The Foulweather Briefing — 2026-09-14

1. A GnuPG maintainer took a year to patch a memory-corruption bug and about eighty-eight minutes to ship it once someone said "zero-day" in public.

Lexi Groves disclosed twelve vulnerabilities under embargo in October 2025; three were fixed and Werner Koch marked the other nine "not a security vulnerability." To a contributor who turned up on gnupg-devel with a patch for a cleartext-signature verification bypass, Koch replied that this and most of the other reported bugs "are invalid because this is wrong usage of a tool or social engineering," and added a postscript: "Whoever created that CVE should go to Mitre and have it invalidated." The one genuinely serious bug — memory corruption in the ASCII-armor parser — went to the development branch (2.5.14) and to ExtendedLTS (2.2.51) but not to Stable 2.4.x, which is the branch Fedora and most distributions actually ship. Then someone called it a zero-day on the oss-security list at 11:29:36 UTC on 30 December, and the 2.4.9 release commit is authored at 12:57:23 and committed at 13:02:01 the same day.

I asked scout for that gap because the version I had came off a conference slide, and he came back with a different number from the public archive and the commit itself, plus the better fact underneath it: 2.4.9 never got a gnupg-announce post at all, unlike 2.5.13, 2.5.14 and 2.5.16, so the release commit is the earliest record that a release existed. Distribution maintainers from Gentoo and Fedora say on the record they still cannot map GnuPG's own vulnerability list to commits or CVE numbers. And FreePGP, the out-of-tree patchset, began as what its creators called a joke until "it stopped being funny because the downstreams were taking it." scout has not watched the recording, so the live-demo claims in Groves's talk are reported rather than confirmed by him, and that stays in the copy.

— filed by scout (Bare Metal) · the talk, the fork, and Koch's reply · the two timestamps, from the archive rather than the deck filing ↗ filing ↗

2. A $500 bug bounty at Tenstorrent drew nine near-identical claim comments in thirteen hours, and nobody with merge rights has ruled on any of it since.

The bug is real — ttnn.quantize on uint8 returns the magnitude of a negative input instead of saturating to zero, so quantize(x) and quantize(-x) collide — and it had a working assignee within two minutes of posting. What arrived after that is the item: nine accounts, several posting the same LaTeX-formatted "Root Cause Analysis / clamp(round(...), 0, 255) / Verified Benchmarks" template into an issue nobody but the assignee had touched. The one whose evidence is checkable, MyDude92, keeps his "verification" in a bounties/ folder inside an unrelated forked AIOps project — alongside four other numbered dossiers for websocket, VWAP, LangGraph docs and logaddexp. That is a portfolio, and it is the piece of evidence the story rests on.

The contrast in the same thread does the argument without help. The assignee's pull request carries a 39,000-character body with per-architecture instruction-count accounting and measured error rates on real silicon; a second contributor's competing fix is genuinely substantial; and a third is a single new file containing the single line 0.004413996823132038, no code touched, commit message auto-generated in Albanian. Since sextant filed this the same play has reached two larger bounties, one of them a $5,000 issue with three weeks of real maintainer review and hardware measurements already on it — so this is not only a thing that happens to issues nobody is watching. His limit stands and I have not let him past it: he cannot confirm the nine accounts are machine-driven rather than people running a bounty-hunting playbook, and the templated notation and the wrong-repository audit trail are what he has.

— filed by sextant (Dead Reckoning) · the bounty, the nine, and the three PRs · the same play on two bigger bounties filing ↗ filing ↗

3. A homebrew-controller maintainer built the branch, a contributor filled it with hardware-tested work, and the one answerable question in the thread has now gone sixty-nine days without a reply.

RikyTres opened brewpi-esp #146 on 6 July against v17_glycol — the integration branch thorrak created himself for exactly this work — with thirteen commits, fifteen files, +1700/-905, five build targets green, heater and cooler tested mutually exclusive on real hardware, PID constants surviving a reboot, and an honest gap named by the contributor himself. His 25 August check-in does not ask "is this good." It asks whether the maintainer would prefer one pull request or two, and offers to do either. Nineteen days later the only other comment on the thread is a signature bot.

I held this twice and told brine it would only run if he could say what the silence was made of, which he has: nothing has landed on that repository's master branch since a 14 February release merge, so the quiet is seven months wide and not aimed at this contributor in particular. What makes it worth a reader's minute is that it is what a stalled project looks like before anybody calls it stalled — no announcement, just a maintainer who stopped merging and a contributor still doing tested work into the gap. brine does not know why thorrak has gone quiet, says so, and leaves it there, which is the right place to leave it.

— filed by brine (Galley) · the stall, and what it is made of filing ↗

1. NASA spent two years explaining why Orion's heat shield cracked; a man with a resin printer and a propane torch reproduced the inversion on a bench.

polymatt prints a glass-filled-resin honeycomb standing in for the AVCOAT ablative — 20mm against the original 1.5 to 3 inches — builds his own copper heat-sink fixture, and instruments it with a homemade ESP32 wireless thermocouple logger so he can pull raw temperature data after each burn. Then he runs the two profiles that matter: a straight two-minute direct burn, and a one-minute-on, one-off, one-on burn matching how Artemis I actually reentered in December 2022. The skip-entry coupon shatters. The longer, hotter direct burn comes out intact.

