THE LAB

The Tab Was Muted. AliExpress's Audio Fingerprint Wasn't.

↩ Developing story — first reported Jun 19 · previously Jun 20, Jul 03, Jul 04

Opening an AliExpress tab in Firefox broke Bluetooth multipoint audio — the phone fell silent, nothing audible played on the PC, and muting the tab changed nothing. Closing the tab fixed it immediately. That last part — mute failing — turned out to be the diagnostic.

An engineer documented the investigation on their blog. The usual suspects came up empty: no <audio> or <video> elements, no HTMLMediaElement.play() calls, no active Media Session state, no media network requests. The problem appeared only after the page had been idle several seconds, ruling out inline autoplay. Wrapping the AudioContext constructor to log every instantiation caught the culprit: the AliExpress homepage creates two running AudioContext objects, both connected to AudioContext.destination, originating from heavily obfuscated scripts under Alibaba's AWSC anti-abuse bundle: collina.js and fireyejs.js.¹

Both scripts build the same signal chain — sawtooth oscillator → AnalyserNode → ScriptProcessorNode → GainNode (gain set to zero) → destination — and read frequency data from the analyser after the browser's audio stack has processed it. The zero-gain node is why the user hears nothing. The connection to destination is why it still matters. Browsers actively process any graph wired to the system audio endpoint regardless of output volume, and that processing is enough to hold the Bluetooth audio path open, preventing multipoint headphones from switching back to the phone. Tab mute does nothing because there is no media element — only a live audio-processing graph that the browser's mute control has no handle on.

The audio measurement is one signal in a comprehensive device fingerprint. The AWSC scripts also query canvas rendering output, WebGL renderer info, extensions and shader precision, screen and viewport dimensions, device pixel ratio, hardware concurrency, device memory, installed plugins, supported audio and video formats, WebRTC behavior, performance timing, mouse and touch interaction, device motion sensors, and properties associated with browser automation. Results are serialized, encrypted, and transmitted to Alibaba telemetry endpoints via fetch() or sendBeacon(). The anti-fraud rationale is real — fingerprints outlast cleared cookies, and behavioral signals help distinguish automated purchasing from legitimate traffic. But running a comprehensive sensor sweep on the general shopping homepage, via deliberately unreadable code, before any sensitive user action, with a concrete hardware side effect that the browser's own controls cannot stop — that is a different thing from fraud prevention. The author provides narrow uBlock Origin rules targeting the two AWSC script paths, scoped to aliexpress.com, though blocking anti-fraud scripts may produce extra CAPTCHAs at login and checkout.¹

Tim Sweeney spoke at Unreal Fest Seoul today in a roundtable with local media — the thread's first substantive UE6 update since it went dormant in early July. The headline figure is Early Access targeting late 2027, roughly 18 months out.² Sweeney described UE6's core architectural additions around cross-game digital ownership: items and outfits moving between titles without platform friction, with Verse as the scripting layer and Epic Online Services as the runtime glue for standalone games that want to participate in the open ecosystem. On AI tooling, Sweeney said Epic is in discussions with Claude, Gemini, and graph models to support Verse-based development, and that voice and 3D modeling are the near-term targets because they don't require billion-parameter models — an implicit invitation to smaller Korean AI shops. The anti-Apple posture was unchanged: iOS third-party stores remain blocked in Korea even as Japan allows them, and Apple charges a 15% fee on those stores and their payment systems. Sweeney called Apple's practice of collecting fees on transactions it has no direct involvement in "truly bizarre." UE6 general availability remains unscheduled; late 2027 for Early Access was the only concrete date offered.

Simon Willison tasked Claude Fable 5 running in Claude Code for web with evaluating smolmachines as a sandboxed runtime for untrusted Python and JavaScript. The model hit a hard constraint immediately: the Claude Code container is itself a Firecracker guest with no /dev/kvm and no virtualization CPU flags, so smolvm machine run failed as expected. Rather than stopping, the model identified that GitHub Actions ubuntu runners expose /dev/kvm, wrote a temporary test-runner workflow, committed it to a branch, ran the full test battery on the Actions runner, collected logs, then cleaned up the workflow in the final commit.³ The writeup, posted Aug 19, frames it as a clean example of the model being "relentlessly proactive" within environmental constraints rather than failing closed.

The Go team shipped 1.27 on Aug 19 with three language changes: generic methods (type parameters on receiver methods, not just free functions), direct initialization of fields in nested and embedded struct literals using their selector name, and generalized function type inference that now applies in composite literals, type conversions, and channel sends.⁴ The go fix tool gains four new modernizers; go doc accepts package@version queries.

