Blogroll

Tools are not cheap, especially when you have a bunch of them. It’s like an investment, so to speak. You put a lot of money into your tool collection, and theft can become a costly setback, not to mention a frustrating experience.

November means the holidays are on the way and cuffing season is in full swing. Hooking up might not sound as fun in the colder months. Instead, you might want to find someone to snuggle with through Valentine's Day — or beyond. Why not try a dating app?

As a lesbian, you probably know all about them. Lesbian Americans (along with bisexual and gay Americans) are far more likely to have ever used dating apps than straight Americans: 51 percent to 28 percent, according to the Pew Research Center.

SEE ALSO: Forget 'Hot Girl Summer.' Fall is the best time to date.

​​Online dating as a lesbian can be a joyous experience, but it can also involve having your space invaded by straight people or seeing your ex-girlfriends (and your ex-girlfriends' ex-girlfriends) show up in your feed over and over. You might also be subject to lesbian vs. bi discourse, but that's not a prerequisite. Scroll on by and focus on doing you.

Over the decades, queer women have turned to personal ads, frequented bars, and relied on word of mouth to find love. These days, it's not too different. From trying to find a date on WLW TikTok to entrepreneurial lesbians creating new apps just for them, LGBTQ women are down to get creative to find their special someone.

Thankfully, in 2026, there are both niche and general apps where queer women can find a partner — whether for one night or for life. Which ones are the best dating apps for lesbians? We tested the most popular dating sites and apps and drew on insights from our Dating & Relationships writers to find out.

How to find the best dating apps for lesbians Niche lesbian dating apps aren't your only option for finding love. Credit: Stacey Zhu / Mashable

In Mashable's recommendations below, you'll find both general dating apps and apps specifically for queer people. As the former appeals to the general population, you'll find more users in these spaces. The caveat, however, is that when you swipe on other women, you might find those coupled with men who are looking for another woman to have a threesome with (aka unicorn hunters). No judgment here, but that's probably not what you're looking for. Then again, people of all types are on dating apps like Tinder and Hinge. You never know who you may come across.

Then there are apps specifically for the community, like HER and Lex. If you yearn for a smaller dating scene, head for these apps. While there's no "Grindr for lesbians" — we go into why in the FAQ section — these apps are more so like stepping into your neighborhood lesbian bar than an app like Bumble. 

You can also try multiple dating apps, as each one below has a free version. You can filter by the gender you identify with and are looking for, and sometimes, as with OkCupid, there are many options to choose from.

Diving into the dating pool isn't easy, but the water's fine. Check out our guide below for the full rundown of our recommendations and dating app reviews.

The first thing your PC does when you press the power button is initialize its hardware, a task handled by its BIOS before handing control over to the bootloader that starts your OS.

Goodbye, GrubHub. Hello, Uber Eats.

That's what Amazon is saying in a Thursday announcement about its new partnership with Uber's popular food delivery service.

Amazon Prime subscribers will now be able to order from their favorite restaurants directly through Amazon's website thanks to a new deal between Uber Eats and Amazon.

There are additional bonuses for Amazon Prime users as well. For one, Amazon Prime subscribers won't even need an Uber Eats account in order to use the service, as the whole process will take place on Amazon's website. 

If you already have an Uber Eats account, that part of the partnership might not seem all that enticing. However, maybe this part will: Amazon Prime subscribers will also pay $0 on delivery fees for all orders of $25 or more as part of the partnership.

Amazon and Uber will also be providing Prime members with a limited-time offer to celebrate the partnership. Over the next two weeks, Prime subscribers can get $20 off their first two Uber Eats orders of $25 or more.

While the order receipt will come from Uber Eats, Amazon will handle everything else for Prime users ordering delivery. The order process and delivery alerts will also come from Amazon.

Amazon originally entered the food delivery business with Amazon Restaurants, which was an in-house service provided by the company. However, in 2019, Amazon shuttered Amazon Restaurants and opted to instead partner with food delivery companies.

In 2022, Amazon announced a new partnership with GrubHub, which provided Amazon Prime users with a free GrubHub+ subscription. Two years later, in 2024, Amazon and Grubhub extended their partnership, making the Grubhub+ membership an ongoing perk for Prime members.

With the UberEats deal, Amazon's relationship with GrubHub is coming to an end. Both Amazon and GrubHub have confirmed that the partnership between the two companies will end on Thursday.

Ditching GrubHub for UberEats makes sense for Amazon. Amazon Prime perks are there to encourage its customers to keep their paid subscription active. According to a report from Foodspark, Uber Eats has between 23 and 26 percent share of the U.S. food delivery market. GrubHub only captures between 6 and 8 percent. This makes the new Amazon Prime offering much more appealing to a larger portion of its customer base.

Want more tech and digital culture news delivered to your inbox daily or sent straight to your device? Sign up for Mashable's Top Stories newsletter or get Mashable push alerts today.

After waiting 13 years for a new Grand Theft Auto game, Kai Cenat plans to take his time with it.

The streamer has clarified his plans for GTA 6, telling fans that his playthrough will leave plenty of room to explore rather than race through the story. In a post on X, Cenat said he wants to be "fully immersed" in the game and encouraged his audience to enjoy it at their own pace, too.

"Don't want you guys to think your [sic] about to see me try to beat the story fast as hell," he wrote. "Not happening."

This Tweet is currently unavailable. It might be loading or has been removed.

Instead, Cenat said he'll combine story missions with "high-level exploration," discovering new features and enjoying the game fans have spent more than a decade waiting for. As for how long he'll be live, he's leaving that open.

"I ain't coming off stream until I feel like it’s the right time," he wrote.

The update follows Cenat's announcement of a separate GTA marathon ahead of the new game's release. As Mashable reported earlier this week, he plans to stream GTA 3, Vice City, San Andreas, GTA 4, and GTA 5 in one sitting, with the broadcast scheduled to begin Nov. 5 at 3 p.m. ET on Twitch and YouTube.

SEE ALSO: As 'GTA 6' release looms, Kai Cenat will stream 5 'GTA' games in one sitting

For GTA 6, though, his message goes beyond what viewers should expect from his stream. Cenat also urged fans to make time for their own playthroughs, saying the internet moves quickly and people don't always appreciate good games while they're playing.

"Take time and really have fun!" he wrote.

Grand Theft Auto VI launches Nov. 19 on PS5 and Xbox Series X/S.

When Archive of Our Own (AO3) went offline on Oct. 29 for an extended maintenance period, millions of fanfiction readers suddenly found themselves with a lot more free time. But fandom doesn't simply disappear when its favorite website goes down. It finds somewhere else to congregate.

And apparently, that somewhere is Tumblr, an old familiar haunt for millennial fans.

According to data shared with Mashable by Tumblr, the blogging platform has seen a significant increase in new users since AO3 went offline. Between Oct. 29 and Nov. 2, new sign-ups increased 49 percent compared to the previous two weeks. Among users ages 18 to 25, that number jumped to 75 percent.

SEE ALSO: AO3's outage has exposed a growing divide between fanfiction authors and readers

Tumblr also reported an increase in daily active users, though it did not provide a specific percentage. Meanwhile, the biggest increase in daily users joining Tumblr Communities, the platform's dedicated spaces for shared interests, reached 63 percent.

In other words, AO3's temporary absence appears to be giving one of fandom's longtime gathering places a boost.

This Tweet is currently unavailable. It might be loading or has been removed.

"Fandom has always had a home on Tumblr, and we're glad to be a place fans can gather while AO3 recovers," Ari Levine, Tumblr's head of brand marketing and partnerships, said in a statement. "We've offered to help, and we're rooting for the OTW's volunteers and hope to see it back soon."

The numbers offer a glimpse into how fandom communities are navigating AO3's extended downtime. The fanfiction archive, which is operated by the nonprofit Organization for Transformative Works (OTW), has become an essential part of online fandom culture, housing millions of fan-created stories across thousands of fandoms. Its temporary shutdown has left readers scrambling for alternative ways to access their favorite works and writers figuring out where to reconnect with their audiences.

This Tweet is currently unavailable. It might be loading or has been removed.

For some, that means returning to Tumblr. Of course, Tumblr and AO3 have long existed alongside each other in the fandom ecosystem. Where AO3 provides an archive for fanworks, Tumblr has historically served as a place to discuss them, share recommendations, post fan art, and build communities around shared obsessions. It's where a reader might discover a new ship, find a fic recommendation, or follow an author whose work they love.

That relationship makes Tumblr a natural gathering place during AO3's absence. According to Tumblr, fans have been sharing fanfiction recommendations, reconnecting through fandom Communities, and commiserating over the outage.

What's particularly notable is the increase in younger users. Tumblr has been a fixture of internet fandom for well over a decade, but its 75 percent increase in sign-ups among 18- to 25-year-olds suggests that the current disruption may also be introducing a new generation of fans to the platform.

Still, the numbers don't necessarily mean Tumblr is experiencing a permanent resurgence. The company shared percentage increases rather than raw sign-up figures, and it's too early to know whether these new users will stick around once AO3 returns. The timing also doesn't establish that every new account was created because of the outage.

