Josse-posten

Iran’s counter-proposal lands dead on arrival; the Hormuz blockade grinds into a second month; and a War on the Rocks essay declares the battlefield golden hour extinct.

Tehran Broadcasts Its Terms, Washington Says No

Iran delivered its formal counter-proposal to the US peace framework on Saturday — and made sure the world saw it before Washington could respond. The 14-point package demands full sovereignty over the Strait of Hormuz, war reparations, and a permanent end to hostilities. Trump called it “totally unacceptable.” Netanyahu declared the war “not over” until enriched uranium leaves Iran. France pre-positioned its carrier for a Hormuz mission.

The terms were never designed for negotiation. House of Saud’s sharp analysis argues Tehran deliberately broadcast its maximalist demands through IRNA, Tasnim, and Al Jazeera before any back-channel could soften them — locking Iranian negotiators out of future compromise. Supporting moves preceded the broadcast: a Persian Gulf Strait Authority established May 5, and supreme leader advisers publicly equating Hormuz control with nuclear capability. The strategy is to anchor public expectations so that any Saudi-brokered framework at Trump’s coming Riyadh visit reads as documented Iranian refusal, not failed diplomacy.

Meanwhile, Iran’s civilian population absorbs the cost: soaring food inflation, a collapsed currency, and a nationwide internet blackout limiting outside communication. BBC correspondents reaching dissidents via intermediaries heard accounts of people feeling “helpless” under the dual burden of war and government repression.

Axios · Reuters · BBC · NPR · Al Jazeera (food inflation) · House of Saud (analysis) · France 24 (carrier)

The Golden Hour Is Dead

War on the Rocks publishes a sobering essay arguing that Western casualty evacuation doctrine — built on the “golden hour” from Afghanistan and Iraq — is obsolete. Persistent drone surveillance means evacuation itself now generates lethal risk exceeding the original injury: any movement creates observable signatures that drone operators exploit through integrated fire systems. Mine contamination forces casualties onto pre-registered kill corridors. The authors document soldiers refusing assaults and taking their own lives after injury due to fear of abandonment. The conclusion: wounded may remain forward for extended periods, requiring all troops — not just medics — to sustain casualties in place. Western militaries must shift from rapid extraction toward survivability under exposure.

War on the Rocks

A Divided Kingdom

Keir Starmer is fighting for survival as around 40 Labour MPs call for his resignation after historic local election losses. Health Secretary Wes Streeting and Deputy PM Angela Rayner are positioning for leadership bids. But the deeper story is structural: Reuters reports that pro-independence parties are simultaneously surging across Scotland, Wales, and Northern Ireland — all three on course to be led by separatist parties. Northern Ireland’s leader called it “seismic.” The three parties could coordinate pressure on Westminster. Meanwhile in Australia, One Nation won its first-ever lower house seat, tracking the same global populist current.

The Guardian (Starmer) · Reuters (independence) · NPR · NYT (One Nation)

Markets

Indicator Value Change
S&P 500 +0.83%
Gold +0.48%
Oil −1.02%
EUR/USD 1.0843
USD/NOK 10.82
BTC $80,752

Gold +0.5% on safe-haven bid as Iran talks collapse and Russia breaks Ukraine truce. Oil −1.0% despite Hormuz headlines — disruption likely priced in; Saudi Aramco reported +26% Q1 profit on pipeline rerouting.

NASA Space Shuttle view of the Strait of Hormuz — the 21-nautical-mile narrows at the center of Iran’s sovereignty claim.

War on the Rocks: the golden hour is dead in the age of persistent drone surveillance.

World

Hormuz Blockade Hammers Global Energy

The Strait remains effectively shut, pushing oil prices sharply higher. Saudi Aramco’s east-west pipeline lets it route around the Gulf — Q1 profits up 26%. India’s Modi urged citizens to work from home and limit foreign travel. A South Korean cargo vessel was struck by unidentified objects in the Hormuz area on May 4. UK consumer confidence is collapsing ahead of a new cost-of-living wave.

