+ Xiaomi streams its RL training run, live
- Neovim: $800k in Bitcoin, untouched since 2023
- Flock camera dumped: Android 8.1, hard-coded keys
+ Servo: one year of donation-funded maintenanceXiaomi is training its next model live on a public web page, whose counter reads one million dollars and seven restarts. Xiaomi opened the trainer logs of MiMo 2.6 to the internet. Neovim was told it owns eight hundred thousand dollars of Bitcoin it never touched. Hackers cut down a Flock camera and read its firmware. And Servo counted what a year of donations bought. The page is mimo.xiaomi.com/rl: the trainer's own metrics for two reinforcement learning runs, MiMo 2.6 Pro, a trillion parameter model with forty two billion active, and 2.6 Flash, the small one. Both started on Tuesday; by Wednesday night Hacker News had given it four hundred and eighty points, more than most models get at release.
Every step, the Pro run samples about fifteen hundred prompts, two thirds of them code, runs sixteen attempts each in sandboxes, grades them, and trains on the result, two and a half billion tokens a step. The headline is the pass rate, the share of attempts that succeed: fifty six percent at step one, sixty one at step fourteen, the sound of a model learning, or of a very expensive dice game. Now the part no launch blog would ever show you. The Pro run has restarted seven times in fifty one hours, and the operators post the reasons: a VRAM issue on one node; a network problem between the training cluster and the grader; and then, we removed the cyber dataset since we observed some bad patterns in the rollout logs, the most honest sentence ever published by a company selling a model. The Flash run was rolled back to step fifteen because an infra error on one dataset went undetected for three hours, which in most companies is the intern's problem and here is a public changelog entry. Meanwhile the cost counter ticks at five dollars and seventy one cents a second, about twenty thousand dollars an hour, so every restart you watch is somebody's annual salary evaporating live.
The benchmark line is the one to watch. Xiaomi hand-fills DeepSWE scores as checkpoints get evaluated, and Pro went from fifty eight to sixty five point eight in eleven steps, near the top of the coding agent leaderboards. Hacker News asked: if you grade the model on the benchmark while you train it, is that not contamination? The defence: a checkpoint check is not training data, which is true, and also how every lab picks the checkpoint that scores highest. A slide-deck benchmark, drawn live. Two more things. The footer says Open is what we value, yet Xiaomi's own X account has not mentioned the stream; its latest post is a desktop app beta, so the most transparent training run in AI was discovered by a Hacker News user and a Hugging Face engineer. And the model is not out; users of today's MiMo 2.5 Pro call it either great value or fast but dumb, so the stream is a promise, not a product. Then the fortune nobody claimed. A Hacker News user checked the Bitcoin address in Neovim's website footer and found ten Bitcoin that arrived in March 2023, worth a quarter million dollars then and about eight hundred and thirty thousand today. Nothing has left that wallet since October 2019; donations moved to Open Collective, the footer never did. The thread's top worry is the key, not the money: I hope they still have the private key, the crypto version of asking who has the root password after the founder left. Nobody from Neovim has replied yet, so it is either a hardware wallet in a drawer, or a very well-funded paperweight.
Now the camera. A collective called stegan0gram removed a Flock license plate reader from a pole outside Milwaukee, imaged its storage, and gave the partitions to DDoSecrets. Micah Lee read the firmware: Android 8.1 from 2017, a security patch level from June 2018, a Linux 3.18 kernel, compiled in June 2025. Eight years of missing patches on a device that photographed fifty thousand vehicles in a few days. It gets better. Nineteen of the twenty Flock apps share one library with a hard-coded API key, which the camera trades, with its MAC address, for Auth0 credentials it stores in plain text on a partition built to survive a factory reset. The media partition is encrypted; the key sits next to it in a file. Flock says it received no report through its disclosure process, which is technically true, because the researchers reported it to the internet instead. And the good news, small on purpose. A year ago Servo, the Rust browser engine, used its monthly donations to pay one long-time maintainer, Josh Bowman-Matthews, part-time. His report card: one thousand one hundred and fifty pull requests reviewed, eight new maintainers, a hundred and fourteen starter issues, ninety two percent fixed by newcomers. That is what a few thousand dollars a month buys when someone remembers to spend it, which, after Neovim, is a pointed remark.
Verdict: SHIP IT — Seven public restarts beat one polished launch post.
Sources
https://mimo.xiaomi.com/rl/
https://news.ycombinator.com/item?id=49732270
https://huggingface.co/XiaomiMiMo/MiMo-V2.5-Pro
https://platform.xiaomimimo.com/docs/en-US/news/v2.5-price-update
https://news.ycombinator.com/item?id=48282814
https://x.com/XiaomiMiMo/status/2059314052892099070
https://x.com/XiaomiMiMo/status/2097237573261574326
https://artificialanalysis.ai/agents/coding-agents?coding-agents-performance-chart=deep-swe-v1.1
https://x.com/eliebakouch/status/2100316319459500128
https://x.com/jsrailton/status/2100188810914976021
https://x.com/JakeManger/status/2100532260277514660
https://x.com/dmehro/status/2100213742747238820
https://news.ycombinator.com/item?id=49738879
https://neovim.io/
https://mempool.space/address/1Evu6wPrzjsjrNPdCYbHy3HT6ry2EzXFyQ
https://www.wired.com/story/hackers-flock-camera-data-shows-how-system-works/
https://news.ycombinator.com/item?id=49726586
https://micahflee.com/flock-cameras-are-riddled-with-security-vulnerabilities-and-hard-coded-credentials/
https://servo.org/blog/2026/09/15/one-year-of-sponsorship/
https://news.ycombinator.com/item?id=49737849
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.
YouTube · thedailydiff.dev · forward this to the intern who deployed on Friday.