But the surge illustrates something about how online fandom works. Fan communities aren't confined to a single website, even when that website becomes central to how they participate. They exist across platforms, held together by the people who create, recommend, discuss, and share the stories they love.

AO3 may be where fans go to read the fic. But while it's offline, Tumblr is reminding them that fandom has always been about more than the archive.

Read more of our creator coverage, sign up for our Trending Now and Top Stories newsletters, or get Mashable push alerts to discover the internet's most exciting voices.

Pornhub is one of the top-visited websites in the world. So, performing their civic duty on Election Day doesn't stop Americans from watching explicit content.

It seems that the U.S. (at least, half the states where Pornhub isn't blocked) woke up with an insatiable urge to watch porn, as traffic at 5 a.m. was 22 percent higher on Nov. 3 compared to an average day. (All visitor times are adjusted by local time, according to Pornhub.) The above-average numbers continued until around 4 p.m., before most polls closed.

Credit: Pornhub

For the next couple of hours, traffic dipped at most 10 percent below average. In the early evening, perhaps after many people voted, it rose up again to slightly above average. By 10 p.m., though, it was back down — maybe because they were watching Steve Kornacki deliver the election results instead.

SEE ALSO: The 10 best hookup apps of 2026: I swiped until my thumb hurt

Pornhub has blocked itself in many states due to age-verification laws, so there's no data on whether people in key battlegrounds like Georgia, Texas, Florida, and the Carolinas opted to watch porn on Tuesday.

But in Washington, D.C., Pornhub traffic was a staggering 43 percent higher than average in the morning and 25 percent in the afternoon, suggesting that political staffers may have had to let off a little steam. (It's less staggering than in 2022, however, when Pornhub traffic doubled in D.C.)

Wisconsin also saw a bigger-than-average day on Pornhub, with 20 percent higher traffic in the morning and 16 percent in the afternoon. Michigan and Ohio, with their highly-watched races, saw modest increases (8 percent and 5 percent, respectively).

See how other states fared on Election Day in Pornhub's blog post.

TL;DR: Burger King is launching its 2026 holiday advent calendar. Sold exclusively on BKAdventCalendar.com, 110 calendars will be available daily from Nov. 16-20, while supplies last.

Burger King announced that its limited-edition holiday advent calendar is returning for its third consecutive run. Unlike standard chocolate-filled boxes, the 2026 BK Advent Calendar lets buyers build a fully functional miniature Burger King restaurant over 12 days.

The box retails for $19.54 (a nod to the year the chain was founded in 1954). The catch? It is incredibly tough to actually get your hands on this viral product. Only 110 units will drop each day at 12 p.m. ET from Nov. 16-20, exclusively via BKAdventCalendar.com while supplies last.

The last two calendars sold out in under five minutes, so fans are encouraged to mark their calendars before this year's drop is gone for good. In fact, you can text “ADVENT” to 251-251 to get a reminder when the first drop goes live.  

Behind each of the calendar's 12 doors is a piece of the Burger King experience, just mini. From fan-favorite menu items like the Whopper to restaurant details like the King's Booth and a soda fountain, the calendar packs some of the brand's most recognizable elements into an extremely festive package. 

And on Day 12, the pieces combine to form a complete miniature storefront, accompanied by a $5 BK digital coupon code for Royal Perks members.

"We know Guests will be excited that for the third year in a row, the Advent Calendar is back, and it's the best one ever," said Joel Yashinsky, Chief Marketing Officer, Burger King US&C. "These limited-edition Advent Calendars sell out fast, and we know our Guests are always looking for more holiday fun from BK. So this year, fans can build their very own BK restaurant, complete with a mini-Whopper, nuggets, and other items that make BK feel like BK. It's our one-of-a-kind way to celebrate the season, and we can't wait for families to bring a little BK home for the holidays!"

Inexpensive Android TV streaming boxes have become a popular alternative to streaming devices from established brands that typically cost more. A lot of these are manufactured in China, and then they're sold in the US under different brand names. Like other streaming devices, these boxes provide access to popular streaming apps, but many also offer fewer restrictions on installing third-party software. That flexibility makes them particularly appealing to those looking to access pirated TV shows, movies, and live television. Regardless of how you plan to use it, if you bought one of these devices, you may have gotten more than you bargained for.

Halloween may be over, but that isn't stopping Sony from performing their second resurrection in less than a month.

Following the rebirth of the Walkman (starting at an eye-watering $1,899.99), Sony is launching the Sony MDR-3R wired headphones. It's a modern take on the headphones that launched with the original Walkman. (You may also recognize them as the headphones Max wears in Stranger Things.) I got to try these new headphones ahead of their release, and they sound surprisingly good.

The new USB-C version of the retro headphones brings modern tech to the original Sony MDR-3 Walkman headphones, but the classic '80s design is the same. And unlike the Walkman 2.0, you won't have to shell out thousands if you want to live out your analog dreams: the headphones are available at Amazon and Sony for $59.99.

For this release, Sony's also rolling out an appropriate collaboration: a Stranger Things edition of the headphones will launch in honor of Stranger Things Day on Nov. 6. They feature an exclusive design with red and black ear cushions, plus a Stranger Things engraving on the headband. The price point is also slightly higher, at $79.99.

Where to buy the Sony MDR-3R headphones Only the smartphone gives away the era. Credit: Sony

The retro Sony MDR-3R headphones are available at major retailers, including Amazon and Sony, for $59.99. Included with the headphones is two pairs of swappable ear cushions in blue and orange. Unlike the original version, they come with a USB-C connection and an in-line remote on the cable for playback controls, as well as a built-in mic for phone calls.

Headphones that easily fit in to Hawkins. Credit: Sony

The Stranger Things edition comes with red and black ear cushions, while the standard version comes with blue and orange.

Opens in a new window Credit: Sony Sony MDR-3R $59.99 at Amazon and Sony
  Shop Now at Amazon and Sony Opens in a new window Credit: Sony Sony MDR-3R 'Stranger Things' edition $79.99 at Amazon & Sony
  Shop Now at Amazon & Sony How the Sony MDR-3R headphones sound

First things first — I can confirm that listening to "Running Up That Hill" does hit different on these headphones.

Before I get into the sound, I also want to note that I was complimented on the look of these headphones three different times while testing them out. In the dozens of headphones I've tested, that's never happened before — and I've tried the Nothing headphones.

Credit: Sony

As for how they actually sound, Sony went for a similar profile to the OG version, using the same 23mm driver units found on the original headphones. Naturally, some re-engineering took place to give these headphones the benefits of modern audio tech. I will say — I was surprised by how clear the sound came through. Sure, it doesn't have the greatest depth, but I don't need that from these retro on-ear headphones.

The other huge benefit? While they can handle a range of genres, listening to music from the 70s and 80s on these just feels right. Never has Queen's "Cool Cat" felt so funky or has Billy Joel seemed so in a "New York State of Mind." Don't even get me started on the Talking Heads. I also discovered, while listening to Pat Benatar's "Hit Me With Your Best Shot," that these headphones can get really loud, so proceed with caution.

SEE ALSO: Bose announces ANC wired earbuds, and I got to try them early

As expected, they did experience some sound leakage — my roommate sitting a few feet away from me could hear Pat wailing "fire away" clearly as I tested the limit of the headphones, but even at normal volumes, she could tell I was listening to something, even if she couldn't quite identify what. There were also some issues with sound leakage on calls. When FaceTiming my girlfriend, she said she heard herself speaking (even as I had the volume low), but she stipulated that it was an issue she experiences with AirPods-wearing friends, too.

All told, these aren't your premium headphones — but they're not trying to be. They're a fun way to lean into a very particular (very cool!) aesthetic, while getting a decent listening experience. They're certainly meant to be an eye-catching accessory. With no ability to fold or a carrying case, you better be ready to show them off wherever you go.

Want more tech and digital culture news delivered to your inbox daily or sent straight to your device? Sign up for Mashable's Top Stories newsletter or get Mashable push alerts today.

At a glance

• Formal methods for everyday software. PDD Kit helps you turn your intent into a formal spec, then proves the code your agent writes for every input and uses tests where a proof can’t reach. It takes formal methods beyond niche, specialist work to engineers without a formal methods background and to everyday applications, like the full-stack web app shown here.
• Exhaustive line-by-line human review can become difficult to scale as AI agents generate increasingly large amounts of code. The plan is supposed to be the contract between you and a coding agent, but nothing actually forces the agent to follow it. The tests it writes usually check what it built, rather than what you asked for. 
• PDD Kit makes the agent keep the plan. It works with you to turn your intent into a formal specification in Verus (opens in new tab), proves the agent’s code meets that spec for every input, and falls back to tests where a proof can’t reach.
• We tried it on a full-stack web app. Inside GitHub Next’s Chopin (opens in new tab), we used PDD Kit to formally verify the login logic of Pet Store, a Rust (opens in new tab) storefront. Verus hardened the code and uncovered existing bugs, proving the absence of login bugs with respect to the specification. The developer reviewed the intent and never read the generated code line-by-line. 

The plan is the contract the agent should follow, but nothing constrains the agent to follow it.

