Meta releases open-weight model, RPKI coverage reaches 70%, Deno joins Cloudflare

In this issue

Citizen Lab confirms zero-click spyware delivery via targeted ads
Meta releases Muse Spark Open, an 816B-parameter model optimized for Apple M5 Ultra desktops
Researcher argues neural networks are inherently legible, challenging superposition theory
RPKI coverage of Internet routes reaches 70%
Schaller uses AI to reverse engineer Linux drivers for unsupported hardware
Deno team joins Cloudflare as runtime winds down
and 4 more in brief

Top stories

Citizen Lab confirms zero-click spyware delivery via targeted ads

The Citizen Lab has provided the first public technical confirmation of zero-click mercenary spyware delivered through targeted online advertisements. The research team, led by Bill Marczak and colleagues, identifies this technique as AdFection. They demonstrate how devices at Al Jazeera were infected with Candiru spyware using this method. The investigation also uncovers Discover-Tech, an Israeli company that facilitates these attacks for multiple surveillance vendors. While mainstream browsers are moving toward blocking non-HTTPS requests, the report notes that mobile app ecosystems may still embed webviews permitting such content, leaving a potential vulnerability window.

citizenlab.ca HN discussion

Meta releases Muse Spark Open, an 816B-parameter model optimized for Apple M5 Ultra desktops

Meta has released the weights for Muse Spark Open, describing it as the most capable US open-weight model to date. The natively multimodal model features 816 billion total parameters with 42 billion active and supports a 1 million token context window. It is optimized to run on desktop hardware, specifically using two Apple M5 Ultra Mac Studios with the MLX framework. Meta states the model is built for coding and agentic work, including long-horizon tasks and complex software engineering. The weights are available for download on Hugging Face, Amazon SageMaker, and other platforms, while API access is provided through partners like Baseten and Fireworks AI.

research.meta.ai HN discussion

Researcher argues neural networks are inherently legible, challenging superposition theory

A researcher argues that neural networks are already clean, meaning their internal mechanisms are legible building blocks rather than tangled knots. After studying image and language models, the author contends that canonical evidence for polysemanticity was misread. What appeared to be arbitrary packing is instead recursive generalization, a less concerning phenomenon. This perspective suggests that mechanistic interpretability can proceed by studying networks directly, without first untangling them through complex reconstruction objectives or sparse autoencoders.

already-clean.goodfire.com HN discussion

RPKI coverage of Internet routes reaches 70%

RPKI now validates 70.3% of Internet routes, up from 54.0% a year ago. This 16.4-point jump is larger than the increases in the previous two years, driven largely by China, which moved from 3.7% to 83.0% coverage. Outside China, the share rose from 58.0% to 63.2%. The data shows that invalid routes are increasingly isolated, with nearly half reaching only a single vantage point. This indicates that invalid routes barely propagate across the broader network.

ipinfo.io HN discussion

Schaller uses AI to reverse engineer Linux drivers for unsupported hardware

Christian F.K. Schaller describes using AI tools to reverse engineer hardware drivers after finding his Plustek 8200i scanner lacked Linux support. He built a harness to capture USB traffic from a Windows virtual machine, allowing Claude to analyze the data and generate a working SANE backend. The author also applied this method to fix MIPI camera issues on his laptop, producing kernel and libcamera patches. Schaller argues that AI excels at the tedious aspects of driver development, such as decoding bus captures and writing probes, while humans retain control over hardware validation and architectural decisions.

blogs.gnome.org HN discussion

Deno team joins Cloudflare as runtime winds down

Ryan Dahl announced that the Deno team is joining Cloudflare, with the runtime winding down over the next year. The team’s new role involves merging Deno’s celld into workerd, while JSR continues running on Cloudflare infrastructure. This consolidation follows Bun’s move to Anthropic ten months ago. The author argues that while the alternative-runtime experiment may be ending, the ecosystem has absorbed the benefits Deno pushed, even if Deno itself did not reach critical production mass.

vlt.io HN discussion

In brief

DEsk releases v0.1.2 beta with Fedora installer. DEsk, a Wayland desktop environment featuring skeuomorphic design, has released version 0.1.2 beta. This initial public release includes bug fixes and a dedicated installer for Fedora. The project describes itself as a realistic desktop where windows appear as paper on a walnut desk.

github.com HN discussion

Libreboot 26.10 adds full UEFI support and 233 Chromebook boards. Libreboot 26.10 introduces full UEFI support via an EDK2 payload, enabling compatibility with Microsoft Windows. The release also imports 233 Chromebook boards from the MrChromebox project, expanding hardware coverage to recent Intel and AMD systems.

libreboot.org HN discussion

CGPM sets 2027 deadline for continuous UTC. The 28th CGPM adopted Resolution 5, making UTC a continuous time scale effective 20 May 2027. The resolution increases the maximum |UT1-UTC| difference to one hour to ensure long-term continuity for global synchronization systems.

bipm.org HN discussion

Scan of 217 million web responses finds 7,959 sites sending AI-directed HTTP headers. Signals Corps analyzed 217 million Common Crawl responses and identified 7,959 sites sending HTTP headers aimed at AI agents. Most headers point to llms.txt files or MCP servers, while 30 sites attempted prompt injection. The authors note that defense depends on which response parts fetch tools pass to models.

signalscorps.com HN discussion