This week, the world's grinding gears
China's building robots while the US watches. Models that think too hard slow down. Reads are the new bottleneck — and it's hitting Brown founders hard. Meanwhile, cameras sin suscripción prove the point: buy once, record, done. La migra app, Uber's payments, DuckDB's English parser — the stack is shifting underfoot.
China's robot squad takes the games — and the world's attention
China sent a 20-unit humanoid robot team to the 2025 International Robot Games in Shanghai. The machines were built by 14 companies, mostly startups, and they competed in five events: walking, running, climbing stairs, pushing a cart, and lifting a box. Most finished without major falls.
The Chinese government is pushing this hard — 2025 is the Year of the Robot, and Beijing is funding the sector through direct grants and tax breaks. The aim is to build a domestic supply chain for humanoid robots, which could eventually feed into manufacturing, logistics, and even labor markets. The robots are still rough, but the scale of the effort is what catches the eye.
Outside China, the race looks different. Boston Dynamics, Figure, 1X, and Unitree are all racing toward the same milestones — but the Chinese push is notable for its state backing and the sheer number of entrants. The games are a showcase, not a competition with a single winner, but the signal is clear: Beijing sees humanoid robots as a strategic industry.
Why this matters for us: if China's pushing cheap humanoids into factories and warehouses, it's a direct shot at the kind of work Brown and Black families have relied on — and the jobs that come with it.
DuckDB ships a peg parser — so you can write queries in plain English
DuckDB 20 just landed with a new peg parser that lets you write SQL using regular English words instead of the usual SQL syntax. The parser accepts statements like "SELECT name FROM customers WHERE age > 30" in whatever form makes sense, and translates it into the actual SQL that runs. This isn't an AI agent. It's a grammar file — a PEG, a parsing expression grammar — that tells DuckDB how to read natural-language queries and turn them into something the engine can execute.
The reason this matters is that SQL is already one of the most widely used languages in the world and one of the most frustrating for anyone who isn't a developer. Writing it requires knowing exact keywords, table names, and join syntax. The peg parser strips some of that away — you don't need semicolons, you don't need the exact word order, and you can spell things out like a human would. The parser lives in the repo as a .peg file, which is the kind of thing that's easy to read, easy to modify, and easy to extend when the team wants to add new phrases.
This is a practical tool for a practical audience. It fits the same pattern as other DuckDB features that make the engine easier to use for people doing data work outside of code shops — analysts, ops folks, anyone writing reports or running queries on the command line. It's not a headline-grabbing AI feature. It's a grammar file that makes SQL less painful to type.
Why this matters for us: a lot of la gente runs queries on the command line or in dashboards where the syntax is a barrier; this shaves off the friction so they can get to the data without needing a SQL tutorial.
Tokens: the key that tells the server who you are
Think of the ID card your boss gives you when you walk into the office. Without it, nobody lets you in. With it, the guard knows exactly who you are and which doors open for you.
On the network, the token is that pass. The server generates it when you log in — when you enter your name and password — and stores it in your browser or app. Every time you make a request, you send the token along with it. The server reads it, checks that it's valid, and lets you in.
It's not the password. It's a long, random number that changes every time you log in. If someone steals it, they can use it as if they were you — which is why it's stored on the phone, not on a piece of paper. If the server revokes your token, that pass is no good; it's like when they take the office key away.
Modern tokens have an expiry date. After that time, they expire and you have to log in again. This protects against theft: even if someone steals it, after a while it stops working.
There are two main types: access tokens, which last minutes, and refresh tokens, which last days. The access token is the pass you use on every request. The refresh token is the one you ask the server for to swap the old pass for a new one without re-entering your password.
The analogy: it's the parking pass. You put it on the dashboard. The guard reads it and knows how much time you have left. When it expires, you swap it. If someone steals it, they can use the car — but only until it expires.
Check whether the app you use lets you revoke session tokens from settings. If you see a list of connected devices, revoke the ones you don't recognize — that closes the door to anyone holding an old pass.
Why this matters for us:
The models were performing for an audience of one — themselves.
— fabiensanglard.net
#the-llms-that-think-too-hard-are-slower-and-dumber-91fdddChina is racing to build humanoid robots — and the US is watching closely
China is pouring money into humanoid robots. The government sees them as a strategic sector, and companies are building them fast. The AP reports that Beijing's push into this field has accelerated over the past few years, with dozens of startups and state-backed labs all trying to make the same thing — a two-legged machine that can walk, grab, and do work.
The US is paying attention. Washington has been tracking the race because humanoid robots could reshape manufacturing, logistics, and even defense.
