Formlabs sent me a Form Studio 1 resin 3D printer to test after years of back-and-forth about their Form 4 printer. Like the Form 4, it's an SLA (stereolithography) printer, but unlike the Form 4 (which starts at $2,600), it's affordable for a hobbyist. It's not cheap , coming in at $699 (or $749 with a flex build platform, which I highly recommend), but it is affordable. I can't say as much about this printer as people who are well-versed in resin printing and use other SLA printers (all my experience until now is with FDM, or Fused Deposition Modeling 1 , printers). But I can convey my first-time experience using this printer and with the entire SLA experience.

0 views
Kev Quirk Yesterday

2026-10-14 11:53: Out for coffee this morning with my wife, as is our Wednesday morning routine, and...

Out for coffee this morning with my wife, as is our Wednesday morning routine, and this little guy came to sit with us. Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️ You can reply to this post by email , or leave a comment .

0 views
Stratechery Yesterday

Apple HomeView, The New Apple TV, The App Story

The Apple Homeview is official, and the question is how big is the addressable market for expensive devices based on subpar AI.

0 views

A curl audit by Aisle

Over the last year or so, multiple engineers at Aisle have spent a lot of time and energy while pointing their AI powered tooling at the curl source code. This has resulted in no less than thirty-five published curl vulnerabilities and CVE Ids. Today, we make Aisle’s audit report available on the curl website . Yet another audit of curl source code that together with all the other work we do, help keeping the products safe, secure and top quality. Few other software projects have had the same amount and level of scrutiny and verification as curl has gotten over the last few years. In the curl project we have nothing but positive experiences from having cooperated closely with Aisle all this time. Aisle has found more CVEs in curl than any other group or individual ever did before, and Aisle employees have authored several dozens of commits in curl already. With Aisle, we have a cooperation like with no other security organization before. Their vast amount of detailed and accurate findings backed up by a team of skilled humans have made it possible for us to identify and fix more vulnerabilities in curl at a higher rate than ever before, leading to the billions of mostly indirect daily curl users to be more secure. Aisle blogged about this: One AISLE curl Audit Produced 24 CVEs. 18 Ship Today . This concludes the 5th external official audit of curl over several years. Audits help us to prove quality for outsiders to some extent. They also help us ensure there aren’t any blind spots in the code or in our development process. The curl source code is continuously, every day of the week, being scanned and probed by countless humans and AIs trying to find vulnerabilities, but we can’t say for sure how many nor who they are. We are also scanning and testing curl ourselves with all the best tools and harnesses we have access to, so that we can catch mistakes as early as possible, ideally before they are ever shipped in a release.

