Editorial: A theme runs through today’s picks: tooling that promises certainty — offline archives, validation tools, formal verification — bumping up against the messy realities of software, maintenance, and attribution. When infrastructure or claims fail, the failure modes are often human: outdated renderers, maintainer burnout, or convenient storytelling.
In Brief
Kobo rejects a valid EPUB; blame Adobe
Why this matters now: Kobo readers and publishers need to know that Kobo’s Adobe-based renderer can silently reject otherwise-valid EPUBs, forcing conversions or device testing before shipping.
An indie author discovered a valid EPUB (it passed epubcheck) that Kobo devices treated as “corrupted.” After digging, the problem was a modern CSS rule using the math() min() function — legal per the spec but unrecognized by the version of Adobe’s RMSDK Kobo still uses. According to the author’s writeup, Kobo routes standard EPUBs to the same Adobe engine behind Adobe Digital Editions, which apparently chokes without a helpful error message. The post includes this maddening behavior: ADE tells the user, “you can’t import that book, you already added it,” while showing a blank screen. Read the original post for the full troubleshooting tale.
"you can’t import that book, you already added it" — Adobe Digital Editions, while showing a blank screen.
Takeaway: epubcheck validates specs, not buggy renderers. The practical workaround is to produce a KEPUB (Kobo’s WebKit-based path) or run conversions with tools like Calibre before release.
curl will pause vulnerability reports in July
Why this matters now: Organizations that monitor curl for zero-days must adjust disclosure channels for July 2026 because the curl project will not accept reports then.
The curl project announced a month-long pause on public vulnerability intake — calling it "thecurl summer of bliss" — from July 1 to August 3, 2026. HackerOne submissions and the project's security email will be a dead end during that window; paid support customers are still covered. The move is framed as maintainer wellness and a business signal that paid support gets faster handling. The announcement prompted mixed reactions: relief and applause for self-care on one side, and pragmatic concerns that attackers don’t respect calendars on the other.
Jane Street: formal methods meet agentic coding
Why this matters now: Jane Street is committing to weave formal proofs into everyday development, betting that AI agents lower the cost of verification and raise its payoff.
Jane Street published a thoughtful roadmap arguing that the rise of agentic code makes verification more valuable, not less. Their point: proofs were historically expensive (they cite multiyear efforts to verify modest C codebases), but if AI writes more code, the verification bottleneck becomes critical — so automating proofs and integrating them into languages like OCaml could scale safety. The post is practical, not idealistic: it’s about shifting costs and tooling, not magic. Read their blog for specifics and examples.
Deep Dive
Kage — Shadow any website to a single binary for offline viewing
Why this matters now: Kage can produce faithful, script-stripped, fully offline copies of websites — useful for archivists, air-gapped teams, and anyone who needs a deterministic, portable snapshot.
Kage drives a real browser (headless Chrome), waits for pages to settle, captures the final DOM, strips scripts and network calls, and writes a static, runnable snapshot. The author bundles output as a ZIM archive for Kiwix or as a self-contained executable that serves the site locally. That combination — faithful rendering plus easy distribution — is what sets Kage apart from older tools like HTTrack or SingleFile.
Two practical strengths stand out. First, by executing the site until it finishes, Kage often captures complex client-side renderings and hydration that static crawlers miss. Second, the tool emphasizes determinism: the project claims byte-identical ZIMs across runs, which matters for archival integrity and reproducibility. Community feedback on the GitHub repo and Hacker News was mostly pragmatic: people suggested a single-HTML entrypoint trick, noted CORS and service-worker quirks, and pointed out that "no tracking" claims are only as good as your snapshot policy.
"No tracking, no network calls, no surprises."
Caveats are real. Some interactive features won’t survive being scriptless, and sites that lazy-load on user gestures may need special handling. There are also legal and ethical considerations when archiving third-party content. Still, for documentation teams, offline training materials, or long-term preservation, Kage reduces friction: a single command can turn a changing web resource into something you can ship on a USB stick or a plane.
Rio de Janeiro’s “homegrown” LLM looks like a stitched model
Why this matters now: Evidence indicates Rio’s Rio-3.5-Open-397B is a direct weight merge of Nex and Qwen3.5, so claims of a locally trained municipal model may be misleading.
A close inspection of the released weights and behavior suggests Rio-3.5-Open-397B isn’t an original, locally-trained model. Researchers allege the weights are an element-wise linear blend — roughly 60% Nex and 40% Qwen3.5‑397B — and found deployment-time prompts that hardcode identity. Once those prompts were removed, the model self-identified as "Nex, from Nex‑AGI" about 79% of the time and never as "Rio." The issue discussion on GitHub lays out the technical evidence and the replication attempts; read the issue thread.
Why this matters beyond PR: model provenance affects licensing, safety analysis, and trust. Nex itself is a Qwen finetune, so a weight merge is a plausible shortcut to decent performance without full retraining. The ethical line is crossed when public-facing claims imply local training or municipal achievement without clear attribution. Hacker News commenters were fascinated by the technical simplicity of a global weight blend and worried about the incentives: it's easy to manufacture a "local win" if disclosure and verification aren’t demanded.
There are technical follow-ups to watch. Independent validation of the blend ratio, checksums on released artifacts, and clearer provenance metadata could settle the matter. For governments and institutions, the episode is a reminder: name your sources and publish enough metadata so third parties can verify origin and licensing.
Closing Thought
Tooling gives us agency — to archive the web, verify code, and ship books — but agency depends on honesty and maintenance. Today’s stories all point to the same friction: infrastructure ages (Kobo’s renderer), maintainers need boundaries (curl), and provenance matters (Rio’s model). The sensible guardrails are simple: test on real targets, document lineage, and fund the people who keep these systems healthy.