PixelsTech

Google AI Plus ($4.99/month) loses Gemini Pro on November 13. In the Gemini app and AI Mode in Search, Plus subscribers can then pick only Flash and Flash-Lite; Pro needs AI Pro ($19.99) or higher. Existing Pro chats continue on another model.

GitHub's Skyline site is gone, but its CLI extension still works: gh extension install github/gh-skyline, then gh skyline --year 2024 --output my-skyline.stl gives you a 3D-printable model of a year of contributions. pixelstech.net/article/17378…

testing.AllocsPerRun reported 0 for a Go function that allocated 20 times. Go Weekly, 2026-11-02 ~ 2026-11-09: 8 posts. 4 worth your time: 1. Go 1.27 adds stable encoding/json/v2 and jsontext, fixing v1 flaws with options, streaming, better performance, and compatibility. 2. Go accepted a generic Set for golang.org/x/exp, defined as map[E]struct{}. A nil Set panics on Insert, so the zero value is not safe. 3. Go accepted maps.Grow to pre-size an existing map. On Go 1.27.3 a pre-sized merge ran up to 59% faster, but slower when sized for keys already present. 4. A Go developer shows how one generic MustCreate test helper replaces repetitive per-type helpers, with MustCreate2 for multi-parameter constructors. All 8 links, grouped by topic: substack.com/home/post/p-224…

WebCodecs audio encoders add priming silence but still stamp the first packet at 0, so encoded audio lags the video. Apple's AAC encoder adds 2112 samples, 44 ms at 48 kHz. Mediabunny 1.63.0 now measures each encoder's delay at runtime and writes negative timestamps instead.

A failed CREATE INDEX CONCURRENTLY leaves an INVALID index. If it died in the second scan or final wait, every write still maintains it and a unique one still enforces uniqueness, though no query uses it. Find them with NOT indisvalid in pg_index, then DROP INDEX CONCURRENTLY.

Every Mac since macOS 13 runs knowledgeconstructiond and intelligenceplatformd, building a graph of who you know from Contacts, Photos, Calendar and Family Sharing, per Eighth Rank. On 26.6.2 it's 51 SQLite databases in ~/Library/IntelligencePlatform, behind Full Disk Access.

That matches what NVIDIA's docs suggest. One gap left if auth is still off: the ingress only protects traffic that goes through it. Anything inside the lab that can reach 30080 directly can still create or delete clusters, since NVKE does no authorization.

Agreed. With no authorization, anything that reaches 30080 can create or delete clusters. Turning auth on isn't enough alone: there's no TLS, so tokens cross the network in clear. NVIDIA's docs suggest your own TLS endpoint in front or isolating its clients.

For anyone triaging: services that never call the zlib Brotli APIs can still be exposed. Node’s global fetch() decodes a br response even when it only offered gzip, deflate. Fixed in 22.23.4, 24.22.1 and 26.12.1; Node 20 gets no fix.

CPython’s experimental JIT is leaving main. Its authors withdrew PEP 836 on Oct 19, and removal is expected early in the 3.16 cycle. Speedups had been small and only for some programs, such as long-running tight loops. pixelstech.net/feed/link/857…

Trying NVIDIA’s NVKE preview, its open-source Kubernetes engine for GPU operators? After install the API serves plain HTTP on port 30080 with authentication off, and NVKE does no authorization. There is no backup/restore or management-plane upgrade yet either.

Go's accepted generic Set (golang.org/x/exp/collection/…) is type Set[E comparable] map[E]struct{}. So a zero-value Set panics on Insert, == doesn't compile, and JSON encodes it as an object of {} values, not an array. Initialise every Set field. #golang

Run SourceHut with registration closed? Since 2021, POST /register/step2 still created accounts if SMTP was set up: the handler only checked the setting on error paths. A CSRF token from /login works. Fixed Nov 3 (CVE-2026-121728). Check meta's /users for unknown accounts.

Installed or updated the Claude Code extension in Cursor on Oct 29? Look for an SSH key labelled svc-telemetry. A trojanized 2.1.313 was on Cursor's marketplace for about 11 hours. It adds an attacker SSH key plus a LaunchAgent or scheduled task that retries a reverse tunnel.

Chrome's Save as PDF leaves blank boxes where images should be when a page lazy-loads them. Scroll to the bottom before you press Ctrl+P. Pages that scroll inside a box, like long chats, only print what fits in it. pixelstech.net/article/17938…

Root is the one account a stock Alpine sshd shouldn't hand over this way: OpenSSH defaults PermitRootLogin to prohibit-password, which refuses password logins for root. Other users are the exposure, and the fix is OpenSSH 10.6p2.

Building SQLite with zig cc? Zig's rewritten strspn measures the whole remaining string on every call, so a tokenizer stepping through a large input goes quadratic. One developer's JSON inserts took minutes; tokenizing a 1.2MB file was about 12,000x slower.

SET COMPRESSION lz4 on a Postgres column only affects new writes. In a test on 18.6, VACUUM FULL, UPDATE doc = doc and INSERT ... SELECT into an lz4 column all left 20,000 rows on pglz. Only a new value (doc || '[]') recompressed. pg_column_compression() tells you which.

Worth checking the PgBouncer version while switching to scram-sha-256: 1.17.0 through 1.26.0 let anyone who knows one auth_file user's password log in as any other SCRAM user. 1.26.1 fixes it, and there's no config workaround.

v2 takes options per call, so the flag can just pick an options set: json.MatchCaseInsensitiveNames(true) and jsontext.AllowDuplicateNames(true) bring back those two v1 behaviours and keep the rest of v2. A field's case tag option overrides the call-level setting.