0 views

A UAF turned RCE

In the curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free . This post explains the bug, what the problem can lead to, and something about why it happened and what we have done to make it harder to introduce a problem like this in curl again in the future. This is a much simplified explanation. Please refer to the original report for all the details and the full reproducible Docker image for all the low-level fun and education you could possibly want. I highly recommend doing that; the report and the reproducible are awesome. It is a use-after-free , which is a classic problem in memory-unsafe programming languages, like C, where we erroneously have a lingering pointer left, pointing to memory that is already freed, and yet we use that pointer and the memory it points to. This family of errors is especially bad when a malicious actor can affect the content that gets stored into that memory area that is still used even though it was freed. Tricking the program to do something unintended. This problem involves HTTP/2. HTTP/2 is a multiplexed protocol, meaning that it handles multiple logical transfers over the same physical connection. curl needs to keep track of a number of transfers at the same time, and when data arrives or is to be sent off, it needs to keep things apart appropriately. For every transfer done using libcurl, the application creates and sets up a dedicated handle . We call it an easy handle . This handle is kept around for as long as the transfer is in progress, and the application can close and free it once the operation is completed. When doing multiple transfers, multiple handles are used. libcurl also has multi handles , which is a super handle type that holds any amount of easy handles . This handle, and the corresponding multi interface, makes it possible to drive any amount of concurrent transfers. A transfer done with libcurl always has at least one multi handle and one easy handle. (Sometimes the multi handle is hiddenly used under the hood.) In order to trigger this problem, we need an application (such as the curl command line tool) to do an upload over HTTP/2 to a server. By default, libcurl negotiates HTTP/2 when a HTTPS:// URLs is used and the server agrees. When the upload has started, the server pauses the send by zeroing the HTTP/2 window size, returns a piece of the response and then it resets the stream, which shuts down the transfer – but not the connection. curl then correctly pulls down the entire transfer, but it accidentally leaves a lingering pointer to the involved easy handle . When the application finds out that the transfer completed (with an error), it subsequently frees the easy handle and then, and here comes the problematic part: cleans up the multi handle. At this point, the easy handle was just freed but there is still a reference to that handle. When libcurl shuts down the multi handle, it misunderstands the situation, allocates memory to download data into, finds the still dangling pointer and manages to download data from the server that ends up in the very same memory previously used for the easy handle. In this process, it sends off a request that leaks internal client details, which includes information about local addresses, which is crucial. Modern operating systems use Address Space Layout Randomization (ASLR), so a server needs this clue in order to generate a good attack payload. Subsequently, when libcurl deals with this received data (using the handle the dangling pointer points to) in the download buffer, it uses a function pointer that now has been modified by data just downloaded from the server, and then it runs remote code . Here’s a simplified 6-step illustration. Conditions to trigger In order to actually successfully execute remote code, lots of several specific conditions need to be met and we deem it extremely difficult to meet these requirements in the wild, which is why we decided this is “only” severity HIGH and not CRITICAL. The most likely outcome of an attempted attack is rather just a crash. We estimate that the chance for a successful attack is slim. This problem was found and reported by Luna Tong at Anthropic using their new OSS Scanner. Presumably this involves their AI models. In general we have over the last few years been working on reducing the amount of internal pointers to handles that needs to be correct, and instead we store transfer identifiers that we look-up on demand. While this is a tiny bit slower, it is more foolproof when there are logical mistakes like the one mentioned here. We also of course continue to add more tests and we verify the code with more tools and analyzers in order to find additional similar mistakes. Multiplexed protocols like HTTP/2 have this challenge that there are many concurrent transfers going and they all have different life-times and with memory-unsafe languages, dangling pointer mistakes can indeed be fatal. This is of course no guarantee that we do not have or will not introduce another use-after-free in the code now or later. libcurl is written in C – a memory unsafe language. With a memory-safe language, this mistake could probably have been avoided. We have worked on curl for almost thirty years, and have over this time manage to make a rather polished transfer engine. For the longest time there really was no memory-safe alternative that also allowed libcurl to be a low-level library available on hundreds of operating systems and several dozen CPU architectures. It even barely exist alternatives now. We do not rewrite curl. Not into another language but also not in C. We are set to iterate, polish, improve, refactor over and over until the end of time. Porting curl to another language (like rust) would be a monstrous undertaking that would be slow and introduce lots of new short to medium term problems. Not to mention that the existing curl team is not rust experts and that libcurl is currently portable to many more platforms and environments than rust itself is. When this vulnerability was confirmed by the curl security team just hours after it was submitted to us on September 15. We immediately realized the significance and decided to rush the pending next release. However, we still wanted to be careful, follow the procedures and not create any further problems or mistakes by stressing it too much. That’s how we ended up just shortening the release cycle with two weeks. Down from eight to six weeks from the previous release. This allowed us to also merge and fix many more vulnerabilities and general bugs in the same release. We never provide CVSS for our published vulnerabilities as we don’t think we can do a job there. Others will provide them even for our flaws. The victim needs to actually attempt to upload data to a malicious server, meaning that the server certificate must remain valid. The size of the upload needs to be roughly the right size (~135KB) The attacker needs to know curl’s architecture to generate and deliver the right code The attack requires a specific sequence of allocations and allocation sizes so that the data from the server ends up in the right place (from the attacker’s view). This pattern differs between Linux distros, libc versions/flavors, TLS certificate bundles, libcurl using applications and more. nghttp2 and OpenSSL/TLS 1.3 behavior, including allocation effects around session tickets The payload storage area is small (around 23 bytes)

0 views

curl 8.23.0

the 277th release 4 changes 42 days (total: 10,929) 281 bugfixes (total: 14,770) 476 commits (total: 40,084) 0 new public libcurl function (total: 100) 0 new curl_easy_setopt() option (total: 312) 0 new curl command line option (total: 278) 84 contributors, 58 new (total: 3,844) 45 authors, 28 new (total: 1,546) 24 security fixes (total: 239) This time we announce no less than twenty-four fixed vulnerabilities. So many that I decided to not list them individually here. Go check them on the curl security page . Over two hundred and sixty bugfixes landed in this release. Check them out in the 8.23.0 changelog . The symbol formerly known as is now deprecated in favor of the more accurately named . Used with the curl_global_init function. SMB(S) support is gone. Neither curl nor libcurl support these protocols anymore. The tool’s –no-clobber option got two improvements: 1) it now inserts the number into the file name as “-[number]” before the file extension if there is an extension. 2) It now tries many more numbers before giving up. Up to 9999.

