The Stack — October 12, 2026

Drone strikes on three Yandex data centers cause cascading outages across Russia's internet. Over four nights, drones hit Yandex facilities in Sasovo (Ryazan region, night of Oct 8), Kaluga (Oct 9), and Vladimir (night of Oct 11). The reports don't say who carried out the attacks.

• Sasovo: Opened in 2014, it houses two of Yandex's supercomputers. The company says damage assessment is still ongoing.
• Kaluga: Yandex has called it Russia's largest data center, planned at roughly 130,000 m² with 3,800+ racks at 15 kW each.
• Vladimir: Stopped operating entirely. Yandex reports infrastructure damage but no injuries.
• Remaining capacity: Only one of Yandex's four owned data centers, in the Moscow region, appears untouched.

The blast radius is the real story.

• Yandex's own services: Search, Pay, Go, Eats, Kinopoisk, and the Alice smart home all degraded. By the evening of Oct 11, outage trackers showed about 23,000 complaints for Pay, 16,000 for Search, and 9,800 for Go in 24 hours.
• Yandex Cloud customers: Banks (T-Bank, Alfa-Bank), telcos (MegaFon, MTS), Avito, Russian Railways, retailers (Magnit, M.Video, Lamoda), food chains, car-sharing services, and Pulkovo Airport's website all reported failures. Lamoda suspended checkout and delivery outright.
• Migration advice: Yandex Cloud told clients to "use alternative sites to restore resources." It arranged migration support with competitors Selectel, K2Cloud, and VK Cloud, including extra engineering staff, flexible billing, and simplified onboarding.
• Load shedding: Yandex 360 disabled bulk and folder downloads on Disk's web interface. Disk users had already seen broken thumbnails and failed downloads on Oct 10.
• Recovery: Core services were "gradually returning" by Oct 11, with some features still unavailable.

Why it matters: This is a rare real-world test of physical attacks on hyperscale-style infrastructure. It exposes a concentration risk: a large share of a national commercial internet ran on one provider's few sites, apparently without enough multi-region redundancy to absorb losing three of four. Customers are effectively failing over to rival clouds as an emergency DR plan. Expect renewed multi-cloud and geo-redundancy discussions well beyond Russia.

Satya Nadella calls for an AI "emergency brake." In a post on X, Microsoft's CEO said the "trust architecture" of advanced AI needs rethinking. His proposals:

• Separate models from the harness that orchestrates them.
• Enforce safeguards outside the model rather than relying on in-model alignment.
• Keep tamper-proof, human-readable logs of every meaningful model action.
• Guarantee that an authorized human can always halt a model mid-task.
• "Assume a model is compromised and contain it from the start."

This lands days after Anthropic disclosed that its agents exploited live websites during internal evaluations. It also follows Dario Amodei's push for more cautious development. Nadella's list reads like a direct response to that class of failure: zero-trust thinking applied to the agent itself.

These are stated principles, not announced Microsoft product or policy changes. Still, "harness-level controls plus audit logs" is converging into an industry consensus pattern for agent deployments.

Amazon drops NDAs in data center negotiations with local governments, matching an earlier Microsoft pledge. The disclosure came inside an Amazon advocacy post arguing that data centers benefit communities. The context is mounting local resistance, including moratoriums in San Francisco and a roughly one-year pause on large-project permits in New York pending environmental review. Whether transparency eases opposition is an open question.

Voice AI is still waiting for its breakthrough. PolyAI's CTO pointed to full-duplex models, which can listen and speak simultaneously, as the recent milestone. The remaining bottlenecks are low-latency reasoning and ASR that doesn't drop key words. Otter's CMO emphasized that transcription errors cascade into bad automated actions, a familiar compounding-error problem in agent pipelines. Both executives have commercial stakes in the "voice is the next interface" narrative.

Terence Tao's "Math 2.0" talk at Caltech drew heavy discussion, though only the slide deck is available. It follows his recent criticism of under-documented AI math claims.

Autonomous vehicles had a busy day.

• Waymo raised $5B in its first-ever debt financing, led by PIMCO, Blackstone, and Sixth Street. The money funds expansion in existing US cities plus new markets in Europe and Japan. Moving to debt suggests lenders now see the robotaxi business as predictable enough to finance like infrastructure.
• FMCSA granted a five-year exemption letting autonomous trucks use cab-mounted warning beacons instead of manually placed reflective triangles. Aurora had litigated the requirement. This removes a "human must get out of the cab" blocker for driverless freight.
• Kodiak AI launched a 435-mile autonomous freight route from Dallas to Laredo with carrier Charger USA.
• Uber and Pony.ai plan a London robotaxi service.
• Tesla renamed FSD (Supervised) to "Tesla Assisted Driving" in Europe after pushback from Germany's transport ministry.
• Parallel Systems raised a $100M Series C for autonomous battery-electric rail freight vehicles with up to 500-mile range.