Coding agents now ship whole features in one sitting often spanning tens of thousands or hundreds of thousands of lines of code. As a result, reading every line of the pull request doesn’t scale to this new way of work. Now, most teams invest in the plan and relevant testing instead: describe to an agent what they want, go back and forth until the plan and proposed tests look right, and hand them off to the agent for implementation. 

This plan or natural language spec is meant to be the contract that an agent holds. However, in practice, the agent can drift from it. It implements something slightly different, then writes tests that pass for its implementation rather than the code you intended it to write. Continuous integration (CI) grows due to a profusion of low quality and high quantity of tests, coverage looks healthy, and the gap between what you asked for and what shipped stays hidden until a bug report or a nasty edge case shows up.

So, how do you reliably scale review as agents generate increasingly large amounts of code? Agent code fails in two ways a careful reviewer would usually catch: it leaves out something obviously necessary, or it does something obviously wrong. Tests alone don’t close that gap, because they only exercise a tiny slice of what a program can do. Closing it needs a different kind of machinery, which is where proofs come in.

Review asks “does this look right?” A proof answers “is this right?” A mathematical proof shows that code meets its specification for every input, including the ones your test suite can miss. That provides stronger assurance for specified properties than testing alone, especially when line-by-line review isn’t practical.

Proofs used to be too expensive for everyday software. You needed specialists, unfamiliar languages, proofs many times larger than the code, and proofs took years to develop, but two things have changed since. First, recent advances in coding agents have made it increasingly practical for them to help generate formal proofs from well-defined specs. Secondly, agents can now better help you write formal specs. We call this new software development paradigm Proof-Driven Development (PDD). PDD Kit is our toolkit for it.

How PDD Kit works

PDD Kit is to formal methods roughly what Spec Kit (opens in new tab) is to Spec-Driven Development. It runs as a partner inside Chopin (opens in new tab), GitHub Next’s real-time, multiplayer planning environment, where a team and agents can plan in one shared document.

The workflow has two halves (Figure 1). First, team members review intent in plain language. PDD Kit asks the questions a careful reviewer would ask, explains the relevant code as it goes, and records the answers in an intent artifact, a document that bridges the user’s intent with the formal specification or tests. The parts of the user’s intent that can be formalized are converted into formal specifications and the rest, which must be taken on trust, are converted to informal specifications for tests. PDD Kit automatically generates proofs that the code satisfies the derived formal specs and high-quality tests for the informal specs. You don’t need a formal methods background for any of it. 

Figure 1. Proof-Driven Development with PDD Kit. Team members settle intent. Verus and the test suite hold the code to it.

Consequently, every result in PDD Kit says which kind of verification it rests on: 

• Formal verification is a mathematical proof that code satisfies its specification for every possible input, checked by a tool called a verifier. For PDD Kit today, that verifier is Verus (opens in new tab), a proof language for Rust co-developed by Microsoft Research, Carnegie Mellon University, VMware Research, ETH Zurich, MPI-SWS, UNSW Sydney, the University of Texas at Austin, the University of Michigan, the University of British Columbia, the University of Wisconsin–Madison and the Weizmann Institute of Science.
• Empirical verification checks code by running it and observing what it does. It covers what a proof can’t reach, such as a third-party cryptography library or a user interface. It uses unit and end-to-end tests, terminal automation, browser agents, and computer-use agents for anything a browser can’t drive. A passing test only shows the code worked on the inputs it tried, so PDD Kit labels it as evidence rather than proof.

The line between the two is the Trusted Computing Base (TCB): the code that the proof assumes behaves as described. PDD Kit makes that line explicit and asks you to sign off on each piece. 

The capstone: a full-stack web app

To show PDD Kit integrating with existing codebases, we built Pet Store, a full-stack web app written entirely in Rust (opens in new tab). The backend uses Axum (opens in new tab) and SQLite (opens in new tab) and handles inventory, promotions, orders and checkout. The storefront is a Leptos (opens in new tab) app compiled to WebAssembly (opens in new tab). Together they come to about 5,000 lines of Rust.

For brevity in this blog, we focus on formally verifying the login logic of the app, but the same process can be used to verify functional correctness of the entire app. PDD Kit recommends starting with the most sensitive parts of your application and incrementally verifying your application. A login bug can hand an attacker a customer’s account or an admin’s controls, so that’s where proof effort pays off first. The developer’s whole request in Chopin was two sentences: 

Verify the login logic in backend/src/handlers/auth.rs. Here are my requirements:

1. You only get a token with the right password.
2. Only admin accounts get admin tokens.

We kept the request rough on purpose. Capturing the intent of the user and turning the user request into something a proof can check is PDD Kit’s job.

Step 1: Questions before code

PDD Kit’s planning workflow, pdd-plan, reads the code and comes back, before writing anything, with questions in a Decisions tab. When a question depends on how the code works, the card explains that part first: the goal, how the pieces fit, and the exact function involved, so you can answer without opening the source. 

Figure 2. The first decision card. “Only with the right password” on its own is also met by a login that refuses everyone. Proving both ways rules that out.

The question looks pedantic, but it matters. “You only get a token with the right password” rules out the bad case, a wrong password getting a token, and a login that refuses everyone keeps that promise perfectly. “The right password always works” is the half that rules it out. Formally, the first is an implication (token ⇒ right password) and the second is its converse. Together they make an “if and only if.” An agent left alone would pick one without telling you, but here the developer picked both ways.

Step 2: A human readable intent map

As the conversation goes on, PDD Kit keeps a rough work section at the top of the plan current, so a user can keep track of important concepts without having to scroll back through a long chat to find what was agreed. It includes a flowchart of the login being specified, a spec landscape of what will be proved and what will be trusted, and, when a picture helps, a mental model. For login, PDD Kit drew a ticket desk (Figure 3).

Figure 3. PDD Kit’s mental model for login. The field you send picks the window, the window picks the table and with it the role, and nothing prints until the password matches.

Below it, the intent map ties each requirement back to the developer’s own words and records how it was settled (Figure 4). Each entry links to the section of the formal spec that models it and to the tests that cover it, and the spec section shows snippets of the Verus contract, annotated so the developer can see how the formal spec models their intent.

Figure 4. An intent map entry after the decision: a login gets a token only with the right password for that account, and always with it. The flowchart shows every way the password check can end.

The decision card in Figure 2 is the kind of ambiguity an agent would otherwise settle silently. Figure 5 shows how small the difference looks on paper: the two readings disagree in a single cell, a right password that gets no token.

Figure 5. Two readings of the same sentence. They differ in one cell, and that cell changes what the proof has to establish. Step 3: Proving the login function

Before anything gets built, PDD Kit asks the team to sign off on the plan as a whole. Its first draft proved the decision at the center of login, picking the table and gating on the password, and kept the handler around it trusted and tested. That’s a sensible default, and it’s what PDD Kit recommended, but the developer wanted more. The handler is where the lookups get awaited and the token gets signed, and that glue is exactly where a refactor can quietly swap two lines. So at intent review the developer chose to give the login handler its own async spec, so the proof covers that glue too instead of trusting it (Figure 6).

Figure 6. Proving more of login means trusting more small wrappers. The card says so before the developer chooses. 

That choice moved almost everything into the proof and left the login handler with nothing to do but unpack the request. A new async function, login_flow, carries the contract from the request’s fields all the way to the token or the HTTP error. PDD Kit then brought the revised plan back for a fresh sign-off, because matching your intent isn’t proof, and it doesn’t approve new trust or a wider scope. 

Step 4: Where proof stops

There are plenty of things you can’t prove about a program, and login runs into most of them:

• Code the verifier can’t see. bcrypt’s hashing, sqlx’s queries and jsonwebtoken’s signing live in other crates, outside the proof. 
• Facts about the outside world. What SQLite holds right now and what time the clock says are inputs to the program, not something its code can establish. 
• Whether, and how fast, something finishes. The spec says what you get if login answers. A hung query, or a slow one, breaks nothing in it. 
• Anything a person has to judge, like whether an error message helps or a screen makes sense. 
• Whatever nobody wrote down. A proof covers its spec and says nothing about requirements outside it. 

That’s where empirical verification comes in. PDD Kit spells out the trusted boundary, the part of the TCB this proof leans on. It wraps each trusted piece in a small function with an assumed contract, using Verus’s #[verifier::external_body] or external_fn_specification, asks the developer to accept each one on its own, and writes a test for every assumed clause into the plan. For login, the developer signed off on six pieces:

• The two lookups, Customer::find_by_email and Admin::find_by_username. Each awaited, successful lookup returns exactly the row its own table holds for that email or username, or none. 
• check_password, a thin wrapper around bcrypt::verify. It errors only on a stored hash bcrypt can’t read, and Ok(true) means exactly the right password. 
• generate_token, which signs exactly the claims it is given under the configured secret and reports a signing failure as a 500. 
• expiry_from_now, which reads the clock and writes an expiry exactly 24 hours later. 
• database_error, which turns a failed lookup into today’s 500 with sqlx’s message. 
• The login handler shell, which unpacks the request and passes its fields to login_flow unchanged. 

