Josse-posten

Day 67 of the Iran war turns kinetic at Hormuz, two ceasefires that don’t overlap hang over Ukraine’s Victory Day, and Norway loses an icon.

Hormuz Goes Hot

Project Freedom launched yesterday — over 100 US vessels and aircraft escorting commercial shipping through the Strait — and Iran answered by setting a UAE oil port ablaze, firing cruise missiles at US Navy destroyers, and striking vessels in the waterway. The US says it destroyed six Iranian small boats; Iran claims the Americans killed five civilians on passenger boats. A South Korean-operated tanker burned. The UAE intercepted Iranian missiles for the first time since the ceasefire. Brent crude surged nearly 6%.

The Norwegian car carrier Alliance Fairfax became the first Norwegian vessel to exit the Persian Gulf in nine weeks, escorted by US forces. Trump threatened to “blow Iran off the face of the earth”; Iran’s parliament speaker declared “we have not even begun.” The IEA warns the world faces its most serious energy crisis in history, compounded by the chokehold on 20% of global oil flows and El Nino fears.

Al Jazeera · CBS News · The Guardian · NRK · TU.no

Two Ceasefires, Zero Trust

Both Russia and Ukraine declared unilateral ceasefires for Victory Day — but they don’t overlap. Ukraine’s runs from midnight May 5–6; Russia’s covers May 8–9. Neither side formally notified the other. Zelenskyy warned Ukrainian drones may strike Moscow’s Victory Day parade; Putin threatened a “massive missile strike on central Kyiv” if festivities are disrupted. A Ukrainian drone hit an upmarket Moscow high-rise near the Kremlin on Sunday, underscoring the point.

Ukrainska Pravda · NPR · BBC

Stein Erik Hagen 1956–2026

“Rimi-Hagen” died suddenly Monday from cardiac arrest at 69. He built discount grocer Rimi from one store in 1977 to over 1,150 before selling for 7 billion kroner, chaired Orkla, and in his later years became a prominent LGBTQ+ advocate — marrying partner Bendik Skinningsrud last November. Prime Minister Støre, Stoltenberg, and business leaders across Norway paid tribute to an entrepreneur who reshaped how Norwegians shop.

NRK · E24 · DN

Markets

Indicator Value Change
Oil (Brent) +3.4%
S&P 500 −0.37%
Gold −2.00%
EUR/USD 1.0843
USD/NOK 10.8172
BTC $80,915 +1.45%
VIX 18.29

Oil up on Hormuz combat. Gold down despite war — unusual. GME −10% on the eBay bid; EBAY +5%.

Cargo ships in the Gulf of Oman near the Strait of Hormuz, as seen from the UAE shoreline near Khor Fakkan, May 1.

World

Leipzig Car Attack Kills 2

A 33-year-old German citizen deliberately drove an SUV into a pedestrian zone in central Leipzig, killing at least two and injuring eight. The suspect was detained at the scene; motivation unknown. — BBC · The Guardian · NRK

Modi Takes West Bengal, Completing National Dominance

BJP won one of India’s last opposition strongholds — a resounding consolidation of power midway through Modi’s third term. The opposition is left with almost no national foothold. — BBC · The Guardian · Al Jazeera

Chinese Fireworks Factory Explosion Kills 26

A massive explosion in Liuyang, Hunan — China’s “fireworks capital” — killed 26 and injured 61. The national safety regulator had previously flagged dangerous gas buildups at the facility. — Al Jazeera · NPR

GameStop Bids $55.5bn for eBay

Ryan Cohen’s surprise takeover offer pitches the meme-stock-era retailer as a serious rival to Amazon. Market scepticism was immediate: GME down 10%, EBAY up 5%. — BBC

European Leaders Endorse £78bn Ukraine Loan as Trump Looms

At the European Political Community summit in Armenia, Starmer backed joining the EU loan scheme for Ukraine. Leaders acknowledged their alliances “aren’t where they want them to be.” — The Guardian · BBC

Google DeepMind UK Workers Vote to Unionize

Partly driven by concerns over Google’s US military deal. One worker pointed to the Iran war and the Pentagon’s conflict with Anthropic as signs the DoD is “not a responsible partner” — among the most significant labour actions in the AI industry to date. — The Guardian

