THE PELOTON

Volta a Portugal Resumes in Mourning After Death of Finlay Tarling

↩ Developing story — first reported Aug 10 · previously Aug 12, Aug 13

PORTUGAL — Before the Volta a Portugal's penultimate stage rolled out on Saturday, the peloton stopped. Finlay Tarling, a 19-year-old Briton riding for the NSN Development Team, had died the day before after a collision with a car during stage 8. Race organisers confirmed the stage would go ahead — "in an atmosphere of profound mourning," their statement read — but without Tarling's teammates, who had all withdrawn.¹

NSN Cycling announced the Development squad's withdrawal Saturday morning, with the full support of Tarling's parents.¹ The team's WorldTour roster will continue racing at the Czech Tour and the Arctic Race of Norway. "We will continue to hold Fin in our hearts as we race in his honor, doing what he loved most," the squad wrote.

Patrick Lefevere used his Saturday column in Het Nieuwsblad to address the Roglič-to-Lotto question — and the picture he painted of the Belgian team's track record was not encouraging. As this paper reported Thursday, Lotto-Intermarché is now the sole remaining 2027 suitor for the 36-year-old Red Bull-BORA-Hansgrohe rider, with a decision expected before the Vuelta start on August 22. What Lefevere adds today is a ledger: John Degenkolb, Elia Viviani, and Philippe Gilbert combined for four victories across six seasons at the squad, none of them at WorldTour level.²

The argument cuts both ways, and Lefevere knows it. He also catalogued his own version of the same gamble paying off: Virenque arrived at his squad in 2001 at nearly 32 and produced three Tour de France stage wins; Cavendish turned up in 2021 "when he wasn't worth five francs anymore" and delivered four Tour stages and the green jersey. The variable that separated those successes from the failures, he implied, was motivation — and that is the one thing Lefevere says he cannot read in Roglič. "We have to be honest," he wrote of Lotto's position, "that means teams aren't exactly lining up to sign him."

Visma-Lease a Bike confirmed Friday the signing of Fabio Jakobsen on a deal through 2027.³ The 29-year-old Dutch sprinter was released by Picnic-PostNL mid-season after double iliac artery surgery in early 2025 gutted his sprint power; his last victory was the opening stage of the Tour of Turkey two years ago, and his best result in 2026 is a 16th place at the UAE Tour. Visma said the coming months will centre on rebuilding his condition rather than race results — a low-risk rehabilitation play for a team that has several quick finishers but no dedicated flat-stage specialist, and which is watching its budget carefully during an ongoing search for new title sponsorship.

The reasons behind Van Aert's Belgian Gravel Championships appearance on Sunday deserve closer inspection than the headline allows. The course in Grobbendonk is seven kilometres from his home in Herentals, on roads he trains on regularly. The event moved from May to August, clearing his schedule. He has no road commitments this weekend. And the Vuelta a España, which starts August 22, includes a 3.5-kilometre gravel sector on Stage 6 at the Puerto del Bartolo — the first of its kind in the race's history.⁴ The toughest section of the Grobbendonk course, according to a Nieuwsblad reporter who rode it, is a 700-metre stretch of loose sand on a disused railway track, 15 kilometres from the finish. "If he manages to secure the title in his home region, that's a nice bonus," Belgian Gravel Championships organisation member Erwin Vervecken told Wielerflits. "If not, he won't lose any sleep over it either."

↑ Back to top

THE LAB

The Protocol Fit a Multiplayer RPG into 56k. One Step Cost Seven Bytes.

In 2004, a single step north in RuneScape cost seven bytes upstream. The server's reply — a full scene update covering every player the client could see — came back in nine. A post published Aug 14 traces how, working from a decompiled RuneScape 2 client, with code that carries through to Old School RuneScape today.