In the spec, a lookup keeps its code where it is and gets a contract from the outside with external_fn_specification: 

/// Looks up a customer by exact email. 
/// Trusted, not proved: the SQL query runs in sqlx, which Verus cannot check. 
/// Every customer promise of `login_flow` rests on it. 
#[verifier::external_fn_specification] 
pub async fn ex_customer_find_by_email(pool: &sqlx::SqlitePool, email: &str) 
    -> (r: Result, sqlx::Error>) 
    ensures 
        // When the query succeeds, it returns the customers row on 
        // file for exactly this email, or None when there is none. 
        r matches Ok(found) ==> found == customer_on_file(email@), 
{ 
    Customer::find_by_email(pool, email).await 
} 

The clock is a small wrapper marked #[verifier::external_body]. Verus uses its ensures clause and never reads the body: 

/// Reads the clock and computes a token's expiry 24 hours ahead. 
/// Trusted, not proved: chrono's clock is outside the proof. 
/// It panics if the time is out of range, as today's login does; 
/// that panic is not promised against. 
#[verifier::external_body] 
pub fn expiry_from_now() -> (r: Expiry) 
    ensures 
        // The expiry is exactly 24 hours (86,400 seconds) after the clock reading. 
        r.exp as int == r.now as int + 86_400, 
{ 
    ... 
} 

Figure 7 puts the three layers together: what Verus proves, what people accept and tests check, and what nobody is promising. 

Figure 7. Where the login proof stops. Verus proves the core for every input. People accept the trusted ring and tests check it. The plan lists what nobody is promising. 

Figure 8 maps what gets proved and what gets trusted. Each trust decision is its own card. It shows the clauses Verus will take on faith, what the developer is accepting, and which promise falls apart if the assumption is wrong (Figure 9). Every assumed clause then gets an empirical check in the plan’s Empirical verification section, written as Given/When/Then scenarios before any test exists (Figure 10). An entry says planned until it has run, and then it records the command’s result and the commit it ran against.

Figure 8. What gets proved and what gets trusted in login. Green functions are proved by Verus for every input. Amber pieces are trusted, accepted by the developer, and checked by the planned tests in the plan’s §4.1. Figure 9. A trust card for check_password. Verus takes these two clauses on faith, so a person accepts them and two tests check them.  Figure 10. A planned test for the trusted check_password, written before the test exists. The plan labels a passing test as evidence rather than proof. 

The plan is just as explicit about what nobody is promising: that the login future ever completes, that an out-of-range clock won’t panic, anything about the timing or rate of attempts, and how other endpoints read the role. 

Step 5: Reading the spec

The intent artifact is what the team reviews. It’s the plain-language version of the formal spec PDD Kit writes as Verus contracts. You might be wondering whether someone now has to read the proof instead of the code. Nobody does, because the coding agent writes the proof and Verus checks every step of it. If Verus accepts the proof, it holds whether or not anyone reads it. The spec is what the proof is held to, so that’s what people review, and this one is short enough to learn to read in a few minutes. Each function gets an ensures block: statements about its result, r, that must hold for every possible input. Verus checks them when you build, and if any clause could fail for even one input, the build fails and Verus points at that clause. Each clause reads as an if-then, and Figure 11 takes apart the clause for the developer’s first requirement.

Figure 11. The ensures clause on login_flow for “You only get a token with the right password.” The same account a appears on every line, which ties the password check to the token.

Notice that the same a appears on every line, which ties the password check to the token. For example, imagine a bug where login checks the password against one account but signs the token for another. Bob logs in with his own, correct password and gets back a token for Alice’s account. Each step looks fine on its own, but this clause catches it, because the password check and the token have to name the same account. That’s the kind of wiring bug a test suite rarely thinks to look for. The spec also has to talk about SQLite, bcrypt and JWTs without running any of them. It does that with uninterpreted functions, names with no body: customer_on_file(email) and admin_on_file(username) for the rows the database holds, bcrypt_verdict(password, hash) for what bcrypt would say, and token_claims(token, secret) for what a token carries. Verus knows nothing about them except what the trusted contracts from Step 4 promise. The proof says “whatever the database holds, login does the right thing with it,” and a trusted contract says “the lookup returns what the database holds.” 

/// The customers row the database holds for 
/// exactly this email, if any, when login looks. 
/// Left abstract: only `Customer::find_by_email`'s 
/// trusted contract says what it is. 
pub uninterp spec fn customer_on_file(email: Seq) -> Option; 
... 
/// What bcrypt says about `password` against a 
/// stored `hash`: Some(true) when it is the password 
/// the hash was made from, Some(false) when it is 
/// not, None when bcrypt cannot read the hash. 
/// Left abstract: its meaning is bcrypt's, taken on trust through `check_password`. 
pub uninterp spec fn bcrypt_verdict(password: Seq, hash: Seq) 
    -> Option; 
 
/// The password is the right one for the stored hash, by bcrypt's verdict. 
pub open spec fn password_matches(password: Seq, hash: Seq) -> bool { 
    bcrypt_verdict(password, hash) == Some(true) 
} 

On top of those, named_account(email, username) says which account a login names: the customers row for the email when one is sent, otherwise the admins row for the username, otherwise none. It’s written like Rust, but it’s a mathematical definition that never runs and only appears in contracts. Code like this is called ghost code, since the verifier checks it but the compiler erases it from the program. With it, the developer’s two-sentence request ends up as eight ensures clauses on login_flow (Figure 12). 

/// The account a login names: the customers row for 
/// the email when one is sent (role "customer"), 
/// otherwise the admins row for the username (role "admin"), otherwise none. 
pub open spec fn named_account(email: Option, username: Option) 
    -> Option { 
    match email { 
        Some(e) => match customer_on_file(e@) { 
            Some(c) => Some(NamedAccount { 
                id: c.id@, password_hash: c.password_hash@, role: customer_role() }), 
            None => None, 
        }, 
        None => match username { 
            Some(u) => match admin_on_file(u@) { 
                Some(a) => Some(NamedAccount { 
                    id: a.id@, password_hash: a.password_hash@, role: admin_role() }), 
                None => None, 
            }, 
            None => None, 
        }, 
    } 
} 

Figure 12. The two-sentence request and the Both ways decision ended up as eight ensures clauses on login_flow. Four of them keep today’s refusals, so the storefront and the existing API tests keep working. 

Here’s the whole contract, with its doc comment trimmed. Each clause has the plain-English comment above it that the intent artifact shows the team: 

/// The whole login, awaited end to end: from the 
/// request's fields to the token or the HTTP error. 
/// ... 
pub async fn login_flow(pool: &sqlx::SqlitePool, config: &Config, 
    email: Option, username: Option, password: &str) 
    -> (r: Result) 
    ensures 
        // Neither an email nor a username: 400 with today's message. 
        email is None && username is None 
            ==> (r matches Err(AppError::BadRequest(m)) 
                && m@ == missing_identity_text()), 
        // A token only for the account the login names, with its right 
        // password; it carries that account's id and its table's role. 
        r matches Ok(t) ==> (named_account(email, username) matches Some(a) 
            && password_matches(password@, a.password_hash) 
            && token_claims(t@, config.jwt_secret@) matches Some(c) 
            && c.sub@ == a.id && c.role@ == a.role), 
        // The right password for the named account always gets a 
        // token, unless a lookup or signing failure gives 500. 
        (named_account(email, username) matches Some(a) 
            && password_matches(password@, a.password_hash)) 
            ==> (r is Ok || r matches Err(AppError::Internal(_))), 
        // A login naming an account nobody holds gets 
        // 401, unless the lookup fails with 500. 
        ((email is Some || username is Some) && named_account(email, username) is None) 
            ==> (r matches Err(AppError::Unauthorized) 
                || r matches Err(AppError::Internal(_))), 
        // A wrong password for an account whose hash bcrypt 
        // can read gets 401, unless the lookup fails with 500. 
        (named_account(email, username) matches Some(a) 
            && bcrypt_verdict(password@, a.password_hash) == Some(false)) 
            ==> (r matches Err(AppError::Unauthorized) 
                || r matches Err(AppError::Internal(_))), 
        // An account whose stored hash bcrypt cannot read gets 500 and no token. 
        (named_account(email, username) matches Some(a) 
            && bcrypt_verdict(password@, a.password_hash) is None) 
            ==> r matches Err(AppError::Internal(_)), 
        // The admin role only for an admins row 
        // found by username, with no email sent. 
        (r matches Ok(t) && token_claims(t@, config.jwt_secret@) matches Some(c) 
            && c.role@ == admin_role()) 
            ==> (email is None && username matches Some(u) 
                && admin_on_file(u@) is Some), 
        // An email login's token always carries the customer role. 
        (r matches Ok(t) && email is Some) 
            ==> (token_claims(t@, config.jwt_secret@) matches Some(c) 
                && c.role@ == customer_role()), 
{ 
    unimplemented!() 
} 

The trusted boundary shows up in the code too. check_password is one of the functions whose body Verus doesn’t check. Its contract ties it to bcrypt_verdict, an uninterpreted model of bcrypt with no axioms:

/// Asks bcrypt whether `password` matches the stored `hash`. 
/// Trusted, not proved: Verus cannot check bcrypt's hashing, 
/// so this wrapper's contract is assumed. 
/// Every password promise of `login_flow` rests on it. 
#[verifier::external_body] 
pub fn check_password(password: &str, hash: &str) -> (r: Result) 
    ensures 
        // bcrypt answers (Ok) exactly when it can read the stored hash. 
        r is Ok <==> bcrypt_verdict(password@, hash@) is Some, 
        // Its answer is its verdict: true for the 
        // right password, false for any other. 
        r matches Ok(b) ==> bcrypt_verdict(password@, hash@) == Some(b), 
{ 
    bcrypt::verify(password, hash).map_err(|e| e.to_string()) 
} 

The doc comment above it says what rests on it: every password promise of login_flow. Every login ends in one of a handful of places, and only one of them has a token (Figure 13). The proof covers all of them at once. 