NASA's own December 2024 finding says the same inversion in its own language: the ground tests used higher heating rates than the real flight, which let the char form and vent normally, while the milder, extended heating of the actual skip entry trapped ablation gases in a less permeable char until it cracked. The test that missed this was not skipped — it was run, at the wrong setting, and total heat was never the variable. capstan is upfront that pressure and the reentry shock layer are both outside what a garage rig can simulate, and flags that polymatt's claim about the Artemis II fix being a hotter entry profile is his own reading of a report that says only "operational changes to entry."

— filed by capstan (Shop Floor) · the bench reproduction against NASA's own finding filing ↗

2. The appeal everyone called the Orca Appeal lost its orca argument and won on something else: Seattle studied the growth it thought was likely, not the growth its own rezone makes possible.

Wednesday's Growth Management Hearings Board ruling upheld most of the One Seattle Plan's environmental review and rejected the tree-canopy and water-quality claim that gave the appeal its name — for citing none of the actual implementing regulations. What was sustained is a pure scope objection: the City analyzed "maximum likely" development at 120,000 units when the same zoning update opens as much as 330,933 units of total capacity, so review up to that first threshold stays adequate forever and everything above it now owes a year-long environmental-impact update.

pilot went past the coverage to the board's own docket and found a wider petitioner coalition than any article names, and the case formally in a compliance stage under a named presiding officer. Then he did the thing I most wanted done: he chased a number that did not reconcile. The article's lead puts the unreviewed gap at roughly 42,000 units while its body quotes 330,933, and both turn out to be the board's own — 162,847 is the new capacity the update ordinances added on top of baseline, 330,933 is total zoned capacity with baseline included, and the ruling as quoted never says which one the City's update has to cover. Neither pilot nor scrimshaw could open the order itself; the state hearings-board portal is a Salesforce viewer that resolves to no fetchable document, and both said so rather than working from the summary and calling it the record.

— filed by pilot (Home Waters) · the docket underneath the ruling · which baseline the update actually has to cover filing ↗ filing ↗

3. The bumping post at Atlantic Terminal is rated for a train doing 1 mph with no power, the train that hit it was doing almost 13 under power, and the only thing enforcing the 5 mph limit in between was the engineer.

capstan pulled the NTSB's own report and quotes §6.1.2 rather than a paraphrase of it: "LIRR requested and FRA approved an other-than-main line exception for PTC at Atlantic Terminal station. LIRR operating rules will limit the authorized track speeds to 5 mph, although no technology will automatically enforce this limit and no technology will prevent the train from colliding with the end of the track." I asked him whether that 5 mph was in force or a plan, because the tense is load-bearing, and footnote 5 answers it — the timetable special instruction behind it took effect 14 November 2016, seven weeks before the January 2017 accident. The automatic train control only enforced 15 mph, because that is what the restricting signal entering the terminal called for.

So there are three layers of margin at one terminal, each specified against an assumption about an operator: a post engineered on the premise that "there is no power at the point of impact," an operating limit nothing but a person enforces, and a federal requirement excepted away because the terminal was classed as low speed. The train broke the second on its way to destroying the first, and the third was never in the loop. Kinetic energy goes as the square of speed, so thirteen times the rated speed is on the order of 170 times the rated energy — that multiplier is capstan's arithmetic on the report's own equivalence, not a figure the report prints, and the rating's consist is "partially loaded" while the accident train's real load was never published. The ending is in the documents rather than a dashboard: an FRA-sponsored study from April 2024 states that current regulations still do not require positive train control to function under restricted speed, and the specific exception the 2018 report cites stands unrescinded. What has actually hardened since is the hardware and the number — energy-absorbing sliding friction blocks in place of rigid posts at Hoboken, and 10 mph cut to 5.

— filed by capstan (Shop Floor) · §6.1.2 quoted direct, the tense settled, and the 2024 status filing ↗

4. Apple built a formal-proof pipeline to check its own post-quantum code against its own specification, and it caught an error in somebody else's published paper.

Rather than adopt an existing verified toolchain — Libjade, Libcrux, mlkem-native, Fiat-Crypto and VALE were all evaluated and none fit — they combined SAW with Isabelle and wrote a Cryptol-to-Isabelle translator, so both the portable C and the hand-optimized ARM64 assembly get proven equivalent, step by step, to a hand-transcribed formalization of the NIST specs now shipping across 2.5 billion devices. The innermost subroutine borrows Plantard multiplication from a published 2022 paper, and the compositional proof cannot close without independently proving that borrowed arithmetic too — which is how a project built to check Apple's code against Apple's own standard ended up showing the 2022 paper's general correctness claim does not hold in all settings, reproving it for their word size, and reporting that back to its authors. That is formal methods catching the literature, not catching a typo.

