Issue 15

10 April 2026

Hey there,

Control hides in the boring layer most of the time. Driver signing. Platform reach. A shell command. A browser cookie. None of them feel like grand strategy on their own.

This week they added up. OpenAI got another uncomfortable governance read. France put desktop operating systems into its sovereignty plan. VeraCrypt found out how much of Windows distribution still depends on a human at Microsoft finding the right queue.

Industry

1. The New Yorker reopens the Sam Altman trust file

Ronan Farrow and Andrew Marantz published the most detailed public account yet of the 2023 OpenAI board fight, built on interviews and internal documents not previously disclosed in full. It reads less as a personality profile and more as a governance document. OpenAI is now much larger, much more central, and much more entangled with Microsoft, governments, infrastructure finance and national-security work than it was when the board first tried to remove Altman.

Paywalled. Worth the money. The accompanying animation is free and very funny.

2. EFF leaves X after the numbers stop making sense

EFF announced it is leaving X after almost twenty years. The arithmetic is the part to read: five to ten daily tweets in 2018 produced 50–100 million impressions per month. 1,500 posts last year produced about 13 million impressions for the whole year. The rights argument is in there too, but the reach numbers are sharper. At some point a platform is just a habit with bad analytics.

3. France writes Linux into its state dependency plan

France’s interministerial digital directorate put Linux desktops into the state sovereignty plan on 8 April. DINUM says the state will move off Windows for workstation evolution. Health-insurance administration is moving 80,000 agents onto Tchap, Visio and FranceTransfert. Every ministry must produce a dependency-reduction plan by autumn.

Don’t overstate the politics. The practical signal is enough on its own: desktop OS, collaboration, anti-virus, AI, databases, virtualisation and network equipment are all named parts of the procurement map now. For a Microsoft partner shop like Hanso, this is the conversation that keeps surfacing in European tenants. Sovereignty is on the RFP.

Artificial Intelligence

4. Project Glasswing turns AI vulnerability discovery into an industry coalition

Anthropic announced Project Glasswing with AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks and others, around defensive use of Claude Mythos Preview. Anthropic says the unreleased model found thousands of high-severity vulnerabilities, including in major operating systems and browsers. The commitment: up to $100M in usage credits and $4M in donations to open-source security organisations. Put maintainers in the room before the room is on fire.

5. OpenAI backs an Illinois liability shield for frontier models

WIRED reported OpenAI testified in support of Illinois SB 3444, a bill that limits when frontier-model developers can be held liable for "critical harms" tied to their systems. The scope isn’t small: death or serious injury affecting 100 or more people, at least $1 billion in property damage, weaponisation scenarios. OpenAI’s pitch is harmonisation and clearer federal standards. Critics see a liability shield arriving before the case law does. Convenient timing, as these things often have.

6. Claude Code’s regression complaint becomes product feedback at scale

A long GitHub issue claims Claude Code got worse at complex engineering work after February model updates. The author analysed 17,871 thinking blocks and 234,760 tool calls across several thousand session files. Read the causality carefully – this is user-side analysis, not an Anthropic postmortem.

The complaint resonated because it described a pattern many agent users recognise: less reading before editing, more premature certainty, more "done" when the work isn’t done. Marasy and I have hit versions of this on internal builds at Hanso, which is part of why it caught my eye. Agent quality is being audited like a production system now.

Infrastructure

7. Little Snitch comes to Linux, with eBPF and caveats

Objective Development released Little Snitch for Linux, bringing the Mac network monitor to Linux kernel 6.12 or newer with BTF support. It hooks into the network stack through eBPF, shows which applications are talking to which servers, supports rules and blocklists, and exposes a local web UI. The limitations section is unusually good: this is privacy tooling, not hardening against a determined adversary. Mapping every packet back to a process or hostname is fuzzier than users tend to expect.

Microsoft

8. Copilot CLI gets BYOK, local models, and offline mode

GitHub added BYOK and local-model support to Copilot CLI on 7 April. The CLI can now use Azure OpenAI, Anthropic, OpenAI-compatible endpoints, Ollama, vLLM or Foundry Local. COPILOT_OFFLINE=true disables GitHub server contact and telemetry. GitHub auth is optional with a custom provider, though signing in still enables GitHub-specific features. More model choice, a real air-gapped story, and no silent fallback to hosted models if config is wrong.

