Josse-posten

America votes on Trump’s second term with US strikes on Iran in the background, while Russia answers a collapsed truce by bombing an aid queue, and someone remotely turns up the heat in Europe’s supermarket freezers.

Komyshuvakha: Russia bombs an aid centre, then returns to bomb the shelter

A burning bus and a destroyed building after the Russian aerial attack on Komyshuvakha, Zaporizhzhia region, 2 November. Photo: BBC

Russian forces struck a school in Komyshuvakha, Zaporizhzhia Oblast, on 2 November while it served as a humanitarian aid distribution site. Ukrainska Pravda and ISW report 10 guided aerial bombs in the first wave. When civilians took cover underground, Russian aircraft came back and dropped nine more glide bombs on the shelter. At least 29 people are confirmed dead, including rescue workers and police officers who responded to the first strike, and 48 are still missing. Zelenskyy called the attack “vile” and “utterly horrific” and said it shows that Russia has no interest in de-escalation. The strike came days after the six-day Kherson-region ceasefire ended without an agreement. Ukraine says Russia used the pause to refortify. The same night, a mass drone attack hit a hospital in Kharkiv and Ukraine’s energy grid (see Ukraine).

US strikes Iran’s Qeshm Island as midterm votes are cast

The US military carried out what officials called “limited and defensive” strikes on Iran’s Qeshm Island in the Strait of Hormuz late Monday, hours before the polls opened. The Wall Street Journal, CBS and Reuters reported the strikes, and Iranian state media reported explosions on the island. According to NRK and Aftenposten, the strikes were a response to Iran firing at a US aircraft on Monday evening. Trump says the US “has won the war”, and Vice President Vance spoke optimistically about a diplomatic breakthrough. Oil fell more than 6% on hopes of a deal, rose on news of the strikes, and dropped back when an Iranian news agency reported an opening for talks with the US. Separately, several officials told the AP that Netanyahu is pressing Trump to escalate against Iran once the midterms are over.

Americans vote in midterms seen as a referendum on Trump’s second term

Both chambers of Congress are at stake. Democrats need five seats to flip the House and four to take the Senate. Polls give them a lead of up to 8 points, and some analysts predict a “blue tsunami”. More than 54.5 million people voted early, and spending is projected at a record of nearly $12 billion. Hours before the polls opened, the Supreme Court denied the Justice Department’s emergency request to make California set aside about 20,000 ballots the administration says came from non-citizens. That ends the administration’s most aggressive legal move before the election. Trump closed his campaign with a speech about granite and algae at a reflecting pool in Washington. Fear that he will dispute a defeat dominates the discussion.

Hackers raise supermarket freezers to 50°C across seven European countries

A supermarket employee throws away spoiled refrigerated food outside an ICA store in Stockholm, 2 November. Photo: BBC

Attackers got remote access to refrigeration control systems at hundreds of grocery stores in Belgium, Luxembourg, France, Sweden (ICA, Coop), Ireland and other countries. They raised freezer temperatures to 50–55°C and forced stores to throw away large amounts of food. This is the second attack of this kind in a few weeks; the first hit French supermarkets. No group has claimed responsibility. The EU food commissioner called it “a deliberate attempt to disrupt our food supply”. No Norwegian stores were affected, but MDG wants the government to require stronger digital security for grocery chains. On r/norge, the main question was why freezer controls are connected to the internet at all. The same week, the UK’s NCSC assessed that AI-powered malware is “highly likely” to attack UK power stations, airports and hospitals by 2028. In Norway, a targeted attack against UiT is in progress (see Norway).

Ukraine–Russia talks set for Abu Dhabi, as Europe’s peacekeepers get permission to fire back

US envoy Steve Witkoff announced working-level Ukraine–Russia negotiations in Abu Dhabi on 10–11 November. They will cover security arrangements, de-escalation and humanitarian steps. US negotiators will meet European and NATO allies in Brussels at the same time. The Financial Times reports that the US, Russia and China are discussing a Trump–Putin–Xi meeting. UK and French officials confirmed that the planned Anglo-French stabilisation force in Ukraine would be allowed to return fire if attacked. It is designed without US systems, including Starlink. An 11-nation exercise, “Koalicja” (2,800 troops), will rehearse a rapid deployment to Ukraine from Poland this month. On the NATO perimeter, an unidentified drone crashed in Latvia near the Russian border, and Poland launched a border operation along Kaliningrad after intelligence warnings of Russian sabotage.