The walk packet itself is a first study in minimalism. The opcode is enciphered with ISAAC, but only the opcode — the body travels in plaintext, because without the opcode the body is unreadable wall-of-bytes anyway, so enciphering that one byte was "the cheapest possible defence against third-party packet parsers." Walk paths send only corners: client and server each run the same BFS pathfinder over the same collision map, so the full path never crosses the wire. Subsequent waypoints are delta-encoded from the first absolute position — two bytes each instead of four — and a ten-tile straight line sends one waypoint, the destination. That gives you the complete packet: opcode, length, two-byte x, two-byte z, one Ctrl-key toggle. Seven bytes.¹

The server-to-client update is where the real work lives. Steps 1 through 3 of the player update packet are bit-packed. A player who neither moved nor changed this cycle costs exactly one bit — the cheapest possible representation of the most common state. A step costs seven bits: one for "update follows," two for movement type, three for direction, one for "more detail coming." Stand in a crowd of twenty players where only you moved, and the full scene update is six bytes of payload: one bit for the local player flag, eight bits for the crowd count, seven bits for your step, nineteen bits for nineteen idle players, eleven bits for the end-of-list sentinel, two bits of byte-alignment padding.¹ Position is encoded as a signed 5-bit delta per axis — fifteen tiles is the visibility limit, and fifteen fits in five bits — rather than a 16-bit world coordinate. Step 4, the appearance block (equipment changes, animations, hit markers), switches to byte-aligned reads. The reason is cache: the server pre-builds each player's appearance as a byte blob and splices it directly into outbound packets. Byte-aligned blobs are position-independent and position-invariant; bit-align the same data and the offset shifts for every observer every cycle, destroying the cache and forcing a shift-and-mask on every send.

The closing argument is worth quoting: "Every economy in this protocol depends on both ends sharing knowledge that is never transmitted. The protocol is small because the two programs were written together, by people treating the network as an implementation detail of a single application rather than a boundary separating two." Both ends know the same collision map. Both ends have the same default — no change — baked in at compile time. The contrasting design (self-describing, verbose, independently deployable) is the right default when what presses on you is teams and change velocity rather than bytes. The point is knowing which constraint is actually binding.

A detailed Aug 14 critique by Dmitry Grinberg makes a specific and uncomfortable argument: the ISA's design decisions, which might have been acceptable from a research project in the 1970s, are inexcusable from an architecture designed this century with decades of prior art available.

The interrupt overhead comparison is precise. An embedded RISC-V core (with Zicsr implemented) needs at least 44 cycles before a C handler can run: one CSRRW to stash a register and get a base address, 19 stores to save ABI-required registers, another CSRRW to recover the original value, plus a JAL and a RET.² A Cortex-M0 from 2010 does the same work in 27 cycles and pushes ABI-clobbered registers in hardware, so the handler is already valid C with no prologue. The RV32E variant saves six cycles on push and pop, bringing it to 38 — still over a third slower than the decade-old competing part at the core's primary embedded job. The existence of CLIC and various proprietary "fast IRQ" extensions is, the piece argues, a further indictment: the base ISA forces vendors to invent non-standard silicon to reach parity with a Cortex-M0, which in turn further fragments the standard.

Optionality compounds everything. Every extension is optional: multiply, divide, user mode, supervisor mode, CSRs. The feature-detection register, misa, is gated behind Zicsr — itself optional — and misa is permitted to read as all zeroes even when the silicon is physically present. The specification eventually introduced profiles (RVA23) as a second layer of standardization whose entire purpose is to declare which parts of the first standard you are required to implement. As of now, none of the currently available and recommended RISC-V SBCs are RVA23 compliant — not the VisionFive 2, not the Banana Pi BPI-F3, not the Orange Pi RV2, not even the HiFive Premier P550. None of them will run Ubuntu LTS or future AOSP builds.² The profile designed to solve fragmentation has divided the existing hardware into "almost-RVA23" and post-RVA23.

The encoding is the most visceral chapter. J-type immediates are scattered through the instruction word in bit order 20 10 9 8 7 6 5 4 3 2 1 11 19 18 17 16 15 14 13 12. More seriously, certain extension combinations produce conflicting encodings with no illegal-instruction trap to warn you. Instruction 0xA002 is either a double-precision float store to stack (C.FSDSP) or a jump (CM.JT), depending on whether the D extension or Zcmp is present. An MCU upgrade that adds floating-point support can silently turn valid stores into jumps; instruction 0xAC66 is either a stack store or a register-to-register move — no control-flow change, just corrupted registers and a value never reaching the stack. Grinberg's conclusion: RISC-V will displace 8051 in cheap microcontroller sockets on price, not ISA quality, and will be chosen by ML accelerator designers for the same reason — "good-enough is a low bar." For desktop-class compute, where the margins exist to license a well-designed aarch64 core, he does not expect it to be a serious player.

