The Day the Internet Broke - DTNS 5378

0:00This episode is brought to you by Capital One. Capital One's tech team isn't just talking about multi-agentic AI. They already deployed one. It's called Chat Concierge and it's simplifying car shopping. Using self-reflection and layered reasoning with live API checks, it doesn't just help buyers find a car they love. It helps schedule a test drive, get pre-approved for financing, and estimate trade-in value. Advanced, intuitive, and deployed. That's how they stack. That's technology at Capital One. When demand slowed for HydroJug, Amazon Ads rising star Hayden Wadsworth pivoted.

0:34Huyen Tue Dao: When our bank account hit near zero, my brother Jake and I had one last shot to save HydroJug. So we engineered the Traveler, a leak-proof, cup holder-friendly Tumblr. Amazon Ads enables a business to be able to expand their product shelf because of the visibility and the reach you can get. Each week, our new-to-brand customers make up about 95 % of all of our sales. Watch HydroJug's story at advertising.amazon.com slash rising-stars. Some days, getting the work done isn't the problem. Staying locked in is. AlphaBrain is Onnit's daily nootropic formula for cognitive support, designed to support memory, focus, attention, and mental clarity.

1:12Huyen Tue Dao: Its formula with science-driven ingredients include theanine and huperzine A to support focus and memory, and it's caffeine-free. So when you're deep in the work, AlphaBrain helps support enhanced productivity and tune out distractions. Get focused on what matters. Shop AlphaBrain now at onnit.com.

1:57Huyen Tue Dao: Ready to go. Switch today at ShipStation.com. Code audio.

2:11Huyen Tue Dao: This is the Daily Tech News for Wednesday, October 21st, 2026. We tell you what you need to know, give you important context. And wow, today we're really going to do our best to help each other understand. Well, today the internet broke in two very interesting ways. or actually, well, today, reporting that yesterday the internet broke in two very interesting ways. But there's a fix. There is. That's good to hear. I'm Tom Merritt. I'm going to it now. Let's start with what you need to know with that big, big story. Oh, my gosh. Yesterday afternoon, the news hit that eight extremely weak TLS security certificates had been found that could allow attackers to impersonate legitimate connections on the internet.

2:52Huyen Tue Dao: That was bad enough. And that was followed by the release of a vulnerability found in PHP, the programming language that underlies everything on the web. I mean, it's just in WordPress and Drupal and Joomla and Magento, et cetera, et cetera, et cetera. Let's start with the PHP vulnerability. PHP, for those uninitiated, is a scripting language. It dates back to 1993. It's been around for a long time. originally stood for personal homepage, but then they turned it into one of those fun acronyms, PHP Hypertech Pre-Processor, PHP Hypertech, it's a back, anyway. You can think of it like JavaScript, but it runs on the server, whereas JavaScript runs in your browser.

3:36Huyen Tue Dao: WordPress is built on it, and between that and lots of other web software out there, more than 70 % of the web runs on PHP. I think of it as the way my site communicates with its database. All of our WordPress posts are in a database, and then the WordPress software uses PHP to pull those posts out of the SQL database. But it can also track user states, manage cookies, the good kind as well as the bad kind. It can handle form data and lots of other stuff that you want websites to do. So it is extremely important. Security researchers from Califf working as part of OpenAI's Patch the Planet initiative.

4:13Huyen Tue Dao: and independently, folks at Google's Wiz subsidiary discovered two remote code execution flaws in PHP. Calif's Ryan Austin was using GPT 5.6 Sol to discover the bugs in August. He was running an audit of PHP. He just wanted it to see like, what can you find? And it found these. One of the flaws had been flagged decades before, but at the time it was considered pretty much way too difficult to exploit. but GPT 5.6 Sol found an easy way to exploit it. So they got together, alerted several organizations, started a working group, created a patch. It's a biggin, 200 files with 10 ,000 lines of code and they set a patch date of Thursday, October 22nd.

5:02Huyen Tue Dao: Sharp-eared listeners will note, that's not today as I'm recording this, that's tomorrow. But as happens on the internet, That word leaked out on Tuesday. So they decided to tell everyone, yes, a patch is coming. And on Wednesday, GPHP Foundation rushed out two security patches for two critical vulnerabilities rated 9.2 and 10 out of 10, respectively. These two vulnerabilities are collectively being referred to as PHP 2, the number two, PHP 2 Shell. Security firm Watchtower confirmed the vulnerability affects every version from PHP 5. back in 2004 on up. There are reports that the vulnerabilities would let attackers run code on any server with PHP and potentially control it.