Indicator Value Change
S&P 500 (f) 7,557.5 -0.22%
Dow 30 (f) 51,781 -0.68%
Nasdaq (f) 28,135.5 +0.03%
Russell 2000 (f) 2,811.6 -0.22%
VIX 21.87 +3.41%
Gold 3,907 -1.58%
BTC $76,538 -1.82%
EUR/USD 1.1190 -0.01%
USD/NOK 9.2505 -0.61%
  • Oil fell more than 6% on ceasefire hopes, then recovered after the US strikes on Qeshm (see above)
  • Futures slightly lower and VIX up on election day; the krone is at its strongest since 2022 (see Norway)

World

Israel: Eisenkot closes in on the premiership with Arab backing

Former IDF chief Eisenkot appears set to receive 67 recommendations as Arab Knesset lists move to support him. This is a possible way out of the deadlock that has paralysed Israeli politics since the election. If confirmed, it would be a historic realignment: Arab parties would act as kingmakers for a centre-left government, and Netanyahu’s way back to power would become much narrower. Meanwhile, Netanyahu is lobbying Trump to escalate against Iran after the midterms (see the front page).

Russia withdraws from the UN Convention Against Torture

Russia has formally withdrawn from the UN Convention Against Torture while human rights bodies continue to document widespread torture of Ukrainian prisoners of war and civilians. The withdrawal removes a formal accountability mechanism, although Russia has long ignored the convention’s oversight bodies in practice. Separately, the Trump administration lifted the last US sanctions on Boeing parts for Belarus. Critics see this as another small concession to Minsk, and through Minsk to Moscow.

“A serious failure”: prosecutor cites an AI-invented case in a child rape hearing

A senior Crown Prosecution Service lawyer in a high court child rape case cited a precedent that does not exist. An AI research tool had generated it. The CPS calls the error “a serious failure”. It is one of dozens of documented AI hallucinations in UK court proceedings, and there are new calls for formal guidance on how legal professionals can use AI. In Australia, Reddit and the Digital Freedom Project argued before the High Court that the world’s first under-16 social media ban is unconstitutional. They say it breaks the implied freedom of political communication and is “ill-thought-out” and “over-broad”.

New York child dies of measles, the state’s first measles death in 30 years

A child in rural northern New York has died of measles. The governor called it a “devastating reminder of what’s at stake” when vaccine protection weakens. The death follows a national decline in childhood vaccination rates, and the administration’s health messaging has become more and more hostile to vaccine mandates.

US under bipartisan pressure to halt Afghan deportations

At least 150 Afghans face deportation to Pakistan and then on to Afghanistan. Lawmakers from both parties are asking the administration to stop the removals. Advocates warn that deportees, especially people who worked with US forces or NGOs, will face “certain death” under the Taliban.

Also today

Middle East & Asia
Israeli soldiers blindfolded and arrested Al Jazeera correspondent Montaser Nassar in a raid on his home near Hebron, then released him hours later — Al Jazeera · Al Jazeera: video
Asian Cup 2027 in Saudi Arabia moved from January to December because of continuing Houthi attacks — BBC · Al Jazeera
Assam bulldozes hundreds of homes in Muslim-minority Dhubri district, and thousands are displaced — Al Jazeera
Indian Navy frees a hijacked fishing vessel off Somalia and rescues all 20 crew — The Hindu
Two helicopters collide near Everest base camp; one Indian tourist killed — Al Jazeera
Europe
France: high-school blockades resume, with a nationwide teachers’ strike called for Thursday — The Guardian
UK doubles the wait for permanent residency to 10 years, with exemptions for care workers — Al Jazeera
Economy & Science
Reserve Bank of Australia hikes for the fifth time this year, to 4.85%, the highest since 2008: “pain now” — The Guardian
Traces of heme and possible fossilised red blood cells found in the bone of a 115-million-year-old dinosaur — The Guardian

