📰 Tech Trends Daily — Sunday, November 8, 2026

Data Source: Hacker News Top 30 + Lobsters Top 25. HN front page and discussion pages are read directly from the DOM after browser rendering; direct connection from this machine to lobste.rs is unreachable (TCP 443 timeout), so Lobsters front page and discussion pages are retrieved via r.jina.ai, fully preserving scores, comment counts, and /s/XXXXX discussion links. Lobsters front page items remain listed for several days; items already covered in yesterday’s daily digest are not repeated.

🔥 Today’s Focus

When musl’s crypt() encounters input it cannot process, it returns "*". Unix, in turn, uses "*" to denote “account locked.” Meanwhile, sshd computes hashes for locked accounts anyway to eliminate timing discrepancies—three individually reasonable conventions that, when spliced together on Alpine, form a login path requiring no password whatsoever. Apiiro uncovered another chain entirely: Claude Code’s “Yes, and don’t ask again” writes complete commands containing passwords directly into .claude/settings.local.json. Across public repositories, there are 104,185 copies of this file, 1,122 of which harbor live secrets spanning 63 documented organizations. What these two vulnerabilities truly have in common lies in their defaults: both make trust decisions on behalf of users, after which no one ever circles back to audit them.

The same day brought two distinct “clawbacks”: Asahi Linux transitioned its repositories from MIT to GPL-2.0-or-later, noting in its announcement that in-progress feature code had been lifted directly from personal branches for redistribution, or rewritten with LLMs to strip attribution; Microsoft Research shuttered its AI Frontiers team, with John Langford’s post-mortem remarking that there is no viable path for research inside an organization that believes only in scaling. Whether permissive licenses buy adoption or merely breed substitutes, and who calls the shots between research budgets and market narratives—both questions received their answers today.

🔒 Security & Privacy

  • Claude Code’s “Don’t Ask Again” Exposes Passwords in Project Configs, 1,122 Public Files Harbor Live Secrets — Claude Code’s “Don’t Ask Again” exposes passwords in 1,122 public GitHub files. 78 points / 61 comments (HN). The exploit chain is remarkably short: when an agent issues a command carrying passwords pulled from configuration, the user clicks “Yes, and don’t ask again,” and that command along with the password is written straight into .claude/settings.local.json—a file bearing no inherent markers flagging it as private. Apiiro tallied 104,185 copies across public repos, with 1,122 containing live secrets, totaling 2,539 credentials across 63 organizations. Samples included a cloud management key for a database vendor, production Azure Postgres credentials, and a production Square token; TruffleHog only caught 643 of them, while one-fifth of the passwords embedded within command arguments went undetected by both mainstream scanners. 💬 bcherny from the Claude Code team explained in the thread: settings.local.json was always meant to stay local, and Claude automatically gitignores it when creating it itself; the affected batch was manually created and manually committed by users. markasoftware rejected that defense, noting that users are advised to run auto mode even though nobody has ever clearly articulated auto mode’s threat model; gsnedders audited public configurations and discovered that over 5% explicitly allow arbitrary shell commands, while another 43% specify rules like Bash(python:*), effectively granting wide-open interpreter execution.

  • Alpine openssh-server Allows Login Without Password Verification in a Single Connection — Security advisory: openssh-server password authentication bypass. 3 points / 2 comments (Lobsters). Sending a 257 to 1024-byte password to an account whose password field is * bypasses verification entirely: musl’s crypt() returns "*" for such input, while sshd interprets "*" as “no password,” creating a seamless semantic mismatch between the two. The prerequisites are an openssh-server instance with PAM disabled, PasswordAuthentication yes, plus another existing account with a $5$ or $6$ hash. Versions 3.16 through 3.24 as well as edge are all impacted, containers remain unaffected, and no CVE had been assigned at the time of the announcement. Simply upgrading packages is insufficient; sshd must be restarted to take effect.

  • Forwarded Header Trusted by Default, Enabling Client IP and Host Spoofing — Forwarded Without Question: How Web Frameworks Overtrust the Forwarded Header. 9 points / 0 comments (Lobsters). Rails, Spring, and Jetty read Forwarded right out of the box, whereas most reverse proxies, CDNs, and middleware never strip or sanitize it. The author stumbled across this opening while tracing X-Forwarded-For behavior in Envoy, ultimately mitigating it by dropping all incoming X-Forwarded-* and Forwarded headers indiscriminately.