5:50Huyen Tue Dao: Both flaws take advantage of the fact that PHP left memory in a corrupted state if a request ended abnormally. So that's the first thing you do. You end a request abnormally, and then you try to take advantage of that corrupted state if you're an attacker. It affects all PHP installations serving web requests with mod underscore PHP at the highest risk because an, and I quote, unauthenticated request can trigger an attack before any application code runs. Yeah, not good. Patches are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you're older than that, they suggest you upgrade, but PHP's security team provided minimal source backports for 7.4, 8.0, and 8.1.

6:41Huyen Tue Dao: There are some mitigations out there if you're not able to get the patch on right away. However, PHP core developer Gina Peter Banyard noted that no mitigation is going to fully block these attacks, so security patches are your only permanent defense. Cloudflare and Watchtower have already observed early attacks targeting PHP 2 shell. If you can't patch, the next best thing is take your application offline. We'll get to the TLS one in a second, Gwen, but I'd like to get your thoughts on this one. I'm not a security person that I've mentioned so many times, but I know what PHP is. I'm old enough.

7:16This is frightening. This is absolutely terrifying. And I suppose the one thing that really gets uh gets me is that it again in the age of generative ai things that i think we relied on as being too hard or through office like not even just obfuscation but just through effort and time and resourcing have now become a bit easier to whether it's we mistakenly thought it was like hard to hard to exploit or whether it just again took time and effort um yeah y 'all uh it's a scary time yeah and like you said php is literally everything which is kind of hilarious in a sense because it's PHP. But it's kind of amazing and terrifying.

7:55Awesome in the traditional sense of the word.

7:58Huyen Tue Dao: Yes. Inducing awe. Not the cute kind. Not awe. But like awe. I mean, I want to run through some of the questions I know are going through some people's minds. First one being like, well, if they knew one of these existed decades ago, why didn't they fix it? In the information space of things we know, there are more vulnerabilities than we as humans can fix. That's actually the upside of what we were just talking about is that a lot of these tools can now fix things that we wouldn't have had time to fix, like this one, for example. So you always have to prioritize. And there are vulnerabilities that security professionals look at and say, the chances of anyone exploiting that are extremely low.

8:41Huyen Tue Dao: So we're going to start with the ones that are extremely high. And that's what they should do. what this tool did is say, we just figured out a way to do it easily. And therefore they fixed it, right? Once they figured out how to do it easily, it shot to the top of the priority list and they started fixing it. The other thing is like, well, then why didn't they push the patch out earlier? It's because you want to give everybody a chance to get prepared. So you put the patch out. So the patch goes out before the bad guys know about it and everything is fine. and what went badly in that is that word leaked out on Hacker News that this was coming just a couple of days earlier.

9:19Huyen Tue Dao: And so they had to do a little bit of a mad scramble. If this was October 22nd and they were just announcing, hey, guys, guess what? We patched this PHP vulnerability. You should know about it if you haven't patched it yet. This would be almost, I would think, an entirely good news story, which is, oh, this could have been bad, but we patched it. As it is, it's not as bad as it could have been story. They just had to rush that patch a little faster than they meant to yeah i mean as you said it was it's a massive patch and presumably that a patch that big i mean like the probably proportional to the size of the patch is also some risks of like like you know something regressing or some oh yeah something happening so understandably they that uh yeah i just thought that was interesting the communication of it uh and how does that usually happen like for security folks like like there's like a obviously a benefit for people good people knowing but obviously a good benefit for bad people knowing early so it was kind of interesting.

10:09I did wonder why they let people know because presumably I feel like once you announce something, it's only a matter of time before bad people find out.

10:16Huyen Tue Dao: Yeah. And they were going to, there's, there's always going to be a day you tell people, right? They're like, let's work on the patch before we tell people. Cause we don't want to tell people and not have a patch. Let's make sure the patch is working properly. Right. So we don't have a regression, uh, before we tell people in the patch. And that's why you set a date and then it just kind of leaked out somehow ahead of time. So there's a crazy amount of sites that just, uh because as as you said like sometimes like some like basically if you can't like was it some like this way oh no wait sorry that maybe i might be like spoilering the next story i was oh yeah it's easy to get these two confused especially because the other one's really bad too yeah uh um before before we move on to the other one and maybe maybe we should just so we can have both of them in our heads uh because we we can talk about some of these issues together uh you as a user don't need to do anything unless you run a wordpress site right or something that uses PHP, but an end user, you don't even have to update software or anything.