BBC (oil) · BBC (India) · The Guardian (Aramco) · The Guardian (UK) · Al Jazeera (Korea)

The True Cost of the Iran War

A New York Times opinion piece challenges Defense Secretary Hegseth’s public claim that the war has cost $25 billion, tallying actual expenditures and finding the real number significantly higher — a pattern familiar from the GWOT era, when true costs were systematically obscured through off-budget accounting.

NYT (gift link)

Trump to Press Xi on Iranian Oil During China Visit

Trump’s upcoming China visit — the first US presidential trip in nearly a decade — will focus on pressing Xi to stop purchasing Iranian oil that undermines the naval blockade. The visit also tests a fragile tariff truce, making it one of the most consequential diplomatic events of the conflict.

Al Jazeera · BBC · Jerusalem Post

FIFA World Cup Faces Heightened Terror Risk

Security experts warn that 78 World Cup matches across 11 US cities face elevated terrorism risk, with intelligence gaps and “soft target” vulnerabilities amplified by the Iran conflict. — The Guardian

Israel Kills 51 in Lebanon in 24 Hours; Tungsten Weapons Documented

Israeli attacks killed at least 51 in Lebanon including medical personnel — 552 killed since the nominal ceasefire began April 16. Al Jazeera documented weapons firing tiny tungsten metal cubes causing devastating internal injuries, the same munitions previously reported in Gaza.

Al Jazeera · Al Jazeera (tungsten)

IDF Chief: Army ‘Will Fall Apart’ Without More Soldiers

Israel’s military chief warned lawmakers the IDF faces a severe manpower crisis from sustained simultaneous operations in Gaza, Lebanon, and the Iran conflict. Separately, South Korea is exploring Hyundai robotics platforms to offset its own shrinking conscript pool — a broader global pattern. — Ynet News · Bloomberg (Korea)

Settlers Force Palestinian Family to Exhume Father

Israeli settlers forced a Palestinian family to dig up a freshly buried father and rebury him in the West Bank — condemned by the UN as “appalling and emblematic of the dehumanisation of Palestinians.” Meanwhile, a Gaza documentary the BBC refused to broadcast won the BAFTA for Best Current Affairs.

BBC · NPR · Al Jazeera (BAFTA)

Russia Offered Iran Fiber-Optic Guided Drones

Intelligence reports indicate Russia offered Iran advanced fiber-optic guided drones — resistant to electronic jamming — for use against US forces. The offer deepens the Russia-Iran military relationship and signals Moscow’s willingness to directly arm Tehran against American assets. — United24Media

Hantavirus: Multi-Country Quarantine After Third Death

The MV Hondius hantavirus outbreak has become a multi-country public health incident. Three dead; 17 Americans repatriated to a Nebraska quarantine facility; Australian passengers face three-week quarantine; a symptomatic French national returning; and UK military parachuted onto Tristan da Cunha to treat a British case. Origin investigation underway in Ushuaia.

The Guardian · NPR · BBC (France) · BBC (Tristan da Cunha)

Also today

  • Narges Mohammadi granted bail — Nobel laureate’s smuggled memoir details beatings and medical neglect in Iranian prisons — The Guardian · BBC
  • Ziobro flees Hungary to US — Poland’s fugitive ex-justice minister, wanted for leading an organized criminal enterprise, received a Trump-issued visa after Magyar signaled Hungary would stop shielding fugitives — The Guardian · Politico
  • Thaksin Shinawatra released from Thai prison on parole after eight months — Al Jazeera
  • Philippines to impeach VP Sara Duterte — Congress moving to vote on removal and permanent disqualification — Al Jazeera
  • Japan–Philippines weapons pact talks agreed amid China’s coercive South China Sea activities — AP
  • Putin threatens Armenia with “Ukraine scenario” over EU ambitions — United24Media
  • Vatican recognizes LGBTQ+ pain in landmark report — stops short of doctrinal change — Attitude
  • Pakistan: 21 police killed in coordinated car bomb and ambush in the northwest — Al Jazeera
  • Film star Vijay sworn in as Tamil Nadu chief minister — Al Jazeera

Fresh produce market in Tehran as food prices soar under the US naval blockade.