0 views
Unsung Yesterday

The distance between ⌘8 and ⌘9

One thing that might be fun to add to the ⌘1/2/3 tab post is this: while ⌘1–8 select tabs from the left, ⌘9 doesn’t jump to the ninth tab, but to the last tab: I think it’s thoughtful – a recognition that both edges are important. (Previously we’ve seen Bear understanding that , too.) Why not ⌘0, though? Sure, you can say it’s not as elegant (0 is smaller than 9), or that it wouldn’t work in Hungary… = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/the-distance-between-cmd8-and-cmd9/3.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/the-distance-between-cmd8-and-cmd9/3.1600w.avif" type="image/avif"> …but I think the Occam’s Razor is simply that ⌘0 has already been taken by a popular “zoom to 100%” command by then, and overlapped too often for comfort.

0 views
baby steps Yesterday

What agents mean for Rust (and vice versa)

As someone who has made a career of programming language design, I definitely have moments of existential dread about the rise of LLMs. I started coding in 5th grade on an x86 1 that ran at 5MHz, had something like a 5MB hard-disk and 512K of RAM 2 . Computers were really, really different back then. But honestly, programming wasn’t. For all the advances in IDEs and programming languages and so forth, the basic act of entering code into a file has remained surprisingly constant 3 – right up until a few years ago, when everything kinda turned on its head. That’s been exciting and empowering at times 4 but also scary and disorienting. Will my skills in programming matter? What about my skills in programming language design (such as they are)? This blog post is my attempt to answer those questions. So as not to keep you in suspense, let me just give you the conclusion. In short, yes, I believe there will still be a role for humans in programming . And yes, I think that programming language design is still relevant . And, naturally, I also happen to think Rust is a really good fit for agentic development – but that’s not to say we can’t make it a better fit . And that’s what this post is ultimately about: what makes Rust and agentic development work well, and where we could double down on those strengths. This is a kind of “blog post companion version” of a talk I gave this week at REBASE, part of SPLASH . You might also enjoy the slides from the talk I gave at IWACO, IWACO and Rust: hidden links revealed , which was a bit more of a retrospective (no soundtrack for those, though). In any case, this turned out to be a great conference! Jack Huey presented on the Rust Vision Doc and, quite to my surprise, Steve Klabnik and Dorian Scheidt presented “LLMs as Collaborators in Language Specification and Design” , talking about their process in building out Rue . It was fun to see Steve again. On top of that, there was a ton of great research presented at IWACO in particular. I was particularly taken by the work on Reachability Types and Information Borrowing . I also really liked learning about Hylo Lang , particularly their approach to projections. Clever and cool. Rust is popular right now. Very popular: Stratospheric among the breakout languages is TypeScript, cropped from the chart and sitting currently at +1200% growth from the prior year. [..] The second most rapid recent growth is in Rust. Meta engineers have written twice as much first-party Rust code so far this year than in the previous 9 years combined. — David Tolnay (emphasis mine) Some of that is because agents make it very easy to try out new things. And some of that is because Rust has a reputation for being performant and, if it’s just as easy to pick any language, why not pick one that will yield faster execution times? But I think Rust is popular for another reason: because Rust happens to be a really good fit for agentic coding 6 . Of course, I would, wouldn’t I? The point of this post is (1) to argue for why that is and then (2) to discuss what we might change about Rust to make it work even better. It seems to me that an effective “software factory” will have three pillars: None of these pillars are solved, but some have made more progress than others. Rust is designed to give “good performance by default”, making the idiomatic thing typically also be the fastest thing. But another key part of Rust is that you have the knobs to eke out better performance when you need it. You control when something is stack- or heap-allocated and where pointer indirection occurs. If you want to, you can force the layout of your structs to be done in a particular way, or decide where to introduce boxing into your async stack frames. In the limit, you can put in inline assembly. In the past, learning how to “tune the performance knobs” could be a bit of a black art: but agents are making that much easier. 