  • Every Mac Runs an Undocumented Kinship Classifier — Every Mac comes with an (undocumented) family member classifier. 557 points / 328 comments (HN). knowledgeconstructiond and intelligenceplatformd populate ~/Library/IntelligencePlatform with 51 plain SQLite databases, including graph.db with 181 entity classes and 278 predicates; an XGBoost model scores 17 relationship columns across 61 individuals, rating mother/father/daughter uniformly at 0.960 and brother/son/sister at 0.500. The author also built iKnow to inspect and dump this graph directly. 💬 The discussion did not stop at “Apple is stealing data”: one camp viewed it as a natural extension of offloading tasks like remembering birthdays or tracking personal feuds to machines; another approached it from how elderly parents interact with devices—they can’t even remember filesystem paths anymore, so the “personal computer” no longer belongs to the user. The adage “you are not the customer, you are the product” was also traced back to its 1973 video art origin by Serra and Schoolman.

  • iPhone Keyboard Maintains a Grey List of Phrases It Refuses to Autocomplete — Apple’s grey list: Words and phrases your iPhone won’t help you spell. 296 points / 202 comments (HN). The Guardian cataloged the autocomplete behavior itself: midway through typing, the candidate bar simply refuses to suggest completions, spanning politically sensitive expressions as well as words that are merely unpleasant. 💬 One faction argued that keyboards should never decide what users say; another pointed to open-source local keyboards running lightweight models like Futo, noting that swapping away from the system keyboard reveals that the price of freedom is typing accuracy.

  • A Honeypot Disguised as a Supermarket Fridge Controller — Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller. 172 points / 37 comments (HN). A single Python script using only the standard library, simulating both Danfoss AK-SM 800A and Copeland/Dixell XWEB EVO devices simultaneously: nginx response header ordering, Danfoss StoreView page titles, enforcing TLS 1.2 only, and self-signed certificates with CN=DanfossSM800A are all replicated faithfully. Both Supervisor/12345 and CVE-2025-41450 “code of the day” successfully “log in,” presenting attackers with a mock defrost dashboard. The backdrop: earlier this year, attackers scanned refrigeration controllers across Europe using default credentials and outdated firmware to forcibly trigger defrost cycles.

  • An APK with Zero Code and Zero Permissions Puts Phones into Bootloops — GhostMap: The Android flaw that crashes your phone before you open the app. 6 points / 2 comments (Lobsters). Mismatching two fields in a ZIP entry inside an APK (compression method and declared uncompressed size) causes Android to map the file into unallocated memory, triggering an instant SIGBUS on any process touching it. Once installed, system processes crash, reboot, and crash again, with Safe Mode unreachable, forcing a full factory reset. The sample was captured in the wild on August 12 as a broken banking trojan dropper—the vulnerability resides entirely within the operating system, not the malware itself.

  • Prompt Injections Hidden in PDF Text Layers Executed Blindly by Internal Tools — Catching prompt injections hidden in PDFs. 0 points / 0 comments (Lobsters). A straightforward demonstration: an ostensibly ordinary financial earnings PDF containing instructions for parsers slipped into the body text, which internal data tools ran without hesitation—nobody ever treats an “internal PDF” as untrusted input. The detection heuristic provided at the end of the post proves far more useful than the tool itself: inspect the text layer prior to parsing for imperative sentences disconnected from the document’s core topic.

🤖 AI & Models

  • Microsoft Research’s AI Frontiers Group Shuttered, Post-Mortem Blames Scaling Obsession — The end of Microsoft Research’s AI Frontiers group. 312 points / 177 comments (HN). Formed inside MSR around 50 people following ChatGPT’s release in 2023, AI Frontiers produced AutoGen and the Fara computer-operating agent, while also setting up a unified monorepo across all of MSR. Merged into Microsoft AI in early September, John Langford documented the core conflict: leadership believed the research had no path to product output, effectively terminating AIF and ending intern hiring along with it. 💬 The comment section repeatedly referenced a historical precedent: corporate labs invented transistors, LCDs, and lasers, yet were repeatedly cut down under “no short-term utility” verdicts; conversely, others asked what genuinely useful products MSR had shipped in recent years.