Figure 13. Every way a login can end, from the plan. 

login_flow is async: it awaits a database query. Verus can put contracts on async functions, with one rule worth knowing (Figure 14). requires is checked when the call creates the future. ensures describes the value you get when you await it. Nothing promises the future finishes, so a hung query breaks no clause. 

The doc comment on login_flow says so in as many words: 

/// ... No promise the future completes. 
pub async fn login_flow(...) -> (r: Result) 

Figure 14. When a contract is checked, for a sync fn and an async fn. 

login_flow stays short because it’s built from smaller proved pieces. lookup_target picks the table. login_core awaits the lookup and calls decide_login, the password gate. issue_token signs the token, or maps a refusal to today’s HTTP error. Each piece has its own contract, and Verus proves login_flow using only those contracts, without re-reading their bodies. Change the body of decide_login and only decide_login gets proved again. 

Here’s the smallest piece, whole, and the start and end of the password gate: 

pub fn lookup_target(email: Option, username: Option) 
    -> (r: Result) 
    ensures 
        // An email, when sent, wins: customers are searched for exactly that email. 
        email matches Some(e) 
            ==> r == Ok::(LookupTarget::CustomerByEmail(e)), 
        // With no email, a username sends the search 
        // to admins for exactly that username. 
        email is None && username matches Some(u) 
            ==> r == Ok::(LookupTarget::AdminByUsername(u)), 
        // With neither, the login is refused for missing an identity. 
        email is None && username is None 
            ==> r == Err::(LoginError::MissingIdentity), 

pub fn decide_login(target: &LookupTarget, found: Option, password: &str) 
    -> (r: Result) 
    ensures 
        // No row found: refused as Unauthorized, 
        // the same answer as a wrong password. 
        found is None 
            ==> r == Err::(LoginError::Unauthorized), 
        // Claims come back only for a found row 
        // whose stored hash matches the password. 
        r is Ok ==> found is Some 
            && password_matches(password@, found->Some_0.password_hash@), 
        // The right password for a found row always gets claims. 
        found matches Some(a) && password_matches(password@, a.password_hash@) 
            ==> r is Ok, 
        ... 
        // An admins-table search gives the role text "admin". 
        r matches Ok(c) && target is AdminByUsername ==> c.role@ == admin_role(), 
        // A customers-table search gives the role text "customer". 
        r matches Ok(c) && target is CustomerByEmail ==> c.role@ == customer_role(), 

An overview of login.rs 

Figure 15 maps the whole spec file, verified/src/login.rs. It reads top to bottom in four layers: headers, imports and types Verus needs to know about, an abstract view of the outside world, the trusted contracts that connect that view to real code, and the five contracts the proof has to meet.  

Figure 15. The parts of login.rs, in file order. Gray is header and types, purple is math that only appears in contracts, amber is trusted, and green is proven.

Here are two of the less obvious parts, abridged. external_type_specification introduces a type Verus didn’t define. The pool stays opaque, while a customers row keeps its fields visible: 

/// The connection pool, opaque to the proof: only 
/// the lookups' contracts say what it returns. 
#[verifier::external_type_specification] 
#[verifier::external_body] 
#[verifier::reject_recursive_types(DB)] 
pub struct ExPool(sqlx::Pool); 
... 
/// A customers row, with its fields visible to the proof. 
#[verifier::external_type_specification] 
pub struct ExCustomer(Customer); 

And LoginError keeps the decision separate from the HTTP response, which is what lets issue_token pin each refusal to today’s status code: 

/// Why a login gets no token. 
pub enum LoginError { 
    /// Neither an email nor a username was sent: 400 Bad Request. 
    MissingIdentity, 
    /// No such account, or the password does not match: 401 Unauthorized. 
    Unauthorized, 
    /// bcrypt could not read the stored hash, with its message: 500 Internal. 
    UnreadableHash(String), 
    /// The lookup query failed: 500 Internal, with sqlx's message. 
    Database(sqlx::Error), 
} 

Before the plan comes back to you, two reviewer agents poke holes in the derived formal spec from the intent artifact to ensure a high-quality translation, so that the spec matches what you asked for and doesn’t promise more than a proof could show. The spec refinement runs in the background and takes live user feedback, iterating until reviewers agree that the spec is sound. 

Step 6: Prove, check, close the gaps 

Signing off on the spec is where the developer’s review ends. Everything after it, the implementation and the proof, is checked by machines, which is why this post spends its time on the spec and not the proof. Once the developer signs off, a Build plan stage (Figure 16) hands the approved plan to pdd-prove, which turns it into a small task graph (Figure 16). For login, that’s seven tasks: get login.rs building under Verus inside the backend crate, prove the decision, the token and the whole flow, then write the tests for the trusted wrappers and the end-to-end login. 

Figure 16. Build plan turns the approved spec into seven tasks on a development machine. The first gets login.rs building under Verus without changing what any contract promises, and stops to ask rather than weaken a contract. 

Each task runs the same loop: 

• A coding agent writes the implementation and the proof, and Verus checks them against the derived formal spec. 
• Anything in the trusted boundary gets the tests the plan called for. 
• An LLM verifier reads the plan, the specification and the results side by side, and looks for gaps: requirements with no proof and no passing check. Gaps go back to the coding agent until none remain. If the specification itself has a gap, such as two requirements that contradict each other, it comes back to the developer as a decision. 

A proof is only as good as its spec, so pdd-prove checks the spec too. When a model writes its own spec, or is tuned to produce proofs, it tends to land on weak invariants: clauses that verify but rule out almost nothing. They prove something, just rarely the thing you care about. We call that “vibe verification.” That’s why it’s so important to make sure your intent is aligned with the agent and what PDD Kit is great for. 

The loop is strict about not moving the goalposts. If an async construct can’t be expressed in the pinned Verus, the task stops and asks the team instead of switching to a non-async helper or weakening a contract. 

How does PDD Kit remove classes of bugs? The mutation check is how PDD Kit guards against vibe verification. pdd-prove plants one bug per ensures clause in a scratch copy of the code, like refusing everyone or checking the username before the email, and Verus has to reject each mutant on the clause it targets. A mutant that gets through means that clause constrains nothing, and it comes back as a gap. 

Step 7: Review intent alongside verified code

When the tasks pass, pdd-prove opens pull requests. They add a verified/ crate with login_flow, its pieces, their proofs, and the trusted wrappers with their tests, and route the real login handler through login_flow, keeping the existing HTTP status codes. Your verified logic integrates with and hardens your production login path, not a copy of it. 

The developer was able to merge without relying on exhaustive line-by-line review of the generated code. The review had already happened on the intent artifact this whole time, where the team has the final say. We shifted more of the review focus from code review to intent review. The pull request works as a receipt, and its description marks every login requirement as either formally verified or empirically checked. 

Merging is where the proof joins the team’s normal workflow. PDD Kit’s pdd-ship workflow adds the Verus check to CI next to the empirical tests, so every later change to login, by a person or an agent, has to keep proving against the same spec, and a broken proof fails the build like a failing test. And because a proof covers every input, PDD Kit prunes tests that only re-check what’s already proved, such as example-based tests of the password gate, and keeps the ones that guard the trusted boundary, so CI gets stronger and leaner at the same time. 

What the proof does and doesn’t say 

“Fully verified” is easy to oversell, so here’s exactly what we’re claiming.

• Proved. The bodies of login_flow, login_core, lookup_target, decide_login and issue_token meet their contracts for every input. Login picks the right table, compares the request’s password against the stored hash of the account it names, issues a token with that account’s id and the role its table gives, and refuses everything else with today’s 400, 401 or 500 and no token. 
• Trusted and tested. The two database lookups, check_password over bcrypt, the clock, token signing, the database error message and the handler’s request unpacking sit outside the proof, each behind an assumed contract the developer accepted. Tests against the real bcrypt, the real SQLite schema and the real router cover them. 
• Assumed. The Verus, Rust compiler and Z3 (opens in new tab) toolchain, and Verus’s standard library vstd (opens in new tab). 

Why Rust 

PDD Kit only verifies Rust today, since that’s the language Verus works on. If your codebase is already Rust, there’s nothing to migrate. Code in other languages can be ported to Rust and checked against the same spec, and non-Rust projects can call verified Rust through bindings. 

There’s also a less obvious upside. Once reliance on exhaustive line-by-line review has been reduced, readability stops being the main reason to pick a language. You can pick one for speed and safety, and optimize as hard as you want, because any change that breaks the spec fails the proof. 