Mali’s Defense Minister Killed; Junta Leader Takes Direct Command

Sadio Camara died during a massive coordinated jihadist offensive. Assimi Goïta named himself defense minister, consolidating personal control as the insurgency intensifies. — BBC

Also today

  • Hantavirus kills 3 on cruise ship MV Hondius; 150 stranded off Cape Verde — BBC · The Guardian
  • Spain seizes record 30–45 tonnes of cocaine bound for Libya — BBC
  • US Supreme Court grants mifepristone 1-week reprieve on mail access — NPR
  • Lula to meet Trump at White House amid Brazil-US trade tensions — Al Jazeera
  • 2026 Pulitzer Prizes announced — NPR
  • Samsung family pays off record $8bn inheritance tax — BBC
  • India tests long-range hypersonic anti-ship missile — Times of India

Firefighters at the explosion site in Liuyang, Hunan province.

Ukraine

Overnight Barrage: 164 Drones, 11 Missiles; Double-Tap Kills Firefighters

Russia launched 164 drones and 11 missiles overnight May 4–5; Ukraine downed 149 drones and one missile. A deliberate double-tap struck first responders in Poltava Oblast — two firefighters killed, 23 wounded. Railway infrastructure damaged across three oblasts. Ukraine hit back with Flamingo cruise missiles, striking a defense plant in Novocheboksarsk (~800 km from the front) and igniting one of Russia’s largest oil refineries in Leningrad Oblast. — Ukrainska Pravda · UNN

Putin Living in Bunkers, Fears Coup — Leaked EU Intelligence

A leaked European intelligence report describes Putin spending most of his time underground in Krasnodar Krai, having abandoned Moscow Oblast and Valdai residences. Security was extended to 10 senior generals after the December 2025 assassination of Lt. Gen. Sarvarov. The report flags Shoigu as a coup risk — though CNN notes the claim is unsupported within the document. ISW corroborates the security posture. — CNN · iStories · Novaya Gazeta EU

Russia Suffers First Net Territorial Loss Since 2024

ISW reports Ukrainian counterattacks outpacing Russian advances for the first time in over a year. Separately, Russia is redeploying 3,000 troops from the 90th Tank Division to Pokrovsk and installing drone control points to dominate low-altitude airspace — defensive moves that confirm the shift. — ISW · Novaya Gazeta EU

Bucha-Linked General Appointed Air Force Commander

Col. Gen. Alexander Chayko — who commanded forces responsible for the Bucha atrocities and the failed Kyiv encirclement — replaces Gen. Afzalov as VKS chief. The appointment follows milblogger criticism of targeting failures and aircraft shortages, and fits Putin’s pattern of rotating failed commanders rather than dismissing them. — Kyiv Independent · ISW

Also today

  • Russian official admits economic despair: “We can’t even take one region” — Fortune
  • Austria expels 3 Russian diplomats over “forest of antennas” spy setup in Vienna — BBC · The Guardian
  • Ukraine strikes Shahed/Iskander factory with Flamingo missiles; “poisonous black rain” from burning oil — Kyiv Independent · Washington Post

Firefighters at the scene of Russia’s double-tap missile strike in Poltava Oblast.

Norway

Epstein-granskningen starter tirsdag

The Norwegian Epstein commission begins formal investigation work today, examining how the foreign service and senior officials handled the affair. Separately, it emerged that Norway granted 90 million kroner in December 2017 to WE-FI, an organization founded that year by Svetlana Pozhidaeva — Epstein’s personal assistant. Crown Princess Mette Marit texted Pozhidaeva about collaborating the following year; she had met her at Epstein’s home in 2013. — DN · r/Norway

PST etterforsker dødstrusler mot Frp-politiker etter rasismestorm

PST opened an investigation into death threats against Frp MP Simen Velle and his family after TV2’s hidden-camera recording of Frp advisor Hårek Hansen calling Pakistanis “minusvarianter.” Threats explicitly reference Swedish criminal networks. First poll since the scandal shows Frp support is unaffected. — NRK · Dagsavisen

Oljefondet stemmer med Big Tech 90% av tiden — også mot egne verdier

NRK finds the Government Pension Fund Global votes with management recommendations 89.8% of the time, opposing shareholder proposals on climate, child safety, and human rights even when those align with its own stated expectations. The fund’s defense — “we are a financial investor, not a political actor” — is precisely what critics dispute: at this ownership scale, abstention is a political choice. — NRK