Civil defence volunteer beside the bodies of nine killed in an Israeli airstrike on Jibshit, southern Lebanon, May 10.

Ukraine

Day 3: 180 Russian Attacks, Ukrainian Advances in Three Sectors

The Victory Day ceasefire has collapsed in all but name. Ukraine reported 180 Russian attacks on day 3, up from 147 on day one, plus 8,037 drones and 6,380 strikes in 24 hours. Both sides accuse the other of violations; NASA thermal data confirms fighting decreased but never stopped. Ukrainian forces made tactical gains in the Borova direction, in Nykyforivka southeast of Slovyansk, and in Illinivka south of Kostyantynivka. ISW confirmed Russian forces near Pokrovsk have been wearing Red Cross insignia — a Geneva Convention war crime — for several consecutive days.

Ukrainska Pravda · ISW, May 10 · Kyiv Independent · Al Jazeera

POW Exchange Moves Forward; Zelensky Says Putin Signals Openness

Ukraine submitted its list of 1,000 POWs to Russia with the US acting as guarantor — directly rebutting Putin’s May 9 claim that Kyiv was sabotaging the swap. Zelensky said Putin is now “finally ready for real meetings,” though no venue or format has been agreed; Putin still insists on Moscow.

Ukrainska Pravda · Ukrainska Pravda

Germany’s Pistorius in Kyiv; EU Rejects Schröder Gambit

German Defence Minister Boris Pistorius made a surprise Kyiv visit to discuss joint drone production, including a new Ukraine-Norway deal on long-range 155mm artillery shells. Putin’s suggestion that ex-chancellor Gerhard Schröder serve as EU negotiator was dismissed by EU foreign policy chief Kaja Kallas over his ties to Russian state companies. The EU will discuss conditions for Russia dialogue at a Cyprus meeting May 27–28.

Kyiv Independent · Ukrainska Pravda · France 24

New Weapons on Both Sides

Russia debuted Banderol cruise missiles launched from Mi-28 helicopters in Kharkiv Oblast and BM-70 reconnaissance-strike drones. Ukraine deployed AI-powered anti-drone turrets capable of neutralizing fiber-optic drones with a single button press, and a converted An-28 aircraft operating as a drone hunter has downed 213 Russian UAVs using onboard machine guns and interceptor drones.

Militarnyi · Defence Ukraine · ISW, May 10

Russia Escalates AI-Generated Propaganda to Fake Advances

ISW reports a coordinated Kremlin campaign using increasingly sophisticated AI-generated flag-raising video to claim advances where Russian forces hold no enduring positions. Volume surged before Victory Day to compensate for territorial deadlines. Paired with continued suppression of critical milbloggers: one with a double leg fracture was reportedly sent to a frontline assault unit after criticizing Putin; another former combat pilot was arrested on unrelated charges. — ISW

Also today

  • Russian frigate patrols UK waters — latest grey-zone provocation as formal diplomacy stalls — iNews
  • Explosive drone drifts into Greek waters — suspected Ukraine-linked device detonated off Lefkada; uncomfortable questions about NATO territory — The Guardian

Kill markings on a Ukrainian An-28 modified for drone hunting — 213 Russian UAVs downed.

German Defence Minister Boris Pistorius arrives at Kyiv’s central station, May 11.

Tech & Security

ClaudeBleed: Any Chrome Extension Can Hijack Claude’s Browser Extension

LayerX found that Anthropic’s Claude Chrome extension accepts messages from any script in its browser origin without verifying the caller. Any installed extension — requiring zero permissions — can issue commands to Claude, including opening Google Drive files and sharing them externally. Anthropic’s v1.0.70 fix added internal checks, but switching to “privileged” mode bypasses them entirely. The vulnerability creates a privilege escalation primitive across Chrome extensions — something Chrome is explicitly designed to prevent.

