This is the meat of the headline:

For example, the Anthropic-claimed 181 Firefox exploits ran with the browser sandbox turned off and the FreeBSD exploit transcript “shows substantial human guidance, not autonomy.”

Additionally, the “‘thousands of severe vulnerabilities’ extrapolates from 198 manually reviewed reports. The Linux kernel bug was found by Opus 4.6, the public model, not Mythos,” Devansh said.

Another researcher, Davi Ottenheimer, pointed out that the security section (Section 3, pages 47-53) of Anthropic’s 244-page documentation “contains no count of zero-days at all. With no CVE list, no CVSS distribution, no severity bucket, no disclosure timeline, no vendor-confirmed-novel table, no false-positive rate.”

Ottenheimer likens it to “the ending of the Wizard of Oz, a sorry disappointment about a model weaponizing two bugs that a different model found, in software the vendor had already patched, in a test environment with the browser sandbox and defense-in-depth mitigations stripped out.”

He’s talking about a physical object, something you have on your desk that you can pick up and prove your identity to the person on the other end of the video call.

Reminds me of the ‘totems’ in Inception, except they were to prove to yourself you were not in a dream.

I think all these measures are designed to slow the flow, spread the storage of the rain across more places so it can cope with the larger downfall in the short-term, buying time for it all to flow away once it has passed.

There are similar ideas in UK with reintroduction of beavers who transform land into spongey floodplains that can tolerate much more rainfall before spilling over.

Canenter, Canentrance, Can’entree?

On the positive side the PMOS device wiki for Fairphone 4 is accurate to what he discovered i.e. audio, battery and calls not yet fully working:

https://wiki.postmarketos.org/wiki/Fairphone_4_(fairphone-fp4)

I assume they hope that their added license condition of an ‘obligation to retain the original product logo’ is a ‘reasonable…author attribution’ (AGPL section 7b). Hmm.

They invite the FSF to judge:

If FSF determines that our license and project align with AGPLv3, we will continue as an open-source initiative. However, if the decision goes against us, we are ready to consider other options.

https://www.onlyoffice.com/blog/2026/03/interview-with-lev-bannov-ceo-at-onlyoffice-on-the-euro-office-situation

This is a more recent view:

https://www.theregister.com/2026/03/20/uk_palantir_contracts/

Speaking to MPs, science minister Patrick Vallance said that the government’s deals with Palantir – which has large contracts with the NHS and the Ministry of Defence – would be done differently in the future, instead emphasizing investment in UK technology and companies.

For example filesystems like btrfs can be very sensitive to errors in ram due to all the checksumming. On the positive side you’ll know about it fast!

I was curious how this is run, nice to see a clear explanation:

BigSwitch.eu is fully open-source. All data and code are hosted transparently on Codeberg. We encourage the community to contribute by submitting new tools, updating existing information, or improving the platform itself. Visit our Community Hub to learn how to get involved.

And

In the spirit of digital sovereignty, BigSwitch.eu is proudly hosted on Hetzner servers located in Finland.

The platform is developed and maintained by Sabrina Zaki, a Danish woman passionate about European tech independence.

Sounds good!

Bought during process of administration though, seems important but not in the headline. What a mess:

The way in which senior management have conducted themselves throughout this sales process has been nothing short of a national disgrace

https://www.gov.uk/government/publications/social-media-endorsements-guidance-for-content-creators/social-media-endorsements-being-transparent-with-your-followers

I’m not an expert but from this link it would appear to be covered by either the asa or the cma.

More here and new law since 2025 looks to be tougher:

https://www.gov.uk/government/collections/reviews-and-social-media-endorsements-what-businesses-and-content-creators-must-know

https://www.asa.org.uk/about-asa-and-cap/the-work-we-do/what-we-cover.html

They do already don’t they? There are some caveats but broadly speaking it seems you can complain to them.

What happened?

https://strudel.cc/

What can you do with Strudel?

• live code music: make music with code in real time
• algorithmic composition: compose music using tidal’s unique approach to pattern manipulation

Interesting, some effort required to keep it on track:

Claude can be very persistent when it really wants to do something. I’ve seen Claude run the contents of a make command when make itself is blocked, or write a Python script to edit a file it’s been told it can’t edit. But hooks at least offer better enforcement than prompting alone.

The author assesses both Tidal and Spotify to be no longer under European influence:

To be clear from the beginning, Spotify was founded in Sweden but now operates within financial structures that place it firmly inside the global Big Tech ecosystem.

Similarly, Tidal was founded in Norway, but it now holds a marginal European market share of less than 1% and is controlled by American capital.

Both now operate within financial and corporate structures that place them outside the European sphere of influence. The cultural and economic centre of gravity is no longer European for these companies.

You’re not wrong to call them out, they have a plan to migrate:

Without meaning to, we would be contradicting the spirit of this newsletter. Something similar happened when we chose to host Choosing Europe on Substack. Regarding that subject we are still working on our own solution which is getting closer. It will likely be ready later in February or in early March.

There was a moment in time where maybe it was qmail:

https://en.wikipedia.org/wiki/Qmail

Ten years after the launch of qmail 1.0, and at a time when more than a million of the Internet’s SMTP servers ran either qmail or netqmail, only four known bugs had been found in the qmail 1.0 releases, and no security issues.

More on how it was accomplished:

https://blog.acolyer.org/2018/01/17/some-thoughts-on-security-after-ten-years-of-qmail-1-0/

Wow that’s bad. The original idea of standing up, I understand, was to keep the meeting short through physical discomfort and only speak of blockers to progress or ask for help. It is not meant to report status, which can make people feel like they have to continually justify themselves and their work.

nmcli to support wireguard peers, nice