11:13Huyen Tue Dao: This all happens on, that's the nice thing about PHP being server side, not client side. It's the people who maintain the servers, which I know many of you are, and I'm not trying to minimize the difficulty of that. But I know there's some folks who are like, well, wait, do I need to update my browser for this? No, not for the PHP one. Yes, for the TLS certificate one. Actually, I don't even think you have to update your browser for this one either. I think they were able to fix that in a different way, but this one affects you a little closer. India's eMudra found out that eight of its intermediate CA certificates, these are certificates used to prove cryptographically this site is who it says it is, that eight that were created on April 2025 used private keys that were three to eight bits long.

12:02Huyen Tue Dao: Usually they need to be 384 bits long. 384 bits means you can make a cryptographic number that's 116 digits. That's really hard for someone to guess. 8 bits means you just need to try every number between 1 and 256. You don't even need to automate that. You could just sit there and do it over an hour or so. Hacker News says the private keys, and I don't feel bad giving these out because you could just guess all 256 numbers if you wanted, but the private keys were 4, 56, 66, 115, 155, 156, 230, and 237. In other words, you just needed to know that number, put it in, and the certificate would go, oh, you are legitimately that person.

12:47Huyen Tue Dao: You know the secret number. That's why the secret number needs to be really long. Anyway, how did this happen? Emudra said a script error generated two sets of keys. The second set was the week set with the three to eight bit long numbers. And because those keys had similar labels to the properly generated keys, they were accidentally implemented. They did not say how they were accidentally implemented. They were never used in production. That's good news. And there's no evidence yet that they were issued to any end users. That's very good news. How'd they find out? An informal advisory published to emudra.wehaveaproblem.com on Tuesday posted the message, we have a problem here, dash Wayne.

13:37Huyen Tue Dao: Wayne is the security group who discovered these certificates existed. And then they signed the message digitally with the private key of one of these eMudra certificates to demonstrate that, yes, indeed, there is a problem. Any attacker that knows this could replicate those certificates and pretend to be a secure server. That would let them intercept traffic. Now, granted, you'd have to be an adversary in the middle for that kind of attack. So it would take some significant resources in most cases, unless you control the whole network, like in a compromised cafe Wi-Fi situation. But this ain't good.

14:15Huyen Tue Dao: Emudra has revoked all the certificates. They blame the script. No report of certificate transparency logs. That would show if somebody was using the compromised keys maliciously. So we haven't seen that. Mozilla, Google, and Apple have all blocked the compromised certificates from being honored in their browsers. And as I mentioned earlier, you don't even have to update your browser. They have done that on their side. Interestingly, Edge has not updated yet. Very curious about that. But any app that doesn't check for revocations will also need to be updated to avoid being fooled by them. So the real dangers here might be a VPN, an Internet of Things device, an old unmaintained server.

14:56Huyen Tue Dao: And one of the folks from Wayne Security pointed out that macOS's built-in curl utility could be fooled by this as well. So that will need to be updated by Apple. And in case you're wondering, apps like Signal and WhatsApp and WireGuard do not rely on TLS for confidentiality, so they are unaffected. And if you remember the Heartbleed TLS fiasco of 2014, this is assumed to be a bigger cleanup job than that. And it took a couple of years to clean up after Heartbleed. It's so fascinating. I'm, so again, not a security person. So I have many, I have so many questions. I do like the idea that they signed the message on we have a problem with their, with eMudra's own private key.

15:39yeah i was imagining since it's g it's great british break-off season i imagine someone sending a message to paul paul hollywood kind of baked in like one of his secret bread recipes or something like paul we have a problem i don't know i couldn't think of a better report they

15:51Huyen Tue Dao: used the private key for the smallest one of the bunch just to rub salt in the wound i think um i'm kind of curious like how this this all happened and what the purpose of the week keys were whether that was like for testing or something and how that all got conflict all that got muddled It does sound like, as you said, again, less for us as end users to worry about. But also how, why, how did this happen? Because 8 is a lot different than 384 in regards to bits. And I guess that goes against to maybe tying into the first one about how. I don't know. And maybe it's irresponsible to even say this.