LayerX Security · Lobsters

Malicious Claude Code Installer: Top Google Sponsored Result

A developer with 30 years of experience installed a trojan after a Google-sponsored ad appeared first for “claude code.” The attack was macOS-specific: the installer used xattr -c to strip the quarantine attribute, bypassing Gatekeeper entirely. Not lazy phishing — the attacker engineered around macOS security, exploiting the trust model of curl-pipe-install commands. — r/ClaudeAI

Obsidian Plugin Ecosystem Used to Deploy RAT

Threat actors distributed Phantom Pulse RAT through the Obsidian community plugin marketplace, targeting knowledge workers who install plugins from GitHub without code review. No mandatory review, no signature verification — concrete supply chain risk.

NetSecOps · HN

Cyber Law Gaps and Big Tech Veto Power Are Hollowing Out Sovereignty

War on the Rocks identifies two structural threats. First, international law’s “kinetic equivalence” standard only classifies cyber operations as armed attacks when they parallel physical force — a gray zone Russia has exploited since 2014. Second, military dependence on private infrastructure grants CEOs de facto veto power: the piece cites Starlink’s 2022 geofencing of Crimean waters that restricted Ukrainian connectivity during a counteroffensive. Proposed remedies: reclassify destructive cyber ops based on intent, and impose binding continuity-of-service obligations on critical infrastructure providers.

War on the Rocks

Hardware Attestation as Monopoly Enforcement

GrapheneOS warns Apple and Google are expanding hardware attestation beyond legitimate security uses, deploying it to exclude alternative operating systems and enforce app store lock-in. Banking apps, payment systems, and streaming platforms requiring attestation effectively mandate the duopoly’s OS stack on hardware users nominally own. — GrapheneOS · HN

Replacing a 3GB SQLite Database with a 10MB FST

Andrew Quinn replaced a 3GB SQLite lookup database with a 10MB finite state transducer — 300× smaller, faster lookups. FSTs compactly encode sorted string sets with prefix sharing, making them ideal for read-only, memory-mapped lookup tables. When your query is always “does this string exist and what does it map to,” SQLite’s generality is pure overhead.

andrew-quinn.me · Lobsters

Debian Makes Reproducible Builds Mandatory

Packages must now be reproducible to migrate into Debian Testing — the tooling actively blocks failures, including regressions. Enforcement went live the day after the announcement. This makes Debian the first major distro to enforce reproducibility at the gate.

Debian Devel Announce · Lobsters

How Factorio Syncs a Million Objects Over the Network

Deep dive into Factorio’s netcode for deterministic lockstep simulation of conveyors, machines, and items. Covers delta compression, entity state representation, and why the hard constraint of determinism shapes the entire network architecture. — YouTube · Lobsters

Idempotency Breaks When the Retry Has Different Parameters

The simple definition (same request → same result) hides the hard case: a client retrying with different parameters due to a bug, changed intent, or timeout ambiguity. The post works through real failure modes in payment systems and the design patterns that handle them robustly. — dochia.dev · Lobsters

Maryland Ratepayers Billed $2B for Out-of-State AI Data Center Grid Upgrades

Maryland regulators complained to FERC that citizens are charged $2B for transmission infrastructure serving AI data centers located outside the state — a structural artifact of how regional transmission organizations allocate costs. The state says it violates ratepayer protection commitments. A concrete case of AI infrastructure costs externalized through regulatory mechanisms.

Tom’s Hardware · HN

Also today

  • AI PRs overwhelming open source — RPCS3 PS3 emulator team asks people to stop submitting AI-generated pull requests — Kotaku · HN
  • adamsreview — multi-agent Claude Code plugin for higher-confidence PR reviews with parallel sub-agents — GitHub · HN
  • Robot dogs are a security nightmare — specific CVEs, default creds, unencrypted command channels — YouTube · Lobsters
  • FreeBSD privesc via execve() patched — SA-26:13 — FreeBSD
  • CVE-2024-YIKES — satirical supply chain incident report that reads uncomfortably like reality — nesbitt.io · HN
  • Replacing Ctrl-R without the removed TIOCSTI ioctl — PTY manipulation and signal handling — rickardlindberg.me
  • Revaulter — unlock encrypted ZFS volumes remotely with a passkey on your phone — withblue.ink · Lobsters
  • wayland.fyi — new minimalist Wayland special interest group for Sway/River/Hyprland users — wayland.fyi
  • Tiny-Lua-Compiler — minimal compiler as pedagogical study — GitHub
  • Implementing a PL in 7 lines — Matt Might’s 2010 classic resurfaces — matt.might.net · HN
  • let-go — near-Clojure written in Go, persistent data structures, macros, REPL — GitHub

