I wonder how much GrapheneOS support will help other Android "distros" like LineageOS. In theory since GrapheneOS is open source it should be quite easy to port the low-level stuff including security updates for the full supported lifecycle (at least as much as the security patches affect both Graphene and other ROMs).

It won't change much, there's no low level stuff, most of the important bits are closed source, so we'd simply end up pulling them from Moto directly.

The truth coming from graphene or Moto won't be a factor.

Quite trivial, especially with AI. Even after official support ends you can build your own Graphene from source.

1. It's opt-in. The user is choosing the occasional broken site over light themes.

2. The site can always provide their own dark theme if the automatic one is broken.

I think a sensible architecture would involve many pools of wallets with different availability. So the majority of funds can probably be completely offline, with only occasional transfers to/from various offline vaults. The there could be different groups of different levels of online funds that are ideally physically separated (individual teams and employees can only access a subset of the wallets).

I can maybe remember CVE-2026. But there is no way I can remember 6 random digits.

Yeah, because the six number chunk is near the limit of recall. Don't remember CVE-2026 since the year and CVE can be reconstructed from time memory. You know it came up this year. Remember that vuln 111-497 (as two chunks) came out this year, and remembering two short chunks is easier.

I don’t know why you’d want to remember the number, but this one seems easy if you know some memory techniques.

> Remember that vuln 111-497 (as two chunks)

Good first step. Remember it’s two sets of three numbers. The first set is all ones, meaning the first three numbers are 1, then the fourth number is 4, then you add five for the next one (9), then you have to remember to subtract two (7)¹.

May sound silly, but I bet some of you have already memorised it from that alone. Being a slightly convoluted by still logical set-by-step helps with recollection.

¹ Lot of different ways to go about that, like remembering that the first set was three of one so “two was left out”.

What if they never fix it? Is there at least a deadline where the researcher's are ungagged? What if the exploit is being used in the wild, can the researcher warn people then?

I'm having the same issue. It seems that their CRL updates aren't working well on Android?

The words in a novel and the order in which try appear are so facts. But somehow that is clearly copyrightable.

This is the only way. Auto mode is really just yolo mode with more LLM tokens billed. It may catch some weird shit but it isn't a reliable sandbox. Just lock up the LLM and let it run.

Just FYI, auto mode is free now.

Are you sure? When they announced it they said they will update quotas to account for it. Which just means that the next adjustment will effectively null it out.

The docs all say there is a time and billing cost:

> Auto mode may have a small impact on token consumption, cost, and latency for tool calls. https://claude.com/resources/articles/auto-mode#what-to-expe...

https://code.claude.com/docs/en/permission-modes#cost-and-la... doesn't say anything specific. It mentions that server-side classification can be used but doesn't talk about the billing for it.

But at the end of the day it is a leaky system. It may reduce the frequency of bad actions but doesn't prevent it. So you need the sandbox either way.

Your article is dated March 24, 2026.

This post is dated August 7, 2026: "In the coming month, working with our cloud partners, we plan to make it the default across all of these and no longer charge for classifier overhead." https://claude.com/resources/articles/auto-mode-default-in-c...

> but doesn't prevent it. So you need the sandbox either way.

Yep. Single points of failure are bad.

It's the only way if you want 100% security but often a compromise between security and usability is preferred.

I'm actually working on multi harness auto mode. It's already done for Pi and I'm currently working on copilot cli port (where it is needed the most by the fa r of autopilot in copilot being so atrocious).

The correct way for auto approve to work is similar to what claude code does (a deterministic algorithm where a separate model reads what the user says and adds rules based on what the user enables).

I couldn't believe such a thing that works well doesn't exist, but it doesn't. You either have to do borderline yolo or you cannot leave a model working overnight and not find it got stuck on some silyness after an hour.

Not only revenue but enterprise users are valuable market share. Think of things like Slack calling which last I checked don't work in Firefox unless you spoof the user-agent. More enterprise users will force better Firefox support in a huge variety of websites which will benefit all Firefox users.

I wonder if you keep compiling back and forth would you ever hit a cycle or would it be constantly growing?

theoretically it should be a circle, if it keeps constantly growing then you're looking at bugs