Composed by AI from public sources — it may be incomplete or wrong; verify before relying on it.
The Double Standard of Data: Swartz Prosecuted, Meta Unscathed
Scraping's legality hinges on power, not principle, while AI's raw outputs and hidden trackers reshape our digital trust.
- In 2011, Aaron Swartz, RSS co-creator, was federally prosecuted for downloading ~70 GB of JSTOR articles via MIT’s network while evading access blocks; he died by suicide before trial.
- An essay, “Don’t paste the AI, please,” argues against forwarding raw chatbot answers in DMs, Slack, or code review; it says use AI for drafting but rewrite, condense to three sentences, or say “no strong opinion.”
- AliExpress homepage runs hidden WebAudio fingerprinting via two obfuscated scripts (collina.js, fireyejs.js), generating a sawtooth wave and connecting it to the audio destination at zero gain.
- A solo developer trained a 125M-parameter transformer to autocomplete piano MIDI in real time: ~108 notes/sec on an iPhone 15, via a free iOS app called RollTab.
- On Aug 20, 2026, a compromised maintainer account published `arrayref` 0.3.10, which added the typosquatted `proc-macro1` dependency; its build script downloads and runs a remote binary at compile time.
- GitHub’s August 17 outage lasted 7 hours 47 minutes, disrupting authentication, Actions, APIs, pull requests, issues, and Copilot.
- A Zhejiang University study in NeuroImage (Jan 2026) scanned 56 young adults and found watching liked short videos to completion significantly deactivated two cognitive-control regions: the dACC and dlPFC.
- Huzzah is an experimental editor where you write persistent, declarative pseudocode in `.hz` files; saving one triggers an LLM to regenerate the actual code, using the diff as the prompt.
In this issue
- Aaron Swartz was prosecuted for scraping, while Meta does it without consequence
- Don't paste the AI, please
- AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
- I trained a 125M model to autocomplete piano on-device
- Malicious Rust crate Arrayref runs a build-time payload
- The August 17 outage
- Watching TikTok and Instagram deactivates the cognitive control network: Study
- Huzzah – a novel approach to coding with AI
1. Aaron Swartz was prosecuted for scraping, while Meta does it without consequence
Source ↗· AI-selected
- In 2011, Aaron Swartz, RSS co-creator, was federally prosecuted for downloading ~70 GB of JSTOR articles via MIT’s network while evading access blocks; he died by suicide before trial.
- Meta is accused of torrenting ~80 TB of books to train AI models, but faces civil litigation and likely only a financial penalty.
- The asymmetry: an individual drew a threatened 35-year criminal case, while a tech giant’s industrial-scale data intake is treated as a commercial dispute.
The scale gap (70 GB vs 80 TB) matters less than who enforces and why. The U.S. government pursued Swartz even though JSTOR did not seek civil damages, while Meta’s conduct touches AI competitiveness, making prosecutors cautious. This reveals a legal system that can criminalize personal knowledge access yet leave corporate training-data extraction to fines. The test is whether Meta’s case sets a real cost for mass ingestion or confirms that scale buys legal insulation.
2. Don't paste the AI, please
Source ↗· AI-selected
- An essay, “Don’t paste the AI, please,” argues against forwarding raw chatbot answers in DMs, Slack, or code review; it says use AI for drafting but rewrite, condense to three sentences, or say “no strong opinion.”
- Since recipients have the same tools, a generic AI wall of text adds little; the scarce asset is the sender’s judgment, context, and taste.
- The reception is split: some see AI-pasted context as useful state transfer that cuts back-and-forth, while others see it as burden-shifting and note it ignores lazy questions and language barriers.
The real division is responsibility, not authorship. A concise human reply filters signal and owns the message; a verbose paste shifts comprehension to the reader. Yet async teams may prefer over-communication if it transfers working context. The durable norm is less “never paste” than “own what you send”—read, compress, and stand behind it, whatever the drafting tool.
3. AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
Source ↗· AI-selected
- AliExpress homepage runs hidden WebAudio fingerprinting via two obfuscated scripts (collina.js, fireyejs.js), generating a sawtooth wave and connecting it to the audio destination at zero gain.
- It captures a broad device fingerprint (canvas, WebGL, hardware, interaction) and keeps a PC-to-headphones Bluetooth multipoint link active, blocking phone audio; tab mute does nothing.
- Anti-fraud tracking vs. permission-free hardware side effects; users can block the scripts with uBlock Origin but may face more CAPTCHAs.
The incident exposes a browser permission gap: audio output is not consent-gated, so a zero-volume DSP graph can seize a physical audio route. AliExpress likely treats this as bot detection, but it imposes real hardware disruptions and invisibly collects persistent identifiers. Watch whether browser makers classify silent audio as active playback or gate WebAudio device connections—both would close this channel, though fingerprinting will likely migrate to other APIs.