Norges Bank rentemøte torsdag: markedet splittet

The market is almost evenly divided between a hike now and June. Several chief economists call for immediate action — inflation has “dug in.” Foreign banks are less convinced. LO’s strong wage round adds inflationary pressure. — E24 · Aftenposten

Statnett fryser strømnett nord for Svartisen

All new major power reservations halted in Northern Norway, citing grid capacity constraints. Sydvaranger mining electrification delayed eight years; large industrial projects blocked across the region. Frp demands the energy minister brief parliament — “en tikkende bombe for hele landet.” — TU.no · TU.no

Rhipto-saken: eksperter vantro over at UD betalte

Independent researchers found reports from the two-person Rhipto organization — which received ~30 million kroner from UD — were exaggerated, poorly documented, or contained only publicly available information. Director Christian Nellemann was convicted of serious fraud in 2024. Experts: “completely unbelievable” that UD didn’t see through it. — Panorama Nyheter

Hotell- og restaurantstreiken trappes opp; NHO saksøker LO

Fellesforbundet adds 326 more workers Saturday, bringing the total above 4,000 across 286 businesses. NHO has filed suit in Arbeidsretten over alleged procedural violations — the dispute is now both industrial and legal. — NRK · E24

Equinors største endring på 20 år

1,000 managers through training for what Equinor calls its most radical operational change in two decades — not a reorganization chart, but fundamental changes to how work is done. Simultaneously announced 17 billion kroner in supplier contract extensions. — DN · E24

E-tjenesten masseovervåking til ankesak

The Tinius Foundation’s challenge to the Intelligence Service’s bulk digital surveillance advances to appeal. The core question: who has standing to sue against surveillance when no target knows they’ve been monitored? — Digi.no

Telia-lekkasje: 16 000 kunders trafikkdata og militærbasekart eksponert

Analysis of the Telia Norway breach is complete: 16,000 customers had call and SMS traffic logs exposed, along with fiber network maps showing military base locations. — Digi.no

Norge blir 15. medlem i USAs Kina-motvekt Pax Silica

The US State Department plans to announce Norway’s accession to Pax Silica this week — a coalition countering Chinese dominance in critical minerals, technology, and AI. A US official cited the sovereign wealth fund and mineral reserves as strategically valuable. — Aftenposten

NTNU-professor kalte 7. oktober «århundrets vakreste ting»

Professor Bassam Hussein at NTNU described the Hamas attack as “the most beautiful thing that has happened in our century” during a public lecture. Ervin Kohn of the Jewish Cooperation Council condemned it as glorification of terror. Hussein later acknowledged “beautiful” was unfortunate but said it was in an analytical context about Palestinian displacement. Politicians from Ap and Høyre have distanced themselves. — NRK · Aftenposten

Oppdrettsnæringen forurenser fem ganger mer enn alle kommuner til sammen

A Guardian investigation finds Norwegian salmon farming produces nutrient discharges five times greater than all municipalities, agriculture, and industry combined. A single medium-sized farm generating 3,000 tonnes of salmon produces waste equivalent to the sewage of a city of 50,000. — The Guardian

Also today

  • Defense procurement consultant charged in Ukraine aid case; Elden criticizes sealed documents — TU.no
  • Kripos study reveals how they tracked the 2019 Hydro hackers — Digi.no
  • Russian troll factories expected to refocus on Norway after Hungarian election — r/norge
  • Red-green government cuts transit prices nationwide — VG
  • Railway directorate says national 499kr monthly pass would cost 5 billion/year, advises against — NRK
  • ChatGPT learning study retracted after UiT researchers flag errors — NRK
  • Norwegian graduates locked out of labor market while employers complain of shortages — DN
  • Norway can reconstruct clitoris for FGM survivors — but women aren’t told about it — NRK
  • Swedish coast guard boards suspected shadow fleet tanker — TU.no
  • Sweden launches first spy satellite — TU.no
  • Colonoscopy cuts cancer risk 19% but not mortality — NordICC study — NRK
  • Høiby seeks ankle bracelet; hearing Wednesday — NRK
  • Økern murder: Swedish teens remanded, 15-year-old claims self-defense — NRK
  • OBOS housing prices fell 0.3% in Oslo in April — E24
  • May snowfall and ice warnings — summer tires warned off roads — NRK
  • Rosenborg fires Johansson; Tettey takes interim charge — NRK
  • AI i skolen: “holdningen har vært for naiv” — Digi.no
  • Witzøe at Met Gala for second year — NRK
  • Alexander Rybak performing in Eurovision Vienna final interval act — NRK
  • Norwegian cheerleaders filming Olympic bid documentary — NRK

Stein Erik Hagen (1956–2026).