7 It turns out that agents are really good at fine-tuning the performance of existing code. For example, people who work on super high-performance cryptographic algorithms used to do so by hand-tuning assembly code. But those people tell me that they are now turning to agents for that same job. More prosaicly, a lot of people building network services are finding that, using a profiler like dial9 , agents can quite effectively diagnose async performance pitfalls, like long polls or blocking. Therefore, I think the task for Rust is clear. We keep on with our goal of “low-level enough for a kernel, high level enough for a GUI” . If anything, I think the shift around agents means we can tolerate a bit more “noise” in the form of explicit calls to or – but not too much, since we still want the “happy path” of the code to be clear and evident 8 , even as we surface details that are important in specific scenarios (like tracking precisely how many clones you have of a channel endpoint). Combined with a profiler, you get an effective feedback loop to get your code running fast: As usual though, while a reputation for good performance is what brings people to Rust, what makes them want to stay is a sense that using Rust “just seems to work better”. The basic theory is that Rust’s type system and guardrails help keep agents on track : rust is a perfect language for agents, given that if it compiles it's ~correct I think there’s truth in that: languages like Rust, Ocaml, or Haskell all share this “if it compiles, it works” feeling, and I think that agents will benefit from that. Testing can show the presence of bugs, but not their absence. — Edsger W. Dijkstra, 1970 Writing tests has never been enough to show that your program is correct – but, with agents, it’s not even close. It happens so often that my first few tests seem great and then the next one goes completely bonkers. Usually bonkers in a way where I cannot even imagine how that bug could have come about. Then I dig in and I realize the agent completely missed the boat on the logic I was trying to express. 9 This is where a type systems really shines – particularly an advanced one like Rust. Type systems give you some guardrails that keep the agent on track. In Rust, those guardrails extend beyond simple stuff like “do all fields have the correct names” and to stuff like never having to close a socket . Type systems can show the absence of bugs, but not the presence of correctness. — Me, failing to coin a phrase of equal eloquence 10 , 2026 So yeah, type systems are helpful! But they have inherent limits. A type system is a simple set of rules that, if you follow them, make sure that you avoid (certain kinds of) mistakes. But they don’t tell you that you do the right thing – only that you don’t do (certain kinds of) wrong things . If you want to go further, you need a proof system – something that will let you show that richer properties are actively true, not just that you’re avoiding bugs. As it happens, there are a lot of interesting proof tools for Rust, like Verus , Creusot , Aeneas , and Kani . As a starting point, you can prove that your code is panic-free, which will eliminate a lot of bugs, though it is still fundamentally a “type-checker-like” property (i.e., you avoid doing things wrong). But you can also go further and add assertions that show your code is computing the results you expect. Deplying proofs is not just good for getting code right – it’s good for getting code fast . This is somewhat counterintuitive, but it’s true. Earlier I mentioned how optimized cryptographic algorithms were now being written by agents . Part of what makes that possible is that cryptographic algorithms have a very clear mathematical definition. This means that you can basically tell the agent “do whatever you want, as long as you can prove that the code still computes the correct result”. These proofs can be done with theorem provers like Lean or Rocq . The blog post “Why Lean is faster than Rust” makes the point quite well. For Rust, a good example of this would be around unsafe code. Right now, people are sometimes reluctant to deploy unsafe code even if it might make their code faster because it’s not worth the risk of getting it wrong. And I applaud that effort. But what if you could use a prover to show that your unsafe code is, in fact, safe (i.e., incapable of causing undefined behavior)? Then you’d be free to optimize to your heart’s content. You might wonder: if we’re deploying a proof system on our code, do we still need type systems? I think the answer is definitely yes. Type systems are infinitely simpler to work with, which is why they are much more popular. Using a type system lets you rule out all kinds of annoying bugs so that you can focus your “proof energy” only on the important stuff. As a simple example of this, consider the following Java code: Without seeing more code, it is impossible to prove whether this assertion is true or not! This is because there could be any number of other threads running around mutating . In contrast, the following Rust code must be true (at least, so long as the operator is reflexive for ): We know this because the type system of Rust guarantees that implies a unique reference. This is in fact exactly how Verus works. By trusting the Rust borrow checker to track uniqueness etc, it simplifies the job of the SMT solver, making proof checking must faster and more reliable than it would be otherwise. So my take is that Rust should double down on if it compiles, it works . As expressive as Rust’s type system is, there are plenty of things that it cannot capture. This includes fairly common things, like this method only reads one particular field or internal references , but also fancy things like “no logging of personally identifiable information”. We should work to lift those limits, giving agents room to prove more complex properties. We also need to improve the experience of integrating a proof tool by working towards an extensible compiler . As cool as the existing Rust-based proof tools are, using