What to Expect from PDD Kit

PDD Kit is a research prototype, and it only verifies Rust today since that’s the language Verus works on. Code in other languages can be ported to Rust and checked against the same spec, and non-Rust projects can call verified Rust through bindings. Proofs still take real effort, mostly in producing the proof itself, and a clear spec is what keeps that effort down, which is why so much of PDD Kit is about getting intent right first. We’d start where a bug costs the most, such as login, payments, or permissions, and verify the rest of a codebase one piece at a time.

Pet Store’s login is one piece of one app: a spec anyone can read, a Verus proof that the code matches it, and tests for everything the proof takes on trust. We want to be upfront about the weakest links. The guarantees are only as strong as the six trusted pieces, and two carry most of the weight: check_password for every password promise, and the two lookups for every promise about which account a token names. Tests support them, but nothing proves them. We expect that trusted boundary to shrink significantly over time, so a growing share of the code can be formally verified, and we want to find out how far this scales.

What we’re really changing is what people review. Instead of relying mainly on line-by-line review of agent-generated code, a team reviews what it meant, in plain language, and a proof holds the code to it. The plan was always supposed to be the contract, and now the agent actually has to keep it.

Acknowledgments

This work is a collaboration between the Microsoft Research Catalyst Lab, GitHub Next, and the Research in Software Engineering (RiSE) group. We would like to thank Maggie Appleton and Krzysztof Cieślak of GitHub Next for their collaboration on Chopin, and Nikhil Swamy, Lef Ioannidis, Janardhan Kulkarni, and Shuvendu Lahiri for their feedback and discussions on formal verification and intent formalization. We also thank the F*/Pulse and Verus teams for their support. Finally, we thank Idan Gazit of GitHub Next for supporting this collaboration.

FAQ

• If AI writes the spec, who makes sure the spec is right, and doesn't a wrong spec just give me the wrong verified code?

  You do, and yes, it would. A proof shows the code meets the spec, not that the spec is what you meant. That’s why PDD Kit is built around existing research in intent formalization. The pdd-plan workflow reads your code, asks questions before writing anything, and turns your answers into a Verus spec plus a plain-language plan you approve, flagging ambiguity instead of guessing. Two reviewer agents check the spec, and the pdd-prove workflow plants one bug per clause to catch clauses that verify but rule out nothing. A wrong spec is still possible, which is why PDD Kit emphasizes making requirements explicit, identifying ambiguities, and keeping developers involved in reviewing and approving the spec before verification begins. 

• How is this different from Spec-Driven Development (SDD), Test-Driven Development (TDD), or just telling the agent to check its own work?

  The difference is what holds the code to the plan.

  ApproachWhat checks the codeSpec-Driven DevelopmentNothing enforces the specTest-Driven DevelopmentTests on a sample of inputs, often written to match what was built Agent checks its own workThe same model that wrote the codeProof-Driven DevelopmentVerus automatically verifies the proof that your code satisfies the spec your approved

  PDD keeps the planning loop from SDD and still uses tests where a proof can’t reach. A test checks some inputs, while a proof establishes that the code satisfies specified properties for all inputs covered by the formal model, under its stated assumptions. 

• What exactly is the proof? Where does it run? Is it deterministic or another language model (LM)? And how long does it take? 

  The proof is Rust code annotated with Verus constructs, checked mechanically by Verus using the Z3 solver. It runs wherever your Rust builds: the pdd-prove workflow runs it while proving, and the pdd-ship workflow adds it to your build and CI so a broken proof fails the build. The check is deterministic, with no model involved. Models write the spec, code, and proof, but only a deterministic Verus run decides whether it passed. How long the check takes varies with the size of the code and how hard the proofs are: usually seconds for a small module, up to minutes for a larger codebase.

• If verification replaces line-by-line code review, what do I actually review?

  PDD Kit shifts more of the review process toward validating what the code should do, while using formal verification to provide additional assurance that the implementation meets those requirements. Developers review the natural-language plan, the formal spec, and the trusted components that fall outside the scope of the proof. The resulting pull request documents what was formally verified, what was tested, and where additional review may be needed. On the Pet Store full stack web app, this approach reduced reliance on exhaustive line-by-line review of the generated code.

• Is it Rust only? And why Verus instead of other verification tools or formal languages?

  We chose Verus because it allows us to verify Rust code directly, aligning with PDD Kit’s focus on integrating formal verification into existing Rust development workflows. Other proof languages (e.g., Lean, F*, Rocq) take different approaches to formal verification, each with its own tradeoffs. The techniques behind PDD Kit could help put them to work as well.

Opens in a new tab

The post Formally verifying agent-written full-stack web apps with PDD Kit appeared first on Microsoft Research.

There's an old saying that “software is eating the world,” but these days, it feels more like artificial intelligence is eating software. AI is definitely having a moment, and I'm not talking about generating images, writing emails, or building your website. Just last week, I wrote about how AI and the small team behind ArtCraft were building free, open-source alternatives to expensive software, including Adobe Creative Cloud and Microsoft Office. That's giving the traditional software-as-a-service business model a lot to think about. What’s interesting to me is how quickly AI is helping these small teams and individual developers accomplish things that in the past would have required a lot more time, expertise, and resources.

TL;DR: Starbucks just dropped its 2026 holiday cups and a holiday pup cup. The collection lands in U.S. stores nationwide on Nov. 5.

Starbucks has revealed its official 2026 holiday cup lineup, landing in U.S. stores nationwide on Nov. 5.

The 2026 aesthetic pivots hard into retro nostalgia: layered ribbons, vintage gift bows, holiday tree silhouettes, and a festive palette pairing Starbucks green and red with mint, antique gold, and creamy eggshell white. We're fans.

Credit: Starbucks

Starbucks has also made a savvy viral play by creating a dedicated limited-edition holiday Pup Cup.

Available at participating U.S. stores while supplies last, the pint-sized paper cup features miniature evergreen boughs and tiny red bow detailing and is filled with the traditional complimentary dollop of whipped cream. It is a calculated social media play aimed straight at TikTok and Instagram Reels feeds — expect local drive-thru lanes to be completely backed up this weekend with pet owners. I'm tempted to bring my cats.

Credit: Starbucks

The cup drop accompanies the official launch of Starbucks' winter menu, headlined by an all-new Tiramisu Velvet beverage platform and a Braised Short Rib Grilled Cheese.

It's important to note that this launch is different from the Red Cup Day giveaway taking place on Nov. 17. These holiday cups are made from single-use paper, unlike the free reusable cups set to launch at participating stores while supplies last.

AI agents aren't allowed on Tinder and Hinge, the CEO of their parent company, Match Group, Spencer Rascoff, wrote in a New York Times op-ed yesterday.

Rascoff argues that the initial purpose of dating apps was to remove friction, which is also the goal of AI agents, but that in some cases friction is necessary for a more meaningful experience.

SEE ALSO: Hinge testing new feature and lower-priced subscription tier

"We want to ensure humans are reviewing other humans' dating profiles and sending messages to other users on our apps. That's why we have put in place guardrails meant to prevent the use of AI agents on our platforms, like Tinder and Hinge," Rascoff wrote.

Match Group figured that if users let AI agents message potential dates, there's a pretty low chance they'll connect authentically, Rascoff continued.

Daters themselves seem split on using AI when trying to find a partner. In Match's own Singles in America survey this year, half of singles said they wouldn't use AI for dating in the future. While 37 percent said AI wouldn't be helpful in early dating at all, the same number of participants wouldn't consider AI use in dating a dealbreaker.

While Match Group has banned AI agents among users, its apps use AI in features and feature creation. Tinder launched its AI matchmaker, Chemistry, earlier this year, and Hinge added AI-powered Convo Starters last Dec. And in Match Group's 2026 Q3 earnings call, the company stated that Tinder's upcoming Missed Connections feature is "a clear example of how we're using AI to accelerate the pace of product innovation."

The term “Japandi” is a portmanteau of “Japan” and “Scandi,” and models bearing this label are very well represented in 3D printing model repositories. But this popularity goes beyond aesthetics, since these models are particularly well-suited to this method of manufacturing. Here’s why.

I use all sorts of software when I travel: a VPN, streaming music apps, cloud storage, and more. I turned my Raspberry Pi into a one-stop-shop travel router that combines all of those uses into one device, so I don't have to worry about them individually on my phone, laptop, or console.

TL;DR: Starbucks Red Cup Day 2026 takes place on Nov. 17. To get your free cup, buy any handcrafted holiday or seasonal beverage (hot, iced, or blended) in any size.

If your morning routine revolves around seasonal espresso shots and viral coffee tumblers, mark your calendar: Starbucks’ 2026 holiday menu officially launches on Nov. 5, bringing back fan favorites and fresh treats.

That's exciting news, but it's not the main draw for seasoned coffee lovers and cup collectors. The Peppermint Mocha is great and all, but it's not Red Cup Day. This is arguably the biggest day on the coffee lovers' calendar. Starbucks hands out a free, limited-edition red reusable cup with every qualifying handcrafted holiday beverage order on this special day. And you guessed it: fans and collectors go wild.

Starbucks has officially confirmed the date for Red Cup Day 2026: You can score a free reusable holiday cup on Nov. 17.

Credit: Starbucks How to score a free reusable cup

Getting your hands on the free collectible cup is pretty straightforward, but we should note that supplies run out notoriously fast.