4. I trained a 125M model to autocomplete piano on-device
Source ↗· AI-selected
- A solo developer trained a 125M-parameter transformer to autocomplete piano MIDI in real time: ~108 notes/sec on an iPhone 15, via a free iOS app called RollTab.
- The key design is predicting one whole note per transformer step — pitch, onset delta, duration, velocity — instead of a token per MIDI event, which avoids hanging notes and cuts latency.
- It trained on a few hundred thousand cleaned piano MIDI files (~300M note events); aggressive cleaning, deduplication, scheduled sampling, and DPO mattered more than adding 5x more data.
The trade-off is musical validity versus on-device size. Cross-entropy training treats one held-out continuation as correct even though many continuations can work, so the model can produce statistically plausible but flat or disconcerting lines; DPO and scheduled sampling try to steer it toward musical reward. Still, this is more Copilot than autopilot: low latency lets a live player prompt, accept, or override in real time. Watch whether the larger model can shrink to the 64M version without losing musicality, since that will determine battery and adoption on phones.
5. Malicious Rust crate Arrayref runs a build-time payload
Source ↗· AI-selected
- On Aug 20, 2026, a compromised maintainer account published `arrayref` 0.3.10, which added the typosquatted `proc-macro1` dependency; its build script downloads and runs a remote binary at compile time.
- `arrayref` has ~245M all-time downloads and sits deep in common Rust GUI graphs via `winit`/egui, so simply compiling an affected project triggers the payload.
- Older 0.3.5–0.3.9 releases were yanked to nudge users toward the malicious 0.3.10; crates.io has since removed the bad versions and related typosquat crates.
The attack exploits Cargo’s unsandboxed build scripts rather than any flaw in `arrayref`’s code, which stayed unchanged and made the malicious dependency easy to miss. The compromised account and deleted GitHub repos complicate auditing, while yanked older releases funneled users toward the poisoned version. With Rust’s thin standard library and widespread transitive dependencies, build-time supply-chain attacks remain a high-leverage vector unless Cargo adds sandboxing, minimum publish ages, or clearer yank/advisory handling.
6. The August 17 outage
Source ↗· AI-selected
- GitHub’s August 17 outage lasted 7 hours 47 minutes, disrupting authentication, Actions, APIs, pull requests, issues, and Copilot.
- It was the second major incident in August, caused when a critical Central US datacenter component failed to scale to a new traffic peak—no code or configuration change triggered it.
- Recovery was delayed by Copilot client-side retry loops amplifying traffic; monthly commits grew from 1.4B to 2.9B since April, intensifying capacity pressure.
GitHub’s outage exposes a capacity-planning failure at the heart of developer infrastructure: doubling monthly commits in five months, much of it automated or AI-assisted, is outpacing hardware provisioning. Microsoft’s Azure migration—now 58% of platform load—and planned read-scaling for monorepos add headroom, but they don't fix the operational gap that let a retry storm delay recovery. The real test is whether the new isolation and retry-budget controls hold during the next traffic spike; if not, developers will keep absorbing availability risk as a cost of using GitHub.
7. Watching TikTok and Instagram deactivates the cognitive control network: Study
Source ↗· AI-selected
- A Zhejiang University study in NeuroImage (Jan 2026) scanned 56 young adults and found watching liked short videos to completion significantly deactivated two cognitive-control regions: the dACC and dlPFC.
- Higher resting dACC glutamate predicted less suppression; disliked videos showed weaker or no dACC deactivation. Visual cortex stayed active, so the effect was specific to control regions.
- The authors call this adaptive low-effort, low-conflict processing, not impairment, but the single-session design cannot show long-term or addiction-related effects.
The result is more nuance than alarm: the same prefrontal quieting appears in flow states and immersive media, so deactivation alone doesn’t prove harm. That cuts against treating short-video feeds as a simple neurochemical hijack, but leaves a real gap—whether repeated suppression compounds into weaker self-control remains untested. Platforms benefit from exactly this low-effort, continuous watching; users may lose if it entrenches automatic processing over deliberate attention. Watch for longitudinal and compulsive-use data before drawing policy conclusions.
8. Huzzah – a novel approach to coding with AI
Source ↗· AI-selected
- Huzzah is an experimental editor where you write persistent, declarative pseudocode in `.hz` files; saving one triggers an LLM to regenerate the actual code, using the diff as the prompt.
- It replaces transient, imperative chat prompts with durable human intent and a source map linking pseudocode to the generated code it controls.
- Main risks: scaling to large/existing codebases, cross-file dependencies, ambiguity in ad-hoc pseudocode, and lower-fidelity models adding tech debt.
Huzzah trades chat fatigue for spec design: the human stays closer to the code’s shape while spending fewer tokens, and the pseudocode doubles as documentation. But the approach depends on the model reliably turning terse intent into correct code, and on a codebase simple enough to have a clean pseudocode representation. For larger projects, persistence and source mapping may matter more than the syntax itself, and the approach remains unproven there.