Ukraine

Russia bets on civilian suffering as the ground campaign stalls

Overnight on 2–3 November, Russia launched 364 drones (178 of them jet-powered) and 10 loitering munitions. They hit a hospital in Kharkiv (73 injured, 226 patients evacuated) and a substation in Rivne near a nuclear plant, and caused emergency power cuts in Kyiv and Dnipropetrovsk Oblast. An attack on energy facilities in the east left 180,000 households without power. In October, Russia fired 6,473 Shaheds. Ukraine shot down 75% of them, up from 50–60% in the summer. ISW assesses that Putin has changed his theory of victory: after about 100,000 losses in September–October and no territorial gains, he is turning to coercive strikes on civilians. Russia is also expanding its arsenal. The Gerbera decoy has become the Gerbera-2 strike drone (1,200 km range, 25 kg warhead), and jet-powered BM-35 and BM-70 variants are now confirmed in combat.

Yaroslavl refinery burns, and the fuel crisis reaches Russia’s Su-57s

Fire at the Slavneft-YANOS refinery in Yaroslavl after a Ukrainian drone attack, 3 November. Photo: Militarnyi

Ukrainian drones struck the Yaroslavl refinery overnight. It is Russia’s fifth-largest (15 million tonnes a year), and this was its third hit since August. Several fires started at the same time across the complex. The 1 November strike on the Samara linear production-dispatch station, described as Europe’s largest oil tank farm, is also confirmed. The fuel shortage now visibly affects military aviation. According to Ukraine’s GUR, a Su-57 exploded during engine start at Akhtubinsk on 29 October, partly because of low-grade fuel. Russia has started to import JET-A1 from Malaysia to keep its aircraft and jet-powered drones flying. Zelenskyy has said Ukraine would stop the refinery strikes in exchange for air interceptors now. But the 500 Patriot missiles approved last week will be delivered over three years, starting in 2030.

Kherson ceasefire collapses; “Pressure Putin, not me”

Fighting has started again in the Kherson region after the six-day humanitarian ceasefire, the longest pause of the war, ended without a lasting agreement. Ukraine accuses Russia of using the truce to strengthen positions, improve defences and build up logistics. Zelenskyy told Trump: “Pressure Putin, not me.”

Norway

Pågående dataangrep mot UiT — NSM på nest høyeste risikonivå

Et målrettet cyberangrep fra en ressurssterk aktør pågår mot Universitetet i Tromsø. Universitetet er i beredskap og ber studenter og ansatte om å være varsomme. NSM har allerede hevet det nasjonale cyberrisikonivået til nest høyeste trinn, og KS advarer om at svært mange kommuner mangler kapasitet og spesialistkompetanse til å håndtere trusselbildet alene. Digi.no melder samtidig om hacking mot både russiske og ukrainske kriseapper. (Se også fryserangrepet på forsiden.)

Sjefene for Telia og Telenor Norge advarer om at Norge er i ferd med å gjøre seg farlig avhengig av SpaceX/Starlink for kritisk infrastruktur — uten et raskt og pålitelig alternativ. «Hvis du først blir avhengig av Starlink, klarer du ikke å komme deg ut», sier de til E24. Finske Iceye mener Norden kan bygge et eget satellittforsvar basert på Andøya Spaceport, Kongsberg Satellite Services og Iceye. Musk hevder Ukraina-fronten ville kollapset uten Starlink; forsvarsforsker Tor Bukkvoll bestrider det.

Helsereformutvalg: Fjern helseregionene — staten overtar sykehusene

Et offentlig utvalg foreslår den største omleggingen av norsk helsevesen på 25 år: de fire regionale helseforetakene avvikles, og staten tar direkte ansvar for sykehusene. Kommunene skal ta større ansvar for nærhelsetjenester, men mange er for små til å klare det alene. Senterpartiet er skuffet over at utvalget ikke er tydeligere, Rødt kan ikke støtte forslaget, og tillitsvalgte frykter mer press på en hardt belastet sektor. Helseminister Jan Christian Vestre sier det er «et stort stykke arbeid foran oss». Samtidig advarer kirurg og overlege Kristina Stølen Ugelvik om at sykehusene ikke har noen mulighet til å ta imot de 7 000 skadde soldatene regjeringen har bedt dem forberede seg på.