Tech

Critical Nix/Lix Daemon Vulnerabilities — Patch Immediately

Buffer overflow vulnerabilities in both Nix and Lix daemon implementations allow a local attacker who can talk to the daemon to gain arbitrary code execution as root in multi-user installations. Nix is additionally affected by a path traversal bug. Affected: Nix 2.24.4+, Lix 2.93.0+. Fix: update Nix to 2.34.7 (or 2.33.6/2.32.8/2.31.5/2.30.5/2.29.4/2.28.7), Lix to 2.95.2 (or 2.94.2/2.93.4). A companion NixOS PR (#510943) adds ASLR hardening. A related discussion explores whether Home Manager can be structured so users don’t need to be in allowed-users, reducing blast radius. — NixOS Discourse · Lobsters

Anthropic Acquires Bun; AI-Assisted Zig-to-Rust Port Sparks Controversy

After Anthropic acquired Bun in December 2024, a massive AI-assisted port from Zig to Rust appeared — a single commit with ~774K additions on a branch named claude/phase-a-port. The PORTING.md describes it as a “faithful mechanical translation.” Community reaction is sceptical: Rust compile times exceed Zig’s, the approach risks losing institutional knowledge of a 572K-line codebase, and it echoes the earlier episode where Bun’s AI-assisted upstream patches to Zig were rejected as fundamentally flawed. A companion piece — “I am worried about Bun” — frames whether Anthropic will maintain Oven’s historically high product quality. — HN · HN (worried) · Lobsters

Connected Cars Are Advertising and Surveillance Infrastructure

Stellantis pushes pop-up ads to dashboards at ignition. Google’s Android Automotive OS bundles Google’s advertising stack into the car OS across Polestar, Volvo, GM, Honda, Ford, Nissan, and Mazda. The 4screen platform serves programmatic ads across 16 brands and tracks whether drivers visit advertised locations within three days. All 25 major automakers reviewed by Mozilla failed privacy assessments; 19 of 25 can sell personal data. Policies reserve rights to infer “psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.” — Nobody Asked For This · HN

Async Rust Never Left MVP State

A sharp critique: async fn in traits only recently landed, async Drop is still unstable, cancellation semantics are leaky and underspecified, the runtime ecosystem stays fragmented with no standard. The argument: Rust shipped async before the design was complete, and production teams absorb that technical debt now with no clear resolution path in the language itself. — Tweede Golf · Lobsters

Stripe Formatted 25 Million Lines of Ruby Overnight

Stripe’s developer productivity team rolled out rubyfmt — a Rust-based, zero-config formatter — across what they describe as the world’s largest Ruby codebase in a single overnight pass. The challenge was as much coordination as tooling: thousands of concurrent engineers, CI pipelines, and pending PRs had to survive the transition. — Stripe Engineering · HN

LLMs Are Homogenizing Written Language

Research tracking how LLM-generated text narrows the diversity of written English. Human essays scatter widely in embedding space; LLM-revised versions cluster tightly. A preference paradox: users report satisfaction with LLM revisions despite acknowledging loss of personal voice. LLM peer-review scores 10% higher than human reviewers with different criteria — relevant as future models train on increasingly LLM-shaped text. — Research site · Lobsters

Agent Skills: Engineering Discipline for AI Coding Agents

Addy Osmani’s framework: a “skill” is a structured workflow with checkpoints and exit criteria, not reference docs. Five load-bearing principles: process over prose, anti-rationalization tables (pre-written rebuttals to plausible excuses to skip steps), mandatory verification, progressive skill loading for token efficiency, and strict scope discipline. Directly applicable to anyone building agentic coding workflows. — Addy Osmani · HN