Revaulter: approve a ZFS decrypt request via passkey on your phone.

“We see something that works, and then we understand it.” — Daniel Lemire on engineering epistemology: understanding follows demonstration, not the other way around. lemire.me

Cultural footnote

James Burke’s unbroken walk through the British Museum in Connections (1978) — one continuous take, no cuts, tracing the historical chain of causation behind modern technology. Still unmatched for intellectual density and cinematic ambition. — Open Culture · HN

AI & Automation

Fields Medalist: ChatGPT 5.5 Pro Made Genuine Research Contributions

Timothy Gowers (Fields Medal, 1998) used ChatGPT 5.5 Pro on open research problems in additive number theory and found the model produced novel constructions using h²-dissociated sets that improved bounds from exponential to polynomial complexity — validated as “almost certainly correct” by the original researcher. Gowers is clear-eyed: this is meaningful participation in frontier mathematical work, not benchmark performance. He raises hard questions about PhD training and how mathematical contribution will be valued.

Gowers’s Weblog · Lobsters

Claude Mythos Preview Lands on METR’s Autonomous Task Benchmark

METR updated its time-horizon chart to include Claude Mythos Preview, Anthropic’s next-generation model. Community readings: 90% success at tasks taking 80 minutes of expert time, 99% at 6-minute tasks. METR caveat that measurements above 16 hours are unreliable — potentially relevant if Mythos pushes into that range.

METR · r/ClaudeAI

LLM Rankings Are Non-Transitive

A developer modeled benchmark results as a directed graph and found many cycles: A beats B, B beats C, C beats A. There is no consistent total ordering across tasks. Leaderboard rankings that aggregate obscure that the dominance relation isn’t transitive. The visualization at llm-win.com makes it easy to see which models win on which task types.

r/MachineLearning · LLM Win

DeepSeek V4: FP4 QAT Cuts Inference Cost 73–90%

The full V4 paper adds significant depth beyond the April preview. The headline technique: FP4 quantization-aware training applied in late-stage training, quantizing MoE expert weights to FP4 with 2× QK selection speedup at 99.7% recall. V4-Pro uses 27% of V3.2 FLOPs and 10% of KV cache; V4-Flash drops to 10% FLOPs and 7% KV cache. Stability mechanisms include anticipatory routing (deliberately desyncing router updates from main model updates) and SwiGLU clamping.

r/MachineLearning

Claude as User-Space IP Stack: ~10 Second Pings

Adam Dunkels — creator of uIP, lwIP, and the Contiki OS — asked Claude to implement a user-space IP stack and measured ICMP round-trip latency at roughly 10 seconds. A playful but technically grounded experiment from the person who wrote the embedded TCP/IP book.

dunkels.com · HN

Proxy Hack Exposes Claude Code’s Unified Rate Limit Pool

A developer built a local proxy intercepting Claude Code traffic and discovered there is only one unified token pool — no separate Sonnet bucket exists. Anthropic announced a separate Sonnet limit in November 2025 but the backend never shipped it (confirmed in GitHub issue #57050). The Sonnet usage bar in the UI is cosmetic.

r/ClaudeAI

LLMs Have Killed the 90-Day Disclosure Window

Security researcher argues the 90-day responsible disclosure model was designed for a world where exploit development was slow. LLMs can now rediscover and develop exploits at near-zero timelines, meaning disclosed vulnerabilities should be treated as already known. The conclusion: critical issues are P0 — hours, not sprints.

