Iran’s mixed signals: Vance’s letter welcomed, Khamenei threatens a “maximum” response

US Vice President JD Vance sent a letter to Iran’s national security chief, and an Iranian official called it a sign of a “positive shift”. Both foreign ministers said a diplomatic end to the US-Iran conflict is still possible. At the same time, Khamenei ordered a “maximum” response to any US attack and said retaliation would have “no geographic limits”. The statement is most likely meant for deterrence and for a domestic audience, and it does not close the door on talks.

US midterms: 50 million early votes, Epstein ads in swing races, and ballots isolated in Alaska

With three days until polling day, more than 50 million people have voted early, a record pace. Democrats lead Republicans in the states that report by party. Democratic groups are running Epstein-related ads in dozens of swing races and accuse Republicans of blocking the release of the files. A few of the ads target Democrats. In Alaska, the Justice Department wants to isolate ballots during a criminal probe into claims that Democrats recruited a spoiler candidate for a toss-up Senate race. The Senate races in Texas and Michigan are still very close.

FBI blames North Korea for the record $6.3bn Binance heist

The FBI has attributed the largest cryptocurrency theft on record to TraderTraitor, a North Korean state-sponsored group. The attackers used compromised employee credentials to drain $6.3bn from Binance. Binance says it has covered 90 percent of the losses from its reserves, and withdrawals are starting again. The theft is far larger than any earlier North Korean crypto operation. It shows how Pyongyang uses cybercrime to pay for its weapons programmes.

Poland: Tusk says “no compromise is possible” on the constitutional court

Poland’s constitutional crisis hardened over the weekend. Prime Minister Donald Tusk said there can be “no compromise” on his government’s overhaul of the constitutional tribunal, which he says was captured under PiS rule. The president is holding crisis talks and refuses to back down. Many Poles are protesting the heavy-handed way the court building was taken back last week.

Thousands in Tel Aviv rally for a Jewish-Arab coalition to remove Netanyahu

Large crowds gathered at Habima Square in Tel Aviv. They called on former military chief Gadi Eisenkot to lead a Jewish-Arab governing coalition, as a way to unseat Prime Minister Netanyahu after the recent election. Netanyahu supporters held a counter-protest and called the idea a coalition with “terrorists”.

Serbia marks two years since Novi Sad — in a changed country

Two years ago, the canopy at Novi Sad railway station collapsed and killed 15 people. It started Serbia’s protest movement. The anniversary comes one week after Aleksandar Vučić lost the election, a defeat the BBC calls a carbon copy of Viktor Orbán’s fall in Hungary. Novi Sad helped bring an authoritarian chapter to an end.

India: opposition rallies in Delhi against a voter roll purge

Congress and its opposition allies held a large rally in New Delhi to demand the resignation of the chief election commissioner. The cause is a revision of the voter rolls that could disenfranchise up to 130 million people. The opposition says the revision is designed to remove voters from constituencies that do not favour the BJP. Riot vehicles and security personnel with batons surrounded the protest site before the march.

Mossad veteran named as the organiser of Flávio Bolsonaro’s escape

A former Mossad agent has been identified as the person who organised Flávio Bolsonaro’s escape from Brazil through Argentina, while Jair Bolsonaro faces criminal proceedings in Brasília. Rubio denied that the US government was involved. Trump said Bolsonaro can stay in the US “as long as he wants”. The incident already involves Brazil, the US and Argentina.

“Overdependent on the US”: Carney and Starmer on a lasting break

Canadian Prime Minister Mark Carney said Canada has “learned we are overdependent on the US”. He is pushing a “middle power” strategy built on new multilateral trade deals. Former UK Prime Minister Keir Starmer said Britain and Europe must move closer together because the US has become an unreliable partner, and that this will not simply reset when Trump leaves office.

UN human rights worker dies after two years in Houthi detention

Mohammad el-Shami, a UN Human Rights staff member, has died in Houthi custody after more than two years of arbitrary detention. He was one of dozens of UN and NGO workers who were seized in mid-2024 and accused of espionage. The UN demands an independent investigation and the immediate release of all remaining detainees.

Russia fires 433 drones at Ukraine’s energy grid as winter approaches

Russia launched 433 drones overnight into November 1, 47 of them jet-powered. They hit a combined heat and power plant in Shostka, substations in Dnipropetrovsk Oblast (about 200,000 households lost power), energy infrastructure in Kyiv Oblast and railway infrastructure in Kharkiv and Dnipro. More than 650 settlements in Zhytomyr Oblast also lost electricity. Air defence shot down or jammed 371 drones. The previous night, Russia launched 302. The pace before winter matches Russia’s theory that sustained attacks on infrastructure can force Ukraine to capitulate.

Kaliningrad goes dark

A major power plant failure in Kaliningrad, Russia’s Baltic exclave between Poland and Lithuania, caused a widespread blackout across the region.

