--- title: "Daily Brief" canonical: "https://current.tinyfish.ai/issue/9/daily-brief" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/9/daily-brief" issue: 9 section: "daily-brief" description: "Your daily digest of web developments through the lens of enterprise agent deployment" authors: ["Sable Whitford"] published: 2025-12-29 updated: 2026-11-05 articles: 23 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 9 — Daily Brief Your daily digest of web developments through the lens of enterprise agent deployment ### The Accounts You Locked Were the Ones That Opened: Meet \*sshole - [The Accounts You Locked Were the Ones That Opened: Meet \*sshole]() — By [Sable Whitford]() · Published 2026-11-05 OpenSSH and Alpine Linux **shipped fixes today** for `*sshole`, a decade-old bug that let any password between 257 and 1024 bytes log in on Linux boxes running musl libc without PAM. Locked accounts get a `*` in `/etc/shadow`. musl's `crypt()` also returns `*` when it chokes on a password. OpenSSH compared the two, saw a match, and let you in. The bug was reported Wednesday and patched **this Thursday** with no embargo, because maintainer Damien Miller says AI agents now rediscover bugs within hours. Upgrading alone won't protect you. You still have to restart sshd. ### The coding-agent land grab Morning. Before the cards, a little history on the pipes AI coding runs through, because the pipes are suddenly hot property. - Linus Torvalds wrote Git in 2005 after the Linux kernel lost free access to its old version-control tool. Within days, Git was hosting its own source. It was designed for humans typing commits. Fleets of agents branching in parallel weren't on anyone's mind. - GitHub launched in 2008, and Microsoft paid $7.5 billion for it in 2018. A huge share of the world's code review still flows through it. - Writing code got cheap. Reviewing it, merging it, deploying it and keeping it alive at 3 AM are still slow and expensive, and the money has noticed. So the unglamorous layers are where the fight is. Plumbing nerds, this one's for you. Grab a coffee. - **OpenAI buys the Git plumbing under Codex** — [Source]() — Published 2026-11-05 Tag: Acquisition OpenAI is acquiring Pierre Computer Company, maker of Git-based distributed storage "with API ergonomics designed for machines." Pierre's open-source Trees and Diffs libraries already run file browsing and change review in Codex, and they stay open source. Terms undisclosed. It follows Pando, OpenAI's in-house source-control backend, which reportedly cut deploy latency about 80%. Coverage is calling this a GitHub challenger. OpenAI hasn't said so. - **Meta buys Conductor, users get eviction notice** — [Source]() — Published 2026-11-05 Tag: Wind-down Same day, different buyer: Meta picked up Conductor, the app for running several coding agents at once. Sign-ups and downloads are frozen and the cloud side is winding down. Cloud data deletion starts November 20, so export what you care about now. CEO Charlie Holtz promises something new early next year. Meta hasn't said whether existing integrations survive. - **GitHub picks a terrible day to wobble** — [Source]() — Published 2026-11-05 Tag: Outage From 09:49 UTC Wednesday, Git operations, Issues and pull requests degraded, then Actions and the API joined in. Mitigated around 11:30, resolved by 11:50, with a few more Actions hiccups later on. All of it landed the same day OpenAI bought a Git storage company built for agents. Rough optics. Rougher pager. - **Revolut swaps Claude Code for self-hosted GLM** — [Source]() — Published 2026-11-05 Tag: Cheap wins About 2,000 Revolut engineers now default to a self-hosted Z.ai GLM model: open weights, Revolut's own US servers, roughly 56 Nvidia B200s, about $0.30 per million tokens, around a tenth of the old bill. Claude Code and Codex stay for the hardest work, and Gemini gets images. Revolut reports 70% better lead time and 60% better coding time. AI ops head David Abitbol says the bottleneck "is not necessarily coding." Cheap and good enough is winning fans, and people are loudly arguing over the stigma around Chinese open weights. ### Security and the strained web - **Rent-a-proxy, now exiting from the White House** — [Source]() — Published 2026-11-05 Tag: Weird networking Layer3 Intel saw residential proxy traffic exit from AS2650, the Executive Office of the President's network, 236 times in a 30-day window ending Tuesday. That was 6 addresses, on 26 of the 30 days, across 28 proxy services. Layer3 wasn't hunting for it. The addresses just turned up in rotation. The pattern looks like someone's everyday device rather than guest Wi-Fi. No breach is shown and the device is unidentified. Sentient, via Cybernews, suspects Rave.io, an app bundling 12 proxy SDKs. The White House hasn't commented. - **CISA flags an actively exploited WordPress flaw** — [Source]() — Published 2026-11-05 Tag: Patch now CISA added a WordPress Core vulnerability to its Known Exploited Vulnerabilities catalog, so attackers are already using it. Details are thin. Do the boring thing: update WordPress, check that auto-updates actually ran, and poke whoever supposedly "owns" the marketing site. - **Bot swarms are knocking university libraries offline** — [Source]() — Published 2026-11-05 Tag: Scraper fatigue Data-hungry bot swarms are hitting university library websites hard enough to crash them. Sites built for students and researchers are soaking up crawler traffic that will never borrow a single book. Toss it on the scraper-fatigue pile, which keeps getting taller. - **Does Gemini train on paid chats?