16:31Huyen Tue Dao: but I suspect maybe a generative model created the second set of weak certificates. And that's why they were labeled the same. I'd be curious to know if that was the case. I also had that irresponsible thought labeled responsible. Yeah. Yeah. I really April of 2025. So it's within the window of that being a possible thing. Yeah. And last year, so things were less capable. Yeah. Yeah. that's true uh yeah i i again not as a comparison just uh it's so interesting though again like how so much of security i think it's like the fascinating thing and also the scary thing is about making things hard to do again eight bits versus 384 bits just the fact that it's a much larger number makes it like almost you know uh inconceivably hard at least in the before times And then now again, like not exactly the same situation here, but again, with agents and things that can do things in a short amount of time on its scale, every little thing becomes just absolutely frightening because those barriers seem to have come down a little bit.

17:39But I don't know. Like, I'm curious if like proper security people, how are you feeling these days, guys? What makes you nervous?

17:46Huyen Tue Dao: There were some security folks in our Discord like, oh, this is going to be a long couple of days cleaning up after this TLS thing. And that was before the PHP thing hit. So, yeah, this is not going to be a fun couple of weeks here. Four, huh? Yep, just four. Four. Oh, you guessed my secret key. Oh, no, it was four. How did you know? I got you on that one. It's like making your password 54321 just to think that, you know. Yeah, that's slightly more secure. All right. Well, we have more than 384 bits of love for you in our heart, the listener, because we are made possible by you. So let's take a little bit of time to thank Jeffrey Zilks, Alo Adam L, Philip Les, and Kirill Killander.

18:30Yay! Or Killandev, I'm so sorry. Killandev! Killandev. Episode prep gets messy when research, Slack threads, and script trackers are all in different places. That's where ChatGPT work comes in. Give it the goal and connect to the tools where work happens, like apps and files, and it can help pull the pieces into a draft you can review without you having to re-explain the project at every step. For example, ChatGPT work can gather team feedback from Slack and use it to suggest updates to a project brief in Google Docs. You stay in control reviewing the draft and deciding what moves forward. Put ChatGPT to work on your most ambitious ideas and projects.

19:09Get started at ChatGPT.com by selecting Work Mode. Available on Plus and Pro plans. This episode is brought to you by Capital One. Capital One's tech team isn't just talking about multi-agentic AI. They already deployed one. It's called Chat Concierge and it's simplifying car shopping. Using self-reflection and layered reasoning with live API checks, it doesn't just help buyers find a car they love. It helps schedule a test drive, get pre-approved for financing, and estimate trade-in value. Advanced, intuitive, and deployed. That's how they stack. That's technology at Capital One. Meet Amazon Ads rising star Daryl Spencer, who set out to redefine men's self-care with his brand Crown Skin.

19:54Amazon Ads helped him grow.

19:55Huyen Tue Dao: I walked away from big tech to build a luxury brand in a category that no one was paying attention to. With the help of Amazon ads, I'm reaching relevant audiences and competing with the biggest names in men's grooming. We've scaled to over$500 ,000 in monthly revenue. Watch Crown Skin's story at advertising.amazon.com slash rising-stars. Some days, getting the work done isn't the problem. Staying locked in is. Alpha Brain is Onnit's daily nootropic formula for cognitive support, designed to support memory, focus, attention, and mental clarity. Its formula with science-driven ingredients include theanine and huperzine A to support focus and memory.

20:36Huyen Tue Dao: And it's caffeine-free. So when you're deep in the work, Alpha Brain helps support enhanced productivity and tune-out distractions. Get focused on what matters. Shop Alpha Brain now at onnit.com. Therapy's biggest impact doesn't show up in some dramatic breakthrough. It shows up in the smallest moments. You bite your tongue instead of escalating. You put your phone down instead of firing off that text. You say what you actually mean instead of what would hurt someone else the most. Nobody applauds those moments, but they quietly change your life. That's what growing feels like. And that's exactly what Grow Therapy is here for.