QuakeCon's 30th anniversary on Aug 11 brought all four id Software founders together in Grapevine, Texas for the first time since 1993 — John Carmack, John Romero, Adrian Carmack, and Tom Hall.³ Carmack played the original Doom on an Evercade port and forgot where the keycards were in E1M4 and E1M5, levels with speedrun par times of 1:30 and 2:45, spending about 15 minutes on each. The more substantive note came from Sandy Petersen's X post that Quake had "ruined id Software." Carmack agreed publicly, writing that Quake "was overly ambitious technically" and that "I had pushed everyone too hard. The studio could have done all the great multiplayer and modding work inside a Doom++ engine, allowing the designers to work with a more stable base instead of a rug pulling everything out from underneath them a couple of times." Romero, the report notes, didn't say much about it.

Simon Willison linked Aug 14 to a technique by Doug Turnbull worth knowing about: instead of forcing a model to classify against a fixed existing vocabulary — which falls apart once the vocabulary is too large to fit in context — prompt it to invent whatever tags might fit the document freely, then use vector embeddings to find the real vocabulary entries closest to the model's hypothetical output.⁴ The inability to constrain itself to a known taxonomy becomes the feature; the model generates a target in tag-space without enumerating thousands of options first.

Trending today: GitHub is saturated with DeepSeek Harness derivative repos — Electron desktop wrappers, TUI plugins, web UI skins, and preset packs dominate the top 25; the core deepseek-ai/deepseek-harness framework (12k stars, the one substantive candidate) was inaccessible for technical review.

↑ Back to top

THE WORLD

West Seattle Link Slips to 2035; M7.7 Strikes Indonesia

↩ Developing story — first reported Aug 11 · previously Aug 12, Aug 13, Aug 14

• Indonesia, M7.7 — A M7.7 earthquake struck off Indonesia's Ende coast; USGS reports 2 million people exposed to strong-to-violent shaking and warns significant casualties are possible. USGS
• France social media ban blocked — France's Constitutional Council struck down a bill banning social media for under-15s, ruling it disproportionate; Macron has ordered the government to rework it. CNN

• West Seattle Link to 2035 — Sound Transit confirmed Thursday the extension will open in 2035 — three years later than its previous estimate and five years past the 2030 date promised to ST3 voters — after the agency dropped Avalon Station to cut over $2 billion in costs; the board votes August 27 on $765 million for property acquisitions. The Urbanist
• Girl killed in Graham — A 5-year-old was found dead Thursday evening after her grandmother reported her missing; Pierce County deputies shot an aggressive cane corso found near her body, though investigators have not confirmed whether the dog was responsible. KIRO7
• Modrite Fire fully lined — Firefighters completed the final segments of direct fireline on the Modrite Fire's western perimeter Friday, making the blaze fully enclosed at nearly 58,000 acres; crews are now pulling structure protection sprinklers from Twin Lakes as mop-up continues. KIRO7
• WA income tax to outperform — The state Department of Revenue now projects Washington's high-earner income tax will generate $3.1 billion in its first year — up from $2.7 billion estimated when Gov. Ferguson signed the bill — with 25,000 households expected to pay; voters decide in November whether to repeal it via Initiative 645. Issaquah Reporter

ON THE TRAIL

• West Tiger 3 (Tiger Mountain, Aug 13) — Trail in great shape; a hiker spotted a mother bear and two cubs near the summit. Plan around the trailhead outhouse, which is out of supplies. WTA
• Thunder Mountain Lakes (Stevens Pass, Aug 13) — Tunnel Creek road is in rough shape from December 2025 floods; the trail beyond Trap Pass is unmaintained and requires navigation skills; bears are active in the Hope Lake–Trap Pass meadows. WTA
• Kendall Katwalk / Red Pass — Closed due to the Three Queens Fire as of Aug 12; verify status before heading out. WTA

↑ Back to top

THE LONG READ

The Backdoor Comes Back: AI Is About to Make Software Too Secure for the FBI

For the past decade, the "Going Dark" debate — the FBI's long campaign to force backdoors into encrypted software — has been quietly losing. Not because law enforcement gave up, but because the market offered them something better: the ability to simply hack the device. When Apple refused to unlock a shooter's iPhone in 2016, an outside contractor stepped in and did it anyway.¹ After that, the urgency drained out of the backdoor argument. Why legislate exceptional access when you can buy GrayKey or license Pegasus?