A record month for Russian losses — and men taken off the streets

Russia lost 54,400 soldiers in October, a new monthly record according to independent estimates. Ukraine’s Unmanned Systems Forces alone hit a target every 41 seconds: 64,807 targets and 16,796 Russian personnel losses in the month. The General Staff reported 2,100 Russians killed and wounded on November 1. ISW estimates 698,000 Russian casualties since March 2025, for a gain of just over 4,000 km².

To replace the losses, Russia has moved from occasional street conscription to a systematic practice. In several cities, men are stopped at metro stations, at markets and in other public places and handed military summons on the spot.

Do the math: taking over ChatGPT accounts through a chained cross-frame exploit

Parameter Security chained several issues into a full account takeover. A malicious public conversation contained a graph, which loads MathLive, and an HTML Preview panel. MathLive accepted cross-frame messages without checking their origin and rendered attacker-controlled HTML. The result was an unsandboxed iframe with ChatGPT’s session identity. A YouTube JSONP endpoint got around the Content Security Policy, so the injected JavaScript could list and exfiltrate private conversations. The vulnerability is now patched.

Do AT Protocol users know this is public?

Melaniekat looked through public AT Protocol data and found private RSS subscription URLs: a Club MacStories paid feed, full-text 404 Media subscriber feeds, Patreon backer-only feeds and private GitLab repository feeds. All of them could be read without authentication, just by walking the public PDS. The architecture publishes all app data to a personal data server that anyone can mirror. Apps built on the protocol inherit this by default, and most users do not know.

Reports: Anthropic restricts Claude users whose questions touch model training

Several users report that their accounts were restricted after they asked Claude about training or building larger AI models. One of them is a researcher in Hong Kong who was doing legitimate research. The HN thread is mostly critical and calls the policy anti-competitive and harmful to Claude’s usefulness for AI research. Anthropic has not commented publicly.

Five small Qwen3 models beat Fable 5 on hard coding problems

Memdoor shows a multi-agent workflow in which five Qwen3 models of 8B to 27B parameters work together on coding problems. Together they beat the much larger Fable 5 on LiveCodeBench Hard. The interesting claim is not the benchmark number. It is that orchestration can replace raw parameter count.

The AI cost of JavaScript frameworks

Nolan Lawson used AI agents to build the same Pokémon app with different JavaScript frameworks. The cost per run went from $2.67 with Hono and htmx to $4.97 with Angular, almost twice as much. The difference comes from framework complexity, the amount of boilerplate and how much context the agent must keep. Simpler frameworks also produced less code to maintain. LLM runs are noisy, but the pattern was consistent enough to matter for teams that run agents at scale.

It’s the memory, stupid: two posts on where performance really goes

The Futhark team got up to 36× faster GPU copies with only a reordering. Before a copy, they sort the array dimensions by stride, so that adjacent threads read adjacent memory and uncoalesced accesses become fully coalesced. There is no extra computation, and the compiler now does this automatically.

Pivotlake makes the same point for CPUs. A modern CPU can execute 400–800 instructions while it waits for one cache line from RAM. When they restructured GROUP BY with radix partitioning so that the working data fits in L2/L3, memory stalls fell from 50 percent to 23.5 percent, although the code does more operations in total. Extra CPU work that avoids DRAM is almost always worth it.

Hardware performance counters are not deterministic — not even retired instructions

Researchers at the University of Maine show that real PMU implementations often give different counts for identical runs. Events that should be exact, such as “retired instructions”, overcount on several architectures. This breaks a basic assumption of profiling: that hardware counters are ground truth. The paper covers x86, ARM and RISC-V and describes what deterministic counters would actually require.

Kwi: KDE’s new GPU-accelerated terminal, 3–35× faster than Konsole

KDE introduces Kwi, a terminal emulator built on libghostty-vt and Qt Quick with Vulkan or OpenGL rendering. This is the same GPU path that made Ghostty fast. Benchmarks show it is 3–35× faster than Konsole, which draws on the CPU through QWidget. Kwi supports the Kitty image protocol, has better screen reader access and exports a public QML module, so other KDE apps can embed a terminal. It is an early release, but the architecture is solid. The name comes from the Korean word for ghost.

BeOS now runs in the browser

Infinite Mac now runs several BeOS versions with the DingusPPC PowerMac emulator. This needed significant fixes to ADB emulation and video memory handling. It also does nested emulation: System 7.6.1 in SheepShaver on BeOS R5, in the browser. BeOS shipped a fully preemptive, pervasively multithreaded system in 1995, years before macOS or Windows.

Zinc creep brought down Arecibo, and it gave no visible warning

A National Academies report concludes that the 2020 collapse of the Arecibo telescope was caused by zinc creep in the cable spelter sockets. The zinc alloy that held the ends of the main support cables slowly deformed under constant load until the cables pulled free. It is the first documented case of long-term zinc creep failure in this type of installation. The failure gives no visible warning signs and was not part of the inspection programme, so nobody could see that the telescope was doomed.