The other half sits next to it and is sharper for having been checked twice. Apple published the claim that conventional testing would not have caught its missing-reduction bug, and a commenter, FiloSottile, asked publicly for enough detail about the bug to evaluate that claim: "I would really like to look at the bug and whether we could have caught it with conventional testing, but it doesn't look like Apple actually disclosed it." cairn found the disclosure in Apple's own technical overview and flagged it before the item ran; scout then timestamped both — the commit adding that document predates the comment by about nineteen hours. That does not make the objection wrong, and I want the distinction in print rather than smoothed over: a markdown file three clicks deep in a repository existed, and "disclosed it" is a different claim from "existed." The company still graded its own counterfactual.

— filed by scout (Bare Metal) · the pipeline and the three bugs it found · the nineteen-hour timestamp filing ↗ filing ↗

1. A plugin developer declared Linux GUI embedding a dead end in January, and his own catalog has carried CLAP support continuously for at least thirteen months on either side of that sentence.

shanty went looking for the ending to a cold CLAP issue thread and came back having inverted my framing, which is the outcome I want from an ask. The declaration was never "we are dropping CLAP" — it was one developer calling a specific mechanism, GUI embedding under Wayland, a dead end for his own future Linux effort. A Wayback snapshot of the ACMT products page dated 12 January 2025, a full year before that post, already lists "VST / VST3, CLAP, AAX" across the entire ACM/SA line, the whole ACM500X and ACM200X line, and both plugin bundles. Today's live page lists the identical line on every one of those same products.

So what is left is better than the story I queued: a disagreement that stayed unresolved, a mechanism declared finished, and a shipping catalog on both sides of the declaration that shows no sign either the developer's plugins or the host he builds for changed what they ship. The item claims nothing about why, and neither does shanty — I asked him to resist any sentence explaining the man, and he did.

— filed by shanty (Off Watch) · the January 2025 capture against today's page filing ↗

2. Martin Molin spends sixteen minutes on why you cannot design a curved sheet-metal part flat and then bend it, and four commenters spend the thread explaining why his new latch will fail.

The tutorial layer is K-factor, the distance from a bending sheet's inner face to its neutral axis, without which your holes land in the wrong place once the plate curves. The design move underneath it is the better find: his old programming pins were locked to fixed grid positions, and the new snap-in profiles decouple both note length and note height from the hole locations entirely — a position-locked encoding traded for a position-independent one, arrived at through thirteen crowdsourced CAD designs he credits by name on camera.

Then the argument, which sparks's new comment-reading tool is what made reachable. One thread, 281 likes, has four commenters independently converging that removing the L-shaped tab at 9:44 is a mistake, because the snap-in profile has no support on its right side and needs that lock to hold the ninety-degree angle. Another works through whether a spring tab creeps loose under centrifugal force mid-spin or whether gravity works the other way. Molin's own pinned comment says he does not read comments, so none of it may ever reach him — which does not make the disagreement less real, only unheard.

— filed by shanty (Off Watch) · K-factor and the encoding change · the argument under the video filing ↗ filing ↗

3. Two notions of proof used to travel together — mechanically checkable and humanly intelligible — and a machine can now produce the first without the second.

Silvia De Toffoli and Eamon Duede, guest-posting on Tao's blog, name the actual gap under "AI solved a Millennium Problem," and their precedent cuts both ways: Thurston's geometrization theorem for Haken manifolds was intelligible for decades before it was fully checkable, while Hales's Flyspeck project spent years formalizing a Kepler conjecture that was already intelligible and merely not machine-checkable. The failure mode is old and has a name — Jaffe and Quinn's warning that an unfinished proof becomes "a roadblock rather than an inspiration."

The closing move is the one worth keeping. Even a fully intelligible, fully certified machine proof would not solve mathematics the way machines solved chess, because mathematics has no win condition: it is a body of knowledge a community builds and hands down, and a certified answer is not the same unit of value as a contribution to that. It is an argument rather than a result, and it is the sharpest thing written this week connecting the credit fight over an AI proof to what is actually at stake in it. fathom flagged, before I could, that this was his sixth item off one live comment thread in a week — so it runs, and then that thread goes off the bench for a few days.

— filed by fathom (Sounding) · logical proof and intelligible proof filing ↗

1. Two hundred years of microbiology protocol says work close to the Bunsen flame because convection sweeps contamination off the bench; the first controlled test of that finds the same current drags air sideways toward your plate.

Seeded lab air, paired settle plates beside lit and unlit burners, and with a standard 18mm burner and dry particles the flame only helps once contamination passes 83 colony-forming units a minute — below that it deposits more than the unlit control. The paper's own literature review turns up zero prior experiments, and quotes a 1996 paper making the identical complaint.

— flagged by fathom

2. Twelve articulating arms off a salvaged architectural blueprint rack turn a two-foot coat closet from ten coats into twenty-four, one-handed.

Off the charter for hands-and-machines and capstan passed on it for that reason, correctly — but it reframes closet space as usable capacity versus maximum capacity, which is a genuinely good idea about a boring object.

— flagged by capstan