Trending today: GitHub is saturated with AI agent harnesses, CLAUDE.md skill collections, and LLM wrapper forks — the one technical outlier is AprilNEA/OpenLogi, a native macOS Logitech Options+ replacement in Rust that speaks HID++ directly with no account or telemetry.

↑ Back to top

THE PELOTON

Three Races Start; Vaughters Tells the BBC This Is Preventable

↩ Developing story — first reported Jun 20 · previously Aug 17, Aug 18, Aug 19

Three races opened across Belgium, Germany, and Britain on Wednesday, each setting its own week in motion with three days until the Vuelta a España lights up the Monaco seafront.

The Renewi Tour's first stage compressed into exactly the kind of photo finish the race's flat, Benelux parcours tends to produce. Crosswinds and echelons threatened to splinter the peloton through the middle passages, but the sprint trains absorbed everything in the final kilometers and drove around 105 riders to the line in the same time. The stage came down to millimeters.¹

In Nuremberg, the Deutschland Tour prologue covered the top three in five seconds. UAE Team Emirates-XRG set the early pace — Isaac del Toro, who supported Pogačar through the Tour de France's GC stages this summer, clocked 3:08, with Soudal-QuickStep stacking two riders just behind him.² UAE lines up in Monaco on Saturday as the Vuelta's dominant force; a prologue won to the hundredth of a second is the kind of thing the team files quietly.

The Tour of Britain Women opened in Lancashire under different terms. SD Worx-Protime positioned five riders in the 32-rider reduced peloton that survived a day of narrow roads and progressive selection — their sprint specialist, two GC threats (Lotte Kopecky and Mischa Bredewold), and two more capable of disrupting any breakaway. Sport director Christian Kos explained the team's patience: "Once a strong group had gone clear and we had the right riders in there, we waited for quite a long time to see whether or not the stage could be decided from a breakaway. When it became clear that this wouldn't be the case, we made the decision to keep the race together." Chiara Consonni (Canyon-SRAM) acknowledged afterward that SD Worx "can plan different things, not only the sprint."³ Stage 2 heads to Blackpool.

In France, Ewen Costiou rode clear solo on Tour du Limousin stage 2.

The Vuelta starts Saturday in Monaco. As this paper reported Tuesday, Red Bull–BORA–hansgrohe has named stage wins — not GC — as Roglič's target, and UAE arrives as the race's undisputed centerpiece. What Thursday brought was the arithmetic.

Philippa York's pre-race analysis for Cyclingnews put a number to what the peloton privately suspects: if Pogačar decides to press, second place at the finish in Granada on September 13 could arrive roughly 10 minutes down.⁵ She was careful to flag why total domination is unlikely — Pogačar still has the Worlds in Montréal and Il Lombardia ahead, reasons to manage his effort — but her structural argument was harder to dismiss. João Almeida and Jay Vine arrive at the Vuelta fresh, with no Grand Tour in their legs this season, "super motivated to impress everyone," in York's words. Both would be outright leaders at any other team in the race. Their presence absorbs podium duties and media obligations from Pogačar, making a controlled performance easier to execute, not harder. For the rest of the GC field, the question is not whether to follow Pogačar but when to start racing each other for what remains.

The route provides the stage. Race director Javier Guillén has written 58,156 meters of climbing into 21 stages — seven summit finishes, 51 categorized climbs, and a final block planted entirely in Andalucía where heat can push into the mid-30s Celsius and beyond.⁶ The queen stage (Stage 20) ends atop the Collado del Alguacil, 8.3km averaging 9.8%, a summit the Vuelta has not used before. ProCyclingStats data puts the race's recent average at 2,649 vertical meters per stage, against 2,426 at the Tour de France. Guillén called it one of the toughest editions in the race's history, which is not a claim he made lightly.

While the peloton assembles in Monaco, Pogačar's agent Alex Carera confirmed to Velo that contract extension talks are underway.⁷ His current deal runs through 2030, when he will be 32. No new agreement has been signed; no term length decided. Further talks are expected in Monaco in the coming days — the race's start city, where the team will be in any case. Del Toro recently extended through 2031. UAE is planning for the long term.

Jonathan Vaughters spoke to the BBC on Wednesday to say what teams have been thinking since Finlay Tarling was killed by a car during the Volta a Portugal last week: this is preventable, and the UCI is the one who needs to fix it. "What I'm really not enjoying is this sentiment that's coming from very powerful people in cycling, that says: 'What can you do? Sometimes cars just end up on the road,'" said the EF Education-EasyPost CEO. "That is not true."