Fagforbundet varsler politisk streik for Posten 16. november

Politisk streik for Posten er varslet 16. november. Foto: NRK

Fagforbundet tar for første gang initiativ til en landsomfattende politisk streik: tre timer 16. november, foran Stortinget og i flere byer. Bakgrunnen er regjeringens forslag til statsbudsjett for 2027, som ifølge forbundet kan føre til at 2 000 av 3 000 postansatte mister jobben allerede fra 1. juli neste år. Parolen er «Leve Posten!».

Datasenter-moratorium nærmer seg: 70 % av Statnetts kraftetterspørsel, 94 % utenlandsk eid

Debatten om å fryse ny datasentervekst har tilspisset seg. Datasentre står nå for 70 % av årets nye kraftetterspørsel hos Statnett, og en Menon-rapport viser at 94 % av verdiskapingen fra datasentre i Norge tilfaller utenlandske eiere. SV vil kopiere kjøpesenterstoppen fra 1999 med et femårig moratorium; Rødt vil bruke energiloven til strakstiltak. Flertallet mangler fortsatt, men støtten vokser. Bransjen advarer om at en frys vil ramme de norskeide aktørene hardest. Samtidig mener OpenAI-sjef Sam Altman at det er «forferdelig» at RAM brukes i private PC-er — minnet hører hjemme i datasentre.

Russisk gigant saksøker Norge om fiskerettigheter

Det russiske fiskerikonsernet Norebo møter staten i tingretten om retten til å fiske i Norges økonomiske sone. Norge strammet inn tilgangen for russiske fartøy etter invasjonen av Ukraina, og Norebo hevder Norge diskriminerer selskapet ulovlig. Saken kan bli en presedens for hvordan Norge håndterer russiske næringsinteresser i norsk sone.

NRK

Varmeste oktober siden 2000 — og 40 grader er ikke lenger utenkelig

Isbreer i Geirangerfjord-området. 46 av 48 breer i de to verdensarvområdene er døende. Foto: NRK

Oktober 2026 endte 2,7 grader over normalen for dagens klima, den varmeste oktober siden 2000, med over 60 temperaturrekorder. En ny studie fra Meteorologisk institutt i Finland (npj Natural Hazards, åpen tilgang) analyserte 7 308 simulerte somre og fant 0,53 % årlig sannsynlighet for 40 °C et sted i Norge, Sverige eller Finland — en seksdobling siden 1981. Norge har høyest sannsynlighet i Norden for å slå sin nasjonale varmerekord. Mekanismen er sterk omega-blokkering kombinert med uvanlig tørr jord, og forfatterne påpeker at Norden er langt dårligere tilpasset ekstrem varme enn kontinentet. I Geirangerfjorden og Nærøyfjorden er 46 av 48 breer døende, og glasiologer kaller situasjonen «ganske alarmerande».

Innovasjon Norge på Times Square: «Welcome to a sh**house country»

Innovasjon Norges reklame på Times Square. Foto: NRK

Innovasjon Norge har kjøpt reklameplass på Times Square og snur Trumps eget «shithole country»-vokabular mot ham. «Welcome to a sh**house country» lyser fra storskjermene midt i Trumps hjemby — en invitasjon til talenter og investorer om å velge Norge.

NRK

Norway — Street Level

Frikanalen i svart etter strid om russiskvennlig innhold

Allmennkanalen Frikanalen gikk av lufta mandag kveld etter at to fraksjoner har strides om kontrollen over organisasjonen. Konflikten handler om professor Glenn Diesen, som fyller omtrent en firedel av sendetiden med programmer som «Massivt angrep på Moskva. EU forbereder krig», ofte sammen med Kreml-vennlige stemmer som Alex Christoforou fra The Duran. Den ene fraksjonen forsøkte å fjerne ham gjennom et ekstraordinært styremøte; den andre kaller det et ulovlig «kuppforsøk». Frikanalen distribueres automatisk til alle norske kabelabonnenter.

