Josse-posten

The Starlink story turns out to be American policy, not one man’s whim; Ukraine shuts every Moscow airport; and Iran declares the Gulf closed to the US Navy as Brent hits $117.

A Reuters investigation reveals that the US government has for years asked SpaceX to modify Starlink service in Ukraine and the Middle East. This reframes the restrictions as US policy rather than Musk’s unilateral decisions. On the ground, little has changed: Trump and Musk say the limits are lifted, but Ukraine’s General Staff, Defence Ministry and Zelensky confirmed on 23–24 October that the 161 km/h speed limits remain active across “some” units. Some terminals now work above that speed, which makes the service inconsistent and operationally unreliable.

In Washington, bipartisan senators say they will hold up Trump administration confirmation votes until satellite access is fully restored, and a bipartisan House group urged Defence Secretary Hegseth to expand the Starshield Pentagon contract. Canada’s PM Carney called the manipulation a security concern. Meanwhile, Ukraine is learning to fight without Starlink — switching drone frequencies and battlefield communications to reduce its dependence.

Ukrainian drones and balloons shut all four Moscow airports; Storm Shadows hit an Iskander supplier

A Ukrainian drone on the tarmac at Sheremetyevo and a balloon over Moscow City, 23 October. Photo: Militarnyi

Overnight 22–23 October, Ukraine launched its most geographically dispersed strike campaign in recent memory. 155 drones and balloons aimed at Moscow Oblast forced all four major Moscow airports — Sheremetyevo, Domodedovo, Vnukovo and Zhukovsky — to close, and the IQ-Quarter tower, which houses several Russian ministries, was evacuated. Storm Shadow cruise missiles struck the Proton optoelectronics plant in Oryol, which makes components for Iskander-M missiles, Pantsir-S1 air defence and Kh-71 cruise missiles. An FP-1 drone hit the Azot UralKhim chemical plant in Berezniki, Perm Krai — about 1,585 km from the border, one of the deepest confirmed strikes of the war.

The following night, a drone hit the Tolyattikauchuk synthetic rubber plant in Tolyatti, and an attack on energy infrastructure near Sevastopol caused widespread power cuts across occupied Crimea.

Iran bans the US Navy from the Gulf as oil hits $117 — and Washington warns of “advanced” assassination plots

Brent crude rose to $117 a barrel, its highest in over six months, after Iran’s top general announced that US military vessels are banned from entering the Gulf “under any circumstances.” A US intelligence memo warns of sophisticated Iranian plots to kill American officials abroad, and embassies are on elevated alert. The US has also notified Iraq of a potential strike on Iran; Iraq’s prime minister warned armed groups in the country not to act. The warnings indicate that strike planning is at an advanced stage. Iran’s own target list is growing too (see World).

Melania Trump brokers a local ceasefire for starving Oleshky — but the start dates differ

The White House says the First Lady secured a limited ceasefire in Russian-occupied Oleshky, Kherson Oblast — the first time Russia has agreed to humanitarian access to the city, where residents have been reduced to eating garden weeds. Ukraine’s Ombudsman confirmed the deal covers a ceasefire, humanitarian cargo and free civilian movement. Russia’s chief of general staff Gerasimov put the start at 04:00 Moscow time on 27 October; the White House said 29 October. The discrepancy is unexplained. Russian occupation authorities cut off food and medicine to Oleshky in late 2025 and rejected three Ukrainian humanitarian ceasefire proposals this year. Ukrainian media has identified the Russian officers responsible for the blockade.

Secret Kremlin financing sinks a $25bn Alaska gas venture, as the first Russian diesel heads for New York

Executives have quit a $25 billion natural gas project in Alaska’s Beaufort Sea after hidden Russian government financing was found inside the venture’s structure, the New York Times reports — a discovery that surfaced during US gas talks with the Kremlin. In parallel, a tanker carrying 40,000 tonnes of Russian diesel is on its way to New York, the first cargo under the new Putin–Trump commercial deal. The buyer and seller are unknown, which raises questions about how the shipment fits the existing sanctions architecture.