Vaughters named rolling enclosures — standard practice at smaller events like the Volta a Portugal, both Tours of Britain, and many 2.1-ranked races — as the structural failure. Full closures seal the route; rolling enclosures move a safety bubble with the race. When the peloton fragments into groups, T-junctions can open. A car moving at 100kph into a group still racing at 50kph creates a closing speed of 150kph. The economics compound the problem: teams chasing UCI ranking points feel pressure to race at events that cannot afford the safety infrastructure those points implicitly require. "If you are forcing teams to fight for ranking points at this event then you damn well better make sure the event is up to standard," he said. His proposed remedy was structural: cut UCI-sanctioned race days from roughly 700 to 100.⁴

The interview ran the same morning news came from Tennessee. Two Milligan University student cyclists — Haylan Engdahl and Brayden Rogers, both sophomores — were killed and seven others injured when a driver struck their 11-rider training group on a rural stretch of Highway 19 in Hampton.⁸ Driver John Benfield, 69, was charged with two counts of vehicular homicide and five counts of aggravated assault. Milligan's men's squad had won the collegiate national championships team time trial earlier this summer. The crash falls entirely outside UCI jurisdiction. Vaughters' argument doesn't need it to.

↑ Back to top

THE WORLD

US Debt Hits $40 Trillion; Wilson Recall Hearing Set for Aug. 31

↩ Developing story — first reported Aug 13 · previously Aug 17

• US debt crosses $40 trillion — The national debt crossed the $40 trillion mark this week, a new milestone for federal borrowing. KIRO 7
• Pennsylvania mid-air collision — A pilot was killed and two others injured Wednesday when a plane struck a Pennsylvania State Police helicopter. KIRO 7

• Wilson recall hearing confirmed for Aug. 31 — As this paper reported Aug. 17, Mayor Katie Wilson faces a recall petition alleging dereliction of duty; she spoke publicly Wednesday: "That is a legal process that will be playing out." King County Superior Court Judge Patrick Oishi will hold the hearing Aug. 31 to determine whether the petition meets the legal threshold for signature collection — petitioners would need roughly 70,000 signatures if it clears. KIRO 7
• Renton bans new data centers for a year — Renton City Council voted unanimously Monday to impose a one-year moratorium on new large data center construction, citing power and water demands — a single modern AI data center can consume as much as 100,000 homes' worth of electricity and 300,000 gallons of water per day per the World Resources Institute. Renton joins Seattle, Federal Way, Spokane, and several other Washington cities with similar bans now in effect. Issaquah Reporter
• Thunderstorms and fire-start risk Saturday — KIRO 7 has issued a Pinpoint Alert for Saturday: fast-moving storms producing dry lightning could trigger new fire starts across the already-parched landscape, with risk extending from the mountains into some lowland areas. Thursday and Friday remain clear; storm activity may linger in the North Cascades through Sunday morning. KIRO 7
• Grove of Patriarchs bridge — coming in 2029 — The National Park Service is designing a new 215-foot suspension bridge at Mt. Rainier's Grove of the Patriarchs to replace one removed after 2021 flood damage, elevated 30 to 35 feet above the riverbed for flood resilience. Construction is planned to begin in 2028, with a projected 2029 reopening; public open house is Aug. 26 in Packwood. Issaquah Reporter

ON THE TRAIL

• Hold Saturday Cascades plans — Dry lightning and fast-moving thunderstorms forecast Saturday across Washington; KIRO 7 calls it a Pinpoint Alert Day with high fire-start risk. Thursday and Friday are the clean windows this week; storms could linger Sunday morning in the North Cascades.
• PCT closed Snoqualmie to Stevens Pass; smoke limits Cascade views — Wildfire closures are forcing PCT thru-hikers onto road alternates between Snoqualmie Pass and Stevens Pass; hikers on Tonga Ridge Wednesday passed four thru-hikers walking the detour rather than hitching. Multiple Mountain Loop Highway and Snoqualmie Pass reports note haze and smoke-limited summit views; the Olympic Peninsula (Marmot Pass, Hood Canal) is getting traffic from hikers escaping Cascade smoke.
• Berries ripe, trails in good shape — Blueberries and huckleberries are peaking at Three Fingers, Gothic Basin, Mount Dickerman, and the Kaleetan/Melakwa area. The Melakwa Lake trail is crew-maintained and in good condition; Chair Peak Lake area air quality was rated excellent midweek.