That workaround, Johns Hopkins cryptographer Matt Green argues in an essay published Friday from Usenix Security 2026 in Baltimore, is about to vanish. And what replaces it will be worse for everyone.

The argument is counterintuitive enough to be worth unpacking slowly. Green is worried that AI is about to make software dramatically more secure — not in a marginal way, but in a way that eliminates the practical attack surface law enforcement and intelligence agencies have depended on for the past twelve years. The same AI models that can find novel vulnerabilities are being integrated into CI pipelines before code ships. Entire backlogs of decades-old bugs are being patched in bulk. Green's estimate: within two years, major maintained software will run out of remotely exploitable bugs in any practical quantity.¹

He roots this in specifics. Anthropic's Mythos model, announced this past April, demonstrated unusual skill at software vulnerability finding; the U.S. government moved immediately to restrict its export.¹ The restriction turned out to matter little — OpenAI published comparable capabilities, and Chinese open-weight labs Z.ai and Moonshot demonstrated near-parity within months. The bug-finding capability is diffusing rapidly. So is patching. "Defenders are now in the process of patching every bug they can find — often decades worth of bugs — and the backlog feels huge," Green writes. "But they're making progress."¹

This is, in isolation, unambiguously good news. Then comes the problem.

The FBI and NSA have never abandoned the underlying logic of Going Dark — they merely deprioritized it when private-sector hacking tools kept the surveillance window open. When that window closes, the demand for intentional, legislated backdoors will return with compounded urgency. Agencies that could previously buy access will find their vendors have nothing to sell. Green argues this dynamic will produce exactly the outcome that cryptographers and civil liberties advocates spent a decade warning against: governments will press for backdoors constructed deliberately into the architecture of communications systems.

The technical case against backdoors hasn't changed. The UK's version of this argument has already "metastasized into something worse," in Green's framing — a reference to Apple's reported compliance with UK government demands for iCloud access.¹ In the U.S., the Salt Typhoon campaign (where Chinese intelligence exploited lawful intercept infrastructure built for U.S. wiretaps) demonstrated exactly what happens when governments construct intentional access points into communications systems: adversaries find them and use them too.

Green is clear that he doesn't have a solution. "This is not a call to action for experts to rally behind a sophisticated plan." The essay is diagnostic, not prescriptive: we are on a slide toward a policy crisis that will arrive faster than anyone in Washington currently expects, driven by a technical shift that security engineers will experience as progress. The paradox is that the same AI cycle that finally delivers on decades of promises about secure software will, within two years, hand the Going Dark caucus the strongest argument they've ever had.

For the full essay: Everything Is About to Go Dark — Matt Green, Usenix Security 2026, Aug 14, 2026.

↑ Back to top

FROM THE ARCHIVE

No Japanese Military Unit Had Surrendered: August 15, 1945

No Japanese military unit had surrendered during World War II. Japan had never capitulated to a foreign power. Then, in the span of nine days in August 1945, the framework of that resistance collapsed entirely.

On August 6, the United States dropped an atomic bomb over Hiroshima, killing as many as 140,000 people.¹ Two days later, the Soviet Union declared war on Japan. On August 9, a second bomb fell on Nagasaki, killing approximately 70,000. The battles for Iwo Jima and Okinawa earlier in the year had already cost enormous casualties on both sides — Okinawa fell to American forces on June 22, and an invasion of the Japanese home islands was being planned. By August 14, the Japanese government had run out of room. It accepted Allied surrender terms without qualifications. That same day, President Harry S. Truman announced from the White House that Japan had met the conditions laid down at Potsdam.¹

The news broke across the United States like a pressure valve releasing. In Times Square, sailors climbed lampposts to unfurl American flags while ticker tape rained on the crowds below.¹ In San Francisco, parades celebrated the imminent return of troops through that port. In Honolulu, veterans who had waited since Pearl Harbor drank toasts in warm sunlight. In North Platte, Nebraska — and thousands of towns like it — there were fireworks and confetti and impromptu parades down Main Street.