Railway CI breach: the attackers wanted AI provider keys

Between 20 and 22 October, attackers used a privilege escalation in Railway’s build infrastructure to reach encrypted environment variables for about 1.85% of customer workspaces (~100K). Their goal was AI provider credentials — Anthropic, OpenAI, OpenRouter — for model distillation, not payment or user data. Railway rotated keys with those providers, Stripe, GitHub and others; user accounts were untouched and running apps stayed online. It is the second attack aimed at AI keys this week, after the LiteLLM supply-chain compromise.

Indicator Value Change
S&P 500 7,624 -0.52%
Dow 30 52,215 -1.23%
Nasdaq 25,955 -0.21%
Russell 2000 2,776 -0.29%
VIX 19.45 +2.21%
Gold 4,008 -1.29%
BTC $80,705 -0.93%
USD/NOK 9.36 0.00%
  • Brent at $117, a six-month high, as Iran declares the Gulf closed to US warships. US stocks closed lower, the Dow down 1.23%.

World

Iran has detailed plans to cut the Gulf’s undersea cables

Iran holds detailed operational plans to sabotage submarine communications cables in the Gulf if the war resumes, Reuters reports, adding information infrastructure to a target list that already includes refineries and datacentres. (See also the leader on Iran’s Gulf ban.)

Oil slick spreads for miles along the UAE coast

Satellite images show an expanding oil slick along the UAE coastline after a tanker was struck — reportedly by a naval mine — in early October. Beaches are closed, and the full environmental damage is still being assessed.

Israel launches mass punishment in Hebron days before Tuesday’s election

After two Israeli soldiers were killed at a Hebron checkpoint, Netanyahu ordered demolitions of Palestinian buildings and mass detentions across the West Bank, with raids in at least 15 towns including Nablus and Jenin. The operation comes days before the 27 October general election, where Netanyahu faces a divided electorate; three-quarters of Jewish first-time voters now identify as right or centre-right. Lebanese analysts say no outcome is likely to change Israel’s occupation policy in the south.

Serbia votes: student movement neck-and-neck with Vučić

Serbia votes today in its most competitive election in years. The Student List, born from nearly two years of anti-corruption protests, is now the largest single challenger to Vučić’s ruling SNS — turning an expected formality into a real contest for the largest bloc in parliament.

BBC

France deploys 70,000 police for Saturday’s protests; racist shooting kills one near Paris

France is mobilising 70,000 officers, including elite counter-terrorism units, as hundreds of thousands march in the first organised national protest since last week’s riots, which left Limoges city hall in ruins. On Friday a gunman fired from a car in Trappes and Verrières, west of Paris, killing one and wounding five, including a 12-year-old girl. Macron called it a “racist terrorist attack” and called for a reckoning with French racism.

Gunmen kill seven at a church funeral in Jordan’s Karak

Two masked gunmen opened fire during a Greek Orthodox funeral in the southern city of Karak, killing seven and wounding between 34 and 40. State television broadcast CCTV of the attackers approaching on foot. A manhunt is under way; nobody has claimed responsibility.

Rubio publicly calls on Cubans to work with the CIA for regime change

Secretary of State Marco Rubio urged Cubans to secretly work with the CIA to topple their government, moments after Trump told a Florida rally that US warships could intervene near Cuba. It is the most overt US regime-change posture toward Cuba in years.

DOJ orders California counties to set aside “likely noncitizen” ballots

Federal prosecutors wrote to county registrars across California, demanding they set aside and verify ballots identified as possibly cast by noncitizens — the latest Justice Department intervention in election administration before the midterms. Critics call it coordinated voter suppression; state officials are pushing back.

Spain’s PP runs an AI deepfake of the PM’s wife

Spain’s main opposition party, Partido Popular, ran an election ad with an AI-generated deepfake of Pedro Sánchez’s wife apparently confessing to wrongdoing. The ad has sparked cross-party outrage and a national debate about AI in politics.