them is a janky experience involing annoying macros and pinned compiler versions. We can do better. I’d like to propose a north star for Rust: no more unsafe code . By that, I don’t mean that we never use the keyword . Rather, I mean that we have the power to prove that all the unsafe code we write is correct and cannot cause undefined behavior. Don’t get me wrong: knowing exactly what code needs to be vetted is a huge step forward, as is normalizing the idea that libraries need to be responsible for protecting their users from undefined behavior via safe API boundaries 11 . But given agents’ ability to find vulnerabilities, I think we need to up-our-game if we want to stop the steady stream of CVEs. 12 But before you go about proving things or optimizing them, you need to have a clear idea of what you are building. As far as I can tell the state of the art here is basically variations on “markdown-driven-development”, developing docs and hoping that agents pay attention. I don’t know how much of a role for Rust there is in this space. I think there are some steps we might wind up taking that could be helpful here – for example, having ways to separate out interface from implementation so that it’s easier to review the interface in isolation or to see when the agent made changes there. 13 Or perhaps just providing betters tools to review that. I also think there’s space for dedicated “modeling languages”, something that let you iterate quickly with agents on the high-level designs and invariants without having to get into the weeds and read the code. I have more thoughts on this but it merits many blog posts all of its own. For the moment, I’ll start by pointing you all at this post by Kari Wilhelm, “Principles of Anchor Engineering” , which I think does a nice job of describing what it means to pull out the key elements of a design and drive the coding from there. We covered a lot of ground here, so let me put this all together. What makes Rust a good choice for developing with agents? And what could make it better, from a language design perspective? Overall, I think it’s very similar to what we were doing, except that the way we weight the tradeoffs is tweaked to account for agents doing the code authoring, and humans focused more on code comprehension: As a final close, let me point you at this interesting article by Marc Brooker, “What’s easy now? What’s hard now?” . He posits that the more it is possible to clearly specify success criteria for a task, the easier it is, and that we may find that tasks we traditionally think of as ‘hard’ (e.g., building out an efficient implementation of a cryptographic algorithm) may soon become automated, whereas tasks that we have thoght of as ’easy’ (e.g., making a unique, compelling website) may become more valued. Looking at it from a PL point-of-view, I think Marc’s point reinforces my sense that the biggest action is going to come from design languages , things that let you capture the architecture and intended behavior at a very high-level. The goal would be to let humans intuitively specify a design that gets translated into effective guardrails, whether that’s type system checks, lints, or theorems to be proven. Agents would then take on the task of translating the design into code written in a traditional PL like Rust, with humans looking at it only rarely. This doesn’t make the design of traditional PLs less interesting, but it definitely makes the tradeoffs very different than they were before. Secretly I have always been jealous of people that coded using punchcards and stored things on gigantic rolls of tape or whatever. I just want to be world weary so badly! I am kinda delighted that I’m finally old enough that I can say things like “I remember when we had to edit CONFIG.SYS before we could play a computer game!” and younger programmers will gasp in horror. 5 But I still feel like I must sound like a silly kid to folks who were around “back in the day”.  ↩︎ I still remember when my dad told me he had bought me a 10MB disk and secretly he had bought a 40MB disk to surprise me. It seemed absurdly large. “I’ll never need a new disk again!”  ↩︎ I mean my god, we’re even using again! My first editor!  ↩︎ I built an electron app! And it was so easy to do! And reading weird papers and things is so much more accessible now that I can ask an LLM to translate all the math jargon for me.  ↩︎ I remember once trying to tell Alex Crichton how I used to “order shareware from a paper catalog by putting a check in the mail” and he was like “I do not understand any of the nouns in that sentence”. Highlight of my life, right after Rust 1.0. Oh, and maybe the birth of my child and getting married. I guess.  ↩︎ I’m not saying Rust is the only language that’s a good fit. I’m not even saying that the way that Rust is a good fit is the only way to be a good fit. I have heard for example that Go is a really good fit for agentic coding and I believe it: I think it hits a different sweet spot, one that helps agents iterate quickly (although I do suspect agents will let data races and subtle bugs slip through that Rust would have prevented).  ↩︎ The fact that agentic development makes more room for knobs is good for Rust performance, but it is quite likely an even better fit for performance in other languages. Tuning a GC has traditionally been a job that really requires a GC expert, but agents can likely fill that role pretty well these days.  ↩︎ On this pont, I’m even more convinced of the importance of ergonomic RC now that I work with agents. Agents are good at introducing the extra clones and things you need to deal with capturing around async tasks, but the resulting code is so annoying to read, it really hides what’s going on.  ↩︎ “Claude, this is not what we talked about!” – me, all too often.  ↩︎ So close though, right? I just .. couldn’t land the plane.  ↩︎ All too often, C++ libraries consider it adequate to tell users “you’re holding it wrong” – i.e., that they are responsible for causing undefined behavior by misusing the API. Rust takes a clear position that a safe API has to protect its users, no matter how much they abuse it.  ↩︎ To be fair, if Rust is encountering a stream of CVEs, other languages like C++ and Java are encountering a veritable flood, since they lack the protection of Rust’s type system. st takes a clear position that a safe API has to protect its users, no matter how much they abuse it.  ↩︎ The revenge of files?  ↩︎ Design: figure out and specify clearly what the code is supposed to do. Construction: author code that does what it is supposed to do. Optimization: optimize the code so that it runs efficiently. It offers good default perf (why pay more?) and, in conjunction with a profiler, can be tuned as much as you want. The type system gives stronger guardrails, and if you setup your agents right, you can strengthen those guardrails through techniques like new types. If it compiles, it works – our type system is our big advantage, we need to make it more expressive and more functional so that agents don’t get stuck trying to work around it! And as an adjunct, establish a North Star: Enable Unsafe code without unsafety by supporting proof, and see the most widely used Rust libraries proven sound. Low-level enough for a kernel, high-level enough for a GUI – make sure we expose the knobs needed to tune for performance, while also making the code’s intent clear (but don’t worry about golfing the code down to an absolute minimum number of characters). Extensible and versatile – one of Rust’s great strengths is that, with macros + our type system, we support DSLs and a wide variety of targets. We need to bring that spirit of extensibility into the compiler so we can target more styles of development (e.g., GPU, deep language interop, etc) and also integrate theorem provers and other tools that require more than just tokens. Secretly I have always been jealous of people that coded using punchcards and stored things on gigantic rolls of tape or whatever. I just want to be world weary so badly! I am kinda delighted that I’m finally old enough that I can say things like “I remember when we had to edit CONFIG.SYS before we could play a computer game!” and younger programmers will gasp in horror. 5 But I still feel like I must sound like a silly kid to folks who were around “back in the day”.  ↩︎ I still remember when my dad told me he had bought me a 10MB disk and secretly he had bought a 40MB disk to surprise me. It seemed absurdly large. “I’ll never need a new disk again!”  ↩︎ I mean my god, we’re even using again! My first editor!  ↩︎ I built an electron app! And it was so easy to do! And reading weird papers and things is so much more accessible now that I can ask an LLM to translate all the math jargon for me.  ↩︎ I remember once trying to tell Alex Crichton how I used to “order shareware from a paper catalog by putting a check in the mail” and he was like “I do not understand any of the nouns in that sentence”. Highlight of my life, right after Rust 1.0. Oh, and maybe the birth of my child and getting married. I guess.  ↩︎ I’m not saying Rust is the only language that’s a good fit. I’m not even saying that the way that Rust is a good fit is the only way to be a good fit. I have heard for example that Go is a really good fit for agentic coding and I believe it: I think it hits a different sweet spot, one that helps agents iterate quickly (although I do suspect agents will let data races and subtle bugs slip through that Rust would have prevented).  ↩︎ The fact that agentic development makes more room for knobs is good for Rust performance, but it is quite likely an even better fit for performance in other languages. Tuning a GC has traditionally been a job that really requires a GC expert, but agents can likely fill that role pretty well these days.  ↩︎ On this pont, I’m even more convinced of the importance of ergonomic RC now that I work with agents. Agents are good at introducing the extra clones and things you need to deal with capturing around async tasks, but the resulting code is so annoying to read, it really hides what’s going on.  ↩︎ “Claude, this is not what we talked about!” – me, all too often.  ↩︎ So close though, right? I just .. couldn’t land the plane.  ↩︎ All too often, C++ libraries consider it adequate to tell users “you’re holding it wrong” – i.e., that they are responsible for causing undefined behavior by misusing the API. Rust takes a clear position that a safe API has to protect its users, no matter how much they abuse it.  ↩︎ To be fair, if Rust is encountering a stream of CVEs, other languages like C++ and Java are encountering a veritable flood, since they lack the protection of Rust’s type system. st takes a clear position that a safe API has to protect its users, no matter how much they abuse it.  ↩︎ The revenge of files?  ↩︎

0 views