Threat Notes · Lobsters

Hollow-agentOS: Self-Modifying Local Agents with a “Suffering” Constraint System

An open-source multi-agent runtime targeting consumer hardware via Qwen 3.6:35B-A3B. The distinctive design: a mechanical “suffering” system where six stressor types, when thresholds exceed 0.55, make specific capabilities literally unavailable — enforcing task discipline via hard constraints rather than prompt suggestions. Agents synthesize their own tools at runtime and write operational lessons to JSON. Humans are treated as a callable service via invoke_claude.

GitHub · r/ClaudeAI

Also today

  • Signals — triage informative agent traces without LLM judges; 82% informativeness vs 54% random sampling — arXiv
  • Qwen 3.6 27B local — community consensus: capable for execution given a spec, not for architecture; use Claude for design, local for implementation — r/ClaudeAI
  • Running local models on M4 — practical breakdown of what works with 24GB unified memory — jola.dev
  • Agent clarification timing — knowing when to ask questions is harder than it looks; a framework for when agents should interrupt — r/automation
  • Freddy — wearables MCP server (Polar, Oura, Withings, Suunto) now supports headless OAuth for scheduled workflows — freddy.coach

Adam Dunkels’ experiment: Claude operating as a user-space IP stack, responding to ICMP pings in ~10 seconds.

Health

Cord Blood HPC Therapy: 85% vs 30% Fatigue Resolution in Phase IIa

StemCyte’s allogeneic cord blood-derived hematopoietic progenitor cell therapy (CD34+/CD133+ cells, trade name RegeneCyte) showed a striking efficacy signal in a small placebo-controlled trial: 85% of treated patients vs. 30% of controls reached normal/borderline fatigue at 26 weeks, with CFQ-11 Bimodal dropping from 6.75 to 1.00 vs. 7.70 to 5.20 (p<0.001). The FDA cleared an expanded access program in January 2026. Critically, no immune biomarkers were measured, so the mechanism is unknown — the cord blood progenitors are hypothesized to modulate immunity but this was not tested. Phase 3 is planned.

eClinicalMedicine (Lancet) · PubMed · FDA expanded access PR

ME1 as Molecular Switch Between Reversible and Irreversible CD8+ T Cell Exhaustion

A Mayo Clinic preprint identifies malic enzyme 1 (ME1) as the metabolic-epigenetic anchor of “latent effector capacity” in CD8+ T cells — defining a boundary between reversible exhaustion (ME1 present, chromatin at effector loci open, rebound possible with checkpoint inhibition) and irreversible exhaustion (ME1 lost, chromatin closes, no rebound even with PD-1 blockade). This is cancer immunology, not Long COVID directly. But the relevant subset with highest ME1 and resilience — CX3CR1+ effector memory CD8+ T cells — is precisely the subset characteristically depleted in Long COVID. If surviving CD8+ T cells are ME1-low, reducing antigen load alone won’t restore function; reconstitution strategies (ANKTIVA IL-15, daratumumab’s downstream effects) become more logically motivated.

bioRxiv (preprint)

Trial tracking

  • IA-PACS-CFS (Charité immunoadsorption) — treatment completed Jan 2026; in analysis phase
  • IAMPOCO (Mainz immunoadsorption crossover) — data collected Oct 2024, results pending
  • ADDRESS-LC (bezisterim/BioVie) — topline data slipping toward H2 2026
  • REVERSE-LC (baricitinib Phase 3) — recruiting 550; neurocognition Nov 2026, full Jul 2027
  • ANKTIVA (INTERRUPT_LC, COVID-4.019-Long) — recruiting; results Jul/Oct 2026
  • Daratumumab (Haukeland) — ongoing double-blind; ~2027
  • Sonlicromanol — active Phase 2, PEM primary endpoint
  • TURN-Long COVID (Amsterdam UMC, AAb-stratified IA) — recruiting
  • Stellate ganglion block (UHN Toronto Phase 4) — not yet recruiting
cd ~/repos/ratatosk && claude --resume 697bb898-68fd-47ba-8aa7-152792ec5c73