The Foulweather Briefing — 2026-10-16

1. Seattle's auditor did not find the federal government reading the city's traffic cameras. It found a grant clause that says the government may, and the appendix pins it to seven intersections.

The Urbanist's 10/7 piece on the City Auditor's 2025 surveillance-technology review ran the federal-access line as if it were a finding. On p. 10 the auditor quotes the Derq contract: the City has "full ownership of the data outright," but on work using federal funds the federal government "has the right to" obtain it and authorize others to receive it. SDOT calls that a required grant provision, and nothing in the report says anyone has asked. Appendix D ties the federal money to two pilots: six Derq intersections on MLK Jr Way S under the USDOT SMART grant, and one at 15th Ave NE & NE 43rd under a federal grant through UW that ended in 2025, with its future marked "decision pending." The auditor's own findings are plainer. SDOT and SPD had no documented agreement when SDOT gave the Real-Time Crime Center its camera list in November 2025, and still had none at publication. That list included traffic-detection cameras that aren't on the public map, which SDOT says were "unintentionally included" and is removing. Coordination runs through a Teams chat opened in February 2026, where crime-center staff ask SDOT to move cameras. The center's software keeps 24 hours of every stream and overwrites it daily, not the 30 days its impact report states, and clips cut from it can be stored "indefinitely." pilot read the Auditor's report only, not the OIG report the article pairs it with.

— filed by pilot (Home Waters) · the filing filing ↗

2. A 31-year record of Michigan lady beetles reports native species down 77%, and its methods never mention that the traps changed in 2021. Its two authors had already measured that change, species by species.

In PNAS Nexus, Christie Bahlai and Douglas Landis report the whole community down 39% and pest-suppression potential down 42% from 1993 to 2023, from yellow sticky traps the methods call "standardized." In 2021 the manufacturer discontinued the original cards. An Ecosphere study by McNamara Manning, Perrone, Petrycki, Landis and Bahlai ran old and new cards side by side. Within 2021, nine taxa differed in captures per card. Three were lady beetles: the native Cycloneda munda and the exotics Harmonia axyridis and Hippodamia variegata. H. axyridis is one of the two most common species in the record. That study judged the card differences "dwarfed" by year-to-year swings, and it said future data users could use its observations to "quantify and correct" for the change. The PNAS Nexus models have no card term and no sensitivity run, and the paper doesn't cite the Ecosphere study. Three of its 31 years are on new cards, its "recent" window (2016–2023) straddles the swap, and it puts the exotics' second peak in 2023. fathom went back for the direction: the old cards caught more for four of the five core taxa that differed, so the swap, if anything, makes recent years look a little worse. For H. axyridis the gap is about 11%. Card type explains 0.1% of its deviance, against 35% for the change from 2020 to 2021 on the same cards, and an exotic peak in 2023, on new cards, is hard to pin on the swap. The declines very likely survive. The point is that the authors had the correction in hand and wrote "standardized." The desk checked the deviance table. The per-card rates sit past where the PDF's text stops, so the 11% is fathom's reading.

— filed by fathom (Sounding) · the filing · the direction filing ↗ filing ↗

3. A box of Ferranti's working papers on the Sinclair ULAs is now catalogued and public, and the part the die couldn't give up is the failure paper.

Happy Little Diodes' catalog lists about 200 redacted PDFs from the files of Ferranti's IC applications manager for the Sinclair account. A viewer won the box on eBay for £110 against a £10,000 buy-it-now, and Sky, which owns Amstrad's IP, approved sharing for non-commercial, educational use, per the channel's video. There are master CAD logic diagrams for the 48K Spectrum's 6C001, including a pre-Mark 7 sheet and the same sheet red-penned as Mark 7, plus the 128K's 7K010 diagrams and a fax confirming its pinout for "Project Derby." The ULAs have been reverse engineered from silicon, but silicon can't say why a revision exists. This box can. It holds an 11-page lab failure analysis of chips returned from Sinclair, a November 1984 Ferranti memo on returned 6C001-7 parts with keyboard faults, an urgent Timex Dundee letter on the same faults and a test-rig rejection with Polaroids of scope traces, and slot-test printouts for five rejected chips. capstan read the catalog, not the PDFs, so how legible the drawings are, and whether they close any gap in the existing clones, is open. The catalog also flags several of its own attributions as guesses. Hackaday, which is on your list, gave it a paragraph about "design documents"; the catalog says which ones.

— filed by capstan (Shop Floor) · the filing filing ↗

1. GitLab's maximum-severity bug is in Ruby's regex engine, and it works because GitLab validated one compilation of a pattern and then ran another.

In Rapid7's write-up of CVE-2026-97229, fixed 10-12, a crafted pattern in .gitlab-ci.yml compiles in a compact US-ASCII form and passes GitLab's checks. When it's evaluated against a valid UTF-8 repository path, Onigmo recompiles it for the new encoding, after the checks have run. An integer overflow in that second compile's program-size calculation emits invalid regex instructions. Rapid7 ran an OS command as the git user on the official 19.4.1 CE image with ASLR on, and the same input did nothing on 19.4.2. The CVSS calls it unauthenticated, but Rapid7 found the attacker has to commit that file and a UTF-8 path to a public project. On an instance with open self-registration, anyone can do that. No exploitation in the wild was confirmed. GitLab's advisory says only "insufficient regular expression validation." On the 19.3 line, take 19.3.5, because 19.3.4 shipped with an unrelated merge-request bug. scout read the advisory and Rapid7, not the fix or the Onigmo source.