  • Tweaking 17 Lines in 89 Benchmark Tasks Separates the Field into Two Tiers — MaxxBench – “Nice DeepSWE score. But is it true?”. 160 points / 46 comments (HN). The approach is simple: modify the prompt instructions and initial code across 89 DeepSWE tasks to see if models adhere to new requirements, such as changing Chrome.xml to chrome.xml; the median reference patch altered only 17 lines (3.5%). Opus 5.5 rose from 74.2% to 76.4%, GPT-6 Astra dropped from 74.1% to 71.9%, GPT-5.6 Sol slid from 72.7% to 69.1%, and Fable 5 fell from 69.9% to 63.5%; the spread across 12 configurations widened from 20.9 points to 48.3 points, with DeepSeek V4.1 Flash and Gemini 3.8 Flash dropping 18.6 to 20.5 points each. 💬 antirez cited two primary factors: smaller models have their strong priors for benchmark patterns shattered by tweaked instructions, whereas only large models can deduce “I am being tested” when specifications are ambiguous; druskacik added a third: distilled lightweight models collapse hardest; Tade0 suggested asking models “What are you?” hundreds of times, noting that in his tests Qwen3.8 Flash Next once replied: “I am Kilo Code, a coding agent.”

  • Compressing a 31B Video+Audio Diffusion Model to 14B with 6-Step Generation — Show HN: We compressed a 31B video+audio diffusion model to 14B, 6 steps, INT8. 52 points / 11 comments (HN). A few-step distilled variant of MiniMax-H3 generating synchronized video and stereo audio: 13.7B (fl2va) / 13.9B (ref2va), down from the ~31B original; quantized to Q4_K_M (9.1 GB) and Q8_0 (14.9 GB), runnable on 24 GB or 32 GB GPUs paired with 16 GB system RAM. Generating a 5.2-second clip in 6 steps takes 8.7 seconds on 4x B200s, 36 seconds on a single H200, and 92 seconds on a single RTX 5090.

  • The Web Was Rotting Before AI, AI Just Accelerated It — How are you dealing with all the negative side effects of AI on the web?. 56 points / 52 comments (Lobsters). The poster highlighted a concrete absurdity: search results are flooded with slop, making LLM summaries palatable by comparison—not because summaries are inherently superior, but because they at least surface the handful of quality links buried at the bottom of the page. Meanwhile, Google and DuckDuckGo rate-limit regular users, and GitHub’s login walls grow steadily taller. 💬 The maintainer of Marginalia Search added another layer in the comments: the web was already decaying prior to AI, and his chief concern is that future “proof of humanity” schemes will settle on hardware attestation, permanently tethering digital identities to physical persons.

🛠️ Tools & Engineering

  • libghostty 1.0: Turning the Terminal Emulator into a C Library — Libghostty 1.0. 145 points / 7 comments (Lobsters). The 1.0 release of libghostty-vt decouples the entire terminal emulation core from Ghostty and finalizes its C ABI. The author notes millions of terminals already run atop it; JetBrains announced in October that its entire IDE fleet switched its built-in terminal to it. 💬 Practical feedback on Lobsters noted that this C ABI cleanly shields consumers from Zig’s volatile version churn, at the cost of still requiring builds to target a specific Zig compiler version.

  • Discord’s Rust Client Reaches Friends List While Electron Version Is Still on Splash Screen — Every Windows 11 app should kill Electron, and Discord just showed why. 180 points / 179 comments (HN). Sourced from a 15-second side-by-side launch recording posted by Discord’s CTO with over two million views, where the new client loads the friends list while the Electron build is still booting. 💬 The sharpest pushback asked: Electron’s value proposition has always been “one team, one codebase spanning desktop and mobile,” and peak performance was never part of that contract—the article leaves unanswered what engineering trade-offs were made in rewriting it in Rust.

  • Text.js: Rendering Full-Stack React 19 Apps Inside the DevTools Console — Text.js: Build full-stack React apps that render inside console.log. 78 points / 44 comments (HN). Supports standard layout primitives like <Box className="flex-col gap-1 p-2"> alongside ASCII typography and useInput key handling, fully preserving Suspense, error boundaries, and concurrent rendering. Directories under app/ map to routes with back/forward history and deep linking, while the grid layout dynamically adapts to the DevTools panel width. Pressing Ctrl+Shift+J brings up the application directly in the console.