9. VeraCrypt gets caught on the Windows signing chokepoint

VeraCrypt maintainer Mounir Idrassi said Microsoft terminated the account used for Windows driver and bootloader signing. No warning, no explanation, no visible appeal path. VeraCrypt couldn’t publish Windows updates while Linux and macOS releases continued. By 9 April, Idrassi said Microsoft VP Scott Hanselman had reached out and connected him with the right people.

The uncomfortable part remains. For Windows encryption software, "can reach a human at Microsoft" is now part of the release process. That is also one of the things Hanso clients pay us for – routing the right ticket to the right person before the release window closes. "Can reach a human" is becoming a real USP, and one I am willing to pay for.

Development

10. Ally Piechowski’s five git commands are a codebase intake checklist

Ally Piechowski’s git-before-code checklist is short enough to steal immediately: churn hotspots, contributor concentration, bug clusters, monthly commit rhythm, firefighting traces. git log has no secret magic. History is often more honest than architecture diagrams – the file nobody wants to own, the senior engineer who left six months ago, the release process that keeps leaving hotfix and rollback breadcrumbs.

Also works well if you feed it to your coding agents.

11. Cranelift explains its acyclic e-graph optimiser

Chris Fallin wrote up Cranelift’s acyclic e-graph, the data structure now sitting in the compiler’s mid-end optimiser. The post starts from the classic pass-ordering problem – redundant-load elimination, GVN, LICM, constant propagation, algebraic rewrites all wanting to cooperate – and walks toward a sea-of-nodes-with-CFG representation that handles more of that reasoning in one framework.

Dense reading. Worth following if you have any appetite for compiler internals. You think I’m a compiler person now, or that I understood a single word of the paragraph Hanoka summarised for me? I am not, and I didn’t. But trying to follow it pulled me into a proper rabbit hole – old lecture memories surfacing, Wikipedia tabs multiplying – and that was a lot of fun.

12. Stripe keeps making Ruby monorepo work look boring

Stripe published a write-up on selective test execution in a 50-million-line Ruby monorepo. "Big monorepo" is not a diagnosis on its own. The question is whether the org has the dependency graph, ownership model and CI discipline to make small changes feel small. Stripe has been unusually good at writing these pieces down.

13. Linux writes down expectations for AI-assisted kernel patches

The Linux kernel tree now has process documentation for AI assistance when contributing. Measured rather than absolutist: contributors stay responsible for understanding and testing their patches, maintainers may ask how AI was used, generated churn is not excused by the tool that produced it. The signed-off-by line still belongs to a human.

Information Security

14. Filippo Valsorda moves his post-quantum clock forward

Filippo Valsorda changed his public position on post-quantum migration urgency after new Google and Oratomic work lowered estimates for breaking 256-bit elliptic curves. His conclusion is practical: ship ML-KEM for key exchange, stop treating non-post-quantum key exchange as fine for secrets with multi-year value, move much faster on ML-DSA signatures even where the wire formats are ugly. Calibrate urgency to risk, not to prediction confidence. If nobody can rule out a cryptographically relevant quantum computer by 2030, the rollout schedule has to move regardless.

15. Deleted Signal messages still left notification artefacts

9to5Mac, following 404 Media, reported the FBI recovered incoming Signal message content from an iPhone notification database after Signal had been removed from the device. The caveat: this appears to involve notification previews being enabled, and the reporting does not prove a universal Signal failure. The operational lesson is sharp. Encrypted messaging can protect the channel while the OS quietly stores fragments around the edges.

Someone better tell Mike.

Coming up

14 April: Apple Business launches globally. Tenant prep is days away now, not weeks.

22–24 April: Google Cloud Next 2026 in Las Vegas. After Glasswing, watch how Google packages its own security-and-agents story against a frontier-lab consortium it isn’t part of.

23 April: Ubuntu 26.04 LTS is scheduled for release. Last clean week to test before treating it as a default base image.

28 April – 1 May: RSA Conference 2026 in San Francisco. After Glasswing, expect the AI-security pitch to be heavy. Watch the gap between coalition announcements and shipped controls.

30 April: Node.js 20 reaches end of life. CI images, Actions runners and serverless environments still on 20 should be off the runway before the date, not on it.

Curious which of these reads as the more uncomfortable signal. Hit me with it.

Regards,
Julian