To get your free cup, buy any handcrafted holiday or seasonal beverage (hot, iced, or blended) in any size. The promo applies across in-cafe purchases, drive-thru orders, mobile orders on the Starbucks app, and delivery via Uber Eats, DoorDash, or Grubhub. Once you have your reusable red cup, bringing it back on future visits saves you $0.10 per drink.

Just be prepared for heavy app delays and long drive-thru lines on launch morning — mobile ordering at least 20 minutes ahead is non-negotiable if you want to dodge the rush.

The minimalism of Pixel software is great — until you want to change how something works. That's why I've always loved "Good Lock" on Samsung phones. It's an optional suite of tools specifically for power users. That's what the "Essentials" app is trying to do for Pixel phones, and I finally get the hype.

Reviewing the new M6 MacBook Pro gave me a powerful feeling of déjà vu. It even uses the same artwork as the M5 MacBook Pro that came out last year. This laptop was also completely upstaged by the new MacBook Pro OLED announced at Apple's recent "Pro and Tell" event.

Apple has released another iterative update, equipping the 2026 MacBook Pro with the latest Apple silicon. And if you have a much older MacBook, the new model also runs macOS 27 Golden Gate and Siri AI, the latter of which is still a work in progress.

Last year, in my M5 MacBook Pro review, I wrote that "Apple is just showing off," and the new model offers even better performance, while keeping everything you already love about the MacBook Pro.

Want more tech and digital culture news delivered to your inbox daily or sent straight to your device? Sign up for Mashable's Top Stories newsletter or get Mashable push alerts today.

MacBook Pro (M6) review: I've grown weary of iterative upgrades Credit: Timothy Werth / Mashable

I'm not the first tech reviewer to complain about iterative updates. In recent years, many tech brands have been releasing new models on an annual release cycle. That means customers don't have to wait as long for new upgrades to come to market, but there are downsides, too.

In a world of iterative updates, your shiny new laptop or phone gets out of date much more quickly. I wish tech companies would focus more on making future-proofed models that stand the test of time. We already live in a world of overconsumption and high prices, and every annual release is another opportunity for trillion-dollar tech companies to increase prices even more.

The new $1,999 MacBook Pro is $300 more expensive than the 2025 version with M5 silicon. To be fair, Apple increased prices across the board in June due to the memory shortage, and this release doesn't include an additional price bump.

As I said in my latest MacBook Air review, I wish Apple had waited to release a new MacBook Air and stuck with the older, less expensive version a little longer, but that may not have been possible thanks to RAMageddon.

The M6 MacBook Pro is a highly capable laptop for the pros (obviously) Credit: Timothy Werth / Mashable

Testing the new M6 is a bit tedious. I have already thoroughly stress-tested the M5 Pro, and the M6 will inevitably deliver the same results with some improvements. And that's exactly what I found.

Apple promises the new "12-core GPU delivers up to 30 percent faster graphics and up to 25 percent faster AI workloads when compared to M5." Unsurprisingly, that matches up with my results.

Because of a shipping delay, I'm still performing some of our standard benchmarks on the new MacBook Pro, and I'll update this review after spending more time testing the M6 chip and battery. I

M6 MacBook Pro: What about gaming? If you loved 'Backrooms,' then try 'Pools' for some spooky fun. Credit: Timothy Werth / Mashable

Like the M5, the M6 MacBook Pro passes the Cyberpunk: 2077 test, with some compromises. I didn't notice significant improvement in performance this time around. I originally tried loading the game with a 60-frame-per-second target refresh rate and MetalFX and ray tracing turned up to the max. I had just enough time to wipe out a gang of Tiger Claws before the game crashed.

At 30 frames per second and with some graphic settings tuned down, I was able to play the game without problems, and Night City still looks gorgeous. However, I had more fun playing the backrooms-inspired game Pools, recently adapted from its original virtual reality format. The spooky, atmospheric visuals looked great on the Pro.

Siri AI is still a work in progress Left: Siri AI tries, and fails, to answer a simple query. Credit: Timothy Werth / Mashable Right: Notice anything wrong with this picture? Credit: Timothy Werth / Mashable

Siri AI isn't unique to macOS 27 Golden Gate, and if you have a compatible Apple device, it's been available for a few months. I tried to use Siri AI on this new laptop, with mixed results. While Siri AI was able to answer many of my queries and draw on my personal data, it also struggled in disappointing ways.

At one point, I asked it to pull up photos from my time visiting Charleston, SC, a city I visit frequently. Siri told me it couldn't find any photos from Charleston. But look at the picture of this moment, and you'll notice the on-screen Photos widget is literally showing an album of photos from Charleston at the exact same time. Siri AI also struggled to find texts and emails from a contact with an oddly spelled name.

These are the kinds of frustrating and basic mistakes that make it hard to fully trust or recommend Siri AI yet.

MacBook Pro with M6: Design and build quality Credit: Timothy Werth / Mashable

The latest MacBook Pro retains the high-end build and classic Apple design of recent MacBooks, but it only suffers in comparison to the just-released MacBook Pro OLED laptop, which has an OLED display and upgraded speaker system.

If you have an older MacBook, I think you'll be very impressed with the speakers on this model. While they're the same as last year's model, they still sound fantastic. Radiohead's "Everything in its Right Place" and Florence and the Machine's "Lungs" sound rich and well-balanced, though you can also plug in your favorite headphones in the 3.5mm headphone jack for true high-fidelity audio via Apple Music.

So far, I haven't had any overheating issues or any problems at all from a design standpoint. The keyboard, trackpad, webcam, and Liquid Retina display are still rock solid.

Credit: Timothy Werth / Mashable MacBook Pro with M5: The verdict

While the latest MacBook Pro doesn't rate very highly on the "Wow factor," it's still a powerful laptop that can support professional workloads. I suspect some professionals will want to hold out for the inevitable 16-inch model, or splurge on the reference-monitor-quality display on the new OLED model.

Hopefully, the PROLED XDR Display becomes available with the regular MacBook Pro in the near-ish future, and I think it eventually will. That would be a non-iterative upgrade and a welcome one for many techies.

You can buy the new MacBook Pro for $1,999 at Apple, Amazon, and wherever Apple laptops are sold; it will be released on Nov. 6 alongside the new touch MacBook Pro OLED.

Apple MacBook Pro, 14 inches (M6, 16GB RAM, 1TB SSD) $1,999 at Amazon
  Shop Now at Amazon Shop Now at B&H Photo Video

Want to learn more about getting the best out of your tech? Sign up for Mashable's Top Stories and Deals newsletters or get Mashable push alerts today. 

MacBook Pro M5: Specifications

• Processor: Apple M6 chip with a 12-core CPU (2 super cores, 4 performance cores, 6 efficiency cores); 12-core GPU with Neural Accelerators

• Memory: 16GB, 24GB, 32GB

• Storage: 1TB, 2TB, 4TB

• Colors: Space Black, Silver

• Dimensions: 0.61 inches × 12.31 inches × 8.71 inches;

• Weight: 3.4 pounds

• Ports: Three Thunderbolt 4 (USB-C) ports with support for two external monitors; SDXC card slot; HDMI port; 3.5 mm headphone jack, MagSafe 3 charging port

• Wireless Connectivity: Apple N1 chip supporting Wi-Fi 7, Bluetooth 6.0

• Display: 14.2-inch Liquid Retina XDR display

• Resolution: 3,024 x 1,964 resolution

• Brightness: Up to 1,000 nits sustained brightness; up to 1,600 nits peak brightness for HDR content

• Cameras: 12MP Center Stage camera with Desk View support

• Audio: Six-speakers with support for spatial audio; three-mic array

• Battery: Up to 24 hours of video streaming

MacBook users have been waiting a long time for this one: After many years, Apple has finally relented and released a touchscreen laptop. But what's really exciting about this new Apple machine is the incredible tandem OLED display, which Apple has dubbed the PROLED XDR Display. The internet is split on whether "PROLED" is cheesy or not, but what isn't the internet split about?

I'm still in the process of testing the new MacBook Pro, but I can tell you this: Apple has made an incredible laptop, and the company wasn't exaggerating when it promised a "groundbreaking" and "industry-leading" display.

Now, if you're a laptop nerd, you might be rolling your eyes. Touchscreen laptops have been around for ages, and virtually all of Apple's competitors have long offered a high-end OLED display. Well, it shouldn't surprise you that Apple's version of an OLED laptop goes hard in every possible way.

View this post on Instagram

I'm loving this laptop so far, and I think it's the first true slam-dunk of the John Ternus era.

MacBook Pro OLED review: Let's talk about the display Credit: Timothy Werth / Mashable

Apple hasn't just made an OLED laptop; it's made a genuine reference-quality display, designed to meet industry standards for video editors, photographers, animators, 3D artists, and color graders. The PROLED XDR display is also the brightest laptop display ever made, with 2,000 nits of peak brightness for HDR content, racing past the MacBook Pro's Liquid Retina XDR display, which tops out at 1,600 nits. The top Windows competition maxes out at 1,300 nits. For non-HDR content, the PROLED offers up to 1,000 nits of sustained brightness.

