Issue 34

21 August 2026

Hi there,

Somebody registered a domain as a joke in 2018 to redirect to a weather-balloon tracker, and eight years later found the wind-prediction API being used to plan drone flights over Russia. He did not switch it off, because switching it off would also have consequences.

That is the week’s theme without anyone intending it: small pieces of infrastructure turning out to carry weight nobody designed for. A browser fingerprint hidden in inaudible audio, a phone wipe leading to felony charges, and a search engine offering to hide the results you cannot read.

Industry

An announced marketplace deal, a temporary price cut, and reported talks over debt financing.

1. Stripe and OpenRouter announced a deal

OpenRouter announced it was joining Stripe without disclosing a transaction price. The announcement does not establish that the deal had closed by this issue’s date.

2. OpenAI cut its flagship price by a fifth

OpenAI announced a temporary reduction of more than 20 percent in GPT-5.6 Sol API and credit pricing. The announced discount was promotional rather than a permanent price cut.

3. Broadcom’s debt talks and Nvidia’s Poolside licence

Bloomberg reported Broadcom was in talks to raise more than $60 billion of debt, not that it had raised the sum. Its separate Poolside report says Nvidia, not Broadcom, agreed a $6 billion licence with the startup. These are reported transactions at different stages, not established evidence of a single financing structure.

4. Prosecuted for scraping, and not

A widely shared post set Aaron Swartz’s prosecution for bulk downloading against the training-data scraping now done at industrial scale without consequence. It is an argument about selective enforcement rather than about copyright, and it is not answered by pointing out that the law changed, because it did not.

Artificial Intelligence

Provenance arguments, on three different surfaces.

5. Gruber on Anthropic’s watermark

John Gruber called Anthropic’s text watermarking a perversion of writing, arriving a week after Anthropic explained what the mark actually claims, which is only that Claude was likely involved. The disagreement is real and worth being precise about: Anthropic proposes to alter future model outputs in order to make provenance detectable later, and whether that is a reasonable trade depends entirely on whether the output is yours or theirs.

6. Apple Music will tag AI-generated songs

PCMag reported on Apple’s communication to partners: providers would submit AI transparency metadata, with consumer-facing labels planned later in the year. Apple had not announced a precise display date or a system that independently detects AI-made tracks.

7. OpenAI wants SB 53 widened

A report said OpenAI sought changes to California’s SB 53. Without the original letter, the precise proposal and its effect on competitors are unclear.

Infrastructure

One vendor account of domestic inference infrastructure, and a disputed chip-shipment report.

8. Z.ai describes domestic inference infrastructure

Z.ai says its inference infrastructure uses more than 100,000 Chinese-made accelerators. That vendor account does not establish that a one-gigawatt Ulanqab facility is live or that export controls caused this specific build-out.

9. Nvidia denied a report of a China-tailored chip

A 20 August report relayed a claim that Nvidia would ship a China-tailored chip by year-end; Nvidia explicitly denied it. The report did not establish that shipments would happen. A comparison with Western system pricing would be conjecture, not evidence of Nvidia’s motive.

Development

Three small things that make the machine more yours, or less.

10. Kagi will hide paywalled results

Secondary coverage described a Kagi preference for filtering paywalled results. Kagi’s mutable changelog needs a dated primary entry before we can pin the launch to this week.

11. Android source tags stopped appearing

GrapheneOS reported that Google has stopped pushing Git tags for some Android source. Tags are how downstream projects pin to a release, so their absence makes reproducing a build harder without any announcement having been made. Worth watching if you depend on AOSP for anything.

Information Security

Three stories about infrastructure discovering what it is really for.

12. A joke domain that ended up aiming drones

The author of SondeHub registered the domain in May 2018 as a redirect to a radiosonde filter on someone else’s balloon tracker. It grew into a full weather-balloon platform with an API and open data on S3. From December 2024 a single IP produced weekly spikes of wind-prediction requests, and the eventual explanation was Ukrainian operators using the forecasts to plan fixed-wing drone flights, with a contact confirming they use it to surf the sky toward target areas. He did not block it: he called AWS to keep the account alive and shipped a Docker Compose build of the predictor so people could run it themselves. A request from the US Office of the Secretary of War arrived in 2025, and he invoiced them for it.

13. Felony charges over a wiped phone

Earlier coverage of the charges described Samuel Tunick’s case after his GrapheneOS phone wiped during a border search. The case concerns the legal consequences of a device wipe during a border search; charges are not a finding of guilt.

14. AliExpress fingerprints you with sound you cannot hear

Matt Callaghan worked out why his Bluetooth headphones dropped out of multipoint whenever he opened AliExpress: the site builds a WebAudio graph with a sawtooth oscillator at zero gain, inaudible but enough to claim the audio device and to read back frequency data that identifies the machine. He found two heavily obfuscated scripts inside the site’s own anti-abuse tooling. It is a good reminder that a fingerprinting surface does not have to be a permission prompt, and a better one that the bug report you file about your headphones sometimes turns out to be a privacy finding.

Coming up

31 August–3 September · VMware Explore, Las Vegas. Broadcom’s event focuses on private-cloud operations, hands-on labs and technical sessions. Official event page.

Reply if you want to dig into any of it. I read everything that comes back.

Best regards,
Julian

How this is made

Throughout the week I stumble across a mildly unreasonable number of interesting things, and I forward them instantly to the friend or colleague I think might care – sometimes to their delight, sometimes to their annoyance, and often with no context at all. Heartbeat is the attempt to do that a little better.

Every Friday a small agent I built, Honoka, looks through the places where those links tend to leak out: my private email, work email, Matrix, Mastodon, WhatsApp, Apple Messages, Signal, and the faint imprints on the platen of my Olympia typewriter (still not an API, tragically). It sorts, filters, groups and summarises the week, then hands me a draft.

Honoka is guided by a private corpus of things I have written over the last fifteen years, so it can get closer to how I sound in more-or-less official emails and public notes. I still take a pass by hand: remove things, change sentences, check links, argue with the judgement. Whether that is enough is, frankly, the experiment. Every issue has one item written entirely by hand. If you can reliably spot it, hit reply and judge.