Ambulansetjenesten preget av trakassering — vikar bedt om å gjøre livredning på gammelt lik

En NRK XL-kartlegging blant 818 ansatte viser at 38 % av ambulansearbeiderne har opplevd trakassering det siste året; i ett av åtte tilfeller kom det fra en leder eller kollega. I det groveste tilfellet ble en ung vikar beordret av sin overordnede til å gjøre hjerte-lunge-redning på en person som hadde vært død i flere dager — «for å øve på et menneske». Lederen ble internt frikjent etter at en kollega varslet. Forbundslederen kaller funnene «skremmende»: mønsteret var tidligere dokumentert i Finnmark, men er nå nasjonalt.

Grassroots

  • NRK kartla 58 mindreårige i ungdomsfengsel over to år: to av tre født i Norge, rundt 80 % hadde langvarig barnevernskontakt, og halvparten havner i fengsel igjen innen fem år. På r/norge handlet debatten mest om demografien, mindre om hovedfunnet: at systemet griper inn for sent — NRK · r/norge
  • «Har det rablet for Harald Eia?» Økende kritikk på r/norge av hans nedlatende omtale av ME/CFS-pasienter i podkaster, blant annet hos Wolfgang Wee — r/norge

Også i dag

Politikk og økonomi
Høyre får 13,1 % på TV 2-gallup — laveste siden juli 2009 — Aftenposten
Kronen er den sterkeste siden 2022 — E24
Enova gir 3,9 mrd. til to flytende havvindanlegg, men Statnett mener norsk havvind trolig aldri lønner seg uten støtte — TU: Enova · TU: Statnett
E24: analytikere advarer om oljesjokk etter mellomvalget — E24
Teknologi og KI
Google lanserer verdensmodellen Genie 4, «et stort skritt mot AGI», mens teknologiaksjer faller i Asia — Digi.no · DN
«Skynet agent»: angrepsmetode som kaprer KI-modeller og utfører opptil 100 000 steg uten mennesker — Digi.no: Skynet · Digi.no: IBM-studie
Binance-kunder har tatt ut 3,64 mrd. dollar etter tyveriet; Nord-Korea avviser FBIs anklager — E24 · Aftenposten
Helse og sport
FDA godkjenner billig generisk HIV-forebyggende medisin — kan stoppe epidemien — Aftenposten
Brann seriemester i Toppserien etter 4–1 over LSK — NRK
Kimi Antonelli (20) blir historiens yngste F1-verdensmester — NRK

Tech

Weight-space programming: frontier LLMs can read and rewrite neural network weights directly

A research post by Rikiya Takehi shows that GPT-6 “Astra” can analyse another neural network’s weights and edit them directly from a natural-language intent, without gradient descent or a training loop. Editing just 0.016% of Qwen3.5-0.8B’s weights raised its MATH-500 score from 7.9% to 48.1%. The model can also tell from the weights alone what a network has learned (which game it plays, which language it speaks), and it can write weights from scratch for simple tasks. The capability appears to be emergent, not explicitly trained. If the results hold up, weight space becomes a medium that LLMs understand natively.

Ubuntu LTS kernels still unpatched for critical RCE after three weeks

CVE-2026-98432, the CVSS 9.8 remote code execution flaw in the Linux MPTCP stack reported on Saturday, is still unpatched in all three Ubuntu LTS releases (22.04, 24.04, 26.04), almost three weeks after disclosure. Canonical has not published a fixed kernel package for any of them and has not given an ETA. Internet-facing and multi-tenant self-hosted systems are the most exposed.

Jailbreaking my car’s navigation system just so I can change the time

The Renault head unit, showing “No maps found!” in Estonian. Photo: Rasmus Moorats

A firmware update removed the clock setting from Rasmus Moorats’s Renault infotainment system, so he jailbroke it. The exploit uses a path traversal in the LOG command of a scripting interface to write |/bin/sh /media/sdcard/payload.sh to /proc/sys/kernel/core_pattern. It then deliberately crashes dbus-monitor, and the coredump handler runs the payload as root. The SD card is mounted noexec, so calling the payload through /bin/sh on the rootfs gets around that. Now he can change the time.