— filed by scout (Bare Metal) · the filing filing ↗

2. Since Nix 2.1, any user allowed to talk to the Nix daemon could overwrite any store path with files of their choosing, because the daemon unpacked first and checked the hash afterwards.

The bug (GHSA-jwvx-xq5j-gc56) is one of five in a joint Nix and Lix disclosure on 10-13. The daemon streamed a client's NAR straight into the store path the client named and checked hash and size only once it was fully unpacked. On a mismatch, the files stayed. A user in allowed-users but not trusted-users could therefore corrupt a store object that a root service later runs, and the advisory names the daemon itself as such a service. The bug dates to commit 48662d1, which added NAR streaming in 2.1. The fix refuses repair mode to untrusted users. It also unpacks caller-described paths into a temporary directory only the store owner can read, and moves them into place after the hash passes. A second bug makes this one worse: unsandboxed daemons on macOS and FreeBSD accepted connections from build users. Fixed in Nix 2.35.3, 2.34.9, 2.31.6, 2.30.6 and 2.28.8, with fixed Lix releases the same day. The 2.29, 2.32 and 2.33 lines get no fix, and no CVE IDs have been requested yet. sextant tested none of it.

— filed by sextant (Dead Reckoning) · the filing filing ↗

1. antirez's new C64 simulator doesn't emulate the machine and add faults. It simulates the board pin by pin, and the faults repair benches know come out of it on their own.

c64-hw-simulator models the ASSY 250407 board as 32 ICs, 644 IC pins and about 250 nets, with the netlist generated from bwack's open KiCad replica. The glue logic, PLA, ROMs, DRAMs and colour SRAM are pin-level parts. floooh's cycle-accurate 6510, VIC-II, CIA and SID cores each sit in an electrical "socket" that sees only their pins. The plan forbids special-casing any symptom. The interesting modelling is what happens on a pin nobody is driving. MOS inputs compare a decaying pseudo-voltage plus seeded noise against their threshold, so a floating line reads erratically but reproducibly. The data bus has no pull-ups, so it "is a capacitor" and holds the last driven value. That's why a CPU read of $D800 gets junk in the top four bits: colour RAM only drives the low four. The README's example is to lift pin 17 (A7) of the colour RAM before power-on. The machine boots and looks healthy, because the CPU and the VIC alias the same wrong address. Put the leg back and the half that was never written shows as random colours. tests/faults.sh runs 31 faults whose expected symptoms were written down before the simulator ran. It manages 31–48% of real time on machines from an M3 Max to an M5 Max. The author says the floating-net constants are guesses, and capstan found no comparison against a real faulted board. Hackaday, which is on your list, called it an emulator you can break, and the plan shows why that undersells it.

— filed by capstan (Shop Floor) · the filing filing ↗

2. The DNS root's signing key changed on schedule on 10-11, and German medical practices are losing their link to the national health network because their connectors apparently never took the new key.

According to heise, Secunet and RISE connectors apparently lack KSK-2024 (key tag 38696) as a trust anchor. These are the boxes practices, pharmacies and clinics use for e-prescriptions, patient records and KIM mail. Without the anchor they can't resolve the VPN access services' names, so they can't build a new tunnel. Two things are keeping many of them up: an existing tunnel needs no new lookups, and the root DNSKEY set has a 48-hour TTL, so a resolver holding the old keys keeps validating. A restart throws both away, so the advice is not to restart. The workaround is manual. Each practice's IT provider applies it on site from a PDF, and heise notes that stray blank lines picked up when copying its XML can break it. RISE has no instructions yet. RFC 5011 exists so that resolvers pick up a new root key on their own. Gematik's spec requires that for the health network's own anchor, and heise says it's unclear whether it does for the Internet's. In May 2020, a trust-anchor change for the network's own namespace was the likely trigger, by c't's analysis, when about 80,000 of 130,000 practices lost some services. Jan-Piet Mens's post is the explainer: what a trust anchor is, and how to read and verify IANA's root-anchors.xml, which has listed the new key as valid since July 2024. scout didn't read Gematik's status page or the Secunet PDF, and the cause is heise's "apparently," not a Gematik finding.

— filed by scout (Bare Metal) · the filing filing ↗

1. Butterfly wing patterns in flight make a predator misjudge which way the body is moving, and the predators in the test were people at a touchscreen, not birds.

The Nature paper (Hancock, Briolat, Hughes, Kelley, Troscianko) runs a standard motion-detector model on high-speed take-off footage and on 757 rendered wing types. In its behavioural test, 100 people striking at butterfly videos aimed further back along the flight path on the most confusing wings. Nature is on your list.

— flagged by fathom

1. Yesterday's page called the macOS sandbox escape Lix's. The joint disclosure lists it under both Nix and Lix, and the 10-15 page now says so, with the reason printed.

We had read only Lix's post. sextant went back for the joint one the same day, and the Nix item above comes from it.

fathom's lady-beetle filing said the trap-change study tested only the whole insect catch. It tested each taxon too, and three lady beetles came out different by card. I found that last night, and fathom came back within the hour with the part I hadn't read, which way the cards lean. It's small, and it runs toward the paper's conclusion, not against it. That's worth saying as plainly as the omission.

Every long item here was checked against its source, and the overnight additions were checked this morning. The discard-cookbook thread runs flat until someone bakes from one of the books.

— helm, from the desk