The United Kingdom designated August 15 as its official V-J Day. The United States would hold its formal commemoration on September 2, 1945 — the date surrender documents were signed aboard the USS Missouri in Tokyo Bay.¹

But even the celebrations carried weight. More than 400,000 Americans had died in the conflict; an estimated 65 million people worldwide.¹ Historian Donald L. Miller wrote in The Story of World War II: "It was too much death to contemplate, too much savagery and suffering; and in August 1945 no one was counting. For those who had seen the face of battle and been in the camps and under the bombs — and had lived — there was a sense of immense relief."¹

The war was over.

↑ Back to top

THE FUNNIES

Seven Bytes / Should've Stayed in Bed

*After XKCD — on the RuneScape protocol's deepest trick: the path that never crosses the wire because both ends already know it. After Garfield — on the Going Dark paradox, in which AI makes software so secure that the FBI runs out of things to hack and immediately demands a key to the front door.*

↑ Back to top

ALSO NOTED

Also Noted

• Safest Helmet Ever Tested — The Pikio Si Oblik scored 4.61 in Virginia Tech's helmet rating system (lower is better), the best mark ever recorded across road, MTB, and full-face helmets, achieved through a "deflection-sensitive nodal system" that divides the liner into independently moving modules — each tuned to respond to the specific location, direction, and intensity of impact rather than relying on a single crush-foam liner; priced at $379, US and Canada only. bikeradar.com Aug 14, 2026
• Wahoo Challenges Garmin With Three-Tier App — Wahoo launched a restructured software lineup: a free tier (head unit basics), a new $4.99/month Core plan with training load analytics and fitness trends, and a $17.99/month Pro plan with the full SYSTM structured-workout library — along with a new running-profiling system called Three-Dimensional Pace (3DP) modeled on its cycling 4DP metric, available to Coros watch owners on the paid tiers. velo.outsideonline.com Aug 13, 2026
• Trek Domane 5: Climbing Bike Wearing Endurance Clothes — Trek's fifth-generation Domane sheds 305 grams from the frame and fork (835g frame, 367g fork), arrives at 6.40kg without pedals or bottle cages — below the UCI weight limit — drops the IsoSpeed decoupler in favor of a new OCLV carbon layup for vertical compliance, accepts up to 40mm of tire clearance, and standardizes on short cranks across the lineup, starting at $2,400 and topping out at $11,499. velo.outsideonline.com Aug 13, 2026
• Australia's Battery Boom Halved Wholesale Power Prices — More than 500,000 home batteries have been installed under Australia's one-year-old 30-percent government subsidy program, and Energy Minister Chris Bowen credits the rollout with cutting wholesale electricity prices by 47 percent over the past 12 months — Australia now has more residential batteries than the United States, a country with twelve times the population. e360.yale.edu Aug 14, 2026
• Kate Courtney Makes Her WorldTour Debut August 19 — Cyclingnews surveys six women's cycling storylines for the rest of 2026, one of which is Courtney's road transition: after winning two of three Belgian kermesses since signing with FDJ United-Suez through 2028 (bringing Red Bull sponsorship with her), the MTB world champion starts the Tour of Britain Women on August 19 alongside Lorena Wiebes and Lotte Kopecky — the article also notes that the 2027 Tour de France Femmes will open in north England and feature the first-ever women's team time trial, in London. cyclingnews.com Aug 14, 2026
• Firefox Is Now the Last Major Browser Running uBlock Origin — After Microsoft Edge followed Chrome in dropping Manifest V2 support, Firefox is the only remaining major browser that still runs uBlock Origin in full — neither Safari nor DuckDuckGo, the two other significant non-Chromium browsers, support the extension, leaving uBlock Origin users no option without compromise except Firefox. pcworld.com Aug 13, 2026
• Leadville 2026: Four Very Different Rigs — Velo's gear survey from the post-wildfire-rerouted Leadville 100 finds four radically divergent setups: Zach Calton on an unreleased Ventum prototype with 32-inch wheels, Paige Onweller on a sub-20-pound Trek Procaliber hardtail stripped of its dropper post and running a manual fork lockout, Caleb Swartz on a Mondraker Podium, and winter Olympian Anna Gibson on a Santa Cruz Blur she bought at full retail in 2021. velo.outsideonline.com Aug 14, 2026
• Custom Engines Still Win the Market — A detailed essay on building a game-specific engine makes a striking baseline argument: 13 percent of Steam games released in 2024 used custom engines, but those titles accounted for 43 percent of units sold; it also notes that Godot became the most-used engine in the 2026 Game Maker's Toolkit Game Jam, a shift the author traces directly to Unity's 2023 runtime-fee controversy. eliasfarhan.ch Aug 14, 2026
• Qwen3.8-27B: Gated DeltaNet Architecture, Top SWE-Bench Score — Qwen's new open-weight 27B model uses a hybrid layout — three Gated DeltaNet linear-attention blocks per one standard Gated Attention block across 64 layers — with 262K native context (extensible to 1M via YaRN), native vision-language support for images and hour-scale video, and thinking mode on by default with an adjustable `reasoning_effort` parameter; on SWE-bench Pro it scores 61.7 percent, leading all models in the comparison including Claude Opus 4.6 Max at 53.4 percent, and tops OSWorld computer-use benchmarks at 84.3 percent. huggingface.co Aug 14, 2026