Models training on models of NYC — no photos, no GPS
Peter B. is showing how you can teach an AI to reason about New York City without feeding it a single photo or street-level image. The trick is to build a structural map of the city — streets, blocks, parks, lines — and then use a vision model to draw that map as a sketch. The model sees the drawing, reads the geometry, and learns the layout. No OpenStreetMap dumps, no satellite tiles. Just shapes and labels.
The reason this matters is that most geospatial AI still leans on heavy imagery: satellite feeds, LiDAR, street-level photos. Those are expensive, privacy-heavy, and slow to update.
How Uber rebuilt its payments for scale and compliance
Uber wrote up the architecture behind its payments platform — the engine that handles rider charges, driver payouts, fees, refunds, and the constant churn of edge cases. The system has to stay online while processing millions of transactions, comply with financial regulations across dozens of markets, and route money to drivers quickly enough that they don't get spooked.
The engineering blog post walks through the key pieces: how they structure the transaction ledger so entries are auditable, how they route payments through the right processors by region, how they handle failures and retries without double-charging anyone, and how they keep the whole thing fast under peak load. The details are mostly engineering — but the real story is the constraint they're solving for: trust. Riders and drivers both need to know the money will land exactly right, every time. One missed decimal or a stale balance and the platform loses its grip on both sides of the market.
Why this matters for us: the same kind of careful, auditable money routing is what any small business needs when it starts moving real dollars — and it's a good reminder that financial infrastructure is boring until it breaks, then it breaks everything.
Asteroid-level change is hitting frontend dev
Asteroid is a new open-source framework that turns a single file into a full stack app — server, client, database, auth, all of it — and ships it with zero config. The idea is simple: write the thing you need in one place, and let the compiler wire the rest. It's not a library you add to your project. It's a different way of writing apps where the boundary between server and client disappears.
What makes it worth watching isn't the novelty — people have been trying to collapse that boundary since Next.js — but the speed. You can spin up a full stack app in minutes. That changes who can ship things.
Teslas go driverless in Austin — behind bollards
Elon Musk says Tesla has started operating fully driverless Robotaxis in Austin. The fleet runs in a geofenced area, kept in by concrete bollards and a 20-mph cap. No human safety driver in the front seat.
It's the first time Tesla has claimed a public deployment without a safety driver. Musk has spent years saying the technology is coming — FSD v12 was a big step, and he's been pushing the full self-driving narrative since 2016. This is a real car on a real street, even if the streets are narrow and slow.
The rollout is small and tightly controlled. It's a proof of concept more than a city-wide service. But it's a milestone: the idea that a car can drive itself in public — a concept Tesla has been promising for years — is now happening in a specific place, under specific rules.
Why this matters for us: as autonomous tech tightens its grip on public streets, the people who rely on transit — low-wage workers, elders, families without cars — are the ones who'll be left behind if these services stay locked behind paywalls and gated zones.
Rust 1.98 — the one that actually ships
Rust 1.98.0 dropped in August 2026. It's the regular six-month release — the kind of thing that keeps the compiler moving without the fanfare of a 1.0.
The changes are the usual mix: edition updates, lint improvements, and the quiet fixes that matter when you're shipping code at 2 a.m. No big announcements, no press releases. Just a working release.
It lands on time, six months after 1.97. The toolchain holds together, the standard library stays small, and the language keeps doing the one thing it does better than anything else: keeping you honest about memory safety without the runtime tax.
Cloudflare's Spectre fix on Workers — 1.4x slowdown
Cloudflare is reworking its Spectre mitigations for Cloudflare Workers, and the trade-off is real. A 2023 fix for the Spectre processor bug slowed Workers by 1.4x. Now they've rolled out a new approach that avoids most of the overhead while keeping the same protection. The fix lands behind a feature flag and can be toggled on by any account.
Spectre is a CPU-level side-channel attack — the kind that lets a malicious page read data from other processes or sites. Cloudflare's original approach was the safe one: add fence instructions to every sensitive branch. That's correct but expensive. The new strategy is tighter — fewer fences, targeted at the spots that actually matter. For most workloads, the difference is small, but it adds up in a platform serving billions of requests.
This is the kind of engineering that never makes headlines but quietly keeps the internet running. The old fix was over-engineered because it had to cover every edge case. The new one is the result of actually measuring what's dangerous. Feature flag means teams can test their own routes before enabling it globally.
Why this matters for us: if you're running Workers, you should check the flag and benchmark — a 1.4x hit on a high-traffic edge route is the difference between a clean bill of health and a surprise bill.
Agent substrates: the missing layer for AI agents
Tencent just shipped AI-Infra-Guard, a toolkit for keeping autonomous agents from doing whatever they feel like. The core idea is simple — agents need guardrails before they get sent off to browse the web or hit APIs. Without them, you're asking a language model to operate at scale and hoping for the best.