↑ Back to top

THE LONG READ

The Glue Code Was Always the Problem: How LLMs Change the Case for Extensible Software

The reason most web software doesn't have a plugin system isn't that developers don't want one. It's that the glue code — the logic a user needs to connect two systems, customize a behavior, or automate a workflow — has always been the hard part. Writing it requires a developer. Debugging it requires a developer. Maintaining it requires a developer. For most products serving most users, that math never made sense.

Jeremy Morrell, a Cloudflare engineer, published a piece Tuesday arguing that LLMs change that math. Not because they make plugin architectures technically easier to build — the host-side work remains substantial — but because they finally solve the authorship problem on the user side. If a non-programmer can describe what they want and a model can extrude working code in seconds, the long tail of unmet user needs becomes addressable in a way it simply wasn't before. "Your users have suddenly acquired the ability to speak code into existence," Morrell writes. "Most existing software can't leverage this."¹

It's a clean thesis, and the piece earns it through the details. Morrell's diagnosis of why extensibility has been hard on the web is more precise than most takes on the subject. Local software — game mods, IDE plugins, Obsidian extensions — achieves real extensibility because the stakes are bounded. The user trusts the software enough to let it run arbitrary code on their machine. Obsidian's plugin model can do basically anything, and Morrell acknowledges this is probably the right tradeoff for a notes app with a self-selected technical audience. But the moment you want that same extensibility in software holding other people's data — customer records, financial transactions, private messages — the trust model collapses.

The technical bulk of the piece is a survey of what a viable isolation primitive needs to do: economical cold starts (single-digit milliseconds if the extension sits on the critical path), hard resource limits, genuine security isolation including protection against Spectre-class speculative execution attacks, and a controlled capability surface. That last requirement is the most interesting. Morrell makes a strong case against the standard approach of handing untrusted code an API key and filtering its requests in a proxy layer. The problem is that you're starting with full access and trying to restrict it, and "keeping that up-to-date as the backing API evolves" quickly produces proxy logic that's impossible to test comprehensively.

His preferred alternative is the object-capability model: instead of handing the extension a credential, you hand it a narrow function reference. The extension receives getApprovedEmail() — not an email API key. It can call that function; it cannot do anything else with the underlying credential because the credential is never exposed. No ambient I/O means no exfiltration path. The code can only take actions via the references it's been passed.¹ This is strictly easier to reason about, and as Morrell notes, generating code against a TypeScript capability definition is also more token-efficient for the LLM writing the extension than handing it an OpenAPI spec.¹

The most surprising section is the Salesforce case study. Salesforce has been running user-supplied code in multi-tenant isolation since 2007 — before AWS EC2 was a year old.¹ They built a custom compiler, a Java-adjacent language called Apex, a runtime, a debugger, integrated SQL, and an entire educational ecosystem around it, because they had no better options and the problem was real enough to justify the investment. Morrell's point is not that anyone should copy Salesforce's architecture. It's that the feasibility question was settled nearly two decades ago; the only question is which 2026 primitives fit the job better than a bespoke compiler did in 2006. He surveys the options — embedded interpreters like QuickJS or Lua, V8 isolates, microVMs, WASM+WASI — with enough technical specificity to actually be useful, then makes the unsurprising pivot to Cloudflare's Dynamic Workers.

The Cloudflare plug is the piece's genuine weakness, and Morrell is at least upfront about it: he discloses his employer and notes that his exposure to Cloudflare's design thinking has shaped his views. The Dynamic Workers section reads accordingly — it's accurate, but it's also marketing. The architectural arguments that precede it stand on their own; whether Dynamic Workers are specifically the right implementation is a separate question the piece can't answer without conflict.

What the piece does well, and what makes it worth reading even for skeptics of the conclusion, is the problem framing. Web software has been stuck in a particular design assumption: you build features for the top of the demand curve, you accept that the long tail goes unserved, and you add webhooks as a concession to power users who want to wire things together themselves. Webhooks are a high bar — they require operating a separate service, handling delivery failures, and writing the integration logic that nobody wanted to write in the first place. LLMs don't make platform-building easy. The host-side work — isolation primitives, capability design, observability, multi-tenant data storage — remains hard, and Morrell doesn't pretend otherwise. But the user-side barrier, the one that kept most of the web's potential plugin ecosystems from ever shipping, now looks much lower than it did. That's a real structural shift, and the piece makes a credible case that software design hasn't caught up with it yet.