  • Meridian: An Experimental Web Browser Built on Servo and GPUI — Meridian — an experimental web browser built on Servo and GPUI. 43 points / 6 comments (Lobsters). Running on macOS, it features address bar completion, horizontal and vertical tab layouts, bookmarks, browsing history, per-site zoom, and reader mode, launchable via a single nix run invocation. 💬 Opening nytimes.com prompted Cloudflare to trigger bot challenges: switching engine fingerprints and JS capabilities instantly trips anti-bot heuristics across modern sites.

  • OpenBSD’s top(1) Adds -Q Flag to Directly Display chroot, pledge, and unveil Status — OpenBSD top(1) adds flag to show chroot, pledge and unveil status. 14 points / 1 comments (Lobsters). The commit message is refreshingly pragmatic: to quickly audit which running programs are unaware of their own privilege constraints, non-root users can run a single command without assembling ps -o state,pledge pipelines or wrapping processes.

  • Route 53 Rejects Scriptable Logic, Author Migrates GeoDNS to Bunny — Scriptable GeoDNS: leaving AWS for Bunny. 24 points / 11 comments (Lobsters). Running seven self-hosted NixOS nodes across Paris, Nuremberg, Ashburn, Singapore, San Jose, São Paulo, and Sydney, routing visitors to geographically distinct origins. 💬 viraptor questioned why a static blog needs self-hosted nodes instead of letting Bunny cache everything; the author responded that he enjoys the tinkering, explaining that while CSS and JS can be verified externally via SRI hashes, HTML lacks SRI, making self-hosting essential to safeguard content integrity.

  • Two-Dimensional Version Control: Commits on the Horizontal Axis, Chapters on the Vertical — Two Dimensional Version Control. 27 points / 1 comments (Lobsters). Amit Patel picks up new tools annually through Roguelike tutorial projects; this year’s challenge involved a 14-chapter tutorial where edits in any arbitrary chapter must seamlessly propagate downstream. While Git can model this with sequential branches, rebasing requires manual intervention; Jujutsu automatically cascades changes forward, freeing the author to focus purely on editing.

  • Where Postgres FOR UPDATE SKIP LOCKED Queues Actually Break Down — Just how far can the FOR UPDATE SKIP LOCKED Postgres queue go?. 1 points / 1 comments (Lobsters). Stress testing against a shared 20-connection pool feeding 128 workers peaked at 650 jobs/s; the first bottleneck hit was connection slot exhaustion rather than row locking contention or disk I/O. Empirical benchmarks like this provide vastly more insight than abstract pattern overviews.

  • GitHub Introduces Workflow Dependency Lockfiles for Actions — Workflow dependency lockfiles. 3 points / 0 comments (Lobsters). Supply chain hardening extends directly to CI/CD workflows: reusable workflow and action references are now pinned into lockfiles, ensuring dependencies are fixed prior to runtime execution.

  • Writing Web Services with Janet and httpf — Exploring Janet and the httpf web framework. 11 points / 1 comments (Lobsters). Combining a Lisp dialect with lightweight primitives across routing, templating, and request handling layers, focusing on how much error detection can be caught at compile time.

💻 Systems & Hardware

  • Asahi Linux 7.3: macaudio and avd Land Upstream, Thunderbolt Only Halfway There — Asahi Linux Progress Linux 7.3. 294 points / 239 comments (HN); 43 points / 3 comments (Lobsters). Fedora Asahi Remix launched day-and-date with Fedora 45, marking their first simultaneous release. Two major drivers merged upstream: macaudio with ~3,100 lines of Devicetree changes, and avd with ~13,000 lines after spending only three months downstream. Thunderbolt patches entered the downstream kernel covering USB3, XDomain, and Thunderbolt Networking, though PCIe tunneling remains missing, leaving external USB-C displays non-functional for now. In the same week, the project announced re-licensing its repositories from MIT to GPL-2.0-or-later, citing unreleased work-in-progress code lifted from personal branches for premature redistribution or rewritten by LLMs to strip attribution.

  • Amutable Foundations: Moving Linux from Package Management into Image-Based World — Amutable Foundations: A Technical Overview. 7 points / 0 comments (Lobsters). Penned by Lennart Poettering, Michael Vogt, and Joaquim Rocha, featuring two core components: AOS, an integrity-protected image-based Linux aimed at eliminating configuration drift and restoring reproducibility; and ACP, handling tracking, updating, and verifying fleets of installations. The boundary between the base OS and runtime workloads is now delineated entirely at the image layer.