OpenAI builds Pando, a horizontally scalable Git backend for Codex’s agent load

Codex multiplied concurrent pushes, branches and CI fetches beyond what standard Git hosting could handle, so OpenAI built Pando. It is a server-side Git backend that stays fully protocol-compatible but updates branch refs independently and in parallel. It also reuses packfiles across readers instead of generating a pack for each client. Median push latency dropped almost 5×, and Pando now serves close to a petabyte of Git data per day. Anthropic’s Scion replaced Git altogether; Pando keeps engineers and agents on unmodified Git clients, and OpenAI is contributing improvements back to upstream Git.

OpenAI · HN

Egoless mathematics in the AI era, now co-written with AI

Yesterday’s issue covered a manifesto on Tao’s blog. This is a follow-up there by Karthik C. S., Amit Sahai and Jie Xue. They argue that AI only seems threatening because academic mathematics rewards personal credit. If mathematics is about getting to the truth rather than claiming it, AI authorship takes nothing away. The essay was drafted with GPT Astra 6.0 and 6.1 Sol. Depending on their priors, commenters found that either validating or grimly ironic.

Why PostHog is moving its warehouse off DuckDB

At about 2 petabytes and 1 trillion rows, PostHog reached the limits of a single-node engine. In the cloud, the machine has to be sized before the query arrives. The DuckLake catalog made things worse: a single-table write could take more than three minutes because it re-read statistics for the whole catalog, and 99% of those rows belonged to deleted tables. The replacement is Trino on top of HogLake, a custom open table format designed for distributed scale. It is a candid post-mortem from a production system.

The lost malloc()

In Unix V4–V10, malloc took an explicit region: malloc(coremap, size). With separate pools for different lifetimes, you could free a whole region at once, and heap corruption was harder. The design predates arenas and region-based memory management as named concepts. As programs needed objects with arbitrary shared lifetimes, the simpler but more dangerous flat heap won. The post also traces how early Unix code used a #define new(t) macro long before C++ made new part of the language.

Altermagnetism: first direct proof of a third magnetic phase

Ferromagnetism, antiferromagnetism and altermagnetism, shown with mirrors. Image: SLAC

Until now, magnetism came in two known types: ferromagnetism, where all spins align, and antiferromagnetism, where alternating spins cancel out. Working at the European Synchrotron Radiation Facility, SLAC researchers used polarised X-rays to detect chirality in manganese telluride. That geometric asymmetry should not exist in an antiferromagnet, and it is the defining signature of altermagnetism. Altermagnets have zero net magnetisation like antiferromagnets but carry spin-polarised currents like ferromagnets. This makes them candidates for faster, more energy-efficient spintronic memory.

SLAC · HN

Also today

  • Side channels: WiFi Channel State Information can passively recognise keystrokes in the same room, and background hum in audio (grid frequency and phase drift) can reveal where a recording was made — IEEE · Lobsters: WiFi · YouTube · Lobsters: audio
  • The advantages of mobile Linux over AOSP: AOSP has 309M lines that a community fork cannot maintain, and Phosh has about 453K lines because it reuses GNOME and Wayland — amosbbatto · Lobsters
  • Firefox Q3: containers are now built in, Web Audio fingerprinting protection is stronger, extensions need permission to read local files, and iOS gets an ad blocker — attackanddefense.dev · Lobsters

Linux & Infrastructure

Hyprland 0.57: wobbly windows arrive, and .conf configs are gone

The new “drops” animated blur. Image: Hyprland

Hyprland 0.57 ships the most-requested visual feature: Compiz-style wobbly windows. It also adds two animated blur variants, “jar” (liquid edge distortion) and “drops”, which users report spins up fans even on water-cooled PCs. Screen sharing can now use a single workspace as a source. Other additions are cursor:warp_on_monitor_change, the no_glow and no_wobble window rules, a global tablet disable, and new Lua APIs (hl.reload_config(), hl.get_devices(), config unload events). Breaking change: .conf files are no longer supported, so you must migrate to Lua before you upgrade. Users who update without migrating report workspaces renamed to “active” and broken bindings.

