Muse Spark Open
Muse Spark Open puts Meta’s coding model on your own hardware
On Thursday's Hacker News front page, Meta released the weights for Muse Spark Open, a model built for coding and long agent tasks. You can download it and run it yourself, or call it through hosts like OpenRouter, Together and Groq. It has 816 billion parameters, but only 42 billion work on any one token, and it holds a million tokens of context. It runs on vLLM, llama.cpp and Apple's MLX.
Two Mac Studios
Meta’s desktop setup is two M5 Ultra Mac Studios with 512 GB each
“So we are looking at least $28k - $30k for the setup Muse team is advertising.”
Running it at home takes two Mac Studios with the M5 Ultra, each holding 512 gigabytes of unified memory, so between them they fit the whole model. In the thread, devy puts that pair at about 30 thousand dollars, and expects the 512 gigabyte Mac Studio to go on sale in late October. For that money, GodelNumbering places the model level with DeepSeek V4.1 Flash on Artificial Analysis, and behind GLM 5.3 Flash and Qwen 3.8 Flash Next.
The Muse Model License
Free to use, until you sell it as an API past $20 million a year
“…the Licensee must notify Meta and enter into a separate written agreement with Meta before offering the Software or any Derivatives as part of that Model as a Service business.”
The Muse Model License lets you build on it for free, commercial products included. The limit is for anyone serving it to others as an API. Once that business passes 20 million dollars a year in revenue, it needs a separate agreement with Meta. Internal use and research sit outside that clause. popinman322 expects it to mean less price competition between the big hosts, and isityettime argues a license with that clause isn't open source at all.
AdFection
A targeted ad delivered Candiru spyware with zero clicks
Discover-Tech, an Israeli company that passed as an ordinary ad buyer, ran ads whose script called home the moment they rendered. For almost everyone, its server sent back nothing. For chosen targets it sent JavaScript that led to spyware from Candiru, and at least 45 devices at Al Jazeera were targeted. Its ads ran on almost 200 thousand websites and apps in four months, through exchanges including Google's, which has now cut it off. Postosuchus, who works in ad tech, points out that the report never names the exploit that fired without a click.
A checksum that passed
A TP-Link access point corrupted downloads and recalculated the TCP checksum
TCP checksum valid TLS bad record mac fix, as root echo 0 > /sys/sfe/l2_feature echo 0 > /sys/sfe/ppe_rfs_feature
A TP-Link Wi-Fi 7 access point was corrupting big downloads, 64 bytes at a time. Qualcomm's driver reused packet buffers without clearing stale cache lines, and the hardware offload then recalculated the TCP checksum over the damaged bytes, so TCP accepted them. TLS and SSH caught it. Two settings turn the offload off, but they need root, the shell TP-Link provides doesn't have it, and the device is out of support, so the author wrote a kernel exploit for their own access point. In the thread, the author, 0xdeafbeef, says at least 13 drivers in the Linux tree share the bug, which stays hidden on x86 and corrupts data on Arm.
Your C is not standard C
GCC, Clang and musl each break the C standard in their defaults
FLT_ROUNDS is always 1, whatever the rounding modeconst int f(); conflicts with int f();va_start blocks C23’s one-argument formThe C that GCC and Clang compile by default differs from the standard in small, specific ways. GCC still ignores every standard floating-point pragma, 27 years after C99 added them, and reports round-to-nearest whatever rounding mode you set. Clang treats a const on a return type as part of the function's type. And musl's own header blocks the one-argument form of va_start that C23 allows. In the thread, dzaima argues the fixed rounding report is defensible, because without that pragma, changing the rounding mode is undefined behavior anyway.