Ebola spreads to four countries; WHO starts a vaccine trial in DRC

Kenya recorded its second Ebola death, a close relative of the first victim, who had travelled from DRC. Nigeria’s mystery case is now linked to a Swiss diplomat’s wife who passed through Uganda, raising fears that the Kenyan and Nigerian cases share a common airport exposure. The WHO has launched a clinical trial of several vaccine candidates in DRC as the outbreak spans eastern, central and western Africa.

Europe’s summer heat killed 50,000; climate change blamed for two-thirds

A new study finds this year’s European heat events caused about 50,000 deaths, and attributes roughly two-thirds of them to human-caused climate change — more evidence that extreme heat is now the continent’s deadliest weather hazard.

Also today

Middle East & Asia
Yemen: a Taiz hospital is days from collapse as the Houthi siege tightens; dialysis sessions already cut and drinking water dwindling — Al Jazeera · NPR
Kim Jong Un arrives in China, a week after a new border bridge opened — Al Jazeera
Typhoon Champi kills one and injures 500+ in Taiwan, now heading for China — The Guardian · Al Jazeera
Americas & Europe
Pentagon designates Confucius Institutes a national security threat, claiming they run under new names at 30 universities — The Guardian · Al Jazeera
Argentine judge drops the LibreLibre crypto fraud investigation into Milei — BBC · Al Jazeera
Fire engulfs Hitler’s Eagle’s Nest in Bavaria; police detain a suspect — The Guardian · BBC

Ukraine

Putin invokes “historical Russia” to claim Ukrainian oblasts he does not hold

On 22 October Putin called occupied Ukraine “the territory of historical Russia” and rejected Zelensky’s proposal to freeze the current frontline. ISW says the framing refers to the Kremlin’s “Novorossiya” concept, which extends beyond the four illegally annexed oblasts to Kharkiv, Dnipropetrovsk, Mykolaiv and Odesa — territory Ukraine controls, with millions of residents. Taken literally, Putin’s demands require Ukraine to give up another ~20% of Donetsk Oblast, a quarter of Zaporizhzhia including the city itself (700,000 pre-war), and 30% of Kherson including Kherson City. He also repeated the December 2021 demand to roll back NATO’s eastern posture, which ISW notes is incompatible with current US deployments in Poland and the Baltics. Zelensky says Ukraine is ready to end the war but will not recognise occupied territory as Russian.

Meanwhile, the US is reportedly prepared to offer Ukraine a path to EU membership in exchange for dropping its NATO bid — trading the collective-defence guarantee for economic integration.

Russian drone sinks a cargo ship off Romania; debris lands in a Moldovan village

A likely Russian drone struck and sank the Comoros-flagged cargo ship Khoryv about 13 nautical miles off Constanța, just outside Romanian territorial waters. One person was killed and three are missing. Drone debris also fell within 100 metres of a home near Chistelnica in Moldova’s Telenești district. Romanian President Nicușor Dan and Commission President von der Leyen directly blamed Russia. Black Sea strikes are escalating: two tankers were hit inside Romanian waters on 14–15 October, and civilian ships in Bulgaria’s EEZ on 12–13 October.

Tech

Brotli RCE (“http2shell”): Node.js, Python and .NET clients exposed

A memory-safety bug in Google’s reference Brotli decoder allows remote code execution in any application that decompresses untrusted Brotli HTTP responses. The decoder confuses “needs more data” with “format error” and keeps processing. Node.js auto-decompresses Brotli in fetch; Python is affected when brotli is installed alongside urllib3, requests, httpx or aiohttp; .NET’s BrotliStream binds to the same C library. Pure-Rust implementations appear unaffected. Python fix: upgrade brotli to 1.2.1.

HN

eMudhra follow-up: 156 Indian government sites still serve revoked certificates

Four days after eMudhra revoked the certificates issued under its single-byte private keys, 156 Indian government domains — including UIDAI’s LEA portal and India’s own PKI trust site — still serve them. Firefox blocks these sites; Chrome and Edge show nothing wrong, because CRLSet does not cover the revocations. The keys were generated in April 2025: 18 months of exposure before discovery.