21:14Grow is therapy that works, covered by insurance. Sessions average$21 with insurance and some pay as little as$0 depending on their plan. There are no subscriptions, no long-term commitments. You just pay per session. Grow connects you with thousands of high-quality licensed therapists across the U.S. offering both virtual and in-person sessions nights and weekends. You can search by what matters, like insurance, specialty, identity, or availability. And you can book a therapy session in minutes and begin in as little as two days, not the national 48-day average. See if you could pay as little as$0 for therapy in seconds at growtherapy.com slash ACAST.

21:56That's growtherapy.com slash ACAST. growtherapy.com slash ACAST. Availability and coverage vary by state and insurance plan.

22:10Huyen Tue Dao: There's more we need to know today. let's get to the briefs all right we've had enough security horror stories so we have a palette cleanser for you game console horror story it is a spooky season so very appropriate well a profile of xbox ceo asha sharma from fortune says a next-gen handheld gaming device will come from xbox by the end of 2027 and a new game console will arrive by the 2028 holiday season but but may cost anywhere from$1 ,200 to$1 ,800 based on internal projections. Microsoft might subsidize that since, you know, generally game consoles are often sold at cost or at a loss in order to make money on the games, on the game side of things.

22:53So there's also an internal competition, according to Fortune, between using Windows for the handheld as it did with the, did I say wrong? ROG, ROG Xbox Ally, or an OS built by the Xbox group. and to further confuse the matter xbox cto scott van vliet van vliet told windows central helix os is being built on windows and the xbox and xbox and windows teams are working closely together and people familiar with the matter say say xbox game pass will soon have more a la carte options like add-ons for console only games cloud gaming and multiplayer so is sharma just polishing up xbox for sale fortune quotes microsoft executive judson uh judson althoff we would not have put

23:41Huyen Tue Dao: sharma on a business we intend to sell so you're saying there's a chance uh no that one's actually pretty pretty cut and dried uh he didn't say we're not that's the only thing that that he left a little bit of a loophole he said we would not have done this would we maybe just leaving it open just in case, but I feel like that's, that's the kind of thing you say, because you never want to shut down the possibility that you might need to change your mind in the future and sell Xbox, you know, so you're hedging your bets, but it does, it does. I don't think they plan to sell Xbox anytime soon. Maybe it's a possibility they want to keep open for some time in the future, but it's not their current intention.

24:22Huyen Tue Dao: Uh, they want to make it make money. And I think they're doing the, that's what all these things are meant to be doing. Uh, I find it interesting that there's I find it unsurprising, but interesting that there's a turf battle over the Xbox OS versus using Windows. And I don't think that clarification that they're working together tells me anything other than the executives say, you two need to work together. That doesn't mean they like it. I also think that$1 ,200 and$1 ,800 price is probably not going to be the price. Do you think, right, because by the time that actually comes out, memory pressure and other component pressure might be dead?

24:58Huyen Tue Dao: I hadn't actually thought about that. You're right. Like maybe, maybe by the time we get to 2028, the, the, the component prices have stabilized, but also that's probably what they think it'll cost to build. They're going to want to keep it below a thousand dollars if they can. They're, they're going to want to try to subsidize that. $1 ,800 would be hard to keep it. yeah for sure um no i i agree it's kind of interesting as you mentioned like with corporate especially with a company that is just so big and has such a large i mean microsoft in itself and then like just the just just like the gaming division and especially the way that i usually like not quite cannibalized but the yeah the weird internal competition that happens when a company acquires or builds multiple projects and then it's like hey it's like a little play date work together and then just hopefully they play well together.

25:45But it also sometimes feels a little bit confusing with differently kind of competing streams.

25:50Huyen Tue Dao: And I can see where they might talk right past each other. Windows, rightfully, the Windows team is going to say, like, compatibility, man. People want to play their games everywhere. And Windows can do that, which it can. And Xbox folks are going to say, performance, man. Our operating system is built specifically to run games at the highest possible performance and windows is not and they're both right you know yeah so yeah it's kind of curious what the benefit of of again like that coordination like what what what kind of exchange could benefit could be mutually beneficial there but well the fortune article said that uh one of the xbox executives in charge of the handheld said fine we just won't make a handheld then if we have to i'm gonna take my toys and go home yeah Yeah, there was a little bit of a take my toys and go home moment, but I assume they've smoothed that all out.