** — [Source]() — Published 2026-11-05 Tag: Privacy gripe A complaint making the rounds says Gemini trains on chat history even for paying subscribers. It's an unconfirmed claim that people are arguing about loudly. Either way, it's a decent excuse to go poke at your own settings. ### Chips, models and the AI buildout - **Nvidia's AI laptop: unplug it to go faster** — [Source]() — Published 2026-11-05 Tag: Linux pain On RTX Spark laptops running GPT-OSS-120B, Windows and WSL hit about 65 tokens per second. Native Linux managed 13.9, roughly 79% slower. Pull the power cord and Linux climbs back to about 61–67. MindStudio blames a Windows-only firmware component with an encrypted power table Linux can't decrypt. That's one study, and Nvidia hasn't confirmed it. Battery mode as a performance feature. Wild. - **AMD expects to outsell Intel, a first** — [Source]() — Published 2026-11-05 Tag: Chip wars Per Tom's Hardware, AMD expects to outsell Intel in Q4 for the first time ever. That's a forecast, so wait for the final count. Still, anyone who remembers AMD as the perennial underdog gets to enjoy that sentence. - **Data centers get voted down, town after town** — [Source]() — Published 2026-11-05 Tag: Midterms Data centers had a bad night in Tuesday's midterms. Bloomberg headlines say only one town out of dozens voted in favor of them, and AI Weekly counts bans or restrictions passing in at least 14 Ohio municipalities. Wall Street read the night its own way: Bloomberg reports Big Tech rallied as the results reshaped the AI spending outlook. - **Baidu ships ERNIE 5.5 Flash Base** — [Source]() — Published 2026-11-05 Tag: Model drop Baidu released ERNIE 5.5 Flash Base. For now there's a release page and not much else, so no specs to argue about yet. It lands on a day when Chinese models were already the talk of engineering teams. ### Culture, hot takes and fun finds - **OccupySaaS: laid-off engineers clone everything** — [Source]() — Published 2026-11-05 Tag: Revenge builds Under the OccupySaaS banner, laid-off engineers are using AI to build open-source alternatives to, well, everything. Auth0 and Salesforce clones are in the works. Free time plus a code generator turns out to be a hell of a combination. - **AI is calling in 40 years of tech debt** — [Source]() — Published 2026-11-05 Tag: Hot take An IEEE piece argues AI is forcing organizations to finally pay off four decades of technical debt. The headline alone had people glancing nervously at the oldest box in their stack, the one nobody is allowed to reboot. "We'll fix it later" apparently had a due date. - **A detective game where every suspect lies** — [Source]() — Published 2026-11-05 Tag: Play this Uncracked City casts LLMs as your suspects, and they lie to you, on purpose this time. You interrogate them, cross-check their stories and catch the contradictions. A model making things up is the whole point here, and it's suspiciously good practice for reading AI output at work. - **Stringman: a room-sized robot gripper, $800** — [Source]() — Published 2026-11-05 Tag: Open hardware Stringman is an open-source robot gripper that works across an entire room, for about $800. That's roughly used-bike money, which puts room-scale robotics within reach of anyone with a free weekend and a garage. Expect weekend projects. - **MCP Explained, for when the acronym blurs** — [Source]() — Published 2026-11-05 Tag: Bookmark it MCP Explained is a standalone site that walks through Model Context Protocol, the standard for hooking AI models up to tools and data. Bookmark it for the next meeting where someone says "just wire it up with MCP" and the whole room nods like they know. - **Download your favourite YouTube videos. Seriously.** — [Source]() — Published 2026-11-05 Tag: Keep a copy A warm little essay makes the case for keeping local copies of the YouTube videos you love, because channels vanish and links rot. Ops people will agree on sight: if it matters and there's no backup, you're only borrowing it. ### Favorite Featured Stories - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Faria Huq and the Reason Behind a Human Step]() — Published 2026-10-30 When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. ## Other sections in Issue 9 - [Market Pulse]() - [Foundations]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()