Security roundup

  • Copy Fail (CVE-2026-31431): privilege escalation in rootless containers via error-handling in copy operations — Dragonsreach
  • Linux kernel privesc: local users can gain root; flaw reportedly 20+ years old — Digi.no
  • Vaultwarden 1.36.0: patches SSO CSRF, user enumeration, session binding — GitHub
  • Multiple CVEs in uutils coreutils (Rust reimplementation) — oss-security
  • cPanel vulnerability actively exploited for ransomware — Digi.no
  • Microsoft Edge stores all saved passwords in cleartext in memory — HN
  • Zero-auth cross-tenant bug in DoD-backed SaaS platform — Strix
  • Determinate Secure Packages 25.11: enterprise LTS for nixpkgs through May 2028 — Determinate Systems

Also today

  • Embedded Rust vs C for industrial firmware: comparative study with Ariel OS — arXiv
  • Spotify introducing artist verification to block AI-generated music — Kode24

A Jeep Grand Cherokee infotainment screen displaying a $1,500 promotional offer at ignition.

Linux & Infrastructure

nix-output-monitor: Making Complex NixOS Builds Readable

nom wraps nix commands and renders the build as a live dependency hierarchy — makes it easy to spot which package is causing a long compilation or unexpected rebuild. Prefix builds with nom or install via nix run nixpkgs#nix-output-monitor. — GitHub · r/NixOS

The libGL Anomaly: Where NixOS Isolation Breaks Down

Full Time Nix podcast digs into graphics library ABI mismatches that create “impurities” where NixOS’s theoretical isolation guarantees fail. Title: Nix is a Lie, and that’s ok. Takeaway: powerful but has documented edge cases with system-level graphics dependencies. — Full Time Nix · r/NixOS

Embedded SQL Treesitter Highlighting in Neovim Required Patching NixOS Packages

Setting up cross-language syntax highlighting for sqlx Rust code via Treesitter injections hit NixOS-specific packaging issues, ultimately requiring Nix patches. Useful reference for anyone doing language injections on NixOS. — sitr.us · r/NixOS

AI Agents with Shell Access Are a Practical Argument for Nix

Giving AI agents unrestricted shell access made the author take Nix seriously: reproducibility, isolation, and rollback become practically valuable when automated agents can make arbitrary system changes. Discussion touches on devShells as agent environments. — r/Nix

nixfmt-rs: Toward Rust-Quality Parser Error Messages for Nix

Proposal to bring Rust compiler-quality error reporting to Nix code parsing — source location references and meaningful diagnostics instead of generic error messages. — NixOS Discourse

Hyprland Ecosystem Updates

klearShell — a new Hyprland shell in Kotlin/C, early development. TIL: hyprlock at startup via exec-once can handle keyring unlock, eliminating tuigreet for that job. A Discourse thread works out correct NixOS .desktop file generation for greetd + tuigreet + Hyprland. — Codeberg · r/hyprland · NixOS Discourse

Tools & selfhosted

  • netwatch v0.15 — terminal network diagnostics, live topology view, packet capture, flight recorder (Rust/ratatui)
  • sabiql — PostgreSQL TUI with ER diagrams, vim nav, read-only mode (Rust)
  • eilmeldung — TUI RSS reader with query language and smart folders (Rust)
  • Matcha — terminal email client: multi-account, HTML rendering, PGP, plugin marketplace (Go/Bubble Tea)
  • baeru — cinematic reveal effects and ANSI color rewriting for any TUI via PTY (Rust)
  • torii — Go reverse proxy with live request dashboard and Coraza WAF
  • AudioMuse-AI v1.1.0 — lyrics semantic search for self-hosted music analysis (Jellyfin/Navidrome)
  • Speakr v0.8.19 — self-hosted transcription with speaker diarization and LLM chat
  • n8n + Paperless-ngx + Paperless-GPT: RAG over scanned documents — r/selfhosted
  • ESPHome voice satellite: ReSpeaker Lite + ESP32-S3 improves mic performance — r/homeassistant
  • Home Assistant 26.4 adds native infrared device support — r/homeassistant

netwatch topology view: local peers, public Internet, router/ISP as spine.

cd ~/repos/ratatosk && claude --resume a5a141c5-a8ce-49de-b2c3-7c1ff7f4a8cd