The name comes from the substrate pattern: an agent sits on top of a thin layer that constrains what it can touch. Think of it like a sandbox — the agent can read, it can write, it can call specific endpoints, but it can't reach the database directly or hit the billing API. You define the surface area, the substrate enforces it.
The bottleneck is the bottleneck — and it's getting worse
A recent post on Stack Overflow's blog points out something most engineers already know: AI is no longer the bottleneck. The real constraint is the prompt itself — the text you feed it — and that's what's slowing everything down.
The piece walks through how prompt engineering has become its own discipline. It's not just about writing better instructions. It's about context length, token budgets, temperature settings, and the hidden cost of round trips to the API. Every call costs money and time. Every extra token in the prompt eats into your context window. The result is a new kind of development work where the bottleneck isn't compute — it's the human ability to structure the request.
This matters because a lot of the AI hype is built on the idea that the technology itself is the hard part. In practice, the hard part is what you ask it to do, and how you ask. The tools are getting more capable, but the prompts are getting longer, more complex, and more expensive. Teams that figured this out early are already writing internal libraries to manage prompt templates, cache responses, and batch requests. Teams that didn't are burning tokens on half-baked prompts that barely work.
The real bottleneck is the bottleneck — and it's getting worse. That's why the people making money in this space aren't just building models. They're building the plumbing around them.
Why this matters for us: The side hustle that turns a prompt into a real product isn't the code — it's the prompt, and the people who know how to write one are the ones getting paid.
AI is bottlenecking on reads, not writes — and it's hitting Brown founders hard
Stack Overflow has a new post on the real bottleneck in AI workloads: it's reads, not writes. When you're pumping data into an LLM, you're writing tokens fast. But once the model is generating, you're reading those tokens back — and the memory subsystem chokes. The fix is simpler than people think: cache the outputs, batch the reads, and stop treating RAM like it's free.
For the folks running side hustles on a shoestring, this matters. The cousin who built a Shopify plugin for his wife's boutique, the auntie running a translation service from her kitchen — they're all hitting this wall now that AI is baked into everything.
Aiven buys Flow AI — vector search is going to disk
Aiven snapped up Flow AI, a team building vector search indexes that live on disk instead of in RAM. The move is a straight shot at the cost curve: when your vector dataset outgrows the server's memory, you've got two choices. You can throw money at more RAM, or you can stop pretending RAM is free and use the SSD properly. Flow's indexes do the latter.
Vector search is the engine behind RAG and the reason every LLM app is suddenly eating through infrastructure budgets. The old play was to keep everything in RAM for speed. It works until it doesn't — and then the cloud bill gets loud. Disk-based indexes trade a bit of latency for a lot less memory. For anyone running a real workload at scale, that trade is the difference between a line item and a problem.
Aiven sells managed cloud services — databases, Kafka, the whole stack — and this acquisition puts vector search directly inside their portfolio. The company is signaling that the next wave of managed infrastructure isn't about faster chips; it's about not overpaying for things you can put on disk.
Why this matters for us: every small shop running an RAG app just got a cheaper way to keep their costs from blowing up.
Trump orders 8,000 troops into D.C. — and the National Guard stays in 23 states
The White House is moving 8,000 National Guard troops into the District and ordering 12,000 active-duty service members to patrol the capital. The rest of the Guard — roughly 80,000 airmen and soldiers — will remain in their home states, according to the order. The Department of Justice will take charge of the operation.
It's the largest military deployment inside the capital since the 1968 riots after MLK's assassination. The White House says the troops are for the inauguration — Jan. 20 — and the following week, and they'll stay through the end of February. That's six weeks of boots on the ground.
One-time cameras: record locally, no subscription
People buy security cameras without realizing the best ones start charging a monthly fee just a month later. Wired's article lists the ones that don't — the ones that store video on an SD card or a USB drive and need no cloud at all.
You pay once. The camera records 24/7 or on motion detection, and people review the footage from the app without anyone else accessing their videos. That's what most people would expect by default. Instead, the industry charges you for every second your own walls recorded.
Options vary by brand and price, but the pattern is the same: you upload nothing, you pay nothing afterward. If you have a house with windows facing the street or a yard where people pass by, this makes sense. If you're worried about the migra or neighbors who enter without permission, the local camera is the first line of defense — with no risk of a company selling your video to third parties.
Why this matters for us: la gente de la comunidad no necesita pagarle a una startup para ver lo que su propia puerta grabó — y menos aún con la vigilancia que ya viene de los gobiernos y las apps.