01 — The Register
More than 100 groups across 15 European countries plan coordinated actions on November 6 and 7, The Register reports. They want a moratorium on new large-scale datacenters until governments establish clearer rules and public scrutiny. Their objections center on land, water, electricity and effects on local communities.
Why it matters
The planned protests put infrastructure expansion and communities’ competing demands for resources on the same political agenda.
Read the source →02 — The Register
Security researcher Gal Weizman demonstrated a browser extension using Claude Dispatch to make a connected desktop execute code, The Register reports. The attack requires an extension with access to claude.ai and authenticated, connected sessions; it also automates approval clicks. Weizman says shared sessions could extend access to another computer. The report says Anthropic acknowledged the flaw in May; the company did not respond to questions.
Why it matters
Connecting browser sessions to desktop agents can give a compromised extension access beyond the browser, potentially reaching work computers.
Read the source →03 — The Verge
Motorola announced the Signature 27, a premium non-folding phone going on sale in the US November 26, The Verge reports. It pairs a 7,000mAh battery and tandem OLED display with planned GrapheneOS support and a promise of seven years of OS upgrades. The $1,599 configuration includes 512GB of storage, but lacks built-in Qi2 magnets.
Why it matters
The phone adds another premium Android option, with privacy software support and update longevity among its more consequential promises.
Read the source →04 — Hacker News
The author of Sshole reports finding incorrect login acceptance when testing OpenSSH with musl and without PAM. The write-up traces how musl’s password-hashing failure marker, an asterisk, can collide with the same marker used for accounts without usable passwords. It connects the behavior to earlier timing protections and describes comparing builds across roughly 17,600 unusual login attempts.
Why it matters
Security assumptions that seem safe within one component can fail when libraries, authentication code and account conventions interact.
Read the source →05 — Ars Technica
Agility Robotics began trading on Nasdaq November 5, bringing new financial disclosures about its humanoid robot business, Ars Technica reports. Its securities filing acknowledges that humanoids remain unproven at scale. Co-founder Jonathan Hurst argues that renting robots at rates comparable to human labor lowers customers’ adoption risk, though the supplied excerpt provides no financial results to test that argument.
Why it matters
Public disclosures offer a way to examine whether humanoid robots can become a sustainable business beyond individual warehouse deployments.
Read the source →06 — Hacker News
Portable OpenSSH 10.6p2 addresses a password authentication bypass affecting some Linux systems using musl with PAM disabled, according to the project’s release notes. Maintainers say the root cause lies outside sshd, but can be worked around there. They also plan more frequent releases because independent rediscovery of AI-found bugs suggests attackers could find them too.
Why it matters
Administrators of musl-based systems without PAM have a specific authentication risk to assess and an upstream workaround available.
Read the source →07 — Interconnects
Interconnects argues that open-model inference is growing rapidly, while warning that available adoption measures are noisy and incomplete. Its analysis uses disclosures from Baseten, Fireworks and Together AI, plus OpenRouter usage data. Missing breakdowns from major cloud providers make the market difficult to size, and token volumes alone leave important questions unanswered.
Why it matters
Readers get a useful caution against treating startup usage disclosures as a complete picture of the open-model market.
Read the source →08 — Cloudflare
Cloudflare announced analytics that identify supported personal agents and show their requests, paths and errors. Site owners can set policies for individual agents, including blocking them only on pages with ads. Account-level views can also show which agents act for particular users, though those features require Account Abuse Protection, currently in early access.
Why it matters
Website operators gain more specific choices for handling automated customer activity than allowing or blocking all agents together.
Read the source →