The plugin ecosystem has already caught up. Hyprstretch (0.57+) stretches a window across all monitors or a chosen subset. hypr-window-rotate rotates single windows in 90° steps and remaps pointer input correctly. Hypr Screen turns an Android phone into a real second display with its own workspaces and Waybar: 60 fps H.264 over USB, multitouch, and a 76 KB APK.

PSA: the CachyOS kernel binary cache was compromised

The attic.xuyh0120.win cache used by the nix-cachyos-kernel flake was compromised, and the signing key may have been stolen. A NixOS config that trusts this substituter keeps trusting the old key until you rebuild. The cache has been rebuilt with a new signing key. If your config references it, pull and rebuild.

claude-cage: a flake that sandboxes Claude Code to the project directory

claude-cage wraps Claude Code in bubblewrap. Only the project root (read-write), /nix/store and a minimal set of system paths are visible, so host SSH keys, tokens and other projects stay hidden. Host environment variables are cleared. With the provided .envrc, direnv makes claude run sandboxed in that directory. Network access stays on. The motivation: Claude’s built-in sandbox confines only the Bash tool, not file reads.

Hashsync: 13× less bandwidth when copying Nix closures

Hashsync deduplicates SSH transfers against content blocks anywhere in the destination Nix store, including store paths that were renamed or rebuilt, which rsync cannot match. After a mass glibc rebuild, a copy that would have sent 37 GB via nix copy sent 2.8 GB. In another benchmark, a 19-minute sync dropped to 4 minutes. Hashsync works as a transparent pipe over SSH and indexes immutable store paths only once.

nixpkgs PR proposes banning LLM-generated prose

PR #581542 would add a rule to the nixpkgs CONTRIBUTING file against LLM-generated text in PR descriptions, commit messages and comments. The reasons given are verbosity without substance and failure to explain why a change is needed. Some exceptions are proposed for useful or harmless output. Feedback is being collected on the PR itself.

Unplugging the thermostat cloud: unfr0zen for Nest, freedo for Tado

Two projects arrived just in time for heating season. unfr0zen patches 2nd- and 3rd-gen Nest Learning Thermostats over USB so they run fully locally. You can choose MQTT with Home Assistant autodiscovery, Matter over Wi-Fi, or Zigbee through the thermostat’s built-in 802.15.4 radio. The original firmware is backed up first. freedo replaces the Tado internet bridge with an ESP32 and a CC1101 radio that speaks Tado’s 868 MHz protocol. A Go daemon exposes climate entities to Home Assistant, which also avoids Tado’s free-tier cap of 100 API requests a day.

Also today

NixOS
AirlockOS: Qubes-style Xen VM isolation with NixOS for dom0 and every guest, and a shared Nix store with read-only views for each VM. Still early — GitHub · r/NixOS
“Why did you choose the nix you nix?” Thread consensus: CppNix is the safe default, Lix is community-first with minor divergence, Determinate only makes sense with a support contract, and Snix/Tvix are not daily-usable yet — Lobsters
Home Assistant
Vedetta: local LAN device fingerprinting that shows the clues and weights behind each identification — GitHub · r/homeassistant
steer-tts-nano: 2.97 MB int8 neural TTS on an ESP32-S3 without PSRAM, using 122 KB RAM with 0.35 s to first audio — Hugging Face · r/homeassistant
E-paper air quality tile: ESP32-C3 with SCD30, SHT41, SGP41 and VEML7700, a thermally isolated sensor chamber, and refreshes only when values cross a threshold — r/homeassistant
glass-floorplan-card: a frosted-glass HA floorplan where lights glow in their real colours, with a visual editor. Mostly AI-written code — GitHub · r/homeassistant
Self-hosting
Pocket ID v3, the passkey-first OIDC provider, gets a rewritten UI with a sidebar, command palette and audit log — GitHub · r/selfhosted
cd ~/repos/josse-posten && claude --resume 0b241146-38c6-4f62-aff7-5d5366eac9cb