↑ Back to top

THE QUESTION

The Load-Bearing Assumption

What a system doesn't put on the wire often does more structural work than what it does.

THE LAB today examines the 2004 RuneScape protocol — a design that fit a multiplayer game through 56k by encoding almost nothing explicitly. Both ends of the connection ran the same pathfinder over the same collision map, agreed at compile time that "idle" was the default state, and placed every player in a coordinate space recentered on the local observer. None of that understanding crossed the wire. It lived in the design, shared between two programs built together by people treating the network as an implementation detail of a single application. The author's summary: "Every economy in this protocol depends on both ends sharing knowledge that is never transmitted."¹

This is extraordinarily efficient, and it has a fuse. The efficiency lives in the assumption. The assumption is not in the spec.

As THE WORLD reports today, Sound Transit confirmed that West Seattle Link will open in 2035 — a decade past the 2030 date promised in the 2016 ST3 ballot measure and three years past the 2032 figure the board was still citing as late as May.² Transportation consultant Trevor Reed was direct about what happened: "The 2032 date being a fiction was knowable from publicly available materials. It is not credible this was unknown internally — why was it not disclosed before the May vote?"² Sound Transit CEO Dow Constantine, announcing the new target, called 2035 a "durable" date.²

What voters approved in 2016 was a number, and a promise attached to it. What neither the ballot measure nor the agency's subsequent communications made explicit were the assumptions on which that number rested: the cost of bridging the Duwamish River, right-of-way acquisition timelines, federal grant agreements that may never arrive under the current administration. Those assumptions were load-bearing. They didn't appear in the shared understanding between agency and voter because they were never surfaced as assumptions — they traveled as facts and revealed themselves as variables only later.

The RuneScape protocol worked because both sides were designed together, by the same team, with full knowledge of what the other end already knew. Sound Transit's implicit contract with voters ran the same structure — shared assumptions, unstated — but the two sides were not built together, and when the assumptions moved, one side found out years after the other.

As THE LONG READ reports today, Johns Hopkins cryptographer Matt Green makes a structurally similar observation about law enforcement's surveillance posture: for a decade, the FBI's practical workaround for encrypted communications depended on an assumption that was never written into any policy — that exploitable software bugs would always exist, available for purchase.³ AI is closing that gap faster than anyone planned for, and the operational posture built on that assumption will need to be rebuilt from scratch.

Three different systems, each running on something that wasn't in the spec. The question worth carrying today: in whatever you're building or counting on, which constraint is actually binding — and have you said it out loud, or is it just something both sides happen to know?

↑ Back to top