self.md radar — 2026-11-12
a denied AWS request can pass locally
AWS’s launch page promises millisecond responses from local API calls
its security guide says a request rejected by real AWS might succeed there
1. AWS releases a local emulator, with security excluded
AWS Emulator launched on November 11 for testing on a laptop or in CI without an AWS account
existing SDK and CLI calls go to a local endpoint; each running instance gets separate keys, a port and in-memory resources
unsupported operations return 501 Not Implemented
requests signed with the emulator’s own key are never denied, according to its security guide
it does not check S3 bucket policies or KMS key policies; some IAM policies are evaluated, but not as AWS evaluates them
keep a real-AWS test for the application and its security settings before production
the README asks for at least 100 GB of free disk to build from source
that also applies to Rust’s embedded test mode, which compiles the emulator into the test binary
Linux users can install prebuilt packages; macOS and Windows users get a documented Docker path
reading: AWS’s README and build requirements · service limitations and fidelity
2. a missing LLM key could send the OpenAI key instead
a typo in api_key_name was enough
if the named key had not been stored, LLM could silently send OPENAI_API_KEY to the custom api_base
LLM 0.37.2, released November 11, makes that configuration fail with No key found
it also fixes a separate route: responses: true plus -o chat_completions 1 could send the stored OpenAI key or environment key to a custom endpoint when no named key was configured
the first advisory covers versions from 0.6 through 0.37.1; the second starts at 0.32a2
these are documented credential-disclosure paths, not reports of active theft
users of third-party providers, proxies or self-hosted gateways should update and check whether either configuration was used before the update
reading: missing named-key advisory · chat-delegate advisory
3. Gemini Decisions returns probabilities without writing an answer
Google’s new Decisions API scores supplied alternatives: yes/no checks, multiple-choice questions and ordered rubrics
Gemini Decision 1 accepts multimodal input and returns probabilities rather than generating answer text token by token
the limits are a 256K-token context window and up to 1,000 questions, subject to that window
the speed measurements cover a smaller range: Google reports 150–250 ms median end-to-end latency for contexts up to 16K tokens, staying nearly flat from 1 to 100 questions
input costs $0.10 per million tokens, with no output-token charge
shared input is billed once; each question still adds its own instructions and criteria
the documentation warns that choice questions distribute probability across the supplied options even when none fits
it recommends a confidence threshold, a separate scope check or an explicit “other” option
reading: Decisions API types, confidence and out-of-scope inputs
more to read
- Modern Web Guidance 1.0 — Chrome’s November 10 release adds a modernization scan for coding agents; it starts with a limited set of static patterns, while user-facing guides have been reviewed by accessibility experts using assistive technologies