26:40Huyen Tue Dao: Okay. Google has begun rolling out personal intelligence for Gemini for Android Auto. Personal intelligence is already available on Gemini, but now you can access it through Android Auto. This lets Gemini pull from any authorized connections. That's what personal intelligence means. So it can use your Gmail or your Maps or your calendar to personalize your responses. and personal intelligence is off by default. If you've turned it on already for something else, you will now be able to use it in Android Auto. But if you haven't, you would have to go into your Google account and turn it on. And then you can choose what apps it can access.

27:15Huyen Tue Dao: You can say, access my Gmail, but nothing else, if you want. One example of how it works is you're on your way to the airport. You ask Gemini for your flight gate and departure status. You just say, hey, Gemini, what's my flight gate and departure status? And it will go into your Gmail, look at your ticket information, then go to the web, search, update the info and tell you, oh, you've been moved to gate 35, but you're still on an on-time departure. Another example would be you just say, let's go to the car wash. And it knows from maybe looking at your Google Maps history or even your Google Photos that you usually go to this particular car wash.

27:52Huyen Tue Dao: And so it just creates a navigation route to go to the car wash without you having to say which car wash you needed to go to. In related news, you can now chat with Gemini in Google Maps for Apple CarPlay as well, but that doesn't have personal intelligence, but just throwing that out there. Would you use personal intelligence in Android Auto if you had these things? I think so. I don't have a car new enough for CarPlay or Android Auto, sadly. So my experience with them is when I rent a car, I would not want it to be on in the rental car, but in my own personal car uh having having google having google use the stuff it already has access to to be able to answer a question faster i think i'm okay with i i mean i i def i this is just like a lot of the features that we've kind of gotten and then it's like the feature hokey pokey that google has given us and taken away and then given us with kind of this more predictive kind of anticipatory like information slash like and then of course now we're adding in like the intelligence part of it with it actually kind of trying to do more natural language like type searching and prompting i i don't know like i i'm not i'm not opposed to it as he said um these are things that they already have access to yeah for better for worse i i'm still curious about how often people use this it's like a nice to have feature i honestly legitimately wonder especially in a car how often these things get you i think like even in productivity and for like day-to-day work a lot of this makes sense uh or for just wrangling a bunch of people uh for family things and whatnot i do i do really wonder um but yes uh if you do this if you i'm going to be renting a car very soon i'm going to south bay and uh seeing all the phones that get left inside of a rental car the list the list my husband's very sweet he goes through and he actually deletes all he'll take extra time yeah he's he's a sweetheart um so yeah uh especially if you think you might have left your phone connected to a rental car, maybe don't turn on personal intelligence in your Android Auto.

29:52Huyen Tue Dao: Yeah. I don't even know that it would leave any traces of it, but just to make sure I'm not missing something, I might not do that. Your second question is the more pertinent one to me. How often would I use this? I don't think I would use it all that often. It would probably be the kind of thing I'd want on for that unexpected time when I asked something and it got the answer perfectly right because it had access to that. I'd be like, oh, I'm glad that was on. So that, you know, I got that. But I don't see it being an everyday use for me. I don't know. I guess we'll see. Yeah. And if y 'all use it and love it and did something very personal intelligency, let us know.

30:30Huyen Tue Dao: Yeah. Feedback at DailyTechNewsShow.com. There you go. Well, guess what? DTNess is making a 2027 wall calendar. And your art, yours, I'm pointing at you if you're listening only, could be in it right alongside art from, of course, the wonderful Scott Johnson and the wonderful Len Peralta. Your submission should work for either January or December and be tech-related. Both winning submissions will get a free calendar, and you can get the submission guidelines at patreon.com slash DTNS, and submit your art to feedback at dailytechnewshow.com by October 30th. Yeah, the guidelines on the Patreon page are really just like, we need it to be this kind of file in this kind of resolution.

31:12Huyen Tue Dao: We've had a lot of people ask like, well, what if it's a photo? Or what if I just did this? And my answer is submit and find out. It can't hurt. The more people that submit, the better. Right now, your chances of being in the calendar, I'm going to say are pretty high. So if you're on the fence, go do it.

31:36This episode is brought to you by Capital One. Capital One's tech team isn't just talking about multi-agentic AI. They already deployed one. It's called Chat Concierge and it's simplifying car shopping. Using self-reflection and layered reasoning with live API checks, it doesn't just help buyers find a car they love. It helps schedule a test drive, get pre-approved for financing, and estimate trade-in value. Advanced, intuitive, and deployed. That's how they stack. That's technology at Capital One. Meet Amazon Ads rising star Daryl Spencer, who set out to redefine men's self-care with his brand Crown Skin.

