|
Friday morning, and the ceasefire is holding the way a paper bag holds water — technically intact, visibly leaking.
The Islamabad talks begin today, and the gap between what each side considers a starting position remains enormous. Iran's ten-point list includes retaining enrichment rights, lifting all U.S. sanctions, and formalizing its control over the Strait of Hormuz. Mediators say Tehran has softened some positions — on troop withdrawal, reparations, the enrichment language — but the architecture of the demand is unchanged: Iran believes it won, and is negotiating accordingly. The Gulf states agree with that assessment, which is the problem. Mohammed Baharoon, who runs the B'huth think tank in Dubai, put it flatly: "We woke up to a deal that doesn't reduce the risk, but instead replaces it with a bigger risk." Bahrain, Kuwait, Saudi Arabia, and the UAE all reported continued Iranian missile and drone strikes after the ceasefire was announced, which remains a strange way to observe one.
The White House is insisting otherwise. Karoline Leavitt called the five-week operation a "military triumph." Pete Hegseth said the military achieved "every single objective, on plan, on schedule." But inside the administration, the confidence is thinner than the podium language suggests. More than half of Iran's missile launchers have been destroyed, but a substantial number remain buried deep underground. The IRGC retains dozens of small boats capable of threatening ships in the strait, even after strikes sank over 90% of the regular navy. Senior aides have warned Trump that Iran is unlikely to reopen the strait without significant concessions he's unlikely to grant — a formula for resumed fighting. One analyst at the Foundation for Defense of Democracies described it as "a variant of the 'd' word: Iran has certainly been defanged, the regime's capabilities have been degraded, but there's a smaller group of things that have been fully destroyed."
The physical oil market hasn't gotten the ceasefire memo. U.S. crude futures bounced back to nearly $98 a barrel Thursday after Tuesday's relief selloff. But that number understates what's actually happening: spot prices for real-world crude shipments reached as high as $145 a barrel Wednesday, because refiners are scrambling to lock in supplies that still aren't flowing through the strait in any meaningful volume. Average U.S. gas hit $4.17 a gallon Thursday, up from $2.98 the day before the war began. California diesel: $7.75. Even if the strait reopens fully, gas station operators tend to lower prices gradually after a shock — they're selling expensive inventory and rebuilding margins. The phrase analysts keep using is "sticky on the way down." Delta, which owns a Pennsylvania refinery it bought for $150 million in 2012, expects that asset to boost second-quarter earnings by $300 million. Every other major U.S. airline is just absorbing the hit.
The White House is also exploring punishment for NATO allies it considers unhelpful during the war. The proposal would move U.S. troops out of countries deemed uncooperative and station them in friendlier ones — a reshuffling that falls short of withdrawal but signals the same impulse. Spain blocked U.S. planes from its airspace. Germany's officials criticized the war publicly, even as Ramstein served as a drone operations hub. Italy briefly blocked access to a Sicilian air base. Trump wrote Wednesday evening that "NATO wasn't there when we needed them, and they won't be there if we need them again." NATO Secretary-General Rutte traveled to Washington for what Leavitt described as a "frank and candid conversation," which is diplomatic shorthand for an unpleasant one.
Meanwhile, Russia tested what the war's distraction might allow. Britain revealed Thursday that its navy tracked three Russian submarines for a month in the North Atlantic — one acting as a decoy while two specialist vessels from Russia's deep-sea military unit lurked over critical undersea pipelines and cables. Defense Secretary Healey said no damage was done but warned of "serious consequences" for future attempts. The submarines belong to the same Kremlin directorate whose spy ship, the Yantar, was chased from British waters last year. Moscow is probing while attention is elsewhere, which is exactly what the Gulf states feared when the ceasefire was announced and exactly what Joe Kent's resignation letter warned about three weeks ago.
The domestic economy continues to absorb pressure from several directions at once. U.S. fertility hit a record low in 2025 — 1.57 births per woman, well below replacement. For the first time, birthrates for women in their late 30s exceeded those for women in their early 20s. The labor force participation rate is already at its lowest since 1977 outside the pandemic; a population that isn't replacing itself will make that structural problem permanent without immigration, which is moving in the opposite direction. HOA fees are up 29% since 2019. The median condo fee is now $420 a month, and three million households pay more than $500. Insurance, labor, materials — everything that goes into maintaining shared spaces costs more, and none of it is cyclical.
Small private colleges are dying. Enrollment at 442 of the nation's 1,700 private nonprofits puts them at significant risk of closing or merging within a decade. St. Michael's College in Vermont — enrollment down 45%, bond rating cut to junk, tenured biology professors doubling as groundskeepers to cut back invasive shrubs — is the kind of institution that survived the Depression but may not survive the demographic cliff. The consolidation is producing a winner-take-all market: Ivy League schools and flagship publics with sports programs and research funding are thriving. Everyone else is discounting tuition and selling property.
The insurance sector drew another warning. A.M. Best plans to publish a report Friday finding that annuity portfolios hold more risky debt than they did in 2007, with a slightly smaller financial cushion. The $1 trillion in private-credit investments sitting in insurer portfolios — the same ones Treasury started meeting with state commissioners about — are now being measured against pre-crisis benchmarks and coming up short. BlackRock, notably, is weathering the private-credit storm better than peers precisely because most of its business is still in public markets. Its stock is down 6.4% this year; Blackstone, KKR, Apollo, Ares, and Blue Owl have dropped an average of 31%. The lesson the market is drawing is that the firms most exposed to the asset class that was supposed to be the future are the ones most vulnerable to the present.