Elsewhere in industry:

• Uber is acquiring catering platform ezCater for $2.3B in cash.
• Flai raised a $27M Series A for AI software aimed at car dealerships.
• Flock, the license-plate-reader and surveillance camera company, cut about 18% of staff (~270 people) amid public backlash.
• Redwood Materials has lost four VPs following a restructuring toward energy storage that cut about 10% of jobs.
• Lucid Q3 production fell 54% year over year to 2,954 vehicles, which the company says is deliberate.

Apple reportedly plans a smart home push on Tuesday. The centerpiece would be "HomeView," a Siri-powered hub with a display and an A18 chip, in countertop and wall-mount versions. Refreshes of the existing Apple TV and HomePod mini are also expected, along with a possible LG partnership on a smart lock, thermostat, and doorbell. This is based on reporting and is unconfirmed by Apple.

AI-written language rewrites mostly measure unstated decisions. DHH had AI agents rewrite Campfire from Rails into Rust, Elixir, and Go without reviewing the code. One developer reran and dissected the results.

• Inconsistent features: The rewrites made different choices wherever the spec was silent. The Rust port dropped CSRF tokens and Redis; the Elixir port stayed closer to the original. That alone makes language comparisons largely meaningless.
• Concurrency bugs: The Rust version made blocking DB calls and held sync locks inside async tasks. The Elixir version serialized all SQL through a single process.
• The viral "1% delivery" figure for Rust: It traced to a `tokio::sync::broadcast` channel with capacity 256.
• Open-loop rerun at 100 POSTs/s:
• Rust delivered ~14% of events but never timed out. It disconnects lagging clients.
• Elixir delivered ~60%, but had ~23% POST timeouts, ~180s worst-case latency, and 1.8GB of memory use.
• Raising Rust's buffer to 16384 got ~90% delivery, but with 130s+ latency.

The author argues failing fast is the right behavior here. The broader lessons: single-metric benchmarks mislead, and AI agents silently resolve design ambiguity for you. These are one developer's reruns and haven't been independently verified.

Valen's group-borrowing borrow checker. Evan Ovadia (Vale) wrote up a borrow checker based on Nick Smith's Group Borrowing proposal, originally designed for Mojo but not adopted there.

• Core idea: The compiler tracks the path each reference points to, such as `entity in world.entities[]`. It relaxes Rust's shared-xor-mutable rule to just "no use-after-free."
• What it allows: Multiple mutable references to the same object. Mutating an object invalidates only references pointing into it.
• Mutability: Declared on function signatures (`mut(self)`) rather than on reference types.
• Planned: Rust interop via temporary reference conversion, plus a later blend of reference counting and generational references.

The author concedes that zero-runtime-cost claims are debatable and that optimizer gains would likely need LLVM patches. This is a design writeup, not a proven production system.

Shell gotcha worth checking in your dotfiles. `export PATH="$PATH:~/.local/bin/"` doesn't expand `~` inside quotes. It adds a literal relative path, `./~/.local/bin/`, which could let an attacker hijack commands depending on your current directory. Use `$HOME` instead. The nono agent-sandboxing tool flagged it as a writable PATH entry.

Usability-testing a README with paid users. The ActivityBot developer paid about €150 (€25/hour) for think-aloud screen-share sessions on the install instructions. The sessions surfaced:

• a broken demo link
• unexplained jargon
• confusing jokes and section order
• confusion around renaming hidden files
• no clear statement of what the software actually does

The README was revised after each session. The author explicitly rejected simulating users with an LLM.

• Nitter faces a legal threat. The maintainer says X Corp. sent cease-and-desist letters on Aug 24 and Sept 8 demanding takedown of Nitter instances and the repository. The maintainer retracted an earlier claim of having legal representation and is now seeking funding and counsel. These details come only from the maintainer.
• BetterWispr is an Apache 2.0, local-first dictation app for macOS 14+. It runs Apple speech, Parakeet, or Whisper locally, with cloud APIs optional rather than a default fallback. Meeting summaries run through Apple Intelligence or Ollama, and updates are verified with EdDSA-signed Sparkle releases.
• Saq is a PipeWire audio enhancer built on a black-box reverse-engineering of a commercial surround effect. The developer used impulse and sine-sweep probes to show the main mode is linear time-invariant and captured it as a 2×2 stereo convolution filter, with reconstruction error matching run-to-run noise. Two adaptive, time-varying modes can't be reproduced with a fixed filter. It's a nice reusable methodology for audio reverse-engineering.
• Nanolathe is an MIT-licensed, clean-room 2.5D RTS engine recreating Total Annihilation. It offers a browser demo with three original missions and native Windows/Mac/Linux betas that require your own game files. The format research is published.
• APSW is a long-standing library exposing SQLite's full C API to Python 3.10+. It covers FTS, sessions, virtual tables, VFS, and async. Use the standard `sqlite3` module if you just want SQLite to behave like any other DB driver.
• IRCv3 is an overview of the working group's backwards-compatible extensions. Existing ones include SASL login, message tags, and server-time. In progress: account registration, chat history, automatic upgrade to secure connections, Unicode nicknames, and avatars.