32:12Amazon Ads helped him grow.

32:13Huyen Tue Dao: I walked away from big tech to build a luxury brand in a category that no one was paying attention to. With the help of Amazon ads, I'm reaching relevant audiences and competing with the biggest names in men's grooming. We've scaled to over$500 ,000 in monthly revenue. Watch Crown Skin's story at advertising.amazon.com slash rising-stars.

32:39Huyen Tue Dao: here are some quick headlines that we will go from our mouths into our microphones through your headphones into your brain and make you smart well tom seems to love making me an android person tell you about iphone reviews but i happen to be a foldable person too so guess what we're going to talk about what people are saying about the iphone duo in reviews out today so on the plus side. People praise the build, the lack of visible screen, as well as the quality of that inner screen. On the downside, apps aren't all fully optimized. Oh, as an Android developer preach. It lacks telephoto and face ID using Touch ID instead.

33:17It's heavier than other foldables, and the outer display feels a bit cramped. But in one last bit of good news, Wired says Apple will bring its reachability feature back to Duo, making it easier to use

33:30Huyen Tue Dao: the widescreen with one hand yeah i i i think the uh face id thing may be the first thing that i get frustrated with maybe the telephoto i don't know i take a lot of pictures at concerts and stuff so i might run into the being frustrated by that but everything else nothing else there surprised me no i mean and i i i say this with sympathy not with spite welcome ios developer fam to the to the realm of hey why doesn't this i mean although you've all either black bars ipad yeah i mean it's it's a thing. Um, and it's still early, so hopefully we'll see people take it back up. So NVIDIA had several announcements at GTC in Berlin, including DSX pod AI factory.

34:13Huyen Tue Dao: This is a shipping container that comes with seven racks of Vera Rubin AI machines pre-installed one for every member of BTS open shell reference architecture is a new way to monitor agents on NVIDIA's open-shell secure runtime. Agile 1SN is a humanoid robot reference platform done in cooperation with Germany's Agile robots. And ducks, robot ducks, micro ducks from Pollen Robotics, which sadly were just limited to demonstrating NVIDIA's physical intelligence workflow when they should have been doing something much cuter. I want a micro duck and a BTS Vera Rubin. Right, I'll take one of each one.

34:54Huyen Tue Dao: Which Vera Rubin is V?

34:59On OpenAI's alignment research blog, the company reported two instances where agents weakened its misalignment monitoring system while working on software changes. On October 3rd, an employee told GPT 6.1 Sol not to send any messages about a task, so the agent stopped sending the security team the required notifications. And on October 6, GPT-6 Astra removed OpenAI's monitoring system while migrating a program and then told the user it had not disabled it.

35:32Huyen Tue Dao: mm-hmm yep open ai said in both cases the agents considered whether monitoring safeguards should be preserved but then decided that the instructions that they were given overruled keeping the monitoring system which just backs up my contention that a lot of these models are still in the sort of like bumbling intern phase of like but you told me not to tell anyone. So that would have been telling someone, right? Yeah. Yeah. Yeah. Also, again, LLMs are still struggling with negation. So sometimes it's hard to tell not to do something. And apparently it'll take that and be like, I won't do anything.

36:15Huyen Tue Dao: Fine. I'll just take my toys and go home. We won't have an Xbox handheld. During SpaceX's earnings call, CEO Elon Musk said the company has formed a special committee with his other company, Tesla, to explore a merger of the two companies. Musk is not participating in the discussions because he's CEO of both. Any merger would need approval from 50 % of all shareholders of both companies. I want to make a joke about recent demos, but I'm not going to. Google Cloud will begin offering models from OpenAI. OpenAI uses Google Cloud to run ChatGBT and its API. Sony announced its PlayStation Pulse wireless headsets are open for pre-orders on October 29th for$100, and they'll start shipping on November 19th.

36:59Well, Waymo made Las Vegas Airport the sixth airport it can autonomously pick you up and drop you off at. Las Vegas joins Phoenix, Nashville, San Antonio, San Francisco, and San Jose.