Memory is slow, disk is fast: NVMe beats DRAM at 2 billion nodes

AVL tree in RAM vs DiskArray on NVMe. Chart: bitflux.ai

At 2 billion nodes, an AVL tree in 144 GiB of RAM manages 320K insertions/sec. A hybrid DiskArray using 264 MiB of RAM backed by eight NVMe drives does 670K/sec — 2.1× faster — and scales to 64 billion nodes, where the RAM structure runs out of memory. The point: Big O counts steps, not cost. Once the working set leaves L3, DRAM random-access latency dominates, and parallel NVMe I/O can deliver more aggregate bandwidth. The charts show exactly where the crossover happens.

Roc’s pure-FP deflate is within 2.6–8.9% of hand-tuned C

Richard Feldman’s roc-deflate runs only 2.6–8.9% slower than libdeflate, a SIMD-heavy C library among the fastest deflate implementations, despite Roc’s automatic reference counting and bounds checks. The write-up shows how the gap closed: bounds checks hoisted before loops, wrapping arithmetic, compile-time lookup tables, avoiding unnecessary sharing. The argument is not speed parity but what the ~5% buys: no side effects, no supply-chain risk via build scripts, deterministic cross-platform output.

Tov’s “faster than Rust” benchmarks were handicapped

Tov transpiles TypeScript to C and claimed benchmark wins over Rust. An independent analysis found each benchmark used deliberately slow Rust — HashMap instead of ahash, Box<dyn Trait> instead of enums. With idiomatic Rust the results invert. And since Tov compiles to C, and C and Rust perform comparably, it cannot systematically beat Rust anyway.

Two Zig deep dives: @xkcdRandom and traits via comptime

Zig’s @xkcdRandom builtin returns a consistent value (and panics if actually reached) in Debug and ReleaseSafe, and compiles away entirely in ReleaseFast and ReleaseSmall — a debugging assertion and a performance annotation in one construct. A second post, “We have traits at home”, encodes Rust-style trait polymorphism with comptime, comparing a fat-pointer approach with tagged unions and the trade-offs in dispatch, code size and ergonomics.

Undefined behaviour in C is not fine

A rebuttal to the “UB is just an optimisation hint” defence. The post works through cases where UB propagates through optimising compilers and produces wrong behaviour far from the original site — often silently, and in security-critical paths.

Corgi: a terminal multiplexer for human–agent collaboration

Corgi is a tmux-style multiplexer built for running AI agents alongside your own work. It shows what agents are doing in real time, lists every file an agent touched in one scrollable feed, works over SSH on slow links and supports image paste. Agents learn the setup via corgi --skill. It targets the gap between “agent running in the background” and “I have no idea what it did”.

Dessa: Block’s conversation model trained only on speech

Block released Dessa, a conversational model trained exclusively on speech — no text transcripts during training. It learns prosody, timing, tone and turn-taking from raw audio, dropping the text-as-ground-truth assumption common in voice AI.

Block · HN

Canada’s C-22 surveillance bill: EFF warns time is running out

Bill C-22 would require platforms and ISPs to conduct mass surveillance of user communications and share data with government agencies without judicial oversight, going beyond comparable EU legislation. EFF warns the window to oppose it is closing.

EFF · HN

Alzheimer’s sleep loss is driven by microglia, not plaques — and is reversible in mice

Overactive immune cells, not plaques, suppress deep sleep. Illustration: ScienceDaily

University of Kentucky researchers found that overactive microglia — brain immune cells responding to plaques — suppress NREM deep sleep in Alzheimer’s, not the plaques themselves. Removing ~87% of microglia in Alzheimer’s-model mice restored over two hours of daily sleep without reducing plaque load. Sleep disruption appears early, plateaus and is decoupled from plaque progression. Existing drugs such as metformin may offer a way to calm microglia. Human trials are pending.

Also today

cd ~/repos/josse-posten && claude --resume f59baa91-8833-46a2-b2d0-82e52d332185