HN Daily | October 23, 2026

October 23, 2026 finds technology pulling in several directions at once: AI models are becoming faster and more capable, while the systems around them—from phones to certificates—are becoming more centralized and tightly governed. At the same time, curious developers keep rebuilding the stack from first principles, whether that means booting iOS on Android, writing a container runtime, or proving software correct.

AI & Machine Learning

1. Kimi K3.1 Pro and K3.1 Pro Highspeed — Kimi has fully rolled out its new 3T-parameter flagship models, offering a 1M-token context window, multimodal input, and thinking-only operation. The Highspeed version promises roughly 2–3× faster output, though at about twice the quota cost; the more interesting shift is how quickly very long-context coding models are becoming routine products.

2. Dessa: the most authentic full-duplex speech model ever built — Block is presenting Dessa as a highly natural, full-duplex speech system designed for genuinely conversational interaction rather than turn-based voice commands. The launch also raises the familiar but important question of how much personal and device data voice assistants will collect as they become more responsive.

3. The Rise and Fall of Jev — This skeptical essay examines the hype around Jev, a fast decision-oriented model positioned as something distinct from an LLM. Its central warning is useful: schema-conforming output and low hallucination rates are not the same as reasoning, correctness, or general intelligence.

4. LLMs are making formal software verification feasible at a much larger scale — Anthropic and Theorem used Claude to produce formal security proofs for more than 100 open-source libraries at the RISC-V assembly level. The work is not a proof that software is bug-free in every environment, but it suggests that AI may finally make verification practical beyond a handful of safety-critical projects.

Platforms, Privacy & Policy

1. Phone Is About to Stop Being Yours: 70 Days Until Lockdown — The Keep Android Open campaign warns that Google’s upcoming developer-verification system could require every Android app developer to register, pay, provide government ID, and associate applications with signing keys. The dispute is really about whether sideloading remains a meaningful property of Android once an operating-system update can silently reject software from unregistered developers.

2. Canadians are running out of time to oppose Bill C-22 — The EFF argues that Canada’s proposed Lawful Access Act would expand surveillance powers, require metadata retention, and potentially enable compelled backdoors. Encryption backdoors rarely stay neatly confined to “lawful” use, making this a security issue as much as a civil-liberties issue.

3. Now Google says it might use your Gmail and Google Photos data to target ads — Google’s updated privacy language appears to allow data from Gmail, Drive, and Photos to inform personalized ads when users connect those services to Search or Gemini features. The important detail is the exchange being offered: more useful AI personalization in return for making private context available to the advertising system.

4. Investor-owned utilities charge 23% more for electricity than public providers — An analysis of U.S. electricity prices finds that households served by investor-owned utilities paid an average of 17.8 cents per kilowatt-hour in 2025, compared with 14.5 cents at public utilities and 14.1 cents at co-ops. The interactive state-by-state comparison makes a complicated ownership question unusually concrete: infrastructure governance shows up directly on household bills.

Security & Trust

1. Today, we hacked what we'd set out to hack: the iPhone — A security team demonstrated a chain of iPhone compromises at Hexacon, including a one-click Signal attack and what it calls an Apple Persistent Threat. The technical details are still forthcoming, but the teaser is a reminder that mobile security depends on long exploit chains and that “walled garden” does not mean “unbreakable.”

2. eMudhra ignored Mozilla Root investigation deadline; blames social media — Mozilla’s investigation says private keys for eight eMudhra intermediate certificates were compromised because the key-generation process was trivially exploitable, prompting rapid distrust in Firefox. The case illustrates why browser root programs are effectively a global security institution—and why delays, incomplete responses, and poor incident handling matter far beyond one certificate authority.

3. eMudhra to exit global SSL/TLS certificate business — Following the certificate incident, eMudhra says it will withdraw from the global SSL/TLS business and help customers transition certificates through partners. Its claim that the business represents only about 1% of revenue is economically plausible, but the episode also shows how concentrated and unforgiving the public certificate ecosystem has become.

Open Source & Systems

1. Run full iOS 16.5 firmware on Android Devices — HackiOS boots Apple’s XNU kernel and unmodified iOS 16.5 user space on a POCO X5 Pro, with a QEMU target for ordinary Linux machines. It is a remarkable compatibility-layer project: not a practical phone ROM, but a research bench demonstrating how far open drivers, UEFI, emulation, and reverse engineering can go.

2. OpenShell – A safe, private runtime for fleets of autonomous AI agents — NVIDIA’s OpenShell provides isolated sandboxes, kernel-enforced policies, controlled credentials, and formal checks for permission changes before autonomous agents receive new access. As agents begin installing packages and calling APIs on their own, treating them as untrusted processes rather than trusted scripts is the sensible default.

3. A whirlwind tour of systemd-nspawn containers — This practical guide explores systemd-nspawn as a lightweight, writable-root container alternative to Docker, particularly useful on VPSs, for GPU access, and when full virtualization is unavailable. It is a good reminder that Linux containers are a collection of kernel primitives, not a single magical technology owned by any one tool.

4. Docker is weird — A developer building a container runtime from scratch discovers that containers are ordinary processes surrounded by namespaces, cgroups, networking machinery, and filesystem tricks. The article is valuable less as a Docker critique than as a compact lesson in how much abstraction hides beneath a command as simple as docker run.

5. UUIDv7 doesn't have the properties you think it does — UUIDv7 is often advertised as time-sortable, timestamp-bearing, and difficult to guess, but the RFC leaves implementations considerable freedom. Clock corrections, monotonicity counters, and implementation details can make embedded timestamps inaccurate or even race far into the future; uniqueness is the property developers should trust most.

Web & Developer Tools

1. Faster than earcut: triangulating 3.7M map polygons in 489 ms — The earstrip library replaces a constrained Delaunay approach with a carefully optimized ear-clipping triangulator for map polygons, processing 3.7 million polygons in under half a second in the reported benchmark. The lesson is wonderfully practical: algorithm choice should match the workload, and a simpler method can win when most real-world shapes are tiny or uncomplicated.

2. The foolishness of "natural language programming" (1978) — Edsger Dijkstra’s 1978 essay argues that formal notation is not an arbitrary burden but a tool for preventing ambiguity and nonsense. Read in the era of prompt-driven programming, it feels almost prophetic: natural language is convenient for expressing intent, but precision still has to come from somewhere.

3. The HTML-in-Canvas API origin trial — Chrome’s experimental API aims to combine canvas and WebGL/WebGPU performance with real HTML semantics, accessibility, text selection, browser search, and form controls. If it works as promised, complex 2D and 3D applications will no longer need to choose between a rich DOM interface and a fast but opaque pixel surface.

Local & Civic Technology

1. Local Wikipedia: Wikipedia, but only for things a half hour walk from you — Local Wikipedia filters geocoded Wikipedia pages to show points of interest within roughly a half-hour walk, keeping location data in the browser rather than embedding it in shared links. It is a small, elegant example of geographic computing that makes a huge reference work feel useful at neighborhood scale.

Closing thought

The common thread today is control: who controls the software on your phone, the data behind your assistant, the certificates trusted by your browser, and the permissions granted to your agents. The best counterweight remains the same—transparent systems, portable tools, and enough technical understanding to question the defaults.