  • Inform: A Programming Language for Interactive Fiction Written in Natural Language — Inform is a programming language for creating interactive fiction. 13 points / 2 comments (Lobsters). Created in 2006 and open-sourced in 2022, its syntax closely mirrors natural English, parsing logic via linguistic rules rather than regular expressions. Extensively adopted across literary writing, game prototyping, and digital narrative curricula, Inform has made multiple appearances in TIOBE’s top 100 index.

  • MeccanicOS: An Opinionated Linux Desktop Documenting Installation as a PDF — MeccanicOS. 8 points / 3 comments (HN). Requires a 16GB+ USB stick via Ventoy, providing dedicated platform-specific flash binaries (mos-usb-windows.exe, mos-usb-macos-arm64, mos-usb-linux-x86_64, etc.) hosted under unofficialtools, with the README distributed as a raw PDF. The project’s ethos outshines its feature set: establishing strong foundational opinions before addressing compatibility.

  • Running Debian, systemd, and Podman on a $10 OpenStick — What I run on my $10 USD OpenStick homelab. 260 points / 63 comments (HN). A $10 shipped MSM8916 dongle packed with 512MB RAM (~450MB usable), quad-core Cortex-A53 at 1GHz, 4GB eMMC, 150Mbit/s Wi-Fi, integrated 4G and GPS, passive cooling, and a programmable LED. The author migrated an entire suite of self-hosted home services onto it.

  • The $8 RISC-V Linux Computer (2022) — The $8 Linux Computer (2022). 191 points / 83 comments (HN). Documenting the Ox64 board housing three distinct processor cores; when written, Ethernet, Wi-Fi, and SD card drivers were still non-functional—the rock-bottom hardware price paid for with a year’s worth of driver bring-up effort.

  • Turning Every Radio into a Radar — Turning Every Radio into a Radar. 9 points / 1 comments (HN). Exploring passive radar architectures: transmitting no signals and instead capturing environmental ambient reflections, transforming ubiquitous RF transceivers into opportunistic sensing arrays.

📖 Culture & History

  • A UK Law Firm Running Its Entire Practice on Open Source Software — Running a law firm on Free software. 221 points / 102 comments (HN). Breaking down document authoring, time tracking, billing, and client portals into specific software selections, while openly identifying where commercial platforms still serve as necessary fallbacks. Concrete operational breakdowns like this offer far more utility than ideological debates over whether open source is enterprise-ready.

  • Centuries of Oral Origin Myth Confirmed by Ancient DNA — A barbarian tribe’s mythic origin story is true, ancient DNA reveals. 197 points / 182 comments (HN). A tribe’s traditional lore of “where we came from” successfully held up under genomic sequencing, recalibrating the credibility boundaries of myth as historical evidence.

  • How Long Can Life Wait? — How Long Can Life Wait?. 112 points / 70 comments (HN). From bacterial spore cryptobiosis to spontaneous DNA degradation rates, the upper limit of biological preservation is bounded not by biological potential, but by molecular chemical clocks: given enough time, the underlying information degrades on its own.

  • Terry Pratchett’s Study — Terry Pratchett’s Study. 81 points / 19 comments (HN). Floor-to-ceiling bookshelves, antique typewriters, and scattered miscellany preserved exactly as they were—the workspace itself remains an integral part of the creative legacy.

  • Five Memorable Books About Programming (2008) — Five memorable books about programming (2008). 72 points / 44 comments (HN). Revisiting past recommendations: examining which titles remain cited classics, which have been rendered obsolete by changing toolchains, and which were misguided from the outset.

  • The Typo Generation Is Damaging Literature — The typo generation is damaging literature. 54 points / 73 comments (HN). Directing scrutiny at generative rewriting: misspellings, colloquial phrasing, and idiosyncrasies get systematically smoothed away, stripping readers of subtle cues about the author’s psychological state—uniform neatness is itself an editorial stance.

  • GeoWorks: The 90s Desktop That Was Genuinely Better Than Windows — GeoWorks, Microsoft Windows’ Upstart ’90s Competitor (2016). 35 points / 11 comments (HN). GEOS/Ensemble ran circles around Windows 3.0 on low-end hardware, losing out to software bundling and ecosystem leverage rather than product merit. Every revisit to this chapter mirrors modern software platform struggles.

