Scattered Spider pleads out; Jaeger gets 8.6x cheaper storage

Scattered Spider pleads out, Jaeger gets 8.6x compression on a real workload, and Red Hat spends two posts arguing the same S-curve point from opposite ends.

// SECURITY FOCUS

Scattered Spider members plead guilty on trial day one

The TfL August 2024 attack took down Oyster card top-ups, contactless payments, and staff systems for weeks – a rare case study in what full transit network compromise looks like operationally. The guilty pleas confirm the TTPs attributed to Scattered Spider (SIM swapping, social engineering helpdesks, MFA fatigue) were real and deployed at scale. If your org hasn’t reviewed helpdesk identity-verification procedures and MFA push policies since 2024, this conviction is the prompt.

What to do: Audit your helpdesk escalation paths for account recovery: any path that bypasses MFA via a phone call or ticket alone is the same vector TfL was hit through.

  1. The innovation S-curve: How technology matures, disrupts, and why your next platform decision matters more than you think — Red Hat Blog · Jun 23
    Red Hat’s blog uses the S-curve model to argue that sticking with hypervisor-based infrastructure – particularly VMware post-Broadcom – is a bet on a plateaued curve, while Kubernetes is still climbing. The core claim: Broadcom’s $61B VMware acquisition follows the same harvest playbook it ran with Brocade, CA Technologies, and Symantec – cut R&D, bundle, raise prices, and count on migration pain to keep customers locked in. The CNCF’s 2025 survey puts Kubernetes in production at 82% of container users, up from 66% two years prior, which Red Hat cites as evidence the network-effects flywheel is still spinning. The pitch lands, predictably, on OpenShift Virtualization – VMs as Kubernetes CRDs via KVM, one control plane for containers and VMs alike – positioned as the jump to the next curve rather than a lateral hypervisor swap. It’s a well-structured argument, but it’s still a vendor blog, so weigh the OpenShift-as-obvious-answer framing accordingly; the S-curve logic is sound, the product conclusion is theirs to sell.
  2. Toward More Controllable AI Video Editing: An Early Research Exploration at Netflix — Netflix TechBlog · Jun 23
    By Zhuoning Yuan, Ta-Ying Cheng, Benjamin Klein, Bahareh Azarnoush Introduction At Netflix, we build technology to help storytellers bring their creative visions to life and to help members discover the stories they love. To connect stories with diverse audiences around the world, we produce promotional assets, including trailers, teasers, and social short‑form videos, that build on and elevate the original footage. Through close collaboration with the teams crafting these assets, we identified a recurring gap in current tools. Transforming raw footage into a polished final asset often requires complex edits like seamlessly adding new visual elements, patching or replacing backgrounds, or removing unwanted objects without breaking the scene’s physical continuity. These tasks typically demand hours of specialized manual editing work. While recent generative video editing models show promise, they often struggle to preserve the integrity of the source footage. Many methods regenerate every pixel to make an edit, which can fail to isolate changes and inadvertently alter elements that should remain untouched. To execute these tasks effectively, artists need tools that empower them to dictate exactly what changes and how it changes. Our research goal is to make this process easier for artists. We’re deliberate about where and how AI is applied, ensuring that the technology always serves the creative intent. That principle drives our recent work: exploring the benefits of…
  3. Building Jaeger’s ClickHouse backend: 8.6x compression on 10 million spans — CNCF Blog · Jun 23
    Jaeger v2.18.0 ships ClickHouse as an alpha storage backend, replacing or supplementing Cassandra and Elasticsearch with a columnar OLAP store built for append-heavy telemetry workloads. On a single-node benchmark of 10 million spans across 1 million traces, the backend hit 50k spans/sec ingest throughput, achieved 8.6x compression on the spans table – shrinking roughly 6 GiB down to 722 MiB on disk – and kept trace retrieval around 100 ms with most search queries under 50 ms. The schema sorts by (service_name, name, start_time) rather than trace_id, which pushes trace retrieval from ~27 ms to ~100 ms but drops multi-filter search from ~880 ms to ~140 ms; a bloom filter skip index on trace_id and a materialized view for trace timestamps recover most of the retrieval cost. Attribute-only searches still require full column scans, so the docs recommend always pairing attribute filters with service, operation, or time constraints. These numbers come from a single-node setup with a specific dataset, so production results on distributed clusters or denser attribute schemas will differ – check the linked benchmarking report before sizing anything.
  4. From cost to currency with sovereign AI — Red Hat Blog · Jun 23
    A Red Hat telco exec argues that sovereign AI infrastructure – keeping data local and running your own inference rather than paying external providers per query – is shifting from compliance burden to margin opportunity for service providers. The pitch is that as agentic AI drives token costs up, operators who run their own inference on a controlled stack become “token providers” instead of “token consumers,” turning sovereignty into a revenue line rather than a checkbox. Red Hat points to Telenor AI Factory in Norway and Orange Business Cloud Avenue as customers doing this on OpenShift. The article is a vendor opinion piece with no independent benchmarks or cost figures, so take the margin claims at face value – the underlying logic that fragmented 5G stacks were expensive to maintain and 6G/AI shouldn’t repeat that mistake is the more useful part.
  5. Build an AI knowledge fabric for your organization — Thoughtworks · Jun 22
    Thoughtworks argues that as organizations move from chatbots to autonomous AI agents, the real bottleneck is context – and the fix is a structured “knowledge fabric” rather than pointing agents at existing Confluence or SharePoint dumps. The proposal has three layers: engineering knowledge (your tech stack defaults, security rules, architecture patterns), industry knowledge (domain terminology and regulatory constraints scoped tightly to your vertical), and institutional knowledge (your actual internal APIs, OpenAPI schemas, team ownership, integration patterns). The practical rules are sensible enough – use Markdown and YAML over PDFs, keep chunks short, automate updates via CI/CD pipelines when APIs change, assign explicit owners to each section, and document antipatterns explicitly so agents know what not to do. The concept is reasonable, but the article’s own performance claims are placeholders: cost savings are listed as “X%” and latency improvements as “X seconds,” so there’s no real data to evaluate here. Treat this as a framework post, not a benchmark.

// In other news

ai

cloud

culture

dev

iac

  • Cloudflare-First Networking as Code with Pulumi (Pulumi Blog) · Jun 23 — Pulumi’s Cloudflare provider guide covers managing DNS, WAF rules, and Workers as code alongside origin infrastructure, closing the visibility gap where most IaC stops at the load balancer.

k8s

linux

obs

sec

  • Anthropic’s Fable 5 Model Jailbroken Within Days (Schneier on Security) · Jun 23 — Anthropic’s Fable 5, positioned as the safety-hardened version of Mythos Preview, was jailbroken within days of release – Schneier’s analysis focuses on why guardrail layers keep failing at the same seam.

web

Scattered Spider pled out on day one — patch the auth stack before it’s someone else’s case study. Back tomorrow.

Leave a comment