The Justice Department opened an investigation into the NFL over anticompetitive practices — the cost and fragmentation of watching football, essentially. Disney is preparing to cut up to 1,000 jobs under its new CEO. Melania Trump made a surprise White House appearance to deny any connection to Jeffrey Epstein, calling on Congress to hold public hearings for his victims. And the Artemis II crew, which flew past the moon this week with an unauthorized jar of Nutella tumbling through the capsule on NASA's livestream, faces re-entry tonight — the heat shield that chipped in more than 100 locations during the uncrewed mission is about to get its crewed test at 5,000 degrees.
The talks start today in Islamabad. The strait is still functionally closed. The ceasefire bought two weeks, and the first week is already half gone. The pattern from every previous cycle holds: each pause produces just enough hope to sustain itself, and just enough unresolved pressure to ensure the next crisis is worse than the last.
|
|
The people who build the things we depend on keep discovering, in different ways, that the systems they're trusting don't know what belongs to whom.
Microsoft terminated VeraCrypt's signing account this week — the account that lets the open-source encryption tool ship Windows updates through Secure Boot. The termination appears to have been an automated process with no human review and no meaningful path to appeal. VeraCrypt isn't alone: WireGuard's creator got the same treatment, and a forum thread on the OSR developer community shows a wave of Windows driver developers suddenly locked out of Microsoft's Partner Center without explanation. An engineer who previously used Microsoft's Azure Trusted Signing to codesign his own free software described an identical pattern — verification failed on renewal, documentation was rejected, and no human was reachable at any point. The platform that decides whether your encryption software can run on your computer made that decision without a person in the room.
The same week, a researcher published a detailed teardown of the Vercel plugin for Claude Code — the AI coding agent that a growing number of developers now use as their primary programming interface. The plugin, once installed, injects roughly 19,000 tokens of instructions into every session, regardless of whether the project has anything to do with Vercel. It registers a hook that sends every bash command Claude executes — full command strings, file paths, environment variable names — to Vercel's telemetry servers, by default, with no opt-in. A Vercel engineer responded that they "collect the native tool calls and bash commands" and that this is intended behavior. The plugin's scope matcher is an empty string, which means it triggers on everything. An engineer who builds Claude Code skills noted there's no architectural enforcement of Anthropic's own plugin policy, which explicitly prohibits collecting "extraneous conversation data, even for logging purposes." The rules exist on paper. The code doesn't know about them.
Claude itself, meanwhile, has been mixing up who said what. A developer documented a pattern where Claude Code, deep in a long session, begins attributing its own statements to the user and the user's statements to itself. "No, you said that," the model insists, citing words the developer never wrote. Several engineers initially assumed this was a harness bug — mislabeled message routing — but reports from other interfaces and models suggest something more fundamental. The model infers authorship from how text sounds, not from role labels. When the context gets long enough, the boundary between self and interlocutor dissolves. One person who builds wrappers for Claude Code noted that subagent messages are stored with type="user" in the conversation transcript. The metadata says one thing. The model believes another.
The EFF announced it's leaving X, which by itself is unremarkable — organizations leave platforms constantly. What's notable is the math: their posts went from 50 to 100 million impressions annually to roughly 13 million last year, a 97 percent decline that the organization attributes to algorithmic suppression. They're staying on Facebook, Instagram, YouTube, and TikTok, which they acknowledge is contradictory but defend on the grounds that those platforms still deliver reach to people who need it. The comment that cut deepest came from someone who pointed out the obvious: the cost of cross-posting to X is approximately zero, which means the departure is a statement, not a strategy. A former EFF employee from 2001 to 2019 noted something more interesting — that the organization was historically a coalition of progressives and libertarians, and that this coalition has been fraying for years. The announcement was less about X than about which audience the EFF has decided it's speaking to.
Cities across the United States are pulling Flock Safety's license plate reader cameras. The surveillance company, a Y Combinator alumnus whose CEO Gary Tan still evangelizes publicly, has built a network of over 5,000 law enforcement agencies whose cameras can be cross-queried — meaning any agency in the network can search footage from any other agency's cameras without that agency's knowledge or permission. One engineer who examined the system noted that "customer-owned data that anyone in the network can query isn't customer-owned in any meaningful sense." Flock has expanded into drones launched autonomously in response to 911 calls. Washington state just exempted Flock data from freedom of information requests.
Meta, for its part, is removing ads from its platforms that recruit plaintiffs for lawsuits alleging social media addiction in children — lawsuits in which Meta has already been found negligent. "We will not allow trial lawyers to profit from our platforms while simultaneously claiming they are harmful," a spokesperson said, which is a sentence that works only if you don't think about it for more than three seconds. The company that can't stop scam ads impersonating the Canadian prime minister found the capacity to block these specific ones within days.
And someone ported Mac OS X to the Nintendo Wii. Not a toy project — a full XNU kernel boot on 88 megabytes of RAM, with hand-rolled IOKit drivers, a custom framebuffer doing CPU-bound YUV-to-RGB conversion at 60 frames per second, and debugging sessions conducted from an economy airplane seat. The Wii's PowerPC 750CL is close enough to a G3 iMac that Darwin mostly just worked, which says something about how well Apple's original abstraction layers were built — and something else about what happens when a single person decides a boundary is worth respecting. A commenter who ported a hypervisor to ARM described spending far too long discovering that secure and non-secure physical address spaces were backed by different memory at the same address, distinguished by a single bit in a page table entry. The systems that look solid are the ones where someone cared enough to make the boundaries real. The ones that break are the ones where the labels were trusted instead.
|