↑ Back to top

FROM THE ARCHIVE

The Signal Is Still Coming In: August 20, 1977

Forty-nine years ago today, Voyager 2 lifted off from Cape Canaveral. Over the next twelve years it made close observations of Jupiter (1979), Saturn (1981), Uranus (1986), and Neptune (1989) — a sequence no other spacecraft has matched.¹ It remains the only human-made object ever to visit all four outer planets.

Then it kept going. In 2026, Voyager 2 is in interstellar space, 49 years into a journey that had no defined endpoint. It is still transmitting.² The signal is still arriving.

↑ Back to top

THE FUNNIES

The Most Expensive Voicemail; I Just Wanted Socks

*After Pearls Before Swine* — on Voyager 2 turning 49 today and still transmitting from interstellar space, where every reply takes twenty hours. *After Bloom County* — on the AliExpress tab you muted that wasn't really muted, and the silent audio graph inside it that held your Bluetooth headphones hostage.

↑ Back to top

ALSO NOTED

Also Noted

• Tacoma's Soundview Little League wins LLWS opener — The all-volunteer Tacoma squad defeated Phenix City, Ala., 2-0 in its first-ever Little League World Series appearance; Washington last won the championship when Kirkland took the 1982 title, and Soundview plays the Southwest region this Friday. kiro7.com Aug 20, 2026
• Alaska quake could push a tsunami all the way into Puget Sound — A new Washington state model based on a 9.2-magnitude Aleutian earthquake projects two-foot water rises in Seattle, four feet in Olympia, and up to 24 feet at Westport, with a roughly 3.5-hour warning window before the first waves reach the coast. kiro7.com Aug 20, 2026
• Rondo is back, with its original team — Polish manufacturer Storm Riders has acquired Rondo, NS Bikes, and Crème from 7ANNA's bankruptcy, keeping founder Szymon Koblinski and the original design and engineering team while moving production in-house, ending the supplier delays that helped sink the parent company. bikeradar.com Aug 20, 2026
• AI could design novel doping agents faster than detection catches up — A Science & Cycling conference presentation warned that the same generative AI chemistry platforms that produced the first AI-designed drug in human trials last year could accelerate performance-enhancing compounds that the biological passport hasn't yet seen, while digital twins — already in use at Ineos Grenadiers — could theoretically personalize doping to minimize detectable impact. cyclingnews.com Aug 19, 2026
• Cerebras CS-4 ships with an overclocked WSE-3 Turbo — Rather than a new wafer design, the CS-4's Nexus rack houses three WSE-3 Turbo backpacks running at roughly double the original 1.4 GHz clock for 2× throughput, with compute, power, and networking modules independently upgradeable; early access is open now with general availability expected in Q3. nextplatform.com Aug 19, 2026

↑ Back to top

THE QUESTION

The Certificate Doesn't Expire When the Use Case Does

The question today's edition keeps raising, in different vocabularies, is about what protection mechanisms are actually certified to cover.

As THE PELOTON reports, Vaughters made the case explicitly after a second fatal crash put the UCI's safety framework back under pressure: rolling enclosures — the lower-cost alternative to full road closures — weren't designed for pelotons that fragment into groups.¹ The CPA spent two years raising the gap inside UCI working structures. The mechanism was in place. It simply didn't cover the actual use case.

THE LAB's lead story is a different rendering of the same problem. The browser's mute control was designed for media elements. An AudioContext graph wired to the system audio endpoint isn't a media element — it's a processing pipeline the browser sustains regardless of what the mute icon shows, and that the browser's own controls have no handle on.² The gap between what the control covers and what the threat looks like was invisible until Bluetooth audio stopped switching.

The structural question is this: certification tests a mechanism against known scenarios. When the scenario changes — faster racing speeds, a different audio architecture — the mechanism remains certified. The certificate doesn't expire when the use case does. And the options available are the same in both cases: a workaround that doesn't touch the underlying design (a uBlock rule scoped to two script paths;² a proposal to cut UCI-sanctioned race days from 700 to 100),¹ or sustained advocacy inside an institution that had no mechanism to act on the gap until the failure made it visible. Vaughters' deeper argument is that fixing the standard without fixing the economics is treating the symptom — teams chase ranking points at underfunded events because the points system requires it, and the points system doesn't ask whether the event can afford to close its roads. The anti-fraud rationale for the browser fingerprinting is equally real; the question isn't whether the mechanism exists, but whether it should be running on a general shopping page, through deliberately unreadable code, causing a hardware side effect users cannot stop. Both arguments point at the same thing: a protection mechanism adequate for the scenario it was certified against, operating in a scenario it wasn't.

↑ Back to top