  • Uranium Cubes Reveal Why the German Nuclear Project Failed — Uranium cubes reveal why the German nuclear project failed. 30 points / 4 comments (HN). Isotopic analysis of surviving fuel elements reconstructs the true operating conditions of wartime reactor experiments, proving that the engineering failure was encoded in the metallurgy itself.

  • Commodore’s Industrial Designer Ira Velinsky — IRA Velinsky – Commodore’s Industrial Designer. 3 points / discussion (HN). Crafting the physical enclosures and ergonomic layouts of the PET era machines, shining light on an overlooked facet of computer history: the form factor of historic machines was rarely decided by engineers alone.

🎮 Light & Fun

  • Need for Speed Underground 2 Multiplayer Brought to the Browser — Need for Speed Underground 2 online in the browser. 756 points / 215 comments (HN). The 2004 classic racing title ported to WebGL/WASM, bringing online multiplayer back to life alongside it. 💬 Commenters filled in the historical ledger: released in November 2004 with 11 million copies sold, EA pulled the plug on official servers in August 2006. Some proposed an extended fair-use model granting non-commercial public sharing after 20 years, noting that a game’s commercial lifecycle is vastly shorter than statutory copyright duration.

  • 356 Processor Dies Photographed from 1972 to 2024 — Every processor die anyone has photographed and given away. 63 points / 14 comments (HN). Aggregating microphotography from four contributors into a single visual catalog, featuring a “true scale” view comparing 114 dies of verified dimensions—putting five decades of silicon manufacturing scale side-by-side.

  • Retro Song Bird: Plug in Any Game Boy Cartridge to Hear the Soundtrack — Retro Song Bird: Plug in any Game Boy cartridge to hear the soundtrack. 23 points / 3 comments (HN). Reading audio data directly from physical Game Boy cartridges via dedicated hardware without relying on emulator audio recording layers.

  • An Offline Desktop Companion to Help Maintain a Healthy Blink Rhythm — Show HN: An offline desktop companion to help maintain a healthy blink rhythm. 11 points / 4 comments (HN). Addressing the screen-induced habit of forgetting to blink using a lightweight, ambient local desktop animation with zero internet connectivity and zero telemetry.

  • UploadYourRam.org: Dedicate Your Memory to Offset AI Crawlers — UploadYourRam.org. 48 points / 4 comments (Lobsters). A protest site inviting visitors to allocate client-side memory to impose quota costs on scrapers. 💬 Code inspections revealed the implementation only allocates ~0.5 GB alongside bloated bookkeeping, coupled with odd iframe usage; furthermore, new Uint8Array(1e9) remains lazily allocated until explicitly accessed—the political gesture is clear, but the load-testing mechanics fall short.

  • CHIMERA: Simulating Organic Sound with Acoustic Tubes — CHIMERA simulates organic sound with acoustic tubes. 1 points / 2 comments (Lobsters). An in-browser physical modeling synthesizer utilizing acoustic tube resonance rather than sample stitching to synthesize organic vocal timbres.

  • Making Any Integer with Four 2s (2025) — Making any integer with four 2s (2025). 11 points / 3 comments (HN). Constrained to four 2s and arithmetic operations, the trick involves leveraging factorials and square roots as boundary-bending operators—construction puzzles ultimately test one’s grasp of formal rule boundaries.

📝 Summary

The most pragmatic lesson today is that default values sign contracts on your behalf: "*" means “locked” in shadow files, but signifies “failure” in musl’s crypt(); disconnected from each other’s context, they assemble into a passwordless shell. “Don’t ask again” transfers secrets from local configurations into public repositories the instant it is clicked, with no one considering that a write operation. MIT states permission to use, which some interpret as permission to take and rewrite. Three essential reads stand out: Alpine’s security advisory (if you manage musl-based systems, restart sshd today), Apiiro’s secret audit (agent configuration files written into project roots demand dedicated ignore rules), and Asahi Linux’s licensing announcement (which candidly exposes the real costs of permissive licensing in the era of LLMs). Viewed horizontally, MaxxBench and the shuttering of AIF are two sides of the same coin: both the measurement of capability and the production model of research are being repriced. When altering 17 lines of code can split the benchmark field into two distinct tiers, it reveals that much of the apparent “capability gap” was simply memorized patterns.