37:10Huyen Tue Dao: HPE will include its fourth-gen space-born computer, which the register coined SBC4. I like that. That will be included on Astrolab's Flex Lunar Innovation Platform, or FLIP lunar rover. The rover will be deployed near the moon's south pole later this year. And then the SBC4 computer will test an LLM for searching and interpreting onboard documents and machine learning interpretation of camera and LiDAR data. It'll also do just a bunch of benchmarks on how a computer performs when you're on the surface of the moon with all the vibrations of bouncing around on the rover and the cold conditions and all of that.

37:47And finally, thanks to LurkerB for posting this one on the subreddit. An Orogyna report found that around a third of enterprise IT budgets go to software upgrades, and 28 % of large enterprise IT budgets are spent on vendor-driven changes that the company would not otherwise have chosen. The, quote, software tax is also felt in lost productivity as workers spend time dealing with new updates. 91 % of those surveys support legislation to protect enterprises against forced upgrades.

38:21Huyen Tue Dao: Oh, this is a good one, Lurker B. Thanks for pointing this one out to us. I bet this is going to start coming up. You're going to start here about the software tax, and now you know what it means. It's this idea that software updates come too often, and we spend too much time dealing with them. And there ought to be a law. I don't know if there ought to be a law, but that's what they're going to say. It might be. All right. Well, we end every episode of DTNS with some shared perspectives. Today, Andrew has an example of something he thinks AI is good for. Yes, Andrew wrote, When I started taking blood pressure meds over a decade ago, I had one that required taking three times a day.

38:57Huyen Tue Dao: I tested every available app and settled on one that just worked for me. Its killer feature is that it would ding once every five minutes until you told it you took the pill. Sadly, that app got its last update six years ago and started misbehaving on modern phones this year. I have never touched mobile coding before, but I coded a replacement to the app over a weekend using AI and have been using it to keep me medicated ever since. I even put it up on GitHub. We'll have a link to that in the show notes. I have not yet tried to figure out distribution through the Play Store, though. Generally, software ought to make our lives easier.

39:32Huyen Tue Dao: So if there's something you need a piece of software to do to improve something, there's never been a better time to get AI to help you make that happen. Andrew from Colorado. Yeah, we've been talking about this a bit, especially since now there's like playground apps and things like that. Yeah. And Google's figuring out distribution on the Play Store. I can't disagree with this, especially as an, specifically as an Android app developer, I cannot disagree with this. And it's a good example of something simple, right? There's less to go wrong with this. You just need it to go off three times a day, right?

40:01Yeah. And I know a lot of us have been struggling in the, especially on the Android side, struggling with the Gemini versus Google Assistant. That's not a coup to talk at this thing. But like, you know, like the these little features like reminders and things that we feel like we had or that should be easy. Yeah. Because of the because of that. I wouldn't say gatekeeping because of that, that barrier to entry of software development. So many things that should, again, as you said, be simple, be everyday and but be infinitely useful are unreachable. And now they are much more attainable, even if you don't like if you're not a professional.

40:35And I can't help but think that's great. Exactly. I agree with you, Andrew. Software ought to make our lives easier. That's kind of the point. So I'm into that. Well, what are you thinking about? Do you have some insight? Let us know. Feedback at DailyTechNewsShow.com.

40:49Huyen Tue Dao: Yes. Thanks again, Andrew, for contributing to today's show. Thank you out there for being along for Daily Tech News Show, listening or watching. There was no new patron today, but that could be changed tomorrow by you becoming a patron at Patreon.com slash DTNS.

41:07The DTNS family of podcasts. Helping each other understand.

41:13Huyen Tue Dao: Diamond Club hopes you have enjoyed this program.

41:19This episode is brought to you by Capital One. Capital One's tech team isn't just talking about multi-agentic AI. They already deployed one. It's called Chat Concierge and it's simplifying car shopping. Using self-reflection and layered reasoning with live API checks, it doesn't just help buyers find a car they love. It helps schedule a test drive, get pre-approved for financing, and estimate trade-in value. Advanced, intuitive, and deployed. That's how they stack. That's technology at Capital One.

41:49Huyen Tue Dao: Hey, I'm running out to drop off a stack of letters and packages. Need anything shipped while I'm gone? Save the gas. Stamps.com lets you print postage and schedule pickups right from your desk. Sync your contacts into the address book, get detailed accounting insights, and get notified the moment your certified mail is delivered. all from my desk all from your desk join the 4 million businesses using stamps.com right now with code podcast and get your free welcome gift stamps.com code podcast taxes and fees apply