After spending just 72 hours with the PROLED, my eyes are hurting, and I'm genuinely worried the screen is too bright for my own good.

I'm not going to waste time explaining exactly how tandem OLED technology works; instead, you'll have to trust me that it means a brighter display that lasts longer. The blacks on the display are deep, the colors pop, and the shadows and highlights provide incredibly detailed contrast.

Photo on display by Paul Reiffer Credit: Timothy Werth / Mashable

Previously, Apple reserved tandem OLED for the iPad Pro, and the M4 and M5 iPad Pros are famous for reference-quality displays. The iPad Pros also introduced Apple's ProMotion technology, powering an adaptive refresh rate up to 120 Hz. Tandem OLED combined with ProMotion is unmatched, and you don't really know what you're missing until you try it.

Now, ProMotion and tandem OLED finally, finally, come to the MacBook Pro.

This laptop absolutely slaps, and the incredible PROLED XDR display is the headline. It's stunning.

Photo on display by Paul Reiffer Credit: Timothy Werth / Mashable

The bad news? I do recommend paying $500 more for the 16-inch model. You'll want the extra screen space. This is a maximalist laptop, and I think size matters here.

MacBook Pro OLED: What about the touchscreen?

To be honest, I don't care about touchscreen. I think there's limited utility if your touchscreen laptop isn't a convertible that flips all the way around into tablet mode. The PROLED also lacks support for Apple Pencil and third-party styluses. So, after so many years talking smack about touchscreens, why has Apple given in?

Maybe it's because kids born today expect everything to be a touchscreen. There are also 3D artists and animators working in Blender who will be happy to pinch and zoom to their heart's content.

Pinch to zoom right on your MacBook's screen. Credit: Timothy Werth / Mashable Expect more developers to make use of Apple's new Gesture API in the months ahead. Credit: Timothy Werth / Mashable

I tried out the touchscreen using software like Blender and Final Cut Pro. Some apps will have custom touchscreen interfaces and functionality, but it will take time for macOS developers to adapt to a touchscreen world. For now, anything you can do on the trackpad, you can do on the display. The touchscreen is responsive, and mostly works as you expect. I just don't really need or care about it.

If I were a betting man, I would wager that the touchscreen won't stick around forever. However, the OLED ProMotion display is going to make a lot of Mac users jealous. I wouldn't be surprised if it becomes available as an option, like the Nano Texture finish is with certain Apple products.

MacBook Pro with PROLED XDR Display: Performance On-device AI generated perfectly accurate subtitles for my video files. Credit: Timothy Werth / Mashable

I did my best to stress-test this laptop, which runs macOS 27 Golden Gate, with the limited time I've had with it. Due to a shipping delay, I've only had three days with this laptop, so I haven't been able to conduct battery rundown tests or some of our other standard benchmarks.

But when you have to condense a week's worth of testing into three days, you really appreciate just how much modern laptops have to do. I've been busy testing local AI performance, speakers, cameras, multitasking, file transfers, video and photo editing, Siri AI, the new touchscreen display, and the new OLED panel. So far, I'm impressed across the board.

Apple made stress-testing this machine difficult. My 16-inch review unit has 48GB of RAM and the M5 Pro chip, and it wasn't easy to slow it down. The high-powered M5 chips feature an 18-core CPU architecture, including six "super cores."

For my stress test, I opened complex Blender files. I made Final Cut Pro export large 4K video files while simultaneously applying local AI effects such as stabilization, color adjustment, and generating subtitles to an entire project. I watched 4K HDR YouTube videos, used Siri AI, opened a massive 15.5MB Excel spreadsheet (with 16,000 rows in some tabs), and asked Gemma 4 to compose a sonnet in iambic pentameter about the majestic manatee.* With my 48GB of RAM and the M5 Pro chip, I was able to run a large local AI model, Gemma 4 26B-A4B, and set it to coding applications and composing my sonnet.

Weirdly, the only task that really brought up the spinning wheel of death? That damn Numbers spreadsheet. Go figure.

I also ran the latest Geekbench 7 benchmark test, and it logged impressive results:

• Single-core: 3,736

• Multi-core: 34,492

Mashable has tested over 90 laptops in the last couple of years, and the PROLED is now the top multi-core scorer in our entire database, handily beating other Macs and Windows laptops with the Qualcomm Snapdragon X2 Elite chipset.

If you're a superuser, you can also upgrade to the M5 Max chip and even more RAM. As we've noted before, a fully specced-out MacBook Pro PROLED will set you back $14,549.

MacBook Pro PROLED: Design and build quality Credit: Timothy Werth / Mashable

As you'd expect from a high-end Apple laptop, the design is both familiar and impeccable. There's a reason the Windows world has been copying the best MacBooks for decades. However, there are some key hardware and software changes on this laptop (it's the first to bring Dynamic Island from iOS to macOS), aside from the display. The laptop is also lighter and thinner than its forebears. The 14-inch version is half a pound lighter, the 16-inch model is 0.7 pounds lighter, and Apple shaved off half a millimeter and a full millimeter, respectively.

Apple has also famously brought back the glowing Apple logo on the top cover, which dims and brightens as you adjust the brightness settings. That glowing apple has been missing since 2015, and it's a nice touch. Otherwise, this laptop feels a lot like other Apple laptops, with a familiar keyboard, trackpad, and Touch ID key.

For super-super users, this laptop has three Thunderbolt 5 ports and supports up to three external displays.

The laptop supports three external displays with three Thunderbolt 5 ports. Credit: Timothy Werth / Mashable The new touchscreen MacBook Pro OLED is thinner and lighter. Credit: Timothy Werth / Mashable Credit: Timothy Werth / Mashable The speakers sound incredible

I'm simultaneously testing the latest MacBook Pro with the M6 chip, and I was in the middle of writing a note about how much I love the speakers when I decided to do a side-by-side test with the MacBook Pro OLED.

Apple enhanced the speaker system to provide deeper bass and better clarity, and you can hear the difference. This MacBook doesn't get quite as loud as I expected, but the sound it produces is incredibly clear and rich (it supports Dolby Atmos and spatial audio, of course ). Compared to the regular MacBook Pro, the audio just has more space to it.

The opening chords of Radiohead's "Everything in its Right Place" have an otherworldly quality, as they should, and bass-heavy tracks like "Billie Jean" really hit you. I also queued up Master and Commander and Masters of the Air on Apple TV, and the combination of the display and audio quality should make other laptops tremble in their aluminum chassis.

The verdict: A laptop worth splurging on The glowing Apple logo is back. Credit: Timothy Werth / Mashable

Unfortunately, I'm not enough of a "Pro" to require a laptop like this, but for creators, professionals, and early adopters who need (or just want) the best possible display in a laptop, I think this MacBook Pro justifies its high cost. I've done a lot of complaining about prices in my tech reviews this year, but I think Apple has put enough into this laptop to make it worth the investment. You can order it at Amazon, Apple, and other retailers.

The Apple touchscreen MacBook Pro with PROLED XDR Display launches on Nov. 6. The 14-inch model starts at $2,899, and the 16-inch model (the one I recommend for most people) starts at $3,399.

One last note: We're still testing this laptop — we haven't finished our standard battery of tests. So, if you want to wait for Black Friday and see if this laptop goes on sale, that's not a bad idea. Unfortunately, there's no guarantee this won't sell out like the iPhone Duo did.

Apple MacBook Pro with PROLED XDR Display, 14.2 inches $2,899 at Amazon
  Shop Now at Amazon Apple MacBook Pro with PROLED XDR Display, 16.3 inches $3,399 at Amazon
  Shop Now at Amazon Shop Now at Best Buy Shop Now at Apple.com The touch MacBook Pro OLED: By the numbers

Just looking for a spec sheet? I've got that, too:

• Processor: Apple M5 Pro (18-core CPU) or Apple M5 Max (18-core CPU; 16-core Neural Engine.

• Memory: 24GB, 48GB, 64GB, 128GB of unified memory.

• Storage: 1TB up to 16TB SSD

• Display Panel: 14.2-inch or 16.3-inch PROLED XDR display with tandem OLED

• Display Brightness: Up to 1,000 nits sustained brightness; up to 2,000 nits peak HDR brightness

• Refresh Rate: ProMotion adaptive refresh rates up to 120Hz

• Color & Contrast: 10,000,000:1 contrast ratio; 1 billion+ colors; native support for P3 wide color and Adobe RGB gamuts

• Display Extras: Anti-reflective coating; optional nano-texture glass available

• Ports: 3 Thunderbolt 5 (USB-C) ports; 1 HDMI port; 1 SDXC card slot; MagSafe 3 charging dock; 3.5mm headphone jack

• Wireless Connectivity: WiFi 7 with N1 wireless chip, Bluetooth 6

• Camera & Audio: 12MP Center Stage camera with Desk View support; six-speaker sound system with Dolby Atmos and Spatial Audio

• Battery: Up to 22 to 24 hours of video streaming

• Weight & Dimensions: 14-inch is 3.0 pounds; 16-inch is 4.0 pounds.

• Colors: Space Black and Silver.

*I shared the manatee sonnet on my X profile.

Want to learn more about getting the best out of your tech? Sign up for Mashable's Top Stories and Deals newsletters or get Mashable push alerts today.